Fondue.exe

  • File Path: C:\WINDOWS\SysWOW64\Fondue.exe
  • Description: Windows Features on Demand UX

Screenshot

Fondue.exe

Hashes

Type Hash
MD5 1A274BFE1306A75C215A832F274F4E44
SHA1 9D610EC688783599877CA71E00382EF7C1E47611
SHA256 B28684090E0C877C71D0E37958BF0EE18FC4F6614A69B99C19E6CE90EA3B294C
SHA384 6378BBB89DBFB71D432C3262FAC4044277B82038D814106003F4DB451C639C7C2E8859883B6413D773080C758FBF0A71
SHA512 B6A69396C5D927F28A5A370DDD975CB3B2CFFA0184680F1864D801FE03044A2C66EF3E3A110620B37B9C23EFACFE35451286110EF1217159253A78AF63989A01
SSDEEP 3072:qRwpDH5nwbEaznWfH22ZsuX2xKwMPTnaSrIrvDa:KwB5nOznWjZnXeKwMLnaqY
IMP C90A9B51B5004E7BF81F560D871186E8
PESHA1 F49C4D6577938072C9B7E2280BA1F8583EF66FFD
PE256 0959BEB86717538583F62841C426A06C32F2B795A34AF126689589BDEDB21FF6

Runtime Data

Child Processes:

Fondue.exe

Open Handles:

Path Type
(R-D) C:\Windows\System32\en-US\propsys.dll.mui File
(R-D) C:\Windows\SysWOW64\en-US\Fondue.exe.mui File
(RW-) C:\Windows File
(RW-) C:\Windows\SysWOW64 File
(RW-) C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22000.120_none_e541a94fcce8ed6d File
\BaseNamedObjects__ComCatalogCache__ Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro Section
\BaseNamedObjects\windows_shell_global_counters Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\Sessions\2\BaseNamedObjects\UrlZonesSM_TI-ADMIN Section
\Sessions\2\BaseNamedObjects\windows_shell_global_counters Section

Loaded Modules:

Path
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\System32\wow64.dll
C:\WINDOWS\System32\wow64base.dll
C:\WINDOWS\System32\wow64con.dll
C:\WINDOWS\System32\wow64cpu.dll
C:\WINDOWS\System32\wow64win.dll
C:\WINDOWS\SysWOW64\Fondue.exe

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: Fondue.EXE.MUI
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.22000.1 (WinBuild.160101.0800)
  • Product Version: 10.0.22000.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/74
  • VirusTotal Link: https://www.virustotal.com/gui/file/b28684090e0c877c71d0e37958bf0ee18fc4f6614a69b99c19e6ce90ea3b294c/detection

File Similarity (ssdeep match)

File Score
C:\Windows\system32\Fondue.exe 77
C:\windows\system32\Fondue.exe 83
C:\WINDOWS\system32\Fondue.exe 80
C:\WINDOWS\system32\Fondue.exe 85
C:\Windows\system32\Fondue.exe 77
C:\Windows\system32\Fondue.exe 82
C:\WINDOWS\system32\OptionalFeatures.exe 79
C:\Windows\system32\OptionalFeatures.exe 80
C:\Windows\system32\OptionalFeatures.exe 85
C:\WINDOWS\system32\OptionalFeatures.exe 80
C:\Windows\system32\OptionalFeatures.exe 85
C:\Windows\SysWOW64\Fondue.exe 86
C:\WINDOWS\SysWOW64\Fondue.exe 82
C:\windows\SysWOW64\Fondue.exe 77
C:\Windows\SysWOW64\Fondue.exe 80
C:\Windows\SysWOW64\Fondue.exe 82

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

fondue

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Enables Windows optional features by downloading required files from Windows Update or another source specified by Group Policy. The manifest file for the feature must already be installed in your Windows image.

Syntax

fondue.exe /enable-feature:<feature_name> [/caller-name:<program_name>] [/hide-ux:{all | rebootrequest}]

Parameters

Parameter Description
/enable-feature:<feature_name> Specifies the name of the Windows optional feature you want to enable. You can only enable one feature per command line. To enable multiple features, use fondue.exe for each feature.
/caller-name:<program_name> Specifies the program or process name when you call fondue.exe from a script or batch file. You can use this option to add the program name to the SQM report if there is an error.
/hide-ux:{all | rebootrequest} Use all to hide all messages to the user including progress and permission requests to access Windows Update. If permission is required, the operation will fail.<p>Use rebootrequest to only hide user messages asking for permission to reboot the computer. Use this option if you have a script that controls reboot requests.

Examples

To enable Microsoft .NET Framework 4.8, type:

fondue.exe /enable-feature:NETFX4

To enable Microsoft .NET Framework 4.8, add the program name to the SQM report, and not display messages to the user, type:

fondue.exe /enable-feature:NETFX4 /caller-name:Admin.bat /hide-ux:all

Additional References

MIT License. Copyright (c) 2020-2021 Strontic.