| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Jun-04 09:29:02 |
| Detected languages |
English - United States
|
| Debug artifacts |
MpDlpService.pdb
|
| CompanyName | Microsoft Corporation |
| FileDescription | Microsoft Data Loss Prevention Service |
| InternalName | MpDlpService.exe |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | MpDlpService.exe |
| ProductName | Microsoft® Windows® Operating System |
| FileVersion | 4.18.23110.3 (9ebb3643d539a6fc4659898b1df3124d5da4c0a9) |
| ProductVersion | 4.18.23110.3 |
| Info | Matching compiler(s): | Microsoft Visual C++ 8.0 |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains references to security software:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to RC5 or RC6
Microsoft's Cryptography API |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Info | The PE is digitally signed. |
Signer: Microsoft Windows Publisher
Issuer: Microsoft Windows Production PCA 2011 |
| Safe | VirusTotal score: 0/71 (Scanned on 2026-05-02 02:01:49) | All the AVs think this file is safe. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf8 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2026-Jun-04 09:29:02 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x74000 |
| SizeOfInitializedData | 0x34000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00000000000053E0 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x1000 |
| OperatingSystemVersion | A.0 |
| ImageVersion | A.0 |
| SubsystemVersion | 6.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xa9000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0xafe0f |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x80000 |
| SizeofStackCommit | 0x2000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| ADVAPI32.dll |
UnregisterTraceGuids
RegisterTraceGuidsW GetTraceEnableLevel GetTraceEnableFlags GetTraceLoggerHandle TraceMessage RegCloseKey GetSecurityDescriptorSacl AllocateAndInitializeSid SetEntriesInAclW SetNamedSecurityInfoW CopySid FreeSid CheckTokenMembership EventUnregister EventRegister EventWriteTransfer ChangeServiceConfig2W LookupPrivilegeValueW AdjustTokenPrivileges CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatus NotifyServiceStatusChangeW StartServiceW CreateProcessAsUserW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW GetLengthSid RegQueryValueExW RegOpenKeyExW RegSetValueExW OpenProcessToken ChangeServiceConfigW QueryServiceConfigW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW GetTokenInformation ConvertSidToStringSidW SetSecurityInfo InitializeAcl |
|---|---|
| KERNEL32.dll |
CloseHandle
EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess RaiseException GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeCriticalSectionEx DebugBreak GetFileAttributesW WaitForSingleObject GetTickCount64 OutputDebugStringW FormatMessageW GetProcessTimes ProcessIdToSessionId LoadLibraryW GetFileInformationByHandle AcquireSRWLockShared ReleaseSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockExclusive ExpandEnvironmentStringsW QueryDosDeviceW CreateSemaphoreExW HeapFree ReleaseSemaphore GetModuleHandleExW ReleaseMutex OpenSemaphoreW CreateMutexExW GetProcessHeap CompareFileTime lstrcmpW DeleteFileW FindClose OpenProcess SleepEx CreateFileW LocalFree GetDriveTypeW DeleteTimerQueueTimer LCMapStringW UnregisterWaitEx MultiByteToWideChar WideCharToMultiByte FormatMessageA GetModuleFileNameW GetSystemDirectoryW HeapSetInformation CreateProcessW CreateDirectoryW ReadFile FindFirstFileW GetFileSizeEx CreateTimerQueueTimer FindNextFileW WriteFile RegisterWaitForSingleObject SetEnvironmentVariableW SetFilePointerEx LoadLibraryExW FileTimeToSystemTime GetLocalTime GetSystemTime DeviceIoControl HeapAlloc GetFinalPathNameByHandleW WriteConsoleW SetEndOfFile ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapSize CompareStringW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW GetFileType SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW FindFirstFileExW HeapReAlloc GetOEMCP GetACP IsValidCodePage FreeLibraryAndExitThread ExitThread CreateThread GetCommandLineW GetCommandLineA ExitProcess GetStdHandle GetCPInfo LCMapStringEx DecodePointer InitOnceComplete InitOnceBeginInitialize GetLocaleInfoEx SetErrorMode GetProcAddress FreeLibrary GetModuleFileNameA GetStringTypeW VirtualLock |
| mpclient.dll |
MpConfigUninitialize
MpClientUtilExportFunctions MpFreeMemory MpAllocMemory MpConfigRegisterForNotifications MpConfigGetValue MpConfigOpen MpConfigUnregisterNotifications MpConfigClose MpConfigGetValueAlloc MpConfigSetValue MpConfigInitialize |
| WTSAPI32.dll |
WTSQueryUserToken
|
| ntdll.dll |
RtlUnwind
RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlNtStatusToDosError NtQueryInformationProcess RtlGetVersion |
| CRYPT32.dll |
CertVerifyCertificateChainPolicy
|
| ole32.dll |
CreateBindCtx
CoSetProxyBlanket CoTaskMemFree CoCreateInstance |
| RPCRT4.dll |
RpcImpersonateClient
RpcBindingToStringBindingW RpcStringBindingParseW RpcBindingInqAuthClientW RpcStringFreeW RpcServerRegisterAuthInfoW RpcServerUseProtseqW RpcRevertToSelf RpcServerInqBindings RpcEpRegisterW RpcServerRegisterIfEx RpcBindingVectorFree RpcEpUnregister RpcServerUnregisterIf NdrServerCallAll NdrServerCall2 |
| USERENV.dll |
CreateEnvironmentBlock
DestroyEnvironmentBlock ExpandEnvironmentStringsForUserW |
| WINTRUST.dll |
WTHelperGetProvSignerFromChain
CryptCATAdminCalcHashFromFileHandle CryptCATAdminAcquireContext WinVerifyTrust CryptCATCatalogInfoFromContext CryptCATAdminReleaseCatalogContext CryptCATAdminReleaseContext WTHelperProvDataFromStateData CryptCATAdminEnumCatalogFromHash |
| urlmon.dll |
MkParseDisplayNameEx
|
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 4.18.23110.3 |
| ProductVersion | 4.18.23110.3 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | Microsoft Corporation |
| FileDescription | Microsoft Data Loss Prevention Service |
| InternalName | MpDlpService.exe |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | MpDlpService.exe |
| ProductName | Microsoft® Windows® Operating System |
| FileVersion (#2) | 4.18.23110.3 (9ebb3643d539a6fc4659898b1df3124d5da4c0a9) |
| ProductVersion (#2) | 4.18.23110.3 |
| Resource LangID | English - United States |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Jun-04 09:29:02 |
| Version | 0.0 |
| SizeofData | 41 |
| AddressOfRawData | 0x91c1c |
| PointerToRawData | 0x91c1c |
| Referenced File | MpDlpService.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Jun-04 09:29:02 |
| Version | 0.0 |
| SizeofData | 1264 |
| AddressOfRawData | 0x91c48 |
| PointerToRawData | 0x91c48 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Jun-04 09:29:02 |
| Version | 0.0 |
| SizeofData | 36 |
| AddressOfRawData | 0x92160 |
| PointerToRawData | 0x92160 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Jun-04 09:29:02 |
| Version | 0.0 |
| SizeofData | 4 |
| AddressOfRawData | 0x92184 |
| PointerToRawData | 0x92184 |
| StartAddressOfRawData | 0x1400921a8 |
|---|---|
| EndAddressOfRawData | 0x1400921b0 |
| AddressOfIndex | 0x14009d2a8 |
| AddressOfCallbacks | 0x14007b908 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x14009c690 |
| GuardCFCheckFunctionPointer | 5369214640 |
| GuardCFDispatchFunctionPointer | 0 |
| GuardCFFunctionTable | 0 |
| GuardCFFunctionCount | 0 |
| GuardFlags | (EMPTY) |
| CodeIntegrity.Flags | 0 |
| CodeIntegrity.Catalog | 0 |
| CodeIntegrity.CatalogOffset | 0 |
| CodeIntegrity.Reserved | 0 |
| GuardAddressTakenIatEntryTable | 0 |
| GuardAddressTakenIatEntryCount | 0 |
| GuardLongJumpTargetTable | 0 |
| GuardLongJumpTargetCount | 0 |
| XOR Key | 0xb256641e |
|---|---|
| Unmarked objects | 0 |
| C objects (32595) | 37 |
| C++ objects (32595) | 229 |
| ASM objects (32595) | 23 |
| Imports (32595) | 31 |
| Total imports | 434 |
| 126 (VS2012 build 50727 / VS2005 build 50727) | 10 |
| C++ objects (LTCG) (32595) | 175 |
| Resource objects (32595) | 1 |
| Linker (32595) | 1 |
No comments yet.