Fondue.exe

  • File Path: C:\WINDOWS\system32\Fondue.exe
  • Description: Windows Features on Demand UX

Screenshot

Fondue.exe

Hashes

Type Hash
MD5 B2394CA80127A7BAB628DA4F5D629DA8
SHA1 24E34AF1F582AF388C2354414EE86CABE97EEA81
SHA256 E00C82610D6E9D2BA4837012833F514CA12914EEFB6E5F8CF263B36B50AE7A3C
SHA384 71DD4190BFCC11A319445C42C19E674F547A078DC815354F915D3000D240AC42FF6E1A95845C3DA00A74D612A1389AA7
SHA512 C18D35B40B13CEBEE3ABA50C63F9B6C3C361B520AA523A77A16C6D62BF6D8537DFAF239CA60A8669A5A146A65A284887DEEF89AC47CADEA7D5824F3A73CA26CA
SSDEEP 3072:xbqNOpiH3D5+bEaznWfH22ZsuX2xKwMPTnaSrIrvDa:xOMsXDuznWjZnXeKwMLnaqY
IMP E8309E14FD0CD5D0959FCC7F5E47D546
PESHA1 7765BC08B1EEC93771B59126CC96DBA145671F57
PE256 57DB583BA5B9D7DC48F09B9ECB58517AAEC4C156EA51853BF7968DCD51D241EE

Runtime Data

Window Title:

Windows Features

Open Handles:

Path Type
(R-D) C:\Windows\Fonts\StaticCache.dat File
(R-D) C:\Windows\System32\en-US\appwiz.cpl.mui File
(R-D) C:\Windows\System32\en-US\Fondue.exe.mui File
(RW-) C:\Windows\System32 File
(RW-) C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22000.120_none_9d947278b86cc467 File
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\Sessions\2\Windows\Theme1077709572 Section
\Windows\Theme3461253685 Section

Loaded Modules:

Path
C:\WINDOWS\system32\Fondue.exe
C:\WINDOWS\System32\GDI32.dll
C:\WINDOWS\System32\gdi32full.dll
C:\WINDOWS\System32\KERNEL32.DLL
C:\WINDOWS\System32\KERNELBASE.dll
C:\WINDOWS\System32\msvcp_win.dll
C:\WINDOWS\System32\msvcrt.dll
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\System32\ucrtbase.dll
C:\WINDOWS\System32\USER32.dll
C:\WINDOWS\System32\win32u.dll

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: Fondue.EXE.MUI
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.22000.1 (WinBuild.160101.0800)
  • Product Version: 10.0.22000.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/73
  • VirusTotal Link: https://www.virustotal.com/gui/file/e00c82610d6e9d2ba4837012833f514ca12914eefb6e5f8cf263b36b50ae7a3c/detection

File Similarity (ssdeep match)

File Score
C:\Windows\system32\Fondue.exe 82
C:\windows\system32\Fondue.exe 82
C:\WINDOWS\system32\Fondue.exe 79
C:\Windows\system32\Fondue.exe 77
C:\Windows\system32\Fondue.exe 80
C:\WINDOWS\system32\OptionalFeatures.exe 75
C:\Windows\system32\OptionalFeatures.exe 77
C:\Windows\system32\OptionalFeatures.exe 80
C:\WINDOWS\system32\OptionalFeatures.exe 82
C:\Windows\system32\OptionalFeatures.exe 79
C:\Windows\SysWOW64\Fondue.exe 85
C:\WINDOWS\SysWOW64\Fondue.exe 79
C:\windows\SysWOW64\Fondue.exe 77
C:\WINDOWS\SysWOW64\Fondue.exe 85
C:\Windows\SysWOW64\Fondue.exe 82
C:\Windows\SysWOW64\Fondue.exe 79

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

fondue

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Enables Windows optional features by downloading required files from Windows Update or another source specified by Group Policy. The manifest file for the feature must already be installed in your Windows image.

Syntax

fondue.exe /enable-feature:<feature_name> [/caller-name:<program_name>] [/hide-ux:{all | rebootrequest}]

Parameters

Parameter Description
/enable-feature:<feature_name> Specifies the name of the Windows optional feature you want to enable. You can only enable one feature per command line. To enable multiple features, use fondue.exe for each feature.
/caller-name:<program_name> Specifies the program or process name when you call fondue.exe from a script or batch file. You can use this option to add the program name to the SQM report if there is an error.
/hide-ux:{all | rebootrequest} Use all to hide all messages to the user including progress and permission requests to access Windows Update. If permission is required, the operation will fail.<p>Use rebootrequest to only hide user messages asking for permission to reboot the computer. Use this option if you have a script that controls reboot requests.

Examples

To enable Microsoft .NET Framework 4.8, type:

fondue.exe /enable-feature:NETFX4

To enable Microsoft .NET Framework 4.8, add the program name to the SQM report, and not display messages to the user, type:

fondue.exe /enable-feature:NETFX4 /caller-name:Admin.bat /hide-ux:all

Additional References

MIT License. Copyright (c) 2020-2021 Strontic.