perf_va.dll

• File Path: C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\legacy\perf_va.dll
• Description: XPerfCore AddIn: VirtualAlloc

Hashes

Type	Hash
MD5	6B312B735067595FAB1CE84DC692750E
SHA1	3E42F0BF90B1A8AF9A7FA4DAD028943804A915E4
SHA256	663B41E464E73B0D560B478084ECC570686BF554DE5131F9DE2BE8387BF7A105
SHA384	354C1AC6A7A3FC80F7FD3312599B07875528546017ADC2577C45FC2F65628129A78248BF9E311EED1D55B73B17076047
SHA512	9F0E64ABF7151B025C1C7678ED34957B45CB72AFB7920CDE1C4D7F47520005BBC41364B38116C9F9E7FD15D750472760581C8CFCC1CCF8A686110399AB99F491
SSDEEP	3072:SbcwbYIWL8bv3lgLDvSkv8AT1RFpeKQyMDfrFGO+0h9A0laxI:SlbwL8D3uWAHhQyMDjKe9A0N
IMP	1483110084490918C3D59E3914690E11
PESHA1	A282F0EAE29D6554F66B40BF8F04300E31F3558A
PE256	A5D101C9BC354E560E76DEC4205898151B9E2A7FB517E66EDC02EE433A84769F

DLL Exports:

Function Name	Ordinal	Type
DllRegisterServer	3	Exported Function
DllUnregisterServer	4	Exported Function
DllCanUnloadNow	1	Exported Function
DllGetClassObject	2	Exported Function

Signature

• Status: Signature verified.
• Serial: 33000002CF6D2CC57CAA65A6D80000000002CF
• Thumbprint: 1A221B3B4FEF088B17BA6704FD088DF192D9E0EF
• Issuer: CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
• Subject: CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

• Original Filename: perf_va.dll
• Product Name: Microsoft Windows Operating System
• Company Name: Microsoft Corporation
• File Version: 10.0.19041.1 (WinBuild.160101.0800)
• Product Version: 10.0.19041.1
• Language: English (United States)
• Legal Copyright: Microsoft Corporation. All rights reserved.
• Machine Type: 64-bit

File Scan

• VirusTotal Detections: 0/75
• VirusTotal Link: https://www.virustotal.com/gui/file/663b41e464e73b0d560b478084ecc570686bf554de5131f9de2be8387bf7a105/detection

File Similarity (ssdeep match)

File	Score
C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\perf_va.dll	97

MIT License. Copyright (c) 2020-2021 Strontic.