bbebf17b8d67ccc9d15b430613b751b071d5bc3189bc61764fa991f3074e1d7a

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Jun-26 04:28:48
Debug artifacts D:\a\_work\1\s\src\runtime\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
CompanyName Windows資格情報ビューア
FileDescription Windows資格情報ビューア
FileVersion 1.0.0.0
InternalName Windows資格情報ビューア.dll
LegalCopyright
OriginalFilename Windows資格情報ビューア.dll
ProductName Windows資格情報ビューア
ProductVersion 1.0.0
Assembly Version 1.0.0.0

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • https://aka.ms
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
  • LoadLibraryA
 Functions which can be used for anti-debugging purposes:
  • SwitchToThread
 Can access the registry:
  • RegCloseKey
  • RegOpenKeyExW
  • RegGetValueW
 Possibly launches other programs:
  • ShellExecuteW
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 e4702089d327ffa20cf4e281d0ea5c69 🔍
SHA1 a046ab46c8df8e488700bbdd81875c8e39306e79 🔍
SHA256 bbebf17b8d67ccc9d15b430613b751b071d5bc3189bc61764fa991f3074e1d7a 🔍
SHA3 87fcc701f07f3cb7af38c6319bd3f31da5e7c2474665a990c8dd8431e8de4c9f 🔍
SSDeep 3072:VVDxk88wN1xL+x7dL1Z9QnlP97E3swm9uzaAT5jr+2ymU:jRax7F1nQnhcUJ0s 🔍
Imports Hash 53e4e12437621212a425d294842d0a96 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Jun-26 04:28:48
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x18400
SizeOfInitializedData 0x15600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000013BA0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x32000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x180000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 e339f76efadd4ce34819f7605f952957 🔍
SHA1 d8c0408818589e37962d999ec6af7d260d898b1f 🔍
SHA256 0268b1011057c783acb003a54d61af8f3db469a2d1b161a52c939ed4a38b3c37 🔍
SHA3 f31a5c6c26b1db46ba1d7db704cba1ea1369e764c5b0c26a91b3aa76abc9d548 🔍
VirtualSize 0x183bc
VirtualAddress 0x1000
SizeOfRawData 0x18400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.36586

.rdata

MD5 ac02bae2a4c2863f242f89894f1ceb11 🔍
SHA1 ed8c628e7b2359c1272bb384a26e9a227dfa4841 🔍
SHA256 a52d2655049634a455852007f76e07955ebdc89f83bac0d13b6b4e19f77303e3 🔍
SHA3 c5c1fbb544b05fdd1c93f27acb794917a0ec574d4f643ca2210ed2c60aada5fc 🔍
VirtualSize 0xc5fe
VirtualAddress 0x1a000
SizeOfRawData 0xc600
PointerToRawData 0x18800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.84858

.data

MD5 e0c455d26805d8bd919ea44f0ce49146 🔍
SHA1 9c0c21447bc385c4f1d3bfbb98efcb4624537072 🔍
SHA256 0fa8cafa80a3548e7fe8bc055e3dc4d38766c212e148111d7cfbc6f7474ed010 🔍
SHA3 0ef7f28e52195548a8621a6537cde2f8d32f0aacc19c8da76e9d18bd80041f86 🔍
VirtualSize 0x1a40
VirtualAddress 0x27000
SizeOfRawData 0xc00
PointerToRawData 0x24e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.30907

.pdata

MD5 24165f8dfccb28f7da4cf026f3968201 🔍
SHA1 4c13384f8be4365f23e7cf1c8572599e9d2e2fcf 🔍
SHA256 46ccf92b7ee0d9686b75fda66946fcb333a0db8a3537cdfa6b4a06f2d5c931aa 🔍
SHA3 3b6e5f48f316f873f1ba655459440c348f39549325278e1772984e38c9279573 🔍
VirtualSize 0x14c4
VirtualAddress 0x29000
SizeOfRawData 0x1600
PointerToRawData 0x25a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.9072

.reloc

MD5 b8472d51988d5beb6dd6b7775bd86a3d 🔍
SHA1 fcb4f44e00d0c78d8c02e26cb1ef31d844b28625 🔍
SHA256 1c65c020d394bac1d3c25e86dffa7c7e5ad69170ee0b21134f827ee507c43afc 🔍
SHA3 7afe2b2194e8554434f83ea26af9aad4e2aedf047862193dd360b946496157a9 🔍
VirtualSize 0x33c
VirtualAddress 0x2b000
SizeOfRawData 0x400
PointerToRawData 0x27000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.80636

.rsrc

MD5 3ff3bba90d580ceacacfbbed3c5f03c3 🔍
SHA1 885c4df73554309f8c1bd4e010b8421d15a4e756 🔍
SHA256 63a28de386bebd7e6805e36272796e1563f3e91928ab68d9f90ad34423436e8d 🔍
SHA3 1dd9f2cc5ad6188f02e83a81159154adcd0140001095cc2f667fe7e2aa21caa3 🔍
VirtualSize 0x5900
VirtualAddress 0x2c000
SizeOfRawData 0x5a00
PointerToRawData 0x27400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.84353

Imports

SHELL32.dll ShellExecuteW
ADVAPI32.dll RegCloseKey
ReportEventW
RegisterEventSourceW
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
KERNEL32.dll TlsFree
CreateActCtxW
ActivateActCtx
GetLastError
FindResourceW
GetWindowsDirectoryW
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetStdHandle
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
GetFileAttributesW
MultiByteToWideChar
GetConsoleMode
GetFileAttributesExW
LoadLibraryA
WriteConsoleW
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
OutputDebugStringW
GetCurrentProcessId
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
USER32.dll MessageBoxW
api-ms-win-crt-runtime-l1-1-0.dll terminate
_register_thread_local_exe_atexit_callback
_c_exit
__p___wargv
__p___argc
_exit
exit
_initterm_e
_errno
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
abort
_invoke_watson
api-ms-win-crt-heap-l1-1-0.dll _set_new_mode
calloc
malloc
_callnewh
free
api-ms-win-crt-time-l1-1-0.dll _time64
_gmtime64_s
wcsftime
api-ms-win-crt-stdio-l1-1-0.dll __stdio_common_vfwprintf
__p__commode
fputwc
__acrt_iob_func
__stdio_common_vswprintf
_set_fmode
_wfsopen
fflush
setvbuf
__stdio_common_vsnwprintf_s
api-ms-win-crt-locale-l1-1-0.dll _create_locale
___mb_cur_max_func
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_configthreadlocale
setlocale
_lock_locales
_free_locale
_unlock_locales
api-ms-win-crt-string-l1-1-0.dll strlen
strcmp
wcsncmp
toupper
strcpy_s
_wcsdup
wcsnlen
api-ms-win-crt-convert-l1-1-0.dll _wtoi
wcstoul
api-ms-win-crt-math-l1-1-0.dll __setusermatherr

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x52d3
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.96403
Detected Filetype PNG graphic file
MD5 44f6d0f132d3283e3e68f98cdb9699a9 🔍
SHA1 cae71a8054d846daa69ddec9bb6a0639d7a40101 🔍
SHA256 3601c7c1f2c5ed007421fbe0ba44f2a3d78207932e7e19a5bd47cbeabc4fd0b7 🔍
SHA3 a8955b0592e0f9552f3caeff72e25eaf5fd15ff2252475cbeb643cd4ff7750d3 🔍

32512

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.51664
Detected Filetype Icon file
MD5 4c0256698175a30039cba4a79fbb1012 🔍
SHA1 02b6ef2d3b9c1e056e0959be0ea50bbd9c5a5ded 🔍
SHA256 95ccc8730d498ab81c2c38dd6ad73a84b3dcea26b6bcddeef48f9616589eaba4 🔍
SHA3 68e0853a0d9cb3834461f87f7a2138c64e56b946a2a04751dd09aea30ebd366e 🔍

1 (#2)

Type RT_VERSION
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x2fc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.69172
MD5 21f9ba242652b0d815946b5e81dd0b98 🔍
SHA1 292b0f8880717c23907889ea2a677f98ad1b2da8 🔍
SHA256 f959ef459a86ac93b01822bb27cd0a79e3391800c703979c42fd7c754c16bb1e 🔍
SHA3 fb7b3707934d748cec17309f3546fcaddcac8d6c18ff4d30531d978aaa5d76cb 🔍

1 (#3)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x1ea
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.00112
MD5 b7db84991f23a680df8e95af8946f9c9 🔍
SHA1 cac699787884fb993ced8d7dc47b7c522c7bc734 🔍
SHA256 539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a 🔍
SHA3 4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
CompanyName Windows資格情報ビューア
FileDescription Windows資格情報ビューア
FileVersion (#2) 1.0.0.0
InternalName Windows資格情報ビューア.dll
LegalCopyright
OriginalFilename Windows資格情報ビューア.dll
ProductName Windows資格情報ビューア
ProductVersion (#2) 1.0.0
Assembly Version 1.0.0.0
Resource LangID UNKNOWN

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Jun-26 19:39:09
Version 0.0
SizeofData 121
AddressOfRawData 0x22e2c
PointerToRawData 0x2162c
Referenced File D:\a\_work\1\s\src\runtime\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2026-Jun-26 19:39:09
Version 0.0
SizeofData 20
AddressOfRawData 0x22ea8
PointerToRawData 0x216a8

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Jun-26 19:39:09
Version 0.0
SizeofData 988
AddressOfRawData 0x22ebc
PointerToRawData 0x216bc

UNKNOWN

Characteristics 0
TimeDateStamp 2026-Jun-26 19:39:09
Version 0.0
SizeofData 4
AddressOfRawData 0x232c0
PointerToRawData 0x21ac0

TLS Callbacks

StartAddressOfRawData 0x1400232e8
EndAddressOfRawData 0x1400232f8
AddressOfIndex 0x140028a28
AddressOfCallbacks 0x14001a518
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_8BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0x800
EditList 0
SecurityCookie 0x1400270c0
GuardCFCheckFunctionPointer 5368816712
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0x2c9dd37e
Unmarked objects 0
ASM objects (35207) 10
C objects (35207) 13
C++ objects (35207) 86
Imports (VS2008 SP1 build 30729) 16
Imports (33145) 9
Total imports 212
C++ objects (LTCG) (35223) 10
Linker (35223) 1

Errors

Leave a comment

No comments yet.