tools.7z
- SHA256 17eec88d46eb3e7d945bed68a18473b8ede13f0dbff9afaaffb749f8d2026321
Static task
static1
1 signatures
General
- Target tools.7z
- Size 14.8MB
- Sample261107-ym7cjs1vfv
- SHA256 17eec88d46eb3e7d945bed68a18473b8ede13f0dbff9afaaffb749f8d2026321
- MD5 7ebfdba9f12ebc97641c8660f25b85a0
- SHA1 24e5d26d1f5adc72ffddad550c14a68a8fe3864b
- SHA512 89719e3d0dfdbc878525425c4d893c972a20bf07df9e8a40edee47905a042a6f410603d1f184bf68bb9b1961d5c0bfec61dd499e92b74c7a7c4102eb1b82fd42
- SSDEEP 196608:zUOIRjI/ui7eXm5vpQvI4gBtp7hEdeZsk045JOJ81J2pahmuaZ+nmP7t4I1a5Mtq:ziK97/Yw4Otkcq81hqZUU7+MJZvsb
- TLSH T139F633260ED8FA32DBCE0D1D769B0E16AB646A4C25FA44044FB33E4C7E8F635E416497
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/Vain Governor UI.exe unpack001/Vain Toolbox.exe unpack001/Vain Tools.exe unpack001/VainShell.dll
File Explorer
-
tools.7z.7z 14.8MB
-
CoreMessagingXP.dll.dll 1018KB
-
MRM.dll.dll 281KB
-
Microsoft.DirectManipulation.dll.dll 642KB
-
Microsoft.InputStateManager.dll.dll 446KB
-
Microsoft.Internal.FrameworkUdk.dll.dll 905KB
-
Microsoft.UI.Composition.OSSupport.dll.dll 66KB
-
Microsoft.UI.Input.dll.dll 1.6MB
-
Microsoft.UI.Windowing.Core.dll.dll 530KB
-
Microsoft.UI.Windowing.dll.dll 538KB
-
Microsoft.UI.Xaml.Controls.dll.dll 6.3MB
-
Microsoft.UI.Xaml.Internal.dll.dll 914KB
-
Microsoft.UI.Xaml.Phone.dll.dll 1.1MB
-
Microsoft.UI.dll.dll 170KB
-
Microsoft.Windows.ApplicationModel.Resources.dll.dll 152KB
-
Microsoft.WindowsAppRuntime.Bootstrap.dll.dll 384KB
-
Microsoft.WindowsAppRuntime.dll.dll 2.4MB
-
Microsoft.ui.xaml.dll.dll 14.4MB
-
Microsoft.ui.xaml.resources.19h1.dll.dll 552KB
-
Microsoft.ui.xaml.resources.common.dll.dll 53KB
-
Vain Governor UI.exe.exe 2.0MB
-
Vain Governor UI.pri1.3MB
-
Vain Toolbox.exe.exe 11.7MB
-
Vain Toolbox.pri1.4MB
-
Vain Tools.exe.exe 516KB
-
VainShell.dll.dll 66KB
-
WinUIEdit.dll.dll 3.3MB
-
dcompi.dll.dll 1.6MB
-
dwmcorei.dll.dll 2.7MB
-
en-us/Microsoft.ui.xaml.dll.mui.dll 25KB
-
marshal.dll.dll 498KB
-
wuceffectsi.dll.dll 478KB
CoreMessagingXP.dll
- IMPHASH 2c1464846f1f8fa606f92f9490aa0720
- SHA256 003e601de5487a359962222df2d855fc7a6c92b7d38e08b7340b3b8bb6f1fac0
- MD5 a99c627b59f83497e6861ab3c8a552e2
- SHA1 d385392751250ab214962ee4a09efaf78232f30e
- SHA512 66a3e374d80aff0a07d772b8d6267250d5ab9f0a1fb9ac50249856795b74b95deb8ba9fa941db8590c7e1770f3e77a02ee9371ff9a63df3bcd39223c039f612b
- SSDEEP 12288:LQedXrqIRe4VM3S24ByTDdT2mHCxkHh5uq7zSx7y+C06NZuaj8OP8fs:f1rxRe4+3DdN2mk2u6zFuaj8g8
- TLSH T118253C6F6FE84496D17AC23E85BB8A8AF2F178531B3147CB0465422D3F27BE45A79310
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ac:2c:fc:9c:5d:c7:94:8e:55:63:c7:f9:d9:bc:3a:ba:34:bc:7e:bf:a6:48:a2:0c:bb:2f:e4:57:c2:f3:0e:bd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 14, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:85:5e:99:ec:0e:59:2f:cd:d7:00:00:00:00:04:85
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:21:33:c0:35:fb:d2:0f:21:a4:00:01:00:00:02:21
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5824
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
CoreMessagingXP.pdb
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
terminate
abort
_errno
_cexit
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_invalid_parameter_noinfo
_crt_atexit
_execute_onexit_table
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
CreateMutexExW
LeaveCriticalSection
OpenSemaphoreW
CreateSemaphoreExW
ReleaseSemaphore
InitializeCriticalSectionEx
WaitForSingleObject
WaitForSingleObjectEx
ReleaseMutex
DeleteCriticalSection
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetLastError
RaiseException
GetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InitializeSListHead
InterlockedFlushSList
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-rtlsupport-l1-1-0
RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry
api-ms-win-core-fibers-l1-1-0
FlsGetValue
FlsFree
FlsSetValue
FlsAlloc
api-ms-win-core-util-l1-1-0
EncodePointer
kernel32
GetHandleInformation
InitOnceExecuteOnce
SetWaitableTimer
CreateWaitableTimerExW
GetThreadPriority
OpenThread
GetTickCount64
LocalFree
Sleep
RaiseFailFastException
DecodePointer
WaitForMultipleObjectsEx
ResetEvent
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
HeapSize
VirtualFree
VirtualAlloc
GetSystemInfo
GetModuleHandleExA
QueryDepthSList
InterlockedPopEntrySList
InitializeSRWLock
SetThreadPriority
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SetEvent
WaitForMultipleObjects
CreateThread
CreateEventW
CallbackMayRunLong
DuplicateHandle
GetCurrentProcess
LoadLibraryW
AcquireSRWLockShared
ReleaseSRWLockShared
OpenProcess
GetCurrentThread
FreeLibrary
RtlCaptureStackBackTrace
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
DisableThreadLibraryCalls
LoadLibraryExW
InitializeCriticalSection
advapi32
EventWriteTransfer
EventUnregister
RegCreateKeyExW
OpenProcessToken
RegSetValueExW
RegQueryValueExW
GetTokenInformation
RevertToSelf
OpenThreadToken
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
EventRegister
shcore
RecordFeatureUsage
SubscribeFeatureStateChangeNotification
UnsubscribeFeatureStateChangeNotification
api-ms-win-crt-heap-l1-1-0
_free_base
_aligned_free
_callnewh
malloc
_aligned_offset_malloc
free
realloc
calloc
_calloc_base
api-ms-win-crt-string-l1-1-0
wmemcpy_s
strcpy_s
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateErrorW
GetRestrictedErrorInfo
SetRestrictedErrorInfo
RoFailFastWithErrorContext
RoOriginateError
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsCreateString
WindowsCreateStringReference
api-ms-win-core-winrt-error-l1-1-1
IsErrorPropagationEnabled
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
ntdll
NtAlpcAcceptConnectPort
NtAlpcCreatePort
RtlInitUnicodeString
NtAlpcDisconnectPort
AlpcInitializeMessageAttribute
NtAlpcQueryInformation
AlpcGetMessageAttribute
NtAlpcSendWaitReceivePort
NtClose
NtAllocateReserveObject
NtAlpcConnectPort
NtSetIoCompletionEx
NtAlpcImpersonateClientOfPort
NtRemoveIoCompletionEx
NtCancelWaitCompletionPacket
NtAssociateWaitCompletionPacket
NtCreateWaitCompletionPacket
NtCreateIoCompletion
RtlDeactivateActivationContextUnsafeFast
RtlActivateActivationContextUnsafeFast
RtlReleaseActivationContext
RtlQueryInformationActiveActivationContext
RtlFreeUnicodeString
NtQuerySystemInformation
api-ms-win-crt-math-l1-1-0
ceilf
api-ms-win-crt-utility-l1-1-0
rand_s
CoreMsgCreateSession
CoreMsgGetExistingSession
CoreUICallComputeMaximumMessageSize
CoreUICallCreateConversationHost
CoreUICallCreateEndpointHost
CoreUICallCreateEndpointHostWithSendPriority
CoreUICallGetAddressOfParameterInBuffer
CoreUICallReceive
CoreUICallSend
CoreUICallSendVaList
CoreUIConfigureTestHost
CoreUIConfigureUserIntegration
CoreUICreateAnonymousStream
CoreUIEnableCrossProcessPrototyping
CoreUIInitializeTestService
CoreUIRouteToTestRegistrar
CoreUIUninitializeTestService
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
MsgBlobCreateShared
MsgBlobCreateStack
MsgBufferShare
MsgRelease
MsgStringCreateShared
MsgStringCreateStack
WinUICreateDispatcherQueueController
WinUIGetDispatcherQueueForCurrentThread
Name
.text
Size
656KB
Virtual Size
655KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
244KB
Virtual Size
241KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
40KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
232B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
40KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=69, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=244, id=1, productName=Unmarked objects,
count=45, id=261, version=33145,
count=12, id=259, version=33145,
count=1, id=256, version=33145,
count=463, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
MRM.dll
- IMPHASH b5e5b2eb8eb707484dc1223ee3d3580b
- SHA256 a02dacc7326aea124add6ccd95f3596a8ae0c3cd2b1ab08266454416a21b92e8
- MD5 12010621bdc171f94eb5fabe400528cc
- SHA1 3cd8c467090b32ea1e192fdfe5fef893d972d448
- SHA512 c142c279de97c367e655b4fbf430eb5122fd632e66af5e883c27243d1513174c0dce56d9350684dc9757fe98e88679b85cd4bbf3aeae0d53e65131fca0ac1171
- SSDEEP 6144:tARQvMQIDFjpcneyLrNHjg4MzU+wA+IRhM:tARSMQIDNqFrN847QDM
- TLSH T1AC545B6A63E81DEAE53AA23CC6D7451AF7B2740123719ACB03A1811E6F5BFE45C3D350
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e6:7f:70:50:fc:81:53:2c:8d:16:42:ed:6d:f1:08:6c:c5:35:05:0f:ab:68:52:8c:90:a9:d8:14:bf:2b:40:bb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 24, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1c:fa:cd:c5:9b:e8:2f:7e:c4:00:00:00:00:02:1c
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6B05-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:11:45:18:39:9b:43:cf:fc:6c:00:01:00:00:02:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
197216
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
MRM.pdb
kernel32
InterlockedFlushSList
ReleaseSemaphore
GetModuleHandleExW
GetModuleFileNameW
SetLastError
K32GetModuleFileNameExW
CompareStringOrdinal
GetEnvironmentVariableW
WaitForSingleObject
GetFileAttributesW
GetCurrentThreadId
ReleaseMutex
HeapFree
FormatMessageW
GetLastError
OutputDebugStringW
FlsSetValue
InitOnceComplete
WaitForSingleObjectEx
CreateSemaphoreExW
CloseHandle
LoadLibraryW
HeapAlloc
FlsGetValue
InitOnceBeginInitialize
GetProcAddress
CreateMutexExW
GetCurrentPackageFullName
FlsAlloc
GetCurrentProcessId
GetProcessHeap
FindStringOrdinal
GetModuleHandleW
FreeLibrary
RaiseException
WideCharToMultiByte
DebugBreak
IsDebuggerPresent
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
MultiByteToWideChar
GetThreadPreferredUILanguages
OpenSemaphoreW
GetSystemWindowsDirectoryW
ReadFile
GetFileSizeEx
CreateFileW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
GetDriveTypeW
LoadLibraryExW
GetFinalPathNameByHandleW
GetFileAttributesExW
RtlPcToFileHeader
InitializeCriticalSectionEx
GetModuleFileNameA
RtlUnwindEx
RtlLookupFunctionEntry
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
CreateEventW
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
EncodePointer
FlsFree
ole32
CoTaskMemFree
CoTaskMemAlloc
advapi32
EventWriteTransfer
EventRegister
EventUnregister
EventSetInformation
RegGetValueW
api-ms-win-core-path-l1-1-0
PathCchRemoveFileSpec
PathCchRenameExtension
PathCchCombineEx
user32
LoadStringA
api-ms-win-crt-private-l1-1-0
_o___std_exception_copy
_o___std_exception_destroy
_o___stdio_common_vswprintf
_o__callnewh
_o__calloc_base
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__free_base
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wtoi
_o_abort
_o_free
_o_isalpha
_o_iswalnum
_o_iswdigit
_o_iswspace
_o_malloc
_o_qsort_s
_o_terminate
_o_towlower
_o_towupper
_o_wcsncpy_s
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
MrmAllocateBuffer
MrmCreateResourceContext
MrmCreateResourceManager
MrmDestroyResourceContext
MrmDestroyResourceManager
MrmFreeQualifierNamesOrValues
MrmFreeResource
MrmGetAllQualifierNames
MrmGetChildResourceMap
MrmGetFilePathFromName
MrmGetQualifier
MrmGetResourceCount
MrmLoadEmbeddedResource
MrmLoadEmbeddedResourceFromResourceUri
MrmLoadStringOrEmbeddedFromResourceUri
MrmLoadStringOrEmbeddedResource
MrmLoadStringOrEmbeddedResourceByIndex
MrmLoadStringOrEmbeddedResourceByIndexWithQualifierValues
MrmLoadStringOrEmbeddedResourceWithQualifierValues
MrmLoadStringResource
MrmLoadStringResourceFromResourceUri
MrmSetQualifier
Name
.text
Size
215KB
Virtual Size
214KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=260, version=35724,
count=9, id=259, version=35724,
count=36, id=261, version=35724,
count=1, id=253, version=35724,
count=1156, id=1, productName=Unmarked objects,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=40, id=265, version=35724,
count=1, id=256, version=35724,
count=1, id=255, version=35724,
count=1, id=151,
count=1, id=258, version=35724,
Microsoft.DirectManipulation.dll
- IMPHASH 8555ecc89e15b49cc9587893036527f1
- SHA256 71deb30f484fb455200c241330788f79a53094e2c8d140dba2c73990897ffbe6
- MD5 f33a94404d2fc72aef2d3c0ca7cf9021
- SHA1 a3a137f64f6e153b9643fe5264eb50741390eaa5
- SHA512 3d2ba8de12362b4332763342fd22407342765ca67122d2a88b98f35e928dbb3308908a2a242a1b0f2147fe4527c4f75ba65a5d100860862832bb14136d9f7389
- SSDEEP 12288:BLBY+vBO90m2YbRMYOKAroVn56Ml4UEOK7xV8YDRgC3lQcLw:jvBO90m28F64n56Ml4UEBxVT3lQg
- TLSH T1F9E48C2E5BE440E1D276917C92678A1AFAB174111B2596CB03A1813C5F3BFE09F7EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ee:a8:60:5d:18:bf:cb:3d:9e:05:ec:38:e7:69:18:1e:2e:4c:ad:39:e1:eb:25:d0:6e:c0:8f:67:6e:7a:30:ce
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 14, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:84:98:e2:12:e0:78:a3:31:5d:00:00:00:00:04:84
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:14:8d:cd:23:44:ee:06:df:72:00:01:00:00:02:14
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
6064
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Microsoft.DirectManipulation.pdb
api-ms-win-crt-runtime-l1-1-0
abort
_invalid_parameter_noinfo
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
terminate
_initterm_e
_initterm
_get_errno
_set_errno
_errno
_invalid_parameter_noinfo_noreturn
_invoke_watson
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
SetEvent
ReleaseMutex
ReleaseSRWLockShared
OpenSemaphoreW
CreateMutexExW
CreateEventW
ReleaseSemaphore
AcquireSRWLockExclusive
WaitForMultipleObjectsEx
EnterCriticalSection
CreateSemaphoreExW
OpenEventW
AcquireSRWLockShared
WaitForSingleObjectEx
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionEx
InitializeCriticalSection
ReleaseSRWLockExclusive
api-ms-win-core-heap-l1-1-0
HeapFree
HeapCreate
HeapAlloc
HeapReAlloc
HeapDestroy
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
RaiseException
GetLastError
SetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
ResumeThread
TlsSetValue
TlsFree
TlsAlloc
TlsGetValue
CreateThread
SetThreadPriority
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount64
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedFlushSList
api-ms-win-core-rtlsupport-l1-1-0
RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry
api-ms-win-core-fibers-l1-1-0
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-crt-heap-l1-1-0
_free_base
malloc
_calloc_base
free
api-ms-win-crt-string-l1-1-0
strcpy_s
api-ms-win-crt-filesystem-l1-1-0
_wsplitpath_s
api-ms-win-crt-math-l1-1-0
sqrtf
sqrt
tanh
cosf
cosh
floor
sinf
floorf
tanhf
_copysign
log
logf
powf
ntdll
RtlAcquireSRWLockShared
RtlReleaseSRWLockShared
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoOriginateError
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventWriteTransfer
EventRegister
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceExecuteOnce
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceLoggerHandle
TraceMessage
GetTraceEnableFlags
api-ms-win-rtcore-ntuser-window-l1-1-0
PostThreadMessageW
DispatchMessageW
DestroyWindow
TranslateMessage
KillTimer
SetTimer
GetClientRect
PeekMessageW
PostMessageW
GetQueueStatus
IsWindowEnabled
IsGUIThread
PostQuitMessage
GetWindowThreadProcessId
IsWindow
GetMessageTime
DefWindowProcW
SetWindowLongPtrW
IsChild
CreateWindowExW
CallWindowProcW
ClientToScreen
GetAncestor
RegisterClassW
api-ms-win-core-com-l1-1-0
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoInitializeEx
CoUninitialize
CoCreateInstance
api-ms-win-rtcore-ntuser-synch-l1-1-0
MsgWaitForMultipleObjects
api-ms-win-core-processthreads-l1-1-3
SetThreadDescription
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
api-ms-win-ntuser-sysparams-l1-1-0
GetMonitorInfoW
SystemParametersInfoW
GetSystemMetrics
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
api-ms-win-ntuser-rectangle-l1-1-0
CopyRect
IsRectEmpty
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
dcompi
WinUIDCompositionCreateDevice3
api-ms-win-crt-utility-l1-1-0
qsort_s
api-ms-win-rtcore-ntuser-wmpointer-l1-1-0
GetPointerInfo
GetPointerInputTransform
GetPointerDeviceRects
api-ms-win-core-largeinteger-l1-1-0
MulDiv
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
microsoft.inputstatemanager
InitDManipHookInProc
UndelegateInputInProc
HandleDelegatedInputInProc
DelegateCapturePointersInProc
DelegateReleasePointerCaptureInProc
SendMessageCallbackInProc
DelegateInputInProc
?InitializeDManipHook@@YAHKPEAX@Z
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
440KB
Virtual Size
437KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
116KB
Virtual Size
115KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
280B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
32KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=10, id=259, version=33145,
count=87, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=221, id=1, productName=Unmarked objects,
count=39, id=261, version=33145,
count=1, id=256, version=33145,
count=69, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Microsoft.InputStateManager.dll
- IMPHASH 8fd6b398b1bc0fcc01b8bf7f4513fee5
- SHA256 1bc9bb28636a2cdcfdcc28a08bc5239db16dd556c9ccf7a6e6088ff3a7102144
- MD5 14afe09c0e086a5a0cf18cead8f96324
- SHA1 c9ce6c9b0fca118432ad676fed2ac88fedbadcf2
- SHA512 91022739768c6f7b8dc34e11570d26d8e6f9f534f11e7caa559c93d6c8ac74609c7c34f54ad8efb7131f2dc289fc35963263853243ea42085824b5b9e0f0a8fa
- SSDEEP 6144:lG4Z/f+eZP3SoLm4E4AJwfshd/V69bkW3m7/ZX8DwXsoR1yYEHeIAu3reAwT:oif+2bL2JQshdVc3mBX8esoR1yYNeO
- TLSH T13DA44B7BEAA844E0D13A913C85A78B07F6B1745907319ACB42A0926D1F3BFF49D3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ab:7c:05:a8:bc:61:9f:a6:9f:64:05:b5:09:56:9d:01:c0:0e:0a:e0:65:6f:c9:0e:89:20:27:7a:cc:cf:8a:1f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 14, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:85:5e:99:ec:0e:59:2f:cd:d7:00:00:00:00:04:85
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1e:a3:ac:a4:6e:39:6f:7c:49:00:01:00:00:02:1e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
8560
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Microsoft.InputStateManager.pdb
ntdll
RtlCaptureStackBackTrace
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
api-ms-win-rtcore-ntuser-private-l1-1-1
ord2505
ord2503
api-ms-win-rtcore-ntuser-wmpointer-l1-1-0
GetPointerInputTransform
GetPointerInfo
GetPointerDeviceRects
GetRawPointerDeviceData
GetPointerDeviceProperties
GetPointerFrameInfo
GetPointerFramePenInfoHistory
GetPointerFrameTouchInfoHistory
GetPointerFrameInfoHistory
GetPointerPenInfo
GetPointerTouchInfo
GetPointerType
kernel32
InitializeCriticalSection
SleepConditionVariableSRW
WakeAllConditionVariable
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
InterlockedFlushSList
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
DeleteCriticalSection
EncodePointer
RaiseException
OutputDebugStringW
FormatMessageW
IsDebuggerPresent
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
DebugBreak
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
InitializeCriticalSectionEx
LoadLibraryExW
GetCurrentProcess
LeaveCriticalSection
InitOnceBeginInitialize
InitOnceComplete
FreeLibrary
QueryPerformanceFrequency
LoadLibraryW
CreateEventExW
DuplicateHandle
GetCurrentThread
SetEvent
advapi32
EventSetInformation
EventUnregister
EventWriteTransfer
EventRegister
EventActivityIdControl
ole32
CoCreateFreeThreadedMarshaler
user32
DispatchMessageW
GetWindowLongPtrW
TranslateMessage
GetRawInputDeviceList
PeekMessageW
SetCapture
DestroyWindow
IsGUIThread
MapWindowPoints
PostThreadMessageW
GetAsyncKeyState
ClientToScreen
CreateWindowExW
ReleaseCapture
RegisterClassExW
DefWindowProcW
GetMessageTime
GetKeyState
SetCursor
LoadCursorW
MsgWaitForMultipleObjects
GetWindowThreadProcessId
SetWindowLongPtrW
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoInitialize
RoGetActivationFactory
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WakeByAddressSingle
WaitOnAddress
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-core-processthreads-l1-1-3
SetThreadDescription
ext-ms-win-ntuser-private-l1-1-1
ord2546
ext-ms-win-rtcore-ntuser-dpi-l1-2-0
SetThreadDpiAwarenessContext
GetWindowDpiAwarenessContext
coremessagingxp
CoreUICallReceive
CoreMsgCreateSession
CoreUICallCreateConversationHost
CoreUICallSend
microsoft.ui.composition.ossupport
RecordFeatureUsage
SubscribeFeatureStateChangeNotification
MicrosoftTelemetryAssertTriggeredArgs
UnsubscribeFeatureStateChangeNotification
microsoft.internal.frameworkudk
InputPrivates_GetActivationConfiguration
CoreDragOperationFunctions_StartAsync
InputPrivates_InputSite_GetForInputSink
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
abort
terminate
_seh_filter_dll
_initterm
_cexit
_initialize_narrow_environment
_crt_atexit
_execute_onexit_table
_initialize_onexit_table
_invalid_parameter_noinfo
_errno
_invalid_parameter_noinfo_noreturn
_beginthreadex
_register_onexit_function
_initterm_e
api-ms-win-crt-heap-l1-1-0
_calloc_base
_callnewh
_free_base
free
malloc
api-ms-win-crt-string-l1-1-0
iswspace
strcpy_s
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
microsoft.ui.input
InitializeDirectManipulationHookInProc
marshal
LegacyMarshalerQueryCompositionInputSinkLuid
LegacyMarshalerQueryCompositionInputQueueAndTransform
LegacyMarshalerDuplicateCompositionInputSink
LegacyMarshalerCloseCompositionInputSink
oleaut32
SysFreeString
SysStringLen
GetErrorInfo
SetErrorInfo
api-ms-win-crt-math-l1-1-0
ceilf
CreateInputRenderingConnection
CreateInputSiteConnection
DelegateCapturePointersInProc
DelegateInputInProc
DelegateReleasePointerCaptureInProc
HandleDelegatedInputInProc
InitDManipHookInProc
LiftedDragStartAsync
LiftedDragStartAsync_OnInputThread
NotifyInputSinkParented
NotifyInputSinkRemoved
NotifyInputSinkTransformChanged
RegisterManipulationThread
SendMessageCallbackInProc
SetManipulationInputTarget
StopAndEndInertia
UndelegateInputInProc
Name
.text
Size
300KB
Virtual Size
298KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
96KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=257, version=33145,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=44, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=197, id=1, productName=Unmarked objects,
count=44, id=261, version=33145,
count=11, id=259, version=33145,
count=62, id=264, version=33145,
count=1, id=256, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Microsoft.Internal.FrameworkUdk.dll
- IMPHASH 94cb2a3d1db5e1a99869c829d72d9a49
- SHA256 0c28ae577735672414078846fcc6b18ee55bf8eedf7b7581dc015c6af65776ea
- MD5 ae2ffdf32c72b401f0bcda59f7dc5ce9
- SHA1 bd15453fcd829ae47984067356c7c74032b70bd8
- SHA512 431540329368312232ffae8fd1cc0f59c1b280d8df454c117106f9822f73fc3611b0e36ce305192bef5a584d0153d031ed93c817b579b9da3ead9d2766c5b95d
- SSDEEP 6144:UsdRmeyMJzFuDGSoqc9FoswcHgRzMWBotbVy6UHCKCkFvw7vr9JJwnVRUEtsQ/1A:bdygzFZSxcTwc9tM6UHBmX9kcEtsy7xq
- TLSH T16215741AEE7951E0C4BAD03D9192622FF8B170A68B3057C3D6919A1F5F32BF4A53E740
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
56:ff:fe:48:e6:b1:b8:e2:f4:63:0c:24:d0:e1:3e:2c:b0:1b:a1:e1:3e:b5:75:5f:d1:19:20:37:48:82:c9:5c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 14, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:19:da:dd:aa:8b:dc:44:b2:92:00:00:00:00:05:19
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:2b:bb:00:50:ff:4d:3b:9a:a1:00:01:00:00:02:2b
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
16080
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Microsoft.Internal.FrameworkUdk.pdb
api-ms-win-crt-runtime-l1-1-0
terminate
_invalid_parameter_noinfo
_errno
_invalid_parameter_noinfo_noreturn
_set_errno
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
abort
_initterm_e
_initterm
api-ms-win-crt-string-l1-1-0
iswspace
wcscpy_s
memcpy_s
toupper
wcsnlen
wcsncpy
strncpy_s
strcpy_s
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
__stdio_common_vsprintf_s
__stdio_common_vswprintf_s
api-ms-win-crt-convert-l1-1-0
strtol
wcstod
api-ms-win-crt-heap-l1-1-0
free
_calloc_base
_free_base
malloc
realloc
_callnewh
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleW
LoadLibraryExA
LoadLibraryExW
GetModuleFileNameA
GetModuleHandleExW
FreeLibrary
GetModuleFileNameW
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
CreateSemaphoreExW
SetEvent
WaitForSingleObject
CreateMutexExW
InitializeSRWLock
OpenSemaphoreW
EnterCriticalSection
WaitForSingleObjectEx
LeaveCriticalSection
AcquireSRWLockExclusive
InitializeCriticalSectionEx
CreateEventExW
ReleaseSRWLockExclusive
ReleaseMutex
AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseSemaphore
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
GetLastError
RaiseException
SetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TlsFree
TlsAlloc
TlsGetValue
OpenProcessToken
GetCurrentProcess
GetCurrentProcessId
TlsSetValue
api-ms-win-core-localization-l1-2-0
SetProcessPreferredUILanguages
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoInitialize
RoUninitialize
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
InitOnceBeginInitialize
InitOnceExecuteOnce
SleepConditionVariableSRW
InitOnceComplete
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
RoFailFastWithErrorContext
RoTransformError
RoOriginateError
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsDeleteString
api-ms-win-core-path-l1-1-0
PathCchRemoveFileSpec
PathCchCombine
api-ms-win-core-file-l1-1-0
GetFileAttributesW
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-featurestaging-l1-1-0
GetFeatureEnabledState
SubscribeFeatureStateChangeNotification
RecordFeatureError
RecordFeatureUsage
UnsubscribeFeatureStateChangeNotification
api-ms-win-core-featurestaging-l1-1-1
GetFeatureVariant
api-ms-win-security-base-l1-1-0
DuplicateToken
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
AccessCheck
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-security-provider-l1-1-0
GetSecurityInfo
ntdll
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlGetDeviceFamilyInfoEnum
NtQuerySystemInformation
RtlUnsubscribeWnfStateChangeNotification
NtPowerInformation
profapi
ord114
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegCloseKey
RegGetValueW
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-com-l1-1-0
CoRevertToSelf
CoTaskMemFree
CoImpersonateClient
CoCreateFreeThreadedMarshaler
CoGetMalloc
CoGetApartmentType
CoCreateInstance
CoTaskMemAlloc
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer
rpcrt4
UuidToStringW
UuidCreate
RpcStringFreeW
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetSystemTimeAsFileTime
api-ms-win-core-registry-l2-1-0
RegOpenKeyW
RegEnumKeyW
api-ms-win-core-psapi-l1-1-0
K32GetModuleFileNameExW
api-ms-win-core-rtlsupport-l1-1-0
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InterlockedFlushSList
InterlockedPushEntrySList
InitializeSListHead
api-ms-win-core-fibers-l1-1-0
FlsSetValue
FlsAlloc
FlsGetValue
FlsFree
api-ms-win-core-util-l1-1-0
EncodePointer
bcp47langs
LanguageListAsMuiForm
GetFontFallbackLanguageList
GetApplicationLanguages
coremessaging
CoreUICreate
api-ms-win-appmodel-runtime-l1-1-1
GetPackagePathByFullName
api-ms-win-appmodel-runtime-l1-1-0
GetCurrentPackageFullName
PackageFamilyNameFromFullName
api-ms-win-appmodel-runtime-internal-l1-1-1
GetSystemMetadataPathForPackage
api-ms-win-appmodel-runtime-internal-l1-1-4
GetEffectivePackageStatusForUserSid
api-ms-win-rtcore-ntuser-window-l1-1-0
SetPropW
PostThreadMessageW
RemovePropW
dcomp
ord1040
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-memory-l1-1-0
VirtualProtect
VirtualQuery
oleaut32
GetErrorInfo
SysFreeString
SysStringLen
SetErrorInfo
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-crt-math-l1-1-0
pow
ceilf
AppModelApi_GetProgIdAndACIDForInputs
AppxPackageVolumeReset_CheckDeviceForAppReset
AppxPackageVolumeReset_RepairDeviceWithAppReset
AudioGraphSettingsExtension_SetUseSpatialAudioApi
AutomationExtension_IsUiaEndpointsSupported
BackButtonIntegration_InjectBackButtonPress
BackButtonIntegration_RegisterListener
BackButtonIntegration_UnregisterListener
Containment_GetChangeEnabled
Containment_SetConfiguration
CoreDragOperationFunctions_StartAsync
DCompPrivates_CreateColorContent
DCompPrivates_CreateCompositionBatchQuery
DCompPrivates_CreateSharedVisual
DCompPrivates_CreateSharedVisualHandle
DCompPrivates_OpenAndAttachSharedTarget
DCompPrivates_OpenSharedDCompositionObject
DCompPrivates_OpenSharedResourceHandle
DCompPrivates_ResizeDCompositionSurface
DCompPrivates_SetCommitCompletionEvent
DCompPrivates_SetTransparentForInput
DCompPrivates_SetVisualRelativeSize
DCompPrivates_SetVisualSize
DisplayPrivates_CreateDisplayEvents
DisplayPrivates_DisplayConfigGetAdvancedColorInfo
DisplayPrivates_GetCurrentColorProfilePath
DisplayPrivates_RegisterStereoChangedListener
DisplayPrivates_UnregisterStereoChangedListener
DxPrivates_PartnerDeviceFromDevice
DxPrivates_SwapChainPartnerFromDxgiSwapChain
DxPrivates_WarpPalCreateExtensionFactory
DxPrivates_WarpPalGetDeviceCaps
DxPrivates_WarpPrivateAPIFromDevice
FinalUnhandledErrorDetected_RegisterHandler
FinalUnhandledErrorDetected_UnregisterHandler
FrameworkInputView_RegisterListener
FrameworkInputView_UnregisterListener
FrameworkUdk_Diagnostic
InitializeXamlDiagnosticsEx
InputPaneFramework_Advise
InputPaneFramework_RegisterListener
InputPaneFramework_UnregisterListener
InputPrivates_GetActivationConfiguration
InputPrivates_InputSite_GetForInputSink
InputPrivates_IsShellManagedHwnd
InputPrivates_IsShellManagedZBand
MFMediaEngineExtension_DisableVisibilityHandling
MFMediaEngineExtension_GetCurrentMediaPlaybackItem
MFMediaEngineExtension_SetSourceFromMediaSource
MediaCaptureExtension_GetPreviewSource
MediaPlaybackDataSourceExtension_SendMediaPlaybackCommand
MediaPlaybackDataSourceExtension_SendPlaybackPositionChangeRequest
MediaPlaybackDataSourceExtension_SendPlaybackRateChangeRequest
MediaPlaybackDataSourceExtension_SendRepeatModeChangeRequest
MediaPlaybackListExtension_AddAutoRepeatChanged
MediaPlaybackListExtension_AddCurrentItemChanged
MediaPlaybackListExtension_RemoveAutoRepeatChanged
MediaPlaybackListExtension_RemoveCurrentItemChanged
MediaPlaybackSessionExtension_IsPlaybackRateSupported
MediaPlayerExtension_AddCastingRenderLocationChanged
MediaPlayerExtension_AddIsLoopingEnabledChanged
MediaPlayerExtension_DisableVisibilityHandling
MediaPlayerExtension_GetCurrentMediaPlaybackItem
MediaPlayerExtension_GetCurrentMediaPlaybackItem_Deprecated
MediaPlayerExtension_GetMediaPlayerCastingRenderLocation
MediaPlayerExtension_GetVideoSwapchainHandle
MediaPlayerExtension_RemoveCastingRenderLocationChanged
MediaPlayerExtension_RemoveIsLoopingEnabledChanged
Mui_GetFontFallbackLanguageList
Mui_PropagateApplicationLanguages
PackageManagement_IsFeatureSupported
PackageManagement_IsPackageRegistrationPending
PackageManagement_IsRegisteredOrNewerAvailable
PackageManagement_RemovePackageByUriAsync
PackageManagement_RemovePackageByUriAsync2
PackageManagement_RepairPackageAsync
PackageManagement_RepairPackageAsync2
PackageManagement_ResetPackageAsync
PackageManagement_ResetPackageAsync2
PowerNotifications_GetCompositeBatteryStatus
PowerNotifications_GetDischargeTime
PowerNotifications_GetDisplayStatus
PowerNotifications_GetEnergySaverStatus
PowerNotifications_GetPowerCondition
PowerNotifications_GetUserPresenceStatus
PowerNotifications_RegisterCompositeBatteryStatusChangedListener
PowerNotifications_RegisterDischargeTimeChangedListener
PowerNotifications_RegisterDisplayStatusChangedListener
PowerNotifications_RegisterEnergySaverStatusChangedListener
PowerNotifications_RegisterPowerConditionChangedListener
PowerNotifications_RegisterSystemIdleStatusChangedListener
PowerNotifications_RegisterUserPresenceStatusChangedListener
PowerNotifications_UnregisterCompositeBatteryStatusChangedListener
PowerNotifications_UnregisterDischargeTimeChangedListener
PowerNotifications_UnregisterDisplayStatusChangedListener
PowerNotifications_UnregisterEnergySaverStatusChangedListener
PowerNotifications_UnregisterPowerConditionChangedListener
PowerNotifications_UnregisterSystemIdleStatusChangedListener
PowerNotifications_UnregisterUserPresenceStatusChangedListener
PushNotifications_CloseChannel
PushNotifications_CreateChannelWithRemoteIdentifier
PushNotifications_GetFullTrustApplicationsWithChannels
PushNotifications_RegisterFullTrustApplication
PushNotifications_RegisterNotificationSinkForFullTrustApplication
PushNotifications_UnregisterFullTrustApplication
PushNotifications_UnregisterNotificationSinkForFullTrustApplication
ResourceManager_GetDefaultResourcePathForPackageFullName
TextAnalysis_CreateDWritePrivateTextAnalysisSourceProxy
TextAnalysis_GetContentReadingDirection
TextAnalysis_SetLocaleNameList
TextInputProxy_putInputSettings
TextInput_SetKeyboardSkin
TextInput_SetTextPrediction
Theming_TryEnableHostBackdropBrush
Theming_TrySetDarkTheme
TimedMetadataTrackExtension_AddCueEntered
TimedMetadataTrackExtension_RemoveCueEntered
ToastNotifications_GetHistory
ToastNotifications_PostToast
ToastNotifications_QuerySettings
ToastNotifications_RemoveAllToastsForApp
ToastNotifications_RemoveToast
ToastNotifications_RemoveToastsWithTagAndGroup
ToastNotifications_RetrieveAssets
ToastNotifications_UpdateNotificationData
Uup_SRAddOrUpdateUupProduct
Uup_SRFindPackageFullNamesByUupProductId
Uup_SRGetAllPackageFullNamesInUupProducts
Uup_SRGetAllUupProductsForPackageFullName
VisualDiagnosticsPort_Register
VisualDiagnosticsPort_Unregister
WindowPositionChanged_RegisterListener
WindowPositionChanged_UnregisterListener
Windowing_GetDisplayIdFromMonitor
Windowing_GetIconFromIconId
Windowing_GetIconIdFromIcon
Windowing_GetMonitorFromDisplayId
Windowing_GetWindowFromWindowId
Windowing_GetWindowIdFromWindow
WnpNotifications_IsCallingPreviewSupported
WnpNotifications_RemoveAllNotificationsForAppOfType
Workloads_FindIdsForUserOrDefaultAccount
Workloads_GetWorkloadForUserOrDefaultAccount
Name
.text
Size
640KB
Virtual Size
639KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
176KB
Virtual Size
173KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
52KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
168B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=257, version=33145,
count=1, productName=Unmarked objects (old),
count=17, id=260, version=33145,
count=10, id=259, version=33145,
count=119, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=257, id=1, productName=Unmarked objects,
count=46, id=261, version=33145,
count=70, id=264, version=33145,
count=1, id=256, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Microsoft.UI.Composition.OSSupport.dll
- IMPHASH 158b38fdb07981a25c33e557ec847333
- SHA256 e5c49e4a1269babdafd49b7e64638bca3ffd54a22feb5080f9a79fdd6a305f06
- MD5 21753c42ee23c81a1e0c3fafc9414edd
- SHA1 d82e87f3cdb4869efd37e40a46f61cea84d59321
- SHA512 d2ede7732df55a5f5cf09ccedadfa640f58a6e11d2b790af0b436760295a18367d9d4129a87beeb3c5ee7597bd465d380a1d80ff0b5f4064c04062ee651b00c3
- SSDEEP 1536:6cum2n7hIpk5Bsshnj9gQFPS47Y2mF1za:6cuThIpkDfg+Y9F1W
- TLSH T1C6636C45A19820EAF877017CC056CF19A8B5B26213506AFF03A0C6BD1FD3BC5A53EF95
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
26:90:85:55:77:dc:ca:aa:a0:5f:aa:af:cb:e9:8f:b5:84:da:fb:df:bc:12:ec:d6:86:3d:d5:56:f6:e5:57:89
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 14, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:85:5e:99:ec:0e:59:2f:cd:d7:00:00:00:00:04:85
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:F002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:20:24:e1:e6:e0:17:b9:b4:8e:00:01:00:00:02:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5328
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Microsoft.UI.Composition.OSSupport.pdb
api-ms-win-crt-runtime-l1-1-0
abort
terminate
_initialize_onexit_table
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_errno
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_invalid_parameter_noinfo
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
kernel32
FlsAlloc
DeleteCriticalSection
InitializeCriticalSectionEx
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
RaiseException
RaiseFailFastException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
WideCharToMultiByte
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LoadLibraryW
FreeLibrary
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
GetSystemTimeAsFileTime
RtlUnwindEx
FlsGetValue
FlsSetValue
FlsFree
ntdll
RtlDeleteElementGenericTable
RtlInsertElementGenericTable
NtQueryValueKey
NtQueryObject
NtQuerySystemInformation
NtOpenKey
DbgPrompt
RtlLookupElementGenericTable
RtlEnumerateGenericTableWithoutSplaying
RtlInitializeGenericTable
api-ms-win-core-com-l1-1-0
CoCreateGuid
api-ms-win-crt-heap-l1-1-0
_calloc_base
_free_base
DbgPrompt_Onecore
EnableMouseInPointerForWindow
ExUuidCreate
GetFeatureEnabledState
GetFeatureVariant
GetLastError_Winbase
InitializeSListHead_Winbase
InterlockedFlushSList_Winbase
InterlockedPopEntrySList_Winbase
InterlockedPushEntrySList_Winbase
KeGetCurrentIrql
MicrosoftTelemetryAssertTriggeredArgs
MicrosoftTelemetryAssertTriggeredNoArgs
NtQueryObject_Ntdll
NtQuerySystemInformation_Onecore
RaiseException_Winbase
RaiseFailFastException_Winbase
RecordFeatureError
RecordFeatureUsage
RtlDeleteElementGenericTable_Onecore
RtlEnumerateGenericTableWithoutSplaying_Onecore
RtlInitializeGenericTable_Onecore
RtlInsertElementGenericTable_Onecore
RtlLookupElementGenericTable_Onecore
RtlNotifyFeatureUsage
RtlQueryFeatureConfiguration
SetLastError_Winbase
SetUnhandledExceptionFilter_Winbase
SubscribeFeatureStateChangeNotification
TerminateProcessOnMemoryExhaustion
UnhandledExceptionFilter_Winbase
UnsubscribeFeatureStateChangeNotification
WideCharToMultiByte_Winbase
ZwOpenKey
ZwQueryValueKey
Name
.text
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
168B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=9, id=259, version=33145,
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=96, id=1, productName=Unmarked objects,
count=36, id=261, version=33145,
count=1, id=256, version=33145,
count=6, id=264, version=33145,
count=1, id=258, version=33145,
Microsoft.UI.Input.dll
- IMPHASH eef7e6dee7de06df6b17f65c0cd854bb
- SHA256 44761659493c82ef2664c0061e9a11f25a753b43d540b4782c50ab25dae7eb1c
- MD5 992a463ed0daa28667cec2086508b5a9
- SHA1 41312f5ce79dbf383c8b1f8648beff7ec1a23a7d
- SHA512 a6b33b98ce3e19d7bd417190f36847f359c8c4dac824023c65c2ea368ff5fbcdf6062278b259658c591dfd680c2e13a72a916f8ebbb820646c0b7c12d5e6bb7d
- SSDEEP 24576:AMjStSBI1DfUMmsS0l2Axf3y8zB6pROR3:AMjeEI1DTmsF2P8zB2ROR
- TLSH T14A853A6B9FA88495C236A23DC4A78F4AF6B174151B7197CB0171422E6F3BBE48D39730
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ec:58:2b:a6:d0:d6:ac:bb:5a:22:2d:d2:27:d0:83:01:0e:34:40:a5:25:8f:8f:11:b3:cb:9f:21:9a:71:5f:00
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 14, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:85:5e:99:ec:0e:59:2f:cd:d7:00:00:00:00:04:85
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:24:3b:84:21:b0:2c:ac:64:22:00:01:00:00:02:24
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
12464
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Microsoft.UI.Input.pdb
api-ms-win-crt-runtime-l1-1-0
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_invalid_parameter_noinfo
_errno
abort
_invalid_parameter_noinfo_noreturn
_initterm_e
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswscanf
__stdio_common_vswprintf
ntdll
RtlIsMultiSessionSku
RtlGetDeviceFamilyInfoEnum
RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry
iswspace
_wcsicmp
strcpy_s
microsoft.internal.frameworkudk
DCompPrivates_SetVisualRelativeSize
DCompPrivates_OpenSharedResourceHandle
Windowing_GetDisplayIdFromMonitor
Theming_TryEnableHostBackdropBrush
Windowing_GetMonitorFromDisplayId
Windowing_GetWindowIdFromWindow
Windowing_GetWindowFromWindowId
AutomationExtension_IsUiaEndpointsSupported
InputPrivates_IsShellManagedHwnd
InputPrivates_IsShellManagedZBand
DCompPrivates_CreateSharedVisual
DCompPrivates_OpenAndAttachSharedTarget
DCompPrivates_OpenSharedDCompositionObject
DCompPrivates_CreateSharedVisualHandle
microsoft.ui.composition.ossupport
RecordFeatureUsage
UnsubscribeFeatureStateChangeNotification
SubscribeFeatureStateChangeNotification
TerminateProcessOnMemoryExhaustion
marshal
LegacyMarshalerCloseCompositionInputSink
LegacyMarshalerQueryCompositionInputSinkLuid
LegacyMarshalerCreateCompositionInputSink
LegacyMarshalerCreateImplicitCompositionInputSink
coremessagingxp
CoreUICallSend
CoreUICallCreateConversationHost
CoreUICallCreateEndpointHost
CoreUICallReceive
CoreMsgCreateSession
WinUIGetDispatcherQueueForCurrentThread
microsoft.inputstatemanager
LiftedDragStartAsync_OnInputThread
ord8
CreateInputSiteConnection
microsoft.ui.windowing.core
DestroyMessageFilter
DefFeatureProc
DetachWindowFeature
ContentPreTranslateMessage
SetFeatureInstanceData
GetFeatureInstanceData
UnregisterWindowFeature
ContentNodeManagerCreate
GetWindowFeature
CreateMessageFilter
RegisterWindowFeature
AttachWindowFeature
AddMessageRangeToFilter
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateErrorW
RoOriginateError
SetRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-1
IsErrorPropagationEnabled
RoReportFailedDelegate
RoOriginateLanguageException
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-string-l1-1-0
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsCreateString
WindowsCreateStringReference
WindowsDuplicateString
WindowsDeleteString
api-ms-win-rtcore-ntuser-wmpointer-l1-1-0
GetPointerDeviceRects
GetPointerInfo
GetPointerInputTransform
GetPointerTouchInfo
api-ms-win-core-libraryloader-l1-2-0
SizeofResource
LockResource
LoadResource
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
LoadLibraryExW
GetModuleHandleA
GetModuleFileNameA
LoadStringA
DisableThreadLibraryCalls
LoadLibraryExA
FreeLibrary
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceExecuteOnce
WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceComplete
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
InitializeSRWLock
CreateEventW
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSRWLockShared
InitializeCriticalSection
CreateMutexExW
CreateEventExW
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockShared
AcquireSRWLockExclusive
SetEvent
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
RaiseException
GetLastError
SetLastError
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolWait
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
api-ms-win-core-processthreads-l1-1-0
CreateProcessW
GetCurrentThread
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
FindResourceW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPushEntrySList
InterlockedFlushSList
api-ms-win-core-fibers-l1-1-0
FlsSetValue
FlsGetValue
FlsFree
FlsAlloc
api-ms-win-security-base-l1-1-0
AllocateLocallyUniqueId
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureStackBackTrace
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegOpenKeyExW
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-processthreads-l1-1-1
OpenProcess
GetProcessMitigationPolicy
oleaut32
SysStringLen
GetErrorInfo
SysAllocString
SysFreeString
VariantInit
SafeArrayDestroy
SafeArrayPutElement
SetErrorInfo
SafeArrayCreateVector
user32
GetDesktopWindow
IsWindowEnabled
EnumDisplaySettingsW
GetMonitorInfoW
GetMenu
AdjustWindowRectEx
IsIconic
GetClassNameW
GetWindowTextW
MonitorFromWindow
InvalidateRect
GetKeyboardState
KillTimer
SetTimer
EvaluateProximityToPolygon
EvaluateProximityToRect
GetAsyncKeyState
GetMessageTime
SetCursor
SetCapture
ReleaseCapture
EnumChildWindows
SetParent
RegisterWindowMessageW
SetWindowPos
TrackMouseEvent
GetForegroundWindow
GetRawInputDeviceList
SendInput
ShowCursor
RemovePropW
SetFocus
GetPropW
SetWindowRgn
IsChild
DestroyCursor
GetWindowThreadProcessId
MapWindowPoints
UnionRect
GetClientRect
GetMessageExtraInfo
IsWindowVisible
GetSystemMetrics
GetAncestor
GetFocus
GetWindowRect
GetWindowLongW
SetWindowLongW
PeekMessageW
IsZoomed
PostMessageW
GetCursorPos
WindowFromPoint
GetWindowLongPtrW
GetKeyState
SetActiveWindow
EnableWindow
SendMessageW
IsWindow
GetMessagePos
SetPropW
ScreenToClient
PtInRect
DestroyWindow
ShowWindow
RegisterClassExW
SetWindowLongPtrW
DefWindowProcW
CreateWindowExW
SetLayeredWindowAttributes
LoadCursorW
kernel32
AppPolicyGetWindowingModel
MulDiv
gdi32
SetRectRgn
CreateRectRgn
CombineRgn
DeleteObject
dcomp
DCompositionCreateDevice3
ord1038
api-ms-win-crt-heap-l1-1-0
malloc
free
_free_base
_calloc_base
realloc
_callnewh
api-ms-win-crt-math-l1-1-0
floorf
sqrt
sqrtf
ceilf
atan2
cos
roundf
_finite
_isnan
sin
api-ms-win-core-memory-l1-1-0
VirtualProtect
VirtualQuery
api-ms-win-crt-string-l1-1-0
wcscmp
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
InitializeDirectManipulationHookInProc
LiftedInputCapturePointerIdForDragAndDrop
Name
.text
Size
1008KB
Virtual Size
1004KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
432KB
Virtual Size
431KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
52KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
304B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
124KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=257, version=33145,
count=1, productName=Unmarked objects (old),
count=15, id=260, version=33145,
count=85, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=350, id=1, productName=Unmarked objects,
count=42, id=261, version=33145,
count=11, id=259, version=33145,
count=1, id=256, version=33145,
count=172, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Microsoft.UI.Windowing.Core.dll
- IMPHASH 306772a04c88412af7576cd77abf1429
- SHA256 e11d144bb82a9356185f0eb956f3bdf7f1223751b325c9d3dffc212a5de3684b
- MD5 6021268a3faa0e17be211e44d5b841aa
- SHA1 04b4b7d1167befe2023672a607ba7de0c7eea4dc
- SHA512 1d424e8a6aaff9010f6e9a95a2cf0e750f38b1427915a4d132bfeca96ac5e9767fc0e83baf8e75d0d0061acdfd0235dd6a165486433d9fa91d7c53ac5c46991d
- SSDEEP 6144:Ss4jY1PnSzURJG9m3+v6Vtcu5/4m0qVFOU4prZdtPDqbaux2Qlj:pSY1PSw+5Ccu2m0qPOUANdhqbau
- TLSH T1D5B43D6F6BE84492E22A613D96978B09F6F174125732CBCB0111D13E6F2BBE85D7E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
3f:a3:66:41:39:3c:71:80:58:3c:c1:c4:ab:7e:77:9a:b0:f5:7d:f8:06:ec:a9:38:7b:20:74:f8:ab:cb:d7:d8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 14, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:85:5e:99:ec:0e:59:2f:cd:d7:00:00:00:00:04:85
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:21:33:c0:35:fb:d2:0f:21:a4:00:01:00:00:02:21
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
7344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Microsoft.UI.Windowing.Core.pdb
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
abort
_errno
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_cexit
_initialize_narrow_environment
_invalid_parameter_noinfo
_configure_narrow_argv
_seh_filter_dll
terminate
_initterm_e
_initterm
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
api-ms-win-crt-string-l1-1-0
wcscpy_s
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstol
coremessagingxp
CoreMsgCreateSession
microsoft.internal.frameworkudk
Theming_TrySetDarkTheme
api-ms-win-core-apiquery-l2-1-0
IsApiSetImplemented
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
SizeofResource
GetModuleHandleW
LoadStringA
GetModuleHandleExA
FreeLibrary
LoadStringW
FindResourceExW
GetModuleFileNameA
GetModuleHandleExW
LoadResource
LockResource
DisableThreadLibraryCalls
LoadLibraryExW
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
InitializeSRWLock
DeleteCriticalSection
CreateEventExW
ResetEvent
InitializeCriticalSection
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
AcquireSRWLockExclusive
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
RaiseException
api-ms-win-core-processthreads-l1-1-0
TlsFree
GetCurrentThreadId
TlsGetValue
GetCurrentProcessId
TlsAlloc
GetCurrentProcess
GetCurrentThread
TlsSetValue
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsPromoteStringBuffer
WindowsCreateStringReference
WindowsPreallocateStringBuffer
WindowsDeleteStringBuffer
WindowsIsStringEmpty
WindowsGetStringRawBuffer
api-ms-win-core-synch-l1-2-0
SleepConditionVariableSRW
InitOnceComplete
InitOnceBeginInitialize
WakeAllConditionVariable
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CreateThreadpoolWait
SetThreadpoolWait
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoOriginateErrorW
SetRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister
api-ms-win-core-largeinteger-l1-1-0
MulDiv
api-ms-win-core-registry-l1-1-0
RegGetValueW
oleaut32
SysAllocString
SafeArrayPutElement
SafeArrayDestroy
SafeArrayCreateVector
VariantInit
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-security-base-l1-1-0
AllocateLocallyUniqueId
rpcrt4
RpcStringFreeW
UuidToStringW
api-ms-win-core-atoms-l1-1-0
FindAtomW
GlobalAddAtomW
GlobalDeleteAtom
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedFlushSList
api-ms-win-core-rtlsupport-l1-1-0
RtlUnwindEx
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlPcToFileHeader
api-ms-win-core-fibers-l1-1-0
FlsSetValue
FlsGetValue
FlsFree
FlsAlloc
api-ms-win-core-util-l1-1-0
EncodePointer
user32
DrawIconEx
CopyRect
LoadIconW
GetWindowLongW
SetWindowLongW
GetClassLongPtrW
SetLayeredWindowAttributes
SendMessageW
GetSysColor
MonitorFromWindow
SetThreadDpiAwarenessContext
LoadCursorW
GetForegroundWindow
DestroyAcceleratorTable
RemovePropW
GetWindowTextLengthW
SetWindowLongPtrW
CreateAcceleratorTableW
GetWindowLongPtrW
GetWindowRect
GetSystemMetricsForDpi
CopyAcceleratorTableW
InflateRect
IsRectEmpty
GetClientRect
GetPropW
GetClassInfoExW
MapWindowPoints
GetWindowThreadProcessId
PostMessageW
ShowWindow
CopyImage
FindWindowExW
SetPropW
ScreenToClient
ClientToScreen
GetKeyState
BeginDeferWindowPos
VkKeyScanExW
CreateWindowExW
GetWindowTextW
ord2557
TranslateAcceleratorW
RegisterClassExW
GetWindowDpiAwarenessContext
RegisterWindowMessageW
EndDeferWindowPos
CallWindowProcW
DefWindowProcW
DestroyWindow
DeferWindowPos
GetKeyboardLayout
SetWindowPos
IsZoomed
api-ms-win-rtcore-ntuser-private-l1-1-0
IsWindowInDestroy
api-ms-win-crt-heap-l1-1-0
malloc
free
_free_base
calloc
_calloc_base
_callnewh
api-ms-win-crt-math-l1-1-0
ceilf
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
AddMessageFilterToFilter
AddMessageListToFilter
AddMessageNameToFilter
AddMessageRangeToFilter
AddMessageToFilter
AttachWindowFeature
ContentNodeManagerCreate
ContentPreTranslateMessage
CreateFeatureTypeBuilder
CreateFeatureWindow
CreateMessageFilter
CreateMessageFilterBuilder
DefFeatureProc
DestroyMessageFilter
DetachWindowFeature
DllGetActivationFactory
GetFeatureInstanceData
GetFeatureStyles
GetFeatureTypeData
GetWindowFeature
RegisterFeatureWindowClass
RegisterWindowFeature
SetFeatureInstanceData
SetFeatureStyles
UnregisterWindowFeature
Name
.text
Size
324KB
Virtual Size
320KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
132KB
Virtual Size
130KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=257, version=33145,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=87, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=263, id=1, productName=Unmarked objects,
count=49, id=261, version=33145,
count=11, id=259, version=33145,
count=1, id=256, version=33145,
count=237, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Microsoft.UI.Windowing.dll
- IMPHASH e08070410854147f9f45028718c7f6ba
- SHA256 1d1b84cdb528d8035ec0e603ab7b2da690caf4edfcfb380eba185ed7e5747292
- MD5 90f7fbc532b168a18f04b0e473e13daa
- SHA1 cd1b661d4b862c144d78aefa1c592c95cd7fa967
- SHA512 f6f757e335b4585d64eb52ba0214661bda9e4a0ae21e1444873881abf786006e01090ac406706617c0b681165b14551b73fb4b53e7aba13ccbf941bf98bad03b
- SSDEEP 6144:ylLJdDCMslOzqjXsvPueIP7mNq6CIRPDoxqTHXa9k6totUInrMFAc6:gLJdDCrkqj3eIKFC6DosjamV3c
- TLSH T1DFC43B6EBBA44696D12A813DC6A78F06F3F0B8555731DBCB4161823D9F37BE8593A300
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
67:ce:c1:0c:95:89:41:46:36:2f:c8:dc:d6:1f:97:26:7a:c3:c0:5b:ad:bf:0a:a1:3d:0e:9b:6a:c4:52:fa:f9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 14, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:84:98:e2:12:e0:78:a3:31:5d:00:00:00:00:04:84
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:14:8d:cd:23:44:ee:06:df:72:00:01:00:00:02:14
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
6416
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Microsoft.UI.Windowing.pdb
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
abort
_errno
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_cexit
_initialize_narrow_environment
_invalid_parameter_noinfo
_configure_narrow_argv
_seh_filter_dll
terminate
_initterm_e
_initterm
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
api-ms-win-crt-convert-l1-1-0
wcstol
microsoft.ui.windowing.core
GetFeatureInstanceData
RegisterFeatureWindowClass
DefFeatureProc
SetFeatureStyles
SetFeatureInstanceData
GetWindowFeature
DetachWindowFeature
RegisterWindowFeature
UnregisterWindowFeature
AttachWindowFeature
CreateFeatureWindow
api-ms-win-core-libraryloader-l1-2-0
LoadStringA
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleHandleW
FreeLibrary
GetModuleFileNameA
LoadLibraryExW
GetProcAddress
api-ms-win-core-synch-l1-1-0
WaitForSingleObjectEx
ReleaseSRWLockShared
AcquireSRWLockExclusive
EnterCriticalSection
AcquireSRWLockShared
LeaveCriticalSection
InitializeCriticalSectionEx
OpenSemaphoreW
ReleaseMutex
ReleaseSRWLockExclusive
DeleteCriticalSection
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
CreateMutexExW
InitializeCriticalSection
InitializeSRWLock
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
RaiseException
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
GetStartupInfoW
GetCurrentThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsCreateString
WindowsIsStringEmpty
WindowsCreateStringReference
WindowsPreallocateStringBuffer
WindowsPromoteStringBuffer
WindowsDeleteStringBuffer
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
api-ms-win-core-largeinteger-l1-1-0
MulDiv
api-ms-win-ntuser-sysparams-l1-1-0
EnumDisplayMonitors
SystemParametersInfoW
GetMonitorInfoW
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
api-ms-win-core-com-l1-1-0
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoTaskMemAlloc
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceInitialize
WakeAllConditionVariable
InitOnceComplete
SleepConditionVariableSRW
InitOnceBeginInitialize
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InterlockedFlushSList
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
api-ms-win-core-fibers-l1-1-0
FlsGetValue
FlsAlloc
FlsSetValue
FlsFree
api-ms-win-core-util-l1-1-0
EncodePointer
user32
LoadIconW
LoadCursorW
GetWindowThreadProcessId
GetWindowTextLengthW
GetWindowTextW
ShowWindow
GetClassLongPtrW
SendMessageW
SendNotifyMessageW
SetWindowTextW
LoadImageW
MonitorFromPoint
EnableMenuItem
GetSystemMenu
IsRectEmpty
GetSystemMetricsForDpi
DefWindowProcW
RegisterWindowMessageW
IntersectRect
SetWindowPos
IsWindowEnabled
DestroyWindow
IsWindow
MonitorFromWindow
OffsetRect
GetWindowPlacement
GetThreadDpiAwarenessContext
GetDpiForWindow
EnableWindow
SetPropW
GetAwarenessFromDpiAwarenessContext
MonitorFromRect
SetThreadDpiAwarenessContext
GetWindowLongPtrW
EqualRect
GetWindowLongW
IsZoomed
SetWindowPlacement
IsIconic
GetWindow
GetWindowRect
GetClientRect
GetDesktopWindow
GetAncestor
RemovePropW
api-ms-win-rtcore-ntuser-private-l1-1-0
IsWindowInDestroy
api-ms-win-crt-heap-l1-1-0
free
_free_base
_calloc_base
calloc
malloc
_callnewh
api-ms-win-crt-string-l1-1-0
strcpy_s
api-ms-win-crt-math-l1-1-0
pow
ceilf
sqrt
round
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllGetActivationFactory
Name
.text
Size
340KB
Virtual Size
337KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
140KB
Virtual Size
139KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33145,
count=83, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=223, id=1, productName=Unmarked objects,
count=48, id=261, version=33145,
count=12, id=259, version=33145,
count=1, id=256, version=33145,
count=208, id=264, version=33145,
count=1, id=258, version=33145,
Microsoft.UI.Xaml.Controls.dll
- IMPHASH 1b39d10086a89f98a8bdc73e8b811106
- SHA256 784f355a9fe86a4abedcf5f1c25bafe6604a9df638aff66608fd4f70204586ee
- MD5 e3fe655aae86b1d9ab2df68ef47059c6
- SHA1 287aa4951c7e76912bb92a23d7c35267c942acce
- SHA512 4793cc7d74a31afc51486ba458f356a8b02700cf6ae5a2a271ddd80a80738de0589f8cbc7737a1c9bd5deb129f87c502ad8d7027dfc0ee1d0e4c92aea15ef859
- SSDEEP 196608:hF0Oex4JntNE5CccN8lRVhOHXSv+9O6iPjygRIkZw5I0iwfgeXOKrQsuQfXEJjwo:hF0Oex4htNRbN8lRVhOHXSv+9O6iPjyg
- TLSH T132666B4AA5B917E8D0F8E9BCD6A3481BF4B278698335DBCF0175412A0F2B7F1493E611
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
73:f5:bb:45:3e:dd:ca:63:6d:8b:ba:99:54:05:c8:f9:4f:08:61:86:0c:57:35:41:9c:69:4e:7b:2e:c3:7b:3f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 24, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1c:fa:cd:c5:9b:e8:2f:7e:c4:00:00:00:00:02:1c
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:521A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:17:71:fb:2e:a5:af:01:1d:ea:00:01:00:00:02:17
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
2
Major OS version
6
Entry point
908224
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\__w\1\s\BuildOutput\obj\amd64fre\controls\dev\dll\Microsoft.UI.Xaml.Controls.pdb
user32
RegisterClassW
DefWindowProcW
DestroyWindow
CreateWindowExW
PostMessageW
SetWindowPos
GetWindowRect
IsWindow
ClientToScreen
FindWindowExA
GetWindow
RegisterClipboardFormatW
GetSystemMetrics
GetWindowPlacement
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventWriteTransfer
EventSetInformation
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetUserDefaultLocaleName
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
CompareStringOrdinal
api-ms-win-core-com-l1-1-0
CoGetObjectContext
CoCreateInstance
CoTaskMemFree
CoGetApartmentType
CoCreateGuid
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolWait
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolWait
TrySubmitThreadpoolCallback
CreateThreadpoolWait
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-synch-l1-1-0
ReleaseSemaphore
WaitForSingleObjectEx
CreateEventW
CreateMutexExW
CreateSemaphoreExW
SetEvent
CreateMutexW
ReleaseMutex
OpenSemaphoreW
WaitForSingleObject
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
LoadLibraryExW
FreeLibrary
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-handle-l1-1-0
CloseHandle
d2d1
ord1
api-ms-win-appmodel-runtime-l1-1-0
GetCurrentPackageInfo
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initialize_onexit_table
_invoke_watson
abort
_wassert
_invalid_parameter_noinfo
_errno
terminate
api-ms-win-crt-string-l1-1-0
strcmp
wcsnlen
strcpy_s
strlen
wcsncmp
iswspace
_wcsdup
towupper
_wcsicmp
api-ms-win-crt-convert-l1-1-0
wcstoul
wcstof
_wtoi
api-ms-win-crt-math-l1-1-0
_fdclass
ceil
_ldsign
_dsign
_fdsign
ceilf
cos
floor
nextafterf
floorf
log
pow
powf
roundf
round
sin
sqrt
atan2
_dclass
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
api-ms-win-crt-heap-l1-1-0
calloc
free
malloc
_callnewh
realloc
api-ms-win-crt-locale-l1-1-0
___lc_locale_name_func
_lock_locales
__pctype_func
___lc_collate_cp_func
___mb_cur_max_func
___lc_codepage_func
_unlock_locales
localeconv
setlocale
kernel32
FreeLibraryWhenCallbackReturns
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwindEx
TryAcquireSRWLockExclusive
GetStringTypeW
SwitchToThread
RaiseException
RtlPcToFileHeader
InitializeSListHead
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
LCMapStringEx
CompareStringEx
oleaut32
SetErrorInfo
GetErrorInfo
SysFreeString
SysAllocString
SysStringLen
DeinitializeMUXC
DllCanUnloadNow
DllGetActivationFactory
DllMain
SendTelemetryOnSuspend
Name
.text
Size
4.5MB
Virtual Size
4.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
314KB
Virtual Size
314KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=260, version=30795,
count=12, id=259, version=35207,
count=12, id=260, version=35207,
count=95, id=261, version=35207,
count=1, id=261, version=30795,
count=60, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=257, version=30795,
count=230, id=1, productName=Unmarked objects,
count=455, id=270, version=35215,
count=1, id=256, version=35215,
count=1, id=255, version=35215,
count=1, id=258, version=35215,
Microsoft.UI.Xaml.Internal.dll
- IMPHASH 6767b5d619e0a1ff9556e237ebb8970a
- SHA256 a0a015738156b74405a1127e3153312e9ca02405d5473c97e927ab8ea244f6f5
- MD5 a48ab26d529a371986890c85373453e9
- SHA1 0ce98ae6de9447ec921de91abe5af18d9e6c00be
- SHA512 434a2f077dab7d9c01f33bc939cc381208210028f2d595d0610904f21143e764b97f3e786df92059b0173e21ceb7061a1a40071112fc481d24f7d7e19957b763
- SSDEEP 24576:E0exR4Za+rzSqpzdkbk9clMplX7+gQM3A6V+ClO:EZzGgilKjMwP
- TLSH T11C158C62D7A910E4D47BD170855B460BFFB0BC86272487CB16B09A461F2BFA15E3E339
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
26:e1:c7:d0:fe:38:6e:8e:78:3e:eb:05:1b:34:eb:bb:e8:d6:8c:86:85:4d:fd:3e:74:c5:fa:71:10:ec:c3:c3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 24, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1c:fa:cd:c5:9b:e8:2f:7e:c4:00:00:00:00:02:1c
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:14:8d:cd:23:44:ee:06:df:72:00:01:00:00:02:14
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
718784
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\__w\1\b\Obj\x64fre\Microsoft.UI.Xaml.Internal\Microsoft.UI.Xaml.Internal\Microsoft.UI.Xaml.Internal.pdb
api-ms-win-crt-runtime-l1-1-0
_cexit
terminate
_errno
_initterm
_initialize_onexit_table
_initterm_e
abort
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_execute_onexit_table
_invalid_parameter_noinfo
api-ms-win-crt-string-l1-1-0
wcsncmp
strcpy_s
strcmp
iswspace
strlen
kernel32
GetProcAddress
MultiByteToWideChar
GetProcessHeap
HeapFree
LoadLibraryExW
HeapAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
InterlockedFlushSList
RtlPcToFileHeader
RaiseException
GetLastError
SetLastError
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
FormatMessageW
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
calloc
free
oleaut32
GetErrorInfo
SysAllocString
SysFreeString
SetErrorInfo
ColorHelper_ToDisplayNameId
CreateSimpleLsObject
DestroySimpleLsObject
InitializeReverseInit
IsOrientationSupportedLegacy
LsAllocMemory
LsAssert
LsCompressSubline
LsCreateContext
LsCreateLine
LsCreateLineGivenBreak
LsCreateParaBreakingSession
LsDebugViewLine
LsDebugViewSubline
LsDestroyBreakRecord
LsDestroyContext
LsDestroyLine
LsDestroyMemory
LsDestroyParaBreakingSession
LsDestroySublineIteratorBidi
LsDisplayLine
LsDisplaySubline
LsDuplicateBreakRecord
LsEnumLine
LsEnumSubline
LsExpandSubline
LsFindMasterSubline
LsFinishCurrentSubline
LsGetHihLsimethods
LsGetInlineBlockLsimethods
LsGetLineBreaks
LsGetMathLsimethods
LsGetMinMaxDurUntilHardBreak
LsGetNextDnodeInSublineBidi
LsGetNextSpanSubline
LsGetPenaltyModule
LsGetReverseLsimethods
LsGetRubyLsimethods
LsGetStretchabilityForLine
LsGetTatenakayokoLsimethods
LsGetVRubyLsimethods
LsGetWarichuLsimethods
LsLwMultDivR
LsMatchPresSubline
LsModifyLineHeight
LsNewSublineIteratorBidi
LsNotReached
LsPointUV2FromPointUV1
LsPointXYFromPointUV
LsQueryCpPpointSubline
LsQueryEnumAutonum
LsQueryEnumBorderDnode
LsQueryEnumCharRunArrays
LsQueryEnumDnode
LsQueryEnumFrontierDnode
LsQueryEnumGlyphRunArrays
LsQueryEnumHih
LsQueryEnumInlineBlock
LsQueryEnumLine
LsQueryEnumMathAccent
LsQueryEnumMathBox
LsQueryEnumMathBoxedFormula
LsQueryEnumMathDelimiters
LsQueryEnumMathDelimitersWithSeparators
LsQueryEnumMathDelimitersWithSeparatorsPart
LsQueryEnumMathEquation
LsQueryEnumMathEquationArray
LsQueryEnumMathFraction
LsQueryEnumMathFunctionApply
LsQueryEnumMathGeneral
LsQueryEnumMathLeftSubSuperScript
LsQueryEnumMathList
LsQueryEnumMathLowerLimit
LsQueryEnumMathMarshal
LsQueryEnumMathMatrix
LsQueryEnumMathMatrixCell
LsQueryEnumMathMatrixColumn
LsQueryEnumMathMatrixRow
LsQueryEnumMathNaryOperator
LsQueryEnumMathOperatorCharacter
LsQueryEnumMathOverBar
LsQueryEnumMathPhantom
LsQueryEnumMathRadical
LsQueryEnumMathSlashedFraction
LsQueryEnumMathStack
LsQueryEnumMathStretchStack
LsQueryEnumMathSubScript
LsQueryEnumMathSubSuperScript
LsQueryEnumMathSuperScript
LsQueryEnumMathUnderBar
LsQueryEnumMathUpperLimit
LsQueryEnumMathZone
LsQueryEnumPenDnode
LsQueryEnumRealDnode
LsQueryEnumReverse
LsQueryEnumRuby
LsQueryEnumSubline
LsQueryEnumTab
LsQueryEnumTatenakayoko
LsQueryEnumText
LsQueryEnumVRuby
LsQueryEnumWarichu
LsQueryLineCpPpoint
LsQueryLineDown
LsQueryLineDup
LsQueryLineMaxDepth
LsQueryLinePointPcp
LsQueryLinePointToSpan
LsQueryLineUp
LsQueryLineVisibilityWord
LsQueryLineVisibleRectangle
LsQueryNumberSpanBoxes
LsQueryPointPcpSubline
LsQuerySpanBoxes
LsQuerySpanInfo
LsQuerySpanTotalRelativeOffset
LsQuerySublineDown
LsQuerySublineUp
LsQueryTextCellDetails
LsReallocMemory
LsSetDebugFlags
LsSqueezeSubline
LsTransformRectangle
LsUpdateBreakRecord
LsdnDistribute
LsdnFinishByCurrentPosition
LsdnFinishSimple
LsdnFinishWordRegular
LsdnFinishWordRegularAddAdvancePen
LsdnGetDup
LsdnModifyParaEnding
LsdnQueryPenNode
LsdnResetObjDim
LsdnResetPenNode
LsdnSetAbsBaseLine
LsdnSetRigidDup
LsmsrvFIsOperator
LsmsrvGetBreakingQualityForOperatorCharacter
LsmsrvGetBuildupClass
LsmsrvGetSpacing
LsmsrvGetSpacingClassAsDifferential
LsmsrvGetSpacingClassAsMathOp
LsmsrvGetSpacingClassAsSubformula
LsmsrvGetSpacingClassAsText
LsmsrvGetSpacingClassForOperatorCharacter
LsmsrvGetSpacingClassForRegularFunction
LssbDistributeInSubline
LssbFDoneDisplay
LssbFDonePresSubline
LssbGetDupSubline
LssbGetDurTrailInSubline
LssbGetDurTrailWithPensInSubline
LssbGetNumberDnodesInSubline
LssbGetObjDimSubline
LssbGetPlsrunsFromSubline
LssbGetVisibleDcpInSubline
LsusrvCanBreakAfterChar
LsusrvCanBreakBeforeChar
LsusrvCompOnRun
LsusrvCompSpace
LsusrvExpOnRun
LsusrvExpSpace
LsusrvGetBreakingClass
LsusrvGetBreakingClassForDictionary
LsusrvGetBreakingInfo
LsusrvGetCharCompInfoFullMixed
LsusrvGetCharExpansionInfoFullMixed
LsusrvGetCompressionInfo
LsusrvGetExpanInfo
LsusrvGetGlyphCompInfoFullMixed
LsusrvGetGlyphExpansionInfoFullMixed
LsusrvGetModWidthClassWarichuCloseParen
LsusrvGetModWidthClassWarichuOpenParen
LsusrvGetModWidthClasses
LsusrvGetModWidthPairsInfo
LsusrvGetNumberBreakingUnitsClasses
LsusrvGetNumberCompUnits
LsusrvGetNumberExpanUnits
LsusrvGetNumberModPairUnits
LsusrvGetNumberModWidthClasses
LsusrvGetNumberOfPriorities
LsusrvModWidthOnRun
LsusrvModWidthSpace
dvl
dvs
dvsq
Name
.text
Size
719KB
Virtual Size
719KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
161KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=260, version=30795,
count=9, id=259, version=35207,
count=10, id=260, version=35207,
count=36, id=261, version=35207,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30795,
count=72, id=1, productName=Unmarked objects,
count=157, id=265, version=35215,
count=1, id=256, version=35215,
count=1, id=255, version=35215,
count=1, id=258, version=35215,
Microsoft.UI.Xaml.Phone.dll
- IMPHASH 6a2c9b10c0140239971976e515acefe1
- SHA256 ba9a7846afa3f1c882f1f98b3ac3be6fd905aa7ddc9b56f2fd4028f7f1d5a123
- MD5 6c1218c6bbc644a5c6c9d5ff0899dbc6
- SHA1 39c3579a75c867959a443c4401991d82308cba58
- SHA512 d4ef63f4e37ee41f26a94ecca75b677c23d46c2eadd60cea1e03fcebf7b6e6c5ae8dead5eedaaa4c0c6ebbd16d313e00f2ff3d5ee2bf3777100b35214999ae97
- SSDEEP 24576:28yAEeo/dKhn1mXyV80NN3J2Q7jpbrQtY3XRgIi7:28yAEeo/dawy5H3Jn3XRna
- TLSH T16135E74316ED0952D5BCE27C9593595EFA71B8422372BACB02A4025D8F3FBD18E3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
65:45:03:e7:71:71:3e:f1:2b:af:da:c3:cb:3e:b3:e2:36:7e:9a:e3:cf:66:02:ad:53:a9:0e:a3:ba:ce:95:c1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 24, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1d:4d:19:c8:4e:d7:0f:57:48:00:00:00:00:02:1d
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:2b:bb:00:50:ff:4d:3b:9a:a1:00:01:00:00:02:2b
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
17056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\__w\1\s\BuildOutput\obj\amd64fre\dxaml\xcp\dxaml\dllsrv\exts\phone\Microsoft.UI.Xaml.Phone.pdb
kernel32
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
DisableThreadLibraryCalls
DecodePointer
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EncodePointer
ReleaseSRWLockShared
WaitForSingleObjectEx
InitOnceExecuteOnce
RtlCaptureContext
RaiseException
RaiseFailFastException
OutputDebugStringW
GetLastError
FormatMessageW
OpenSemaphoreW
GetModuleFileNameW
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
GetModuleHandleExW
ReleaseSemaphore
SetLastError
HeapFree
CreateSemaphoreExW
AcquireSRWLockShared
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
RtlPcToFileHeader
InterlockedFlushSList
RtlUnwindEx
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
RtlCaptureStackBackTrace
GetSystemTimeAsFileTime
LoadLibraryExW
FreeLibrary
FindResourceExW
LoadResource
LockResource
InitializeSRWLock
SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolTimer
WakeAllConditionVariable
SleepConditionVariableSRW
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
TryAcquireSRWLockExclusive
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
LCMapStringEx
advapi32
EventWriteTransfer
TraceEvent
RegGetValueW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
EventSetInformation
EventRegister
EventUnregister
ole32
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoGetApartmentType
CoTaskMemFree
StringFromGUID2
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
SetRestrictedErrorInfo
RoOriginateError
RoOriginateErrorW
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsConcatString
WindowsIsStringEmpty
WindowsCompareStringOrdinal
WindowsCreateStringReference
WindowsDeleteString
WindowsDuplicateString
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
_invoke_watson
terminate
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_errno
_initterm
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
abort
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
__stdio_common_vsprintf_s
api-ms-win-crt-heap-l1-1-0
calloc
realloc
malloc
free
api-ms-win-crt-math-l1-1-0
frexp
ceilf
floor
api-ms-win-crt-string-l1-1-0
wcsnlen
strcpy_s
strcmp
_wcsdup
wcsncmp
_wcsnicmp
strcspn
strlen
api-ms-win-crt-locale-l1-1-0
___lc_locale_name_func
_unlock_locales
setlocale
___mb_cur_max_func
__pctype_func
localeconv
___lc_codepage_func
_lock_locales
oleaut32
SetErrorInfo
GetErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoClearError
microsoft.internal.frameworkudk
Mui_PropagateApplicationLanguages
shlwapi
PathRemoveFileSpecW
PathIsRelativeW
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
GetDependencyLocatorStorage
SendTelemetryOnSuspend
XamlControlsGetDatePickerSelection
XamlControlsGetListPickerSelection
XamlControlsGetTimePickerSelection
XamlControlsTestHookCreateLoopingSelector
XamlTestHookFreePhoneResourceLibrary
Name
.text
Size
815KB
Virtual Size
815KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
171KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=11, id=260, version=35207,
count=2, id=257, version=33145,
count=1, id=263, version=30795,
count=28, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=260, version=30795,
count=11, id=257, version=30795,
count=217, id=1, productName=Unmarked objects,
count=70, id=261, version=35207,
count=75, id=270, version=35215,
count=1, id=256, version=35215,
count=1, id=255, version=35215,
count=1, id=258, version=35215,
Microsoft.UI.dll
- IMPHASH 94b80d3bad647f9e422306129613d876
- SHA256 0e9fdf6cb5842edd5ee7dc92ae5e73e5249a4b22db77f5d2860a66d61c08b9ce
- MD5 509f836757152f75b5bac7ced62c10f4
- SHA1 e36465fdbd30914600b8127f4f13380487fae575
- SHA512 c479b745f085c0f3415a1072098a850d80525905e281cfebfd336cae69da62acbab5e40ece1de1eb925ab5bf89ee42ca0ef7900ee3f094e092a32c2263562531
- SSDEEP 3072:0RK73i3Td7q3FfOnvmttt4LKd3vXdLTRKlPb:mx3Tl4WnZLKrTy
- TLSH T17104C43EBFA445F1D1355438D5E28A0CB7B2A0E25B3157DB4306832D9F13AEEAC35A51
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7a:0f:82:4f:2d:3d:3c:a7:f3:38:83:01:78:ff:eb:3a:a9:88:d0:42:ca:2d:5c:45:22:20:83:1f:f5:5a:75:fb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 14, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:84:98:e2:12:e0:78:a3:31:5d:00:00:00:00:04:84
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:431A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1d:4b:c0:92:87:38:85:7e:39:00:01:00:00:02:1d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5424
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Microsoft.UI.pdb
api-ms-win-crt-runtime-l1-1-0
terminate
_initterm
_invalid_parameter_noinfo
_seh_filter_dll
_errno
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
abort
_invalid_parameter_noinfo_noreturn
_initterm_e
api-ms-win-crt-string-l1-1-0
iswspace
strcpy_s
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal
api-ms-win-core-errorhandling-l1-1-0
RaiseException
GetLastError
SetLastError
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
InitializeCriticalSectionEx
OpenSemaphoreW
WaitForSingleObject
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
CreateMutexExW
CreateSemaphoreExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameA
GetProcAddress
GetModuleHandleExW
FreeLibrary
LoadLibraryExA
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
InitOnceComplete
SleepConditionVariableSRW
InitOnceBeginInitialize
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateError
RoFailFastWithErrorContext
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemInfo
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InterlockedFlushSList
InitializeSListHead
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-rtlsupport-l1-1-0
RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry
api-ms-win-core-fibers-l1-1-0
FlsGetValue
FlsFree
FlsSetValue
FlsAlloc
api-ms-win-core-util-l1-1-0
EncodePointer
ext-ms-win-rtcore-ntuser-sysparams-l1-1-0
SystemParametersInfoW
api-ms-win-appmodel-runtime-l1-1-0
GetCurrentPackageInfo
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
_free_base
_calloc_base
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualProtect
oleaut32
SysStringLen
GetErrorInfo
SetErrorInfo
SysFreeString
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
api-ms-win-core-com-l1-1-1
RoGetAgileReference
DllCanUnloadNow
DllGetActivationFactory
Name
.text
Size
80KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
784B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=11, id=260, version=33145,
count=9, id=259, version=33145,
count=63, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=108, id=1, productName=Unmarked objects,
count=42, id=261, version=33145,
count=1, id=256, version=33145,
count=10, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
Microsoft.Windows.ApplicationModel.Resources.dll
- IMPHASH 0916cb1219079e326366ceebda22f77d
- SHA256 5a6dfdd9ca0940e0ea20c3fbee50841b04f969b86305c66393c8877f59c521b6
- MD5 fad9eff816c2039a3edf572a03e9ff26
- SHA1 4c5b6ef577c70cc4bf9776c85284a2d339b367fd
- SHA512 dd7c09bf6f3a699fd6d75256ffde7cbd7a72c1205e3a0314650eae11b4648fe937846c429e149eb2036c8ba55a568e65fd017480df39ebd1b04cfe4be46dd3ca
- SSDEEP 3072:Ja16pKhRvYg3fKdU24N3zT54FZw3ZNW6f+i6EEKyyHt:O6AF3aNEWXAEKyk
- TLSH T126E33992B1BC41F5E4BBA43EC5D74A05FA72B025432163DB4221833E1F77BD6E93AA50
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
07:3e:45:0a:90:37:9a:5a:82:c5:75:e9:7d:f3:13:99:f4:77:5a:a2:4b:bb:db:51:7d:19:74:df:45:61:1c:a7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 24, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1d:4d:19:c8:4e:d7:0f:57:48:00:00:00:00:02:1d
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:26:35:b4:3e:67:43:93:f6:1f:00:01:00:00:02:26
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
65728
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Microsoft.Windows.ApplicationModel.Resources.pdb
microsoft.internal.frameworkudk
ResourceManager_GetDefaultResourcePathForPackageFullName
mrm
MrmLoadStringOrEmbeddedResourceByIndex
MrmLoadStringOrEmbeddedResource
MrmGetResourceCount
MrmCreateResourceContext
MrmLoadStringResourceFromResourceUri
MrmLoadStringResource
MrmDestroyResourceManager
MrmGetChildResourceMap
MrmCreateResourceManager
MrmDestroyResourceContext
MrmSetQualifier
MrmGetQualifier
MrmGetAllQualifierNames
MrmFreeQualifierNamesOrValues
MrmLoadStringOrEmbeddedResourceByIndexWithQualifierValues
MrmLoadStringOrEmbeddedResourceWithQualifierValues
MrmFreeResource
MrmGetFilePathFromName
kernel32
IsDebuggerPresent
LoadLibraryExW
MultiByteToWideChar
DebugBreak
WideCharToMultiByte
GetModuleHandleW
GetProcessHeap
GetProcAddress
HeapAlloc
GetModuleHandleExW
HeapFree
GetModuleFileNameA
LocalFree
GetLastError
GetFileAttributesW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
FreeLibrary
FormatMessageW
GetCurrentPackageFullName
OutputDebugStringW
GetCurrentThreadId
bcp47mrm
IsWellFormedTag
api-ms-win-crt-private-l1-1-0
_o___stdio_common_vswprintf
_o__callnewh
_o__calloc_base
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__free_base
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__register_onexit_function
_o__seh_filter_dll
_o_abort
_o_free
_o_iswspace
_o_malloc
_o_terminate
_o___std_exception_destroy
_o___std_exception_copy
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InterlockedFlushSList
InterlockedPushEntrySList
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
api-ms-win-core-fibers-l1-1-0
FlsAlloc
FlsGetValue
FlsFree
FlsSetValue
api-ms-win-core-util-l1-1-0
EncodePointer
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
DeleteCriticalSection
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
oleaut32
SysAllocString
SysStringLen
SetErrorInfo
GetErrorInfo
SysFreeString
ole32
CoTaskMemFree
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
DllCanUnloadNow
DllGetActivationFactory
Name
.text
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
924B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=260, version=35724,
count=32, id=261, version=35724,
count=1, id=253, version=35724,
count=12, id=259, version=35724,
count=32, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35724,
count=5, id=257, version=33145,
count=1141, id=1, productName=Unmarked objects,
count=15, id=265, version=35724,
count=1, id=256, version=35724,
count=1, id=255, version=35724,
count=1, id=258, version=35724,
Microsoft.WindowsAppRuntime.Bootstrap.dll
- IMPHASH b1e2ab305645ba3ec8e20fa948a6fc2a
- SHA256 2201517f3eeac2f810b4b14789b6b704ca723853f840f4a34bd7442614710ceb
- MD5 f110d3b981c2c531e96b870f754a4af1
- SHA1 558a6dbb8da3fa73d4f20a8593060d24b1cdad7e
- SHA512 e02d3cfb483822840ebefa34b5741f7d07c7adcfc63dfba00bee04b738de2e8b877fa5953485b0f21a9faebd6e3cb483f7232097bb346477d5b6bc9ff1b28746
- SSDEEP 6144:1As3AvP92f0fl0CmqX5V9ph0lhSMXlBXBWnbsQf:1As3AEsflnmqX53ph0lhSMXlibsU
- TLSH T1C3848D25FBE941EAF027D178D9B74B06FB33308D432156DB026981291F77BE6693A381
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6c:f5:a8:81:34:52:f7:11:b8:3e:97:56:29:33:8b:e8:93:70:bb:f8:bd:e6:77:e8:e8:a3:95:07:2d:35:d7:22
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 24, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1c:fa:cd:c5:9b:e8:2f:7e:c4:00:00:00:00:02:1c
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2D1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:12:d1:08:06:3c:ca:18:4f:aa:00:01:00:00:02:12
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
150688
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Microsoft.WindowsAppRuntime.Bootstrap.pdb
advapi32
EventWriteTransfer
EventUnregister
EventActivityIdControl
DeregisterEventSource
EventSetInformation
EventRegister
ReportEventW
RegisterEventSourceW
GetTokenInformation
GetSidSubAuthority
GetSidSubAuthorityCount
kernel32
GetModuleHandleW
ReleaseSemaphore
SetLastError
GetLastError
OutputDebugStringW
GetCurrentThreadId
FormatMessageW
IsDebuggerPresent
CreateSemaphoreExW
HeapAlloc
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
FreeLibrary
LoadLibraryExW
GetModuleFileNameA
CreateEventExW
GetModuleHandleExW
GetProcAddress
WideCharToMultiByte
DisableThreadLibraryCalls
CloseHandle
GetCurrentPackageFullName
DebugBreak
CreateMutexExW
LoadLibraryW
CompareStringOrdinal
PackageIdFromFullName
OpenPackageInfoByFullName
GetPackageInfo
AddDllDirectory
SetEnvironmentVariableW
GetEnvironmentVariableW
RemoveDllDirectory
GetCurrentProcessId
FormatApplicationUserModelId
GetPackagePathByFullName
FindFirstFileW
OpenSemaphoreW
HeapFree
GetProcessHeap
InitOnceComplete
GetModuleFileNameW
K32GetModuleFileNameExW
WaitForSingleObjectEx
ReleaseMutex
ClosePackageInfo
SetEvent
InitOnceBeginInitialize
FindClose
WaitForSingleObject
ole32
CoCreateInstance
CoCreateGuid
CoTaskMemAlloc
CoTaskMemFree
CoCreateFreeThreadedMarshaler
api-ms-win-core-winrt-error-l1-1-0
GetRestrictedErrorInfo
RoFailFastWithErrorContext
SetRestrictedErrorInfo
oleaut32
SysFreeString
SysAllocString
SysStringLen
SetErrorInfo
GetErrorInfo
user32
MessageBoxW
LoadStringA
rpcrt4
UuidFromStringW
shell32
ShellExecuteExW
api-ms-win-appmodel-runtime-l1-1-1
VerifyPackageFamilyName
api-ms-win-crt-locale-l1-1-0
_lock_locales
_unlock_locales
api-ms-win-crt-private-l1-1-0
_o___stdio_common_vswprintf_s
_o___stdio_common_vswscanf
_o__callnewh
_o__calloc_base
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__dsign
_o__errno
_o__execute_onexit_table
_o__fdsign
_o__free_base
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__ldsign
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o___stdio_common_vswprintf
_o_abort
_o_calloc
_o_free
_o_iswspace
_o_localeconv
_o_malloc
_o_setlocale
_o_terminate
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_codepage_func
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-synch-l1-1-0
CreateEventW
ResetEvent
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-errorhandling-l1-1-0
RaiseException
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InterlockedFlushSList
InitializeSListHead
InterlockedPushEntrySList
api-ms-win-core-memory-l1-1-0
VirtualProtect
VirtualQuery
api-ms-win-core-rtlsupport-l1-1-0
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
api-ms-win-core-fibers-l1-1-0
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExA
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
MddBootstrapInitialize
MddBootstrapInitialize2
MddBootstrapShutdown
MddBootstrapTestInitialize
Name
.text
Size
176KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
185KB
Virtual Size
184KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
668B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=261, version=35207,
count=11, id=260, version=35724,
count=11, id=259, version=35724,
count=38, id=261, version=35724,
count=1, id=253, version=35724,
count=2, id=260, version=33145,
count=1192, id=1, productName=Unmarked objects,
count=57, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=44, id=265, version=35724,
count=1, id=256, version=35724,
count=1, id=255, version=35724,
count=1, id=151,
count=1, id=258, version=35724,
Microsoft.WindowsAppRuntime.dll
- IMPHASH e385bb71d1f79250ba10cc0f4b5129bc
- SHA256 1e225c94e0eb30e9815c788b40ec7523e113ec14ac221f61cdb82dbaf3bc059f
- MD5 b8eb2f0fa79aaeb50a63299852f3997b
- SHA1 9e90f7ed2934dc27ba735bb977ca46f7f71e116c
- SHA512 99e69dd177ecda1569f638e98cdd70e63652eeaa950289fb590650b779b466573ae21af9cc1056e88139ebb4a4fb6943cb5086d903d7ab52012425708f6dfb38
- SSDEEP 49152:z5qWnIeWwpuUWrI17OORcjNx4bngvaaAg8HQdrLzyIRHcFImT/xbsv371pjAFGX4:kTWgvan
- TLSH T114B54A42B1BD81D5D8BBE87ED22B0A12FB3370661334A6D7411543292EA7FE3A23F551
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
39:ac:b5:fb:1c:6d:fd:6a:7e:9f:81:9e:b2:de:e1:7e:28:39:3a:89:61:74:d8:44:6f:67:7d:ef:9a:fb:6d:6b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 24, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1d:4d:19:c8:4e:d7:0f:57:48:00:00:00:00:02:1d
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:23:4f:d9:60:24:53:cf:fe:2b:00:01:00:00:02:23
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
1188384
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Microsoft.WindowsAppRuntime.pdb
advapi32
GetTokenInformation
DeregisterEventSource
ReportEventW
RegisterEventSourceW
EqualSid
RegDeleteKeyExW
GetSidSubAuthority
GetSidSubAuthorityCount
GetLengthSid
CopySid
RegEnumKeyExW
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
MakeSelfRelativeSD
RegQueryInfoKeyW
RegGetValueW
RegEnumValueW
FreeSid
RegDeleteTreeW
ConvertStringSidToSidW
ConvertSecurityDescriptorToStringSecurityDescriptorW
RegQueryValueExW
RegCreateKeyExW
EventActivityIdControl
OpenProcessToken
RegDeleteValueW
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
RegSetValueExW
AllocateAndInitializeSid
CheckTokenMembership
RegCloseKey
RegOpenKeyExW
kernel32
FreeLibrary
ReleaseMutex
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CloseHandle
UnregisterWait
GetProcAddress
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CompareStringOrdinal
GetCurrentProcessId
ResetEvent
CreateThreadpoolWait
DuplicateHandle
OpenProcess
RegisterWaitForSingleObject
CloseThreadpoolTimer
TrySubmitThreadpoolCallback
IsWow64Process2
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
GetModuleHandleExW
DeleteProcThreadAttributeList
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
CreateProcessW
ResumeThread
WaitForSingleObjectEx
GetCommandLineW
OpenEventW
SetEvent
CreateFileMappingW
MapViewOfFile
CreateMutexExW
CreateEventExW
UnmapViewOfFile
GetModuleHandleW
GetCurrentPackageFullName
SetLastError
PackageFamilyNameFromFullName
IsWow64Process
ReadProcessMemory
ExitProcess
VirtualAllocEx
FindPackagesByPackageFamily
RemoveDirectoryW
SetFileInformationByHandle
FindNextFileW
DeleteFileW
SetFileAttributesW
LocalFree
GetFileInformationByHandleEx
CreateFileW
PackageFamilyNameFromId
FindClose
FindFirstFileW
GetFullPathNameW
HeapFree
GetCurrentPackageFamilyName
InitOnceBeginInitialize
LocaleNameToLCID
LoadLibraryW
ReleaseSRWLockShared
AcquireSRWLockShared
GetCurrentApplicationUserModelId
InitOnceComplete
GetModuleFileNameW
WriteProcessMemory
GetProcessHeap
HeapAlloc
MultiByteToWideChar
IsDebuggerPresent
WideCharToMultiByte
CreateThreadpoolTimer
SetThreadpoolTimer
DisableThreadLibraryCalls
LoadLibraryExW
GetFileSizeEx
ReadFile
WriteFile
GetCurrentPackageInfo
GetCurrentThread
GetPackageInfo
FormatMessageW
PackageIdFromFullName
SetEnvironmentVariableW
ClosePackageInfo
GetEnvironmentVariableW
RemoveDllDirectory
OpenPackageInfoByFullName
AddDllDirectory
GetCurrentProcess
FindResourceW
LoadResource
SizeofResource
LockResource
ExpandEnvironmentStringsW
K32GetModuleFileNameExW
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeW
InitializeCriticalSection
GetOverlappedResult
InitOnceExecuteOnce
EnterCriticalSection
LeaveCriticalSection
CancelIoEx
VirtualQueryEx
SetThreadContext
FlushInstructionCache
CreateThreadpool
SetThreadpoolThreadMaximum
SetThreadpoolThreadMinimum
CreateThreadpoolCleanupGroup
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolCleanupGroupMembers
GetThreadContext
VirtualProtectEx
SuspendThread
VirtualAlloc
VirtualFree
RaiseException
SetThreadpoolWaitEx
ReleaseActCtx
CreateActCtxW
QueryActCtxW
CreateEventW
LocalAlloc
OpenSemaphoreW
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
GetModuleFileNameA
DebugBreak
GetPackagePathByFullName
GetExitCodeProcess
GetCurrentThreadId
OutputDebugStringW
GetLastError
GetNamedPipeServerProcessId
WaitNamedPipeW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetFileAttributesW
userenv
DeriveAppContainerSidFromAppContainerName
user32
AllowSetForegroundWindow
wsprintfW
MessageBoxW
SendMessageTimeoutW
LoadStringA
DestroyIcon
ole32
CoRevokeClassObject
CoGetDefaultContext
CoRegisterClassObject
CoGetApartmentType
CoMarshalInterface
CreateStreamOnHGlobal
CoGetMarshalSizeMax
CoReleaseMarshalData
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoGetObjectContext
CoUnmarshalInterface
CoIncrementMTAUsage
StringFromGUID2
CoCreateGuid
CoInitializeEx
CoCreateFreeThreadedMarshaler
CoUninitialize
StringFromCLSID
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
shlwapi
ord213
ord12
PathFindFileNameW
PathIsFileSpecW
SHCreateStreamOnFileEx
api-ms-win-core-path-l1-1-0
PathCchRemoveFileSpec
PathAllocCombine
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference
WindowsCreateString
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
xmllite
CreateXmlReaderInputWithEncodingName
CreateXmlReader
oleaut32
VarDecFix
VarDecFromI8
VarDecRound
VarDecDiv
VarDecAbs
SysAllocString
SysFreeString
VarDecMul
VarDecNeg
VarDecSu
VarBstrFromDec
VarUI4FromDec
VarI4FromDec
VarR8FromDec
VarR4FromDec
VarUI8FromDec
GetErrorInfo
VarUI2FromDec
SetErrorInfo
SysStringLen
VarUI1FromDec
VarI8FromDec
VarI2FromDec
VarDecCmp
VarDecFromUI4
VarDecFromI2
VarDecFromI4
VarDecFromStr
VarDecFromUI1
VarDecFromUI2
VarDecFromUI8
VarDecFromR4
VarDecFromR8
VarDecAdd
VarDecInt
api-ms-win-ro-typeresolution-l1-1-0
RoResolveNamespace
RoGetMetaDataFile
api-ms-win-power-setting-l1-1-1
PowerRegisterForEffectivePowerModeNotifications
PowerUnregisterFromEffectivePowerModeNotifications
api-ms-win-power-base-l1-1-0
PowerUnregisterSuspendResumeNotification
PowerRegisterSuspendResumeNotification
api-ms-win-core-synch-l1-2-0
WakeByAddressSingle
WaitOnAddress
WakeAllConditionVariable
SleepConditionVariableSRW
crypt32
CryptQueryObject
CryptMsgGetParam
CertGetSubjectCertificateFromStore
CertGetEnhancedKeyUsage
CertCloseStore
CertFreeCertificateContext
CryptMsgClose
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
GetRestrictedErrorInfo
RoFailFastWithErrorContext
api-ms-win-appmodel-runtime-l1-1-1
VerifyPackageFamilyName
VerifyPackageFullName
rometadata
MetaDataGetDispenser
api-ms-win-crt-locale-l1-1-0
_unlock_locales
_lock_locales
api-ms-win-crt-string-l1-1-0
wcsnlen
strcmp
wcsncmp
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__calloc_base
_o__cexit
_o__configure_narrow_argv
_o__create_locale
_o__crt_atexit
_o__dsign
_o__errno
_o__execute_onexit_table
_o__fdsign
_o__free_base
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__ldsign
_o__localtime64_s
_o__malloc_base
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__W_Gettnames
_o__wcsdup
_o__Wcsftime
_o__wcsicmp_l
_o_abort
_o_calloc
_o_ceilf
_o_free
_o_iswspace
_o_localeconv
_o_malloc
_o_realloc
_o_setlocale
_o_terminate
_o_towlower
_o_towupper
_o_wcstok_s
_o_wcstoul
_o_wcstoull
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o____mb_cur_max_func
_o___stdio_common_vswprintf
_o____lc_locale_name_func
_o____lc_collate_cp_func
_o____lc_codepage_func
api-ms-win-core-rtlsupport-l1-1-0
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
api-ms-win-core-processthreads-l1-1-0
SwitchToThread
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemInfo
api-ms-win-core-string-l1-1-0
CompareStringEx
GetStringTypeW
api-ms-win-core-localization-l1-2-0
GetLocaleInfoEx
FormatMessageA
LCMapStringEx
api-ms-win-core-file-l1-1-0
CreateDirectoryW
GetFileAttributesExW
api-ms-win-core-file-l1-2-0
CreateFile2
api-ms-win-core-synch-l1-1-0
TryAcquireSRWLockExclusive
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitializeCriticalSectionEx
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-2-0
GetSystemTimePreciseAsFileTime
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolWork
FreeLibraryWhenCallbackReturns
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedFlushSList
InterlockedPushEntrySList
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualProtect
api-ms-win-core-fibers-l1-1-0
FlsGetValue
FlsFree
FlsSetValue
FlsAlloc
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExA
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
GetSecurityDescriptorForAppContainerNames
MddAddPackageDependency
MddDeletePackageDependency
MddGetGenerationId
MddGetIdForPackageDependencyContext
MddGetPackageGraphRevisionId
MddGetResolvedPackageFullNameForPackageDependency
MddGetResolvedPackageFullNameForPackageDependency2
MddLifetimeManagementGC
MddLifetimeManagementTestInitialize
MddRemovePackageDependency
MddTryCreatePackageDependency
MsixInstallLicenses
WindowsAppRuntime_EnsureIsLoaded
WindowsAppRuntime_IsSelfContained
WindowsAppRuntime_VersionInfo_MSIX_Framework_PackageFamilyName_Get
WindowsAppRuntime_VersionInfo_MSIX_Main_PackageFamilyName_Get
WindowsAppRuntime_VersionInfo_TestInitialize
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
883KB
Virtual Size
883KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
65KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
416B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=261, version=35207,
count=13, id=260, version=35724,
count=44, id=261, version=35724,
count=1, id=253, version=35724,
count=13, id=259, version=35724,
count=5, id=260, version=33145,
count=1, id=262, version=33145,
count=87, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1469, id=1, productName=Unmarked objects,
count=173, id=265, version=35724,
count=1, id=256, version=35724,
count=1, id=255, version=35724,
count=1, id=151,
count=1, id=258, version=35724,
Microsoft.ui.xaml.dll
- IMPHASH e4003a8b029095b35e61ce18e1ff1e57
- SHA256 5d908e22d1e55fbfa0b696e3614c0c231f26ff179d1606c58ac39f8be5e64581
- MD5 74c49b6d10ea38a5593cf782abe70c2e
- SHA1 38184575855e3a1292c282ca92b40f87dfb73d4f
- SHA512 7717e9f11f70916702680b8ea2f469458ad57eaaa352fe02c9295bbc9dc5ceb0fd388bc20a7a6c85bb8f8c611e9b34e405e2c51cf969a4e16f82695bd7492c0a
- SSDEEP 196608:0i+kiRC0Az+q9GL+VBXp1SKzwRgfFBmT1jcbZfeCzxi:0i+ki00Az+q9GiVBZ1S+wRgfFMTSbzxi
- TLSH T182E63A0B17ED5591C6B9E238DA2B525EEAB234211372ABCF0174015D8F7FBD28B7D620
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e0:59:08:b5:e3:89:10:ce:b1:f0:93:fc:6c:83:07:b3:bf:dd:0a:66:3a:c5:7b:65:19:b6:85:52:86:bb:83:78
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 24, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1d:4d:19:c8:4e:d7:0f:57:48:00:00:00:00:02:1d
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:23:4f:d9:60:24:53:cf:fe:2b:00:01:00:00:02:23
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
2633072
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\__w\1\s\BuildOutput\obj\amd64fre\dxaml\xcp\dxaml\dllsrv\winrt\native\Microsoft.ui.xaml.pdb
kernel32
AddDllDirectory
RtlCaptureContext
InitOnceBeginInitialize
InitOnceComplete
LoadLibraryW
GetModuleFileNameW
CreateEventExW
TlsAlloc
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitOnceExecuteOnce
IsDebuggerPresent
DebugBreak
SetFilePointerEx
SystemTimeToFileTime
GetFileTime
SetEndOfFile
WriteFile
WideCharToMultiByte
GetFileSizeEx
GetFileAttributesW
GetCurrentPackageInfo
GetModuleHandleW
LocalFree
GetEnvironmentVariableW
HeapReAlloc
ReclaimVirtualMemory
OfferVirtualMemory
VirtualAlloc
VirtualFree
DuplicateHandle
SwitchToThread
GlobalUnlock
GlobalLock
GlobalAlloc
GetCurrentApplicationUserModelId
ReadFile
GetFileSize
RaiseFailFastException
ResolveDelayLoadedAPI
DelayLoadFailureHook
GetWindowsDirectoryW
GetModuleHandleA
GetTimeFormatW
AppPolicyGetWindowingModel
LCIDToLocaleName
WakeAllConditionVariable
GetDynamicTimeZoneInformation
FindNLSStringEx
SleepConditionVariableSRW
FindResourceExW
RtlLookupFunctionEntry
GetThreadTimes
InitializeSRWLock
TlsFree
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentPackageId
ExpandEnvironmentStringsW
SetUnhandledExceptionFilter
TerminateProcess
GetProcessHeap
GetCurrentProcessId
CreateMutexExW
lstrcmpiW
GetProcAddress
HeapAlloc
CloseHandle
InitializeCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
OutputDebugStringW
GetLastError
OpenFileMappingW
IsProcessorFeaturePresent
SetPriorityClass
GetPriorityClass
K32GetProcessMemoryInfo
GetProcessAffinityMask
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
CreateThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
SubmitThreadpoolWork
DecodePointer
GetTickCount
InitializeSListHead
QueryPerformanceCounter
QueryPerformanceFrequency
SetThreadPriority
GetCurrentThread
GetThreadPriority
WaitForMultipleObjectsEx
OpenEventW
SearchPathW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
FormatMessageW
TlsGetValue
TlsSetValue
RtlCaptureStackBackTrace
SetEvent
ResetEvent
GetSystemTimeAsFileTime
ReleaseMutex
LoadLibraryExW
GetVersionExW
Sleep
CreateThread
RaiseException
HeapCreate
RtlPcToFileHeader
InterlockedFlushSList
FreeLibrary
CompareStringEx
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
WaitForSingleObject
GetModuleHandleExW
RtlUnwindEx
MultiByteToWideChar
SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolTimer
InitializeCriticalSectionEx
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CreateEventW
CreateThreadpoolWait
LCMapStringEx
ReleaseSemaphore
CreateFileMappingW
MapViewOfFile
CreateFileW
GetTickCount64
GetTempFileNameW
GetTempPathW
EncodePointer
GetModuleFileNameA
GetSystemInfo
UnmapViewOfFile
ResolveLocaleName
LocaleNameToLCID
GetLocaleInfoEx
CompareStringOrdinal
TryAcquireSRWLockExclusive
GetUserDefaultLCID
LockResource
PowerSetRequest
PowerClearRequest
PowerCreateRequest
ReleaseSRWLockShared
AcquireSRWLockShared
SetLastError
HeapFree
CreateSemaphoreExW
MulDiv
SizeofResource
FindResourceW
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
GetThreadUILanguage
GetCurrentProcess
IsWow64Process2
GetLocaleInfoW
RemoveDllDirectory
LoadResource
GetStringTypeW
CreateMutexW
advapi32
RegQueryInfoKeyW
EventActivityIdControl
EventRegister
EventSetInformation
TraceMessage
RegCloseKey
RegisterTraceGuidsW
RegQueryValueExW
GetTraceEnableLevel
RegOpenKeyExW
EventUnregister
RegGetValueW
GetTraceEnableFlags
GetTraceLoggerHandle
TraceEvent
EventWriteTransfer
RegNotifyChangeKeyValue
RegDeleteValueW
RegCreateKeyExW
RegDeleteKeyW
UnregisterTraceGuids
RegEnumKeyExW
RegSetValueExW
shlwapi
UrlCombineW
UrlCanonicalizeW
ord280
PathRemoveFileSpecW
ord12
PathFileExistsW
PathIsRelativeW
PathFindExtensionW
UrlCreateFromPathW
ord16
PathCreateFromUrlW
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_cexit
terminate
_initterm_e
_initterm
__doserrno
abort
_invalid_parameter_noinfo
_errno
_invoke_watson
_seh_filter_dll
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
__stdio_common_vswprintf
__stdio_common_vswscanf
api-ms-win-crt-string-l1-1-0
wcsnlen
strcmp
_wcsicmp
wcscmp
_wcsdup
strlen
tolower
strcpy_s
wcsncpy_s
iswspace
isalpha
wcsncmp
isspace
_wcsnicmp
iswdigit
wcscpy_s
towlower
api-ms-win-crt-filesystem-l1-1-0
_wsplitpath_s
api-ms-win-crt-convert-l1-1-0
_itow_s
wcstol
wcstoul
_wtoi
_wcstoi64
wcstoll
wcstod
_ultow_s
api-ms-win-crt-math-l1-1-0
sinf
sin
_isnan
powf
lroundf
pow
logf
ceilf
cos
cosf
exp
floor
floorf
ceil
atan2f
_finite
_fdclass
sqrtf
log
tanf
roundf
round
api-ms-win-crt-heap-l1-1-0
realloc
calloc
_recalloc
malloc
free
microsoft.internal.frameworkudk
MediaPlayerExtension_AddCastingRenderLocationChanged
MediaPlayerExtension_GetCurrentMediaPlaybackItem
MediaPlaybackDataSourceExtension_SendPlaybackRateChangeRequest
TextInput_SetKeyboardSkin
FrameworkInputView_RegisterListener
MediaPlaybackDataSourceExtension_SendMediaPlaybackCommand
MediaPlaybackDataSourceExtension_SendRepeatModeChangeRequest
FrameworkInputView_UnregisterListener
Windowing_GetWindowFromWindowId
MediaPlayerExtension_AddIsLoopingEnabledChanged
MediaPlayerExtension_RemoveIsLoopingEnabledChanged
MediaPlaybackListExtension_AddAutoRepeatChanged
MediaPlaybackListExtension_RemoveAutoRepeatChanged
MediaPlaybackSessionExtension_IsPlaybackRateSupported
AudioGraphSettingsExtension_SetUseSpatialAudioApi
WindowPositionChanged_RegisterListener
WindowPositionChanged_UnregisterListener
VisualDiagnosticsPort_Register
VisualDiagnosticsPort_Unregister
BackButtonIntegration_InjectBackButtonPress
TextAnalysis_SetLocaleNameList
TextAnalysis_GetContentReadingDirection
Theming_TryEnableHostBackdropBrush
Mui_GetFontFallbackLanguageList
MediaPlayerExtension_GetVideoSwapchainHandle
Windowing_GetWindowIdFromWindow
FinalUnhandledErrorDetected_RegisterHandler
FinalUnhandledErrorDetected_UnregisterHandler
MediaPlayerExtension_RemoveCastingRenderLocationChanged
MediaPlayerExtension_GetMediaPlayerCastingRenderLocation
TextInput_SetTextPrediction
TextInputProxy_putInputSettings
BackButtonIntegration_RegisterListener
TextAnalysis_CreateDWritePrivateTextAnalysisSourceProxy
BackButtonIntegration_UnregisterListener
TimedMetadataTrackExtension_RemoveCueEntered
InputPaneFramework_Advise
Mui_PropagateApplicationLanguages
TimedMetadataTrackExtension_AddCueEntered
InputPaneFramework_RegisterListener
InputPaneFramework_UnregisterListener
MediaPlaybackDataSourceExtension_SendPlaybackPositionChangeRequest
microsoft.ui.windowing.core
ContentPreTranslateMessage
urlmon
CreateIUriBuilder
CreateUri
CreateURLMonikerEx
RegisterBindStatusCallback
oleaut32
SetErrorInfo
VarUI4FromStr
SafeArrayCreateVector
SafeArrayPutElement
GetErrorInfo
SysAllocString
VariantClear
SafeArrayGetDim
SysAllocStringLen
SafeArrayDestroy
SafeArrayGetVartype
SafeArrayGetLBound
VariantInit
SysStringLen
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayUnlock
SafeArrayLock
VariantChangeType
CreateErrorInfo
SysFreeString
api-ms-win-core-winrt-string-l1-1-0
WindowsTrimStringEnd
WindowsSubstringWithSpecifiedLength
WindowsTrimStringStart
WindowsCreateStringReference
WindowsDeleteString
WindowsConcatString
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsCompareStringOrdinal
WindowsPromoteStringBuffer
WindowsPreallocateStringBuffer
WindowsDeleteStringBuffer
WindowsGetStringLen
WindowsDuplicateString
WindowsIsStringEmpty
WindowsCreateString
ole32
CoCreateFreeThreadedMarshaler
CoWaitForMultipleHandles
CreateStreamOnHGlobal
CoTaskMemAlloc
StringFromCLSID
OleUninitialize
OleInitialize
CoTaskMemFree
CreateBindCtx
CoInitializeEx
CoUninitialize
CoTaskMemRealloc
CoCreateInstance
CoGetApartmentType
PropVariantClear
CoCreateGuid
CLSIDFromString
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoGetActivationFactory
RoActivateInstance
RoUninitialize
rpcrt4
UuidToStringW
RpcStringFreeW
UuidCreate
user32
GetWindowThreadProcessId
IsWindow
SystemParametersInfoW
GetSystemMetrics
GetCaretBlinkTime
GetDC
ReleaseDC
ClientToScreen
ScreenToClient
ReleaseCapture
SetCapture
GetDesktopWindow
IsClipboardFormatAvailable
SetWindowTextW
SetTimer
GetWindowLongW
EnumDisplaySettingsW
GetMessageTime
IsChild
OffsetRect
GetFocus
GetWindowRect
GetDpiForWindow
InflateRect
PostMessageW
GetKeyboardState
GetClientRect
SetWindowPos
DefWindowProcW
IsRectEmpty
EqualRect
GetWindowLongPtrW
RegisterClassW
DestroyWindow
EnableMouseInPointer
SetWindowLongPtrW
EnumDisplayDevicesW
FindWindowW
CharNextW
PeekMessageW
CreateWindowExW
PostQuitMessage
GetMessageW
TranslateMessage
DispatchMessageW
MsgWaitForMultipleObjects
SendMessageW
ShowWindow
RedrawWindow
RegisterWindowMessageW
CallWindowProcW
SetWindowLongW
GetSysColor
ToUnicodeEx
RegisterClassExW
LoadCursorW
GetParent
VkKeyScanExW
MonitorFromRect
GetMonitorInfoW
PtInRect
GetCursorPos
GetClassInfoExW
MonitorFromWindow
BeginPaint
EndPaint
TrackPopupMenuEx
SetMenuDefaultItem
GetSystemMenu
SetMenuItemInfoW
KillTimer
GetWindowPlacement
IsIconic
IsWindowVisible
GetWindowTextLengthW
GetWindowTextW
IsZoomed
UpdateWindow
SetActiveWindow
GetKeyboardLayout
SetFocus
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateErrorW
RoGetErrorReportingFlags
GetRestrictedErrorInfo
SetRestrictedErrorInfo
RoOriginateError
gdi32
SetDIBitsToDevice
DeleteObject
CreateRectRgn
StartPage
GetMapMode
SetMapMode
GetRegionData
CombineRgn
DPtoLP
StretchDIBits
SetBkColor
EndPage
ExtTextOutW
dwrite
DWriteCreateFactory
d3d11
D3D11CreateDevice
api-ms-win-power-setting-l1-1-0
PowerSettingRegisterNotification
PowerSettingUnregisterNotification
api-ms-win-core-path-l1-1-0
PathCchAppend
PathCchCombineEx
api-ms-win-ro-typeresolution-l1-1-0
RoParseTypeName
version
GetFileVersionInfoSizeW
VerQueryValueA
GetFileVersionInfoW
api-ms-win-dx-d3dkmt-l1-1-0
GdiEntry13
api-ms-win-core-winrt-error-l1-1-1
RoReportUnhandledError
RoOriginateLanguageException
uxtheme
CloseThemeData
GetThemeAnimationTransform
GetThemeAnimationProperty
OpenThemeData
GetThemeTimingFunction
ntdll
RtlConvertDeviceFamilyInfoToString
RtlGetDeviceFamilyInfoEnum
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
___lc_collate_cp_func
___lc_locale_name_func
setlocale
_unlock_locales
_lock_locales
___mb_cur_max_func
__pctype_func
d2d1
ord1
DllCanUnloadNow
DllGetActivationFactory
DllMain
GetErrorContextIndex
GetHeapHandle
OverrideXamlMetadataProvider
OverrideXamlResourcePropertyBag
XamlCheckProcessRequirements
Name
.text
Size
9.9MB
Virtual Size
9.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
57KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
579KB
Virtual Size
578KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
158KB
Virtual Size
157KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
504KB
Virtual Size
504KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=13, id=260, version=35207,
count=1, id=262, version=30795,
count=5, id=261, version=35215,
count=11, id=260, version=30795,
count=1, id=263, version=30795,
count=59, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=257, version=30795,
count=4, id=257, version=33145,
count=601, id=1, productName=Unmarked objects,
count=73, id=261, version=35207,
count=1522, id=270, version=35215,
count=1, id=256, version=35215,
count=1, id=255, version=35215,
count=1, id=258, version=35215,
Microsoft.ui.xaml.resources.19h1.dll
- SHA256 dd0a3df9a48893fdbd8dde096bc158970f4580bac74d5fc3b4d849a64cb2a407
- MD5 169503b343a53a292db3ac00d6f10753
- SHA1 f1d38015be8c72ba60600ee510f04004da645683
- SHA512 e218eee5abc9eaf2e26becc55a6a06b866135d9daaaab6a48ea188b3d252b6c4d4b6bb39674f9237f1ba41f0a5f16be28b1477f055414d73ec6e6d5efb849426
- SSDEEP 6144:A33u9Ra+DIY8EGc0aeGPh46AdtUJyDJAg0ZCzstVskoud:43ufIY8EUdAzVskZ
- TLSH T111C40D01E7FB1648F2F76AB06FFA496418B3BE536E31C07F40141A4E0A72F859A95763
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
db:36:8c:85:f8:23:79:4f:e9:12:06:a2:d5:32:11:a1:d4:27:05:21:22:31:9e:8f:33:a9:04:4b:13:f2:2f:a4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 24, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1d:4d:19:c8:4e:d7:0f:57:48:00:00:00:00:02:1d
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:2b:bb:00:50:ff:4d:3b:9a:a1:00:01:00:00:02:2b
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
542KB
Virtual Size
541KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=35215,
count=1, id=258, version=35215,
Microsoft.ui.xaml.resources.common.dll
- SHA256 68179388e46d5f0202238545d10e2656aa3f6d3aa4847659faa6b06c38a8883e
- MD5 1bb73008f1c6fbc61c12344b038fd94d
- SHA1 3d408fd68b7b4277862466b15ce4bf72133d9db1
- SHA512 e01ee31a1d97dced0a41602611272f14b7ad086f32c998a38890bdcbce548315d12f0f886f62c75c07b330807df7b8e91dc99b571a83d5789404b1a83ff3f168
- SSDEEP 768:QWmEEdKuC0eJ1MH5+1RNMoy0CW7SaDWKFxGd1HUBsUbAz79zA:QWmEEcuVQiHaQHpGDBsUERzA
- TLSH T10633865067F95208FAF73F74AEB95A644E7ABD9AAD79C21D1210904E0972F40CDB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
3c:d9:3e:8c:4b:46:39:9e:ba:cc:b4:fb:d8:42:c4:5d:b4:ba:ee:f6:97:58:0d:34:dd:5f:68:49:7e:7a:98:c7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 24, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1d:4d:19:c8:4e:d7:0f:57:48:00:00:00:00:02:1d
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:25:80:c7:37:c6:cd:aa:77:49:00:01:00:00:02:25
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=35215,
count=1, id=258, version=35215,
Vain Governor UI.exe
- IMPHASH 4aa856b7f054b7f06dda3bebc0933f1f
- SHA256 0f622993db6e219298e74cdb89e3f7438c9f5259b867e8097f781230ab37bd18
- MD5 f736dcb2f83c8f74243ba589a3d6a868
- SHA1 8586427dfaf1dedf1003d379e8fc30b0a6b5fcc4
- SHA512 87731edfd8e0eb45e8530455663a88d24d1d64d483eadc10be41fee6b9a5799b4ee0509b11233cc1d393cad54ecc2f98e255ef27ae75dae99b4abd8dd831620d
- SSDEEP 24576:IcUlfU5bDcipwUXxaOHSuH1tMAMPq0WQtIR8Tf:rUlqDccwWDXbMbWQtIuf
- TLSH T115953C4172A422F9E4AB9178851ADD3AEE323CC68734D7D738F14E1B7E236D19EB9101
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
6
Entry point
806656
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetCurrentProcess
ExitProcess
CreateMutexW
GetSystemCpuSetInformation
CreateToolhelp32Snapshot
OpenProcess
GetProcessDefaultCpuSets
GetPriorityClass
SetPriorityClass
GetProcessAffinityMask
SetProcessAffinityMask
GetProcessInformation
SetProcessInformation
GetProcessPriorityBoost
SetProcessPriorityBoost
SetProcessDefaultCpuSets
LocalFree
SetLastError
GetTickCount64
SetProcessWorkingSetSize
UnmapViewOfFile
OpenFileMappingW
MapViewOfFile
TerminateProcess
GetSystemTimes
GlobalMemoryStatusEx
GetCurrentProcessId
QueryFullProcessImageNameW
OpenThread
Process32FirstW
Process32NextW
WaitForSingleObject
Sleep
OpenEventW
SetEvent
GetSystemTime
CreateFileW
GetProcAddress
GetFileSizeEx
GetLastError
Module32FirstW
Module32NextW
GetThreadId
Thread32First
Thread32Next
SetThreadPriority
SetThreadPriorityBoost
SuspendThread
ResumeThread
TerminateThread
GetThreadPriority
GetThreadPriorityBoost
GetThreadDescription
GetThreadIdealProcessorEx
SetThreadIdealProcessorEx
SetThreadSelectedCpuSets
SetThreadAffinityMask
GetThreadSelectedCpuSets
LoadLibraryExW
HeapAlloc
InterlockedFlushSList
EncodePointer
TrySubmitThreadpoolCallback
MultiByteToWideChar
FreeLibrary
InterlockedPushEntrySList
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
SetUnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
OutputDebugStringW
FormatMessageW
GetCurrentThreadId
CloseHandle
IsDebuggerPresent
DebugBreak
WideCharToMultiByte
GetModuleHandleW
ReadFile
GetProcessHeap
GetModuleHandleExW
HeapFree
WriteFile
GetModuleFileNameA
user32
SendMessageW
ReleaseDC
MapVirtualKeyW
DrawIconEx
DestroyIcon
SetForegroundWindow
SetWindowLongPtrW
GetKeyNameTextW
SetWindowPos
LoadImageW
GetSystemMetrics
ShowWindow
GetWindowLongPtrW
FindWindowW
GetDC
MessageBoxW
GetKeyState
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegCloseKey
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegDeleteTreeW
RegCopyTreeW
RegEnumKeyExW
RegEnumValueW
RegDeleteValueW
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
api-ms-win-security-base-l1-1-0
AdjustTokenPrivileges
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-com-l1-1-0
CoGetApartmentType
CoGetObjectContext
CoCreateFreeThreadedMarshaler
CoInitializeEx
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
api-ms-win-service-management-l1-1-0
OpenSCManagerW
api-ms-win-core-registry-l2-1-0
RegDeleteKeyW
crypt32
CryptBinaryToStringW
CryptStringToBinaryW
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_counter
_Query_perf_frequency
_Thrd_yield
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
_Mtx_lock
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_unlock
advapi32
CloseServiceHandle
EnumServicesStatusExW
dwmapi
DwmSetWindowAttribute
gdi32
CreateCompatibleDC
DeleteDC
SelectObject
GdiFlush
DeleteObject
CreateDIBSection
shell32
SHGetFileInfoW
ShellExecuteExW
ShellExecuteW
comdlg32
GetOpenFileNameW
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
__current_exception
memset
_CxxThrowException
__std_type_info_destroy_list
__current_exception_context
memmove
__C_specific_handler
__std_exception_destroy
__std_exception_copy
__std_terminate
_purecall
wcsrchr
memcmp
api-ms-win-crt-runtime-l1-1-0
_exit
_invalid_parameter_noinfo
_errno
_register_thread_local_exe_atexit_callback
abort
_configure_wide_argv
_get_wide_winmain_command_line
_set_app_type
_seh_filter_exe
_initterm_e
_initterm
terminate
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_c_exit
_initialize_wide_environment
exit
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
_set_new_mode
api-ms-win-crt-string-l1-1-0
_wcsicmp
wcscmp
iswspace
towupper
strlen
wcslen
towlower
wcsncpy_s
api-ms-win-crt-stdio-l1-1-0
__p__commode
__stdio_common_vswprintf
__stdio_common_vswprintf_s
_set_fmode
api-ms-win-crt-convert-l1-1-0
_wcstoui64
wcstoul
_wtoi
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
floor
ceilf
__setusermatherr
oleaut32
SysStringLen
SetErrorInfo
SysFreeString
GetErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-error-l1-1-0
RoFailFastWithErrorContext
RoTransformError
api-ms-win-core-com-l1-1-1
RoGetAgileReference
DllGetActivationFactory
VSDesignerCanUnloadNow
VSDesignerDllMain
Name
.text
Size
1000KB
Virtual Size
999KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
341KB
Virtual Size
340KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
286KB
Virtual Size
289KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
314KB
Virtual Size
313KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=259, version=35721,
count=10, id=260, version=35721,
count=36, id=261, version=35721,
count=6, id=257, version=35721,
count=1, id=260, version=33145,
count=42, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=257, version=33145,
count=272, id=1, productName=Unmarked objects,
count=13, id=265, version=36260,
count=1, id=256, version=36260,
count=1, id=255, version=36260,
count=1, id=151,
count=1, id=258, version=36260,
Vain Governor UI.pri
- SHA256 c27bb16a2ce63b6b33f10e06f853d367b91cecb2ccd232bacf8a3fe1f55523f6
- MD5 17360f8f196fbcdab7ab255f1fbb9d5b
- SHA1 22a72a6e2ef4dbaba10afe7da2c7253c4d04a4ce
- SHA512 882ba657c2dee900e6d6c106339a31fd48d0e514ac9ca968cedc74f1c55146d1d9d296cf11d156cc6c3d7bf2498e79be4f96f566a5364ec0af63eb91ee90732f
- SSDEEP 12288:ZkG4N94Z30MF7kM4zsRPcOvzdt6XPBxHJ+fE2WShPCUu25etNrO:JHIxzsRPHqcU25ey
- TLSH T192556201E3F70208FAF77AB1AEBA4B2568B6BE165931C07F1044570E2E72B455AF5723
- MD5 SHA1 SHA512 SSDEEP TLSH
Vain Toolbox.exe
- IMPHASH 9dd74aa01c69c862d6a5f0cfed744d41
- SHA256 1b86a89d32de5d055c140b55db30934793f351c00b73e50f6bab710bd0f4aa2b
- MD5 6619f7983847ece1a325d40efba47e31
- SHA1 155a2cd281b0df89c6adb36fbb7e11fbab92b176
- SHA512 c446c1740e0179db8e282270726879616fe1d2ea3b45c7c3adad2a84322bca421c9ec503edd238dac5816894d52c1dcb304de69fc9f273bbe02af157e3911fe6
- SSDEEP 98304:vVKkHGAn3HR7eBtFte1Z+pjh60ujqQRGADo1DKCk7igX:vVXHFn3cBtFt+Z+thaqQPcplbg
- TLSH T137C67C50B9E4A1E0E0FBD1395A7B6556EA3671C743B1CAEB3C9D43091F326D2CEBA104
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
6
Entry point
2972448
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetTempPathW
CreateFileW
GetFileSizeEx
WriteFile
CloseHandle
GetModuleFileNameW
GetLocalTime
LoadLibraryW
GetCurrentProcess
GetCurrentThread
GetTickCount64
RtlCaptureContext
SetUnhandledExceptionFilter
AddVectoredExceptionHandler
GetCurrentProcessId
ExitProcess
CreateMutexW
FindResourceW
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
FreeLibrary
LocalFree
LocalAlloc
CreateEventW
SetEvent
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
GetDateFormatEx
GetTimeFormatEx
GetLocaleInfoEx
GetDynamicTimeZoneInformation
EnumSystemLocalesEx
CreatePipe
SetHandleInformation
ReadFile
GetSystemCpuSetInformation
GetActiveProcessorCount
OpenProcess
QueryFullProcessImageNameW
FindFirstFileW
FindNextFileW
FindClose
GetWindowsDirectoryW
FindFirstFileExW
CreateDirectoryW
GetLogicalDriveStringsW
GetDriveTypeW
GetVolumeInformationW
ExpandEnvironmentStringsW
GetFileAttributesExW
FormatMessageW
IsDebuggerPresent
GetFileAttributesW
GetLogicalProcessorInformationEx
GetMaximumProcessorCount
GetSystemDirectoryW
GetFileSize
GetTempFileNameW
DeleteFileW
FlushFileBuffers
MoveFileExW
OpenEventW
CreateToolhelp32Snapshot
Process32FirstW
GetProcessTimes
Process32NextW
GetStdHandle
QueryPerformanceCounter
LoadLibraryExW
GetCurrentThreadId
InterlockedFlushSList
CreateThreadpoolTimer
SetThreadpoolTimerEx
SetThreadpoolTimer
CloseThreadpoolTimer
EncodePointer
TrySubmitThreadpoolCallback
InterlockedPushEntrySList
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetStartupInfoW
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetFileInformationByHandleEx
AreFileApisANSI
CreateFile2
SetFileInformationByHandle
FormatMessageA
InitOnceComplete
InitOnceBeginInitialize
GetLastError
DebugBreak
WideCharToMultiByte
GetProcessHeap
GetModuleHandleW
GetProcAddress
HeapAlloc
Sleep
OutputDebugStringW
GetModuleHandleExW
HeapFree
GetNativeSystemInfo
GetModuleFileNameA
user32
EnumDisplaySettingsW
EnumDisplaySettingsExW
DisplayConfigGetDeviceInfo
DisplayConfigSetDeviceInfo
ReleaseDC
GetDC
GetIconInfo
IsIconic
IsWindowVisible
GetForegroundWindow
MapVirtualKeyW
GetKeyNameTextW
GetKeyState
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
DestroyIcon
GetMonitorInfoW
MonitorFromWindow
SendMessageW
GetSystemMetrics
LoadImageW
SetForegroundWindow
ShowWindow
FindWindowW
MessageBoxW
GetDisplayConfigBufferSizes
ChangeDisplaySettingsExW
QueryDisplayConfig
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegCreateKeyExW
RegEnumKeyExW
RegDeleteTreeW
RegSetValueExW
RegCloseKey
RegEnumValueW
RegDeleteValueW
RegGetValueW
RegOpenKeyExW
api-ms-win-shcore-stream-winrt-l1-1-0
CreateRandomAccessStreamOverStream
api-ms-win-devices-config-l1-1-1
CM_Get_DevNode_Status
CM_Locate_DevNodeW
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_ListW
CM_Get_Device_IDW
CM_Get_DevNode_PropertyW
dxgi
CreateDXGIFactory1
ext-ms-win-dxcore-l1-1-0
DXCoreCreateAdapterFactory
api-ms-win-core-com-l1-1-0
CoGetObjectContext
CoGetApartmentType
CLSIDFromString
CoInitializeEx
CoSetProxyBlanket
CoCreateFreeThreadedMarshaler
CoUninitialize
PropVariantClear
CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
api-ms-win-security-base-l1-1-0
GetLengthSid
AddAccessAllowedAce
AdjustTokenPrivileges
InitializeAcl
api-ms-win-security-sddl-l1-1-0
ConvertStringSidToSidW
api-ms-win-security-provider-l1-1-0
SetSecurityInfo
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
RegDeleteKeyValueW
oleaut32
SysAllocString
SysFreeString
VariantClear
GetErrorInfo
SetErrorInfo
VariantInit
SysStringLen
api-ms-win-core-timezone-l1-1-0
EnumDynamicTimeZoneInformation
api-ms-win-core-version-l1-1-1
GetFileVersionInfoW
api-ms-win-core-version-l1-1-0
VerQueryValueW
winhttp
WinHttpReadData
WinHttpSendRequest
WinHttpOpenRequest
WinHttpConnect
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpSetTimeouts
WinHttpOpen
WinHttpCrackUrl
WinHttpCloseHandle
powrprof
PowerReadDescription
PowerReadPossibleFriendlyName
PowerReadValueUnitsSpecifier
PowerReadACValueIndex
PowerReadDCValueIndex
PowerReadValueMin
PowerReadValueMax
PowerReadValueIncrement
PowerReadSettingAttributes
PowerWriteSettingAttributes
PowerWriteACValueIndex
PowerWriteDCValueIndex
PowerSetActiveScheme
PowerImportPowerScheme
PowerEnumerate
PowerWriteDescription
PowerDeleteScheme
PowerReadFriendlyName
PowerWriteFriendlyName
api-ms-win-power-setting-l1-1-0
PowerGetActiveScheme
api-ms-win-service-management-l1-1-0
OpenSCManagerW
api-ms-win-core-registry-l2-1-0
RegDeleteKeyW
msvcp140
__crtLCMapStringW
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
_Wcscoll
_Wcsxfrm
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$collate@_W@std@@2V0locale@2@A
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?uncaught_exceptions@std@@YAHXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?good@ios_base@std@@QEBA_NXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Random_device@std@@YAIXZ
_Query_perf_counter
_Query_perf_frequency
?_Xout_of_range@std@@YAXPEBD@Z
_Mtx_lock
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_unlock
?_Xbad_function_call@std@@YAXXZ
_Thrd_yield
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
_Cnd_broadcast
_Cnd_wait
_Thrd_id
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
_Thrd_hardware_concurrency
_Thrd_join
_Cnd_do_broadcast_at_thread_exit
??7ios_base@std@@QEBA_NXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xinvalid_argument@std@@YAXPEBD@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Id_cnt@id@locale@std@@0HA
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
_Cnd_register_at_thread_exit
_Cnd_unregister_at_thread_exit
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
??0task_continuation_context@Concurrency@@AEAA@XZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
??Bios_base@std@@QEBA_NXZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
ole32
RegisterDragDrop
RevokeDragDrop
ReleaseStgMedium
advapi32
GetUserNameW
DeleteService
CloseServiceHandle
OpenServiceW
ControlService
shlwapi
UrlCreateFromPathW
PathFindFileNameW
ord12
PathParseIconLocationW
PathUnquoteSpacesW
msi
ord45
ord70
shell32
ord165
SHGetFolderPathW
ShellExecuteExW
SHCreateDirectoryExW
SHGetKnownFolderPath
SHGetFileInfoW
SHEmptyRecycleBinW
ord6
ShellExecuteW
DragQueryFileW
SHQueryRecycleBinW
setupapi
SetupDiOpenDeviceInfoW
SetupDiCreateDeviceInfoList
SetupDiSetClassInstallParamsW
SetupDiCallClassInstaller
CM_Get_Next_Res_Des
CM_Get_First_Log_Conf
SetupOpenInfFileW
CM_Disable_DevNode
CM_Enable_DevNode
SetupDiGetClassDevsW
SetupGetInfInformationW
CM_Free_Res_Des_Handle
SetupDiGetDevicePropertyW
CM_Get_Device_ID_Size
CM_Get_Res_Des_Data_Size
CM_Get_Res_Des_Data
CM_Free_Log_Conf_Handle
SetupDiEnumDeviceInfo
SetupDiOpenDevRegKey
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstanceIdW
SetupDiGetDeviceRegistryPropertyW
SetupCloseInfFile
CM_Get_Child
SetupDiGetDeviceInstallParamsW
SetupDiClassNameFromGuidW
CM_Get_Sibling
SetupFindFirstLineW
SetupQueryInfOriginalFileInformationW
SetupGetStringFieldW
dwmapi
DwmSetWindowAttribute
comctl32
ord412
ord410
ord413
version
GetFileVersionInfoSizeW
gdi32
GetDIBits
DeleteObject
GetObjectW
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
__std_exception_copy
__std_terminate
wcsrchr
_set_purecall_handler
_purecall
__C_specific_handler
__RTtypeid
__std_type_info_compare
memcmp
memcpy
memmove
memset
_CxxThrowException
__current_exception
__current_exception_context
__std_type_info_destroy_list
strchr
api-ms-win-crt-runtime-l1-1-0
set_terminate
_exit
_invalid_parameter_noinfo
abort
_set_invalid_parameter_handler
exit
signal
_set_abort_behavior
_beginthreadex
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_seh_filter_exe
_set_app_type
_errno
_register_thread_local_exe_atexit_callback
_initialize_wide_environment
_get_wide_winmain_command_line
_c_exit
_configure_wide_argv
api-ms-win-crt-heap-l1-1-0
_callnewh
_set_new_mode
free
realloc
malloc
api-ms-win-crt-string-l1-1-0
strncmp
strlen
strcmp
towupper
wcsncpy_s
_wcsnicmp
towlower
_wcsicmp
wcscpy_s
wcscmp
iswdigit
wcslen
iswspace
isalnum
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsnwprintf_s
__p__commode
__stdio_common_vsprintf
__stdio_common_vswprintf
fclose
__stdio_common_vswprintf_s
__stdio_common_vswscanf
_get_stream_buffer_pointers
fread
fwrite
fgetpos
_fseeki64
fgetc
fputc
ungetc
fsetpos
setvbuf
fflush
_set_fmode
api-ms-win-crt-convert-l1-1-0
strtod
atoi
wcstod
wcstol
wcstoul
wcstoull
_itow_s
_wtoi
_wtoi64
api-ms-win-crt-math-l1-1-0
sqrt
pow
floor
ceilf
ceil
nan
lround
lroundf
round
llround
__setusermatherr
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-environment-l1-1-0
_wdupenv_s
api-ms-win-crt-locale-l1-1-0
___lc_locale_name_func
_configthreadlocale
___lc_codepage_func
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-winrt-error-l1-1-0
RoFailFastWithErrorContext
RoTransformError
api-ms-win-core-com-l1-1-1
RoGetAgileReference
DllGetActivationFactory
VSDesignerCanUnloadNow
VSDesignerDllMain
Name
.text
Size
3.5MB
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1.2MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
141KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5.3MB
Virtual Size
5.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=261, version=33145,
count=1, id=262, version=33145,
count=10, id=260, version=35721,
count=48, id=261, version=35721,
count=6, id=259, version=35721,
count=6, id=257, version=35721,
count=4, id=260, version=33145,
count=68, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=25, id=257, version=33145,
count=582, id=1, productName=Unmarked objects,
count=44, id=265, version=36260,
count=1, id=256, version=36260,
count=1, id=255, version=36260,
count=1, id=151,
count=1, id=258, version=36260,
Vain Toolbox.pri
- SHA256 5c1a08dd824a79fe512b6ef4d26352fe713b946753b3c62c6231b152d8aa8cea
- MD5 766a6e9bf917791dbb2347a42cf61fc1
- SHA1 81607ccaac64b2b5a13b167bf6bb769c77e497e0
- SHA512 08b9d30423daf27b5c4216c5838f9fd4cc9b1a3736938d0f803507d054797cd3f47acecde6fdbc36a37007072ed4168812224a900109dbca79505116bbbce45b
- SSDEEP 12288:adVkG4N94Z30MF7kM4zsRPcOvzdtlXPBxHJ+fE2WShPCUu25etNr2:adtHIxzsRPHPcU25ey
- TLSH T154658301E7FB0208F6F77AB1ADBA4B2568B6BE226831C17F1044570D2E72B455AF5723
- MD5 SHA1 SHA512 SSDEEP TLSH
Vain Tools.exe
- IMPHASH 197788d2838560359d59566093dfeb60
- SHA256 6e7a3f11c1dcfd5d317a2e1edde94be526b332099425ea9f5147896375809875
- MD5 1730a6e8d12db66fd64c47e5e5b63ab5
- SHA1 79b00657572082104a551611d9ac27f14261e214
- SHA512 c841131353c1682b9c03a7f2da9fcb6e41488b6a041c776aa6ccbbb4cec55b63cab1a0d546e93c6500c3e87573fc871b564b637921074076498cb731da9a17fd
- SSDEEP 6144:Q+wfdOzmCyt3XXvhfVUVi3aOtBL2IVGRKnxquglmeblDSGSnKOgqv9mxvb8lv:wEAXPTthhVCKnxuSvREM
- TLSH T1D1B41816B990093FC06B927C8651DA3AC6727CC11B309AE763E17D573A929D4FF39603
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
252160
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
SetProcessAffinityMask
GetThreadIdealProcessorEx
AssignProcessToJobObject
GetProcessAffinityMask
WaitForMultipleObjects
CreateJobObjectW
SetThreadPriority
Thread32Next
GetProcessDefaultCpuSets
Thread32First
GetThreadDescription
SuspendThread
ResumeThread
UnmapViewOfFile
SetProcessDefaultCpuSets
OpenProcess
CreateToolhelp32Snapshot
CreateEventW
Sleep
GetTickCount64
Process32NextW
SetEvent
GetCurrentThread
TerminateThread
GetThreadPriority
Process32FirstW
CreateThread
Module32FirstW
GetSystemCpuSetInformation
SetThreadPriorityBoost
GetPriorityClass
LocalFree
GetThreadId
GetCurrentProcessId
GetModuleHandleW
GetProcessInformation
Module32NextW
QueryFullProcessImageNameW
SetPriorityClass
CreateFileMappingW
MapViewOfFile
GetProcessPriorityBoost
OpenThread
LoadLibraryW
FindFirstFileW
FindNextFileW
GetTempPathW
FindClose
GetCurrentThreadId
GlobalAlloc
DeleteFileW
GlobalFree
GetLocalTime
GlobalLock
GetSystemTimeAsFileTime
GlobalUnlock
GetProcessTimes
ReadFile
GetFileSizeEx
WriteFile
CreateFileW
MultiByteToWideChar
ResetEvent
MoveFileExW
WideCharToMultiByte
FlushFileBuffers
FreeLibrary
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
SetUnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitOnceBeginInitialize
InitOnceComplete
GetThreadPriorityBoost
SetInformationJobObject
GetCurrentProcess
SetThreadIdealProcessorEx
SetThreadSelectedCpuSets
SetThreadAffinityMask
SetProcessPriorityBoost
GetExitCodeProcess
LoadLibraryExW
CreateProcessW
GetProcAddress
CloseHandle
GetLastError
SetProcessInformation
WaitForSingleObject
CreateMutexW
GetProcessId
GetModuleFileNameW
TerminateProcess
GetThreadSelectedCpuSets
user32
SetCapture
LoadCursorW
BringWindowToTop
SetFocus
GetForegroundWindow
AttachThreadInput
MsgWaitForMultipleObjectsEx
PeekMessageW
EmptyClipboard
CloseClipboard
SetTimer
OpenClipboard
GetAsyncKeyState
GetWindowLongPtrW
CallNextHookEx
ScreenToClient
SetWindowLongPtrW
SetActiveWindow
GetDC
DestroyWindow
GetKeyState
SetClipboardData
DestroyMenu
ReleaseCapture
SetWindowsHookExW
UnregisterHotKey
RegisterHotKey
SetWinEventHook
UnhookWinEvent
GetWindowThreadProcessId
GetMessageW
DefWindowProcW
PostMessageW
MessageBoxW
GetMenuItemCount
CreateWindowExW
GetSystemMetrics
CreatePopupMenu
RegisterClassExW
TrackPopupMenu
ShowWindow
DispatchMessageW
EnumWindows
SetCursor
PostThreadMessageW
RegisterClipboardFormatW
KillTimer
TranslateMessage
LoadIconW
FindWindowW
AppendMenuW
InvalidateRect
ReleaseDC
BeginPaint
EndPaint
SendInput
FindWindowExW
UnhookWindowsHookEx
PostQuitMessage
SetForegroundWindow
LoadImageW
SendMessageTimeoutW
GetCursorPos
gdi32
SelectObject
CreateCompatibleDC
DeleteDC
CreateCompatibleBitmap
BitBlt
DeleteObject
advapi32
RegCloseKey
RegSetKeyValueW
CloseServiceHandle
OpenSCManagerW
RegEnumKeyExW
EnumServicesStatusExW
RegGetValueW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegQueryValueExW
RegOpenKeyExW
shell32
SHCreateDirectoryExW
Shell_NotifyIconW
SHGetKnownFolderPath
ole32
CoTaskMemFree
CoCreateInstance
CoInitializeEx
msvcp140
_Mtx_unlock
_Mtx_lock
?_Throw_Cpp_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
dwmapi
DwmEnableMMCSS
gdiplus
GdipCreateStringFormat
GdipDeleteFontFamily
GdipGetImageHeight
GdipGetImageEncoders
GdipResetClip
GdipAddPathArcI
GdipCreateFontFamilyFromName
GdipCloneImage
GdipSetPenStartCap
GdipBitmapUnlockBits
GdipDeleteBrush
GdipDrawEllipseI
GdipAlloc
GdipCreateBitmapFromHBITMAP
GdipDeletePath
GdipGetPenColor
GdipDisposeImage
GdipSetSmoothingMode
GdipCreatePath
GdipFillPolygon
GdipCreateFont
GdipCreateSolidFill
GdipFillPath
GdipDrawLine
GdipDrawRectangle
GdipFillRectangle
GdipSetClipRectI
GdipClosePathFigure
GdiplusShutdown
GdipDrawPath
GdipDrawString
GdipSetStringFormatLineAlign
GdipSetPenLineJoin
GdipCreateFromHDC
GdipFillEllipseI
GdipFillEllipse
GdipSetPenEndCap
GdipSetTextRenderingHint
GdipCloneBrush
GdipMeasureString
GdiplusStartup
GdipGetImageGraphicsContext
GdipFillRectangleI
GdipAddPathArc
GdipGetImageEncodersSize
GdipDeleteGraphics
GdipDeleteStringFormat
GdipDeleteFont
GdipDrawLines
GdipGetImageWidth
GdipTranslateWorldTransform
GdipDeletePen
GdipCreateBitmapFromScan0
GdipCreatePen1
GdipSetStringFormatAlign
GdipDrawImageRectRectI
GdipSaveImageToFile
GdipGetPenFillType
GdipFree
GdipBitmapLockBits
wtsapi32
WTSFreeMemory
WTSQuerySessionInformationW
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_copy
_CxxThrowException
__current_exception_context
__current_exception
__std_exception_destroy
__std_terminate
__C_specific_handler
wcsrchr
memset
wcsstr
memmove
memcpy
memcmp
api-ms-win-crt-string-l1-1-0
_wcsicmp
wcsncpy_s
wcslen
towlower
wcscat_s
wcscmp
strncmp
strlen
wcscpy_s
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
__stdio_common_vsnwprintf_s
__p__commode
__stdio_common_vsprintf
_set_fmode
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
malloc
_callnewh
api-ms-win-crt-math-l1-1-0
sqrt
llround
floor
lround
__setusermatherr
ceilf
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
abort
_register_onexit_function
_register_thread_local_exe_atexit_callback
_c_exit
_exit
_crt_atexit
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_cexit
terminate
_seh_filter_exe
_set_app_type
_configure_wide_argv
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
252KB
Virtual Size
252KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
189KB
Virtual Size
188KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
380B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=260, version=35721,
count=31, id=261, version=35721,
count=6, id=259, version=35721,
count=6, id=257, version=35721,
count=1, id=262, version=33145,
count=19, id=257, version=33145,
count=319, id=1, productName=Unmarked objects,
count=8, id=265, version=36260,
count=1, id=255, version=36260,
count=1, id=151,
count=1, id=258, version=36260,
VainShell.dll
- IMPHASH 26367c2d61cf70b56712df8e4c622cd7
- SHA256 a004e90dacafff6a42923cc0ca1629edc2a595f607e65990a9b62a4c1dfa2983
- MD5 7a270fbeb96112ed5cde225e93a21ac1
- SHA1 965820ff527607f54306f6e53dab488d96bfa2b9
- SHA512 dac203fdcd5f95d9984135d92d0061d5157d2bbd13c1d08c540b92c6fe9eca5e3a6f9d0e2ac3e7b3596926f7fd10c7c1bda1cfc2a87fa09df54c36d3b5bb5010
- SSDEEP 1536:PpnJ6SogVIYQNgoWBut+g7jdEQhK1xbbGogmLirQfGSGmq5dXR:hJ3ogVIYbZg7jdhhKih
- TLSH T12363EA5AE95A916BD25D9D38C9434905DF23BC928BA4A7CF7B910FAF0D31BE48F39100
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
27504
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
oleaut32
SetErrorInfo
GetErrorInfo
SysFreeString
SysStringLen
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
kernel32
GetCurrentThreadId
QueryPerformanceCounter
GetModuleFileNameW
CreateMutexW
CreateEventW
Sleep
GetLastError
SetEvent
CloseHandle
CreateThread
GetProcAddress
GetCurrentProcessId
LoadLibraryExW
WaitForSingleObject
HeapAlloc
GetSystemTimeAsFileTime
InitializeSListHead
FreeLibrary
HeapFree
GetProcessHeap
MultiByteToWideChar
InterlockedPushEntrySList
user32
CallNextHookEx
msvcp140
_Thrd_detach
_Mtx_unlock
_Mtx_lock
?_Xlength_error@std@@YAXPEBD@Z
_Thrd_join
_Thrd_id
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
memcmp
__std_type_info_destroy_list
wcsrchr
__std_terminate
_CxxThrowException
__C_specific_handler
memset
_purecall
__std_exception_copy
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
_invalid_parameter_noinfo
_cexit
_initterm
_seh_filter_dll
terminate
_errno
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_initterm_e
abort
api-ms-win-crt-heap-l1-1-0
_callnewh
free
malloc
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
api-ms-win-crt-string-l1-1-0
_wcsicmp
strlen
iswspace
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
ole32
CoCreateFreeThreadedMarshaler
DllCanUnloadNow
DllGetClassObject
VainHookProc
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
472B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=259, version=35721,
count=8, id=260, version=35721,
count=21, id=261, version=35721,
count=6, id=257, version=35721,
count=11, id=257, version=33145,
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=89, id=1, productName=Unmarked objects,
count=3, id=265, version=36260,
count=1, id=256, version=36260,
count=1, id=255, version=36260,
count=1, id=258, version=36260,
WinUIEdit.dll
- IMPHASH cdcd85fe85bffbbad3028cd68c6b3f33
- SHA256 44686cd3989eae902bcaed915ce8bcb0d5d60d755ff6e30a841117b2e85f5162
- MD5 3b7f1a20515e2c3d395231f057193265
- SHA1 b23b3206a17a3e8ebe38af1eca4c3cbee462f9e9
- SHA512 7cc3ed44e75cb4601eb799404f3f58bbe7086768f6dababd8f26cfc4826df2ff3b56eb2e74fb8bcf2f047a644843efeabdd7b6bb92998c6b61f06af643a193a4
- SSDEEP 49152:57kxbsq02+JjhLwO8ddLJS9EmetkLW3XZU1Zf+eRz0cu550R9tmKmhLjloQxdpuI:q2wvcetkuqme6
- TLSH T1F9F58D12A6FA41F8C469D17C8A5B461BFBF178550335A7CB0271856E2F3BBE01A3E325
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6d:c1:ba:f0:41:b0:51:81:fb:51:9a:2e:22:e2:2d:bd:36:c8:54:a1:be:49:43:7d:76:cb:06:fc:c8:b0:ff:b6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 24, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1c:fa:cd:c5:9b:e8:2f:7e:c4:00:00:00:00:02:1c
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:4C1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:18:25:d9:92:05:e2:e7:e5:e4:00:01:00:00:02:18
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
1936192
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\__w\1\b\Obj\x64fre\WinUIEdit\richedit\src\dll\WinUIEdit\WinUIEdit.pdb
gdi32
SetBkColor
GetGlyphIndicesW
GetCharABCWidthsW
LineTo
GetObjectW
GetCharWidth32A
TextOutW
ExtTextOutA
RealizePalette
CreateDCW
IntersectClipRect
GetKerningPairsA
DeleteDC
DeleteObject
GetTextMetricsW
GetDeviceCaps
SelectPalette
GetTextCharsetInfo
CreatePalette
CreatePen
RestoreDC
MoveToEx
CreateDIBSection
GetStockObject
CreateFontIndirectW
GetCurrentObject
GetTextFaceW
GdiAlphaBlend
GetOutlineTextMetricsW
SetTextAlign
SetBkMode
GetObjectType
DPtoLP
GetWorldTransform
EnumFontFamiliesExW
StretchDIBits
GdiFlush
CreateICW
SaveDC
GetCharWidthW
GetGlyphOutlineW
SelectObject
Rectangle
GetFontData
CreateSolidBrush
Polyline
StretchBlt
CreateCompatibleDC
BitBlt
SetGraphicsMode
DeleteMetaFile
CreateBitmap
GetBkColor
EnumMetaFile
ExtTextOutW
SetMetaFileBitsEx
CreateMetaFileA
SetTextColor
CreatePatternBrush
DeleteEnhMetaFile
GetWinMetaFileBits
SetWindowExtEx
SetWindowOrgEx
PatBlt
OffsetViewportOrgEx
GetPixel
CloseMetaFile
CreateCompatibleBitmap
GetViewportOrgEx
TranslateCharsetInfo
GetMetaFileBitsEx
GetEnhMetaFileBits
GetEnhMetaFileHeader
SetEnhMetaFileBits
GetBkMode
user32
ValidateRect
CreateCaret
SetCaretPos
ScreenToClient
HideCaret
IsWindowVisible
DestroyWindow
ReleaseCapture
SetScrollInfo
SetForegroundWindow
InvalidateRect
IsIconic
IsClipboardFormatAvailable
GetKeyState
GetAsyncKeyState
UpdateLayeredWindow
GetPointerFrameInfoHistory
GetKeyboardLayoutNameW
GetKeyboardLayout
EndMenu
RegisterClipboardFormatW
GetWindowRect
GetUpdateRect
IsMenu
IsWindow
RegisterClassExW
CreateWindowExW
SetWindowPos
RegisterWindowMessageW
SetTimer
SetCaretBlinkTime
MapWindowPoints
SetCapture
LoadCursorW
SetCursor
GetClientRect
KillTimer
EnableScrollBar
PtInRect
GetCursorPos
BeginPaint
EndPaint
TrackPopupMenuEx
GetKeyboardLayoutList
InsertMenuItemW
GetScrollInfo
IsChild
SetScrollRange
GetMessagePos
GetMessageTime
CreatePopupMenu
FillRect
InvertRect
TrackPopupMenu
GetMenuItemInfoW
ClientToScreen
WindowFromDC
DestroyMenu
SetFocus
GetDlgItem
AppendMenuW
GetClipboardOwner
OpenClipboard
MessageBeep
CloseClipboard
LoadStringW
ShowCaret
EmptyClipboard
SetScrollPos
ScrollWindowEx
GetClipboardData
LoadBitmapW
SetClipboardData
GetFocus
GetPointerInfo
ActivateKeyboardLayout
DestroyCaret
GetDC
GetWindowDC
SetRect
ReleaseDC
GetWindowLongW
DefWindowProcW
ShowScrollBar
PostMessageW
SetWindowLongPtrW
IsImmersiveProcess
SendMessageW
GetSystemMetrics
UnregisterClassW
GetWindowLongPtrW
RegisterWindowMessageA
PeekMessageW
GetDoubleClickTime
GetSysColor
SendMessageA
SetWindowLongW
GetClassLongW
SystemParametersInfoW
IsWindowUnicode
GetParent
UpdateWindow
kernel32
SubmitThreadpoolWork
LCIDToLocaleName
WaitForThreadpoolWorkCallbacks
CompareStringEx
CreateThreadpoolWork
GetTickCount
lstrcmpiA
CloseThreadpoolWork
GetPackageFullName
GetSystemDirectoryW
QueueUserWorkItem
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedFlushSList
GlobalReAlloc
TlsFree
GlobalUnlock
GetFileType
GlobalLock
TlsGetValue
GlobalFree
GlobalAlloc
GetCurrentProcessId
ReadFile
WriteFile
CloseHandle
GlobalFlags
WideCharToMultiByte
GetUserDefaultLCID
FindAtomA
FreeLibrary
RtlPcToFileHeader
GetModuleFileNameA
InitOnceBeginInitialize
InitOnceExecuteOnce
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
RtlUnwindEx
EncodePointer
WaitForSingleObject
ReleaseMutex
GlobalSize
InitializeSListHead
FormatMessageW
ReleaseSRWLockExclusive
OutputDebugStringW
InitOnceComplete
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSRWLockShared
HeapAlloc
GetSystemTimeAsFileTime
DecodePointer
CreateMutexExW
AcquireSRWLockShared
GetProcessHeap
GetProcAddress
GetModuleHandleW
LocaleNameToLCID
DebugBreak
IsDebuggerPresent
QueryPerformanceCounter
ResolveLocaleName
LoadLibraryW
LCMapStringEx
TlsAlloc
GetSystemDefaultLangID
CreateFileW
SetFilePointer
IsProcessorFeaturePresent
GetThreadLocale
GetModuleFileNameW
TerminateProcess
GetLastError
SetUnhandledExceptionFilter
GetSystemDefaultLCID
MultiByteToWideChar
IsValidCodePage
GlobalHandle
UnhandledExceptionFilter
GetModuleHandleA
RtlVirtualUnwind
LocalFree
RtlLookupFunctionEntry
GetCurrentThreadId
GetLocaleInfoW
VerSetConditionMask
RtlCaptureContext
VerifyVersionInfoW
CompareStringOrdinal
LoadLibraryExW
GetLocaleInfoEx
SleepConditionVariableSRW
WakeAllConditionVariable
GetStringTypeExW
GetCurrentProcess
LoadLibraryExA
VirtualQuery
TlsSetValue
FindResourceW
LoadResource
RaiseException
CreateEventExW
SetEvent
DisableThreadLibraryCalls
VirtualProtect
InitializeSRWLock
GetTickCount64
GetSystemInfo
ole32
CoInitializeEx
CoReleaseMarshalData
CoUninitialize
CoCreateFreeThreadedMarshaler
CoWaitForMultipleHandles
CoMarshalInterThreadInterfaceInStream
PropVariantClear
CoTaskMemFree
CoCreateInstance
CoGetInterfaceAndReleaseStream
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoOriginateErrorW
oleaut32
VariantClear
SysFreeString
SysAllocStringByteLen
VariantInit
advapi32
RegOpenKeyExW
EventActivityIdControl
EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer
RegEnumKeyExW
RegQueryValueExA
RegGetValueW
RegOpenKeyExA
RegQueryValueExW
RegCloseKey
usp10
ScriptStringAnalyse
ScriptFreeCache
ScriptString_pLogAttr
ScriptStringFree
ScriptTextOut
ScriptPlace
ScriptStringValidate
ScriptSubstituteSingleGlyph
ScriptGetLogicalWidths
ScriptItemize
ScriptGetProperties
ScriptGetCMap
ScriptShape
ScriptBreak
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
__stdio_common_vswprintf
__stdio_common_vsprintf_s
api-ms-win-crt-string-l1-1-0
wcslen
wcscpy_s
wcscmp
strcpy_s
strcmp
iswspace
wcsncmp
strncmp
_wcsicmp
strlen
strnlen
wcsnlen
wcsncpy_s
strncpy_s
wmemcpy_s
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_configure_narrow_argv
_invoke_watson
_register_onexit_function
_execute_onexit_table
_crt_atexit
_seh_filter_dll
_cexit
terminate
_initterm
_errno
_initterm_e
abort
_invalid_parameter_noinfo
_wassert
_initialize_narrow_environment
api-ms-win-crt-heap-l1-1-0
realloc
_callnewh
free
calloc
malloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
wcstod
_itow_s
api-ms-win-core-path-l1-1-0
PathCchAppend
elscore
MappingFreeServices
MappingGetServices
MappingFreePropertyBag
MappingRecognizeText
api-ms-win-crt-math-l1-1-0
ceilf
sqrt
pow
CreateTextServices
DllGetActivationFactory
DllGetVersion
GetMathAlphanumeric
GetMathAlphanumericCode
IID_IRichEditOle
IID_IRichEditOleCallback
IID_IRicheditUiaNotificationOverrides
IID_IRicheditUiaOverrides
IID_IRicheditWindowlessAccessibility
IID_ITextDocument2
IID_ITextHost
IID_ITextHost2
IID_ITextServices
IID_ITextServices2
MathBuildDown
MathBuildUp
MathTranslate
RichEdit10ANSIWndProc
RichEditANSIWndProc
RichEditWndProc
SetCustomTextOutHandlerEx
SetTextServicesDpiCalculationOverride
ShutdownTextServices
Name
.text
Size
2.7MB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
447KB
Virtual Size
446KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
82KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
456B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=190, id=261, version=35215,
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=49, id=261, version=35207,
count=3, id=260, version=30795,
count=4, id=257, version=30795,
count=1, id=261, version=30795,
count=445, id=1, productName=Unmarked objects,
count=31, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=188, id=265, version=35215,
count=1, id=256, version=35215,
count=1, id=255, version=35215,
count=1, id=151,
count=1, id=258, version=35215,
dcompi.dll
- IMPHASH 0d0fb2bfe445c6a96dd181c778b73dc9
- SHA256 e3dbf206275c924babb531a1bf94f2fd2c648e002e168c427d4f5bc99556e9ec
- MD5 a4e5ff0cba175800480fc20afb2d8702
- SHA1 528a1e56026f5cc6b591698e2adc3ab21878fa15
- SHA512 1ee19989e8e5712636cdb544ec222a4eecb9646921172a8c6a853a9fc7737aba5b30bcc639ed8e4ab97cc822124ccf64689ca3acb8c91638bf4e872b7af0bc7d
- SSDEEP 49152:mRGt5QB9gfsX5cj7Bze3bQ5+Sl3TA0DAN:GGt2zIz
- TLSH T136755B5B6ABC0095E6BAA179C5B7861ED7B13C150FB497CF1124026E9F33FE0993A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
df:b0:ef:2a:a2:0f:68:89:3e:4a:c3:61:cf:d5:ac:4a:56:35:a8:9d:9b:99:3a:4b:ff:4e:cb:ee:da:48:24:8f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 14, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:85:5e:99:ec:0e:59:2f:cd:d7:00:00:00:00:04:85
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:24:3b:84:21:b0:2c:ac:64:22:00:01:00:00:02:24
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
8800
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
dcompi.pdb
api-ms-win-crt-runtime-l1-1-0
abort
_errno
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_invoke_watson
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
terminate
_crt_atexit
_cexit
_invalid_parameter_noinfo
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf_s
__stdio_common_vswprintf
__stdio_common_vswprintf_s
api-ms-win-crt-string-l1-1-0
wcsncmp
strncat_s
_wcsicmp
wcsnlen
wcsncpy_s
wcscpy_s
towlower
_wcsdup
_wcsicmp_l
strcpy_s
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
_finite
sqrt
ceilf
sin
api-ms-win-crt-heap-l1-1-0
_free_base
malloc
realloc
_calloc_base
_malloc_base
free
api-ms-win-crt-convert-l1-1-0
_wtof
api-ms-win-crt-locale-l1-1-0
___lc_collate_cp_func
___mb_cur_max_func
__pctype_func
setlocale
_unlock_locales
_lock_locales
___lc_codepage_func
___lc_locale_name_func
kernel32
RtlPcToFileHeader
FlsFree
GetSystemInfo
LoadLibraryExA
VirtualProtect
FlsSetValue
FlsGetValue
FlsAlloc
RtlLookupFunctionEntry
RtlUnwindEx
VirtualQuery
InitializeSListHead
GetSystemTimeAsFileTime
SleepConditionVariableSRW
WakeAllConditionVariable
CompareStringEx
LCMapStringEx
InitializeCriticalSectionEx
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
HeapReAlloc
FreeLibrary
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
CreateEventExW
CompareStringOrdinal
InitializeSRWLock
ResetEvent
SetEvent
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CreateThreadpoolWait
DuplicateHandle
RaiseException
RtlCaptureStackBackTrace
RaiseFailFastException
EncodePointer
InitOnceExecuteOnce
DecodePointer
GetCurrentProcess
MapViewOfFile
VirtualFree
VirtualAlloc
GetNativeSystemInfo
InitOnceComplete
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForThreadpoolTimerCallbacks
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
ReleaseSRWLockExclusive
OutputDebugStringW
CloseThreadpoolTimer
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
SetThreadpoolTimer
ReleaseSRWLockShared
HeapAlloc
GetProcAddress
CreateMutexExW
AcquireSRWLockShared
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
CreateThreadpoolTimer
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
QueryPerformanceFrequency
GetTickCount
GetTickCount64
CreateEventW
CreateFileMappingW
InitOnceBeginInitialize
InterlockedFlushSList
user32
GetSystemMetrics
GetDC
GetMonitorInfoW
MonitorFromWindow
ReleaseDC
marshal
LM_PresentCompositionBuffers
LM_CloseTokenHandle
LM_CreateTokenHandle
LegacyMarshalerDestroyChannel
LM_CloseSurfaceHandle
LM_CreateCompositionBuffer
LegacyMarshalerCloseCompositionInputSink
LegacyMarshalerDuplicateCompositionInputSink
LegacyMarshalerGetBatchId
LegacyMarshalerCloseSectionHandle
LegacyMarshalerMapViewOfSection
LegacyMarshalerReleaseAllResources
LegacyMarshalerGetDeletedResources
LegacyMarshalerGetFrameStatistics
LegacyMarshalerCreateChannel
LegacyMarshalerProcessChannelBatchBuffer
LegacyMarshalerCommitChannel
LegacyMarshalerWaitForChannel
LegacyMarshalerSetChannelCommitCompletionEvent
LegacyMarshalerCreateAndBindSharedSection
LegacyMarshalerSynchronize
LegacyMarshalerSetChannelConnectionId
LegacyMarshalerInitialize
dwmcorei
LiftedCompositionEngine_Initialize
LiftedCompositionEngine_Uninitialize
coremessagingxp
CoreUICallCreateConversationHost
CoreUICallReceive
WinUIGetDispatcherQueueForCurrentThread
CoreMsgCreateSession
microsoft.ui.composition.ossupport
UnsubscribeFeatureStateChangeNotification
TerminateProcessOnMemoryExhaustion
RecordFeatureUsage
SubscribeFeatureStateChangeNotification
GetFeatureEnabledState
microsoft.internal.frameworkudk
DxPrivates_SwapChainPartnerFromDxgiSwapChain
DCompPrivates_OpenAndAttachSharedTarget
Windowing_GetMonitorFromDisplayId
DCompPrivates_CreateSharedVisualHandle
DxPrivates_WarpPalCreateExtensionFactory
DxPrivates_PartnerDeviceFromDevice
DxPrivates_WarpPalGetDeviceCaps
api-ms-win-downlevel-advapi32-l1-1-0
EventRegister
EventUnregister
EventWriteTransfer
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
AllocateLocallyUniqueId
api-ms-win-downlevel-ole32-l1-1-0
CoTaskMemAlloc
CoGetApartmentType
CoCreateInstance
CoCreateFreeThreadedMarshaler
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoFailFastWithErrorContext
SetRestrictedErrorInfo
GetRestrictedErrorInfo
RoOriginateError
RoOriginateErrorW
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
RoReportFailedDelegate
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsGetStringLen
WindowsTrimStringStart
WindowsCreateString
WindowsConcatString
WindowsDeleteString
WindowsSubstringWithSpecifiedLength
WindowsDuplicateString
WindowsTrimStringEnd
WindowsIsStringEmpty
WindowsCreateStringReference
WindowsCompareStringOrdinal
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
ntdll
RtlDestroyHeap
RtlCreateHeap
RtlAllocateHeap
RtlFreeHeap
NtUnmapViewOfSection
RtlNumberGenericTableElements
RtlInitializeGenericTable
RtlLookupElementGenericTable
RtlInsertElementGenericTable
RtlEnumerateGenericTableWithoutSplaying
NtQuerySystemInformation
RtlDeleteElementGenericTable
RtlGetElementGenericTable
d3d11
D3D11CreateDevice
dcomp
ord1040
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
WinUIDCompositionCreateDevice3
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
284KB
Virtual Size
281KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
40KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=257, version=33145,
count=1, productName=Unmarked objects (old),
count=16, id=260, version=33145,
count=11, id=259, version=33145,
count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=297, id=1, productName=Unmarked objects,
count=40, id=261, version=33145,
count=394, id=264, version=33145,
count=1, id=256, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
dwmcorei.dll
- IMPHASH f370d509ce65224f0dd43cf5cc773273
- SHA256 521bacd990e73ca1083ab5b31d046b4b9a029626d7423465fdb03db1b4760d91
- MD5 efc66dec32af0a7d6f99b55cc7d14b01
- SHA1 74ef7c236a194351ba3d99b1ff3316dd6ad80198
- SHA512 b6b13c629a0558a94ad876d2882b7b0e122212236aa2737469453c9401f6de336efb9076b02d5ba1a611a4beb84aeae2ba9e651b8a1bacd5df68d75729e18aea
- SSDEEP 49152:rk5bwaCRhvEzlDc+bLmVrC7+eeShgSDhHr3Q:r9hMS+Y0cGd3Q
- TLSH T1A3D55B0732E480B6C57ED23899DB8B1AF771B81117B28ACB2254126C9F77BD05E7B364
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c2:21:f2:43:95:6b:bd:f4:b8:bb:27:d5:af:84:ca:9a:87:39:2b:63:41:c3:81:e8:19:f0:a4:1d:cf:25:76:e7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 14, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:85:5e:99:ec:0e:59:2f:cd:d7:00:00:00:00:04:85
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:2b:bb:00:50:ff:4d:3b:9a:a1:00:01:00:00:02:2b
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
35200
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
dwmcorei.pdb
microsoft.ui.composition.ossupport
TerminateProcessOnMemoryExhaustion
SubscribeFeatureStateChangeNotification
UnsubscribeFeatureStateChangeNotification
GetFeatureEnabledState
RecordFeatureUsage
MicrosoftTelemetryAssertTriggeredNoArgs
d2d1
ord1
ord5
ord3
ord4
ord2
d3d11
D3D11CreateDevice
d3dcompiler_47
D3DCreateFunctionLinkingGraph
D3DCreateBlob
D3DLoadModule
D3DCreateLinker
dxgi
CreateDXGIFactory1
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleExW
GetProcAddress
GetModuleHandleW
FreeLibrary
api-ms-win-core-synch-l1-2-0
InitOnceComplete
Sleep
InitOnceBeginInitialize
api-ms-win-core-synch-l1-1-0
CreateEventW
WaitForSingleObject
CreateEventExW
ReleaseMutex
ReleaseSRWLockExclusive
ResetEvent
AcquireSRWLockExclusive
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetWaitableTimerEx
WaitForSingleObjectEx
CancelWaitableTimer
CreateSemaphoreExW
OpenSemaphoreW
AcquireSRWLockShared
CreateMutexExW
SetEvent
ReleaseSRWLockShared
ReleaseSemaphore
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventEnabled
EventSetInformation
EventUnregister
EventWriteTransfer
EventRegister
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWork
CloseThreadpoolTimer
CloseThreadpoolWork
CreateThreadpoolTimer
WaitForThreadpoolWorkCallbacks
SetThreadpoolTimer
SubmitThreadpoolWork
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentThread
GetThreadId
TlsGetValue
TlsFree
GetCurrentProcess
ProcessIdToSessionId
CreateThread
GetCurrentProcessId
TlsAlloc
TlsSetValue
SetThreadPriority
ResumeThread
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
OutputDebugStringA
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-power-setting-l1-1-0
PowerSettingUnregisterNotification
PowerSettingRegisterNotification
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
CreateWaitableTimerW
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetTickCount64
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureStackBackTrace
api-ms-win-core-interlocked-l1-1-0
QueryDepthSList
InitializeSListHead
InterlockedPushEntrySList
InterlockedFlushSList
api-ms-win-core-realtime-l1-1-0
QueryThreadCycleTime
api-ms-win-core-processthreads-l1-1-3
SetThreadDescription
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
GetRestrictedErrorInfo
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm
_errno
_invalid_parameter_noinfo_noreturn
_invoke_watson
abort
_invalid_parameter_noinfo
terminate
_initterm_e
_cexit
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
__stdio_common_vswprintf
__stdio_common_vsprintf
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-math-l1-1-0
tan
sqrtf
sqrt
sinf
sin
powf
pow
logf
log10f
log
fmodf
fmod
floorf
floor
expf
exp
cosf
ceilf
atanf
atan2f
asinf
acosf
tanf
acos
_hypot
fmaxf
_finite
_isnan
modff
fminf
api-ms-win-crt-string-l1-1-0
strcpy_s
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
malloc
_free_base
_calloc_base
free
marshal
LM_TokenManagerThread
LegacyMarshalerDestroyConnection
LegacyMarshalerCreateConnection
LegacyMarshalerBeginFrame
LM_CloseSurfaceHandle
LegacyMarshalerConfirmFrame
LegacyMarshalerGetConnectionBatch
LM_TokenManagerDeleteAllTokens
LM_GetSurfaceInfo
LegacyMarshalerMapViewOfSection
LegacyMarshalerCloseSectionHandle
LM_ValidateSurfaceHandle
LM_GetFrameSurfaceUpdates
LegacyMarshalerGetFrameStatistics
LegacyMarshalerCloseCompositionInputSink
LegacyMarshalerDuplicateCompositionInputSink
LegacyMarshalerQueryCompositionInputIsImplicit
LegacyMarshalerUpdateInputSinkTransforms
LegacyMarshalerQueryCompositionInputSink
LegacyMarshalerQueryCompositionInputQueueAndTransform
LegacyMarshalerQueryCompositionInputSinkLuid
LM_TokenManagerOpenSectionAndEvents
coremessagingxp
CoreUICallReceive
CoreUICallCreateConversationHost
CoreMsgCreateSession
CoreUICallCreateEndpointHost
CoreUICallSend
microsoft.inputstatemanager
NotifyInputSinkRemoved
NotifyInputSinkParented
NotifyInputSinkTransformChanged
SetManipulationInputTarget
CreateInputRenderingConnection
RegisterManipulationThread
StopAndEndInertia
kernel32
InitializeCriticalSectionEx
RtlPcToFileHeader
FlsFree
RaiseException
FlsSetValue
PulseEvent
DuplicateHandle
MapViewOfFile
GetSystemInfo
GetVersionExW
HeapReAlloc
VirtualProtect
LoadLibraryExA
FlsGetValue
VirtualQuery
WakeAllConditionVariable
SleepConditionVariableSRW
RtlUnwindEx
FlsAlloc
user32
GetPointerDeviceRects
GetSystemMetrics
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
DispatchMessageW
SystemParametersInfoW
IsGUIThread
ntdll
RtlInitializeGenericTable
NtQuerySystemInformation
DbgPrintEx
RtlGetDeviceFamilyInfoEnum
RtlEnumerateGenericTableWithoutSplaying
RtlDeleteElementGenericTable
RtlUnsubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlInsertElementGenericTable
RtlSubscribeWnfStateChangeNotification
RtlLookupElementGenericTable
api-ms-win-dx-d3dkmt-l1-1-0
D3DKMTEscape
D3DKMTCloseAdapter
D3DKMTQueryAdapterInfo
api-ms-win-dx-d3dkmt-l1-1-1
D3DKMTOpenAdapterFromLuid
dcomp
DCompositionCreateDevice2
microsoft.internal.frameworkudk
DCompPrivates_ResizeDCompositionSurface
DxPrivates_WarpPalCreateExtensionFactory
DxPrivates_WarpPalGetDeviceCaps
DCompPrivates_OpenSharedDCompositionObject
DCompPrivates_SetVisualSize
DCompPrivates_SetVisualRelativeSize
DCompPrivates_CreateCompositionBatchQuery
DCompPrivates_SetTransparentForInput
DCompPrivates_CreateColorContent
DCompPrivates_SetCommitCompletionEvent
LiftedCompositionEngine_Initialize
LiftedCompositionEngine_Uninitialize
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
752KB
Virtual Size
750KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
60KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
136B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
220KB
Virtual Size
218KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=15, id=260, version=33145,
count=10, id=259, version=33145,
count=88, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=261, version=33145,
count=27, id=257, version=33145,
count=297, id=1, productName=Unmarked objects,
count=1, id=256, version=33145,
count=504, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
en-us/Microsoft.ui.xaml.dll.mui
- SHA256 6facf9cb3a7f68d1114dd054ae821f0c4d0e709615148c7c4a295dfa4588bc36
- MD5 c1d7e790662544312a767a4f93c81762
- SHA1 ec21d1182e302854d7a5027e896b50939dc9d003
- SHA512 b574154c9956538856cf4c7ee01b138089aad61e3f4620ddeebe2d3d5ab6afda9fa31208dfda0fa01784e6b13b1b28cb4afc200cffe31c52b586947e08c18281
- SSDEEP 384:9WmedouMtn73JA1F+zg2PEdlNylUyR9zZV8W:gq7n73M2PEglU+9zZmW
- TLSH T106C27391A7FC0509F1FB6FB46EB69A516E3ABD936D34C61D0250A04E0C72B81EE20777
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
28:0e:0b:3b:d0:da:e0:56:6d:7c:a8:db:83:53:69:79:fe:95:ad:c1:22:80:a6:19:9b:ef:01:8c:27:b8:bd:6b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 24, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1d:4d:19:c8:4e:d7:0f:57:48:00:00:00:00:02:1d
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:28:f0:a5:87:d7:f3:c8:1e:40:00:01:00:00:02:28
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=35215,
count=1, id=258, version=35215,
marshal.dll
- IMPHASH bcfd1792e16f54d7ba3b1e4f1867c6bc
- SHA256 885a4fe213e37b75ba6a61bd5392849d6ceb9ba7615882814c1650142e9172f9
- MD5 3b25c1f9b8543b780d3f87c5d767298a
- SHA1 0fdb893dba67d504e7ec534e296d67f69b2bae03
- SHA512 fa3383f5fc4b14e8c993294e253e344e25d60f168291505b23e254ae921fc91ba8f748e52fb79d76e8d3cd64362e93544223b1beaf04a03e3a14865672674cb8
- SSDEEP 12288:t/dlbndUK7WEZcg8pMXuGh8OeEPkBJYVFz/k:jxWK7W+cg8pMeGmOeUk4X/
- TLSH T13AB4088F656104A3D57F8378B69F8749DB71BA12035097CF01A062B9DF1FBD82C79A28
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c9:c0:e1:f0:52:82:b7:88:ca:63:af:b9:31:8b:ee:d6:a5:7c:30:2e:11:93:8e:89:aa:92:02:00:b9:80:14:a0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 14, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:85:5e:99:ec:0e:59:2f:cd:d7:00:00:00:00:04:85
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:21:33:c0:35:fb:d2:0f:21:a4:00:01:00:00:02:21
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
6192
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
marshal.pdb
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_errno
_invalid_parameter_noinfo_noreturn
terminate
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
abort
_initialize_onexit_table
_invoke_watson
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_invalid_parameter_noinfo
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
api-ms-win-crt-heap-l1-1-0
_calloc_base
_free_base
free
calloc
malloc
api-ms-win-crt-convert-l1-1-0
_wcstoui64
microsoft.ui.composition.ossupport
InterlockedPushEntrySList_Winbase
InterlockedPopEntrySList_Winbase
ExUuidCreate
RtlQueryFeatureConfiguration
InitializeSListHead_Winbase
RaiseFailFastException_Winbase
RaiseException_Winbase
RtlNotifyFeatureUsage
ZwQueryValueKey
ZwOpenKey
TerminateProcessOnMemoryExhaustion
RtlDeleteElementGenericTable_Onecore
RtlInsertElementGenericTable_Onecore
RtlLookupElementGenericTable_Onecore
RtlEnumerateGenericTableWithoutSplaying_Onecore
RtlInitializeGenericTable_Onecore
NtQuerySystemInformation_Onecore
SetLastError_Winbase
GetLastError_Winbase
UnsubscribeFeatureStateChangeNotification
RecordFeatureUsage
SubscribeFeatureStateChangeNotification
NtQueryObject_Ntdll
InterlockedFlushSList_Winbase
api-ms-win-ntuser-rectangle-l1-1-0
UnionRect
OffsetRect
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleExW
GetProcAddress
GetModuleHandleW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-synch-l1-1-0
ReleaseMutex
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObject
OpenSemaphoreW
ReleaseSRWLockShared
CreateMutexExW
AcquireSRWLockShared
CreateSemaphoreExW
SetEvent
ResetEvent
CreateEventExW
ReleaseSemaphore
TryAcquireSRWLockExclusive
InitializeCriticalSectionEx
DeleteCriticalSection
WaitForSingleObjectEx
CreateEventW
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-sysinfo-l1-2-0
GetSystemTimePreciseAsFileTime
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
RtlCaptureStackBackTrace
api-ms-win-security-base-l1-1-0
AllocateLocallyUniqueId
api-ms-win-core-fibers-l1-1-0
FlsFree
FlsGetValue
FlsAlloc
FlsSetValue
api-ms-win-core-util-l1-1-0
EncodePointer
api-ms-win-core-memory-l1-1-0
VirtualFree
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
VirtualAlloc
api-ms-win-crt-string-l1-1-0
strnlen
strcpy_s
api-ms-win-crt-math-l1-1-0
ceilf
_finite
LM_CloseSurfaceHandle
LM_CloseTokenHandle
LM_CreateCompositionBuffer
LM_CreateTokenHandle
LM_GetFrameSurfaceUpdates
LM_GetSurfaceInfo
LM_OpenCompositionBuffer
LM_PresentCompositionBuffers
LM_TokenManagerDeleteAllTokens
LM_TokenManagerOpenSectionAndEvents
LM_TokenManagerThread
LM_ValidateSurfaceHandle
LegacyMarshalerBeginFrame
LegacyMarshalerCloseCompositionInputSink
LegacyMarshalerCloseSectionHandle
LegacyMarshalerCommitChannel
LegacyMarshalerConfirmFrame
LegacyMarshalerCreateAndBindSharedSection
LegacyMarshalerCreateChannel
LegacyMarshalerCreateCompositionInputSink
LegacyMarshalerCreateConnection
LegacyMarshalerCreateImplicitCompositionInputSink
LegacyMarshalerDestroyChannel
LegacyMarshalerDestroyConnection
LegacyMarshalerDuplicateCompositionInputSink
LegacyMarshalerGetBatchId
LegacyMarshalerGetConnectionBatch
LegacyMarshalerGetDeletedResources
LegacyMarshalerGetFrameStatistics
LegacyMarshalerInitialize
LegacyMarshalerMapViewOfSection
LegacyMarshalerProcessChannelBatchBuffer
LegacyMarshalerQueryCompositionInputIsImplicit
LegacyMarshalerQueryCompositionInputQueueAndTransform
LegacyMarshalerQueryCompositionInputSink
LegacyMarshalerQueryCompositionInputSinkLuid
LegacyMarshalerQueryCompositionInputSinkViewId
LegacyMarshalerReleaseAllResources
LegacyMarshalerSetChannelCommitCompletionEvent
LegacyMarshalerSetChannelConnectionId
LegacyMarshalerSynchronize
LegacyMarshalerUpdateInputSinkTransforms
LegacyMarshalerWaitForChannel
__imp_MmHighestUserAddress
Name
.text
Size
344KB
Virtual Size
341KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
100KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=10, id=259, version=33145,
count=53, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=140, id=1, productName=Unmarked objects,
count=34, id=261, version=33145,
count=1, id=256, version=33145,
count=168, id=264, version=33145,
count=1, id=258, version=33145,
wuceffectsi.dll
- IMPHASH af395312113fa147b6149dbc312f600b
- SHA256 3aeca410e49368de9193ccc18e144a144b0470232d80c796eafa6f0ced17c188
- MD5 54ecf9f7580c4080f3dec4827ff62e66
- SHA1 86f2f63039429d5607d8829f5a3357d9196f584b
- SHA512 c1791b9f77395ac7757b3f18842e593a7122d0300f3077d5a167883a4c2cee04c1292443ccdcf1100da7b410a93579f48b667868ccc4a113baef96b82dae61ff
- SSDEEP 6144:Bj6s0Y+JEhsX7lHbfFwsFfAzNDQrqn2C04jEPRxFfYZ:NB0MhoFfasxAzBJGRx1m
- TLSH T1FBA44B6AEB944DA7E533903CCDB7860AE3B174A9073186CB216D422E1F37BE45C39791
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
71:93:ed:53:32:85:53:6e:43:0b:bb:5a:b9:d6:70:09:4f:e1:db:5e:f0:c1:4e:2b:a7:4b:fd:88:02:b5:57:ae
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 14, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:84:98:e2:12:e0:78:a3:31:5d:00:00:00:00:04:84
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6B05-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:11:45:18:39:9b:43:cf:fc:6c:00:01:00:00:02:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
256384
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wuceffectsi.pdb
api-ms-win-crt-runtime-l1-1-0
abort
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_invalid_parameter_noinfo_noreturn
terminate
_beginthreadex
_invalid_parameter_noinfo
_initterm_e
_initterm
_errno
api-ms-win-crt-string-l1-1-0
strcmp
iswspace
_wcsicmp_l
_wcsicmp
strcpy_s
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
__stdio_common_vsprintf_s
api-ms-win-crt-locale-l1-1-0
_create_locale
api-ms-win-crt-convert-l1-1-0
_itoa_s
_ltoa_s
api-ms-win-crt-heap-l1-1-0
free
_free_base
malloc
_calloc_base
microsoft.ui.composition.ossupport
TerminateProcessOnMemoryExhaustion
SubscribeFeatureStateChangeNotification
RecordFeatureUsage
UnsubscribeFeatureStateChangeNotification
kernel32
GetSystemTimeAsFileTime
InitializeSListHead
MultiByteToWideChar
RtlPcToFileHeader
InterlockedFlushSList
InterlockedPushEntrySList
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
RtlUnwindEx
RtlLookupFunctionEntry
InitializeCriticalSectionEx
GetSystemTimePreciseAsFileTime
QueryPerformanceFrequency
SleepConditionVariableSRW
WakeConditionVariable
WakeAllConditionVariable
Sleep
RaiseFailFastException
RtlCaptureStackBackTrace
QueryPerformanceCounter
LoadLibraryExW
InitOnceComplete
InitOnceBeginInitialize
SizeofResource
LockResource
GetModuleFileNameA
InitOnceExecuteOnce
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
EncodePointer
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
ReleaseSRWLockExclusive
OutputDebugStringW
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
ReleaseSRWLockShared
HeapAlloc
DecodePointer
GetProcAddress
CreateMutexExW
AcquireSRWLockShared
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
DebugBreak
IsDebuggerPresent
RaiseException
InitializeCriticalSection
DeleteCriticalSection
LoadLibraryW
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
FindResourceA
LoadResource
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsDuplicateString
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsSubstringWithSpecifiedLength
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoOriginateError
RoTransformError
api-ms-win-core-com-l1-1-0
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoTaskMemAlloc
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWriteTransfer
EventUnregister
EventSetInformation
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
ntdll
NtQuerySystemInformation
oleaut32
GetErrorInfo
SetErrorInfo
SysStringLen
SysFreeString
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-crt-math-l1-1-0
cosf
powf
sqrtf
ceilf
sinf
cos
CompileEffectDescription
CreateEffectDescription
DeserializeEffectDescription
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
SerializeEffectDescription
Name
.text
Size
268KB
Virtual Size
267KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
116KB
Virtual Size
113KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
40KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33145,
count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=173, id=1, productName=Unmarked objects,
count=39, id=261, version=33145,
count=12, id=259, version=33145,
count=1, id=256, version=33145,
count=97, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,