Fondue.exe

  • File Path: C:\Windows\system32\Fondue.exe
  • Description: Windows Features on Demand UX

Screenshot

Fondue.exe

Hashes

Type Hash
MD5 237E1F3944532E26BB1EB945798DB582
SHA1 D0F203A9692CAF03AA92F77A63058221191999EE
SHA256 52319D1A4C727BAC0A328383F4A571DEC7B7B72EF6D50913E9212834983C5547
SHA384 629E9539E2B1F9333168434461502E5692231B0C3724B2EF0168756127E2EC80357D905F6B909E9E48A1CD7C97BA5585
SHA512 F7DEA6AB00E89B871E7580FDF3F790E27BE8E6F4D265106C7311F51FA16E9E907881B8D672FF418D000597058392E2EF32BE3CD10CE74A0CE9389D3C7A99E376
SSDEEP 3072:rexYNbibEaznWfH22ZsuX2xKwMPTnaSrIrvDJ:6Eb0znWjZnXeKwMLnaqY
IMP E8309E14FD0CD5D0959FCC7F5E47D546
PESHA1 5AC03405715EE1CD71A30F2E00BFE7AF6EABC9D5
PE256 AF0E79174AC1F061BA2B64BBDE2DA8C12316F8A42C4970DA80F7505882BCEEF1

Runtime Data

Window Title:

Windows Features

Open Handles:

Path Type
(R-D) C:\Windows\Fonts\StaticCache.dat File
(R-D) C:\Windows\System32\en-US\appwiz.cpl.mui File
(R-D) C:\Windows\System32\en-US\Fondue.exe.mui File
(RW-) C:\Users\user File
(RW-) C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.488_none_ca04af081b815d21 File
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2 Section
\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\Sessions\1\Windows\Theme1175649999 Section
\Windows\Theme601709542 Section

Loaded Modules:

Path
C:\Windows\system32\Fondue.exe
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\SYSTEM32\ntdll.dll

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: Fondue.EXE.MUI
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/76
  • VirusTotal Link: https://www.virustotal.com/gui/file/52319d1a4c727bac0a328383f4a571dec7b7b72ef6d50913e9212834983c5547/detection

File Similarity (ssdeep match)

File Score
C:\windows\system32\Fondue.exe 88
C:\WINDOWS\system32\Fondue.exe 85
C:\WINDOWS\system32\Fondue.exe 82
C:\Windows\system32\Fondue.exe 85
C:\Windows\system32\Fondue.exe 86
C:\WINDOWS\system32\OptionalFeatures.exe 79
C:\Windows\system32\OptionalFeatures.exe 82
C:\Windows\system32\OptionalFeatures.exe 86
C:\WINDOWS\system32\OptionalFeatures.exe 86
C:\Windows\system32\OptionalFeatures.exe 85
C:\Windows\SysWOW64\Fondue.exe 85
C:\WINDOWS\SysWOW64\Fondue.exe 91
C:\windows\SysWOW64\Fondue.exe 82
C:\WINDOWS\SysWOW64\Fondue.exe 77
C:\Windows\SysWOW64\Fondue.exe 85
C:\Windows\SysWOW64\Fondue.exe 91

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

fondue

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Enables Windows optional features by downloading required files from Windows Update or another source specified by Group Policy. The manifest file for the feature must already be installed in your Windows image.

Syntax

fondue.exe /enable-feature:<feature_name> [/caller-name:<program_name>] [/hide-ux:{all | rebootrequest}]

Parameters

Parameter Description
/enable-feature:<feature_name> Specifies the name of the Windows optional feature you want to enable. You can only enable one feature per command line. To enable multiple features, use fondue.exe for each feature.
/caller-name:<program_name> Specifies the program or process name when you call fondue.exe from a script or batch file. You can use this option to add the program name to the SQM report if there is an error.
/hide-ux:{all | rebootrequest} Use all to hide all messages to the user including progress and permission requests to access Windows Update. If permission is required, the operation will fail.<p>Use rebootrequest to only hide user messages asking for permission to reboot the computer. Use this option if you have a script that controls reboot requests.

Examples

To enable Microsoft .NET Framework 4.8, type:

fondue.exe /enable-feature:NETFX4

To enable Microsoft .NET Framework 4.8, add the program name to the SQM report, and not display messages to the user, type:

fondue.exe /enable-feature:NETFX4 /caller-name:Admin.bat /hide-ux:all

Additional References

MIT License. Copyright (c) 2020-2021 Strontic.