82bbac014c88110eec071d10fe60b9cd0115334e840b605ad9ade3bfed1e2d2e

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-May-11 12:54:52
Detected languages English - United States
TLS Callbacks 1 callback(s) detected.
Debug artifacts eRmm.pdb
CompanyName ESET
FileDescription Remote monitoring and management
FileVersion 10.64.10013.0
InternalName eRmm.exe
LegalCopyright Copyright (c) ESET, spol. s r.o. 1992-2026. All rights reserved.
LegalTrademarks NOD, NOD32, AMON, ESET are registered trademarks of ESET.
OriginalFilename eRmm.exe
ProductName ESET Security
ProductVersion 13.0.12005.0

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Info Interesting strings found in the binary: Contains domain names:
  • crl.microsoft.com
  • http://crl.microsoft.com
  • http://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0
  • http://logo.verisign.com
  • http://logo.verisign.com/vslogo.gif0
  • http://www.microsoft.com
  • http://www.microsoft.com/pki/certs/MicrosoftCodeVerifRoot.crt0
  • logo.verisign.com
  • microsoft.com
  • verisign.com
  • www.microsoft.com
Info Cryptographic algorithms detected in the binary: Uses constants related to MD5
Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to SHA512
Uses constants related to RC5 or RC6
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryW
  • GetProcAddress
  • LoadLibraryExW
 Functions which can be used for anti-debugging purposes:
  • SwitchToThread
 Memory manipulation functions often used by packers:
  • VirtualProtect
  • VirtualAlloc
 Functions related to the privilege level:
  • OpenProcessToken
Info The PE is digitally signed. Signer: ESET
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Safe VirusTotal score: 0/58 (Scanned on 2026-10-25 22:21:43) All the AVs think this file is safe.

Hashes

MD5 9955f323aa5f0681192552f3e921ecbf 🔍
SHA1 9efb5b25a67bd6bec6a1b101cb3a4d75e1f07b30 🔍
SHA256 82bbac014c88110eec071d10fe60b9cd0115334e840b605ad9ade3bfed1e2d2e 🔍
SHA3 1e305cd35d429148dd636748ede2beebca2485fe699d12c053cf4b2b7d5e5d13 🔍
SSDeep 24576:xupSvxsGIkK3kNzgb3tg8TMS61OKQW4ff/s93:x8ssCNzgDtg8TaNQzH 🔍
Imports Hash e8b20eb0a84502f8a8ab8fe4a6d01857 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-May-11 12:54:52
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xae600
SizeOfInitializedData 0x39a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000000A5D60 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xeb000
SizeOfHeaders 0x400
Checksum 0xfa31a
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d437410b3c0d83c4e2190b3eae0cd7ee 🔍
SHA1 ea26345794b0a76da08ba6f85d7ac37def18cf2a 🔍
SHA256 47fbbf1bc63c634dfe9412f758604ff4ff6963518004ff57634db1a10bda4e85 🔍
SHA3 b8f5732129a3a5c77f2fc88e44303bbf92890a2a93e487b70a69f9e3627b65d8 🔍
VirtualSize 0xae4d7
VirtualAddress 0x1000
SizeOfRawData 0xae600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.4272

.rdata

MD5 d76b2a2c7ce7ddebd893c83fe4911b38 🔍
SHA1 306176b7d01c76e512078d05845ae29df7919f00 🔍
SHA256 3a681270787d24f0c2a3089fd8ff4045ba44def0d2e758ce88719dd11a7030f6 🔍
SHA3 002acdb3cff240d8cdb99682f6e323e0b013f0d39f71eb95406d35012a2ebc09 🔍
VirtualSize 0x2cc48
VirtualAddress 0xb0000
SizeOfRawData 0x2ce00
PointerToRawData 0xaea00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.99407

.data

MD5 5d924b4dfb0a1b8fa013d8df88217311 🔍
SHA1 fa65003af9968c5863397ac1770829a5889b88ce 🔍
SHA256 51f6e03367390139c7ed59b5491287e57ec96b3fe65784757688d37be54d668a 🔍
SHA3 420603fa492b81847e85b81102d7ed5413e6e26d9af1fc0455e289897f59df41 🔍
VirtualSize 0x4340
VirtualAddress 0xdd000
SizeOfRawData 0x3000
PointerToRawData 0xdb800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.38989

.pdata

MD5 53582905d588275c3f1885cd4ea6c717 🔍
SHA1 b193d31ecf66f4039de50bf484ba150ca1bf3b94 🔍
SHA256 f2d83f707483cf7f5247cb39fe6c221fce9efb7d5c6e544919fec8165f1654e9 🔍
SHA3 cf7fa0cc424bf342be66a627b99b3f98689244bd9dd50067054c86d2d7d68d9a 🔍
VirtualSize 0x6c3c
VirtualAddress 0xe2000
SizeOfRawData 0x6e00
PointerToRawData 0xde800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.90957

.rsrc

MD5 2cb4cab92dddf03a5ca26ce1fd310411 🔍
SHA1 4eb313018db09ce95f9afafa2ac9abaedc67520e 🔍
SHA256 1e65dd13816f299ca12c4dd541f04d466f0e00fd9ed0fbfd5bbdda3562298b2a 🔍
SHA3 5845fec106a905f1440f50c4f97d7fc9a4655904205aee78a239c08e675ac1cb 🔍
VirtualSize 0xb48
VirtualAddress 0xe9000
SizeOfRawData 0xc00
PointerToRawData 0xe5600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.80129

.reloc

MD5 ae8308ae3a855e557d183dbd495fe6c6 🔍
SHA1 5c71b8c2ddf9859d1b78cf595e94bde3ec591629 🔍
SHA256 8ecb36a54b48e9195b8854696e5868c897dba3a4fdec653aa5cdaf359b10e6d2 🔍
SHA3 38297bb06f12677597702db250b7e74af1ccd860fdc36879fbb916e9df88e4a3 🔍
VirtualSize 0xd00
VirtualAddress 0xea000
SizeOfRawData 0xe00
PointerToRawData 0xe6200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.29928

Imports

ProtobufLite.dll ?fixed_address_empty_string@internal@protobuf@google@@3V?$ExplicitlyConstructed@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@$07@123@A
?VarintParseSlow64@internal@protobuf@google@@YA?AU?$pair@PEBD_K@std@@PEBDI@Z
?VarintParseSlow32@internal@protobuf@google@@YA?AU?$pair@PEBDI@std@@PEBDI@Z
?ParseMessage@ParseContext@internal@protobuf@google@@QEAAPEBDPEAVMessageLite@34@PEBD@Z
?UnknownFieldParse@internal@protobuf@google@@YAPEBDIPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBDPEAVParseContext@123@@Z
?kGlobalEmptyTable@internal@protobuf@google@@3QBQEAXB
?Set@ArenaStringPtr@internal@protobuf@google@@QEAAXPEBDPEAVArena@34@@Z
?GetArenaForAllocation@MessageLite@protobuf@google@@IEBAPEAVArena@23@XZ
??$DoMergeFrom@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@InternalMetadata@internal@protobuf@google@@AEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??$DoClear@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@InternalMetadata@internal@protobuf@google@@AEAAXXZ
?AppendToString@MessageLite@protobuf@google@@QEBA_NPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?ParseFromArray@MessageLite@protobuf@google@@QEAA_NPEBXH@Z
?AddOutOfLineHelper@RepeatedPtrFieldBase@internal@protobuf@google@@AEAAPEAXPEAX@Z
?DestroyProtos@RepeatedPtrFieldBase@internal@protobuf@google@@IEAAXXZ
?ClearToEmpty@ArenaStringPtr@internal@protobuf@google@@QEAAXXZ
?Destroy@ArenaStringPtr@internal@protobuf@google@@QEAAXXZ
?Set@ArenaStringPtr@internal@protobuf@google@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVArena@34@@Z
?ReadTagFallback@internal@protobuf@google@@YA?AU?$pair@PEBDI@std@@PEBDI@Z
?VerifyUTF8@internal@protobuf@google@@YA_NVStringPiece@stringpiece_internal@23@PEBD@Z
?AddCleanup@ThreadSafeArena@internal@protobuf@google@@QEAAXPEAXP6AX0@Z@Z
?InternalWriteMessage@WireFormatLite@internal@protobuf@google@@SAPEAEHAEBVMessageLite@34@HPEAEPEAVEpsCopyOutputStream@io@34@@Z
?VerifyUtf8String@WireFormatLite@internal@protobuf@google@@SA_NPEBDHW4Operation@1234@0@Z
?InitializationErrorString@MessageLite@protobuf@google@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?AllocateAlignedWithCleanup@Arena@protobuf@google@@AEAA?AU?$pair@PEAXPEAUCleanupNode@SerialArena@internal@protobuf@google@@@std@@_KPEBVtype_info@@@Z
??0CachedSize@internal@protobuf@google@@QEAA@XZ
?Done@ParseContext@internal@protobuf@google@@QEAA_NPEAPEBD@Z
?Set@CachedSize@internal@protobuf@google@@QEAAXH@Z
?Get@CachedSize@internal@protobuf@google@@QEBAHXZ
?LengthDelimitedSize@WireFormatLite@internal@protobuf@google@@SA_K_K@Z
?StringSize@WireFormatLite@internal@protobuf@google@@SA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?UInt32SizePlusOne@WireFormatLite@internal@protobuf@google@@SA_KI@Z
?InlineGreedyStringParser@internal@protobuf@google@@YAPEBDPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBDPEAVParseContext@123@@Z
?EnumSize@WireFormatLite@internal@protobuf@google@@SA_KH@Z
?MergeFromInternal@RepeatedPtrFieldBase@internal@protobuf@google@@AEAAXAEBV1234@P81234@EAAXPEAPEAX1HH@Z@Z
??1RepeatedPtrFieldBase@internal@protobuf@google@@IEAA@XZ
??1MessageLite@protobuf@google@@UEAA@XZ
??0MessageLite@protobuf@google@@IEAA@PEAVArena@12@_N@Z
?OnDemandRegisterArenaDtor@MessageLite@protobuf@google@@UEAAXPEAVArena@23@@Z
??0MessageLite@protobuf@google@@QEAA@XZ
?InitDefault@ArenaStringPtr@internal@protobuf@google@@QEAAXXZ
??0ArenaStringPtr@internal@protobuf@google@@QEAA@PEAV?$ExplicitlyConstructed@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@$07@123@UConstantInitialized@123@@Z
?AllocateAlignedWithHook@Arena@protobuf@google@@AEAAPEAX_K0PEBVtype_info@@@Z
?AllocateAlignedWithHookForArray@Arena@protobuf@google@@AEAAPEAX_K0PEBVtype_info@@@Z
?WriteVarint32SignExtendedToArray@CodedOutputStream@io@protobuf@google@@SAPEAEHPEAE@Z
?WriteVarint32ToArray@CodedOutputStream@io@protobuf@google@@SAPEAEIPEAE@Z
?WriteStringMaybeAliased@EpsCopyOutputStream@io@protobuf@google@@QEAAPEAEIAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAE@Z
?WriteRaw@EpsCopyOutputStream@io@protobuf@google@@QEAAPEAEPEBXHPEAE@Z
?EnsureSpace@EpsCopyOutputStream@io@protobuf@google@@QEAAPEAEPEAE@Z
?WriteStringOutline@EpsCopyOutputStream@io@protobuf@google@@AEAAPEAEIAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAE@Z
?ReadSizeAndPushLimitAndDepth@ParseContext@internal@protobuf@google@@AEAAPEBDPEBDPEAH@Z
?ReadSizeFallback@internal@protobuf@google@@YA?AU?$pair@PEBDH@std@@PEBDI@Z
?ReadString@EpsCopyInputStream@internal@protobuf@google@@QEAAPEBDPEBDHPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?PopLimit@EpsCopyInputStream@internal@protobuf@google@@QEAA_NH@Z
?UInt32Size@WireFormatLite@internal@protobuf@google@@SA_KI@Z
?VarintSize32@CodedOutputStream@io@protobuf@google@@SA_KI@Z
?Int64SizePlusOne@WireFormatLite@internal@protobuf@google@@SA_K_J@Z
?Int32SizePlusOne@WireFormatLite@internal@protobuf@google@@SA_KH@Z
?Mutable@ArenaStringPtr@internal@protobuf@google@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVArena@34@@Z
?WriteVarint64ToArray@CodedOutputStream@io@protobuf@google@@SAPEAE_KPEAE@Z
KERNEL32.dll RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
SwitchToThread
OpenFileMappingW
OpenMutexW
ReleaseMutex
GetModuleFileNameW
SetUnhandledExceptionFilter
GetCurrentThreadId
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
VirtualProtect
VirtualFree
VirtualAlloc
GetSystemTimeAsFileTime
UnmapViewOfFile
MapViewOfFile
GetSystemInfo
InitializeSListHead
SetLastError
InitializeCriticalSection
GetTickCount
GetModuleHandleW
GetCurrentThread
GetLastError
GetCurrentProcess
VerSetConditionMask
VerifyVersionInfoW
LoadLibraryW
FreeLibrary
GetProcAddress
FindFirstFileW
FindClose
LocalFree
WideCharToMultiByte
MultiByteToWideChar
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDateFormatW
GetSystemTime
GetTimeFormatW
GetCurrentProcessId
Sleep
FindFirstFileExW
FindNextFileW
CreateDirectoryW
LoadLibraryExW
WaitForSingleObject
ReadFile
WriteFile
SetEndOfFile
SetFilePointer
GetFileSize
DeleteFileW
GetFileInformationByHandle
MoveFileW
GetTempPathW
GetTempFileNameW
FlushFileBuffers
GetFileTime
GetFileAttributesW
ADVAPI32.dll OpenProcessToken
AllocateAndInitializeSid
EqualSid
FreeSid
SetThreadToken
OpenThreadToken
RevertToSelf
SHELL32.dll ShellExecuteExW
MSVCP140.dll ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?uncaught_exceptions@std@@YAHXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?getline@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEA_W_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Id_cnt@id@locale@std@@0HA
?wcin@std@@3V?$basic_istream@_WU?$char_traits@_W@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
_Query_perf_counter
_Query_perf_frequency
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
VCRUNTIME140_1.dll __CxxFrameHandler4
VCRUNTIME140.dll _CxxThrowException
__current_exception_context
memmove
memset
memcpy
memcmp
strstr
_set_se_translator
__C_specific_handler
_purecall
wcsrchr
__std_type_info_compare
__std_exception_destroy
__std_exception_copy
strchr
__current_exception
api-ms-win-crt-runtime-l1-1-0.dll _register_thread_local_exe_atexit_callback
terminate
signal
_c_exit
abort
__p___wargv
__p___argc
_register_onexit_function
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_crt_atexit
_set_app_type
_seh_filter_exe
_cexit
_invoke_watson
_invalid_parameter_noinfo
_errno
_initialize_onexit_table
api-ms-win-crt-heap-l1-1-0.dll _set_new_mode
realloc
_callnewh
malloc
free
calloc
api-ms-win-crt-convert-l1-1-0.dll wcstoll
strtoll
wcstod
strtod
strtoul
_ecvt_s
wcstoul
api-ms-win-crt-string-l1-1-0.dll isalpha
isspace
isdigit
wcspbrk
wcscat_s
strcat_s
strncpy_s
strcpy_s
_stricmp
wcsncpy_s
strcmp
tolower
toupper
towlower
towupper
_strnicmp
wcscpy_s
_wcsnicmp
api-ms-win-crt-stdio-l1-1-0.dll fwrite
fread
_fseeki64
__stdio_common_vsscanf
fflush
fgetc
fputc
ungetc
setvbuf
fsetpos
fgetpos
__stdio_common_vswprintf
_get_stream_buffer_pointers
__stdio_common_vswprintf_s
__stdio_common_vsnprintf_s
_set_fmode
__p__commode
__stdio_common_vsprintf
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf_s
fclose
api-ms-win-crt-time-l1-1-0.dll _localtime64_s
_mkgmtime64
_gmtime64_s
_time64
wcsftime
_mktime64
api-ms-win-crt-utility-l1-1-0.dll qsort
bsearch
api-ms-win-crt-math-l1-1-0.dll _finite
_isnan
fmod
floor
ceil
__setusermatherr
api-ms-win-crt-filesystem-l1-1-0.dll _unlock_file
_lock_file
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale

Delayed Imports

1

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x3e0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.50388
MD5 1f8d4ed33a8c25e435eccb7ce3cafde4 🔍
SHA1 9357b15b89c5d82ca484e67d9facfc1da7d85353 🔍
SHA256 c96a9beed8ec55af33220131126347ebb39c3bfe6f1d3a31f6b29c50b81ecfe5 🔍
SHA3 5c7f12632b582b89a7aea587ddf18907adece6e720b170652d638a0156882a19 🔍

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x6c5
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.14382
MD5 1db692c55f5952277b7e507c94b7e20e 🔍
SHA1 0a03d301bbeeb8d7759fbf15166984c79adec19e 🔍
SHA256 30256d2e078aa819f7bc656f0477a66494aaf3c28f508028063c12b31803857d 🔍
SHA3 6c7713e71bfac717d970a5e5f77f42d83fe7402e252325b71830b528191ce464 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 10.64.10013.0
ProductVersion 13.0.12005.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName ESET
FileDescription Remote monitoring and management
FileVersion (#2) 10.64.10013.0
InternalName eRmm.exe
LegalCopyright Copyright (c) ESET, spol. s r.o. 1992-2026. All rights reserved.
LegalTrademarks NOD, NOD32, AMON, ESET are registered trademarks of ESET.
OriginalFilename eRmm.exe
ProductName ESET Security
ProductVersion (#2) 13.0.12005.0
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-May-11 12:54:52
Version 0.0
SizeofData 33
AddressOfRawData 0xc7aec
PointerToRawData 0xc64ec
Referenced File eRmm.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2026-May-11 12:54:52
Version 0.0
SizeofData 20
AddressOfRawData 0xc7b10
PointerToRawData 0xc6510

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-May-11 12:54:52
Version 0.0
SizeofData 1352
AddressOfRawData 0xc7b24
PointerToRawData 0xc6524

UNKNOWN

Characteristics 0
TimeDateStamp 2026-May-11 12:54:52
Version 0.0
SizeofData 4
AddressOfRawData 0xc806c
PointerToRawData 0xc6a6c

TLS Callbacks

StartAddressOfRawData 0x1400c8090
EndAddressOfRawData 0x1400c8098
AddressOfIndex 0x1400e04f0
AddressOfCallbacks 0x1400b0b48
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks 0x000000014001EE60

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0xa00
EditList 0
SecurityCookie 0x1400dd180
GuardCFCheckFunctionPointer 5369432576
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0xba0e05e1
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 20
C objects (35207) 10
C++ objects (35207) 42
ASM objects (35207) 6
Imports (35207) 6
Imports (33145) 14
Imports (35226) 3
Total imports 540
Unmarked objects (#2) 37
C++ objects (LTCG) (35226) 152
Resource objects (35226) 1
151 1
Linker (35226) 1

Errors

Leave a comment

No comments yet.