Version string is base64 encoded so I decoded it again, nothing too useful output though: ZQA]BPTVZDNCFCU$)R;$;V ,U?!<#0sd{~w3$";$#6Ert}xjG7;GrxoqC1 However, from the line "ImageBase: 06E50000" I can guess that it occurred in a DLL, EXEs normally have an imagebase of 401000. That imagebase looks unique, if there was only a tool to mass-examine the imagebase of all the DLLs on the machine it would be possible to find which one it was...