| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2012-Jul-26 21:23:14 |
| Detected languages |
English - United States
|
| Debug artifacts |
VSPerfCmd.pdb
|
| CompanyName | Microsoft Corporation |
| FileDescription | VSPerf Performance Control Tool |
| FileVersion | 11.0.50727.1 built by: RTMREL |
| InternalName | VSPerfCmdUI.dll |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | VSPerfCmdUI.dll |
| ProductName | Microsoft® Visual Studio® 2012 |
| ProductVersion | 11.0.50727.1 |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Tries to detect virtualized environments:
|
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Info | The PE is digitally signed. |
Signer: Microsoft Corporation
Issuer: Microsoft Code Signing PCA |
| Safe | VirusTotal score: 0/70 (Scanned on 2026-06-29 10:01:35) | All the AVs think this file is safe. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x108 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2012-Jul-26 21:23:14 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 11.0 |
| SizeOfCode | 0x3f800 |
| SizeOfInitializedData | 0x1e400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000026568 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | A.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x65000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x6f1f6 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x2000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| ADVAPI32.dll |
GetAclInformation
GetAce GetSecurityDescriptorDacl RegQueryValueExA RegOpenKeyExA GetSecurityInfo IsValidSid RegCloseKey GetExplicitEntriesFromAclA GetNamedSecurityInfoW ConvertStringSecurityDescriptorToSecurityDescriptorW IsValidSecurityDescriptor GetSecurityDescriptorGroup RegSetValueExW SetSecurityDescriptorSacl GetSecurityDescriptorSacl GetSecurityDescriptorOwner SetSecurityDescriptorOwner InitializeSecurityDescriptor RegCreateKeyExW MapGenericMask SetSecurityDescriptorGroup RegQueryValueExW RegOpenKeyExW AdjustTokenPrivileges LookupPrivilegeValueA GetTokenInformation OpenProcessToken GetTraceEnableLevel RegisterTraceGuidsA TraceEvent GetTraceLoggerHandle GetTraceEnableFlags IsTextUnicode MakeSelfRelativeSD GetSidLengthRequired SetSecurityInfo MakeAbsoluteSD LookupAccountSidW GetSecurityDescriptorLength SetNamedSecurityInfoW SetSecurityDescriptorDacl LookupAccountNameW GetSecurityDescriptorControl GetSidSubAuthorityCount SetEntriesInAclA GetSidSubAuthority IsValidAcl GetSidIdentifierAuthority ControlService QueryServiceConfigA OpenSCManagerA QueryServiceStatus ChangeServiceConfigA StartServiceA OpenServiceW DeleteService CloseServiceHandle CreateServiceW |
|---|---|
| KERNEL32.dll |
SetThreadPriority
TerminateThread VirtualAllocEx CreateRemoteThread Module32NextW CreateToolhelp32Snapshot Process32NextW Module32FirstW OpenThread Process32FirstW Thread32Next GetExitCodeProcess ReadProcessMemory Thread32First CreateFileA ResumeThread SuspendThread CreateMutexW CreateFileMappingW CreateEventW ReleaseMutex GetVersion ExpandEnvironmentStringsW WaitNamedPipeA SetNamedPipeHandleState LoadLibraryExA ReadConsoleW CreateMutexA OpenSemaphoreA CreateSemaphoreA HeapSetInformation SetUnhandledExceptionFilter LocalAlloc GetProcAddress SwitchToThread GetCurrentProcessId DeviceIoControl OpenEventA ProcessIdToSessionId OpenMutexA SetLastError MultiByteToWideChar CreateFileW GetModuleFileNameW Sleep GetLocaleInfoW WideCharToMultiByte OpenProcess GetTickCount GetModuleHandleW GetSystemDefaultLCID WaitForSingleObject GetFullPathNameW CloseHandle GetModuleHandleA LockResource RaiseException SizeofResource LoadResource FindResourceW FindResourceExW LocalFree GetVersionExA GetLastError CompareStringW VirtualFreeEx GetCommandLineW EncodePointer DecodePointer HeapFree IsDebuggerPresent IsProcessorFeaturePresent GetCurrentThreadId ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetProcessHeap GetFileType InitializeCriticalSectionAndSpinCount DeleteCriticalSection InitOnceExecuteOnce GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime GetTickCount64 GetEnvironmentStringsW FreeEnvironmentStringsW RtlUnwindEx HeapSize HeapAlloc RtlPcToFileHeader IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW HeapReAlloc EnterCriticalSection LeaveCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter FlsAlloc FlsGetValue FlsSetValue FlsFree GetCurrentProcess TerminateProcess FreeLibrary LoadLibraryExW OutputDebugStringW LoadLibraryW LCMapStringEx GetConsoleCP GetConsoleMode SetFilePointerEx SetStdHandle WriteConsoleW FlushFileBuffers InitializeCriticalSectionEx HeapDestroy FindFirstFileW InitializeCriticalSection FindClose FormatMessageA FormatMessageW WriteConsoleA GetConsoleScreenBufferInfo GetDriveTypeW GetFileAttributesW LoadLibraryA GetSystemInfo QueryPerformanceFrequency GetFileSize ReadFile MapViewOfFile UnmapViewOfFile VirtualUnlock VirtualAlloc CreateFileMappingA VirtualLock OpenFileMappingA PeekNamedPipe CreatePipe lstrlenW SetEvent CreateEventA ResetEvent FindFirstFileA GetModuleFileNameA GetUserDefaultUILanguage CreateProcessW WaitForMultipleObjects DuplicateHandle WriteProcessMemory |
| VSPMsg.dll |
SetErrorMessageModule
GetErrorMessageModule |
| ole32.dll |
CoInitializeEx
CoCreateInstance CLSIDFromString CoInitialize CoUninitialize |
| OLEAUT32.dll |
SysFreeString
SysAllocStringLen SysAllocString |
| PSAPI.DLL |
GetModuleBaseNameW
|
| SETUPAPI.dll |
SetupDiGetClassRegistryPropertyA
SetupDiSetClassRegistryPropertyA |
| SHLWAPI.dll |
PathAddBackslashW
PathAppendW SHCreateStreamOnFileW PathRemoveFileSpecW |
| pdh.dll |
PdhLookupPerfNameByIndexW
|
| XmlLite.dll |
CreateXmlReader
|
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 11.0.50727.1 |
| ProductVersion | 11.0.50727.1 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_DLL
|
| Language | English - United States |
| CompanyName | Microsoft Corporation |
| FileDescription | VSPerf Performance Control Tool |
| FileVersion (#2) | 11.0.50727.1 built by: RTMREL |
| InternalName | VSPerfCmdUI.dll |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | VSPerfCmdUI.dll |
| ProductName | Microsoft® Visual Studio® 2012 |
| ProductVersion (#2) | 11.0.50727.1 |
| Resource LangID | English - United States |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2012-Jul-26 21:23:14 |
| Version | 0.0 |
| SizeofData | 38 |
| AddressOfRawData | 0x4ae90 |
| PointerToRawData | 0x49a90 |
| Referenced File | VSPerfCmd.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2012-Jul-26 21:23:14 |
| Version | 0.0 |
| SizeofData | 16 |
| AddressOfRawData | 0x4aeb8 |
| PointerToRawData | 0x49ab8 |
| Size | 0x70 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140059088 |
| XOR Key | 0xdd8cd081 |
|---|---|
| Unmarked objects | 0 |
| 188 (30716) | 2 |
| 190 (30716) | 1 |
| Imports (50628) | 2 |
| C++ objects (50628) | 67 |
| C objects (50628) | 135 |
| ASM objects (50628) | 12 |
| Total imports | 265 |
| 185 (30716) | 23 |
| 211 (50628) | 62 |
| Resource objects (50628) | 1 |
| Linker (50628) | 1 |
No comments yet.