Fondue.exe

  • File Path: C:\Windows\SysWOW64\Fondue.exe
  • Description: Windows Features on Demand UX

Screenshot

Fondue.exe

Hashes

Type Hash
MD5 69A312336DBCAE207F5D8C04520B9B3C
SHA1 F0B1B23EB18C0818897CB36E2B16E01F2E7C63ED
SHA256 8F4758F2B671E901CFC743FB7F3BD7B63094D84D55B4D8F7EB0722BA1205A6D2
SHA384 DF19C94A6C044779BEE023A238A9620004DA04D1673E8DA31E3325ECF0CDE9F18172A4508B477B082F5C7BF6AFF57437
SHA512 88F4BEBE4973F5F29B640792D21227D99AE234A834FAAB6C0BF07DF0BB0DCAF5D020B244E8CF752E4C1BAD3D0046313455598373A64947B65E690CAD64F600B8
SSDEEP 3072:2zslQbEaznWfH22ZsuX2xKwMPTnaSrIrvDJ:aQuznWjZnXeKwMLnaqY
IMP C90A9B51B5004E7BF81F560D871186E8
PESHA1 3A85AB9BDB5A6AD857E896F40D2070640F6DE2B9
PE256 916C757994B67FC3C554B5D9155846F1680A2D78B8820D58DD15BA74F0E5319C

Runtime Data

Child Processes:

Fondue.exe

Open Handles:

Path Type
(R-D) C:\Windows\System32\en-US\propsys.dll.mui File
(R-D) C:\Windows\SysWOW64\en-US\Fondue.exe.mui File
(RW-) C:\Users\user File
(RW-) C:\Windows File
(RW-) C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.488_none_11b1e5df2ffd8627 File
\BaseNamedObjects__ComCatalogCache__ Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2 Section
\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\BaseNamedObjects\windows_shell_global_counters Section
\Sessions\1\BaseNamedObjects\UrlZonesSM_user Section
\Sessions\1\BaseNamedObjects\windows_shell_global_counters Section

Loaded Modules:

Path
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\wow64.dll
C:\Windows\System32\wow64cpu.dll
C:\Windows\System32\wow64win.dll
C:\Windows\SysWOW64\Fondue.exe

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: Fondue.EXE.MUI
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/74
  • VirusTotal Link: https://www.virustotal.com/gui/file/8f4758f2b671e901cfc743fb7f3bd7b63094d84d55b4d8f7eb0722ba1205a6d2/detection

File Similarity (ssdeep match)

File Score
C:\Windows\system32\Fondue.exe 85
C:\windows\system32\Fondue.exe 90
C:\WINDOWS\system32\Fondue.exe 85
C:\WINDOWS\system32\Fondue.exe 82
C:\Windows\system32\Fondue.exe 85
C:\Windows\system32\Fondue.exe 86
C:\WINDOWS\system32\OptionalFeatures.exe 86
C:\Windows\system32\OptionalFeatures.exe 85
C:\Windows\system32\OptionalFeatures.exe 85
C:\WINDOWS\system32\OptionalFeatures.exe 85
C:\Windows\system32\OptionalFeatures.exe 85
C:\Windows\SysWOW64\Fondue.exe 88
C:\WINDOWS\SysWOW64\Fondue.exe 90
C:\windows\SysWOW64\Fondue.exe 85
C:\WINDOWS\SysWOW64\Fondue.exe 80
C:\Windows\SysWOW64\Fondue.exe 88

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

fondue

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Enables Windows optional features by downloading required files from Windows Update or another source specified by Group Policy. The manifest file for the feature must already be installed in your Windows image.

Syntax

fondue.exe /enable-feature:<feature_name> [/caller-name:<program_name>] [/hide-ux:{all | rebootrequest}]

Parameters

Parameter Description
/enable-feature:<feature_name> Specifies the name of the Windows optional feature you want to enable. You can only enable one feature per command line. To enable multiple features, use fondue.exe for each feature.
/caller-name:<program_name> Specifies the program or process name when you call fondue.exe from a script or batch file. You can use this option to add the program name to the SQM report if there is an error.
/hide-ux:{all | rebootrequest} Use all to hide all messages to the user including progress and permission requests to access Windows Update. If permission is required, the operation will fail.<p>Use rebootrequest to only hide user messages asking for permission to reboot the computer. Use this option if you have a script that controls reboot requests.

Examples

To enable Microsoft .NET Framework 4.8, type:

fondue.exe /enable-feature:NETFX4

To enable Microsoft .NET Framework 4.8, add the program name to the SQM report, and not display messages to the user, type:

fondue.exe /enable-feature:NETFX4 /caller-name:Admin.bat /hide-ux:all

Additional References

MIT License. Copyright (c) 2020-2021 Strontic.