office2010_2022春节版[.]7z

Sharing

Copy URL Twitter E-mail

General

Target

office2010_2022春节版.7z
Size

85.6MB
MD5

e50c629fd88d86a58f43340f51b3230b
SHA1

bdd03c9a643ca8f2a4e05013c3c4ee7d98a8fd9d
SHA256

a9a083c97f097a7478f5ddf1ea6da3924f8b03b729911448ac29de60ddea87ad
SHA512

1cd7a45fb13a850806a8ff99c6332f44ca75422783c883b4a799c19010e8b88180b0fffe3bdb308934ec073013b7645ee44712629327b94f29fe7bb341f4e326
SSDEEP

1572864:Zk5g3FzqwUoac4+QTt5Ri2D5jDqEdtb5zy8y/wjsdeaQpM5I63g1YHnioUwYR:Zk5g1zqwUoaIQTtPFmsB5z0wjKGu5ZQJ

Score

8^/10

macro

Malware Config

Signatures

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

resource
static1/unpack001/office2010/Office14/Library/Analysis/ATPVBACS.XLAM

Files

office2010_2022春节版.7z
.7z
office2010/!)安装.cmd
.cmd .vbs
office2010/+)access.cmd
.cmd .vbs
office2010/-)卸载.cmd
.cmd .vbs
office2010/MShared/EQUATION/2052/EEINTL.DLL
.dll windows x86

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:27:81:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/10/2008, 21:24

Not After

22/01/2010, 21:34

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cc:77:0d:42:97:71:73:67:a8:9a:b6:5f:8b:b1:9b:be:1f:08:66:72
Signer

Actual PE Digest

cc:77:0d:42:97:71:73:67:a8:9a:b6:5f:8b:b1:9b:be:1f:08:66:72

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

05/03/2009, 06:12
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/MShared/EQUATION/EEINTL.DLL
.dll windows x86

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:27:81:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/10/2008, 21:24

Not After

22/01/2010, 21:34

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cc:77:0d:42:97:71:73:67:a8:9a:b6:5f:8b:b1:9b:be:1f:08:66:72
Signer

Actual PE Digest

cc:77:0d:42:97:71:73:67:a8:9a:b6:5f:8b:b1:9b:be:1f:08:66:72

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

05/03/2009, 06:12
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/MShared/EQUATION/EQNEDT32.CNT
office2010/MShared/EQUATION/EQNEDT32.EXE
.exe windows x86

a72299579db60824fabf4cdcfec2b1ea

Code Sign

33:00:00:00:c6:78:80:36:01:75:1a:69:72:00:00:00:00:00:c6
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:8e:87:91:a4:57:1a:5f:ca:3e:00:00:00:00:00:8e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

17/11/2016, 22:09

Not After

17/02/2018, 22:09

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

95:82:3f:0b:16:47:33:b5:b5:43:c2:39:05:67:06:29:60:65:d2:9d:d9:1d:73:d5:92:13:6b:06:6e:a7:3f:3f
Signer

Actual PE Digest

95:82:3f:0b:16:47:33:b5:b5:43:c2:39:05:67:06:29:60:65:d2:9d:d9:1d:73:d5:92:13:6b:06:6e:a7:3f:3f

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

65:85:03:49:cd:45:1f:99:de:40:be:62:c6:d1:01:0c:4f:e1:f0:68
Signer

Actual PE Digest

65:85:03:49:cd:45:1f:99:de:40:be:62:c6:d1:01:0c:4f:e1:f0:68

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

23/08/2017, 18:52
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStringTypeA
GetFileType
FlushFileBuffers
WriteFile
GetStdHandle
GetOEMCP
SetHandleCount
CompareStringW
GetStringTypeW
SetStdHandle
GetEnvironmentStrings
RaiseException
IsBadReadPtr
lstrlenA
lstrcpyA
MulDiv
LocalAlloc
OutputDebugStringA
lstrcmpiA
GlobalSize
GlobalReAlloc
GlobalAlloc
GlobalLock
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCurrentProcess
FreeEnvironmentStringsA
UnhandledExceptionFilter
CloseHandle
TerminateProcess
ExitProcess
HeapCreate
VirtualAlloc
VirtualFree
LCMapStringA
HeapDestroy
LCMapStringW
GetStartupInfoA
RtlUnwind
GetCommandLineA
HeapFree
GetModuleHandleA
HeapAlloc
GetLocalTime
MoveFileA
GetLastError
SetErrorMode
GetSystemTime
GetTimeZoneInformation
WinExec
GetSystemDefaultLangID
GetCPInfo
GetLocaleInfoA
WideCharToMultiByte
GetSystemDirectoryA
LockResource
MultiByteToWideChar
SizeofResource
LoadResource
FreeResource
FindResourceA
_lread
SetEndOfFile
SetFilePointer
_lclose
_lwrite
OpenFile
GetModuleFileNameA
_llseek
GetWindowsDirectoryA
GlobalFlags
GetTickCount
FatalAppExitA
SetEnvironmentVariableA
LocalLock
LocalReAlloc
GlobalUnlock
LocalUnlock
GetProcAddress
LocalFree
GetACP
GetVersion
FreeLibrary
LoadLibraryA
GlobalHandle
GetProfileStringA
lstrcmpA
HeapReAlloc
IsDBCSLeadByte
GlobalFree
ReadFile
CreateFileA
CompareStringA

user32

InvalidateRect
SendDlgItemMessageA
GetDialogBaseUnits
IsDlgButtonChecked
CheckDlgButton
GetNextDlgTabItem
SetScrollRange
SetDlgItemTextA
GetDlgItemTextA
MapWindowPoints
CheckRadioButton
GetDoubleClickTime
ReleaseCapture
SetCapture
RegisterClassW
SetMenu
SetWindowTextA
GetWindowTextA
InvalidateRgn
ScrollDC
IsZoomed
AppendMenuA
GetSystemMenu
GetClassLongA
GetClassLongW
DispatchMessageA
DispatchMessageW
GetMessageW
GetMessageA
DefWindowProcW
VkKeyScanA
GetKeyboardLayout
LoadKeyboardLayoutA
ActivateKeyboardLayout
GetKeyboardLayoutList
InvertRect
GetMenuCheckMarkDimensions
RegisterClipboardFormatA
CloseClipboard
EmptyClipboard
OpenClipboard
IsClipboardFormatAvailable
GetClipboardData
SetClipboardData
HiliteMenuItem
GetMenuState
GetMenuItemID
DeleteMenu
DrawMenuBar
EqualRect
UnionRect
GetDesktopWindow
GetMessagePos
GetMessageTime
SetParent
GetClassInfoA
SetWindowPos
MessageBoxA
DialogBoxParamA
BringWindowToTop
OffsetRect
GetCaretBlinkTime
SetTimer
MessageBeep
WinHelpA
CreateDialogParamA
SendMessageA
GetAsyncKeyState
EnableWindow
GetScrollPos
GetScrollRange
SetScrollPos
SetCursor
PtInRect
ShowCursor
IsWindowVisible
GetMenuItemCount
LoadStringA
IsWindowUnicode
UpdateWindow
GetMenu
FindWindowA
GetKeyState
PeekMessageA
KillTimer
DefWindowProcA
LoadIconA
LoadCursorA
IsDialogMessageA
GetFocus
BeginPaint
EndPaint
ScreenToClient
SetRect
FillRect
IntersectRect
CopyRect
SetWindowLongA
MoveWindow
DestroyWindow
CheckMenuItem
SetRectEmpty
RemoveMenu
GetSubMenu
CreateMenu
EnableMenuItem
GetMenuStringA
ModifyMenuA
InsertMenuA
GetParent
TranslateMessage
SetForegroundWindow
SetFocus
PostQuitMessage
PostMessageA
CreateWindowExA
RegisterClassA
GetDC
LoadMenuA
IsIconic
GetWindowLongA
ClientToScreen
GetWindowRect
GetClassNameA
DestroyMenu
IsRectEmpty
IsWindow
ShowWindow
LoadBitmapA
GetSysColor
GetDlgItem
GetClientRect
DrawTextA
wsprintfA
GetSystemMetrics
GetWindowDC
ReleaseDC
EndDialog
InflateRect
GetCursorPos
GetActiveWindow

gdi32

CreateCompatibleBitmap
CreateFontIndirectA
LineTo
SetBkMode
GetStockObject
CreatePen
MoveToEx
BitBlt
DeleteMetaFile
GetObjectA
GetDeviceCaps
SetBkColor
CopyMetaFileA
PatBlt
CreatePatternBrush
SetTextColor
PtVisible
GetTextFaceA
CreateBitmap
ExtTextOutA
SetMapMode
CreateFontA
GetCharWidthA
GetCharWidth32A
GetMapMode
GetCharWidth32W
GetBitmapBits
GetCharWidthW
TextOutW
SetTextAlign
TextOutA
Escape
CreateICA
GetTextMetricsA
EnumFontFamiliesExA
CreateSolidBrush
EnumFontsA
SelectClipRgn
SetRectRgn
CreateRectRgn
GetClipBox
RectVisible
CreateRectRgnIndirect
Ellipse
Polygon
SetROP2
SetMapperFlags
ExtTextOutW
Arc
SetWindowExtEx
SetWindowOrgEx
GetTextExtentPoint32A
CloseMetaFile
RestoreDC
CreateMetaFileA
SaveDC
StretchBlt
EnumMetaFile
PlayMetaFile
SetViewportExtEx
SetStretchBltMode
FillRgn
CombineRgn
GetMetaFileBitsEx
Rectangle
DeleteDC
CreateCompatibleDC
DeleteObject
SelectObject

advapi32

RegEnumKeyExA
RegEnumValueA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegDeleteKeyA
RegOpenKeyA

ole32

CreateDataAdviseHolder
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
GetHGlobalFromILockBytes
CoDisconnectObject
CoLockObjectExternal
OleUninitialize
CoRegisterMessageFilter
CoRevokeClassObject
CoRegisterClassObject
OleInitialize
CreateOleAdviseHolder
OleRegEnumFormatEtc
ReleaseStgMedium
WriteFmtUserTypeStg
OleTranslateAccelerator
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
GetRunningObjectTable
CoGetMalloc
OleDuplicateData
OleGetClipboard
WriteClassStg
OleFlushClipboard
OleSetClipboard

shell32

DragAcceptFiles

comctl32

ord17

Exports

Exports

AboutMathType
EqnFrameWinProc
FMDFontListEnum
FMDFontProtoEnum
FltToolbarWinProc
MFEnumFunc
MainWinProc
MtInsituWndProc
ParamDlgProc
PopupMenuWinProc
SizeDlgProc
StyleDefDlogProc
StyleOtherDlgProc
ZoomDlgProc

Sections

.text
Size: 328KB - Virtual size: 324KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 128KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/MShared/EQUATION/EQNEDT32.HLP
office2010/MShared/EQUATION/MTEXTRA.TTF
office2010/MShared/EQUATION/eqnedt32.exe.manifest
.xml
office2010/MShared/Filters/odffilt.dll
.dll windows x86

65505e620c45640f603855fccb7c3dff

Code Sign

33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:ec:83:fe:7a:e5:f4:32:71:09:24:89:ef:18:69:75:b5:0d:7b:47
Signer

Actual PE Digest

6a:ec:83:fe:7a:e5:f4:32:71:09:24:89:ef:18:69:75:b5:0d:7b:47

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

25/06/2013, 21:20
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
bsearch
_vscwprintf
wcsstr
wcsncat_s
vswprintf_s
free
malloc
_mbschr
memmove
_snwprintf_s
_snprintf_s
srand
rand
_vsnprintf_s
??_V@YAXPAX@Z
_CxxThrowException
__CxxFrameHandler3
??2@YAPAXI@Z
??0exception@std@@QAE@ABQBD@Z
strncpy_s
wcstol
_wcsnicmp
wcsncmp
wcschr
iswspace
memcpy_s
strstr
wcsrchr
_wtoi
wcscpy_s
__RTDynamicCast
memset
??_U@YAPAXI@Z
wcsncpy_s
memcpy
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
memmove_s
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??3@YAXPAX@Z

msvcp90

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

kernel32

SetFilePointerEx
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedCompareExchange
InterlockedExchange
HeapAlloc
HeapFree
GetProcessHeap
QueryPerformanceCounter
VirtualProtect
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetSystemDirectoryW
LoadLibraryExW
OutputDebugStringA
GetModuleFileNameW
LoadLibraryW
GetVersion
GetFileType
GetLongPathNameW
GetShortPathNameW
GetCurrentProcessId
IsWow64Process
TlsSetValue
TlsGetValue
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
GlobalAlloc
GlobalReAlloc
GlobalFree
RaiseException
WideCharToMultiByte
SetLastError
GetFileAttributesW
SystemTimeToFileTime
GlobalUnlock
GlobalLock
lstrcmpiW
lstrcmpW
CompareStringW
TerminateProcess
GetCurrentProcess
lstrlenW
MultiByteToWideChar
lstrlenA
CloseHandle
DeleteFileW
WriteFile
CreateFileW
GetTempFileNameW
GetTempPathW
InitializeCriticalSectionAndSpinCount
CreateSemaphoreW
ReadFile
GetCurrentThreadId
Sleep
ReleaseSemaphore
WaitForSingleObject
RemoveDirectoryW
CreateDirectoryW
GetTickCount
GetUserDefaultLCID
FileTimeToSystemTime
GetSystemInfo
GetProcAddress
GetModuleHandleA
GetModuleHandleW
GetVersionExA
GetSystemDefaultLCID
IsDBCSLeadByte
LockResource
LoadResource
FindResourceA
GetStringTypeExW
IsValidLocale
GetSystemTime
IsValidCodePage
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
GetOverlappedResult
WaitForMultipleObjects
ResetEvent
CreateEventA
GetFileTime
SetFileTime
TryEnterCriticalSection
GetFileSizeEx
SetEndOfFile
FlushFileBuffers
DeviceIoControl
TlsAlloc
TlsFree

user32

RegisterClipboardFormatW
GetSystemMetrics
CharUpperBuffW

advapi32

RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegQueryValueExW
RegisterTraceGuidsA
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegEnumValueW
RegOpenKeyExW
RegCloseKey

shell32

SHGetDesktopFolder

shlwapi

StrRetToBufW

ole32

CLSIDFromProgID
GetConvertStg
CoCreateInstance
StringFromGUID2
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
ReadClassStg
WriteFmtUserTypeStg
CLSIDFromString
CreateStreamOnHGlobal
CoGetClassObject
CoTaskMemAlloc
CoTaskMemFree
CoCreateGuid

oleaut32

SysStringLen
VariantInit
SysAllocString
SysFreeString
VariantClear

query

BindIFilterFromStream
BindIFilterFromStorage

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 702KB - Virtual size: 701KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 226KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/MShared/MSClientDataMgr/MSCDM.DLL
.dll regsvr32 windows x86

9346a9ab66ea21ec32201e31660e0469

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6b:64:8b:3b:42:59:42:00:3f:81:8d:d4:a1:20:ac:5c:b2:e1:69:80
Signer

Actual PE Digest

6b:64:8b:3b:42:59:42:00:3f:81:8d:d4:a1:20:ac:5c:b2:e1:69:80

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

14/01/2010, 06:30
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
??3@YAXPAX@Z
_encoded_null
_malloc_crt
_except_handler4_common
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
vswprintf_s
_recalloc
wcscat_s
wcscpy_s
wcsstr
calloc
realloc
malloc
free
wcscspn
wcschr
wcsncpy_s
memcpy_s
memset
_wtol
iswspace
memmove
memcpy
??_U@YAPAXI@Z
??_V@YAXPAX@Z
??2@YAPAXI@Z
_vsnwprintf_s
__clean_type_info_names_internal

advapi32

ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegQueryValueExW
RegQueryValueExA
RegSetValueExW
RegSetValueExA
RegDeleteKeyW
RegDeleteKeyA
RegCreateKeyExW
RegCreateKeyExA
RegOpenKeyExW
RegOpenKeyExA
RegCloseKey

kernel32

FindResourceW
LoadResource
SizeofResource
FreeLibrary
GetModuleHandleW
GetProcAddress
DisableThreadLibraryCalls
lstrcmpiW
LoadLibraryExW
WaitForMultipleObjects
GetCurrentThreadId
GetSystemDefaultLCID
Sleep
lstrlenW
RaiseException
GetUserDefaultLCID
VirtualProtect
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcessHeap
HeapFree
HeapAlloc
LoadLibraryW
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
WaitForSingleObject
IsDebuggerPresent
SetEvent
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameA
GetModuleFileNameW
CompareStringW

ole32

CoTaskMemAlloc
StringFromCLSID
CoCreateGuid
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CoGetMalloc
StringFromGUID2

oleaut32

VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SafeArrayGetUBound
SafeArrayGetElement
SafeArrayDestroy
VarAdd
SetErrorInfo
SysStringLen
VarBstrCmp
SysFreeString
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
VariantInit
VariantClear
VariantCopy
VariantChangeTypeEx
VariantChangeType
VarSu
CreateErrorInfo
GetErrorInfo
VarCmp

user32

MsgWaitForMultipleObjects
TranslateMessage
DispatchMessageW
PeekMessageW
CharNextW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 245KB - Virtual size: 245KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/MShared/OFFICE14/2052/ALRTINTL.DLL
.dll windows x86

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

32:26:42:91:f4:bf:31:79:b2:01:59:2c:c2:d6:a8:6e:a5:d9:aa:f2
Signer

Actual PE Digest

32:26:42:91:f4:bf:31:79:b2:01:59:2c:c2:d6:a8:6e:a5:d9:aa:f2

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/03/2010, 00:33
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 137B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 151KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/MShared/OFFICE14/2052/MSOINTL.dll
.dll windows x86

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:12

Not After

04/12/2013, 21:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

de:83:f4:1f:64:ca:88:f3:b2:f5:1c:17:5f:c3:16:43:76:e3:64:12
Signer

Actual PE Digest

de:83:f4:1f:64:ca:88:f3:b2:f5:1c:17:5f:c3:16:43:76:e3:64:12

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

14/12/2012, 15:18
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 131B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/MShared/OFFICE14/2052/MSSOAPR3.DLL
.dll regsvr32 windows x86

307ef2ccd8d4eb6d3f69c07fac53b21e

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

a5:9d:e8:93:1c:4b:59:b3:24:e7:16:49:75:b4:68:39:c1:de:80:36
Signer

Actual PE Digest

a5:9d:e8:93:1c:4b:59:b3:24:e7:16:49:75:b4:68:39:c1:de:80:36

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/03/2010, 05:50
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DisableThreadLibraryCalls
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
IsDebuggerPresent

msvcr90

_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
_except_handler4_common

Exports

Exports

DllCanUnloadNow
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/MShared/OFFICE14/2052/OARPMANR.DLL
.dll windows x86

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

fb:29:3c:bf:99:d4:3c:45:19:2b:c2:2c:14:d6:72:a0:51:b8:d5:5c
Signer

Actual PE Digest

fb:29:3c:bf:99:d4:3c:45:19:2b:c2:2c:14:d6:72:a0:51:b8:d5:5c

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/03/2010, 05:42
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/MShared/OFFICE14/2052/xlsrvintl.dll
.dll windows x86

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7d:23:df:de:d9:b5:27:ac:df:b4:27:b3:bd:e9:5d:b9:3d:a4:8b:f6
Signer

Actual PE Digest

7d:23:df:de:d9:b5:27:ac:df:b4:27:b3:bd:e9:5d:b9:3d:a4:8b:f6

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/03/2010, 06:51
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/MShared/OFFICE14/Cultures/OFFICE.ODF
.dll windows x86

Code Sign

33:00:00:00:f4:22:58:95:c2:a9:d8:28:25:00:00:00:00:00:f4
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2018, 20:19

Not After

23/11/2019, 20:19

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:11

Not After

26/07/2019, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:08

Not After

26/07/2019, 20:08

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cb:42:a4:8b:4a:b9:65:41:0c:bb:63:01:58:e2:32:f0:fd:d3:15:ae:b4:27:1f:70:e2:6b:c9:dd:e8:f9:0c:66
Signer

Actual PE Digest

cb:42:a4:8b:4a:b9:65:41:0c:bb:63:01:58:e2:32:f0:fd:d3:15:ae:b4:27:1f:70:e2:6b:c9:dd:e8:f9:0c:66

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

dc:9b:7d:0a:e9:c8:56:81:c2:f9:4b:b7:48:af:ac:cc:5f:74:b0:68
Signer

Actual PE Digest

dc:9b:7d:0a:e9:c8:56:81:c2:f9:4b:b7:48:af:ac:cc:5f:74:b0:68

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

20/11/2018, 02:10
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 133B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/MShared/OFFICE14/EXPSRV.DLL
.dll windows x86

ec0fe268630d6414506244b95e6d9456

Code Sign

33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/08/2016, 20:17

Not After

02/11/2017, 20:17

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

95:dc:52:56:f3:e8:e3:3a:3c:3c:ac:26:be:37:10:fd:84:2a:d3:40
Signer

Actual PE Digest

95:dc:52:56:f3:e8:e3:3a:3c:3c:ac:26:be:37:10:fd:84:2a:d3:40

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

16/03/2017, 19:39
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoDisconnectObject
CoGetClassObject
CoCreateInstance
CreateBindCtx
MkParseDisplayName
BindMoniker
CoGetMalloc

oleaut32

VarDateFromStr
SysFreeString
SafeArrayDestroy
SafeArrayDestroyData
VariantChangeTypeEx
SafeArrayCreate
SafeArrayAllocDescriptor
VariantCopy
SafeArrayPutElement
SetErrorInfo
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
SysStringLen
GetErrorInfo
CreateErrorInfo
LoadTypeLi
RevokeActiveObject
SafeArrayDestroyDescriptor
SafeArrayCopy
SafeArrayAllocData
SafeArrayUnlock
SafeArrayRedim
SysAllocString
SafeArrayLock
GetActiveObject
VariantCopyInd
VarCyFromI4
VarBstrFromI2
VarBstrFromI4
VarBstrFromR4
VarBstrFromR8
VarBstrFromDate
VarBstrFromCy
VarI2FromStr
VarI4FromStr
LHashValOfNameSysA
LoadRegTypeLi
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
VariantInit
VariantChangeType
SafeArrayGetDim
SafeArrayGetElement
SysReAllocStringLen
SysReAllocString
VarCyFromStr
VarR8FromStr
VarR4FromStr
VarI4FromR8
VariantClear

user32

LoadStringA
GetSystemMetrics
CharUpperBuffW
CharUpperBuffA
CharLowerBuffW
CharLowerBuffA
FindWindowW
FindWindowA
SendMessageA
GetKeyboardLayout
MessageBeep
SetFocus
SetForegroundWindow
AttachThreadInput
GetWindowThreadProcessId
IsWindowVisible
IsWindowEnabled
GetWindowTextA
GetDesktopWindow
GetWindow
GetFocus
OemToCharBuffA
CharToOemA
GetKeyboardState
UnhookWindowsHookEx
SetKeyboardState
keybd_event
CallNextHookEx
GetAsyncKeyState
WaitForInputIdle
SetWindowsHookExW
SetWindowsHookExA
VkKeyScanW
VkKeyScanA
GetForegroundWindow

kernel32

GetTimeZoneInformation
GetStringTypeW
InitializeCriticalSectionAndSpinCount
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetProcessHeap
SetEndOfFile
SetStdHandle
HeapSize
GetOEMCP
GetACP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
HeapDestroy
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetStdHandle
SetHandleCount
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
ExitProcess
MoveFileA
DeleteFileA
RemoveDirectoryA
CreateDirectoryA
SetEnvironmentVariableA
GetFullPathNameA
SetCurrentDirectoryA
GetCurrentDirectoryA
UnlockFile
LockFile
SetFilePointer
GetConsoleMode
GetConsoleCP
WriteFile
ReadFile
GetFileType
FlushFileBuffers
HeapReAlloc
HeapAlloc
HeapFree
FindNextFileA
GetSystemInfo
GetModuleHandleW
GetCommandLineA
GetCurrentThreadId
RtlUnwind
GetUserDefaultLCID
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateProcessA
CreateProcessW
lstrcatA
GetPrivateProfileIntA
CompareStringA
WideCharToMultiByte
MultiByteToWideChar
GetLastError
GetModuleFileNameA
VirtualQuery
VirtualProtect
VirtualAlloc
VirtualFree
GetProcAddress
GetModuleHandleA
GetVersion
InterlockedDecrement
InterlockedIncrement
DisableThreadLibraryCalls
GetSystemDefaultLangID
GetUserDefaultLangID
IsDBCSLeadByte
GetStringTypeA
LCMapStringA
GetLocaleInfoA
LoadLibraryA
OpenFile
CreateFileA
CompareStringW
SetLastError
LCMapStringW
GetModuleFileNameW
FormatMessageW
FreeLibrary
SetErrorMode
GetSystemDirectoryA
Sleep
GlobalFree
GetTickCount
GlobalUnlock
GlobalLock
GlobalAlloc
GetComputerNameA
RaiseException
IsBadReadPtr
IsValidCodePage
lstrcmpiA
SetFileTime
GetFileTime
CloseHandle
GetDriveTypeA
FindClose
FindFirstFileA
GetFileAttributesA
GetVolumeInformationA
FileTimeToSystemTime
FileTimeToLocalFileTime
SetFileAttributesA
GetLocalTime
SetLocalTime
GetCurrentProcess

advapi32

RegQueryInfoKeyA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegSetValueExA
RegSetValueExW
RegCreateKeyA
RegCreateKeyW
RegQueryValueExA
RegQueryValueExW
RegEnumValueA
RegEnumValueW
RegEnumKeyA
RegEnumKeyW
RegDeleteValueA
RegDeleteValueW
RegDeleteKeyA
RegDeleteKeyW
RegOpenKeyA
RegOpenKeyW

Exports

Exports

BASIC_CLASS_AddRef
BASIC_CLASS_GetIDsOfNames
BASIC_CLASS_Invoke
BASIC_CLASS_QueryInterface
BASIC_CLASS_Release
BASIC_DISPINTERFACE_GetTICount
BASIC_DISPINTERFACE_GetTypeInfo
CopyRecord
CreateIExprSrvObj
DllFunctionCall
EVENT_SINK2_AddRef
EVENT_SINK2_Release
EVENT_SINK_AddRef
EVENT_SINK_GetIDsOfNames
EVENT_SINK_Invoke
EVENT_SINK_QueryInterface
EVENT_SINK_Release
EbCreateContext
EbDestroyContext
EbGetErrorInfo
EbGetHandleOfExecutingProject
EbGetObjConnectionCounts
EbGetVBAObject
EbIsProjectOnStack
EbLibraryLoad
EbLibraryUnload
EbLoadRunTime
EbResetProject
EbResetProjectNormal
EbSetContextWorkerThread
GetMem1
GetMem2
GetMem4
GetMem8
GetMemEvent
GetMemNewObj
GetMemObj
GetMemStr
GetMemVar
IID_IVbaHost
MethCallEngine
ProcCallEngine
PutMem1
PutMem2
PutMem4
PutMem8
PutMemEvent
PutMemNewObj
PutMemObj
PutMemStr
PutMemVar
SetMemEvent
SetMemNewObj
SetMemObj
SetMemVar
TipCreateInstanceEx
TipCreateInstanceProject2
TipGetAddressOfPredeclaredInstance
TipInvokeMethod
TipInvokeMethod2
TipSetOption
TipUnloadInstance
TipUnloadProject
VarPtr
Zombie_AddRef
Zombie_GetIDsOfNames
Zombie_GetTypeInfo
Zombie_GetTypeInfoCount
Zombie_Invoke
Zombie_QueryInterface
Zombie_Release
_CIatan
_CIcos
_CIexp
_CIlog
_CIsin
_CIsqrt
_CItan
__vbaAryConstruct
__vbaAryConstruct2
__vbaAryCopy
__vbaAryDestruct
__vbaAryLock
__vbaAryMove
__vbaAryRebase1Var
__vbaAryRecCopy
__vbaAryRecMove
__vbaAryUnlock
__vbaAryVar
__vbaAryVarVarg
__vbaBoolErrVar
__vbaBoolStr
__vbaBoolVar
__vbaBoolVarNull
__vbaCVarAryUdt
__vbaCastObj
__vbaCastObjVar
__vbaCheckType
__vbaCheckTypeVar
__vbaChkstk
__vbaCopyBytes
__vbaCopyBytesZero
__vbaCyAbs
__vbaCyAdd
__vbaCyErrVar
__vbaCyFix
__vbaCyForInit
__vbaCyForNext
__vbaCyI2
__vbaCyI4
__vbaCyInt
__vbaCyMul
__vbaCyMulI2
__vbaCySgn
__vbaCyStr
__vbaCySub
__vbaCyUI1
__vbaCyVar
__vbaDateR4
__vbaDateR8
__vbaDateStr
__vbaDateVar
__vbaDerefAry
__vbaDerefAry1
__vbaEnd
__vbaErase
__vbaEraseKeepData
__vbaEraseNoPop
__vbaError
__vbaErrorOverflow
__vbaExceptHandler
__vbaExitEachAry
__vbaExitEachColl
__vbaExitEachVar
__vbaExitProc
__vbaFPException
__vbaFPFix
__vbaFPInt
__vbaFailedFriend
__vbaFileClose
__vbaFileCloseAll
__vbaFileLock
__vbaFileOpen
__vbaFileSeek
__vbaFixstrConstruct
__vbaForEachAry
__vbaForEachCollAd
__vbaForEachCollObj
__vbaForEachCollVar
__vbaForEachVar
__vbaFpCDblR4
__vbaFpCDblR8
__vbaFpCSngR4
__vbaFpCSngR8
__vbaFpCmpCy
__vbaFpCy
__vbaFpI2
__vbaFpI4
__vbaFpR4
__vbaFpR8
__vbaFpUI1
__vbaFreeObj
__vbaFreeObjList
__vbaFreeStr
__vbaFreeStrList
__vbaFreeVar
__vbaFreeVarList
__vbaFreeVarg
__vbaGenerateBoundsError
__vbaGet3
__vbaGet4
__vbaGetFxStr3
__vbaGetFxStr4
__vbaGetOwner3
__vbaGetOwner4
__vbaGosub
__vbaGosubFree
__vbaGosubReturn
__vbaHresultCheck
__vbaHresultCheckNonvirt
__vbaHresultCheckObj
__vbaI2Abs
__vbaI2Cy
__vbaI2ErrVar
__vbaI2ForNextCheck
__vbaI2I4
__vbaI2Sgn
__vbaI2Str
__vbaI2Var
__vbaI4Abs
__vbaI4Cy
__vbaI4ErrVar
__vbaI4ForNextCheck
__vbaI4Sgn
__vbaI4Str
__vbaI4Var
__vbaInStr
__vbaInStrB
__vbaInStrVar
__vbaInStrVarB
__vbaInputFile
__vbaLateIdCall
__vbaLateIdCallLd
__vbaLateIdCallSt
__vbaLateIdNamedCall
__vbaLateIdNamedCallLd
__vbaLateIdNamedCallSt
__vbaLateIdNamedStAd
__vbaLateIdSt
__vbaLateIdStAd
__vbaLateMemCall
__vbaLateMemCallLd
__vbaLateMemCallSt
__vbaLateMemNamedCall
__vbaLateMemNamedCallLd
__vbaLateMemNamedCallSt
__vbaLateMemNamedStAd
__vbaLateMemSt
__vbaLateMemStAd
__vbaLbound
__vbaLdZeroAry
__vbaLenBstr
__vbaLenBstrB
__vbaLenVar
__vbaLenVarB
__vbaLineInputStr
__vbaLineInputVar
__vbaLsetFixstr
__vbaLsetFixstrFree
__vbaMidStmtBstr
__vbaMidStmtBstrB
__vbaMidStmtVar
__vbaMidStmtVarB
__vbaNameFile
__vbaNew
__vbaNew2
__vbaNextEachAry
__vbaNextEachCollAd
__vbaNextEachCollObj
__vbaNextEachCollVar
__vbaNextEachVar
__vbaObjAddref
__vbaObjIs
__vbaObjSet
__vbaObjSetAddref
__vbaObjVar
__vbaOnError
__vbaOnGoCheck
__vbaPowerR8
__vbaPrintFile
__vbaPrintObj
__vbaPut3
__vbaPut4
__vbaPutFxStr3
__vbaPutFxStr4
__vbaPutOwner3
__vbaPutOwner4
__vbaR4Cy
__vbaR4ErrVar
__vbaR4ForNextCheck
__vbaR4Sgn
__vbaR4Str
__vbaR4Var
__vbaR8Cy
__vbaR8ErrVar
__vbaR8FixI2
__vbaR8FixI4
__vbaR8ForNextCheck
__vbaR8IntI2
__vbaR8IntI4
__vbaR8Sgn
__vbaR8Str
__vbaR8Var
__vbaRaiseEvent
__vbaRecAnsiToUni
__vbaRecAssign
__vbaRecDestruct
__vbaRecDestructAnsi
__vbaRecUniToAnsi
__vbaRedim
__vbaRedimPreserve
__vbaRedimPreserveVar
__vbaRedimPreserveVar2
__vbaRedimVar
__vbaRedimVar2
__vbaRefVarAry
__vbaResume
__vbaRsetFixstr
__vbaRsetFixstrFree
__vbaSetSystemError
__vbaStopExe
__vbaStr2Vec
__vbaStrAryToAnsi
__vbaStrAryToUnicode
__vbaStrBool
__vbaStrCat
__vbaStrCmp
__vbaStrComp
__vbaStrCompVar
__vbaStrCopy
__vbaStrCy
__vbaStrDate
__vbaStrErrVarCopy
__vbaStrFixstr
__vbaStrI2
__vbaStrI4
__vbaStrLike
__vbaStrMove
__vbaStrR4
__vbaStrR8
__vbaStrTextCmp
__vbaStrTextLike
__vbaStrToAnsi
__vbaStrToUnicode
__vbaStrUI1
__vbaStrVarCopy
__vbaStrVarMove
__vbaStrVarVal
__vbaUI1Cy
__vbaUI1ErrVar
__vbaUI1I2
__vbaUI1I4
__vbaUI1Sgn
__vbaUI1Str
__vbaUI1Var
__vbaUbound
__vbaUdtVar
__vbaUnkVar
__vbaVar2Vec
__vbaVarAbs
__vbaVarAdd
__vbaVarAnd
__vbaVarCat
__vbaVarCmpEq
__vbaVarCmpGe
__vbaVarCmpGt
__vbaVarCmpLe
__vbaVarCmpLt
__vbaVarCmpNe
__vbaVarCopy
__vbaVarDateVar
__vbaVarDiv
__vbaVarDup
__vbaVarEqv
__vbaVarErrI4
__vbaVarFix
__vbaVarForInit
__vbaVarForNext
__vbaVarIdiv
__vbaVarImp
__vbaVarIndexLoad
__vbaVarIndexLoadRef
__vbaVarIndexLoadRefLock
__vbaVarIndexStore
__vbaVarIndexStoreObj
__vbaVarInt
__vbaVarLateMemCallLd
__vbaVarLateMemCallLdRf
__vbaVarLateMemCallSt
__vbaVarLateMemSt
__vbaVarLateMemStAd
__vbaVarLike
__vbaVarLikeVar
__vbaVarMod
__vbaVarMove
__vbaVarMul
__vbaVarNeg
__vbaVarNot
__vbaVarOr
__vbaVarPow
__vbaVarSetObj
__vbaVarSetObjAddref
__vbaVarSetUnk
__vbaVarSetUnkAddref
__vbaVarSetVar
__vbaVarSetVarAddref
__vbaVarSub
__vbaVarTextCmpEq
__vbaVarTextCmpGe
__vbaVarTextCmpGt
__vbaVarTextCmpLe
__vbaVarTextCmpLt
__vbaVarTextCmpNe
__vbaVarTextLike
__vbaVarTextLikeVar
__vbaVarTextTstEq
__vbaVarTextTstGe
__vbaVarTextTstGt
__vbaVarTextTstLe
__vbaVarTextTstLt
__vbaVarTextTstNe
__vbaVarTstEq
__vbaVarTstGe
__vbaVarTstGt
__vbaVarTstLe
__vbaVarTstLt
__vbaVarTstNe
__vbaVarVargNofree
__vbaVarXor
__vbaVarZero
__vbaVargObj
__vbaVargObjAddref
__vbaVargParmRef
__vbaVargUnk
__vbaVargUnkAddref
__vbaVargVar
__vbaVargVarCopy
__vbaVargVarMove
__vbaVargVarRef
__vbaVerifyVarObj
__vbaWriteFile
_adj_fdiv_m16i
_adj_fdiv_m32
_adj_fdiv_m32i
_adj_fdiv_m64
_adj_fdiv_r
_adj_fdivr_m16i
_adj_fdivr_m32
_adj_fdivr_m32i
_adj_fdivr_m64
_adj_fpatan
_adj_fprem
_adj_fprem1
_adj_fptan
_allmul
rtBoolFromErrVar
rtBstrFromErrVar
rtCyFromErrVar
rtDecFromVar
rtI2FromErrVar
rtI4FromErrVar
rtR4FromErrVar
rtR8FromErrVar
rtUI1FromErrVar
rtcAbsVar
rtcAnsiValueBstr
rtcAppActivate
rtcAppleScript
rtcArray
rtcAtn
rtcBeep
rtcBstrFromAnsi
rtcBstrFromByte
rtcBstrFromChar
rtcBstrFromError
rtcBstrFromFormatVar
rtcByteValueBstr
rtcCVErrFromVar
rtcCallByName
rtcChangeDir
rtcChangeDrive
rtcCharValueBstr
rtcChoose
rtcCommandBstr
rtcCommandVar
rtcCompareBstr
rtcCos
rtcCreateObject
rtcCreateObject2
rtcCurrentDir
rtcCurrentDirBstr
rtcDDB
rtcDateAdd
rtcDateDiff
rtcDateFromVar
rtcDatePart
rtcDeleteSetting
rtcDir
rtcDoEvents
rtcEndOfFile
rtcEnvironBstr
rtcEnvironVar
rtcErrObj
rtcExp
rtcFV
rtcFileAttributes
rtcFileCopy
rtcFileDateTime
rtcFileLen
rtcFileLength
rtcFileLocation
rtcFileReset
rtcFileSeek
rtcFileWidth
rtcFilter
rtcFixVar
rtcFormatCurrency
rtcFormatDateTime
rtcFormatNumber
rtcFormatPercent
rtcFreeFile
rtcGetAllSettings
rtcGetCurrentCalendar
rtcGetDateBstr
rtcGetDateValue
rtcGetDateVar
rtcGetDayOfMonth
rtcGetDayOfWeek
rtcGetErl
rtcGetFileAttr

Sections

.text
Size: 236KB - Virtual size: 235KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

ENGINE
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/MShared/OFFICE14/EXP_PDF.DLL
.dll windows x86

9884878e43f2549d8051319072fc67c8

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:12

Not After

04/12/2013, 21:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a6:88:0c:a1:d7:e2:ef:e0:e1:14:c9:62:a1:3f:bb:29:ef:9a:5f:48
Signer

Actual PE Digest

a6:88:0c:a1:d7:e2:ef:e0:e1:14:c9:62:a1:3f:bb:29:ef:9a:5f:48

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

18/02/2013, 14:43
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

_initterm
memmove
strnlen
strncpy_s
memset
rand
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
wcsncpy_s
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
_snprintf_s
_CIcos
_CIsin
strncat_s
_vsnprintf_s
memcpy

kernel32

InterlockedCompareExchange
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
CloseHandle
GetLastError
ReadFile
GetFileInformationByHandle
LoadLibraryW
SetLastError
GetModuleFileNameW
OutputDebugStringA
FileTimeToSystemTime
GetTimeZoneInformation
FreeLibrary
DeleteFileW
SetFilePointer
TerminateProcess
WriteFile
DisableThreadLibraryCalls
VirtualProtect
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcessHeap
InterlockedExchange
Sleep
RaiseException

user32

ReleaseDC
GetDesktopWindow
GetDC

advapi32

CryptReleaseContext
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
CryptDestroyKey
CryptGetKeyParam
CryptEncrypt
CryptSetKeyParam
CryptImportKey
CryptDestroyHash

rpcrt4

UuidCreate

gdi32

GetOutlineTextMetricsA
CombineTransform
GetCharWidthI
DeleteObject
GetCharWidth32A
SelectObject
GetGlyphIndicesW
GetGlyphOutlineA
SetTextAlign
GetTextAlign
GetTextExtentPointA

mso

ord2191
ord2456
ord3654
ord439
ord28
ord286
ord6420
ord6002
ord6675
ord1300
ord2929
ord10306
ord6843
ord1853
ord2071
ord5138
ord9835
ord6306
ord4892
ord8366
ord5508
ord2905
ord874
ord8725
ord5717
ord1222
ord1923
ord4700
ord2628
ord6139
ord5098
ord5471
ord3819
ord2859
ord7570
ord1880
ord1449
ord1511
ord7068
ord8175
ord6392
ord6053
ord3969
ord1460

Exports

Exports

HrGetDocExDocument

Sections

.text
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/MShared/OFFICE14/EXP_XPS.DLL
.dll windows x86

6285bfed394e7f0e36eb346872712710

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:02:8e:42:00:00:00:00:00:1f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e0:96:f3:16:a1:72:4a:34:ae:b8:4a:fc:58:64:81:4f:45:46:a9:c1
Signer

Actual PE Digest

e0:96:f3:16:a1:72:4a:34:ae:b8:4a:fc:58:64:81:4f:45:46:a9:c1

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

14/02/2013, 15:10
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

_initterm_e
floor
free
malloc
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
ceil
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
memset
_vsnwprintf_s
wcsncpy_s
_snwprintf_s
rand

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetLastError
DeleteFileW
DisableThreadLibraryCalls
VirtualProtect

user32

GetDesktopWindow
ReleaseDC
GetDC

gdi32

SetTextAlign
GetTextAlign
GetGlyphIndicesW
CreateCompatibleBitmap
SelectObject
GetOutlineTextMetricsA
DeleteObject
GetCharWidthI

mso

ord4560
ord3654
ord3084
ord1391
ord4022
ord2551
ord6002
ord6420
ord4732
ord3026
ord5835
ord7038
ord4892
ord2456
ord1132
ord6306
ord874
ord6053
ord6790
ord6392
ord1644
ord3763
ord5426
ord2171
ord2967
ord8965
ord1460
ord9957
ord1324
ord5471
ord1880
ord1449
ord413
ord3147
ord3439
ord4849
ord4059
ord5098
ord4384
ord5313
ord4501
ord3186
ord5593
ord8121
ord10127
ord2905
ord5118
ord2850
ord6062
ord4257
ord834
ord9704
ord434
ord8921
ord9980
ord2929
ord5400
ord4925
ord1511
ord5717
ord8366
ord5508
ord8725
ord3663
ord1395
ord4441
ord7025
ord2552
ord10212
ord5219
ord7037
ord2301
ord1633
ord1923
ord4700
ord2628
ord8175
ord9649

Exports

Exports

HrGetDocExDocument

Sections

.text
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/MShared/OFFICE14/MSORES.DLL
.dll windows x86

Code Sign

61:1a:f5:ea:00:00:00:00:00:6a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/11/2011, 22:39

Not After

01/02/2013, 22:49

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:05:13:36:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2011, 20:42

Not After

25/10/2012, 20:42

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

5c:a6:63:83:7d:be:fa:10:bb:5e:dc:ab:8b:02:f0:69:87:ca:bb:9c
Signer

Actual PE Digest

5c:a6:63:83:7d:be:fa:10:bb:5e:dc:ab:8b:02:f0:69:87:ca:bb:9c

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

18/01/2012, 03:26
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 123B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 69.2MB - Virtual size: 69.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/MShared/OFFICE14/MSOXEV.DLL
.dll regsvr32 windows x86

8d285471f5aaa9d022808b6404776ded

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f8:4b:5d:ec:e3:2c:a6:d9:95:b6:45:a6:8b:fe:25:f7:f0:d0:38:69
Signer

Actual PE Digest

f8:4b:5d:ec:e3:2c:a6:d9:95:b6:45:a6:8b:fe:25:f7:f0:d0:38:69

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

05/11/2012, 15:30
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CharLowerW
IsCharAlphaW
DdeConnectList
DdeQueryNextServer
DdeQueryConvInfo
GetParent
IsIconic
ShowWindow
SetForegroundWindow
DdeFreeDataHandle
DdeFreeStringHandle
DdeDisconnectList
DdeUninitialize
DdeClientTransaction
DdeCreateStringHandleW
DdeInitializeW
AllowSetForegroundWindow

kernel32

InterlockedExchange
LocalAlloc
CreateProcessW
GlobalAlloc
CloseHandle
MultiByteToWideChar
GetACP
ReadFile
CreateFileW
GlobalFree
lstrlenW
LoadLibraryA
GetModuleHandleA
RaiseException
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
GetLastError
SetLastError
GetModuleFileNameW
OutputDebugStringA
GetVersionExA
GetModuleHandleExW
RtlCaptureStackBackTrace
FreeLibrary
VirtualProtect
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcessHeap
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
SetUnhandledExceptionFilter
LoadLibraryW

advapi32

RegOpenKeyExA
RegisterTraceGuidsA
TraceEvent
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

shell32

SHGetFileInfoW
ShellExecuteExW
ShellExecuteW
ord743

msvcr90

_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_onexit
_lock
wcsncpy_s
memset
_wcsicmp
_wcsnicmp
wcschr
memcpy
wcsstr
swscanf_s
_wtoi
_wcslwr_s
_encode_pointer
_malloc_crt
free
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_except_handler4_common
__dllonexit
__clean_type_info_names_internal
_unlock

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
XevDetect
XevDetectFileType
XevDetectStreamType
XevGetAppForGenericXML
XevGetFileIcons
XevInvokeVerb
XevIsDetectionEnabled
XevSetDetection
XevShellExecEx

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/MShared/OFFICE14/MSPTLS.DLL
.dll windows x86

2fe2b9172f01c9f6bc20dea3fbf343cd

Code Sign

33:00:00:01:12:51:dd:e2:f7:cb:45:1f:25:00:00:00:00:01:12
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2018, 20:20

Not After

23/11/2019, 20:20

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:7AB5-2DF2-DA3F,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:11

Not After

26/07/2019, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:08

Not After

26/07/2019, 20:08

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:61:3b:3c:af:9d:ed:ab:02:8e:77:ee:b2:66:63:4f:9a:99:f5:d7:d8:76:c0:21:2b:5d:3c:37:69:08:d8:99
Signer

Actual PE Digest

a7:61:3b:3c:af:9d:ed:ab:02:8e:77:ee:b2:66:63:4f:9a:99:f5:d7:d8:76:c0:21:2b:5d:3c:37:69:08:d8:99

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

1d:ed:4a:e6:10:1d:3c:b9:68:8f:ba:8f:51:7a:a2:4d:fa:7c:07:09
Signer

Actual PE Digest

1d:ed:4a:e6:10:1d:3c:b9:68:8f:ba:8f:51:7a:a2:4d:fa:7c:07:09

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

17/10/2018, 19:55
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

_except_handler4_common
_encode_pointer
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
memset
memcpy

kernel32

QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
VirtualProtect

Exports

Exports

FsAddFigureObstacle
FsAllocMemory
FsClearUpdateInfoInPage
FsClearUpdateInfoInSubpage
FsClearUpdateInfoInSubtrack
FsClearUpdateInfoInTableSrv
FsCommitFilledRectangle
FsCompareSubpages
FsCompareSubtrack
FsCompareTableSrv
FsCreateDocContext
FsCreateDummyFootnoteRejector
FsCreatePageBottomless
FsCreatePageFinite
FsCreateSubpageBottomless
FsCreateSubpageFinite
FsDestroyDocContext
FsDestroyFootnoteRejector
FsDestroyMemory
FsDestroyPage
FsDestroyPageBreakRecord
FsDestroySubpage
FsDestroySubpageBreakRecord
FsDestroySubtrack
FsDestroySubtrackBreakRecord
FsDestroyTableSrv
FsDestroyTableSrvBreakRecord
FsDuplicateGeometry
FsDuplicatePageBreakRecord
FsDuplicateSubpageBreakRecord
FsDuplicateSubtrackBreakRecord
FsDuplicateTableSrvBreakRecord
FsFAllFootnotesAllowed
FsFFootnoteAllowed
FsFormatSubtrackBottomless
FsFormatSubtrackFinite
FsFormatTableSrvBottomless
FsFormatTableSrvFinite
FsGetClientHandle
FsGetColumnRectangle
FsGetEmptySpaces
FsGetFigureObstacleData
FsGetFloaterFsimethods
FsGetIntervals
FsGetMaxNumberEmptySpaces
FsGetMaxNumberIntervals
FsGetNextTick
FsGetNumberSubpageFootnotes
FsGetNumberSubtrackFootnotes
FsGetPageRectangle
FsGetShiftOffset
FsGetSubpageColumnBalancingInfo
FsGetSubpageFootnoteInfo
FsGetSubpageFootnoteInfoWord
FsGetSubtrackColumnBalancingInfo
FsGetSubtrackFootnoteInfo
FsGetTableObjFsimethods
FsGetTableSrvColumnBalancingInfo
FsGetTableSrvFootnoteInfo
FsGetTableSrvNumberFootnotes
FsJustifySubpage
FsQueryAttachedObjectList
FsQueryCompositeColumnDetails
FsQueryCompositeColumnFootnoteList
FsQueryDcpLineVariantsFromCachedTextPara
FsQueryEndnoteColumnDetails
FsQueryEquationDetails
FsQueryFigureObjectDetails
FsQueryFloaterDetails
FsQueryFootnoteColumnDetails
FsQueryFootnoteColumnTrackList
FsQueryHeightDefinedColumnSpanAreaList
FsQueryLineCompositeElementList
FsQueryLineListComposite
FsQueryLineListSingle
FsQueryMathLineList
FsQueryMathParaDetails
FsQueryMathParaEquationList
FsQueryMathParaEquationNumberList
FsQueryPageDetails
FsQueryPageFootnoteColumnList
FsQueryPageSectionList
FsQuerySectionBasicColumnList
FsQuerySectionCompositeColumnList
FsQuerySectionDetails
FsQuerySectionEndnoteColumnList
FsQuerySegmentDefinedColumnSpanAreaList
FsQuerySubpageBasicColumnList
FsQuerySubpageDetails
FsQuerySubpageHeightDefinedColumnSpanAreaList
FsQuerySubpagePrepositionElements
FsQuerySubpageSegmentDefinedColumnSpanAreaList
FsQuerySubtrackDetails
FsQuerySubtrackParaList
FsQueryTableObjCellList
FsQueryTableObjDetails
FsQueryTableObjFigureCountWord
FsQueryTableObjFigureListWord
FsQueryTableObjRowDetails
FsQueryTableObjRowList
FsQueryTableObjTableProperDetails
FsQueryTableSrvCellList
FsQueryTableSrvRowDetails
FsQueryTableSrvRowList
FsQueryTableSrvTableDetails
FsQueryTextDetails
FsQueryTrackDetails
FsQueryTrackParaList
FsReallocMemory
FsRegisterFloatObstacle
FsReleaseGeometry
FsResolveOverlap
FsRestoreGeometry
FsSetDebugFlags
FsShiftSubtrackVertical
FsSynchronizeBottomlessSubtrack
FsTransferDisplayInfoSubpage
FsTransferDisplayInfoSubtrack
FsTransferDisplayInfoTableSrv
FsTransformBbox
FsTransformPoint
FsTransformRectangle
FsTransformVector
FsUpdateBottomlessPage
FsUpdateBottomlessSubpage
FsUpdateBottomlessSubtrack
FsUpdateBottomlessTableSrv
FsUpdateFinitePage
LsAllocMemory
LsAppendRunToCurrentSubline
LsCompressSubline
LsCreateBreakRecordSubline
LsCreateContext
LsCreateLine
LsCreateLineGivenBreak
LsCreateParaBreakingSession
LsCreateStartOppInsideSubline
LsCreateSubline
LsCreateSublineFragment
LsDebugViewLine
LsDebugViewSubline
LsDestroyBreakOppSubline
LsDestroyBreakRecord
LsDestroyBreakRecordSubline
LsDestroyContext
LsDestroyLine
LsDestroyMemory
LsDestroyParaBreakingSession
LsDestroyStartOppSubline
LsDestroySubline
LsDestroySublineFragment
LsDisplayLine
LsDisplaySubline
LsDoSpacingSubline
LsDuplicateBreakRecord
LsDuplicateBreakRecordSubline
LsEnumLine
LsEnumSubline
LsExpandSubline
LsFetchAppendToCurrentSubline
LsFetchAppendToCurrentSublineResume
LsFindBreakOppAfterCpTruncateSubline
LsFindBreakOppBeforeCpTruncateSubline
LsFindForceBreakOppBeforeCpTruncateSubline
LsFindNextBreakOppInsideSubline
LsFindPrevBreakOppInsideSubline
LsFindPrevForceBreakOppInsideSubline
LsFinishCurrentSubline
LsGetHihLsimethods
LsGetLineBreaks
LsGetMathLsimethods
LsGetMinMaxDurUntilHardBreak
LsGetPenaltyModule
LsGetReverseLsimethods
LsGetRubyLsimethods
LsGetSpecialEffectsSubline
LsGetSpecialEffectsSublineFragment
LsGetStretchabilityForLine
LsGetTatenakayokoLsimethods
LsGetVRubyLsimethods
LsGetWarichuLsimethods
LsLwMultDivR
LsMatchPresSubline
LsModifyLineHeight
LsPointUV2FromPointUV1
LsPointXYFromPointUV
LsProposeBreakAfterSubline
LsProposeBreakBeforeSubline
LsQueryCpPpointSubline
LsQueryFLineEmpty
LsQueryLineCpPpoint
LsQueryLineDown
LsQueryLineDup
LsQueryLineMaxDepth
LsQueryLinePointPcp
LsQueryLineUp
LsQueryPointPcpSubline
LsQuerySublineDown
LsQuerySublineUp
LsQueryTextCellDetails
LsReallocMemory
LsResetRMInCurrentSubline
LsSetBreakSubline
LsSetBreaking
LsSetCompression
LsSetDebugFlags
LsSetDoc
LsSetExpansion
LsSetModWidthPairs
LsSetPenalty
LsSqueezeSubline
LsTruncateSubline
LsZaFromZq
LsZqFromZa
LsdnDistribute
LsdnFinishByPen
LsdnFinishRegular
LsdnFinishRegularAddAdvancePen
LsdnGetCurTabInfo
LsdnGetDup
LsdnModifyParaEnding
LsdnQueryObjDimRange
LsdnQueryPenNode
LsdnResetObjDim
LsdnResetPenNode
LsdnResolvePrevTab
LsdnSetAbsBaseLine
LsdnSetRigidDup
LsdnSkipCurTab
LsmsrvFIsOperator
LsmsrvGetBreakingQualityForOperatorCharacter
LsmsrvGetBuildupClass
LsmsrvGetSpacing
LsmsrvGetSpacingClassAsDifferential
LsmsrvGetSpacingClassAsMathOp
LsmsrvGetSpacingClassAsSubformula
LsmsrvGetSpacingClassAsText
LsmsrvGetSpacingClassForOperatorCharacter
LsmsrvGetSpacingClassForRegularFunction
LssbFDoneDisplay
LssbFDonePresSubline
LssbFIsSublineEmpty
LssbGetDupSubline
LssbGetDurTrailInSubline
LssbGetDurTrailWithPensInSubline
LssbGetNumberDnodesInSubline
LssbGetObjDimSubline
LssbGetPlsrunsFromSubline
LssbGetVisibleDcpInSubline
dvl
dvs

Sections

.text
Size: 723KB - Virtual size: 723KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/MShared/OFFICE14/MSSOAP30.DLL
.dll regsvr32 windows x86

b9479145531b585587fdabbd56df5fa5

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7d:a2:2b:92:fc:00:3d:06:72:53:c6:33:85:09:d4:e8:17:ff:ad:5d
Signer

Actual PE Digest

7d:a2:2b:92:fc:00:3d:06:72:53:c6:33:85:09:d4:e8:17:ff:ad:5d

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

06/02/2010, 13:24
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

UrlCombineW

urlmon

URLOpenBlockingStreamW

kernel32

GetModuleFileNameW
IsValidLocale
GetEnvironmentVariableW
GetTimeZoneInformation
WideCharToMultiByte
MultiByteToWideChar
TlsSetValue
TlsGetValue
TlsAlloc
TlsFree
CreateFileW
GetCPInfo
GetProcAddress
LoadLibraryExW
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
GetLastError
DeleteFileW
CloseHandle
MoveFileW
GetTempFileNameW
GetTempPathW
FindClose
FindNextFileW
FindFirstFileW
GetUserDefaultLCID
GetSystemDefaultLangID
LoadLibraryW
Sleep
FlushFileBuffers
SetFilePointer
ReadFile
WriteFile
SetEndOfFile
GetFileTime
GetFileSize
IsDebuggerPresent
GetSystemDefaultLCID
FreeLibrary
FormatMessageW
GetModuleHandleW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
GetProcessHeap

user32

LoadStringW

advapi32

RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegQueryValueExW
RegCloseKey
RegOpenKeyExW

ole32

CLSIDFromString
StringFromCLSID
CoTaskMemFree
CoCreateFreeThreadedMarshaler
StringFromGUID2
CLSIDFromProgID
CoCreateGuid
CoCreateInstance

oleaut32

SysAllocStringByteLen
SafeArrayCreateVector
SysStringByteLen
SystemTimeToVariantTime
SafeArrayCreateEx
SafeArrayPutElement
SafeArrayRedim
SafeArrayGetElement
SafeArrayGetRecordInfo
SafeArrayLock
SafeArrayPtrOfIndex
SafeArrayUnlock
VarDateFromStr
SafeArrayGetDim
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
VariantTimeToSystemTime
VarDecFromI4
SafeArrayDestroy
VarDecCmp
LoadTypeLibEx
VariantChangeType
GetErrorInfo
SetErrorInfo
SafeArrayCopy
VariantCopy
VariantChangeTypeEx
SafeArrayCopyData
SysStringLen
SysAllocStringLen
SysAllocString
VariantClear
VariantInit
SysFreeString
VarDecFromStr
SafeArrayCreate

msvcr90

wcsnlen
__clean_type_info_names_internal
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
vswprintf_s
malloc
ceil
_wcsnicmp
iswspace
_vsnwprintf
_wcslwr_s
_wtoi
floor
wcstok_s
memcpy
wcstol
wcsncmp
__CxxFrameHandler3
??3@YAXPAX@Z
??2@YAPAXI@Z
_CxxThrowException
qsort
_wcsicmp
bsearch
??_V@YAXPAX@Z
??_U@YAPAXI@Z
memset
wcsstr
wcsrchr
free
realloc
wcschr
?_type_info_dtor_internal_method@type_info@@QAEXXZ

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 325KB - Virtual size: 325KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/MShared/OFFICE14/RICHED20.DLL
.dll windows x86

acf00600166aadce6005fa7a4ded69d3

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:12

Not After

04/12/2013, 21:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

76:3d:e2:a5:89:5d:95:42:12:5b:70:67:be:55:59:da:a7:4b:64:f6
Signer

Actual PE Digest

76:3d:e2:a5:89:5d:95:42:12:5b:70:67:be:55:59:da:a7:4b:64:f6

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

15/01/2013, 12:33
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

QueryPerformanceCounter
GetSystemTimeAsFileTime
GetProcessHeap
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LeaveCriticalSection
RaiseException
GetFileType
SetFilePointer
CloseHandle
WriteFile
ReadFile
GetCurrentProcessId
Sleep
LocalAlloc
LocalLock
LocalUnlock
HeapDestroy
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
LocalFree
GetTickCount
lstrcmpiA
HeapReAlloc
HeapCreate
HeapAlloc
HeapFree
GetCurrentThreadId
GetLastError
FindAtomW
FindAtomA
LoadLibraryW
LoadLibraryA
CompareStringW
CompareStringA
CreateFileW
CreateFileA
GetStringTypeExW
GetStringTypeExA
GetModuleHandleA
GetSystemDefaultLCID
GetACP
GetModuleHandleW
GetModuleFileNameW
GetModuleFileNameA
GetUserDefaultLCID
GetSystemDefaultLangID
GetLocaleInfoW
WideCharToMultiByte
IsValidCodePage
GetThreadLocale
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
GlobalUnlock
GlobalHandle
GlobalLock
GlobalSize
GlobalReAlloc
GlobalFlags
GlobalFree
GlobalAlloc
lstrcmpiW
GetProfileSectionW
GetVersionExA
MultiByteToWideChar
GetProcAddress
FreeLibrary
MulDiv
EnterCriticalSection
VirtualProtect

user32

CreatePopupMenu
AppendMenuW
UnionRect
IsWindowEnabled
GetDesktopWindow
IsWindow
GetWindow
EnableWindow
IsChild
CreateWindowExA
SetParent
MoveWindow
ShowWindow
GetDCEx
MonitorFromWindow
GetMonitorInfoW
DrawFrameControl
GetCursor
DestroyWindow
GetScrollInfo
DrawFocusRect
GetMessageTime
GetMessagePos
OffsetRect
CopyRect
GetAsyncKeyState
WindowFromDC
DestroyMenu
MessageBeep
GetClipboardData
GetClipboardOwner
OpenClipboard
EmptyClipboard
CloseClipboard
SetClipboardData
IsClipboardFormatAvailable
GetCaretPos
GetCapture
DestroyCaret
BeginPaint
EndPaint
ValidateRect
SetScrollInfo
SetForegroundWindow
ClientToScreen
ScreenToClient
SetCursor
SetFocus
SetCapture
ReleaseCapture
ScrollWindowEx
SetCaretPos
ShowCaret
HideCaret
CreateCaret
UpdateWindow
SetScrollPos
SetScrollRange
IsWindowVisible
InvalidateRect
GetDlgItem
GetFocus
IsIconic
GetWindowDC
GetWindowRect
SetRect
ReleaseDC
GetDC
IntersectRect
NotifyWinEvent
RegisterClipboardFormatA
GetSystemMetrics
RegisterClassW
RegisterClassA
UnregisterClassW
UnregisterClassA
CharUpperBuffW
CharUpperA
CharLowerBuffW
CharLowerA
CreateWindowExW
SetWindowPos
GetDoubleClickTime
GetKeyboardLayoutList
IsWindowUnicode
SendMessageW
RegisterWindowMessageA
FindWindowA
SendMessageA
SystemParametersInfoW
GetKeyState
GetSysColor
FrameRect
InflateRect
FillRect
SetTimer
GetClientRect
MapWindowPoints
GetCursorPos
PtInRect
WindowFromPoint
KillTimer
GetForegroundWindow
GetParent
InvertRect
PeekMessageW
PeekMessageA
PostMessageW
PostMessageA
SetWindowLongW
SetWindowLongA
LoadCursorW
LoadCursorA
LoadBitmapW
LoadBitmapA
GetClassLongW
GetClassLongA
GetWindowLongW
GetWindowLongA
DefWindowProcW
DefWindowProcA
SetCaretBlinkTime
EnableScrollBar
ShowScrollBar
ActivateKeyboardLayout
GetKeyboardLayout
TrackPopupMenu

gdi32

StretchBlt
CombineRgn
CreateRectRgnIndirect
GetWindowOrgEx
Polyline
PatBlt
SetTextColor
GetBkColor
SetBkMode
CreatePen
GetCurrentObject
EnumMetaFile
DeleteMetaFile
CloseMetaFile
SetWindowExtEx
SetWindowOrgEx
CreateMetaFileA
DeleteEnhMetaFile
SetMetaFileBitsEx
GetWinMetaFileBits
CreatePatternBrush
SelectClipRgn
GetBkMode
RestoreDC
IntersectClipRect
SaveDC
GdiFlush
GetMetaFileBitsEx
GetEnhMetaFileBits
GetEnhMetaFileHeader
SetEnhMetaFileBits
TranslateCharsetInfo
GetPixel
CreateCompatibleBitmap
Rectangle
SetROP2
CreateDIBSection
GetOutlineTextMetricsW
GetFontData
GetGlyphOutlineW
StretchDIBits
GetGlyphIndicesW
BitBlt
CreateCompatibleDC
GetTextMetricsA
CreateICW
CreateICA
GetStockObject
CreateBitmap
CreatePalette
GetObjectW
GetObjectA
CreateFontIndirectW
CreateFontIndirectA
GetTextFaceW
GetTextFaceA
EnumFontFamiliesExW
GetKerningPairsA
SelectPalette
SelectObject
ExtTextOutA
GetOutlineTextMetricsA
GetTextMetricsW
GetCharWidthW
GetCharWidthA
GetCharWidth32A
GetCharABCWidthsW
GetDeviceCaps
CreateDCW
SetBkColor
CreateSolidBrush
RealizePalette
DeleteObject
GetObjectType
Escape
LPtoDP
DPtoLP
ExtTextOutW
GetTextCharsetInfo
SetTextAlign
DeleteDC

advapi32

RegEnumKeyExW
RegEnumKeyExA
RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegOpenKeyExW

msvcr90

?_type_info_dtor_internal_method@type_info@@QAEXXZ
wcsrchr
memset
wcsncpy_s
memcpy
memmove
strncpy_s
_wcsnicmp
qsort
wcsncmp
wcstod
_encode_pointer
_malloc_crt
free
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_vsnprintf_s
_except_handler4_common
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
iswspace

Exports

Exports

CreateMathXmlHandler
CreateTextBoxLayout
CreateTextServices
DllGetVersion
GetMathAlphanumeric
GetMathAlphanumericCode
GetMathContextMenu
GetMathContextMenuItems
IID_IRichEditOle
IID_IRichEditOleCallback
IID_ITextDocument2
IID_ITextHost
IID_ITextHost2
IID_ITextHostEx
IID_ITextServices
IID_ITextServices2
MathBuildDown
MathBuildUp
MathTranslate
ProcessMathMenuID
RECreateMessageFilter
REExtendedRegisterClass
REMSOHInst
RichComboBoxWndProc
RichEdit10ANSIWndProc
RichEditANSIWndProc
RichEditWndProc
RichListBoxWndProc
SetCustomTextOutHandlerEx
WriteMathPrSax
_DisableOleinitCheck@0

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/MShared/OFFICE14/USP10.DLL
.dll windows x86

7bf4543bbf1e3ec43d043dd6a35cd162

Code Sign

33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/08/2016, 20:17

Not After

02/11/2017, 20:17

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:4f:e7:c6:62:c9:46:f4:a9:7f:00:00:00:00:01:4f
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

17/11/2016, 21:59

Not After

17/02/2018, 21:59

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:73:96:35:db:57:da:2d:cf:fa:7c:04:d8:84:50:84:e2:5e:95:89:ba:20:a9:9d:18:6e:7f:d2:22:d1:26:0d
Signer

Actual PE Digest

62:73:96:35:db:57:da:2d:cf:fa:7c:04:d8:84:50:84:e2:5e:95:89:ba:20:a9:9d:18:6e:7f:d2:22:d1:26:0d

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

ed:d9:16:c7:10:2a:ac:cc:71:0b:31:47:37:78:2c:ed:6a:12:28:98
Signer

Actual PE Digest

ed:d9:16:c7:10:2a:ac:cc:71:0b:31:47:37:78:2c:ed:6a:12:28:98

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

03/08/2017, 18:33
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_isatty
_write
_lseeki64
_fileno
__pioinfo
__badioinfo
wctomb
_itoa
_snprintf
_iob
isleadbyte
memcpy
memset
_amsg_exit
_initterm
free
malloc
_XcptFilter
_errno
memmove
_vsnprintf

kernel32

UnmapViewOfFile
CreateFileW
GetFileSizeEx
CreateFileMappingA
LocalAlloc
InterlockedCompareExchange
MapViewOfFile
EnterCriticalSection
LeaveCriticalSection
ConvertDefaultLocale
IsValidLocale
GetLocaleInfoW
GetACP
GetProcAddress
GetLastError
InterlockedIncrement
MulDiv
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
GetProfileIntA
GetProfileStringA
lstrcmpiA
CreateFileA
ReadFile
CloseHandle
LoadLibraryA
TlsAlloc
InitializeCriticalSection
GetVersionExA
ExpandEnvironmentStringsW
DeleteCriticalSection
TlsFree
DisableThreadLibraryCalls
GetUserDefaultLCID
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
LocalFree
InterlockedExchange
TlsGetValue
HeapSize
TlsSetValue
FindResourceA
LoadResource
LockResource
DelayLoadFailureHook
FreeLibrary
LoadLibraryExA
Sleep
OutputDebugStringA
RtlUnwind
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter

user32

GetSysColor
GetDC
ReleaseDC
GetSystemMetrics
CharUpperW
SetRect

gdi32

GetTextMetricsW
GetTextAlign
GetCurrentPositionEx
SetBkColor
SetTextColor
SetTextAlign
GetFontData
GetObjectW
CreateSolidBrush
Ellipse
GetTextExtentExPointW
ExtTextOutA
LineTo
CreatePen
GetStockObject
GetTextColor
DeleteDC
SetGraphicsMode
GetGraphicsMode
CreateCompatibleDC
MoveToEx
SetBkMode
GetObjectType
GetBkMode
ExtTextOutW
DeleteObject
CreateFontA
CreateFontIndirectW
TranslateCharsetInfo
GetCharWidthA
DPtoLP
GetGlyphOutlineA
GetTextCharset
GetTextFaceA
GetDeviceCaps
GetTextFaceW
GetOutlineTextMetricsW
GetTextMetricsA
SelectObject
CreateFontIndirectA
GetObjectA
GetCurrentObject
GetViewportExtEx
GetWindowExtEx

Exports

Exports

LpkPresent
ScriptApplyDigitSubstitution
ScriptApplyLogicalWidth
ScriptBreak
ScriptCPtoX
ScriptCacheGetHeight
ScriptFreeCache
ScriptGetCMap
ScriptGetFontAlternateGlyphs
ScriptGetFontFeatureTags
ScriptGetFontLanguageTags
ScriptGetFontProperties
ScriptGetFontScriptTags
ScriptGetGlyphABCWidth
ScriptGetLogicalWidths
ScriptGetProperties
ScriptIsComplex
ScriptItemize
ScriptItemizeOpenType
ScriptJustify
ScriptLayout
ScriptPlace
ScriptPlaceOpenType
ScriptPositionSingleGlyph
ScriptRecordDigitSubstitution
ScriptShape
ScriptShapeOpenType
ScriptStringAnalyse
ScriptStringCPtoX
ScriptStringFree
ScriptStringGetLogicalWidths
ScriptStringGetOrder
ScriptStringOut
ScriptStringValidate
ScriptStringXtoCP
ScriptString_pLogAttr
ScriptString_pSize
ScriptString_pcOutChars
ScriptSubstituteSingleGlyph
ScriptTextOut
ScriptXtoCP
UspAllocCache
UspAllocTemp
UspFreeMem

Sections

.text
Size: 369KB - Virtual size: 369KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 167KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/MShared/OFFICE14/VBAJET32.DLL
.dll windows x86

ee68311f9723479d45460c5fe7acd641

Code Sign

33:00:00:00:c6:78:80:36:01:75:1a:69:72:00:00:00:00:00:c6
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/08/2016, 20:17

Not After

02/11/2017, 20:17

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:ab:5c:12:d7:b3:29:3d:e3:ce:ce:6f:1a:14:fe:47:ac:7d:53:fd
Signer

Actual PE Digest

38:ab:5c:12:d7:b3:29:3d:e3:ce:ce:6f:1a:14:fe:47:ac:7d:53:fd

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

16/03/2017, 19:39
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeLibrary
GetProcAddress
GetSystemDirectoryA
LoadLibraryA
GetLastError
GetModuleFileNameA
GetModuleHandleA
SetErrorMode
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
WriteFile
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
HeapSize

Exports

Exports

LoadExprSrvDll
VBAGetExprSrv

Sections

.text
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/MShared/OFFICE14/WISC30.DLL
.dll regsvr32 windows x86

8c3bb8051bd42ee7e145039027a00edb

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6d:1c:eb:86:f0:80:b8:63:3e:71:3b:cc:54:20:f1:db:8f:69:99:a5
Signer

Actual PE Digest

6d:1c:eb:86:f0:80:b8:63:3e:71:3b:cc:54:20:f1:db:8f:69:99:a5

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

06/02/2010, 13:24
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetSetOptionW
InternetReadFile
InternetCloseHandle
HttpQueryInfoA
HttpEndRequestW
HttpSendRequestExW
InternetWriteFile
HttpAddRequestHeadersW
InternetCrackUrlW
InternetOpenW
InternetConnectW
HttpQueryInfoW
HttpOpenRequestW

crypt32

CertNameToStrW
CertOpenStore
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext

kernel32

InterlockedExchange
Sleep
GetLastError
GetProcAddress
LoadLibraryExW
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
FormatMessageW
FindClose
FindNextFileW
InterlockedCompareExchange
GetUserDefaultLCID
GetSystemDefaultLCID
GetSystemDefaultLangID
FreeLibrary
LoadLibraryW
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
GetModuleHandleW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
VirtualProtect
IsDebuggerPresent
FindFirstFileW
GetTickCount

user32

LoadStringW

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

ole32

CoCreateFreeThreadedMarshaler

oleaut32

LoadTypeLibEx
GetErrorInfo
SetErrorInfo
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen
SysStringLen
SysFreeString
SysAllocString

msvcr90

??2@YAPAXI@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_onexit
__CxxFrameHandler3
??3@YAXPAX@Z
_CxxThrowException
_lock
_wcsicmp
??_U@YAPAXI@Z
memset
iswspace
wcsncmp
_wtoi
_vsnwprintf
wcsstr
malloc
realloc
??_V@YAXPAX@Z
_encode_pointer
_malloc_crt
free
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_except_handler4_common
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/MShared/OFFICE14/msoshext.dll
.dll regsvr32 windows x86

cecb5a191b042927eb95418f27fc6a5f

Code Sign

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

94:5e:d8:33:02:b9:49:d9:b1:38:48:06:16:f2:24:40:ba:4c:da:93
Signer

Actual PE Digest

94:5e:d8:33:02:b9:49:d9:b1:38:48:06:16:f2:24:40:ba:4c:da:93

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

25/06/2013, 21:19
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__clean_type_info_names_internal
_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_mbschr
_snprintf_s
srand
rand
_vsnprintf_s
swprintf_s
_snwprintf_s
strncpy_s
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
memcpy_s
bsearch
_vscwprintf
wcsstr
vswprintf_s
vsprintf_s
??2@YAPAXI@Z
??3@YAXPAX@Z
memmove
wcsncat_s
wcschr
wcsrchr
wcsncpy_s
memcpy
_vsnwprintf_s
memset
realloc
malloc
free
__CxxFrameHandler3

kernel32

ReleaseSemaphore
GetSystemInfo
GetModuleHandleExW
RtlCaptureStackBackTrace
CreateSemaphoreW
LocalFree
RemoveDirectoryW
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
GetUserDefaultLCID
CloseHandle
WaitForSingleObject
OpenMutexW
CreateMutexW
ReleaseMutex
GetModuleFileNameW
GetVersionExW
DeleteFileW
GetLastError
CopyFileExW
GetTempFileNameW
GetVersionExA
IsWow64Process
GetCurrentProcess
GetFileAttributesW
GetCurrentThreadId
GetCurrentProcessId
GetTickCount
GetSystemTimeAsFileTime
GetShortPathNameW
GetLongPathNameW
CreateDirectoryW
SetLastError
GetFileType
CreateFileW
RaiseException
GetModuleHandleA
ReplaceFileW
SetFileAttributesW
GlobalFree
GlobalAlloc
GetCurrentThread
GetProcAddress
GetModuleHandleW
GetSystemDefaultLCID
InitializeCriticalSectionAndSpinCount
GetOverlappedResult
WaitForMultipleObjects
ResetEvent
ReadFile
CreateEventA
GetFileTime
SetFileTime
SetFilePointerEx
GetFileSizeEx
WriteFile
SetEndOfFile
FlushFileBuffers
DeviceIoControl
IsDBCSLeadByte
LockResource
LoadResource
FindResourceA
GetStringTypeExW
IsValidLocale
FileTimeToSystemTime
SystemTimeToFileTime
GetSystemTime
WideCharToMultiByte
IsValidCodePage
CompareStringW
MultiByteToWideChar
FileTimeToLocalFileTime
MulDiv
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
GetVersion
LoadLibraryW
OutputDebugStringA
LoadLibraryExW
GetSystemDirectoryW
UnmapViewOfFile
IsDebuggerPresent
CreateFileMappingA
VirtualProtect
QueryPerformanceCounter
GetProcessHeap
HeapFree
HeapAlloc
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
MapViewOfFile

user32

GetSystemMetrics
GetDC
ReleaseDC
RegisterClipboardFormatW

shell32

SHGetDesktopFolder
SHGetSpecialFolderPathW

shlwapi

StrRetToBufW

ole32

StringFromGUID2
CoTaskMemFree
PropVariantClear
PropVariantCopy
CoGetMalloc
StgOpenStorageOnILockBytes
WriteFmtUserTypeStg
CreateILockBytesOnHGlobal
CLSIDFromString
CoCreateGuid
CoTaskMemAlloc
ReadClassStg
GetConvertStg
CLSIDFromProgID
StgCreateDocfileOnILockBytes
CreateStreamOnHGlobal
CoCreateInstance

gdi32

DeleteObject
ExtFloodFill
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC

advapi32

GetTokenInformation
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
TraceEvent
RegEnumValueW
ConvertSidToStringSidW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegisterTraceGuidsA
IsValidSid
CopySid
GetLengthSid
OpenProcessToken
OpenThreadToken
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids

oleaut32

SafeArrayCreate
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayCopy
VariantTimeToSystemTime
VariantChangeTypeEx
SafeArrayAccessData
SafeArrayUnaccessData
SystemTimeToVariantTime
SysAllocStringLen
SysStringLen
SysFreeString
SysAllocString
VariantChangeType
VariantClear
VariantInit

gdiplus

GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdiplusShutdown
GdiplusStartup
GdipGetImageHeight
GdipGetImageWidth
GdipFree
GdipAlloc
GdipLoadImageFromStreamICM
GdipDisposeImage
GdipCloneImage
GdipDeleteGraphics
GdipLoadImageFromStream

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 707KB - Virtual size: 706KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 221KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/MShared/Portal/2052/PortalConnect.dll
.dll windows x86

e57983b5d2e2f8ff1ff815b5273370e3

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

26:36:b3:b3:a2:2f:1a:0b:c7:33:28:63:52:87:8f:b2:f3:a7:7e:d7
Signer

Actual PE Digest

26:36:b3:b3:a2:2f:1a:0b:c7:33:28:63:52:87:8f:b2:f3:a7:7e:d7

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/03/2010, 04:45
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer

kernel32

VirtualProtect
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/MShared/Portal/PortalConnectCore.dll
.dll regsvr32 windows x86

038bfd1dc271802119d8da1e18b697ed

Code Sign

61:02:8e:42:00:00:00:00:00:1f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1c:23:48:67:d9:03:a6:98:c0:be:49:53:be:f2:5d:1b:d1:81:92:a0
Signer

Actual PE Digest

1c:23:48:67:d9:03:a6:98:c0:be:49:53:be:f2:5d:1b:d1:81:92:a0

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

06/03/2013, 07:11
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

secur32

GetUserNameExW

kernel32

HeapSize
HeapUnlock
HeapLock
GetCurrentThreadId
CreateFileW
ExpandEnvironmentStringsW
GetProcessTimes
GetCurrentProcess
GlobalFree
CreateMutexA
OpenMutexA
CreateSemaphoreA
CreateFileMappingA
GetShortPathNameA
GlobalAlloc
GetSystemDirectoryW
GetTimeZoneInformation
GetDiskFreeSpaceExW
IsWow64Process
GetSystemInfo
GetUserDefaultLCID
GetVersionExW
TerminateProcess
GetCurrentProcessId
UnmapViewOfFile
MapViewOfFile
GetUserDefaultLangID
LocalFree
LocalAlloc
Sleep
GetTempPathW
WriteFile
GetShortPathNameW
GetLongPathNameW
CreateDirectoryW
GetFileType
HeapReAlloc
LockResource
GetStringTypeExW
IsValidCodePage
GetCurrentThread
GlobalMemoryStatus
ReleaseSemaphore
IsProcessorFeaturePresent
EnumUILanguagesW
EnumSystemLocalesW
GetLocalTime
GetTickCount
GetSystemTimeAsFileTime
CloseHandle
ReleaseMutex
WaitForSingleObject
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedCompareExchange
InterlockedExchange
QueryPerformanceCounter
VirtualProtect
RtlCaptureStackBackTrace
GetModuleHandleExW
GetVersionExA
TlsFree
GetSystemDefaultLCID
TlsAlloc
InitializeCriticalSectionAndSpinCount
TlsGetValue
HeapDestroy
HeapCreate
HeapSetInformation
VirtualAlloc
GetProcessHeap
HeapAlloc
HeapFree
IsValidLocale
GetSystemDefaultLangID
ReadFile
DeleteFileW
SetFileAttributesW
VirtualFree
TlsSetValue
OutputDebugStringA
GetModuleFileNameW
SetLastError
LoadLibraryW
GetVersion
GetFileAttributesW
LoadLibraryExW
CompareStringW
GetLocaleInfoW
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
IsDBCSLeadByte
GetModuleHandleW
GetModuleFileNameA
lstrcmpiA
lstrlenA
GetModuleHandleA
GetProcAddress
GetLastError
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
WideCharToMultiByte
MultiByteToWideChar

ole32

CoCreateInstance
StringFromGUID2
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

SysAllocString
VarBstrCmp
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysFreeString
SysStringLen

user32

SystemParametersInfoA
GetSystemMetrics
ReleaseDC
LoadStringW
MessageBoxW
CharNextW
CharNextA
GetMenuCheckMarkDimensions
GetKeyboardLayoutList
GetKeyboardLayout
GetSysColor
GetMonitorInfoA
EnumDisplayMonitors
GetDC

wininet

InternetCrackUrlW

rpcrt4

UuidCreate

gdi32

DeleteObject
GetDeviceCaps
DeleteDC
CreateDCA
CreateSolidBrush

shell32

SHGetDesktopFolder
SHGetSpecialFolderPathW

shlwapi

StrRetToBufW
PathRemoveFileSpecW

advapi32

RegQueryValueExW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegEnumKeyExA
RegQueryInfoKeyA
ConvertSidToStringSidA
RegCreateKeyExW
UnregisterTraceGuids
OpenThreadToken
CheckTokenMembership
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
OpenProcessToken
GetTokenInformation
CopySid
AllocateAndInitializeSid
InitializeAcl
AddAccessDeniedAce
AddAccessAllowedAce
GetLengthSid
RegEnumValueW
RegEnumKeyW
RegQueryInfoKeyW
RegQueryValueExA
RegEnumValueA
RegSetValueExW
RegDeleteValueW
TraceEvent
RegisterTraceGuidsA
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegOpenKeyExW
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
IsValidSid

msvcr90

strstr
malloc
free
memcpy_s
strcpy_s
wcsncpy_s
strncpy_s
strcat_s
_resetstkoflw
_recalloc
memset
wcsncat_s
_snwprintf_s
memcpy
iswspace
wcschr
bsearch
_vsnprintf_s
wcsstr
memmove
wcsrchr
_CIsqrt
vswprintf_s
_vscwprintf
wcscpy_s
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
_crt_debugger_hook
__clean_type_info_names_internal
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__CxxFrameHandler3
_vsnprintf
_CxxThrowException
_wcsicmp

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 320KB - Virtual size: 319KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 197KB - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/MShared/VBA/VBA6/VBE6EXT.OLB
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/MShared/VBA/VBA7/--VBE7.DLL
.dll regsvr32 windows x86

fd4029a686c1d3553bb1dd4cb4b58cbb

Code Sign

33:00:00:01:2e:8f:84:66:68:39:bf:05:bd:00:00:00:00:01:2e
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/09/2019, 20:40

Not After

04/12/2020, 20:40

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6f:cb:6e:95:e2:10:05:7b:f0:ad:90:50:77:90:d1:03:43:da:a6:41:51:84:5a:94:60:e4:59:2d:e8:75:5f:31
Signer

Actual PE Digest

6f:cb:6e:95:e2:10:05:7b:f0:ad:90:50:77:90:d1:03:43:da:a6:41:51:84:5a:94:60:e4:59:2d:e8:75:5f:31

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

5c:bc:1b:06:74:f0:a8:36:10:ec:25:6a:1f:3e:e1:ec:17:22:8d:0c
Signer

Actual PE Digest

5c:bc:1b:06:74:f0:a8:36:10:ec:25:6a:1f:3e:e1:ec:17:22:8d:0c

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

17/03/2020, 01:58
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapFree
SetEndOfFile
CreateFileMappingA
GetProfileIntA
DuplicateHandle
GetCurrentProcess
CreatePipe
SetLocalTime
RtlUnwind
SetFileTime
GetFileTime
GetVolumeInformationA
FileTimeToSystemTime
FileTimeToLocalFileTime
SetFileAttributesA
GetUserDefaultLangID
IsValidCodePage
GetModuleFileNameW
TerminateThread
CreateThread
GetDriveTypeW
GetLocaleInfoW
LoadLibraryW
SearchPathW
CreateFileW
GetStringTypeExW
LCMapStringW
FlushInstructionCache
GetComputerNameA
SetCurrentDirectoryA
HeapSize
SetEnvironmentVariableA
GetSystemTimeAsFileTime
CreateDirectoryA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetFileSize
GetCommandLineA
GetModuleHandleW
GetSystemInfo
FlushFileBuffers
GetConsoleCP
GetConsoleMode
LockFile
UnlockFile
FindNextFileA
RemoveDirectoryA
ExitProcess
GetFullPathNameW
WriteConsoleW
GetStdHandle
GetCPInfo
GetOEMCP
SetHandleCount
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
SetStdHandle
GetProcessHeap
WriteConsoleA
GetConsoleOutputCP
InitializeCriticalSectionAndSpinCount
GetStringTypeW
GetTimeZoneInformation
HeapReAlloc
GlobalMemoryStatus
SetFilePointer
IsBadWritePtr
VirtualFree
VirtualAlloc
GetLocalTime
CreateProcessW
OpenFile
FormatMessageW
VirtualProtect
HeapCreate
InitializeCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
HeapAlloc
HeapDestroy
TlsFree
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FindFirstFileA
FindClose
_lopen
InterlockedIncrement
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
WriteFile
GetSystemTime
InterlockedDecrement
_lcreat
CompareStringW
lstrcmpiW
WritePrivateProfileStringA
GetPrivateProfileIntA
GetVersion
lstrlenW
GetStringTypeExA
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
GetStringTypeA
GetTickCount
LoadLibraryExA
MultiByteToWideChar
GetCurrentProcessId
GetEnvironmentVariableA
MulDiv
FindResourceA
SizeofResource
LoadResource
FreeResource
SetErrorMode
GlobalAddAtomA
GetACP
GlobalDeleteAtom
DisableThreadLibraryCalls
IsBadCodePtr
GetSystemDefaultLCID
GetUserDefaultLCID
GetLocaleInfoA
GetSystemDirectoryA
GetProcAddress
GetVersionExA
Sleep
FreeLibrary
VirtualQuery
LoadLibraryA
WideCharToMultiByte
CompareStringA
GetCurrentDirectoryA
GetModuleFileNameA
GetDriveTypeA
GlobalAlloc
GlobalSize
GetFileAttributesA
MoveFileA
LockResource
_lwrite
_lread
_lclose
SetLastError
GetFullPathNameA
SearchPathA
GetFileType
GlobalUnlock
GlobalFree
GlobalHandle
GlobalReAlloc
GlobalLock
GetTempPathA
GetTempFileNameA
lstrcpynA
_llseek
GetModuleHandleA
FormatMessageA
GetLastError
GetWindowsDirectoryA
GetPrivateProfileStringA
GetShortPathNameA
WinExec
CreateFileA
ReadFile
CloseHandle
RaiseException
GetCurrentThreadId
IsBadReadPtr
lstrcpyA
lstrcatA
DeleteFileA
GetSystemDefaultLangID
LCMapStringA
IsDBCSLeadByte
lstrcmpiA
lstrcmpA
IsDebuggerPresent
lstrlenA

user32

RegisterClipboardFormatA
DefMDIChildProcA
DefFrameProcA
GetTopWindow
SetKeyboardState
GetKeyboardState
keybd_event
WaitForInputIdle
SetWindowsHookExW
VkKeyScanW
VkKeyScanA
SetCaretPos
HideCaret
ScrollDC
SetScrollRange
DestroyCaret
SetRectEmpty
OemToCharBuffA
CharToOemA
ScrollWindow
CharUpperBuffW
CharUpperBuffA
CharLowerBuffW
CharLowerBuffA
FindWindowW
FindWindowA
GetUpdateRect
GetScrollPos
MapDialogRect
SetDlgItemInt
GetDlgCtrlID
GetDoubleClickTime
CreateCaret
ShowCaret
GetMessageTime
EnableScrollBar
RedrawWindow
GetScrollInfo
SetScrollInfo
DeferWindowPos
EndDeferWindowPos
BeginDeferWindowPos
LockWindowUpdate
DrawFrameControl
AdjustWindowRect
CreateMDIWindowA
SetParent
GetMessagePos
WaitMessage
EnumThreadWindows
ValidateRect
GetClipCursor
LoadStringW
GetNextDlgTabItem
EmptyClipboard
SetClipboardData
OpenClipboard
IsClipboardFormatAvailable
GetClipboardData
EnumClipboardFormats
CloseClipboard
LoadImageA
LoadIconA
DestroyCursor
CharLowerA
GetSystemMetrics
EnumChildWindows
SetWindowsHookExA
UnhookWindowsHookEx
DrawIcon
DrawEdge
GetDlgItemInt
PostQuitMessage
GetDialogBaseUnits
CallNextHookEx
MessageBoxIndirectA
DialogBoxParamA
GetWindowTextLengthA
RegisterClassExA
FrameRect
DdeInitializeA
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
DdeFreeStringHandle
DdeUninitialize
DdeDisconnect
GetWindowPlacement
CreateDialogParamA
TranslateMessage
DispatchMessageA
CharToOemBuffA
GetWindowTextA
DrawTextA
SetActiveWindow
GetAsyncKeyState
LoadBitmapA
IsWindowUnicode
IsDialogMessageW
IsDialogMessageA
TranslateMDISysAccel
GetKeyboardLayout
RegisterWindowMessageA
IsDlgButtonChecked
CheckRadioButton
FillRect
SetCursor
ClipCursor
GetKeyState
CallWindowProcA
GetClassNameA
GetPropA
RemovePropA
SetPropA
SetForegroundWindow
IsWindow
UnregisterClassA
DestroyIcon
LoadCursorA
RegisterClassA
GetDlgItem
CheckDlgButton
MessageBoxA
LoadStringA
SendDlgItemMessageA
EndDialog
GetDesktopWindow
SetRect
CharUpperA
SetDlgItemTextA
GetWindowDC
GetClassInfoA
EqualRect
CopyRect
AdjustWindowRectEx
PeekMessageA
IsCharAlphaA
CharPrevA
MoveWindow
GetUpdateRgn
ChildWindowFromPointEx
IsWindowEnabled
GetWindowLongA
GetActiveWindow
GetSysColor
GetIconInfo
OffsetRect
GetCursor
GetCursorPos
MapWindowPoints
ReleaseDC
GetDC
KillTimer
ShowWindow
IsWindowVisible
SetTimer
ScreenToClient
WindowFromPoint
SystemParametersInfoA
CreateWindowExA
UpdateWindow
SetWindowPos
SetWindowTextA
GetCapture
DestroyWindow
EndPaint
GetClientRect
BeginPaint
DefWindowProcA
PostMessageA
GetFocus
GetParent
GetWindow
SetFocus
EnableWindow
SendMessageA
BringWindowToTop
LoadAcceleratorsA
GetDCEx
IntersectRect
InvalidateRect
InvalidateRgn
IsRectEmpty
SubtractRect
wsprintfA
CharNextA
AttachThreadInput
GetWindowThreadProcessId
PtInRect
ReleaseCapture
SetCapture
InflateRect
GetWindowRect
ClientToScreen
GetSystemMenu
SetWindowLongA
MessageBeep
GetForegroundWindow
IsZoomed
IsIconic
EnableMenuItem
RemoveMenu
IsChild
DrawFocusRect
CopyAcceleratorTableA
GetDlgItemTextA

gdi32

OffsetRgn
InvertRgn
SetTextAlign
GetCurrentPositionEx
CreateICA
GetTextFaceA
EnumFontFamiliesExA
GetTextColor
GetPixel
SetStretchBltMode
MoveToEx
LineTo
Rectangle
GetTextExtentPoint32A
CopyEnhMetaFileA
CopyMetaFileA
GetObjectType
GetDIBits
GetNearestColor
GetPaletteEntries
RectInRegion
DeleteObject
CreateMetaFileA
CloseMetaFile
SaveDC
RestoreDC
DeleteMetaFile
PlayMetaFile
SetMapMode
ScaleViewportExtEx
SetViewportOrgEx
SetViewportExtEx
SetWindowExtEx
SetAbortProc
Escape
CreateDCA
EndPage
StartPage
AbortDoc
EndDoc
StartDocA
BitBlt
CreatePalette
CreateDIBitmap
StretchBlt
GetDeviceCaps
GetBkColor
TextOutA
GetStockObject
CreateCompatibleDC
GetCurrentObject
CreateCompatibleBitmap
StretchDIBits
GetClipBox
DeleteDC
GetROP2
SetROP2
SetBrushOrgEx
EnumFontsA
PatBlt
SelectPalette
RealizePalette
GetTextMetricsA
CreateRectRgn
SetRectRgn
CombineRgn
ExcludeClipRect
SetWindowOrgEx
IntersectClipRect
SelectClipRgn
CreateRectRgnIndirect
CreateFontIndirectA
GetTextExtentPointA
GetObjectA
GetBitmapBits
SetBkMode
SelectObject
ExtTextOutA
CreatePen
CreateSolidBrush
UnrealizeObject
CreateBitmap
CreatePatternBrush
SetTextColor
SetBkColor
OffsetWindowOrgEx

advapi32

RegQueryValueExA
RegSetValueExW
RegCreateKeyW
RegQueryValueExW
RegQueryValueW
RegEnumValueW
RegEnumKeyW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyW
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegFlushKey
RegEnumKeyExA
RegCreateKeyExA
RegDeleteValueA
RegQueryInfoKeyA
RegEnumValueA
RegSetValueA
RegEnumKeyA
RegDeleteKeyA
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueA
RegCloseKey
RegOpenKeyA

ole32

CreateBindCtx
MkParseDisplayName
BindMoniker
OleSetClipboard
OleFlushClipboard
OleGetClipboard
CoLockObjectExternal
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CoTaskMemAlloc
ReleaseStgMedium
RevokeDragDrop
RegisterDragDrop
DoDragDrop
CoIsOle1Class
GetHGlobalFromStream
CreateStreamOnHGlobal
CoGetCurrentProcess
CoRegisterClassObject
CoRevokeClassObject
CreateFileMoniker
GetRunningObjectTable
StringFromGUID2
ProgIDFromCLSID
CoGetClassObject
CoCreateInstance
CLSIDFromProgID
CoTaskMemFree
CoGetMalloc
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
OleRegGetMiscStatus
IIDFromString
CoCreateGuid
CoDisconnectObject
OleIsRunning
OleRun
OleLockRunning
StgCreateDocfile
StgOpenStorage
CLSIDFromString
StringFromCLSID
OleSave

oleaut32

SysAllocString
SysAllocStringLen
SafeArrayGetLBound
SysStringLen
VariantInit
VariantClear
LHashValOfNameSysA
OaBuildVersion
SysReAllocString
VariantChangeType
SetErrorInfo
CreateErrorInfo
GetErrorInfo
DispGetParam
LHashValOfNameSys
LoadRegTypeLi
QueryPathOfRegTypeLi
SysReAllocStringLen
LoadTypeLi
RegisterTypeLi
SysAllocStringByteLen
SysStringByteLen
DispGetIDsOfNames
DispInvoke
SafeArrayCreate
SafeArrayPutElement
SafeArrayDestroy
VariantCopy
VariantCopyInd
RevokeActiveObject
VarDateFromStr
GetActiveObject
SafeArrayDestroyData
VariantChangeTypeEx
SafeArrayAllocDescriptor
SafeArrayLock
SafeArrayUnlock
VarR8FromStr
SafeArrayGetElement
SafeArrayGetDim
VarCyFromI4
VarBstrFromI2
VarBstrFromI4
VarBstrFromR4
VarBstrFromR8
VarBstrFromDate
VarBstrFromCy
VarI2FromStr
VarI4FromStr
VarI4FromR8
VarR4FromStr
VarCyFromStr
VarR4FromR8
SafeArrayCopy
SafeArrayDestroyDescriptor
SafeArrayAllocData
SafeArrayRedim
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SysFreeString

Exports

Exports

DLLGetDocumentation
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllRegisterServerEx
DllUnregisterServer
DllVbaInitHostAddins
DllVbeGetHashOfCode
DllVbeInit
DllVbeSetMsiApis
DllVbeTerm
VarPtr
_GetLongPathNameA@12
rtBoolFromErrVar
rtBstrFromErrVar
rtCyFromErrVar
rtDecFromVar
rtI2FromErrVar
rtI4FromErrVar
rtR4FromErrVar
rtR8FromErrVar
rtUI1FromErrVar
rtcAbsVar
rtcAnsiValueBstr
rtcAppActivate
rtcAppleScript
rtcArray
rtcAtn
rtcBeep
rtcBstrFromAnsi
rtcBstrFromByte
rtcBstrFromChar
rtcBstrFromError
rtcBstrFromFormatVar
rtcByteValueBstr
rtcCVErrFromVar
rtcCallByName
rtcChangeDir
rtcChangeDrive
rtcCharValueBstr
rtcChoose
rtcCommandBstr
rtcCommandVar
rtcCompareBstr
rtcCos
rtcCreateObject
rtcCreateObject2
rtcCurrentDir
rtcCurrentDirBstr
rtcDDB
rtcDateAdd
rtcDateDiff
rtcDateFromVar
rtcDatePart
rtcDeleteSetting
rtcDir
rtcDoEvents
rtcEndOfFile
rtcEnvironBstr
rtcEnvironVar
rtcErrObj
rtcExp
rtcFV
rtcFileAttributes
rtcFileCopy
rtcFileDateTime
rtcFileLen
rtcFileLength
rtcFileLocation
rtcFileReset
rtcFileSeek
rtcFileWidth
rtcFilter
rtcFixVar
rtcFormatCurrency
rtcFormatDateTime
rtcFormatNumber
rtcFormatPercent
rtcFreeFile
rtcGetAllSettings
rtcGetCurrentCalendar
rtcGetDateBstr
rtcGetDateValue
rtcGetDateVar
rtcGetDayOfMonth
rtcGetDayOfWeek
rtcGetErl
rtcGetFileAttr
rtcGetHostLCID
rtcGetHourOfDay
rtcGetMinuteOfHour
rtcGetMonthOfYear
rtcGetObject
rtcGetPresentDate
rtcGetSecondOfMinute
rtcGetSetting
rtcGetTimeBstr
rtcGetTimeValue
rtcGetTimeVar
rtcGetTimer
rtcGetYear
rtcHexBstrFromVar
rtcHexVarFromVar
rtcIMEStatus
rtcIPMT
rtcIRR
rtcImmediateIf
rtcInStr
rtcInStrChar
rtcInStrRev
rtcInputBox
rtcInputCharCount
rtcInputCharCountVar
rtcInputCount
rtcInputCountVar
rtcIntVar
rtcIsArray
rtcIsDate
rtcIsEmpty
rtcIsError
rtcIsMissing
rtcIsNull
rtcIsNumeric
rtcIsObject
rtcJoin
rtcKillFiles
rtcLeftBstr
rtcLeftCharBstr
rtcLeftCharVar
rtcLeftTrimBstr
rtcLeftTrimVar
rtcLeftVar
rtcLenCharVar
rtcLenVar
rtcLog
rtcLowerCaseBstr
rtcLowerCaseVar
rtcMIRR
rtcMacId
rtcMakeDir
rtcMidBstr
rtcMidCharBstr
rtcMidCharVar
rtcMidVar
rtcMonthName
rtcMsgBox
rtcNPV
rtcNPer
rtcOctBstrFromVar
rtcOctVarFromVar
rtcPMT
rtcPPMT
rtcPV
rtcPackDate
rtcPackTime
rtcPartition
rtcQBColor
rtcR8ValFromBstr
rtcRandomNext
rtcRandomize
rtcRate
rtcRemoveDir
rtcReplace
rtcRgb
rtcRightBstr
rtcRightCharBstr
rtcRightCharVar
rtcRightTrimBstr
rtcRightTrimVar
rtcRightVar
rtcRound
rtcSLN
rtcSYD
rtcSaveSetting
rtcSendKeys
rtcSetCurrentCalendar
rtcSetDatabaseLcid
rtcSetDateBstr
rtcSetDateVar
rtcSetFileAttr
rtcSetTimeBstr
rtcSetTimeVar
rtcSgnVar
rtcShell
rtcSin
rtcSpaceBstr
rtcSpaceVar
rtcSplit
rtcSqr
rtcStrConvVar
rtcStrConvVar2
rtcStrFromVar
rtcStrReverse
rtcStringBstr
rtcStringVar
rtcSwitch
rtcTan
rtcTrimBstr
rtcTrimVar
rtcTypeName
rtcUpperCaseBstr
rtcUpperCaseVar
rtcVarBstrFromAnsi
rtcVarBstrFromByte
rtcVarBstrFromChar
rtcVarDateFromVar
rtcVarFromError
rtcVarFromFormatVar
rtcVarFromVar
rtcVarStrFromVar
rtcVarType
rtcWeekdayName

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 124KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 100KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/MShared/VBA/VBA7/2052/VBE7INTL.DLL
.dll windows x86

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

3d:be:01:8c:9d:a7:23:a1:2d:c9:3d:b3:4f:ba:ec:95:2d:ab:17:8a
Signer

Actual PE Digest

3d:be:01:8c:9d:a7:23:a1:2d:c9:3d:b3:4f:ba:ec:95:2d:ab:17:8a

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

28/01/2011, 18:33
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 145KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/MShared/VBA/VBA7/VBE7.DLL
.dll regsvr32 windows x86

fd4029a686c1d3553bb1dd4cb4b58cbb

Code Sign

33:00:00:01:5b:35:5a:26:9f:60:85:60:fc:00:00:00:00:01:5b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/12/2019, 01:13

Not After

17/03/2021, 01:13

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:32BD-E3D5-3B1D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

91:e6:ed:18:84:2a:43:53:6c:39:24:8e:d8:ee:94:47:e2:d3:40:81:13:1e:8f:a3:74:02:1f:18:c7:a7:9e:98
Signer

Actual PE Digest

91:e6:ed:18:84:2a:43:53:6c:39:24:8e:d8:ee:94:47:e2:d3:40:81:13:1e:8f:a3:74:02:1f:18:c7:a7:9e:98

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

f7:c6:33:0a:29:64:3a:4b:44:a4:7c:e8:0c:db:e7:16:3f:d4:46:79
Signer

Actual PE Digest

f7:c6:33:0a:29:64:3a:4b:44:a4:7c:e8:0c:db:e7:16:3f:d4:46:79

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

26/09/2020, 00:58
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapFree
SetEndOfFile
CreateFileMappingA
GetProfileIntA
DuplicateHandle
GetCurrentProcess
CreatePipe
SetLocalTime
RtlUnwind
SetFileTime
GetFileTime
GetVolumeInformationA
FileTimeToSystemTime
FileTimeToLocalFileTime
SetFileAttributesA
GetUserDefaultLangID
IsValidCodePage
GetModuleFileNameW
TerminateThread
CreateThread
GetDriveTypeW
GetLocaleInfoW
LoadLibraryW
SearchPathW
CreateFileW
GetStringTypeExW
LCMapStringW
FlushInstructionCache
GetComputerNameA
SetCurrentDirectoryA
HeapSize
SetEnvironmentVariableA
GetSystemTimeAsFileTime
CreateDirectoryA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetFileSize
GetCommandLineA
GetModuleHandleW
GetSystemInfo
FlushFileBuffers
GetConsoleCP
GetConsoleMode
LockFile
UnlockFile
FindNextFileA
RemoveDirectoryA
ExitProcess
GetFullPathNameW
WriteConsoleW
GetStdHandle
GetCPInfo
GetOEMCP
SetHandleCount
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
SetStdHandle
GetProcessHeap
WriteConsoleA
GetConsoleOutputCP
InitializeCriticalSectionAndSpinCount
GetStringTypeW
GetTimeZoneInformation
HeapReAlloc
GlobalMemoryStatus
SetFilePointer
IsBadWritePtr
VirtualFree
VirtualAlloc
GetLocalTime
CreateProcessW
OpenFile
FormatMessageW
VirtualProtect
HeapCreate
InitializeCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
HeapAlloc
HeapDestroy
TlsFree
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FindFirstFileA
FindClose
_lopen
InterlockedIncrement
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
WriteFile
GetSystemTime
InterlockedDecrement
_lcreat
CompareStringW
lstrcmpiW
WritePrivateProfileStringA
GetPrivateProfileIntA
GetVersion
lstrlenW
GetStringTypeExA
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
GetStringTypeA
GetTickCount
LoadLibraryExA
MultiByteToWideChar
GetCurrentProcessId
GetEnvironmentVariableA
MulDiv
FindResourceA
SizeofResource
LoadResource
FreeResource
SetErrorMode
GlobalAddAtomA
GetACP
GlobalDeleteAtom
DisableThreadLibraryCalls
IsBadCodePtr
GetSystemDefaultLCID
GetUserDefaultLCID
GetLocaleInfoA
GetSystemDirectoryA
GetProcAddress
GetVersionExA
Sleep
FreeLibrary
VirtualQuery
LoadLibraryA
WideCharToMultiByte
CompareStringA
GetCurrentDirectoryA
GetModuleFileNameA
GetDriveTypeA
GlobalAlloc
GlobalSize
GetFileAttributesA
MoveFileA
LockResource
_lwrite
_lread
_lclose
SetLastError
GetFullPathNameA
SearchPathA
GetFileType
GlobalUnlock
GlobalFree
GlobalHandle
GlobalReAlloc
GlobalLock
GetTempPathA
GetTempFileNameA
lstrcpynA
_llseek
GetModuleHandleA
FormatMessageA
GetLastError
GetWindowsDirectoryA
GetPrivateProfileStringA
GetShortPathNameA
WinExec
CreateFileA
ReadFile
CloseHandle
RaiseException
GetCurrentThreadId
IsBadReadPtr
lstrcpyA
lstrcatA
DeleteFileA
GetSystemDefaultLangID
LCMapStringA
IsDBCSLeadByte
lstrcmpiA
lstrcmpA
IsDebuggerPresent
lstrlenA

user32

RegisterClipboardFormatA
DefMDIChildProcA
DefFrameProcA
GetTopWindow
SetKeyboardState
GetKeyboardState
keybd_event
WaitForInputIdle
SetWindowsHookExW
VkKeyScanW
VkKeyScanA
SetCaretPos
HideCaret
ScrollDC
SetScrollRange
DestroyCaret
SetRectEmpty
OemToCharBuffA
CharToOemA
ScrollWindow
CharUpperBuffW
CharUpperBuffA
CharLowerBuffW
CharLowerBuffA
FindWindowW
FindWindowA
GetUpdateRect
GetScrollPos
MapDialogRect
SetDlgItemInt
GetDlgCtrlID
GetDoubleClickTime
CreateCaret
ShowCaret
GetMessageTime
EnableScrollBar
RedrawWindow
GetScrollInfo
SetScrollInfo
DeferWindowPos
EndDeferWindowPos
BeginDeferWindowPos
LockWindowUpdate
DrawFrameControl
AdjustWindowRect
CreateMDIWindowA
SetParent
GetMessagePos
WaitMessage
EnumThreadWindows
ValidateRect
GetClipCursor
LoadStringW
GetNextDlgTabItem
EmptyClipboard
SetClipboardData
OpenClipboard
IsClipboardFormatAvailable
GetClipboardData
EnumClipboardFormats
CloseClipboard
LoadImageA
LoadIconA
DestroyCursor
CharLowerA
GetSystemMetrics
EnumChildWindows
SetWindowsHookExA
UnhookWindowsHookEx
DrawIcon
DrawEdge
GetDlgItemInt
PostQuitMessage
GetDialogBaseUnits
CallNextHookEx
MessageBoxIndirectA
DialogBoxParamA
GetWindowTextLengthA
RegisterClassExA
FrameRect
DdeInitializeA
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
DdeFreeStringHandle
DdeUninitialize
DdeDisconnect
GetWindowPlacement
CreateDialogParamA
TranslateMessage
DispatchMessageA
CharToOemBuffA
GetWindowTextA
DrawTextA
SetActiveWindow
GetAsyncKeyState
LoadBitmapA
IsWindowUnicode
IsDialogMessageW
IsDialogMessageA
TranslateMDISysAccel
GetKeyboardLayout
RegisterWindowMessageA
IsDlgButtonChecked
CheckRadioButton
FillRect
SetCursor
ClipCursor
GetKeyState
CallWindowProcA
GetClassNameA
GetPropA
RemovePropA
SetPropA
SetForegroundWindow
IsWindow
UnregisterClassA
DestroyIcon
LoadCursorA
RegisterClassA
GetDlgItem
CheckDlgButton
MessageBoxA
LoadStringA
SendDlgItemMessageA
EndDialog
GetDesktopWindow
SetRect
CharUpperA
SetDlgItemTextA
GetWindowDC
GetClassInfoA
EqualRect
CopyRect
AdjustWindowRectEx
PeekMessageA
IsCharAlphaA
CharPrevA
MoveWindow
GetUpdateRgn
ChildWindowFromPointEx
IsWindowEnabled
GetWindowLongA
GetActiveWindow
GetSysColor
GetIconInfo
OffsetRect
GetCursor
GetCursorPos
MapWindowPoints
ReleaseDC
GetDC
KillTimer
ShowWindow
IsWindowVisible
SetTimer
ScreenToClient
WindowFromPoint
SystemParametersInfoA
CreateWindowExA
UpdateWindow
SetWindowPos
SetWindowTextA
GetCapture
DestroyWindow
EndPaint
GetClientRect
BeginPaint
DefWindowProcA
PostMessageA
GetFocus
GetParent
GetWindow
SetFocus
EnableWindow
SendMessageA
BringWindowToTop
LoadAcceleratorsA
GetDCEx
IntersectRect
InvalidateRect
InvalidateRgn
IsRectEmpty
SubtractRect
wsprintfA
CharNextA
AttachThreadInput
GetWindowThreadProcessId
PtInRect
ReleaseCapture
SetCapture
InflateRect
GetWindowRect
ClientToScreen
GetSystemMenu
SetWindowLongA
MessageBeep
GetForegroundWindow
IsZoomed
IsIconic
EnableMenuItem
RemoveMenu
IsChild
DrawFocusRect
CopyAcceleratorTableA
GetDlgItemTextA

gdi32

OffsetRgn
InvertRgn
SetTextAlign
GetCurrentPositionEx
CreateICA
GetTextFaceA
EnumFontFamiliesExA
GetTextColor
GetPixel
SetStretchBltMode
MoveToEx
LineTo
Rectangle
GetTextExtentPoint32A
CopyEnhMetaFileA
CopyMetaFileA
GetObjectType
GetDIBits
GetNearestColor
GetPaletteEntries
RectInRegion
DeleteObject
CreateMetaFileA
CloseMetaFile
SaveDC
RestoreDC
DeleteMetaFile
PlayMetaFile
SetMapMode
ScaleViewportExtEx
SetViewportOrgEx
SetViewportExtEx
SetWindowExtEx
SetAbortProc
Escape
CreateDCA
EndPage
StartPage
AbortDoc
EndDoc
StartDocA
BitBlt
CreatePalette
CreateDIBitmap
StretchBlt
GetDeviceCaps
GetBkColor
TextOutA
GetStockObject
CreateCompatibleDC
GetCurrentObject
CreateCompatibleBitmap
StretchDIBits
GetClipBox
DeleteDC
GetROP2
SetROP2
SetBrushOrgEx
EnumFontsA
PatBlt
SelectPalette
RealizePalette
GetTextMetricsA
CreateRectRgn
SetRectRgn
CombineRgn
ExcludeClipRect
SetWindowOrgEx
IntersectClipRect
SelectClipRgn
CreateRectRgnIndirect
CreateFontIndirectA
GetTextExtentPointA
GetObjectA
GetBitmapBits
SetBkMode
SelectObject
ExtTextOutA
CreatePen
CreateSolidBrush
UnrealizeObject
CreateBitmap
CreatePatternBrush
SetTextColor
SetBkColor
OffsetWindowOrgEx

advapi32

RegQueryValueExA
RegSetValueExW
RegCreateKeyW
RegQueryValueExW
RegQueryValueW
RegEnumValueW
RegEnumKeyW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyW
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegFlushKey
RegEnumKeyExA
RegCreateKeyExA
RegDeleteValueA
RegQueryInfoKeyA
RegEnumValueA
RegSetValueA
RegEnumKeyA
RegDeleteKeyA
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueA
RegCloseKey
RegOpenKeyA

ole32

CreateBindCtx
MkParseDisplayName
BindMoniker
OleSetClipboard
OleFlushClipboard
OleGetClipboard
CoLockObjectExternal
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CoTaskMemAlloc
ReleaseStgMedium
RevokeDragDrop
RegisterDragDrop
DoDragDrop
CoIsOle1Class
GetHGlobalFromStream
CreateStreamOnHGlobal
CoGetCurrentProcess
CoRegisterClassObject
CoRevokeClassObject
CreateFileMoniker
GetRunningObjectTable
StringFromGUID2
ProgIDFromCLSID
CoGetClassObject
CoCreateInstance
CLSIDFromProgID
CoTaskMemFree
CoGetMalloc
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
OleRegGetMiscStatus
IIDFromString
CoCreateGuid
CoDisconnectObject
OleIsRunning
OleRun
OleLockRunning
StgCreateDocfile
StgOpenStorage
CLSIDFromString
StringFromCLSID
OleSave

oleaut32

SysAllocString
SysAllocStringLen
SafeArrayGetLBound
SysStringLen
VariantInit
VariantClear
LHashValOfNameSysA
OaBuildVersion
SysReAllocString
VariantChangeType
SetErrorInfo
CreateErrorInfo
GetErrorInfo
DispGetParam
LHashValOfNameSys
LoadRegTypeLi
QueryPathOfRegTypeLi
SysReAllocStringLen
LoadTypeLi
RegisterTypeLi
SysAllocStringByteLen
SysStringByteLen
DispGetIDsOfNames
DispInvoke
SafeArrayCreate
SafeArrayPutElement
SafeArrayDestroy
VariantCopy
VariantCopyInd
RevokeActiveObject
VarDateFromStr
GetActiveObject
SafeArrayDestroyData
VariantChangeTypeEx
SafeArrayAllocDescriptor
SafeArrayLock
SafeArrayUnlock
VarR8FromStr
SafeArrayGetElement
SafeArrayGetDim
VarCyFromI4
VarBstrFromI2
VarBstrFromI4
VarBstrFromR4
VarBstrFromR8
VarBstrFromDate
VarBstrFromCy
VarI2FromStr
VarI4FromStr
VarI4FromR8
VarR4FromStr
VarCyFromStr
VarR4FromR8
SafeArrayCopy
SafeArrayDestroyDescriptor
SafeArrayAllocData
SafeArrayRedim
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SysFreeString

Exports

Exports

DLLGetDocumentation
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllRegisterServerEx
DllUnregisterServer
DllVbaInitHostAddins
DllVbeGetHashOfCode
DllVbeInit
DllVbeSetMsiApis
DllVbeTerm
VarPtr
_GetLongPathNameA@12
rtBoolFromErrVar
rtBstrFromErrVar
rtCyFromErrVar
rtDecFromVar
rtI2FromErrVar
rtI4FromErrVar
rtR4FromErrVar
rtR8FromErrVar
rtUI1FromErrVar
rtcAbsVar
rtcAnsiValueBstr
rtcAppActivate
rtcAppleScript
rtcArray
rtcAtn
rtcBeep
rtcBstrFromAnsi
rtcBstrFromByte
rtcBstrFromChar
rtcBstrFromError
rtcBstrFromFormatVar
rtcByteValueBstr
rtcCVErrFromVar
rtcCallByName
rtcChangeDir
rtcChangeDrive
rtcCharValueBstr
rtcChoose
rtcCommandBstr
rtcCommandVar
rtcCompareBstr
rtcCos
rtcCreateObject
rtcCreateObject2
rtcCurrentDir
rtcCurrentDirBstr
rtcDDB
rtcDateAdd
rtcDateDiff
rtcDateFromVar
rtcDatePart
rtcDeleteSetting
rtcDir
rtcDoEvents
rtcEndOfFile
rtcEnvironBstr
rtcEnvironVar
rtcErrObj
rtcExp
rtcFV
rtcFileAttributes
rtcFileCopy
rtcFileDateTime
rtcFileLen
rtcFileLength
rtcFileLocation
rtcFileReset
rtcFileSeek
rtcFileWidth
rtcFilter
rtcFixVar
rtcFormatCurrency
rtcFormatDateTime
rtcFormatNumber
rtcFormatPercent
rtcFreeFile
rtcGetAllSettings
rtcGetCurrentCalendar
rtcGetDateBstr
rtcGetDateValue
rtcGetDateVar
rtcGetDayOfMonth
rtcGetDayOfWeek
rtcGetErl
rtcGetFileAttr
rtcGetHostLCID
rtcGetHourOfDay
rtcGetMinuteOfHour
rtcGetMonthOfYear
rtcGetObject
rtcGetPresentDate
rtcGetSecondOfMinute
rtcGetSetting
rtcGetTimeBstr
rtcGetTimeValue
rtcGetTimeVar
rtcGetTimer
rtcGetYear
rtcHexBstrFromVar
rtcHexVarFromVar
rtcIMEStatus
rtcIPMT
rtcIRR
rtcImmediateIf
rtcInStr
rtcInStrChar
rtcInStrRev
rtcInputBox
rtcInputCharCount
rtcInputCharCountVar
rtcInputCount
rtcInputCountVar
rtcIntVar
rtcIsArray
rtcIsDate
rtcIsEmpty
rtcIsError
rtcIsMissing
rtcIsNull
rtcIsNumeric
rtcIsObject
rtcJoin
rtcKillFiles
rtcLeftBstr
rtcLeftCharBstr
rtcLeftCharVar
rtcLeftTrimBstr
rtcLeftTrimVar
rtcLeftVar
rtcLenCharVar
rtcLenVar
rtcLog
rtcLowerCaseBstr
rtcLowerCaseVar
rtcMIRR
rtcMacId
rtcMakeDir
rtcMidBstr
rtcMidCharBstr
rtcMidCharVar
rtcMidVar
rtcMonthName
rtcMsgBox
rtcNPV
rtcNPer
rtcOctBstrFromVar
rtcOctVarFromVar
rtcPMT
rtcPPMT
rtcPV
rtcPackDate
rtcPackTime
rtcPartition
rtcQBColor
rtcR8ValFromBstr
rtcRandomNext
rtcRandomize
rtcRate
rtcRemoveDir
rtcReplace
rtcRgb
rtcRightBstr
rtcRightCharBstr
rtcRightCharVar
rtcRightTrimBstr
rtcRightTrimVar
rtcRightVar
rtcRound
rtcSLN
rtcSYD
rtcSaveSetting
rtcSendKeys
rtcSetCurrentCalendar
rtcSetDatabaseLcid
rtcSetDateBstr
rtcSetDateVar
rtcSetFileAttr
rtcSetTimeBstr
rtcSetTimeVar
rtcSgnVar
rtcShell
rtcSin
rtcSpaceBstr
rtcSpaceVar
rtcSplit
rtcSqr
rtcStrConvVar
rtcStrConvVar2
rtcStrFromVar
rtcStrReverse
rtcStringBstr
rtcStringVar
rtcSwitch
rtcTan
rtcTrimBstr
rtcTrimVar
rtcTypeName
rtcUpperCaseBstr
rtcUpperCaseVar
rtcVarBstrFromAnsi
rtcVarBstrFromByte
rtcVarBstrFromChar
rtcVarDateFromVar
rtcVarFromError
rtcVarFromFormatVar
rtcVarFromVar
rtcVarStrFromVar
rtcVarType
rtcWeekdayName

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/MShared/ospp32/OSPPC.DLL
.dll windows x86

5b21d953c7c6cf4344984a4f9e67db65

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:04:ca:69:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/06/2007, 22:03

Not After

05/06/2012, 22:13

Subject

CN=Microsoft Time-Stamp Service,OU=nCipher DSE ESN:A5B0-CDE0-DC94,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

60:0f:e2:56:86:95:e3:a9:4b:ab:16:ba:ff:9f:b4:fb:53:1c:92:2a
Signer

Actual PE Digest

60:0f:e2:56:86:95:e3:a9:4b:ab:16:ba:ff:9f:b4:fb:53:1c:92:2a

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

12/08/2009, 01:56
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
memcpy
_onexit
_lock
__dllonexit
_unlock
_adjust_fdiv
_amsg_exit
_initterm
free
malloc
_XcptFilter
memmove
_purecall
_vsnwprintf

ntdll

RtlUnwind

rpcrt4

RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFree
I_RpcExceptionFilter
I_RpcMapWin32Status
NdrClientCall2

kernel32

LocalAlloc
GetVersion
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
InterlockedExchange
GetCurrentProcessId
OpenProcess
WaitForSingleObjectEx
CreateThread
WaitForMultipleObjects
SetThreadPriority
FreeLibraryAndExitThread
InterlockedDecrement
VirtualQuery
LoadLibraryW
CreateMutexW
OpenMutexW
IsWow64Process
DeleteCriticalSection
CreateEventW
CreateSemaphoreW
ReleaseMutex
ReleaseSemaphore
GetCurrentThreadId
WaitForSingleObject
GetModuleHandleW
GetProcAddress
Sleep
SleepEx
SetEvent
GetModuleFileNameW
RaiseException
GetCurrentThread
GetThreadPriority
GetCurrentProcess
GetProcessAffinityMask
GetVersionExW
InitializeCriticalSectionAndSpinCount
GetLastError
HeapAlloc
GetProcessHeap
HeapFree
DecodePointer
SetLastError
DisableThreadLibraryCalls
EncodePointer
GetSystemInfo
CloseHandle
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
LocalFree
InterlockedIncrement

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
CloseServiceHandle
QueryServiceStatus
RevertToSelf
AllocateAndInitializeSid
FreeSid
RegQueryValueExW
StartServiceW
TraceMessage
RegOpenKeyExW
SetThreadToken
OpenSCManagerW
OpenServiceW
OpenThreadToken

Exports

Exports

SLCallServer
SLClose
SLConsumeRight
SLDepositOfflineConfirmationId
SLFireEvent
SLGenerateOfflineInstallationId
SLGetApplicationInformation
SLGetApplicationPolicy
SLGetAuthenticationResult
SLGetEncryptedPIDEx
SLGetGenuineInformation
SLGetInstalledProductKeyIds
SLGetLicense
SLGetLicenseFileId
SLGetLicenseInformation
SLGetLicensingStatusInformation
SLGetPKeyId
SLGetPKeyInformation
SLGetPolicyInformation
SLGetPolicyInformationDWORD
SLGetProductSkuInformation
SLGetSLIDList
SLGetServiceInformation
SLInstallLicense
SLInstallProofOfPurchase
SLInstallProofOfPurchaseEx
SLIsGenuineLocalEx
SLLoadApplicationPolicies
SLOpen
SLPersistApplicationPolicies
SLPersistRTSPayloadOverride
SLReArm
SLRegisterEvent
SLRegisterPlugin
SLSetAuthenticationData
SLSetCurrentProductKey
SLSetGenuineInformation
SLUninstallLicense
SLUninstallProofOfPurchase
SLUnloadApplicationPolicies
SLUnregisterEvent
SLUnregisterPlugin
SLpAuthenticateGenuineTicketResponse
SLpBeginGenuineTicketTransaction
SLpDepositTokenActivationResponse
SLpGenerateTokenActivationChallenge
SLpGetGenuineBlob
SLpGetGenuineLocal
SLpGetLicenseAcquisitionInfo
SLpGetMSPidInformation
SLpGetMachineUGUID
SLpGetTokenActivationGrantInfo
SLpVLActivateProduct

Sections

.text
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/MShared/ospp32/OSPPCEXT.DLL
.dll windows x86

620676041e22c6fe62254f876e181f5d

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:03:dc:f6:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:12

Not After

25/07/2011, 19:22

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3c:85:c9:8a:ff:60:b6:42:a2:ca:da:81:08:90:6e:d2:96:0d:c8:1f
Signer

Actual PE Digest

3c:85:c9:8a:ff:60:b6:42:a2:ca:da:81:08:90:6e:d2:96:0d:c8:1f

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

12/08/2009, 01:56
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__pioinfo
_purecall
_fileno
memmove
wcsncmp
_lseeki64
_write
_isatty
memcpy
__CxxFrameHandler
_errno
_gcvt
_CxxThrowException
_msize
towlower
iswspace
_fpclass
_wcstoi64
_wcstoui64
_HUGE
wcstod
_wtoi
??1type_info@@UAE@XZ
wcschr
memset
_wcsicmp
swscanf
__badioinfo
realloc
ferror
_itoa
_snprintf
_iob
isleadbyte
__mb_cur_max
mbtowc
calloc
_onexit
_lock
__dllonexit
_unlock
_adjust_fdiv
_amsg_exit
_initterm
free
malloc
_XcptFilter
_vsnwprintf

kernel32

HeapAlloc
GetProcessHeap
HeapFree
DecodePointer
SetLastError
DisableThreadLibraryCalls
LocalFree
GetLastError
GetVersionExW
GetFileAttributesW
CreateDirectoryW
GetProcAddress
GetModuleHandleW
IsWow64Process
GetCurrentProcess
ExpandEnvironmentStringsW
InterlockedIncrement
LocalAlloc
WideCharToMultiByte
InterlockedDecrement
EncodePointer
FreeLibrary
GetModuleHandleExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LCMapStringW
LeaveCriticalSection
EnterCriticalSection
GetSystemDirectoryW
LoadLibraryW
InterlockedExchange
Sleep
OutputDebugStringA
RtlUnwind
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetVersion
InterlockedCompareExchange
VirtualAlloc
VirtualFree
CloseHandle
VirtualProtect
GetSystemInfo
GlobalFree
RaiseException
WaitForSingleObject
SetEvent
ReleaseSemaphore
CreateSemaphoreW
CreateEventW
lstrlenW
GetLocalTime
GlobalAlloc
UnmapViewOfFile
DebugBreak
CreateTimerQueueTimer
GetSystemTime
lstrcmpiW
HeapDestroy
HeapReAlloc
HeapSize

advapi32

CryptGetUserKey
RegCloseKey
RegDeleteKeyW
CloseServiceHandle
RegCreateKeyW
RegOpenKeyW
RegSetValueExW
RegDeleteValueW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
OpenServiceW
OpenSCManagerW
SetNamedSecurityInfoW
GetSecurityDescriptorControl
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegSetKeySecurity
RegEnumKeyW
RegQueryInfoKeyW
QueryServiceStatus
RegEnumKeyExW
CryptReleaseContext
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptGetProvParam
TraceMessage
CryptGetKeyParam
CryptSetProvParam
CryptVerifySignatureW
CryptCreateHash
CryptHashData
CryptSignHashW
CryptAcquireContextW
CryptGenRandom
CryptDestroyKey
CryptDestroyHash

crypt32

CertCloseStore
CertFreeCertificateContext
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertSaveStore
CertOpenStore
CertEnumCertificatesInStore
CryptImportPublicKeyInfoEx
CertGetCertificateContextProperty
CryptDecodeObjectEx
CertFindExtension
CryptAcquireCertificatePrivateKey
CryptFindOIDInfo
CertDuplicateCertificateContext
CertGetEnhancedKeyUsage
CertCompareCertificate
CertAddCertificateContextToStore

winscard

SCardEstablishContext
SCardReleaseContext
SCardGetCardTypeProviderNameW
SCardListReadersW
SCardGetStatusChangeW
SCardFreeMemory
SCardListCardsW

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx

oleaut32

SafeArrayCreateVector
SysAllocStringLen
SysAllocString
VariantInit
VariantClear
SysFreeString
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SysStringLen

winhttp

WinHttpGetIEProxyConfigForCurrentUser
WinHttpSetTimeouts
WinHttpOpen
WinHttpReadData
WinHttpGetProxyForUrl
WinHttpDetectAutoProxyConfigUrl
WinHttpCrackUrl
WinHttpConnect
WinHttpSendRequest
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpReceiveResponse

osppc

SLpDepositTokenActivationResponse
SLpGetTokenActivationGrantInfo
SLpGenerateTokenActivationChallenge
SLpBeginGenuineTicketTransaction
SLpGetGenuineBlob
SLpAuthenticateGenuineTicketResponse
SLOpen
SLInstallProofOfPurchase
SLUninstallLicense
SLInstallLicense
SLClose
SLpVLActivateProduct
SLGetApplicationInformation
SLGetSLIDList
SLGetPKeyInformation
SLGetLicenseFileId
SLUninstallProofOfPurchase
SLGetPKeyId
SLpGetLicenseAcquisitionInfo

rpcrt4

RpcStringFreeW
UuidToStringW
UuidCreate

Exports

Exports

SLAcquireGenuineTicket
SLActivateProduct
SLDepositTokenActivationResponse
SLFreeTokenActivationCertificates
SLFreeTokenActivationGrants
SLGenerateTokenActivationChallenge
SLGetPackageProductKey
SLGetPackageProperties
SLGetPackageToken
SLGetReferralInformation
SLGetServerStatus
SLGetTokenActivationCertificates
SLGetTokenActivationGrants
SLInitialize
SLInstallPackage
SLSignTokenActivationChallenge
SLUninstallPackage

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/MShared/ospp32/OSPPOBJS.DLL
.dll windows x86

c361320843df866cab4081722b672eaf

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:03:dc:f6:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:12

Not After

25/07/2011, 19:22

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

90:f0:5b:60:36:9c:f5:e8:e4:79:6c:9f:43:39:db:78:11:dc:7f:6d
Signer

Actual PE Digest

90:f0:5b:60:36:9c:f5:e8:e4:79:6c:9f:43:39:db:78:11:dc:7f:6d

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

12/08/2009, 01:56
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memmove
memcpy
_wcsnicmp
_purecall
_onexit
_lock
__dllonexit
_unlock
memset
_adjust_fdiv
_amsg_exit
_initterm
free
malloc
_XcptFilter
_vsnwprintf
_wcsicmp
rand
srand
wcschr
_wtol
wcsstr
wcsncmp
_wtoi
_CIlog10
_itow
memchr

ntdll

RtlUnwind

dnsapi

DnsQuery_W
DnsFree

advapi32

GetCurrentHwProfileW
SystemFunction036
LsaOpenPolicy
LsaQueryInformationPolicy
LsaFreeMemory
LsaClose
RegQueryInfoKeyW
RegEnumKeyW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegSetKeySecurity
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
AllocateAndInitializeSid
OpenProcessToken
EqualSid
GetTokenInformation
RegQueryValueExW
RegOpenKeyExW
FreeSid
RegCloseKey
StartServiceW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
CloseServiceHandle
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags

rpcrt4

RpcBindingFromStringBindingW
I_RpcMapWin32Status
RpcStringFreeW
RpcImpersonateClient
UuidToStringW
NdrAsyncClientCall
UuidCreate
UuidFromStringW
RpcStringBindingComposeW
RpcRevertToSelfEx
RpcAsyncInitializeHandle
I_RpcExceptionFilter
RpcAsyncCancelCall
RpcAsyncCompleteCall
RpcBindingFree

oleaut32

SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
VariantClear
VariantInit
SysFreeString
SysAllocString

ole32

CoInitializeEx
CoCreateInstance
CoInitializeSecurity
CoUninitialize

kernel32

FileTimeToSystemTime
GetComputerNameExW
GetSystemDirectoryW
LoadLibraryW
LCMapStringW
RaiseException
UnmapViewOfFile
ReleaseSemaphore
CreateSemaphoreW
SystemTimeToFileTime
GetLocalTime
CreateFileW
GetProcessAffinityMask
GetThreadPriority
GetCurrentThread
GetModuleFileNameW
VirtualQuery
InterlockedExchangeAdd
FreeLibraryAndExitThread
SetThreadPriority
CreateThread
GetSystemDefaultLangID
WideCharToMultiByte
DeviceIoControl
GlobalMemoryStatusEx
IsProcessorFeaturePresent
MultiByteToWideChar
InitializeCriticalSection
DelayLoadFailureHook
VirtualAlloc
VirtualFree
VirtualProtect
GetSystemInfo
DebugBreak
GetModuleHandleA
ResetEvent
SetEvent
CreateEventW
WaitForMultipleObjects
WaitForSingleObject
CreateTimerQueueTimer
CompareFileTime
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetModuleHandleExW
GetSystemTime
GetDateFormatW
GetTimeFormatW
IsWow64Process
GetUserGeoID
GetUserDefaultUILanguage
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
LeaveCriticalSection
GetVersion
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetSystemDefaultUILanguage
CloseHandle
LocalAlloc
GetModuleHandleW
SleepEx
HeapAlloc
GetProcessHeap
HeapFree
EncodePointer
DecodePointer
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
GetLastError
LocalFree
DisableThreadLibraryCalls
SetLastError
GetProcAddress
FreeLibrary
InterlockedCompareExchange
LoadLibraryA
InterlockedExchange
Sleep
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetVersionExW

Exports

Exports

SppPluginCanUnloadNow
SppPluginCreateInstance
SppPluginInitialize
SppPluginShutdown

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/MShared/ospp32/OSPPREARM.EXE
.exe windows x86

13f40932178d5ec2f8cfffdc5fa85c7b

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

0f:30:86:7c:5a:15:70:e4:c4:23:8e:6a:4a:6c:ef:f6:68:a5:c5:bf
Signer

Actual PE Digest

0f:30:86:7c:5a:15:70:e4:c4:23:8e:6a:4a:6c:ef:f6:68:a5:c5:bf

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

06/03/2010, 10:35
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

_except_handler4_common
_decode_pointer
_controlfp_s
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
_crt_debugger_hook
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__initenv
exit
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_invoke_watson
printf

ole32

CLSIDFromString

kernel32

RaiseException
LocalAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
GetLastError
LoadLibraryA
FreeLibrary

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 404B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/MShared/ospp32/OSPPSVC.EXE
.exe windows x86

098491521a1b9a4483726cf667edd9ea

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:04:ca:69:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/06/2007, 22:03

Not After

05/06/2012, 22:13

Subject

CN=Microsoft Time-Stamp Service,OU=nCipher DSE ESN:A5B0-CDE0-DC94,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

67:17:3c:3a:bc:e7:ac:c1:d7:14:e4:ea:cf:8d:e3:43:74:a2:01:25
Signer

Actual PE Digest

67:17:3c:3a:bc:e7:ac:c1:d7:14:e4:ea:cf:8d:e3:43:74:a2:01:25

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

12/08/2009, 01:56
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceMessage
RegCloseKey
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
SetServiceStatus
RegOpenKeyExW
RegQueryValueExW
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
FreeSid
RegDeleteKeyW
RegCreateKeyExW
CheckTokenMembership
AllocateAndInitializeSid
ConvertStringSidToSidW
RegEnumKeyW
RegQueryInfoKeyW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegSetKeySecurity
RegDeleteValueW
RegSetValueExW
CryptGenRandom
CryptAcquireContextW
CryptReleaseContext
DeregisterEventSource
ReportEventW
RegisterEventSourceW
EqualSid
OpenProcessToken
ConvertSidToStringSidW
LookupAccountNameW
RegEnumKeyExW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptDestroyKey
CryptEncrypt
CryptDecrypt
CryptImportKey
CryptSignHashA
CryptVerifySignatureA
CryptExportKey
CryptGenKey
RegOpenKeyW
RegCreateKeyW
GetTokenInformation

kernel32

DeleteTimerQueue
Sleep
InterlockedCompareExchange
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
GetCurrentThreadId
DeleteTimerQueueEx
ReleaseSemaphore
LoadLibraryW
SetThreadPriority
GetThreadPriority
DuplicateHandle
GetCurrentProcess
GetCurrentThread
OpenThread
GetTickCount
ReleaseMutex
CreateSemaphoreW
IsWow64Process
OpenMutexW
CreateMutexW
ExpandEnvironmentStringsW
GetTimeFormatW
GetDateFormatW
FileTimeToSystemTime
SetFileAttributesW
GetFileAttributesW
ChangeTimerQueueTimer
CreateDirectoryW
WriteFile
CreateFileW
GetFileSizeEx
QueueUserWorkItem
ReadFile
GetFileSize
MultiByteToWideChar
OpenProcess
GetCurrentProcessId
UnregisterWaitEx
CompareFileTime
SystemTimeToFileTime
GetSystemTimeAsFileTime
lstrlenW
GetSystemTime
DebugBreak
GetPrivateProfileStringW
lstrcmpiW
GetPrivateProfileSectionW
InitializeCriticalSection
SetLastError
VirtualProtect
VirtualFree
VirtualAlloc
GetLocalTime
MoveFileExW
CopyFileW
FlushFileBuffers
DeleteFileW
SetFilePointer
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetComputerNameW
DeviceIoControl
GetLocaleInfoW
GetSystemDirectoryW
LCMapStringW
WideCharToMultiByte
GetVersionExA
GetVersion
UnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedExchange
SetEvent
GetModuleHandleExW
GetProcAddress
CreateTimerQueue
CreateTimerQueueTimer
CreateEventW
RegisterWaitForSingleObject
RaiseException
InterlockedDecrement
GetVersionExW
InterlockedIncrement
GetLastError
HeapSetInformation
DeleteTimerQueueTimer
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
LocalFree
LocalAlloc
FreeLibrary
CloseHandle
DecodePointer
EncodePointer
HeapFree
GetProcessHeap
HeapAlloc
GetSystemInfo

msvcrt

srand
_itow
time
rand
malloc
_controlfp
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
wcsncmp
_wcsnicmp
wcschr
memmove
swscanf
_wcsicmp
_purecall
sscanf
memcpy
memset
_vsnwprintf
free
_wtof
_wtoi
_ui64tow

rpcrt4

UuidFromStringW
I_RpcMapWin32Status
RpcServerRegisterIfEx
RpcServerUseProtseqEpW
RpcServerListen
RpcServerUnregisterIf
RpcMgmtStopServerListening
I_RpcBindingInqLocalClientPID
RpcServerInqCallAttributesW
RpcRaiseException
RpcStringFreeW
RpcRevertToSelfEx
UuidToStringW
NdrServerCall2
UuidCreate
RpcImpersonateClient

ntdll

RtlUnwind

user32

CharPrevW
CharNextW

ole32

CoInitializeEx
CoUninitialize
CoInitializeSecurity

Sections

.text
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 489KB - Virtual size: 489KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/MShared/ospp32/OSPPWMI.DLL
.dll regsvr32 windows x86

dfa89eb38ac0131cdb9a527ef82bcb45

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:04:b3:f5:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:13

Not After

25/07/2011, 19:23

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

7a:b9:2b:c1:8c:66:8b:6f:b6:de:12:25:d1:ab:1f:f8:43:77:5f:0e
Signer

Actual PE Digest

7a:b9:2b:c1:8c:66:8b:6f:b6:de:12:25:d1:ab:1f:f8:43:77:5f:0e

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

12/08/2009, 01:56
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_adjust_fdiv
_amsg_exit
_initterm
free
malloc
_XcptFilter
_wcsicmp
memset
memmove
memcpy
towlower
towupper
_purecall
_vsnwprintf

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedCompareExchange
InterlockedExchange
CompareStringW
WideCharToMultiByte
SetLastError
DisableThreadLibraryCalls
FileTimeToSystemTime
LocalAlloc
Sleep
DeleteCriticalSection
CreateEventW
CreateSemaphoreW
InitializeCriticalSectionAndSpinCount
ReleaseSemaphore
SetEvent
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
RaiseException
InterlockedDecrement
VirtualQuery
GetModuleFileNameW
HeapAlloc
GetProcessHeap
HeapFree
EncodePointer
DecodePointer
CloseHandle
InterlockedIncrement
LocalFree
GetLastError

advapi32

RegCloseKey
RegDeleteKeyW
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyW
RegQueryInfoKeyW
RegSetValueExW
RegSetKeySecurity
RegDeleteValueW
RegQueryValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
TraceMessage

crypt32

CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertNameToStrW
CertFreeCertificateContext

ole32

CoCreateInstance
CoRevertToSelf
CoImpersonateClient
CoGetClassObject

oleaut32

SysFreeString
RegisterTypeLi
LoadTypeLi
SafeArrayGetElement
SafeArrayCreateVector
VariantInit
SafeArrayGetDim
SafeArrayCreate
SysAllocString
VariantClear
SysAllocStringLen
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SysStringLen
SafeArrayUnaccessData
SafeArrayDestroy
UnRegisterTypeLi

rpcrt4

UuidToStringW
RpcStringFreeW
UuidFromStringW
I_RpcMapWin32Status

osppcext

SLGetTokenActivationCertificates
SLDepositTokenActivationResponse
SLGenerateTokenActivationChallenge
SLGetTokenActivationGrants
SLActivateProduct
SLInstallPackage
SLSignTokenActivationChallenge
SLFreeTokenActivationCertificates
SLFreeTokenActivationGrants
SLAcquireGenuineTicket

osppc

SLIsGenuineLocalEx
SLUninstallLicense
SLGetLicenseInformation
SLOpen
SLGetLicensingStatusInformation
SLConsumeRight
SLGetServiceInformation
SLInstallProofOfPurchase
SLGetApplicationInformation
SLGetSLIDList
SLInstallLicense
SLGetPolicyInformation
SLGetProductSkuInformation
SLDepositOfflineConfirmationId
SLClose
SLGenerateOfflineInstallationId
SLGetPKeyInformation
SLUninstallProofOfPurchase

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/MShared/ospp32/OSPPWMI.MOF
office2010/MShared/ospp32/osppobjs-spp-plugin-manifest-signed.xrm-ms
office2010/MShared/ospp64/OSPPC.DLL
.dll windows x64

6e5c72c1bc7ce9202456fda14ddcef5a

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:04:ca:69:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/06/2007, 22:03

Not After

05/06/2012, 22:13

Subject

CN=Microsoft Time-Stamp Service,OU=nCipher DSE ESN:A5B0-CDE0-DC94,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

98:0d:cd:8e:37:0d:f9:e7:b6:a0:d9:4c:0a:2a:44:37:da:d5:b6:5e
Signer

Actual PE Digest

98:0d:cd:8e:37:0d:f9:e7:b6:a0:d9:4c:0a:2a:44:37:da:d5:b6:5e

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

12/08/2009, 02:06
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memset
memcpy
_onexit
_lock
__dllonexit
_unlock
__C_specific_handler
_amsg_exit
free
_initterm
malloc
_XcptFilter
_vsnwprintf
memmove
memcmp

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

rpcrt4

I_RpcMapWin32Status
RpcBindingFree
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
NdrClientCall2
I_RpcExceptionFilter

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
WaitForSingleObjectEx
RaiseException
CloseHandle
GetThreadPriority
GetProcessAffinityMask
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
WaitForMultipleObjects
ReleaseSemaphore
Sleep
SleepEx
GetVersionExW
SetEvent
GetModuleHandleW
CreateSemaphoreW
CreateEventW
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetCurrentProcessId
OpenProcess
LocalFree
CreateThread
GetModuleFileNameW
VirtualQuery
FreeLibraryAndExitThread
GetCurrentThread
SetThreadPriority
ReleaseMutex
WaitForSingleObject
OpenMutexW
CreateMutexW
FreeLibrary
GetLastError
GetCurrentProcess
GetProcAddress
GetVersion
GetSystemInfo
DecodePointer
SetLastError
DisableThreadLibraryCalls
GetProcessHeap
HeapFree
HeapAlloc
LoadLibraryW
LocalAlloc

advapi32

FreeSid
AllocateAndInitializeSid
CloseServiceHandle
SetThreadToken
OpenServiceW
OpenSCManagerW
RevertToSelf
OpenThreadToken
QueryServiceStatus
StartServiceW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
TraceMessage

Exports

Exports

SLCallServer
SLClose
SLConsumeRight
SLDepositOfflineConfirmationId
SLFireEvent
SLGenerateOfflineInstallationId
SLGetApplicationInformation
SLGetApplicationPolicy
SLGetAuthenticationResult
SLGetEncryptedPIDEx
SLGetGenuineInformation
SLGetInstalledProductKeyIds
SLGetLicense
SLGetLicenseFileId
SLGetLicenseInformation
SLGetLicensingStatusInformation
SLGetPKeyId
SLGetPKeyInformation
SLGetPolicyInformation
SLGetPolicyInformationDWORD
SLGetProductSkuInformation
SLGetSLIDList
SLGetServiceInformation
SLInstallLicense
SLInstallProofOfPurchase
SLInstallProofOfPurchaseEx
SLIsGenuineLocalEx
SLLoadApplicationPolicies
SLOpen
SLPersistApplicationPolicies
SLPersistRTSPayloadOverride
SLReArm
SLRegisterEvent
SLRegisterPlugin
SLSetAuthenticationData
SLSetCurrentProductKey
SLSetGenuineInformation
SLUninstallLicense
SLUninstallProofOfPurchase
SLUnloadApplicationPolicies
SLUnregisterEvent
SLUnregisterPlugin
SLpAuthenticateGenuineTicketResponse
SLpBeginGenuineTicketTransaction
SLpDepositTokenActivationResponse
SLpGenerateTokenActivationChallenge
SLpGetGenuineBlob
SLpGetGenuineLocal
SLpGetLicenseAcquisitionInfo
SLpGetMSPidInformation
SLpGetMachineUGUID
SLpGetTokenActivationGrantInfo
SLpVLActivateProduct

Sections

.text
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/MShared/ospp64/OSPPCEXT.DLL
.dll windows x64

5c7e195ae0bfbaea13219220aca1d33e

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:04:ca:69:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/06/2007, 22:03

Not After

05/06/2012, 22:13

Subject

CN=Microsoft Time-Stamp Service,OU=nCipher DSE ESN:A5B0-CDE0-DC94,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

8b:cb:f3:37:17:a2:cc:08:c7:75:a7:61:2f:d1:5c:db:cf:27:78:ec
Signer

Actual PE Digest

8b:cb:f3:37:17:a2:cc:08:c7:75:a7:61:2f:d1:5c:db:cf:27:78:ec

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

12/08/2009, 02:06
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

swscanf
_vsnwprintf
wcschr
realloc
??1type_info@@UEAA@XZ
_itoa
memmove
_purecall
wcsncmp
__CxxFrameHandler
ferror
__badioinfo
__pioinfo
_fileno
_errno
_gcvt
_XcptFilter
malloc
_initterm
free
_amsg_exit
__C_specific_handler
towlower
_msize
_wtoi
_wcstoui64
_wcstoi64
_HUGE
iswspace
wcstod
_fpclass
memcmp
_lseeki64
_write
_isatty
_snprintf
_iob
isleadbyte
__mb_cur_max
mbtowc
calloc
_CxxThrowException
memset
memcpy
_onexit
_lock
__dllonexit
_unlock
_wcsicmp

kernel32

UnhandledExceptionFilter
HeapAlloc
HeapFree
GetProcessHeap
DisableThreadLibraryCalls
SetLastError
DecodePointer
ExpandEnvironmentStringsW
GetLastError
GetVersionExW
LocalFree
GetFileAttributesW
VirtualFree
GetProcAddress
LocalAlloc
WideCharToMultiByte
LCMapStringW
GetModuleHandleExW
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
LoadLibraryW
EncodePointer
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetSystemDirectoryW
VirtualProtect
Sleep
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
CreateDirectoryW
SetUnhandledExceptionFilter
VirtualAlloc
GetSystemInfo
CloseHandle
GetVersion
GlobalFree
WaitForSingleObject
GetLocalTime
GlobalAlloc
ReleaseSemaphore
SetEvent
RaiseException
CreateEventW
CreateSemaphoreW
lstrlenW
UnmapViewOfFile
DebugBreak
CreateTimerQueueTimer
GetSystemTime
lstrcmpiW
HeapDestroy
HeapReAlloc
HeapSize

advapi32

CryptCreateHash
QueryServiceStatus
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegSetKeySecurity
RegCreateKeyW
RegOpenKeyW
RegSetValueExW
RegDeleteValueW
RegQueryValueExW
RegOpenKeyExW
CloseServiceHandle
OpenSCManagerW
OpenServiceW
GetSecurityDescriptorDacl
GetSecurityDescriptorControl
ReportEventW
DeregisterEventSource
RegisterEventSourceW
CryptDestroyHash
CryptVerifySignatureW
CryptDestroyKey
CryptSignHashW
CryptHashData
TraceMessage
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
CryptSetProvParam
CryptGetKeyParam
CryptGetUserKey
CryptGetProvParam
RegDeleteKeyW
RegCloseKey
RegEnumKeyW
RegQueryInfoKeyW
RegEnumKeyExW
RegCreateKeyExW
SetNamedSecurityInfoW

crypt32

CryptDecodeObjectEx
CryptFindOIDInfo
CertDuplicateCertificateContext
CertFindExtension
CertFreeCertificateContext
CertOpenStore
CertGetCertificateContextProperty
CryptAcquireCertificatePrivateKey
CertGetCertificateChain
CertGetEnhancedKeyUsage
CertVerifyCertificateChainPolicy
CertAddCertificateContextToStore
CertSaveStore
CertEnumCertificatesInStore
CertCloseStore
CertFreeCertificateChain
CryptImportPublicKeyInfoEx
CertCompareCertificate

winscard

SCardGetStatusChangeW
SCardListReadersW
SCardEstablishContext
SCardFreeMemory
SCardListCardsW
SCardGetCardTypeProviderNameW
SCardReleaseContext

ole32

CoUninitialize
CoInitializeEx
CoCreateInstance

oleaut32

SysAllocStringLen
SysStringLen
SysFreeString
SafeArrayDestroy
VariantClear
SysAllocString
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
VariantInit

winhttp

WinHttpDetectAutoProxyConfigUrl
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSetOption
WinHttpOpenRequest
WinHttpConnect
WinHttpSetTimeouts
WinHttpOpen
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpReadData
WinHttpCrackUrl
WinHttpCloseHandle

ntdll

RtlDeleteFunctionTable
RtlInstallFunctionTableCallback

osppc

SLpAuthenticateGenuineTicketResponse
SLpGetGenuineBlob
SLpBeginGenuineTicketTransaction
SLClose
SLOpen
SLpGetTokenActivationGrantInfo
SLUninstallLicense
SLInstallLicense
SLGetApplicationInformation
SLpVLActivateProduct
SLGetPKeyInformation
SLGetSLIDList
SLpGenerateTokenActivationChallenge
SLpDepositTokenActivationResponse
SLGetPKeyId
SLUninstallProofOfPurchase
SLGetLicenseFileId
SLInstallProofOfPurchase
SLpGetLicenseAcquisitionInfo

rpcrt4

UuidCreate
RpcStringFreeW
UuidToStringW

Exports

Exports

SLAcquireGenuineTicket
SLActivateProduct
SLDepositTokenActivationResponse
SLFreeTokenActivationCertificates
SLFreeTokenActivationGrants
SLGenerateTokenActivationChallenge
SLGetPackageProductKey
SLGetPackageProperties
SLGetPackageToken
SLGetReferralInformation
SLGetServerStatus
SLGetTokenActivationCertificates
SLGetTokenActivationGrants
SLInitialize
SLInstallPackage
SLSignTokenActivationChallenge
SLUninstallPackage

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/MShared/ospp64/OSPPOBJS.DLL
.dll windows x64

16cc4b6e8c79bff0318a368c7f629f1d

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:04:ca:69:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/06/2007, 22:03

Not After

05/06/2012, 22:13

Subject

CN=Microsoft Time-Stamp Service,OU=nCipher DSE ESN:A5B0-CDE0-DC94,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

f2:31:80:89:cf:9e:93:af:07:b1:d1:b8:96:a1:24:17:18:60:46:d9
Signer

Actual PE Digest

f2:31:80:89:cf:9e:93:af:07:b1:d1:b8:96:a1:24:17:18:60:46:d9

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

12/08/2009, 02:06
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memcmp
memchr
_wcsnicmp
memmove
_onexit
_lock
__dllonexit
_unlock
memset
memcpy
__C_specific_handler
_amsg_exit
free
_initterm
malloc
_XcptFilter
_purecall
_itow
_vsnwprintf
_wcsicmp
srand
rand
wcschr
_wtol
wcsncmp
wcsstr
_wtoi
log10

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

dnsapi

DnsFree
DnsQuery_W

advapi32

AllocateAndInitializeSid
GetCurrentHwProfileW
SystemFunction036
LsaFreeMemory
LsaQueryInformationPolicy
LsaOpenPolicy
LsaClose
RegEnumKeyW
RegQueryInfoKeyW
RegSetValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCreateKeyExW
RegSetKeySecurity
RegDeleteValueW
RegOpenKeyExW
GetTokenInformation
RegQueryValueExW
FreeSid
RegCloseKey
EqualSid
OpenProcessToken
QueryServiceStatus
OpenServiceW
OpenSCManagerW
CloseServiceHandle
CryptReleaseContext
CryptAcquireContextW
CryptGenRandom
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle

rpcrt4

RpcStringBindingComposeW
RpcStringFreeW
RpcImpersonateClient
RpcRevertToSelfEx
I_RpcMapWin32Status
UuidFromStringW
NdrAsyncClientCall
UuidCreate
RpcBindingFree
RpcAsyncCompleteCall
RpcAsyncCancelCall
I_RpcExceptionFilter
RpcAsyncInitializeHandle
RpcBindingFromStringBindingW
UuidToStringW

oleaut32

SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
VariantClear
SysFreeString
SysAllocString
VariantInit

ole32

CoUninitialize
CoInitializeSecurity
CoCreateInstance
CoInitializeEx

kernel32

SetEvent
ResetEvent
WaitForSingleObject
DeleteTimerQueueTimer
CompareFileTime
GetModuleHandleExW
GetComputerNameExW
LoadLibraryW
GetSystemDirectoryW
FileTimeToSystemTime
CreateTimerQueueTimer
CreateEventW
ChangeTimerQueueTimer
LCMapStringW
GetLocalTime
SystemTimeToFileTime
CreateFileW
CreateSemaphoreW
RaiseException
UnmapViewOfFile
ReleaseSemaphore
SetThreadPriority
GetCurrentThread
FreeLibraryAndExitThread
VirtualQuery
GetModuleFileNameW
CreateThread
GetProcessAffinityMask
GetThreadPriority
GetSystemDefaultLangID
WideCharToMultiByte
DeviceIoControl
GlobalMemoryStatusEx
MultiByteToWideChar
InitializeCriticalSection
DelayLoadFailureHook
VirtualFree
RtlInstallFunctionTableCallback
VirtualAlloc
GetSystemInfo
RtlDeleteFunctionTable
GetVersion
__chkstk
DebugBreak
GetModuleHandleA
WaitForMultipleObjects
CloseHandle
GetUserGeoID
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetTimeFormatW
GetDateFormatW
QueryPerformanceCounter
GetSystemTime
LocalAlloc
GetVersionExW
SleepEx
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
VirtualProtect
LoadLibraryA
GetProcAddress
FreeLibrary
GetLastError
DeleteCriticalSection
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
HeapAlloc
HeapFree
GetProcessHeap
SetLastError
EncodePointer
DisableThreadLibraryCalls
DecodePointer
LocalFree
GetTickCount

Exports

Exports

SppPluginCanUnloadNow
SppPluginCreateInstance
SppPluginInitialize
SppPluginShutdown

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/MShared/ospp64/OSPPSVC.EXE
.exe windows x64

95686bd7b223c506f7d914aaad8412ae

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:04:ca:69:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/06/2007, 22:03

Not After

05/06/2012, 22:13

Subject

CN=Microsoft Time-Stamp Service,OU=nCipher DSE ESN:A5B0-CDE0-DC94,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

2c:d7:70:3e:28:71:73:47:5d:33:cb:65:fc:af:f3:fa:95:cf:70:48
Signer

Actual PE Digest

2c:d7:70:3e:28:71:73:47:5d:33:cb:65:fc:af:f3:fa:95:cf:70:48

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

12/08/2009, 02:06
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
AllocateAndInitializeSid
CheckTokenMembership
ConvertStringSidToSidW
FreeSid
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyW
RegCreateKeyExW
RegSetKeySecurity
RegSetValueExW
RegDeleteKeyW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptGenRandom
CryptAcquireContextW
CryptReleaseContext
ConvertSidToStringSidW
OpenProcessToken
EqualSid
GetTokenInformation
RegEnumKeyExW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptDestroyKey
CryptEncrypt
CryptDecrypt
CryptImportKey
CryptSignHashA
CryptVerifySignatureA
CryptExportKey
CryptGenKey
RegOpenKeyW
RegCreateKeyW
LookupAccountNameW

kernel32

RegisterWaitForSingleObject
CreateTimerQueue
CreateTimerQueueTimer
GetModuleHandleExW
DeleteCriticalSection
UnregisterWaitEx
CloseHandle
DeleteTimerQueue
DecodePointer
DeleteTimerQueueEx
EncodePointer
InitializeCriticalSectionAndSpinCount
FileTimeToSystemTime
CreateMutexW
OpenMutexW
ReleaseMutex
GetTickCount
CreateSemaphoreW
GetDateFormatW
GetTimeFormatW
ExpandEnvironmentStringsW
MultiByteToWideChar
CreateFileW
GetFileSize
ReadFile
QueueUserWorkItem
GetCurrentProcessId
OpenProcess
WriteFile
GetFileAttributesW
SetFileAttributesW
ChangeTimerQueueTimer
CreateDirectoryW
GetFileSizeEx
GetSystemInfo
CreateEventW
CompareFileTime
GetSystemTimeAsFileTime
lstrlenW
VirtualProtect
GetSystemTime
DebugBreak
lstrcmpiW
GetPrivateProfileStringW
InitializeCriticalSection
GetVersion
VirtualAlloc
SetLastError
VirtualFree
GetLocalTime
DeleteFileW
FlushFileBuffers
CopyFileW
MoveFileExW
SetFilePointer
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetVersionExA
WideCharToMultiByte
GetComputerNameW
DeviceIoControl
LCMapStringW
GetModuleHandleA
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GetSystemDirectoryW
UnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
RaiseException
GetProcAddress
LoadLibraryW
FreeLibrary
Sleep
GetVersionExW
WaitForSingleObject
SetEvent
ReleaseSemaphore
HeapSetInformation
LeaveCriticalSection
EnterCriticalSection
DeleteTimerQueueTimer
GetCurrentThreadId
LocalFree
SetThreadPriority
GetThreadPriority
GetCurrentProcess
DuplicateHandle
GetCurrentThread
GetLastError
OpenThread
LocalAlloc
GetProcessHeap
HeapFree
HeapAlloc
SystemTimeToFileTime

msvcrt

_wtof
_wtoi
memcmp
_itow
rand
srand
time
_ui64tow
malloc
?terminate@@YAXXZ
memset
memcpy
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
wcsncmp
_wcsnicmp
_purecall
sscanf
wcschr
_wcsicmp
swscanf
memmove
_vsnwprintf
free

rpcrt4

UuidCreate
UuidFromStringW
UuidToStringW
RpcStringFreeW
RpcServerUseProtseqEpW
RpcServerRegisterIfEx
RpcServerListen
RpcServerInqCallAttributesW
I_RpcBindingInqLocalClientPID
I_RpcMapWin32Status
RpcServerUnregisterIf
RpcMgmtStopServerListening
RpcRaiseException
RpcImpersonateClient
RpcRevertToSelfEx
NdrServerCall2

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlDeleteFunctionTable
RtlInstallFunctionTableCallback

user32

CharPrevW
CharNextW

ole32

CoInitializeEx
CoUninitialize
CoInitializeSecurity

Sections

.text
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 451KB - Virtual size: 451KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/MShared/ospp64/OSPPWMI.DLL
.dll regsvr32 windows x64

649cb2d0b7b07c70b3598258df5f28df

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:04:b3:f5:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:13

Not After

25/07/2011, 19:23

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

ca:35:d6:90:2e:78:6a:c7:08:cb:70:7c:3f:73:25:75:4e:b9:8e:11
Signer

Actual PE Digest

ca:35:d6:90:2e:78:6a:c7:08:cb:70:7c:3f:73:25:75:4e:b9:8e:11

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

12/08/2009, 02:06
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memmove
memset
memcpy
_amsg_exit
free
_initterm
malloc
_XcptFilter
_wcsicmp
_purecall
towupper
_vsnwprintf
__C_specific_handler
memcmp

kernel32

RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
CompareStringW
WideCharToMultiByte
Sleep
RaiseException
WaitForSingleObject
SetEvent
ReleaseSemaphore
LocalFree
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
VirtualQuery
GetModuleFileNameW
CloseHandle
DeleteCriticalSection
DecodePointer
DisableThreadLibraryCalls
InitializeCriticalSectionAndSpinCount
CreateSemaphoreW
CreateEventW
EncodePointer
SetLastError
GetLastError
FileTimeToSystemTime
LocalAlloc
GetProcessHeap
HeapFree
HeapAlloc

advapi32

RegQueryValueExW
RegSetKeySecurity
RegCreateKeyExW
RegQueryInfoKeyW
RegEnumKeyW
RegCloseKey
RegSetValueExW
RegDeleteKeyW
TraceMessage
RegDeleteValueW
RegOpenKeyExW

crypt32

CertFreeCertificateContext
CertDuplicateCertificateContext
CertNameToStrW
CertGetCertificateContextProperty

ole32

CoGetClassObject
CoCreateInstance
CoImpersonateClient
CoRevertToSelf

oleaut32

SafeArrayDestroy
SafeArrayCreate
SafeArrayAccessData
SafeArrayGetElement
SafeArrayCreateVector
VariantInit
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
SysFreeString
SafeArrayGetDim
SysAllocStringLen
SysAllocString
SafeArrayGetUBound
SafeArrayGetLBound
SysStringLen
VariantClear
SafeArrayUnaccessData

rpcrt4

RpcStringFreeW
UuidFromStringW
UuidToStringW
I_RpcMapWin32Status

osppcext

SLInstallPackage
SLDepositTokenActivationResponse
SLGenerateTokenActivationChallenge
SLGetTokenActivationGrants
SLActivateProduct
SLSignTokenActivationChallenge
SLGetTokenActivationCertificates
SLFreeTokenActivationCertificates
SLFreeTokenActivationGrants
SLAcquireGenuineTicket

osppc

SLGetPKeyInformation
SLUninstallLicense
SLGetLicenseInformation
SLClose
SLOpen
SLGetApplicationInformation
SLGetServiceInformation
SLGetSLIDList
SLInstallProofOfPurchase
SLInstallLicense
SLGetLicensingStatusInformation
SLGetPolicyInformation
SLIsGenuineLocalEx
SLGenerateOfflineInstallationId
SLGetProductSkuInformation
SLUninstallProofOfPurchase
SLDepositOfflineConfirmationId
SLConsumeRight

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 734B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/MShared/ospp64/OSPPWMI.MOF
office2010/MShared/ospp64/osppobjs-spp-plugin-manifest-signed.xrm-ms
office2010/Office14/1033/CLGRINTL.DLL
.dll windows x86

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

02:7f:be:ea:db:a1:c3:0c:64:a6:81:1b:0f:54:3d:74:59:a5:59:53
Signer

Actual PE Digest

02:7f:be:ea:db:a1:c3:0c:64:a6:81:1b:0f:54:3d:74:59:a5:59:53

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

28/02/2010, 12:13
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/Office14/1033/GKINTL.DLL
.dll windows x86

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

12:4b:f5:6b:02:9b:87:b5:f0:7c:a1:2b:fd:7a:d6:79:40:c8:a8:de
Signer

Actual PE Digest

12:4b:f5:6b:02:9b:87:b5:f0:7c:a1:2b:fd:7a:d6:79:40:c8:a8:de

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

28/02/2010, 12:13
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 130B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/Office14/1033/MSO.ACL
office2010/Office14/2052/BCSRuntimeRes.dll
.dll windows x86

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

f2:bd:67:6c:1e:6c:79:6a:6a:bf:97:d5:40:79:aa:34:f5:04:8c:e3
Signer

Actual PE Digest

f2:bd:67:6c:1e:6c:79:6a:6a:bf:97:d5:40:79:aa:34:f5:04:8c:e3

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

22/12/2010, 15:50
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 137B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/Office14/2052/BHOINTL.DLL
.dll windows x86

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

98:36:84:34:42:69:be:ea:00:8a:48:ff:a2:0c:ba:2a:da:e5:6e:56
Signer

Actual PE Digest

98:36:84:34:42:69:be:ea:00:8a:48:ff:a2:0c:ba:2a:da:e5:6e:56

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/03/2010, 04:52
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 147B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/Office14/2052/CERTINTL.DLL
.dll windows x86

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

60:fd:d8:bc:0e:fe:b4:c8:72:f2:d2:63:ba:37:ca:58:45:f0:8c:fc
Signer

Actual PE Digest

60:fd:d8:bc:0e:fe:b4:c8:72:f2:d2:63:ba:37:ca:58:45:f0:8c:fc

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/03/2010, 04:49
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 138B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/Office14/2052/CLVWINTL.DLL
.dll windows x86

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c7:2d:34:30:c4:5e:25:93:45:bf:98:08:93:fc:33:2a:4c:00:9d:ea
Signer

Actual PE Digest

c7:2d:34:30:c4:5e:25:93:45:bf:98:08:93:fc:33:2a:4c:00:9d:ea

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/03/2010, 01:12
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 135B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/Office14/2052/ContactPickerIntl.dll
.dll windows x86

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

4a:5f:ac:c9:00:cc:08:bf:1d:72:f0:90:b7:81:a9:03:0b:cb:80:f0
Signer

Actual PE Digest

4a:5f:ac:c9:00:cc:08:bf:1d:72:f0:90:b7:81:a9:03:0b:cb:80:f0

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/03/2010, 04:44
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/Office14/2052/EAWFINTL.DLL
.dll windows x86

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:c5:b9:54:4a:78:04:fd:fe:72:76:5f:28:62:a2:27:1e:e4:9c:06
Signer

Actual PE Digest

6a:c5:b9:54:4a:78:04:fd:fe:72:76:5f:28:62:a2:27:1e:e4:9c:06

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/03/2010, 04:44
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 142B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/Office14/2052/EntityPickerIntl.dll
.dll windows x86

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7f:12:99:aa:d2:9e:bb:03:c1:ac:31:87:ae:c7:2b:05:1c:e6:0b:7a
Signer

Actual PE Digest

7f:12:99:aa:d2:9e:bb:03:c1:ac:31:87:ae:c7:2b:05:1c:e6:0b:7a

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/03/2010, 04:23
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 147B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/Office14/2052/GR8GALRY.GRA
.xls .gra windows office2003
office2010/Office14/2052/GRINTL32.DLL
.dll windows x86

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

13:5e:56:b9:86:61:2b:e6:3a:19:58:fe:fa:86:08:ba:00:fc:e9:c3
Signer

Actual PE Digest

13:5e:56:b9:86:61:2b:e6:3a:19:58:fe:fa:86:08:ba:00:fc:e9:c3

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

20/03/2010, 21:08
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 134B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 141KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
office2010/Office14/2052/GRLEX.DLL
.dll windows x86

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

4e:64:9a:c0:2c:fd:a1:e2:2d:09:6c:df:2c:6c:fc:3d:89:97:24:a4
Signer

Actual PE Digest

4e:64:9a:c0:2c:fd:a1:e2:2d:09:6c:df:2c:6c:fc:3d:89:97:24:a4

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

20/03/2010, 21:08
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 131B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
office2010/Office14/2052/MSAIN.DLL
.dll windows x86

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

81:15:81:dd:82:ae:fe:05:b8:48:e5:e3:7e:a7:85:a2:c9:59:50:51
Signer

Actual PE Digest

81:15:81:dd:82:ae:fe:05:b8:48:e5:e3:7e:a7:85:a2:c9:59:50:51

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

14/12/2012, 14:14
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/Office14/2052/MSO.ACL
office2010/Office14/2052/OLBINTL.DLL
.dll windows x86

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

3a:e8:32:a1:1f:07:86:c6:55:e0:46:34:5a:ea:e6:5c:f0:47:1a:b4
Signer

Actual PE Digest

3a:e8:32:a1:1f:07:86:c6:55:e0:46:34:5a:ea:e6:5c:f0:47:1a:b4

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

23/03/2010, 13:09
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 131B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/Office14/2052/PPINTL.DLL
.dll windows x86

Code Sign

33:00:00:01:5c:12:f8:b2:79:cd:42:43:43:00:00:00:00:01:5c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/12/2019, 01:13

Not After

17/03/2021, 01:13

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:F87A-E374-D7B9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:f3:07:55:2b:7b:a6:03:ad:7c:00:02:00:00:01:f3
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2020, 20:18

Not After

30/09/2020, 20:18

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:04:35:45:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

20/09/2018, 17:42

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ae:af:29:bb:97:8b:81:13:8f:79:1a:34:be:13:a4:30:90:ff:82:0e:76:79:8f:15:a4:71:28:f0:61:82:69:58
Signer

Actual PE Digest

ae:af:29:bb:97:8b:81:13:8f:79:1a:34:be:13:a4:30:90:ff:82:0e:76:79:8f:15:a4:71:28:f0:61:82:69:58

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

6a:73:c5:3b:b9:d1:d6:4e:83:bd:b2:6f:7c:13:49:0a:fd:9c:39:e0
Signer

Actual PE Digest

6a:73:c5:3b:b9:d1:d6:4e:83:bd:b2:6f:7c:13:49:0a:fd:9c:39:e0

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

23/07/2020, 08:04
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 130B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/Office14/2052/WWINTL.DLL
.dll windows x86

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

9d:fe:b8:d6:17:35:5d:f0:18:15:0d:ea:97:88:4c:af:f0:9d:06:7e
Signer

Actual PE Digest

9d:fe:b8:d6:17:35:5d:f0:18:15:0d:ea:97:88:4c:af:f0:9d:06:7e

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

22/12/2010, 16:48
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 131B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 834KB - Virtual size: 833KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/Office14/2052/XLINTL32.DLL
.dll windows x86

Code Sign

33:00:00:01:65:32:39:e9:8f:f9:50:e5:48:00:00:00:00:01:65
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2020, 17:24

Not After

01/04/2021, 17:24

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:fa:fc:1e:0a:0b:f8:7f:37:9a:00:02:00:00:01:fa
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/07/2020, 18:30

Not After

25/04/2021, 18:30

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:04:35:45:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

20/09/2018, 17:42

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:e0:71:73:24:ca:5c:98:f8:19:00:00:00:00:01:e0
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c3:a4:d5:42:f9:dd:10:9b:7c:a0:ec:d7:00:f7:b1:68:fe:9e:7c:1d:4f:d7:ed:06:d8:55:14:d8:5e:14:9c:af
Signer

Actual PE Digest

c3:a4:d5:42:f9:dd:10:9b:7c:a0:ec:d7:00:f7:b1:68:fe:9e:7c:1d:4f:d7:ed:06:d8:55:14:d8:5e:14:9c:af

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

f3:ce:79:13:7a:f2:49:31:2a:3d:99:cf:60:47:3c:83:aa:bb:02:cb
Signer

Actual PE Digest

f3:ce:79:13:7a:f2:49:31:2a:3d:99:cf:60:47:3c:83:aa:bb:02:cb

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

12/03/2021, 03:54
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 131B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
office2010/Office14/2052/XLLEX.DLL
.dll windows x86

Code Sign

33:00:00:00:59:d6:73:cd:51:8e:f0:22:c5:00:00:00:00:00:59
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2014, 17:13

Not After

23/08/2015, 17:13

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

91:2b:84:b6:61:96:18:f1:e6:f9:56:fb:2a:b4:07:60:f7:53:db:f3
Signer

Actual PE Digest

91:2b:84:b6:61:96:18:f1:e6:f9:56:fb:2a:b4:07:60:f7:53:db:f3

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/03/2015, 09:51
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
office2010/Office14/2052/XLSLICER.DLL
.dll regsvr32 windows x86

3122c9ce30bce55c428d372ea63a9865

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

07:da:30:7a:f6:f3:28:b9:48:5c:ef:e9:08:9d:b0:07:fc:e9:50:ed
Signer

Actual PE Digest

07:da:30:7a:f6:f3:28:b9:48:5c:ef:e9:08:9d:b0:07:fc:e9:50:ed

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13/03/2010, 08:18
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

memcpy
strncpy_s
_snprintf_s
_CxxThrowException
memset
__CxxFrameHandler3
wcscpy_s
wcsncat_s
wcsncpy_s
??_U@YAPAXI@Z
??2@YAPAXI@Z
strstr
malloc
??3@YAXPAX@Z
free
memcpy_s
strcpy_s
strcat_s
_resetstkoflw
_recalloc
swscanf_s
_vsnwprintf_s
_snwprintf_s
fclose
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
vswprintf_s
strncat_s
fopen_s
??_V@YAXPAX@Z
fprintf

advapi32

RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
DeregisterEventSource
ReportEventW
RegisterEventSourceW
RegQueryValueExW
RegOpenKeyExW

comctl32

InitCommonControlsEx
PropertySheetA
ImageList_LoadImageA

gdi32

SelectPalette
CreatePalette
GetDeviceCaps
DeleteObject
SetStretchBltMode
RealizePalette
CreateFontIndirectA
SelectObject
DeleteDC
StretchDIBits

kernel32

LoadResource
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleFileNameW
LoadLibraryW
HeapAlloc
HeapFree
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualProtect
GetCurrentDirectoryA
SetLastError
GetCurrentThreadId
GetFullPathNameW
GetACP
GetCurrentProcess
FlushInstructionCache
GetModuleHandleA
LoadLibraryExA
IsDBCSLeadByte
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
DisableThreadLibraryCalls
lstrcmpiA
lstrlenA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
GetLastError
FormatMessageA
LocalFree
GlobalFree
GlobalUnlock
GlobalLock
LockResource
GlobalAlloc
SizeofResource
FreeLibrary
FindResourceA

ole32

StringFromGUID2
CoCreateFreeThreadedMarshaler
CoTaskMemRealloc
CoGetMalloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance

oleaut32

VarUI4FromStr
SysFreeString
SysStringLen
GetErrorInfo
VariantInit
SysAllocString
VariantClear
VariantChangeType
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
SysStringByteLen
VarBstrCat
SysAllocStringLen
SysAllocStringByteLen

user32

RegisterClassA
GetMessagePos
GetWindowLongW
SetWindowLongW
ReleaseDC
GetDC
PostMessageA
GetClientRect
EndPaint
DrawEdge
BeginPaint
InvalidateRect
DefWindowProcA
UnregisterClassA
GetClassInfoA
MessageBoxA
GetActiveWindow
LoadStringA
SetCursor
LoadCursorA
GetSystemMetrics
SendMessageA
CharNextA
SetWindowLongA
SetTimer
KillTimer
GetDlgItem
EndDialog
SetWindowTextA
CharNextW
GetClassNameA
EnumChildWindows
SystemParametersInfoA
DialogBoxParamA
GetParent
GetWindowTextLengthA
GetWindowTextA
GetWindowLongA
MapWindowPoints

comdlg32

GetSaveFileNameA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
SlicerCreateLocalCube
_FInstrumented@4

Sections

.text
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/2052/ospintl.dll
.dll windows x86

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

be:0a:a2:e8:ae:b2:cc:c6:1c:c0:c8:70:81:49:5c:2e:31:8f:94:06
Signer

Actual PE Digest

be:0a:a2:e8:ae:b2:cc:c6:1c:c0:c8:70:81:49:5c:2e:31:8f:94:06

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/03/2010, 06:21
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 131B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/Office14/ADDINS/MSOSEC.DLL
.dll windows x86

dae02f32a21e03ce65412f6e56942daa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorDllMain

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/ADDINS/MSOSEC.XML
office2010/Office14/ADDINS/MSTR2TSC.DLL
.dll windows x86

188b61c0395ae40aa8774baf326ccf03

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

60:91:56:14:7c:62:74:c7:8d:88:47:ab:1a:50:27:8b:6f:58:51:b5
Signer

Actual PE Digest

60:91:56:14:7c:62:74:c7:8d:88:47:ab:1a:50:27:8b:6f:58:51:b5

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/10/2012, 12:31
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetLastError
GetModuleFileNameW
OutputDebugStringA
FreeLibrary
GetSystemDirectoryW
GetVersionExA
TlsSetValue
DeleteCriticalSection
TlsFree
TlsAlloc
InitializeCriticalSection
GetACP
CompareStringW
CreateDirectoryW
lstrlenW
SizeofResource
DeleteFileA
GetTempFileNameA
GetTempPathA
DeleteFileW
CloseHandle
WriteFile
CreateFileA
GetLastError
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
LeaveCriticalSection
EnterCriticalSection
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
FindResourceExW
LoadResource
LockResource
TlsGetValue
WideCharToMultiByte
GetVersion
GetFileAttributesW
GetProcAddress
GetModuleHandleW
LoadLibraryW
LoadLibraryA
GetModuleHandleA
CreateFileW
IsDebuggerPresent

user32

DispatchMessageA
SetWindowPos
SendMessageA
SetWindowTextA
IsDialogMessageA
PeekMessageA
DestroyWindow
SetFocus
SendDlgItemMessageW
SendMessageW
IsWindowVisible
GetFocus
ReleaseDC
GetDC
SetWindowLongA
IsWindow
SetWindowTextW
LoadIconA
SendDlgItemMessageA
GetDlgItem
ShowWindow
SetDlgItemTextW
EnableWindow
GetWindowLongA
EndDialog
DialogBoxIndirectParamW
DialogBoxParamW
CreateDialogIndirectParamW
GetSysColor

gdi32

SetTextColor
CreateCompatibleDC
GetTextColor
DeleteDC
CreateCompatibleBitmap
SelectObject
DeleteObject

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

msvcr90

?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
wcsncpy_s
wcsncat_s
strcpy_s
_vsnprintf_s
strncat_s
_vsnwprintf_s
memset
wcsncmp
??2@YAPAXI@Z
??3@YAXPAX@Z
memcpy
__CxxFrameHandler3
_CxxThrowException
wcsrchr
??_V@YAXPAX@Z
??_U@YAPAXI@Z
_encode_pointer
_malloc_crt
free
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_except_handler4_common
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit

mso

ord8625
ord7018
ord9847
ord6297
ord6446
ord2358
ord425
ord7549
ord3269
ord10147
ord4247
ord10516
ord2303
ord5868

Exports

Exports

CheckAddStats
CheckAddUdr
CheckBatchUpdate
CheckCloseMdt
CheckEnumHandles
CheckFreeHandle
CheckGetError
CheckGetErrorInformation
CheckGetStats
CheckIgnoreError
CheckIgnoreRule
CheckInit
CheckInitStats
CheckIsRuleIgnored
CheckLoadPersistData
CheckOpenMdt
CheckOptionSettings
CheckResetError
CheckResetOptions
CheckResetRule
CheckSavePersistData
CheckStats
CheckSubtractStats
CheckTerminate
CheckText
CheckUnloadDoc
CheckUseOptions
CheckVersion
CheckWriteOptions
TCSCConvertText
TCSCFreeConvertedText
TCSCInitialize
TCSCShowCustomDictionaryDialog
TCSCUninitialize

Sections

.text
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/ADDINS/MSTR2TSC.LEX
office2010/Office14/ADDINS/MSVCR71.DLL
.dll windows x86

7acc8c379c768a1ecd81ec502ff5f33e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
GetModuleFileNameW
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
GetCurrentThreadId
GetCommandLineA
GetVersionExA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ExitThread
CloseHandle
GetLastError
ResumeThread
CreateThread
TlsAlloc
SetLastError
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
FindNextFileA
FindFirstFileA
FindClose
FindNextFileW
FindFirstFileW
HeapAlloc
HeapFree
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
SetHandleCount
GetFileType
GetStartupInfoA
GetACP
GetOEMCP
GetCPInfo
LoadLibraryA
MultiByteToWideChar
GetCommandLineW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
InitializeCriticalSection
RtlUnwind
UnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetConsoleCtrlHandler
InterlockedExchange
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetEnvironmentVariableA
SetEnvironmentVariableW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetLocaleInfoW
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
HeapSize
VirtualProtect
GetSystemInfo
FlushFileBuffers
SetFilePointer
SetStdHandle
CompareStringA
CompareStringW
Sleep
Beep
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDiskFreeSpaceA
GetLogicalDrives
SetErrorMode
GetFileAttributesA
GetCurrentDirectoryA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetDriveTypeA
CreateDirectoryA
RemoveDirectoryA
DeleteFileA
GetFileAttributesW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetFileAttributesW
GetFullPathNameW
CreateDirectoryW
DeleteFileW
MoveFileW
RemoveDirectoryW
GetDriveTypeW
MoveFileA
RaiseException
IsBadReadPtr
SetUnhandledExceptionFilter
IsBadCodePtr
GetExitCodeProcess
WaitForSingleObject
FreeLibrary
CreateProcessA
CreateProcessW
HeapValidate
HeapCompact
HeapWalk
ReadConsoleA
SetConsoleMode
GetConsoleMode
IsDBCSLeadByteEx
GetConsoleCP
ReadConsoleW
SetEndOfFile
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
DuplicateHandle
GetFileInformationByHandle
PeekNamedPipe
ReadConsoleInputA
PeekConsoleInputA
GetNumberOfConsoleInputEvents
ReadConsoleInputW
LockFile
UnlockFile
CreateFileA
CreatePipe
ReadFile
CreateFileW
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
GetLocalTime
SetLocalTime

Exports

Exports

$I10_OUTPUT
??0__non_rtti_object@@QAE@ABV0@@Z
??0__non_rtti_object@@QAE@PBD@Z
??0bad_cast@@AAE@PBQBD@Z
??0bad_cast@@QAE@ABQBD@Z
??0bad_cast@@QAE@ABV0@@Z
??0bad_cast@@QAE@PBD@Z
??0bad_typeid@@QAE@ABV0@@Z
??0bad_typeid@@QAE@PBD@Z
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1__non_rtti_object@@UAE@XZ
??1bad_cast@@UAE@XZ
??1bad_typeid@@UAE@XZ
??1exception@@UAE@XZ
??1type_info@@UAE@XZ
??2@YAPAXI@Z
??3@YAXPAX@Z
??4__non_rtti_object@@QAEAAV0@ABV0@@Z
??4bad_cast@@QAEAAV0@ABV0@@Z
??4bad_typeid@@QAEAAV0@ABV0@@Z
??4exception@@QAEAAV0@ABV0@@Z
??8type_info@@QBEHABV0@@Z
??9type_info@@QBEHABV0@@Z
??_7__non_rtti_object@@6B@
??_7bad_cast@@6B@
??_7bad_typeid@@6B@
??_7exception@@6B@
??_Fbad_cast@@QAEXXZ
??_Fbad_typeid@@QAEXXZ
??_U@YAPAXI@Z
??_V@YAXPAX@Z
?_query_new_handler@@YAP6AHI@ZXZ
?_query_new_mode@@YAHXZ
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_set_new_mode@@YAHH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?before@type_info@@QBEHABV1@@Z
?name@type_info@@QBEPBDXZ
?raw_name@type_info@@QBEPBDXZ
?set_new_handler@@YAP6AXXZP6AXXZ@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?swprintf@@YAHPAGIPBGZZ
?swprintf@@YAHPA_WIPB_WZZ
?terminate@@YAXXZ
?unexpected@@YAXXZ
?vswprintf@@YAHPAGIPBGPAD@Z
?vswprintf@@YAHPA_WIPB_WPAD@Z
?what@exception@@UBEPBDXZ
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_CRT_RTC_INIT
_CxxThrowException
_EH_prolog
_Getdays
_Getmonths
_Gettnames
_HUGE
_Strftime
_XcptFilter
__CppXcptFilter
__CxxCallUnwindDtor
__CxxCallUnwindVecDtor
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__STRINGTOLD
___lc_codepage_func
___lc_collate_cp_func
___lc_handle_func
___mb_cur_max_func
___setlc_active_func
___unguarded_readlc_active_add_func
__argc
__argv
__badioinfo
__buffer_overrun
__crtCompareStringA
__crtCompareStringW
__crtGetLocaleInfoW
__crtGetStringTypeW
__crtLCMapStringA
__crtLCMapStringW
__dllonexit
__doserrno
__fpecode
__getmainargs
__initenv
__iob_func
__isascii
__iscsym
__iscsymf
__lc_clike
__lc_codepage
__lc_collate_cp
__lc_handle
__lconv_init
__mb_cur_max
__p___argc
__p___argv
__p___initenv
__p___mb_cur_max
__p___wargv
__p___winitenv
__p__acmdln
__p__amblksiz
__p__commode
__p__daylight
__p__dstbias
__p__environ
__p__fileinfo
__p__fmode
__p__iob
__p__mbcasemap
__p__mbctype
__p__osver
__p__pctype
__p__pgmptr
__p__pwctype
__p__timezone
__p__tzname
__p__wcmdln
__p__wenviron
__p__winmajor
__p__winminor
__p__winver
__p__wpgmptr
__pctype_func
__pioinfo
__pwctype_func
__pxcptinfoptrs
__security_error_handler
__set_app_type
__set_buffer_overrun_handler
__setlc_active
__setusermatherr
__threadhandle
__threadid
__toascii
__unDName
__unDNameEx
__uncaught_exception
__unguarded_readlc_active
__wargv
__wcserror
__wgetmainargs
__winitenv
_abnormal_termination
_access
_acmdln
_adj_fdiv_m16i
_adj_fdiv_m32
_adj_fdiv_m32i
_adj_fdiv_m64
_adj_fdiv_r
_adj_fdivr_m16i
_adj_fdivr_m32
_adj_fdivr_m32i
_adj_fdivr_m64
_adj_fpatan
_adj_fprem
_adj_fprem1
_adj_fptan
_adjust_fdiv
_aexit_rtn
_aligned_free
_aligned_malloc
_aligned_offset_malloc
_aligned_offset_realloc
_aligned_realloc
_amsg_exit
_assert
_atodbl
_atoi64
_atoldbl
_beep
_beginthread
_beginthreadex
_c_exit
_cabs
_callnewh
_cexit
_cgets
_cgetws
_chdir
_chdrive
_chgsign
_chkesp
_chmod
_chsize
_clearfp
_close
_commit
_commode
_control87
_controlfp
_copysign
_cprintf
_cputs
_cputws
_creat
_cscanf
_ctime64
_cwait
_cwprintf
_cwscanf
_daylight
_dstbias
_dup
_dup2
_ecvt
_endthread
_endthreadex
_environ
_eof
_errno
_except_handler2
_except_handler3
_execl
_execle
_execlp
_execlpe
_execv
_execve
_execvp
_execvpe
_exit
_expand
_fcloseall
_fcvt
_fdopen
_fgetchar
_fgetwchar
_filbuf
_fileinfo
_filelength
_filelengthi64
_fileno
_findclose
_findfirst
_findfirst64
_findfirsti64
_findnext
_findnext64
_findnexti64
_finite
_flsbuf
_flushall
_fmode
_fpclass
_fpieee_flt
_fpreset
_fputchar
_fputwchar
_fsopen
_fstat
_fstat64
_fstati64
_ftime
_ftime64
_ftol
_fullpath
_futime
_futime64
_gcvt
_get_heap_handle
_get_osfhandle
_get_sbh_threshold
_getch
_getche
_getcwd
_getdcwd
_getdiskfree
_getdllprocaddr
_getdrive
_getdrives
_getmaxstdio
_getmbcp
_getpid
_getsystime
_getw
_getwch
_getwche
_getws
_global_unwind2
_gmtime64
_heapadd
_heapchk
_heapmin
_heapset
_heapused
_heapwalk
_hypot
_i64toa
_i64tow
_initterm
_inp
_inpd
_inpw
_iob
_isatty
_isctype
_ismbbalnum
_ismbbalpha
_ismbbgraph
_ismbbkalnum
_ismbbkana
_ismbbkprint
_ismbbkpunct
_ismbblead
_ismbbprint
_ismbbpunct
_ismbbtrail
_ismbcalnum
_ismbcalpha
_ismbcdigit
_ismbcgraph
_ismbchira
_ismbckata
_ismbcl0
_ismbcl1
_ismbcl2
_ismbclegal
_ismbclower
_ismbcprint
_ismbcpunct
_ismbcspace
_ismbcsymbol
_ismbcupper
_ismbslead
_ismbstrail
_isnan
_itoa
_itow
_j0
_j1
_jn
_kbhit
_lfind
_loaddll
_local_unwind2
_localtime64
_lock
_locking
_logb
_longjmpex
_lrotl
_lrotr
_lsearch
_lseek
_lseeki64
_ltoa
_ltow
_makepath
_mbbtombc
_mbbtype
_mbcasemap
_mbccpy
_mbcjistojms
_mbcjmstojis
_mbclen
_mbctohira
_mbctokata
_mbctolower
_mbctombb
_mbctoupper
_mbctype
_mbsbtype
_mbscat
_mbschr
_mbscmp
_mbscoll
_mbscpy
_mbscspn
_mbsdec
_mbsdup
_mbsicmp
_mbsicoll
_mbsinc
_mbslen
_mbslwr
_mbsnbcat
_mbsnbcmp
_mbsnbcnt
_mbsnbcoll
_mbsnbcpy
_mbsnbicmp
_mbsnbicoll
_mbsnbset
_mbsncat
_mbsnccnt
_mbsncmp
_mbsncoll
_mbsncpy
_mbsnextc
_mbsnicmp
_mbsnicoll
_mbsninc
_mbsnset
_mbspbrk
_mbsrchr
_mbsrev
_mbsset
_mbsspn
_mbsspnp
_mbsstr
_mbstok
_mbstrlen
_mbsupr
_memccpy
_memicmp
_mkdir
_mktemp
_mktime64
_msize
_nextafter
_onexit
_open
_open_osfhandle
_osplatform
_osver
_outp
_outpd
_outpw
_pclose
_pctype
_pgmptr
_pipe
_popen
_purecall
_putch
_putenv
_putw
_putwch
_putws
_pwctype
_read
_resetstkoflw
_rmdir
_rmtmp
_rotl
_rotr
_safe_fdiv
_safe_fdivr
_safe_fprem
_safe_fprem1
_scalb
_scprintf
_scwprintf
_searchenv
_seh_longjmp_unwind
_set_SSE2_enable
_set_error_mode
_set_purecall_handler
_set_sbh_threshold
_set_security_error_handler
_seterrormode
_setjmp
_setjmp3
_setmaxstdio
_setmbcp
_setmode
_setsystime
_sleep
_snprintf
_snscanf
_snwprintf
_snwscanf
_sopen
_spawnl
_spawnle
_spawnlp
_spawnlpe
_spawnv
_spawnve
_spawnvp

Sections

.text
Size: 228KB - Virtual size: 226KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/ADDINS/OTKLOADR.DLL
.dll regsvr32 windows x86

c0ed8cb3f44c1915f4cf2abbd9de8ef1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InitializeCriticalSection
DeleteCriticalSection
GetLastError
lstrcmpiW
lstrcpyW
GetModuleFileNameW
DisableThreadLibraryCalls
InterlockedIncrement
InterlockedDecrement
lstrcpynW
lstrcatW
LeaveCriticalSection
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
LockResource
FindResourceExW
GetProcAddress
LoadLibraryW
GetProcessHeap
HeapSize
EnterCriticalSection
RaiseException
lstrlenW
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
FreeLibrary
InterlockedExchange
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
ExitProcess

user32

CharNextW

advapi32

RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW

ole32

StringFromGUID2
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc

oleaut32

SafeArrayUnlock
SysFreeString
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
SysAllocStringLen
SysStringLen
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
VariantClear
SafeArrayDestroy
VarBstrCat
SysStringByteLen
SysAllocStringByteLen
SafeArrayRedim
SafeArrayCreate
VariantCopyInd
SafeArrayLock

wininet

InternetSetOptionW
InternetAutodial
InternetGetConnectedState
GetUrlCacheEntryInfoW
InternetCombineUrlW

urlmon

CoInternetQueryInfo

mscoree

CorBindToRuntimeEx

shlwapi

PathIsRelativeW
PathIsURLW
PathFindExtensionW

msvcr71

_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__security_error_handler
__CppXcptFilter
_adjust_fdiv
_initterm
wcsrchr
memset
iswspace
wcslen
memmove
wcscspn
wcsspn
wcsstr
wcscmp
??_U@YAPAXI@Z
realloc
wcsncpy
_purecall
__CxxFrameHandler
??2@YAPAXI@Z
_except_handler3
_CxxThrowException
free
malloc
??_V@YAXPAX@Z
??3@YAXPAX@Z

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/ADDINS/TCSCCONV.DLL
.dll regsvr32 windows x86

3228c4fe1f005d29443312c63cb0b562

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ce:91:34:74:20:b1:e0:a1:db:c2:bc:a4:3a:dc:1d:c9:fd:c1:85:1b
Signer

Actual PE Digest

ce:91:34:74:20:b1:e0:a1:db:c2:bc:a4:3a:dc:1d:c9:fd:c1:85:1b

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

29/07/2015, 00:32
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mso

ord2303
ord5868
ord6160

advapi32

DeregisterEventSource
ReportEventW
RegisterEventSourceW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegEnumValueW

kernel32

InterlockedExchange
lstrlenW
DisableThreadLibraryCalls
GetModuleFileNameW
GetModuleHandleW
lstrcmpiW
CompareStringW
LockResource
LoadResource
FindResourceExW
SizeofResource
InterlockedCompareExchange
LocalFree
LocalAlloc
FormatMessageW
GetLastError
MultiByteToWideChar
lstrlenA
Sleep
FreeLibrary
GetModuleHandleA
GetProcAddress
GetFileAttributesW
GetVersion
LoadLibraryW
SetLastError
OutputDebugStringA
GetSystemDirectoryW
CloseHandle
WaitForSingleObject
CreateEventW
SetEvent
TerminateProcess
FindResourceW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
VirtualProtect
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcessHeap
HeapAlloc
HeapFree
GetCurrentProcess

ole32

CLSIDFromProgID
CoCreateInstance
StringFromIID
CoTaskMemFree
OleRun
CLSIDFromString

oleaut32

GetErrorInfo
DispGetIDsOfNames
DispInvoke
SysAllocString
LoadTypeLibEx
UnRegisterTypeLi
SysAllocStringByteLen
SysStringByteLen
CreateErrorInfo
SysFreeString
SysAllocStringLen
VariantInit
VariantCopy
VariantClear
VariantChangeType
SysStringLen

user32

PeekMessageW
MessageBoxW
GetFocus
DispatchMessageW
SetDlgItemTextW
IsDlgButtonChecked
CheckDlgButton
GetDlgItem
EnableWindow
SetWindowTextW
DialogBoxIndirectParamW
ShowWindow
SendDlgItemMessageW
EndDialog
TranslateMessage

msvcr90

_CxxThrowException
__clean_type_info_names_internal
_crt_debugger_hook
_except_handler4_common
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
??2@YAPAXI@Z
__CxxFrameHandler3
wcscpy_s
??3@YAXPAX@Z
wcscat_s
memset
memcpy_s
swprintf_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
free
malloc
wcsncat_s
_beginthread
vswprintf_s
_encode_pointer
_malloc_crt

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/AUTHZAX.DLL
.dll regsvr32 windows x86

9cc7d33d7650cff99befbfa1c01b7441

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ac:52:52:f6:3f:64:19:37:2f:76:3a:36:98:18:9e:2f:85:a4:29:a4
Signer

Actual PE Digest

ac:52:52:f6:3f:64:19:37:2f:76:3a:36:98:18:9e:2f:85:a4:29:a4

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

10/01/2010, 04:41
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegQueryValueExW
RegOpenKeyExW
ReportEventW
DeregisterEventSource
RegisterEventSourceW

kernel32

RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
GetProcAddress
GetModuleHandleA
lstrlenA
lstrcmpiA
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleW
IsDBCSLeadByte
CloseHandle
LoadLibraryExW
GetSystemDirectoryW
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleFileNameW
LoadLibraryW
HeapAlloc
lstrlenW
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
MultiByteToWideChar
WideCharToMultiByte
HeapFree

ole32

CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2

oleaut32

LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
SysStringLen

shlwapi

UrlGetPartW

user32

CharNextW
CharNextA

msvcr90

free
memcpy_s
strcpy_s
wcsncpy_s
strncpy_s
strcat_s
??_V@YAXPAX@Z
_resetstkoflw
_recalloc
??_U@YAPAXI@Z
memset
memcpy
_wcsicmp
??2@YAPAXI@Z
vswprintf_s
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
_crt_debugger_hook
__clean_type_info_names_internal
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
strstr
??3@YAXPAX@Z
malloc

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/BORDERS/MSART1.BDR
office2010/Office14/BORDERS/MSART10.BDR
office2010/Office14/BORDERS/MSART11.BDR
office2010/Office14/BORDERS/MSART12.BDR
office2010/Office14/BORDERS/MSART13.BDR
office2010/Office14/BORDERS/MSART14.BDR
office2010/Office14/BORDERS/MSART15.BDR
office2010/Office14/BORDERS/MSART2.BDR
office2010/Office14/BORDERS/MSART3.BDR
office2010/Office14/BORDERS/MSART4.BDR
office2010/Office14/BORDERS/MSART5.BDR
office2010/Office14/BORDERS/MSART6.BDR
office2010/Office14/BORDERS/MSART7.BDR
office2010/Office14/BORDERS/MSART8.BDR
office2010/Office14/BORDERS/MSART9.BDR
office2010/Office14/CDLMSO.DLL
.dll windows x86

049c09b4418f2654b782f304599243d4

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:12

Not After

04/12/2013, 21:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ab:bc:25:83:ee:c9:5a:bd:c1:1d:c3:1c:14:20:57:88:27:f2:67:a1
Signer

Actual PE Digest

ab:bc:25:83:ee:c9:5a:bd:c1:1d:c3:1c:14:20:57:88:27:f2:67:a1

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

05/11/2012, 15:29
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
_vscwprintf
vswprintf_s
?_query_new_handler@@YAP6AHI@ZXZ
memset
wcsncpy_s
_CxxThrowException
memmove
memcpy
??8type_info@@QBE_NABV0@@Z
__CxxFrameHandler3

kernel32

VirtualProtect
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcessHeap
HeapFree
HeapAlloc
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
FoldStringW
Sleep
TlsAlloc
FormatMessageW
TlsSetValue
TlsGetValue
TlsFree
EncodePointer
FreeLibrary
GetTickCount
MultiByteToWideChar
GetVersionExA
RaiseException
FindResourceW
LoadResource
LockResource
OutputDebugStringA
GetModuleFileNameW
SetLastError
GetLastError
LoadLibraryW
GlobalFree
MulDiv
GetVersion
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetCurrentThreadId
DecodePointer
LoadLibraryA
LocalAlloc
GetLocaleInfoW

gdi32

CreateRectRgn
GetCurrentObject
GetPaletteEntries
CreateDIBSection
Rectangle
CreateBitmap
CreateCompatibleDC
BitBlt
StretchBlt
CreatePen
SetROP2
ExtSelectClipRgn
GetClipRgn
RestoreDC
SaveDC
SelectObject
DeleteDC
GetDeviceCaps
SetMapMode
UpdateColors
SelectPalette
RealizePalette
GdiFlush
SetDIBColorTable
Polygon
PatBlt
ExcludeClipRect
IntersectClipRect
GetTextFaceW
GetTextExtentPoint32A
MoveToEx
LineTo
SetTextAlign
SetBkMode
GetStockObject
SetStretchBltMode
GetClipBox
SelectClipRgn
GetTextMetricsW
CreateSolidBrush
DeleteObject
GetObjectW
GetLayout
SetLayout
CreateRectRgnIndirect
SetTextColor
SetBkColor
CreateFontIndirectW

user32

EnumWindows
IsWindowEnabled
SystemParametersInfoW
PtInRect
IsChild
WindowFromPoint
ChildWindowFromPoint
MapWindowPoints
DestroyWindow
SetFocus
GetFocus
ShowWindow
IsDlgButtonChecked
GetScrollPos
SetScrollPos
GetScrollRange
SetScrollRange
GetSystemMetrics
GetCursorPos
DestroyIcon
DrawFrameControl
InflateRect
IntersectRect
UnionRect
GetKeyboardLayout
SetWindowPos
UpdateWindow
RegisterClassW
UnregisterClassW
CreateWindowExW
GetSysColorBrush
IsIconic
GetNextDlgGroupItem
GetCapture
GetAsyncKeyState
GetWindowRect
LoadIconW
DrawIconEx
KillTimer
GetScrollInfo
LoadImageW
SetCursor
LoadCursorW
FrameRect
DrawTextW
GetKeyState
SetWindowTextW
GetNextDlgTabItem
ActivateKeyboardLayout
GetWindow
GetDlgItem
MoveWindow
GetDlgCtrlID
SetTimer
NotifyWinEvent
CallWindowProcW
SendDlgItemMessageW
IsDialogMessageW
MapDialogRect
FillRect
SetCapture
ReleaseCapture
DrawEdge
SystemParametersInfoA
DispatchMessageW
GetMessageTime
PeekMessageW
TrackMouseEvent
GetMessagePos
DefWindowProcW
RegisterWindowMessageW
CreateDialogIndirectParamW
WaitMessage
LoadAcceleratorsW
TranslateAcceleratorW
GetDoubleClickTime
ReleaseDC
SetRectEmpty
TranslateMessage
EqualRect
DrawFocusRect
SetParent
GetDC
BeginPaint
EndPaint
GetSysColor
SetWindowLongW
GetWindowLongW
SendMessageW
MessageBeep
OffsetRect
BringWindowToTop
GetParent
GetForegroundWindow
GetClassNameW
InvalidateRect
IsWindow
GetWindowTextLengthW
IsWindowVisible
GetClientRect
PostMessageW
CheckDlgButton
EnableWindow
SetForegroundWindow
GetDesktopWindow
GetUpdateRect

advapi32

RegQueryValueExW
DeregisterEventSource
ReportEventW
RegOpenKeyExW
RegCloseKey
RegisterEventSourceW

ole32

CoCreateInstance
CoDisconnectObject

oleaut32

LoadRegTypeLi
LoadTypeLi
VariantInit
SysAllocString

Exports

Exports

??0CExceptionHandler@Cdl@@QAE@XZ
??0CLibraryException@Cdl@@AAE@HPB_W@Z
??0CObjectSafe@Cdl@@QAE@XZ
??0DLAnimation@Cdl@@QAE@AAVDLDialog@1@K@Z
??0DLAutoLayoutDialog@Cdl@@QAE@AAVDLDialog@1@@Z
??0DLBitmapButton@Cdl@@QAE@AAVDLDialog@1@KABUtagRECT@@H_N@Z
??0DLBitmapButton@Cdl@@QAE@AAVDLDialog@1@K_N@Z
??0DLCheckBox@Cdl@@QAE@AAVDLDialog@1@KPB_WABUtagRECT@@H@Z
??0DLCheckBox@Cdl@@QAE@AAVDLDialog@1@K_N@Z
??0DLCheckBoxList@Cdl@@QAE@AAVDLDialog@1@KABUtagRECT@@H@Z
??0DLCheckBoxList@Cdl@@QAE@AAVDLDialog@1@KH@Z
??0DLComboBoxFrame@Cdl@@QAE@AAVDLEditString@1@AAVDLTextListBox@1@PAVDLCompositeFrame@1@@Z
??0DLComboPopup@Cdl@@QAE@AAVDLDialog@1@K@Z
??0DLComboPopup@Cdl@@QAE@AAVDLDialog@1@KABUtagRECT@@_N@Z
??0DLCompositeFrame@Cdl@@IAE@AAVCompositeFrame@DlgAutoLayout@@@Z
??0DLContainerFrame@Cdl@@IAE@AAVContainerFrame@DlgAutoLayout@@@Z
??0DLControl@Cdl@@IAE@AAVDLDialog@1@K_N@Z
??0DLCtrlContainerFrame@Cdl@@QAE@AAVDLControl@1@PAVDLCompositeFrame@1@@Z
??0DLCtrlFrame@Cdl@@QAE@AAVDLControl@1@PAVDLCompositeFrame@1@@Z
??0DLDialog@Cdl@@QAE@AAUICdlContext@1@KKK@Z
??0DLDialog@Cdl@@QAE@AAUICdlContext@1@PAUHFONT__@@KK@Z
??0DLDialog@Cdl@@QAE@AAUICdlContext@1@W4DLDialogMode@1@KKW4DLPositioning@1@PAUHWND__@@@Z
??0DLDialog@Cdl@@QAE@AAUICdlContext@1@W4DLDialogMode@1@KW4DLPositioning@1@PAUHWND__@@PAUHFONT__@@_N@Z
??0DLDialogBase@Cdl@@IAE@AAUICdlContext@1@KW4DLDialogMode@1@W4DLDialogType@1@@Z
??0DLDisableUpdatesRestorer@Cdl@@QAE@AAVDLControl@1@_N@Z
??0DLEditPopup@Cdl@@QAE@AAVDLDialog@1@K@Z
??0DLEditPopup@Cdl@@QAE@AAVDLDialog@1@KABUtagRECT@@H@Z
??0DLEditString@Cdl@@QAE@AAVDLDialog@1@K@Z
??0DLEditString@Cdl@@QAE@AAVDLDialog@1@KPB_WABUtagRECT@@H@Z
??0DLEditString@Cdl@@QAE@AAVDLDialog@1@KPB_WABUtagRECT@@KK@Z
??0DLFlowFrame@Cdl@@QAE@AAVDLDialog@1@PAVDLCompositeFrame@1@@Z
??0DLForeignDialogHelper@Cdl@@QAE@AAUICdlContext@1@KW4DLDialogMode@1@W4DLDialogType@1@_N@Z
??0DLForeignDlgHelperHook@Cdl@@AAE@AAVDLForeignDialogHelper@1@@Z
??0DLFrame@Cdl@@IAE@AAVFrame@DlgAutoLayout@@@Z
??0DLFrameEqualizer@Cdl@@QAE@PAVDLDialog@1@@Z
??0DLFrameLifetime@Cdl@@QAE@AAVIMsoAutoLayoutDialog@DlgAutoLayout@@@Z
??0DLGCC@Cdl@@QAE@AAVDLDialog@1@QBH@Z
??0DLGallery@Cdl@@QAE@AAVDLDialog@1@KH@Z
??0DLGalleryBatchModeRestorer@Cdl@@QAE@AAVDLGallery@1@@Z
??0DLGalleryUser@Cdl@@QAE@AAVDLGallery@1@@Z
??0DLGenericControl@Cdl@@QAE@AAVDLDialog@1@K@Z
??0DLGenericFrame2@Cdl@@QAE@AAVDLControl@1@PAVDLCompositeFrame@1@@Z
??0DLGenericFrame@Cdl@@QAE@AAVDLDialog@1@KPAVDLCompositeFrame@1@@Z
??0DLHeader@Cdl@@QAE@AAVDLDialog@1@K@Z
??0DLHeader@Cdl@@QAE@AAVDLDialog@1@KABUtagRECT@@H@Z
??0DLHeader@Cdl@@QAE@AAVDLDialog@1@KABUtagRECT@@KK@Z
??0DLHighlightHook@Cdl@@QAE@XZ
??0DLHorizFrame@Cdl@@QAE@AAVDLDialog@1@PAVDLCompositeFrame@1@@Z
??0DLIAccessible@Cdl@@QAE@AAVELEventFrame@1@@Z
??0DLIAccessibleUser@Cdl@@QAE@AAVDLIAccessible@1@@Z
??0DLIcon@Cdl@@QAE@AAVDLDialog@1@K@Z
??0DLIcon@Cdl@@QAE@AAVDLDialog@1@KABUtagRECT@@_N@Z
??0DLLabelBox@Cdl@@QAE@AAVDLDialog@1@K@Z
??0DLLabelBox@Cdl@@QAE@AAVDLDialog@1@KPB_WABUtagRECT@@H@Z
??0DLLabelBoxFrame@Cdl@@QAE@AAVDLLabelBox@1@PAVDLCompositeFrame@1@@Z
??0DLLabelBoxFrame@Cdl@@QAE@AAVDLLabelLine@1@PAVDLCompositeFrame@1@@Z
??0DLLabelLine@Cdl@@QAE@AAVDLDialog@1@K@Z
??0DLLabelLine@Cdl@@QAE@AAVDLDialog@1@KPB_WABUtagRECT@@H@Z
??0DLLeafFrame@Cdl@@IAE@AAVLeafFrame@DlgAutoLayout@@@Z
??0DLListEdit@Cdl@@QAE@AAVDLDialog@1@K@Z
??0DLListEdit@Cdl@@QAE@AAVDLDialog@1@KPB_WABUtagRECT@@H@Z
??0DLListView@Cdl@@QAE@AAVDLDialog@1@K@Z
??0DLListView@Cdl@@QAE@AAVDLDialog@1@KPB_WABUtagRECT@@H@Z
??0DLListViewUser@Cdl@@QAE@AAVDLListView@1@@Z
??0DLModelessRef@Cdl@@QAE@AAVDLDialog@1@@Z
??0DLNotificationDisabler@Cdl@@QAE@AAVDLDialog@1@_N@Z
??0DLNumInputFrame@Cdl@@QAE@AAVDLNumberInput@1@PAVDLCompositeFrame@1@@Z
??0DLNumberInput@Cdl@@QAE@AAVDLDialog@1@KKJJJJJG_N1@Z
??0DLOverlapFrame@Cdl@@QAE@AAVDLDialog@1@PAVDLCompositeFrame@1@@Z
??0DLPicture@Cdl@@QAE@AAVDLDialog@1@K@Z
??0DLPicture@Cdl@@QAE@AAVDLDialog@1@KABUtagRECT@@H@Z
??0DLProgressBar@Cdl@@QAE@AAVDLDialog@1@K@Z
??0DLProgressBar@Cdl@@QAE@AAVDLDialog@1@KHHH@Z
??0DLPushButton@Cdl@@QAE@AAVDLDialog@1@KPB_WABUtagRECT@@H_N@Z
??0DLPushButton@Cdl@@QAE@AAVDLDialog@1@K_N@Z
??0DLRadioButton@Cdl@@QAE@AAVDLRadioCluster@1@KABUtagRECT@@H@Z
??0DLRadioButton@Cdl@@QAE@AAVDLRadioCluster@1@KH@Z
??0DLRadioCluster@Cdl@@QAE@AAVDLDialog@1@@Z
??0DLRect@Cdl@@QAE@AAVDLDialog@1@KABUtagRECT@@H@Z
??0DLSDMParentSetup@Cdl@@QAE@XZ
??0DLScrollBar@Cdl@@QAE@AAVDLDialog@1@K@Z
??0DLScrollBar@Cdl@@QAE@AAVDLDialog@1@KHHHABUtagRECT@@H@Z
??0DLSpinner@Cdl@@QAE@AAVDLDialog@1@K@Z
??0DLSpinner@Cdl@@QAE@AAVDLDialog@1@KABUtagRECT@@H@Z
??0DLStaticPopup@Cdl@@QAE@AAVDLDialog@1@K@Z
??0DLStaticPopup@Cdl@@QAE@AAVDLDialog@1@KABUtagRECT@@H@Z
??0DLStaticString@Cdl@@QAE@AAVDLDialog@1@K@Z
??0DLStaticString@Cdl@@QAE@AAVDLDialog@1@KPB_WABUtagRECT@@H@Z
??0DLTCIDBitmap@Cdl@@QAE@AAVDLDialog@1@K@Z
??0DLTCIDBitmap@Cdl@@QAE@AAVDLDialog@1@KH@Z
??0DLTTHook@Cdl@@QAE@AAVDLDialog@1@@Z
??0DLTabControl@Cdl@@QAE@AAVDLDialog@1@K@Z
??0DLTabControl@Cdl@@QAE@AAVDLDialog@1@KABUtagRECT@@@Z
??0DLTabCtrlFrame@Cdl@@QAE@AAVDLTabControl@1@PAVDLCompositeFrame@1@@Z
??0DLTabSheet@Cdl@@AAE@AAVDLDialog@1@K@Z
??0DLTabSheet@Cdl@@AAE@AAVDLDialog@1@PB_W@Z
??0DLTableFrame@Cdl@@QAE@AAVDLDialog@1@HHPAVDLCompositeFrame@1@@Z
??0DLTextListBox@Cdl@@QAE@AAVDLDialog@1@KABUtagRECT@@H@Z
??0DLTextListBox@Cdl@@QAE@AAVDLDialog@1@KH@Z
??0DLTextListHelper@Cdl@@QAE@AAVDLControl@1@H@Z
??0DLToggleButton@Cdl@@QAE@AAVDLDialog@1@KABUtagRECT@@H_N@Z
??0DLToggleButton@Cdl@@QAE@AAVDLDialog@1@K_N@Z
??0DLTrackBar@Cdl@@QAE@AAVDLDialog@1@K@Z
??0DLTrackBar@Cdl@@QAE@AAVDLDialog@1@KPB_WHHHABUtagRECT@@H@Z
??0DLTrackBarUser@Cdl@@QAE@AAVDLTrackBar@1@@Z
??0DLTreeView@Cdl@@QAE@AAVDLDialog@1@K@Z
??0DLTreeViewUser@Cdl@@QAE@AAVDLTreeView@1@@Z
??0DLTriStateCheckBox@Cdl@@QAE@AAVDLDialog@1@K@Z
??0DLTriStateCheckBox@Cdl@@QAE@AAVDLDialog@1@KPB_WABUtagRECT@@H@Z
??0DLUICDialog@Cdl@@QAE@AAUICdlContext@1@@Z
??0DLUserButton@Cdl@@QAE@AAVDLDialog@1@KABUtagRECT@@H_N@Z
??0DLUserButton@Cdl@@QAE@AAVDLDialog@1@K_N@Z
??0DLUserControl@Cdl@@QAE@AAVDLDialog@1@KABUtagRECT@@H_N@Z
??0DLUserControl@Cdl@@QAE@AAVDLDialog@1@K_N@Z
??0DLUserControlUser@Cdl@@QAE@AAVDLUserControl@1@@Z
??0DLVertFrame@Cdl@@QAE@AAVDLDialog@1@PAVDLCompositeFrame@1@@Z
??0DLWorkPaneBitmapButton@Cdl@@QAE@AAVDLDialog@1@K@Z
??0DLWorkPaneBitmapButton@Cdl@@QAE@AAVDLDialog@1@KABUtagRECT@@@Z
??0DLWorkPaneButton@Cdl@@IAE@AAVDLDialog@1@K@Z
??0DLWorkPaneButton@Cdl@@IAE@AAVDLDialog@1@KABUtagRECT@@@Z
??0DLWorkPaneDropDownButton@Cdl@@QAE@AAVDLDialog@1@KH@Z
??0DLWorkPaneDropDownButton@Cdl@@QAE@AAVDLDialog@1@KHABUtagRECT@@@Z
??0DLWorkPaneHyperlink@Cdl@@QAE@AAVDLDialog@1@K@Z
??0DLWorkPaneHyperlink@Cdl@@QAE@AAVDLDialog@1@KABUtagRECT@@@Z
??0DLWorkPanePushButton@Cdl@@QAE@AAVDLDialog@1@K@Z
??0DLWorkPanePushButton@Cdl@@QAE@AAVDLDialog@1@KABUtagRECT@@@Z
??0DialogHolder@Cdl@@IAE@AAUICdlContext@1@KKK@Z
??0DialogHolder@Cdl@@IAE@AAUICdlContext@1@PAUHFONT__@@KK@Z
??0DialogHolder@Cdl@@QAE@AAUICdlContext@1@W4DLDialogMode@1@KKW4DLPositioning@1@PAUHWND__@@@Z
??0DialogHolder@Cdl@@QAE@AAUICdlContext@1@W4DLDialogMode@1@KW4DLPositioning@1@PAUHWND__@@PAUHFONT__@@_N@Z
??0DialogHolder@Cdl@@QAE@PAVDLDialog@1@@Z
??0DialogUser@Cdl@@QAE@AAVDLDialog@1@@Z
??0ELCatchAllHook@Cdl@@QAE@XZ
??0ELEventFrame@Cdl@@QAE@AAUICdlContext@1@@Z
??0ELEventHook@Cdl@@QAE@H@Z
??0ELEventHook@Cdl@@QAE@IH@Z
??0ELEventLoopUser@Cdl@@QAE@XZ
??0ELIdleDisabler@Cdl@@QAE@XZ
??0ELIdleHook@Cdl@@QAE@XZ
??0ELMouseLeaveHook@Cdl@@QAE@XZ
??0ELMouseTracker@Cdl@@QAE@AAVELEventFrame@1@_N@Z
??0ELMsoMsgHook@Cdl@@QAE@XZ
??0ELNativePalette@Cdl@@AAE@AAVELEventFrame@1@PAUHPALETTE__@@@Z
??0ELPostTask@Cdl@@IAE@PAVELEventFrame@1@@Z
??0ELPostTask@Cdl@@IAE@XZ
??0LVListView@Cdl@@QAE@PAUHWND__@@@Z
??0LVListViewUser@Cdl@@QAE@AAVLVListView@1@@Z
??0MsoGlobals@Cdl@@QAE@XZ
??0TTHook@Cdl@@QAE@AAUICdlContext@1@@Z
??0TTItem@Cdl@@QAE@XZ
??0TTManager@Cdl@@QAE@XZ
??0TVTreeView@Cdl@@QAE@PAUHWND__@@@Z
??0TVTreeView@Cdl@@QAE@XZ
??0TVTreeViewUser@Cdl@@QAE@AAVTVTreeView@1@@Z
??0UICMsoComponent@Cdl@@QAE@AAUICdlContext@1@@Z
??0WizardHolder@Cdl@@IAE@PAVDLDialog@1@@Z
??0WizardHolder@Cdl@@QAE@AAUICdlContext@1@W4DLDialogMode@1@KKW4DLPositioning@1@PAUHWND__@@@Z
??0WizardHolder@Cdl@@QAE@AAUICdlContext@1@W4DLDialogMode@1@KW4DLPositioning@1@PAUHWND__@@PAUHFONT__@@_N@Z
??0WorkPaneDialogUser@Cdl@@QAE@AAVDLDialog@1@@Z
??0WorkPaneHolder@Cdl@@IAE@PAVDLDialog@1@@Z
??0WorkPaneHolder@Cdl@@QAE@AAUICdlContext@1@KKK@Z
??0WorkPaneHolder@Cdl@@QAE@AAUICdlContext@1@PAUHFONT__@@KK@Z
??1CObjectSafe@Cdl@@UAE@XZ
??1DLAnimation@Cdl@@UAE@XZ
??1DLBitmapButton@Cdl@@UAE@XZ
??1DLCheckBoxList@Cdl@@UAE@XZ
??1DLComboPopup@Cdl@@UAE@XZ
??1DLControl@Cdl@@UAE@XZ
??1DLDialog@Cdl@@UAE@XZ
??1DLDisableUpdatesRestorer@Cdl@@QAE@XZ
??1DLEditPopup@Cdl@@UAE@XZ
??1DLEditString@Cdl@@UAE@XZ
??1DLForeignDialogHelper@Cdl@@UAE@XZ
??1DLFrameLifetime@Cdl@@QAE@XZ
??1DLGCC@Cdl@@UAE@XZ
??1DLGallery@Cdl@@UAE@XZ
??1DLGalleryBatchModeRestorer@Cdl@@QAE@XZ
??1DLGalleryUser@Cdl@@UAE@XZ
??1DLGenericControl@Cdl@@UAE@XZ
??1DLHeader@Cdl@@UAE@XZ
??1DLHighlightHook@Cdl@@UAE@XZ
??1DLIAccessible@Cdl@@UAE@XZ
??1DLIAccessibleUser@Cdl@@UAE@XZ
??1DLIcon@Cdl@@UAE@XZ
??1DLLabelBox@Cdl@@UAE@XZ
??1DLLabelLine@Cdl@@UAE@XZ
??1DLListEdit@Cdl@@UAE@XZ
??1DLListView@Cdl@@UAE@XZ
??1DLListViewUser@Cdl@@UAE@XZ
??1DLModelessRef@Cdl@@QAE@XZ
??1DLNotificationDisabler@Cdl@@QAE@XZ
??1DLNumberInput@Cdl@@UAE@XZ
??1DLPicture@Cdl@@UAE@XZ
??1DLProgressBar@Cdl@@UAE@XZ
??1DLRadioButton@Cdl@@UAE@XZ
??1DLSDMParentSetup@Cdl@@QAE@XZ
??1DLSpinner@Cdl@@UAE@XZ
??1DLStaticPopup@Cdl@@UAE@XZ
??1DLStaticString@Cdl@@UAE@XZ
??1DLTCIDBitmap@Cdl@@UAE@XZ
??1DLTabControl@Cdl@@UAE@XZ
??1DLTabSheet@Cdl@@EAE@XZ
??1DLTextListBox@Cdl@@UAE@XZ
??1DLTextListHelper@Cdl@@QAE@XZ
??1DLToggleButton@Cdl@@UAE@XZ
??1DLTrackBar@Cdl@@UAE@XZ
??1DLTreeView@Cdl@@UAE@XZ
??1DLTreeViewUser@Cdl@@UAE@XZ
??1DLUICDialog@Cdl@@QAE@XZ
??1DLUserButton@Cdl@@UAE@XZ
??1DLUserControl@Cdl@@UAE@XZ
??1DLUserControlUser@Cdl@@UAE@XZ
??1DLWorkPaneButton@Cdl@@MAE@XZ
??1DLWorkPaneDropDownButton@Cdl@@UAE@XZ
??1DialogUser@Cdl@@UAE@XZ
??1ELCatchAllHook@Cdl@@UAE@XZ
??1ELEventFrame@Cdl@@UAE@XZ
??1ELEventHook@Cdl@@UAE@XZ
??1ELIdleDisabler@Cdl@@QAE@XZ
??1ELIdleHook@Cdl@@UAE@XZ
??1ELMouseLeaveHook@Cdl@@UAE@XZ
??1ELMouseTracker@Cdl@@UAE@XZ
??1ELMsoMsgHook@Cdl@@UAE@XZ
??1ELNativePalette@Cdl@@AAE@XZ
??1ELPostTask@Cdl@@MAE@XZ
??1LVListView@Cdl@@UAE@XZ
??1LVListViewUser@Cdl@@UAE@XZ
??1MsoGlobals@Cdl@@QAE@XZ
??1TTHook@Cdl@@UAE@XZ
??1TTItem@Cdl@@QAE@XZ
??1TTManager@Cdl@@QAE@XZ
??1TVTreeView@Cdl@@UAE@XZ
??1TVTreeViewUser@Cdl@@UAE@XZ
??1UICMsoComponent@Cdl@@QAE@XZ
??1WorkPaneDialogUser@Cdl@@UAE@XZ
??2CAllocator@Cdl@@SAPAXI@Z
??3CAllocator@Cdl@@SAXPAX@Z
??6DLCompositeFrame@Cdl@@QAGAAV01@AAVDLFrame@1@@Z
??6DLFrameEqualizer@Cdl@@QAGAAV01@AAVDLFrame@1@@Z
??6DLTableFrame@Cdl@@QAGAAV01@AAVDLFrame@1@@Z
??6DLTableFrame@Cdl@@QAGAAV01@H@Z
??BELEventFrame@Cdl@@QBGPAUHWND__@@XZ
??CMsoGlobals@Cdl@@QBGPBUMSOSG@@XZ
??_FELEventHook@Cdl@@QAEXXZ
??_UCAllocator@Cdl@@SAPAXI@Z
??_VCAllocator@Cdl@@SAXPAX@Z
?AddButton@DLRadioCluster@Cdl@@QAGXAAVDLRadioButton@2@@Z
?AddControl@DLDialog@Cdl@@QAGXAAVDLControl@2@@Z
?AddGroupBox@DLTableFrame@Cdl@@QAGXAAVDLLabelBox@2@HHHH_N@Z
?AddGroupBox@DLTableFrame@Cdl@@QAGXAAVDLLabelLine@2@HHHH_N@Z
?AddItem@DLGallery@Cdl@@QAGHPAX@Z
?AddLeftString@DLLeafFrame@Cdl@@QAGXAAVDLStaticString@2@@Z
?AddRef@DLIAccessible@Cdl@@UAGKXZ
?AddRef@ELEventPump@Cdl@@SGXXZ
?AddRightString@DLLeafFrame@Cdl@@QAGXAAVDLStaticString@2@@Z
?AddString@DLCheckBoxList@Cdl@@QAGHPB_W_N@Z
?AddString@DLEditPopup@Cdl@@QAGHPB_W@Z
?AddString@DLStaticPopup@Cdl@@QAGHPB_W@Z
?AddString@DLTextListBox@Cdl@@QAGHPB_W@Z
?AddString@DLTextListHelper@Cdl@@QAGXPB_W@Z
?AddTabStop@DLTabControl@Cdl@@QAGXPB_WH@Z
?AddToUICList@DLDialog@Cdl@@AAGXXZ
?AddTopString@DLLeafFrame@Cdl@@QAGXAAVDLStaticString@2@@Z
?AdjustHeightToFit@DLStaticString@Cdl@@QAGXXZ
?AdjustLine@DLLabelLine@Cdl@@AAGXXZ
?AdjustPosition@DLSpinner@Cdl@@QAGXXZ
?AfterAChange@DLComboPopup@Cdl@@MAGXXZ
?AfterAChange@DLDialog@Cdl@@EAGXK@Z
?AfterAChange@DLEditString@Cdl@@MAGXXZ
?AfterAChange@DialogUser@Cdl@@MAGXK@Z
?AfterDropdownMenu@DLGalleryUser@Cdl@@MAGXHH@Z
?AfterInit@DLDialog@Cdl@@EAGXXZ
?AfterInit@DialogUser@Cdl@@MAGXXZ
?AfterPressed@DLDialog@Cdl@@EAGXK@Z
?AfterPressed@DLPushButton@Cdl@@EAGXXZ
?AfterPressed@DialogUser@Cdl@@MAGXK@Z
?AfterSelect@DLDialog@Cdl@@EAGXK@Z
?AfterSelect@DLStateButton@Cdl@@EAGXXZ
?AfterSelect@DialogUser@Cdl@@MAGXK@Z
?AfterShow@DLDialog@Cdl@@EAGXXZ
?AfterShow@DialogUser@Cdl@@MAGXXZ
?AlertFont@DLDialog@Cdl@@SGPAUHFONT__@@XZ
?AllocFailure@DLControl@Cdl@@IAGXXZ
?AllocFailure@DLDialog@Cdl@@QAGXXZ
?AppendSheet@DLDialog@Cdl@@IAGXPAVDLTabSheet@2@@Z
?ApproximateRect@DLListView@Cdl@@QBGXAAH0@Z
?ApproximateRect@LVListView@Cdl@@QBGXAAH0@Z
?AttachEditString@DLTextListBox@Cdl@@QAGXPAVDLEditString@2@@Z
?AttachListBox@DLEditString@Cdl@@QAGXPAVDLTextListBox@2@@Z
?AttachNumberInput@DLSpinner@Cdl@@QAGXAAVDLNumberInput@2@@Z
?AutoLayoutDialog@DLDialog@Cdl@@QAGAAVDLAutoLayoutDialog@2@XZ
?AutoLayoutDialog@DLDialog@Cdl@@QBGABVDLAutoLayoutDialog@2@XZ
?AutoLayoutDialogForCtrl@Cdl@@YGAAVDLAutoLayoutDialog@1@AAVDLControl@1@@Z
?BackgroundBrush@DLDialog@Cdl@@QBGPAUHBRUSH__@@XZ
?BackgroundColor@DLDialog@Cdl@@QBGKXZ
?BackgroundColor@DLGallery@Cdl@@IBGKH@Z
?BeforeDropdownMenu@DLGalleryUser@Cdl@@MAGXHH@Z
?BeforeNextEvent@DLWaitForModalsLoopUser@Cdl@@EAGXXZ
?BeforeNextEvent@ELCatchAllHook@Cdl@@UBGXXZ
?BeforeNextEvent@ELEventLoopUser@Cdl@@EAGXXZ
?BeforeNextEvent@RunModalLoopUser@Cdl@@EAGXXZ
?BeforeProcessEvent@ELEventLoopUser@Cdl@@EBGXAAUtagMSG@@@Z
?BeforeRemoveEvent@ELEventLoopUser@Cdl@@EBGXAAUtagMSG@@@Z
?BeforeSheetSelect@DLTabSheet@Cdl@@EAG_NXZ
?BeforeSheetSelect@DialogUser@Cdl@@MAG_NXZ
?BeforeShow@DLDialog@Cdl@@EAGXXZ
?BeforeShow@DialogUser@Cdl@@MAGXXZ
?BeforeUpdate@ELEventFrame@Cdl@@MAGXXZ
?BeginMouseTracking@DLGallery@Cdl@@IAGXXZ
?BindChildPair@DLFlowFrame@Cdl@@QBGXAAVDLFrame@2@@Z
?BindChildPair@DLVertFlowFrame@Cdl@@QBGXAAVDLFrame@2@@Z
?Bitmap@DLWorkPaneButton@Cdl@@QBG_NXZ
?ButtonWidth@DLControl@Cdl@@QBGHH@Z
?CancelTracking@ELMouseLeaveHook@Cdl@@QAGXXZ
?CdlFini@Cdl@@YGXXZ
?CdlInit@Cdl@@YG_NABUInitInfo@1@@Z
?CdlVersion@Cdl@@YGKXZ
?CenterInControl@DLPicture@Cdl@@QAGXXZ
?CheckAccessibility@DLDialog@Cdl@@IBGXXZ
?CheckDefaultButton@DLDialog@Cdl@@QBGXXZ
?CheckHotKeys@DLDialog@Cdl@@IBGXXZ
?CheckMouseOver@DLSpinner@Cdl@@QAGXABUtagPOINT@@@Z
?CheckMouseOver@DLUserButton@Cdl@@QAGXABUtagPOINT@@@Z
?CheckMultipleClick@Cdl@@YGXPAUELMouseEvent@1@_N1@Z
?CheckNow@DLGalleryTTHook@Cdl@@AAGXXZ
?CheckTips@TTManager@Cdl@@IAGXABUtagPOINT@@@Z
?CheckValue@DLControl@Cdl@@UAG_NXZ
?CheckValue@DLEditString@Cdl@@MAG_NXZ
?CheckValues@DLDialog@Cdl@@UAG_NPAVDLPushButton@2@@Z
?CleanupModalRun@DLDialog@Cdl@@QAGXXZ
?CleanupModalRun@DLForeignDialogHelper@Cdl@@AAGXXZ
?CleanupModelessRun@DLDialog@Cdl@@QAGXXZ
?Clear@DLEditPopup@Cdl@@QAGXXZ
?Clear@DLGallery@Cdl@@UAGXXZ
?Clear@DLGalleryTTHook@Cdl@@SGXXZ
?Clear@DLStaticPopup@Cdl@@QAGXXZ
?Clear@DLTTHook@Cdl@@SGXXZ
?Clear@DLTextListBox@Cdl@@UAGXXZ
?Clear@TTManager@Cdl@@IAGXXZ
?ClearFlags@DLGallery@Cdl@@QAGXH@Z
?ClearItemFlags@DLGallery@Cdl@@QAGXHH@Z
?Close@DLAnimation@Cdl@@QAG_NXZ
?Close@DLModelessRef@Cdl@@AAGXXZ
?CloseModeless@UICDialog@Cdl@@SGXAAUICdlContext@2@@Z
?CommitModeless@Cdl@@YGXAAVDialogHolder@1@@Z
?CommitUIModal@Cdl@@YGXAAVDialogHolder@1@@Z
?CommonConstructor@DLDialog@Cdl@@AAGXXZ
?CompositeFramesExpandByDefault@DLAutoLayoutDialog@Cdl@@UBG_NXZ
?ComputeMinSize@DLBitmapButton@Cdl@@UBGXAAH0@Z
?ComputeMinSizeForBitmapBtn@DLAutoLayoutDialog@Cdl@@UBGXPAXAAH1@Z
?ConsumeEvent@Event@ELEventHook@Cdl@@QAGXJ@Z
?ContinueIdle@ELIdleHook@Cdl@@QBG_NXZ
?Control@DLGalleryUser@Cdl@@QBGAAVDLGallery@2@XZ
?Control@DLListViewUser@Cdl@@QBGAAVDLListView@2@XZ
?Control@DLTrackBarUser@Cdl@@QBGAAVDLTrackBar@2@XZ
?Control@DLTreeViewUser@Cdl@@QBGAAVDLTreeView@2@XZ
?Control@DLUserControlUser@Cdl@@QBGAAVDLUserControl@2@XZ
?Control@LVListViewUser@Cdl@@QBGAAVLVListView@2@XZ
?Control@TVTreeViewUser@Cdl@@QBGAAVTVTreeView@2@XZ
?ControlFromPoint@Cdl@@YGPAUHWND__@@PAU2@ABUtagPOINT@@@Z
?ControlList@DLDialog@Cdl@@QBGPAVDLControl@2@XZ
?CreateLine@DLLabelLine@Cdl@@AAGXXZ
?CreateTabControl@DLDialog@Cdl@@QAGXABUtagRECT@@@Z
?CreateTabControl@DLDialog@Cdl@@QAGXK@Z
?CtrlFromPointInPopup@DLEditPopup@Cdl@@SGPAV12@ABUtagPOINT@@@Z
?CtrlFromPointInPopup@DLStaticPopup@Cdl@@SGPAV12@ABUtagPOINT@@@Z
?CtrlID@DLControl@Cdl@@QBGKXZ
?CurrTracker@ELMouseTracker@Cdl@@SGPAV12@XZ
?CurrentSheet@DLDialog@Cdl@@QBGPAVDLTabSheet@2@XZ
?CurrentSheetIndex@DLDialog@Cdl@@QBGHXZ
?DLCHBitmapFromTCID@Cdl@@YG_NPAUHDC__@@HAAVCHBitmap@Ofc@@@Z
?DLDrawBitmapButton@Cdl@@YGXPAUHWND__@@PAUHDC__@@_N22ABUDLBitmapInfo@1@2@Z
?DLDrawDimmedBitmap@Cdl@@YGXPAUHDC__@@ABUtagRECT@@PAUHBITMAP__@@1@Z
?DLDrawDimmedIcon@Cdl@@YGXPAUHDC__@@ABUtagRECT@@PAUHICON__@@@Z
?DLDrawDimmedTransparentBitmap@Cdl@@YGXPAUHDC__@@ABUtagRECT@@KPAUHBITMAP__@@1@Z
?DLDrawFlatTab@Cdl@@YGXPAUHDC__@@AAY04$$CBUtagPOINT@@_NKPB_W@Z
?DLDrawHighlight@Cdl@@YGXPAUHDC__@@ABUtagRECT@@@Z
?DLDrawPopupArrow@Cdl@@YGXPAUHDC__@@ABUtagRECT@@W4DLButtonState@1@_N@Z
?DLDrawPopupFrame@Cdl@@YG?AUtagRECT@@PAUHDC__@@ABU2@W4DLButtonState@1@_N33@Z
?DLDrawTCIDButton@Cdl@@YGXPAUHWND__@@PAUHDC__@@_N22HKABUDLBitmapInfo@1@2@Z
?DLDrawThemedComboBox@Cdl@@YGXPAUHDC__@@ABUtagRECT@@1W4DLButtonState@1@_N33@Z
?DLDrawWPPopupArrow@Cdl@@YGXPAUHDC__@@ABUtagRECT@@W4DLButtonState@1@_N3@Z
?DLDrawWPPopupFrame@Cdl@@YG?AUtagRECT@@PAUHDC__@@ABU2@W4DLButtonState@1@_N333@Z
?DLHdcDrawPatchFrame@Cdl@@YGXPAUHDC__@@ABUtagRECT@@@Z
?DLInsetRect@Cdl@@YGXAAUtagRECT@@HHHH@Z
?DLPopupFrameArrowDimensions@Cdl@@YG?AUtagRECT@@AAU2@_N@Z
?DLSyncTrackNumInput@Cdl@@YGXAAVDLTrackBar@1@AAVDLNumberInput@1@_N@Z
?DLWPPopupFrameArrowDimensions@Cdl@@YG?AUtagRECT@@AAU2@_N@Z
?DeadCount@ELIdleHook@Cdl@@SGHXZ
?DeadModeEnabled@ELIdleHook@Cdl@@SG_NXZ
?Decrement@DLNumberInput@Cdl@@ABGJJ@Z
?DefaultBtnPressed@DLDialog@Cdl@@QBG_NXZ
?DefaultButton@DLDialog@Cdl@@QBGPAVDLPushButton@2@XZ
?DelayKeySelection@DLEditPopup@Cdl@@QAGXXZ
?DelayKeySelection@DLStaticPopup@Cdl@@QAGXXZ
?Delete@UICDialog@Cdl@@SGXAAUICdlContext@2@@Z
?DeleteAllItems@DLListView@Cdl@@QAG_NXZ
?DeleteAllItems@DLTreeView@Cdl@@QAG_NXZ
?DeleteAllItems@LVListView@Cdl@@QAG_NXZ
?DeleteAllItems@TVTreeView@Cdl@@QAG_NXZ
?DeleteCdlContext@Cdl@@YGXPAUICdlContext@1@@Z
?DeleteColumn@DLListView@Cdl@@QAG_NI@Z
?DeleteColumn@LVListView@Cdl@@QAG_NI@Z
?DeleteItem@DLEditPopup@Cdl@@QAG_NH@Z
?DeleteItem@DLGallery@Cdl@@UAG_NH@Z
?DeleteItem@DLHeader@Cdl@@QAG_NI@Z
?DeleteItem@DLListView@Cdl@@QAG_NI@Z
?DeleteItem@DLStaticPopup@Cdl@@QAG_NH@Z
?DeleteItem@DLTextListBox@Cdl@@UAG_NH@Z
?DeleteItem@DLTreeView@Cdl@@QAG_NPAU_TREEITEM@@@Z
?DeleteItem@LVListView@Cdl@@QAG_NI@Z
?DeleteItem@TVTreeView@Cdl@@QAG_NPAU_TREEITEM@@@Z
?DeleteRegistered@ELEventFrame@Cdl@@SGXXZ
?DeleteTabStop@DLTabControl@Cdl@@QAGXH@Z
?DeleteTasks@ELPostTask@Cdl@@CGXPBVELEventFrame@2@@Z
?DeltaPos@DLProgressBar@Cdl@@QAGHH@Z
?DerefDlgPtr@Cdl@@YGAAVDLDialog@1@PAV21@@Z
?Destruct@DLDialog@Cdl@@AAGXXZ
?Dialog@DLControl@Cdl@@QBGAAVDLDialog@2@XZ
?Dialog@DLRadioCluster@Cdl@@QBGAAVDLDialog@2@XZ
?Dialog@DialogUser@Cdl@@QBGAAVDLDialog@2@XZ
?DialogUnitsToPixels@DLDialog@Cdl@@QBGXABUtagRECT@@AAU3@@Z
?DisableAutoLayouting@DLDialog@Cdl@@QAGXXZ
?DisableIME@DLEditString@Cdl@@QAGXXZ
?DisableIdleTimeCheck@ELIdleHook@Cdl@@SGXXZ
?DisableTheming@DLDialog@Cdl@@QAGX_N@Z
?DispatchMsg@DLCheckBox@Cdl@@UAGJIIJ@Z
?DispatchMsg@DLControl@Cdl@@EAGJIIJ@Z
?DispatchMsg@DLDialog@Cdl@@UAGJIIJ@Z
?DispatchMsg@DLEditPopup@Cdl@@MAGJIIJ@Z
?DispatchMsg@DLEditString@Cdl@@MAGJIIJ@Z
?DispatchMsg@DLHeader@Cdl@@MAGJIIJ@Z
?DispatchMsg@DLListView@Cdl@@MAGJIIJ@Z
?DispatchMsg@DLPushButton@Cdl@@MAGJIIJ@Z
?DispatchMsg@DLRadioButton@Cdl@@MAGJIIJ@Z
?DispatchMsg@DLScrollBar@Cdl@@EAGJIIJ@Z
?DispatchMsg@DLStaticPopup@Cdl@@EAGJIIJ@Z
?DispatchMsg@DLTabControl@Cdl@@MAGJIIJ@Z
?DispatchMsg@DLTabSheet@Cdl@@UAGJIIJ@Z
?DispatchMsg@DLTextListBox@Cdl@@MAGJIIJ@Z
?DispatchMsg@DLTrackBar@Cdl@@EAGJIIJ@Z
?DispatchMsg@DLTreeView@Cdl@@MAGJIIJ@Z
?DispatchMsg@DLTriStateCheckBox@Cdl@@EAGJIIJ@Z
?DispatchMsg@DLUserButton@Cdl@@MAGJIIJ@Z
?DispatchMsg@ELEventFrame@Cdl@@UAGJIIJ@Z
?DispatchMsg@LVListView@Cdl@@UAGJIIJ@Z
?DispatchMsg@TVTreeView@Cdl@@UAGJIIJ@Z
?DoAfterAChange@DLDialog@Cdl@@QAGXK@Z
?DoAfterAChange@DLEditString@Cdl@@MAGXXZ
?DoAfterInit@DLDialog@Cdl@@QAGXXZ
?DoAfterPressed@DLDialog@Cdl@@QAGXK@Z
?DoAfterPressed@DLPushButton@Cdl@@MAGXXZ
?DoAfterPressed@DLToggleButton@Cdl@@UAGXXZ
?DoAfterPressed@DLWorkPaneDropDownButton@Cdl@@MAGXXZ
?DoAfterSelect@DLDialog@Cdl@@QAGXK@Z
?DoAfterSelect@DLStateButton@Cdl@@MAGXXZ
?DoBeforeSheetSelect@DLTabSheet@Cdl@@MAG_NXZ
?DoButton@ELMouseTracker@Cdl@@AAG_NABUtagMSG@@H_N@Z
?DoEvent@Cdl@@YG_NAAUtagMSG@@@Z
?DoIdle@Cdl@@YGXXZ
?DoKey@DLTextListBox@Cdl@@QAGXG@Z
?DoNativeEvent@ELMouseTracker@Cdl@@AAG_NABUtagMSG@@@Z
?DoOnActivate@DLDialog@Cdl@@QAGX_N@Z
?DoOnAutoLayout@DLDialog@Cdl@@QAGXABUtagPOINT@@@Z
?DoOnAutoLayout@DLDialog@Cdl@@QAGXXZ
?DoOnCheckValues@DLDialog@Cdl@@QAG_NXZ
?DoOnCloseup@DLEditPopup@Cdl@@MAGXXZ
?DoOnCloseup@DLStaticPopup@Cdl@@MAGXXZ
?DoOnDoubleClick@DLCheckBoxList@Cdl@@MAGXXZ
?DoOnDoubleClick@DLRadioButton@Cdl@@MAGXXZ
?DoOnDoubleClick@DLTextListBox@Cdl@@MAGXXZ
?DoOnEraseBkgnd@DLDialog@Cdl@@QAG_NXZ
?DoOnFocus@DLDialog@Cdl@@QAGXK_N@Z
?DoOnIdle@DLDialog@Cdl@@QAGXH@Z
?DoOnIdle@ELIdleHook@Cdl@@SGXXZ
?DoOnIdleModeChange@ELIdleHook@Cdl@@CGXW4ELIdleModeType@2@@Z
?DoOnKeyDown@DLEditString@Cdl@@MAG_NG@Z
?DoOnKeyDown@DLNumberInput@Cdl@@MAG_NG@Z
?DoOnKillFocus@DLComboPopup@Cdl@@MAGXXZ
?DoOnKillFocus@DLControl@Cdl@@MAGXXZ
?DoOnKillFocus@DLNumberInput@Cdl@@MAGXXZ
?DoOnKillFocus@DLSpinner@Cdl@@MAGXXZ
?DoOnKillFocus@DLUserButton@Cdl@@MAGXXZ
?DoOnPopup@DLEditPopup@Cdl@@MAGXXZ
?DoOnPopup@DLStaticPopup@Cdl@@MAGXXZ
?DoOnRequestResize@DLEditString@Cdl@@MAGXAAUtagRECT@@@Z
?DoOnSelectionChange@DLDialog@Cdl@@QAGXK@Z
?DoOnSelectionChange@DLEditPopup@Cdl@@MAGXXZ
?DoOnSelectionChange@DLEditString@Cdl@@MAGXXZ
?DoOnSelectionChange@DLGallery@Cdl@@MAGXXZ
?DoOnSelectionChange@DLStaticPopup@Cdl@@MAGXXZ
?DoOnSelectionChange@DLTextListBox@Cdl@@MAGXXZ
?DoOnSetFocus@DLComboPopup@Cdl@@MAGXXZ
?DoOnSetFocus@DLControl@Cdl@@MAGXXZ
?DoOnSetFocus@DLNumberInput@Cdl@@MAGXXZ
?DoOnSetFocus@DLSpinner@Cdl@@MAGXXZ
?DoOnSetFocus@DLUserButton@Cdl@@MAGXXZ
?DoOnSheetSelect@DLTabSheet@Cdl@@IAGX_N@Z
?DoOnShow@DLDialog@Cdl@@QAGX_N@Z
?DoOnShowHelper@DLDialog@Cdl@@AAGX_N@Z

Sections

.text
Size: 344KB - Virtual size: 343KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/CLVIEW.EXE
.exe windows x86

2df4ecb40420afec4eac2bb2788cf4cb

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

af:58:f8:1c:0b:48:33:be:f8:97:fa:96:0d:1a:d7:66:2e:16:f3:07
Signer

Actual PE Digest

af:58:f8:1c:0b:48:33:be:f8:97:fa:96:0d:1a:d7:66:2e:16:f3:07

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

14/02/2013, 15:21
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

CreateSolidBrush
DeleteObject

kernel32

RaiseException
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
SetLastError
MulDiv
GetCommandLineW
FreeLibrary
InitializeCriticalSection
DeleteCriticalSection
lstrlenW
GetLastError
GetProcAddress
GetModuleHandleW
lstrcmpiW
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
CloseHandle
WriteFile
ReadFile
GetFileSize
DeleteFileW
MoveFileExW
GlobalUnlock
GlobalLock
GlobalAlloc
LocalFree
GetUserDefaultLCID
lstrlenA
CreateThread
FindClose
FindFirstFileW
GetLongPathNameW
WaitForSingleObject
ReleaseMutex
CreateMutexW
WideCharToMultiByte
CreateProcessW
ProcessIdToSessionId
GetCurrentProcessId
LocalAlloc
RtlCaptureStackBackTrace
GetModuleHandleExW
GetVersionExA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
InterlockedExchange
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
VirtualProtect
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
LoadLibraryA
FormatMessageA
GetSystemDirectoryW
LoadLibraryW
Sleep
TlsGetValue

user32

TrackPopupMenu
GetMenuStringW
ModifyMenuW
CreatePopupMenu
AppendMenuW
AdjustWindowRect
MessageBeep
FindWindowExW
GetClassNameW
OpenClipboard
EmptyClipboard
SetClipboardData
GetCursorPos
InflateRect
FrameRect
CloseClipboard
KillTimer
MessageBoxA
GetKeyState
SetWindowLongW
GetWindowLongW
SendMessageW
GetClientRect
ShowWindow
GetClassInfoExW
LoadCursorW
CallWindowProcW
CharNextW
SetTimer
MapVirtualKeyW
DestroyIcon
GetWindowPlacement
SetWindowPlacement
SetWindowTextW
MessageBoxW
PostMessageW
GetSystemMetrics
GetTopWindow
GetForegroundWindow
BringWindowToTop
GetWindow
EnumWindows
SendMessageTimeoutW
GetParent
MonitorFromWindow
GetMonitorInfoW
SetWindowPos
SystemParametersInfoW
IsWindowVisible
GetWindowRect
LoadIconW
MapWindowPoints
CopyRect
DestroyWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
UnregisterClassA

msocf

?CreateTheApp@Frame@MsoCF@@YGXAAUCreateTheAppArgs@12@@Z
?TheApp@Frame@MsoCF@@YGPAUAFrameApp@2@XZ
?TerminateTheApp@Frame@MsoCF@@YGXXZ
?Finish@Frame@MsoCF@@YGXXZ
?Finish@Utilities@MsoCF@@YGXXZ
??0CToolbarData@MsoCF@@QAE@XZ
?Init@CToolbarData@MsoCF@@QAGXPBUStaticToolbarDesc@2@IPBUStaticMenuDesc@2@I@Z
?Start@Utilities@MsoCF@@YGXHPAU_msotcfcf@@@Z
?Start@Frame@MsoCF@@YGXXZ
?g_FixedBufferAllocator@MsoCF@@3VCFixedBufferAllocator@1@A
?SetWzFromNumber@Strings@MsoCF@@YGXAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@IHHPAH@Z
?g_FastBufferAllocator@MsoCF@@3VCFastBufferAllocator@1@A
?AppendArrayOfCharactersToWz@Strings@MsoCF@@YGXPB_WHAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@PAH@Z
?SetWzFromResource@Strings@MsoCF@@YGXAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@PAUHINSTANCE__@@IPAH@Z
?CreateActionManager@MsoCF@@YGXPAPAUIActionManager@1@@Z
??1CToolbarData@MsoCF@@QAE@XZ
?SetWtzFromPattern@Strings@MsoCF@@YGXAAV?$CWtzInBuffer_Template@V?$CBuffer@_W@MsoCF@@@2@PAUHINSTANCE__@@IQAPB_WH@Z
?SetWzFromPattern@Strings@MsoCF@@YGXAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@PAUHINSTANCE__@@IQAPB_WHPAH@Z
?TheActionManager@MsoCF@@YGPAUIActionManager@1@XZ
?Set@Properties@MsoCF@@YGXPAUIPropertySet@2@ABUPropertyInfo@2@PBXW4PropertyType@2@@Z
?LookupProperty@MsoCF@@YGABUPropertyInfo@1@I@Z
?FGet@Properties@MsoCF@@YG_NPAUIPropertySet@2@PBUPropertyInfo@2@PAXHW4PropertyType@2@@Z
?FreeAndZero_ComplexType@CPropertyData@MsoCF@@SGXPAXW4PropertyType@2@@Z
?ProduceAtom@MsoCF@@YGXPAPAVIAtom@1@PBXH@Z
?GetProperty@IPropertySet@MsoCF@@QAGXABUPropertyInfo@2@PAVCPropertyValue@2@@Z
?RegisterPropertySpace@MsoCF@@YGXPBUPropertySpaceInfo@1@@Z
?Free@Allocator@Memory@MsoCF@@YGXPAX@Z

msvcr90

_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_crt_debugger_hook
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
??3@YAXPAX@Z
??_V@YAXPAX@Z
__CxxFrameHandler3
_CxxThrowException
swprintf_s
wcsncpy_s
??_U@YAPAXI@Z
memset
_recalloc
??2@YAPAXI@Z
wcsstr
malloc
free
memcpy_s
_vsnwprintf_s
_vsnprintf_s
memcpy
wcschr
_snwprintf_s
_wtoi
wcsrchr
_wcsdup
_wtol
_mbsstr
strncpy_s
vswprintf_s
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e

oleaut32

VariantClear
VariantInit
SysAllocString
SafeArrayGetLBound
SafeArrayGetElement
SafeArrayDestroyData
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
VariantChangeType
VarUI4FromStr
SysFreeString

shlwapi

PathCreateFromUrlW
AssocQueryStringW

shell32

SHFileOperationW
CommandLineToArgvW

wininet

InternetErrorDlg
HttpQueryInfoW
InternetOpenW
InternetReadFile
InternetCloseHandle
InternetOpenUrlW

urlmon

URLDownloadToFileW
ObtainUserAgentString

Sections

.text
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/CSS7DATA0009.DLL
.dll windows x86

417c1fd810bff13d1542b458aa9eae51

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

78:f1:48:7c:d7:1b:31:04:72:61:07:a8:09:67:66:58:23:1a:87:56
Signer

Actual PE Digest

78:f1:48:7c:d7:1b:31:04:72:61:07:a8:09:67:66:58:23:1a:87:56

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

30/03/2010, 04:49
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

strncmp
__CxxFrameHandler3
malloc
free
memset
_vsnwprintf
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
_crt_debugger_hook
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
_wsplitpath_s
memcpy
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_resetstkoflw
__iob_func
swscanf_s
_CxxThrowException
_fileno
_isatty
wcsncat_s
fread
ftell
fseek
fclose
_wfopen_s
_itoa_s
_itow_s
atoi
wcsncmp
_CIlog
_CIexp
memmove
wcschr
wcsncpy_s
realloc

oleaut32

SysStringByteLen
SysAllocStringByteLen
VariantCopy
SysFreeString
SysAllocString
VariantInit
VariantChangeType
VariantClear
SetErrorInfo
CreateErrorInfo

kernel32

GetFileSize
GetLocaleInfoA
WideCharToMultiByte
SetEndOfFile
ReadFile
GetFileInformationByHandle
FlushFileBuffers
SetFilePointer
WriteFile
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualProtect
GetModuleFileNameW
LoadLibraryW
GetCurrentThreadId
FormatMessageW
GetTimeZoneInformation
GetLocalTime
FindResourceW
LoadResource
LockResource
SizeofResource
CreateFileW
CreateFileMappingW
MapViewOfFile
MultiByteToWideChar
UnmapViewOfFile
CloseHandle
GetProcAddress
FreeLibrary
DisableThreadLibraryCalls
LeaveCriticalSection
DeleteCriticalSection
GetLastError
InitializeCriticalSectionAndSpinCount
SetLastError
LocalFree
EnterCriticalSection

Exports

Exports

NlsLangDataCall

Sections

.text
Size: 459KB - Virtual size: 458KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/ContactPicker.dll
.dll regsvr32 windows x86

14e0311a2cf7d6e8e871a5c043ab52f5

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:02:8e:42:00:00:00:00:00:1f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:cd:9f:50:72:75:bd:07:ad:38:bf:cc:a3:74:f5:e0:bd:8f:00:32
Signer

Actual PE Digest

52:cd:9f:50:72:75:bd:07:ad:38:bf:cc:a3:74:f5:e0:bd:8f:00:32

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

14/02/2013, 15:16
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mso

ord8209
ord8447
ord8058
ord1064
ord3084
ord474
ord6019
ord10271
ord1511
ord10110
ord1476
ord4910
ord6829
ord563
ord3826
ord10350
ord1640
ord5105
ord4879
ord8354
ord6445
ord9526
ord2064
ord6435
ord3920
ord6230
ord10293
ord6035
ord6913
ord10503
ord3611
ord4675
ord8365
ord10031
ord124
ord7450
ord1395
ord128
ord3408
ord1880
ord3819
ord1890
ord1449
ord7657
ord903
ord5082
ord9139
ord5118
ord1672
ord5098
ord2055
ord6160
ord9129
ord2208
ord163
ord5674
ord5751

msvcr90

__CppXcptFilter
_itow_s
wcscat_s
wcsncpy_s
wcscpy_s
malloc
wcsstr
memcpy
??2@YAPAXI@Z
calloc
free
memcpy_s
_CxxThrowException
memmove_s
??_V@YAXPAX@Z
??3@YAXPAX@Z
memset
_vscwprintf
vswprintf_s
wcsnlen
??_U@YAPAXI@Z
_recalloc
iswspace
wcsspn
wcscspn
_resetstkoflw
wcstol
_wcsicmp
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
__CxxFrameHandler3
_crt_debugger_hook
__clean_type_info_names_internal
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
swprintf_s

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
HeapAlloc
HeapFree
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
RtlCaptureStackBackTrace
GetModuleHandleExW
GetVersionExA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapSize
HeapReAlloc
HeapDestroy
QueryPerformanceCounter
VirtualProtect
CloseHandle
CreateEventW
ResetEvent
WaitForSingleObject
SetEvent
GlobalAlloc
GlobalSize
GlobalLock
GlobalUnlock
lstrlenA
FindResourceExW
LockResource
lstrcmpW
LoadLibraryA
GetThreadLocale
SetThreadLocale
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
GetCurrentThreadId
LoadLibraryExW
FreeLibrary
OutputDebugStringA
GetModuleFileNameW
SetLastError
LoadLibraryW
MulDiv
GetCurrentProcess
FlushInstructionCache
RaiseException
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
lstrlenW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
lstrcmpiW

user32

GetSysColor
FillRect
LoadAcceleratorsW
SystemParametersInfoW
InflateRect
DestroyAcceleratorTable
ClientToScreen
GetDC
SetCursor
GetCaretPos
MessageBoxW
TrackMouseEvent
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
AdjustWindowRectEx
IsWindowEnabled
MapWindowPoints
ScreenToClient
RegisterClipboardFormatW
SetWindowPos
MoveWindow
SetWindowTextW
GetWindow
TranslateAcceleratorW
CharLowerBuffW
InvalidateRect
GetKeyState
GetFocus
IsChild
SetFocus
DestroyWindow
CreateWindowExW
GetClassInfoExW
UnregisterClassA
RegisterClassExW
UnregisterClassW
RegisterClassW
DefWindowProcW
CallWindowProcW
BeginPaint
CheckDlgButton
GetDlgItemInt
IsDlgButtonChecked
PostMessageW
SendMessageW
PtInRect
UnionRect
SetWindowLongW
GetWindowLongW
ShowWindow
GetParent
IsWindow
LoadCursorW
ReleaseDC
GetActiveWindow
WinHelpW
IsDialogMessageW
GetDlgItem
EnableWindow
GetSystemMetrics
CreateDialogParamW
GetDialogBaseUnits
SetParent
SetDlgItemInt
GetWindowRect
GetClientRect
EndPaint
SendDlgItemMessageW
CharNextW

gdi32

Rectangle
SetTextColor
SetDCBrushColor
SetDCPenColor
SetWindowExtEx
GetObjectType
GetTextColor
GetTextExtentPointW
SetViewportExtEx
GetObjectW
SetTextAlign
SelectObject
GetTextMetricsW
CombineRgn
SelectClipRgn
OffsetWindowOrgEx
DeleteObject
CreateRectRgnIndirect
CreateFontIndirectW
LPtoDP
SaveDC
SetMapMode
SetWindowOrgEx
SetViewportOrgEx
DeleteDC
RestoreDC
CreateDCW
GetStockObject
GetDeviceCaps

advapi32

RegisterTraceGuidsA
TraceEvent
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegQueryValueExW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExA

ole32

CoCreateInstance
ReleaseStgMedium
CoCreateGuid
OleGetClipboard
CreateOleAdviseHolder
OleRegGetMiscStatus
OleRegGetUserType
OleRegEnumVerbs
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2

oleaut32

SysStringLen
OleCreateFontIndirect
SysStringByteLen
SysAllocStringByteLen
OleTranslateColor
VarBstrCmp
SysAllocStringLen
VarBstrCat
VariantChangeType
OleCreatePropertyFrame
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
DispCallFunc
LoadTypeLi
SysAllocString
VariantClear
VariantInit
SysFreeString

shlwapi

PathFindFileNameW

uxtheme

GetThemeSysFont

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/DBGHELP.DLL
.dll windows x86

3f5a00ef2a36f3cd8924690a5a1d6f3c

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:27:81:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/10/2008, 21:24

Not After

22/01/2010, 21:34

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

2c:60:39:ea:22:12:68:2c:86:88:cd:43:0f:e3:68:bf:49:78:c7:f3
Signer

Actual PE Digest

2c:60:39:ea:22:12:68:2c:86:88:cd:43:0f:e3:68:bf:49:78:c7:f3

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/01/2009, 00:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_isatty
_write
_lseeki64
??3@YAXPAX@Z
_fileno
_read
__pioinfo
__badioinfo
ferror
wctomb
_snprintf
isleadbyte
mbtowc
_onexit
_lock
__dllonexit
_unlock
_ismbblead
_amsg_exit
_initterm
_XcptFilter
memmove
_iob
__mb_cur_max
strchr
_vsnwprintf
_errno
__CxxFrameHandler
iswspace
calloc
_itoa
_wcsdup
towlower
tolower
_wcslwr
time
_wctime
_ltoa
_wcsnicmp
_purecall
ctime
malloc
strncmp
isspace
_stricmp
_strlwr
free
wcsrchr
strstr
memcpy
_wcsicmp
qsort
wcschr
wcsstr
wcsncmp
iswxdigit
memset
??2@YAPAXI@Z
iswprint
atol
fclose
__unDName
iswdigit
_CxxThrowException
bsearch
_wfsopen
fread
fseek
wcstol
_wfullpath
_wgetenv
_get_osfhandle
_chsize
_close
_open_osfhandle
ftell
_memicmp
_mbscmp
??1type_info@@UAE@XZ
_wsopen

kernel32

HeapReAlloc
MapViewOfFileEx
GetCurrentDirectoryW
InitializeCriticalSectionAndSpinCount
GetFileType
DeviceIoControl
SetFileAttributesW
CreateFileMappingW
InterlockedIncrement
InterlockedDecrement
LocalFree
FormatMessageW
DelayLoadFailureHook
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedExchange
GetThreadSelectorEntry
CreateThread
TerminateThread
VirtualQueryEx
GetPriorityClass
GetThreadPriority
GetThreadTimes
GetThreadContext
ResumeThread
SuspendThread
GetCurrentThreadId
GetSystemTimeAsFileTime
Sleep
GetVersion
GetSystemInfo
LoadLibraryExA
InterlockedCompareExchange
ReadProcessMemory
GetProcessHeap
GetFileAttributesA
SetErrorMode
WriteFile
OutputDebugStringA
VirtualFree
OpenProcess
GetCurrentProcessId
GetModuleHandleA
CreateFileMappingA
MapViewOfFile
DuplicateHandle
VirtualAlloc
VirtualProtect
CreateDirectoryA
UnmapViewOfFile
GetCurrentProcess
SetFilePointer
IsDBCSLeadByte
HeapFree
HeapAlloc
GetVersionExA
InitializeCriticalSection
HeapCreate
HeapDestroy
FindClose
LocalAlloc
SetLastError
LeaveCriticalSection
EnterCriticalSection
CloseHandle
ReadFile
GetFileSize
CreateFileA
GetLastError
TlsSetValue
TlsGetValue
FreeLibrary
LoadLibraryA
TlsAlloc
TlsFree
DeleteCriticalSection
FlushViewOfFile

Exports

Exports

DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
EnumDirTree
EnumDirTreeW
EnumerateLoadedModules
EnumerateLoadedModules64
EnumerateLoadedModulesEx
EnumerateLoadedModulesExW
EnumerateLoadedModulesW64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindDebugInfoFileExW
FindExecutableImage
FindExecutableImageEx
FindExecutableImageExW
FindFileInPath
FindFileInSearchPath
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MapDebugInformation
MiniDumpReadDumpStream
MiniDumpWriteDump
SearchTreeForFile
SearchTreeForFileW
StackWalk
StackWalk64
SymAddSourceStream
SymAddSourceStreamA
SymAddSourceStreamW
SymAddSymbol
SymAddSymbolW
SymCleanup
SymDeleteSymbol
SymDeleteSymbolW
SymEnumLines
SymEnumLinesW
SymEnumProcesses
SymEnumSourceFileTokens
SymEnumSourceFiles
SymEnumSourceFilesW
SymEnumSourceLines
SymEnumSourceLinesW
SymEnumSym
SymEnumSymbols
SymEnumSymbolsForAddr
SymEnumSymbolsForAddrW
SymEnumSymbolsW
SymEnumTypes
SymEnumTypesByName
SymEnumTypesByNameW
SymEnumTypesW
SymEnumerateModules
SymEnumerateModules64
SymEnumerateModulesW64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindDebugInfoFile
SymFindDebugInfoFileW
SymFindExecutableImage
SymFindExecutableImageW
SymFindFileInPath
SymFindFileInPathW
SymFromAddr
SymFromAddrW
SymFromIndex
SymFromIndexW
SymFromName
SymFromNameW
SymFromToken
SymFromTokenW
SymFunctionTableAccess
SymFunctionTableAccess64
SymGetFileLineOffsets64
SymGetHomeDirectory
SymGetHomeDirectoryW
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromAddrW64
SymGetLineFromName
SymGetLineFromName64
SymGetLineFromNameW64
SymGetLineNext
SymGetLineNext64
SymGetLineNextW64
SymGetLinePrev
SymGetLinePrev64
SymGetLinePrevW64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOmapBlockBase
SymGetOmaps
SymGetOptions
SymGetScope
SymGetScopeW
SymGetSearchPath
SymGetSearchPathW
SymGetSourceFile
SymGetSourceFileFromToken
SymGetSourceFileFromTokenW
SymGetSourceFileToken
SymGetSourceFileTokenW
SymGetSourceFileW
SymGetSourceVarFromToken
SymGetSourceVarFromTokenW
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetSymbolFile
SymGetSymbolFileW
SymGetTypeFromName
SymGetTypeFromNameW
SymGetTypeInfo
SymGetTypeInfoEx
SymGetUnwindInfo
SymInitialize
SymInitializeW
SymLoadModule
SymLoadModule64
SymLoadModuleEx
SymLoadModuleExW
SymMatchFileName
SymMatchFileNameW
SymMatchString
SymMatchStringA
SymMatchStringW
SymNext
SymNextW
SymPrev
SymPrevW
SymRefreshModuleList
SymRegisterCallback
SymRegisterCallback64
SymRegisterCallbackW64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymSearch
SymSearchW
SymSetContext
SymSetHomeDirectory
SymSetHomeDirectoryW
SymSetOptions
SymSetParentWindow
SymSetScopeFromAddr
SymSetScopeFromIndex
SymSetSearchPath
SymSetSearchPathW
SymSrvDeltaName
SymSrvDeltaNameW
SymSrvGetFileIndexInfo
SymSrvGetFileIndexInfoW
SymSrvGetFileIndexString
SymSrvGetFileIndexStringW
SymSrvGetFileIndexes
SymSrvGetFileIndexesW
SymSrvGetSupplement
SymSrvGetSupplementW
SymSrvIsStore
SymSrvIsStoreW
SymSrvStoreFile
SymSrvStoreFileW
SymSrvStoreSupplement
SymSrvStoreSupplementW
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnDecorateSymbolNameW
UnmapDebugInformation
WinDbgExtensionDllInit
block
chksym
dbghelp
dh
fptr
homedir
itoldyouso
lmi
lminfo
omap
srcfiles
stack_force_ebp
stackdbg
sym
symsrv
vc7fpo

Sections

.text
Size: 979KB - Virtual size: 979KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/EAWFCTRL.DLL
.dll regsvr32 windows x86

33c0534d9afc135d7bed6c10b3d93e9c

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:02:8e:42:00:00:00:00:00:1f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8f:df:20:95:27:1a:91:6d:c2:02:ea:3b:fb:6b:3a:40:f0:c4:19:4e
Signer

Actual PE Digest

8f:df:20:95:27:1a:91:6d:c2:02:ea:3b:fb:6b:3a:40:f0:c4:19:4e

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/10/2012, 12:40
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
RegQueryValueExW

gdi32

CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
CreateSolidBrush
GetObjectW
GetStockObject
TextOutW
SetTextAlign
CreateRectRgnIndirect
DeleteMetaFile
CloseMetaFile
RestoreDC
SetWindowExtEx
SetWindowOrgEx
SaveDC
CreateMetaFileW
CreateDCW
SetViewportOrgEx
SetMapMode
LPtoDP
DeleteObject
GetDeviceCaps
DeleteDC
SelectObject

kernel32

RaiseException
GetLastError
EnterCriticalSection
LeaveCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
FlushInstructionCache
GetCurrentProcess
GlobalAlloc
SetLastError
GetModuleFileNameW
OutputDebugStringA
MultiByteToWideChar
lstrlenA
GetCurrentThreadId
MulDiv
GetVersionExW
lstrcmpW
lstrlenW
GlobalLock
GlobalFree
GlobalHandle
InitializeCriticalSection
DeleteCriticalSection
lstrcmpiW
GetTickCount
LoadLibraryExW
FreeLibrary
SetEvent
WaitForSingleObject
ResetEvent
CreateEventW
CloseHandle
SetThreadLocale
GetThreadLocale
InterlockedCompareExchange
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
HeapDestroy
HeapReAlloc
HeapSize
GetVersion
GetFileAttributesW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
Sleep
InterlockedExchange
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
VirtualProtect
GetProcAddress
GetModuleHandleW
LoadLibraryW
GetModuleHandleA
LoadLibraryA
GlobalUnlock

ole32

ReadClassStm
OleSaveToStream
WriteClassStm
CreateDataAdviseHolder
OleRegGetMiscStatus
OleRegGetUserType
OleRegEnumVerbs
CreateOleAdviseHolder
CoTaskMemFree
CoTaskMemRealloc
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
CoCreateInstance
OleLockRunning
StringFromGUID2

oleaut32

SysAllocStringLen
VarBstrCmp
SysAllocString
SysAllocStringByteLen
SysStringByteLen
VariantInit
VariantClear
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
VarBstrCat
VariantChangeType
VarUI4FromStr
OleCreatePropertyFrame
UnRegisterTypeLi
RegisterTypeLi
SysStringLen
SysFreeString

shlwapi

PathFindFileNameW

user32

MessageBoxW
GetKeyState
UnionRect
PtInRect
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
DestroyIcon
UpdateWindow
GetMessagePos
GetActiveWindow
RegisterWindowMessageW
LockWindowUpdate
CreateAcceleratorTableW
LoadCursorW
DestroyAcceleratorTable
IsWindow
GetFocus
GetDesktopWindow
BeginPaint
EndPaint
CharNextW
FillRect
ReleaseCapture
GetClassNameW
IsChild
SetCapture
RedrawWindow
InvalidateRgn
ClientToScreen
MoveWindow
UnregisterClassA
MapDialogRect
SetWindowContextHelpId
GetWindow
GetSysColor
SetCursor
DefWindowProcW
DialogBoxIndirectParamW
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
EndDialog
GetDC
ReleaseDC
GetDlgItem
SetWindowLongW
GetParent
SendDlgItemMessageW
CheckRadioButton
SetFocus
EnableWindow
IsWindowVisible
ShowWindow
InvalidateRect
ScreenToClient
GetClientRect
GetWindowRect
SetWindowPos
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
SendMessageW
GetWindowLongW
DestroyWindow
SetParent

imm32

ImmNotifyIME
ImmGetContext
ImmReleaseContext

msvcr90

_encode_pointer
??_V@YAXPAX@Z
free
memcpy_s
malloc
_CxxThrowException
memmove_s
wcscpy_s
wcscat_s
__RTDynamicCast
memset
iswspace
wcsstr
_wcslwr_s
_vscwprintf
vswprintf_s
wcsnlen
calloc
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
??3@YAXPAX@Z
memcpy
wcscspn
wcsspn
qsort
_itow_s
wcsncpy_s
swprintf_s
??2@YAPAXI@Z
_wtoi
??_U@YAPAXI@Z
__CxxFrameHandler3
_resetstkoflw
_recalloc

mso

ord1449
ord1798
ord6160
ord286
ord6913
ord6035
ord5098
ord3611
ord6620
ord4675
ord8365
ord10031
ord5868
ord124
ord7450
ord4673
ord3266
ord4670
ord5751
ord903
ord3819
ord1880
ord1890
ord7657

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 257KB - Virtual size: 256KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/EXCEL.EXE
.exe windows x86

85d0e8c0eb73c0cff6421f87d00875de

Code Sign

33:00:00:01:7f:bd:b8:af:e4:9e:45:0c:a7:00:00:00:00:01:7f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2020, 17:25

Not After

01/04/2021, 17:25

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:F77F-E356-5BAE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:fa:fc:1e:0a:0b:f8:7f:37:9a:00:02:00:00:01:fa
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/07/2020, 18:30

Not After

25/04/2021, 18:30

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:04:35:45:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

20/09/2018, 17:42

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:e0:71:73:24:ca:5c:98:f8:19:00:00:00:00:01:e0
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5a:3d:17:b3:ec:8f:b8:5f:48:84:f6:51:71:4d:6c:2f:a4:ae:3b:de:e1:ff:4e:b0:d0:41:12:2d:6a:29:b8:9a
Signer

Actual PE Digest

5a:3d:17:b3:ec:8f:b8:5f:48:84:f6:51:71:4d:6c:2f:a4:ae:3b:de:e1:ff:4e:b0:d0:41:12:2d:6a:29:b8:9a

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

1f:1d:8c:10:60:1c:d8:77:1c:18:47:1f:b4:cf:db:16:3e:6c:80:54
Signer

Actual PE Digest

1f:1d:8c:10:60:1c:d8:77:1c:18:47:1f:b4:cf:db:16:3e:6c:80:54

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

16/03/2021, 01:54
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
OpenProcessToken
MakeSelfRelativeSD
InitializeSecurityDescriptor
AllocateAndInitializeSid
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
InitializeAcl
SetSecurityDescriptorDacl
GetPrivateObjectSecurity
SetPrivateObjectSecurity
GetSecurityDescriptorLength
MapGenericMask
GetSecurityDescriptorDacl
GetAclInformation
LookupAccountNameW
EqualSid
FreeSid
BuildTrusteeWithSidW
GetExplicitEntriesFromAclW
SetEntriesInAclW
GetLengthSid
IsValidSecurityDescriptor
GetAce
LookupAccountSidW
ImpersonateSelf
OpenThreadToken
AccessCheck
RevertToSelf
SetNamedSecurityInfoW
CryptAcquireContextW
CryptReleaseContext
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
GetSecurityDescriptorControl
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorSacl
IsValidSid
IsValidAcl
MakeAbsoluteSD
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorW
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
TraceEvent
RegQueryValueExA
RegOpenKeyExA
RegisterTraceGuidsA
DeregisterEventSource
ReportEventW
RegisterEventSourceW
RegOpenKeyA
GetTraceEnableFlags

gdi32

GetBkColor
PlayEnhMetaFile
DeleteEnhMetaFile
SelectClipRgn
CreateSolidBrush
RestoreDC
GetTextColor
GetStockObject
IntersectClipRect
GetViewportExtEx
SetViewportExtEx
GetClipBox
CreatePen
CreatePatternBrush
GetNearestColor
GetTextFaceW
GetNearestPaletteIndex
SaveDC
GetMapMode
CreateBrushIndirect
CreateCompatibleBitmap
SetMapMode
CombineRgn
DPtoLP
GetPaletteEntries
DeleteObject
CreateBitmap
GetTextCharsetInfo
GetRgnBox
ExcludeClipRect
GetDIBits
SetBrushOrgEx
CreateFontIndirectW
CreateHatchBrush
EnumFontsW
GetWindowExtEx
SetWindowExtEx
LPtoDP
GetTextMetricsW
CreateDIBPatternBrush
GetWindowOrgEx
EnumFontFamiliesW
SetWindowOrgEx
SetBitmapBits
ExtCreatePen
MoveToEx
GetCurrentPositionEx
LineTo
PatBlt
Polygon
Ellipse
Pie
Arc
CreateCompatibleDC
DeleteDC
GetBitmapBits
GetPixel
SetPixel
Escape
CreatePolygonRgn
GetEnhMetaFileHeader
GetWinMetaFileBits
SetMetaFileBitsEx
CreateMetaFileW
EnumMetaFile
CloseMetaFile
DeleteMetaFile
GetMetaFileBitsEx
SetWinMetaFileBits
PlayMetaFileRecord
PlayEnhMetaFileRecord
EnumEnhMetaFile
GdiComment
Polyline
CreateDIBSection
GdiFlush
GetSystemPaletteEntries
CreatePalette
SelectPalette
RealizePalette
RoundRect
Rectangle
CreateRectRgn
CreateRectRgnIndirect
CreateRoundRectRgn
OffsetRgn
GetTextAlign
SetTextAlign
SetMapperFlags
EnumObjects
GetCurrentObject
ExtEscape
SetAbortProc
AbortDoc
EndDoc
StartPage
EndPage
CreateICW
SetStretchBltMode
StretchDIBits
InvertRgn
GetEnhMetaFileBits
CopyMetaFileW
CopyEnhMetaFileW
CreateDIBitmap
SetEnhMetaFileBits
SetDIBits
GetOutlineTextMetricsW
ExtTextOutA
ExtTextOutW
UnrealizeObject
GetClipRgn
GetTextExtentPoint32W
TextOutW
SetViewportOrgEx
ScaleViewportExtEx
GetLayout
SetLayout
CreateFontA
CreateBitmapIndirect
GetObjectType
GetCharacterPlacementA
StretchBlt
GetTextMetricsA
GetWorldTransform
SetGraphicsMode
GetRegionData
BitBlt
GetObjectW
SetBkMode
SetROP2
SetTextColor
SetBkColor
SelectObject
SetWorldTransform
GetDeviceCaps
SetRectRgn

kernel32

LoadLibraryW
GetModuleFileNameW
OutputDebugStringA
WinExec
GlobalLock
GetSystemDefaultLCID
GlobalAlloc
GetVersionExW
lstrlenW
GetLastError
GlobalFree
IsDBCSLeadByte
GetACP
IsDBCSLeadByteEx
GetDriveTypeW
GlobalSize
GlobalReAlloc
GetFileSize
GetFileTime
SetFileTime
GetVolumeInformationW
UnlockFile
LockFile
GetCurrentDirectoryW
MoveFileW
ReadFile
WriteFile
SetFilePointer
DeleteFileW
SetFileAttributesW
CloseHandle
SearchPathW
FindClose
FindFirstFileW
FindNextFileW
SetCurrentDirectoryW
SetEnvironmentVariableW
GetShortPathNameW
SetErrorMode
FindResourceW
LoadResource
GetLocalTime
SystemTimeToFileTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareStringA
GetStringTypeW
FreeLibrary
LCMapStringW
IsBadReadPtr
GetOEMCP
DeleteCriticalSection
GetCurrentProcess
LocalAlloc
LocalFree
GetSystemDirectoryW
GetStartupInfoW
GetCommandLineW
GetCurrentThread
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
MoveFileExW
GetSystemDefaultLangID
GlobalFlags
DebugBreak
InitializeCriticalSection
CreateEventW
CreateThread
SetThreadIdealProcessor
GetExitCodeThread
TerminateThread
SetEvent
GetSystemInfo
GetTempFileNameW
GetSystemTime
IsBadWritePtr
TerminateProcess
RaiseException
OutputDebugStringW
SizeofResource
LockResource
GetWindowsDirectoryW
SetThreadPriority
GlobalAddAtomW
AddAtomW
FlushFileBuffers
GetTempPathW
lstrcmpW
GetFileAttributesExW
VirtualAlloc
VirtualFree
GetLocaleInfoW
IsValidCodePage
LoadLibraryExW
EnumCalendarInfoW
GetLogicalDrives
GetFullPathNameW
HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree
IsValidLocale
GlobalGetAtomNameW
GlobalDeleteAtom
QueryPerformanceCounter
SystemTimeToTzSpecificLocalTime
SetCriticalSectionSpinCount
QueryPerformanceFrequency
InitializeSListHead
InterlockedFlushSList
InterlockedPushEntrySList
WaitForSingleObjectEx
ResetEvent
WaitForSingleObject
WideCharToMultiByte
GetStringTypeExW
GetFileAttributesW
GetVersion
GetProcAddress
GetModuleHandleW
GetModuleHandleA
SetLastError
GetCurrentProcessId
GetUserDefaultLCID
GetVersionExA
OpenFile
LoadLibraryExA
TlsAlloc
FormatMessageW
TlsSetValue
TlsGetValue
TlsFree
GetStringTypeExA
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
VirtualProtect
RtlCaptureStackBackTrace
GetModuleHandleExW
LoadLibraryA
FormatMessageA
GetCurrentThreadId
GetGeoInfoW
GetUserGeoID
GetTickCount
Sleep
EncodePointer
MulDiv
LeaveCriticalSection
DecodePointer
GlobalUnlock
EnterCriticalSection

ole32

OleTranslateAccelerator
OleSetMenuDescriptor
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoCreateGuid
CoCreateInstanceEx
GetHGlobalFromILockBytes
OleCreateFromData
CoRegisterMessageFilter
CoFreeUnusedLibraries
CoUninitialize
OleQueryCreateFromData
CoAllowSetForegroundWindow
CoRegisterClassObject
CoRevokeClassObject
CreateOleAdviseHolder
OleRegGetUserType
CreateDataAdviseHolder
OleQueryLinkFromData
CoInitialize
CoInitializeEx
OleSetContainedObject
ReadClassStm
CoTreatAsClass
SetConvertStg
WriteClassStg
WriteClassStm
OleSaveToStream
OleConvertIStorageToOLESTREAM
OleConvertOLESTREAMToIStorage
CoTaskMemAlloc
CLSIDFromProgID
CoFileTimeNow
CoIsOle1Class
CreateItemMoniker
WriteFmtUserTypeStg
OleGetIconOfClass
ReadFmtUserTypeStg
CoGetMalloc
GetClassFile
CLSIDFromString
OleSave
OleUninitialize
DoDragDrop
OleInitialize
ReadClassStg
CoDisconnectObject
CreateGenericComposite
OleIsRunning
ProgIDFromCLSID
ReleaseStgMedium
MkParseDisplayName
OleRun
OleCreateLinkFromData
CreateBindCtx
CoTaskMemFree
CoMarshalInterface
CoUnmarshalInterface
OleGetClipboard
OleFlushClipboard
OleSetClipboard
StringFromGUID2
GetHGlobalFromStream
CoLockObjectExternal
GetRunningObjectTable
CoCreateInstance
CoGetClassObject
CreateFileMoniker
StringFromCLSID
StgIsStorageFile
StgSetTimes
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CreateStreamOnHGlobal
OleIsCurrentClipboard
IsAccelerator

oleaut32

VariantInit
VariantClear
VariantChangeType
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SysAllocString
SysStringLen
SysFreeString
SafeArrayUnlock
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayLock
SafeArrayDestroy
SysAllocStringLen
SafeArrayGetElement
SafeArrayPutElement
GetErrorInfo
OleCreateFontIndirect
VariantChangeTypeEx
VariantCopyInd
SysAllocStringByteLen
SysReAllocStringLen
SetErrorInfo
LoadTypeLi
RegisterTypeLi
SafeArrayPtrOfIndex
SafeArrayGetElemsize
RegisterActiveObject
RevokeActiveObject
LoadRegTypeLi
CreateErrorInfo
VarDateFromUdate
VarUdateFromDate
GetAltMonthNames
VariantCopy

user32

DeferWindowPos
SetWindowsHookExW
GetKeyboardState
SetKeyboardState
UnhookWindowsHookEx
SetActiveWindow
IsRectEmpty
MonitorFromPoint
MonitorFromWindow
GetMonitorInfoW
RegisterClassExW
ClientToScreen
ShowWindow
AdjustWindowRectEx
HideCaret
ShowCaret
GetActiveWindow
IsChild
GetSystemMenu
PeekMessageW
BeginPaint
EndPaint
GetScrollInfo
InvalidateRect
GetTopWindow
GetParent
MapWindowPoints
GetWindowTextW
GetUpdateRgn
InvalidateRgn
ExcludeUpdateRgn
ValidateRect
ValidateRgn
SetCapture
ReleaseCapture
GetCapture
EnableWindow
IsWindowEnabled
IsWindow
DestroyWindow
UpdateWindow
FlashWindow
DispatchMessageW
GetClassLongW
BeginDeferWindowPos
EndDeferWindowPos
RedrawWindow
GetUpdateRect
SetClassLongW
IsWindowVisible
InSendMessage
VkKeyScanW
GetClassNameW
TranslateMessage
MapVirtualKeyW
WaitMessage
GetQueueStatus
GetInputState
PostQuitMessage
GetCursorPos
RegisterClipboardFormatW
SetCursor
ShowCursor
MessageBeep
FindWindowW
OpenIcon
GetWindowThreadProcessId
SetRectEmpty
EnumDisplayMonitors
CreateMenu
DestroyMenu
DrawMenuBar
GetMenuItemCount
GetMenuItemID
RemoveMenu
GetSubMenu
EnableMenuItem
AppendMenuW
TrackPopupMenu
EnumThreadWindows
SetWindowWord
SetWindowPos
GetWindowWord
CallWindowProcW
GetDlgItem
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollInfo
EmptyClipboard
CloseClipboard
GetKeyboardLayout
IsClipboardFormatAvailable
GetClipboardData
SetClipboardData
OpenClipboard
GetClipboardOwner
EnumClipboardFormats
CreateCaret
DestroyCaret
GetCaretPos
PostMessageW
GetThreadDesktop
OpenInputDesktop
GetUserObjectInformationW
CloseDesktop
IsCharUpperW
SetWindowTextA
IsWindowUnicode
DispatchMessageA
GetMessageW
WindowFromPoint
SetCursorPos
ArrangeIconicWindows
IsZoomed
GetAncestor
SetParent
FlashWindowEx
GetMenu
UnregisterClassW
MoveWindow
EqualRect
GetMessagePos
ToAscii
ToUnicode
GetMessageTime
BringWindowToTop
GetTitleBarInfo
GetWindowInfo
DestroyIcon
DrawIcon
NotifyWinEvent
GetAsyncKeyState
RegisterWindowMessageW
EnumChildWindows
CharUpperA
CharLowerW
ActivateKeyboardLayout
FreeDDElParam
PackDDElParam
GetClipboardFormatNameW
SetWindowTextW
CreatePopupMenu
CharLowerBuffW
DrawFrameControl
GetCursor
SetMenu
CreateAcceleratorTableW
CharUpperBuffW
CreateIconIndirect
IsCharAlphaW
GetForegroundWindow
DefWindowProcW
LoadCursorFromFileW
GetIconInfo
GetKeyboardLayoutList
CallNextHookEx
LoadImageW
MessageBoxW
PostMessageA
DestroyAcceleratorTable
GetDesktopWindow
GetDoubleClickTime
GetWindowDC
UnpackDDElParam
SendMessageTimeoutW
MessageBoxA
OffsetRect
ScreenToClient
GetWindowRect
SendMessageW
SetWindowPlacement
GetWindowPlacement
GetWindow
FillRect
IsIconic
SetForegroundWindow
MonitorFromRect
SetWindowLongW
GetWindowLongW
CreateWindowExW
GetSystemMetrics
RegisterClassW
LoadIconW
LoadCursorW
RegisterWindowMessageA
KillTimer
SetTimer
GetSysColor
SetCaretPos
SetRect
PtInRect
SystemParametersInfoW
TrackMouseEvent
DrawFocusRect
SetFocus
InflateRect
GetClientRect
EnumDisplaySettingsW
GetFocus
UnionRect
ReleaseDC
GetDC
IntersectRect
SetScrollPos
GetKeyState

msvcr90

memcpy
__CxxFrameHandler3
_vscwprintf
floor
__CxxLongjmpUnwind
_CxxThrowException
_seh_longjmp_unwind4
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_crt_debugger_hook
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
vswprintf_s
memset
free
malloc
tolower
_fpreset
toupper
_ecvt_s
_wtof
_wsplitpath_s
_vsnprintf_s
wcscspn
atof
_controlfp_s
wcsncmp
_snwprintf_s
rand
srand
_wtoi
memcpy_s
wcsnlen
_vsnwprintf_s
strncpy_s
wcsrchr
memmove
wcschr
exit
wcsstr
_wassert
ceil
?raw_name@type_info@@QBEPBDXZ
wcsncpy_s
??8type_info@@QBE_NABV0@@Z

gfx

ord819
ord699
ord77
ord590
ord879
ord377
ord762
ord185
ord504
ord24
ord166
ord235
ord541
ord171
ord207
ord145
ord892
ord70
ord164
ord952
ord192
ord341
ord316
ord353
ord624
ord175
ord635
ord931
ord214
ord833
ord133
ord951
ord216
ord322
ord844
ord453
ord471
ord649
ord794
ord307
ord362
ord787
ord782
ord641
ord843
ord302
ord326
ord795
ord498
ord430
ord11
ord569
ord75
ord938
ord601
ord770
ord61
ord534
ord735
ord627
ord513
ord46
ord303
ord976
ord752
ord467
ord34
ord497
ord910

oart

ord7998
ord5830
ord3901
ord3528
ord7116
ord5624
ord6934
ord1321
ord7349
ord2130
ord3194
ord2428
ord8222
ord3247
ord6878
ord6492
ord4825
ord3315
ord985
ord6327
ord2574
ord5062
ord475
ord134
ord5723
ord7724
ord3829
ord964
ord8040
ord5774
ord2585
ord6687
ord3452
ord2032
ord4588
ord446
ord1876
ord7281
ord6769
ord6424
ord1607
ord1430
ord2475
ord5479
ord616
ord8179
ord3156
ord978
ord3994
ord3910
ord6560
ord2943
ord5292
ord2335
ord7273
ord4059
ord4269
ord3460
ord988
ord8260
ord5811
ord2950
ord3426
ord7920
ord1633
ord2538
ord790
ord7052
ord6553
ord2929
ord6331
ord7634
ord6334
ord4483
ord362
ord4270
ord5331
ord3772
ord5278
ord961
ord6407
ord4429
ord2786
ord2189
ord4532
ord2776
ord314
ord7333
ord2340
ord2107
ord1333
ord7890
ord7713
ord592
ord2246
ord5833
ord604
ord5518
ord4796
ord4535
ord6113
ord2445
ord6632
ord5227
ord4842
ord912
ord6362
ord2152
ord8417
ord1663
ord344
ord4353
ord1976
ord3673
ord1102
ord6659
ord5923
ord59
ord4685
ord3956
ord1978
ord2047
ord5983
ord2135
ord1715
ord4681
ord4607
ord6544
ord1905
ord3610
ord7764
ord7749
ord3821
ord6531
ord2676
ord8276
ord81
ord7388
ord6338
ord7593
ord1398
ord4206
ord732
ord5512
ord8370
ord1870
ord7711
ord8245
ord5459
ord6998
ord5946
ord6595
ord4759
ord6714
ord7812
ord8054
ord2410
ord6977
ord3900
ord4049
ord7602
ord5111
ord5808
ord7013
ord4159
ord7193
ord243
ord1879
ord1045
ord2998
ord6534
ord7867
ord2338
ord1080
ord5330
ord3891
ord7578
ord1988
ord639
ord4621
ord6127
ord7718
ord3851
ord5260
ord7475
ord1682
ord6387
ord2064
ord6827
ord3909
ord5785
ord4762
ord3151
ord3155
ord5869
ord295
ord6844
ord4793
ord5710
ord4617
ord7356
ord3983
ord1923
ord6660
ord2372
ord7704
ord5709
ord258
ord5312
ord2436
ord6062
ord8225
ord4256
ord8207
ord7529
ord6743
ord909
ord1840
ord1851
ord4492
ord4105
ord5346
ord3567
ord7306
ord2174
ord8070
ord1660
ord5009
ord7061
ord7509
ord7775
ord4222
ord2751
ord3820
ord1200
ord8415
ord4544
ord6291
ord7111
ord8195
ord3845
ord4229
ord6400
ord3846
ord3608
ord2610
ord5966
ord1115
ord1172
ord1288
ord3773
ord8171
ord5338
ord8421
ord953
ord1491
ord8329
ord5635
ord2385
ord3681
ord2458
ord6278
ord1054
ord788
ord2670
ord3325
ord1886
ord5015
ord7358
ord7121
ord4846
ord764
ord1627
ord4849
ord2056
ord2562
ord2039
ord3599
ord7303
ord5953
ord3329
ord2102
ord5779
ord2394
ord3936
ord332
ord2437
ord2474
ord5683
ord2778
ord4190
ord1006
ord5879
ord5149
ord285
ord7003
ord5629
ord1594
ord6147
ord2679
ord6228
ord2257
ord3328
ord4073
ord7202
ord3921
ord1316
ord3729
ord2694
ord3980
ord7691
ord8353
ord7513
ord2899
ord1789
ord2328
ord7991
ord4445
ord2468
ord4495
ord3605
ord1113
ord1799
ord454
ord6460
ord3970
ord4185
ord5076
ord2948
ord1381
ord5425
ord4618
ord8175
ord2084
ord7675
ord834
ord5718
ord1386
ord6883
ord3704
ord1525
ord741
ord7334
ord2492
ord4111
ord4879
ord5200
ord7990
ord7447
ord4513
ord5101
ord5294
ord4822
ord10
ord5775
ord5485
ord6374
ord7892
ord1189
ord3273
ord8361
ord5034
ord7484
ord6118
ord1791
ord3029
ord7905
ord4701
ord2936
ord6279
ord8132
ord2504
ord713
ord5543
ord1339
ord8073
ord4600
ord2235
ord2726
ord8412
ord5047
ord855
ord5920
ord1108
ord693
ord1345
ord1588
ord520
ord3944
ord4260
ord3837
ord6350
ord2904
ord6967
ord4547
ord8144
ord3202
ord2954
ord3693
ord8124
ord4947
ord1661
ord90
ord2506
ord6924
ord4980
ord3095
ord5996
ord6590
ord3235
ord6052
ord5843
ord2116
ord5794
ord6418
ord6591
ord6006
ord971
ord2124
ord1793
ord4402
ord5623
ord4356
ord4918
ord3530
ord7961
ord1935
ord6987
ord4094
ord1587
ord6231
ord3627
ord1678
ord2037
ord3611
ord1801
ord682
ord3946
ord5941
ord2890
ord7468
ord6438
ord4197
ord658
ord1238
ord4514
ord2059
ord263
ord5642
ord3945
ord4744
ord8033
ord7271
ord4275
ord6899
ord2790
ord5711
ord5403
ord2740
ord5248
ord5476
ord5022
ord4253
ord6990
ord1122
ord1909
ord6849
ord7842
ord7146
ord6003
ord2705
ord2494
ord6718
ord6992
ord3987
ord2956
ord8275
ord1297
ord8296
ord5859
ord7516
ord5483
ord4319
ord6546
ord6772
ord304
ord1093
ord3037
ord4957
ord6441
ord1602
ord6885
ord6623
ord3527
ord449
ord40
ord5994
ord1738
ord2749
ord1021

Exports

Exports

DllGetLCID
MdCallBack
MdCallBack12
_LPenHelper

Sections

.text
Size: 15.7MB - Virtual size: 15.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 982KB - Virtual size: 1009KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 680KB - Virtual size: 680KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/EXCEL.EXE.manifest
office2010/Office14/EXPSRV.DLL
.dll windows x86

ec0fe268630d6414506244b95e6d9456

Code Sign

33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/08/2016, 20:17

Not After

02/11/2017, 20:17

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

95:dc:52:56:f3:e8:e3:3a:3c:3c:ac:26:be:37:10:fd:84:2a:d3:40
Signer

Actual PE Digest

95:dc:52:56:f3:e8:e3:3a:3c:3c:ac:26:be:37:10:fd:84:2a:d3:40

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

16/03/2017, 19:39
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoDisconnectObject
CoGetClassObject
CoCreateInstance
CreateBindCtx
MkParseDisplayName
BindMoniker
CoGetMalloc

oleaut32

VarDateFromStr
SysFreeString
SafeArrayDestroy
SafeArrayDestroyData
VariantChangeTypeEx
SafeArrayCreate
SafeArrayAllocDescriptor
VariantCopy
SafeArrayPutElement
SetErrorInfo
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
SysStringLen
GetErrorInfo
CreateErrorInfo
LoadTypeLi
RevokeActiveObject
SafeArrayDestroyDescriptor
SafeArrayCopy
SafeArrayAllocData
SafeArrayUnlock
SafeArrayRedim
SysAllocString
SafeArrayLock
GetActiveObject
VariantCopyInd
VarCyFromI4
VarBstrFromI2
VarBstrFromI4
VarBstrFromR4
VarBstrFromR8
VarBstrFromDate
VarBstrFromCy
VarI2FromStr
VarI4FromStr
LHashValOfNameSysA
LoadRegTypeLi
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
VariantInit
VariantChangeType
SafeArrayGetDim
SafeArrayGetElement
SysReAllocStringLen
SysReAllocString
VarCyFromStr
VarR8FromStr
VarR4FromStr
VarI4FromR8
VariantClear

user32

LoadStringA
GetSystemMetrics
CharUpperBuffW
CharUpperBuffA
CharLowerBuffW
CharLowerBuffA
FindWindowW
FindWindowA
SendMessageA
GetKeyboardLayout
MessageBeep
SetFocus
SetForegroundWindow
AttachThreadInput
GetWindowThreadProcessId
IsWindowVisible
IsWindowEnabled
GetWindowTextA
GetDesktopWindow
GetWindow
GetFocus
OemToCharBuffA
CharToOemA
GetKeyboardState
UnhookWindowsHookEx
SetKeyboardState
keybd_event
CallNextHookEx
GetAsyncKeyState
WaitForInputIdle
SetWindowsHookExW
SetWindowsHookExA
VkKeyScanW
VkKeyScanA
GetForegroundWindow

kernel32

GetTimeZoneInformation
GetStringTypeW
InitializeCriticalSectionAndSpinCount
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetProcessHeap
SetEndOfFile
SetStdHandle
HeapSize
GetOEMCP
GetACP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
HeapDestroy
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetStdHandle
SetHandleCount
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
ExitProcess
MoveFileA
DeleteFileA
RemoveDirectoryA
CreateDirectoryA
SetEnvironmentVariableA
GetFullPathNameA
SetCurrentDirectoryA
GetCurrentDirectoryA
UnlockFile
LockFile
SetFilePointer
GetConsoleMode
GetConsoleCP
WriteFile
ReadFile
GetFileType
FlushFileBuffers
HeapReAlloc
HeapAlloc
HeapFree
FindNextFileA
GetSystemInfo
GetModuleHandleW
GetCommandLineA
GetCurrentThreadId
RtlUnwind
GetUserDefaultLCID
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateProcessA
CreateProcessW
lstrcatA
GetPrivateProfileIntA
CompareStringA
WideCharToMultiByte
MultiByteToWideChar
GetLastError
GetModuleFileNameA
VirtualQuery
VirtualProtect
VirtualAlloc
VirtualFree
GetProcAddress
GetModuleHandleA
GetVersion
InterlockedDecrement
InterlockedIncrement
DisableThreadLibraryCalls
GetSystemDefaultLangID
GetUserDefaultLangID
IsDBCSLeadByte
GetStringTypeA
LCMapStringA
GetLocaleInfoA
LoadLibraryA
OpenFile
CreateFileA
CompareStringW
SetLastError
LCMapStringW
GetModuleFileNameW
FormatMessageW
FreeLibrary
SetErrorMode
GetSystemDirectoryA
Sleep
GlobalFree
GetTickCount
GlobalUnlock
GlobalLock
GlobalAlloc
GetComputerNameA
RaiseException
IsBadReadPtr
IsValidCodePage
lstrcmpiA
SetFileTime
GetFileTime
CloseHandle
GetDriveTypeA
FindClose
FindFirstFileA
GetFileAttributesA
GetVolumeInformationA
FileTimeToSystemTime
FileTimeToLocalFileTime
SetFileAttributesA
GetLocalTime
SetLocalTime
GetCurrentProcess

advapi32

RegQueryInfoKeyA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegSetValueExA
RegSetValueExW
RegCreateKeyA
RegCreateKeyW
RegQueryValueExA
RegQueryValueExW
RegEnumValueA
RegEnumValueW
RegEnumKeyA
RegEnumKeyW
RegDeleteValueA
RegDeleteValueW
RegDeleteKeyA
RegDeleteKeyW
RegOpenKeyA
RegOpenKeyW

Exports

Exports

BASIC_CLASS_AddRef
BASIC_CLASS_GetIDsOfNames
BASIC_CLASS_Invoke
BASIC_CLASS_QueryInterface
BASIC_CLASS_Release
BASIC_DISPINTERFACE_GetTICount
BASIC_DISPINTERFACE_GetTypeInfo
CopyRecord
CreateIExprSrvObj
DllFunctionCall
EVENT_SINK2_AddRef
EVENT_SINK2_Release
EVENT_SINK_AddRef
EVENT_SINK_GetIDsOfNames
EVENT_SINK_Invoke
EVENT_SINK_QueryInterface
EVENT_SINK_Release
EbCreateContext
EbDestroyContext
EbGetErrorInfo
EbGetHandleOfExecutingProject
EbGetObjConnectionCounts
EbGetVBAObject
EbIsProjectOnStack
EbLibraryLoad
EbLibraryUnload
EbLoadRunTime
EbResetProject
EbResetProjectNormal
EbSetContextWorkerThread
GetMem1
GetMem2
GetMem4
GetMem8
GetMemEvent
GetMemNewObj
GetMemObj
GetMemStr
GetMemVar
IID_IVbaHost
MethCallEngine
ProcCallEngine
PutMem1
PutMem2
PutMem4
PutMem8
PutMemEvent
PutMemNewObj
PutMemObj
PutMemStr
PutMemVar
SetMemEvent
SetMemNewObj
SetMemObj
SetMemVar
TipCreateInstanceEx
TipCreateInstanceProject2
TipGetAddressOfPredeclaredInstance
TipInvokeMethod
TipInvokeMethod2
TipSetOption
TipUnloadInstance
TipUnloadProject
VarPtr
Zombie_AddRef
Zombie_GetIDsOfNames
Zombie_GetTypeInfo
Zombie_GetTypeInfoCount
Zombie_Invoke
Zombie_QueryInterface
Zombie_Release
_CIatan
_CIcos
_CIexp
_CIlog
_CIsin
_CIsqrt
_CItan
__vbaAryConstruct
__vbaAryConstruct2
__vbaAryCopy
__vbaAryDestruct
__vbaAryLock
__vbaAryMove
__vbaAryRebase1Var
__vbaAryRecCopy
__vbaAryRecMove
__vbaAryUnlock
__vbaAryVar
__vbaAryVarVarg
__vbaBoolErrVar
__vbaBoolStr
__vbaBoolVar
__vbaBoolVarNull
__vbaCVarAryUdt
__vbaCastObj
__vbaCastObjVar
__vbaCheckType
__vbaCheckTypeVar
__vbaChkstk
__vbaCopyBytes
__vbaCopyBytesZero
__vbaCyAbs
__vbaCyAdd
__vbaCyErrVar
__vbaCyFix
__vbaCyForInit
__vbaCyForNext
__vbaCyI2
__vbaCyI4
__vbaCyInt
__vbaCyMul
__vbaCyMulI2
__vbaCySgn
__vbaCyStr
__vbaCySub
__vbaCyUI1
__vbaCyVar
__vbaDateR4
__vbaDateR8
__vbaDateStr
__vbaDateVar
__vbaDerefAry
__vbaDerefAry1
__vbaEnd
__vbaErase
__vbaEraseKeepData
__vbaEraseNoPop
__vbaError
__vbaErrorOverflow
__vbaExceptHandler
__vbaExitEachAry
__vbaExitEachColl
__vbaExitEachVar
__vbaExitProc
__vbaFPException
__vbaFPFix
__vbaFPInt
__vbaFailedFriend
__vbaFileClose
__vbaFileCloseAll
__vbaFileLock
__vbaFileOpen
__vbaFileSeek
__vbaFixstrConstruct
__vbaForEachAry
__vbaForEachCollAd
__vbaForEachCollObj
__vbaForEachCollVar
__vbaForEachVar
__vbaFpCDblR4
__vbaFpCDblR8
__vbaFpCSngR4
__vbaFpCSngR8
__vbaFpCmpCy
__vbaFpCy
__vbaFpI2
__vbaFpI4
__vbaFpR4
__vbaFpR8
__vbaFpUI1
__vbaFreeObj
__vbaFreeObjList
__vbaFreeStr
__vbaFreeStrList
__vbaFreeVar
__vbaFreeVarList
__vbaFreeVarg
__vbaGenerateBoundsError
__vbaGet3
__vbaGet4
__vbaGetFxStr3
__vbaGetFxStr4
__vbaGetOwner3
__vbaGetOwner4
__vbaGosub
__vbaGosubFree
__vbaGosubReturn
__vbaHresultCheck
__vbaHresultCheckNonvirt
__vbaHresultCheckObj
__vbaI2Abs
__vbaI2Cy
__vbaI2ErrVar
__vbaI2ForNextCheck
__vbaI2I4
__vbaI2Sgn
__vbaI2Str
__vbaI2Var
__vbaI4Abs
__vbaI4Cy
__vbaI4ErrVar
__vbaI4ForNextCheck
__vbaI4Sgn
__vbaI4Str
__vbaI4Var
__vbaInStr
__vbaInStrB
__vbaInStrVar
__vbaInStrVarB
__vbaInputFile
__vbaLateIdCall
__vbaLateIdCallLd
__vbaLateIdCallSt
__vbaLateIdNamedCall
__vbaLateIdNamedCallLd
__vbaLateIdNamedCallSt
__vbaLateIdNamedStAd
__vbaLateIdSt
__vbaLateIdStAd
__vbaLateMemCall
__vbaLateMemCallLd
__vbaLateMemCallSt
__vbaLateMemNamedCall
__vbaLateMemNamedCallLd
__vbaLateMemNamedCallSt
__vbaLateMemNamedStAd
__vbaLateMemSt
__vbaLateMemStAd
__vbaLbound
__vbaLdZeroAry
__vbaLenBstr
__vbaLenBstrB
__vbaLenVar
__vbaLenVarB
__vbaLineInputStr
__vbaLineInputVar
__vbaLsetFixstr
__vbaLsetFixstrFree
__vbaMidStmtBstr
__vbaMidStmtBstrB
__vbaMidStmtVar
__vbaMidStmtVarB
__vbaNameFile
__vbaNew
__vbaNew2
__vbaNextEachAry
__vbaNextEachCollAd
__vbaNextEachCollObj
__vbaNextEachCollVar
__vbaNextEachVar
__vbaObjAddref
__vbaObjIs
__vbaObjSet
__vbaObjSetAddref
__vbaObjVar
__vbaOnError
__vbaOnGoCheck
__vbaPowerR8
__vbaPrintFile
__vbaPrintObj
__vbaPut3
__vbaPut4
__vbaPutFxStr3
__vbaPutFxStr4
__vbaPutOwner3
__vbaPutOwner4
__vbaR4Cy
__vbaR4ErrVar
__vbaR4ForNextCheck
__vbaR4Sgn
__vbaR4Str
__vbaR4Var
__vbaR8Cy
__vbaR8ErrVar
__vbaR8FixI2
__vbaR8FixI4
__vbaR8ForNextCheck
__vbaR8IntI2
__vbaR8IntI4
__vbaR8Sgn
__vbaR8Str
__vbaR8Var
__vbaRaiseEvent
__vbaRecAnsiToUni
__vbaRecAssign
__vbaRecDestruct
__vbaRecDestructAnsi
__vbaRecUniToAnsi
__vbaRedim
__vbaRedimPreserve
__vbaRedimPreserveVar
__vbaRedimPreserveVar2
__vbaRedimVar
__vbaRedimVar2
__vbaRefVarAry
__vbaResume
__vbaRsetFixstr
__vbaRsetFixstrFree
__vbaSetSystemError
__vbaStopExe
__vbaStr2Vec
__vbaStrAryToAnsi
__vbaStrAryToUnicode
__vbaStrBool
__vbaStrCat
__vbaStrCmp
__vbaStrComp
__vbaStrCompVar
__vbaStrCopy
__vbaStrCy
__vbaStrDate
__vbaStrErrVarCopy
__vbaStrFixstr
__vbaStrI2
__vbaStrI4
__vbaStrLike
__vbaStrMove
__vbaStrR4
__vbaStrR8
__vbaStrTextCmp
__vbaStrTextLike
__vbaStrToAnsi
__vbaStrToUnicode
__vbaStrUI1
__vbaStrVarCopy
__vbaStrVarMove
__vbaStrVarVal
__vbaUI1Cy
__vbaUI1ErrVar
__vbaUI1I2
__vbaUI1I4
__vbaUI1Sgn
__vbaUI1Str
__vbaUI1Var
__vbaUbound
__vbaUdtVar
__vbaUnkVar
__vbaVar2Vec
__vbaVarAbs
__vbaVarAdd
__vbaVarAnd
__vbaVarCat
__vbaVarCmpEq
__vbaVarCmpGe
__vbaVarCmpGt
__vbaVarCmpLe
__vbaVarCmpLt
__vbaVarCmpNe
__vbaVarCopy
__vbaVarDateVar
__vbaVarDiv
__vbaVarDup
__vbaVarEqv
__vbaVarErrI4
__vbaVarFix
__vbaVarForInit
__vbaVarForNext
__vbaVarIdiv
__vbaVarImp
__vbaVarIndexLoad
__vbaVarIndexLoadRef
__vbaVarIndexLoadRefLock
__vbaVarIndexStore
__vbaVarIndexStoreObj
__vbaVarInt
__vbaVarLateMemCallLd
__vbaVarLateMemCallLdRf
__vbaVarLateMemCallSt
__vbaVarLateMemSt
__vbaVarLateMemStAd
__vbaVarLike
__vbaVarLikeVar
__vbaVarMod
__vbaVarMove
__vbaVarMul
__vbaVarNeg
__vbaVarNot
__vbaVarOr
__vbaVarPow
__vbaVarSetObj
__vbaVarSetObjAddref
__vbaVarSetUnk
__vbaVarSetUnkAddref
__vbaVarSetVar
__vbaVarSetVarAddref
__vbaVarSub
__vbaVarTextCmpEq
__vbaVarTextCmpGe
__vbaVarTextCmpGt
__vbaVarTextCmpLe
__vbaVarTextCmpLt
__vbaVarTextCmpNe
__vbaVarTextLike
__vbaVarTextLikeVar
__vbaVarTextTstEq
__vbaVarTextTstGe
__vbaVarTextTstGt
__vbaVarTextTstLe
__vbaVarTextTstLt
__vbaVarTextTstNe
__vbaVarTstEq
__vbaVarTstGe
__vbaVarTstGt
__vbaVarTstLe
__vbaVarTstLt
__vbaVarTstNe
__vbaVarVargNofree
__vbaVarXor
__vbaVarZero
__vbaVargObj
__vbaVargObjAddref
__vbaVargParmRef
__vbaVargUnk
__vbaVargUnkAddref
__vbaVargVar
__vbaVargVarCopy
__vbaVargVarMove
__vbaVargVarRef
__vbaVerifyVarObj
__vbaWriteFile
_adj_fdiv_m16i
_adj_fdiv_m32
_adj_fdiv_m32i
_adj_fdiv_m64
_adj_fdiv_r
_adj_fdivr_m16i
_adj_fdivr_m32
_adj_fdivr_m32i
_adj_fdivr_m64
_adj_fpatan
_adj_fprem
_adj_fprem1
_adj_fptan
_allmul
rtBoolFromErrVar
rtBstrFromErrVar
rtCyFromErrVar
rtDecFromVar
rtI2FromErrVar
rtI4FromErrVar
rtR4FromErrVar
rtR8FromErrVar
rtUI1FromErrVar
rtcAbsVar
rtcAnsiValueBstr
rtcAppActivate
rtcAppleScript
rtcArray
rtcAtn
rtcBeep
rtcBstrFromAnsi
rtcBstrFromByte
rtcBstrFromChar
rtcBstrFromError
rtcBstrFromFormatVar
rtcByteValueBstr
rtcCVErrFromVar
rtcCallByName
rtcChangeDir
rtcChangeDrive
rtcCharValueBstr
rtcChoose
rtcCommandBstr
rtcCommandVar
rtcCompareBstr
rtcCos
rtcCreateObject
rtcCreateObject2
rtcCurrentDir
rtcCurrentDirBstr
rtcDDB
rtcDateAdd
rtcDateDiff
rtcDateFromVar
rtcDatePart
rtcDeleteSetting
rtcDir
rtcDoEvents
rtcEndOfFile
rtcEnvironBstr
rtcEnvironVar
rtcErrObj
rtcExp
rtcFV
rtcFileAttributes
rtcFileCopy
rtcFileDateTime
rtcFileLen
rtcFileLength
rtcFileLocation
rtcFileReset
rtcFileSeek
rtcFileWidth
rtcFilter
rtcFixVar
rtcFormatCurrency
rtcFormatDateTime
rtcFormatNumber
rtcFormatPercent
rtcFreeFile
rtcGetAllSettings
rtcGetCurrentCalendar
rtcGetDateBstr
rtcGetDateValue
rtcGetDateVar
rtcGetDayOfMonth
rtcGetDayOfWeek
rtcGetErl
rtcGetFileAttr

Sections

.text
Size: 236KB - Virtual size: 235KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

ENGINE
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/EntityDataHandler.dll
.dll regsvr32 windows x86

120ce4d2d49482ad01fea146e66eb927

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:12

Not After

04/12/2013, 21:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

88:64:6d:95:cd:58:ae:84:ac:6c:96:cf:06:1e:11:f0:f7:0e:5c:40
Signer

Actual PE Digest

88:64:6d:95:cd:58:ae:84:ac:6c:96:cf:06:1e:11:f0:f7:0e:5c:40

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/10/2012, 12:22
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

free
_lock
__dllonexit
_unlock
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_onexit
_malloc_crt
_encode_pointer
vswprintf_s
memcpy_s
memset
wcscat_s
wcsncpy_s
wcscpy_s
_crt_debugger_hook
__clean_type_info_names_internal
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_encoded_null

kernel32

GetModuleHandleExW
GetVersionExA
RtlCaptureStackBackTrace
FreeLibrary
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
GetProcAddress
GetModuleHandleW
lstrlenW
GetModuleFileNameW
VirtualProtect
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcessHeap
HeapFree
HeapAlloc
LoadLibraryW
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess

user32

CharNextW

advapi32

RegisterTraceGuidsA
RegDeleteKeyW
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
TraceEvent
RegQueryValueExW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegOpenKeyExA

ole32

CoCreateFreeThreadedMarshaler
StringFromCLSID
CoTaskMemFree
StringFromGUID2
CoCreateInstance

oleaut32

SafeArrayAccessData
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayDestroyData
SysStringByteLen
SysAllocStringByteLen
VariantClear
VariantInit
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen
SysFreeString

mso

ord1880
ord8354
ord6445
ord6435
ord1449

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/EntityPicker.dll
.dll regsvr32 windows x86

140a36e5e7044d25e893411aa942f724

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:12

Not After

04/12/2013, 21:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

12:83:63:93:15:69:76:b1:19:37:8e:42:85:47:66:bd:39:fe:28:e3
Signer

Actual PE Digest

12:83:63:93:15:69:76:b1:19:37:8e:42:85:47:66:bd:39:fe:28:e3

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/10/2012, 12:22
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mso

ord5098
ord6160
ord5674
ord5842
ord1640
ord5390
ord10350
ord6445
ord2019
ord1182
ord9584
ord4948
ord6919
ord2926
ord9638
ord4879
ord1449
ord1571
ord9526
ord2064
ord6435
ord6035
ord5105
ord3920
ord6913
ord10503
ord3611
ord4675
ord8365
ord10031
ord124
ord7450
ord1395
ord5894
ord1880

msvcr90

calloc
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__clean_type_info_names_internal
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
_wtoi
_itoa_s
wcstol
_snwprintf_s
_resetstkoflw
wcscspn
wcsspn
iswspace
swprintf_s
memset
_recalloc
wcsnlen
vswprintf_s
_vscwprintf
_itow_s
wcscat_s
wcsncpy_s
wcscpy_s
malloc
wcsstr
memcpy
free
_CxxThrowException
memcpy_s
memmove_s
_wcsicmp

kernel32

VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapSize
HeapReAlloc
HeapDestroy
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
HeapAlloc
HeapFree
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualProtect
GlobalSize
lstrlenA
lstrcmpW
LoadLibraryA
GetThreadLocale
SetThreadLocale
MultiByteToWideChar
GetCurrentThreadId
RaiseException
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
GetVersionExW
lstrlenW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
lstrcmpiW
LoadLibraryW
SetLastError
GetModuleFileNameW
OutputDebugStringA
FreeLibrary
LoadLibraryExW
FlushInstructionCache
GetCurrentProcess
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc

user32

GetWindowTextLengthW
GetWindowTextW
WinHelpW
IsDialogMessageW
CreateDialogParamW
GetDialogBaseUnits
GetDlgItem
SetParent
SetDlgItemTextW
SetDlgItemInt
SendDlgItemMessageW
GetDlgItemInt
RegisterClipboardFormatW
SetCursor
GetSysColor
FillRect
LoadAcceleratorsW
GetActiveWindow
GetSubMenu
RemoveMenu
DestroyMenu
EnableMenuItem
InsertMenuW
DestroyAcceleratorTable
ClientToScreen
MessageBoxW
DestroyIcon
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
EnableWindow
MapWindowPoints
GetWindowRect
SetWindowPos
LoadMenuW
MoveWindow
SetWindowTextW
AdjustWindowRectEx
GetWindow
TranslateAcceleratorW
CharLowerBuffW
InvalidateRect
GetKeyState
GetFocus
IsChild
SetFocus
GetClassInfoExW
RegisterClassExW
CallWindowProcW
BeginPaint
GetClientRect
EndPaint
GetDC
LoadCursorW
IsWindow
GetParent
ShowWindow
GetWindowLongW
SetWindowLongW
UnionRect
PtInRect
DestroyWindow
DefWindowProcW
CreateWindowExW
UnregisterClassW
RegisterClassW
CharNextW
SendMessageW
PostMessageW
ReleaseDC
UnregisterClassA

gdi32

RestoreDC
CloseMetaFile
DeleteMetaFile
GetDeviceCaps
Rectangle
SetTextColor
SetWindowExtEx
SetDCPenColor
GetStockObject
GetObjectType
GetTextMetricsW
GetTextColor
GetTextExtentPointW
SetWindowOrgEx
SaveDC
CreateMetaFileW
CreateDCW
DeleteDC
SetViewportOrgEx
SetMapMode
LPtoDP
CreateFontIndirectW
CreateRectRgnIndirect
DeleteObject
OffsetWindowOrgEx
SelectClipRgn
CombineRgn
SetTextAlign
SelectObject
GetObjectW
SetDCBrushColor
SetViewportExtEx

advapi32

ReportEventW
DeregisterEventSource
RegQueryValueExW
TraceEvent
RegEnumKeyExW
RegisterTraceGuidsW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterEventSourceW

ole32

CoCreateGuid
ReadClassStm
OleSaveToStream
ReleaseStgMedium
CreateOleAdviseHolder
CreateDataAdviseHolder
OleRegGetMiscStatus
CoCreateInstance
WriteClassStm
OleRegGetUserType
OleRegEnumVerbs
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

OleTranslateColor
VarBstrCmp
SysAllocStringLen
VariantCopy
SysReAllocString
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayPutElement
VarBstrCat
SafeArrayGetVartype
OleCreatePropertyFrame
SafeArrayGetElement
OleCreateFontIndirect
SysFreeString
SysStringLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
SysAllocStringByteLen
SysStringByteLen
VariantInit
VariantClear
VariantChangeType
SafeArrayCreateVector
DispCallFunc
LoadRegTypeLi

shlwapi

PathFindFileNameW

mapi32

ord17

uxtheme

GetThemeSysFont

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 154KB - Virtual size: 154KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/FM20.DLL
.dll regsvr32 windows x86

574d6570571011d06f2fd414d4004641

Code Sign

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bd:66:55:a6:cb:18:b3:44:8f:d3:17:0a:76:95:de:31:eb:85:7e:6a
Signer

Actual PE Digest

bd:66:55:a6:cb:18:b3:44:8f:d3:17:0a:76:95:de:31:eb:85:7e:6a

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

01/11/2013, 01:14
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

SafeArrayPutElement
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
VarBoolFromStr
VarBoolFromCy
VarBoolFromDate
VarBoolFromR8
VarBoolFromR4
VarBoolFromI4
VarBoolFromI2
VarBstrFromDate
VarBstrFromCy
VarBstrFromR8
VarBstrFromI2
VarCyFromBool
VarCyFromStr
VarCyFromDate
VarCyFromR8
VarCyFromR4
VarCyFromI4
VarCyFromI2
VarDateFromBool
VarDateFromStr
VarDateFromCy
VarDateFromR8
VarDateFromR4
VarDateFromI4
VarDateFromI2
VarR8FromStr
VarR8FromDate
VarR8FromCy
VarR4FromDate
VarR4FromCy
VarR4FromR8
VarR4FromI4
VarI4FromDate
VarI4FromCy
VarI4FromR8
VarI4FromR4
VarI2FromStr
VarI2FromDate
VarI2FromCy
VarI2FromR8
VarI2FromR4
VarI2FromI4
VarBstrFromBool
VarBstrFromI4
VarI4FromStr
VariantCopy
SafeArrayGetUBound
SafeArrayCopy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayDestroy
SafeArrayCreate
VarBstrFromR4
VarR4FromStr
LoadTypeLi
CreateErrorInfo
SetErrorInfo
GetErrorInfo
VariantChangeType
SysReAllocStringLen
SysReAllocString
SysAllocStringLen
SysAllocString
VariantClear
SysStringLen
VariantChangeTypeEx
VariantInit
SysFreeString

gdi32

GetROP2
SetROP2
CreateFontIndirectW
UnrealizeObject
SetBrushOrgEx
Rectangle
SetPixelV
SetPixel
OffsetRgn
CombineRgn
GetRegionData
CreateHatchBrush
LineTo
RectVisible
ExcludeClipRect
PolylineTo
MoveToEx
SelectClipRgn
GetClipRgn
CreateRectRgn
CreatePen
GetNearestColor
GetBkColor
SetStretchBltMode
StretchBlt
PatBlt
GetPixel
GetCurrentObject
CreateBitmap
IntersectClipRect
CreateRectRgnIndirect
SetWindowOrgEx
SetWindowExtEx
SetViewportExtEx
LPtoDP
SetMapMode
SetBkColor
SaveDC
RestoreDC
PlayMetaFile
GetWindowOrgEx
GetWindowExtEx
GetObjectType
GetMapMode
CreateMetaFileA
CloseMetaFile
DeleteMetaFile
SetTextColor
SetBkMode
RealizePalette
SelectPalette
CreateDCA
CreateDCW
CreateFontIndirectA
CreateICA
CreateICW
EnumFontFamiliesA
EnumFontFamiliesW
GetTextExtentPoint32A
GetTextExtentPoint32W
GetTextMetricsA
GetTextMetricsW
GetObjectA
GetObjectW
ExtTextOutA
ExtTextOutW
GetTextFaceA
GetTextFaceW
CreateSolidBrush
DeleteObject
GetStockObject
CreatePatternBrush
CreatePalette
GetDeviceCaps
GetPaletteEntries
CreateCompatibleDC
DeleteDC
BitBlt
CreateCompatibleBitmap
SelectObject
SetViewportOrgEx
GetClipBox

kernel32

DeleteFileW
CloseHandle
GetProfileIntA
DecodePointer
GetCommandLineA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
GetCurrentProcess
InterlockedDecrement
SetEndOfFile
InterlockedIncrement
SetLastError
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
WriteFile
GetCPInfo
GetACP
GetOEMCP
GetStringTypeW
LCMapStringW
SetStdHandle
GetConsoleCP
GetConsoleMode
InterlockedExchange
SetFilePointer
LoadLibraryW
RtlUnwind
EnumSystemLocalesA
WriteConsoleW
FlushFileBuffers
LocalAlloc
LoadLibraryA
SearchPathA
TlsGetValue
GetLocaleInfoW
GetLastError
GetProcessHeap
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetCurrentThreadId
TlsAlloc
TlsSetValue
TlsFree
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
IsValidLocale
GetSystemDefaultLCID
GetUserDefaultLCID
SearchPathW
LoadLibraryExA
RaiseException
GetFullPathNameA
GetModuleFileNameA
FreeResource
LoadResource
LockResource
SizeofResource
FindResourceW
SetCurrentDirectoryA
SetCurrentDirectoryW
GetCurrentDirectoryA
GetCurrentDirectoryW
CreateDirectoryA
CreateDirectoryW
FindFirstFileA
FindFirstFileW
GetFileAttributesA
GetFileAttributesW
GetFullPathNameW
OutputDebugStringA
OutputDebugStringW
GetSystemDirectoryA
GetSystemDirectoryW
GetWindowsDirectoryA
GetWindowsDirectoryW
GetVersionExA
FormatMessageA
FormatMessageW
lstrlenW
FindResourceA
CompareStringW
MultiByteToWideChar
WideCharToMultiByte
CompareStringA
GetLocaleInfoA
GetSystemInfo
VirtualAlloc
VirtualFree
GlobalLock
GlobalUnlock
OpenFile
_lread
_lwrite
_lclose
_llseek
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetTickCount
GetCurrentProcessId
GlobalAlloc
GlobalSize
GlobalFree
IsValidCodePage
GetUserDefaultLangID
IsDBCSLeadByte
Sleep
MulDiv
GetEnvironmentVariableW
CreateFileW

advapi32

RegEnumKeyExW
RegCreateKeyExW
RegEnumKeyW
RegFlushKey
RegSetValueExW
RegSetValueExA
RegSetValueA
RegQueryValueExW
RegQueryValueExA
RegQueryValueA
RegOpenKeyExA
RegOpenKeyW
RegOpenKeyA
RegCloseKey
RegEnumKeyExA
RegEnumKeyA
RegDeleteKeyW
RegDeleteKeyA
RegCreateKeyW
RegCreateKeyA
RegSetValueW
RegQueryValueW
RegOpenKeyExW

ole32

ReadClassStg
ReadClassStm
OleFlushClipboard
OleIsCurrentClipboard
StringFromCLSID
ReleaseStgMedium
ProgIDFromCLSID
StringFromGUID2
IIDFromString
OleSaveToStream
GetRunningObjectTable
StgCreateDocfileOnILockBytes
CreateBindCtx
CreateILockBytesOnHGlobal
DoDragDrop
OleSetClipboard
OleGetClipboard
CreateOleAdviseHolder
OleGetIconOfClass
CreateStreamOnHGlobal
CreateDataAdviseHolder
WriteClassStg
WriteClassStm
WriteFmtUserTypeStg
RegisterDragDrop
RevokeDragDrop
CreateDataCache
OleDraw
CLSIDFromString
CLSIDFromProgID
CoCreateGuid
CreateItemMoniker
OleSave
CoRegisterMessageFilter
OleQueryCreateFromData
OleCreateFromData
OleCreateLinkFromData
OleCreateStaticFromData
OleRun
CoGetClassObject
OleQueryLinkFromData
StgOpenStorage
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
StgCreateDocfile

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllRegisterServerSetup
DllUnregisterServer
FormsCheckUFIControls
FormsCloseParentUnit
FormsOpenParentUnit
FormsSetLCID
_ChooseColorA@4
_ChooseColorW@4
_ChooseFontA@4
_ChooseFontW@4
_CommDlgExtendedError@0
_ExtractIconA@12
_ExtractIconW@12
_GetOpenFileNameA@4
_GetOpenFileNameW@4
_GetSaveFileNameA@4
_GetSaveFileNameW@4
_PrintDlgW@4

Sections

.text
Size: 858KB - Virtual size: 857KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 240KB - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/FM20CHS.DLL
.dll windows x86

Code Sign

33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

26/07/2012, 20:50

Not After

26/10/2013, 20:50

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4b:5f:a3:32:e9:1f:a4:6d:72:f1:8d:5a:c9:2c:b1:2c:97:69:12:b4
Signer

Actual PE Digest

4b:5f:a3:32:e9:1f:a4:6d:72:f1:8d:5a:c9:2c:b1:2c:97:69:12:b4

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

12/10/2012, 13:55
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 364B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/Office14/GFX.DLL
.dll windows x86

b14a9f005202acfe46fe69d4cb26470a

Code Sign

33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:2d:27:7b:5a:c0:cb:94:2a:d6:db:5a:9f:0c:5a:e0:99:3a:f3:9e
Signer

Actual PE Digest

61:2d:27:7b:5a:c0:cb:94:2a:d6:db:5a:9f:0c:5a:e0:99:3a:f3:9e

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

27/06/2013, 21:07
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadFile
WriteFile
SetFilePointerEx
GetTempFileNameW
GetTempPathW
GetFileSizeEx
HeapFree
HeapAlloc
DisableThreadLibraryCalls
SystemTimeToFileTime
TlsFree
TlsAlloc
SetThreadPriority
GetThreadPriority
GetCurrentProcessId
LoadLibraryA
VirtualFree
VirtualAlloc
TlsGetValue
TlsSetValue
GetSystemInfo
GetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
CreateEventA
DebugBreak
OutputDebugStringA
EncodePointer
DecodePointer
VerSetConditionMask
VerifyVersionInfoW
GetLastError
Sleep
GetModuleHandleW
SignalObjectAndWait
CreateEventW
CreateThread
ResetEvent
SetEvent
LeaveCriticalSection
EnterCriticalSection
RaiseException
FormatMessageW
SetLastError
MulDiv
GetVersionExA
GetModuleFileNameW
GetModuleHandleExW
RtlCaptureStackBackTrace
VirtualProtect
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetProcessHeap
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteFileW
GetSystemDefaultLangID
lstrcmpA
GlobalFree
LocalAlloc
DeleteCriticalSection
InitializeCriticalSection
GetTickCount
GetCurrentThreadId
GetProcAddress
LoadLibraryW
GetSystemWow64DirectoryW
GetSystemDirectoryW
CreateMutexW
CloseHandle
GetCurrentProcess
IsWow64Process
FreeLibrary
FindFirstFileW
FindClose
ReleaseMutex
WaitForMultipleObjects
WaitForSingleObject

gdi32

DeleteDC
SelectPalette
RealizePalette
SetROP2
SetViewportOrgEx
OffsetWindowOrgEx
StretchBlt
SetStretchBltMode
BitBlt
LPtoDP
CreateCompatibleDC
CreateFontIndirectW
GetStockObject
GetRgnBox
GetRegionData
CreateDIBSection
GetPaletteEntries
DeleteEnhMetaFile
DeleteMetaFile
EnumFontFamiliesExW
GetEnhMetaFileHeader
GetWindowOrgEx
CreateEnhMetaFileW
EnumMetaFile
SelectObject
SetMetaFileBitsEx
GetMetaFileBitsEx
GetEnhMetaFileBits
StretchDIBits
GetOutlineTextMetricsW
GetObjectW
GetCurrentObject
GetDeviceCaps
GetObjectType
OffsetRgn
SetBkMode
SetBkColor
SetTextColor
SetTextAlign
SaveDC
RestoreDC
GetTextFaceW
GetFontData
GetTextCharsetInfo
CreateICW
CreateDCW
Escape
ExtEscape
EndDoc
StartDocW
AbortDoc
EndPage
StartPage
GetPath
SetEnhMetaFileBits
GetViewportOrgEx
LineDDA
SetGraphicsMode
SetWorldTransform
CreateRectRgn
CreateRectRgnIndirect
DeleteObject
CombineRgn
SelectClipRgn
GetGlyphOutlineW
GetClipRgn
ExtSelectClipRgn
CloseEnhMetaFile
SetMetaRgn
ModifyWorldTransform
SetMapMode
SetWindowOrgEx
GetKerningPairsW
GetTextMetricsW

user32

InvalidateRgn
InvalidateRect
UnionRect
IntersectRect
InflateRect
ClientToScreen
DestroyWindow
UnregisterClassW
RegisterWindowMessageW
RegisterClassExW
CreateWindowExW
DefWindowProcW
EnumDisplayMonitors
MonitorFromPoint
GetClientRect
OffsetRect
GetMonitorInfoW
EnumDisplayDevicesW
GetDC
ReleaseDC
FillRect
GetSystemMetrics
GetSysColor

advapi32

GetTraceEnableFlags
GetTraceLoggerHandle
UnregisterTraceGuids
TraceEvent
RegisterTraceGuidsA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
GetTraceEnableLevel

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification

msimg32

AlphaBlend

msvcr90

__clean_type_info_names_internal
_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
_vscwprintf
vswprintf_s
isdigit
atoi
system
vsprintf_s
vfprintf
remove
fclose
fopen
memmove
_resetstkoflw
_CIlog
printf
_vsnprintf_s
free
malloc
_CIlog10
_aligned_free
_aligned_malloc
??8type_info@@QBE_NABV0@@Z
_CItan
_hypotf
_CIfmod
_CIasin
_hypot
memcpy
_set_controlfp
_wcsnicmp
_controlfp_s
ceil
_CIacos
memset
floor
_CIatan2
_CIcos
_CIsin
__CxxFrameHandler3
memcpy_s
wcsncpy_s
_isnan
_CIexp
_snprintf_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_CIsqrt
_CIpow
_CxxThrowException
_finite

ole32

CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
StringFromCLSID

Exports

Exports

?Retrieve@Typeface@GEL@@SG?AV12@PB_WEEPBUtagPANOSE@@@Z

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/GKExcel.dll
.dll windows x86

bdcdfe77e3085858bca0647eade7a7d8

Code Sign

33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1a:ed:0f:74:f9:32:2b:e6:a9:cb:f3:d6:c8:50:cb:2e:32:98:74:a6
Signer

Actual PE Digest

1a:ed:0f:74:f9:32:2b:e6:a9:cb:f3:d6:c8:50:cb:2e:32:98:74:a6

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

15/07/2013, 19:25
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
VirtualAlloc
HeapReAlloc
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
SetEnvironmentVariableA
SetEnvironmentVariableW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetProcAddress
GetModuleHandleW
GetCommandLineA
GetCurrentThreadId
SetFilePointer
CopyFileW
GetTempPathW
WriteFile
CompareStringA
CreateFileW
GetLastError
LoadLibraryA
GetFileSizeEx
CloseHandle
RaiseException
GetTickCount
CompareStringW
lstrlenA
GetProcessHeap
GlobalFree
GlobalAlloc
InitializeCriticalSection
GetSystemInfo
SetLastError

ole32

CreateStreamOnHGlobal
CoTaskMemAlloc
StgIsStorageFile
StgOpenStorageEx
CoTaskMemFree

oleaut32

SysAllocStringLen
SysAllocString
SysFreeString
VariantClear

advapi32

IsValidSecurityDescriptor
GetSecurityDescriptorLength
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

Exports

Exports

DwGetErrorType
FGetErrorCallstack
FValidateExcelFile
FValidateExcelFile5
FValidateExcelFile8
FValidateExcelStorage
FValidateExcelStorage5
FValidateExcelStorage8
FValidatePivotStm
FValidatePivotStm5
FValidatePivotStm8
FValidateVBA
HrInitHost

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 99KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 163KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/GKPowerPoint.dll
.dll windows x86

a28690b5fd7d6abf413c8633fb1596b9

Code Sign

33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:12

Not After

04/12/2013, 21:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e5:6a:1c:88:55:3d:17:d1:8f:24:08:19:88:19:27:76:8d:ad:32:e8
Signer

Actual PE Digest

e5:6a:1c:88:55:3d:17:d1:8f:24:08:19:88:19:27:76:8d:ad:32:e8

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

09/03/2013, 00:07
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsFree
InterlockedIncrement
GetLastError
InterlockedDecrement
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
TlsGetValue
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
TlsSetValue
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
SetEnvironmentVariableA
SetEnvironmentVariableW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
GetProcAddress
GetModuleHandleW
GetCommandLineA
GetCurrentThreadId
GlobalSize
GlobalUnlock
GlobalLock
SetLastError
CompareStringW
GlobalFree
GlobalAlloc
CopyFileW
GetTempPathW
WriteFile
RaiseException
lstrcmpW
CreateFileW
TlsAlloc
CloseHandle
GetFileSizeEx
GetCPInfo
lstrlenA
GetProcessHeap
GetStringTypeExW
GetSystemDefaultLCID
InitializeCriticalSection
GetSystemInfo

ole32

CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateStreamOnHGlobal
CoTaskMemAlloc
StgIsStorageFile
StgOpenStorageEx
CoTaskMemFree

oleaut32

SysAllocString
SysFreeString
VariantClear

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

Exports

Exports

DwGetErrorType
FGetErrorCallstack
FValidatePptFile
FValidatePptStorage
HrInitHost

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 257KB - Virtual size: 265KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/GKWord.dll
.dll windows x86

98e7c5d383455f00cc0425cce5ec3dc3

Code Sign

33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:12

Not After

04/12/2013, 21:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7f:05:13:73:f0:02:38:be:a6:17:24:fb:41:9e:ba:8e:d1:52:d2:67
Signer

Actual PE Digest

7f:05:13:73:f0:02:38:be:a6:17:24:fb:41:9e:ba:8e:d1:52:d2:67

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

09/03/2013, 00:07
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
LeaveCriticalSection
GetLastError
EnterCriticalSection
HeapAlloc
VirtualAlloc
HeapReAlloc
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
SetEnvironmentVariableA
SetEnvironmentVariableW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetProcAddress
GetModuleHandleW
GetCommandLineA
GetCurrentThreadId
lstrcmpW
CopyFileW
GetTempPathW
WriteFile
CreateFileW
InterlockedDecrement
GetFileSizeEx
CloseHandle
CompareStringW
CompareStringA
lstrlenA
GetProcessHeap
GlobalFree
GlobalAlloc
InitializeCriticalSection
GetSystemInfo
RaiseException

ole32

CreateStreamOnHGlobal
CoTaskMemAlloc
StgIsStorageFile
StgOpenStorageEx
CoTaskMemFree

oleaut32

SysAllocString
SysFreeString
SysAllocStringLen
VariantClear

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

Exports

Exports

DwGetErrorType
FGetErrorCallstack
FValidateVBA
FValidateWordFile
FValidateWordStorage
HrInitHost

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 78KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/GRAPH.EXE
.exe windows x86

573bf669ed89b0716ee70ea2155921b0

Code Sign

33:00:00:01:6c:1b:db:5a:dd:bf:4c:55:9d:00:00:00:00:01:6c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2020, 17:24

Not After

01/04/2021, 17:24

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:D6BD-E3E7-1685,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:f9:f1:3d:78:67:62:cc:94:66:00:02:00:00:01:f9
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/07/2020, 18:30

Not After

25/04/2021, 18:30

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:04:35:45:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

20/09/2018, 17:42

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5e:a1:51:26:6f:2f:bc:c1:51:ce:cd:4c:55:66:88:f8:35:1c:37:d4:df:bf:e9:b1:b6:93:1c:35:08:24:e9:6a
Signer

Actual PE Digest

5e:a1:51:26:6f:2f:bc:c1:51:ce:cd:4c:55:66:88:f8:35:1c:37:d4:df:bf:e9:b1:b6:93:1c:35:08:24:e9:6a

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

7a:df:26:a2:88:d0:8f:59:43:e6:d7:c5:34:eb:71:64:d5:f0:42:30
Signer

Actual PE Digest

7a:df:26:a2:88:d0:8f:59:43:e6:d7:c5:34:eb:71:64:d5:f0:42:30

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

11/03/2021, 04:45
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceEvent
RegQueryValueExA
RegOpenKeyExA
RegisterTraceGuidsA
DeregisterEventSource
ReportEventW
RegisterEventSourceW
RegQueryValueExW

gdi32

GetNearestColor
GetTextFaceW
GetNearestPaletteIndex
GetObjectW
GetBkColor
SaveDC
GetMapMode
CreateBrushIndirect
CreateCompatibleBitmap
SetMapMode
CombineRgn
DPtoLP
SetRectRgn
GetPaletteEntries
SelectObject
DeleteObject
SetBkMode
CreateBitmap
GetTextCharsetInfo
GetRgnBox
ExcludeClipRect
SetBkColor
GetDIBits
SetBrushOrgEx
CreateFontIndirectW
CreateHatchBrush
SetTextColor
EnumFontsW
GetWindowExtEx
SetWindowExtEx
LPtoDP
GetTextMetricsW
CreateDIBPatternBrush
BitBlt
EnumFontFamiliesW
SetWindowOrgEx
SetBitmapBits
ExtCreatePen
MoveToEx
GetCurrentPositionEx
LineTo
PatBlt
Polygon
Ellipse
Pie
Arc
GetWindowOrgEx
CreateCompatibleDC
DeleteDC
GetBitmapBits
GetPixel
SetPixel
StretchBlt
Escape
CreatePolygonRgn
GetEnhMetaFileHeader
GetWinMetaFileBits
SetMetaFileBitsEx
DeleteMetaFile
DeleteEnhMetaFile
GetMetaFileBitsEx
SetWinMetaFileBits
GdiComment
Polyline
CreateDIBSection
GdiFlush
GetSystemPaletteEntries
CreatePalette
SelectPalette
RealizePalette
RoundRect
Rectangle
CreateRectRgn
CreateRectRgnIndirect
CreateRoundRectRgn
OffsetRgn
GetTextAlign
SetTextAlign
SetMapperFlags
EnumObjects
GetCurrentObject
ExtEscape
CreateICW
SetStretchBltMode
StretchDIBits
InvertRgn
GetEnhMetaFileBits
CopyMetaFileW
CopyEnhMetaFileW
CreateDIBitmap
GetObjectType
SetEnhMetaFileBits
SetDIBits
GetOutlineTextMetricsW
ExtTextOutA
ExtTextOutW
UnrealizeObject
SetLayout
GetLayout
CreateFontA
GetViewportExtEx
SetROP2
CreatePatternBrush
SetViewportExtEx
GetClipBox
CreatePen
GetCharacterPlacementA
GetTextMetricsA
GetStockObject
GetTextColor
RestoreDC
CreateSolidBrush
SelectClipRgn
GetDeviceCaps
IntersectClipRect

kernel32

GlobalLock
GlobalAlloc
GetVersionExW
MulDiv
GlobalUnlock
GlobalFree
IsDBCSLeadByte
GetACP
IsDBCSLeadByteEx
GlobalSize
GlobalReAlloc
GetFileSize
GetVolumeInformationW
UnlockFile
LockFile
GetCurrentDirectoryW
MoveFileW
ReadFile
WriteFile
SetFilePointer
DeleteFileW
SetFileAttributesW
CloseHandle
SearchPathW
FindClose
FindFirstFileW
FindNextFileW
SetCurrentDirectoryW
SetEnvironmentVariableW
GetTickCount
FindResourceW
LoadResource
GetLocalTime
GetStringTypeW
FreeLibrary
LCMapStringW
GetOEMCP
Sleep
GlobalCompact
GetWindowsDirectoryW
IsValidCodePage
VirtualAlloc
VirtualFree
LoadLibraryExW
SizeofResource
LockResource
SetErrorMode
EnumCalendarInfoW
GetFullPathNameW
HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree
QueryPerformanceCounter
GetSystemTime
SystemTimeToTzSpecificLocalTime
InitializeCriticalSection
SetCriticalSectionSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
lstrcmpW
LocalAlloc
LocalFree
GetLocaleInfoW
SetEvent
CreateEventW
InitializeCriticalSectionAndSpinCount
RaiseException
WideCharToMultiByte
WaitForSingleObject
GetStringTypeExW
OutputDebugStringA
GetModuleFileNameW
LoadLibraryW
GetLastError
GetFileAttributesW
GetVersion
GetStringTypeExA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
GetSystemTimeAsFileTime
VirtualProtect
RtlCaptureStackBackTrace
GetModuleHandleExW
LoadLibraryA
FormatMessageA
GetSystemDirectoryW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
SetLastError
GetCurrentProcessId
GetVersionExA
GetCurrentThreadId
GetSystemDefaultLCID
GetUserDefaultLCID

ole32

StringFromGUID2
CoInitialize
CoTaskMemFree
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleQueryLinkFromData
CreateDataAdviseHolder
OleRegGetUserType
CreateOleAdviseHolder
ReadClassStg
CoLockObjectExternal
GetRunningObjectTable
CoRevokeClassObject
CoRegisterClassObject
CreateStreamOnHGlobal
CoGetMalloc
OleQueryCreateFromData
CoUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
OleTranslateAccelerator
OleIsCurrentClipboard
GetHGlobalFromILockBytes
CreateItemMoniker
OleSetClipboard
MkParseDisplayName
CreateBindCtx
ReleaseStgMedium
ProgIDFromCLSID
OleLoad
OleSave
OleIsRunning
OleCreateLinkFromData
OleGetClipboard
CoDisconnectObject
OleFlushClipboard
WriteFmtUserTypeStg
OleGetIconOfClass
CoCreateInstance
ReadClassStm
WriteClassStg
StgIsStorageFile
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal

oleaut32

VariantInit
SysStringLen
VariantChangeType
SysFreeString
LoadTypeLi
RegisterTypeLi
VariantClear
SysAllocString
SysAllocStringLen
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayLock
SafeArrayUnlock
VariantCopyInd
SafeArrayGetDim
SafeArrayGetElement
SafeArrayCreate
SafeArrayPutElement
SafeArrayDestroy
SafeArrayGetElemsize
SafeArrayAccessData
SafeArrayUnaccessData
RegisterActiveObject
RevokeActiveObject
LoadRegTypeLi
SetErrorInfo
VarDateFromUdate
VarUdateFromDate
GetAltMonthNames

user32

GetActiveWindow
IsChild
GetSystemMenu
PeekMessageW
UnionRect
BeginPaint
EndPaint
GetScrollInfo
InvalidateRect
SetRect
GetTopWindow
GetParent
MapWindowPoints
GetUpdateRgn
InvalidateRgn
ValidateRect
SetCapture
ReleaseCapture
GetCapture
EnableWindow
IsWindowEnabled
IsWindow
DestroyWindow
UpdateWindow
FlashWindow
DispatchMessageW
GetClassLongW
GetFocus
BeginDeferWindowPos
EndDeferWindowPos
GetUpdateRect
IsWindowVisible
InSendMessage
VkKeyScanW
GetClassNameW
TranslateMessage
MapVirtualKeyW
GetAsyncKeyState
WaitMessage
GetQueueStatus
GetKeyState
GetInputState
SetTimer
KillTimer
PostQuitMessage
GetCursorPos
RegisterClipboardFormatW
SetCursor
ShowCursor
MessageBeep
GetWindowThreadProcessId
EnumDisplayMonitors
CreateMenu
DestroyMenu
DrawMenuBar
GetMenuItemCount
GetMenuItemID
GetSubMenu
EnableMenuItem
ShowCaret
SetWindowWord
SetScrollPos
GetWindowWord
CallWindowProcW
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollInfo
EmptyClipboard
CloseClipboard
SetCaretPos
IsClipboardFormatAvailable
GetClipboardData
SetClipboardData
OpenClipboard
EnumClipboardFormats
RegisterWindowMessageA
InflateRect
OffsetRect
CreateCaret
DestroyCaret
GetCaretPos
GetKeyboardLayout
GetThreadDesktop
OpenInputDesktop
GetUserObjectInformationW
CloseDesktop
IsCharUpperW
SetWindowTextA
IsWindowUnicode
DispatchMessageA
CallNextHookEx
GetMessageTime
RegisterWindowMessageW
IsZoomed
MoveWindow
SetParent
GetMenu
PostMessageW
GetMessageW
GetKeyboardState
SetKeyboardState
SetCursorPos
DrawFocusRect
CharUpperBuffW
GetCursor
GetIconInfo
WindowFromPoint
GetKeyboardLayoutList
DefWindowProcW
DrawIcon
MessageBoxW
SetActiveWindow
DestroyAcceleratorTable
GetDesktopWindow
CharLowerBuffW
GetDoubleClickTime
MessageBoxA
GetDC
RegisterClassW
LoadIconW
LoadCursorW
HideCaret
AdjustWindowRectEx
SetFocus
ShowWindow
ClientToScreen
RegisterClassExW
GetMonitorInfoW
MonitorFromRect
IsRectEmpty
IntersectRect
SystemParametersInfoW
UnhookWindowsHookEx
SetWindowsHookExW
PtInRect
DeferWindowPos
SetWindowPos
ScreenToClient
GetWindowRect
SendMessageW
SetWindowPlacement
GetWindowPlacement
GetWindow
FillRect
GetClientRect
IsIconic
SetForegroundWindow
GetSysColor
SetWindowLongW
GetWindowLongW
CreateWindowExW
GetSystemMetrics
EnumThreadWindows
ReleaseDC

msvcr90

_setjmp3
__CxxFrameHandler3
__CxxLongjmpUnwind
memcpy
_CxxThrowException
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
?terminate@@YAXXZ
_crt_debugger_hook
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_seh_longjmp_unwind4
_initterm_e
_initterm
_acmdln
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
vswprintf_s
memset
_wassert
tolower
toupper
_fpreset
_ecvt_s
_snwprintf_s
wcschr
wcsncpy_s
longjmp
memmove
exit

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 810KB - Virtual size: 812KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/Graph.exe.manifest
office2010/Office14/IEAWSDC.DLL
.dll regsvr32 windows x86

6524408fe830c3b50457c50ec921ad34

Code Sign

61:1a:f5:ea:00:00:00:00:00:6a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/11/2011, 22:39

Not After

01/02/2013, 22:49

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:05:13:36:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2011, 20:42

Not After

25/10/2012, 20:42

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

94:2f:58:48:99:51:8e:2c:4d:f4:e9:54:37:7d:a6:63:35:8d:f0:cf
Signer

Actual PE Digest

94:2f:58:48:99:51:8e:2c:4d:f4:e9:54:37:7d:a6:63:35:8d:f0:cf

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

14/03/2012, 04:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

urlmon

CoInternetParseUrl
URLDownloadToCacheFileW

setupapi

SetupIterateCabinetW

shell32

SHFileOperationW
ord165
ShellExecuteW
SHGetDesktopFolder
SHGetSpecialFolderPathW

user32

CreateWindowExW
RegisterClassExW
EnumThreadWindows
DestroyWindow
GetClassNameW
ShowWindow
SetForegroundWindow
LoadCursorW
GetClassInfoExW
PostMessageW
SetWindowLongW
OpenClipboard
EmptyClipboard
CloseClipboard
RegisterClipboardFormatW
SetClipboardData
CallWindowProcA
GetWindowLongA
SetWindowLongA
DefWindowProcA
CharNextW
CharNextA
UnregisterClassA

kernel32

RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
GetProcAddress
GetModuleHandleA
lstrlenA
lstrcmpiA
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleW
IsDBCSLeadByte
CloseHandle
LoadLibraryExW
GetSystemDirectoryW
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
CopyFileW
DeleteFileW
ReadFile
WriteFile
SetFilePointerEx
GetFileSizeEx
CreateFileW
GetTempPathW
LoadLibraryW
HeapSize
GetStringTypeExW
GlobalUnlock
GlobalFree
GlobalLock
GlobalAlloc
GetFileSize
CreateDirectoryW
GetFileAttributesW
FindNextFileW
FindFirstFileW
GetTempFileNameW
ExpandEnvironmentStringsW
SetFilePointer
MoveFileW
FindClose
CreateThread
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
SetLastError
GetLocaleInfoA
LCMapStringA
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
InitializeCriticalSectionAndSpinCount
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapDestroy
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
ExitProcess
Sleep
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
GetVersionExW
TlsAlloc
InterlockedCompareExchange
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
GetCommandLineA
VirtualProtect
GetSystemInfo
VirtualQuery
HeapReAlloc
TlsGetValue

advapi32

RegEnumKeyExW
RegDeleteValueA
RegEnumKeyW
CryptGetDefaultProviderW
CryptAcquireContextW
CryptReleaseContext
RegEnumValueW
RegQueryValueExA
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteKeyA

gdi32

GetMetaFileW
SetEnhMetaFileBits
SetMetaFileBitsEx
GetMetaFileBitsEx
DeleteMetaFile
SetWinMetaFileBits
GetEnhMetaFileW

oleaut32

SysFreeString
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
VariantInit
VariantClear
LoadRegTypeLi
SysStringLen

shlwapi

UrlGetPartW

ole32

CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
DoDragDrop
StringFromGUID2

crypt32

CryptVerifyCertificateSignatureEx

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
HrAddAssetIdToMruListEx
HrExtractTemplateToPath
HrExtractTemplateVer
_HrAddAssetIdToMruList@12
_HrExtractTemplate@20

Sections

.text
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/INTLDATE.DLL
.dll windows x86

abe3a61581b8e9dfda425bed0d0f7ba5

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:02:8e:42:00:00:00:00:00:1f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d0:2d:5a:ec:f3:73:96:61:9f:ac:c4:c1:d9:1b:27:e6:1a:22:07:3b
Signer

Actual PE Digest

d0:2d:5a:ec:f3:73:96:61:9f:ac:c4:c1:d9:1b:27:e6:1a:22:07:3b

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/10/2012, 12:23
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegEnumValueW
RegQueryInfoKeyA
RegCreateKeyExW
RegCloseKey

kernel32

GetSystemTime
LockResource
LoadResource
FindResourceExA
LeaveCriticalSection
EnumCalendarInfoExW
EnterCriticalSection
GetModuleHandleA
RaiseException
InitializeCriticalSection
DeleteCriticalSection
GlobalAlloc
GlobalFree
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcAddress
GetProcessHeap
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect

msvcr90

__dllonexit
_lock
_onexit
_crt_debugger_hook
__clean_type_info_names_internal
_except_handler4_common
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_unlock
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
_encode_pointer
_wcsicmp
__CxxFrameHandler3
memset
memcpy
memmove
??3@YAXPAX@Z
_decode_pointer

Exports

Exports

AdjustMonth
BidiConvertDate
ConvertDateGregToLocal
ConvertDateLocalToGreg
DaysInMonth
GetDateFormatInfo
GetMonthAdvance
IsCalendarSupported
MonthsInYear
SetMonthAdvance

Sections

.text
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/Library/Analysis/ANALYS32.XLL
.xll windows x86

243d7b7a9081358543280de842bbf896

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

eb:72:15:f9:ef:fa:aa:a7:9c:74:f4:26:4c:5d:0f:88:76:c2:a4:d6
Signer

Actual PE Digest

eb:72:15:f9:ef:fa:aa:a7:9c:74:f4:26:4c:5d:0f:88:76:c2:a4:d6

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13/03/2010, 08:18
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetProcAddress
GetModuleHandleA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
DisableThreadLibraryCalls

msvcr90

srand
_CItan
_wcsnicmp
towlower
wcsncat_s
wcsncmp
wcstod
isdigit
mbstowcs_s
_gcvt_s
rand
_malloc_crt
free
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
wcscat_s
toupper
_CIatan
_CIatan2
_CIcos
_CIexp
wcschr
_CIlog
_CIlog10
_CIpow
ceil
_CIsqrt
wcscpy_s
floor
_CIfmod
_CIsin
_encode_pointer

Exports

Exports

_SetExcel12EntryPt@4
accrint
accrintm
besseli
besselj
besselk
bessely
bin2dec
bin2hex
bin2oct
convert
coupdaybs
coupdays
coupdaysnc
coupncd
coupnum
couppcd
cumipmt
cumprinc
dec2bin
dec2hex
dec2oct
delta
disc
dollarde
dollarfr
duration
edate
effect
eomonth
erf
erfc
fDialog
fExit
factdouble
fnAmorDegrc
fnAmorLinc
fnAnova1
fnAnova1Q
fnAnova2
fnAnova2Q
fnAnova3
fnAnova3Q
fnDescr
fnDescrQ
fnExpon
fnExponQ
fnFourier
fnFourierQ
fnFtestV
fnFtestVQ
fnHistogram
fnHistogramQ
fnMCorrel
fnMCorrelQ
fnMCovar
fnMCovarQ
fnMoveAvg
fnMoveAvgQ
fnRandBetween
fnRandom
fnRandomQ
fnRankPerc
fnRankPercQ
fnRegress
fnRegressQ
fnSample
fnSampleQ
fnTtestEq
fnTtestEqQ
fnTtestM
fnTtestMQ
fnTtestUeq
fnTtestUeqQ
fnWeekNum
fnZtestM
fnZtestMQ
fncomplex
fvschedule
gcd
gestep
hex2bin
hex2dec
hex2oct
imabs
imaginary
imargument
imconjugate
imcos
imdiv
imexp
imln
imlog10
imlog2
impower
improduct
imreal
imsin
imsqrt
imsub
imsum
intrate
iseven
isodd
lcm
mduration
mround
multinomial
networkdays
nominal
oct2bin
oct2dec
oct2hex
oddfprice
oddfyield
oddlprice
oddlyield
price
pricedisc
pricemat
quotient
received
seriessum
sqrtpi
tbilleq
tbillp
tbilly
workday
xirr
xlAddInManagerInfo12
xlAutoAdd
xlAutoClose
xlAutoOpen
xlAutoRegister12
xlAutoRemove
xnpv
yearfrac
yield
yielddisc
yieldmat

Sections

.text
Size: 151KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/Library/Analysis/ATPVBACS.XLAM
.xlam office2007

VBA Functions and Subs

ThisWorkbook

Sheet1

Sheet2
office2010/Office14/Library/Analysis/ATPVBAEN.XLAM
.xlam office2007

VBA Functions and Subs

ThisWorkbook

Sheet1

Sheet2
office2010/Office14/Library/Analysis/FUNCRES.XLAM
.xlam office2007

ThisWorkbook

Sheet1

RibbonX_Code
office2010/Office14/Library/Analysis/PROCDB.XLAM
.xlam office2007
office2010/Office14/Library/EUROTOOL.XLAM
.xlam office2007
office2010/Office14/Library/SOLVER/SOLVER.XLAM
.xlam office2007

ThisWorkbook

Sheet1

Sheet2

SolverCode

VBA_Functions

dlgSolverParameters

dlgConstraint

dlgOptions

dlgLoadSave

dlgFinish

dlgInterrupt

dlgMerge

dlgScenario

SolverCalls

DialogLinks
office2010/Office14/Library/SOLVER/SOLVER32.DLL
.dll windows x86

16854f2ee8d0e7fb1728748b4925c638

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

a9:c2:96:f1:ca:5d:96:91:d1:4a:48:8a:05:44:02:7d:2d:ab:97:bb
Signer

Actual PE Digest

a9:c2:96:f1:ca:5d:96:91:d1:4a:48:8a:05:44:02:7d:2d:ab:97:bb

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13/03/2010, 08:18
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
HeapFree
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
VirtualProtect
GetModuleHandleA
GetProcAddress
GetTickCount
GlobalMemoryStatus

oleaut32

SysAllocString
VariantInit
VariantClear
VariantChangeType
SysFreeString

msvcr90

_CIsqrt
_CIasin
_CIpow
_CIexp
ceil
floor
realloc
calloc
_finite
_unlock
__dllonexit
_encode_pointer
_lock
_CIlog
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
_vswprintf_c_l
memmove
wcscpy_s
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
??2@YAPAXI@Z
_onexit
_invalid_parameter_noinfo
__CxxFrameHandler3
??0exception@std@@QAE@XZ
??3@YAXPAX@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
??_U@YAPAXI@Z
??_V@YAXPAX@Z
swprintf_s
ldexp
frexp
free
memset
malloc
_decode_pointer

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

Exports

Exports

Solv
SolveInternal
_SetExcel12EntryPt@4

Sections

.text
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/MORPH9.DLL
.dll windows x86

0592964b10cd80bd445189c4421aa7d1

Code Sign

61:02:8e:42:00:00:00:00:00:1f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

63:1f:93:a9:b5:74:b3:c3:6d:e0:b6:cb:ed:92:02:7c:79:f1:2e:1e
Signer

Actual PE Digest

63:1f:93:a9:b5:74:b3:c3:6d:e0:b6:cb:ed:92:02:7c:79:f1:2e:1e

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

09/03/2013, 00:05
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

_adjust_fdiv
__CxxFrameHandler3
_CxxThrowException
memcpy
_vsnwprintf_s
wcsncpy_s
wcstol
strncpy_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_onexit
memset
wcstok_s
bsearch
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
?terminate@@YAXXZ
__CppXcptFilter
memmove
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
_snwprintf_s
wcschr

kernel32

GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
UnhandledExceptionFilter
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
RaiseException
LoadLibraryW
GetCPInfo
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetSystemDefaultLCID
GetLocalTime
GetSystemTime
MulDiv
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
WideCharToMultiByte
GetFileAttributesA
DisableThreadLibraryCalls
Sleep

user32

SendMessageW
LoadBitmapA
InflateRect
FillRect
GetSysColor
ReleaseDC
GetDC

gdi32

DeleteDC
DeleteObject
SetTextColor
BitBlt
SetBkColor
CreateCompatibleBitmap
StretchBlt
SelectObject
CreateCompatibleDC
CreateSolidBrush
GetObjectA

oleaut32

SysFreeString
SysAllocString

mso

ord1449
ord8559
ord6671
ord462
ord4733
ord3084
ord5723
ord2929
ord3476
ord7238
ord4755
ord10009
ord2317
ord1511
ord8091
ord6754
ord5761
ord7014
ord6268
ord6115
ord4403
ord9732
ord8039
ord4171
ord10457
ord6202
ord1880

Exports

Exports

CreateAgent
DxGetTmcItemWidth
FFillComboTmc
FGetTmcItemInfo
FPubWid
GetMappedOpyVal
GetUnmappedOpyVals
HrInitMorphDll
PaintListboxItem

Sections

.text
Size: 371KB - Virtual size: 370KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/MSADDNDR.dll
.dll regsvr32 windows x86

9be13f2b612903afc1c77de2fac14181

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

72:0a:36:dd:c3:19:b0:da:43:9d:83:6f:fd:ba:9f:6a:50:69:d4:fa
Signer

Actual PE Digest

72:0a:36:dd:c3:19:b0:da:43:9d:83:6f:fd:ba:9f:6a:50:69:d4:fa

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetLocaleInfoA
InterlockedDecrement
InterlockedIncrement
GetProcAddress
LoadLibraryA
GetWindowsDirectoryA
MultiByteToWideChar
GetModuleFileNameA
lstrcpynA
GetFileAttributesA
GetVersion
InitializeCriticalSection
DisableThreadLibraryCalls
DeleteCriticalSection
FreeLibrary
HeapReAlloc
lstrcpyA
WideCharToMultiByte
LoadResource
FindResourceA
lstrlenA
HeapAlloc
HeapFree
LockResource
lstrlenW
GetProcessHeap
LeaveCriticalSection
EnterCriticalSection
IsBadWritePtr
lstrcatA

user32

SetParent
EndPaint
BeginPaint
MoveWindow
DestroyWindow
ReleaseDC
GetDC
CharNextA
PtInRect
IntersectRect
GetActiveWindow
DefWindowProcA
OffsetRect
EqualRect
SetWindowRgn
GetKeyState
SetFocus
SetDlgItemTextA
UnregisterClassA
SetWindowLongA
LoadAcceleratorsA
GetDlgItem
GetWindowRect
ScreenToClient
EnableWindow
GetSystemMetrics
SetRect
SetWindowPos
GetDialogBaseUnits
CreatePopupMenu
InsertMenuItemA
SetWindowTextA
GetFocus
GetNextDlgTabItem
ShowWindow
InvalidateRect
DialogBoxParamA
CreateWindowExA
GetClientRect
CharPrevW
LoadCursorA
RegisterClassA
EndDialog
GetWindowTextLengthA
GetWindowTextA
MessageBoxA
ClientToScreen
SetRectEmpty
CreateDialogIndirectParamA
EnableMenuItem
TrackPopupMenuEx
GetWindowLongA
GetParent
SendMessageA
LoadStringA
IsWindowVisible
CharNextW
wsprintfA
TranslateAcceleratorA

ole32

CreateOleAdviseHolder
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree

advapi32

RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueA
RegEnumValueA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegQueryValueExA
RegCloseKey

oleaut32

SetErrorInfo
OleCreatePropertyFrame
SysAllocStringLen
LoadTypeLibEx
UnRegisterTypeLi
LoadTypeLi
RegisterTypeLi
SysAllocString
VariantInit
VariantChangeType
VariantClear
LoadRegTypeLi
SysFreeString
LHashValOfNameSys
CreateErrorInfo

gdi32

SetViewportExtEx
SetMapMode
SetWindowExtEx
LPtoDP
CreateRectRgnIndirect
CreateDCA
SetWindowOrgEx
SetViewportOrgEx
DeleteDC
GetTextExtentPoint32A
GetTextMetricsA
SelectObject
GetViewportExtEx
GetWindowExtEx
CreateCompatibleDC
GetDeviceCaps

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterDesigner
DllRegisterServer
DllUnregisterDesigner
DllUnregisterServer

Sections

.text
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/MSAEXP30.DLL
.dll windows x86

4566526ac80ff197dcbbd8341567f032

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

43:50:2d:53:4e:54:c1:eb:cc:18:33:6d:3b:70:e8:ae:ce:70:02:fb
Signer

Actual PE Digest

43:50:2d:53:4e:54:c1:eb:cc:18:33:6d:3b:70:e8:ae:ce:70:02:fb

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

14/10/2015, 15:59
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetWindowRect
SendMessageW
DrawFocusRect
GetKeyState
GetWindowLongW
IsWindow
CallWindowProcW
DefWindowProcW
GetSystemMetrics
GetCaretPos
GetLastActivePopup
GetParent
OffsetRect
GetClientRect
UpdateWindow
RedrawWindow
SetTimer
KillTimer
EndDeferWindowPos
DeferWindowPos
InvalidateRect
EnableWindow
BeginDeferWindowPos
SetActiveWindow
GetActiveWindow
IsWindowEnabled
SetCursor
LoadCursorW
IsCharAlphaA
SetWindowLongW
SetRect

gdi32

GetTextMetricsW

msaccess.exe

ord8
ord12
ord17
ord6
ord13
ord9
ord1
ord2
ord93
ord107
ord51
ord108
ord5
ord3
ord14
ord112
ord7
ord15
ord106
ord4
ord86
ord11
ord109
ord111

kernel32

lstrcmpiW
GetSystemDefaultLangID
LockResource
GetModuleHandleA
FindResourceW
LoadResource
GetLastError
SetLastError
GetProcAddress
GetModuleHandleW
LoadLibraryW
GetSystemTimeAsFileTime
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LocalFree
LocalAlloc
VirtualProtect
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetProcessHeap
GetCurrentProcessId

mfc90u

ord3226
ord6376
ord5404
ord3682
ord6804
ord4174
ord6802
ord1641
ord2368
ord2375
ord2630
ord2612
ord2610
ord2628
ord2640
ord2617
ord2633
ord2638
ord2621
ord2623
ord2625
ord2619
ord2635
ord2615
ord971
ord967
ord969
ord965
ord960
ord5683
ord5685
ord6466
ord1728
ord4702
ord5154
ord3743
ord5664
ord4603
ord6800
ord5512
ord2074
ord5602
ord4664
ord1493
ord4345
ord1751
ord1754
ord6411
ord3355
ord654
ord795
ord590
ord266
ord265
ord4128
ord6635
ord4130
ord6579
ord1442
ord799
ord5322
ord4044
ord1248
ord1088
ord1063
ord1137
ord3665
ord791
ord2595
ord1688
ord436
ord1005
ord3146
ord4040
ord797
ord2154
ord4215
ord1364
ord321
ord589
ord3670
ord4905
ord3285
ord3115
ord6018
ord5663
ord5680
ord4996
ord4347
ord5676
ord5674
ord3217
ord2087
ord4213
ord5830
ord6741
ord5548
ord1048
ord4179
ord6035
ord2206
ord2251
ord4747
ord6803
ord4173
ord6801
ord4423
ord4448
ord794
ord2447
ord639
ord3515
ord4682
ord1492
ord6408
ord3353
ord1675
ord1809
ord1810
ord5324
ord4631
ord5632
ord6065
ord2904
ord5387
ord6604
ord2364
ord5124
ord5167
ord5653
ord712
ord5883
ord1039
ord464
ord1213
ord1144
ord1119
ord3741
ord5592
ord6577
ord1764
ord2597
ord5635
ord1108
ord376
ord6780
ord4530
ord6311
ord1047
ord586
ord5008
ord4000
ord4741
ord3589
ord3590
ord6131
ord1249
ord1250
ord3561
ord1694
ord1693
ord1774
ord1773
ord600
ord938
ord286
ord3489
ord4652
ord1665
ord2274
ord611
ord5625
ord2139
ord1792
ord1791
ord1727
ord5650
ord2771
ord2983
ord3112
ord4728
ord2966
ord3140
ord2774
ord2893
ord2764
ord3286
ord4080
ord4081
ord4071
ord2891
ord4348
ord4910
ord4681
ord3528
ord595
ord2069
ord1261
ord801
ord605
ord1274
ord1241
ord1239
ord1264
ord1180
ord1233
ord2084
ord391
ord1152
ord1273
ord1271
ord1145
ord1076
ord322
ord320
ord802

msvcr90

wcsncpy_s
__CxxFrameHandler3
wcscpy_s
wcsncat_s
_CxxThrowException
_vsnwprintf_s
wcschr
iswalpha
iswdigit
_wcsicmp
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
iswalnum
memmove
wcsncmp
wcscat_s
_except_handler4_common
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
free
_encoded_null
_initterm
_initterm_e
memset
_amsg_exit

Exports

Exports

LaunchExpBuilder

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/MSO0127.ACL
office2010/Office14/MSOCF.DLL
.dll windows x86

a19859c4b26c4fd1becf6e93fabf98f8

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:b2:9b:00:00:00:00:00:15
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

21/02/2011, 20:53

Not After

21/05/2012, 20:53

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

11:64:57:39:e1:13:e0:69:86:43:a3:ea:1c:7a:cd:42:a3:38:75:71
Signer

Actual PE Digest

11:64:57:39:e1:13:e0:69:86:43:a3:ea:1c:7a:cd:42:a3:38:75:71

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

11/03/2011, 17:49
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsFree
TlsGetValue
TlsSetValue
FormatMessageW
GetLastError
TlsAlloc
Sleep
RaiseException
GetProcAddress
GetModuleHandleW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
WaitForSingleObject
CloseHandle
RtlCaptureStackBackTrace
GetModuleHandleExW
GetModuleFileNameW
GetVersionExW
IsWow64Process
OpenFileMappingW
CreateFileMappingW
CreateMutexW
MapViewOfFile
UnmapViewOfFile
ReleaseMutex
LoadLibraryA
FreeLibrary
VirtualProtect
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcessHeap
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LocalAlloc

msvcr90

?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
memmove
memcpy
_vscwprintf
__CxxFrameHandler3
memset
_CxxThrowException
vswprintf_s
wcsncpy_s
_vsnwprintf_s
?terminate@@YAXXZ

ole32

CreateBindCtx
CoRegisterMessageFilter

Exports

Exports

??0CToolbarData@MsoCF@@QAE@XZ
??0CWindow@MsoCF@@QAE@XZ
??0CallbackCount_EHSafe@MsoCF@@QAE@XZ
??1CToolbarData@MsoCF@@QAE@XZ
??1CWindow@MsoCF@@UAE@XZ
?Allocate@Allocator@Memory@MsoCF@@YGPAXIW4FailureStrategy@23@@Z
?AppendArrayOfCharactersToWz@Strings@MsoCF@@YGXPB_WHAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@PAH@Z
?ClonePropertySet_Imp@IPropertySet@MsoCF@@UAGXPAPAU12@@Z
?Copy@Memory@MsoCF@@YGXPBXPAXI@Z
?CopyWzToWz@Strings@MsoCF@@YGXPB_WAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@PAH@Z
?Copy_MakeDeep_ComplexType@CPropertyData@MsoCF@@SGXQAXW4PropertyType@2@@Z
?Create@CWindow@MsoCF@@QAGXPB_W0KKHHIIPAUHWND__@@PAUHINSTANCE__@@@Z
?CreateActionManager@MsoCF@@YGXPAPAUIActionManager@1@@Z
?CreatePropertySet@MsoCF@@YGXPAPAUIPropertySet@1@PAU21@@Z
?CreateTheApp@Frame@MsoCF@@YGXAAUCreateTheAppArgs@12@@Z
?Destroy@CWindow@MsoCF@@QAGXXZ
?DisablePropertiesTypeSafety@MsoCF@@YGXXZ
?FGet@Properties@MsoCF@@YG_NPAUIPropertySet@2@PBUPropertyInfo@2@PAXHW4PropertyType@2@@Z
?Finish@Frame@MsoCF@@YGXXZ
?Finish@Utilities@MsoCF@@YGXXZ
?Free@Allocator@Memory@MsoCF@@YGXPAX@Z
?FreeAndZero_ComplexType@CPropertyData@MsoCF@@SGXPAXW4PropertyType@2@@Z
?Get@Properties@MsoCF@@YGXPAUIPropertySet@2@PBIPAVCPropertyValue@2@H@Z
?GetIterator_Imp@IPropertySet@MsoCF@@MAGXPAPAUIPropertySetIterator@2@@Z
?GetMsoHinst@MsoCF@@YGPAUHINSTANCE__@@XZ
?GetProperty@IPropertySet@MsoCF@@QAGXABUPropertyInfo@2@PAVCPropertyValue@2@@Z
?Init@CToolbarData@MsoCF@@QAGXPBUStaticToolbarDesc@2@IPBUStaticMenuDesc@2@I@Z
?ListProperties@IPropertySet@MsoCF@@QAGXPAHPAIHI@Z
?LookupProperty@MsoCF@@YGABUPropertyInfo@1@I@Z
?OnFinalMessage@CWindow@MsoCF@@UAGXPAUHWND__@@@Z
?OnPropertyChange@IPropertySet@MsoCF@@UAGXABUPropertyInfo@2@@Z
?ProduceAtom@MsoCF@@YGXPAPAVIAtom@1@PBXH@Z
?Reallocate@Allocator@Memory@MsoCF@@YGPAXPAPAXIW4FailureStrategy@23@I@Z
?RegisterPropertySpace@MsoCF@@YGXPBUPropertySpaceInfo@1@@Z
?Set@Properties@MsoCF@@YGXPAUIPropertySet@2@ABUPropertyInfo@2@PBXW4PropertyType@2@@Z
?SetAllProperties_Imp@IPropertySet@MsoCF@@UAGXPAU12@@Z
?SetProperty@IPropertySet@MsoCF@@QAGXABUPropertyInfo@2@ABVCPropertyValue@2@@Z
?SetWtzFromPattern@Strings@MsoCF@@YGXAAV?$CWtzInBuffer_Template@V?$CBuffer@_W@MsoCF@@@2@PAUHINSTANCE__@@IQAPB_WH@Z
?SetWzFromNumber@Strings@MsoCF@@YGXAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@IHHPAH@Z
?SetWzFromNumber@Strings@MsoCF@@YGXAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@_KHHPAH@Z
?SetWzFromPattern@Strings@MsoCF@@YGXAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@PAUHINSTANCE__@@IQAPB_WHPAH@Z
?SetWzFromResource@Strings@MsoCF@@YGXAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@PAUHINSTANCE__@@IPAH@Z
?Start@Frame@MsoCF@@YGXXZ
?Start@Utilities@MsoCF@@YGXHPAU_msotcfcf@@@Z
?TerminateTheApp@Frame@MsoCF@@YGXXZ
?TheActionManager@MsoCF@@YGPAUIActionManager@1@XZ
?TheApp@Frame@MsoCF@@YGPAUAFrameApp@2@XZ
?WndProc@CWindow@MsoCF@@UAGJIIJ@Z
?Zero@Memory@MsoCF@@YGXPAXI@Z
?c_Zeros@MsoCF@@3QBEB
?g_FastBufferAllocator@MsoCF@@3VCFastBufferAllocator@1@A
?g_FixedBufferAllocator@MsoCF@@3VCFixedBufferAllocator@1@A

Sections

.text
Size: 125KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/MSOCFU.DLL
.dll windows x86

f1746dedf64e918e8bf209a12a83d57a

Code Sign

33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:12

Not After

04/12/2013, 21:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4c:94:b8:54:7d:53:7c:27:06:22:7a:8f:27:2b:8b:c8:fd:fd:41:69
Signer

Actual PE Digest

4c:94:b8:54:7d:53:7c:27:06:22:7a:8f:27:2b:8b:c8:fd:fd:41:69

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

27/06/2013, 22:08
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedCompareExchange
InterlockedExchange
QueryPerformanceCounter
VirtualProtect
IsDebuggerPresent
TlsFree
GetLastError
TlsAlloc
Sleep
RaiseException
GetProcAddress
GetModuleHandleW
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
CloseHandle
OutputDebugStringA
LoadLibraryA
HeapFree
GetProcessHeap
VirtualAlloc
GetSystemTimeAsFileTime
GetTickCount
GetCurrentProcess
GlobalFree
VirtualFree
GetSystemInfo
FreeLibrary
TerminateProcess
GetCurrentProcessId
LocalFree
LocalAlloc
GlobalMemoryStatus
IsProcessorFeaturePresent

msvcr90

__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__clean_type_info_names_internal
_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_malloc_crt
_encode_pointer
__CxxFrameHandler3
_CxxThrowException
_unlock
_vsnprintf
free

Exports

Exports

_GetAllocCounters@0

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 684B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/MSOEURO.DLL
.dll regsvr32 windows x86

3f8a08ac24c416fc92880dc63b7f4b53

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

9b:08:73:47:2d:46:ff:fa:7b:ff:cd:d3:d6:e6:d6:75:5d:fa:0f:4e
Signer

Actual PE Digest

9b:08:73:47:2d:46:ff:fa:7b:ff:cd:d3:d6:e6:d6:75:5d:fa:0f:4e

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13/03/2010, 08:18
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
GetVersionExA
GetModuleFileNameW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
IsDebuggerPresent

advapi32

RegOpenKeyExW
RegDeleteKeyA
RegSetValueA
RegEnumKeyA
RegDeleteKeyW
RegCloseKey
RegEnumKeyW
RegSetValueW
RegOpenKeyExA

oleaut32

VariantInit
VariantChangeType
VarR8FromStr
LoadTypeLi
RegisterTypeLi
UnRegisterTypeLi
SysAllocString
LoadRegTypeLi

msvcr90

_encode_pointer
_malloc_crt
free
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
memmove
??2@YAPAXI@Z
??3@YAXPAX@Z
vswprintf_s
_wcsupr_s
_finite
_encoded_null

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 716B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/MSOHEV.DLL
.dll regsvr32 windows x86

0062d8f5339ada058361b7cf5161f09a

Code Sign

33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:11

Not After

26/07/2019, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:f9:5c:c9:22:55:0a:c0:9d:c4:00:00:00:00:00:f9
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2018, 20:20

Not After

23/11/2019, 20:20

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:08

Not After

26/07/2019, 20:08

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7e:14:4e:ec:85:20:9a:0d:cc:ed:37:ed:b1:d3:13:3e:49:e6:48:31:6a:e2:de:4c:9a:82:ff:d5:15:82:27:cc
Signer

Actual PE Digest

7e:14:4e:ec:85:20:9a:0d:cc:ed:37:ed:b1:d3:13:3e:49:e6:48:31:6a:e2:de:4c:9a:82:ff:d5:15:82:27:cc

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

7e:c0:34:8f:ba:57:7b:68:d5:ad:4f:4f:5b:70:9f:1e:c6:55:87:21
Signer

Actual PE Digest

7e:c0:34:8f:ba:57:7b:68:d5:ad:4f:4f:5b:70:9f:1e:c6:55:87:21

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

12/12/2018, 02:30
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

DdeClientTransaction
DdeQueryConvInfo
GetParent
IsIconic
DdeCreateStringHandleW
SetForegroundWindow
SendNotifyMessageW
DdeUninitialize
DdeConnectList
DdeAccessData
DdeUnaccessData
DdeFreeDataHandle
DdeDisconnect
DdeQueryNextServer
DdeDisconnectList
DdeFreeStringHandle
DdeInitializeW
AllowSetForegroundWindow
GetDesktopWindow
ShowWindow

kernel32

HeapAlloc
HeapFree
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
ReadFile
SetFilePointer
CloseHandle
MultiByteToWideChar
GetACP
GetDriveTypeW
ExpandEnvironmentStringsW
GlobalAlloc
InterlockedExchange
DebugBreak
RaiseException
GetLastError
CreateFileMappingW
GetFileAttributesW
GetUserDefaultLangID
WideCharToMultiByte
CreateFileW
CreateProcessW
GetModuleFileNameW
LoadLibraryA
GetModuleHandleA
LoadLibraryW
GetModuleHandleW
GetProcAddress
GetVersion
SetLastError
OutputDebugStringA
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GlobalFree
VirtualProtect

advapi32

RegSetValueExW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegQueryValueExW
RegCreateKeyExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegCloseKey

ole32

CoCreateInstance
CoFileTimeNow
CoInitialize
StgOpenStorage

shell32

SHGetFileInfoW
ShellExecuteExW
SHGetSpecialFolderPathW

msvcr90

?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
memset
vswprintf_s
_encode_pointer
_malloc_crt
free
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_except_handler4_common
_crt_debugger_hook
__clean_type_info_names_internal

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
FCoInitialized
FHevActivateApp
FHevAddToFileInfo
FHevRegister
FHevSetDefaultEditor
FHevUnregister
HevDestroyFileInfo
HevFCheckNonMSApp
HevFGetCreatorAppIcon
HevFGetCreatorAppName
HevFGetCurrentProgIDFromApp
HevFGetFileIcons
HevFGetProgIDFromFile
HevFGetProgIDFromFileEx
HevFIsHTMLOrMHTML
HevFQueryDefaultEditor
HevFSetExtraData
HevWzRegistryProgIDFromDocProgID
PHevCreateFileInfo
PHevCreateFileInfoForAddons
PHevCreateFileInfoFromURL
PwszHEVGetUrlIfInCache
WHevParseFile
WHeviAppFromProgId

Sections

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/MSOHEVI.DLL
.dll regsvr32 windows x86

8739ed4a9ce032dafdda9b626e356a68

Code Sign

33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:11

Not After

26/07/2019, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:fc:a0:e2:4f:d0:dc:19:5a:3a:00:00:00:00:00:fc
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2018, 20:20

Not After

23/11/2019, 20:20

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:08

Not After

26/07/2019, 20:08

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c0:88:42:67:de:c6:42:b1:d5:3a:da:37:4c:2f:5f:4d:ec:b3:76:d0:76:35:c8:ac:c3:5f:eb:51:4d:ed:18:aa
Signer

Actual PE Digest

c0:88:42:67:de:c6:42:b1:d5:3a:da:37:4c:2f:5f:4d:ec:b3:76:d0:76:35:c8:ac:c3:5f:eb:51:4d:ed:18:aa

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

49:fa:06:6a:43:7c:14:70:b7:7e:09:56:8a:55:68:54:54:72:35:71
Signer

Actual PE Digest

49:fa:06:6a:43:7c:14:70:b7:7e:09:56:8a:55:68:54:54:72:35:71

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

12/12/2018, 02:29
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

DdeClientTransaction
DdeCreateStringHandleW
SendNotifyMessageW
DdeUninitialize
DdeConnectList
DdeAccessData
DdeUnaccessData
DdeFreeDataHandle
DdeDisconnect
DdeQueryNextServer
DdeDisconnectList
DdeFreeStringHandle
DdeInitializeW
GetDesktopWindow

kernel32

HeapAlloc
HeapFree
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
ReadFile
SetFilePointer
CloseHandle
MultiByteToWideChar
GetACP
GetDriveTypeW
ExpandEnvironmentStringsW
GlobalAlloc
InterlockedExchange
DebugBreak
GetLastError
GetFileAttributesW
GetUserDefaultLangID
WideCharToMultiByte
CreateFileW
GetModuleFileNameW
LoadLibraryA
GetModuleHandleA
LoadLibraryW
GetModuleHandleW
GetProcAddress
GetVersion
SetLastError
OutputDebugStringA
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GlobalFree
VirtualProtect

advapi32

RegSetValueExW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegQueryValueExW
RegCreateKeyExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegCloseKey

ole32

CoCreateInstance
CoFileTimeNow
CoInitialize

shell32

SHGetFileInfoW
SHGetSpecialFolderPathW

msvcr90

?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
memset
vswprintf_s
_encode_pointer
_malloc_crt
free
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_except_handler4_common
_crt_debugger_hook
__clean_type_info_names_internal

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/MSOHTMED.EXE
.exe windows x86

6c8aaa413e9ef7e646844a1255d66790

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

4b:ef:4c:34:e6:c6:62:48:87:36:ac:4a:d6:ef:aa:a7:0b:6c:82:31
Signer

Actual PE Digest

4b:ef:4c:34:e6:c6:62:48:87:36:ac:4a:d6:ef:aa:a7:0b:6c:82:31

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

11/01/2010, 02:49
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

SetForegroundWindow
DdeFreeStringHandle
DdeDisconnectList
DdeQueryNextServer
DdeDisconnect
AllowSetForegroundWindow
DdeInitializeW
DdeCreateStringHandleW
DdeClientTransaction
DdeQueryConvInfo
GetParent
IsIconic
ShowWindow
GetDesktopWindow
SendNotifyMessageW
DdeUninitialize
DdeFreeDataHandle
DdeUnaccessData
DdeConnectList
DdeAccessData

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
Sleep
ReadFile
SetFilePointer
CloseHandle
MultiByteToWideChar
GetACP
ExpandEnvironmentStringsW
GlobalAlloc
GlobalFree
DebugBreak
GetLastError
CreateFileMappingW
GetFileAttributesW
GetUserDefaultLangID
ExitProcess
ReleaseMutex
GetCommandLineW
CreateFileW
CreateMutexW
CreateProcessW
GetModuleFileNameW
LoadLibraryA
GetModuleHandleA
LoadLibraryW
GetModuleHandleW
GetProcAddress
GetVersion
SetLastError
OutputDebugStringA
HeapAlloc
GetCurrentProcessId
HeapFree
GetProcessHeap
GetSystemTimeAsFileTime
VirtualProtect
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
RaiseException
InterlockedExchange

advapi32

RegDeleteKeyW
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegCloseKey
RegisterEventSourceW
ReportEventW
DeregisterEventSource

ole32

CoCreateInstance
CoInitialize
StgOpenStorage
CoUninitialize
CoFileTimeNow

shell32

ShellExecuteExW
SHGetSpecialFolderPathW

msvcr90

_adjust_fdiv
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
_decode_pointer
_onexit
_lock
memset
vswprintf_s
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_except_handler4_common
_crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/MSOSTYLE.DLL
.dll windows x86

78fdb656bce984683ef844d9661b27fd

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ae:d7:e6:40:17:fc:af:06:d8:2f:24:d6:5f:a7:fa:49:43:85:9c:3c
Signer

Actual PE Digest

ae:d7:e6:40:17:fc:af:06:d8:2f:24:d6:5f:a7:fa:49:43:85:9c:3c

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

23/03/2010, 18:04
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MapViewOfFile
CreateFileMappingA
OpenFileMappingA
CreateMutexA
GetTickCount
GetEnvironmentVariableA
CreateProcessA
GetFileAttributesA
lstrcmpiA
ReleaseMutex
WaitForSingleObject
UnmapViewOfFile
CloseHandle
GlobalHandle
GlobalUnlock
GlobalFree
GlobalAlloc
GlobalLock
DisableThreadLibraryCalls
lstrlenA
IsDebuggerPresent
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
UnhandledExceptionFilter
Sleep
InterlockedExchange
GetModuleFileNameW
LoadLibraryW
HeapAlloc
HeapFree
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
VirtualProtect

advapi32

DeregisterEventSource
RegisterEventSourceW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetUserNameA
ReportEventW

user32

LoadStringA
CharLowerA
IsCharAlphaA
GetKeyboardLayout
GetSysColor

ole32

CoInitialize
CoUninitialize
CoCreateInstance

msvcr90

_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
vswprintf_s
memset
_vsnprintf_s
strncat_s
_snprintf_s
strncpy_s

Exports

Exports

?CustomizeIMEShare@@YAXXZ
?FSupportSty@@YAHII@Z
DllMain
EndIMEShare
FBoldIMEStyle
FFundamentalIMEColorStyle
FGetIMEStyleAttr
FInitIMEShare
FItalicIMEStyle
FRGBIMEColorStyle
FRefreshStyle
FSaveIMEShareSetting
FSetIMEColorStyle
FSetIMEStyle
FSetIMEStyleAttr
FSpecialIMEColorStyle
FSpecialTextIMEColorStyle
FSpecialWindowIMEColorStyle
FUlIMEStyle
FWinIMEColorStyle
GrfStyIMEStyle
IdFundamentalFromIMEColorStyle
IdSpecialFromIMEColorStyle
IdUlIMEStyle
IdWinFromIMEColorStyle
PColorStyleBackFromIMEStyle
PColorStyleTextFromIMEStyle
PIMEShareCreate
PIMEStyleFromAttr
RGBFromIMEColorStyle

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/MSPPT.OLB
.dll windows x86

Code Sign

33:00:00:00:7b:16:00:6d:b9:28:cc:e8:85:00:00:00:00:00:7b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:40

Not After

04/09/2016, 17:40

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:d1:3d:99:f3:65:bf:af:86:22:71:36:a6:f0:3c:21:3b:77:cd:5f
Signer

Actual PE Digest

7b:d1:3d:99:f3:65:bf:af:86:22:71:36:a6:f0:3c:21:3b:77:cd:5f

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13/10/2015, 11:32
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 122B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 386KB - Virtual size: 385KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/Office14/MSRTEDIT.DLL
.dll regsvr32 windows x86

fea6521e2ab0a6f9aa33a1f59c5c6e5d

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

1f:d0:2d:1e:02:8c:eb:66:78:66:bb:70:7a:19:87:94:3e:8d:08:ca
Signer

Actual PE Digest

1f:d0:2d:1e:02:8c:eb:66:78:66:bb:70:7a:19:87:94:3e:8d:08:ca

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

20/10/2010, 16:37
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

SetViewportOrgEx
SetMapMode
DeleteDC
CreateDCW
CreateMetaFileW
SaveDC
SetWindowOrgEx
SetWindowExtEx
RestoreDC
CloseMetaFile
DeleteMetaFile
GetDeviceCaps
CreateRectRgnIndirect
SetTextAlign
TextOutW
LPtoDP

kernel32

lstrcmpiW
MultiByteToWideChar
GetModuleFileNameW
DisableThreadLibraryCalls
FlushInstructionCache
GetCurrentProcess
MulDiv
FreeLibrary
GetCurrentThreadId
SetLastError
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
LoadLibraryW
GetModuleHandleW
GetProcAddress
GetLastError
DeleteCriticalSection
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
Sleep
InterlockedExchange
GetSystemTimeAsFileTime
GetCurrentProcessId
InitializeCriticalSection
QueryPerformanceCounter
VirtualProtect
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GlobalUnlock
GlobalLock
GlobalAlloc
RaiseException
GetTickCount
GlobalSize
lstrlenW
EnterCriticalSection
LeaveCriticalSection

user32

RegisterClipboardFormatA
SendMessageW
GetWindowLongW
SetWindowLongW
UnregisterClassA
InvalidateRect
SetWindowPos
CharNextW
DefWindowProcW
CreateWindowExW
RegisterClassExW
IsWindow
GetParent
GetFocus
BeginPaint
GetClientRect
EndPaint
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
GetDC
ReleaseDC
LoadCursorW
GetClassInfoExW
IsChild
SetFocus
ShowWindow
GetWindowRect
CallWindowProcW
UnionRect
PtInRect
GetKeyState
DestroyWindow

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
OleRegEnumVerbs
CoCreateInstance
OleRegGetUserType
OleRegGetMiscStatus
CreateDataAdviseHolder
CreateOleAdviseHolder
WriteClassStm
OleSaveToStream
ReadClassStm

oleaut32

OleCreatePropertyFrame
LoadRegTypeLi
VariantChangeType
SysStringByteLen
SysAllocStringByteLen
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
OleCreateFontIndirect
SysAllocString
VariantClear
VariantInit
SysStringLen
SysAllocStringLen
SysFreeString

advapi32

RegSetValueExW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW

msvcr90

_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
vswprintf_s
_resetstkoflw
swprintf_s
??_U@YAPAXI@Z
memset
calloc
_recalloc
wcscat_s
wcsncpy_s
wcscpy_s
memcpy_s
free
malloc
wcsstr
??2@YAPAXI@Z
??_V@YAXPAX@Z
??3@YAXPAX@Z
_unlock
__dllonexit
_lock
_onexit
__clean_type_info_names_internal
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/MSWORD.OLB
.dll windows x86

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:50:54:e8:61:db:66:82:a0:ec:61:65:06:3d:e5:bd:81:6f:0d:33
Signer

Actual PE Digest

52:50:54:e8:61:db:66:82:a0:ec:61:65:06:3d:e5:bd:81:6f:0d:33

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13/10/2015, 21:58
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 873KB - Virtual size: 872KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/Office14/Media/单击.WAV
office2010/Office14/Media/微风.WAV
office2010/Office14/Media/打字机.WAV
office2010/Office14/Media/抽气.WAV
office2010/Office14/Media/推动.WAV
office2010/Office14/Media/收款机.WAV
office2010/Office14/Media/激光.WAV
office2010/Office14/Media/炸弹.WAV
office2010/Office14/Media/照相机.WAV
office2010/Office14/Media/爆炸.WAV
office2010/Office14/Media/电压.WAV
office2010/Office14/Media/疾驰.WAV
office2010/Office14/Media/硬币.WAV
office2010/Office14/Media/箭头.WAV
office2010/Office14/Media/锤打.WAV
office2010/Office14/Media/风声.WAV
office2010/Office14/Media/风铃.WAV
office2010/Office14/Media/鼓声.WAV
office2010/Office14/Media/鼓掌.WAV
office2010/Office14/NAME.DLL
.dll regsvr32 windows x86

de670b73925cf09045a20ab8a24e7567

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:b2:9b:00:00:00:00:00:15
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

21/02/2011, 20:53

Not After

21/05/2012, 20:53

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ec:76:e3:5f:52:7f:98:62:ab:ed:8d:2e:b6:b0:41:da:5c:47:7e:e4
Signer

Actual PE Digest

ec:76:e3:5f:52:7f:98:62:ab:ed:8d:2e:b6:b0:41:da:5c:47:7e:e4

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

09/08/2011, 18:17
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateEventA
LoadLibraryExW
GetSystemDirectoryW
Process32Next
Process32First
CreateToolhelp32Snapshot
ProcessIdToSessionId
GetCurrentProcessId
WaitForSingleObject
SetEvent
CreateThread
GetCurrentProcess
FlushInstructionCache
lstrcmpiA
lstrlenA
IsDebuggerPresent
LoadLibraryExA
UnhandledExceptionFilter
TerminateProcess
Sleep
InterlockedExchange
GetModuleFileNameW
LoadLibraryW
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
VirtualProtect
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
FindResourceA
LoadResource
SizeofResource
FreeLibrary
SetLastError
IsDBCSLeadByte
GetCurrentThreadId
GetModuleHandleW
GetModuleFileNameA
DisableThreadLibraryCalls
CloseHandle
SetUnhandledExceptionFilter
GetModuleHandleA
GetProcAddress
GetLastError
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
WideCharToMultiByte
MulDiv
MultiByteToWideChar

user32

CharNextA
CharNextW
SetWindowLongA
GetWindowLongA
UnregisterClassA
MsgWaitForMultipleObjectsEx
DispatchMessageA
PeekMessageA
ScreenToClient
GetClassInfoExA
ClientToScreen
GetSystemMetrics
GetFocus
GetCursorPos
DestroyWindow
PostMessageA
CreateWindowExA
RegisterClassExA
DefWindowProcA
CallWindowProcA
GetDC
ReleaseDC
LoadCursorA
ChildWindowFromPoint

gdi32

LPtoDP
SaveDC
SetMapMode
SetWindowOrgEx
SetViewportOrgEx
DeleteDC
RestoreDC
CreateDCA
SetTextAlign
TextOutA
GetDeviceCaps

advapi32

RegNotifyChangeKeyValue
RegQueryValueExA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
DeregisterEventSource
ReportEventW
RegisterEventSourceW
RegQueryValueExW
RegOpenKeyExW

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
StringFromCLSID
CoCreateInstance
CoCreateInstanceEx
CoInitializeEx
CoUninitialize

oleaut32

VariantInit
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen
SysFreeString

shlwapi

UrlGetPartW

urlmon

CreateUri

msvcr90

?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__clean_type_info_names_internal
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
vswprintf_s
_wcsicmp
??3@YAXPAX@Z
??_V@YAXPAX@Z
strstr
malloc
free
memcpy_s
strcpy_s
wcsncpy_s
strncpy_s
strcat_s
sprintf_s
_resetstkoflw
??2@YAPAXI@Z
??_U@YAPAXI@Z
_recalloc
memset
wcschr
swprintf_s
memcpy
_stricmp
_strnicmp
strnlen

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/OART.DLL
.dll regsvr32 windows x86

e56208a28be6c96b9b83918eb9d77543

Code Sign

33:00:00:01:23:30:43:8d:24:48:3c:a0:d7:00:00:00:00:01:23
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/10/2018, 21:07

Not After

10/01/2020, 21:07

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:1A8F-E3C3-D69D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:11

Not After

26/07/2019, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:08

Not After

26/07/2019, 20:08

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

46:5f:05:b6:de:cc:72:4f:99:63:b4:1b:ea:7b:4a:26:87:4a:1c:bf:46:ec:c7:d1:09:c3:d1:fe:45:3e:f0:8d
Signer

Actual PE Digest

46:5f:05:b6:de:cc:72:4f:99:63:b4:1b:ea:7b:4a:26:87:4a:1c:bf:46:ec:c7:d1:09:c3:d1:fe:45:3e:f0:8d

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

56:2b:5c:27:f3:cf:30:dd:01:cf:7b:5b:36:c9:e9:d3:21:67:af:0a
Signer

Actual PE Digest

56:2b:5c:27:f3:cf:30:dd:01:cf:7b:5b:36:c9:e9:d3:21:67:af:0a

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

22/01/2019, 00:30
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareStringW
FoldStringW
GetFileAttributesW
SetFilePointerEx
GetTempFileNameW
GetFileSizeEx
ReleaseSemaphore
ResetEvent
CreateSemaphoreW
GetVersionExA
GetModuleHandleExW
RtlCaptureStackBackTrace
VirtualProtect
QueryPerformanceCounter
GetProcessHeap
HeapFree
HeapAlloc
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetUserDefaultLCID
lstrlenW
MultiByteToWideChar
GetModuleHandleA
GetVersion
lstrcmpiW
OutputDebugStringA
LoadLibraryExW
CreateProcessW
LoadLibraryA
LocalAlloc
SetLastError
SystemTimeToFileTime
GetLastError
FormatMessageW
TlsSetValue
TlsGetValue
CreateEventW
SetThreadPriority
SetEvent
GetLocalTime
SetFilePointer
SetEndOfFile
GetFileSize
GetModuleHandleW
GetModuleFileNameW
FindResourceW
SizeofResource
LoadResource
LockResource
DisableThreadLibraryCalls
CreateThread
TerminateThread
GetTempPathW
CreateFileMappingW
GetCurrentProcessId
ExitThread
FindFirstChangeNotificationW
FindNextChangeNotification
FindNextFileW
FindCloseChangeNotification
FindClose
WaitForSingleObject
FindFirstFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetLocaleInfoW
IsDebuggerPresent
LoadLibraryW
GlobalSize
GlobalReAlloc
GetACP
GetStringTypeExW
IsDBCSLeadByte
IsDBCSLeadByteEx
GetSystemDefaultLCID
GetProcAddress
FreeLibrary
GetSystemDefaultLangID
CloseHandle
WriteFile
ReadFile
SetErrorMode
DeleteFileW
RaiseException
TryEnterCriticalSection
GetSystemTimeAsFileTime
FileTimeToSystemTime
GetTickCount
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
Sleep
GetVersionExW
IsBadWritePtr
TlsFree
lstrcmpW
GetSystemTime
SystemTimeToTzSpecificLocalTime
MulDiv
DecodePointer
TlsAlloc
EncodePointer

gdi32

CreatePenIndirect
CreateBrushIndirect
PolylineTo
Arc
Polyline
Polygon
GetTextFaceW
GetMapMode
GetWindowExtEx
GetViewportExtEx
GetOutlineTextMetricsW
GetObjectType
CreateEnhMetaFileW
StretchDIBits
CloseEnhMetaFile
PlayMetaFile
DeleteMetaFile
DeleteEnhMetaFile
GetWindowOrgEx
SetMapMode
SetWindowOrgEx
SetWindowExtEx
SetViewportExtEx
GetClipBox
DPtoLP
GetPaletteEntries
GetRegionData
SetBkColor
ExtCreatePen
CreatePen
GetClipRgn
IntersectClipRect
CreateRectRgnIndirect
DeleteDC
CreateICW
GetDeviceCaps
SetMetaFileBitsEx
GetWinMetaFileBits
GetEnhMetaFileHeader
CreateCompatibleBitmap
SetViewportOrgEx
GetViewportOrgEx
DeleteObject
GdiFlush
BitBlt
CreateDIBSection
GetStockObject
PatBlt
SelectObject
Rectangle
Ellipse
SelectPalette
RealizePalette
GetObjectW
SelectClipRgn
OffsetRgn
CombineRgn
GetMetaFileBitsEx
GetEnhMetaFileBits
SetRectRgn
ModifyWorldTransform
LPtoDP
LineTo
MoveToEx
SetBkMode
SetTextColor
GetTextExtentPoint32W
SetPixel
GetTextMetricsW
SetTextAlign
CreateCompatibleDC
CreateSolidBrush
GetPixel
StretchBlt
SetBrushOrgEx
SetStretchBltMode
CreatePatternBrush
CreateBitmap
ExtTextOutW
CreateRectRgn
FrameRgn
FillRgn
GetRgnBox
CreateFontIndirectW
ExcludeClipRect
CreateRoundRectRgn
GetCurrentObject
SetWorldTransform
SetGraphicsMode
GetWorldTransform
RestoreDC
SaveDC

user32

IsChild
GetWindowRgn
IsIconic
SetWindowRgn
GetClassInfoW
IsCharUpperW
GetSystemMenu
DeleteMenu
SetWindowLongW
TranslateAcceleratorW
LoadAcceleratorsW
CopyAcceleratorTableW
CreateAcceleratorTableW
DestroyAcceleratorTable
IsWindowVisible
SystemParametersInfoW
GetActiveWindow
MonitorFromRect
GetMonitorInfoW
MoveWindow
RedrawWindow
RegisterClassExW
EnumDisplayMonitors
SetForegroundWindow
MsgWaitForMultipleObjects
IsCharAlphaW
CharNextW
MonitorFromWindow
LoadStringW
SetRectEmpty
EnumWindows
GetWindowTextW
GetWindowPlacement
SendMessageTimeoutW
MessageBoxW
GetWindowDC
GetWindowRect
GetDesktopWindow
FrameRect
BeginPaint
EndPaint
GetWindowThreadProcessId
PrintWindow
GetSysColorBrush
GetLastActivePopup
DrawTextW
PostMessageW
GetUpdateRgn
ValidateRect
InvalidateRgn
MessageBeep
TranslateMessage
DispatchMessageW
SetFocus
EnableWindow
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
OpenClipboard
GetPriorityClipboardFormat
GetForegroundWindow
InvalidateRect
GetCaretPos
DefWindowProcW
RegisterClassW
GetWindowLongW
GetParent
CreateWindowExW
ShowWindow
GetWindow
SetWindowPos
NotifyWinEvent
CreateCaret
SetCaretPos
DestroyCaret
UnregisterClassW
UpdateLayeredWindow
FillRect
EnumDisplaySettingsW
DestroyWindow
SetCursor
LoadImageW
ShowCaret
GetFocus
HideCaret
GetWindowInfo
GetClientRect
RegisterWindowMessageW
SendMessageW
PeekMessageW
GetKeyboardLayoutList
ActivateKeyboardLayout
GetKeyState
ClientToScreen
IsWindow
GetKeyboardLayout
LoadCursorW
DestroyIcon
IsRectEmpty
PtInRect
IntersectRect
CopyRect
SetRect
CreateIconIndirect
OffsetRect
UpdateWindow
LockWindowUpdate
SetLayeredWindowAttributes
GetDoubleClickTime
GetCursorPos
MapWindowPoints
ScreenToClient
SetTimer
MapVirtualKeyW
InflateRect
CharUpperBuffW
KillTimer
SetCapture
ReleaseCapture
GetCapture
WindowFromPoint
GetSystemMetrics
GetAsyncKeyState
GetSysColor
UnionRect
RegisterClipboardFormatW
ReleaseDC
GetDC
GetAncestor
TrackMouseEvent

advapi32

RegQueryValueExW
RegCloseKey
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegisterTraceGuidsA
RegOpenKeyExA
TraceEvent
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegOpenKeyExW

ole32

StringFromCLSID
CoCreateGuid
CreateStreamOnHGlobal
OleGetClipboard
DoDragDrop
GetHGlobalFromStream
OleInitialize
OleUninitialize
ReadClassStg
CLSIDFromString
CoDisconnectObject
CoUninitialize
CoInitialize
HWND_UserSize
HWND_UserMarshal
HWND_UserUnmarshal
HWND_UserFree
CreateFileMoniker
CoTaskMemRealloc
CreateBindCtx
CoInitializeEx
CoCreateInstance
CoGetClassObject
IIDFromString
StringFromGUID2
CoTaskMemAlloc
CoTaskMemFree
OleSetClipboard
OleIsCurrentClipboard
OleFlushClipboard
ReleaseStgMedium
CoCreateFreeThreadedMarshaler

msvcr90

_CIasin
??2@YAPAXI@Z
memmove_s
calloc
wcsstr
_recalloc
??_U@YAPAXI@Z
_clearfp
tolower
_ecvt_s
_wtof
modf
srand
rand
_CIexp
_nextafter
_vsnwprintf_s
wcschr
??8type_info@@QBE_NABV0@@Z
__CxxFrameHandler3
_CxxThrowException
memcpy
memset
floor
ceil
_CIsin
_CIcos
_CIsqrt
memmove
_CIatan2
_CIfmod
_hypot
iswspace
_CIacos
wcsncpy_s
wcsncmp
_stricmp
_CIatan
_CItan
_CIpow
?raw_name@type_info@@QBEPBDXZ
wcscpy_s
qsort
_memicmp
_finite
_CIlog
_fpclass
_isnan
strncmp
vswprintf_s
_vscwprintf
memcpy_s
_encode_pointer
_malloc_crt
free
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_crt_debugger_hook
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
toupper
_CIlog10
malloc

gfx

ord81
ord918
ord108
ord739
ord335
ord251
ord745
ord174
ord502
ord819
ord180
ord67
ord527
ord449
ord292
ord38
ord500
ord309
ord64
ord314
ord864
ord95
ord370
ord457
ord609
ord647
ord334
ord480
ord765
ord961
ord47
ord88
ord446
ord916
ord684
ord828
ord675
ord897
ord198
ord972
ord489
ord798
ord800
ord781
ord515
ord878
ord443
ord733
ord667
ord396
ord884
ord398
ord45
ord640
ord908
ord863
ord462
ord138
ord669
ord304
ord463
ord344
ord9
ord121
ord920
ord455
ord87
ord949
ord393
ord499
ord644
ord193
ord210
ord803
ord943
ord801
ord343
ord433
ord312
ord221
ord906
ord475
ord21
ord711
ord603
ord438
ord812
ord980
ord784
ord599
ord562
ord349
ord818
ord929
ord224
ord822
ord921
ord434
ord938
ord588
ord118
ord269
ord453
ord260
ord60
ord179
ord461
ord318
ord416
ord604
ord230
ord690
ord616
ord465
ord607
ord388
ord867
ord882
ord448
ord677
ord258
ord311
ord582
ord964
ord547
ord66
ord843
ord238
ord212
ord930
ord705
ord984
ord297
ord883
ord558
ord284
ord359
ord858
ord904
ord278
ord340
ord158
ord546
ord490
ord931
ord833
ord329
ord477
ord672
ord766
ord973
ord716
ord153
ord405
ord806
ord412
ord693
ord1
ord738
ord474
ord172
ord761
ord73
ord907
ord909
ord65
ord537
ord991
ord59
ord827
ord239
ord51
ord17
ord719
ord62
ord658
ord282
ord919
ord430
ord11
ord498
ord28
ord775
ord310
ord935
ord838
ord371
ord102
ord79
ord293
ord971
ord531
ord529
ord615
ord631
ord168
ord851
ord289
ord840
ord302
ord128
ord519
ord841
ord756
ord123
ord717
ord963
ord385
ord228
ord556
ord222
ord112
ord736
ord940
ord751
ord606
ord844
ord952
ord322
ord795
ord326
ord25
ord75
ord308
ord654
ord394
ord992
ord977
ord215
ord336
ord262
ord367
ord914
ord27
ord20
ord74
ord374
ord395
ord896
ord983
ord901
ord701
ord876
ord922
ord444
ord276
ord291
ord814
ord124
ord746
ord959
ord342
ord885
ord805
ord420
ord106
ord947
ord975
ord780
ord411
ord131
ord301
ord167
ord889
ord482
ord13
ord524
ord831
ord389
ord530
ord917
ord183
ord580
ord891
ord97
ord508
ord727
ord533
ord101
ord90
ord770
ord56
ord226
ord206
ord730
ord839
ord934
ord445
ord201
ord557
ord93
ord967
ord817
ord703
ord328
ord192
ord127
ord488
ord637
ord663
ord487
ord387
ord423
ord288
ord767
ord259
ord197
ord186
ord243
ord507
ord54
ord156
ord776
ord620
ord273
ord111
ord471
ord720
ord52
ord706
ord802
ord362
ord246
ord951
ord710
ord794
ord740
ord782
ord415
ord779
ord317
ord58
ord566
ord548
ord855
ord366
ord641
ord773
ord356
ord678
ord129
ord569
ord731
ord553
ord80
ord764
ord333
ord534
ord586
ord724
ord698
ord974
ord772
ord572
ord913
ord608
ord380
ord285
ord39
ord373
ord777
ord649
ord744
ord71
ord24
ord836
ord880
ord248
ord242
ord653
ord937
ord969
ord549
ord84
ord932
ord190
ord821
ord265
ord155
ord734
ord610
ord859
ord749
ord592
ord409
ord535
ord796
ord61
ord671
ord105
ord161
ord926
ord231
ord774
ord679
ord450
ord694
ord452
ord563
ord955
ord113
ord714
ord571
ord410
ord2
ord721
ord209
ord659
ord491
ord887
ord503
ord442
ord895
ord945
ord120
ord551
ord203
ord680
ord484

rpcrt4

CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
NdrDllRegisterProxy
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrOleAllocate
NdrOleFree
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
CStdStubBuffer_QueryInterface

Exports

Exports

?CreateWordE2oUpdateCommand@WordDr@@YGXABV?$TWeakPtr@VIE2oView@Art@@@Ofc@@AAV?$TOwnerPtr@VCommand@Art@@@3@AAV?$TOwnerPtr@$$CBVCommand@Art@@@3@@Z
?FShouldCompareExtLstAndACB@Art@@YG_NXZ
?FUseColorMatrixForGrayscaleRecoloring@Art@@YG_NABVIEffectCallback@GEL@@@Z
?SetFShouldCompareExtLstAndACB@Art@@YGX_N@Z
DllCanUnloadNow
DllGetClassObject
DllRegisterServer

Sections

.text
Size: 11.1MB - Virtual size: 11.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 548KB - Virtual size: 548KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7.3MB - Virtual size: 7.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 597KB - Virtual size: 596KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/OGL.DLL
.dll windows x86

939a6bc3b76435ee51c522d83eb4175a

Code Sign

33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:8e:87:91:a4:57:1a:5f:ca:3e:00:00:00:00:00:8e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

17/11/2016, 22:09

Not After

17/02/2018, 22:09

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

65:fd:09:10:04:c7:6d:63:87:99:a9:27:1c:a6:b9:0b:52:7e:fa:08:2f:cc:94:4d:de:26:2d:bd:60:29:86:df
Signer

Actual PE Digest

65:fd:09:10:04:c7:6d:63:87:99:a9:27:1c:a6:b9:0b:52:7e:fa:08:2f:cc:94:4d:de:26:2d:bd:60:29:86:df

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

3e:64:8f:1c:1a:4f:2d:4c:e2:8b:52:6b:ab:7a:71:2a:07:c3:35:16
Signer

Actual PE Digest

3e:64:8f:1c:1a:4f:2d:4c:e2:8b:52:6b:ab:7a:71:2a:07:c3:35:16

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

25/08/2017, 18:04
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

_crt_debugger_hook
memset
??3@YAXPAX@Z
memcpy
_CIatan2
strncpy_s
_vsnprintf_s
_CIcos
_CIsin
_finite
_stricmp
sprintf_s
_CIatan
_CIlog
strncat_s
_CIexp
wcsncpy_s
_vsnwprintf_s
_wcsupr_s
wcscpy_s
wcsncat_s
wcsnlen
_snprintf_s
memcpy_s
_encode_pointer
_malloc_crt
free
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_except_handler4_common
_CIsqrt
__clean_type_info_names_internal
_onexit
_lock
__dllonexit
_unlock

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
InterlockedCompareExchange
InterlockedExchange
GetSystemTimeAsFileTime
GetCurrentProcessId
VirtualProtect
UnlockFile
GetFileInformationByHandle
LockFile
CreateSemaphoreA
GetSystemDirectoryA
CreateFileMappingW
ReleaseSemaphore
GlobalAlloc
CreateEventA
CreateThread
SetEvent
WaitForSingleObject
GetProfileSectionA
SearchPathW
SearchPathA
GetOEMCP
HeapCreate
HeapDestroy
GetSystemDirectoryW
GetWindowsDirectoryA
GetSystemDefaultLCID
SetLastError
DisableThreadLibraryCalls
GetCurrentThreadId
GetProcessHeap
HeapReAlloc
HeapFree
HeapAlloc
GetSystemInfo
GetVersionExA
FlushFileBuffers
SetFilePointer
SetEndOfFile
GetFileSize
CreateFileMappingA
MapViewOfFile
GetFileTime
CreateFileW
UnmapViewOfFile
GlobalFree
InitializeCriticalSection
VirtualFree
VirtualAlloc
RaiseException
IsValidLocale
ConvertDefaultLocale
GetLocaleInfoW
LoadLibraryW
GetModuleHandleW
GetModuleFileNameW
GetProcAddress
FreeLibrary
GetModuleHandleA
GetModuleFileNameA
LoadLibraryA
GetACP
FindResourceA
LoadResource
LockResource
MulDiv
MultiByteToWideChar
GetProfileIntA
GetProfileStringA
ReadFile
lstrcmpiW
GetTickCount
CreateFileA
WriteFile
CloseHandle
QueryPerformanceCounter
Sleep
DeleteCriticalSection
GlobalSize
GlobalLock
GlobalUnlock
GetLastError
lstrcmpiA
WideCharToMultiByte
IsDBCSLeadByteEx
LeaveCriticalSection
EnterCriticalSection
LocalAlloc
TerminateProcess

user32

GetSystemMetrics
ClientToScreen
GetDCEx
GetWindowLongA
GetClassLongA
ReleaseDC
IntersectRect
InflateRect
OffsetRect
UnionRect
SetRectEmpty
IsRectEmpty
GetDC
WindowFromDC
GetWindowRect
GetDesktopWindow
GetClientRect
PeekMessageA
MsgWaitForMultipleObjects
TranslateMessage
LoadImageA
LoadImageW
CreateIconIndirect
GetIconInfo
SystemParametersInfoA
GetSysColor
UnregisterClassA
DestroyWindow
DefWindowProcA
CreateWindowExA
RegisterWindowMessageA
RegisterClassA
DispatchMessageA

gdi32

DeleteObject
GetDIBits
GetMiterLimit
GetArcDirection
GetPolyFillMode
GetTextCharsetInfo
TranslateCharsetInfo
CombineRgn
GetWorldTransform
Rectangle
GetTextColor
CreatePenIndirect
GetObjectW
DPtoLP
SetTextJustification
PlayMetaFileRecord
CreateCompatibleBitmap
GetViewportExtEx
GetWindowExtEx
GetRandomRgn
GetMetaFileW
GetMetaFileA
GetRegionData
GetWinMetaFileBits
GetSystemPaletteUse
CreateDIBSection
SetDIBits
ExtCreateRegion
IntersectClipRect
GetBkMode
GetTextAlign
CreateFontIndirectW
CreateFontIndirectA
RestoreDC
SetICMMode
SetMapMode
SetViewportOrgEx
SetWindowOrgEx
GetMapMode
GetViewportOrgEx
GetWindowOrgEx
GetROP2
CreateRectRgn
GetClipRgn
SelectClipRgn
GdiFlush
CreateCompatibleDC
CreateBitmap
SetBrushOrgEx
SetBkColor
DeleteDC
Escape
GetObjectType
SetBkMode
SetTextAlign
ExtTextOutA
SaveDC
ExtSelectClipRgn
GetPixel
ExtEscape
SetMiterLimit
ExtCreatePen
SetStretchBltMode
CreateSolidBrush
Polyline
PolyPolyline
StrokePath
SetROP2
StrokeAndFillPath
FillPath
FillRgn
GdiComment
LPtoDP
StretchDIBits
CreateDIBPatternBrushPt
BeginPath
SetPolyFillMode
PolyPolygon
PolyBezier
EndPath
SelectClipPath
CloseFigure
MoveToEx
PolyBezierTo
LineTo
PolylineTo
GetBkColor
SetTextColor
SelectObject
GetStockObject
Polygon
PatBlt
GetGraphicsMode
SetGraphicsMode
ModifyWorldTransform
GetDCOrgEx
StretchBlt
GetCurrentObject
GetObjectA
GetDIBColorTable
GetDeviceCaps
GetSystemPaletteEntries
CreatePalette
GetNearestColor
GetNearestPaletteIndex
SelectPalette
GetPaletteEntries
CreateBrushIndirect
SetDIBColorTable
CreateDCA
RealizePalette
DrawEscape
CreateICA
ExtTextOutW
SetBitmapBits
GetTextFaceA
SetWorldTransform
GetEnhMetaFileW
GetEnhMetaFileA
GetEnhMetaFileBits
CopyEnhMetaFileA
CopyMetaFileA
SetMetaFileBitsEx
SetEnhMetaFileBits
SetViewportExtEx
SetWindowExtEx
PlayMetaFile
DeleteMetaFile
SetMetaRgn
PlayEnhMetaFileRecord
GetMetaFileBitsEx
EnumMetaFile
CreateEnhMetaFileW
CreateEnhMetaFileA
CloseEnhMetaFile
GetEnhMetaFileHeader
EnumEnhMetaFile
DeleteEnhMetaFile
EnumFontFamiliesExW
EnumFontFamiliesExA
GetTextMetricsW
GetTextFaceW
GetTextMetricsA

ole32

CoTaskMemAlloc
CoTaskMemFree
GetHGlobalFromStream
CreateStreamOnHGlobal

advapi32

RegDeleteKeyA
RegCloseKey
RegQueryInfoKeyW
RegQueryInfoKeyA
RegEnumValueA
RegQueryValueExW
RegSetValueExW
RegSetValueExA
RegDeleteKeyW
RegEnumValueW
RegCreateKeyExW
RegCreateKeyExA
RegEnumKeyExW
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyExW

Exports

Exports

GdipAddPathArc
GdipAddPathArcI
GdipAddPathBezier
GdipAddPathBezierI
GdipAddPathBeziers
GdipAddPathBeziersI
GdipAddPathClosedCurve
GdipAddPathClosedCurve2
GdipAddPathClosedCurve2I
GdipAddPathClosedCurveI
GdipAddPathCurve
GdipAddPathCurve2
GdipAddPathCurve2I
GdipAddPathCurve3
GdipAddPathCurve3I
GdipAddPathCurveI
GdipAddPathEllipse
GdipAddPathEllipseI
GdipAddPathLine
GdipAddPathLine2
GdipAddPathLine2I
GdipAddPathLineI
GdipAddPathPath
GdipAddPathPie
GdipAddPathPieI
GdipAddPathPolygon
GdipAddPathPolygonI
GdipAddPathRectangle
GdipAddPathRectangleI
GdipAddPathRectangles
GdipAddPathRectanglesI
GdipAddPathString
GdipAddPathStringI
GdipAlloc
GdipBeginContainer
GdipBeginContainer2
GdipBeginContainerI
GdipBitmapApplyEffect
GdipBitmapConvertFormat
GdipBitmapCreateApplyEffect
GdipBitmapGetHistogram
GdipBitmapGetHistogramSize
GdipBitmapGetPixel
GdipBitmapLockBits
GdipBitmapSetPixel
GdipBitmapSetResolution
GdipBitmapUnlockBits
GdipClearPathMarkers
GdipCloneBitmapArea
GdipCloneBitmapAreaI
GdipCloneBrush
GdipCloneCustomLineCap
GdipCloneFont
GdipCloneFontFamily
GdipCloneImage
GdipCloneImageAttributes
GdipCloneMatrix
GdipClonePath
GdipClonePen
GdipCloneRegion
GdipCloneStringFormat
GdipClosePathFigure
GdipClosePathFigures
GdipCombineRegionPath
GdipCombineRegionRect
GdipCombineRegionRectI
GdipCombineRegionRegion
GdipComment
GdipConvertToEmfPlus
GdipConvertToEmfPlusToFile
GdipConvertToEmfPlusToStream
GdipCreateAdjustableArrowCap
GdipCreateBitmapFromDirectDrawSurface
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromHICON
GdipCreateBitmapFromResource
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateCachedBitmap
GdipCreateCustomLineCap
GdipCreateEffect
GdipCreateFont
GdipCreateFontFamilyFromName
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipCreateFontFromLogfontW
GdipCreateFromHDC
GdipCreateFromHDC2
GdipCreateFromHWND
GdipCreateFromHWNDICM
GdipCreateHBITMAPFromBitmap
GdipCreateHICONFromBitmap
GdipCreateHalftonePalette
GdipCreateHatchBrush
GdipCreateImageAttributes
GdipCreateLineBrush
GdipCreateLineBrushFromRect
GdipCreateLineBrushFromRectI
GdipCreateLineBrushFromRectWithAngle
GdipCreateLineBrushFromRectWithAngleI
GdipCreateLineBrushI
GdipCreateMatrix
GdipCreateMatrix2
GdipCreateMatrix3
GdipCreateMatrix3I
GdipCreateMetafileFromEmf
GdipCreateMetafileFromFile
GdipCreateMetafileFromStream
GdipCreateMetafileFromWmf
GdipCreateMetafileFromWmfFile
GdipCreatePath
GdipCreatePath2
GdipCreatePath2I
GdipCreatePathGradient
GdipCreatePathGradientFromPath
GdipCreatePathGradientI
GdipCreatePathIter
GdipCreatePen1
GdipCreatePen2
GdipCreateRegion
GdipCreateRegionHrgn
GdipCreateRegionPath
GdipCreateRegionRect
GdipCreateRegionRectI
GdipCreateRegionRgnData
GdipCreateSolidFill
GdipCreateStreamOnFile
GdipCreateStringFormat
GdipCreateTexture
GdipCreateTexture2
GdipCreateTexture2I
GdipCreateTextureIA
GdipCreateTextureIAI
GdipDeleteBrush
GdipDeleteCachedBitmap
GdipDeleteCustomLineCap
GdipDeleteEffect
GdipDeleteFont
GdipDeleteFontFamily
GdipDeleteGraphics
GdipDeleteMatrix
GdipDeletePath
GdipDeletePathIter
GdipDeletePen
GdipDeletePrivateFontCollection
GdipDeleteRegion
GdipDeleteStringFormat
GdipDisposeImage
GdipDisposeImageAttributes
GdipDrawArc
GdipDrawArcI
GdipDrawBezier
GdipDrawBezierI
GdipDrawBeziers
GdipDrawBeziersI
GdipDrawCachedBitmap
GdipDrawClosedCurve
GdipDrawClosedCurve2
GdipDrawClosedCurve2I
GdipDrawClosedCurveI
GdipDrawCurve
GdipDrawCurve2
GdipDrawCurve2I
GdipDrawCurve3
GdipDrawCurve3I
GdipDrawCurveI
GdipDrawDriverString
GdipDrawEllipse
GdipDrawEllipseI
GdipDrawImage
GdipDrawImageFX
GdipDrawImageI
GdipDrawImagePointRect
GdipDrawImagePointRectI
GdipDrawImagePoints
GdipDrawImagePointsI
GdipDrawImagePointsRect
GdipDrawImagePointsRectI
GdipDrawImageRect
GdipDrawImageRectI
GdipDrawImageRectRect
GdipDrawImageRectRectI
GdipDrawLine
GdipDrawLineI
GdipDrawLines
GdipDrawLinesI
GdipDrawPath
GdipDrawPie
GdipDrawPieI
GdipDrawPolygon
GdipDrawPolygonI
GdipDrawRectangle
GdipDrawRectangleI
GdipDrawRectangles
GdipDrawRectanglesI
GdipDrawString
GdipEmfToWmfBits
GdipEndContainer
GdipEnumerateMetafileDestPoint
GdipEnumerateMetafileDestPointI
GdipEnumerateMetafileDestPoints
GdipEnumerateMetafileDestPointsI
GdipEnumerateMetafileDestRect
GdipEnumerateMetafileDestRectI
GdipEnumerateMetafileSrcRectDestPoint
GdipEnumerateMetafileSrcRectDestPointI
GdipEnumerateMetafileSrcRectDestPoints
GdipEnumerateMetafileSrcRectDestPointsI
GdipEnumerateMetafileSrcRectDestRect
GdipEnumerateMetafileSrcRectDestRectI
GdipFillClosedCurve
GdipFillClosedCurve2
GdipFillClosedCurve2I
GdipFillClosedCurveI
GdipFillEllipse
GdipFillEllipseI
GdipFillPath
GdipFillPie
GdipFillPieI
GdipFillPolygon
GdipFillPolygon2
GdipFillPolygon2I
GdipFillPolygonI
GdipFillRectangle
GdipFillRectangleI
GdipFillRectangles
GdipFillRectanglesI
GdipFillRegion
GdipFindFirstImageItem
GdipFindNextImageItem
GdipFlattenPath
GdipFlush
GdipFree
GdipGetAdjustableArrowCapFillState
GdipGetAdjustableArrowCapHeight
GdipGetAdjustableArrowCapMiddleInset
GdipGetAdjustableArrowCapWidth
GdipGetAllPropertyItems
GdipGetBrushType
GdipGetCellAscent
GdipGetCellDescent
GdipGetClip
GdipGetClipBounds
GdipGetClipBoundsI
GdipGetCompositingMode
GdipGetCompositingQuality
GdipGetCustomLineCapBaseCap
GdipGetCustomLineCapBaseInset
GdipGetCustomLineCapStrokeCaps
GdipGetCustomLineCapStrokeJoin
GdipGetCustomLineCapType
GdipGetCustomLineCapWidthScale
GdipGetDC
GdipGetDpiX
GdipGetDpiY
GdipGetEffectParameterSize
GdipGetEffectParameters
GdipGetEmHeight
GdipGetEncoderParameterList
GdipGetEncoderParameterListSize
GdipGetFamily
GdipGetFamilyName
GdipGetFontCollectionFamilyCount
GdipGetFontCollectionFamilyList
GdipGetFontHeight
GdipGetFontHeightGivenDPI
GdipGetFontSize
GdipGetFontStyle
GdipGetFontUnit
GdipGetGenericFontFamilyMonospace
GdipGetGenericFontFamilySansSerif
GdipGetGenericFontFamilySerif
GdipGetHatchBackgroundColor
GdipGetHatchForegroundColor
GdipGetHatchStyle
GdipGetHemfFromMetafile
GdipGetImageAttributesAdjustedPalette
GdipGetImageBounds
GdipGetImageDecoders
GdipGetImageDecodersSize
GdipGetImageDimension
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipGetImageFlags
GdipGetImageGraphicsContext
GdipGetImageHeight
GdipGetImageHorizontalResolution
GdipGetImageItemData
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageRawFormat
GdipGetImageThumbnail
GdipGetImageType
GdipGetImageVerticalResolution
GdipGetImageWidth
GdipGetInterpolationMode
GdipGetLineBlend
GdipGetLineBlendCount
GdipGetLineColors
GdipGetLineGammaCorrection
GdipGetLinePresetBlend
GdipGetLinePresetBlendCount
GdipGetLineRect
GdipGetLineRectI
GdipGetLineSpacing
GdipGetLineTransform
GdipGetLineWrapMode
GdipGetLogFontA
GdipGetLogFontW
GdipGetMatrixElements
GdipGetMetafileDownLevelRasterizationLimit
GdipGetMetafileHeaderFromEmf
GdipGetMetafileHeaderFromFile
GdipGetMetafileHeaderFromMetafile
GdipGetMetafileHeaderFromStream
GdipGetMetafileHeaderFromWmf
GdipGetNearestColor
GdipGetPageScale
GdipGetPageUnit
GdipGetPathData
GdipGetPathFillMode
GdipGetPathGradientBlend
GdipGetPathGradientBlendCount
GdipGetPathGradientCenterColor
GdipGetPathGradientCenterPoint
GdipGetPathGradientCenterPointI
GdipGetPathGradientFocusScales
GdipGetPathGradientGammaCorrection
GdipGetPathGradientPath
GdipGetPathGradientPointCount
GdipGetPathGradientPresetBlend
GdipGetPathGradientPresetBlendCount
GdipGetPathGradientRect
GdipGetPathGradientRectI
GdipGetPathGradientSurroundColorCount
GdipGetPathGradientSurroundColorsWithCount
GdipGetPathGradientTransform
GdipGetPathGradientWrapMode
GdipGetPathLastPoint
GdipGetPathPoints
GdipGetPathPointsI
GdipGetPathTypes
GdipGetPathWorldBounds
GdipGetPathWorldBoundsI
GdipGetPenBrushFill
GdipGetPenColor
GdipGetPenCompoundArray
GdipGetPenCompoundCount
GdipGetPenCustomEndCap
GdipGetPenCustomStartCap
GdipGetPenDashArray
GdipGetPenDashCap197819
GdipGetPenDashCount
GdipGetPenDashOffset
GdipGetPenDashStyle
GdipGetPenEndCap
GdipGetPenFillType
GdipGetPenLineJoin
GdipGetPenMiterLimit
GdipGetPenMode
GdipGetPenStartCap
GdipGetPenTransform
GdipGetPenUnit
GdipGetPenWidth
GdipGetPixelOffsetMode
GdipGetPointCount
GdipGetPropertyCount
GdipGetPropertyIdList
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipGetPropertySize
GdipGetRegionBounds
GdipGetRegionBoundsI
GdipGetRegionData
GdipGetRegionDataSize
GdipGetRegionHRgn
GdipGetRegionScans
GdipGetRegionScansCount
GdipGetRegionScansI
GdipGetRenderingOrigin
GdipGetSmoothingMode
GdipGetSolidFillColor
GdipGetStringFormatAlign
GdipGetStringFormatDigitSubstitution
GdipGetStringFormatFlags
GdipGetStringFormatHotkeyPrefix
GdipGetStringFormatLineAlign
GdipGetStringFormatMeasurableCharacterRangeCount
GdipGetStringFormatTabStopCount
GdipGetStringFormatTabStops
GdipGetStringFormatTrimming
GdipGetTextContrast
GdipGetTextRenderingHint
GdipGetTextureImage
GdipGetTextureTransform
GdipGetTextureWrapMode
GdipGetVisibleClipBounds
GdipGetVisibleClipBoundsI
GdipGetWorldTransform
GdipGraphicsClear
GdipGraphicsSetAbort
GdipImageForceValidation
GdipImageGetFrameCount
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageRotateFlip
GdipImageSelectActiveFrame
GdipImageSetAbort
GdipInitializePalette
GdipInvertMatrix
GdipIsClipEmpty
GdipIsEmptyRegion
GdipIsEqualRegion
GdipIsInfiniteRegion
GdipIsMatrixEqual
GdipIsMatrixIdentity
GdipIsMatrixInvertible
GdipIsOutlineVisiblePathPoint
GdipIsOutlineVisiblePathPointI
GdipIsStyleAvailable
GdipIsVisibleClipEmpty
GdipIsVisiblePathPoint
GdipIsVisiblePathPointI
GdipIsVisiblePoint
GdipIsVisiblePointI
GdipIsVisibleRect
GdipIsVisibleRectI
GdipIsVisibleRegionPoint
GdipIsVisibleRegionPointI
GdipIsVisibleRegionRect
GdipIsVisibleRegionRectI
GdipLoadImageFromFile
GdipLoadImageFromFileICM
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipMeasureCharacterRanges
GdipMeasureDriverString
GdipMeasureString
GdipMultiplyLineTransform
GdipMultiplyMatrix
GdipMultiplyPathGradientTransform
GdipMultiplyPenTransform
GdipMultiplyTextureTransform
GdipMultiplyWorldTransform
GdipNewInstalledFontCollection
GdipNewPrivateFontCollection
GdipPathIterCopyData
GdipPathIterEnumerate
GdipPathIterGetCount
GdipPathIterGetSubpathCount
GdipPathIterHasCurve
GdipPathIterIsValid
GdipPathIterNextMarker
GdipPathIterNextMarkerPath
GdipPathIterNextPathType
GdipPathIterNextSubpath
GdipPathIterNextSubpathPath
GdipPathIterRewind
GdipPlayMetafileRecord
GdipPrivateAddFontFile
GdipPrivateAddMemoryFont
GdipRecordMetafile
GdipRecordMetafileFileName
GdipRecordMetafileFileNameI
GdipRecordMetafileI
GdipRecordMetafileStream
GdipRecordMetafileStreamI
GdipReleaseDC
GdipRemovePropertyItem
GdipResetClip
GdipResetImageAttributes
GdipResetLineTransform
GdipResetPageTransform
GdipResetPath
GdipResetPathGradientTransform
GdipResetPenTransform
GdipResetTextureTransform
GdipResetWorldTransform
GdipRestoreGraphics
GdipReversePath
GdipRotateLineTransform
GdipRotateMatrix
GdipRotatePathGradientTransform
GdipRotatePenTransform
GdipRotateTextureTransform
GdipRotateWorldTransform
GdipSaveAdd
GdipSaveAddImage
GdipSaveGraphics
GdipSaveImageToFile
GdipSaveImageToStream
GdipScaleLineTransform
GdipScaleMatrix
GdipScalePathGradientTransform

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/OIMG.DLL
.dll windows x86

1e1694faa80ff5169655318d498ac8a2

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:0a:0e:b9:79:d9:5e:23:80:d3:fe:86:85:d7:ea:a9:1f:49:01:f1
Signer

Actual PE Digest

0e:0a:0e:b9:79:d9:5e:23:80:d3:fe:86:85:d7:ea:a9:1f:49:01:f1

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

20/11/2012, 20:25
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_crt_debugger_hook
?terminate@@YAXXZ
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
vswprintf_s
_CIacos
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
free
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
ceil
_CIatan2
_CIatan
_aligned_free
_aligned_malloc
_clearfp
_CIexp
wcsnlen
floor
wcschr
_isnan
_finite
_snwprintf_s
_wcsnicmp
qsort
_CIlog
_CIpow
_beginthreadex
_CIsqrt
_CIsin
_CIcos
_CIasin
_mbscmp
_wcsicmp
_wtol
_wcslwr_s
wcscspn
wcsspn
wcspbrk
_resetstkoflw
swprintf_s
calloc
memcpy
memmove_s
_control87
_CxxThrowException
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
__CxxFrameHandler3
memset
strncat_s
strrchr
rand
_CItan
strncpy_s
srand
_msize
realloc
__CxxFrameHandler
memmove
toupper
strchr
_recalloc
wcsncpy_s
memcpy_s
isspace
_CIcosh
_CIfmod
_CIsinh
wcsstr
malloc
wcscpy_s
strncpy
_controlfp
_stricmp
atof
tolower
isdigit
isalnum
isalpha
_vsnprintf
isxdigit
_strdup
setlocale
atoi
_fpclass
_CItanh

kernel32

GetModuleFileNameA
CreateFileMappingW
GetTempFileNameW
GetTempPathW
DeleteFileW
GetVersionExW
LocalAlloc
HeapSize
HeapReAlloc
HeapDestroy
lstrcmpiA
GetSystemInfo
FindResourceA
RaiseException
EnterCriticalSection
LeaveCriticalSection
UnmapViewOfFile
InitializeCriticalSection
DeleteCriticalSection
ReleaseActCtx
DeactivateActCtx
FreeLibrary
SetCurrentDirectoryW
GetSystemDirectoryW
GetCurrentDirectoryW
GetProcAddress
LoadLibraryW
ActivateActCtx
CreateActCtxW
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleW
lstrlenW
GetLastError
lstrcmpiW
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
TryEnterCriticalSection
DebugBreak
GetModuleHandleA
GetFileAttributesW
GetVersion
SetLastError
OutputDebugStringA
GlobalMemoryStatusEx
SetThreadAffinityMask
GetCurrentThread
GetProcessAffinityMask
GetCurrentProcess
QueryPerformanceCounter
FlushInstructionCache
LockResource
GetModuleHandleExW
GetCurrentThreadId
Sleep
QueryPerformanceFrequency
VirtualAlloc
VirtualFree
FindResourceExW
CloseHandle
ReadFile
GetFileSize
CreateFileW
WideCharToMultiByte
CreateEventW
ResetEvent
SetEvent
WaitForSingleObject
ResumeThread
IsProcessorFeaturePresent
VirtualProtect
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
CreateFileA
HeapFree
HeapAlloc
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
CreateFileMappingA
MapViewOfFile
GetFullPathNameA
LoadLibraryA
GetVersionExA
lstrcmpW
GetProcessHeap

gdi32

SelectObject
GetStockObject
OffsetRgn
SetRectRgn
DeleteObject
CreateRectRgn
CreateRectRgnIndirect
BitBlt
CreateCompatibleDC
DeleteDC
GetDeviceCaps
CombineRgn
GetRegionData
CreateDIBitmap
GetRgnBox
GetICMProfileW
CreateDCW
RectInRegion

user32

SetWindowLongW
DestroyWindow
ReleaseDC
GetDC
EnumDisplayMonitors
GetCursorPos
GetClientRect
LoadCursorW
SetCursor
GetWindowLongW
CharNextW
RegisterClassExW
ValidateRgn
GetClassInfoExW
CreateWindowExW
GetMonitorInfoW
LoadStringA
SetRect
ReleaseCapture
SetCapture
UnregisterClassA
DefWindowProcW
CallWindowProcW
GetUpdateRgn
ScrollWindowEx
ScreenToClient
GetClassLongW
GetScrollBarInfo
GetSystemMetrics
InvalidateRgn
InvalidateRect
GetWindowRect
CharLowerBuffW
IsWindow

advapi32

RegDeleteKeyW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
RegDeleteValueW
RegQueryValueExA
RegOpenKeyA

ole32

CoGetMalloc
CoCreateInstance
CoInitialize
CoUninitialize
ProgIDFromCLSID
CLSIDFromString
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

VarUI4FromStr
VariantClear
VariantCopy
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayUnlock
SafeArrayLock
SafeArrayDestroy
SysFreeString
SysStringLen
LoadRegTypeLi
LoadTypeLi
VariantInit
VariantChangeType
SafeArrayGetElement
DispCallFunc
SysAllocStringLen
SafeArrayCopy
SafeArrayPutElement
VariantChangeTypeEx
SysStringByteLen
SysAllocStringByteLen
SysAllocString
VarCmp
VarBstrCmp
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreate
SafeArrayRedim
SafeArrayGetVartype

d3d9

Direct3DCreate9

ddraw

DirectDrawCreate
DirectDrawEnumerateExA

mscms

IsColorProfileValid
OpenColorProfileW
GetColorProfileHeader
GetColorProfileFromHandle
GetColorDirectoryW
CloseColorProfile
CreateMultiProfileTransform
TranslateBitmapBits
DeleteColorTransform
GetColorProfileElement

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

Exports

Exports

??0ColorStatistics@Grabber@CutoutAPI@@QAE@XZ
??0Exception@Base@@IAE@J@Z
??0Exception@Base@@QAE@ABV01@@Z
??0GeneralGraph@CutoutAPI@@QAE@P6G_NHPAX@Z0@Z
??0Grabber@CutoutAPI@@QAE@P6G_NPAX@Z0HP6G_NN0@Z0@Z
??0GridGraph8@CutoutAPI@@QAE@HHP6G_NHPAX@Z0@Z
??0NodeQueue@GeneralGraph@CutoutAPI@@QAE@XZ
??0NodeQueue@GridGraph8@CutoutAPI@@QAE@XZ
??0NodeStack@GeneralGraph@CutoutAPI@@QAE@XZ
??0NodeStack@GridGraph8@CutoutAPI@@QAE@XZ
??0OutOfMemoryException@Base@@IAE@XZ
??0OutOfMemoryException@Base@@QAE@ABV01@@Z
??1ColorStatistics@Grabber@CutoutAPI@@QAE@XZ
??1Exception@Base@@UAE@XZ
??1GeneralGraph@CutoutAPI@@QAE@XZ
??1Grabber@CutoutAPI@@QAE@XZ
??1GridGraph8@CutoutAPI@@QAE@XZ
??1NodeQueue@GeneralGraph@CutoutAPI@@QAE@XZ
??1NodeQueue@GridGraph8@CutoutAPI@@QAE@XZ
??1NodeStack@GeneralGraph@CutoutAPI@@QAE@XZ
??1NodeStack@GridGraph8@CutoutAPI@@QAE@XZ
??1OutOfMemoryException@Base@@UAE@XZ
??4Exception@Base@@QAEAAV01@ABV01@@Z
??4NodeQueue@GeneralGraph@CutoutAPI@@QAEAAU012@ABU012@@Z
??4NodeQueue@GridGraph8@CutoutAPI@@QAEAAU012@ABU012@@Z
??4NodeStack@GeneralGraph@CutoutAPI@@QAEAAU012@ABU012@@Z
??4NodeStack@GridGraph8@CutoutAPI@@QAEAAU012@ABU012@@Z
??4OutOfMemoryException@Base@@QAEAAV01@ABV01@@Z
??BException@Base@@QBEJXZ
??_7Exception@Base@@6B@
??_7OutOfMemoryException@Base@@6B@
??_FGeneralGraph@CutoutAPI@@QAEXXZ
??_FGrabber@CutoutAPI@@QAEXXZ
?ActiveQueueAdd@GeneralGraph@CutoutAPI@@AAEXPAUNode@12@@Z
?ActiveQueueAdd@GridGraph8@CutoutAPI@@AAEXPAUNode@12@@Z
?ActiveQueueGetTop@GeneralGraph@CutoutAPI@@AAEPAUNode@12@XZ
?ActiveQueueGetTop@GridGraph8@CutoutAPI@@AAEPAUNode@12@XZ
?ActiveQueueRemoveTop@GeneralGraph@CutoutAPI@@AAEXXZ
?ActiveQueueRemoveTop@GridGraph8@CutoutAPI@@AAEXXZ
?ActiveQueueReset@GeneralGraph@CutoutAPI@@AAEXXZ
?ActiveQueueReset@GridGraph8@CutoutAPI@@AAEXXZ
?AddNEdge@GridGraph8@CutoutAPI@@QAEXPAUNode@12@HF@Z
?AddNEdges@GeneralGraph@CutoutAPI@@QAEJPAX0FF@Z
?AddNEdges@GridGraph8@CutoutAPI@@QAEXPAUNode@12@HFF@Z
?AddNode@GeneralGraph@CutoutAPI@@QAEPAXXZ
?AddTEdge@GeneralGraph@CutoutAPI@@QAEXPAXF@Z
?AddTEdge@GridGraph8@CutoutAPI@@QAEXPAUNode@12@F@Z
?Adopt@GeneralGraph@CutoutAPI@@AAEJPAUNode@12@@Z
?Adopt@GridGraph8@CutoutAPI@@AAEJPAUNode@12@@Z
?Allocate@GeneralGraph@CutoutAPI@@QAEJXZ
?Allocate@GridGraph8@CutoutAPI@@QAEJHH@Z
?Allocate@NodeQueue@GeneralGraph@CutoutAPI@@QAEJH@Z
?Allocate@NodeQueue@GridGraph8@CutoutAPI@@QAEJH@Z
?Allocate@NodeStack@GeneralGraph@CutoutAPI@@QAEJH@Z
?Allocate@NodeStack@GridGraph8@CutoutAPI@@QAEJH@Z
?Augment@GeneralGraph@CutoutAPI@@AAEJPAUEdge@12@@Z
?Augment@GridGraph8@CutoutAPI@@AAEJPAUNode@12@0H@Z
?Background@Grabber@CutoutAPI@@SG?BKXZ
?BaseAtlThrow@ATL@@YGXJ@Z
?BaseAtlThrowLastError@ATL@@YGXXZ
?ComputeFlowBottomInsideSquare@GridGraph8@CutoutAPI@@CGXAAUSquare@12@PAUVirtualGraph2@12@@Z
?ComputeFlowForTwoVirtualGraphs@GridGraph8@CutoutAPI@@CGXPAUNode@12@0PAUVirtualGraph2@12@1PAH2@Z
?ComputeFlowLeft@GridGraph8@CutoutAPI@@CGXAAUSquare@12@PAUVirtualGraph2@12@PAH2@Z
?ComputeFlowRight@GridGraph8@CutoutAPI@@CGXAAUSquare@12@PAUVirtualGraph2@12@PAH2@Z
?ComputeFlowTop@GridGraph8@CutoutAPI@@CGXAAUSquare@12@PAUVirtualGraph2@12@PAH2@Z
?ComputeFlowTopInsideSquare@GridGraph8@CutoutAPI@@CGXAAUSquare@12@PAUVirtualGraph2@12@@Z
?ComputeMaximumFlow2@GridGraph8@CutoutAPI@@AAEXPAUNode@12@0HH@Z
?ComputeVirtualGraphFromBottomToTop@GridGraph8@CutoutAPI@@CGXAAUSquare@12@PAUVirtualGraph2@12@1@Z
?ComputeVirtualGraphFromLeftBottomToRight@GridGraph8@CutoutAPI@@CGXAAUSquare@12@PAUVirtualGraph2@12@11@Z
?ComputeVirtualGraphFromLeftToRight@GridGraph8@CutoutAPI@@CGXAAUSquare@12@PAUVirtualGraph2@12@1@Z
?ComputeVirtualGraphFromLeftTopToBottom@GridGraph8@CutoutAPI@@CGXAAUSquare@12@PAUVirtualGraph2@12@11@Z
?ComputeVirtualGraphFromLeftTopToRight@GridGraph8@CutoutAPI@@CGXAAUSquare@12@PAUVirtualGraph2@12@11@Z
?ComputeVirtualGraphFromRightBottomLeftToTop@GridGraph8@CutoutAPI@@CGXAAUSquare@12@PAUVirtualGraph2@12@111@Z
?ComputeVirtualGraphFromRightLeftToBottom@GridGraph8@CutoutAPI@@CGXAAUSquare@12@PAUVirtualGraph2@12@11@Z
?ComputeVirtualGraphFromRightLeftToTop@GridGraph8@CutoutAPI@@CGXAAUSquare@12@PAUVirtualGraph2@12@11@Z
?ComputeVirtualGraphFromRightLeftTopToBottom@GridGraph8@CutoutAPI@@CGXAAUSquare@12@PAUVirtualGraph2@12@111@Z
?ComputeVirtualGraphFromRightToLeft@GridGraph8@CutoutAPI@@CGXAAUSquare@12@PAUVirtualGraph2@12@1@Z
?ComputeVirtualGraphFromTopToBottom@GridGraph8@CutoutAPI@@CGXAAUSquare@12@PAUVirtualGraph2@12@1@Z
?ConstrainedBackground@Grabber@CutoutAPI@@SG?BKXZ
?ConstrainedForeground@Grabber@CutoutAPI@@SG?BKXZ
?Copy@ColorStatistics@Grabber@CutoutAPI@@QAEJABV123@@Z
?DavinciCoCreateInstance@Oimg@@YGJABU_GUID@@0PAPAX@Z
?DavinciCoCreateInstance@Oimg@@YGJABU_GUID@@PAUIUnknown@@0PAPAX@Z
?DavinciCoCreateInstance@Oimg@@YGJPB_WABU_GUID@@PAPAX@Z
?DavinciCoCreateInstance@Oimg@@YGJPB_WPAUIUnknown@@ABU_GUID@@PAPAX@Z
?DeAllocate@GeneralGraph@CutoutAPI@@QAEXXZ
?DeAllocate@GridGraph8@CutoutAPI@@QAEXXZ
?DeAllocate@NodeQueue@GeneralGraph@CutoutAPI@@QAEXXZ
?DeAllocate@NodeQueue@GridGraph8@CutoutAPI@@QAEXXZ
?DeAllocate@NodeStack@GeneralGraph@CutoutAPI@@QAEXXZ
?DeAllocate@NodeStack@GridGraph8@CutoutAPI@@QAEXXZ
?DeQueue@NodeQueue@GeneralGraph@CutoutAPI@@QAEPAUNode@23@XZ
?DeQueue@NodeQueue@GridGraph8@CutoutAPI@@QAEPAUNode@23@XZ
?Delete@BasePrivate@@YAXPAX@Z
?DownsampleARGB32@CutoutAPI@@YGJPAVBitmap@Gil@1@0ABU?$RectImpl@H@1@@Z
?DynamicProgrammingMaxflowHorz@GridGraph8@CutoutAPI@@AAEJXZ
?DynamicProgrammingMaxflowVert@GridGraph8@CutoutAPI@@AAEJXZ
?EnQueue@NodeQueue@GeneralGraph@CutoutAPI@@QAEJPAUNode@23@@Z
?EnQueue@NodeQueue@GridGraph8@CutoutAPI@@QAEJPAUNode@23@@Z
?EraseConstrainedBackground@Grabber@CutoutAPI@@SG?BKXZ
?EraseConstrainedForeground@Grabber@CutoutAPI@@SG?BKXZ
?ExtractSprite@Grabber@CutoutAPI@@QAEJPAVBitmap@Gil@2@0ABU?$RectImpl@H@2@0@Z
?Foreground@Grabber@CutoutAPI@@SG?BKXZ
?GetAlphaBehavior@Grabber@CutoutAPI@@QBE_NPAK@Z
?GetAndCheckNeib@GridGraph8@CutoutAPI@@ABEPAUNode@12@PAU312@H@Z
?GetBaseStringComManager@StringCom@Base@@SGAAVCAtlStringMgr@ATL@@XZ
?GetBaseStringManager@String@Base@@SGAAVCAtlStringMgr@ATL@@XZ
?GetBrushWeight@Grabber@CutoutAPI@@QBEHXZ
?GetConnectedComponentPixelCountThreshold@Grabber@CutoutAPI@@QBEHXZ
?GetForegroundConnectivity@Grabber@CutoutAPI@@QBE_NXZ
?GetIterationCount@Grabber@CutoutAPI@@QBEHXZ
?GetNeib@GridGraph8@CutoutAPI@@ABEPAUNode@12@PAU312@H@Z
?GetNodeId@GridGraph8@CutoutAPI@@QAEPAUNode@12@HH@Z
?GetReverseEdge@GridGraph8@CutoutAPI@@CGHH@Z
?GetSegmentation@GeneralGraph@CutoutAPI@@QAEHPAX@Z
?GetSegmentation@GridGraph8@CutoutAPI@@QAEHPAUNode@12@@Z
?GetSizeX@GridGraph8@CutoutAPI@@QAEHXZ
?GetSizeY@GridGraph8@CutoutAPI@@QAEHXZ
?GetX@GridGraph8@CutoutAPI@@QAEHPAUNode@12@@Z
?GetY@GridGraph8@CutoutAPI@@QAEHPAUNode@12@@Z
?Grow@GeneralGraph@CutoutAPI@@AAEPAUEdge@12@XZ
?Grow@GridGraph8@CutoutAPI@@AAE_NAAPAUNode@12@0AAH@Z
?Init@Exception@Base@@AAEXJ@Z
?Initialize@Base@@YGXXZ
?InitializeAndSegment@Grabber@CutoutAPI@@QAEJPAVBitmap@Gil@2@ABU?$RectImpl@H@2@1NH0PAVColorStatistics@12@@Z
?IsAllocated@GeneralGraph@CutoutAPI@@QBE_NXZ
?IsAllocated@GridGraph8@CutoutAPI@@QBE_NXZ
?IsVistaOrGreater@OS@Base@@YG_NXZ
?Maxflow@GeneralGraph@CutoutAPI@@QAEJXZ
?Maxflow@GridGraph8@CutoutAPI@@QAEJH@Z
?MoveSquareDown@GridGraph8@CutoutAPI@@AAEXAAUSquare@12@@Z
?MoveSquareLeft@GridGraph8@CutoutAPI@@AAEXAAUSquare@12@@Z
?MoveSquareRight@GridGraph8@CutoutAPI@@AAEXAAUSquare@12@@Z
?MoveSquareUp@GridGraph8@CutoutAPI@@AAEXAAUSquare@12@@Z
?MultipleTreesDynamicProgrammingMaxflowHorz@GridGraph8@CutoutAPI@@AAEJXZ
?NeighborhoodSize@GridGraph8@CutoutAPI@@2HB
?New@BasePrivate@@YAPAXI_N@Z
?PARENT_FREE@GeneralGraph@CutoutAPI@@0PAUEdge@12@A
?PARENT_FREE@GridGraph8@CutoutAPI@@0IB
?PARENT_ORPHAN@GeneralGraph@CutoutAPI@@0PAUEdge@12@A
?PARENT_ORPHAN@GridGraph8@CutoutAPI@@0IB
?PARENT_TERMINAL@GeneralGraph@CutoutAPI@@0PAUEdge@12@A
?PARENT_TERMINAL@GridGraph8@CutoutAPI@@0IB
?Pop@NodeStack@GeneralGraph@CutoutAPI@@QAEPAUNode@23@XZ
?Pop@NodeStack@GridGraph8@CutoutAPI@@QAEPAUNode@23@XZ
?Push@NodeStack@GeneralGraph@CutoutAPI@@QAEJPAUNode@23@@Z
?Push@NodeStack@GridGraph8@CutoutAPI@@QAEJPAUNode@23@@Z
?PushFlowBottom@GridGraph8@CutoutAPI@@CGXAAUSquare@12@HH@Z
?PushFlowLeft@GridGraph8@CutoutAPI@@CGXAAUSquare@12@HH@Z
?PushFlowRight@GridGraph8@CutoutAPI@@CGXAAUSquare@12@HH@Z
?PushFlowTop@GridGraph8@CutoutAPI@@CGXAAUSquare@12@HH@Z
?Reset@NodeQueue@GeneralGraph@CutoutAPI@@QAEXXZ
?Reset@NodeQueue@GridGraph8@CutoutAPI@@QAEXXZ
?Reset@NodeStack@GeneralGraph@CutoutAPI@@QAEXXZ
?Reset@NodeStack@GridGraph8@CutoutAPI@@QAEXXZ
?Segment@Grabber@CutoutAPI@@QAEJPAVBitmap@Gil@2@0ABU?$RectImpl@H@2@PAVColorStatistics@12@@Z
?SetAlphaBehavior@Grabber@CutoutAPI@@QAEJ_NK@Z
?SetBrushWeight@Grabber@CutoutAPI@@QAEJH@Z
?SetConnectedComponentPixelCountThreshold@Grabber@CutoutAPI@@QAEJH@Z
?SetForegroundConnectivity@Grabber@CutoutAPI@@QAEJ_N@Z
?SetIterationCount@Grabber@CutoutAPI@@QAEJH@Z
?SetSquare@GridGraph8@CutoutAPI@@AAEXHHAAUSquare@12@@Z
?ThreadID@Exception@Base@@QBEKXZ
?Throw@Base@@YGXJ@Z
?ThrowLastError@Base@@YGXXZ
?TopConstrainedBackground@Grabber@CutoutAPI@@SG?BKXZ
?TopConstrainedForeground@Grabber@CutoutAPI@@SG?BKXZ
?UpscaleSegmentation@CutoutAPI@@YGJPAVBitmap@Gil@1@0M@Z
?cutout_dummy_for_linking@@YGHXZ

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 650KB - Virtual size: 649KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/OSPP.HTM
office2010/Office14/OSPP.VBS
.vbs
office2010/Office14/POWERPNT.EXE
.exe windows x86

f1e18036b97809b852959dde12d7cd41

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

25:33:f0:6d:8f:fa:00:f9:31:fa:e6:98:32:e3:50:22:15:12:e5:ea
Signer

Actual PE Digest

25:33:f0:6d:8f:fa:00:f9:31:fa:e6:98:32:e3:50:22:15:12:e5:ea

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

14/10/2015, 15:29
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_decode_pointer
_amsg_exit

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
IsDebuggerPresent

ppcore

_ShowSplashScreen@0
_PPMain@0

Exports

Exports

DllGetLCID

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 892B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/POWERPNT.EXE.manifest
office2010/Office14/PPCORE.DLL
.dll windows x86

77d3878bc625d0c51d656776abb0f475

Code Sign

33:00:00:01:74:79:9d:87:ae:42:96:79:c4:00:00:00:00:01:74
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2020, 17:25

Not After

01/04/2021, 17:25

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:2264-E33E-780C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:f9:f1:3d:78:67:62:cc:94:66:00:02:00:00:01:f9
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/07/2020, 18:30

Not After

25/04/2021, 18:30

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:04:35:45:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

20/09/2018, 17:42

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e7:3b:b1:ac:53:10:e5:7c:82:ca:f0:43:d8:99:42:c0:5a:f9:96:bc:0c:10:ea:cf:85:c7:26:3c:cc:1e:43:68
Signer

Actual PE Digest

e7:3b:b1:ac:53:10:e5:7c:82:ca:f0:43:d8:99:42:c0:5a:f9:96:bc:0c:10:ea:cf:85:c7:26:3c:cc:1e:43:68

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

87:47:08:e6:d6:a3:b5:90:db:cb:d3:76:fb:62:e0:29:90:44:1e:4d
Signer

Actual PE Digest

87:47:08:e6:d6:a3:b5:90:db:cb:d3:76:fb:62:e0:29:90:44:1e:4d

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

16/02/2021, 20:45
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

memmove
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_crt_debugger_hook
_except_handler4_common
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_mbsstr
strncpy_s
wcschr
_stricmp
fwprintf
_CIsqrt
ceil
wcsncmp
?set_terminate@@YAP6AXXZP6AXXZ@Z
wcsncpy_s
qsort
wcscspn
_encoded_null
free
_malloc_crt
_encode_pointer
?raw_name@type_info@@QBEPBDXZ
_fpclass
_vscwprintf
vswprintf_s
_CIatan2
iswspace
_CIasin
_CIacos
_CIsinh
_CIcosh
_CItanh
rand
_CIexp
_CIlog
_CIatan
_CItan
_CIfmod
iswcntrl
memcpy_s
wcsnlen
_CIcos
_CIsin
_clearfp
_wcsnicmp
_wcsicmp
_CIlog10
_fpreset
strncmp
_wtoi
wcsncat_s
_snwprintf_s
__CxxFrameHandler3
floor
_wfopen_s
setvbuf
fclose
fprintf
_CIpow
memcpy
??8type_info@@QBE_NABV0@@Z
_CxxThrowException
memset
wcsrchr

kernel32

FindNextFileW
ReadFile
FreeLibrary
FindNextChangeNotification
FindCloseChangeNotification
FindFirstChangeNotificationW
CopyFileW
QueryDosDeviceW
GetLogicalDrives
RemoveDirectoryW
SetFileAttributesW
GetTempFileNameW
GetLocaleInfoW
CreateDirectoryW
GetShortPathNameW
GetACP
GetSystemDefaultLangID
GetDiskFreeSpaceExW
FileTimeToLocalFileTime
GetStartupInfoW
GetFileSize
GetTimeFormatW
SearchPathW
SetThreadExecutionState
WTSGetActiveConsoleSessionId
ProcessIdToSessionId
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
SetThreadPriority
GetThreadPriority
GetCurrentThread
TlsFree
TlsGetValue
TlsSetValue
FormatMessageW
TlsAlloc
CompareStringW
FoldStringW
SetFilePointer
SetEndOfFile
GetCurrentDirectoryW
GetFileAttributesExW
GetFullPathNameW
SetFilePointerEx
WaitForSingleObject
VirtualProtect
GetSystemTimeAsFileTime
GetProcessHeap
HeapFree
HeapAlloc
InterlockedExchange
InterlockedCompareExchange
GetFileSizeEx
IsDebuggerPresent
DisableThreadLibraryCalls
IsDBCSLeadByteEx
SizeofResource
QueryPerformanceCounter
MoveFileExW
GetSystemDirectoryW
MultiByteToWideChar
ResetEvent
CreateEventW
LoadLibraryA
WriteFile
GetDriveTypeW
ExitProcess
GetCurrentProcess
TerminateProcess
UnhandledExceptionFilter
FileTimeToSystemTime
FindResourceW
LoadResource
LockResource
GetCurrentProcessId
CompareFileTime
GetLocalTime
GetSystemDefaultLCID
SetErrorMode
GetDateFormatW
RaiseException
QueryPerformanceFrequency
TryEnterCriticalSection
CreateEventA
CreateThread
CloseHandle
SetEvent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetTickCount
GetTempPathW
FindFirstFileW
FindClose
GlobalSize
GlobalFree
MulDiv
EncodePointer
GlobalUnlock
GlobalLock
GlobalAlloc
GetSystemTime
SystemTimeToFileTime
GlobalGetAtomNameW
GlobalDeleteAtom
SetCurrentDirectoryW
GlobalAddAtomW
DeleteFileW
OutputDebugStringA
GetModuleFileNameW
SetLastError
GetLastError
LoadLibraryW
GetVersion
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
Sleep
GetCurrentThreadId
DecodePointer
LocalAlloc
GetUserDefaultLCID
GetStringTypeExW
SetFileTime
GetLongPathNameW
FormatMessageA
LocalFree
LoadLibraryExW
OpenFile
LoadLibraryExA
RtlCaptureStackBackTrace
GetModuleHandleExW
GetVersionExA
GetCommandLineW
SetUnhandledExceptionFilter

gdi32

SelectObject
RectInRegion
CreateCompatibleBitmap
CreateMetaFileA
SetWindowExtEx
CloseMetaFile
GetObjectA
GetWindowOrgEx
GetEnhMetaFileW
GetEnhMetaFileHeader
GetWinMetaFileBits
ResetDCW
SetAbortProc
CreateICW
GetNearestColor
SetRectRgn
GetMetaFileBitsEx
GetEnhMetaFileBits
DeleteMetaFile
EnumEnhMetaFile
SetDIBits
PlayEnhMetaFileRecord
PlayMetaFileRecord
SetEnhMetaFileBits
GetTextCharsetInfo
ExtEscape
GetOutlineTextMetricsW
EnumFontFamiliesExW
GetPaletteEntries
CreatePatternBrush
CreateDIBPatternBrushPt
GetRegionData
CreateBitmap
CreateCompatibleDC
OffsetWindowOrgEx
ExtCreatePen
CreatePen
SetROP2
ExtSelectClipRgn
RestoreDC
GetBitmapBits
EnumMetaFile
SetWinMetaFileBits
PlayEnhMetaFile
Ellipse
RoundRect
LPtoDP
SetPixelV
SetMetaFileBitsEx
BitBlt
DeleteEnhMetaFile
CreateDIBSection
GetViewportOrgEx
GetClipRgn
Escape
IntersectClipRect
GetTextFaceW
CreateDIBitmap
GetClipBox
CreateSolidBrush
GetLayout
CreateFontIndirectW
GdiFlush
SetDIBColorTable
GetObjectW
SetLayout
CreateDCW
SetMapMode
SetWindowOrgEx
DeleteDC
GetRasterizerCaps
ExcludeClipRect
Polygon
Polyline
GetObjectType
DPtoLP
UpdateColors
GetRgnBox
MoveToEx
LineTo
StretchDIBits
SetStretchBltMode
StretchBlt
GetDeviceCaps
GetCurrentObject
CreatePalette
SelectPalette
RealizePalette
GetBkColor
GetTextColor
SelectClipRgn
PatBlt
CreateRectRgn
OffsetRgn
CreateRectRgnIndirect
CombineRgn
DeleteObject
RectVisible
SetViewportOrgEx
SetTextColor
SetBkMode
GetTextMetricsW
SetTextAlign
GetStockObject
Rectangle
SetBkColor
ExtTextOutW
SaveDC
SetBrushOrgEx

user32

IntersectRect
InvalidateRect
InvalidateRgn
ValidateRect
WindowFromPoint
GetCapture
PostMessageW
AllowSetForegroundWindow
GetWindowThreadProcessId
DefWindowProcA
SetCapture
GetMessageTime
SetActiveWindow
FillRect
IsWindowEnabled
GetKeyboardLayout
RedrawWindow
MapWindowPoints
ShowCursor
IsChild
SetRect
RegisterClipboardFormatA
GetWindowLongA
SetWindowPlacement
BringWindowToTop
UpdateWindow
MonitorFromWindow
MessageBoxW
GetSysColor
FrameRect
GetSysColorBrush
GetDoubleClickTime
SystemParametersInfoW
DefWindowProcW
DefFrameProcW
DefMDIChildProcW
CallWindowProcW
SendMessageW
DispatchMessageW
TrackMouseEvent
PeekMessageW
GetAsyncKeyState
RegisterClassA
CreateWindowExA
CreateDialogIndirectParamW
TranslateAcceleratorA
TranslateMDISysAccel
ReleaseDC
GetMessagePos
SetRectEmpty
ScrollWindowEx
ValidateRgn
DispatchMessageA
TranslateMessage
DestroyCursor
LoadCursorW
SetCursor
SendMessageTimeoutA
PtInRect
SetWindowLongA
DrawFocusRect
SetScrollPos
SetScrollInfo
NotifyWinEvent
SetParent
EnableWindow
CheckDlgButton
GetWindowTextLengthA
DrawFrameControl
DrawEdge
EnumChildWindows
CreateIconIndirect
DrawIconEx
GetIconInfo
GetNextDlgTabItem
DrawTextW
EnumWindows
GetScrollPos
GetScrollRange
SetScrollRange
GetWindowInfo
UnionRect
GetDlgItem
IsDlgButtonChecked
GetScrollInfo
GetUpdateRect
ChildWindowFromPoint
ActivateKeyboardLayout
GetDlgCtrlID
SendDlgItemMessageA
MapDialogRect
IsDialogMessageW
FlashWindowEx
ShowCaret
HideCaret
GetAncestor
GetActiveWindow
MonitorFromPoint
CallWindowProcA
SetClassLongA
RegisterClassExA
GetDC
RegisterWindowMessageA
GetClassInfoExW
CopyRect
WindowFromDC
IsWindowUnicode
EnumDisplayMonitors
CreateIcon
GetKeyboardLayoutList
RegisterWindowMessageW
AttachThreadInput
ClipCursor
RemoveMenu
GetMenuItemCount
GetForegroundWindow
DrawIcon
IsRectEmpty
GetClipboardFormatNameW
GetQueueStatus
GetCursor
UpdateLayeredWindow
ChangeDisplaySettingsExW
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
BeginPaint
EndPaint
GetUpdateRgn
GetTopWindow
CreateMDIWindowW
EqualRect
GetCursorPos
SetCursorPos
ClientToScreen
GetClientRect
DestroyIcon
DestroyMenu
LoadIconW
SetWindowPos
FindWindowW
KillTimer
SetTimer
GetMonitorInfoW
MonitorFromRect
GetWindowRect
GetSystemMetrics
EnumDisplaySettingsW
IsWindowVisible
EnumDisplayDevicesW
SystemParametersInfoA
MessageBoxA
IsIconic
IsZoomed
GetParent
InflateRect
GetKeyState
GetClassNameW
ReleaseCapture
DestroyWindow
InvertRect
GetWindowLongW
SetWindowLongW
OffsetRect
GetWindow
LoadAcceleratorsA
GetFocus
CopyAcceleratorTableA
RegisterClassW
RegisterClassExW
CreateWindowExW
GetDesktopWindow
SetWindowTextW
GetWindowPlacement
SetForegroundWindow
ShowWindow
SendMessageA
DrawMenuBar
GetMenu
PostMessageA
IsWindow
MoveWindow
SetFocus
SetCaretPos
CreateCaret
GetCaretBlinkTime
DestroyCaret
CreateMenu
MessageBeep
LoadImageW

advapi32

RegDeleteKeyW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExA
SetNamedSecurityInfoW
RegCreateKeyExW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
TraceEvent
RegQueryValueExA
RegOpenKeyExA
RegisterTraceGuidsA
RegOpenKeyA
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegCloseKey

ole32

StgOpenStorageOnILockBytes
CoInitialize
CoUninitialize
CoCreateInstance
CoGetClassObject
CoUnmarshalInterface
CoMarshalInterface
CoAllowSetForegroundWindow
IsAccelerator
OleLoad
CreateClassMoniker
MkParseDisplayName
FreePropVariantArray
CoCreateGuid
DoDragDrop
CreateStreamOnHGlobal
GetHGlobalFromStream
CoRevokeClassObject
OleCreateMenuDescriptor
CoRegisterClassObject
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleGetIconOfFile
OleGetIconOfClass
OleMetafilePictFromIconAndLabel
OleSaveToStream
WriteClassStm
WriteFmtUserTypeStg
CoIsOle1Class
CLSIDFromProgID
CLSIDFromString
CoTreatAsClass
StringFromCLSID
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CoRegisterMessageFilter
OleSetMenuDescriptor
SetConvertStg
GetConvertStg
OleRegGetMiscStatus
CreateOleAdviseHolder
GetRunningObjectTable
CreateDataAdviseHolder
OleRegEnumFormatEtc
OleCreateEmbeddingHelper
StgIsStorageILockBytes
StgIsStorageFile
ReadFmtUserTypeStg
ReadClassStg
OleLockRunning
StgSetTimes
IIDFromString
StringFromGUID2
CreateFileMoniker
CoDisconnectObject
OleCreateLinkFromData
OleCreateFromData
ReleaseStgMedium
OleRun
CreateBindCtx
OleRegEnumVerbs
OleDuplicateData
OleIsRunning
CoFileTimeNow
CoTaskMemAlloc
WriteClassStg
CreateItemMoniker
CreateGenericComposite
OleFlushClipboard
OleQueryCreateFromData
OleQueryLinkFromData
CoGetMalloc
GetClassFile
OleRegGetUserType
OleGetClipboard
OleIsCurrentClipboard
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
ProgIDFromCLSID
CoTaskMemFree
StgCreateDocfileOnILockBytes

oart

ord454
ord6460
ord3970
ord4185
ord8175
ord2084
ord7675
ord834
ord1607
ord1525
ord741
ord7334
ord2492
ord4111
ord3900
ord4879
ord7990
ord7447
ord5459
ord7602
ord4513
ord5775
ord7111
ord2027
ord6977
ord2689
ord638
ord2931
ord4078
ord8332
ord2811
ord3181
ord4136
ord4343
ord2398
ord3855
ord5521
ord7356
ord3152
ord2856
ord4069
ord8198
ord1036
ord6711
ord6365
ord6376
ord2338
ord1623
ord5431
ord5863
ord3655
ord2802
ord6554
ord5879
ord5149
ord285
ord3273
ord1393
ord2556
ord7484
ord3172
ord5908
ord3468
ord5058
ord2328
ord7991
ord6695
ord5782
ord222
ord6908
ord6003
ord1569
ord1791
ord6883
ord1386
ord2621
ord2717
ord8069
ord3553
ord5101
ord7842
ord6659
ord8361
ord59
ord4260
ord6687
ord3688
ord1297
ord8275
ord5628
ord1189
ord4445
ord7892
ord4452
ord2795
ord6387
ord1682
ord7475
ord4428
ord2585
ord5066
ord116
ord2306
ord4210
ord7512
ord4012
ord270
ord6184
ord86
ord8068
ord8139
ord4899
ord8067
ord3360
ord6499
ord7543
ord535
ord258
ord4629
ord482
ord1354
ord7453
ord7254
ord2201
ord2672
ord973
ord3429
ord1658
ord7209
ord6632
ord4946
ord1867
ord7154
ord4588
ord3452
ord2032
ord5671
ord5166
ord2454
ord3472
ord4818
ord5783
ord6126
ord1411
ord7722
ord3474
ord3372
ord5923
ord5331
ord5262
ord4270
ord5240
ord6149
ord7160
ord2727
ord5260
ord2926
ord225
ord5883
ord1267
ord7137
ord8179
ord2509
ord446
ord1876
ord7697
ord3141
ord3818
ord33
ord6864
ord4687
ord7887
ord3156
ord978
ord3122
ord4207
ord4872
ord4621
ord703
ord5292
ord2335
ord7890
ord1422
ord26
ord394
ord322
ord2134
ord6810
ord233
ord1646
ord4540
ord2450
ord8007
ord5382
ord162
ord3509
ord486
ord7438
ord5750
ord3936
ord5779
ord2102
ord3329
ord5128
ord1980
ord1102
ord4240
ord4223
ord8194
ord5463
ord1520
ord6218
ord3000
ord2418
ord2784
ord2125
ord3109
ord5755
ord6546
ord2808
ord3502
ord5859
ord3909
ord1116
ord1765
ord4900
ord3169
ord8093
ord1186
ord8340
ord6016
ord3972
ord344
ord8417
ord3804
ord6274
ord8421
ord3891
ord1941
ord6062
ord3820
ord8171
ord314
ord4353
ord5726
ord265
ord5568
ord5965
ord3019
ord7385
ord7388
ord81
ord8276
ord2676
ord6531
ord3821
ord7749
ord7764
ord6506
ord938
ord5003
ord137
ord5501
ord5623
ord1707
ord2436
ord554
ord1864
ord8365
ord4740
ord2826
ord5111
ord8049
ord732
ord3584
ord1626
ord7193
ord4159
ord6393
ord4841
ord3945
ord7911
ord713
ord2726
ord8412
ord5047
ord855
ord7804
ord3116
ord5723
ord5412
ord7759
ord7753
ord4226
ord475
ord1349
ord7516
ord8094
ord3009
ord7931
ord2471
ord4964
ord1097
ord372
ord6919
ord3160
ord3748
ord5370
ord98
ord6380
ord1270
ord1545
ord3356
ord1807
ord6809
ord6324
ord7138
ord8348
ord2756
ord3204
ord1584
ord4298
ord4248
ord3974
ord4856
ord5212
ord5481
ord2998
ord1045
ord243
ord2006
ord8285
ord2385
ord5635
ord8059
ord1491
ord4923
ord3773
ord1923
ord8329
ord4500
ord6310
ord5243
ord7451
ord3203
ord1870
ord6633
ord4550
ord7232
ord8296
ord5646
ord7817
ord2960
ord1373
ord5936
ord4599
ord1989
ord4654
ord3304
ord3585
ord1902
ord8289
ord6893
ord5254
ord7880
ord1831
ord3334
ord2628
ord1370
ord4100
ord7472
ord6430
ord253
ord2445
ord7501
ord6690
ord3733
ord69
ord1800
ord6887
ord5529
ord6591
ord7454
ord7190
ord6622
ord5953
ord6378
ord169
ord592
ord5833
ord604
ord2246
ord7713
ord2853
ord6031
ord6418
ord3888
ord7365
ord2874
ord7728
ord4239
ord2014
ord6639
ord1063
ord366
ord4520
ord3985
ord2862
ord6927
ord1587
ord1105
ord2110
ord6231
ord3627
ord2484
ord2107
ord1238
ord4875
ord2599
ord1333
ord7333
ord2490
ord3825
ord5174
ord3333
ord4241
ord5753
ord7774
ord2372
ord188
ord1769
ord8208
ord3269
ord803
ord3580
ord6098
ord2844
ord1706
ord4066
ord3051
ord4580
ord7716
ord7670
ord3559
ord6760
ord2664
ord6855
ord4817
ord5897
ord7863
ord1596
ord497
ord6346
ord80
ord3865
ord7821
ord704
ord3663
ord6848
ord7234
ord1999
ord7612
ord1444
ord4261
ord1419
ord2751
ord6985
ord287
ord7020
ord7129
ord6423
ord1861
ord1794
ord1503
ord4080
ord321
ord2518
ord4219
ord5807
ord7781
ord4917
ord1649
ord4049
ord2943
ord1555
ord4936
ord4748
ord671
ord4406
ord2071
ord7347
ord279
ord5015
ord7358
ord6660
ord2716
ord6142
ord7186
ord7210
ord5996

gfx

ord492
ord670
ord408
ord990
ord162
ord919
ord30
ord258
ord588
ord461
ord647
ord644
ord371
ord874
ord505
ord935
ord968
ord922
ord276
ord703
ord472
ord800
ord447
ord460
ord19
ord657
ord274
ord454
ord422
ord340
ord424
ord886
ord138
ord352
ord83
ord925
ord808
ord116
ord574
ord90
ord486
ord923
ord104
ord130
ord320
ord915
ord934
ord537
ord926
ord223
ord184
ord955
ord694
ord161
ord445
ord206
ord146
ord358
ord977
ord570
ord241
ord493
ord455
ord969
ord711
ord32
ord24
ord818
ord669
ord930
ord690
ord867
ord448
ord242
ord671
ord264
ord625
ord366
ord663
ord880
ord212
ord238
ord282
ord15
ord861
ord817
ord876
ord727
ord937
ord549
ord240
ord302
ord343
ord801
ord798
ord192
ord896
ord60
ord971
ord293
ord776
ord420
ord487
ord367
ord11
ord828
ord530
ord423
ord744
ord831
ord885
ord97
ord884
ord821
ord288
ord520
ord738
ord84
ord167
ord932
ord610
ord767
ord389
ord634
ord193
ord61
ord511
ord3
ord760
ord620
ord438
ord273
ord807
ord309
ord859
ord155
ord749
ord560
ord747
ord544
ord160
ord720
ord322
ord952
ord427
ord844
ord531
ord79
ord175
ord624
ord214
ord635
ord353
ord383
ord62
ord526
ord943
ord802
ord862
ord827
ord287
ord307
ord362
ord938
ord204
ord734
ord710
ord75
ord25
ord979
ord133
ord326
ord795
ord787
ord471
ord453
ord796
ord573
ord716
ord498
ord777
ord838
ord430
ord216
ord341
ord782
ord775
ord819
ord502
ord548
ord566
ord843
ord951
ord475
ord409
ord967
ord569
ord906
ord794
ord535
ord190
ord592
ord961
ord446
ord916
ord47
ord106
ord658
ord706
ord779
ord317
ord58
ord641
ord649
ord348

Exports

Exports

DllGetLCID
_PPMain@0
_ShowSplashScreen@0

Sections

.text
Size: 8.1MB - Virtual size: 8.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 503KB - Virtual size: 503KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 31B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 285KB - Virtual size: 285KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 474KB - Virtual size: 474KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/PPSLAX.DLL
.dll regsvr32 windows x86

1ec825d5ff0b6e4105919353e866ef2d

Code Sign

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:a4:c8:91:b5:88:03:70:f2:f9:fa:00:c3:32:49:30:af:1a:21:d8
Signer

Actual PE Digest

0e:a4:c8:91:b5:88:03:70:f2:f9:fa:00:c3:32:49:30:af:1a:21:d8

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

06/03/2013, 09:21
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempPathW
TryEnterCriticalSection
CreateThread
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
FreeLibrary
GetSystemDirectoryW
LoadLibraryExW
CloseHandle
DisableThreadLibraryCalls
GetModuleFileNameW
lstrcmpiW
GetModuleHandleW
GetProcAddress
GetLastError
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
ReadFile
WriteFile
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
CreateFileW
GetLongPathNameW
GetShortPathNameW
IsWow64Process
OutputDebugStringA
GetVersion
GetFileAttributesW
GetModuleHandleA
CompareStringW
IsValidCodePage
WideCharToMultiByte
GetUserDefaultLCID
GetSystemDefaultLCID
IsValidLocale
GetStringTypeExW
SetLastError
FindResourceA
LockResource
IsDebuggerPresent
SetUnhandledExceptionFilter
VirtualProtect
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcessHeap
HeapFree
HeapAlloc
LoadLibraryW
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
lstrlenW

user32

AllowSetForegroundWindow
CharNextW

advapi32

DeregisterEventSource
ReportEventW
RegisterEventSourceW
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW

shlwapi

UrlGetPartW
StrRetToBufW

msvcr90

bsearch
_vscwprintf
wcsrchr
memmove
wcschr
??3@YAXPAX@Z
??_V@YAXPAX@Z
wcsstr
malloc
free
memcpy_s
_CxxThrowException
wcscpy_s
wcsncpy_s
wcscat_s
__CxxFrameHandler3
_recalloc
memcpy
memset
_wcsicmp
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
vswprintf_s
realloc
??2@YAPAXI@Z
??_U@YAPAXI@Z

ole32

CoTaskMemRealloc
StringFromGUID2
CLSIDFromProgID
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc

oleaut32

VariantClear
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
VariantInit
SysFreeString
SysStringLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
VariantCopyInd
LoadRegTypeLi

shell32

SHGetDesktopFolder

Exports

Exports

??4XmlCharacter@@QAEAAV0@ABV0@@Z
?isAsciiDigit@XmlCharacter@@SGH_W@Z
?isHexDigit@XmlCharacter@@SGH_W@Z
?isPubidChar@XmlCharacter@@SG_N_W@Z
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
MsoTraceWzHostTag
_FHostDoSideAssert@16
_GetAllocCounters@0
_HostEnterCriticalSection@4
_HostGetHostType@0
_HostLeaveCriticalSection@4
_HostReportException@12
_HostTryEnterCriticalSection@4
_HrMsoAllocHost@12
_HrMsoMarkMemHost@12
_HrMsoReallocHost@12
_MsoCodeMarkerHost@4
_MsoFreeHost@8
_MsoHrGetSecureTempPathHostW@8
_MsoReleaseMemHost@8
_MsoSetLastHRHost@4
_MsoSqmSetHost@12
_MsoSqmSetTimeHost@12
_SetFInMsoIAppendNewPx@4

Sections

.text
Size: 167KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 196KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/REFEDIT.DLL
.dll regsvr32 windows x86

72cca0b053ba8cb9813a5aaae5bd8a71

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

dc:a8:3c:05:54:c1:30:ed:56:00:d6:a2:77:ad:9a:f5:4e:26:a4:58
Signer

Actual PE Digest

dc:a8:3c:05:54:c1:30:ed:56:00:d6:a2:77:ad:9a:f5:4e:26:a4:58

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13/03/2010, 08:18
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
IsDebuggerPresent

user32

GetParent

ole32

CoGetClassObject

oleaut32

LoadRegTypeLi
VariantInit

msvcr90

_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
_decode_pointer
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_encoded_null
free
_malloc_crt
_encode_pointer
__CxxFrameHandler3
??2@YAPAXI@Z
??3@YAXPAX@Z
__CppXcptFilter

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/SAEXT.DLL
.dll windows x86

021246a4897465eb479b11abcb42c240

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

1d:68:b5:9d:6a:cb:6e:49:8c:51:10:e3:5e:df:7f:4a:40:a5:fd:99
Signer

Actual PE Digest

1d:68:b5:9d:6a:cb:6e:49:8c:51:10:e3:5e:df:7f:4a:40:a5:fd:99

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

10/01/2010, 04:13
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RaiseException
CloseHandle
UnmapViewOfFile
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
FindResourceA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
IsDebuggerPresent

msvcr90

_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_encoded_null
free
_malloc_crt
_encode_pointer
_CxxThrowException
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
??_V@YAXPAX@Z
??2@YAPAXI@Z
memset
??_U@YAPAXI@Z
__CxxFrameHandler3
??3@YAXPAX@Z
_decode_pointer

Exports

Exports

ConvertVietToCP1258
CreateWordBreaker
DeleteWordBreaker
FSupportSAEXT
FSupportSAEXTChar
FindWB
FindWordBreak

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 243KB - Virtual size: 243KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/SLERROR.XML
office2010/Office14/SOA.DLL
.dll windows x86

142a705ffd231721c7bf98e1d54a728f

Code Sign

33:00:00:01:29:a0:47:69:3a:a2:a4:6c:ed:00:00:00:00:01:29
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/09/2019, 20:40

Not After

04/12/2020, 20:40

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:e4:7c:fc:02:95:60:ff:84:fb:00:02:00:00:01:e4
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:20

Not After

02/05/2020, 21:20

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:04:35:45:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

20/09/2018, 17:42

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ab:2f:3b:7a:cc:50:7a:7e:fd:ff:b0:8b:d1:ba:17:36:93:01:ce:92:a2:25:83:e3:b0:7c:e5:7b:07:76:e7:d1
Signer

Actual PE Digest

ab:2f:3b:7a:cc:50:7a:7e:fd:ff:b0:8b:d1:ba:17:36:93:01:ce:92:a2:25:83:e3:b0:7c:e5:7b:07:76:e7:d1

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

34:4d:a9:85:5d:be:9a:c3:ae:6c:eb:be:cf:6c:c6:1b:c4:61:fb:fa
Signer

Actual PE Digest

34:4d:a9:85:5d:be:9a:c3:ae:6c:eb:be:cf:6c:c6:1b:c4:61:fb:fa

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

25/03/2020, 23:08
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RaiseException
GetLocaleInfoW
GetVersionExA
GetProcAddress
GetModuleHandleW
MulDiv
GetModuleHandleA
GlobalSize
DeleteFileW
CloseHandle
WriteFile
SetEndOfFile
GetFileAttributesExA
GetComputerNameW
GetLastError
GetACP
FindClose
FindNextFileW
FindFirstFileW
GetLocalTime
GetCPInfo
LoadLibraryA
FreeLibrary
LocalAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
GetSystemDefaultLCID
MultiByteToWideChar
GetSystemDefaultLangID
GetUserDefaultLangID
GlobalReAlloc
SetFilePointer
GlobalAlloc
GlobalLock
ReadFile
GlobalUnlock
OutputDebugStringW
GlobalFree
Sleep
InterlockedExchange
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
WideCharToMultiByte

user32

GetSystemMetrics
GetDC
ReleaseDC

gdi32

GetWindowOrgEx
GetViewportExtEx
GetWindowExtEx
GetViewportOrgEx
SaveDC
SetMapMode
SelectObject
RestoreDC
GetDeviceCaps

oleaut32

VariantChangeTypeEx
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayCreate
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayUnaccessData
GetErrorInfo
SysStringLen
SysAllocStringLen
VariantChangeType
SysAllocString
VariantClear
VariantInit
SysFreeString
SafeArrayGetLBound

advapi32

RegCloseKey

msvcr90

_encode_pointer
__clean_type_info_names_internal
_except_handler4_common
memcpy
memset
wcsncpy_s
__CxxFrameHandler3
_CxxThrowException
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
_snwprintf_s
free
memcpy_s
_vsnwprintf_s
_wcsdup
wcschr
?terminate@@YAXXZ
_wsplitpath_s
memmove
wcsstr
_wcsupr_s
iswspace
iswalnum
_wcsnicmp
_vsnprintf_s
memmove_s
wcsncmp
??0exception@std@@QAE@ABQBDH@Z
?what@exception@std@@UBEPBDXZ
wprintf
_wtoi
_wtol
_unlock
__dllonexit
wcscspn
_lock
_onexit
_decode_pointer
__lconv_init
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

Exports

Exports

??0ICX@@QAE@ABV0@@Z
??0ICX@@QAE@XZ
??0IParseXML@@QAE@ABV0@@Z
??0IParseXML@@QAE@XZ
??1ICX@@UAE@XZ
??4ICX@@QAEAAV0@ABV0@@Z
??4IParseXML@@QAEAAV0@ABV0@@Z
??_7ICX@@6B@
??_7IParseXML@@6B@
ApplyTransform
ExitParseXML
FPropTablesOK
FreeXMLFormatList
GetXMLFormatList
LpBiff8CxfmtNew
LpBiffCxfmtNew
LpDhtmlCxfmtNew
LpDpCxfmtNew
LpExcel12BiffCxfmtNew
LpExcel12XmlCxfmtNew
LpInitParseXML
LpThtmlCxfmtNew
LpThtxCxfmtNew
LpTrtfCxfmtNew
LpTtextCxfmtNew
LpXmlCxfmtNew
SOA_AddStyle
SOA_CchClipWrap
SOA_ChangeOutputFile
SOA_End
SOA_ErrSetColumnWidths
SOA_ErrSetCurCol
SOA_ErrSetNextRowAttrs
SOA_ErrWrite
SOA_ErrWriteFtyp
SOA_GetFilename
SOA_IdBegin
SOA_PrinterSetup
SOA_SetDocInfo
SOA_SetMailOutput
SetSmartTagUtilsC

Sections

.text
Size: 379KB - Virtual size: 379KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 106KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/URLREDIR.DLL
.dll regsvr32 windows x86

867f2f1984ecc873a35b553ab665fd4f

Code Sign

33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:12

Not After

04/12/2013, 21:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8b:81:38:d2:cb:f9:73:49:11:ac:b7:41:bb:ba:56:e0:13:ce:ee:7d
Signer

Actual PE Digest

8b:81:38:d2:cb:f9:73:49:11:ac:b7:41:bb:ba:56:e0:13:ce:ee:7d

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

06/03/2013, 07:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

secur32

GetUserNameExW

advapi32

DeregisterEventSource
ReportEventW
RegisterEventSourceW
OpenThreadToken
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExA
RegEnumKeyW
RegEnumValueW
RegDeleteValueA
RegEnumValueA
RegQueryInfoKeyA
GetLengthSid
AddAccessAllowedAce
AddAccessDeniedAce
InitializeAcl
AllocateAndInitializeSid
CopySid
GetTokenInformation
OpenProcessToken
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
CheckTokenMembership
IsValidSid
ConvertSidToStringSidA
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsA
TraceEvent
RegOpenKeyExA

gdi32

GetDeviceCaps
DeleteDC
DeleteObject
CreateDCA
CreateSolidBrush

kernel32

VirtualProtect
QueryPerformanceCounter
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
lstrlenW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
lstrcmpiW
LoadLibraryW
SetLastError
GetModuleFileNameW
OutputDebugStringA
LoadLibraryExW
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
DisableThreadLibraryCalls
SetThreadLocale
GetThreadLocale
HeapFree
HeapAlloc
GetProcessHeap
VirtualAlloc
HeapSetInformation
HeapCreate
HeapDestroy
HeapReAlloc
HeapSize
HeapUnlock
HeapLock
TlsSetValue
CreateFileW
GetLocaleInfoW
ExpandEnvironmentStringsW
GetProcessTimes
GetCurrentProcess
GlobalFree
CreateMutexA
OpenMutexA
CreateSemaphoreA
CreateFileMappingA
GetShortPathNameA
GetModuleFileNameA
DeleteFileW
GlobalAlloc
GetSystemDefaultLCID
GetSystemDefaultLangID
IsValidLocale
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
VirtualFree
TlsGetValue
TlsAlloc
TlsFree
LocalFree
LocalAlloc
CloseHandle
GetSystemDirectoryW
GetVersionExA
GetModuleHandleExW
RtlCaptureStackBackTrace
WaitForSingleObject
ReleaseMutex
GetSystemTimeAsFileTime
GetTickCount
GetLocalTime
WriteFile
SetFileAttributesW
ReadFile
GetUserDefaultLangID
GetTimeZoneInformation
GetDiskFreeSpaceExW
IsWow64Process
GetSystemInfo
GetUserDefaultLCID
GetVersionExW
TerminateProcess
GetCurrentProcessId
UnmapViewOfFile
MapViewOfFile
Sleep
IsDBCSLeadByte
LockResource
FindResourceA
GetStringTypeExW
WideCharToMultiByte
IsValidCodePage
CompareStringW
GetTempPathW
GetShortPathNameW
GetLongPathNameW
CreateDirectoryW
GetFileType
GetCurrentThread
InterlockedExchange
GlobalMemoryStatus
ReleaseSemaphore
IsProcessorFeaturePresent
EnumUILanguagesW
EnumSystemLocalesW
InterlockedCompareExchange
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter

ole32

CoInitializeEx
CoUninitialize
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc

oleaut32

VariantClear
SysFreeString
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
SysAllocString
LoadTypeLi
LoadRegTypeLi
DispCallFunc
SysStringLen
VariantInit

shell32

SHGetDesktopFolder
SHGetSpecialFolderPathW
SHGetFileInfoW

user32

GetSysColor
EnumDisplayMonitors
GetMonitorInfoA
GetKeyboardLayout
GetKeyboardLayoutList
GetSystemMetrics
SystemParametersInfoA
ReleaseDC
GetMenuCheckMarkDimensions
MessageBoxW
CharNextW
GetDC

msvcr90

wcsrchr
malloc
free
memcpy_s
wcsstr
_initterm
memset
swprintf_s
wcsnlen
_recalloc
wcscpy_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__clean_type_info_names_internal
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
wcscat_s
memcpy
strncpy_s
wcschr
bsearch
_vsnprintf_s
wcsncat_s
memmove
_CIsqrt
vswprintf_s
_amsg_exit
_initterm_e
wcsncpy_s
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
_wcsicmp
_CxxThrowException
_vsnprintf
__CxxFrameHandler3
_vscwprintf

shlwapi

StrRetToBufW
PathFindExtensionW
AssocQueryStringW
PathFindFileNameW

rpcrt4

UuidCreate

msohev

ord5
ord10
ord28
ord4

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 327KB - Virtual size: 326KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 198KB - Virtual size: 227KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/VEN2232.OLB
.dll windows x86

Code Sign

33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

26/07/2012, 20:50

Not After

26/10/2013, 20:50

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:16:11:04:b4:88:38:8c:be:c3:00:00:00:00:00:16
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

30/08/2012, 17:49

Not After

30/11/2013, 17:49

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

21:4a:00:2d:4b:f9:de:fe:61:6a:9f:66:be:77:b3:f5:c2:be:99:ed:54:5f:a9:7c:b9:ba:25:3f:ce:0c:9c:c6
Signer

Actual PE Digest

21:4a:00:2d:4b:f9:de:fe:61:6a:9f:66:be:77:b3:f5:c2:be:99:ed:54:5f:a9:7c:b9:ba:25:3f:ce:0c:9c:c6

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

af:2b:1d:b6:45:bb:98:fb:49:ca:bd:53:35:a8:23:56:7c:ac:0d:b0
Signer

Actual PE Digest

af:2b:1d:b6:45:bb:98:fb:49:ca:bd:53:35:a8:23:56:7c:ac:0d:b0

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13/09/2012, 03:05
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/WINWORD.EXE
.exe windows x86

abc6b11bfdb7e689f99111581940daa9

Code Sign

33:00:00:01:80:12:d8:63:03:aa:e3:8f:3e:00:00:00:00:01:80
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2020, 17:25

Not After

01/04/2021, 17:25

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:4D2F-E3DD-BEEF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:f9:f1:3d:78:67:62:cc:94:66:00:02:00:00:01:f9
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/07/2020, 18:30

Not After

25/04/2021, 18:30

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:04:35:45:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

20/09/2018, 17:42

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ca:ed:a5:b5:12:74:0d:8f:fc:fd:9b:d4:71:fd:e2:de:a2:f5:1f:03:be:32:c2:62:e7:86:aa:fe:15:21:de:1e
Signer

Actual PE Digest

ca:ed:a5:b5:12:74:0d:8f:fc:fd:9b:d4:71:fd:e2:de:a2:f5:1f:03:be:32:c2:62:e7:86:aa:fe:15:21:de:1e

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

24:f9:0b:05:e8:e3:4c:ca:97:8e:fb:73:ac:53:5c:ae:cc:f3:64:8c
Signer

Actual PE Digest

24:f9:0b:05:e8:e3:4c:ca:97:8e:fb:73:ac:53:5c:ae:cc:f3:64:8c

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

16/03/2021, 01:49
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersion
LoadLibraryW
GetLastError
SetLastError
GetFileAttributesW
OutputDebugStringA
LoadLibraryExW
FreeLibrary
GetSystemDirectoryW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetModuleHandleA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

msvcr90

_crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_invoke_watson
_controlfp_s
_except_handler4_common
__set_app_type
_encode_pointer
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
wcsncat_s
__p__fmode

Exports

Exports

DllGetLCID
wdCommandDispatch
wdGetApplicationObject

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/WINWORD.exe.manifest
office2010/Office14/WWLIB.DLL
.dll windows x86

60ac0c07f280d42b08ab433f767de0fb

Code Sign

33:00:00:01:6d:1b:4b:aa:aa:7d:41:e9:1d:00:00:00:00:01:6d
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2020, 17:24

Not After

01/04/2021, 17:24

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:7BF1-E3EA-B808,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:f9:f1:3d:78:67:62:cc:94:66:00:02:00:00:01:f9
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/07/2020, 18:30

Not After

25/04/2021, 18:30

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:04:35:45:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

20/09/2018, 17:42

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f8:59:41:6f:f8:16:a4:2c:e5:88:f0:cd:ec:a0:39:52:77:7b:91:8f:1a:e3:5a:a6:9d:14:2c:42:e3:bb:0e:4d
Signer

Actual PE Digest

f8:59:41:6f:f8:16:a4:2c:e5:88:f0:cd:ec:a0:39:52:77:7b:91:8f:1a:e3:5a:a6:9d:14:2c:42:e3:bb:0e:4d

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

1c:4c:e3:b0:66:cc:85:1e:73:0e:9b:e8:35:c4:36:16:97:c4:83:c3
Signer

Actual PE Digest

1c:4c:e3:b0:66:cc:85:1e:73:0e:9b:e8:35:c4:36:16:97:c4:83:c3

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

16/03/2021, 01:49
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegQueryValueExA
GetTokenInformation
OpenProcessToken
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegEnumValueW
LookupAccountSidW
SetNamedSecurityInfoW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
TraceEvent
RegOpenKeyExA
RegisterTraceGuidsA
DeregisterEventSource
ReportEventW
RegisterEventSourceW
RegOpenKeyA

gdi32

BitBlt
SelectObject
GetWindowOrgEx
DeleteDC
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
LineTo
MoveToEx
SetTextColor
GetBkColor
GetTextColor
StrokePath
StrokeAndFillPath
CreateSolidBrush
CreatePen
EndPath
BeginPath
GetTextMetricsW
StretchBlt
SetBkColor
EqualRgn
CombineRgn
SetRectRgn
GetRgnBox
SelectClipRgn
PatBlt
IntersectClipRect
GetNearestColor
Polygon
Polyline
GetBrushOrgEx
GetClipBox
SetBrushOrgEx
DeleteMetaFile
GetEnhMetaFileBits
SetWinMetaFileBits
GetMetaFileBitsEx
GetObjectType
ExtEscape
GetTextAlign
GetTextCharsetInfo
Rectangle
GetStockObject
GetGlyphOutlineW
OffsetRgn
CreateRectRgn
GetEnhMetaFileHeader
CopyMetaFileW
CopyEnhMetaFileW
DeleteEnhMetaFile
GetRegionData
CreateRectRgnIndirect
GetCharABCWidthsW
GetKerningPairsA
GetKerningPairsW
GetFontData
GetOutlineTextMetricsW
GetTextFaceA
GetTextFaceW
GetGlyphIndicesW
GetObjectW
GetCharWidthA
SetTextAlign
GetBkMode
GetWindowExtEx
GetViewportExtEx
EnumMetaFile
GetBitmapDimensionEx
SetMetaFileBitsEx
SetEnhMetaFileBits
RemoveFontMemResourceEx
CreatePatternBrush
CreateBitmapIndirect
CreateBitmap
AbortDoc
EndPage
StartPage
GetDeviceCaps
EndDoc
OffsetViewportOrgEx
SetAbortProc
RoundRect
SetBitmapDimensionEx
CreatePenIndirect
GetCurrentObject
GetTextCharset
FillPath
CloseFigure
PolylineTo
PolyBezierTo
GetPath
EnumEnhMetaFile
CloseEnhMetaFile
CreateEnhMetaFileW
GetTextExtentPoint32W
GetClipRgn
UnrealizeObject
GetBitmapBits
ExtSelectClipRgn
ExtCreateRegion
LPtoDP
CreateDIBitmap
ExtTextOutW
SetStretchBltMode
RealizePalette
SelectPalette
StretchDIBits
PlayMetaFile
PlayEnhMetaFile
FillRgn
SetWorldTransform
GetWorldTransform
SetGraphicsMode
SetTextJustification
SetLayout
GetLayout
DPtoLP
GdiComment
CloseMetaFile
CreateMetaFileW
GdiFlush
RectVisible
SetDIBits
PtInRegion
RectInRegion
Ellipse
SetROP2
ExcludeClipRect
RestoreDC
PlayMetaFileRecord
SetBkMode
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
GetViewportOrgEx
SetMapMode
SaveDC
GetDIBColorTable
DeleteObject

kernel32

GetTickCount
LocalFileTimeToFileTime
SystemTimeToFileTime
SetLastError
GetFileType
EncodePointer
FileTimeToLocalFileTime
IsValidCodePage
SetFileTime
GetFileTime
FileTimeToSystemTime
GetDiskFreeSpaceExW
GetLocalTime
CloseHandle
WriteFile
ReadFile
SetFilePointerEx
Sleep
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetDriveTypeW
SetFilePointer
FlushFileBuffers
GetLogicalDrives
GetModuleFileNameW
CreateProcessW
MulDiv
GlobalReAlloc
SizeofResource
LoadResource
FindResourceW
GetUserDefaultLCID
GetVersionExW
EnumSystemLocalesW
GetCurrentProcess
OutputDebugStringA
GetCurrentProcessId
GetSystemTime
SetEndOfFile
GetFileSizeEx
GetFileSize
DeviceIoControl
GetProcAddress
GetSystemDefaultLangID
GetOEMCP
SetErrorMode
RaiseException
GlobalFlags
GlobalHandle
CompareFileTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
GetModuleHandleA
GetFileAttributesW
GetVersion
FreeLibrary
LoadLibraryW
ReleaseMutex
SetEvent
ResumeThread
CreateThread
CreateMutexW
ResetEvent
CreateEventW
GetPriorityClass
SetPriorityClass
CreatePipe
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
SetThreadPriority
GetThreadPriority
GetCurrentThread
GlobalMemoryStatus
GetSystemInfo
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetFileAttributesW
GetCurrentThreadId
GetTempPathW
OutputDebugStringW
OpenEventA
CreateEventA
SwitchToThread
ExpandEnvironmentStringsW
CreateFileMappingW
DebugBreak
ExitProcess
GetVersionExA
GetCommandLineW
SuspendThread
OpenThread
TerminateProcess
GetStartupInfoW
AddAtomW
LoadLibraryA
GetTimeFormatW
GetDateFormatW
LockResource
GlobalDeleteAtom
GetSystemTimeAsFileTime
IsDBCSLeadByteEx
GlobalFindAtomA
GlobalAddAtomW
MoveFileExW
LocalFree
LoadLibraryExW
GetSystemDirectoryW
FormatMessageA
LocalAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedCompareExchange
InterlockedExchange
HeapAlloc
HeapFree
GetProcessHeap
QueryPerformanceCounter
VirtualProtect
FormatMessageW
GetLocaleInfoW
RtlCaptureStackBackTrace
GetModuleHandleExW
OpenFile
LoadLibraryExA
GlobalSize
GlobalAlloc
GlobalLock
GlobalFree
TlsFree
TlsAlloc
TlsSetValue
VirtualFree
VirtualAlloc
WideCharToMultiByte
GetACP
FindClose
GetLastError
TlsGetValue
DecodePointer
GetModuleHandleW
GlobalUnlock

ole32

CoCreateInstance
CoLockObjectExternal
OleSaveToStream
CreateBindCtx
StgIsStorageFile
StgOpenStorageOnILockBytes
CreateGenericComposite
CreateItemMoniker
CreateFileMoniker
MkParseDisplayName
StringFromCLSID
ProgIDFromCLSID
WriteClassStm
OleIsRunning
CLSIDFromString
GetHGlobalFromStream
CoUninitialize
CoInitialize
CoTaskMemAlloc
ReadClassStm
CoGetMalloc
OleCreateDefaultHandler
OleSave
OleConvertIStorageToOLESTREAM
OleConvertIStorageToOLESTREAMEx
GetConvertStg
IIDFromString
OleConvertOLESTREAMToIStorage
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
StringFromGUID2
CoGetClassObject
CoFreeUnusedLibraries
OleGetClipboard
OleIsCurrentClipboard
OleFlushClipboard
ReleaseStgMedium
OleRun
OleDuplicateData
CoDisconnectObject
CoRevokeClassObject
CoRegisterClassObject
CoUnmarshalInterface
CoMarshalInterface
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoGetCallerTID
CoTreatAsClass
OleCreateLinkFromData
OleCreateFromData
CoGetTreatAsClass
CreateDataCache
OleSetClipboard
OleCreateLink
GetClassFile
OleQueryLinkFromData
OleQueryCreateFromData
CoIsOle1Class
CoRegisterMessageFilter
GetRunningObjectTable
OleGetIconOfClass
OleSetMenuDescriptor
SetConvertStg
CoAllowSetForegroundWindow
CreateDataAdviseHolder
OleRegEnumFormatEtc
OleRegGetMiscStatus
CreateOleAdviseHolder
OleRegEnumVerbs
CoCreateGuid
WriteClassStg
WriteFmtUserTypeStg
ReadFmtUserTypeStg
CreateStreamOnHGlobal
CoTaskMemFree
ReadClassStg
IsAccelerator

oleaut32

OleCreateFontIndirect
VariantInit
SysFreeString
SysStringLen
SetErrorInfo
GetErrorInfo
SysAllocStringLen
SysAllocString
VariantChangeType
VarR4FromR8
VarR8FromR4
SysReAllocString
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayCreate
RevokeActiveObject
VariantCopy
SafeArrayGetElement
RegisterActiveObject
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
CreateErrorInfo
SafeArrayPutElement
SafeArrayAllocData
SafeArrayDestroyData
SafeArrayUnlock
SafeArrayLock
SafeArrayGetDim
VariantCopyInd
VariantClear
SystemTimeToVariantTime

user32

GetQueueStatus
SendMessageW
CharToOemBuffA
OemToCharBuffA
GetWindowLongW
DispatchMessageA
DispatchMessageW
IsWindowUnicode
ClientToScreen
MessageBeep
UpdateWindow
SetWindowPos
MoveWindow
RedrawWindow
GetParent
DestroyWindow
SetWindowLongW
GetWindowPlacement
PostMessageW
GetForegroundWindow
SetForegroundWindow
PtInRect
RegisterClassExW
FindWindowW
MapWindowPoints
IsIconic
SetScrollPos
SetScrollRange
DrawFocusRect
GetKeyState
GetFocus
SetFocus
VkKeyScanExW
CloseClipboard
IsClipboardFormatAvailable
OpenClipboard
OpenIcon
GetScrollRange
InvalidateRect
RemoveMenu
SetMenuItemInfoW
InsertMenuItemW
GetMenuItemInfoW
GetMenuItemCount
SetActiveWindow
GetActiveWindow
SetTimer
ToAscii
GetKeyboardState
KillTimer
DrawTextW
DefWindowProcW
DrawFrameControl
GetKeyboardLayoutList
IsZoomed
BringWindowToTop
DestroyIcon
DrawIcon
EnableWindow
SetWindowsHookExW
UnhookWindowsHookEx
GetWindowDC
DestroyMenu
TrackPopupMenu
AppendMenuW
CreatePopupMenu
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
LoadImageA
AllowSetForegroundWindow
GetWindowThreadProcessId
GetMonitorInfoW
MonitorFromRect
GetDoubleClickTime
FlashWindowEx
GetWindow
GetDesktopWindow
SetWindowPlacement
GetClassNameA
SetParent
AdjustWindowRect
InvertRect
EnumWindows
IsWindowEnabled
GetAsyncKeyState
UnionRect
ReleaseCapture
GetCursorPos
SetCapture
GetMenu
CreateAcceleratorTableW
WindowFromPoint
RegisterWindowMessageW
SetMenu
GrayStringW
InSendMessage
ExitWindowsEx
LoadImageW
LoadIconW
LoadCursorFromFileW
LoadCursorW
SetCursor
DestroyCursor
GetCapture
CreateWindowExW
ShowCursor
WindowFromDC
IsChild
SetKeyboardState
GetDCEx
GetUpdateRgn
SetCaretPos
CreateCaret
DestroyCaret
NotifyWinEvent
GetCaretPos
CallNextHookEx
SetCursorPos
TrackMouseEvent
ClipCursor
GetScrollPos
RegisterWindowMessageA
FlashWindow
PostQuitMessage
GetMessageTime
VkKeyScanW
MapVirtualKeyW
RegisterClassW
UnregisterClassW
GetMessagePos
CallWindowProcW
DrawEdge
GetScrollInfo
keybd_event
RealGetWindowClassW
GetCursor
GetKeyNameTextW
LockWindowUpdate
SubtractRect
ArrangeIconicWindows
SendMessageTimeoutW
GetClipboardFormatNameA
PackDDElParam
UnpackDDElParam
FreeDDElParam
ValidateRect
ValidateRgn
GetDlgCtrlID
GetCaretBlinkTime
LoadIconA
DrawIconEx
CreateWindowExA
SendMessageA
GetClassNameW
GetClassLongW
GetPropW
TranslateMessage
ActivateKeyboardLayout
ToAsciiEx
EnableMenuItem
GetSystemMenu
CreateMenu
SetScrollInfo
MonitorFromPoint
EnumThreadWindows
MonitorFromWindow
RemovePropW
SetPropW
ScrollWindowEx
EnumChildWindows
MessageBoxA
ShowWindow
GetWindowRect
ScreenToClient
CopyImage
CopyRect
GetClientRect
IsRectEmpty
GetGuiResources
IsWindow
GetInputState
GetSystemMetrics
SystemParametersInfoW
RegisterClipboardFormatA
EqualRect
SetRectEmpty
SetRect
FrameRect
WaitForInputIdle
GetKeyboardLayout
IsWindowVisible
MessageBoxW
RegisterClipboardFormatW
GetSysColor
GetClipboardFormatNameW
GetUpdateRect
IntersectRect
BeginPaint
EndPaint
GetDC
ReleaseDC
InflateRect
OffsetRect
FillRect
ShowOwnedPopups
GetAncestor

gfx

ord864
ord457
ord609
ord265
ord273
ord167
ord462
ord637
ord442
ord659
ord209
ord503
ord887
ord721
ord405
ord24
ord813
ord899
ord512
ord412
ord186
ord592
ord480
ord47
ord190
ord106
ord916
ord446
ord961
ord64
ord995
ord996
ord882
ord448
ord959
ord487
ord690
ord663
ord647
ord821
ord775
ord97
ord461
ord138
ord387
ord389
ord935
ord806
ord62
ord58
ord317
ord526
ord779
ord342
ord193
ord827
ord471
ord499
ord120
ord314
ord309
ord370
ord95
ord749
ord671
ord880
ord212
ord238
ord943
ord192
ord204
ord322
ord952
ord569
ord844
ord302
ord307
ord61
ord214
ord216
ord133
ord341
ord931
ord951
ord833
ord498
ord11
ord635
ord794
ord430
ord649
ord782
ord641
ord465
ord669
ord867

msvcr90

memcpy
__CxxFrameHandler3
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
free
malloc
_finite
_vscwprintf
vswprintf_s
memcpy_s
_CxxThrowException
memset
memmove
wcsncpy_s
wcsstr
strncpy_s
wcsrchr
ceil
floor
wcschr
_vsnprintf_s
_vsnwprintf_s
_mbschr
_stricmp
_snwprintf_s
_ecvt_s
atof
_CIcos
_CIsin
srand
_CIfmod
_CIatan2
_CIsqrt
_CItan
_errno
wcstoul
_wsplitpath_s
wcsnlen
_mbsrchr
?raw_name@type_info@@QBEPBDXZ
_controlfp_s
_isnan
qsort
_CIacos
??8type_info@@QBE_NABV0@@Z

oart

ord4677
ord4078
ord8010
ord3390
ord1269
ord1434
ord5815
ord3550
ord1240
ord5979
ord1320
ord798
ord7252
ord758
ord2399
ord5586
ord7608
ord4346
ord4130
ord6447
ord1028
ord1043
ord2873
ord1195
ord4027
ord5457
ord7452
ord4682
ord4550
ord3113
ord7232
ord6137
ord3858
ord464
ord5628
ord4509
ord6214
ord5226
ord5098
ord1474
ord2592
ord4694
ord8335
ord746
ord8418
ord5361
ord445
ord6701
ord3953
ord7348
ord5668
ord4793
ord1834
ord6844
ord6649
ord2368
ord5709
ord5657
ord2152
ord7400
ord344
ord8417
ord1202
ord18
ord6633
ord6687
ord4704
ord4445
ord1189
ord7892
ord1381
ord4298
ord1393
ord2556
ord3921
ord7202
ord1316
ord285
ord7484
ord3172
ord5908
ord7003
ord5629
ord5294
ord6695
ord2948
ord5058
ord5076
ord4185
ord5782
ord222
ord2468
ord5718
ord1569
ord5200
ord4879
ord6883
ord1791
ord2621
ord2717
ord3704
ord4822
ord3553
ord3356
ord1807
ord6809
ord6324
ord7138
ord8348
ord2707
ord3291
ord7840
ord124
ord5966
ord137
ord3610
ord2340
ord7052
ord6553
ord790
ord5856
ord7860
ord968
ord582
ord6275
ord3994
ord3829
ord7724
ord5331
ord269
ord4270
ord7722
ord1401
ord3372
ord6222
ord2602
ord8192
ord2932
ord8149
ord5514
ord6331
ord3235
ord1961
ord6595
ord306
ord2458
ord2670
ord4353
ord5635
ord8285
ord713
ord3613
ord3430
ord2768
ord8260
ord4533
ord1115
ord6350
ord2904
ord4402
ord1793
ord2226
ord6722
ord6197
ord4588
ord2032
ord1165
ord3018
ord6756
ord4357
ord2422
ord732
ord4652
ord2966
ord6647
ord5879
ord5149
ord2328
ord7991
ord1386
ord7812
ord5101
ord3273
ord8361
ord4260
ord3928
ord7014
ord7111
ord8396
ord3946
ord5452
ord2923
ord2483
ord8400
ord4617
ord2035
ord1731
ord2793
ord6476
ord6973
ord4418
ord1371
ord3453
ord2013
ord3584
ord8049
ord5227
ord2186
ord1509
ord6871
ord6408
ord2445
ord7352
ord6673
ord7396
ord1072
ord5214
ord5623
ord5113
ord5175
ord7301
ord2040
ord8355
ord3835
ord3881
ord2876
ord5909
ord6066
ord1768
ord7423
ord6471
ord5048
ord3807
ord7614
ord2733
ord3146
ord2289
ord834
ord471
ord6772
ord6027
ord1177
ord1855
ord7356
ord6714
ord1285
ord72
ord7527
ord5344
ord1647
ord6174
ord5857
ord7027
ord1923
ord6362
ord1658
ord4817
ord7863
ord2237
ord3168
ord3673
ord7758
ord3467
ord3192
ord8190
ord6501
ord2810
ord2091
ord7700
ord7694
ord7112
ord6416
ord4244
ord7823
ord3066
ord3416
ord2164
ord2484
ord8093
ord4483
ord2262
ord5225
ord264
ord1976
ord1513
ord3290
ord500
ord2532
ord4421
ord1077
ord1736
ord644
ord3579
ord1357
ord6103
ord802
ord4828
ord3726
ord4208
ord7601
ord1067
ord5620
ord6342
ord3468
ord6908
ord8069
ord2796
ord3242
ord265
ord2480
ord3851
ord1345
ord1588
ord1463
ord5450
ord682
ord6106
ord5241
ord8003
ord5899
ord6726
ord7945
ord8415
ord7928
ord7718
ord4700
ord4470
ord5852
ord2392
ord7023
ord3581
ord7453
ord7938
ord6606
ord180
ord495
ord4629
ord5531
ord2476
ord7624
ord6509
ord7652
ord2818
ord3772
ord6018
ord6750
ord7702
ord2155
ord1549
ord7176
ord5009
ord1190
ord3711
ord1644
ord4544
ord4478
ord4599
ord5315
ord7921
ord7920
ord2330
ord3293
ord1633
ord2585
ord4257
ord5268
ord4568
ord59
ord2672
ord4448
ord3794
ord7459
ord2784
ord4012
ord6808
ord259
ord8221
ord1485
ord1802
ord5811
ord2223
ord2151
ord4830
ord339
ord3816
ord493
ord4356
ord133
ord6582
ord817
ord5340
ord2888
ord2372
ord3020
ord7338
ord8112
ord2171
ord894
ord1440
ord149
ord3084
ord3681
ord2089
ord1297
ord8275
ord2885
ord4966
ord753
ord3059
ord5246
ord2127
ord5336
ord255
ord7050
ord256
ord7820
ord5388
ord362
ord4190
ord1006
ord6003
ord1122
ord1909
ord6849
ord7842
ord7146
ord6990
ord2494
ord6718
ord2705
ord6659
ord5642
ord3987
ord2956
ord6992
ord5434
ord2560
ord3942
ord1221
ord764
ord314
ord3019
ord7385
ord7193
ord1879
ord1045
ord243
ord4159
ord5494
ord6149
ord5212
ord3368
ord6124
ord6643
ord4206
ord7593
ord6338
ord7878
ord4029
ord393
ord3071
ord5851
ord3043
ord6788
ord1398
ord2903
ord1996
ord4085
ord7363
ord900
ord3287
ord1048
ord4258
ord7637
ord4816
ord7333
ord5723
ord7804
ord3820
ord3190
ord1036
ord3063
ord8438
ord1491
ord4618
ord5425
ord1789
ord3729
ord2694
ord3980
ord7691
ord8353
ord4407
ord8175
ord2084
ord7675
ord2265
ord7447
ord5459
ord7602

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllGetLCID
DllMain
FMain
_GetAllocCounters@0
wdCommandDispatch
wdGetApplicationObject

Sections

.text
Size: 14.5MB - Virtual size: 14.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 710KB - Virtual size: 709KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/XLCALL32.DLL
.dll windows x86

79b3362178937bf9559741c46bb9e035

Code Sign

33:00:00:00:76:c2:ce:62:e9:0e:5d:85:3e:00:00:00:00:00:76
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:40

Not After

04/09/2016, 17:40

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7AFA-E41C-E142,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

32:6b:f2:d3:62:cb:71:50:03:a9:2d:a6:15:8f:81:1d:03:0a:59:fa
Signer

Actual PE Digest

32:6b:f2:d3:62:cb:71:50:03:a9:2d:a6:15:8f:81:1d:03:0a:59:fa

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13/10/2015, 11:51
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress

Exports

Exports

Excel4
Excel4v
LPenHelper
XLCallVer

Sections

.text
Size: 1024B - Virtual size: 820B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 8B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/mscss7cm_en.dub
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/Office14/mscss7en.dll
.dll windows x86

70c26468c03290262c1433e277eae6aa

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5d:6f:d8:c3:48:9a:47:57:37:f3:99:27:72:08:c5:a4:61:bc:6e:02
Signer

Actual PE Digest

5d:6f:d8:c3:48:9a:47:57:37:f3:99:27:72:08:c5:a4:61:bc:6e:02

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

30/03/2010, 04:49
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

_decode_pointer
_initterm
_malloc_crt
_encode_pointer
memcpy
wcsrchr
vswprintf_s
wcscpy_s
_time64
fclose
_wfopen_s
swprintf_s
_wstat64
mbstowcs_s
_CIsqrt
fwrite
fread
_CIlog
??1exception@std@@UAE@XZ
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_unlock
__dllonexit
_lock
_onexit
_crt_debugger_hook
__clean_type_info_names_internal
_except_handler4_common
??0exception@std@@QAE@XZ
_wsplitpath_s
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
free
malloc
_CxxThrowException
?what@exception@std@@UBEPBDXZ
__CxxFrameHandler3
??0exception@std@@QAE@ABQBD@Z
_encoded_null
wcsstr
??0exception@std@@QAE@ABV01@@Z
wcsncmp
_waccess
_errno
memcpy_s
_vsnwprintf
memset
memmove
wcschr
_invalid_parameter_noinfo
realloc

msvcp90

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WI@Z
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z

oleaut32

SysAllocString
VariantClear
VariantInit
VariantCopy

kernel32

lstrlenW
LCMapStringW
CompareStringW
FindResourceW
SizeofResource
LoadResource
LockResource
FoldStringW
IsDebuggerPresent
RtlCaptureStackBackTrace
GetModuleHandleExW
GetModuleFileNameW
CloseHandle
CreateMutexW
CreateEventW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualProtect
LoadLibraryW
GetCurrentThreadId
GetLocalTime
LoadLibraryExW
GetProcAddress
FreeLibrary
LeaveCriticalSection
EnterCriticalSection
LocalFree
SetLastError
InitializeCriticalSectionAndSpinCount
GetLastError
DeleteCriticalSection

advapi32

TraceEvent

shell32

SHGetFolderPathAndSubDirW

Exports

Exports

FreeGlobalObjects
GetContextSpellingSession
GetNextToken
RunCssWordBreaker

Sections

.text
Size: 267KB - Virtual size: 266KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/mscss7wre_en.dub
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/Office14/msproof7.dll
.dll windows x86

d199a42d73d8cb5072048c2733dff7e1

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

58:4f:86:e3:5a:07:b1:f7:7e:b6:3e:91:bd:fb:04:20:a9:3c:25:3e
Signer

Actual PE Digest

58:4f:86:e3:5a:07:b1:f7:7e:b6:3e:91:bd:fb:04:20:a9:3c:25:3e

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/12/2010, 02:29
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

free
memmove
_vsnwprintf
iswspace
memset
malloc
memcpy
_wsplitpath_s
_wfopen_s
fclose
__CxxFrameHandler3
wcsncmp
_itow_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
fread
ftell
fseek
realloc
_itoa_s
_CxxThrowException
atoi
swscanf_s
_malloc_crt
_encode_pointer
wcsrchr
wcschr
_wdupenv_s
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_resetstkoflw
memcpy_s

shell32

SHGetFolderPathW

oleaut32

VariantCopy
CreateErrorInfo
SysAllocString
VariantClear
VariantInit
SysStringLen
SysFreeString
VariantChangeType
SysAllocStringByteLen
SysStringByteLen
SetErrorInfo

kernel32

RtlCaptureStackBackTrace
GetModuleHandleExW
GetVersionExA
GetLocaleInfoA
WideCharToMultiByte
SleepEx
ReadFile
GetFileInformationByHandle
FlushFileBuffers
SetFilePointer
WriteFile
CreateFileW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CloseHandle
SetEndOfFile
LeaveCriticalSection
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
VirtualProtect
MultiByteToWideChar
GetCurrentThreadId
GetLocalTime
FormatMessageW
LoadLibraryW
GetModuleFileNameW
GetFullPathNameW
GetProcAddress
FreeLibrary
GetTickCount
DisableThreadLibraryCalls
GetFileSize
EnterCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
GetLastError
DeleteCriticalSection
LocalFree

advapi32

RegCloseKey
RegisterTraceGuidsA
RegQueryValueExW
RegOpenKeyExA
TraceEvent
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/Office14/ogalegit.dll
.dll windows x86

00ebb90722b960dfc4b5e59ad5fb3e38

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c7:e9:01:ee:49:64:cf:14:cb:16:56:7e:8d:cf:76:be:9c:a2:55:4b
Signer

Actual PE Digest

c7:e9:01:ee:49:64:cf:14:cb:16:56:7e:8d:cf:76:be:9c:a2:55:4b

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
IsDebuggerPresent
HeapSize
WriteFile
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeZoneInformation
CreateFileA
CloseHandle
FlushFileBuffers
GetStartupInfoA
ReadProcessMemory
GlobalFree
GlobalAlloc
FindClose
FindFirstFileA
GetSystemDirectoryA
GetDriveTypeA
CreateDirectoryW
GetCurrentDirectoryW
CreateDirectoryA
LocalFree
LocalAlloc
TryEnterCriticalSection
GetVolumeInformationA
GetComputerNameW
CompareFileTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetSystemTime
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
SetFileAttributesW
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileW
FindNextFileA
ReadFile
lstrlenA
lstrlenW
GetSystemInfo
GetVolumeInformationW
GetDriveTypeW
GetLogicalDriveStringsW
DeviceIoControl
WaitForSingleObject
ResumeThread
SetThreadAffinityMask
CreateThread
GetProcessAffinityMask
GetExitCodeThread
GetLogicalDriveStringsA
GlobalMemoryStatus
SetEndOfFile
RaiseException
GetFileType
GetStdHandle
SetHandleCount
Sleep
GetCurrentThread
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
ExitProcess
GetModuleHandleA
GetVersionExA
GetCommandLineA
GetSystemDefaultLangID
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetProcAddress
FreeLibrary
HeapAlloc
GetFileAttributesA
GetModuleFileNameA
GetLastError
GetProcessHeap
HeapFree
GetVersion
InitializeCriticalSectionAndSpinCount
VirtualProtect

ntdll

RtlUnwind

advapi32

RegEnumKeyExW
RegSetValueExA
RegCreateKeyExA
LookupAccountNameW
CopySid
GetLengthSid
GetTokenInformation
OpenProcessToken
OpenThreadToken
CryptReleaseContext
CryptDestroyKey
GetCurrentHwProfileW
RegQueryValueExW
RegEnumKeyA
CryptImportKey
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
GetCurrentHwProfileA
RegEnumKeyExA
RegOpenKeyExW
CryptDecrypt
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptDestroyHash
CryptAcquireContextA

ole32

CoSetProxyBlanket
IIDFromString
CoInitialize
CoUninitialize
CoCreateInstance
StringFromGUID2
CLSIDFromProgID
CoCreateGuid

oleaut32

VariantClear
VariantInit
SysStringLen
SysFreeString
SysAllocString
SysAllocStringLen

user32

GetSystemMetrics
BroadcastSystemMessageA
GetDesktopWindow
wsprintfA

crypt32

CertOpenStore
CertComparePublicKeyInfo
CertCloseStore
CertCreateCertificateContext
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertFindExtension
CryptExportPublicKeyInfo
CertVerifySubjectCertificateContext
CertGetIssuerCertificateFromStore
CertFreeCertificateContext

wininet

InternetOpenA
InternetQueryOptionA
HttpSendRequestA
InternetErrorDlg
HttpOpenRequestA
InternetConnectA
InternetReadFile
HttpQueryInfoA
InternetSetOptionA
InternetAutodial
InternetGetConnectedState
InternetCloseHandle

setupapi

SetupDiGetClassDevsA
SetupDiGetClassDevsW
SetupDiCreateDeviceInfoList
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Exports

Exports

GetLastErrors
GetNonGenuineProductList
LegitCheck
LegitCheckCA
SetPartnerID

Sections

.text
Size: 569KB - Virtual size: 568KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/Office14/protocolhandler.exe
.exe windows x86

a1c82f28b06ceb78333bebf2fcf3f613

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:02:8e:42:00:00:00:00:00:1f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ee:f3:e4:b8:9c:e7:02:ca:ba:73:f7:61:e8:86:03:0c:44:f2:6b:4b
Signer

Actual PE Digest

ee:f3:e4:b8:9c:e7:02:ca:ba:73:f7:61:e8:86:03:0c:44:f2:6b:4b

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13/12/2012, 16:41
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

secur32

GetUserNameExW

msvcr90

?terminate@@YAXXZ
_crt_debugger_hook
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
memcpy_s
_invoke_watson
_CxxThrowException
_vsnprintf
__CxxFrameHandler3
wcscpy_s
_vscwprintf
vswprintf_s
_CIsqrt
memmove
_vsnprintf_s
bsearch
strncpy_s
memcpy
iswspace
tolower
toupper
isalpha
wcsnlen
wcsncpy_s
wcsncat_s
memset
swprintf_s
wcsstr
wcsrchr
wcschr
_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_wcsicmp

user32

MessageBoxW
GetMenuCheckMarkDimensions
ReleaseDC
GetDC
GetMonitorInfoA
EnumDisplayMonitors
GetSysColor
GetKeyboardLayout
GetKeyboardLayoutList
GetSystemMetrics
SystemParametersInfoA

kernel32

GetCurrentThread
LoadLibraryExW
InterlockedExchange
GlobalMemoryStatus
ReleaseSemaphore
IsProcessorFeaturePresent
EnumUILanguagesW
EnumSystemLocalesW
InterlockedCompareExchange
VirtualProtect
QueryPerformanceCounter
GetStartupInfoA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryW
RaiseException
GetCommandLineW
HeapFree
HeapAlloc
GetProcessHeap
GetModuleHandleA
VirtualAlloc
HeapSetInformation
HeapCreate
HeapDestroy
HeapReAlloc
HeapSize
HeapUnlock
HeapLock
TlsSetValue
SetLastError
GetLastError
GetSystemDefaultLCID
GetSystemDefaultLangID
IsValidLocale
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
GetModuleFileNameW
CreateFileW
GetLocaleInfoW
ExpandEnvironmentStringsW
GetProcessTimes
GetCurrentProcess
GlobalFree
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringA
CreateMutexA
OpenMutexA
CreateSemaphoreA
CreateFileMappingA
GetShortPathNameA
GetModuleFileNameA
DeleteFileW
GlobalAlloc
GetVersionExA
GetModuleHandleExW
RtlCaptureStackBackTrace
WaitForSingleObject
ReleaseMutex
CloseHandle
GetSystemTimeAsFileTime
GetTickCount
GetLocalTime
WriteFile
SetFileAttributesW
ReadFile
VirtualFree
TlsGetValue
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsFree
DeleteCriticalSection
InitializeCriticalSection
GetCurrentThreadId
GetUserDefaultLangID
FreeLibrary
LocalFree
LocalAlloc
GetSystemDirectoryW
GetTimeZoneInformation
GetDiskFreeSpaceExW
IsWow64Process
GetSystemInfo
GetUserDefaultLCID
GetVersionExW
TerminateProcess
GetCurrentProcessId
UnmapViewOfFile
MapViewOfFile
Sleep
IsDBCSLeadByte
LockResource
LoadResource
FindResourceA
GetStringTypeExW
WideCharToMultiByte
IsValidCodePage
CompareStringW
MultiByteToWideChar
GetTempPathW
GetShortPathNameW
GetLongPathNameW
CreateDirectoryW
GetFileType

advapi32

ConvertSidToStringSidA
IsValidSid
CheckTokenMembership
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
OpenProcessToken
GetTokenInformation
CopySid
AllocateAndInitializeSid
InitializeAcl
AddAccessDeniedAce
AddAccessAllowedAce
GetLengthSid
TraceEvent
RegisterTraceGuidsA
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegDeleteValueW
RegEnumValueW
RegEnumKeyW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegQueryInfoKeyA
RegEnumValueA
RegDeleteValueA
RegQueryValueExA
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
OpenThreadToken
DeregisterEventSource
ReportEventW
RegisterEventSourceW
RegOpenKeyExA

ole32

CoInitializeEx
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance

shell32

SHGetDesktopFolder
SHGetSpecialFolderPathW
CommandLineToArgvW
SHAssocEnumHandlers

shlwapi

StrRetToBufW

gdi32

GetDeviceCaps
DeleteDC
DeleteObject
CreateDCA
CreateSolidBrush

oleaut32

SysFreeString
SysAllocString

rpcrt4

UuidCreate

msohev

ord9
ord30
ord12
ord25
ord29
ord5
ord4
ord26
ord23
ord10
ord22
ord21

Exports

Exports

_GetAllocCounters@0

Sections

.text
Size: 306KB - Virtual size: 306KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 196KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/MShared/OFFICE14/2052/ACEINTL.DLL
.dll windows x86

bbf9a8b31bbbc2759d7cf931767ea212

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

da:9a:27:bc:a0:77:ed:93:8a:d9:a2:d8:5c:23:b7:6e:b0:89:43:c9
Signer

Actual PE Digest

da:9a:27:bc:a0:77:ed:93:8a:d9:a2:d8:5c:23:b7:6e:b0:89:43:c9

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

23/03/2010, 13:40
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
memcpy

kernel32

LockResource
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
FindResourceA
DisableThreadLibraryCalls
LoadResource

Exports

Exports

CchLszOfId2

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 820B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/MShared/OFFICE14/2052/ACEODBCI.DLL
.dll windows x86

e57983b5d2e2f8ff1ff815b5273370e3

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

43:5c:19:0e:9a:04:43:de:75:f7:e5:be:7f:c4:a2:e1:6d:02:2c:06
Signer

Actual PE Digest

43:5c:19:0e:9a:04:43:de:75:f7:e5:be:7f:c4:a2:e1:6d:02:2c:06

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

23/03/2010, 13:40
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer

kernel32

VirtualProtect
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter

Exports

Exports

DllMain
IntlLibHinst

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/MShared/OFFICE14/2052/ACERECR.DLL
.dll windows x86

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

56:79:68:1d:08:76:6d:59:9e:f4:b9:5c:04:8c:bd:b3:33:c5:e6:67
Signer

Actual PE Digest

56:79:68:1d:08:76:6d:59:9e:f4:b9:5c:04:8c:bd:b3:33:c5:e6:67

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

23/03/2010, 13:40
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 171B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/access/MShared/OFFICE14/2052/ACEWSTR.DLL
.dll windows x86

2ab3ade1d201470d5610d0496e6332dc

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:02:8e:42:00:00:00:00:00:1f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8d:a4:7f:e1:c3:69:f0:56:5b:08:5d:e4:1b:2c:5e:c6:31:85:b9:6a
Signer

Actual PE Digest

8d:a4:7f:e1:c3:69:f0:56:5b:08:5d:e4:1b:2c:5e:c6:31:85:b9:6a

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

02/11/2012, 12:52
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
_except_handler4_common
_wassert
wcsrchr
memmove
malloc
memset
wcsncat_s
memcpy
free

kernel32

LoadResource
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
RaiseException
EnterCriticalSection
LeaveCriticalSection
GetSystemDefaultLCID
GetUserDefaultLCID
GlobalAlloc
GetProcAddress
FreeLibrary
GlobalFree
DeleteCriticalSection
InitializeCriticalSection
LockResource
FindResourceA
LoadLibraryW
GetModuleFileNameW

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 796KB - Virtual size: 796KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/MShared/OFFICE14/ACACEDAO.DLL
.dll windows x86

e752acda3d804793648aaed857eb732a

Code Sign

33:00:00:01:2c:aa:51:49:df:36:06:3b:6e:00:00:00:00:01:2c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/09/2019, 20:40

Not After

04/12/2020, 20:40

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:e3:7d:a3:1f:82:84:dc:e4:a1:00:02:00:00:01:e3
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:20

Not After

02/05/2020, 21:20

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:04:35:45:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

20/09/2018, 17:42

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:00:ac:70:d3:d9:57:2e:f5:c8:d4:ac:77:df:d1:f6:4f:0a:77:c4:4f:18:87:40:c6:5a:b7:e8:26:63:68:3b
Signer

Actual PE Digest

82:00:ac:70:d3:d9:57:2e:f5:c8:d4:ac:77:df:d1:f6:4f:0a:77:c4:4f:18:87:40:c6:5a:b7:e8:26:63:68:3b

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

f5:67:19:51:9a:8f:c5:61:fc:79:e0:82:07:a2:9d:12:17:ca:c1:18
Signer

Actual PE Digest

f5:67:19:51:9a:8f:c5:61:fc:79:e0:82:07:a2:9d:12:17:ca:c1:18

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

25/03/2020, 23:08
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoGetMalloc
StringFromGUID2

msvcr90

free
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
_wassert
_stricmp
wcscspn
memmove
memset
wcsncpy_s
toupper
memcpy
_vsnwprintf_s
wcsstr
_wcsicmp
_wcsnicmp
atoi
atol
_wtoi
wcschr
memchr
malloc

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
GetProcessHeap
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
VirtualProtect
InterlockedExchange
LocalAlloc
RtlCaptureStackBackTrace
GetModuleHandleExW
GetVersionExA
LoadLibraryA
GetSystemDirectoryW
LoadLibraryW
TlsGetValue
Sleep
TlsFree
TlsAlloc
lstrlenA
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
GetCPInfo
LeaveCriticalSection
GetCurrentThreadId
EnterCriticalSection
GetCurrentProcessId
FreeLibrary
GetProcAddress
CompareStringW
GetFullPathNameW
DeleteFileW
CloseHandle
WriteFile
CreateFileW
GetLastError
GetFileAttributesW
TlsSetValue
CompareStringA
GetSystemDefaultLCID
GlobalLock
GlobalAlloc
GlobalReAlloc
GlobalFree
GlobalUnlock
InitializeCriticalSection
DeleteCriticalSection
RaiseException
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleW

user32

GetWindowThreadProcessId
GetDesktopWindow
GetWindow
TranslateMessage
IsWindowVisible
GetWindowLongA
DispatchMessageW

advapi32

RegisterTraceGuidsA
RegOpenKeyExA
TraceEvent
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

oleaut32

VariantChangeTypeEx
SysReAllocString
VariantChangeType
VariantCopy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayPutElement
CreateErrorInfo
SafeArrayGetElement
SafeArrayRedim
LoadTypeLi
LoadRegTypeLi
DispGetIDsOfNames
DispInvoke
SysAllocString
VariantInit
SetErrorInfo
GetErrorInfo
SysStringLen
VariantClear
SysAllocStringLen
SysFreeString
SysAllocStringByteLen
SysStringByteLen
SafeArrayCreate
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 370KB - Virtual size: 369KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/MShared/OFFICE14/ACECORE.DLL
.dll windows x86

0af998578b4413a4bd31cb8ff851e0fb

Code Sign

33:00:00:01:40:51:dd:e1:92:ff:72:d9:8a:00:00:00:00:01:40
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/10/2019, 23:17

Not After

21/01/2021, 23:17

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:D082-4BFD-EEBA,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:fa:fc:1e:0a:0b:f8:7f:37:9a:00:02:00:00:01:fa
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/07/2020, 18:30

Not After

25/04/2021, 18:30

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:04:35:45:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

20/09/2018, 17:42

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:e0:52:8e:bc:b1:4e:6f:29:eb:09:55:1f:ca:8f:60:8f:1d:39:c5:b7:0e:5e:f6:36:38:d0:3f:4b:75:02:85
Signer

Actual PE Digest

05:e0:52:8e:bc:b1:4e:6f:29:eb:09:55:1f:ca:8f:60:8f:1d:39:c5:b7:0e:5e:f6:36:38:d0:3f:4b:75:02:85

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

09:48:3d:cb:fb:2c:f7:e0:9e:ff:7b:3a:71:59:3e:a0:e3:1e:79:86
Signer

Actual PE Digest

09:48:3d:cb:fb:2c:f7:e0:9e:ff:7b:3a:71:59:3e:a0:e3:1e:79:86

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

14/10/2020, 17:46
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoCreateInstance
OleInitialize
CreateStreamOnHGlobal
IIDFromString
CLSIDFromString
CoCreateGuid
StringFromCLSID
CoTaskMemFree
StringFromGUID2

shlwapi

PathIsNetworkPathW

msvcr90

__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_except_handler4_common
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
?terminate@@YAXXZ
vswprintf_s
_beginthreadex
_endthreadex
ceil
modf
_errno
strtod
strchr
_wtol
_ecvt_s
isxdigit
_wcsnicmp
tolower
wcsncpy
toupper
srand
_vsnprintf_s
isdigit
_wtoi
fopen_s
fputs
fputws
fclose
_wcslwr_s
_wcsupr_s
_setjmp3
_wcsicmp
rand
longjmp
wcsrchr
memcmp
ldiv
atoi
wcsnlen
wcscspn
_localtime64_s
wcstok_s
_stricmp
_snprintf_s
_time64
strncpy_s
malloc
_snwprintf_s
memmove
_wassert
free
__RTDynamicCast
memcpy_s
memmove_s
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_invalid_parameter_noinfo
__CxxFrameHandler3
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
memcpy
_wsplitpath_s
towupper
wcsncmp
wcschr
wcsstr
memset
wcsncpy_s
iswctype
wcstol

msvcp90

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

advapi32

ReportEventW
RegisterTraceGuidsA
TraceEvent
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
DeregisterEventSource
RegEnumValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
OpenThreadToken
GetUserNameW
SetThreadToken
RegOpenKeyExA
RegCloseKey
RegisterEventSourceW

kernel32

GetModuleHandleW
ExpandEnvironmentStringsW
FindFirstFileW
GetFileAttributesW
GetShortPathNameW
GetFullPathNameW
GetTempPathW
GetComputerNameW
DeleteFileW
CreateFileW
GetTempFileNameW
LoadLibraryExW
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleA
GetCurrentThread
IsDBCSLeadByte
GetDateFormatA
GetTimeFormatA
GetCurrencyFormatA
GetNumberFormatA
MultiByteToWideChar
GetCPInfo
WideCharToMultiByte
GetDateFormatW
GetSystemTimeAsFileTime
CreateThread
GetCurrentThreadId
WaitForSingleObject
ResetEvent
SetEvent
CreateEventA
GlobalMemoryStatus
GetSystemInfo
GetDriveTypeW
HeapFree
GetProcessHeap
HeapAlloc
SetThreadPriority
ResumeThread
GetFileInformationByHandle
WriteFile
UnlockFile
LockFile
GetFileType
SetFilePointer
GetFileSize
FlushFileBuffers
GetLocaleInfoA
GetFileSizeEx
ReadFile
RaiseException
Sleep
FindFirstFileA
FindClose
GetVersionExA
DeleteFileA
CloseHandle
GetLastError
GetLocalTime
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetTickCount
FreeLibrary
GetUserDefaultLCID
VirtualFree
VirtualQuery
VirtualAlloc
TlsAlloc
DisableThreadLibraryCalls
LocalAlloc
RtlCaptureStackBackTrace
TlsGetValue
LocalFree
TlsFree
LoadLibraryW
GetSystemDirectoryW
LoadLibraryA
VirtualProtect
QueryPerformanceCounter
GetCurrentProcessId
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleExW
GetComputerNameA
TlsSetValue
GetProcAddress
GetUserDefaultLangID
lstrlenW

oleaut32

SafeArrayAccessData
VariantInit
SysFreeString
SafeArrayDestroy
SafeArrayPutElement
SysAllocString
VariantClear
SafeArrayCreateVector
SysStringLen
SysAllocStringLen
SysAllocStringByteLen
SysStringByteLen
VarBstrCmp
VarBstrCat
VariantChangeTypeEx
VariantCopy
SafeArrayUnlock
SafeArrayLock
SafeArrayCreate
SafeArrayUnaccessData
VariantChangeType

user32

TranslateMessage
DispatchMessageW
CharUpperW

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 290KB - Virtual size: 293KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/MShared/OFFICE14/ACEDAO.DLL
.dll windows x86

e752acda3d804793648aaed857eb732a

Code Sign

33:00:00:01:2c:aa:51:49:df:36:06:3b:6e:00:00:00:00:01:2c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/09/2019, 20:40

Not After

04/12/2020, 20:40

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:e3:7d:a3:1f:82:84:dc:e4:a1:00:02:00:00:01:e3
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:20

Not After

02/05/2020, 21:20

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:04:35:45:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

20/09/2018, 17:42

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:00:ac:70:d3:d9:57:2e:f5:c8:d4:ac:77:df:d1:f6:4f:0a:77:c4:4f:18:87:40:c6:5a:b7:e8:26:63:68:3b
Signer

Actual PE Digest

82:00:ac:70:d3:d9:57:2e:f5:c8:d4:ac:77:df:d1:f6:4f:0a:77:c4:4f:18:87:40:c6:5a:b7:e8:26:63:68:3b

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

f5:67:19:51:9a:8f:c5:61:fc:79:e0:82:07:a2:9d:12:17:ca:c1:18
Signer

Actual PE Digest

f5:67:19:51:9a:8f:c5:61:fc:79:e0:82:07:a2:9d:12:17:ca:c1:18

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

25/03/2020, 23:08
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoGetMalloc
StringFromGUID2

msvcr90

free
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
_wassert
_stricmp
wcscspn
memmove
memset
wcsncpy_s
toupper
memcpy
_vsnwprintf_s
wcsstr
_wcsicmp
_wcsnicmp
atoi
atol
_wtoi
wcschr
memchr
malloc

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
GetProcessHeap
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
VirtualProtect
InterlockedExchange
LocalAlloc
RtlCaptureStackBackTrace
GetModuleHandleExW
GetVersionExA
LoadLibraryA
GetSystemDirectoryW
LoadLibraryW
TlsGetValue
Sleep
TlsFree
TlsAlloc
lstrlenA
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
GetCPInfo
LeaveCriticalSection
GetCurrentThreadId
EnterCriticalSection
GetCurrentProcessId
FreeLibrary
GetProcAddress
CompareStringW
GetFullPathNameW
DeleteFileW
CloseHandle
WriteFile
CreateFileW
GetLastError
GetFileAttributesW
TlsSetValue
CompareStringA
GetSystemDefaultLCID
GlobalLock
GlobalAlloc
GlobalReAlloc
GlobalFree
GlobalUnlock
InitializeCriticalSection
DeleteCriticalSection
RaiseException
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleW

user32

GetWindowThreadProcessId
GetDesktopWindow
GetWindow
TranslateMessage
IsWindowVisible
GetWindowLongA
DispatchMessageW

advapi32

RegisterTraceGuidsA
RegOpenKeyExA
TraceEvent
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

oleaut32

VariantChangeTypeEx
SysReAllocString
VariantChangeType
VariantCopy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayPutElement
CreateErrorInfo
SafeArrayGetElement
SafeArrayRedim
LoadTypeLi
LoadRegTypeLi
DispGetIDsOfNames
DispInvoke
SysAllocString
VariantInit
SetErrorInfo
GetErrorInfo
SysStringLen
VariantClear
SysAllocStringLen
SysFreeString
SysAllocStringByteLen
SysStringByteLen
SafeArrayCreate
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 370KB - Virtual size: 369KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/MShared/OFFICE14/ACEERR.DLL
.dll windows x86

58817992a4559b185eeb634fa89225e6

Code Sign

33:00:00:01:31:8d:e1:be:a7:9f:0a:35:e0:00:00:00:00:01:31
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/09/2019, 20:40

Not After

04/12/2020, 20:40

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:e3:7d:a3:1f:82:84:dc:e4:a1:00:02:00:00:01:e3
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:20

Not After

02/05/2020, 21:20

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:04:35:45:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

20/09/2018, 17:42

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

41:3f:1e:21:c5:98:11:86:0f:95:cd:58:77:b6:6c:06:2d:b7:87:4a:bc:53:f4:a0:d2:36:12:5a:89:5f:39:ae
Signer

Actual PE Digest

41:3f:1e:21:c5:98:11:86:0f:95:cd:58:77:b6:6c:06:2d:b7:87:4a:bc:53:f4:a0:d2:36:12:5a:89:5f:39:ae

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

32:2d:c7:39:a7:24:52:33:8d:a6:5e:a8:7e:cd:86:bd:07:9b:02:12
Signer

Actual PE Digest

32:2d:c7:39:a7:24:52:33:8d:a6:5e:a8:7e:cd:86:bd:07:9b:02:12

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

25/03/2020, 23:08
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
_stricmp
wcschr

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

kernel32

DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
GetModuleHandleW
LoadLibraryA
LocalAlloc
GetLastError
GetProcessHeap
LoadLibraryW
FreeLibrary
GetProcAddress
RaiseException
LoadLibraryExW
GetSystemDirectoryW

ole32

StringFromGUID2

Exports

Exports

JetErrFormattedMessage
JetErrIDAForError
JetErrIDARawMessage
JetErrRawMessage

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 812B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/MShared/OFFICE14/ACEES.DLL
.dll windows x86

fa25f55a3f6556411ac8e3f4637df76a

Code Sign

33:00:00:01:29:a0:47:69:3a:a2:a4:6c:ed:00:00:00:00:01:29
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/09/2019, 20:40

Not After

04/12/2020, 20:40

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:e4:7c:fc:02:95:60:ff:84:fb:00:02:00:00:01:e4
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:20

Not After

02/05/2020, 21:20

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:04:35:45:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

20/09/2018, 17:42

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4f:27:2e:9e:27:7b:6a:f1:9c:b5:0f:dc:cd:07:f0:16:c3:e5:8c:d7:c2:fe:b8:9d:8a:13:59:9e:41:cf:6a:b0
Signer

Actual PE Digest

4f:27:2e:9e:27:7b:6a:f1:9c:b5:0f:dc:cd:07:f0:16:c3:e5:8c:d7:c2:fe:b8:9d:8a:13:59:9e:41:cf:6a:b0

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

1b:e2:0f:39:50:38:99:fa:c6:8f:af:df:cc:f2:59:43:88:af:0a:eb
Signer

Actual PE Digest

1b:e2:0f:39:50:38:99:fa:c6:8f:af:df:cc:f2:59:43:88:af:0a:eb

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

25/03/2020, 23:08
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoGetMalloc
CoCreateGuid
CoCreateInstance
StringFromGUID2
IIDFromString
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree

msvcr90

?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_except_handler4_common
_decode_pointer
_onexit
_lock
memset
_encode_pointer
__dllonexit
_unlock
vswprintf_s
_controlfp_s
_finite
_wtoi
wcsstr
wcschr
_vsnprintf_s
_mbsinc
_CIpow
ceil
floor
wcsrchr
strnlen
_CIsqrt
__clean_type_info_names_internal
_invalid_parameter_noinfo
abs
_wassert
wcscspn
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
strlen
_snprintf_s
wcsncmp
wcscmp
_memicmp
_wcsicmp
towupper
wcsncpy_s
towlower
_wcsnicmp
iswalnum
iswcntrl
iswdigit
iswpunct
iswspace
wcslen
_recalloc
free
malloc
strncpy_s
strstr
_CxxThrowException
__CxxFrameHandler3
memcpy_s
_resetstkoflw
memcpy
memmove
_stricmp

msvcp90

?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

advapi32

RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegEnumValueW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegQueryInfoKeyA
RegSetValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA

kernel32

HeapFree
HeapAlloc
HeapDestroy
GetCurrencyFormatW
GetNumberFormatW
GetTimeFormatW
GetStringTypeExW
GetDateFormatW
GetSystemDefaultLCID
LCMapStringW
GetLocalTime
GetACP
GetTickCount
FindResourceExW
FindResourceW
LockResource
GetModuleHandleW
HeapReAlloc
LoadLibraryExW
GetLocaleInfoW
GetModuleFileNameW
GetVersionExA
GetUserDefaultLCID
GetLocaleInfoA
CompareStringW
CompareStringA
RaiseException
IsDBCSLeadByte
GetProcAddress
lstrcmpiA
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
InitializeCriticalSection
GetLastError
lstrlenW
MultiByteToWideChar
GetModuleFileNameA
HeapSize
GetProcessHeap
VirtualProtect
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryW
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemDirectoryW
LocalAlloc
LoadLibraryA
DeleteCriticalSection
GetModuleHandleA
lstrlenA

oleaut32

VarDateFromUdate
VarUdateFromDate
VarUI4FromStr
SysStringLen
LoadRegTypeLi
CreateStdDispatch
SysAllocString
VariantClear
VariantInit
SysStringByteLen
SysReAllocStringLen
SysFreeString
VariantCopy
VariantChangeType
SysAllocStringLen
SysAllocStringByteLen
VarBstrFromCy
VarBstrFromR8
VarBstrFromR4
VarBstrFromI4
VarBstrFromI2
VarBstrFromDec
VarDateFromStr
VarCyFromStr
VarR8FromStr
VarR4FromStr
VarI4FromStr
VarI2FromStr
VarDecFromStr
VarBstrFromDate
LHashValOfNameSys
SafeArrayUnaccessData
SafeArrayGetElemsize
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreate
SystemTimeToVariantTime
VariantChangeTypeEx
VariantTimeToSystemTime
SafeArrayUnlock
SafeArrayGetElement
SafeArrayLock
SafeArrayGetDim
LoadTypeLi
SafeArrayCreateVector
GetAltMonthNames

user32

IsCharUpperW
CharNextA
IsCharAlphaW
IsCharAlphaA

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain

Sections

.text
Size: 583KB - Virtual size: 582KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rtext
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/MShared/OFFICE14/ACEEXCH.DLL
.dll windows x86

810b57159f437b4de14adbf0cf26f882

Code Sign

33:00:00:01:44:53:0e:24:fc:63:f8:45:72:00:00:00:00:01:44
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/11/2019, 21:42

Not After

11/02/2021, 21:42

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:D6BD-E3E7-1685,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:e4:7c:fc:02:95:60:ff:84:fb:00:02:00:00:01:e4
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:20

Not After

02/05/2020, 21:20

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:04:35:45:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

20/09/2018, 17:42

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5d:5f:13:0d:35:4e:84:ad:22:d9:03:be:5e:06:62:60:4e:32:b7:3d:bb:3f:f4:d3:46:4f:d5:b7:3b:6f:1a:1b
Signer

Actual PE Digest

5d:5f:13:0d:35:4e:84:ad:22:d9:03:be:5e:06:62:60:4e:32:b7:3d:bb:3f:f4:d3:46:4f:d5:b7:3b:6f:1a:1b

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

7b:48:b6:ac:39:af:fa:ca:4e:6e:1e:75:22:46:5d:5a:aa:24:75:91
Signer

Actual PE Digest

7b:48:b6:ac:39:af:fa:ca:4e:6e:1e:75:22:46:5d:5a:aa:24:75:91

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

25/03/2020, 23:08
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

StgCreateDocfile
StringFromGUID2

acecore

ord167
ord126
ord146
ord107
ord158
ord108
ord170
ord155
ord173
ord179
ord172
ord159
ord133
ord101
ord114
ord118
ord156
ord140
ord908
ord157

msvcr90

__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
?terminate@@YAXXZ
_wassert
_stricmp
towlower
abs
wcsstr
iswctype
fabs
floor
_mbsicmp
_vsnwprintf_s
_wsplitpath_s
wcschr
wcstok_s
_snwprintf_s
_wtoi
strncpy_s
strlen
_CxxThrowException
_wcsdup
memcpy
memset
__CxxFrameHandler3
wcsncpy_s
wcslen
_wfullpath
malloc
free

advapi32

RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyExW
RegCloseKey

kernel32

VirtualProtect
LoadLibraryA
GetSystemDirectoryW
LoadLibraryW
GetPrivateProfileStringW
GetModuleHandleW
ExpandEnvironmentStringsW
LoadLibraryExW
QueryPerformanceCounter
GetCurrentProcessId
GlobalFree
GlobalUnlock
GlobalAlloc
GlobalLock
GetUserDefaultLCID
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
WritePrivateProfileStringW
GetLastError
SystemTimeToFileTime
RaiseException
MultiByteToWideChar
GetCPInfo
WideCharToMultiByte
FreeLibrary
GetProcAddress
DisableThreadLibraryCalls
GetTickCount
GetSystemTimeAsFileTime
GetProcessHeap
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetFileAttributesW
GetCurrentThreadId
SetCurrentDirectoryW
GetCurrentDirectoryW
LocalAlloc

oleaut32

VarI2FromStr
SysAllocStringLen
VarBstrFromR8
VarDecFromR8
VarR8FromStr
VarR8FromDec
SysFreeString

user32

PostThreadMessageW
GetActiveWindow

Sections

.text
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

CURSORS
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BASE
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/MShared/OFFICE14/ACEEXCL.DLL
.dll windows x86

cc04fadbd0ea82d67bf668d23e4c67ec

Code Sign

33:00:00:01:55:60:61:c6:f8:e5:5f:80:79:00:00:00:00:01:55
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/12/2019, 01:13

Not After

17/03/2021, 01:13

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:7880-E390-8014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:f4:b5:49:35:67:bf:59:a9:f4:00:02:00:00:01:f4
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2020, 20:18

Not After

30/09/2020, 20:18

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:04:35:45:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

20/09/2018, 17:42

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:6f:99:f9:b2:36:4a:f8:6b:0c:9b:c9:36:ee:e8:07:da:36:5a:16:fb:77:97:7a:5b:f1:09:42:ab:b0:fc:2d
Signer

Actual PE Digest

0f:6f:99:f9:b2:36:4a:f8:6b:0c:9b:c9:36:ee:e8:07:da:36:5a:16:fb:77:97:7a:5b:f1:09:42:ab:b0:fc:2d

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

6a:c0:ae:60:77:58:6b:1b:21:c8:e8:34:c9:b6:27:55:93:b7:80:ff
Signer

Actual PE Digest

6a:c0:ae:60:77:58:6b:1b:21:c8:e8:34:c9:b6:27:55:93:b7:80:ff

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

18/07/2020, 01:34
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoUninitialize
CoInitialize
StgCreateDocfile
StgOpenStorage
OleInitialize
CoTaskMemAlloc
CoTaskMemFree
StringFromGUID2
CoCreateInstance
CoTaskMemRealloc
OleUninitialize

msvcr90

__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_except_handler4_common
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
vswprintf_s
_stricmp
_wfullpath
_wassert
__RTDynamicCast
_vsnwprintf_s
_recalloc
_invalid_parameter_noinfo
memcpy_s
towlower
wcsstr
iswctype
memcmp
wcsrchr
toupper
_wcslwr_s
fabs
floor
_ecvt_s
atoi
_wsplitpath_s
wcscmp
strlen
memmove
wcstoul
tolower
malloc
free
memset
wcstok_s
labs
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_wtoi
wcspbrk
_wcsnicmp
wcschr
abs
wcsncpy_s
wcslen
_snwprintf_s
__CxxFrameHandler3
memcpy
memmove_s

msvcp90

?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

advapi32

ReportEventW
DeregisterEventSource
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegisterEventSourceW

kernel32

VirtualProtect
LoadLibraryA
GetSystemDirectoryW
LoadLibraryW
SetCurrentDirectoryW
RemoveDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
ExpandEnvironmentStringsW
FindNextFileW
FindFirstFileW
GetFileAttributesW
GetFullPathNameW
GetTempPathW
DeleteFileW
CreateFileW
lstrcmpiW
LoadLibraryExW
EnterCriticalSection
QueryPerformanceCounter
InitializeCriticalSection
GetModuleFileNameW
DeleteCriticalSection
GetModuleHandleW
FindResourceW
SizeofResource
LoadResource
LockResource
GlobalSize
GetSystemTimeAsFileTime
lstrlenW
lstrlenA
GetProcAddress
FreeLibrary
GetCurrentProcessId
SetFilePointer
WriteFile
LocalAlloc
CloseHandle
GetLastError
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
GlobalFree
GlobalUnlock
GlobalAlloc
GetTickCount
GetCurrentThreadId
GetProcessHeap
HeapFree
HeapAlloc
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LeaveCriticalSection
ReadFile
DisableThreadLibraryCalls
GetACP
IsValidCodePage
MultiByteToWideChar
WideCharToMultiByte
GetCPInfo
GetLocaleInfoW
GetUserDefaultLCID
GetLocaleInfoA
RaiseException
GetTimeFormatW
GetDateFormatW
GlobalLock

oleaut32

SysAllocStringLen
VarBstrCat
VarBstrCmp
VariantClear
VariantChangeType
SysFreeString
SafeArrayDestroy
VarR8FromCy
SafeArrayGetElement
VariantInit
SafeArrayPutElement
SafeArrayCreate
SysAllocString
VarCyFromR8
VarUdateFromDate
SysStringByteLen
VarR8FromDec
VarR8FromStr
VarDecFromR8
VarBstrFromR8
SysStringLen
GetActiveObject
VariantCopy
VarI2FromStr
SysAllocStringByteLen
VariantChangeTypeEx
VarUI4FromStr

user32

EnumWindows
CharUpperW
CharNextW
OpenClipboard
RegisterClipboardFormatW
GetClipboardData
SendMessageW
GetClassNameW
CloseClipboard

Exports

Exports

DllGetClassObject

Sections

.text
Size: 565KB - Virtual size: 564KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/MShared/OFFICE14/ACEODBC.DLL
.dll windows x86

d25bcab3c43a2c8ddf9ff03b673566eb

Code Sign

33:00:00:01:40:51:dd:e1:92:ff:72:d9:8a:00:00:00:00:01:40
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/10/2019, 23:17

Not After

21/01/2021, 23:17

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:D082-4BFD-EEBA,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:e3:7d:a3:1f:82:84:dc:e4:a1:00:02:00:00:01:e3
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:20

Not After

02/05/2020, 21:20

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:04:35:45:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

20/09/2018, 17:42

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:9d:a5:9b:31:bf:27:8a:53:ca:89:39:fa:b7:0c:80:b7:64:0f:63:8c:77:06:d4:18:fa:67:30:7e:c9:d7:da
Signer

Actual PE Digest

77:9d:a5:9b:31:bf:27:8a:53:ca:89:39:fa:b7:0c:80:b7:64:0f:63:8c:77:06:d4:18:fa:67:30:7e:c9:d7:da

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

fd:89:81:a9:dd:23:52:10:36:56:8c:9f:11:40:45:83:04:91:b7:a4
Signer

Actual PE Digest

fd:89:81:a9:dd:23:52:10:36:56:8c:9f:11:40:45:83:04:91:b7:a4

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

19/03/2020, 06:30
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

_onexit
_lock
__dllonexit
_vswprintf_c_l
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
towlower
_errno
strtod
strchr
isspace
isxdigit
strncpy_s
_ecvt_s
isdigit
_snprintf_s
_time64
_localtime64_s
wcscspn
wcsrchr
_wgetcwd
wcsstr
_wchdir
wcschr
wcstok_s
iswctype
wcstol
_wcsnicmp
memmove
floor
modf
_wsplitpath_s
memcpy
_strnicmp
bsearch
_wtol
towupper
wcsncmp
wcspbrk
swprintf_s
_heapmin
memset
_wtoi
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_stricmp
_wassert
_wstat64i32
_wfullpath
calloc
_wcsicmp
free
malloc
wcsncpy_s
_snwprintf_s
swscanf_s

kernel32

LoadLibraryW
LoadLibraryExW
RaiseException
CreateFileW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetSystemDirectoryW
GetLastError
OutputDebugStringW
ExpandEnvironmentStringsA
GetModuleHandleA
GetSystemDirectoryA
CreateFileA
GetFileSize
MoveFileExA
LocalAlloc
LocalLock
LocalUnlock
LoadLibraryA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcessVersion
GetCurrentProcessId
GetCurrentThreadId
WideCharToMultiByte
GetCPInfo
MultiByteToWideChar
DeleteCriticalSection
FreeLibrary
InitializeCriticalSection
GetProcAddress
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameA
GetUserDefaultLCID
GetSystemDefaultLCID
FindFirstFileW
FindClose
FindNextFileW
CloseHandle
GetCurrentDirectoryW
GetDriveTypeW
SetErrorMode
GetWindowsDirectoryW
MoveFileW
DeleteFileW
GetTempFileNameW
GetTempPathW
GetNumberFormatA
GetCurrencyFormatA
GetTimeFormatA
GetDateFormatA
LockResource
LoadResource
FindResourceA
VirtualProtect
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetProcessHeap
GetModuleHandleW
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
LocalFree

advapi32

RegEnumKeyExW
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyExW
GetUserNameW
RegQueryValueExW
RegDeleteKeyW
RegCloseKey
RegSetValueExW
RegCreateKeyExW

user32

EnableWindow
GetWindow
CharLowerW
ShowWindow
RegisterWindowMessageA
EndDialog
GetDlgCtrlID
IsWindowEnabled
LoadCursorA
SendMessageW
CharToOemBuffA
DestroyWindow
CreateDialogParamW
LoadStringA
ReleaseDC
GetDC
CharUpperW
MessageBoxA
LoadStringW
GetWindowTextW
SetWindowTextW
GetWindowTextLengthW
SetWindowPos
SetFocus
SetWindowLongA
GetWindowLongA
GetParent
GetDesktopWindow
GetWindowRect
GetClientRect
ClientToScreen
MoveWindow
GetDlgItem
DialogBoxParamA
DialogBoxParamW
LoadCursorW
SetCursor
MessageBoxW

gdi32

GetTextExtentPointW

comdlg32

GetSaveFileNameW
GetOpenFileNameW

ole32

StringFromGUID2

Exports

Exports

AdvancedDialogProc
AssertSzFail
ConfigDSN
ConfigDSNExW
ConfigDSNW
ConfigDialogProc
ConfigDriverW
DefTxtFmtDlgProc
DllMain
InitDialogAgain
InitializeLoginDialog
InvisibleSelectDb
LoadByOrdinal
LoginDialogProc
OpenDirHook
RepairCompactProc
SQLAllocConnect
SQLAllocEnv
SQLAllocHandle
SQLAllocStmt
SQLBindCol
SQLBindParameter
SQLBulkOperations
SQLCancel
SQLCloseCursor
SQLColAttributeW
SQLColumnsW
SQLConnectW
SQLCopyDesc
SQLDescribeColW
SQLDisconnect
SQLDriverConnectW
SQLEndTran
SQLExecDirectW
SQLExecute
SQLExtendedFetch
SQLFetch
SQLFetchScroll
SQLFreeConnect
SQLFreeEnv
SQLFreeHandle
SQLFreeStmt
SQLGetConnectAttrW
SQLGetCursorNameW
SQLGetData
SQLGetDescFieldW
SQLGetDescRecW
SQLGetDiagFieldW
SQLGetDiagRecW
SQLGetFunctions
SQLGetInfoW
SQLGetStmtAttrW
SQLGetTypeInfoW
SQLMoreResults
SQLNativeSqlW
SQLNumParams
SQLNumResultCols
SQLParamData
SQLPrepareW
SQLProcedureColumnsW
SQLProceduresW
SQLPutData
SQLRowCount
SQLSetConnectAttrW
SQLSetCursorNameW
SQLSetDescFieldW
SQLSetDescRec
SQLSetEnvAttr
SQLSetPos
SQLSetScrollOptions
SQLSetStmtAttrW
SQLSpecialColumnsW
SQLStatisticsW
SQLTablesW
SelectIndexDlgProc
SelectUIdxDlgProc

Sections

.text
Size: 202KB - Virtual size: 201KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/MShared/OFFICE14/ACEODDBS.DLL
.dll windows x86

999d4511aee6c6dc5873b75a8611769d

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:12

Not After

04/12/2013, 21:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

56:89:cb:a8:fc:e6:37:b2:cc:ec:14:c7:07:42:3b:aa:05:62:d7:a6
Signer

Actual PE Digest

56:89:cb:a8:fc:e6:37:b2:cc:ec:14:c7:07:42:3b:aa:05:62:d7:a6

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/10/2012, 17:51
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

_encode_pointer
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt

kernel32

QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
VirtualProtect
MultiByteToWideChar

aceodbc

ord514

Exports

Exports

ConfigDSNW

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/MShared/OFFICE14/ACEODEXL.DLL
.dll windows x86

999d4511aee6c6dc5873b75a8611769d

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:12

Not After

04/12/2013, 21:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:69:b3:24:b2:e3:d1:be:92:be:5e:f4:8c:83:9e:7d:af:2a:a4:52
Signer

Actual PE Digest

08:69:b3:24:b2:e3:d1:be:92:be:5e:f4:8c:83:9e:7d:af:2a:a4:52

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/10/2012, 17:51
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

_encode_pointer
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt

kernel32

QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
VirtualProtect
MultiByteToWideChar

aceodbc

ord514

Exports

Exports

ConfigDSNW

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/MShared/OFFICE14/ACEODTXT.DLL
.dll windows x86

999d4511aee6c6dc5873b75a8611769d

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:12

Not After

04/12/2013, 21:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

86:62:49:59:62:ea:15:0c:43:54:9d:b7:cc:8e:b2:3e:04:15:eb:61
Signer

Actual PE Digest

86:62:49:59:62:ea:15:0c:43:54:9d:b7:cc:8e:b2:3e:04:15:eb:61

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/10/2012, 17:51
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

_encode_pointer
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt

kernel32

QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
VirtualProtect
MultiByteToWideChar

aceodbc

ord514

Exports

Exports

ConfigDSNW

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/MShared/OFFICE14/ACEOLEDB.DLL
.dll windows x86

ea05d4786e7a3fa5542ae8dedc3a03e2

Code Sign

33:00:00:01:2f:0d:ca:5a:e9:ea:70:8d:f5:00:00:00:00:01:2f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/09/2019, 20:40

Not After

04/12/2020, 20:40

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:e3:7d:a3:1f:82:84:dc:e4:a1:00:02:00:00:01:e3
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:20

Not After

02/05/2020, 21:20

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:04:35:45:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

20/09/2018, 17:42

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:21:10:40:68:f0:3d:6d:0e:62:c9:02:fc:7c:bd:ad:3b:00:b2:f6:1f:20:c7:e9:83:df:1e:b2:a5:12:56:ea
Signer

Actual PE Digest

77:21:10:40:68:f0:3d:6d:0e:62:c9:02:fc:7c:bd:ad:3b:00:b2:f6:1f:20:c7:e9:83:df:1e:b2:a5:12:56:ea

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

f3:a0:3e:0a:3b:11:dc:24:53:33:3d:81:97:ad:9e:a0:b6:dd:2b:22
Signer

Actual PE Digest

f3:a0:3e:0a:3b:11:dc:24:53:33:3d:81:97:ad:9e:a0:b6:dd:2b:22

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

25/03/2020, 23:08
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

StringFromGUID2
CoCreateInstance
CoGetMalloc
CoCreateGuid

msvcr90

__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
vswprintf_s
_wcsicmp
_stricmp
_snwprintf_s
rand
calloc
_wassert
srand
_time64
realloc
malloc
free
wcsncpy_s
memcpy
__CxxFrameHandler3
memset

kernel32

GetTickCount
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleFileNameW
HeapAlloc
HeapFree
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
LocalAlloc
QueryPerformanceCounter
VirtualProtect
GetModuleHandleW
LoadLibraryA
GetSystemDirectoryW
LoadLibraryExW
LoadLibraryW
RaiseException
FreeLibrary
GetProcAddress
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
WideCharToMultiByte
GetCPInfo
MultiByteToWideChar

user32

DialogBoxParamA
EndDialog
GetDlgItem
GetWindowTextA
GetWindowTextW
SendMessageA
SetWindowTextA
SetWindowTextW
GetParent
GetWindowRect
GetDesktopWindow
GetSystemMetrics
SetWindowLongA
GetWindowLongA
MoveWindow

advapi32

DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA

oleaut32

VariantCopy
SysFreeString
SysAllocString
VariantClear
SysAllocStringLen
SetErrorInfo
GetErrorInfo
VarBstrFromDate
SysStringByteLen
SysStringLen
VariantInit

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain

Sections

.text
Size: 259KB - Virtual size: 258KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/MShared/OFFICE14/ACER3X.DLL
.dll windows x86

ac72d1dd36771456e4433b99d2c22109

Code Sign

33:00:00:01:41:3f:e0:c4:b5:60:9f:f3:ad:00:00:00:00:01:41
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/10/2019, 23:17

Not After

21/01/2021, 23:17

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FF06-4BC3-B9DA,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:e4:7c:fc:02:95:60:ff:84:fb:00:02:00:00:01:e4
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:20

Not After

02/05/2020, 21:20

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:04:35:45:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

20/09/2018, 17:42

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f7:98:3f:5f:bb:a8:d2:43:db:b7:ee:bb:8b:39:21:4a:df:1b:d0:d2:e3:00:f0:25:b6:01:58:ac:3a:2d:ac:a7
Signer

Actual PE Digest

f7:98:3f:5f:bb:a8:d2:43:db:b7:ee:bb:8b:39:21:4a:df:1b:d0:d2:e3:00:f0:25:b6:01:58:ac:3a:2d:ac:a7

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

e2:0b:21:62:8a:85:39:59:82:7d:63:e8:aa:7c:0a:8e:34:b1:d1:a4
Signer

Actual PE Digest

e2:0b:21:62:8a:85:39:59:82:7d:63:e8:aa:7c:0a:8e:34:b1:d1:a4

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

19/03/2020, 06:30
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
?terminate@@YAXXZ
_wassert
_strnicmp
memmove_s
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
wcschr
memmove
malloc
free
wcsncpy_s
wcstol
strncpy_s
atoi
_stricmp
__CxxFrameHandler3
memcpy
memset

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

advapi32

RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegOpenKeyExA
RegCloseKey

kernel32

LoadLibraryA
GetSystemDirectoryW
LoadLibraryW
GetProcAddress
FreeLibrary
GetModuleHandleW
FindFirstFileW
GetShortPathNameW
GetFullPathNameW
GetTempPathW
DeleteFileW
CreateFileW
GetTempFileNameW
LoadLibraryExW
VirtualProtect
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetFileInformationByHandle
RaiseException
GetTickCount
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
FlushFileBuffers
GetFileSize
SetFilePointer
GetFileType
CloseHandle
LockFile
UnlockFile
FindClose
GetLastError
ReadFile
WriteFile
LocalAlloc
GetLocalTime
CompareStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
HeapAlloc
GetProcessHeap
HeapFree
ResumeThread
SetThreadPriority
VirtualFree
GetSystemInfo
GlobalMemoryStatus
GetComputerNameA
DisableThreadLibraryCalls
VirtualAlloc
CreateEventA
SetEvent
ResetEvent
WaitForSingleObject
CreateThread
GetCurrentThreadId
GetSystemDefaultLangID
IsDBCSLeadByte
GetCPInfo

ole32

StringFromGUID2

Sections

.text
Size: 299KB - Virtual size: 298KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/MShared/OFFICE14/ACERCLR.DLL
.dll windows x86

af38b7531cdce57c1ef4aab0aa2b17b8

Code Sign

33:00:00:01:34:22:1e:7e:49:2a:ac:da:6a:00:00:00:00:01:34
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/10/2019, 18:17

Not After

03/01/2021, 18:17

Subject

CN=Microsoft Time-Stamp service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:E041-4BEE-FA7E,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:e4:7c:fc:02:95:60:ff:84:fb:00:02:00:00:01:e4
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:20

Not After

02/05/2020, 21:20

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:04:35:45:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

20/09/2018, 17:42

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b3:c9:02:36:0e:d9:81:be:7e:c7:c9:f2:5f:83:98:b1:dc:2e:1d:a7:a3:16:bf:80:f7:ca:a3:d7:69:1a:13:bf
Signer

Actual PE Digest

b3:c9:02:36:0e:d9:81:be:7e:c7:c9:f2:5f:83:98:b1:dc:2e:1d:a7:a3:16:bf:80:f7:ca:a3:d7:69:1a:13:bf

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

5e:a7:96:18:b9:63:cd:b0:53:b4:29:63:52:19:02:c0:76:76:29:a5
Signer

Actual PE Digest

5e:a7:96:18:b9:63:cd:b0:53:b4:29:63:52:19:02:c0:76:76:29:a5

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

19/03/2020, 06:30
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CreateBindCtx
CoGetMalloc
StringFromGUID2

gdi32

GetDeviceCaps

msvcr90

wcsncpy_s
swprintf_s
memset
__CxxFrameHandler3
wcsrchr
malloc
free
_wsplitpath_s
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
_stricmp

acerep

ord2001
ord2052
ord2024
ord2041
ord2042

vbajet32

ord1

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

kernel32

GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
LoadLibraryA
GetSystemDirectoryW
LoadLibraryW
GetProcessHeap
GetCurrentProcessId
GetModuleHandleW
ExpandEnvironmentStringsW
FindFirstFileW
GetFileAttributesW
CopyFileW
DeleteFileW
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
IsDebuggerPresent
LocalAlloc
GetVersionExA
DisableThreadLibraryCalls
FreeLibrary
GetLastError
Sleep
FormatMessageA
FindClose
CloseHandle
GetProcAddress
CreateMutexA
WaitForSingleObject
ReleaseMutex
LockResource
LoadResource
FindResourceA
GetVersion
WideCharToMultiByte
MultiByteToWideChar
RaiseException
LoadLibraryExW
CreateFileW

user32

GetDlgCtrlID
MapDialogRect
WinHelpW
EnableWindow
MoveWindow
ScreenToClient
SendMessageA
SetFocus
DrawTextA
MessageBoxA
LoadStringA
WinHelpA
GetWindowLongA
SetWindowLongA
GetParent
SetDlgItemTextA
SetWindowTextA
EndDialog
SendDlgItemMessageA
GetWindowTextA
GetDlgItem
DialogBoxIndirectParamA
SetWindowPos
ReleaseDC
GetWindowRect
GetDC
GetClientRect

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/MShared/OFFICE14/ACEREP.DLL
.dll windows x86

724e7a3c0d3d80986461a6d2300d3ffc

Code Sign

33:00:00:01:2b:6d:cf:b5:17:77:f5:6f:42:00:00:00:00:01:2b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/09/2019, 20:40

Not After

04/12/2020, 20:40

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:e4:7c:fc:02:95:60:ff:84:fb:00:02:00:00:01:e4
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:20

Not After

02/05/2020, 21:20

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:04:35:45:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

20/09/2018, 17:42

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

43:19:cc:44:fe:3b:29:c8:50:8f:58:7c:3d:49:6e:fc:c8:48:62:61:4f:d9:9a:ef:ae:b0:09:bc:7f:19:c3:00
Signer

Actual PE Digest

43:19:cc:44:fe:3b:29:c8:50:8f:58:7c:3d:49:6e:fc:c8:48:62:61:4f:d9:9a:ef:ae:b0:09:bc:7f:19:c3:00

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

98:49:3b:a4:69:84:f3:95:89:43:63:75:04:6a:c1:5c:24:a3:56:65
Signer

Actual PE Digest

98:49:3b:a4:69:84:f3:95:89:43:63:75:04:6a:c1:5c:24:a3:56:65

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

25/03/2020, 23:08
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoCreateGuid
IIDFromString
StringFromGUID2
CoInitialize
CoCreateInstance
CoUninitialize

msvcr90

?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
vswprintf_s
_wassert
__CxxFrameHandler3
_time64
_localtime64_s
_wtoi
memmove
wcschr
_snwprintf_s
strncpy_s
wcsrchr
memset
_stricmp
wcsncpy_s
memcpy
iswctype
_snprintf_s
free
malloc

advapi32

ReportEventW
DeregisterEventSource
RegSetValueExW
RegDeleteKeyW
RegEnumValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegFlushKey
RegCloseKey
RegisterEventSourceW

kernel32

LoadLibraryW
RaiseException
GetDriveTypeW
GetModuleHandleW
ExpandEnvironmentStringsW
GetSystemDirectoryW
FindFirstFileW
GetFileAttributesW
GetShortPathNameW
GetFullPathNameW
GetTempPathW
GetComputerNameW
MoveFileW
CopyFileW
DeleteFileW
CreateFileW
GetTempFileNameW
LoadLibraryExW
LoadLibraryA
VirtualProtect
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
GetProcessHeap
HeapFree
HeapAlloc
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
FreeLibrary
GetProcAddress
GetTickCount
GetLastError
CloseHandle
CreateFileA
GetTempPathA
DeleteFileA
GetVersionExA
DisableThreadLibraryCalls
WideCharToMultiByte
GetCPInfo
MultiByteToWideChar
FindClose
FindFirstFileA
Sleep
GetEnvironmentVariableA
GetFileSize
LocalAlloc
ReadFile
FlushFileBuffers
SetFilePointer
SetEndOfFile
OpenProcess
CreateProcessA
SuspendThread
CreateThread
TerminateThread
GlobalLock
GlobalAlloc
GlobalFree
GlobalUnlock
CreateMutexA
OpenMutexA
WaitForSingleObject
ReleaseMutex
CreateEventA
OpenEventA
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
UnmapViewOfFile
FlushViewOfFile
SetEvent
ResetEvent
WaitForMultipleObjects
GetCurrentProcessId
GetStdHandle
GetModuleFileNameW

user32

CharUpperW
PeekMessageA

Sections

.text
Size: 482KB - Virtual size: 482KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/MShared/OFFICE14/ACETXT.DLL
.dll windows x86

6033cef1d62b63d3b4f84d91e9afa758

Code Sign

33:00:00:01:4f:ef:d6:49:e8:60:11:dc:fc:00:00:00:00:01:4f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/11/2019, 21:42

Not After

11/02/2021, 21:42

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:1A8F-E3C3-D69D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:e4:7c:fc:02:95:60:ff:84:fb:00:02:00:00:01:e4
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:20

Not After

02/05/2020, 21:20

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:04:35:45:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

20/09/2018, 17:42

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

17:b9:f9:56:5e:8f:67:c3:b4:c9:a1:98:a3:54:92:19:66:1c:e7:15:0a:84:95:03:c7:a1:d7:92:79:35:ea:e0
Signer

Actual PE Digest

17:b9:f9:56:5e:8f:67:c3:b4:c9:a1:98:a3:54:92:19:66:1c:e7:15:0a:84:95:03:c7:a1:d7:92:79:35:ea:e0

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

47:fd:52:34:75:bf:ac:45:1f:e0:b3:19:9d:66:17:48:26:ab:f4:23
Signer

Actual PE Digest

47:fd:52:34:75:bf:ac:45:1f:e0:b3:19:9d:66:17:48:26:ab:f4:23

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

25/03/2020, 23:08
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

acecore

ord158
ord118
ord167
ord146
ord908
ord136
ord101
ord159
ord172
ord179
ord108
ord176
ord173
ord155
ord170
ord156

msvcr90

_unlock
__dllonexit
__clean_type_info_names_internal
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
_stricmp
_wfullpath
malloc
free
_wassert
strstr
_wcsicmp
_ecvt_s
floor
_errno
wcstod
_lock
wcspbrk
ldiv
toupper
memmove
memcmp
_snwprintf_s
atoi
wcstok_s
_wtoi
wcscmp
swscanf_s
_wtol
wcsstr
_wsplitpath_s
memset
fabs
wcsrchr
wcschr
wcsncpy_s
memcpy
towlower
abs
iswctype
strlen
wcslen
_onexit
?terminate@@YAXXZ
wcsncmp
memmove_s
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
__CxxFrameHandler3
_CxxThrowException
?_type_info_dtor_internal_method@type_info@@QAEXXZ

kernel32

LocalAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
LoadLibraryA
GetSystemDirectoryW
LoadLibraryW
SetCurrentDirectoryW
RemoveDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
GetModuleHandleW
ExpandEnvironmentStringsW
FindNextFileW
FindFirstFileW
GetFileAttributesW
GetTempPathW
DeleteFileW
CreateFileW
LoadLibraryExW
GetLocaleInfoW
RaiseException
GetSystemDefaultLangID
GetLocaleInfoA
IsValidCodePage
GetStringTypeW
GetStringTypeA
GetFileSize
WritePrivateProfileStringA
GetPrivateProfileStringW
DisableThreadLibraryCalls
GetProcAddress
GetVersionExW
GetCurrentProcessId
SetFilePointer
WideCharToMultiByte
MultiByteToWideChar
GetOEMCP
GetACP
GetUserDefaultLCID
GlobalLock
GlobalAlloc
GlobalUnlock
GlobalFree
GetFileTime
FileTimeToDosDateTime
FileTimeToLocalFileTime
FindClose
GetLastError
CloseHandle
ReadFile
WriteFile
FreeLibrary

user32

CharUpperW

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

oleaut32

VarDecFromStr
SysAllocString
SysAllocStringLen
VarI2FromStr
SysFreeString
SysStringByteLen
VarBstrFromDec

ole32

StringFromGUID2

msvcp90

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

Sections

.text
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/MShared/OFFICE14/ACEWDAT.DLL
.dll windows x86

687db4f06ecabdeb61b156d88a59ba93

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

d0:f1:63:58:e4:96:ba:30:06:ae:f8:f3:76:ba:b5:64:de:82:22:9b
Signer

Actual PE Digest

d0:f1:63:58:e4:96:ba:30:06:ae:f8:f3:76:ba:b5:64:de:82:22:9b

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

22/10/2010, 18:56
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
memcpy

kernel32

GlobalAlloc
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
GlobalFree

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/MShared/OFFICE14/ACEWSS.DLL
.dll windows x86

db2f58fc4ca1202c56617320b659614a

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2e:f5:b4:43:1b:43:4b:5e:a9:26:2e:ed:99:ed:66:13:74:0f:bf:fd
Signer

Actual PE Digest

2e:f5:b4:43:1b:43:4b:5e:a9:26:2e:ed:99:ed:66:13:74:0f:bf:fd

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

05/11/2012, 15:31
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
?terminate@@YAXXZ
_wfullpath
_fullpath
wcsncmp
??3@YAXPAX@Z
_snwprintf_s
_wcsicmp
wcsrchr
wcschr
memcpy
wcsstr
_wtoi
__CxxFrameHandler3
??2@YAPAXI@Z
_itow_s
_vsnwprintf_s
wcstoul
_wtol
vswprintf_s
wcstol
malloc
free
_wcsnicmp
memset
wcsnlen
wcsncat_s
wcsncpy_s

advapi32

ReportEventW
DeregisterEventSource
RegisterTraceGuidsA
TraceEvent
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterEventSourceW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyExW
RegCloseKey

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
IsDebuggerPresent
InterlockedCompareExchange
Sleep
InterlockedExchange
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
HeapAlloc
HeapFree
GetSystemDefaultLCID
lstrcmpW
CompareStringW
GetOEMCP
GetACP
FreeLibrary
RtlCaptureStackBackTrace
GetModuleHandleExW
TerminateProcess
WideCharToMultiByte
MultiByteToWideChar
GetTempPathW
GetUserDefaultLCID
lstrcmpiW
GlobalLock
GlobalAlloc
GlobalUnlock
GlobalFree
GetCurrentProcessId
GetProcAddress
GetModuleHandleW
GetLastError
CloseHandle
ReadFile
WriteFile
SetFilePointer
GetLocalTime
GetVersionExA
GetModuleFileNameW
LoadLibraryW
CreateFileA
CreateFileW
DeleteFileA
DeleteFileW
GetTempPathA
GetFileAttributesA
SetLastError
RemoveDirectoryA
RemoveDirectoryW
GetFileAttributesW

ole32

CoCreateInstance
CoGetMalloc
CLSIDFromString
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
StringFromGUID2

oleaut32

VariantCopy
SafeArrayAccessData
SafeArrayUnaccessData
VariantClear
SafeArrayGetLBound
SafeArrayGetUBound
SysAllocStringLen
SysFreeString
SysStringLen
VariantChangeTypeEx
VariantChangeType
VariantInit
SysAllocString
GetErrorInfo

user32

MessageBoxW

Sections

.text
Size: 222KB - Virtual size: 221KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/MShared/OFFICE14/ACEXBE.DLL
.dll windows x86

bd4a996dbc3262cebe9b25d292cf6cf0

Code Sign

33:00:00:01:2a:30:bf:85:c5:0e:b1:e2:8c:00:00:00:00:01:2a
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/09/2019, 20:40

Not After

04/12/2020, 20:40

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:e4:7c:fc:02:95:60:ff:84:fb:00:02:00:00:01:e4
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:20

Not After

02/05/2020, 21:20

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:04:35:45:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

20/09/2018, 17:42

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

db:f7:fc:f8:85:07:d2:a7:ed:05:e8:9f:36:83:ec:dd:86:0a:ce:c2:62:be:bb:a7:16:53:09:4b:a7:f3:ed:aa
Signer

Actual PE Digest

db:f7:fc:f8:85:07:d2:a7:ed:05:e8:9f:36:83:ec:dd:86:0a:ce:c2:62:be:bb:a7:16:53:09:4b:a7:f3:ed:aa

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

85:fe:5f:a4:3c:9b:a6:74:d5:53:c3:d9:a7:aa:8c:81:2b:17:7f:66
Signer

Actual PE Digest

85:fe:5f:a4:3c:9b:a6:74:d5:53:c3:d9:a7:aa:8c:81:2b:17:7f:66

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

25/03/2020, 23:08
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
wcslen
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
_access_s
modf
fmod
tolower
pow
strncmp
atan2
atan
asin
acos
floor
log10
log
exp
srand
rand
sqrt
tan
sin
cos
asctime_s
_localtime64_s
remove
rename
atof
_lock
strchr
_memccpy
_snprintf_s
_fcvt_s
_ecvt_s
_errno
strcmp
memcmp
toupper
_stricmp
_wfullpath
malloc
free
_wassert
_strnicmp
isalnum
_snwprintf_s
_wcsupr_s
wcscmp
wcsstr
_wsplitpath_s
labs
fabs
_wcsnicmp
wcstol
_wtoi
_strupr_s
strstr
memmove
strncpy_s
qsort
wcschr
memset
wcsrchr
wcsncpy_s
towupper
memcpy
towlower
abs
iswctype
ceil
strlen
_onexit
?terminate@@YAXXZ
_time64
?_type_info_dtor_internal_method@type_info@@QAEXXZ
memmove_s
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
__CxxFrameHandler3
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ

advapi32

RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegSetValueExW

kernel32

GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
CreateFileA
lstrlenA
LoadLibraryA
GetSystemDirectoryW
LoadLibraryW
SetCurrentDirectoryW
RemoveDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
GetModuleHandleW
ExpandEnvironmentStringsW
FindNextFileW
FindFirstFileW
GetFileAttributesW
GetTempPathW
MoveFileW
DeleteFileW
CreateFileW
GetSystemTimeAsFileTime
LoadLibraryExW
RaiseException
IsDBCSLeadByte
GetSystemDefaultLangID
GetLocalTime
UnlockFile
LockFile
SetFilePointer
WriteFile
ReadFile
CloseHandle
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetCurrentProcessId
GlobalFree
GlobalUnlock
GlobalAlloc
GlobalLock
GetLastError
GetUserDefaultLCID
lstrcmpiA
GetProcAddress
GetOEMCP
GetACP
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LocalAlloc
FreeLibrary

oleaut32

SysAllocStringLen
VarI2FromStr
SysFreeString
VarBstrFromR8
VarDecFromR8
VarR8FromStr
VarR8FromDec

user32

CharUpperA
CharUpperW

ole32

StringFromGUID2

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

Sections

.text
Size: 321KB - Virtual size: 320KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/Office14/2052/ACCDDSUI.DLL
.dll windows x86

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

87:92:57:52:08:46:8e:7b:7a:94:e8:df:da:5b:a6:04:c8:7a:64:8a
Signer

Actual PE Digest

87:92:57:52:08:46:8e:7b:7a:94:e8:df:da:5b:a6:04:c8:7a:64:8a

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/03/2010, 00:10
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 135B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/access/Office14/2052/ACCESS12.ACC
office2010/access/Office14/2052/ACCOLKI.DLL
.dll windows x86

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

a0:d9:98:af:6d:d8:f6:6c:23:44:44:4f:c3:11:32:df:f2:df:a2:e4
Signer

Actual PE Digest

a0:d9:98:af:6d:d8:f6:6c:23:44:44:4f:c3:11:32:df:f2:df:a2:e4

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

20/03/2010, 23:46
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 134B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/access/Office14/2052/ACCVDTUI.DLL
.dll windows x86

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ba:d9:72:b4:08:2d:df:b1:83:05:f9:9f:b9:76:c9:a9:a4:f2:d4:f1
Signer

Actual PE Digest

ba:d9:72:b4:08:2d:df:b1:83:05:f9:9f:b9:76:c9:a9:a4:f2:d4:f1

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/03/2010, 00:10
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 135B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/access/Office14/2052/ACWIZRC.DLL
.dll windows x86

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

89:54:63:34:8f:fd:9f:b5:6d:2f:4e:82:9b:d3:c4:96:57:ac:1e:c2
Signer

Actual PE Digest

89:54:63:34:8f:fd:9f:b5:6d:2f:4e:82:9b:d3:c4:96:57:ac:1e:c2

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/03/2010, 00:20
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 227KB - Virtual size: 227KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/access/Office14/2052/DataServices/+新 SQLServer 连接.odc
.html
office2010/access/Office14/2052/DataServices/+连接到新数据源.odc
.html
office2010/access/Office14/2052/DataServices/DESKTOP.INI
office2010/access/Office14/2052/DataServices/FOLDER.ICO
office2010/access/Office14/ACCDDS.DLL
.dll windows x86

937037ee59219ece1f890cab3b11b87a

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a8:bc:2b:6a:66:fb:1f:e6:e0:1f:74:20:52:69:bf:ce:52:29:af:50
Signer

Actual PE Digest

a8:bc:2b:6a:66:fb:1f:e6:e0:1f:74:20:52:69:bf:ce:52:29:af:50

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/10/2012, 19:06
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcp90

?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

kernel32

EnterCriticalSection
InterlockedCompareExchange
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
VirtualProtect
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedExchange
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LocalAlloc
LeaveCriticalSection
InitializeCriticalSection
QueryPerformanceCounter
lstrlenA
FileTimeToSystemTime
HeapFree
GetProcessHeap
HeapAlloc
GetSystemDirectoryW
GetSystemDefaultLCID
GetEnvironmentVariableW
GetUserDefaultLCID
GetSystemInfo
LockResource
FreeResource
IsBadStringPtrW
FormatMessageW
TlsAlloc
TlsGetValue
TlsSetValue
LoadLibraryW
GlobalHandle
GetVersionExW
GetProcAddress
GetVersionExA
WideCharToMultiByte
GetTickCount
GetProfileIntW
lstrcmpW
Sleep
GlobalSize
GetModuleHandleW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
FreeLibrary
SetLastError
GetModuleFileNameW
DisableThreadLibraryCalls
GetCurrentThreadId
GlobalAlloc
GlobalLock
GlobalUnlock
GetCurrentProcess
FlushInstructionCache
lstrcmpiW
RaiseException
GetLastError
lstrlenW
IsBadWritePtr
GlobalFree
MulDiv
DeleteCriticalSection

user32

KillTimer
SetTimer
RegisterClassW
UnregisterClassW
MoveWindow
SetCursorPos
RemovePropW
LoadBitmapW
SystemParametersInfoA
FindWindowW
RegisterWindowMessageW
ShowCursor
RegisterClipboardFormatW
DragDetect
SendMessageW
GetMessagePos
GetAsyncKeyState
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetActiveWindow
EnableWindow
SetActiveWindow
DrawTextW
GetWindowRect
MapWindowPoints
SendDlgItemMessageW
LoadImageW
SetCursor
GetMessageW
GetCapture
DispatchMessageW
ReleaseCapture
GetCursor
CreateWindowExW
RegisterClassExW
GetKeyState
GetParent
GetFocus
IsChild
SetFocus
CallWindowProcW
ClientToScreen
ScreenToClient
BeginPaint
GetClientRect
EndPaint
OffsetRect
SetWindowRgn
GetDC
ReleaseDC
LoadCursorW
GetClassInfoExW
ShowWindow
DefWindowProcW
UnionRect
SetWindowLongW
GetWindowLongW
CharUpperW
IsCharAlphaW
IsCharAlphaNumericW
ShowCaret
HideCaret
SystemParametersInfoW
GetUpdateRect
GetPropW
SetPropW
SetWindowTextW
GetSysColor
DrawFocusRect
FillRect
DrawEdge
GetSysColorBrush
RedrawWindow
IsWindowVisible
MessageBoxW
GetWindowTextW
GetWindowTextLengthW
SetCapture
SetRect
CharNextW
LoadStringW
SetRectEmpty
PtInRect
IsRectEmpty
InflateRect
PostMessageW
DestroyWindow
PeekMessageW
IntersectRect
SetWindowPos
EqualRect
IsWindow
InvalidateRect
UpdateWindow
UnregisterClassA
GetWindow
GetClassNameW
DestroyIcon
DrawIconEx
DestroyCaret
CreateCaret
SetCaretPos
LoadIconW
GetSystemMetrics
GetIconInfo

ole32

CreateILockBytesOnHGlobal
GetHGlobalFromILockBytes
CoRegisterMessageFilter
CoLoadLibrary
ProgIDFromCLSID
CLSIDFromProgID
CLSIDFromString
StringFromCLSID
StringFromGUID2
CoCreateInstance
StgOpenStorage
StgCreateDocfile
GetHGlobalFromStream
OleSetClipboard
DoDragDrop
CreateStreamOnHGlobal
OleGetClipboard
ReleaseStgMedium
CreateOleAdviseHolder
OleRegGetMiscStatus
CreateDataAdviseHolder
OleRegGetUserType
OleRegEnumVerbs
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StgOpenStorageOnILockBytes

oleaut32

VariantClear
SysAllocString
VariantInit
VariantChangeType
OleTranslateColor
DispCallFunc
SysStringLen
VarUI4FromStr
LoadTypeLi
OleCreatePropertyFrame
SysReAllocString
SysStringByteLen
SysAllocStringLen
DispGetParam
VariantCopy
LoadRegTypeLi
GetErrorInfo
SetErrorInfo
OleCreateFontIndirect
OleCreatePictureIndirect
SysAllocStringByteLen
OleLoadPicturePath
VariantChangeTypeEx
SysFreeString

advapi32

RegisterEventSourceW
RegEnumValueW
RegOpenKeyExW
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegCloseKey
DeregisterEventSource
ReportEventW

gdi32

SetWindowExtEx
SetWindowOrgEx
SaveDC
CreateMetaFileW
CreateDCW
DeleteDC
SetViewportOrgEx
SetMapMode
LPtoDP
Polyline
GetClipBox
CreatePen
SetROP2
SelectObject
GetStockObject
CreateFontIndirectW
CloseEnhMetaFile
CreateEnhMetaFileW
EndDoc
EndPage
StartPage
StartDocW
Rectangle
IntersectClipRect
PatBlt
SetTextColor
SetBkMode
LineTo
MoveToEx
CreateSolidBrush
RestoreDC
FrameRgn
CreateEllipticRgn
BitBlt
CreateCompatibleDC
StretchBlt
GetObjectW
DeleteEnhMetaFile
PlayEnhMetaFile
SetBkColor
CreateBitmap
GetTextMetricsW
StretchDIBits
CreateCompatibleBitmap
CreateBrushIndirect
SetDIBitsToDevice
CreateDIBSection
GetObjectType
Arc
Chord
Polygon
Ellipse
CreatePenIndirect
ModifyWorldTransform
SetWorldTransform
CombineTransform
SetGraphicsMode
PlayEnhMetaFileRecord
GetPixel
DeleteMetaFile
CloseMetaFile
CreateRectRgnIndirect
SetTextAlign
TextOutW
GetDeviceCaps
EnumEnhMetaFile
DeleteObject
GetMetaFileBitsEx
SetWinMetaFileBits
SetEnhMetaFileBits
GetStretchBltMode
SetStretchBltMode

comctl32

ImageList_GetIcon
ImageList_Destroy
ImageList_Add
ImageList_SetBkColor
ImageList_Create
InitCommonControlsEx

comdlg32

PrintDlgW

msvcr90

_amsg_exit
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
vswprintf_s
strstr
_CIatan2
_CIcos
_CIsin
ceil
realloc
_fcvt
_ltow
wcscspn
memmove
_wtol
iswdigit
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_wtoi
wcsrchr
_itow
iswascii
_CIsqrt
_CIexp
_vsnwprintf
memcpy
_wcsicmp
_resetstkoflw
swprintf_s
wcsncpy_s
memcpy_s
malloc
wcsstr
memset
calloc
_recalloc
free
memmove_s
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_invalid_parameter_noinfo
_wcsnicmp
__CxxFrameHandler3
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_initterm_e

Exports

Exports

??0CDDSBaseDisp@@QAE@ABU_GUID@@@Z
??0CDDSBaseDisp@@QAE@ABV0@@Z
??1CDDSBaseDisp@@UAE@XZ
??4CDDSBaseDisp@@QAEAAV0@ABV0@@Z
??_7CDDSBaseDisp@@6BCCUSupportErrorInfo@@@
??_7CDDSBaseDisp@@6BIDispatch@@@
??_8CDDSBaseDisp@@7B@
?DdsOverviewWindowProcSTATIC@@YGJPAUHWND__@@IIJ@Z
?FormSubclassWndProcSTATIC@CDDSFormEventSink@@CGJPAUHWND__@@IIJ@Z
?GetIDsOfNames@CDDSBaseDisp@@UAGJABU_GUID@@PAPA_WIKPAJ@Z
?GetTypeInfo@CDDSBaseDisp@@UAGJIKPAPAUITypeInfo@@@Z
?GetTypeInfoCount@CDDSBaseDisp@@UAGJPAI@Z
?IMOriginWindowProcSTATIC@@YGJPAUHWND__@@IIJ@Z
?Invoke@CDDSBaseDisp@@UAGJJABU_GUID@@KGPAUtagDISPPARAMS@@PAUtagVARIANT@@PAUtagEXCEPINFO@@PAI@Z
?LabelWndProcSTATIC@CLabelEditWindow@@CGJPAUHWND__@@IIJ@Z
?VLoadTypeInfo@CDDSBaseDisp@@QAGXU_GUID@@KPAPAUITypeInfo@@@Z
DllCanUnloadNow
DllGetClassObject
DllMain

Sections

.text
Size: 583KB - Virtual size: 583KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 229KB - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/Office14/ACCDDSF.DLL
.dll windows x86

bdb49cbdf8aca03cd5210a95dfafa014

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

92:44:8b:da:3a:f6:8f:26:89:87:fd:af:36:6e:2e:e5:88:43:ef:4f
Signer

Actual PE Digest

92:44:8b:da:3a:f6:8f:26:89:87:fd:af:36:6e:2e:e5:88:43:ef:4f

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

28/02/2010, 11:44
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

VariantChangeType
SafeArrayPutElement
SafeArrayDestroy
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetUBound
SysAllocStringByteLen
SysStringLen
SysReAllocStringLen
SysAllocString
VariantClear
GetErrorInfo
VariantChangeTypeEx
SetErrorInfo
SysFreeString
VariantInit
LoadTypeLi
SysAllocStringLen

gdi32

LineTo
CreateCompatibleBitmap
DeleteDC
GetDeviceCaps
CreateCompatibleDC
DeleteObject
CreatePalette
RealizePalette
SelectPalette
GetPaletteEntries
GetClipBox
SelectObject
SetTextColor
SetBkMode
GetStockObject
CreateSolidBrush
CreatePatternBrush
GetObjectA
SetBkColor
PatBlt
GetCurrentObject
GetBkColor
GetNearestColor
ExtTextOutW
GetTextMetricsW
GetTextFaceW
GetTextExtentPoint32W
GetObjectW
CreateICW
CreateFontIndirectW
CreateDCW
CreateFontIndirectA
GetTextMetricsA
CreateDCA
CreateICA
GetTextExtentPoint32A
GetTextFaceA
ExtTextOutA
DeleteMetaFile
CloseMetaFile
SetWindowExtEx
SetWindowOrgEx
SetMapMode
CreateMetaFileA
RestoreDC
GetObjectType
LPtoDP
GetMapMode
GetWindowExtEx
GetWindowOrgEx
SaveDC
PlayMetaFile
SetViewportExtEx
SetViewportOrgEx
CreateRectRgnIndirect
IntersectClipRect
CreateHatchBrush
SelectClipRgn
ExcludeClipRect
GetClipRgn
CreatePen
RectVisible
BitBlt
GetRegionData
Rectangle
SetBrushOrgEx
UnrealizeObject
SetROP2
OffsetRgn
MoveToEx

kernel32

QueryPerformanceCounter
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetProcessHeap
FreeLibrary
GetProcAddress
LoadLibraryA
HeapSize
HeapAlloc
HeapFree
HeapReAlloc
WideCharToMultiByte
GetLastError
GetUserDefaultLCID
GetVersionExA
GetModuleHandleW
MultiByteToWideChar
MulDiv
GetCurrentProcessId
VirtualFree
VirtualAlloc
GetSystemInfo
GlobalUnlock
GlobalLock
FormatMessageW
RaiseException
SetCurrentDirectoryW
OutputDebugStringW
lstrlenW
LoadLibraryExW
GetWindowsDirectoryW
SearchPathW
GetSystemDirectoryW
GetModuleFileNameW
GetLocaleInfoW
GetFullPathNameW
GetFileAttributesW
FindResourceW
CreateDirectoryW
CompareStringW
CreateDirectoryA
FindResourceA
GetFileAttributesA
GetLocaleInfoA
GetModuleFileNameA
GetSystemDirectoryA
SearchPathA
GetFullPathNameA
GetWindowsDirectoryA
LoadLibraryExA
CompareStringA
OutputDebugStringA
SetCurrentDirectoryA
FreeResource
SizeofResource
LockResource
LoadResource
GlobalFree
GlobalAlloc
IsDBCSLeadByte
GetEnvironmentVariableW
GlobalSize
GetProfileIntA
DebugBreak
LoadLibraryW
VirtualProtect
GetSystemTimeAsFileTime
GetTickCount
lstrcmpiW
LocalAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange

user32

GetWindowLongW
GetPropW
GetMenuStringW
GetClipboardFormatNameW
GetClassNameW
GetClassInfoW
FindWindowW
DrawTextW
DefWindowProcW
CreateWindowExW
CreateDialogParamW
CreateAcceleratorTableW
CopyAcceleratorTableW
CharUpperW
CharToOemW
CharPrevW
CharNextW
CharLowerW
CallWindowProcW
AppendMenuW
GetWindowTextLengthA
AppendMenuA
CharLowerA
CharUpperA
CharToOemA
CreateWindowExA
DrawTextA
FindWindowA
GetClassInfoA
GetClassNameA
GetClipboardFormatNameA
GetMenuStringA
GetPropA
InsertMenuA
MessageBoxIndirectA
ModifyMenuA
RegisterClassA
RegisterWindowMessageA
RemovePropA
SendMessageA
SetDlgItemTextA
SetPropA
SetWindowTextA
UnregisterClassA
WinHelpA
wvsprintfA
GetDlgItem
DestroyCursor
InvalidateRgn
ScrollWindowEx
GetFocus
SetCursor
CreateIconIndirect
GetIconInfo
SetFocus
EnableWindow
ShowWindow
GetUpdateRect
SetWindowRgn
EqualRect
GetWindowDC
ClientToScreen
EnumChildWindows
GetMessageW
DispatchMessageW
GetDCEx
LockWindowUpdate
GetDoubleClickTime
GetMessageTime
IsChild
GetParent
DeleteMenu
GetWindowTextW
GetMessagePos
GetActiveWindow
IsWindowVisible
SetRectEmpty
DestroyAcceleratorTable
GetSubMenu
MapWindowPoints
ShowCaret
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
ScrollDC
GetUpdateRgn
HideCaret
BringWindowToTop
EnableMenuItem
CheckMenuItem
GetMenuItemID
GetMenuItemCount
GetForegroundWindow
SetRect
IsRectEmpty
ChildWindowFromPointEx
UpdateWindow
AdjustWindowRect
GetWindowTextLengthW
InsertMenuW
LoadAcceleratorsW
LoadBitmapW
LoadCursorW
LoadIconW
LoadMenuW
MessageBoxIndirectW
ModifyMenuW
RegisterClassW
RegisterWindowMessageW
RemovePropW
SendDlgItemMessageW
SendMessageW
SetDlgItemTextW
SetPropW
SetWindowLongW
SetWindowsHookExW
SetWindowTextW
SystemParametersInfoW
TranslateAcceleratorW
UnregisterClassW
GetSystemMetrics
GetCursor
GetSysColor
GetWindowRect
IsIconic
SystemParametersInfoA
IntersectRect
OffsetRect
DestroyWindow
IsWindow
KillTimer
ValidateRect
RedrawWindow
SetWindowPos
EndPaint
GetClientRect
BeginPaint
FillRect
SetTimer
WindowFromPoint
ReleaseDC
InvalidateRect
GetDC
PtInRect
GetCursorPos
GetKeyState
LoadStringW
GetWindowThreadProcessId
PeekMessageW
TrackPopupMenu
ReleaseCapture
WinHelpW
wvsprintfW
CallWindowProcA
CopyAcceleratorTableA
CreateAcceleratorTableA
CreateDialogParamA
DefWindowProcA
GetWindowLongA
LoadAcceleratorsA
LoadBitmapA
LoadCursorA
LoadIconA
LoadMenuA
SetWindowLongA
SetWindowsHookExA
TranslateAcceleratorA
InflateRect
DrawFocusRect
InvertRect
RegisterClipboardFormatA
EnumWindows
ScreenToClient
PostMessageW
SetCapture
CallNextHookEx
UnhookWindowsHookEx
GetCapture
RegisterClipboardFormatW

advapi32

RegCloseKey
RegFlushKey
RegSetValueExW
RegSetValueW
RegQueryValueExW
RegQueryValueW
RegOpenKeyW
RegEnumKeyExW
RegEnumKeyW
RegDeleteKeyW
RegCreateKeyW
RegCreateKeyA
RegDeleteKeyA
RegEnumKeyA
RegEnumKeyExA
RegOpenKeyA
RegQueryValueA
RegQueryValueExA
RegSetValueA
RegSetValueExA
RegOpenKeyExW
ReportEventW
RegisterEventSourceW
DeregisterEventSource

ole32

ReadClassStm
ReadClassStg
OleGetClipboard
CoCreateGuid
DoDragDrop
OleQueryLinkFromData
CreateItemMoniker
OleCreateLinkFromData
OleQueryCreateFromData
OleCreateFromData
OleCreateStaticFromData
OleRun
OleSave
CoRegisterMessageFilter
RegisterDragDrop
RevokeDragDrop
CreateDataCache
CreateOleAdviseHolder
OleGetIconOfClass
StgCreateDocfile
WriteClassStg
WriteFmtUserTypeStg
CreateDataAdviseHolder
CreateStreamOnHGlobal
WriteClassStm
OleSaveToStream
StringFromGUID2
ReleaseStgMedium
CoTaskMemFree
CoTaskMemAlloc
OleIsCurrentClipboard
CoCreateInstance
StringFromCLSID
CLSIDFromString
CLSIDFromProgID
ProgIDFromCLSID
CreateBindCtx
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
IIDFromString
GetRunningObjectTable
OleSetClipboard
OleFlushClipboard

msvcr90

__CxxFrameHandler3
memset
_lfind
memcpy
wcsncpy
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
vswprintf_s
qsort
toupper
bsearch
_vsnwprintf_s
memcpy_s
wcstol
memmove
_wcsupr
_ultow
_ltow
_wtoi
wcschr

Exports

Exports

DllCanUnloadNow
DllGetClassObject
FormsSetLCID

Sections

.text
Size: 307KB - Virtual size: 307KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/Office14/ACCDDSLM.DLL
.dll windows x86

562966060dcd19dea05f174b7223ac01

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d5:fb:95:63:b6:96:06:e3:06:eb:17:62:2c:dc:ff:54:7c:3f:fa:7a
Signer

Actual PE Digest

d5:fb:95:63:b6:96:06:e3:06:eb:17:62:2c:dc:ff:54:7c:3f:fa:7a

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/10/2012, 19:06
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
_Inf
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

kernel32

TlsGetValue
TlsAlloc
FormatMessageW
IsBadStringPtrW
GetVersionExA
GetCurrentProcess
GetSystemInfo
HeapAlloc
GetProcessHeap
DeleteCriticalSection
TlsSetValue
GetEnvironmentVariableW
GetSystemDefaultLCID
FileTimeToSystemTime
QueryPerformanceCounter
InitializeCriticalSection
LeaveCriticalSection
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
VirtualProtect
LoadLibraryW
IsBadReadPtr
IsBadWritePtr
GetProcAddress
GetModuleHandleW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
FreeLibrary
GetModuleFileNameW
DisableThreadLibraryCalls
GetUserDefaultLCID
lstrcmpiW
EnterCriticalSection
RaiseException
GetLastError
lstrlenW
HeapFree

user32

CharUpperW
LoadCursorW
IsCharAlphaW
IsCharAlphaNumericW
EqualRect
IntersectRect
LoadStringW
CharNextW
PtInRect

ole32

OleSaveToStream
WriteClassStm
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
ReadClassStm
CoLoadLibrary
CoRegisterMessageFilter

oleaut32

OleCreatePictureIndirect
SysAllocStringLen
SetErrorInfo
GetErrorInfo
LoadRegTypeLi
VariantChangeType
SafeArrayCreate
SysAllocStringByteLen
SysStringByteLen
VarUI4FromStr
VariantInit
VariantCopy
VariantClear
LoadTypeLi
SysStringLen
SysAllocString
VariantChangeTypeEx
SysFreeString

advapi32

RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegDeleteKeyW

msvcr90

_CxxThrowException
_resetstkoflw
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
memset
calloc
_recalloc
wcsncpy_s
memcpy_s
free
malloc
wcsstr
_CIatan2
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
_wcsicmp
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
__CxxFrameHandler3
memmove_s
__RTDynamicCast
div
_fcvt
_ltow
memmove
_wtol
iswdigit
memcpy
_wtoi
wcsrchr
_itow
qsort

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain

Sections

.text
Size: 291KB - Virtual size: 291KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/Office14/ACCVDT.DLL
.dll windows x86

8d8d7e376d5b72b8fcd9356b24daf208

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

18:fc:7a:2b:f1:f3:36:7a:d9:39:9c:41:d4:01:28:73:68:31:51:e3
Signer

Actual PE Digest

18:fc:7a:2b:f1:f3:36:7a:d9:39:9c:41:d4:01:28:73:68:31:51:e3

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

28/02/2010, 11:44
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17
ImageList_Destroy
CreatePropertySheetPageW
DestroyPropertySheetPage
PropertySheetW

comdlg32

ChooseFontW
GetSaveFileNameW

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
Sleep
InterlockedExchange
GetSystemTimeAsFileTime
IsDBCSLeadByte
QueryPerformanceCounter
VirtualProtect
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
GetCPInfo
GetCurrentProcessId
TlsGetValue
MapViewOfFile
CreateFileMappingW
GetCurrencyFormatW
GetNumberFormatW
HeapDestroy
HeapSize
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
GetCurrentProcess
FlushInstructionCache
lstrcmpiW
GetModuleHandleW
GetProcAddress
GetLastError
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
FreeLibrary
DisableThreadLibraryCalls
GetCurrentThreadId
GetModuleFileNameW
SetLastError
LoadLibraryW
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
TlsSetValue
UnmapViewOfFile
TlsAlloc
GetLocaleInfoW
FormatMessageW
WideCharToMultiByte
IsBadStringPtrW
IsBadWritePtr
GetSystemInfo
GetVersionExA
HeapAlloc
HeapReAlloc
GetProcessHeap
HeapFree
GetUserDefaultLCID
GetEnvironmentVariableW
FreeResource
LockResource
GetSystemDefaultLCID
GlobalFree
GetStringTypeA
GetStringTypeW
FileTimeToSystemTime
IsBadReadPtr
lstrcmpW
GetSystemDefaultLangID
GetVersion
GetTickCount
GetLocalTime
CloseHandle
GetTimeFormatA
GetDateFormatA
GlobalSize
GetOEMCP
CreateEventW
SetEvent
WaitForSingleObject
CreateThread
GetDateFormatW
SetLocaleInfoW
GetTimeFormatW
OutputDebugStringW
SystemTimeToFileTime
GetSystemTime

user32

CheckDlgButton
SendDlgItemMessageW
OffsetRect
GetClassNameW
CheckRadioButton
GetMessagePos
UnregisterClassA
GetDlgItem
EnableWindow
GetKeyState
GetClassNameA
DialogBoxIndirectParamW
CreateDialogIndirectParamW
SetWindowTextW
SendMessageW
SetDlgItemTextW
GetWindowTextW
GetSysColor
GetWindowThreadProcessId
GetWindowTextLengthW
EnumChildWindows
IsWindowUnicode
DrawFocusRect
GetDialogBaseUnits
FillRect
GetParent
SetWindowRgn
ReleaseDC
SetWindowPos
RegisterClipboardFormatW
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
SetPropW
CharUpperW
SetCursor
IsCharAlphaW
IsCharAlphaNumericW
RemovePropW
EndDialog
IsWindow
IsDialogMessageW
GetPropW
MessageBoxW
SetFocus
EqualRect
IntersectRect
DestroyWindow
SetMenuItemInfoW
DeleteMenu
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
DestroyMenu
TrackPopupMenu
LoadMenuW
PostMessageW
GetWindowRect
IsRectEmpty
SystemParametersInfoW
RemoveMenu
GetSystemMenu
MoveWindow
MapWindowPoints
GetActiveWindow
SetTimer
KillTimer
SetActiveWindow
MessageBoxIndirectW
RegisterWindowMessageW
IsWindowEnabled
PeekMessageW
SetKeyboardState
GetKeyboardState
GetMessageTime
GetTopWindow
ScreenToClient
LoadIconW
IsDlgButtonChecked
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ClientToScreen
GetWindowLongW
SetWindowLongW
CharNextW
ShowWindow
GetClassInfoExW
LoadCursorW
SetRect
GetCapture
DrawEdge
DrawCaption
SetCapture
ReleaseCapture
DrawFrameControl
RedrawWindow
IsIconic
GetScrollPos
SetScrollRange
ScrollWindow
SetScrollPos
VkKeyScanW
EnableScrollBar
GetCaretPos
SetCaretPos
AdjustWindowRectEx
TranslateMessage
CharPrevExA
IsWindowVisible
DragDetect
SetRectEmpty
GetScrollInfo
GetDesktopWindow
InflateRect
DispatchMessageW
RegisterClassW
UnregisterClassW
WindowFromPoint
GetWindowDC
GetAsyncKeyState
SetParent
GetSystemMetrics
GetSysColorBrush
UpdateWindow
GetNextDlgTabItem
GetWindow
LoadBitmapW
CreateDialogParamW
GetForegroundWindow
SetForegroundWindow
MessageBeep
BringWindowToTop
GetDlgCtrlID
GetClassLongW
SetClassLongW
CreateWindowExW
GetFocus
IsChild
RegisterClassExW
InvalidateRect
DefWindowProcW
UnionRect
PtInRect
CallWindowProcW
LoadStringW
BeginPaint
GetClientRect
EndPaint
GetDC
GetCursorPos

gdi32

StretchBlt
GetTextFaceW
SetROP2
Polyline
GetBkColor
GetTextColor
GetObjectW
GetStockObject
MoveToEx
LineTo
SetBkMode
ExtTextOutA
GetMapMode
GetTextExtentPoint32A
GetObjectType
IntersectClipRect
CreateEnhMetaFileW
CloseEnhMetaFile
PlayEnhMetaFile
CreatePen
SetPolyFillMode
Rectangle
Polygon
PatBlt
DeleteEnhMetaFile
CreateFontIndirectW
GetTextExtentPointA
CreateRectRgnIndirect
CreateCompatibleBitmap
StretchDIBits
CreateSolidBrush
ExtTextOutW
CreateCompatibleDC
SelectObject
CreateBitmap
SetBkColor
BitBlt
SetTextColor
DeleteObject
GetTextMetricsW
GetTextExtentPoint32W
LPtoDP
SetMapMode
SetViewportOrgEx
DeleteDC
CreateDCW
CreateMetaFileW
SaveDC
SetWindowOrgEx
SetWindowExtEx
RestoreDC
CloseMetaFile
DeleteMetaFile
GetDeviceCaps

advapi32

RegDeleteKeyW
RegQueryValueW
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
CryptReleaseContext
CryptDestroyKey
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegOpenKeyExW

ole32

CoGetClassObject
CoCreateInstance
ProgIDFromCLSID
CLSIDFromProgID
CLSIDFromString
StringFromCLSID
StgCreateDocfile
GetHGlobalFromStream
StgCreateDocfileOnILockBytes
GetHGlobalFromILockBytes
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
OleLockRunning
RevokeDragDrop
RegisterDragDrop
ReleaseStgMedium
OleGetClipboard
OleFlushClipboard
OleSetClipboard
DoDragDrop
StringFromGUID2
CoRegisterMessageFilter
CreateStreamOnHGlobal
CoLockObjectExternal
GetRunningObjectTable
CoLoadLibrary
ReadClassStm
OleSaveToStream
CoDisconnectObject
WriteClassStm
CreateDataAdviseHolder
OleRegGetUserType
OleRegEnumVerbs
CreateOleAdviseHolder
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
OleRegGetMiscStatus

oleaut32

VariantChangeTypeEx
CreateErrorInfo
SafeArrayDestroy
SafeArrayCreateVector
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElement
SafeArrayPutElement
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
VariantCopy
SysAllocString
SysAllocStringLen
GetAltMonthNames
SetErrorInfo
GetErrorInfo
OleCreatePropertyFrame
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
SysStringLen
VariantChangeType
VariantClear
VariantInit
SysStringByteLen
SysAllocStringByteLen
SysFreeString
VariantTimeToSystemTime

imm32

ImmSetCompositionWindow
ImmGetContext

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

msvcr90

_lock
__dllonexit
_unlock
_except_handler4_common
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
vswprintf_s
qsort
_snwprintf
_wstrtime
wcstoul
wcstod
wcscpy_s
fopen
fprintf
fclose
_vsnwprintf
wcsncmp
wcstok
iswalpha
iswalnum
islower
iswupper
iswlower
_wcslwr
_wcsupr
_onexit
wcschr
memmove_s
_vswprintf
_fcvt
_itow
_wcsnicmp
wcspbrk
wcscspn
memmove
_strnicmp
_ltow
_wtol
iswdigit
memcpy
towupper
towlower
iswspace
_wcsicmp
_wtoi
wcsrchr
_resetstkoflw
swprintf_s
??0exception@std@@QAE@ABV01@@Z
memset
calloc
_recalloc
_invalid_parameter_noinfo
wcsncpy_s
_CxxThrowException
memcpy_s
free
malloc
__CxxFrameHandler3
??0exception@std@@QAE@XZ
wcsstr
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_crt_debugger_hook
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
wcsspn
iswxdigit
_snwprintf_s
_vsnprintf
atoi
isdigit
wcsnlen
realloc
floor

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/Office14/ACCWIZ.DLL
.dll regsvr32 windows x86

675166bfd504b077d1953c4b667eeb7b

Code Sign

33:00:00:00:76:c2:ce:62:e9:0e:5d:85:3e:00:00:00:00:00:76
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:40

Not After

04/09/2016, 17:40

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7AFA-E41C-E142,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9f:3a:3e:7d:05:a9:cb:13:50:76:2f:7d:13:37:4c:2d:66:5d:8e:c2
Signer

Actual PE Digest

9f:3a:3e:7d:05:a9:cb:13:50:76:2f:7d:13:37:4c:2d:66:5d:8e:c2

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13/10/2015, 11:42
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

LoadRegTypeLi
LoadTypeLi
VariantInit
VariantChangeType
VariantClear
SysReAllocString
SysAllocStringLen
SysStringLen
SysFreeString
SysAllocString

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetVersion
InitializeCriticalSection
DisableThreadLibraryCalls
GetVersionExW
GetModuleHandleW
GetProcAddress
LoadLibraryW
GetSystemDefaultLangID
FreeLibrary
lstrlenW
WideCharToMultiByte
GetCPInfo
IsValidCodePage
GetUserDefaultLCID
GetSystemDefaultLCID
GetStringTypeW
MulDiv
LockResource
SizeofResource
LoadResource
FindResourceW
CloseHandle
GetLastError
CreateFileW
HeapAlloc
GetProcessHeap
HeapFree
VirtualProtect
GetWindowsDirectoryW
DeleteCriticalSection
GlobalAlloc
GlobalLock
GlobalUnlock
HeapReAlloc
GetModuleFileNameW
GetLocaleInfoW
EnterCriticalSection
LeaveCriticalSection

user32

GetCapture
CopyRect
SetCapture
GetWindowDC
ReleaseCapture
DrawFocusRect
wsprintfW
RegisterClassW
LoadCursorW
FillRect
InflateRect
FrameRect
GetActiveWindow
EqualRect
MapWindowPoints
IsWindowVisible
LoadStringW
CharNextW
IsChild
SetCursor
SetParent
ShowWindow
GetDC
SetWindowTextW
RedrawWindow
BeginPaint
EndPaint
GetWindowRect
DefWindowProcW
IsWindow
DestroyWindow
UnregisterClassW
SetFocus
GetKeyState
GetKeyboardState
GetFocus
CallWindowProcW
SetWindowPos
SetWindowRgn
ClientToScreen
WindowFromPoint
SetWindowLongW
GetWindowLongW
ScreenToClient
GetParent
SendMessageW
PtInRect
LoadBitmapW
InvertRect
GetScrollRange
MoveWindow
IntersectRect
InvalidateRect
GetClientRect
ScrollWindow
UpdateWindow
SetRect
CreateWindowExW
GetSystemMetrics
OffsetRect
EnableScrollBar
SetScrollRange
SetScrollPos
ReleaseDC
GetScrollPos
GetSysColor

ole32

StringFromGUID2
OleSaveToStream
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
CoCreateInstance
ReadClassStm
CreateDataAdviseHolder
CreateOleAdviseHolder

advapi32

RegCreateKeyExW
ReportEventW
RegisterEventSourceW
RegQueryValueExW
RegSetValueExW
DeregisterEventSource
RegDeleteKeyW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW

gdi32

GetDeviceCaps
DeleteObject
SetTextAlign
LineTo
TextOutW
SelectClipRgn
CreateRectRgnIndirect
GetClipBox
BitBlt
SetBkColor
GetObjectW
CreateCompatibleDC
GetCharWidthW
SetBkMode
SetTextColor
DeleteDC
MoveToEx
SetROP2
GetNearestColor
SelectObject
ExcludeClipRect
CreateFontIndirectW
CreateDIBitmap
CloseMetaFile
CloseEnhMetaFile
SetWindowExtEx
SetWindowOrgEx
CreateMetaFileW
CreateEnhMetaFileW
CreateDCW
RestoreDC
SetMapMode
LPtoDP
SetViewportOrgEx
SaveDC
GetStockObject
CreatePen
ExtTextOutW
GetTextMetricsW
CreateSolidBrush
GetTextAlign
GetTextExtentPoint32W

msvcr90

_vsnwprintf_s
memset
memcpy
wcsncat_s
memcpy_s
vswprintf_s
_encode_pointer
_malloc_crt
free
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
wcsncpy_s
_CxxThrowException

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllRegisterServerEx
DllUnregisterServer

Sections

.text
Size: 106KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/Office14/ACEDAO.DLL
.dll windows x86

e752acda3d804793648aaed857eb732a

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:02:8e:42:00:00:00:00:00:1f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c4:3e:4b:d5:61:35:96:38:ad:8f:a0:e5:a5:60:ae:1d:c2:f9:42:0e
Signer

Actual PE Digest

c4:3e:4b:d5:61:35:96:38:ad:8f:a0:e5:a5:60:ae:1d:c2:f9:42:0e

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

18/02/2013, 16:46
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoGetMalloc
StringFromGUID2

msvcr90

free
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
_wassert
_stricmp
wcscspn
memmove
memset
wcsncpy_s
toupper
memcpy
_vsnwprintf_s
wcsstr
_wcsicmp
_wcsnicmp
atoi
atol
_wtoi
wcschr
memchr
malloc

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
GetProcessHeap
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
VirtualProtect
InterlockedExchange
LocalAlloc
RtlCaptureStackBackTrace
GetModuleHandleExW
GetVersionExA
LoadLibraryA
GetSystemDirectoryW
LoadLibraryW
TlsGetValue
Sleep
TlsFree
TlsAlloc
lstrlenA
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
GetCPInfo
LeaveCriticalSection
GetCurrentThreadId
EnterCriticalSection
GetCurrentProcessId
FreeLibrary
GetProcAddress
CompareStringW
GetFullPathNameW
DeleteFileW
CloseHandle
WriteFile
CreateFileW
GetLastError
GetFileAttributesW
TlsSetValue
CompareStringA
GetSystemDefaultLCID
GlobalLock
GlobalAlloc
GlobalReAlloc
GlobalFree
GlobalUnlock
InitializeCriticalSection
DeleteCriticalSection
RaiseException
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleW

user32

GetWindowThreadProcessId
GetDesktopWindow
GetWindow
TranslateMessage
IsWindowVisible
GetWindowLongA
DispatchMessageW

advapi32

RegisterTraceGuidsA
RegOpenKeyExA
TraceEvent
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

oleaut32

VariantChangeTypeEx
SysReAllocString
VariantChangeType
VariantCopy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayPutElement
CreateErrorInfo
SafeArrayGetElement
SafeArrayRedim
LoadTypeLi
LoadRegTypeLi
DispGetIDsOfNames
DispInvoke
SysAllocString
VariantInit
SetErrorInfo
GetErrorInfo
SysStringLen
VariantClear
SysAllocStringLen
SysFreeString
SysAllocStringByteLen
SysStringByteLen
SafeArrayCreate
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 370KB - Virtual size: 369KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/Office14/ADDINS/ACCOLK.DLL
.dll regsvr32 windows x86

3297a51715446c128b085913ddd6d94d

Code Sign

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f3:87:d7:9a:37:4d:e2:a2:f2:03:58:64:12:4e:a9:e3:e5:74:2e:00
Signer

Actual PE Digest

f3:87:d7:9a:37:4d:e2:a2:f2:03:58:64:12:4e:a9:e3:e5:74:2e:00

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

06/03/2013, 09:27
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InitializeCriticalSection
DeleteCriticalSection
GetLastError
LocalFree
FormatMessageW
GetDateFormatW
DeleteFileW
CompareFileTime
GetFileAttributesExW
DisableThreadLibraryCalls
GetTempPathW
GetUserDefaultLCID
MultiByteToWideChar
lstrlenW
GetModuleFileNameW
LeaveCriticalSection
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
LoadLibraryW
HeapAlloc
HeapFree
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
EnterCriticalSection
RaiseException
QueryPerformanceCounter
GetTickCount
VirtualProtect

user32

MessageBoxW
GetForegroundWindow

ole32

CLSIDFromProgID
CreateStreamOnHGlobal
CoCreateInstance

oleaut32

DispCallFunc
OleCreatePictureIndirect
VarBstrCmp
VariantTimeToSystemTime
VariantChangeTypeEx
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
VarBstrCat
LoadTypeLi
LoadRegTypeLi
SysStringLen
VariantCopy
SysAllocString
VariantClear
VariantInit
SysFreeString

gdi32

DeleteObject

mso

ord7238
ord10009
ord1746
ord6160
ord4444
ord3084
ord9139
ord2179
ord4656
ord1337
ord1911
ord3869
ord286
ord6798
ord9977
ord7210
ord611
ord5001
ord3796
ord10072
ord6960
ord10153
ord7488
ord9967
ord8280
ord6911
ord8082
ord2477
ord10640
ord414
ord7235
ord9134
ord9939
ord10021
ord625
ord441
ord2294
ord2516
ord2543
ord8525
ord828
ord5098
ord10425
ord4161
ord3367
ord6788
ord6251
ord10287
ord10144
ord10639
ord7145
ord9916
ord196
ord255
ord4765
ord5940
ord3655
ord9377
ord3607
ord8223
ord7131
ord4423
ord8500
ord7556
ord6405
ord4281
ord6649
ord77
ord6599
ord671
ord3908
ord1245
ord3017
ord9166
ord8598
ord4868
ord8021
ord7982
ord5706
ord9295
ord936
ord6866
ord7456
ord7747
ord4264
ord4657
ord7668
ord6709
ord4685
ord4953
ord8429
ord7091
ord1286
ord7191
ord1529
ord4355
ord5299
ord10162
ord219
ord9861
ord3251
ord2273
ord2813
ord3935
ord8083
ord150
ord506
ord4520
ord9030
ord131
ord2763
ord3663
ord5593
ord10127
ord4873
ord9644
ord5400
ord8091
ord3823
ord7376
ord8350
ord7635
ord3237
ord9732
ord5083
ord4320
ord1449
ord1880
ord4651

msvcr90

memcpy_s
wcsrchr
wcsncpy_s
wcsstr
wcscspn
_vsnwprintf_s
memmove_s
calloc
_snwprintf_s
vswprintf_s
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
_crt_debugger_hook
__clean_type_info_names_internal
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
wcschr
free
memset

advapi32

RegisterEventSourceW
RegOpenKeyExW
RegCloseKey
DeregisterEventSource
ReportEventW
RegQueryValueExW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/Office14/AccessWeb/CLNTWRAP.HTM
.html .vbs
office2010/access/Office14/AccessWeb/RPT2HTM4.XSL
.xml .js
office2010/access/Office14/AccessWeb/SERVWRAP.ASP
.vbs
office2010/access/Office14/MSACC.OLB
.dll windows x86

Code Sign

33:00:00:00:76:c2:ce:62:e9:0e:5d:85:3e:00:00:00:00:00:76
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:40

Not After

04/09/2016, 17:40

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7AFA-E41C-E142,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

51:4e:33:d6:10:d5:02:d5:8f:28:00:42:c8:44:f3:7c:59:6f:9f:de
Signer

Actual PE Digest

51:4e:33:d6:10:d5:02:d5:8f:28:00:42:c8:44:f3:7c:59:6f:9f:de

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13/10/2015, 11:42
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 127B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 654KB - Virtual size: 653KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/access/Office14/MSACCESS.EXE
.exe windows x86

b9355bb977347f4f582a161df88b6b3d

Code Sign

33:00:00:01:51:e1:9d:a2:dd:73:93:6c:e2:00:00:00:00:01:51
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/12/2019, 01:12

Not After

17/03/2021, 01:12

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:C4BD-E37F-5FFC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:f3:07:55:2b:7b:a6:03:ad:7c:00:02:00:00:01:f3
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2020, 20:18

Not After

30/09/2020, 20:18

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:04:35:45:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

20/09/2018, 17:42

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e8:e8:00:53:fb:58:fd:e5:e3:85:ee:ba:c8:31:19:24:97:5a:a5:5c:cc:66:37:da:9a:b2:d8:9b:bb:8c:94:ba
Signer

Actual PE Digest

e8:e8:00:53:fb:58:fd:e5:e3:85:ee:ba:c8:31:19:24:97:5a:a5:5c:cc:66:37:da:9a:b2:d8:9b:bb:8c:94:ba

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

c0:b6:9e:a7:cb:70:a7:59:22:70:e2:24:d5:7d:12:55:f9:6d:df:c0
Signer

Actual PE Digest

c0:b6:9e:a7:cb:70:a7:59:22:70:e2:24:d5:7d:12:55:f9:6d:df:c0

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

18/07/2020, 01:35
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHGetFileInfoW

msimg32

TransparentBlt
GradientFill

msi

ord111
ord129

msvcr90

wcstol
wcstoul
_ltow_s
rand
??0exception@std@@QAE@ABQBD@Z
memmove
strncpy_s
_wassert
strncmp
wcstok_s
_wchmod
wcscspn
wcstod
swscanf_s
_fpreset
_statusfp
_clearfp
_CIcos
_CIsin
qsort
atof
_unlink
wcsnlen
realloc
atol
strnlen
_stricmp
_mbsstr
__RTtypeid
_ecvt_s
_mbschr
atoi
swprintf_s
strchr
srand
_CIatan2
_recalloc
abort
vswprintf_s
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_except_handler4_common
__lconv_init
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
strstr
wcsncmp
_wmakepath_s
_snwprintf_s
_CItan
ceil
floor
towlower
_wcsnicmp
exit
?set_terminate@@YAP6AXXZP6AXXZ@Z
_chdrive
_wchdir
??8type_info@@QBE_NABV0@@Z
?terminate@@YAXXZ
__RTDynamicCast
ldiv
_resetstkoflw
_vsnwprintf_s
_wsplitpath_s
free
malloc
wcsstr
wcsrchr
wcschr
memcpy_s
wcsncpy_s
memcpy
_wtol
memset
memmove_s
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBDH@Z
_wtoi
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
??0exception@std@@QAE@XZ
__CxxFrameHandler3
_invalid_parameter_noinfo
??1exception@std@@UAE@XZ
_CIlog
_wcsicmp

msvcp90

?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PB_WHH@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@JH@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?length@?$char_traits@D@std@@SAIPBD@Z
?width@ios_base@std@@QBEHXZ
?flags@ios_base@std@@QBEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?eof@?$char_traits@D@std@@SAHXZ
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?width@ios_base@std@@QAEHH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?good@ios_base@std@@QBE_NXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ

gdi32

CopyEnhMetaFileW
CreateBrushIndirect
CreatePenIndirect
GetViewportExtEx
GetWindowExtEx
SetMapperFlags
CreateDCW
CreateICW
CreateEnhMetaFileW
GdiComment
EndDoc
EndPage
StartPage
AbortDoc
StartDocW
ExtEscape
SetAbortProc
EnumEnhMetaFile
GetTextFaceW
GetCharWidthW
GetTextColor
InvertRgn
FillRgn
PaintRgn
GetTextAlign
GetMapMode
SelectClipRgn
GetWorldTransform
GetWindowOrgEx
SetWorldTransform
GetEnhMetaFileHeader
GetDIBits
CreateDIBitmap
SetWinMetaFileBits
GetEnhMetaFilePaletteEntries
GetBkColor
CreateMetaFileW
CloseMetaFile
ExtTextOutW
SaveDC
SetMapMode
PlayMetaFile
RestoreDC
EnumMetaFile
CreateBitmap
SetDIBits
GetDCOrgEx
PlayEnhMetaFile
StretchDIBits
GetBkMode
RectInRegion
PtInRegion
CreatePolygonRgn
GetClipRgn
ExtSelectClipRgn
SetTextAlign
CreatePalette
GetObjectType
GetMetaFileBitsEx
SetEnhMetaFileBits
SetMetaFileBitsEx
TextOutA
Ellipse
Pie
Arc
GetROP2
GetEnhMetaFileBits
Rectangle
SetWindowExtEx
SetWindowOrgEx
SetViewportExtEx
CloseEnhMetaFile
DeleteEnhMetaFile
PlayEnhMetaFileRecord
SetStretchBltMode
DPtoLP
GetTextCharsetInfo
Escape
LPtoDP
GetViewportOrgEx
DeleteMetaFile
PlayMetaFileRecord
CreateCompatibleDC
DeleteDC
OffsetRgn
CreateCompatibleBitmap
GetRgnBox
OffsetClipRgn
GetClipBox
TextOutW
StretchBlt
GetNearestColor
SetROP2
CreatePen
Polygon
MoveToEx
LineTo
SetBrushOrgEx
UnrealizeObject
OffsetViewportOrgEx
SetRectRgn
EnumFontFamiliesExW
ExcludeClipRect
IntersectClipRect
RectVisible
GetBitmapBits
CreateRectRgnIndirect
CreateRectRgn
CombineRgn
SetViewportOrgEx
CreateSolidBrush
GetPaletteEntries
SelectPalette
RealizePalette
PatBlt
BitBlt
SetBkColor
GetTextMetricsW
GetTextExtentPoint32W
GetObjectW
GetDeviceCaps
GetStockObject
CreatePatternBrush
CreateFontIndirectW
CreateFontW
SelectObject
SetBkMode
SetTextColor
GetTextExtentExPointW
DeleteObject
CopyMetaFileW

user32

SetMenu
GetMenuItemCount
GetDoubleClickTime
GetUpdateRect
GetUpdateRgn
ExcludeUpdateRgn
ValidateRect
ScrollWindowEx
PeekMessageW
CloseClipboard
SetClipboardData
OpenClipboard
GetTabbedTextExtentW
RegisterClipboardFormatA
GetDlgItemInt
DrawIconEx
EnumDisplaySettingsW
SetDlgItemInt
SetClassLongW
IsCharAlphaW
IsCharAlphaNumericW
ActivateKeyboardLayout
GetDesktopWindow
CharNextW
CharNextA
GetKeyboardLayoutList
GetDialogBaseUnits
IsCharLowerW
ReleaseDC
GetDC
GetCaretPos
InvalidateRgn
GetScrollRange
NotifyWinEvent
SetWindowLongA
DestroyCaret
SetCaretPos
CreateCaret
MapVirtualKeyW
DrawMenuBar
OpenIcon
FrameRect
ShowScrollBar
DestroyCursor
LoadAcceleratorsW
GetClipboardFormatNameW
CharPrevW
CreateIcon
DrawIcon
UnregisterClassW
CharLowerW
SetClipboardViewer
ChangeClipboardChain
IsClipboardFormatAvailable
PostThreadMessageW
EmptyClipboard
ScrollDC
LoadKeyboardLayoutW
GetWindowDC
GetDCEx
CreateDialogParamW
GetSysColorBrush
GetSystemMetrics
SystemParametersInfoA
EnumChildWindows
AdjustWindowRectEx
SendMessageW
CharLowerBuffW
GetWindow
ShowCursor
GetWindowRect
IntersectRect
IsZoomed
LoadBitmapW
InvertRect
CopyRect
LoadImageW
GetClassLongW
UnionRect
TrackMouseEvent
GetForegroundWindow
SetParent
RemovePropA
GetPropA
VkKeyScanW
GetKeyboardType
MapDialogRect
IsRectEmpty
ChildWindowFromPoint
GetMessageTime
GetIconInfo
SetRectEmpty
TranslateMessage
GetKeyboardState
SetKeyboardState
SetTimer
HideCaret
EnableMenuItem
ShowCaret
SetCapture
GetClassNameW
SetWindowPlacement
CreateWindowExW
GetClassInfoExW
RegisterClassExW
GetClassInfoW
RegisterClassW
DefWindowProcW
CheckRadioButton
GetWindowTextLengthW
DestroyIcon
RedrawWindow
FillRect
DrawFocusRect
FindWindowW
RemoveMenu
AdjustWindowRect
DefMDIChildProcW
InvalidateRect
GetTopWindow
PostQuitMessage
DefFrameProcW
GetMessagePos
ReplyMessage
TranslateMDISysAccel
GetClassNameA
SetWindowsHookExW
UnhookWindowsHookEx
RegisterWindowMessageA
VkKeyScanExW
GetWindowPlacement
KillTimer
FlashWindow
IsChild
ReleaseCapture
IsWindowUnicode
IsDialogMessageW
IsDialogMessageA
EqualRect
CharUpperW
GetKeyboardLayout
RegisterClipboardFormatW
InSendMessage
DispatchMessageW
CallNextHookEx
CallWindowProcW
GetAsyncKeyState
MessageBoxW
SystemParametersInfoW
LoadCursorW
BeginPaint
EndPaint
GetSysColor
GetDlgCtrlID
GetSystemMenu
DeleteMenu
DialogBoxIndirectParamW
InflateRect
EnumThreadWindows
GetWindowLongW
SetWindowLongW
GetPropW
RemovePropW
IsWindowEnabled
SetPropW
ClientToScreen
PtInRect
WinHelpW
SetRect
MoveWindow
SetWindowPos
LoadIconW
ScreenToClient
GetWindowInfo
MapWindowPoints
DestroyWindow
GetScrollPos
SetScrollRange
BringWindowToTop
ScrollWindow
SetScrollPos
IsWindowVisible
OffsetRect
LockWindowUpdate
DdeInitializeW
DdeKeepStringHandle
SetFocus
DdeGetData
DdeCmpStringHandles
DdeAddData
DdeUninitialize
DdeAccessData
DdeUnaccessData
CharUpperA
DdeNameService
DdeClientTransaction
DdePostAdvise
DdeCreateStringHandleW
DdeConnect
DdeDisconnect
DdeCreateDataHandle
DdeQueryStringW
IsIconic
SetForegroundWindow
DdeAbandonTransaction
DdeGetLastError
DdeFreeDataHandle
DdeEnableCallback
DdeFreeStringHandle
IsWindow
GetWindowThreadProcessId
MessageBeep
GetCapture
GetCursorPos
WindowFromPoint
SetCursor
GetParent
IsDlgButtonChecked
CheckDlgButton
SetActiveWindow
GetKeyState
GetFocus
CharUpperBuffW
UpdateWindow
GetClientRect
SetWindowTextW
SetDlgItemTextW
PostMessageW
GetWindowTextW
EndDialog
GetDlgItemTextW
ShowWindow
GetActiveWindow
RegisterWindowMessageW
MessageBoxA
GetDlgItem
SendDlgItemMessageW
CopyAcceleratorTableW
EnableWindow

kernel32

GlobalSize
GetShortPathNameW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetTickCount
GetFileSize
CreateFileMappingW
TlsAlloc
UnmapViewOfFile
MapViewOfFile
GetACP
FindResourceW
LoadResource
GlobalHandle
LockResource
FindClose
GetTempPathW
GetTempFileNameW
GetUserDefaultLCID
GetSystemDefaultLangID
DeleteFileW
CloseHandle
WritePrivateProfileStringW
OutputDebugStringA
GetModuleFileNameW
SetLastError
GetLastError
LoadLibraryW
RaiseException
FreeLibrary
CreateProcessW
GlobalReAlloc
GetCurrentProcessId
GetCurrentProcess
MulDiv
ExpandEnvironmentStringsW
CopyFileExW
Sleep
GetCommandLineW
GetVersionExA
SetErrorMode
CreateSemaphoreW
GetProcessHeap
IsDBCSLeadByte
GetSystemDefaultLCID
GetDateFormatW
GetCalendarInfoW
ConvertDefaultLocale
VirtualQuery
GetVersionExW
EncodePointer
DecodePointer
GetUserDefaultLangID
GetTempFileNameA
GetTempPathA
GetFullPathNameW
WideCharToMultiByte
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
CopyFileW
CreateDirectoryW
GetTimeFormatW
GetLocalTime
GlobalAddAtomW
GlobalDeleteAtom
GetSystemTimeAsFileTime
WaitForSingleObject
ReleaseMutex
GetCPInfo
GetComputerNameW
LCMapStringW
CompareStringW
GetFileAttributesA
GetDriveTypeW
SetFileTime
GetFileTime
LocalFree
FileTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
DeleteFileA
FlushInstructionCache
VirtualProtect
VirtualAlloc
RemoveDirectoryW
FindNextFileW
FindFirstFileW
GetExitCodeProcess
DuplicateHandle
TerminateProcess
SearchPathW
CreateMutexW
MoveFileW
GetSystemTime
FindAtomW
FileTimeToDosDateTime
GetFileInformationByHandle
SetFileAttributesW
AddAtomW
lstrlenA
OpenProcess
LoadLibraryA
GetCurrentDirectoryW
FormatMessageW
ExitThread
ResumeThread
SetThreadPriority
CreateThread
ResetEvent
SetEvent
CreateEventW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetEnvironmentVariableW
LocalAlloc
LCMapStringA
HeapSize
HeapFree
ReleaseSemaphore
HeapAlloc
HeapReAlloc
HeapCreate
HeapCompact
HeapDestroy
MoveFileExW
GetPrivateProfileIntW
lstrcmpiA
lstrcmpA
GetFileType
GetStringTypeW
SetEndOfFile
lstrcmpiW
LoadLibraryExW
OutputDebugStringW
GetFileSizeEx
QueryPerformanceCounter
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemDirectoryW
FormatMessageA
LoadLibraryExA
OpenFile
GetModuleHandleExW
RtlCaptureStackBackTrace
TlsFree
SizeofResource
GetSystemInfo
GetLocaleInfoW
GetVersion
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetCurrentThreadId
lstrlenW

oart

ord2936
ord6279
ord8132
ord2504
ord5543
ord1339
ord8073
ord2235
ord2726
ord8412
ord5047
ord855
ord893
ord5191
ord637
ord1067
ord6595
ord5225
ord264
ord1976
ord1513
ord3290
ord500
ord2532
ord4421
ord1077
ord1736
ord644
ord3579
ord1357
ord6103
ord802
ord4828
ord3726
ord7892
ord7442
ord1140
ord1122
ord1909
ord6849
ord7146
ord3356
ord1807
ord6992
ord5642
ord3987
ord2956
ord5070
ord716
ord7138
ord8348
ord8331
ord638
ord4081
ord6758
ord945
ord7388
ord6742
ord4949
ord131
ord5242
ord2118
ord296
ord1897
ord6190
ord4488
ord3737
ord3411
ord2629
ord3326
ord5820
ord7794
ord3875
ord2953
ord325
ord1556
ord8404
ord5366
ord1693
ord5324
ord7678
ord4884
ord2817
ord4221
ord5968
ord1896
ord6983
ord400
ord5915
ord6778
ord7784
ord1058
ord5212
ord6133
ord3837
ord331
ord7187
ord3957
ord4301
ord1639
ord7045
ord1021
ord1243
ord5144
ord652
ord3873
ord2558
ord5737
ord8066
ord2097
ord3111
ord5032
ord4216
ord8135
ord5040
ord4698
ord3362
ord4187
ord4727
ord76
ord3214
ord1193
ord7846
ord1738
ord1400
ord2951
ord1088
ord4659
ord943
ord6260
ord1698
ord2757
ord5562
ord4363
ord3333
ord4241
ord4545
ord1499
ord81
ord8276
ord2676
ord6531
ord3821
ord7749
ord7764
ord4069
ord2856
ord4101
ord8082
ord933
ord6678
ord7988
ord5597
ord5402
ord797
ord5200
ord2818
ord3945
ord5522
ord1381
ord4841
ord4856
ord1145
ord3928
ord1320
ord6841
ord798
ord758
ord2399
ord5586
ord7608
ord4663
ord4346
ord4701
ord6447
ord1028
ord1043
ord2873
ord3558
ord1195
ord4027
ord5457
ord7452
ord3494
ord2267
ord3522
ord2229
ord1038
ord3265
ord594
ord4682
ord3241
ord2265
ord7052
ord790
ord1240
ord6643
ord4068
ord169
ord2705
ord6990
ord4298
ord7380
ord2494
ord6718
ord6809
ord6324
ord1322
ord5654
ord3502
ord5328
ord40
ord7283
ord3719
ord8202
ord475
ord5859
ord6546
ord6393
ord3602
ord1370
ord8198
ord6923
ord3152
ord1177
ord5868
ord6177
ord1001
ord5723
ord1422
ord26
ord394
ord322
ord2134
ord6810
ord233
ord1646
ord4540
ord2450
ord8007
ord5382
ord162
ord3509
ord486
ord3604
ord2377
ord5498
ord8417
ord3235
ord1789
ord551
ord4879
ord263
ord1332
ord2059
ord6003
ord1942
ord4248
ord1776
ord4375
ord3894
ord3037
ord6336
ord3913
ord6350
ord2904
ord1091
ord6363
ord3061
ord5497
ord4597
ord2861
ord732
ord4764
ord3162
ord5978
ord7743
ord304
ord4238
ord873
ord806
ord4580
ord6647
ord7716
ord505
ord7269
ord3032
ord2373
ord6738
ord2600
ord7003
ord5629
ord3050
ord5561
ord939
ord5675
ord2468
ord5718
ord4855
ord1244
ord2500
ord3704
ord5294
ord4822
ord924
ord4672
ord2161
ord3225
ord7394
ord8025
ord4771
ord1563
ord8342
ord3757
ord1463
ord7430
ord1212
ord1448
ord6153
ord245
ord4935
ord435
ord5635
ord6358
ord151
ord6946
ord5519
ord27
ord4792
ord6890
ord323
ord6256
ord2820
ord759
ord660
ord6761
ord8311
ord2070
ord7905
ord3029
ord5994
ord713
ord4800
ord3066
ord7823
ord4244
ord6416
ord7112
ord7694
ord7700
ord2091
ord2810
ord6501
ord8190
ord3192
ord3467
ord7758
ord3673
ord3168
ord2237
ord6331
ord7863
ord4817
ord4130

gfx

ord649
ord190
ord569
ord867
ord886
ord412
ord616
ord570
ord706
ord779
ord641
ord167
ord592
ord265
ord309
ord749
ord499
ord461
ord420
ord961
ord446
ord684
ord606
ord916
ord828
ord47
ord106

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Exports

Exports

AccWizExtTextOutU
AccessLoadString
ActidOfHscr@4
CallObjectSensitiveHelp
CloseHscr@4
ComboTypOfActidIarg@8
CreateIExprSrvObj
DllGetLCID
EnumFree
EnumInit
EnumObject
EnumXlateListSep
EnumXlateOp
FCommitIMEString
FControlNameConflict
FDeliverDb
FEnumFuncParams
FGetDlgHelp
FGetHintLogfont
FGetStringHscrIscc@16
FIsSubOfObject
FNextHscr@12
FReallocExpBuffer
FUniqueIndexTableFieldEx@8
FillADT
FreeEnumObject
GetAccessIntellisenseManager
GetFunctionPrototype
GetFunctionTipText
GetHFontDialog
GetHyperLinkObject
GetLCID@0
GetPasteSectionName
GetStringOfId
GetSubControlName
GetWzOfIdz
IRunCommandIdFromDMIArgs@20
IdsArgNameOfActidIarg@8
IdsComboFillOfActidIarg@8
JETESLoadProjectTypeLib
LoadAccessIconResource
MSAU_CreateSystemDatabase@20
MSAU_ErrCloseRegKey@4
MSAU_ErrDeleteRegKey@8
MSAU_ErrDeleteRegValue@8
MSAU_ErrGetRegKey@20
MSAU_ErrGetRegKeyInfo@16
MSAU_ErrGetRegVal@20
MSAU_ErrGetRegValName@24
MSAU_ErrOpenRegKeyEx@20
MSAU_ErrSortStringArray@4
MSAU_ErrWriteRegKey@12
MSAU_ErrWriteRegVal@20
MSAU_FRandomPid@8
MSAU_FillInHashValues@20
MSAU_GetFileName
MSAU_GetSizeCount@8
MSAU_GetSizeList@12
MSAU_OfficeGetFileName@8
MSAU_OfficeGetTcDIB@12
MidEastSupport@0
ObjtypFromDwObj
OpenHscr@24
OpenHscrEmbedded@20
ParseHyperlinkC
ReleaseAccessIconResource
SetEnumIntlView
SizeCallback
WizChooseColor@8

Sections

.text
Size: 9.0MB - Virtual size: 9.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 700KB - Virtual size: 705KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 9B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 514KB - Virtual size: 514KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/access/Office14/MSACCESS.EXE.manifest
office2010/access/data/ACCESS.MDB
office2010/access/data/access.dat
office2010/data/7za.exe
.exe windows x86

00610cd693a2c7bea922440646a9789b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

VariantCopy
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantClear

user32

CharPrevExA
CharUpperW

advapi32

SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
GetFileSecurityW

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
_beginthreadex
realloc
strlen
memset
wcscmp
wcsstr
strcmp
memmove
fputs
fputc
fflush
fgetc
fclose
_iob
free
_CxxThrowException
malloc
memcmp
_purecall
memcpy
__CxxFrameHandler
_isatty
_fileno

kernel32

ResetEvent
CreateSemaphoreW
CreateEventW
WaitForSingleObject
ReleaseSemaphore
InitializeCriticalSection
VirtualAlloc
SetEvent
SetFileAttributesW
QueryPerformanceCounter
LocalFileTimeToFileTime
SetConsoleMode
GetConsoleMode
GetVersionExW
SetFileApisToOEM
GetCommandLineW
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
FileTimeToLocalFileTime
DeleteCriticalSection
GetProcessTimes
OpenEventW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetProcessAffinityMask
WaitForMultipleObjects
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
GlobalMemoryStatus
GetSystemInfo
FileTimeToSystemTime
CompareFileTime
GetCurrentProcess
GetDiskFreeSpaceW
GetFileInformationByHandle
SetEndOfFile
WriteFile
ReadFile
DeviceIoControl
SetFilePointer
GetFileSize
GetLogicalDriveStringsW
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryW
GetModuleFileNameW
LocalFree
FormatMessageW
CloseHandle
SetFileTime
CreateFileW
GetFileAttributesW
RemoveDirectoryW
MoveFileW
GetProcAddress
GetModuleHandleW
CreateDirectoryW
DeleteFileW
SetLastError
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
FindClose
FindFirstFileW
FindNextFileW
GetModuleHandleA
VirtualFree

Sections

.text
Size: 547KB - Virtual size: 546KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/data/FR.exe
.exe windows x86

1eeae4bd7823f7552b23c0acd0fa8f20

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindClose
LocalAlloc
GetFileAttributesW
GetCurrentProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
WideCharToMultiByte
lstrcmpiW
LoadLibraryExW
ReadFile
FindNextFileW
GetSystemDefaultUILanguage
SetFilePointer
CreateFileW
GetCommandLineA
DeleteFileW
CloseHandle
GetModuleHandleW
CopyFileW
GetModuleFileNameA
FindFirstFileA
FindNextFileA
lstrlenA
GetSystemDirectoryA
DeleteFileA
CreateProcessA
SetEndOfFile
HeapReAlloc
lstrlenW
WriteConsoleW
FlushFileBuffers
GetProcessHeap
SetStdHandle
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExA
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetStringTypeW
GetFileType
SetLastError
FindFirstFileW
LoadResource
FreeResource
FindResourceA
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
FormatMessageA
LocalFree
HeapSize
GetLastError
HeapAlloc
HeapFree
GetACP
GetModuleHandleExW
ExitProcess
WriteFile
GetStdHandle
RaiseException
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
DecodePointer

user32

EnableWindow
PostQuitMessage
GetDlgItem
UpdateWindow
LoadImageW
EndPaint
BeginPaint
CreateDialogIndirectParamW
SetWindowLongW
PostMessageW
wsprintfW
EnumDisplayDevicesA
RedrawWindow
ChangeDisplaySettingsA
EnumDisplaySettingsExA
EnumDisplaySettingsA
GetDesktopWindow
GetWindowLongW
GetMessageW
DefWindowProcW
DestroyWindow
CreateWindowExW
ScreenToClient
SendMessageW
GetSystemMetrics
SetWindowTextW
RegisterClassExW
wsprintfA
ShowWindow
GetAsyncKeyState
DispatchMessageW
GetDialogBaseUnits
TranslateMessage
LoadIconW
LoadCursorW

gdi32

AddFontResourceW
SelectObject
CreateFontW
DeleteObject
TextOutA

advapi32

GetUserNameA
RegOpenKeyExA
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegEnumValueW
RegQueryValueExA

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetSpecialFolderPathW

ole32

CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree

setupapi

SetupIterateCabinetA
SetupDiDestroyDeviceInfoList
SetupDiCreateDeviceInfoW
SetupDiSetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiCreateDeviceInfoList
SetupDiGetINFClassW
SetupDiCallClassInstaller

winmm

PlaySoundA

newdev

UpdateDriverForPlugAndPlayDevicesW

Sections

.text
Size: 165KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 188KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/data/MSO-xp.DLL
.dll windows x86

3030a4707e2bfbb46992deeb48f459eb

Code Sign

33:00:00:00:ef:3b:3d:3e:60:af:49:65:20:00:00:00:00:00:ef
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2018, 20:19

Not After

23/11/2019, 20:19

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:11

Not After

26/07/2019, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:08

Not After

26/07/2019, 20:08

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

98:b1:0d:21:88:ee:99:d9:f5:e4:21:f8:c2:77:56:43:93:eb:73:1d:24:c6:d4:6d:f1:a7:3b:cf:d3:28:ef:27
Signer

Actual PE Digest

98:b1:0d:21:88:ee:99:d9:f5:e4:21:f8:c2:77:56:43:93:eb:73:1d:24:c6:d4:6d:f1:a7:3b:cf:d3:28:ef:27

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

5f:e1:35:8f:af:c4:e3:b0:03:a9:47:72:d1:5d:40:3a:db:9e:64:e1
Signer

Actual PE Digest

5f:e1:35:8f:af:c4:e3:b0:03:a9:47:72:d1:5d:40:3a:db:9e:64:e1

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

14/09/2018, 02:12
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegQueryValueExW
RegQueryValueExA
RegQueryInfoKeyA
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
GetTokenInformation
OpenProcessToken
RegNotifyChangeKeyValue
RegDeleteKeyA
RegCreateKeyExA
RegEnumKeyExA
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsA
TraceEvent
CryptReleaseContext
CryptDestroyKey
CryptSetKeyParam
CryptGetKeyParam
CryptGenRandom
CryptEncrypt
CryptDecrypt
CryptGenKey
CryptGetProvParam
CryptImportKey
CryptEnumProvidersW
CryptExportKey
CryptAcquireContextW
CryptDuplicateKey
ConvertSidToStringSidW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
CopySid
GetLengthSid
CryptHashData
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptVerifySignatureW
RegEnumValueA
RegQueryInfoKeyW
RegDeleteKeyW
RegQueryValueW
RegEnumKeyW
RegEnumValueW
RegDeleteValueW
SetFileSecurityW
GetFileSecurityW
GetUserNameW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
UnregisterTraceGuids
CloseEventLog
ReportEventA
AddAccessAllowedAce
AddAccessDeniedAce
InitializeAcl
AllocateAndInitializeSid
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
CheckTokenMembership
EqualSid
IsValidSid
CreateWellKnownSid
SetSecurityInfo
AddAce
AddAccessAllowedAceEx
ConvertSidToStringSidA
RegQueryValueA
RegEnumKeyA
RegisterEventSourceA
IsTextUnicode
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
StartServiceW
GetSidSubAuthority
OpenThreadToken
CryptGetHashParam
CryptSetHashParam
CryptDeriveKey
CryptGetUserKey
RegisterTraceGuidsW
RevertToSelf
CryptAcquireContextA
ImpersonateLoggedOnUser
CreateRestrictedToken
GetAce
GetAclInformation
SetSecurityDescriptorSacl
CreateProcessAsUserW
LogonUserW
SetTokenInformation
ConvertStringSidToSidW

gdi32

CreateEnhMetaFileA
DeleteMetaFile
DeleteEnhMetaFile
GetBkColor
RealizePalette
SetTextColor
SetBkMode
GetBkMode
GetCurrentObject
IntersectClipRect
SetViewportOrgEx
GetViewportOrgEx
Ellipse
OffsetRgn
GetTextColor
PlayEnhMetaFileRecord
LPtoDP
DPtoLP
GetPaletteEntries
GetObjectA
GetTextExtentPoint32A
CreateFontIndirectA
PlayMetaFileRecord
GetEnhMetaFilePaletteEntries
GetObjectType
RestoreDC
GetArcDirection
GetTextAlign
StretchDIBits
SetBkColor
EnumEnhMetaFile
GetEnhMetaFileHeader
EnumMetaFile
CreateDIBPatternBrushPt
GetNearestColor
Polygon
CreateHatchBrush
UnrealizeObject
CreateBitmap
EqualRgn
CreateRectRgn
CreateRectRgnIndirect
SetRectRgn
GetRgnBox
ExtSelectClipRgn
CombineRgn
SelectClipRgn
BitBlt
OffsetClipRgn
FillRgn
PatBlt
CreateDIBSection
CopyEnhMetaFileA
CopyMetaFileA
CreateMetaFileA
SaveDC
ExcludeClipRect
PaintRgn
CreatePolygonRgn
CreatePatternBrush
SetBrushOrgEx
LineDDA
SetStretchBltMode
SetWindowOrgEx
GetBitmapBits
CreateFontA
EnumFontFamiliesExA
SetMetaFileBitsEx
GetWinMetaFileBits
SetDIBitsToDevice
GetDIBits
GdiFlush
GdiComment
GetEnhMetaFileDescriptionW
SetWinMetaFileBits
GetMetaFileBitsEx
SetTextAlign
GetCharWidthA
GetGlyphOutlineA
GetGlyphOutlineW
GetCharABCWidthsA
GetKerningPairsA
GetObjectW
GetSystemPaletteEntries
GetViewportExtEx
GetWindowExtEx
CombineTransform
PolyBezierTo
CloseFigure
StrokePath
EndPath
BeginPath
GetBrushOrgEx
GetMapMode
GetClipBox
RectVisible
ExtCreatePen
GetEnhMetaFileBits
Escape
ExtEscape
SetEnhMetaFileBits
CreatePalette
CreateHalftonePalette
GetSystemPaletteUse
CreateFontIndirectW
GetPixel
GetClipRgn
CreateDIBitmap
SetPolyFillMode
GetPolyFillMode
CreateRoundRectRgn
GetTextMetricsA
GetWindowOrgEx
SetDIBits
SetDCPenColor
CreateFontW
GetTextExtentPointA
SetTextJustification
GetTextCharset
GetTextCharsetInfo
GetTextFaceW
GetOutlineTextMetricsW
GetFontData
GetOutlineTextMetricsA
GetCharABCWidthsI
EnumFontFamiliesExW
ExtTextOutW
GetCharWidth32W
GetGlyphIndicesW
GetTextExtentExPointW
GetTextExtentExPointA
GetTextMetricsW
CreateMetaFileW
CopyMetaFileW
GetMetaFileW
CreateEnhMetaFileW
CopyEnhMetaFileW
GetEnhMetaFileW
CreateColorSpaceW
CreateDCW
ResetDCW
StartDocW
CreateICW
TranslateCharsetInfo
GetWorldTransform
SetWorldTransform
SetGraphicsMode
RemoveFontMemResourceEx
AddFontMemResourceEx
SetPixel
CreateDCA
GetDCOrgEx
RectInRegion
GetNearestPaletteIndex
TextOutA
PlayEnhMetaFile
SetDCBrushColor
UpdateColors
GetTextExtentPointI
GetPath
GetICMProfileW
GetFontUnicodeRanges
SetDIBColorTable
GetTextExtentPoint32W
SetMetaRgn
SelectClipPath
PtVisible
GetRandomRgn
GetMetaRgn
SetBoundsRect
GetBoundsRect
GetDCPenColor
GetDCBrushColor
EnumObjects
DrawEscape
CancelDC
TextOutW
SetTextCharacterExtra
SetMapperFlags
PolyTextOutW
GetTextExtentExPointI
GetTextCharacterExtra
GetKerningPairsW
GetFontLanguageInfo
GetCharWidthI
GetCharWidthFloatW
GetCharacterPlacementW
GetCharABCWidthsFloatW
GetCharABCWidthsW
GetAspectRatioFilterEx
GetDIBColorTable
ExtFloodFill
SetMapMode
SetViewportExtEx
SetWindowExtEx
StretchBlt
CloseEnhMetaFile
CloseMetaFile
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
GetDeviceCaps
GetLayout
SetLayout
GetROP2
PolyBezier
CreateBrushIndirect
Polyline
MoveToEx
LineTo
SetROP2
GetStockObject
Rectangle
SelectPalette
CreatePen
SelectObject
CreateSolidBrush
DeleteObject
ExtTextOutA
EndDoc
EndPage
StartPage
GetBitmapDimensionEx
GetStretchBltMode
MaskBlt
PlgBlt
SetBitmapDimensionEx
AnimatePalette
GetColorAdjustment
ResizePalette
SetColorAdjustment
SetPaletteEntries
SetSystemPaletteUse
CheckColorsInGamut
ColorCorrectPalette
ColorMatchToTarget
EnumICMProfilesW
GetLogColorSpaceW
SetICMMode
SetICMProfileW
GetDeviceGammaRamp
SetDeviceGammaRamp
FrameRgn
GetRegionData
InvertRgn
PtInRegion
Chord
Pie
PolyPolygon
RoundRect
SetColorSpace
CreatePenIndirect
CreateBitmapIndirect
CreateEllipticRgn
CreateEllipticRgnIndirect
CreatePolyPolygonRgn
ExtCreateRegion
DeleteColorSpace
SetAbortProc
AbortDoc

kernel32

QueryDosDeviceW
GetWindowsDirectoryW
WritePrivateProfileStringW
GetLogicalDrives
ResetEvent
PulseEvent
LCMapStringW
LocalAlloc
DeleteFileW
GetTempFileNameW
FindCloseChangeNotification
FindNextChangeNotification
WaitForMultipleObjects
FindFirstChangeNotificationW
FileTimeToLocalFileTime
PostQueuedCompletionStatus
ReadDirectoryChangesW
GetQueuedCompletionStatus
ResumeThread
CreateIoCompletionPort
ExitThread
InitializeCriticalSectionAndSpinCount
TerminateProcess
GetSystemDirectoryW
GetTimeZoneInformation
GetExitCodeThread
OpenProcess
Process32Next
GetCurrentProcessId
Process32First
CreateToolhelp32Snapshot
FindResourceExA
GetNumberFormatW
lstrlenW
GlobalAddAtomW
CreateEventW
FindResourceW
MultiByteToWideChar
TryEnterCriticalSection
GetModuleFileNameA
DeleteFileA
lstrlenA
lstrcmpiA
LoadLibraryExA
IsDBCSLeadByte
GetProcessTimes
SetThreadPriority
VirtualAlloc
IsDebuggerPresent
GetThreadContext
SuspendThread
OpenThread
GlobalFlags
GetUserDefaultLangID
EnumCalendarInfoA
HeapFree
GetProcessHeap
HeapAlloc
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
RemoveDirectoryW
ExitProcess
CreateFileMappingW
VirtualQuery
GetComputerNameW
GetTimeFormatW
GetDateFormatW
FindNextFileW
FindFirstFileW
GetProcessId
ReadProcessMemory
VirtualQueryEx
CreateProcessA
CreateSemaphoreA
ReleaseSemaphore
GetVersionExW
CreateMutexW
FormatMessageW
GetEnvironmentVariableW
MoveFileExW
TerminateThread
OpenFileMappingA
HeapSetInformation
HeapCreate
HeapDestroy
HeapReAlloc
HeapSize
HeapUnlock
HeapLock
GetOEMCP
FindAtomA
AddAtomA
LoadLibraryExW
GetDiskFreeSpaceW
GetVolumeInformationW
GetPrivateProfileIntW
GetProfileIntW
GetCurrentDirectoryW
CopyFileW
CreateFileW
SetCurrentDirectoryW
SetEnvironmentVariableW
SearchPathW
GlobalFindAtomW
GlobalGetAtomNameW
ExpandEnvironmentStringsW
OpenEventA
WaitForSingleObjectEx
WaitForMultipleObjectsEx
SignalObjectAndWait
GetPrivateProfileStringA
GetPrivateProfileStringW
GetProfileStringA
GetProfileStringW
WritePrivateProfileStringA
WriteProfileStringA
WriteProfileStringW
GetPrivateProfileSectionW
GetPrivateProfileSectionA
OpenMutexA
OpenSemaphoreA
GetShortPathNameA
CreateDirectoryW
EnumTimeFormatsW
EnumDateFormatsW
FlushFileBuffers
GetSystemWindowsDirectoryW
VirtualFree
GetCurrencyFormatW
CreateSemaphoreW
lstrcmpA
SetFilePointerEx
Thread32Next
Thread32First
SetThreadContext
DecodePointer
EncodePointer
SetUnhandledExceptionFilter
IsWow64Process
VirtualProtect
AddVectoredExceptionHandler
GetStringTypeW
GetModuleHandleExW
RtlCaptureStackBackTrace
GetFileInformationByHandle
OpenFile
GetTimeFormatA
GetDateFormatA
GetTempPathA
FormatMessageA
FindNextFileA
FindFirstFileA
Beep
FoldStringW
OpenEventW
GetLongPathNameW
GetProfileIntA
GetFileAttributesA
GetLocaleInfoA
GetStartupInfoW
GetModuleHandleExA
GetDiskFreeSpaceExW
lstrcmpiW
lstrcmpW
GetCalendarInfoA
GetCalendarInfoW
GetGeoInfoW
GetUserGeoID
LocalLock
GetFileType
GetAtomNameW
QueryPerformanceCounter
QueryPerformanceFrequency
GetWindowsDirectoryA
CopyFileA
MoveFileA
GetShortPathNameW
SearchPathA
WriteProcessMemory
FlushInstructionCache
ReplaceFileW
AddAtomW
DeleteAtom
GetStringTypeExW
SetProcessWorkingSetSize
GlobalDeleteAtom
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
EnumUILanguagesW
EnumSystemLocalesW
EnumCalendarInfoExW
EnumDateFormatsExW
GetUserDefaultUILanguage
IsProcessorFeaturePresent
GetACP
TlsSetValue
TlsGetValue
MulDiv
GetProcAddress
IsValidLocale
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetTickCount
GetLastError
SetLastError
FindAtomW
IsDBCSLeadByteEx
GlobalSize
GetFileAttributesExW
GetSystemDefaultLangID
WideCharToMultiByte
AreFileApisANSI
CreateMutexA
IsValidCodePage
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceA
ReleaseMutex
GlobalMemoryStatus
CloseHandle
DuplicateHandle
CreateDirectoryExW
CreateJobObjectW
SetInformationJobObject
TerminateJobObject
AssignProcessToJobObject
DisconnectNamedPipe
ConnectNamedPipe
CreateNamedPipeW
SetWaitableTimer
CancelWaitableTimer
CreateWaitableTimerW
GetThreadTimes
IsSystemResumeAutomatic
GetSystemPowerStatus
GetProcessAffinityMask
GetThreadIOPendingFlag
IsBadWritePtr
IsBadReadPtr
DeviceIoControl
GetOverlappedResult
IsProcessInJob
QueryInformationJobObject
GetFullPathNameW
ExpandEnvironmentStringsA
CompareStringA
GetSystemDirectoryA
InterlockedCompareExchange
InterlockedExchange
CreateFileA
UnhandledExceptionFilter
SetFileAttributesW
SetFileTime
TlsAlloc
TlsFree
GetLocalTime
CopyFileExW
FileTimeToDosDateTime
SetErrorMode
DosDateTimeToFileTime
CompareStringW
FreeLibrary
LocalFileTimeToFileTime
GetUserDefaultLCID
GetSystemDefaultLCID
GetLocaleInfoW
LocalFree
GetSystemTimeAsFileTime
Sleep
GetCurrentProcess
GetModuleHandleA
GetModuleHandleW
GetFileAttributesW
GetVersion
LoadLibraryW
GetModuleFileNameW
OutputDebugStringA
LoadLibraryA
GetCurrentThreadId
CompareFileTime
ReadFile
SetFilePointer
WriteFile
GetFileSize
GetFileTime
GetVersionExA
UnmapViewOfFile
GetSystemInfo
MapViewOfFile
CreateFileMappingA
GlobalReAlloc
GlobalHandle
GetEnvironmentVariableA
GetCommandLineA
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateProcessW
FileTimeToSystemTime
SetEvent
CreateEventA
GetDriveTypeW
GetTempPathW
SystemTimeToFileTime
GetSystemTime
FindClose
SetEndOfFile
GetFileSizeEx
WaitForSingleObject
CreateThread
QueueUserAPC
SleepEx
GetCurrentThread
RaiseException

ole32

CoCreateInstance
CoLockObjectExternal
WriteFmtUserTypeStg
OleGetIconOfClass
CoUnmarshalInterface
CoMarshalInterface
CoReleaseMarshalData
CLSIDFromProgID
DoDragDrop
RegisterDragDrop
RevokeDragDrop
OleLoad
OleCreateLinkToFileEx
OleCreateLinkToFile
OleCreateLinkFromDataEx
OleCreateLinkFromData
OleCreateLinkEx
OleCreateLink
OleCreateFromFileEx
OleCreateFromDataEx
OleCreateFromData
OleCreateEx
OleCreateFromFile
OleCreate
OleDraw
OleSave
OleSaveToStream
StgIsStorageILockBytes
WriteClassStg
CreateDataAdviseHolder
CreateOleAdviseHolder
OleRegGetUserType
OleRegEnumVerbs
CoAllowSetForegroundWindow
CoRevokeClassObject
CoGetObject
CoGetClassObject
CoFreeUnusedLibraries
CoCreateFreeThreadedMarshaler
CreateItemMoniker
GetRunningObjectTable
WriteClassStm
ReadClassStm
ReadClassStg
PropVariantCopy
GetHGlobalFromILockBytes
StgOpenStorageOnILockBytes
CLSIDFromString
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
IIDFromString
StgOpenStorage
StgOpenStorageEx
StgCreateStorageEx
StgCreateDocfile
CoRevertToSelf
CoImpersonateClient
GetConvertStg
CoRevokeInitializeSpy
CoRegisterInitializeSpy
CoGetObjectContext
OleInitialize
OleUninitialize
OleSetClipboard
OleIsCurrentClipboard
StringFromIID
StringFromCLSID
CoTaskMemRealloc
GetClassFile
CoDisconnectObject
PropVariantClear
CoFileTimeNow
StgIsStorageFile
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoGetInterfaceAndReleaseStream
CoInitializeEx
CoUninitialize
CreateBindCtx
CoWaitForMultipleHandles
CoCreateGuid
StringFromGUID2
CoTaskMemAlloc
GetHGlobalFromStream
ProgIDFromCLSID
CoGetMalloc
OleConvertOLESTREAMToIStorage
OleConvertIStorageToOLESTREAM
CoTaskMemFree
CreateStreamOnHGlobal
OleGetClipboard
ReleaseStgMedium
CreateFileMoniker
CoRegisterClassObject

user32

UnregisterClassA
FindWindowA
CharNextA
MapVirtualKeyA
ScrollWindow
GetScrollPos
SetScrollInfo
SetParent
IsWindowUnicode
InvalidateRgn
CallWindowProcW
SetWindowPlacement
CharUpperA
ToUnicode
VkKeyScanW
GetClipboardOwner
LoadImageA
RegisterClipboardFormatA
EmptyClipboard
SetClipboardViewer
ChangeClipboardChain
SetClipboardData
CountClipboardFormats
IsHungAppWindow
InternalGetWindowText
GetDialogBaseUnits
BringWindowToTop
LoadBitmapA
FindWindowExW
MessageBoxA
GetWindowTextA
GetNextDlgTabItem
GetDlgCtrlID
IsDlgButtonChecked
SendNotifyMessageW
HideCaret
ShowCaret
AllowSetForegroundWindow
WaitForInputIdle
RegisterClassExA
DdeDisconnect
DdeFreeDataHandle
DdeUnaccessData
DdeAccessData
DdeClientTransaction
DdeFreeStringHandle
DdeConnect
DdeCreateStringHandleA
DdeInitializeA
WindowFromDC
SetCursorPos
InSendMessage
GetMessageA
GetKeyboardLayoutNameW
ActivateKeyboardLayout
SetWindowTextA
GetClipboardFormatNameW
LoadMenuW
LoadStringW
CreateDialogParamW
CreateDialogIndirectParamW
DialogBoxIndirectParamW
SetWindowPos
SystemParametersInfoW
FlashWindow
GetMenuCheckMarkDimensions
CharPrevA
NotifyWinEvent
ChildWindowFromPoint
EnumDisplayMonitors
ScrollWindowEx
FindWindowExA
SendNotifyMessageA
CopyAcceleratorTableA
OpenIcon
SendMessageTimeoutW
CheckDlgButton
keybd_event
PostThreadMessageA
CreateDialogIndirectParamA
DrawTextW
MapDialogRect
SetWindowsHookExW
RegisterClipboardFormatW
GetClassInfoA
GetScrollInfo
GetUpdateRgn
WinHelpW
SendInput
AdjustWindowRect
AttachThreadInput
IsWinEventHookInstalled
FlashWindowEx
SubtractRect
CreateIconIndirect
CreateIconFromResourceEx
LoadCursorFromFileW
GetWindowTextLengthW
GetMonitorInfoW
DrawEdge
ValidateRect
LoadIconW
MsgWaitForMultipleObjects
DeferWindowPos
GetPropA
SetPropA
LoadCursorW
GetWindowLongW
InsertMenuW
AppendMenuW
SetMenuInfo
GetMenuInfo
GetIconInfo
CopyImage
PrintWindow
IsZoomed
AdjustWindowRectEx
GetClassLongW
ScrollDC
SendMessageW
PeekMessageW
GetMessageW
DispatchMessageW
WaitMessage
PostQuitMessage
SetLayeredWindowAttributes
TrackPopupMenuEx
TrackMouseEvent
MonitorFromRect
GetWindowTextLengthA
GetWindowTextW
GetDCEx
GetWindowDC
SetPropW
GetPropW
GetKeyboardLayoutList
RemovePropW
GetWindowPlacement
MonitorFromWindow
UpdateLayeredWindow
SetWindowRgn
DefWindowProcW
SetWindowTextW
LockWindowUpdate
SetWindowsHookExA
UnhookWindowsHookEx
GetMenuStringA
ModifyMenuA
GetWindowInfo
InsertMenuA
AppendMenuA
BeginDeferWindowPos
EndDeferWindowPos
EnumThreadWindows
ReplyMessage
CallNextHookEx
IsWindowEnabled
GetMessageExtraInfo
GetWindowThreadProcessId
SetActiveWindow
GetMessageTime
SetMenu
GetMenu
DrawMenuBar
SetMenuDefaultItem
GetClipCursor
GetCursor
EnableWindow
EnumWindows
IsCharAlphaNumericW
GetKeyboardState
SetKeyboardState
AnimateWindow
RegisterWindowMessageW
SendMessageTimeoutA
GetSubMenu
GetKeyboardLayout
VkKeyScanExW
GetCapture
GetClassNameA
IsMenu
CreateMenu
GetOpenClipboardWindow
LoadImageW
MonitorFromPoint
GetMonitorInfoA
GetForegroundWindow
GetAncestor
IsRectEmpty
GetSystemMenu
EnableMenuItem
GetLastActivePopup
BeginPaint
EndPaint
EnumChildWindows
InvertRect
MoveWindow
GetClassInfoW
RegisterClassA
IsChild
GrayStringA
DrawIcon
GetClassLongA
RegisterWindowMessageA
SetWindowLongW
SendDlgItemMessageW
EndDialog
GetUpdateRect
RedrawWindow
DestroyIcon
LoadIconA
DrawIconEx
DeleteMenu
RemoveMenu
GetMenuState
GetMenuItemID
TrackPopupMenu
CreatePopupMenu
GetMenuItemCount
DestroyMenu
SystemParametersInfoA
CharLowerW
CharUpperW
GetFocus
SetFocus
GetAsyncKeyState
SendDlgItemMessageA
IsDialogMessageA
UpdateWindow
GetDlgItem
DestroyCursor
UnregisterClassW
RegisterClassW
MessageBoxW
GetWindow
SetClassLongA
IsWindow
GetClassNameW
MsgWaitForMultipleObjectsEx
DispatchMessageA
GetDesktopWindow
GetWindowRect
CallWindowProcA
DefDlgProcA
FindWindowW
CreateWindowExW
CreateWindowExA
GetClassInfoExW
RegisterClassExW
PostMessageA
DefWindowProcA
DestroyWindow
GetLastInputInfo
SetForegroundWindow
IsIconic
SetWindowLongA
GetWindowLongA
GetQueueStatus
PeekMessageA
MapWindowPoints
SendMessageA
IsClipboardFormatAvailable
GetClipboardData
SetCapture
ReleaseCapture
GetCursorPos
WindowFromPoint
GetClientRect
EnableScrollBar
SetScrollPos
InvalidateRect
SetScrollRange
GetParent
TranslateMessage
ClipCursor
GetSysColor
DestroyCaret
DrawFocusRect
ClientToScreen
IntersectRect
IsWindowVisible
PostMessageW
ShowWindow
OpenClipboard
EnumClipboardFormats
CloseClipboard
MessageBeep
CreateCaret
SetCaretPos
GetSysColorBrush
SetRectEmpty
CopyRect
OffsetRect
EqualRect
GetActiveWindow
SetRect
InflateRect
FrameRect
GetDC
ReleaseDC
LoadCursorA
SetCursor
UnionRect
PtInRect
FillRect
GetKeyState
GetTabbedTextExtentW
TabbedTextOutW
DrawCaption
ExcludeUpdateRgn
GetWindowRgn
PaintDesktop
ValidateRgn
LoadBitmapW
DrawStateW
GrayStringW
CloseDesktop
CloseWindowStation
UserHandleGrantAccess
SetUserObjectSecurity
GetUserObjectSecurity
GetThreadDesktop
GetProcessWindowStation
CreateDesktopW
SetProcessWindowStation
GetUserObjectInformationW
CreateWindowStationW
DrawTextA
DrawFrameControl
GetMessagePos
ShowCursor
GetSystemMetrics
ScreenToClient
GetDoubleClickTime
KillTimer
GetComboBoxInfo
SetTimer
CopyIcon
DrawTextExW

rpcrt4

NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrClientCall
NdrOleAllocate
NdrOleFree
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
UuidToStringW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
RpcBindingSetAuthInfoA
RpcMgmtIsServerListening
RpcBindingFree
NdrClientCall2
UuidCreate

msvcr90

realloc
_finite
strcpy_s
fprintf
vsprintf_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_crt_debugger_hook
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
wcstol
_vsnprintf
_CIfmod
_wsplitpath_s
iswalpha
strtok_s
fopen_s
fputws
_wdupenv_s
_vscwprintf
modf
_isnan
__CxxFrameHandler3
atoi
_CIlog10
asctime
_localtime64
tolower
wcstoul
strncmp
_time64
_difftime64
wcscat_s
_mbsrchr
strchr
__iob_func
fwprintf
printf
_wfopen_s
fclose
fgets
fwrite
_CxxThrowException
_vswprintf_c_l
_splitpath_s
toupper
_memicmp
swscanf_s
bsearch
iswlower
iswupper
sprintf_s
clock
_mbschr
wcscpy_s
vswprintf_s
_wtol
_itow_s
_recalloc
_resetstkoflw
strstr
_CIlog
iswspace
wcsncat_s
wcstok_s
_errno
_snwprintf_s
_wcsnicmp
_wcslwr_s
_wcsicmp
longjmp
floor
wcsnlen
_wtoi
memmove_s
malloc
free
wcsncmp
swprintf_s
_setjmp3
_CIpow
memcpy_s
_stricmp
strnlen
_snprintf_s
_CIcos
qsort
_CIexp
_CIatan2
_mbsstr
_vsnprintf_s
ceil
_CItan
_CIsin
srand
rand
_CIatan
_vsnwprintf_s
wcscspn
wcsrchr
wcschr
_CIsqrt
_ecvt_s
_controlfp_s
_clearfp
_statusfp
wcsstr
wcsncpy_s
memcpy
memmove
strncpy_s
memset

msi

ord82
ord193
ord155
ord14
ord190
ord137
ord141
ord129
ord203
ord113
ord39
ord66
ord88
ord90
ord45
ord173
ord111
ord70
ord37
ord109

Exports

Exports

??0OdfStgParams@@QAE@XZ
DllCanUnloadNow
DllGetClassObject
DllGetLCID
FInitSdm
MsoMakeCustomItem
MsoMakeFindFile
MsoVBADigSigCreateIndirectData
MsoVBADigSigGetSignedDataMsg
MsoVBADigSigIsMyTypeOfFile
MsoVBADigSigPutSignedDataMsg
MsoVBADigSigRemoveSignedDataMsg
MsoVBADigSigVerifyIndirectData
MsoWintrustFinalPolicy
OfficeSetHelpFilter
_CanCredStoreBeSchemeAware@0
_MsoAlertWtz@12
_MsoCbRegGetBufferSizeWz@4
_MsoCchLoadSz@16
_MsoCchLoadWz@16
_MsoChsFromLid@4
_MsoCompareStringA@24
_MsoCompareStringW@24
_MsoCpCchSzLenFromWz@8
_MsoCpgFromChs@4
_MsoCrCbvGet@4
_MsoCrCbvGetAccurate@12
_MsoCrashMainThread@4
_MsoCreateIOLDocFromWzPersistentName@12
_MsoDestroyIPref@4
_MsoDestroyITFC@4
_MsoDoFontLinkRgwch@24
_MsoDrawTextW@20
_MsoDwGimmeUserInstallBehavior@8
_MsoDwRegGetDw@4
_MsoDwWhichMessengerRunningEx@0
_MsoExtTextOutW@32
_MsoFActivateControl@4
_MsoFAddinsDisabled@0
_MsoFAnsiCodePageSupportsLCID@8
_MsoFCheckPlexCbSize@8
_MsoFCreateButtonEx@36
_MsoFCreateControl@36
_MsoFCreateIPref@28
_MsoFCreateITFC@16
_MsoFCreateITFCHwnd@20
_MsoFCreateITFCNoAssistant@16
_MsoFCreateStdComponentManager@20
_MsoFCreateToolbarSet@28
_MsoFDigitCh@4
_MsoFDoSmartTagSecurityCheck@8
_MsoFEnsureMsoTypelib@0
_MsoFExecWWWHelp@8
_MsoFFEWch@4
_MsoFGetButtonSize@0
_MsoFGetComponentManager@4
_MsoFGetFontSettings@20
_MsoFGetHelpFile@12
_MsoFGetHelpFileFromWz@12
_MsoFGetMSAAWtz@12
_MsoFGetTbShowKbdShortcuts@0
_MsoFGetTextExtentPointW@16
_MsoFGetTooltips@0
_MsoFGimmeComponentEx@24
_MsoFGimmeFeatureEx@8
_MsoFGimmeFileEx@24
_MsoFHandledMessageNeeded@4
_MsoFHideTaiwan@0
_MsoFIEPolicyAndVersion@8
_MsoFInitOffice@20
_MsoFInitOrapi@0
_MsoFInstallOfficeComponentGroup@4
_MsoFIsFileFromTrustedLocation@4
_MsoFLoadToolbarSet@24
_MsoFLongLoad@8
_MsoFLongSave@8
_MsoFMarkMemCore@8
_MsoFPitbsFromHwndAndMsg@12
_MsoFPuncWch@4
_MsoFRegGetDwCore@8
_MsoFRegReadWz@12
_MsoFRegSetDw@8
_MsoFRegSetSz@8
_MsoFRegSetWz@8
_MsoFRequireSignedAddins@0
_MsoFRgchEqual@20
_MsoFSetComponentManager@4
_MsoFSetHMsoinstOfSdm@4
_MsoFSetTooltips@4
_MsoFSpaceWch@4
_MsoFSzEqual@12
_MsoFUseIEFeature@8
_MsoFVBADigSigSignProject@24
_MsoFWebScriptingEnabled@0
_MsoFWndProc@24
_MsoFWndProcNeeded@4
_MsoFWzEqual@12
_MsoFreeCvsList@4
_MsoFreeFlinfo@4
_MsoFreePv@4
_MsoGetFidCSSeqChkDll@0
_MsoGetFidUspDll@0
_MsoGetFileAttributesW@4
_MsoGetHinstIntl@0
_MsoGetHmodPTLServices@0
_MsoGetIDCRLTokenFromPath@8
_MsoGetInstallLcid@0
_MsoGetNewFileName@12
_MsoGetPublishingPlacesPidl@8
_MsoGetStringTypeExW@20
_MsoGetTextExtentExPointW@28
_MsoGetToolbarMetrics@4
_MsoGetUILcid@0
_MsoGetWWWCmdInfo@20
_MsoHpalOffice@0
_MsoHpalSelect@8
_MsoHrGetIMManager@8
_MsoHrGetMyDocumentsFolder@8
_MsoHrLoadVBAStgFromHTML@8
_MsoHrPrepareForIMShutdown@0
_MsoHrRegisterAll@0
_MsoHrSaveVBAStgAsHTML@12
_MsoHrSetupHTMLImport@8
_MsoHrShowConverterEntryDialog@28
_MsoHrSimpleQueryInterface2@20
_MsoHrSimpleQueryInterface@16
_MsoHtmlHelp@16
_MsoIDCRLDisableDavAutoConnect@0
_MsoInitGimme@12
_MsoInitHicd@4
_MsoInitPluggableUI@0
_MsoInitShrGlobal@4
_MsoLoadLocalizedLibraryEx@12
_MsoLoadStringW@16
_MsoMigrate@8
_MsoMultiByteToWideChar@24
_MsoOffice@8
_MsoPeekMessage@8
_MsoPvAllocCore@4
_MsoPwchStripAmpersandsWtz@4
_MsoPwchStripWtz@8
_MsoPwlfFromFlinfo@8
_MsoRegEnumValueW@28
_MsoRegOpenKeyExW@16
_MsoRegQueryValueExW@20
_MsoReleaseMemCore@4
_MsoReportHangAPCProc@4
_MsoRgchToRgwch@16
_MsoSendMessage@16
_MsoSetLVProperty@8
_MsoSetLocale@4
_MsoSetTbShowKbdShortcuts@4
_MsoSzMarkWzCore@4
_MsoUninitOffice@4
_MsoVBADigSigCallDlg@20
_MsoVBADigSigCallDlgEx@28
_MsoVBADigSigDllRegisterServer@0
_MsoVBADigSigDllUnregisterServer@0
_MsoVBADigSigOpenDlg@52
_MsoVBADigSigVerifyProject@56
_MsoVbaInitSecurity@4
_MsoWchToLower@4
_MsoWchToLowerLid@12
_MsoWchToUpper@4
_MsoWchToUpperLid@12
_MsoWebServerSupportEx@12
_MsoWideCharToMultiByte@32
_MsoWzAfterPath@4
_MsoWzFromIhtk@4
_MsoWzGetUserAgent3@0
_MsoWzMarkSzCore@4
_MsoWzUpper@4

Sections

.text
Size: 15.9MB - Virtual size: 15.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 744KB - Virtual size: 743KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 663KB - Virtual size: 663KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 540KB - Virtual size: 539KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/data/MSO.DLL
.dll windows x86

121df04a2e2a2fdd62f41da6ef33980a

Code Sign

33:00:00:01:7c:bb:c3:a7:e0:ad:59:47:ad:00:00:00:00:01:7c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2020, 17:25

Not After

01/04/2021, 17:25

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:60BC-E383-2635,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:fa:fc:1e:0a:0b:f8:7f:37:9a:00:02:00:00:01:fa
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/07/2020, 18:30

Not After

25/04/2021, 18:30

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:04:35:45:00:00:00:00:00:3f
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

20/09/2018, 17:42

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:e0:71:73:24:ca:5c:98:f8:19:00:00:00:00:01:e0
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:c2:ab:f1:8d:ce:41:8d:c7:01:25:60:eb:72:03:9c:9a:a1:e1:86:98:18:dc:a2:dc:3d:c7:90:b4:64:d2:b3
Signer

Actual PE Digest

3a:c2:ab:f1:8d:ce:41:8d:c7:01:25:60:eb:72:03:9c:9a:a1:e1:86:98:18:dc:a2:dc:3d:c7:90:b4:64:d2:b3

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

21/04/2023, 09:04
Valid: false

be:01:e3:23:40:1f:eb:21:cc:9a:1b:b9:ec:e8:2a:1e:8c:99:2d:d8
Signer

Actual PE Digest

be:01:e3:23:40:1f:eb:21:cc:9a:1b:b9:ec:e8:2a:1e:8c:99:2d:d8

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

16/03/2021, 01:30
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegQueryValueExW
RegQueryValueExA
RegQueryInfoKeyA
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
GetTokenInformation
OpenProcessToken
RegNotifyChangeKeyValue
RegDeleteKeyA
RegCreateKeyExA
RegEnumKeyExA
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsA
TraceEvent
CryptReleaseContext
CryptDestroyKey
CryptSetKeyParam
CryptGetKeyParam
CryptGenRandom
CryptEncrypt
CryptDecrypt
CryptGenKey
CryptGetProvParam
CryptImportKey
CryptEnumProvidersW
CryptExportKey
CryptAcquireContextW
CryptDuplicateKey
ConvertSidToStringSidW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
CopySid
GetLengthSid
CryptHashData
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptVerifySignatureW
RegEnumValueA
RegQueryInfoKeyW
RegDeleteKeyW
RegQueryValueW
RegEnumKeyW
RegEnumValueW
RegDeleteValueW
SetFileSecurityW
GetFileSecurityW
GetUserNameW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
UnregisterTraceGuids
CloseEventLog
ReportEventA
AddAccessAllowedAce
AddAccessDeniedAce
InitializeAcl
AllocateAndInitializeSid
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
CheckTokenMembership
EqualSid
IsValidSid
CreateWellKnownSid
SetSecurityInfo
AddAce
AddAccessAllowedAceEx
ConvertSidToStringSidA
RegQueryValueA
RegEnumKeyA
RegisterEventSourceA
IsTextUnicode
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
StartServiceW
GetSidSubAuthority
OpenThreadToken
CryptGetHashParam
CryptSetHashParam
CryptDeriveKey
CryptGetUserKey
RegisterTraceGuidsW
RevertToSelf
CryptAcquireContextA
ImpersonateLoggedOnUser
CreateRestrictedToken
GetAce
GetAclInformation
SetSecurityDescriptorSacl
CreateProcessAsUserW
LogonUserW
SetTokenInformation
ConvertStringSidToSidW

gdi32

CreateEnhMetaFileA
DeleteMetaFile
DeleteEnhMetaFile
GetBkColor
RealizePalette
SetTextColor
SetBkMode
GetBkMode
GetCurrentObject
IntersectClipRect
SetViewportOrgEx
GetViewportOrgEx
Ellipse
OffsetRgn
GetTextColor
PlayEnhMetaFileRecord
LPtoDP
DPtoLP
GetPaletteEntries
GetObjectA
GetTextExtentPoint32A
CreateFontIndirectA
PlayMetaFileRecord
GetEnhMetaFilePaletteEntries
GetObjectType
RestoreDC
GetArcDirection
GetTextAlign
StretchDIBits
SetBkColor
EnumEnhMetaFile
GetEnhMetaFileHeader
EnumMetaFile
CreateDIBPatternBrushPt
GetNearestColor
Polygon
CreateHatchBrush
UnrealizeObject
CreateBitmap
EqualRgn
CreateRectRgn
CreateRectRgnIndirect
SetRectRgn
GetRgnBox
ExtSelectClipRgn
CombineRgn
SelectClipRgn
BitBlt
OffsetClipRgn
FillRgn
PatBlt
CreateDIBSection
CopyEnhMetaFileA
CopyMetaFileA
CreateMetaFileA
SaveDC
ExcludeClipRect
PaintRgn
CreatePolygonRgn
CreatePatternBrush
SetBrushOrgEx
LineDDA
SetStretchBltMode
SetWindowOrgEx
GetBitmapBits
CreateFontA
EnumFontFamiliesExA
SetMetaFileBitsEx
GetWinMetaFileBits
SetDIBitsToDevice
GetDIBits
GdiFlush
GdiComment
GetEnhMetaFileDescriptionW
SetWinMetaFileBits
GetMetaFileBitsEx
SetTextAlign
GetCharWidthA
GetGlyphOutlineA
GetGlyphOutlineW
GetCharABCWidthsA
GetKerningPairsA
GetObjectW
GetSystemPaletteEntries
GetViewportExtEx
GetWindowExtEx
CombineTransform
PolyBezierTo
CloseFigure
StrokePath
EndPath
BeginPath
GetBrushOrgEx
GetMapMode
GetClipBox
RectVisible
ExtCreatePen
GetEnhMetaFileBits
Escape
ExtEscape
SetEnhMetaFileBits
CreatePalette
CreateHalftonePalette
GetSystemPaletteUse
CreateFontIndirectW
GetPixel
GetClipRgn
CreateDIBitmap
SetPolyFillMode
GetPolyFillMode
CreateRoundRectRgn
GetTextMetricsA
GetWindowOrgEx
SetDIBits
SetDCPenColor
CreateFontW
GetTextExtentPointA
SetTextJustification
GetTextCharset
GetTextCharsetInfo
GetTextFaceW
GetOutlineTextMetricsW
GetFontData
GetOutlineTextMetricsA
GetCharABCWidthsI
EnumFontFamiliesExW
ExtTextOutW
GetCharWidth32W
GetGlyphIndicesW
GetTextExtentExPointW
GetTextExtentExPointA
GetTextMetricsW
CreateMetaFileW
CopyMetaFileW
GetMetaFileW
CreateEnhMetaFileW
CopyEnhMetaFileW
GetEnhMetaFileW
CreateColorSpaceW
CreateDCW
ResetDCW
StartDocW
CreateICW
TranslateCharsetInfo
GetWorldTransform
SetWorldTransform
SetGraphicsMode
RemoveFontMemResourceEx
AddFontMemResourceEx
SetPixel
CreateDCA
GetDCOrgEx
RectInRegion
GetNearestPaletteIndex
TextOutA
PlayEnhMetaFile
SetDCBrushColor
UpdateColors
GetTextExtentPointI
GetPath
GetICMProfileW
GetFontUnicodeRanges
SetDIBColorTable
GetTextExtentPoint32W
SetMetaRgn
SelectClipPath
PtVisible
GetRandomRgn
GetMetaRgn
SetBoundsRect
GetBoundsRect
GetDCPenColor
GetDCBrushColor
EnumObjects
DrawEscape
CancelDC
TextOutW
SetTextCharacterExtra
SetMapperFlags
PolyTextOutW
GetTextExtentExPointI
GetTextCharacterExtra
GetKerningPairsW
GetFontLanguageInfo
GetCharWidthI
GetCharWidthFloatW
GetCharacterPlacementW
GetCharABCWidthsFloatW
GetCharABCWidthsW
GetAspectRatioFilterEx
GetDIBColorTable
ExtFloodFill
SetMapMode
SetViewportExtEx
SetWindowExtEx
StretchBlt
CloseEnhMetaFile
CloseMetaFile
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
GetDeviceCaps
GetLayout
SetLayout
GetROP2
PolyBezier
CreateBrushIndirect
Polyline
MoveToEx
LineTo
SetROP2
GetStockObject
Rectangle
SelectPalette
CreatePen
SelectObject
CreateSolidBrush
DeleteObject
ExtTextOutA
EndDoc
EndPage
StartPage
GetBitmapDimensionEx
GetStretchBltMode
MaskBlt
PlgBlt
SetBitmapDimensionEx
AnimatePalette
GetColorAdjustment
ResizePalette
SetColorAdjustment
SetPaletteEntries
SetSystemPaletteUse
CheckColorsInGamut
ColorCorrectPalette
ColorMatchToTarget
EnumICMProfilesW
GetLogColorSpaceW
SetICMMode
SetICMProfileW
GetDeviceGammaRamp
SetDeviceGammaRamp
FrameRgn
GetRegionData
InvertRgn
PtInRegion
Chord
Pie
PolyPolygon
RoundRect
SetColorSpace
CreatePenIndirect
CreateBitmapIndirect
CreateEllipticRgn
CreateEllipticRgnIndirect
CreatePolyPolygonRgn
ExtCreateRegion
DeleteColorSpace
SetAbortProc
AbortDoc

kernel32

QueryDosDeviceW
GetWindowsDirectoryW
WritePrivateProfileStringW
GetLogicalDrives
ResetEvent
PulseEvent
LCMapStringW
LocalAlloc
DeleteFileW
GetTempFileNameW
FindCloseChangeNotification
FindNextChangeNotification
WaitForMultipleObjects
FindFirstChangeNotificationW
FileTimeToLocalFileTime
PostQueuedCompletionStatus
ReadDirectoryChangesW
GetQueuedCompletionStatus
ResumeThread
CreateIoCompletionPort
ExitThread
InitializeCriticalSectionAndSpinCount
TerminateProcess
GetSystemDirectoryW
GetTimeZoneInformation
GetExitCodeThread
OpenProcess
Process32Next
GetCurrentProcessId
Process32First
CreateToolhelp32Snapshot
FindResourceExA
GetNumberFormatW
lstrlenW
GlobalAddAtomW
CreateEventW
FindResourceW
MultiByteToWideChar
TryEnterCriticalSection
GetModuleFileNameA
DeleteFileA
lstrlenA
lstrcmpiA
LoadLibraryExA
IsDBCSLeadByte
GetProcessTimes
SetThreadPriority
VirtualAlloc
IsDebuggerPresent
GetThreadContext
SuspendThread
OpenThread
GlobalFlags
GetUserDefaultLangID
EnumCalendarInfoA
HeapFree
GetProcessHeap
HeapAlloc
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
RemoveDirectoryW
ExitProcess
CreateFileMappingW
VirtualQuery
GetComputerNameW
GetTimeFormatW
GetDateFormatW
FindNextFileW
FindFirstFileW
GetProcessId
ReadProcessMemory
VirtualQueryEx
CreateProcessA
CreateSemaphoreA
ReleaseSemaphore
GetVersionExW
CreateMutexW
FormatMessageW
GetEnvironmentVariableW
MoveFileExW
TerminateThread
OpenFileMappingA
HeapSetInformation
HeapCreate
HeapDestroy
HeapReAlloc
HeapSize
HeapUnlock
HeapLock
GetOEMCP
FindAtomA
AddAtomA
LoadLibraryExW
GetDiskFreeSpaceW
GetVolumeInformationW
GetPrivateProfileIntW
GetProfileIntW
GetCurrentDirectoryW
CopyFileW
CreateFileW
SetCurrentDirectoryW
SetEnvironmentVariableW
SearchPathW
GlobalFindAtomW
GlobalGetAtomNameW
ExpandEnvironmentStringsW
OpenEventA
WaitForSingleObjectEx
WaitForMultipleObjectsEx
SignalObjectAndWait
GetPrivateProfileStringA
GetPrivateProfileStringW
GetProfileStringA
GetProfileStringW
WritePrivateProfileStringA
WriteProfileStringA
WriteProfileStringW
GetPrivateProfileSectionW
GetPrivateProfileSectionA
OpenMutexA
OpenSemaphoreA
GetShortPathNameA
CreateDirectoryW
EnumTimeFormatsW
EnumDateFormatsW
FlushFileBuffers
GetSystemWindowsDirectoryW
GetFullPathNameW
GetFinalPathNameByHandleW
VirtualFree
GetCurrencyFormatW
CreateSemaphoreW
lstrcmpA
SetFilePointerEx
Thread32Next
Thread32First
SetThreadContext
DecodePointer
EncodePointer
SetUnhandledExceptionFilter
IsWow64Process
VirtualProtect
AddVectoredExceptionHandler
GetStringTypeW
GetModuleHandleExW
RtlCaptureStackBackTrace
GetFileInformationByHandle
OpenFile
GetTimeFormatA
GetDateFormatA
GetTempPathA
FormatMessageA
FindNextFileA
FindFirstFileA
Beep
FoldStringW
OpenEventW
GetLongPathNameW
GetProfileIntA
GetFileAttributesA
GetLocaleInfoA
GetStartupInfoW
GetModuleHandleExA
GetDiskFreeSpaceExW
lstrcmpiW
lstrcmpW
GetCalendarInfoA
GetCalendarInfoW
GetGeoInfoW
GetUserGeoID
LocalLock
GetFileType
GetAtomNameW
QueryPerformanceCounter
QueryPerformanceFrequency
GetWindowsDirectoryA
CopyFileA
MoveFileA
GetShortPathNameW
SearchPathA
WriteProcessMemory
FlushInstructionCache
ReplaceFileW
AddAtomW
DeleteAtom
GetStringTypeExW
SetProcessWorkingSetSize
GlobalDeleteAtom
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
EnumUILanguagesW
EnumSystemLocalesW
EnumCalendarInfoExW
EnumDateFormatsExW
GetUserDefaultUILanguage
IsProcessorFeaturePresent
GetACP
TlsSetValue
TlsGetValue
MulDiv
GetProcAddress
IsValidLocale
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetTickCount
GetLastError
SetLastError
FindAtomW
IsDBCSLeadByteEx
GlobalSize
GetFileAttributesExW
GetSystemDefaultLangID
WideCharToMultiByte
AreFileApisANSI
CreateMutexA
IsValidCodePage
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceA
ReleaseMutex
GlobalMemoryStatus
CloseHandle
CreateDirectoryExW
DuplicateHandle
EnumCalendarInfoExEx
CreateJobObjectW
SetInformationJobObject
TerminateJobObject
AssignProcessToJobObject
DisconnectNamedPipe
ConnectNamedPipe
CreateNamedPipeW
SetWaitableTimer
CancelWaitableTimer
CreateWaitableTimerW
GetThreadTimes
IsSystemResumeAutomatic
GetSystemPowerStatus
GetProcessAffinityMask
GetThreadIOPendingFlag
IsBadWritePtr
IsBadReadPtr
DeviceIoControl
GetOverlappedResult
IsProcessInJob
QueryInformationJobObject
ExpandEnvironmentStringsA
CompareStringA
GetSystemDirectoryA
InterlockedCompareExchange
InterlockedExchange
CreateFileA
UnhandledExceptionFilter
SetFileAttributesW
SetFileTime
TlsAlloc
TlsFree
GetLocalTime
CopyFileExW
FileTimeToDosDateTime
SetErrorMode
DosDateTimeToFileTime
CompareStringW
FreeLibrary
LocalFileTimeToFileTime
GetUserDefaultLCID
GetSystemDefaultLCID
GetLocaleInfoW
LocalFree
GetSystemTimeAsFileTime
Sleep
GetCurrentProcess
GetModuleHandleA
GetModuleHandleW
GetFileAttributesW
GetVersion
LoadLibraryW
GetModuleFileNameW
OutputDebugStringA
LoadLibraryA
GetCurrentThreadId
CompareFileTime
ReadFile
SetFilePointer
WriteFile
GetFileSize
GetFileTime
GetVersionExA
UnmapViewOfFile
GetSystemInfo
MapViewOfFile
CreateFileMappingA
GlobalReAlloc
GlobalHandle
GetEnvironmentVariableA
GetCommandLineA
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateProcessW
FileTimeToSystemTime
SetEvent
CreateEventA
GetDriveTypeW
GetTempPathW
SystemTimeToFileTime
GetSystemTime
FindClose
SetEndOfFile
GetFileSizeEx
WaitForSingleObject
CreateThread
QueueUserAPC
SleepEx
GetCurrentThread
RaiseException

ole32

CoCreateInstance
CoLockObjectExternal
WriteFmtUserTypeStg
OleGetIconOfClass
CoUnmarshalInterface
CoMarshalInterface
CoReleaseMarshalData
CLSIDFromProgID
DoDragDrop
RegisterDragDrop
RevokeDragDrop
OleLoad
OleCreateLinkToFileEx
OleCreateLinkToFile
OleCreateLinkFromDataEx
OleCreateLinkFromData
OleCreateLinkEx
OleCreateLink
OleCreateFromFileEx
OleCreateFromDataEx
OleCreateFromData
OleCreateEx
OleCreateFromFile
OleCreate
OleDraw
OleSave
OleSaveToStream
StgIsStorageILockBytes
WriteClassStg
CreateDataAdviseHolder
CreateOleAdviseHolder
OleRegGetUserType
OleRegEnumVerbs
CoAllowSetForegroundWindow
CoRevokeClassObject
CoGetObject
CoGetClassObject
CoFreeUnusedLibraries
CoCreateFreeThreadedMarshaler
CreateItemMoniker
GetRunningObjectTable
WriteClassStm
ReadClassStm
ReadClassStg
PropVariantCopy
GetHGlobalFromILockBytes
StgOpenStorageOnILockBytes
CLSIDFromString
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
IIDFromString
StgOpenStorage
StgOpenStorageEx
StgCreateStorageEx
StgCreateDocfile
CoRevertToSelf
CoImpersonateClient
GetConvertStg
CoRevokeInitializeSpy
CoRegisterInitializeSpy
CoGetObjectContext
OleInitialize
OleUninitialize
OleSetClipboard
OleIsCurrentClipboard
StringFromIID
StringFromCLSID
CoTaskMemRealloc
GetClassFile
CoDisconnectObject
PropVariantClear
CoFileTimeNow
StgIsStorageFile
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoGetInterfaceAndReleaseStream
CoInitializeEx
CoUninitialize
CreateBindCtx
CoWaitForMultipleHandles
CoCreateGuid
StringFromGUID2
CoTaskMemAlloc
GetHGlobalFromStream
ProgIDFromCLSID
CoGetMalloc
OleConvertOLESTREAMToIStorage
OleConvertIStorageToOLESTREAM
CoTaskMemFree
CreateStreamOnHGlobal
OleGetClipboard
ReleaseStgMedium
CreateFileMoniker
CoRegisterClassObject

user32

UnregisterClassA
FindWindowA
CharNextA
MapVirtualKeyA
ScrollWindow
GetScrollPos
SetScrollInfo
SetParent
IsWindowUnicode
InvalidateRgn
CallWindowProcW
SetWindowPlacement
CharUpperA
ToUnicode
VkKeyScanW
GetClipboardOwner
LoadImageA
RegisterClipboardFormatA
EmptyClipboard
SetClipboardViewer
ChangeClipboardChain
SetClipboardData
CountClipboardFormats
IsHungAppWindow
InternalGetWindowText
GetDialogBaseUnits
BringWindowToTop
LoadBitmapA
FindWindowExW
MessageBoxA
GetWindowTextA
GetNextDlgTabItem
GetDlgCtrlID
IsDlgButtonChecked
SendNotifyMessageW
HideCaret
ShowCaret
AllowSetForegroundWindow
WaitForInputIdle
RegisterClassExA
DdeDisconnect
DdeFreeDataHandle
DdeUnaccessData
DdeAccessData
DdeClientTransaction
DdeFreeStringHandle
DdeConnect
DdeCreateStringHandleA
DdeInitializeA
WindowFromDC
SetCursorPos
InSendMessage
GetMessageA
GetKeyboardLayoutNameW
ActivateKeyboardLayout
SetWindowTextA
GetClipboardFormatNameW
LoadMenuW
LoadStringW
CreateDialogParamW
CreateDialogIndirectParamW
DialogBoxIndirectParamW
SetWindowPos
SystemParametersInfoW
FlashWindow
GetMenuCheckMarkDimensions
CharPrevA
NotifyWinEvent
ChildWindowFromPoint
EnumDisplayMonitors
ScrollWindowEx
FindWindowExA
SendNotifyMessageA
CopyAcceleratorTableA
OpenIcon
SendMessageTimeoutW
CheckDlgButton
keybd_event
PostThreadMessageA
CreateDialogIndirectParamA
DrawTextW
MapDialogRect
SetWindowsHookExW
RegisterClipboardFormatW
GetClassInfoA
GetScrollInfo
GetUpdateRgn
WinHelpW
SendInput
AdjustWindowRect
AttachThreadInput
IsWinEventHookInstalled
FlashWindowEx
SubtractRect
CreateIconIndirect
CreateIconFromResourceEx
LoadCursorFromFileW
GetWindowTextLengthW
GetMonitorInfoW
DrawEdge
ValidateRect
LoadIconW
MsgWaitForMultipleObjects
DeferWindowPos
GetPropA
SetPropA
LoadCursorW
GetWindowLongW
InsertMenuW
AppendMenuW
SetMenuInfo
GetMenuInfo
GetIconInfo
CopyImage
PrintWindow
IsZoomed
AdjustWindowRectEx
GetClassLongW
ScrollDC
SendMessageW
PeekMessageW
GetMessageW
DispatchMessageW
WaitMessage
PostQuitMessage
SetLayeredWindowAttributes
TrackPopupMenuEx
TrackMouseEvent
MonitorFromRect
GetWindowTextLengthA
GetWindowTextW
GetDCEx
GetWindowDC
SetPropW
GetPropW
GetKeyboardLayoutList
RemovePropW
GetWindowPlacement
MonitorFromWindow
UpdateLayeredWindow
SetWindowRgn
DefWindowProcW
SetWindowTextW
LockWindowUpdate
SetWindowsHookExA
UnhookWindowsHookEx
GetMenuStringA
ModifyMenuA
GetWindowInfo
InsertMenuA
AppendMenuA
BeginDeferWindowPos
EndDeferWindowPos
EnumThreadWindows
ReplyMessage
CallNextHookEx
IsWindowEnabled
GetMessageExtraInfo
GetWindowThreadProcessId
SetActiveWindow
GetMessageTime
SetMenu
GetMenu
DrawMenuBar
SetMenuDefaultItem
GetClipCursor
GetCursor
EnableWindow
EnumWindows
IsCharAlphaNumericW
GetKeyboardState
SetKeyboardState
AnimateWindow
RegisterWindowMessageW
SendMessageTimeoutA
GetSubMenu
GetKeyboardLayout
VkKeyScanExW
GetCapture
GetClassNameA
IsMenu
CreateMenu
CopyIcon
GetOpenClipboardWindow
MonitorFromPoint
GetMonitorInfoA
GetForegroundWindow
GetAncestor
IsRectEmpty
GetSystemMenu
EnableMenuItem
GetLastActivePopup
BeginPaint
EndPaint
EnumChildWindows
InvertRect
MoveWindow
GetClassInfoW
RegisterClassA
IsChild
GrayStringA
DrawIcon
GetClassLongA
RegisterWindowMessageA
SetWindowLongW
SendDlgItemMessageW
EndDialog
GetUpdateRect
RedrawWindow
DestroyIcon
LoadIconA
DrawIconEx
DeleteMenu
RemoveMenu
GetMenuState
GetMenuItemID
TrackPopupMenu
CreatePopupMenu
GetMenuItemCount
DestroyMenu
SystemParametersInfoA
CharLowerW
CharUpperW
GetFocus
SetFocus
GetAsyncKeyState
SendDlgItemMessageA
IsDialogMessageA
UpdateWindow
GetDlgItem
DestroyCursor
UnregisterClassW
RegisterClassW
MessageBoxW
GetWindow
SetClassLongA
IsWindow
GetClassNameW
MsgWaitForMultipleObjectsEx
DispatchMessageA
GetDesktopWindow
GetWindowRect
CallWindowProcA
DefDlgProcA
FindWindowW
CreateWindowExW
CreateWindowExA
GetClassInfoExW
RegisterClassExW
PostMessageA
DefWindowProcA
DestroyWindow
GetLastInputInfo
SetForegroundWindow
IsIconic
SetWindowLongA
GetWindowLongA
GetQueueStatus
PeekMessageA
MapWindowPoints
SendMessageA
IsClipboardFormatAvailable
GetClipboardData
SetCapture
ReleaseCapture
GetCursorPos
WindowFromPoint
GetClientRect
EnableScrollBar
SetScrollPos
InvalidateRect
SetScrollRange
GetParent
TranslateMessage
ClipCursor
GetSysColor
DestroyCaret
DrawFocusRect
ClientToScreen
IntersectRect
IsWindowVisible
PostMessageW
ShowWindow
OpenClipboard
EnumClipboardFormats
CloseClipboard
MessageBeep
CreateCaret
SetCaretPos
GetSysColorBrush
SetRectEmpty
CopyRect
OffsetRect
EqualRect
GetActiveWindow
SetRect
InflateRect
FrameRect
GetDC
ReleaseDC
LoadCursorA
SetCursor
UnionRect
PtInRect
FillRect
GetKeyState
DrawTextExW
TabbedTextOutW
DrawCaption
ExcludeUpdateRgn
GetWindowRgn
PaintDesktop
ValidateRgn
LoadBitmapW
DrawStateW
GrayStringW
CloseDesktop
CloseWindowStation
UserHandleGrantAccess
SetUserObjectSecurity
GetUserObjectSecurity
GetThreadDesktop
GetProcessWindowStation
CreateDesktopW
SetProcessWindowStation
GetUserObjectInformationW
CreateWindowStationW
DrawTextA
DrawFrameControl
GetMessagePos
ShowCursor
GetSystemMetrics
ScreenToClient
GetDoubleClickTime
KillTimer
GetComboBoxInfo
SetTimer
LoadImageW
GetTabbedTextExtentW

rpcrt4

NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrClientCall
NdrOleAllocate
NdrOleFree
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
UuidToStringW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
RpcBindingSetAuthInfoA
RpcMgmtIsServerListening
RpcBindingFree
NdrClientCall2
UuidCreate

msvcr90

realloc
_finite
strcpy_s
fprintf
vsprintf_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_crt_debugger_hook
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
wcstol
_vsnprintf
_CIfmod
_wsplitpath_s
iswalpha
strtok_s
fopen_s
fputws
_wdupenv_s
_vscwprintf
modf
_isnan
__CxxFrameHandler3
atoi
_CIlog10
asctime
_localtime64
tolower
wcstoul
strncmp
_time64
_difftime64
wcscat_s
_mbsrchr
strchr
__iob_func
fwprintf
printf
_wfopen_s
fclose
fgets
fwrite
_CxxThrowException
_vswprintf_c_l
_splitpath_s
toupper
_memicmp
swscanf_s
bsearch
iswlower
iswupper
sprintf_s
clock
_mbschr
wcscpy_s
vswprintf_s
_wtol
_itow_s
_recalloc
_resetstkoflw
strstr
_CIlog
iswspace
wcsncat_s
wcstok_s
_errno
_snwprintf_s
_wcsnicmp
_wcslwr_s
_wcsicmp
longjmp
floor
wcsnlen
_wtoi
memmove_s
malloc
free
wcsncmp
swprintf_s
_setjmp3
_CIpow
memcpy_s
_stricmp
strnlen
_snprintf_s
_CIcos
qsort
_CIexp
_CIatan2
_mbsstr
_vsnprintf_s
ceil
_CItan
_CIsin
srand
rand
_CIatan
_vsnwprintf_s
wcscspn
wcsrchr
wcschr
_CIsqrt
_ecvt_s
_controlfp_s
_clearfp
_statusfp
wcsstr
wcsncpy_s
memcpy
memmove
strncpy_s
memset

msi

ord82
ord193
ord155
ord14
ord190
ord137
ord141
ord129
ord203
ord113
ord39
ord66
ord88
ord90
ord45
ord173
ord111
ord70
ord37
ord109

Exports

Exports

??0OdfStgParams@@QAE@XZ
DllCanUnloadNow
DllGetClassObject
DllGetLCID
FInitSdm
MsoMakeCustomItem
MsoMakeFindFile
MsoVBADigSigCreateIndirectData
MsoVBADigSigGetSignedDataMsg
MsoVBADigSigIsMyTypeOfFile
MsoVBADigSigPutSignedDataMsg
MsoVBADigSigRemoveSignedDataMsg
MsoVBADigSigVerifyIndirectData
MsoWintrustFinalPolicy
OfficeSetHelpFilter
_CanCredStoreBeSchemeAware@0
_IsFeaturePresent@4
_MsoAlertWtz@12
_MsoAllowReferenceFromPath@4
_MsoCbRegGetBufferSizeWz@4
_MsoCchLoadSz@16
_MsoCchLoadWz@16
_MsoChsFromLid@4
_MsoCompareStringA@24
_MsoCompareStringW@24
_MsoCpCchSzLenFromWz@8
_MsoCpgFromChs@4
_MsoCrCbvGet@4
_MsoCrCbvGetAccurate@12
_MsoCrashMainThread@4
_MsoCreateIOLDocFromWzPersistentName@12
_MsoDestroyIPref@4
_MsoDestroyITFC@4
_MsoDoFontLinkRgwch@24
_MsoDrawTextW@20
_MsoDwGimmeUserInstallBehavior@8
_MsoDwRegGetDw@4
_MsoDwWhichMessengerRunningEx@0
_MsoExtTextOutW@32
_MsoFActivateControl@4
_MsoFAddinsDisabled@0
_MsoFAnsiCodePageSupportsLCID@8
_MsoFCheckPlexCbSize@8
_MsoFCreateButtonEx@36
_MsoFCreateControl@36
_MsoFCreateIPref@28
_MsoFCreateITFC@16
_MsoFCreateITFCHwnd@20
_MsoFCreateITFCNoAssistant@16
_MsoFCreateStdComponentManager@20
_MsoFCreateToolbarSet@28
_MsoFDigitCh@4
_MsoFDoSmartTagSecurityCheck@8
_MsoFEnsureMsoTypelib@0
_MsoFExecWWWHelp@8
_MsoFFEWch@4
_MsoFGetButtonSize@0
_MsoFGetComponentManager@4
_MsoFGetFontSettings@20
_MsoFGetHelpFile@12
_MsoFGetHelpFileFromWz@12
_MsoFGetMSAAWtz@12
_MsoFGetTbShowKbdShortcuts@0
_MsoFGetTextExtentPointW@16
_MsoFGetTooltips@0
_MsoFGimmeComponentEx@24
_MsoFGimmeFeatureEx@8
_MsoFGimmeFileEx@24
_MsoFHandledMessageNeeded@4
_MsoFHideTaiwan@0
_MsoFIEPolicyAndVersion@8
_MsoFInitOffice@20
_MsoFInitOrapi@0
_MsoFInstallOfficeComponentGroup@4
_MsoFIsFileFromTrustedLocation@4
_MsoFLoadToolbarSet@24
_MsoFLongLoad@8
_MsoFLongSave@8
_MsoFMarkMemCore@8
_MsoFPitbsFromHwndAndMsg@12
_MsoFPuncWch@4
_MsoFRegGetDwCore@8
_MsoFRegReadWz@12
_MsoFRegSetDw@8
_MsoFRegSetSz@8
_MsoFRegSetWz@8
_MsoFRequireSignedAddins@0
_MsoFRgchEqual@20
_MsoFSetComponentManager@4
_MsoFSetHMsoinstOfSdm@4
_MsoFSetTooltips@4
_MsoFSpaceWch@4
_MsoFSzEqual@12
_MsoFUseIEFeature@8
_MsoFVBADigSigSignProject@24
_MsoFWebScriptingEnabled@0
_MsoFWndProc@24
_MsoFWndProcNeeded@4
_MsoFWzEqual@12
_MsoFreeCvsList@4
_MsoFreeFlinfo@4
_MsoFreePv@4
_MsoGetFidCSSeqChkDll@0
_MsoGetFidUspDll@0
_MsoGetFileAttributesW@4
_MsoGetHinstIntl@0
_MsoGetHmodPTLServices@0
_MsoGetIDCRLTokenFromPath@8
_MsoGetInstallLcid@0
_MsoGetNewFileName@12
_MsoGetPublishingPlacesPidl@8
_MsoGetStringTypeExW@20
_MsoGetTextExtentExPointW@28
_MsoGetToolbarMetrics@4
_MsoGetUILcid@0
_MsoGetWWWCmdInfo@20
_MsoHpalOffice@0
_MsoHpalSelect@8
_MsoHrGetIMManager@8
_MsoHrGetMyDocumentsFolder@8
_MsoHrLoadVBAStgFromHTML@8
_MsoHrPrepareForIMShutdown@0
_MsoHrRegisterAll@0
_MsoHrSaveVBAStgAsHTML@12
_MsoHrSetupHTMLImport@8
_MsoHrShowConverterEntryDialog@28
_MsoHrSimpleQueryInterface2@20
_MsoHrSimpleQueryInterface@16
_MsoHtmlHelp@16
_MsoIDCRLDisableDavAutoConnect@0
_MsoInitGimme@12
_MsoInitHicd@4
_MsoInitPluggableUI@0
_MsoInitShrGlobal@4
_MsoIsCapabilityAvailable@4
_MsoLoadLocalizedLibraryEx@12
_MsoLoadStringW@16
_MsoMigrate@8
_MsoMultiByteToWideChar@24
_MsoOffice@8
_MsoPeekMessage@8
_MsoPvAllocCore@4
_MsoPwchStripAmpersandsWtz@4
_MsoPwchStripWtz@8
_MsoPwlfFromFlinfo@8
_MsoRegEnumValueW@28
_MsoRegOpenKeyExW@16
_MsoRegQueryValueExW@20
_MsoReleaseMemCore@4
_MsoReportHangAPCProc@4
_MsoRgchToRgwch@16
_MsoSendMessage@16
_MsoSetLVProperty@8
_MsoSetLocale@4
_MsoSetTbShowKbdShortcuts@4
_MsoSzMarkWzCore@4
_MsoUninitOffice@4
_MsoVBADigSigCallDlg@20
_MsoVBADigSigCallDlgEx@28
_MsoVBADigSigDllRegisterServer@0
_MsoVBADigSigDllUnregisterServer@0
_MsoVBADigSigOpenDlg@52
_MsoVBADigSigVerifyProject@56
_MsoVbaInitSecurity@4
_MsoWchToLower@4
_MsoWchToLowerLid@12
_MsoWchToUpper@4
_MsoWchToUpperLid@12
_MsoWebServerSupportEx@12
_MsoWideCharToMultiByte@32
_MsoWzAfterPath@4
_MsoWzFromIhtk@4
_MsoWzGetUserAgent3@0
_MsoWzMarkSzCore@4
_MsoWzUpper@4

Sections

.text
Size: 15.7MB - Virtual size: 15.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 746KB - Virtual size: 746KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 663KB - Virtual size: 663KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 540KB - Virtual size: 540KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/data/QuickToobar.7z
.7z
office2010/data/ShellNew.7z
.7z
office2010/data/fonts/cambria.ttf
office2010/data/net.7z
.7z
office2010/data/netGAC.7z
.7z
office2010/data/office.dat
office2010/data/ospp.7z
.7z
office2010/data/ospp.dat
office2010/data/page.dotx
.dotx office2007
office2010/data/unist.dat
office2010/data/vcredist.exe
.exe windows x86

092eb6daba2f17cbda102fd1a32acd00

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:b2:9b:00:00:00:00:00:15
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

21/02/2011, 20:53

Not After

21/05/2012, 20:53

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

d0:b8:36:c9:ae:3b:cb:20:6d:59:26:4f:5f:9c:95:6f:4b:15:75:3a
Signer

Actual PE Digest

d0:b8:36:c9:ae:3b:cb:20:6d:59:26:4f:5f:9c:95:6f:4b:15:75:3a

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

19/04/2011, 11:54
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

kernel32

GetDriveTypeA
HeapFree
FormatMessageA
LeaveCriticalSection
DeleteFileA
EnterCriticalSection
TerminateProcess
WaitForMultipleObjects
CreateEventW
SetEvent
Sleep
SetEnvironmentVariableA
GetEnvironmentVariableA
WideCharToMultiByte
HeapAlloc
SetLastError
WriteFile
MoveFileA
ExitProcess
DeleteCriticalSection
FlushFileBuffers
GetVersionExA
WaitForSingleObject
OpenEventA
GetCurrentProcess
GetFileAttributesA
GetCommandLineA
GetModuleFileNameA
CreateFileA
FindNextFileA
FindFirstFileA
CopyFileA
SetFileAttributesA
SystemTimeToFileTime
GetSystemTime
GetDiskFreeSpaceA
QueryDosDeviceA
GetCurrentDirectoryA
SetEndOfFile
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetExitCodeProcess
CreateProcessA
ExpandEnvironmentStringsA
GetFileSize
CreateThread
CreateEventA
GetProcessHeap
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
CloseHandle
DeviceIoControl
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
SetErrorMode
GetTickCount
CreateDirectoryA
GetLastError
RemoveDirectoryA
MoveFileExA
SetFilePointer
FindClose
ReadFile

msvcrt

strchr
_strnicmp
_stricmp
strrchr
_strlwr
strncpy
strstr
_snprintf
sprintf

advapi32

AllocateAndInitializeSid
GetTokenInformation
GetLengthSid
InitiateSystemShutdownA
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
InitializeSecurityDescriptor
OpenProcessToken

user32

ShowWindow
SendDlgItemMessageA
SendMessageA
DialogBoxParamA
LoadStringA
EndDialog
SetParent
MessageBoxA

ntdll

NtShutdownSystem
NtAdjustPrivilegesToken
NtClose
NtOpenProcessToken

comctl32

ord17

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.2MB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/data/wps.dat
office2010/icons/ACCICONS.EXE
.dll windows x86

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

94:04:90:46:ad:e4:73:1c:b8:89:f4:20:ae:73:db:43:e9:19:33:57
Signer

Actual PE Digest

94:04:90:46:ad:e4:73:1c:b8:89:f4:20:ae:73:db:43:e9:19:33:57

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

20/11/2012, 20:24
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/icons/GRAPH.ICO
office2010/icons/Kingsoft.dll
.dll windows x86

3dff24d172f5031d837d000fcf3a81f8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SMapLS_IP_EBP_8
SUnMapLS_IP_EBP_8
SMapLS_IP_EBP_12
SUnMapLS_IP_EBP_12
SMapLS_IP_EBP_16
SUnMapLS_IP_EBP_16
ThunkConnect32
GlobalFree
GetVersion
GlobalAlloc
SMapLS_IP_EBP_8
SUnMapLS_IP_EBP_8
SMapLS_IP_EBP_12
SUnMapLS_IP_EBP_12
SMapLS_IP_EBP_16
SUnMapLS_IP_EBP_16
ThunkConnect32
GlobalFree
GetVersion
GlobalAlloc

pncrt

free
_adjust_fdiv
malloc
_initterm

Exports

Exports

GetDevNodeStatus32Call
thk_ThunkData32

Sections

.text
Size: 1024B - Virtual size: 790B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 494B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 217KB - Virtual size: 217KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 194B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
office2010/icons/MSOICONS.EXE
.dll windows x86

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:02:8e:42:00:00:00:00:00:1f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7d:e0:f7:84:c1:7d:07:23:d1:3b:cd:61:6b:9b:d2:ca:38:ca:0b:8c
Signer

Actual PE Digest

7d:e0:f7:84:c1:7d:07:23:d1:3b:cd:61:6b:9b:d2:ca:38:ca:0b:8c

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

20/11/2012, 20:24
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 456KB - Virtual size: 456KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/icons/PPTICO.EXE
.dll windows x86

Code Sign

33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:7d:d6:15:45:44:fc:14:27:33:41:8a:13:16:4d:ff:10:36:8e:c8
Signer

Actual PE Digest

29:7d:d6:15:45:44:fc:14:27:33:41:8a:13:16:4d:ff:10:36:8e:c8

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

04/03/2014, 23:06
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/icons/WORDICON.EXE
.dll windows x86

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:02:8e:42:00:00:00:00:00:1f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f4:93:40:06:9e:9f:58:fc:24:4e:7f:66:97:f7:02:4f:58:05:41:20
Signer

Actual PE Digest

f4:93:40:06:9e:9f:58:fc:24:4e:7f:66:97:f7:02:4f:58:05:41:20

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

20/11/2012, 20:24
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/icons/XLICONS.EXE
.dll windows x86

Code Sign

33:00:00:00:4c:a1:e8:4d:cc:b4:74:7b:3b:00:00:00:00:00:4c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/11/2013, 22:11

Not After

11/02/2015, 22:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

50:54:b0:1c:12:ea:46:9a:59:45:c5:5f:32:2b:ec:62:a6:e4:ec:b6
Signer

Actual PE Digest

50:54:b0:1c:12:ea:46:9a:59:45:c5:5f:32:2b:ec:62:a6:e4:ec:b6

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

04/03/2014, 23:06
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
office2010/icons/misc.exe
.dll windows x86

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

86:a6:bc:a9:7a:27:8e:2f:59:7f:d5:60:d3:b3:c0:15:a6:c9:7d:57
Signer

Actual PE Digest

86:a6:bc:a9:7a:27:8e:2f:59:7f:d5:60:d3:b3:c0:15:a6:c9:7d:57

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

20/11/2012, 20:24
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 551KB - Virtual size: 551KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:06:27:81:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

61:49:7c:ed:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

cc:77:0d:42:97:71:73:67:a8:9a:b6:5f:8b:b1:9b:be:1f:08:66:72Signer

Signature Validations

Verification

05/03/2009, 06:12 Valid: false

Headers

File Characteristics

Sections

.rsrc Size: 32KB - Virtual size: 32KB

.reloc Size: 4KB - Virtual size: 12B

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:06:27:81:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

61:49:7c:ed:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

cc:77:0d:42:97:71:73:67:a8:9a:b6:5f:8b:b1:9b:be:1f:08:66:72Signer

Signature Validations

Verification

05/03/2009, 06:12 Valid: false

Headers

File Characteristics

Sections

.rsrc Size: 32KB - Virtual size: 32KB

.reloc Size: 4KB - Virtual size: 12B

a72299579db60824fabf4cdcfec2b1ea

Code Sign

33:00:00:00:c6:78:80:36:01:75:1a:69:72:00:00:00:00:00:c6Certificate

Extended Key Usages

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79Certificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:00:8e:87:91:a4:57:1a:5f:ca:3e:00:00:00:00:00:8eCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

95:82:3f:0b:16:47:33:b5:b5:43:c2:39:05:67:06:29:60:65:d2:9d:d9:1d:73:d5:92:13:6b:06:6e:a7:3f:3fSigner

Signature Validations

Verification

21/04/2023, 09:04 Valid: false

65:85:03:49:cd:45:1f:99:de:40:be:62:c6:d1:01:0c:4f:e1:f0:68Signer

Signature Validations

Verification

23/08/2017, 18:52 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:06:27:81:00:00:00:00:00:08
Certificate

61:49:7c:ed:00:00:00:00:00:05
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

cc:77:0d:42:97:71:73:67:a8:9a:b6:5f:8b:b1:9b:be:1f:08:66:72
Signer

05/03/2009, 06:12
Valid: false

.rsrc
Size: 32KB - Virtual size: 32KB

.reloc
Size: 4KB - Virtual size: 12B

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:06:27:81:00:00:00:00:00:08
Certificate

61:49:7c:ed:00:00:00:00:00:05
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

cc:77:0d:42:97:71:73:67:a8:9a:b6:5f:8b:b1:9b:be:1f:08:66:72
Signer

05/03/2009, 06:12
Valid: false

.rsrc
Size: 32KB - Virtual size: 32KB

.reloc
Size: 4KB - Virtual size: 12B

33:00:00:00:c6:78:80:36:01:75:1a:69:72:00:00:00:00:00:c6
Certificate

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:8e:87:91:a4:57:1a:5f:ca:3e:00:00:00:00:00:8e
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

95:82:3f:0b:16:47:33:b5:b5:43:c2:39:05:67:06:29:60:65:d2:9d:d9:1d:73:d5:92:13:6b:06:6e:a7:3f:3f
Signer

21/04/2023, 09:04
Valid: false

65:85:03:49:cd:45:1f:99:de:40:be:62:c6:d1:01:0c:4f:e1:f0:68
Signer

23/08/2017, 18:52
Valid: false

.text
Size: 328KB - Virtual size: 324KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 28KB - Virtual size: 69KB

.idata
Size: 12KB - Virtual size: 8KB

.rsrc
Size: 128KB - Virtual size: 124KB

.reloc
Size: 20KB - Virtual size: 17KB

33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34
Certificate

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

6a:ec:83:fe:7a:e5:f4:32:71:09:24:89:ef:18:69:75:b5:0d:7b:47
Signer

25/06/2013, 21:20
Valid: false

.text
Size: 702KB - Virtual size: 701KB

.data
Size: 226KB - Virtual size: 229KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 27KB - Virtual size: 27KB

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:01:cf:3e:00:00:00:00:00:0f
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:06:94:2d:00:00:00:00:00:09
Certificate

6b:64:8b:3b:42:59:42:00:3f:81:8d:d4:a1:20:ac:5c:b2:e1:69:80
Signer

14/01/2010, 06:30
Valid: false