i640[.]cab | Triage

i640.cab

.cab

ApiClient.dll

.dll windows x64

4157db40ac6eeea6d7839e304d25eee2

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

10:b9:5e:b5:70:d7:0d:c6:b1:69:22:8c:e6:14:78:58:98:d3:83:3b:fa:41:4d:b8:9a:ba:15:71:84:9a:1a:aa
Signer

Actual PE Digest

10:b9:5e:b5:70:d7:0d:c6:b1:69:22:8c:e6:14:78:58:98:d3:83:3b:fa:41:4d:b8:9a:ba:15:71:84:9a:1a:aa

Digest Algorithm

sha256

PE Digest Matches

true

10:b9:5e:b5:70:d7:0d:c6:b1:69:22:8c:e6:14:78:58:98:d3:83:3b:fa:41:4d:b8:9a:ba:15:71:84:9a:1a:aa
Signer

Actual PE Digest

10:b9:5e:b5:70:d7:0d:c6:b1:69:22:8c:e6:14:78:58:98:d3:83:3b:fa:41:4d:b8:9a:ba:15:71:84:9a:1a:aa

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Imports

rpcrt4

NdrClientCall2

RpcMgmtIsServerListening

kernel32

GetStartupInfoW

FindClose

CloseHandle

Sleep

LCMapStringW

FreeLibrary

LoadLibraryExW

GetLastError

GetProcAddress

GetModuleHandleW

GetCurrentProcess

GetModuleHandleExW

EnterCriticalSection

LeaveCriticalSection

InitializeCriticalSectionEx

DeleteCriticalSection

WideCharToMultiByte

EncodePointer

DecodePointer

MultiByteToWideChar

GetStringTypeW

GetCPInfo

InitializeCriticalSectionAndSpinCount

CreateEventW

QueryPerformanceCounter

GetCurrentProcessId

GetCurrentThreadId

GetSystemTimeAsFileTime

InitializeSListHead

RtlCaptureContext

RtlLookupFunctionEntry

RtlVirtualUnwind

IsDebuggerPresent

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsProcessorFeaturePresent

TerminateProcess

RtlUnwindEx

InterlockedFlushSList

RtlPcToFileHeader

RaiseException

SetLastError

TlsAlloc

TlsGetValue

TlsSetValue

TlsFree

HeapSize

ExitProcess

GetModuleFileNameW

HeapFree

HeapAlloc

GetStdHandle

GetFileType

HeapReAlloc

GetProcessHeap

FlsAlloc

FlsGetValue

FlsSetValue

FlsFree

FindFirstFileExW

FindNextFileW

IsValidCodePage

GetACP

GetOEMCP

GetCommandLineA

GetCommandLineW

GetEnvironmentStringsW

FreeEnvironmentStringsW

SetFilePointerEx

SetStdHandle

FlushFileBuffers

WriteFile

GetConsoleOutputCP

GetConsoleMode

CreateFileW

WriteConsoleW

Exports

?Activate@@YAJV?$shared_ptr@VORpcClient@@@std@@PEBU_GUID@@@Z

?ActivateEx@@YAJV?$shared_ptr@VORpcClient@@@std@@PEBU_GUID@@K@Z

?ApplyPolicy@@YA_NV?$shared_ptr@VORpcClient@@@std@@PEB_W111H@Z

?CallReArm@@YAJV?$shared_ptr@VORpcClient@@@std@@PEBU_GUID@@@Z

?CancelUpdate@@YAJV?$shared_ptr@VORpcClient@@@std@@@Z

?CollectFileDiagnostics@@YA_NV?$shared_ptr@VORpcClient@@@std@@PEB_WPEA_WKPEAK@Z

?DetermineIsRepairRequired@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_WAEAH@Z

?DetermineIsRepairRequiredEx@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_WAEAHK@Z

?DoRepairForApp@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W@Z

?DoRepairForAppEx@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_WK@Z

?EnsurePerpetualLicensesFolderExists@@YAJV?$shared_ptr@VORpcClient@@@std@@K@Z

?FetchDBSLicense@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W@Z

?GetClickToRunData@@YAJV?$shared_ptr@VORpcClient@@@std@@HPEB_WPEA_WK@Z

?GetClickToRunDataEx@@YAJV?$shared_ptr@VORpcClient@@@std@@HPEB_WPEA_WKK@Z

?GetPipelineStreamedMegabytes@@YAJV?$shared_ptr@VORpcClient@@@std@@PEAK@Z

?GetPipelineTotalMegabytes@@YAJV?$shared_ptr@VORpcClient@@@std@@PEAK@Z

?GetProcessPoolProcessId@@YAJV?$shared_ptr@VORpcClient@@@std@@PEAK@Z

?GetServiceVersion@@YAJV?$shared_ptr@VORpcClient@@@std@@PEA_WK@Z

?HandleHeartbeatScheduledTask@@YAJV?$shared_ptr@VORpcClient@@@std@@H@Z

?HandleHeartbeatScheduledTaskEx@@YAJV?$shared_ptr@VORpcClient@@@std@@HK@Z

?HandleMigrateOSPPToSPP@@YAJV?$shared_ptr@VORpcClient@@@std@@@Z

?HrSetTenantAssociationKey@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W1@Z

?HrStartUpdatesDiscoveryPeriod@@YAJV?$shared_ptr@VORpcClient@@@std@@@Z

?HrStartUpdatesDiscoveryPeriodEx@@YAJV?$shared_ptr@VORpcClient@@@std@@K@Z

?InstallPOP@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_WHHPEA_WHH@Z

?InstallPOPEx@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_WHHPEA_WHHK@Z

?InvokeProcessKiller@@YAJV?$shared_ptr@VORpcClient@@@std@@HHHPEB_WPEAK@Z

?InvokeProcessKillerEx@@YAJV?$shared_ptr@VORpcClient@@@std@@HHHPEB_W1PEAK@Z

?IsFileInVirtualFolder@@YA_NV?$shared_ptr@VORpcClient@@@std@@PEB_W@Z

?KillQueuedProcesses@@YAJV?$shared_ptr@VORpcClient@@@std@@@Z

?ModifyOfficeProducts@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W1111KH@Z

?PromptUser@@YAJV?$shared_ptr@VORpcClient@@@std@@KPEAKPEB_W@Z

?QueueTaskItem@@YAJV?$shared_ptr@VORpcClient@@@std@@U_GUID@@@Z

?QueueUpdate@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W@Z

?QueueUpdateEx@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_WK@Z

?QueueUpdateOnlyApply@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W@Z

?RaiseTaskDialogEvent@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W1@Z

?RaiseTaskErrorEvent2@@YAJV?$shared_ptr@VORpcClient@@@std@@KKKPEB_W@Z

?RaiseTaskErrorEvent3@@YAJV?$shared_ptr@VORpcClient@@@std@@KKKKPEB_W@Z

?RaiseTaskErrorEvent@@YAJV?$shared_ptr@VORpcClient@@@std@@KKK@Z

?RaiseTaskProgressEvent@@YAJV?$shared_ptr@VORpcClient@@@std@@U_GUID@@K@Z

?RaiseTaskToastEvent@@YAJV?$shared_ptr@VORpcClient@@@std@@H@Z

?RestartKilledProcesses@@YAJV?$shared_ptr@VORpcClient@@@std@@@Z

?SetC2RProperty@@YA_NV?$shared_ptr@VORpcClient@@@std@@PEB_WK1KK@Z

?SetPolicyOverride@@YA_NV?$shared_ptr@VORpcClient@@@std@@PEB_W111@Z

?SetPrivacySettings@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_WKKK1KK1KK1KK1KK1@Z

?UninstallPOP@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W@Z

?UninstallPOPEx@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_WK@Z

Activate

ActivateEx

ApplyPolicy

CancelUpdate

CollectFileDiagnostics

DeleteAFOTask

DetermineIsRepairRequired

DetermineIsRepairRequiredEx

DoRepairForApp

DoRepairForAppEx

GetClickToRunData

GetClickToRunDataEx

GetPipelineStreamedMegabytes

GetPipelineTotalMegabytes

GetProcessPoolProcessId

GetServiceVersion

HrSetTenantAssociationKey

HrStartUpdatesDiscoveryPeriod

HrStartUpdatesDiscoveryPeriodEx

InvokeProcessKiller

InvokeProcessKillerEx

IsFileInVirtualFolder

KillQueuedProcesses

ModifyOfficeProducts

PromptUser

QueueTaskItem

QueueUpdate

QueueUpdateEx

QueueUpdateOnlyApply

RaiseTaskDialogEvent

RaiseTaskErrorEvent

RaiseTaskErrorEvent2

RaiseTaskErrorEvent3

RaiseTaskProgressEvent

RaiseTaskToastEvent

RestartKilledProcesses

SetPolicyOverride

Sections

.text
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AppVCatalog.dll

.dll windows x64

e555fdd1d448a5a20e8ceb61ae4b2394

Code Sign

33:00:00:03:df:fb:6a:e3:f4:27:ec:b6:a3:00:00:00:00:03:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

f8:6e:8e:24:ba:fb:90:5f:1b:ab:09:dc:a8:39:9a:c5:a3:6b:d7:62:bf:89:ff:ca:f7:50:2b:a7:76:1c:81:aa
Signer

Actual PE Digest

f8:6e:8e:24:ba:fb:90:5f:1b:ab:09:dc:a8:39:9a:c5:a3:6b:d7:62:bf:89:ff:ca:f7:50:2b:a7:76:1c:81:aa

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Imports

api-ms-win-crt-string-l1-1-0

wcsnlen

strcspn

memset

wcsncmp

api-ms-win-crt-locale-l1-1-0

_unlock_locales

_lock_locales

api-ms-win-crt-runtime-l1-1-0

_initterm

_initterm_e

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment

_o__initialize_onexit_table

_o__invalid_parameter_noinfo

_o__invalid_parameter_noinfo_noreturn

_o__purecall

_o__register_onexit_function

_o__seh_filter_dll

_o__stricmp

_o__ultow_s

_o__waccess

memmove

_o__wcsdup

_o__wcsicmp

_o__wcsnicmp

_o__wcsupr_s

_o__wtoi

_o_abort

_o_calloc

_o_ceilf

_o_free

_o_frexp

_o_isspace

_o_iswalpha

_o_iswdigit

_o_ldexp

_o_localeconv

_o_malloc

_o_pow

_o_powf

_o_setlocale

_o_strtod

_o_strtof

_o_terminate

_o_tolower

_o_towupper

_o_wcscpy_s

__uncaught_exception

__C_specific_handler

__current_exception

__current_exception_context

_CxxThrowException

_o__execute_onexit_table

_o__errno

wcschr

_o__crt_atexit

_o__configure_narrow_argv

_o__cexit

_o__calloc_base

_o__callnewh

_o___stdio_common_vswprintf_s

_o___stdio_common_vswprintf

_o___stdio_common_vsprintf_s

_o___stdio_common_vsnprintf_s

_o___std_type_info_destroy_list

_o___std_exception_destroy

_o___std_exception_copy

_o___pctype_func

_o____mb_cur_max_func

_o____lc_locale_name_func

_o____lc_codepage_func

strrchr

__CxxFrameHandler3

__RTDynamicCast

memchr

memcmp

memcpy

shlwapi

PathFileExistsW

kernel32

InitializeCriticalSectionAndSpinCount

HeapDestroy

HeapReAlloc

AcquireSRWLockExclusive

VirtualQuery

GetSystemInfo

LoadLibraryExA

VirtualProtect

FreeLibrary

GetTempFileNameW

MoveFileExW

SetFileAttributesW

GetTempPathW

SetFileTime

FindFirstFileW

IsWow64Process

CreateSemaphoreExW

HeapFree

SetLastError

ReleaseSemaphore

GetModuleHandleExW

WaitForSingleObject

CreateFileW

CreateEventW

ReleaseSRWLockShared

GetLocalTime

AcquireSRWLockShared

SystemTimeToFileTime

ReleaseMutex

FormatMessageW

GetModuleFileNameA

ReleaseSRWLockExclusive

GetCurrentThreadId

InitializeSRWLock

GetLastError

Sleep

GetFileAttributesW

HeapSize

GetFileAttributesExW

OutputDebugStringW

InitializeSListHead

GetSystemTimeAsFileTime

QueryPerformanceCounter

IsProcessorFeaturePresent

TerminateProcess

GetCurrentProcess

SetUnhandledExceptionFilter

UnhandledExceptionFilter

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

LCMapStringEx

DecodePointer

EncodePointer

InitializeCriticalSectionEx

WideCharToMultiByte

GetStringTypeW

MultiByteToWideChar

FileTimeToSystemTime

DeleteCriticalSection

DisableThreadLibraryCalls

InitializeCriticalSection

LeaveCriticalSection

EnterCriticalSection

DeleteFileW

CreateHardLinkW

RemoveDirectoryW

FindClose

FindNextFileW

FindFirstFileExW

IsDebuggerPresent

DebugBreak

GetModuleHandleW

GetProcessHeap

GetCurrentProcessId

CreateMutexExW

GetProcAddress

HeapAlloc

RaiseException

CloseHandle

OpenSemaphoreW

WaitForSingleObjectEx

GetCurrentThread

advapi32

RegQueryValueExW

EventWriteTransfer

RegCloseKey

EventActivityIdControl

OpenThreadToken

SetThreadToken

EventUnregister

EventRegister

RegDeleteValueW

RegSetValueExW

RegOpenKeyExW

RegDeleteTreeW

RegCreateKeyExW

RegQueryInfoKeyW

RegOpenCurrentUser

RegDeleteKeyExW

RevertToSelf

ImpersonateLoggedOnUser

ole32

CoTaskMemFree

CLSIDFromString

shell32

ord165

SHGetKnownFolderPath

appvpolicy

ord3

ord6

ord8

ord7

appvmanifest

ord3

oleaut32

SysFreeString

SysAllocString

VariantCopy

VariantClear

Exports

Deinitialize

GetClientCatalog

GetComponent

Initialize

InitializeISV

Sections

.text
Size: 320KB - Virtual size: 317KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 224KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AppVClient.man

.xml

AppVClientIsv.man

.xml

AppVFileSystemMetadata.dll

.dll windows x64

9688b6ed1c94441fbe8d8b0a6da389b7

Code Sign

33:00:00:03:df:fb:6a:e3:f4:27:ec:b6:a3:00:00:00:00:03:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

59:c8:cf:5f:f0:86:d5:8f:e7:18:1a:e8:44:a6:47:01:f1:1c:9c:e7:1f:cc:af:64:ad:13:e6:bc:4c:f2:f5:f5
Signer

Actual PE Digest

59:c8:cf:5f:f0:86:d5:8f:e7:18:1a:e8:44:a6:47:01:f1:1c:9c:e7:1f:cc:af:64:ad:13:e6:bc:4c:f2:f5:f5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Imports

api-ms-win-crt-string-l1-1-0

memset

strcspn

wcsnlen

wcsncmp

api-ms-win-crt-locale-l1-1-0

_unlock_locales

_lock_locales

api-ms-win-crt-runtime-l1-1-0

_initterm_e

_initterm

api-ms-win-crt-private-l1-1-0

_o__crt_atexit

_o__errno

_o__execute_onexit_table

_o__initialize_narrow_environment

_o__initialize_onexit_table

_o__invalid_parameter_noinfo_noreturn

_o__purecall

_o__register_onexit_function

_o__seh_filter_dll

_o__stricmp

memmove

_o__wcsdup

_o__wcsicmp

_o__wtoi

_o_abort

_o_calloc

_o_free

_o_frexp

_o_iswalpha

_o_iswdigit

_o_localeconv

_o_malloc

_o_setlocale

_o_terminate

_o_wcscpy_s

__uncaught_exception

__C_specific_handler

__current_exception

__current_exception_context

_CxxThrowException

_o___stdio_common_vsprintf_s

_o__configure_narrow_argv

_o___std_type_info_destroy_list

_o___std_exception_destroy

_o___std_exception_copy

_o___pctype_func

wcschr

_o__cexit

_o____mb_cur_max_func

_o____lc_locale_name_func

_o____lc_codepage_func

strrchr

__CxxFrameHandler3

_o__calloc_base

_o__callnewh

memcmp

memcpy

kernel32

CopyFileExW

GetTempFileNameW

MoveFileExW

DeleteFileW

SetFileAttributesW

FindClose

GetTempPathW

RemoveDirectoryW

FindNextFileW

SetLastError

FindFirstFileW

CreateEventW

InitializeCriticalSectionAndSpinCount

CloseHandle

FindResourceW

LockResource

GetLastError

SizeofResource

GetModuleHandleW

IsDebuggerPresent

InitializeSListHead

GetSystemTimeAsFileTime

GetCurrentThreadId

GetCurrentProcessId

QueryPerformanceCounter

IsProcessorFeaturePresent

TerminateProcess

GetCurrentProcess

SetUnhandledExceptionFilter

UnhandledExceptionFilter

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

LCMapStringEx

DecodePointer

EncodePointer

DeleteCriticalSection

InitializeCriticalSectionEx

LeaveCriticalSection

WideCharToMultiByte

GetStringTypeW

MultiByteToWideChar

DebugBreak

LoadLibraryW

FreeLibrary

GetProcAddress

GetModuleHandleExW

LoadResource

oleaut32

VariantClear

SysAllocString

SysFreeString

VariantCopy

VariantInit

advapi32

EventUnregister

EventRegister

EventWriteTransfer

ole32

CoCreateInstance

Exports

CreateFilesystemMetadataFromFile

CreateFilesystemMetadataFromStream

Sections

.text
Size: 104KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AppVIntegration.dll

.dll windows x64

6cc40ca246db277e777dd9c1d22c02f7

Code Sign

33:00:00:03:df:fb:6a:e3:f4:27:ec:b6:a3:00:00:00:00:03:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

e6:8d:cb:c8:82:78:c2:b2:fa:35:b2:28:bb:a2:8e:09:77:3b:ce:37:e0:62:10:72:58:70:f1:15:f0:23:ed:de
Signer

Actual PE Digest

e6:8d:cb:c8:82:78:c2:b2:fa:35:b2:28:bb:a2:8e:09:77:3b:ce:37:e0:62:10:72:58:70:f1:15:f0:23:ed:de

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm

_initterm_e

api-ms-win-crt-private-l1-1-0

_o__malloc_base

_o__purecall

_o__register_onexit_function

_o__resetstkoflw

_o__seh_filter_dll

_o__stricmp

_o__ultow_s

_o__wcsdup

_o__wcsicmp

_o__wcslwr_s

_o__wcsnicmp

_o__wcsupr_s

memmove

_o__wmakepath_s

_o__wsplitpath_s

_o__wtoi

_o_calloc

_o_ceilf

_o_free

_o_frexp

_o_isspace

_o_iswalpha

_o_iswctype

_o_iswdigit

_o_iswspace

_o_ldexp

_o_localeconv

_o_malloc

_o_pow

_o_powf

_o_rand

_o_realloc

_o_setlocale

_o_srand

_o_strtod

_o_strtof

_o_terminate

_o_tolower

_o_towupper

_o_wcscpy_s

__C_specific_handler

__current_exception

__current_exception_context

__RTDynamicCast

_CxxThrowException

strchr

_o__free_base

_o__execute_onexit_table

_o__errno

_o__crt_atexit

_o__configure_narrow_argv

_o__cexit

_o__calloc_base

_o__callnewh

_o___stdio_common_vswscanf

_o___stdio_common_vswprintf_s

_o___stdio_common_vswprintf

_o___stdio_common_vsprintf_s

_o___stdio_common_vsnprintf_s

_o___std_type_info_destroy_list

_o___std_exception_destroy

_o___std_exception_copy

_o__invalid_parameter_noinfo_noreturn

_o__invalid_parameter_noinfo

_o__initialize_onexit_table

_o__initialize_narrow_environment

_o___pctype_func

_o_abort

__std_type_info_compare

wcschr

wcsstr

__uncaught_exception

_o____mb_cur_max_func

_o____lc_locale_name_func

_o____lc_collate_cp_func

_o____lc_codepage_func

strrchr

__CxxFrameHandler3

memchr

memcmp

memcpy

api-ms-win-crt-string-l1-1-0

wcsncmp

wcsnlen

strcspn

memset

advapi32

EventUnregister

EventWriteTransfer

OpenThreadToken

DuplicateToken

OpenProcessToken

RegCloseKey

CreateProcessAsUserW

EventActivityIdControl

RegQueryValueExW

RegOpenKeyExW

SetThreadToken

RegEnumValueW

RegDeleteValueW

RegSetValueExW

RegEnumKeyExW

RegQueryInfoKeyW

RegDeleteKeyExW

GetTokenInformation

ConvertSidToStringSidW

RegCreateKeyExW

RegOpenCurrentUser

CryptAcquireContextW

CryptCreateHash

CryptHashData

CryptDestroyHash

CryptGetHashParam

CryptReleaseContext

RevertToSelf

ImpersonateLoggedOnUser

GetLengthSid

IsValidSid

CopySid

MakeAbsoluteSD

MakeSelfRelativeSD

GetSecurityDescriptorLength

InitializeAcl

InitializeSecurityDescriptor

AddAce

GetSecurityDescriptorOwner

GetSecurityDescriptorControl

GetSecurityDescriptorGroup

SetSecurityDescriptorOwner

GetAclInformation

GetSecurityDescriptorDacl

SetSecurityDescriptorDacl

GetSecurityDescriptorSacl

RegSetKeySecurity

SetSecurityDescriptorControl

MapGenericMask

EqualSid

GetAce

AccessCheck

RegGetKeySecurity

AdjustTokenPrivileges

LookupPrivilegeValueW

EventRegister

kernel32

DeleteFileW

GetFileAttributesW

FindClose

GetFinalPathNameByHandleW

FindNextFileW

FindFirstFileW

IsWow64Process

GetSystemWow64DirectoryW

ExpandEnvironmentStringsW

GetNativeSystemInfo

GetModuleFileNameW

FormatMessageW

MultiByteToWideChar

GetProcessHeap

HeapAlloc

GetVersionExW

HeapFree

ResetEvent

LocalFree

CreateFileW

DeviceIoControl

CreateProcessW

RaiseException

CreateThreadpoolWork

GetExitCodeProcess

SetLastError

CreateThreadpoolCleanupGroup

SetThreadpoolThreadMaximum

Sleep

CloseThreadpoolCleanupGroup

SetThreadpoolThreadMinimum

CreateThreadpool

CloseThreadpool

CloseThreadpoolWork

RemoveDirectoryW

DebugBreak

DeleteCriticalSection

CloseHandle

GetCurrentThread

SetEvent

GetLastError

CreateEventW

DuplicateHandle

WaitForSingleObject

InitializeCriticalSection

LeaveCriticalSection

EnterCriticalSection

FreeLibrary

GetProcAddress

GetModuleHandleExW

TerminateProcess

GetCurrentProcess

GetModuleHandleW

IsProcessorFeaturePresent

SetUnhandledExceptionFilter

UnhandledExceptionFilter

IsDebuggerPresent

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

InitializeSListHead

GetSystemTimeAsFileTime

GetCurrentThreadId

GetCurrentProcessId

QueryPerformanceCounter

DisableThreadLibraryCalls

MoveFileExW

CloseThreadpoolCleanupGroupMembers

WideCharToMultiByte

GetSystemDirectoryW

LoadLibraryA

LoadLibraryW

GetComputerNameExW

GetCurrentDirectoryW

SearchPathW

GetLongPathNameW

GetShortPathNameW

GetEnvironmentVariableW

GetTempPathW

MoveFileW

GetModuleFileNameA

OutputDebugStringW

GetDriveTypeW

CopyFileW

Wow64RevertWow64FsRedirection

Wow64DisableWow64FsRedirection

CopyFileExW

GetTempFileNameW

SetFileAttributesW

HeapSize

HeapReAlloc

HeapDestroy

GetStringTypeW

InitializeCriticalSectionEx

EncodePointer

DecodePointer

LCMapStringEx

CompareStringEx

InitializeCriticalSectionAndSpinCount

WaitForSingleObjectEx

SubmitThreadpoolWork

msi

ord160

ord32

ord118

ord8

ord217

ord96

ord49

ord173

ord159

ntdll

NtQueryKey

ole32

CoUninitialize

CoTaskMemFree

CLSIDFromString

CoCreateInstance

CoInitializeEx

CoCreateGuid

CoTaskMemAlloc

StringFromGUID2

oleaut32

VariantChangeType

VariantClear

SysAllocString

SysFreeString

VariantInit

VariantCopy

rpcrt4

RpcMgmtSetCancelTimeout

RpcBindingFromStringBindingW

RpcStringBindingComposeW

RpcBindingSetAuthInfoExW

RpcStringFreeW

RpcMgmtIsServerListening

RpcBindingFree

RpcCancelThread

UuidCreate

NdrClientCall2

shell32

SHGetKnownFolderPath

SHGetFolderPathW

ord165

shlwapi

PathIsUNCW

PathCanonicalizeW

SHCreateStreamOnFileEx

PathFileExistsW

PathFindExtensionW

userenv

CreateEnvironmentBlock

GetUserProfileDirectoryW

ExpandEnvironmentStringsForUserW

DestroyEnvironmentBlock

UnloadUserProfile

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

_lock_locales

_unlock_locales

Exports

Deinitialize

GetComponent

Initialize

InitializeISV

Sections

.text
Size: 956KB - Virtual size: 954KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 532KB - Virtual size: 528KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AppVIsvApi.dll

.dll windows x64

2d2eff9efce53528c0e44f5ea7125f5c

Code Sign

33:00:00:03:df:fb:6a:e3:f4:27:ec:b6:a3:00:00:00:00:03:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

97:53:93:8b:e9:87:d7:90:4a:88:f4:a2:3e:5e:81:03:e7:57:20:b1:ad:c6:d4:bb:8c:d0:06:21:0b:32:cb:e3
Signer

Actual PE Digest

97:53:93:8b:e9:87:d7:90:4a:88:f4:a2:3e:5e:81:03:e7:57:20:b1:ad:c6:d4:bb:8c:d0:06:21:0b:32:cb:e3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Imports

api-ms-win-crt-string-l1-1-0

wcsnlen

strcspn

memset

api-ms-win-crt-locale-l1-1-0

_lock_locales

_unlock_locales

api-ms-win-crt-runtime-l1-1-0

_initterm_e

_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment

_o__initialize_onexit_table

_o__invalid_parameter_noinfo

_o__invalid_parameter_noinfo_noreturn

_o__purecall

_o__register_onexit_function

_o__seh_filter_dll

_o__stricmp

memmove

_o__wcsdup

_o__wcsicmp

_o__wtoi

_o_abort

_o_calloc

_o_free

_o_frexp

_o_iswdigit

_o_iswspace

_o_localeconv

_o_malloc

_o_setlocale

_o_terminate

_o_towupper

__uncaught_exception

__C_specific_handler

__current_exception

__current_exception_context

_CxxThrowException

_o__execute_onexit_table

_o__errno

_o__crt_atexit

_o__configure_narrow_argv

_o__cexit

_o__calloc_base

_o__callnewh

_o__beginthreadex

_o___stdio_common_vswprintf_s

_o___stdio_common_vsprintf_s

_o___std_type_info_destroy_list

_o___std_exception_destroy

_o___std_exception_copy

_o___pctype_func

_o____mb_cur_max_func

_o____lc_locale_name_func

_o____lc_codepage_func

strrchr

__CxxFrameHandler3

__RTDynamicCast

memcpy

kernel32

GetModuleFileNameW

InitializeCriticalSectionAndSpinCount

GetExitCodeThread

WaitForMultipleObjects

FreeLibrary

GetProcAddress

LoadLibraryW

CreateThreadpoolWork

SubmitThreadpoolWork

CreateThreadpoolCleanupGroup

SetThreadpoolThreadMaximum

CloseThreadpoolCleanupGroupMembers

CloseThreadpoolCleanupGroup

SetThreadpoolThreadMinimum

CreateThreadpool

CloseThreadpool

CloseThreadpoolWork

RaiseException

GetCurrentThread

GetModuleHandleW

IsDebuggerPresent

InitializeSListHead

GetSystemTimeAsFileTime

GetCurrentProcessId

QueryPerformanceCounter

IsProcessorFeaturePresent

TerminateProcess

GetCurrentProcess

SetUnhandledExceptionFilter

UnhandledExceptionFilter

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

LCMapStringEx

DecodePointer

EncodePointer

InitializeCriticalSectionEx

WideCharToMultiByte

GetStringTypeW

LocalFree

MultiByteToWideChar

GetSystemTime

SystemTimeToFileTime

DeleteCriticalSection

GetLocalTime

ResetEvent

CloseHandle

SetEvent

GetLastError

CreateEventW

WaitForSingleObject

InitializeCriticalSection

LeaveCriticalSection

EnterCriticalSection

AcquireSRWLockShared

ReleaseSRWLockShared

AcquireSRWLockExclusive

DisableThreadLibraryCalls

ReleaseSRWLockExclusive

GetCurrentThreadId

InitializeSRWLock

CallbackMayRunLong

GetComputerNameExW

ole32

CoInitializeEx

CoUninitialize

advapi32

EventActivityIdControl

EventUnregister

RevertToSelf

ImpersonateLoggedOnUser

LookupAccountSidW

ConvertSidToStringSidW

GetTokenInformation

EventRegister

EventWriteTransfer

OpenThreadToken

SetThreadToken

DuplicateTokenEx

appvpolicy

ord1

ord8

ord6

ord3

ord4

userenv

LoadUserProfileW

UnloadUserProfile

wtsapi32

WTSQuerySessionInformationW

WTSEnumerateSessionsW

WTSFreeMemory

WTSQueryUserToken

netapi32

DsGetDcNameW

NetApiBufferFree

NetUserGetInfo

secur32

GetUserNameExW

Exports

CancelPackageLoad

ConfigurePackage

ConfigurePackageGroup

Deinitialize

GetPackageBytesLoaded

Initialize

LoadPackage

LoadPackageRanges

PublishPackage

PublishPackageGroup

RegisterForEvents

ReintegratePackage

ReintegrateVirtualApplications

RemovePackage

RemovePackageGroup

SetEventFilter

UnpublishPackage

UnpublishPackageGroup

UnregisterForEvents

UserLogoff

UserLogon

Sections

.text
Size: 180KB - Virtual size: 179KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 176KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AppVIsvStreamingManager.dll

.dll windows x64

4122be163be3d45aa31a263daba45956

Code Sign

33:00:00:03:df:fb:6a:e3:f4:27:ec:b6:a3:00:00:00:00:03:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

27:69:23:06:8c:95:00:fe:d3:c1:10:62:d7:77:83:48:88:22:3b:23:48:0a:94:bf:68:fd:6e:1d:cc:b6:8d:41
Signer

Actual PE Digest

27:69:23:06:8c:95:00:fe:d3:c1:10:62:d7:77:83:48:88:22:3b:23:48:0a:94:bf:68:fd:6e:1d:cc:b6:8d:41

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e

_initterm

api-ms-win-crt-private-l1-1-0

_o__execute_onexit_table

_o__initialize_narrow_environment

_o__initialize_onexit_table

_o__invalid_parameter_noinfo_noreturn

_o__purecall

_o__register_onexit_function

_o__seh_filter_dll

_o__stricmp

memmove

_o__wcsnicmp

_o_free

_o_iswalpha

_o_malloc

_o_terminate

_o_wcscpy_s

__C_specific_handler

__RTDynamicCast

_CxxThrowException

_o__crt_atexit

_o__configure_narrow_argv

_o__cexit

_o__callnewh

wcschr

_o___std_type_info_destroy_list

_o___std_exception_destroy

_o___std_exception_copy

strrchr

__CxxFrameHandler3

memcmp

memcpy

api-ms-win-crt-string-l1-1-0

memset

wcsncmp

appvmanifest

ord2

advapi32

EventWriteTransfer

kernel32

CopyFileExW

GetTempFileNameW

MoveFileExW

GetTempPathW

Wow64RevertWow64FsRedirection

DecodePointer

InitializeCriticalSectionEx

SetLastError

Wow64DisableWow64FsRedirection

CreateEventW

DisableThreadLibraryCalls

EnterCriticalSection

LeaveCriticalSection

GetCurrentThreadId

GetProcAddress

DeleteCriticalSection

GetModuleHandleW

QueryPerformanceCounter

GetCurrentProcessId

InitializeCriticalSectionAndSpinCount

GetSystemTimeAsFileTime

CompareStringW

CloseHandle

DeleteFileW

GetLastError

SetFileAttributesW

FindClose

RemoveDirectoryW

FindNextFileW

FindFirstFileW

TerminateProcess

GetCurrentProcess

IsProcessorFeaturePresent

SetUnhandledExceptionFilter

UnhandledExceptionFilter

IsDebuggerPresent

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

InitializeSListHead

InitializeCriticalSection

ole32

CoTaskMemFree

CoCreateInstance

oleaut32

VariantCopy

SysAllocString

VariantClear

shell32

SHGetKnownFolderPath

user32

CharLowerW

Exports

Deinitialize

GetComponent

Initialize

InitializeISV

Sections

.text
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AppVIsvSubsystemController.dll

.dll windows x64

3b9a02839d7b903e6bd632ccad3110cb

Code Sign

33:00:00:03:df:fb:6a:e3:f4:27:ec:b6:a3:00:00:00:00:03:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

37:2c:59:c7:8b:69:6d:45:4d:6e:7f:3f:93:6a:02:59:c6:69:15:29:39:e7:39:2b:ba:69:02:78:98:1c:b6:08
Signer

Actual PE Digest

37:2c:59:c7:8b:69:6d:45:4d:6e:7f:3f:93:6a:02:59:c6:69:15:29:39:e7:39:2b:ba:69:02:78:98:1c:b6:08

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Imports

api-ms-win-crt-string-l1-1-0

wcsncmp

wcsnlen

memset

strcspn

api-ms-win-crt-locale-l1-1-0

_unlock_locales

_lock_locales

api-ms-win-crt-runtime-l1-1-0

_initterm

_initterm_e

api-ms-win-crt-private-l1-1-0

_o__malloc_base

_o__purecall

_o__register_onexit_function

_o__resetstkoflw

_o__seh_filter_dll

_o__stricmp

_o__wcsdup

_o__wcsicmp

_o__wcslwr_s

_o__wcsnicmp

_o__wcsupr_s

memmove

_o__wsplitpath_s

_o__wtoi

_o_abort

_o_calloc

_o_ceilf

_o_free

_o_frexp

_o_isspace

_o_iswalpha

_o_iswdigit

_o_iswspace

_o_ldexp

_o_localeconv

_o_malloc

_o_pow

_o_powf

_o_realloc

_o_setlocale

_o_strtod

_o_strtof

_o_terminate

_o_tolower

_o_towupper

_o_wcscpy_s

_o_wcsncpy_s

_o_wcstol

_o_wmemcpy_s

__uncaught_exception

__current_exception

__current_exception_context

_CxxThrowException

_o__invalid_parameter_noinfo_noreturn

_o__invalid_parameter_noinfo

_o__initialize_onexit_table

_o__initialize_narrow_environment

_o__free_base

strchr

__std_type_info_compare

wcschr

_o__execute_onexit_table

_o__errno

_o__crt_atexit

_o__configure_narrow_argv

_o__cexit

_o__calloc_base

_o__callnewh

_o___stdio_common_vswprintf_s

_o___stdio_common_vswprintf

_o___stdio_common_vsprintf_s

_o___stdio_common_vsnwprintf_s

_o___stdio_common_vsnprintf_s

_o___std_type_info_destroy_list

_o___std_exception_destroy

_o___std_exception_copy

_o___pctype_func

_o____mb_cur_max_func

_o____lc_locale_name_func

_o____lc_collate_cp_func

_o____lc_codepage_func

__C_specific_handler

strrchr

__CxxFrameHandler3

__RTDynamicCast

memchr

memcmp

memcpy

advapi32

OpenServiceW

RegSetValueExW

EventUnregister

EventRegister

GetTokenInformation

OpenThreadToken

GetLengthSid

ConvertSidToStringSidW

DuplicateToken

CreateProcessAsUserW

RegEnumValueW

SetThreadToken

OpenProcessToken

IsValidSid

CopySid

EventWriteTransfer

RegQueryValueExW

RegOpenKeyExW

CheckTokenMembership

InitializeSid

GetSidLengthRequired

RegDeleteValueW

RegDeleteTreeW

RegEnumKeyExW

GetSidSubAuthority

EqualSid

RegCloseKey

ImpersonateLoggedOnUser

RevertToSelf

RegCreateKeyExW

ConvertStringSecurityDescriptorToSecurityDescriptorW

GetSidSubAuthorityCount

GetSidIdentifierAuthority

SetSecurityDescriptorGroup

MakeAbsoluteSD

MakeSelfRelativeSD

GetSecurityDescriptorLength

InitializeAcl

InitializeSecurityDescriptor

AddAce

GetSecurityDescriptorOwner

GetSecurityDescriptorControl

GetSecurityDescriptorGroup

SetSecurityDescriptorOwner

GetAclInformation

GetSecurityDescriptorDacl

SetSecurityDescriptorDacl

GetSecurityDescriptorSacl

EventActivityIdControl

RegQueryInfoKeyW

StartServiceW

OpenSCManagerW

CloseServiceHandle

RegSetKeySecurity

RegOpenCurrentUser

RegDeleteKeyExW

kernel32

QueueUserWorkItem

DisconnectNamedPipe

PeekNamedPipe

ReleaseSemaphore

GetVolumePathNameW

DebugBreak

GetTickCount

GetVersionExW

QueryFullProcessImageNameW

GetSystemDirectoryW

GetShortPathNameW

GetLongPathNameW

SearchPathW

GetModuleFileNameW

FlushFileBuffers

MapViewOfFile

CreateFileMappingW

FlushViewOfFile

UnmapViewOfFile

OpenFileMappingW

ReadFile

Sleep

DuplicateHandle

GetFileAttributesW

CreateFileW

FindClose

ExpandEnvironmentStringsW

FindNextFileW

FindFirstFileW

GetNativeSystemInfo

InitializeCriticalSectionAndSpinCount

LoadLibraryA

GetOverlappedResult

FreeLibrary

GetModuleFileNameA

CreateSemaphoreExW

WaitForThreadpoolTimerCallbacks

FormatMessageW

OutputDebugStringW

CloseThreadpoolTimer

WaitForSingleObjectEx

OpenSemaphoreW

SetThreadpoolTimer

CreateThreadpoolTimer

CreateMutexExW

Wow64DisableWow64FsRedirection

Wow64RevertWow64FsRedirection

TransactNamedPipe

InitializeSRWLock

EnterCriticalSection

LeaveCriticalSection

InitializeCriticalSection

GetModuleHandleExW

DisableThreadLibraryCalls

CreateMutexW

WaitForSingleObject

VirtualProtect

VirtualQueryEx

ReadProcessMemory

VirtualAllocEx

VirtualProtectEx

ResumeThread

SetLastError

WriteProcessMemory

LoadLibraryW

IsDebuggerPresent

InitializeSListHead

GetSystemTimeAsFileTime

GetCurrentProcessId

QueryPerformanceCounter

IsProcessorFeaturePresent

TerminateProcess

SetUnhandledExceptionFilter

UnhandledExceptionFilter

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

CompareStringEx

LCMapStringEx

DecodePointer

EncodePointer

InitializeCriticalSectionEx

GetStringTypeW

MultiByteToWideChar

GetEnvironmentVariableW

CompareStringW

HeapDestroy

GetProcessHeap

HeapAlloc

HeapFree

HeapReAlloc

HeapSize

AcquireSRWLockShared

ResetEvent

ReleaseSRWLockShared

AcquireSRWLockExclusive

SetEvent

ReleaseSRWLockExclusive

CreateEventW

WaitForMultipleObjects

GetExitCodeProcess

IsWow64Process

WideCharToMultiByte

CreateProcessW

LocalFree

RaiseException

GetCurrentThread

OpenProcess

GetCurrentProcess

GetModuleHandleW

DeleteCriticalSection

CloseHandle

GetLastError

ReleaseMutex

GetCurrentThreadId

GetProcAddress

ntdll

RtlNtStatusToDosError

NtQueryInformationProcess

RtlInitUnicodeString

NtOpenJobObject

oleaut32

VariantInit

SysAllocString

VariantClear

SysFreeString

rpcrt4

NdrServerCall2

RpcImpersonateClient

RpcRevertToSelf

RpcBindingInqAuthClientW

RpcServerUseProtseqEpW

RpcServerUnregisterIf

RpcServerRegisterIf2

RpcServerListen

RpcServerRegisterAuthInfoW

userenv

ExpandEnvironmentStringsForUserW

UnloadUserProfile

user32

CharLowerW

EnumWindows

PostMessageW

GetWindowThreadProcessId

appvfilesystemmetadata

ord1

ole32

CoTaskMemFree

CoUninitialize

CoCreateInstance

CoInitializeEx

StringFromCLSID

CoCreateGuid

psapi

GetProcessImageFileNameW

shell32

SHGetKnownFolderPath

Exports

Deinitialize

GetComponent

GetVirtualEnvironmentUtils

InitializeISV

RSODDiff

RSODInitialize

RSODPublish

RSODRelease

Sections

.text
Size: 636KB - Virtual size: 634KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 324KB - Virtual size: 322KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.detourd
Size: 4KB - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.detourc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.mrdata
Size: 4KB - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AppVIsvSubsystems64_msix.dll

.dll windows x64

Code Sign

33:00:00:04:fe:59:ca:b7:e6:2a:a5:22:c1:00:00:00:00:04:fe
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/02/2023, 20:11

Not After

31/01/2024, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:03:3c:2b:0a:49:d9:d2:91:7e:ac:00:00:00:00:03:3c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/02/2023, 20:10

Not After

31/01/2024, 20:10

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

e6:88:f2:ae:b2:26:0e:95:48:f4:d9:10:78:ea:c6:31:3c:12:65:09:25:73:ba:d6:e9:28:07:3a:f7:75:1e:b4
Signer

Actual PE Digest

e6:88:f2:ae:b2:26:0e:95:48:f4:d9:10:78:ea:c6:31:3c:12:65:09:25:73:ba:d6:e9:28:07:3a:f7:75:1e:b4

Digest Algorithm

sha256

PE Digest Matches

true

e6:88:f2:ae:b2:26:0e:95:48:f4:d9:10:78:ea:c6:31:3c:12:65:09:25:73:ba:d6:e9:28:07:3a:f7:75:1e:b4
Signer

Actual PE Digest

e6:88:f2:ae:b2:26:0e:95:48:f4:d9:10:78:ea:c6:31:3c:12:65:09:25:73:ba:d6:e9:28:07:3a:f7:75:1e:b4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Exports

APIExportForDetours

Sections

.text
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.c2r
Size: 512B - Virtual size: 102B

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AppVIsvVirtualization.dll

.dll windows x64

c9ac4ff04dafeaa174cbc02cb3a2bba6

Code Sign

33:00:00:03:df:fb:6a:e3:f4:27:ec:b6:a3:00:00:00:00:03:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

af:5b:7a:3a:7a:bb:4e:91:c4:9d:5d:90:ee:ab:82:7b:35:49:eb:c4:a7:22:e2:72:96:e8:4a:01:99:d7:ae:da
Signer

Actual PE Digest

af:5b:7a:3a:7a:bb:4e:91:c4:9d:5d:90:ee:ab:82:7b:35:49:eb:c4:a7:22:e2:72:96:e8:4a:01:99:d7:ae:da

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Imports

api-ms-win-crt-string-l1-1-0

wcsncmp

wcsnlen

memset

strcspn

api-ms-win-crt-locale-l1-1-0

_unlock_locales

_lock_locales

api-ms-win-crt-runtime-l1-1-0

_initterm_e

_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment

_o__initialize_onexit_table

_o__invalid_parameter_noinfo

_o__invalid_parameter_noinfo_noreturn

_o__purecall

_o__register_onexit_function

_o__resetstkoflw

_o__seh_filter_dll

_o__stricmp

_o__waccess

_o__wcsdup

memmove

_o__wcsicmp

_o__wcslwr_s

_o__wcsnicmp

_o__wsplitpath_s

_o__wtoi

_o_abort

_o_calloc

_o_fclose

_o_ferror

_o_fopen

_o_fread

_o_free

_o_frexp

_o_fwrite

_o_isspace

_o_iswalpha

_o_iswdigit

_o_ldexp

_o_localeconv

_o_malloc

_o_pow

_o_powf

_o_setlocale

_o_strtod

_o_strtof

_o_terminate

_o_tolower

_o_towupper

_o_wcscpy_s

__uncaught_exception

__current_exception

__current_exception_context

_CxxThrowException

_o___stdio_common_vswprintf_s

_o___stdio_common_vsprintf_s

_o___std_type_info_destroy_list

_o___std_exception_destroy

_o___std_exception_copy

_o___pctype_func

_o__ftelli64

_o__fseeki64

_o__execute_onexit_table

_o__errno

_o__crt_atexit

_o__configure_narrow_argv

_o__cexit

_o__calloc_base

_o__callnewh

wcschr

_o____mb_cur_max_func

_o____lc_locale_name_func

_o____lc_codepage_func

__C_specific_handler

strrchr

__CxxFrameHandler3

__RTDynamicCast

memchr

memcmp

memcpy

advapi32

GetNamedSecurityInfoW

MapGenericMask

GetSecurityDescriptorSacl

SetSecurityDescriptorDacl

GetSecurityDescriptorDacl

GetAclInformation

SetSecurityDescriptorOwner

GetSecurityDescriptorGroup

GetSidSubAuthority

GetSidLengthRequired

GetSecurityDescriptorControl

InitializeSid

GetSecurityDescriptorOwner

AddAce

InitializeSecurityDescriptor

InitializeAcl

GetSecurityDescriptorLength

MakeSelfRelativeSD

MakeAbsoluteSD

SetSecurityDescriptorGroup

RegDeleteValueW

ConvertStringSecurityDescriptorToSecurityDescriptorW

RevertToSelf

ImpersonateLoggedOnUser

LookupPrivilegeValueW

AdjustTokenPrivileges

EventWriteTransfer

SetTokenInformation

ConvertStringSidToSidW

DuplicateToken

DuplicateTokenEx

EventActivityIdControl

RegCloseKey

RegCreateKeyExW

RegSetValueExW

SetThreadToken

RegOpenKeyExW

OpenThreadToken

RegQueryValueExW

CopySid

IsValidSid

OpenProcessToken

ConvertSidToStringSidW

GetLengthSid

GetTokenInformation

EventRegister

EventUnregister

AccessCheck

kernel32

InitializeCriticalSectionAndSpinCount

WaitForSingleObjectEx

GetModuleHandleExW

DisableThreadLibraryCalls

GetProcAddress

FreeLibrary

InitializeSRWLock

EnterCriticalSection

LeaveCriticalSection

InitializeCriticalSection

GetCurrentThreadId

DeleteCriticalSection

RegisterWaitForSingleObject

UnregisterWait

OpenProcess

ProcessIdToSessionId

GetLastError

ReleaseSRWLockExclusive

AcquireSRWLockExclusive

CloseHandle

ReleaseSRWLockShared

UnregisterWaitEx

LocalFree

AcquireSRWLockShared

HeapSize

HeapReAlloc

HeapFree

HeapAlloc

GetProcessHeap

HeapDestroy

MultiByteToWideChar

Sleep

VirtualProtect

LoadLibraryExA

GetSystemInfo

VirtualQuery

SetFilePointer

FileTimeToDosDateTime

FileTimeToLocalFileTime

GetFileInformationByHandleEx

DosDateTimeToFileTime

SetFileInformationByHandle

LocalFileTimeToFileTime

Wow64RevertWow64FsRedirection

Wow64DisableWow64FsRedirection

QueryFullProcessImageNameW

GetVersionExW

MoveFileExW

DeleteFileW

ResetEvent

SetFileAttributesW

GetFileAttributesW

CreateFileW

FindClose

RemoveDirectoryW

WriteFile

FindNextFileW

SetLastError

FindFirstFileW

ReadFile

GetSystemTime

QueueUserWorkItem

SystemTimeToFileTime

GetLocalTime

SetEvent

CreateEventW

WaitForSingleObject

GetCurrentThread

GetModuleHandleW

IsDebuggerPresent

InitializeSListHead

GetSystemTimeAsFileTime

GetCurrentProcessId

QueryPerformanceCounter

IsProcessorFeaturePresent

TerminateProcess

GetCurrentProcess

SetUnhandledExceptionFilter

UnhandledExceptionFilter

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

LCMapStringEx

DecodePointer

EncodePointer

InitializeCriticalSectionEx

GetStringTypeW

WideCharToMultiByte

RaiseException

ole32

CoTaskMemFree

CoCreateInstance

CoCreateGuid

CoInitializeEx

CoUninitialize

psapi

EnumProcessModulesEx

GetModuleFileNameExW

shell32

SHFileOperationW

ord165

SHGetKnownFolderPath

shlwapi

PathFileExistsW

userenv

UnloadUserProfile

Exports

Deinitialize

GetComponent

Initialize

InitializeISV

Sections

.text
Size: 276KB - Virtual size: 272KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 200KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AppVManifest.dll

.dll windows x64

53cd0868aafecbc636213ede1c07ede6

Code Sign

33:00:00:03:df:fb:6a:e3:f4:27:ec:b6:a3:00:00:00:00:03:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

03:ec:66:34:63:02:52:b3:38:6f:b1:3a:43:0d:c5:31:1e:02:49:ad:80:08:78:0c:44:bb:97:6e:84:cc:39:54
Signer

Actual PE Digest

03:ec:66:34:63:02:52:b3:38:6f:b1:3a:43:0d:c5:31:1e:02:49:ad:80:08:78:0c:44:bb:97:6e:84:cc:39:54

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Imports

api-ms-win-crt-string-l1-1-0

memset

wcsnlen

strcspn

wcsncmp

api-ms-win-crt-locale-l1-1-0

_unlock_locales

_lock_locales

api-ms-win-crt-runtime-l1-1-0

_initterm_e

_initterm

api-ms-win-crt-private-l1-1-0

_o__errno

_o__execute_onexit_table

_o__initialize_narrow_environment

_o__initialize_onexit_table

_o__invalid_parameter_noinfo_noreturn

_o__purecall

_o__register_onexit_function

_o__seh_filter_dll

_o__stricmp

memmove

_o__wcsdup

_o__wcsicmp

_o__wcsupr_s

_o__wtoi

_o_abort

_o_calloc

_o_free

_o_frexp

_o_isspace

_o_iswalpha

_o_iswdigit

_o_ldexp

_o_localeconv

_o_malloc

_o_pow

_o_powf

_o_setlocale

_o_strtod

_o_strtof

_o_terminate

_o_tolower

_o_wcscpy_s

__uncaught_exception

__C_specific_handler

__current_exception

__current_exception_context

_CxxThrowException

_o__crt_atexit

_o__configure_narrow_argv

_o__cexit

_o__calloc_base

_o__callnewh

wcschr

_o___stdio_common_vsprintf_s

_o___std_type_info_destroy_list

_o___std_exception_destroy

_o___std_exception_copy

_o___pctype_func

_o____mb_cur_max_func

_o____lc_locale_name_func

_o____lc_codepage_func

strrchr

__CxxFrameHandler3

__RTDynamicCast

memchr

memcmp

memcpy

kernel32

DeleteFileW

CreateEventW

InitializeCriticalSectionAndSpinCount

FindResourceW

LoadResource

LockResource

SizeofResource

FreeLibrary

CopyFileExW

GetTempFileNameW

MoveFileExW

CloseHandle

GetLastError

SetFileAttributesW

GetTempPathW

RemoveDirectoryW

FindNextFileW

SetLastError

FindFirstFileW

LoadLibraryW

GetProcAddress

GetModuleHandleExW

FindClose

DebugBreak

GetModuleHandleW

IsDebuggerPresent

InitializeSListHead

GetSystemTimeAsFileTime

GetCurrentThreadId

GetCurrentProcessId

QueryPerformanceCounter

IsProcessorFeaturePresent

TerminateProcess

GetCurrentProcess

SetUnhandledExceptionFilter

UnhandledExceptionFilter

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

LCMapStringEx

DecodePointer

EncodePointer

DeleteCriticalSection

InitializeCriticalSectionEx

LeaveCriticalSection

GetStringTypeW

MultiByteToWideChar

lstrcmpiW

WideCharToMultiByte

advapi32

EventUnregister

EventWriteTransfer

RegGetValueW

EventRegister

ole32

CoCreateInstance

CreateStreamOnHGlobal

CLSIDFromString

oleaut32

VariantChangeType

VariantCopy

SysAllocString

SysFreeString

GetErrorInfo

VariantClear

VariantInit

Exports

CreateManifestDocumentFromDocument

CreateManifestDocumentFromFile

CreateManifestDocumentFromXML

GetManifestSelectionNamespaces

Sections

.text
Size: 360KB - Virtual size: 358KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 272KB - Virtual size: 271KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 208KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AppVOrchestration.dll

.dll windows x64

6384da1e442a1ef005220fec91e16239

Code Sign

33:00:00:03:df:fb:6a:e3:f4:27:ec:b6:a3:00:00:00:00:03:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

87:18:f0:86:da:16:e3:bd:59:bc:1b:21:a1:48:b2:0a:e0:46:c9:76:61:ea:0a:db:6d:9c:06:af:be:ea:60:cb
Signer

Actual PE Digest

87:18:f0:86:da:16:e3:bd:59:bc:1b:21:a1:48:b2:0a:e0:46:c9:76:61:ea:0a:db:6d:9c:06:af:be:ea:60:cb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Imports

api-ms-win-crt-string-l1-1-0

wcsnlen

memset

wcsncmp

strcspn

api-ms-win-crt-locale-l1-1-0

_unlock_locales

_lock_locales

api-ms-win-crt-runtime-l1-1-0

_initterm

_initterm_e

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment

_o__initialize_onexit_table

_o__invalid_parameter_noinfo

_o__invalid_parameter_noinfo_noreturn

_o__purecall

_o__register_onexit_function

_o__resetstkoflw

_o__seh_filter_dll

_o__stricmp

_o__ultow_s

memmove

_o__wcsdup

_o__wcsicmp

_o__wcsupr_s

_o__wtoi

_o_abort

_o_calloc

_o_ceilf

_o_free

_o_frexp

_o_isspace

_o_iswalpha

_o_iswdigit

_o_ldexp

_o_localeconv

_o_malloc

_o_pow

_o_powf

_o_setlocale

_o_strtod

_o_strtof

_o_terminate

_o_tolower

_o_towupper

_o_wcscpy_s

__uncaught_exception

__current_exception

__current_exception_context

_CxxThrowException

_o__execute_onexit_table

_o__errno

_o__crt_atexit

_o__configure_narrow_argv

_o__cexit

_o__calloc_base

_o__callnewh

_o___stdio_common_vswprintf_s

_o___stdio_common_vswprintf

_o___stdio_common_vsprintf_s

_o___stdio_common_vsnprintf_s

_o___std_type_info_destroy_list

_o___std_exception_destroy

_o___std_exception_copy

_o___pctype_func

_o____mb_cur_max_func

_o____lc_locale_name_func

_o____lc_codepage_func

__C_specific_handler

strrchr

__CxxFrameHandler3

wcschr

__RTDynamicCast

memchr

memcmp

memcpy

appvpolicy

ord6

advapi32

EventActivityIdControl

EventWriteTransfer

EventUnregister

EventRegister

GetTokenInformation

GetSidIdentifierAuthority

OpenThreadToken

GetLengthSid

DuplicateToken

SetThreadToken

OpenProcessToken

RegSetValueExW

IsValidSid

CopySid

RegCreateKeyExW

RegDeleteKeyValueW

GetSidSubAuthority

GetSidSubAuthorityCount

RegOpenCurrentUser

RegCloseKey

RegSetKeyValueW

ConvertSidToStringSidW

RegOpenKeyExW

RegQueryInfoKeyW

DuplicateTokenEx

ConvertStringSidToSidW

SetTokenInformation

AdjustTokenPrivileges

LookupPrivilegeValueW

RegQueryValueExW

RegOpenKeyW

RegDeleteKeyW

RegEnumKeyW

MapGenericMask

GetNamedSecurityInfoW

AccessCheck

kernel32

IsDebuggerPresent

InitializeSListHead

GetSystemTimeAsFileTime

GetCurrentProcessId

QueryPerformanceCounter

IsProcessorFeaturePresent

TerminateProcess

SetUnhandledExceptionFilter

UnhandledExceptionFilter

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

LCMapStringEx

DecodePointer

EncodePointer

InitializeCriticalSectionEx

GetStringTypeW

WideCharToMultiByte

MultiByteToWideChar

HeapDestroy

GetProcessHeap

HeapAlloc

HeapFree

HeapReAlloc

HeapSize

GetLocalTime

Sleep

DuplicateHandle

DebugBreak

TlsFree

TlsGetValue

SystemTimeToFileTime

RaiseException

TlsAlloc

GetCurrentThread

FileTimeToSystemTime

QueueUserWorkItem

GetCurrentProcess

SetLastError

TlsSetValue

DisableThreadLibraryCalls

GetModuleHandleExW

AcquireSRWLockShared

ReleaseSRWLockShared

AcquireSRWLockExclusive

ReleaseSRWLockExclusive

InitializeSRWLock

FreeLibrary

GetProcAddress

LoadLibraryW

DeleteCriticalSection

ResetEvent

CloseHandle

SetEvent

GetLastError

CreateEventW

GetCurrentThreadId

WaitForSingleObject

InitializeCriticalSection

LeaveCriticalSection

EnterCriticalSection

GetModuleHandleW

GetModuleFileNameA

CreateSemaphoreExW

ReleaseSemaphore

ReleaseMutex

FormatMessageW

OutputDebugStringW

WaitForSingleObjectEx

OpenSemaphoreW

CreateMutexExW

RemoveDirectoryW

FindFirstFileW

FindNextFileW

FindClose

DeleteFileW

MoveFileExW

GetModuleFileNameW

GetTempPathW

GetTempFileNameW

InitializeCriticalSectionAndSpinCount

SetFileAttributesW

LocalFree

ole32

CLSIDFromString

CoInitializeEx

CoTaskMemFree

CoUninitialize

oleaut32

VariantCopy

SysAllocString

VariantClear

shell32

SHFileOperationW

SHCreateDirectoryExW

SHGetKnownFolderPath

userenv

UnloadUserProfile

Exports

Deinitialize

GetControllerComponent

GetControllerRequests

Initialize

InitializeISV

Sections

.text
Size: 452KB - Virtual size: 449KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 308KB - Virtual size: 307KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AppVPolicy.dll

.dll windows x64

794174af15fdbeb4072841771a53dc0e

Code Sign

33:00:00:03:df:fb:6a:e3:f4:27:ec:b6:a3:00:00:00:00:03:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

f7:82:7b:87:6b:83:6d:dd:cb:80:f8:f5:c4:f2:d3:3a:b8:59:c0:f5:aa:d2:73:b5:11:cd:c5:50:77:75:8d:17
Signer

Actual PE Digest

f7:82:7b:87:6b:83:6d:dd:cb:80:f8:f5:c4:f2:d3:3a:b8:59:c0:f5:aa:d2:73:b5:11:cd:c5:50:77:75:8d:17

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Imports

api-ms-win-crt-string-l1-1-0

wcsncmp

wcsnlen

memset

strcspn

api-ms-win-crt-locale-l1-1-0

_unlock_locales

_lock_locales

api-ms-win-crt-runtime-l1-1-0

_initterm

_initterm_e

api-ms-win-crt-private-l1-1-0

_o__crt_atexit

_o__errno

_o__execute_onexit_table

_o__initialize_narrow_environment

_o__initialize_onexit_table

_o__invalid_parameter_noinfo_noreturn

_o__purecall

_o__register_onexit_function

_o__seh_filter_dll

_o__stricmp

memmove

_o__waccess

_o__wcsdup

_o__wcsicmp

_o__wcslwr_s

_o__wcsnicmp

_o__wcsupr_s

_o__wtoi

_o_abort

_o_calloc

_o_ceilf

_o_free

_o_frexp

_o_isspace

_o_iswalpha

_o_iswdigit

_o_ldexp

_o_localeconv

_o_malloc

_o_pow

_o_powf

_o_setlocale

_o_strtod

_o_strtof

_o_terminate

_o_tolower

_o_wcscpy_s

__uncaught_exception

__C_specific_handler

__current_exception

__current_exception_context

_CxxThrowException

_o___stdio_common_vswscanf

_o___stdio_common_vswprintf_s

_o___stdio_common_vsprintf_s

_o__configure_narrow_argv

_o___std_type_info_destroy_list

wcschr

_o__cexit

_o___std_exception_destroy

_o___std_exception_copy

_o___pctype_func

_o____mb_cur_max_func

_o____lc_locale_name_func

_o____lc_codepage_func

strrchr

__CxxFrameHandler3

_o__calloc_base

_o__callnewh

__RTDynamicCast

memchr

memcmp

memcpy

kernel32

LoadResource

LockResource

SizeofResource

CopyFileExW

GetTempFileNameW

MoveFileExW

CloseHandle

GetLastError

SetFileAttributesW

FindClose

GetTempPathW

RemoveDirectoryW

FindNextFileW

SetLastError

FindFirstFileW

CreateEventW

FindResourceW

InitializeCriticalSectionAndSpinCount

DeleteFileW

GetModuleHandleW

IsDebuggerPresent

InitializeSListHead

GetSystemTimeAsFileTime

GetCurrentThreadId

GetCurrentProcessId

QueryPerformanceCounter

IsProcessorFeaturePresent

TerminateProcess

GetCurrentProcess

SetUnhandledExceptionFilter

UnhandledExceptionFilter

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

LCMapStringEx

DecodePointer

EncodePointer

DeleteCriticalSection

InitializeCriticalSectionEx

LeaveCriticalSection

WideCharToMultiByte

GetStringTypeW

MultiByteToWideChar

DebugBreak

SystemTimeToFileTime

GetLocalTime

LoadLibraryW

FreeLibrary

GetProcAddress

GetModuleHandleExW

oleaut32

SysFreeString

VariantClear

VariantInit

VariantCopy

VariantChangeType

SysAllocString

ole32

CoCreateInstance

StringFromCLSID

CoTaskMemFree

CLSIDFromString

advapi32

EventUnregister

EventRegister

EventWriteTransfer

RegGetValueW

Exports

CreatePackageGroupDescriptorDocumentFromFile

CreatePackageGroupDescriptorDocumentFromXML

CreatePackageMachinePolicyDocument

CreatePackageMachinePolicyDocumentFromFile

CreatePackageMachinePolicyDocumentFromXML

CreatePackageUserPolicyDocument

CreatePackageUserPolicyDocumentFromFile

CreatePackageUserPolicyDocumentFromXML

CreatePublishingDescriptorDocumentFromFile

CreatePublishingDescriptorDocumentFromXML

Sections

.text
Size: 384KB - Virtual size: 383KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 288KB - Virtual size: 285KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 272KB - Virtual size: 270KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AppVScripting.dll

.dll windows x64

85f12e94dac74cbcf5b5ac7421ce6fe9

Code Sign

33:00:00:03:df:fb:6a:e3:f4:27:ec:b6:a3:00:00:00:00:03:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

69:7d:db:61:17:b7:9a:3f:6c:39:49:16:18:c0:47:d1:81:84:c4:71:03:8b:05:d2:92:0d:5d:a5:b6:15:13:00
Signer

Actual PE Digest

69:7d:db:61:17:b7:9a:3f:6c:39:49:16:18:c0:47:d1:81:84:c4:71:03:8b:05:d2:92:0d:5d:a5:b6:15:13:00

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Imports

api-ms-win-crt-string-l1-1-0

memset

wcsncmp

wcsnlen

strcspn

api-ms-win-crt-locale-l1-1-0

_unlock_locales

_lock_locales

api-ms-win-crt-runtime-l1-1-0

_initterm_e

_initterm

api-ms-win-crt-private-l1-1-0

_o__free_base

_o__initialize_narrow_environment

_o__initialize_onexit_table

_o__invalid_parameter_noinfo_noreturn

_o__malloc_base

_o__purecall

_o__register_onexit_function

_o__seh_filter_dll

_o__stricmp

memmove

_o__wcsdup

_o__wcsicmp

_o__wcsnicmp

_o__wtoi

_o_abort

_o_calloc

_o_ceilf

_o_free

_o_frexp

_o_iswdigit

_o_localeconv

_o_malloc

_o_realloc

_o_setlocale

_o_terminate

_o_wcscpy_s

__uncaught_exception

__C_specific_handler

__current_exception

__current_exception_context

_CxxThrowException

_o__crt_atexit

_o__configure_narrow_argv

_o__cexit

_o__calloc_base

_o__callnewh

_o___stdio_common_vswprintf_s

_o___stdio_common_vsprintf_s

_o___std_type_info_destroy_list

_o___std_exception_destroy

_o___std_exception_copy

_o___pctype_func

_o__execute_onexit_table

_o__errno

strchr

_o____mb_cur_max_func

_o____lc_locale_name_func

_o____lc_collate_cp_func

_o____lc_codepage_func

strrchr

__CxxFrameHandler3

__RTDynamicCast

memcmp

memcpy

advapi32

EventUnregister

OpenThreadToken

SetThreadToken

EventWriteTransfer

EventActivityIdControl

CreateProcessAsUserW

RegQueryValueExW

RegOpenKeyExW

RegCloseKey

GetTokenInformation

ConvertSidToStringSidW

OpenProcessToken

LookupAccountSidW

EventRegister

kernel32

GetComputerNameExW

SetLastError

QueryFullProcessImageNameW

GetEnvironmentVariableW

GetShortPathNameW

OpenProcess

Wow64RevertWow64FsRedirection

Wow64DisableWow64FsRedirection

IsDebuggerPresent

InitializeSListHead

GetSystemTimeAsFileTime

GetCurrentProcessId

QueryPerformanceCounter

IsProcessorFeaturePresent

SetUnhandledExceptionFilter

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

GetModuleHandleW

CreateEventW

WaitForSingleObjectEx

ResetEvent

SetEvent

InitializeCriticalSectionAndSpinCount

CompareStringEx

LCMapStringEx

DecodePointer

EncodePointer

InitializeCriticalSectionEx

WideCharToMultiByte

GetStringTypeW

LocalFree

MultiByteToWideChar

GetExitCodeProcess

CreateProcessW

SetThreadpoolWait

CreateThreadpoolWait

CloseThreadpoolWait

WaitForSingleObject

TerminateProcess

DeleteCriticalSection

InitializeCriticalSection

RaiseException

CloseHandle

GetCurrentThread

GetLastError

GetCurrentThreadId

LeaveCriticalSection

EnterCriticalSection

GetCurrentProcess

FreeLibrary

GetProcAddress

DisableThreadLibraryCalls

GetModuleHandleExW

UnhandledExceptionFilter

netapi32

NetUserGetInfo

DsGetDcNameW

NetApiBufferFree

ole32

CoTaskMemFree

CoCreateInstance

secur32

GetUserNameExW

shell32

SHGetKnownFolderPath

shlwapi

PathFileExistsW

userenv

DestroyEnvironmentBlock

UnloadUserProfile

CreateEnvironmentBlock

LoadUserProfileW

Exports

Deinitialize

GetComponent

Initialize

InitializeISV

Sections

.text
Size: 196KB - Virtual size: 194KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AppVShNotify.exe

.exe windows x64

bdec22e8cbcc3e2ab7f98315a0cc9543

Code Sign

33:00:00:03:df:fb:6a:e3:f4:27:ec:b6:a3:00:00:00:00:03:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

db:c8:cd:87:0e:2a:3d:0f:2b:4c:cc:eb:b9:b5:fa:04:ad:47:91:41:68:c5:f3:85:6d:ec:f1:80:c6:be:c0:e2
Signer

Actual PE Digest

db:c8:cd:87:0e:2a:3d:0f:2b:4c:cc:eb:b9:b5:fa:04:ad:47:91:41:68:c5:f3:85:6d:ec:f1:80:c6:be:c0:e2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

EventUnregister

EventRegister

GetTokenInformation

SetSecurityDescriptorGroup

MakeAbsoluteSD

OpenThreadToken

GetLengthSid

InitializeAcl

InitializeSecurityDescriptor

OpenProcessToken

AddAce

IsValidSid

GetSecurityDescriptorOwner

InitializeSid

CopySid

GetSecurityDescriptorControl

GetSidLengthRequired

GetSidSubAuthority

GetSecurityDescriptorGroup

SetSecurityDescriptorOwner

GetAclInformation

GetSecurityDescriptorDacl

SetSecurityDescriptorDacl

GetSecurityDescriptorSacl

ConvertSidToStringSidW

EventWriteTransfer

kernel32

WideCharToMultiByte

LCMapStringEx

MultiByteToWideChar

GetProcessHeap

LocalFree

HeapAlloc

CloseHandle

GetCurrentThread

Sleep

HeapFree

CreateThreadpoolWork

SubmitThreadpoolWork

CloseThreadpoolWork

TerminateProcess

GetCurrentProcess

GetModuleHandleW

IsProcessorFeaturePresent

GetStartupInfoW

SetUnhandledExceptionFilter

UnhandledExceptionFilter

IsDebuggerPresent

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

InitializeSListHead

GetSystemTimeAsFileTime

GetCurrentProcessId

QueryPerformanceCounter

DecodePointer

EncodePointer

HeapSize

HeapReAlloc

HeapDestroy

GetStringTypeW

DebugBreak

FreeLibrary

DeleteCriticalSection

GetProcAddress

HeapSetInformation

CreateThreadpoolCleanupGroup

SetThreadpoolThreadMaximum

GetLastError

CloseThreadpoolCleanupGroupMembers

SetThreadpoolThreadMinimum

GetCurrentThreadId

InitializeCriticalSection

LeaveCriticalSection

GetModuleHandleExW

EnterCriticalSection

CreateThreadpool

InitializeCriticalSectionAndSpinCount

SetEvent

ResetEvent

WaitForSingleObjectEx

CreateEventW

InitializeCriticalSectionEx

user32

GetMessageW

DispatchMessageW

TranslateMessage

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback

_initterm

_initterm_e

_c_exit

api-ms-win-crt-private-l1-1-0

_o__get_wide_winmain_command_line

_o__initialize_onexit_table

_o__initialize_wide_environment

_o__invalid_parameter_noinfo

_o__invalid_parameter_noinfo_noreturn

_o__purecall

_o__register_onexit_function

_o__resetstkoflw

_o__seh_filter_exe

_o__set_app_type

_o__set_fmode

_o__set_new_mode

_o__stricmp

_o__wcsdup

_o__wcsicmp

_o__wtoi

_o_abort

_o_calloc

_o_exit

_o_free

_o_frexp

_o_iswdigit

_o_localeconv

_o_malloc

_o_setlocale

_o_terminate

__C_specific_handler

__current_exception

__current_exception_context

_CxxThrowException

_o__exit

_o__errno

_o__crt_atexit

_o__configure_wide_argv

_o__configthreadlocale

_o__cexit

_o__calloc_base

_o__callnewh

_o___stdio_common_vsprintf_s

_o___std_exception_destroy

_o___std_exception_copy

_o___pctype_func

_o___p__commode

_o____mb_cur_max_func

_o____lc_locale_name_func

_o____lc_codepage_func

__uncaught_exception

strrchr

__CxxFrameHandler3

memcmp

memcpy

memmove

api-ms-win-crt-string-l1-1-0

strcspn

wcsnlen

memset

ole32

CoCreateInstance

CoInitializeEx

CoUninitialize

rpcrt4

RpcServerUseProtseqEpW

RpcBindingInqAuthClientW

RpcServerUnregisterIf

RpcServerRegisterIf2

RpcImpersonateClient

RpcRevertToSelf

RpcServerListen

RpcServerRegisterAuthInfoW

NdrServerCall2

shell32

SHCreateItemFromParsingName

SHChangeNotify

userenv

UnloadUserProfile

api-ms-win-crt-locale-l1-1-0

_unlock_locales

_lock_locales

Sections

.text
Size: 88KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 136KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AppvIsvSubsystems32.dll

.dll windows x86

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

03:a4:9d:39:56:91:ef:fb:94:04:e3:ac:16:ae:d7:42:3e:83:7c:d7:8b:df:20:d6:59:96:1d:bf:fd:43:19:48
Signer

Actual PE Digest

03:a4:9d:39:56:91:ef:fb:94:04:e3:ac:16:ae:d7:42:3e:83:7c:d7:8b:df:20:d6:59:96:1d:bf:fd:43:19:48

Digest Algorithm

sha256

PE Digest Matches

true

03:a4:9d:39:56:91:ef:fb:94:04:e3:ac:16:ae:d7:42:3e:83:7c:d7:8b:df:20:d6:59:96:1d:bf:fd:43:19:48
Signer

Actual PE Digest

03:a4:9d:39:56:91:ef:fb:94:04:e3:ac:16:ae:d7:42:3e:83:7c:d7:8b:df:20:d6:59:96:1d:bf:fd:43:19:48

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Exports

APIExportForDetours

CurrentThreadIsVirtualized

RequestUnhookedFunctionList

VirtualizeCurrentProcess

VirtualizeCurrentThread

_IsProcessHooked@0

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.mrdata
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.c2r
Size: 512B - Virtual size: 226B

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AppvIsvSubsystems32_msix.dll

.dll windows x86

Code Sign

33:00:00:05:00:27:d6:32:6f:43:73:7b:87:00:00:00:00:05:00
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/02/2023, 20:11

Not After

31/01/2024, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/02/2023, 20:10

Not After

31/01/2024, 20:10

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

76:2f:2d:e3:3d:a9:eb:a9:c4:11:95:6d:b6:a5:11:74:e4:ee:29:f8:c1:02:65:74:2d:b2:19:97:1a:4b:e5:0c
Signer

Actual PE Digest

76:2f:2d:e3:3d:a9:eb:a9:c4:11:95:6d:b6:a5:11:74:e4:ee:29:f8:c1:02:65:74:2d:b2:19:97:1a:4b:e5:0c

Digest Algorithm

sha256

PE Digest Matches

true

76:2f:2d:e3:3d:a9:eb:a9:c4:11:95:6d:b6:a5:11:74:e4:ee:29:f8:c1:02:65:74:2d:b2:19:97:1a:4b:e5:0c
Signer

Actual PE Digest

76:2f:2d:e3:3d:a9:eb:a9:c4:11:95:6d:b6:a5:11:74:e4:ee:29:f8:c1:02:65:74:2d:b2:19:97:1a:4b:e5:0c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Exports

APIExportForDetours

Sections

.text
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.c2r
Size: 512B - Virtual size: 86B

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AppvIsvSubsystems64.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

9b:44:4c:8f:7b:4e:35:7c:d0:5e:2b:a4:50:27:30:ba:0d:8b:ee:43:59:7f:03:42:fc:c6:4b:94:86:9e:2d:64
Signer

Actual PE Digest

9b:44:4c:8f:7b:4e:35:7c:d0:5e:2b:a4:50:27:30:ba:0d:8b:ee:43:59:7f:03:42:fc:c6:4b:94:86:9e:2d:64

Digest Algorithm

sha256

PE Digest Matches

true

9b:44:4c:8f:7b:4e:35:7c:d0:5e:2b:a4:50:27:30:ba:0d:8b:ee:43:59:7f:03:42:fc:c6:4b:94:86:9e:2d:64
Signer

Actual PE Digest

9b:44:4c:8f:7b:4e:35:7c:d0:5e:2b:a4:50:27:30:ba:0d:8b:ee:43:59:7f:03:42:fc:c6:4b:94:86:9e:2d:64

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Exports

APIExportForDetours

CurrentThreadIsVirtualized

IsProcessHooked

RequestUnhookedFunctionList

VirtualizeCurrentProcess

VirtualizeCurrentThread

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 604KB - Virtual size: 602KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.mrdata
Size: 4KB - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.detourc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.detourd
Size: 4KB - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.c2r
Size: 4KB - Virtual size: 242B

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AppvIsvSubsystems64_arm64x.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

4a:a3:21:07:97:ee:44:d5:3b:57:85:08:0f:57:49:8c:2d:65:60:a1:b5:2e:51:52:88:75:84:a0:8c:30:a4:40
Signer

Actual PE Digest

4a:a3:21:07:97:ee:44:d5:3b:57:85:08:0f:57:49:8c:2d:65:60:a1:b5:2e:51:52:88:75:84:a0:8c:30:a4:40

Digest Algorithm

sha256

PE Digest Matches

true

4a:a3:21:07:97:ee:44:d5:3b:57:85:08:0f:57:49:8c:2d:65:60:a1:b5:2e:51:52:88:75:84:a0:8c:30:a4:40
Signer

Actual PE Digest

4a:a3:21:07:97:ee:44:d5:3b:57:85:08:0f:57:49:8c:2d:65:60:a1:b5:2e:51:52:88:75:84:a0:8c:30:a4:40

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Exports

APIExportForDetours

CurrentThreadIsVirtualized

IsProcessHooked

RequestUnhookedFunctionList

VirtualizeCurrentProcess

VirtualizeCurrentThread

Sections

.hexpthk
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 594KB - Virtual size: 594KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.mrdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.detourc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.a64xrm
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.c2r
Size: 512B - Virtual size: 242B

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

C2R32.dll

.dll windows x86

252df3bcf3fffe5492c82091adb4f367

Code Sign

33:00:00:04:39:f6:1f:7a:67:6d:a0:00:af:00:00:00:00:04:39
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:25

Not After

01/09/2022, 18:25

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:02:55:18:1d:a4:2e:e0:86:fc:15:00:00:00:00:02:55
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:33

Not After

01/09/2022, 18:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

78:25:27:b4:8d:bd:06:3d:1f:eb:92:5e:0a:2c:d7:8a:54:30:e5:01:00:9b:23:3b:4e:bd:95:fc:e8:96:fe:40
Signer

Actual PE Digest

78:25:27:b4:8d:bd:06:3d:1f:eb:92:5e:0a:2c:d7:8a:54:30:e5:01:00:9b:23:3b:4e:bd:95:fc:e8:96:fe:40

Digest Algorithm

sha256

PE Digest Matches

true

78:25:27:b4:8d:bd:06:3d:1f:eb:92:5e:0a:2c:d7:8a:54:30:e5:01:00:9b:23:3b:4e:bd:95:fc:e8:96:fe:40
Signer

Actual PE Digest

78:25:27:b4:8d:bd:06:3d:1f:eb:92:5e:0a:2c:d7:8a:54:30:e5:01:00:9b:23:3b:4e:bd:95:fc:e8:96:fe:40

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Imports

advapi32

RegCreateKeyExW

RegCloseKey

RegSetValueExW

RegOpenKeyExW

RegQueryValueExW

EventWriteTransfer

EventRegister

EventUnregister

RegEnumKeyExW

RegQueryInfoKeyW

RegEnumValueW

RegDeleteTreeW

RegGetValueW

RegDeleteValueW

GetTokenInformation

IsValidSid

GetSidSubAuthorityCount

GetSidSubAuthority

ConvertStringSecurityDescriptorToSecurityDescriptorW

AllocateAndInitializeSid

FreeSid

EqualSid

OpenProcessToken

CreateWellKnownSid

RevertToSelf

OpenThreadToken

GetLengthSid

CopySid

InitializeAcl

AddAccessAllowedAce

InitializeSecurityDescriptor

SetSecurityDescriptorDacl

GetSecurityDescriptorDacl

ConvertSidToStringSidA

OpenSCManagerW

CloseServiceHandle

OpenServiceW

StartServiceW

ole32

CoRevokeInitializeSpy

CoRegisterInitializeSpy

CoTaskMemAlloc

CoInitializeEx

CoUninitialize

CoCreateInstance

CoTaskMemFree

StringFromGUID2

CoCreateGuid

CreateStreamOnHGlobal

oleaut32

SysAllocString

SysFreeString

rpcrt4

RpcBindingFromStringBindingW

RpcStringFreeW

RpcBindingSetAuthInfoW

NdrClientCall2

RpcStringBindingComposeW

RpcMgmtIsServerListening

RpcBindingFree

kernel32

GetQueuedCompletionStatus

GetThreadIOPendingFlag

PostQueuedCompletionStatus

WerRegisterMemoryBlock

GetLongPathNameW

WerUnregisterMemoryBlock

QueryFullProcessImageNameW

CreateIoCompletionPort

CreateMemoryResourceNotification

CancelIoEx

WaitForSingleObject

WaitForThreadpoolWaitCallbacks

GetLocalTime

LoadLibraryExA

VirtualQuery

VirtualProtect

GetSystemInfo

OutputDebugStringW

FlushFileBuffers

WriteConsoleW

SetEnvironmentVariableW

FreeEnvironmentStringsW

GetEnvironmentStringsW

GetCommandLineA

GetOEMCP

GetACP

SetStdHandle

EnumSystemLocalesW

GetLocaleInfoW

CompareStringW

GetTimeFormatW

GetDateFormatW

HeapReAlloc

GetStdHandle

GetCurrentProcess

GetModuleHandleExW

InitializeCriticalSectionEx

GetLastError

CompareStringEx

GetProcAddress

DeleteCriticalSection

FreeLibrary

FlsFree

FlsAlloc

IsWow64Process

GetCommandLineW

ExpandEnvironmentStringsW

GetTickCount64

GetModuleFileNameW

GetCurrentProcessId

MultiByteToWideChar

CreateEventExW

CloseHandle

SetEvent

TerminateProcess

DisableThreadLibraryCalls

GetModuleHandleW

Sleep

FindClose

UnmapViewOfFile

CreateFileMappingA

MapViewOfFile

GetStringTypeExW

GetUserDefaultLCID

LCMapStringW

LocalFree

FormatMessageA

GetSystemTimeAsFileTime

GetCurrentThreadId

TlsAlloc

GetSystemPowerStatus

FlsGetValue

TlsGetValue

FlsSetValue

TlsSetValue

K32GetProcessMemoryInfo

GlobalMemoryStatusEx

LocalAlloc

RaiseException

LoadLibraryExW

VerSetConditionMask

VerifyVersionInfoW

GetVersionExW

WideCharToMultiByte

InitializeSRWLock

AcquireSRWLockExclusive

ReleaseSRWLockExclusive

AcquireSRWLockShared

ReleaseSRWLockShared

GetProcessTimes

GetModuleFileNameA

GetShortPathNameA

K32GetModuleFileNameExW

CreateProcessW

FindResourceW

SizeofResource

LoadResource

OpenProcess

CreateFileW

DeviceIoControl

GetComputerNameW

GetNativeSystemInfo

HeapFree

SetLastError

OutputDebugStringA

LoadLibraryW

HeapAlloc

GetProcessHeap

GetUserDefaultLocaleName

IsValidCodePage

GetSystemTime

FileTimeToSystemTime

ReleaseMutex

OpenMutexW

WaitForSingleObjectEx

SystemTimeToTzSpecificLocalTime

EnterCriticalSection

TryEnterCriticalSection

LeaveCriticalSection

GetFileAttributesExW

CreateDirectoryW

FindFirstFileExW

DeleteFileW

SetFileAttributesW

FindNextFileW

GetFileTime

ReadFile

GetFileSizeEx

SetFilePointerEx

GetTempFileNameW

GetFileType

WriteFile

SetEndOfFile

GetOverlappedResult

GetTempPathW

CreateMutexW

ReleaseSemaphore

GetCurrentThread

WaitForMultipleObjectsEx

GetProcessAffinityMask

CreateWaitableTimerW

SetWaitableTimerEx

CancelWaitableTimer

QueryDepthSList

InitializeSListHead

InterlockedPushEntrySList

InterlockedPopEntrySList

RtlCaptureStackBackTrace

OpenEventA

CreateEventA

OpenMutexA

CreateMutexA

OpenSemaphoreA

CreateSemaphoreA

OpenFileMappingA

GlobalAlloc

GlobalFree

GetPriorityClass

GetExitCodeProcess

GetTimeZoneInformation

IsValidLocale

GetTickCount

ExitProcess

IsSystemResumeAutomatic

TlsFree

GetConsoleOutputCP

GetConsoleMode

HeapSize

InterlockedFlushSList

RtlUnwind

GetStartupInfoW

CreateThread

DecodePointer

SetFileTime

GetFileInformationByHandleEx

QueryPerformanceCounter

QueryPerformanceFrequency

InitOnceComplete

InitOnceBeginInitialize

GetStringTypeW

WakeConditionVariable

WakeAllConditionVariable

SleepConditionVariableSRW

CreateThreadpoolWork

SubmitThreadpoolWork

CreateThreadpoolTimer

SetThreadpoolTimer

WaitForThreadpoolTimerCallbacks

CloseThreadpoolTimer

CreateThreadpoolWait

SetThreadpoolWait

CloseThreadpoolWait

EncodePointer

LCMapStringEx

GetCPInfo

InitializeCriticalSectionAndSpinCount

ResetEvent

CreateEventW

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsProcessorFeaturePresent

IsDebuggerPresent

Exports

AddOfficeProduct

AddOfficeProductEx

ApplyCloudPolicy

C2rVersion

ClearPropertyBagValue

CollectFileInformation

DeleteAFOScheduledTask

EnsureConnection

EnsurePerpetualLicensesFolderExists

FetchDBSLicense

GetInstalledProducts

GetInstalledProductsEx

GetPackageRoot

GetProperty

GetPropertyEx

GetStatusValue

GetStatusValueEx

GetTotalProgress

GetUpdateStatus

HandleError

HandleErrorEx

HandleScheduledHeartbeat

HandleScheduledHeartbeatEx

HrActivate

HrActivateEx

HrApplyUpdatesNow

HrApplyUpdatesNowEx

HrBeginUpdatesDiscoveryPeriod

HrBeginUpdatesDiscoveryPeriodEx

HrDownloadUpdatesNow

HrDownloadUpdatesNowEx

HrGetAreUpdatesCOMManaged

HrGetAreUpdatesEnabled

HrGetAreUpdatesEnabledEx

HrGetAreUpdatesFromAdminSource

HrGetAreUpdatesFromAdminSourceEx

HrGetAreUpdatesLate

HrGetAreUpdatesLateEx

HrGetAreUpdatesReadyForDownload

HrGetAreUpdatesReadyForDownloadEx

HrGetAreUpdatesReadyToApply

HrGetAreUpdatesReadyToApplyEx

HrGetChannelIdForDisplay

HrGetClientFolder

HrGetContainerInstallCommand

HrGetDeviceBasedLicensing

HrGetExecutingScenario

HrGetInstallationPath

HrGetPendingModifyOfficeProducts

HrGetPendingUpdateDeadline

HrGetPendingUpdateDeadlineEx

HrModifyOfficeProducts

HrRefreshState

HrSetAreUpdatesEnabled

HrSetAreUpdatesEnabledEx

HrSetAreUpdatesFromAdminSource

HrSetAreUpdatesFromAdminSourceEx

HrSetPrivacySettings

HrUpdateNow

HrUpdateNowEx

HrUpdateNowWithParameters

InstallProofOfPurchase

InstallProofOfPurchaseEx

IsClick2Run

IsFileInVirtualFolder

IsOSPPReady

IsOSPPReadyEx

IsRepairRequired

IsRepairRequiredEx

IsRoaming

IsStreaming

Launch

LicenseRepair

MigrateOSPPToSPP

OverridePolicy

ReArm

Repair

RepairEx

SetProperty

SetPropertyBagToken

SetTenantAssociationKey

SetUpdateBranch

SetUpdateUrl

SetUpdateUrlSetByUser

StartFB

StartScenario

UninstallProofOfPurchase

UninstallProofOfPurchaseEx

Sections

.text
Size: 923KB - Virtual size: 922KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 379KB - Virtual size: 378KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

C2R64.dll

.dll windows x64

3e3e291ae720e353e0e00f7c125e1190

Code Sign

33:00:00:04:39:f6:1f:7a:67:6d:a0:00:af:00:00:00:00:04:39
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:25

Not After

01/09/2022, 18:25

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:02:55:18:1d:a4:2e:e0:86:fc:15:00:00:00:00:02:55
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:33

Not After

01/09/2022, 18:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

18:01:90:c1:1e:57:5d:ba:ec:f4:d5:80:4b:b9:60:66:5f:54:3b:63:32:41:93:c7:4c:9b:f1:4a:de:90:ea:cf
Signer

Actual PE Digest

18:01:90:c1:1e:57:5d:ba:ec:f4:d5:80:4b:b9:60:66:5f:54:3b:63:32:41:93:c7:4c:9b:f1:4a:de:90:ea:cf

Digest Algorithm

sha256

PE Digest Matches

true

18:01:90:c1:1e:57:5d:ba:ec:f4:d5:80:4b:b9:60:66:5f:54:3b:63:32:41:93:c7:4c:9b:f1:4a:de:90:ea:cf
Signer

Actual PE Digest

18:01:90:c1:1e:57:5d:ba:ec:f4:d5:80:4b:b9:60:66:5f:54:3b:63:32:41:93:c7:4c:9b:f1:4a:de:90:ea:cf

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Imports

advapi32

RegCreateKeyExW

RegCloseKey

RegSetValueExW

RegOpenKeyExW

RegQueryValueExW

EventWriteTransfer

EventRegister

EventUnregister

RegEnumKeyExW

RegQueryInfoKeyW

RegEnumValueW

RegDeleteTreeW

RegGetValueW

RegDeleteValueW

GetTokenInformation

IsValidSid

GetSidSubAuthorityCount

GetSidSubAuthority

ConvertStringSecurityDescriptorToSecurityDescriptorW

AllocateAndInitializeSid

FreeSid

EqualSid

OpenProcessToken

CreateWellKnownSid

RevertToSelf

OpenThreadToken

GetLengthSid

CopySid

InitializeAcl

AddAccessAllowedAce

InitializeSecurityDescriptor

SetSecurityDescriptorDacl

GetSecurityDescriptorDacl

ConvertSidToStringSidA

OpenSCManagerW

CloseServiceHandle

OpenServiceW

StartServiceW

ole32

CoRevokeInitializeSpy

CoRegisterInitializeSpy

CoInitializeEx

CoUninitialize

CoCreateInstance

CoTaskMemFree

StringFromGUID2

CoCreateGuid

CreateStreamOnHGlobal

CoTaskMemAlloc

oleaut32

SysAllocString

SysFreeString

rpcrt4

RpcBindingFromStringBindingW

RpcStringFreeW

RpcBindingSetAuthInfoW

NdrClientCall2

RpcStringBindingComposeW

RpcMgmtIsServerListening

RpcBindingFree

kernel32

WerRegisterMemoryBlock

GetQueuedCompletionStatus

GetThreadIOPendingFlag

WerUnregisterMemoryBlock

CreateIoCompletionPort

GetLongPathNameW

QueryFullProcessImageNameW

CreateMemoryResourceNotification

PostQueuedCompletionStatus

GetSystemPowerStatus

CancelIoEx

WaitForSingleObject

WaitForThreadpoolWaitCallbacks

GetLocalTime

LoadLibraryExA

VirtualQuery

VirtualProtect

GetSystemInfo

OutputDebugStringW

FlushFileBuffers

WriteConsoleW

SetEnvironmentVariableW

FreeEnvironmentStringsW

GetEnvironmentStringsW

GetCommandLineA

GetOEMCP

GetACP

SetStdHandle

EnumSystemLocalesW

GetLocaleInfoW

CompareStringW

GetTimeFormatW

GetDateFormatW

HeapReAlloc

GetCurrentProcess

GetModuleHandleExW

InitializeCriticalSectionEx

GetLastError

CompareStringEx

GetProcAddress

DeleteCriticalSection

FreeLibrary

FlsFree

FlsAlloc

IsWow64Process

GetCommandLineW

ExpandEnvironmentStringsW

GetTickCount64

GetModuleFileNameW

GetCurrentProcessId

MultiByteToWideChar

CreateEventExW

CloseHandle

SetEvent

TerminateProcess

DisableThreadLibraryCalls

GetModuleHandleW

Sleep

FindClose

UnmapViewOfFile

CreateFileMappingA

MapViewOfFile

GetStringTypeExW

GetUserDefaultLCID

LCMapStringW

LocalFree

FormatMessageA

GetSystemTimeAsFileTime

GetCurrentThreadId

TlsAlloc

TlsFree

IsSystemResumeAutomatic

TlsGetValue

FlsSetValue

TlsSetValue

K32GetProcessMemoryInfo

GlobalMemoryStatusEx

LocalAlloc

RaiseException

LoadLibraryExW

VerSetConditionMask

VerifyVersionInfoW

GetVersionExW

WideCharToMultiByte

InitializeSRWLock

AcquireSRWLockExclusive

ReleaseSRWLockExclusive

AcquireSRWLockShared

ReleaseSRWLockShared

GetProcessTimes

GetModuleFileNameA

GetShortPathNameA

K32GetModuleFileNameExW

CreateProcessW

FindResourceW

SizeofResource

LoadResource

OpenProcess

CreateFileW

DeviceIoControl

GetComputerNameW

GetNativeSystemInfo

CreateActCtxW

ActivateActCtx

HeapFree

SetLastError

OutputDebugStringA

FindActCtxSectionStringW

DeactivateActCtx

QueryActCtxW

LoadLibraryW

HeapAlloc

GetProcessHeap

GetUserDefaultLocaleName

IsValidCodePage

GetSystemTime

FileTimeToSystemTime

ReleaseMutex

OpenMutexW

WaitForSingleObjectEx

SystemTimeToTzSpecificLocalTime

EnterCriticalSection

TryEnterCriticalSection

LeaveCriticalSection

GetFileAttributesExW

CreateDirectoryW

FindFirstFileExW

DeleteFileW

SetFileAttributesW

FindNextFileW

GetFileTime

ReadFile

GetFileSizeEx

SetFilePointerEx

GetTempFileNameW

GetFileType

WriteFile

SetEndOfFile

GetOverlappedResult

GetTempPathW

CreateMutexW

ReleaseSemaphore

GetCurrentThread

WaitForMultipleObjectsEx

GetProcessAffinityMask

CreateWaitableTimerW

SetWaitableTimerEx

CancelWaitableTimer

QueryDepthSList

InitializeSListHead

InterlockedPushEntrySList

InterlockedPopEntrySList

RtlCaptureStackBackTrace

OpenEventA

CreateEventA

OpenMutexA

CreateMutexA

OpenSemaphoreA

CreateSemaphoreA

OpenFileMappingA

GlobalAlloc

GlobalFree

GetPriorityClass

GetExitCodeProcess

GetTimeZoneInformation

IsValidLocale

GetTickCount

GetStdHandle

FlsGetValue

ExitProcess

GetConsoleOutputCP

GetConsoleMode

HeapSize

InterlockedFlushSList

RtlUnwindEx

CreateThread

DecodePointer

SetFileTime

GetFileInformationByHandleEx

QueryPerformanceCounter

QueryPerformanceFrequency

InitOnceComplete

InitOnceBeginInitialize

GetStringTypeW

RtlPcToFileHeader

WakeConditionVariable

WakeAllConditionVariable

SleepConditionVariableSRW

CreateThreadpoolWork

SubmitThreadpoolWork

CreateThreadpoolTimer

SetThreadpoolTimer

WaitForThreadpoolTimerCallbacks

CloseThreadpoolTimer

CreateThreadpoolWait

SetThreadpoolWait

CloseThreadpoolWait

EncodePointer

LCMapStringEx

GetCPInfo

InitializeCriticalSectionAndSpinCount

ResetEvent

CreateEventW

RtlCaptureContext

RtlLookupFunctionEntry

RtlVirtualUnwind

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsProcessorFeaturePresent

IsDebuggerPresent

GetStartupInfoW

Exports

AddOfficeProduct

AddOfficeProductEx

ApplyCloudPolicy

C2rVersion

ClearPropertyBagValue

CollectFileInformation

DeleteAFOScheduledTask

EnsureConnection

EnsurePerpetualLicensesFolderExists

FetchDBSLicense

GetInstalledProducts

GetInstalledProductsEx

GetPackageRoot

GetProperty

GetPropertyEx

GetStatusValue

GetStatusValueEx

GetTotalProgress

GetUpdateStatus

HandleError

HandleErrorEx

HandleScheduledHeartbeat

HandleScheduledHeartbeatEx

HrActivate

HrActivateEx

HrApplyUpdatesNow

HrApplyUpdatesNowEx

HrBeginUpdatesDiscoveryPeriod

HrBeginUpdatesDiscoveryPeriodEx

HrDownloadUpdatesNow

HrDownloadUpdatesNowEx

HrGetAreUpdatesCOMManaged

HrGetAreUpdatesEnabled

HrGetAreUpdatesEnabledEx

HrGetAreUpdatesFromAdminSource

HrGetAreUpdatesFromAdminSourceEx

HrGetAreUpdatesLate

HrGetAreUpdatesLateEx

HrGetAreUpdatesReadyForDownload

HrGetAreUpdatesReadyForDownloadEx

HrGetAreUpdatesReadyToApply

HrGetAreUpdatesReadyToApplyEx

HrGetChannelIdForDisplay

HrGetClientFolder

HrGetContainerInstallCommand

HrGetDeviceBasedLicensing

HrGetExecutingScenario

HrGetInstallationPath

HrGetPendingModifyOfficeProducts

HrGetPendingUpdateDeadline

HrGetPendingUpdateDeadlineEx

HrModifyOfficeProducts

HrRefreshState

HrSetAreUpdatesEnabled

HrSetAreUpdatesEnabledEx

HrSetAreUpdatesFromAdminSource

HrSetAreUpdatesFromAdminSourceEx

HrSetPrivacySettings

HrUpdateNow

HrUpdateNowEx

HrUpdateNowWithParameters

InstallProofOfPurchase

InstallProofOfPurchaseEx

IsClick2Run

IsFileInVirtualFolder

IsOSPPReady

IsOSPPReadyEx

IsRepairRequired

IsRepairRequiredEx

IsRoaming

IsStreaming

Launch

LicenseRepair

MigrateOSPPToSPP

OverridePolicy

ReArm

Repair

RepairEx

SetProperty

SetPropertyBagToken

SetTenantAssociationKey

SetUpdateBranch

SetUpdateUrl

SetUpdateUrlSetByUser

StartFB

StartScenario

UninstallProofOfPurchase

UninstallProofOfPurchaseEx

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 560KB - Virtual size: 560KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

C2RHeartbeatConfig.xml

C2RINTL.ar-sa.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

95:05:0f:5b:59:12:86:33:7e:f1:d6:a6:af:4a:2a:ff:fc:12:7c:c1:38:4b:c6:12:05:89:07:24:ec:89:45:c9
Signer

Actual PE Digest

95:05:0f:5b:59:12:86:33:7e:f1:d6:a6:af:4a:2a:ff:fc:12:7c:c1:38:4b:c6:12:05:89:07:24:ec:89:45:c9

Digest Algorithm

sha256

PE Digest Matches

true

95:05:0f:5b:59:12:86:33:7e:f1:d6:a6:af:4a:2a:ff:fc:12:7c:c1:38:4b:c6:12:05:89:07:24:ec:89:45:c9
Signer

Actual PE Digest

95:05:0f:5b:59:12:86:33:7e:f1:d6:a6:af:4a:2a:ff:fc:12:7c:c1:38:4b:c6:12:05:89:07:24:ec:89:45:c9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.bg-bg.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

b3:e2:92:59:19:07:c9:f8:5e:e9:92:93:14:0c:99:69:0a:63:1f:d5:90:ba:1c:f7:c6:e9:70:65:84:c3:f4:be
Signer

Actual PE Digest

b3:e2:92:59:19:07:c9:f8:5e:e9:92:93:14:0c:99:69:0a:63:1f:d5:90:ba:1c:f7:c6:e9:70:65:84:c3:f4:be

Digest Algorithm

sha256

PE Digest Matches

true

b3:e2:92:59:19:07:c9:f8:5e:e9:92:93:14:0c:99:69:0a:63:1f:d5:90:ba:1c:f7:c6:e9:70:65:84:c3:f4:be
Signer

Actual PE Digest

b3:e2:92:59:19:07:c9:f8:5e:e9:92:93:14:0c:99:69:0a:63:1f:d5:90:ba:1c:f7:c6:e9:70:65:84:c3:f4:be

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.cs-cz.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

81:22:75:0c:6c:ac:dd:d2:2b:55:f4:75:18:ae:4d:2f:c9:87:1f:46:01:df:12:b8:a4:0d:ea:4d:b9:f8:a7:60
Signer

Actual PE Digest

81:22:75:0c:6c:ac:dd:d2:2b:55:f4:75:18:ae:4d:2f:c9:87:1f:46:01:df:12:b8:a4:0d:ea:4d:b9:f8:a7:60

Digest Algorithm

sha256

PE Digest Matches

true

81:22:75:0c:6c:ac:dd:d2:2b:55:f4:75:18:ae:4d:2f:c9:87:1f:46:01:df:12:b8:a4:0d:ea:4d:b9:f8:a7:60
Signer

Actual PE Digest

81:22:75:0c:6c:ac:dd:d2:2b:55:f4:75:18:ae:4d:2f:c9:87:1f:46:01:df:12:b8:a4:0d:ea:4d:b9:f8:a7:60

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.da-dk.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

90:b7:39:a6:4a:53:f5:98:81:f2:e5:19:dc:45:06:8e:5f:21:fb:e4:69:73:f3:2a:4b:e1:99:15:4f:5d:ae:23
Signer

Actual PE Digest

90:b7:39:a6:4a:53:f5:98:81:f2:e5:19:dc:45:06:8e:5f:21:fb:e4:69:73:f3:2a:4b:e1:99:15:4f:5d:ae:23

Digest Algorithm

sha256

PE Digest Matches

true

90:b7:39:a6:4a:53:f5:98:81:f2:e5:19:dc:45:06:8e:5f:21:fb:e4:69:73:f3:2a:4b:e1:99:15:4f:5d:ae:23
Signer

Actual PE Digest

90:b7:39:a6:4a:53:f5:98:81:f2:e5:19:dc:45:06:8e:5f:21:fb:e4:69:73:f3:2a:4b:e1:99:15:4f:5d:ae:23

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.de-de.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

d5:03:f5:87:f2:70:b5:87:bd:2e:f9:bf:0d:5b:a4:7f:7f:5b:39:f7:3a:5d:e6:6f:6d:6f:1a:e8:04:de:96:3e
Signer

Actual PE Digest

d5:03:f5:87:f2:70:b5:87:bd:2e:f9:bf:0d:5b:a4:7f:7f:5b:39:f7:3a:5d:e6:6f:6d:6f:1a:e8:04:de:96:3e

Digest Algorithm

sha256

PE Digest Matches

true

d5:03:f5:87:f2:70:b5:87:bd:2e:f9:bf:0d:5b:a4:7f:7f:5b:39:f7:3a:5d:e6:6f:6d:6f:1a:e8:04:de:96:3e
Signer

Actual PE Digest

d5:03:f5:87:f2:70:b5:87:bd:2e:f9:bf:0d:5b:a4:7f:7f:5b:39:f7:3a:5d:e6:6f:6d:6f:1a:e8:04:de:96:3e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.el-gr.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

58:1f:e4:6c:32:4c:00:a3:f0:6e:db:45:a9:e4:02:1e:ca:6f:9b:f2:80:0c:2e:c4:e8:b7:20:c6:57:9a:2b:2e
Signer

Actual PE Digest

58:1f:e4:6c:32:4c:00:a3:f0:6e:db:45:a9:e4:02:1e:ca:6f:9b:f2:80:0c:2e:c4:e8:b7:20:c6:57:9a:2b:2e

Digest Algorithm

sha256

PE Digest Matches

true

58:1f:e4:6c:32:4c:00:a3:f0:6e:db:45:a9:e4:02:1e:ca:6f:9b:f2:80:0c:2e:c4:e8:b7:20:c6:57:9a:2b:2e
Signer

Actual PE Digest

58:1f:e4:6c:32:4c:00:a3:f0:6e:db:45:a9:e4:02:1e:ca:6f:9b:f2:80:0c:2e:c4:e8:b7:20:c6:57:9a:2b:2e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.en-gb.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

96:75:a8:3c:d2:e9:68:07:a8:15:21:14:2d:58:31:b8:30:68:98:2e:a7:e4:02:d4:79:1b:63:51:86:27:35:6a
Signer

Actual PE Digest

96:75:a8:3c:d2:e9:68:07:a8:15:21:14:2d:58:31:b8:30:68:98:2e:a7:e4:02:d4:79:1b:63:51:86:27:35:6a

Digest Algorithm

sha256

PE Digest Matches

true

96:75:a8:3c:d2:e9:68:07:a8:15:21:14:2d:58:31:b8:30:68:98:2e:a7:e4:02:d4:79:1b:63:51:86:27:35:6a
Signer

Actual PE Digest

96:75:a8:3c:d2:e9:68:07:a8:15:21:14:2d:58:31:b8:30:68:98:2e:a7:e4:02:d4:79:1b:63:51:86:27:35:6a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.en-us.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

40:8f:ad:7f:4c:60:5e:cd:3d:44:58:d0:78:70:0a:ee:7a:0b:ea:25:20:52:57:14:19:c8:09:b6:69:ca:32:71
Signer

Actual PE Digest

40:8f:ad:7f:4c:60:5e:cd:3d:44:58:d0:78:70:0a:ee:7a:0b:ea:25:20:52:57:14:19:c8:09:b6:69:ca:32:71

Digest Algorithm

sha256

PE Digest Matches

true

40:8f:ad:7f:4c:60:5e:cd:3d:44:58:d0:78:70:0a:ee:7a:0b:ea:25:20:52:57:14:19:c8:09:b6:69:ca:32:71
Signer

Actual PE Digest

40:8f:ad:7f:4c:60:5e:cd:3d:44:58:d0:78:70:0a:ee:7a:0b:ea:25:20:52:57:14:19:c8:09:b6:69:ca:32:71

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.es-es.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

b3:df:3e:ef:b3:79:fa:69:25:83:d3:8b:88:35:ca:47:7e:f0:a8:60:52:1c:e5:17:7d:0e:c4:a5:f4:14:71:6b
Signer

Actual PE Digest

b3:df:3e:ef:b3:79:fa:69:25:83:d3:8b:88:35:ca:47:7e:f0:a8:60:52:1c:e5:17:7d:0e:c4:a5:f4:14:71:6b

Digest Algorithm

sha256

PE Digest Matches

true

b3:df:3e:ef:b3:79:fa:69:25:83:d3:8b:88:35:ca:47:7e:f0:a8:60:52:1c:e5:17:7d:0e:c4:a5:f4:14:71:6b
Signer

Actual PE Digest

b3:df:3e:ef:b3:79:fa:69:25:83:d3:8b:88:35:ca:47:7e:f0:a8:60:52:1c:e5:17:7d:0e:c4:a5:f4:14:71:6b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.es-mx.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

53:7d:86:ba:ca:60:14:cb:e4:b1:ca:31:2b:99:ec:59:c8:49:3c:a9:72:1c:aa:2e:de:1b:db:43:8f:bc:8c:9d
Signer

Actual PE Digest

53:7d:86:ba:ca:60:14:cb:e4:b1:ca:31:2b:99:ec:59:c8:49:3c:a9:72:1c:aa:2e:de:1b:db:43:8f:bc:8c:9d

Digest Algorithm

sha256

PE Digest Matches

true

53:7d:86:ba:ca:60:14:cb:e4:b1:ca:31:2b:99:ec:59:c8:49:3c:a9:72:1c:aa:2e:de:1b:db:43:8f:bc:8c:9d
Signer

Actual PE Digest

53:7d:86:ba:ca:60:14:cb:e4:b1:ca:31:2b:99:ec:59:c8:49:3c:a9:72:1c:aa:2e:de:1b:db:43:8f:bc:8c:9d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.et-ee.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

5d:3b:66:57:2e:c2:1a:34:66:9f:a0:06:3f:f9:90:dd:41:8f:8b:09:08:ba:08:73:cd:47:f2:73:b9:01:43:2c
Signer

Actual PE Digest

5d:3b:66:57:2e:c2:1a:34:66:9f:a0:06:3f:f9:90:dd:41:8f:8b:09:08:ba:08:73:cd:47:f2:73:b9:01:43:2c

Digest Algorithm

sha256

PE Digest Matches

true

5d:3b:66:57:2e:c2:1a:34:66:9f:a0:06:3f:f9:90:dd:41:8f:8b:09:08:ba:08:73:cd:47:f2:73:b9:01:43:2c
Signer

Actual PE Digest

5d:3b:66:57:2e:c2:1a:34:66:9f:a0:06:3f:f9:90:dd:41:8f:8b:09:08:ba:08:73:cd:47:f2:73:b9:01:43:2c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.fi-fi.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

5e:e3:74:de:e7:94:64:ed:52:01:41:77:70:22:0d:e4:cc:1a:b7:82:a8:a0:ae:06:a6:9a:66:c4:6d:ec:28:8d
Signer

Actual PE Digest

5e:e3:74:de:e7:94:64:ed:52:01:41:77:70:22:0d:e4:cc:1a:b7:82:a8:a0:ae:06:a6:9a:66:c4:6d:ec:28:8d

Digest Algorithm

sha256

PE Digest Matches

true

5e:e3:74:de:e7:94:64:ed:52:01:41:77:70:22:0d:e4:cc:1a:b7:82:a8:a0:ae:06:a6:9a:66:c4:6d:ec:28:8d
Signer

Actual PE Digest

5e:e3:74:de:e7:94:64:ed:52:01:41:77:70:22:0d:e4:cc:1a:b7:82:a8:a0:ae:06:a6:9a:66:c4:6d:ec:28:8d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.fr-ca.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

fd:0a:75:63:60:fa:bd:db:71:c9:5b:b3:e9:ef:60:96:0f:d5:50:be:e8:52:9b:46:b1:85:d4:28:91:a5:4f:2c
Signer

Actual PE Digest

fd:0a:75:63:60:fa:bd:db:71:c9:5b:b3:e9:ef:60:96:0f:d5:50:be:e8:52:9b:46:b1:85:d4:28:91:a5:4f:2c

Digest Algorithm

sha256

PE Digest Matches

true

fd:0a:75:63:60:fa:bd:db:71:c9:5b:b3:e9:ef:60:96:0f:d5:50:be:e8:52:9b:46:b1:85:d4:28:91:a5:4f:2c
Signer

Actual PE Digest

fd:0a:75:63:60:fa:bd:db:71:c9:5b:b3:e9:ef:60:96:0f:d5:50:be:e8:52:9b:46:b1:85:d4:28:91:a5:4f:2c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.fr-fr.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

8c:00:52:71:56:5f:a5:1c:8a:1b:63:77:c4:7e:49:76:17:49:c1:9f:bc:47:85:9e:88:15:e3:1a:e4:b9:69:f2
Signer

Actual PE Digest

8c:00:52:71:56:5f:a5:1c:8a:1b:63:77:c4:7e:49:76:17:49:c1:9f:bc:47:85:9e:88:15:e3:1a:e4:b9:69:f2

Digest Algorithm

sha256

PE Digest Matches

true

8c:00:52:71:56:5f:a5:1c:8a:1b:63:77:c4:7e:49:76:17:49:c1:9f:bc:47:85:9e:88:15:e3:1a:e4:b9:69:f2
Signer

Actual PE Digest

8c:00:52:71:56:5f:a5:1c:8a:1b:63:77:c4:7e:49:76:17:49:c1:9f:bc:47:85:9e:88:15:e3:1a:e4:b9:69:f2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.he-il.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

a1:f3:ab:ae:b3:df:48:e4:1d:6b:d5:d7:0e:50:08:4a:48:49:8a:3c:96:61:95:e3:d0:8a:83:f5:c7:05:4e:05
Signer

Actual PE Digest

a1:f3:ab:ae:b3:df:48:e4:1d:6b:d5:d7:0e:50:08:4a:48:49:8a:3c:96:61:95:e3:d0:8a:83:f5:c7:05:4e:05

Digest Algorithm

sha256

PE Digest Matches

true

a1:f3:ab:ae:b3:df:48:e4:1d:6b:d5:d7:0e:50:08:4a:48:49:8a:3c:96:61:95:e3:d0:8a:83:f5:c7:05:4e:05
Signer

Actual PE Digest

a1:f3:ab:ae:b3:df:48:e4:1d:6b:d5:d7:0e:50:08:4a:48:49:8a:3c:96:61:95:e3:d0:8a:83:f5:c7:05:4e:05

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.hi-in.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

41:e8:dd:9f:c0:47:5a:2e:26:62:49:0d:ce:8e:0a:1f:06:39:01:db:2f:1e:5f:87:ee:e5:24:6b:de:ae:d2:03
Signer

Actual PE Digest

41:e8:dd:9f:c0:47:5a:2e:26:62:49:0d:ce:8e:0a:1f:06:39:01:db:2f:1e:5f:87:ee:e5:24:6b:de:ae:d2:03

Digest Algorithm

sha256

PE Digest Matches

true

41:e8:dd:9f:c0:47:5a:2e:26:62:49:0d:ce:8e:0a:1f:06:39:01:db:2f:1e:5f:87:ee:e5:24:6b:de:ae:d2:03
Signer

Actual PE Digest

41:e8:dd:9f:c0:47:5a:2e:26:62:49:0d:ce:8e:0a:1f:06:39:01:db:2f:1e:5f:87:ee:e5:24:6b:de:ae:d2:03

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.hr-hr.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

8f:ba:60:a5:87:f0:6d:ff:2b:4a:1b:5f:d9:9f:81:89:fd:4e:e4:63:34:6f:ee:2c:b7:fb:a4:ac:02:d8:ea:8b
Signer

Actual PE Digest

8f:ba:60:a5:87:f0:6d:ff:2b:4a:1b:5f:d9:9f:81:89:fd:4e:e4:63:34:6f:ee:2c:b7:fb:a4:ac:02:d8:ea:8b

Digest Algorithm

sha256

PE Digest Matches

true

8f:ba:60:a5:87:f0:6d:ff:2b:4a:1b:5f:d9:9f:81:89:fd:4e:e4:63:34:6f:ee:2c:b7:fb:a4:ac:02:d8:ea:8b
Signer

Actual PE Digest

8f:ba:60:a5:87:f0:6d:ff:2b:4a:1b:5f:d9:9f:81:89:fd:4e:e4:63:34:6f:ee:2c:b7:fb:a4:ac:02:d8:ea:8b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.hu-hu.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

8d:98:38:9c:ea:62:16:0e:36:78:1b:c2:1f:9d:b7:73:e1:b4:fe:80:28:cd:21:32:42:36:2d:09:90:4e:d7:bf
Signer

Actual PE Digest

8d:98:38:9c:ea:62:16:0e:36:78:1b:c2:1f:9d:b7:73:e1:b4:fe:80:28:cd:21:32:42:36:2d:09:90:4e:d7:bf

Digest Algorithm

sha256

PE Digest Matches

true

8d:98:38:9c:ea:62:16:0e:36:78:1b:c2:1f:9d:b7:73:e1:b4:fe:80:28:cd:21:32:42:36:2d:09:90:4e:d7:bf
Signer

Actual PE Digest

8d:98:38:9c:ea:62:16:0e:36:78:1b:c2:1f:9d:b7:73:e1:b4:fe:80:28:cd:21:32:42:36:2d:09:90:4e:d7:bf

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.id-id.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

21:50:50:c3:ef:b0:31:87:d8:66:2a:9e:e3:b1:1b:74:7a:77:d1:8b:92:c4:93:58:11:f6:fb:45:74:3a:d5:ab
Signer

Actual PE Digest

21:50:50:c3:ef:b0:31:87:d8:66:2a:9e:e3:b1:1b:74:7a:77:d1:8b:92:c4:93:58:11:f6:fb:45:74:3a:d5:ab

Digest Algorithm

sha256

PE Digest Matches

true

21:50:50:c3:ef:b0:31:87:d8:66:2a:9e:e3:b1:1b:74:7a:77:d1:8b:92:c4:93:58:11:f6:fb:45:74:3a:d5:ab
Signer

Actual PE Digest

21:50:50:c3:ef:b0:31:87:d8:66:2a:9e:e3:b1:1b:74:7a:77:d1:8b:92:c4:93:58:11:f6:fb:45:74:3a:d5:ab

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.it-it.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0a:bf:92:15:5b:02:fa:22:28:66:8a:f0:71:b6:41:17:43:9d:75:2a:8d:52:ce:b0:fb:ae:4d:5f:57:40:bf:e3
Signer

Actual PE Digest

0a:bf:92:15:5b:02:fa:22:28:66:8a:f0:71:b6:41:17:43:9d:75:2a:8d:52:ce:b0:fb:ae:4d:5f:57:40:bf:e3

Digest Algorithm

sha256

PE Digest Matches

true

0a:bf:92:15:5b:02:fa:22:28:66:8a:f0:71:b6:41:17:43:9d:75:2a:8d:52:ce:b0:fb:ae:4d:5f:57:40:bf:e3
Signer

Actual PE Digest

0a:bf:92:15:5b:02:fa:22:28:66:8a:f0:71:b6:41:17:43:9d:75:2a:8d:52:ce:b0:fb:ae:4d:5f:57:40:bf:e3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.ja-jp.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

a9:65:2b:55:c5:ee:d5:10:ef:0b:e7:85:f6:9c:03:bc:64:0e:83:99:4f:81:0e:d7:d5:29:7d:05:1a:33:fd:1e
Signer

Actual PE Digest

a9:65:2b:55:c5:ee:d5:10:ef:0b:e7:85:f6:9c:03:bc:64:0e:83:99:4f:81:0e:d7:d5:29:7d:05:1a:33:fd:1e

Digest Algorithm

sha256

PE Digest Matches

true

a9:65:2b:55:c5:ee:d5:10:ef:0b:e7:85:f6:9c:03:bc:64:0e:83:99:4f:81:0e:d7:d5:29:7d:05:1a:33:fd:1e
Signer

Actual PE Digest

a9:65:2b:55:c5:ee:d5:10:ef:0b:e7:85:f6:9c:03:bc:64:0e:83:99:4f:81:0e:d7:d5:29:7d:05:1a:33:fd:1e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.kk-kz.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

8f:07:34:ea:9d:1b:71:02:0d:2e:ff:c3:8a:c7:c7:2e:43:63:1a:9e:59:59:54:fa:e2:a6:0d:d6:dc:8f:6d:a0
Signer

Actual PE Digest

8f:07:34:ea:9d:1b:71:02:0d:2e:ff:c3:8a:c7:c7:2e:43:63:1a:9e:59:59:54:fa:e2:a6:0d:d6:dc:8f:6d:a0

Digest Algorithm

sha256

PE Digest Matches

true

8f:07:34:ea:9d:1b:71:02:0d:2e:ff:c3:8a:c7:c7:2e:43:63:1a:9e:59:59:54:fa:e2:a6:0d:d6:dc:8f:6d:a0
Signer

Actual PE Digest

8f:07:34:ea:9d:1b:71:02:0d:2e:ff:c3:8a:c7:c7:2e:43:63:1a:9e:59:59:54:fa:e2:a6:0d:d6:dc:8f:6d:a0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.ko-kr.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

6f:01:e0:8d:a3:ce:26:12:75:c3:c2:e3:43:f3:8b:a1:d6:68:37:23:bd:f8:f5:d4:aa:3f:32:88:b7:57:3d:2c
Signer

Actual PE Digest

6f:01:e0:8d:a3:ce:26:12:75:c3:c2:e3:43:f3:8b:a1:d6:68:37:23:bd:f8:f5:d4:aa:3f:32:88:b7:57:3d:2c

Digest Algorithm

sha256

PE Digest Matches

true

6f:01:e0:8d:a3:ce:26:12:75:c3:c2:e3:43:f3:8b:a1:d6:68:37:23:bd:f8:f5:d4:aa:3f:32:88:b7:57:3d:2c
Signer

Actual PE Digest

6f:01:e0:8d:a3:ce:26:12:75:c3:c2:e3:43:f3:8b:a1:d6:68:37:23:bd:f8:f5:d4:aa:3f:32:88:b7:57:3d:2c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.lt-lt.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

dc:89:ac:ea:3f:20:dd:0f:e9:7a:6e:0f:2e:8b:8a:92:fd:60:11:c4:c4:99:e9:65:3d:25:3c:01:fb:d1:ab:32
Signer

Actual PE Digest

dc:89:ac:ea:3f:20:dd:0f:e9:7a:6e:0f:2e:8b:8a:92:fd:60:11:c4:c4:99:e9:65:3d:25:3c:01:fb:d1:ab:32

Digest Algorithm

sha256

PE Digest Matches

true

dc:89:ac:ea:3f:20:dd:0f:e9:7a:6e:0f:2e:8b:8a:92:fd:60:11:c4:c4:99:e9:65:3d:25:3c:01:fb:d1:ab:32
Signer

Actual PE Digest

dc:89:ac:ea:3f:20:dd:0f:e9:7a:6e:0f:2e:8b:8a:92:fd:60:11:c4:c4:99:e9:65:3d:25:3c:01:fb:d1:ab:32

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.lv-lv.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

04:23:5f:10:25:15:2d:d5:e2:66:f6:05:3c:41:ed:3b:0b:0b:78:e8:11:3f:ac:e5:3e:f4:53:1a:88:7b:a5:35
Signer

Actual PE Digest

04:23:5f:10:25:15:2d:d5:e2:66:f6:05:3c:41:ed:3b:0b:0b:78:e8:11:3f:ac:e5:3e:f4:53:1a:88:7b:a5:35

Digest Algorithm

sha256

PE Digest Matches

true

04:23:5f:10:25:15:2d:d5:e2:66:f6:05:3c:41:ed:3b:0b:0b:78:e8:11:3f:ac:e5:3e:f4:53:1a:88:7b:a5:35
Signer

Actual PE Digest

04:23:5f:10:25:15:2d:d5:e2:66:f6:05:3c:41:ed:3b:0b:0b:78:e8:11:3f:ac:e5:3e:f4:53:1a:88:7b:a5:35

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.ms-my.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

d6:f7:a8:c9:cc:f9:c1:e3:78:f4:1b:88:0d:ef:ed:46:2a:f8:d8:c3:5f:b1:b4:a3:de:e4:19:64:8c:c2:84:0e
Signer

Actual PE Digest

d6:f7:a8:c9:cc:f9:c1:e3:78:f4:1b:88:0d:ef:ed:46:2a:f8:d8:c3:5f:b1:b4:a3:de:e4:19:64:8c:c2:84:0e

Digest Algorithm

sha256

PE Digest Matches

true

d6:f7:a8:c9:cc:f9:c1:e3:78:f4:1b:88:0d:ef:ed:46:2a:f8:d8:c3:5f:b1:b4:a3:de:e4:19:64:8c:c2:84:0e
Signer

Actual PE Digest

d6:f7:a8:c9:cc:f9:c1:e3:78:f4:1b:88:0d:ef:ed:46:2a:f8:d8:c3:5f:b1:b4:a3:de:e4:19:64:8c:c2:84:0e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.nb-no.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

6d:72:a2:52:7e:fd:cb:5d:34:41:fb:2e:90:b3:a6:e5:ff:6b:23:62:0d:47:c2:cc:3c:db:b1:ce:df:d3:d2:99
Signer

Actual PE Digest

6d:72:a2:52:7e:fd:cb:5d:34:41:fb:2e:90:b3:a6:e5:ff:6b:23:62:0d:47:c2:cc:3c:db:b1:ce:df:d3:d2:99

Digest Algorithm

sha256

PE Digest Matches

true

6d:72:a2:52:7e:fd:cb:5d:34:41:fb:2e:90:b3:a6:e5:ff:6b:23:62:0d:47:c2:cc:3c:db:b1:ce:df:d3:d2:99
Signer

Actual PE Digest

6d:72:a2:52:7e:fd:cb:5d:34:41:fb:2e:90:b3:a6:e5:ff:6b:23:62:0d:47:c2:cc:3c:db:b1:ce:df:d3:d2:99

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.nl-nl.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

c9:41:4e:89:75:bb:c2:3a:f9:c0:63:e3:4d:01:a4:6d:98:30:bc:27:5d:10:f6:db:48:4a:bc:f7:89:14:28:9c
Signer

Actual PE Digest

c9:41:4e:89:75:bb:c2:3a:f9:c0:63:e3:4d:01:a4:6d:98:30:bc:27:5d:10:f6:db:48:4a:bc:f7:89:14:28:9c

Digest Algorithm

sha256

PE Digest Matches

true

c9:41:4e:89:75:bb:c2:3a:f9:c0:63:e3:4d:01:a4:6d:98:30:bc:27:5d:10:f6:db:48:4a:bc:f7:89:14:28:9c
Signer

Actual PE Digest

c9:41:4e:89:75:bb:c2:3a:f9:c0:63:e3:4d:01:a4:6d:98:30:bc:27:5d:10:f6:db:48:4a:bc:f7:89:14:28:9c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.pl-pl.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

b0:63:17:f0:e9:c3:af:9d:d0:b0:64:58:e9:ec:57:f7:a0:cf:15:0d:7a:38:e1:82:bc:78:3c:33:89:69:5b:3b
Signer

Actual PE Digest

b0:63:17:f0:e9:c3:af:9d:d0:b0:64:58:e9:ec:57:f7:a0:cf:15:0d:7a:38:e1:82:bc:78:3c:33:89:69:5b:3b

Digest Algorithm

sha256

PE Digest Matches

true

b0:63:17:f0:e9:c3:af:9d:d0:b0:64:58:e9:ec:57:f7:a0:cf:15:0d:7a:38:e1:82:bc:78:3c:33:89:69:5b:3b
Signer

Actual PE Digest

b0:63:17:f0:e9:c3:af:9d:d0:b0:64:58:e9:ec:57:f7:a0:cf:15:0d:7a:38:e1:82:bc:78:3c:33:89:69:5b:3b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.pt-br.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

fa:d5:41:d4:0e:f4:b1:71:8b:76:aa:a6:d0:05:04:56:97:06:13:5a:d4:90:e0:58:53:a7:30:ef:4c:a8:e9:f1
Signer

Actual PE Digest

fa:d5:41:d4:0e:f4:b1:71:8b:76:aa:a6:d0:05:04:56:97:06:13:5a:d4:90:e0:58:53:a7:30:ef:4c:a8:e9:f1

Digest Algorithm

sha256

PE Digest Matches

true

fa:d5:41:d4:0e:f4:b1:71:8b:76:aa:a6:d0:05:04:56:97:06:13:5a:d4:90:e0:58:53:a7:30:ef:4c:a8:e9:f1
Signer

Actual PE Digest

fa:d5:41:d4:0e:f4:b1:71:8b:76:aa:a6:d0:05:04:56:97:06:13:5a:d4:90:e0:58:53:a7:30:ef:4c:a8:e9:f1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.pt-pt.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

42:77:3a:d9:56:a3:46:80:42:c4:04:68:ff:d9:a9:7f:9e:78:8c:b8:d1:d0:6f:42:90:cc:8d:1e:53:7f:17:8a
Signer

Actual PE Digest

42:77:3a:d9:56:a3:46:80:42:c4:04:68:ff:d9:a9:7f:9e:78:8c:b8:d1:d0:6f:42:90:cc:8d:1e:53:7f:17:8a

Digest Algorithm

sha256

PE Digest Matches

true

42:77:3a:d9:56:a3:46:80:42:c4:04:68:ff:d9:a9:7f:9e:78:8c:b8:d1:d0:6f:42:90:cc:8d:1e:53:7f:17:8a
Signer

Actual PE Digest

42:77:3a:d9:56:a3:46:80:42:c4:04:68:ff:d9:a9:7f:9e:78:8c:b8:d1:d0:6f:42:90:cc:8d:1e:53:7f:17:8a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.ro-ro.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

6b:48:60:66:f9:7e:56:2f:3c:42:fc:bb:53:e4:d0:21:a0:8b:7c:56:e7:d8:a6:4a:7a:55:06:d4:80:05:3d:6d
Signer

Actual PE Digest

6b:48:60:66:f9:7e:56:2f:3c:42:fc:bb:53:e4:d0:21:a0:8b:7c:56:e7:d8:a6:4a:7a:55:06:d4:80:05:3d:6d

Digest Algorithm

sha256

PE Digest Matches

true

6b:48:60:66:f9:7e:56:2f:3c:42:fc:bb:53:e4:d0:21:a0:8b:7c:56:e7:d8:a6:4a:7a:55:06:d4:80:05:3d:6d
Signer

Actual PE Digest

6b:48:60:66:f9:7e:56:2f:3c:42:fc:bb:53:e4:d0:21:a0:8b:7c:56:e7:d8:a6:4a:7a:55:06:d4:80:05:3d:6d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.ru-ru.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

d6:fc:fd:c7:b5:b9:5e:31:48:ea:68:f8:62:ca:29:20:7f:74:17:6d:56:a1:d4:a9:7e:bf:f3:5f:22:54:a5:86
Signer

Actual PE Digest

d6:fc:fd:c7:b5:b9:5e:31:48:ea:68:f8:62:ca:29:20:7f:74:17:6d:56:a1:d4:a9:7e:bf:f3:5f:22:54:a5:86

Digest Algorithm

sha256

PE Digest Matches

true

d6:fc:fd:c7:b5:b9:5e:31:48:ea:68:f8:62:ca:29:20:7f:74:17:6d:56:a1:d4:a9:7e:bf:f3:5f:22:54:a5:86
Signer

Actual PE Digest

d6:fc:fd:c7:b5:b9:5e:31:48:ea:68:f8:62:ca:29:20:7f:74:17:6d:56:a1:d4:a9:7e:bf:f3:5f:22:54:a5:86

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.sk-sk.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

55:c5:a5:18:64:6a:02:c8:4c:bd:68:f8:99:b8:01:f8:72:06:aa:39:c1:3d:89:8d:50:e6:58:16:30:f8:96:9a
Signer

Actual PE Digest

55:c5:a5:18:64:6a:02:c8:4c:bd:68:f8:99:b8:01:f8:72:06:aa:39:c1:3d:89:8d:50:e6:58:16:30:f8:96:9a

Digest Algorithm

sha256

PE Digest Matches

true

55:c5:a5:18:64:6a:02:c8:4c:bd:68:f8:99:b8:01:f8:72:06:aa:39:c1:3d:89:8d:50:e6:58:16:30:f8:96:9a
Signer

Actual PE Digest

55:c5:a5:18:64:6a:02:c8:4c:bd:68:f8:99:b8:01:f8:72:06:aa:39:c1:3d:89:8d:50:e6:58:16:30:f8:96:9a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.sl-si.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

16:b4:c3:f6:a8:3a:c5:66:1f:f3:bc:60:c5:e4:37:75:16:42:1b:fb:bd:75:37:11:c8:fc:24:fb:0c:ff:cd:d0
Signer

Actual PE Digest

16:b4:c3:f6:a8:3a:c5:66:1f:f3:bc:60:c5:e4:37:75:16:42:1b:fb:bd:75:37:11:c8:fc:24:fb:0c:ff:cd:d0

Digest Algorithm

sha256

PE Digest Matches

true

16:b4:c3:f6:a8:3a:c5:66:1f:f3:bc:60:c5:e4:37:75:16:42:1b:fb:bd:75:37:11:c8:fc:24:fb:0c:ff:cd:d0
Signer

Actual PE Digest

16:b4:c3:f6:a8:3a:c5:66:1f:f3:bc:60:c5:e4:37:75:16:42:1b:fb:bd:75:37:11:c8:fc:24:fb:0c:ff:cd:d0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.sr-latn-rs.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

e1:24:20:8e:e2:8a:9a:49:ce:6e:1c:fb:23:f7:1f:b6:fe:4a:1c:fb:34:4e:a7:73:3c:64:4d:7c:20:2c:72:8f
Signer

Actual PE Digest

e1:24:20:8e:e2:8a:9a:49:ce:6e:1c:fb:23:f7:1f:b6:fe:4a:1c:fb:34:4e:a7:73:3c:64:4d:7c:20:2c:72:8f

Digest Algorithm

sha256

PE Digest Matches

true

e1:24:20:8e:e2:8a:9a:49:ce:6e:1c:fb:23:f7:1f:b6:fe:4a:1c:fb:34:4e:a7:73:3c:64:4d:7c:20:2c:72:8f
Signer

Actual PE Digest

e1:24:20:8e:e2:8a:9a:49:ce:6e:1c:fb:23:f7:1f:b6:fe:4a:1c:fb:34:4e:a7:73:3c:64:4d:7c:20:2c:72:8f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.sv-se.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

0a:31:69:66:a6:62:e9:7a:d6:28:91:09:6a:a1:91:31:88:55:0a:b0:cb:76:b9:86:59:d9:d4:44:df:27:4c:1c
Signer

Actual PE Digest

0a:31:69:66:a6:62:e9:7a:d6:28:91:09:6a:a1:91:31:88:55:0a:b0:cb:76:b9:86:59:d9:d4:44:df:27:4c:1c

Digest Algorithm

sha256

PE Digest Matches

true

0a:31:69:66:a6:62:e9:7a:d6:28:91:09:6a:a1:91:31:88:55:0a:b0:cb:76:b9:86:59:d9:d4:44:df:27:4c:1c
Signer

Actual PE Digest

0a:31:69:66:a6:62:e9:7a:d6:28:91:09:6a:a1:91:31:88:55:0a:b0:cb:76:b9:86:59:d9:d4:44:df:27:4c:1c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.th-th.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

a7:21:da:e5:5a:a1:66:f8:b2:f6:fe:26:55:b0:bd:a6:8f:5b:41:8e:e0:f0:54:58:17:95:40:df:cd:e0:94:ac
Signer

Actual PE Digest

a7:21:da:e5:5a:a1:66:f8:b2:f6:fe:26:55:b0:bd:a6:8f:5b:41:8e:e0:f0:54:58:17:95:40:df:cd:e0:94:ac

Digest Algorithm

sha256

PE Digest Matches

true

a7:21:da:e5:5a:a1:66:f8:b2:f6:fe:26:55:b0:bd:a6:8f:5b:41:8e:e0:f0:54:58:17:95:40:df:cd:e0:94:ac
Signer

Actual PE Digest

a7:21:da:e5:5a:a1:66:f8:b2:f6:fe:26:55:b0:bd:a6:8f:5b:41:8e:e0:f0:54:58:17:95:40:df:cd:e0:94:ac

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.tr-tr.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

ec:2f:98:aa:11:ce:51:bd:0e:21:f6:b7:76:75:e8:f6:17:bc:c9:7e:1a:cf:7d:d8:d0:2c:cc:db:7e:9c:3e:a5
Signer

Actual PE Digest

ec:2f:98:aa:11:ce:51:bd:0e:21:f6:b7:76:75:e8:f6:17:bc:c9:7e:1a:cf:7d:d8:d0:2c:cc:db:7e:9c:3e:a5

Digest Algorithm

sha256

PE Digest Matches

true

ec:2f:98:aa:11:ce:51:bd:0e:21:f6:b7:76:75:e8:f6:17:bc:c9:7e:1a:cf:7d:d8:d0:2c:cc:db:7e:9c:3e:a5
Signer

Actual PE Digest

ec:2f:98:aa:11:ce:51:bd:0e:21:f6:b7:76:75:e8:f6:17:bc:c9:7e:1a:cf:7d:d8:d0:2c:cc:db:7e:9c:3e:a5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.uk-ua.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

e9:6b:aa:19:7e:60:c1:ec:28:df:03:4a:2d:68:a1:c8:6a:c8:b2:ba:97:2a:c5:1d:fe:0b:ab:be:bb:c6:91:a8
Signer

Actual PE Digest

e9:6b:aa:19:7e:60:c1:ec:28:df:03:4a:2d:68:a1:c8:6a:c8:b2:ba:97:2a:c5:1d:fe:0b:ab:be:bb:c6:91:a8

Digest Algorithm

sha256

PE Digest Matches

true

e9:6b:aa:19:7e:60:c1:ec:28:df:03:4a:2d:68:a1:c8:6a:c8:b2:ba:97:2a:c5:1d:fe:0b:ab:be:bb:c6:91:a8
Signer

Actual PE Digest

e9:6b:aa:19:7e:60:c1:ec:28:df:03:4a:2d:68:a1:c8:6a:c8:b2:ba:97:2a:c5:1d:fe:0b:ab:be:bb:c6:91:a8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.vi-vn.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

88:04:22:3d:1c:e1:c0:77:01:bf:5d:6f:eb:63:16:04:46:0c:d1:d6:02:80:f6:f7:e0:7e:66:1a:81:16:f4:fc
Signer

Actual PE Digest

88:04:22:3d:1c:e1:c0:77:01:bf:5d:6f:eb:63:16:04:46:0c:d1:d6:02:80:f6:f7:e0:7e:66:1a:81:16:f4:fc

Digest Algorithm

sha256

PE Digest Matches

true

88:04:22:3d:1c:e1:c0:77:01:bf:5d:6f:eb:63:16:04:46:0c:d1:d6:02:80:f6:f7:e0:7e:66:1a:81:16:f4:fc
Signer

Actual PE Digest

88:04:22:3d:1c:e1:c0:77:01:bf:5d:6f:eb:63:16:04:46:0c:d1:d6:02:80:f6:f7:e0:7e:66:1a:81:16:f4:fc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.zh-cn.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

1a:af:14:55:4e:5c:4a:fb:49:9e:9d:64:4b:4d:26:08:93:16:f6:ff:70:3d:1a:e0:13:98:80:b8:40:ea:31:34
Signer

Actual PE Digest

1a:af:14:55:4e:5c:4a:fb:49:9e:9d:64:4b:4d:26:08:93:16:f6:ff:70:3d:1a:e0:13:98:80:b8:40:ea:31:34

Digest Algorithm

sha256

PE Digest Matches

true

1a:af:14:55:4e:5c:4a:fb:49:9e:9d:64:4b:4d:26:08:93:16:f6:ff:70:3d:1a:e0:13:98:80:b8:40:ea:31:34
Signer

Actual PE Digest

1a:af:14:55:4e:5c:4a:fb:49:9e:9d:64:4b:4d:26:08:93:16:f6:ff:70:3d:1a:e0:13:98:80:b8:40:ea:31:34

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RINTL.zh-tw.dll

.dll windows x64

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

a9:2b:a1:20:6b:04:33:4b:d5:02:15:6f:ad:b2:14:ba:66:f5:a9:b4:bb:27:7f:ed:6d:bd:91:0e:9f:d3:67:2d
Signer

Actual PE Digest

a9:2b:a1:20:6b:04:33:4b:d5:02:15:6f:ad:b2:14:ba:66:f5:a9:b4:bb:27:7f:ed:6d:bd:91:0e:9f:d3:67:2d

Digest Algorithm

sha256

PE Digest Matches

true

a9:2b:a1:20:6b:04:33:4b:d5:02:15:6f:ad:b2:14:ba:66:f5:a9:b4:bb:27:7f:ed:6d:bd:91:0e:9f:d3:67:2d
Signer

Actual PE Digest

a9:2b:a1:20:6b:04:33:4b:d5:02:15:6f:ad:b2:14:ba:66:f5:a9:b4:bb:27:7f:ed:6d:bd:91:0e:9f:d3:67:2d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

C2RUI.dll

.dll windows x64

e430976b76a696f0e988f7ccec47391e

Code Sign

33:00:00:04:39:f6:1f:7a:67:6d:a0:00:af:00:00:00:00:04:39
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:25

Not After

01/09/2022, 18:25

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:02:55:18:1d:a4:2e:e0:86:fc:15:00:00:00:00:02:55
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:33

Not After

01/09/2022, 18:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

cc:8a:33:9d:bd:fd:c9:62:6d:ee:80:a7:4e:b3:7d:6a:30:8d:3d:31:ae:bf:d6:0d:d3:17:ad:fb:e3:36:d5:bc
Signer

Actual PE Digest

cc:8a:33:9d:bd:fd:c9:62:6d:ee:80:a7:4e:b3:7d:6a:30:8d:3d:31:ae:bf:d6:0d:d3:17:ad:fb:e3:36:d5:bc

Digest Algorithm

sha256

PE Digest Matches

true

cc:8a:33:9d:bd:fd:c9:62:6d:ee:80:a7:4e:b3:7d:6a:30:8d:3d:31:ae:bf:d6:0d:d3:17:ad:fb:e3:36:d5:bc
Signer

Actual PE Digest

cc:8a:33:9d:bd:fd:c9:62:6d:ee:80:a7:4e:b3:7d:6a:30:8d:3d:31:ae:bf:d6:0d:d3:17:ad:fb:e3:36:d5:bc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Imports

advapi32

RegCreateKeyExW

RegCloseKey

RegQueryValueExW

RegOpenKeyExW

RegSetValueExW

CreateWellKnownSid

RegEnumKeyExW

RegQueryInfoKeyW

RegEnumValueW

RegDeleteTreeW

RegDeleteKeyW

RegGetValueW

RegDeleteValueW

EventWriteTransfer

EventRegister

EventUnregister

GetTokenInformation

IsValidSid

GetSidSubAuthorityCount

GetSidSubAuthority

ReportEventW

RegisterEventSourceW

DeregisterEventSource

GetFileSecurityW

SetFileSecurityW

RevertToSelf

OpenThreadToken

OpenProcessToken

GetLengthSid

CopySid

InitializeAcl

AddAccessAllowedAce

AllocateAndInitializeSid

FreeSid

InitializeSecurityDescriptor

SetSecurityDescriptorDacl

GetSecurityDescriptorDacl

ConvertStringSecurityDescriptorToSecurityDescriptorW

ConvertSidToStringSidA

EqualSid

RegEnumValueA

RegDeleteValueA

ole32

CoRevokeInitializeSpy

CoInitializeEx

CoTaskMemAlloc

CoTaskMemFree

CoUninitialize

CoCreateInstance

StringFromGUID2

CoCreateGuid

CoCreateFreeThreadedMarshaler

CoRegisterInitializeSpy

CreateStreamOnHGlobal

gdi32

CreateSolidBrush

Rectangle

DeleteObject

SetDCPenColor

SetBkColor

GetTextExtentPoint32W

SetDCBrushColor

ExtTextOutW

GetStockObject

CreatePen

GetTextMetricsW

SelectObject

SetTextColor

CreateFontW

GetDeviceCaps

oleaut32

SysAllocString

SysFreeString

kernel32

GetLocalTime

InitializeCriticalSectionAndSpinCount

VirtualQuery

VirtualProtect

GetSystemInfo

UnhandledExceptionFilter

LoadLibraryExA

SetUnhandledExceptionFilter

IsProcessorFeaturePresent

GetCurrentProcess

GetModuleHandleExW

InitializeCriticalSectionEx

GetLastError

CompareStringEx

GetProcAddress

DeleteCriticalSection

FreeLibrary

FlsFree

FlsAlloc

IsWow64Process

CloseHandle

SetEvent

OpenThread

WaitForSingleObject

GetExitCodeThread

CreateEventW

ResetEvent

DisableThreadLibraryCalls

FindClose

UnmapViewOfFile

CreateFileMappingA

MapViewOfFile

Sleep

GetStringTypeExW

LocalFree

FormatMessageA

GetSystemTimeAsFileTime

AcquireSRWLockExclusive

ReleaseSRWLockExclusive

AcquireSRWLockShared

ReleaseSRWLockShared

MultiByteToWideChar

TlsAlloc

TlsFree

FlsGetValue

TlsGetValue

FlsSetValue

TlsSetValue

InitializeSRWLock

RaiseException

ExpandEnvironmentStringsW

WideCharToMultiByte

GetCurrentProcessId

FileTimeToSystemTime

GetUserDefaultLocaleName

IsValidCodePage

SetLastError

GetSystemTime

GetProcessTimes

GetTickCount64

TerminateProcess

GetModuleFileNameA

GetShortPathNameA

GetModuleFileNameW

K32GetModuleFileNameExW

CreateProcessW

GetModuleHandleW

LoadLibraryExW

FindResourceW

SizeofResource

LoadResource

VerSetConditionMask

VerifyVersionInfoW

OpenProcess

GlobalMemoryStatusEx

GetVersionExW

GetDiskFreeSpaceExW

CreateFileW

DeviceIoControl

GetComputerNameW

MulDiv

GetNativeSystemInfo

CreateActCtxW

ActivateActCtx

HeapFree

OutputDebugStringA

FindActCtxSectionStringW

DeactivateActCtx

QueryActCtxW

LoadLibraryW

HeapAlloc

GetProcessHeap

CreateThread

WaitForMultipleObjectsEx

CreateEventExW

WakeConditionVariable

WakeAllConditionVariable

SleepConditionVariableSRW

CloseThreadpoolTimer

SetThreadpoolTimer

WaitForThreadpoolTimerCallbacks

CreateThreadpoolTimer

CloseThreadpoolWait

SetThreadpoolWait

WaitForThreadpoolWaitCallbacks

CreateThreadpoolWait

CreateThreadpoolWork

SubmitThreadpoolWork

ReleaseSemaphore

WaitForSingleObjectEx

QueryDepthSList

GetCurrentThreadId

EnterCriticalSection

LeaveCriticalSection

InitializeSListHead

InterlockedPushEntrySList

InterlockedPopEntrySList

RtlCaptureStackBackTrace

SystemTimeToTzSpecificLocalTime

ReleaseMutex

GetTempPathW

GetLongPathNameW

IsDebuggerPresent

GetFileAttributesExW

FindFirstFileExW

DeleteFileW

MoveFileExW

FindNextFileW

CreateDirectoryW

RemoveDirectoryW

SetFileAttributesW

WriteFile

ReadFile

SetFilePointerEx

SetEndOfFile

GetFileSizeEx

FlushFileBuffers

LockFileEx

UnlockFileEx

CopyFileExW

GetVolumePathNamesForVolumeNameW

SetFileInformationByHandle

RtlLookupFunctionEntry

RtlVirtualUnwind

GetFileType

GetOverlappedResult

GetFileTime

ReplaceFileW

CopyFileW

GetTempFileNameW

QueryPerformanceCounter

QueryPerformanceFrequency

GlobalFree

GlobalAlloc

K32GetProcessMemoryInfo

LockResource

SetFileTime

CancelIoEx

GetProcessAffinityMask

CreateWaitableTimerW

SetWaitableTimerEx

CancelWaitableTimer

GetTickCount

WerRegisterMemoryBlock

WerUnregisterMemoryBlock

QueryFullProcessImageNameW

CreateIoCompletionPort

PostQueuedCompletionStatus

GetThreadIOPendingFlag

GetCurrentThread

GetQueuedCompletionStatus

CreateMemoryResourceNotification

GetFileInformationByHandleEx

IsSystemResumeAutomatic

OutputDebugStringW

RtlCaptureContext

OpenEventA

CreateEventA

OpenMutexA

CreateMutexA

OpenSemaphoreA

CreateSemaphoreA

OpenFileMappingA

LocalAlloc

FindFirstFileW

lstrcmpW

ProcessIdToSessionId

GetPriorityClass

GetExitCodeProcess

GetTimeZoneInformation

GetLocaleInfoEx

LCIDToLocaleName

LocaleNameToLCID

ResolveLocaleName

GetUserPreferredUILanguages

GetACP

GetSystemPowerStatus

EnumSystemLocalesEx

GetSystemDefaultLocaleName

GetUserGeoID

InitOnceComplete

InitOnceBeginInitialize

rstrtmgr

RmGetList

RmRegisterResources

RmStartSession

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy

__std_type_info_compare

__std_exception_copy

__std_type_info_name

strchr

wcsrchr

__std_terminate

wcschr

wcsstr

memmove

__current_exception

__current_exception_context

__C_specific_handler

_purecall

__std_type_info_destroy_list

memset

_CxxThrowException

__C_specific_handler_noexcept

memchr

memcmp

memcpy

msvcp140

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z

?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z

??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z

??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z

??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z

??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ

?_Xbad_alloc@std@@YAXXZ

?_Xout_of_range@std@@YAXPEBD@Z

?_Xlength_error@std@@YAXPEBD@Z

?_Syserror_map@std@@YAPEBDH@Z

?_Winerror_map@std@@YAHH@Z

??1_Lockit@std@@QEAA@XZ

??0_Lockit@std@@QEAA@H@Z

?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ

?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z

??1facet@locale@std@@MEAA@XZ

??0facet@locale@std@@IEAA@_K@Z

?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ

?_Incref@facet@locale@std@@UEAAXXZ

??Bid@locale@std@@QEAA_KXZ

?_Throw_C_error@std@@YAXH@Z

_Mtx_lock

_Mtx_unlock

??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ

_Mtx_init_in_situ

_Mtx_destroy_in_situ

?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z

?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ

??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ

??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ

?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ

?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ

?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ

?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ

?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ

?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z

?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z

?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z

?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z

??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ

??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ

??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@F@Z

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_J@Z

_Thrd_id

_Xtime_get_ticks

?_Throw_Cpp_error@std@@YAXH@Z

_Cnd_init_in_situ

_Cnd_destroy_in_situ

_Cnd_broadcast

_Mtx_current_owns

_Cnd_timedwait

_Query_perf_counter

_Query_perf_frequency

?uncaught_exception@std@@YA_NXZ

?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z

?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ

?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ

?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z

??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ

?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z

?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ

??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ

?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z

?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z

?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z

?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z

?_Xinvalid_argument@std@@YAXPEBD@Z

?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z

?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

?is@?$ctype@_W@std@@QEBA_NF_W@Z

??1_Locinfo@std@@QEAA@XZ

??0_Locinfo@std@@QEAA@PEBD@Z

?id@?$ctype@_W@std@@2V0locale@2@A

?id@?$collate@_W@std@@2V0locale@2@A

_Wcsxfrm

_Wcscoll

?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ

?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z

?tolower@?$ctype@_W@std@@QEBA_W_W@Z

?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z

?toupper@?$ctype@_W@std@@QEBA_W_W@Z

?_Xbad_function_call@std@@YAXXZ

?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z

_Thrd_sleep

??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z

api-ms-win-crt-heap-l1-1-0

malloc

free

realloc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnwprintf_s

__stdio_common_vswprintf

__stdio_common_vsprintf_s

__stdio_common_vswscanf

__stdio_common_vswprintf_s

api-ms-win-crt-runtime-l1-1-0

abort

_execute_onexit_table

_register_onexit_function

_invalid_parameter_noinfo_noreturn

_invalid_parameter_noinfo

_errno

_initialize_onexit_table

terminate

_initialize_narrow_environment

_configure_narrow_argv

_seh_filter_dll

_initterm_e

_initterm

_cexit

_crt_atexit

_clearfp

api-ms-win-crt-string-l1-1-0

_towupper_l

strcmp

isspace

wcstok_s

wcscmp

isdigit

wmemcpy_s

wcsncat_s

wcsnlen

strnlen

isxdigit

wcsncpy_s

strncpy_s

_stricmp

wcscat_s

towlower

iswspace

tolower

wcscpy_s

_wcsicmp

api-ms-win-crt-convert-l1-1-0

_ui64toa_s

_ultow_s

_itow_s

strtol

_ui64tow_s

_i64tow_s

_wtoi

wcstod

wcstol

_wcstoi64

_wcstoui64

wcstoul

api-ms-win-crt-time-l1-1-0

_difftime64

_localtime64_s

wcsftime

_time64

_mktime64

api-ms-win-crt-math-l1-1-0

pow

ceilf

expf

floor

log10

logf

round

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char

_create_locale

gdiplus

GdipAlloc

GdipFree

GdipCloneImage

GdipDrawImageRectI

GdipDeleteGraphics

GdipCreateFromHDC

GdiplusStartup

GdipDisposeImage

GdipGetImageHeight

GdipGetImageWidth

GdipGetImageGraphicsContext

GdipCreateSolidFill

GdipDeleteBrush

GdipFillRectangleI

GdipDrawImageRectRectI

GdipLoadImageFromStream

GdipCreateBitmapFromScan0

Exports

CloseC2RUI

ConfirmDialog

ConfirmOnlineRepairDialog

CreateC2RSplashScreen

DestroyAdminUpdateDeadlineProgressAgent

DestroyC2RSplashScreen

DestroyErrorBagUI

DestroyPackageLockedDialog

DestroyProgressAgent

GetLocalizedCountValue

GetString

LoadC2RUIString

SetupAdminUpdateDeadlineProgressAgent

ShowAdminUpdateDeadlineProgressAgent

ShowBlockingDialog

ShowC2RSplashScreen

ShowDisconnectedToast

ShowDuringProcessShutDownDialog

ShowEnforcedUpdateDialog

ShowErrorBagUI

ShowErrorDialog

ShowFeatureBlockStreamingUI

ShowLessAggressiveProcessKillerDialog

ShowModificationInProgressDialog

ShowOffice15InstallationBlockedUI

ShowPackageLockedDialog

ShowPartialRepairDialog

ShowPostPartialRepairDialog

ShowPostUninstallDialog

ShowPrePartialRepairDialog

ShowPreUninstallDialog

ShowPrereqFailureDialog

ShowProcessKillerDialog

ShowProcessKillerFailureDialog

ShowProgressAgent

ShowProgressAgentInstallationBlocked

ShowRepairDialog

ShowRepairTypePickerDialog

ShowRestartNotifyDialog

ShowRetryUI

ShowStreamingCompleteToast

ShowSxSAppRemovalNotifyDialog

ShowTouchlessAttachNotification

ShowUninstallDialog

ShowUnsupportedSxSConfigDialog

ShowUpdatesAreLateProgressAgent

ShowUpdatesCompleteProgressAgent

ShowUpdatesInProgressProgressAgent

ShowUpdatesReadyToApplyDialog

ShowWaitingPackageLockedDialog

StartApplyProgress

StartClientDownloadProgress

StartDetectionProgress

StartDownloadProgress

StartFullRepairProgress

StartPartialRepairProgress

StartProcessShutDownProgress

StartUninstallProgress

UpdateLabelForC2RSplashScreen

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 651KB - Virtual size: 650KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 59KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 536KB - Virtual size: 536KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

ClientCapabilities.json

ClientEventLogMessages.man

FrequentOfficeUpdateSchedule.xml

InspectorOfficeGadget.exe

.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

b9:1b:1a:20:95:32:6c:76:ae:fb:33:54:4e:36:04:77:42:00:35:78:d5:40:c6:c0:9e:87:6a:f3:45:3f:78:bc
Signer

Actual PE Digest

b9:1b:1a:20:95:32:6c:76:ae:fb:33:54:4e:36:04:77:42:00:35:78:d5:40:c6:c0:9e:87:6a:f3:45:3f:78:bc

Digest Algorithm

sha256

PE Digest Matches

true

b9:1b:1a:20:95:32:6c:76:ae:fb:33:54:4e:36:04:77:42:00:35:78:d5:40:c6:c0:9e:87:6a:f3:45:3f:78:bc
Signer

Actual PE Digest

b9:1b:1a:20:95:32:6c:76:ae:fb:33:54:4e:36:04:77:42:00:35:78:d5:40:c6:c0:9e:87:6a:f3:45:3f:78:bc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_NO_SEH

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

IntegratedOffice.exe

.exe windows x64

01d1783cde28ad088742882f6bdbee0b

Code Sign

33:00:00:04:39:f6:1f:7a:67:6d:a0:00:af:00:00:00:00:04:39
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:25

Not After

01/09/2022, 18:25

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:02:55:18:1d:a4:2e:e0:86:fc:15:00:00:00:00:02:55
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:33

Not After

01/09/2022, 18:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

3a:65:a8:f3:c0:6d:5a:c0:af:9d:a7:70:af:0b:94:95:f8:ce:ed:cb:75:cf:2c:66:e4:07:80:d7:4d:a9:ef:0a
Signer

Actual PE Digest

3a:65:a8:f3:c0:6d:5a:c0:af:9d:a7:70:af:0b:94:95:f8:ce:ed:cb:75:cf:2c:66:e4:07:80:d7:4d:a9:ef:0a

Digest Algorithm

sha256

PE Digest Matches

true

3a:65:a8:f3:c0:6d:5a:c0:af:9d:a7:70:af:0b:94:95:f8:ce:ed:cb:75:cf:2c:66:e4:07:80:d7:4d:a9:ef:0a
Signer

Actual PE Digest

3a:65:a8:f3:c0:6d:5a:c0:af:9d:a7:70:af:0b:94:95:f8:ce:ed:cb:75:cf:2c:66:e4:07:80:d7:4d:a9:ef:0a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCreateKeyExW

RegCloseKey

EventWriteTransfer

EventRegister

EventUnregister

RegEnumKeyExW

RegQueryInfoKeyW

RegEnumValueW

RegOpenKeyExW

RegDeleteTreeW

RegDeleteKeyW

RegGetValueW

RegQueryValueExW

RegSetValueExW

RegDeleteValueW

GetTokenInformation

IsValidSid

GetSidSubAuthorityCount

GetSidSubAuthority

ConvertStringSecurityDescriptorToSecurityDescriptorW

AllocateAndInitializeSid

FreeSid

EqualSid

OpenProcessToken

CreateWellKnownSid

RevertToSelf

OpenThreadToken

GetLengthSid

CopySid

InitializeAcl

AddAccessAllowedAce

InitializeSecurityDescriptor

SetSecurityDescriptorDacl

GetSecurityDescriptorDacl

ConvertSidToStringSidA

CheckTokenMembership

EventWrite

RegNotifyChangeKeyValue

ole32

CoCreateFreeThreadedMarshaler

CoUninitialize

CLSIDFromString

CoRevokeInitializeSpy

CoRegisterInitializeSpy

CoTaskMemAlloc

CreateStreamOnHGlobal

IIDFromString

CoCreateInstance

CoSetProxyBlanket

CoTaskMemFree

StringFromGUID2

CoCreateGuid

CoInitializeEx

gdi32

GetDeviceCaps

oleaut32

SysFreeString

VariantInit

VariantClear

SysAllocString

kernel32

FreeEnvironmentStringsW

GetEnvironmentStringsW

GetCommandLineW

GetCommandLineA

GetOEMCP

GetACP

SetStdHandle

EnumSystemLocalesW

GetLocaleInfoW

CompareStringW

SetEnvironmentVariableW

GetDateFormatW

HeapReAlloc

ExitProcess

GetStdHandle

GetConsoleOutputCP

WriteConsoleW

GetSystemInfo

GetTimeFormatW

VirtualProtect

GetConsoleMode

HeapSize

RtlUnwindEx

IsProcessorFeaturePresent

SetUnhandledExceptionFilter

UnhandledExceptionFilter

RtlVirtualUnwind

RtlLookupFunctionEntry

InitializeCriticalSectionAndSpinCount

GetCPInfo

GetCurrentProcess

GetModuleHandleExW

GetLastError

CompareStringEx

GetProcAddress

FreeLibrary

IsWow64Process

MultiByteToWideChar

RaiseException

InitializeCriticalSectionEx

DeleteCriticalSection

DecodePointer

SetLastError

DeactivateActCtx

ActivateActCtx

LoadLibraryW

FindActCtxSectionStringW

CreateActCtxW

GetModuleFileNameW

QueryActCtxW

OutputDebugStringA

LocalFree

FindClose

UnmapViewOfFile

CloseHandle

CreateFileMappingA

MapViewOfFile

Sleep

GetStringTypeExW

GetUserDefaultLCID

LCMapStringW

GetSystemTimeAsFileTime

GetCurrentThreadId

FlsAlloc

TlsAlloc

FlsFree

TlsFree

FlsGetValue

TlsGetValue

FlsSetValue

TlsSetValue

GetTickCount64

GetModuleHandleW

K32GetProcessMemoryInfo

GlobalMemoryStatusEx

GetCurrentProcessId

LocalAlloc

CreateEventExW

LoadLibraryExW

VerSetConditionMask

VerifyVersionInfoW

GetVersionExW

WideCharToMultiByte

VirtualQuery

AcquireSRWLockExclusive

ReleaseSRWLockExclusive

AcquireSRWLockShared

ReleaseSRWLockShared

GetProcessTimes

TerminateProcess

GetModuleFileNameA

GetShortPathNameA

K32GetModuleFileNameExW

CreateProcessW

FindResourceW

SizeofResource

LoadResource

OpenProcess

GetDiskFreeSpaceExW

CreateFileW

DeviceIoControl

GetComputerNameW

GetLogicalProcessorInformation

GetNativeSystemInfo

GetSystemDirectoryW

HeapFree

HeapAlloc

GetProcessHeap

GetUserDefaultLocaleName

IsValidCodePage

SystemTimeToFileTime

FileTimeToSystemTime

GetCPInfoExW

ReleaseMutex

CreateMutexExW

OpenMutexW

WaitForSingleObjectEx

EnterCriticalSection

TryEnterCriticalSection

LeaveCriticalSection

SetEvent

GetFileAttributesExW

CreateDirectoryW

FindFirstFileExW

DeleteFileW

FindNextFileW

GetFileTime

ReadFile

GetFileSizeEx

SetFilePointerEx

GetTempFileNameW

GetFileType

WriteFile

SetEndOfFile

GetOverlappedResult

ExpandEnvironmentStringsW

GetTempPathW

ReleaseSemaphore

WaitForMultipleObjects

ProcessIdToSessionId

GetCurrentThread

WaitForMultipleObjectsEx

GetProcessAffinityMask

CreateWaitableTimerW

SetWaitableTimerEx

CancelWaitableTimer

QueryDepthSList

InitializeSListHead

InterlockedPushEntrySList

InterlockedPopEntrySList

RtlCaptureStackBackTrace

OpenEventA

CreateEventA

OpenMutexA

CreateMutexA

OpenSemaphoreA

CreateSemaphoreA

OpenFileMappingA

GlobalAlloc

GlobalFree

GetPriorityClass

GetExitCodeProcess

GetTimeZoneInformation

IsValidLocale

GetTickCount

CreateThread

CreateEventW

WakeConditionVariable

WakeAllConditionVariable

SleepConditionVariableSRW

CloseThreadpoolTimer

SetThreadpoolTimer

WaitForThreadpoolTimerCallbacks

CreateThreadpoolTimer

CloseThreadpoolWait

SetThreadpoolWait

WaitForThreadpoolWaitCallbacks

CreateThreadpoolWait

CreateThreadpoolWork

SubmitThreadpoolWork

WaitForSingleObject

ResetEvent

QueryPerformanceCounter

QueryPerformanceFrequency

SetFileTime

FlushFileBuffers

CancelIoEx

GetLongPathNameW

WerRegisterMemoryBlock

WerUnregisterMemoryBlock

QueryFullProcessImageNameW

CreateIoCompletionPort

PostQueuedCompletionStatus

GetThreadIOPendingFlag

GetQueuedCompletionStatus

IsDebuggerPresent

GetStartupInfoW

CreateMemoryResourceNotification

GetSystemPowerStatus

IsSystemResumeAutomatic

QueryUnbiasedInterruptTime

OutputDebugStringW

RtlCaptureContext

LCMapStringEx

GetPhysicallyInstalledSystemMemory

GetProductInfo

LoadLibraryExA

GetLocalTime

InitializeSRWLock

EncodePointer

SleepConditionVariableCS

InitializeConditionVariable

GetSystemDefaultLCID

GetUserGeoID

InitOnceComplete

InitOnceBeginInitialize

GetStringTypeW

RtlPcToFileHeader

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 720KB - Virtual size: 719KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 63KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

MavInject32.exe

.exe windows x86

5b25711b4621879c674d52b6c0a46a1a

Code Sign

33:00:00:03:df:fb:6a:e3:f4:27:ec:b6:a3:00:00:00:00:03:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

fd:dc:a7:e4:00:64:60:6b:69:a8:c4:1a:95:40:77:10:21:ff:5f:cb:24:3a:0d:8e:45:5e:b1:bf:be:8d:bd:41
Signer

Actual PE Digest

fd:dc:a7:e4:00:64:60:6b:69:a8:c4:1a:95:40:77:10:21:ff:5f:cb:24:3a:0d:8e:45:5e:b1:bf:be:8d:bd:41

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapSetInformation

LocalFree

ReadProcessMemory

WideCharToMultiByte

VirtualFreeEx

CreateRemoteThread

VirtualAllocEx

LoadLibraryW

DuplicateHandle

WaitForSingleObject

VirtualQueryEx

IsWow64Process

OutputDebugStringW

FreeLibrary

VirtualQuery

GetLastError

GetStartupInfoW

InitializeSListHead

GetSystemTimeAsFileTime

GetCurrentThreadId

GetCurrentProcessId

QueryPerformanceCounter

IsDebuggerPresent

IsProcessorFeaturePresent

TerminateProcess

GetCurrentProcess

SetUnhandledExceptionFilter

UnhandledExceptionFilter

LCMapStringEx

DecodePointer

EncodePointer

DeleteCriticalSection

InitializeCriticalSectionEx

LeaveCriticalSection

GetStringTypeW

MultiByteToWideChar

CloseHandle

OpenProcess

GetModuleHandleW

WriteProcessMemory

VirtualProtectEx

SetLastError

api-ms-win-crt-locale-l1-1-0

_lock_locales

_unlock_locales

api-ms-win-crt-string-l1-1-0

memset

wcsnlen

__strncnt

strcspn

api-ms-win-crt-runtime-l1-1-0

_initterm

_initterm_e

_c_exit

_register_thread_local_exe_atexit_callback

api-ms-win-crt-private-l1-1-0

_o___pctype_func

_o___std_exception_copy

_o___std_exception_destroy

_o___stdio_common_vsprintf_s

_o__callnewh

_o__calloc_base

_o__cexit

_o__CIpow

_o__configthreadlocale

_o__configure_wide_argv

_o__controlfp_s

_o__crt_atexit

_o__errno

_o__exit

_o__free_base

_o__get_wide_winmain_command_line

_o__initialize_onexit_table

_o__initialize_wide_environment

_o__invalid_parameter_noinfo_noreturn

_o__malloc_base

_o___p__commode

_o__purecall

_o__register_onexit_function

_o__seh_filter_exe

_o__set_app_type

_o__set_fmode

_o__set_new_mode

_o__stricmp

_o__wcsdup

_o__wcsicmp

_o__wcslwr_s

_o__wcsnicmp

_o__wcsupr_s

_o_abort

_o_calloc

_o_exit

_o_free

_o_frexp

_o_islower

_o_isspace

_o_isupper

_o_iswdigit

_o_ldexp

_o_localeconv

_o_malloc

_o_setlocale

_o_strtod

_o_strtof

_o_terminate

_o_tolower

__uncaught_exception

__current_exception

__current_exception_context

_except_handler4_common

_CxxThrowException

_o____mb_cur_max_func

_o____lc_locale_name_func

_o____lc_codepage_func

strrchr

wcsstr

__CxxFrameHandler3

memchr

memcmp

memcpy

memmove

ntdll

NtQueryInformationProcess

RtlNtStatusToDosError

shell32

CommandLineToArgvW

advapi32

RegQueryValueExW

RegCloseKey

RegOpenKeyExW

Sections

.text
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

OfficeC2RClient.exe

.exe windows x64

94c881835de31e1a26112780cb2d9db2

Code Sign

33:00:00:04:90:0e:61:14:98:12:78:23:70:00:00:00:00:04:90
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/05/2022, 20:47

Not After

11/05/2023, 20:47

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:02:cf:a0:25:90:e3:13:04:ef:15:00:00:00:00:02:cf
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/05/2022, 20:46

Not After

11/05/2023, 20:46

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

e0:b0:19:25:86:33:dd:ba:e2:d2:51:9b:0b:44:81:5f:40:fe:eb:db:e9:6b:3c:4d:10:7b:b6:3d:ec:01:6a:3f
Signer

Actual PE Digest

e0:b0:19:25:86:33:dd:ba:e2:d2:51:9b:0b:44:81:5f:40:fe:eb:db:e9:6b:3c:4d:10:7b:b6:3d:ec:01:6a:3f

Digest Algorithm

sha256

PE Digest Matches

true

e0:b0:19:25:86:33:dd:ba:e2:d2:51:9b:0b:44:81:5f:40:fe:eb:db:e9:6b:3c:4d:10:7b:b6:3d:ec:01:6a:3f
Signer

Actual PE Digest

e0:b0:19:25:86:33:dd:ba:e2:d2:51:9b:0b:44:81:5f:40:fe:eb:db:e9:6b:3c:4d:10:7b:b6:3d:ec:01:6a:3f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCreateKeyExW

RegCloseKey

RegSetValueExW

RegOpenKeyExW

RegQueryValueExW

GetTokenInformation

OpenProcessToken

ConvertStringSecurityDescriptorToSecurityDescriptorW

ReportEventW

RegisterEventSourceW

DeregisterEventSource

EventWriteTransfer

EventRegister

EventUnregister

RegEnumKeyExW

RegQueryInfoKeyW

RegEnumValueW

RegDeleteTreeW

RegDeleteKeyW

RegGetValueW

RegDeleteValueW

IsValidSid

GetSidSubAuthorityCount

GetSidSubAuthority

RegNotifyChangeKeyValue

EventWrite

AllocateAndInitializeSid

FreeSid

EqualSid

CreateWellKnownSid

RevertToSelf

OpenThreadToken

GetLengthSid

CopySid

InitializeAcl

AddAccessAllowedAce

InitializeSecurityDescriptor

SetSecurityDescriptorDacl

GetSecurityDescriptorDacl

ConvertSidToStringSidA

CheckTokenMembership

RegEnumValueA

RegDeleteValueA

RegGetValueA

GetFileSecurityW

SetFileSecurityW

IsTextUnicode

OpenSCManagerW

CloseServiceHandle

OpenServiceW

QueryServiceStatusEx

QueryServiceConfigW

StartServiceW

ControlService

EnumDependentServicesW

DeleteService

CreateServiceW

ChangeServiceConfig2W

ChangeServiceConfigW

SetServiceObjectSecurity

RegOpenKeyExA

RegSetKeyValueW

EventProviderEnabled

GetNamedSecurityInfoW

SetEntriesInAclW

SetNamedSecurityInfoW

GetAclInformation

GetAce

RegQueryValueExA

gdi32

CreateHalftonePalette

SelectPalette

RealizePalette

GetBrushOrgEx

SetBrushOrgEx

CreateDIBSection

GetDIBits

CreatePatternBrush

StretchDIBits

SetBkColor

ExtTextOutW

ExcludeClipRect

ExtSelectClipRgn

GetClipRgn

GetPixel

SaveDC

RestoreDC

GetCurrentObject

CreateRectRgn

GetLayout

SetDIBColorTable

CreateBitmap

SetDIBits

CreateDIBitmap

CreatePolygonRgn

Polygon

CombineRgn

GetStockObject

SetDCBrushColor

CreatePen

MoveToEx

LineTo

EqualRgn

SetRectRgn

OffsetRgn

Ellipse

RoundRect

GetBkColor

GetTextColor

TextOutW

PatBlt

GetViewportExtEx

GetWindowExtEx

CreateDCW

CreateFontIndirectW

GetDeviceCaps

SetViewportOrgEx

SetWindowOrgEx

IntersectClipRect

CreateSolidBrush

DeleteObject

SetStretchBltMode

GetObjectW

CreateFontW

SetDCPenColor

Rectangle

GetRgnBox

OffsetClipRgn

SetPixel

CreateRectRgnIndirect

GetViewportOrgEx

DeleteEnhMetaFile

CreateEnhMetaFileW

SetViewportExtEx

CloseEnhMetaFile

PlayEnhMetaFile

CopyEnhMetaFileW

SetLayout

GetTextMetricsW

GetTextExtentPoint32W

D3DKMTCheckOcclusion

GetDIBColorTable

RectVisible

GetTextCharsetInfo

GetTextFaceW

GetFontData

CreateFontIndirectA

TranslateCharsetInfo

GetGlyphIndicesW

GetOutlineTextMetricsW

GetTextAlign

GetCharWidthW

GetTextExtentPointW

EnumFontFamiliesExW

SetWorldTransform

UnrealizeObject

GetROP2

EndPage

StartDocW

SetTextCharacterExtra

FillRgn

PtVisible

GetMapMode

SetTextAlign

GdiComment

SetMapMode

BitBlt

SelectObject

CreateCompatibleDC

StretchBlt

GdiFlush

GetClipBox

Escape

GetCharWidthI

GetRandomRgn

SetROP2

GetCharABCWidthsFloatW

InvertRgn

GetSystemPaletteUse

EnumObjects

GetGlyphOutlineW

PtInRegion

ResizePalette

RectInRegion

GetTextExtentExPointI

GetCharABCWidthsW

SetColorAdjustment

GetTextExtentPointI

SetTextJustification

SetPaletteEntries

DrawEscape

GetCharABCWidthsI

GetMetaRgn

GetRegionData

SetMapperFlags

PolyPolygon

ExtEscape

GetBoundsRect

GetSystemPaletteEntries

PolyTextOutW

ColorCorrectPalette

SetPolyFillMode

SetBitmapDimensionEx

CheckColorsInGamut

GetWindowOrgEx

MaskBlt

GetTextExtentExPointA

GetDeviceGammaRamp

ExtFloodFill

AnimatePalette

SelectClipPath

GetDCBrushColor

GetNearestPaletteIndex

SetICMProfileW

CreateCompatibleBitmap

DeleteDC

SetTextColor

SetDIBitsToDevice

SetBkMode

GetFontLanguageInfo

GetTextCharset

SetSystemPaletteUse

UpdateColors

GetCharWidth32W

PaintRgn

Chord

PlgBlt

GetPaletteEntries

SetICMMode

EndDoc

GetStretchBltMode

GetBitmapDimensionEx

GetCharWidthFloatW

GetColorAdjustment

EnumICMProfilesW

SetMetaRgn

GetCharacterPlacementW

AbortDoc

GetTextCharacterExtra

FrameRgn

GetAspectRatioFilterEx

GetTextExtentExPointW

GetDCOrgEx

SetBoundsRect

GetLogColorSpaceW

GetBkMode

GetKerningPairsW

GetDCPenColor

GetTextExtentPoint32A

SetDeviceGammaRamp

StartPage

Pie

ExtTextOutA

GetFontUnicodeRanges

GetICMProfileW

ColorMatchToTarget

GetPolyFillMode

CancelDC

GetNearestColor

GetObjectType

SetAbortProc

DeleteColorSpace

ResetDCW

CreateEllipticRgn

CreatePenIndirect

CreatePalette

ExtCreatePen

ExtCreateRegion

CreatePolyPolygonRgn

CreateDIBPatternBrushPt

CreateRoundRectRgn

CreateEllipticRgnIndirect

CreateHatchBrush

CreateColorSpaceW

CreateBrushIndirect

CreateBitmapIndirect

CreateICW

SetColorSpace

SelectClipRgn

kernel32

GetEnvironmentVariableW

GetLongPathNameW

GetThreadLocale

MoveFileExW

FindFirstFileW

lstrcmpW

CopyFileW

CompareFileTime

ReplaceFileW

FlushViewOfFile

GetFullPathNameW

WaitForMultipleObjects

ProcessIdToSessionId

GetCurrentThread

OpenEventA

CreateEventA

OpenMutexA

CreateMutexA

OpenSemaphoreA

CreateSemaphoreA

OpenFileMappingA

GlobalAlloc

GlobalFree

LocalAlloc

DeleteFileA

GetTempPathA

GetNumberFormatW

GetTimeZoneInformation

IsValidLocale

GetPriorityClass

GetExitCodeProcess

K32EnumProcesses

K32EnumProcessModulesEx

GetLocaleInfoEx

LCIDToLocaleName

GetLocaleInfoW

ResolveLocaleName

GetUserPreferredUILanguages

GetACP

LockResource

LCMapStringEx

GetSystemDefaultLCID

EnumSystemLocalesEx

GetSystemDefaultLocaleName

GetDateFormatEx

GetCalendarInfoEx

GetThreadUILanguage

GetUserGeoID

SetWaitableTimer

GetSystemPowerStatus

AreFileApisANSI

HeapCreate

GetDiskFreeSpaceW

InitializeCriticalSection

GetFullPathNameA

UnlockFileEx

HeapValidate

HeapSize

GetDiskFreeSpaceA

GetFileAttributesA

OutputDebugStringW

HeapReAlloc

GetSystemInfo

HeapCompact

HeapDestroy

LockFileEx

QueryPerformanceCounter

GetTickCount

K32GetProcessMemoryInfo

GetPhysicallyInstalledSystemMemory

GetProductInfo

QueryPerformanceFrequency

WerRegisterMemoryBlock

WerUnregisterMemoryBlock

QueryFullProcessImageNameW

CreateIoCompletionPort

PostQueuedCompletionStatus

GetThreadIOPendingFlag

GetQueuedCompletionStatus

FlsSetValue

FlsGetValue

IsDebuggerPresent

GetStartupInfoW

CreateMemoryResourceNotification

IsSystemResumeAutomatic

QueryUnbiasedInterruptTime

RtlCaptureContext

GetModuleHandleA

VirtualAlloc

TlsAlloc

TlsFree

TlsGetValue

TlsSetValue

SwitchToThread

CreateToolhelp32Snapshot

Process32FirstW

Process32NextW

GetVolumePathNamesForVolumeNameW

CompareStringOrdinal

RtlLookupFunctionEntry

RtlVirtualUnwind

GetLocalTime

GetTimeFormatEx

GlobalSize

GlobalLock

GlobalUnlock

FindAtomW

GetAtomNameA

GetAtomNameW

DeleteAtom

InitializeCriticalSectionAndSpinCount

GlobalFindAtomW

AddAtomW

CreateWaitableTimerW

GlobalDeleteAtom

GetCurrencyFormatW

InterlockedFlushSList

CancelWaitableTimer

GetCurrentProcess

GetModuleHandleExW

GetLastError

VirtualQuery

InitOnceBeginInitialize

InitOnceComplete

GetFileInformationByHandleEx

UnhandledExceptionFilter

K32GetModuleBaseNameW

WerRegisterFile

VirtualProtect

SetUnhandledExceptionFilter

EncodePointer

ReleaseActCtx

GetSystemDefaultLangID

TryAcquireSRWLockShared

TryAcquireSRWLockExclusive

IsDBCSLeadByte

IsProcessorFeaturePresent

WerUnregisterRuntimeExceptionModule

WerRegisterRuntimeExceptionModule

SetThreadPriority

K32GetProcessImageFileNameW

DeleteTimerQueueTimer

CreateTimerQueueTimer

ExpandEnvironmentStringsA

GetProcessAffinityMask

GetTempFileNameW

SetFileInformationByHandle

UnlockFile

LockFile

CreateFileMappingW

CopyFileExW

SetFilePointer

GetFileType

FindNextFileW

FindFirstFileExW

GetTempPathW

RemoveDirectoryW

GetFileAttributesW

CreateDirectoryW

GetFileAttributesExW

CancelIoEx

FlushFileBuffers

GetOverlappedResult

SetFileTime

SetFilePointerEx

WriteFile

SetEndOfFile

GetFileSizeEx

ReadFile

GetFileTime

OpenMutexW

GetSystemDirectoryW

GetNativeSystemInfo

GetLogicalProcessorInformation

FormatMessageW

MulDiv

GetComputerNameW

DeviceIoControl

CreateFileW

GetDiskFreeSpaceExW

OpenProcess

LoadResource

SizeofResource

FindResourceW

CreateProcessW

K32GetModuleFileNameExW

GetShortPathNameA

GetModuleFileNameA

GetProcessTimes

GetVersionExW

GlobalMemoryStatusEx

RtlCaptureStackBackTrace

InterlockedPopEntrySList

InterlockedPushEntrySList

InitializeSListHead

LeaveCriticalSection

EnterCriticalSection

TryEnterCriticalSection

QueryDepthSList

WaitForSingleObject

SubmitThreadpoolWork

SetWaitableTimerEx

CreateThreadpoolWork

CreateThreadpoolWait

WaitForThreadpoolWaitCallbacks

SetThreadpoolWait

CloseThreadpoolWait

CreateThreadpoolTimer

WaitForThreadpoolTimerCallbacks

SetThreadpoolTimer

CloseThreadpoolTimer

SleepConditionVariableSRW

WakeAllConditionVariable

WakeConditionVariable

CreateEventW

LoadLibraryExA

TzSpecificLocalTimeToSystemTime

GetSystemTimeAsFileTime

InitializeSRWLock

ReleaseSRWLockShared

AcquireSRWLockShared

ReleaseSRWLockExclusive

AcquireSRWLockExclusive

GetCPInfoExW

WideCharToMultiByte

IsValidCodePage

GetUserDefaultLocaleName

HeapAlloc

ReleaseSemaphore

CreateSemaphoreExW

ReleaseMutex

CreateMutexExW

WaitForMultipleObjectsEx

WaitForSingleObjectEx

FormatMessageA

LoadLibraryA

GetUserDefaultLCID

GetStringTypeExW

MapViewOfFile

GetFileSize

CreateFileMappingA

CreateFileA

UnmapViewOfFile

FindClose

SetFileAttributesW

DeleteFileW

GetExitCodeThread

OpenThread

GetTickCount64

ResetEvent

Sleep

GetCurrentThreadId

CreateThread

RaiseException

SystemTimeToFileTime

GetSystemTime

LocalFree

SetEvent

CreateEventExW

OutputDebugStringA

QueryActCtxW

CreateActCtxW

FindActCtxSectionStringW

LoadLibraryW

ActivateActCtx

DeactivateActCtx

SetLastError

SetErrorMode

GetModuleHandleW

CompareStringEx

GetProcAddress

FreeLibrary

IsWow64Process

InitializeCriticalSectionEx

DeleteCriticalSection

VerSetConditionMask

VerifyVersionInfoW

FlsFree

FlsAlloc

MultiByteToWideChar

GetDriveTypeW

FileTimeToSystemTime

GetTimeFormatW

CloseHandle

GetProcessHeap

HeapFree

GetCurrentProcessId

GetModuleFileNameW

CreateMutexW

ExpandEnvironmentStringsW

LocaleNameToLCID

TerminateProcess

LoadLibraryExW

GlobalAddAtomW

ole32

GetConvertStg

ReadClassStg

ProgIDFromCLSID

CoRegisterInitializeSpy

CoRevokeInitializeSpy

CoEnableCallCancellation

CoCreateInstance

StgCreateDocfileOnILockBytes

CoCancelCall

CreateStreamOnHGlobal

CoCreateGuid

IIDFromString

StringFromGUID2

CoTaskMemFree

CoSetProxyBlanket

CoTaskMemAlloc

StgOpenStorageOnILockBytes

PropVariantClear

CoInitializeEx

CoUninitialize

WriteFmtUserTypeStg

CLSIDFromString

ReleaseStgMedium

CoDisconnectObject

RegisterDragDrop

RevokeDragDrop

OleUninitialize

OleDraw

CoLockObjectExternal

CreateFileMoniker

CoGetTreatAsClass

CoCreateFreeThreadedMarshaler

CoInitialize

CoDisableCallCancellation

OleInitialize

oleaut32

VarDecAdd

VarDecSu

VarDecInt

VarDecDiv

SafeArrayPutElement

VarDecRound

SafeArrayGetElement

SafeArrayGetUBound

SafeArrayGetLBound

SafeArrayGetDim

SafeArrayLock

SafeArrayCreate

SafeArrayUnlock

SafeArrayUnaccessData

SafeArrayAccessData

SafeArrayCreateVector

SafeArrayDestroy

OleCreateFontIndirect

VarR8FromDec

VarR4FromDec

VarBstrCmp

VariantChangeTypeEx

VarDecFromI4

VarDecFromR8

VariantTimeToSystemTime

VarDecCmp

VarDecFromR4

SysStringByteLen

SysStringLen

VarCmp

VariantCopy

VariantChangeType

SysAllocStringLen

SysAllocString

SysFreeString

VariantClear

VariantInit

VarDecMul

GetErrorInfo

SetErrorInfo

wtsapi32

WTSRegisterSessionNotification

WTSRegisterSessionNotificationEx

WTSUnRegisterSessionNotificationEx

WTSUnRegisterSessionNotification

cabinet

ord13

ord14

iphlpapi

GetAdaptersInfo

rpcrt4

RpcStringBindingComposeW

RpcMgmtIsServerListening

RpcBindingFree

RpcBindingFromStringBindingW

RpcStringFreeW

RpcBindingSetAuthInfoW

rstrtmgr

RmStartSession

RmRegisterResources

RmGetList

setupapi

SetupIterateCabinetW

wer

WerReportSetParameter

WerReportCloseHandle

WerReportCreate

WerReportSubmit

WerReportAddDump

wintrust

WinVerifyTrust

WTHelperProvDataFromStateData

WTHelperGetProvSignerFromChain

apiclient

?ModifyOfficeProducts@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W1111KH@Z

?QueueUpdateEx@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_WK@Z

?GetPipelineTotalMegabytes@@YAJV?$shared_ptr@VORpcClient@@@std@@PEAK@Z

?GetPipelineStreamedMegabytes@@YAJV?$shared_ptr@VORpcClient@@@std@@PEAK@Z

?GetClickToRunData@@YAJV?$shared_ptr@VORpcClient@@@std@@HPEB_WPEA_WK@Z

?QueueUpdateOnlyApply@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler_noexcept

__std_exception_destroy

__std_exception_copy

_purecall

__C_specific_handler

_set_se_translator

__std_type_info_compare

memchr

__RTDynamicCast

__RTtypeid

__std_type_info_name

wcschr

wcsrchr

_CxxThrowException

memcmp

wcsstr

strstr

strchr

__current_exception_context

__current_exception

memmove

memcpy

memset

__std_terminate

msvcp140

?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ

?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ

?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ

?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ

??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ

?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z

??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ

??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ

??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ

??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z

??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ

??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ

??1_Lockit@std@@QEAA@XZ

??0_Lockit@std@@QEAA@H@Z

?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ

??Bid@locale@std@@QEAA_KXZ

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z

?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

?uncaught_exception@std@@YA_NXZ

?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z

?exceptions@ios_base@std@@QEAAXH@Z

?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z

?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z

??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ

??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

?id@?$ctype@D@std@@2V0locale@2@A

?widen@?$ctype@D@std@@QEBADD@Z

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

?narrow@?$ctype@D@std@@QEBADDD@Z

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ

?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z

?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z

?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

?_Xinvalid_argument@std@@YAXPEBD@Z

?_Xbad_function_call@std@@YAXXZ

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z

?classic@locale@std@@SAAEBV12@XZ

?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z

??1facet@locale@std@@MEAA@XZ

??0facet@locale@std@@IEAA@_K@Z

?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ

?_Incref@facet@locale@std@@UEAAXXZ

_Query_perf_counter

_Query_perf_frequency

_Mtx_unlock

_Mtx_lock

?_Throw_C_error@std@@YAXH@Z

?__ExceptionPtrDestroy@@YAXPEAX@Z

?__ExceptionPtrCopy@@YAXPEAXPEBX@Z

?__ExceptionPtrCurrentException@@YAXPEAX@Z

?__ExceptionPtrCreate@@YAXPEAX@Z

?__ExceptionPtrToBool@@YA_NPEBX@Z

?__ExceptionPtrRethrow@@YAXPEBX@Z

_Thrd_yield

_Thrd_id

?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ

?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ

?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z

?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z

??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z

?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z

?getloc@ios_base@std@@QEBA?AVlocale@2@XZ

??1_Locinfo@std@@QEAA@XZ

??0_Locinfo@std@@QEAA@PEBD@Z

?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z

?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z

_Xtime_get_ticks

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z

??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z

?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z

?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

?_Random_device@std@@YAIXZ

_Cnd_init_in_situ

_Cnd_wait

_Cnd_broadcast

_Cnd_destroy_in_situ

??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ

??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z

??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z

?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ

?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ

_Mtx_current_owns

?_Throw_Cpp_error@std@@YAXH@Z

?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z

_Cnd_timedwait

?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ

_Mtx_trylock

_Cnd_do_broadcast_at_thread_exit

_Thrd_detach

_Thrd_join

_Cnd_signal

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z

?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@F@Z

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_J@Z

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z

?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

?is@?$ctype@_W@std@@QEBA_NF_W@Z

?id@?$ctype@_W@std@@2V0locale@2@A

?id@?$collate@_W@std@@2V0locale@2@A

_Wcsxfrm

_Wcscoll

?tolower@?$ctype@_W@std@@QEBA_W_W@Z

?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z

?toupper@?$ctype@_W@std@@QEBA_W_W@Z

_Thrd_sleep

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z

??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z

?widen@?$ctype@_W@std@@QEBA_WD@Z

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z

?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z

?tellp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@N@Z

?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z

?uncaught_exceptions@std@@YAHXZ

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z

?__ExceptionPtrAssign@@YAXPEAXPEBX@Z

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@M@Z

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z

??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAG@Z

?ignore@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_JG@Z

?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z

?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z

?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ

?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z

??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ

_Mtx_init_in_situ

_Mtx_destroy_in_situ

?_Winerror_map@std@@YAHH@Z

?_Syserror_map@std@@YAPEBDH@Z

?_Xlength_error@std@@YAXPEBD@Z

?_Xout_of_range@std@@YAXPEBD@Z

?_Xbad_alloc@std@@YAXXZ

?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ

?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z

?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z

api-ms-win-crt-heap-l1-1-0

_set_new_mode

free

malloc

_msize

realloc

api-ms-win-crt-stdio-l1-1-0

__p__commode

fclose

_wfopen_s

__stdio_common_vsscanf

_set_fmode

fgets

fputs

__stdio_common_vsnprintf_s

__stdio_common_vfprintf

__acrt_iob_func

__stdio_common_vsprintf

__stdio_common_vswscanf

__stdio_common_vsprintf_s

__stdio_common_vsnwprintf_s

__stdio_common_vswprintf

__stdio_common_vfwprintf_s

fwrite

fflush

__stdio_common_vswprintf_s

fopen_s

api-ms-win-crt-runtime-l1-1-0

_resetstkoflw

_invalid_parameter_noinfo

_errno

_seh_filter_exe

_set_app_type

_invalid_parameter_noinfo_noreturn

terminate

_initialize_wide_environment

_get_wide_winmain_command_line

_initterm

_initterm_e

_beginthreadex

_clearfp

abort

exit

_configure_wide_argv

_endthreadex

_exit

_crt_atexit

_cexit

_c_exit

_register_thread_local_exe_atexit_callback

_register_onexit_function

_initialize_onexit_table

api-ms-win-crt-string-l1-1-0

wmemcpy_s

iswalpha

wcscpy_s

wcsncmp

strncat_s

iswalnum

strpbrk

iswspace

isalnum

towupper

toupper

strncmp

strcspn

strcoll

islower

isdigit

ispunct

iscntrl

isxdigit

isalpha

tolower

_wcsnicmp

wcstok_s

_towupper_l

isupper

wcscmp

wcsnlen

_wcsicmp

strcat_s

isspace

strcpy_s

strcmp

strnlen

_stricmp

wcsncat_s

wcscat_s

strncpy_s

towlower

wcsncpy_s

api-ms-win-crt-convert-l1-1-0

mbstowcs_s

_wtoi64

wcstol

_wtof

_ultow_s

wcstombs_s

wcstoull

wcstoll

strtol

_wtoi

_itow_s

_wtol

_ui64tow_s

wcstof

_ui64toa_s

_i64tow_s

strtod

_wcstoi64

strtoll

_wcstoui64

strtoull

strtoul

wcstoul

wcstod

api-ms-win-crt-math-l1-1-0

round

trunc

log2

_dsign

_fdclass

__setusermatherr

ceilf

cosf

cosh

exp

expf

floor

_dclass

ldexp

frexp

floorf

tanh

fmod

modf

fmodf

_isnan

_finite

acos

log

log10

atan2

logf

atan

pow

cos

roundf

asin

sin

sinf

sinh

sqrt

sqrtf

tan

ceil

api-ms-win-crt-time-l1-1-0

_gmtime64_s

_localtime64_s

_difftime64

_mktime64

wcsftime

_time64

api-ms-win-crt-locale-l1-1-0

_create_locale

__initialize_lconv_for_unsigned_char

_configthreadlocale

api-ms-win-crt-utility-l1-1-0

srand

bsearch

rand

rand_s

qsort

api-ms-win-crt-filesystem-l1-1-0

_wmakepath_s

_wsplitpath_s

hlink

ord8

ord4

msimg32

AlphaBlend

GradientFill

Sections

.text
Size: 10.1MB - Virtual size: 10.1MB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 6.6MB - Virtual size: 6.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 396KB - Virtual size: 405KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 412KB - Virtual size: 411KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 224KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

OfficeC2RCom.dll

.dll regsvr32 windows x64

36c88247ae3b3bd1611a9b34eb999705

Code Sign

33:00:00:04:39:f6:1f:7a:67:6d:a0:00:af:00:00:00:00:04:39
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:25

Not After

01/09/2022, 18:25

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:02:55:18:1d:a4:2e:e0:86:fc:15:00:00:00:00:02:55
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:33

Not After

01/09/2022, 18:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

ec:4d:40:0d:ad:d4:9f:27:3c:97:4b:f5:0e:bc:3b:f4:9f:7b:d2:7a:12:8e:73:91:d3:52:28:d4:9a:b0:e2:ab
Signer

Actual PE Digest

ec:4d:40:0d:ad:d4:9f:27:3c:97:4b:f5:0e:bc:3b:f4:9f:7b:d2:7a:12:8e:73:91:d3:52:28:d4:9a:b0:e2:ab

Digest Algorithm

sha256

PE Digest Matches

true

ec:4d:40:0d:ad:d4:9f:27:3c:97:4b:f5:0e:bc:3b:f4:9f:7b:d2:7a:12:8e:73:91:d3:52:28:d4:9a:b0:e2:ab
Signer

Actual PE Digest

ec:4d:40:0d:ad:d4:9f:27:3c:97:4b:f5:0e:bc:3b:f4:9f:7b:d2:7a:12:8e:73:91:d3:52:28:d4:9a:b0:e2:ab

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Imports

advapi32

RegQueryValueExW

RegCreateKeyExW

RegOpenKeyExW

RegCloseKey

EventWriteTransfer

EventRegister

EventUnregister

RegEnumKeyExW

RegQueryInfoKeyW

RegEnumValueW

RegDeleteTreeW

RegGetValueW

RegSetValueExW

RegDeleteValueW

GetTokenInformation

IsValidSid

GetSidSubAuthorityCount

GetSidSubAuthority

ConvertStringSecurityDescriptorToSecurityDescriptorW

AllocateAndInitializeSid

FreeSid

EqualSid

OpenProcessToken

CreateWellKnownSid

RevertToSelf

OpenThreadToken

GetLengthSid

CopySid

InitializeAcl

AddAccessAllowedAce

InitializeSecurityDescriptor

SetSecurityDescriptorDacl

GetSecurityDescriptorDacl

ConvertSidToStringSidA

ole32

CoInitializeEx

CoUninitialize

CoRegisterClassObject

CoRegisterInitializeSpy

CoCreateInstance

CoTaskMemFree

CreateStreamOnHGlobal

CoCreateGuid

CoTaskMemAlloc

StringFromGUID2

CoRevokeInitializeSpy

oleaut32

SysFreeString

SysAllocString

rpcrt4

RpcBindingFromStringBindingW

RpcStringBindingComposeW

RpcBindingSetAuthInfoW

RpcBindingFree

RpcStringFreeW

kernel32

SetStdHandle

GetOEMCP

GetLocaleInfoW

CompareStringW

GetCommandLineA

GetCommandLineW

EnumSystemLocalesW

GetACP

GetEnvironmentStringsW

GetTimeFormatW

GetDateFormatW

HeapReAlloc

GetStdHandle

ExitProcess

GetConsoleOutputCP

GetConsoleMode

HeapSize

InterlockedFlushSList

RtlUnwindEx

GetStartupInfoW

IsProcessorFeaturePresent

SetUnhandledExceptionFilter

UnhandledExceptionFilter

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

InitializeCriticalSectionAndSpinCount

GetCPInfo

GetLastError

CompareStringEx

GetCurrentProcess

IsWow64Process

FreeLibrary

GetProcAddress

GetModuleHandleExW

FindClose

UnmapViewOfFile

CloseHandle

CreateFileMappingA

MapViewOfFile

Sleep

GetStringTypeExW

GetUserDefaultLCID

LCMapStringW

LocalFree

GetSystemTimeAsFileTime

GetCurrentThreadId

FlsAlloc

TlsAlloc

FlsFree

TlsFree

FlsGetValue

TlsGetValue

FlsSetValue

TlsSetValue

GetTickCount64

GetModuleHandleW

K32GetProcessMemoryInfo

GlobalMemoryStatusEx

GetCurrentProcessId

LocalAlloc

MultiByteToWideChar

CreateEventExW

RaiseException

LoadLibraryExW

VerSetConditionMask

VerifyVersionInfoW

GetVersionExW

WideCharToMultiByte

VirtualQuery

AcquireSRWLockExclusive

ReleaseSRWLockExclusive

AcquireSRWLockShared

ReleaseSRWLockShared

GetProcessTimes

TerminateProcess

GetModuleFileNameA

GetShortPathNameA

GetModuleFileNameW

K32GetModuleFileNameExW

FindResourceW

SizeofResource

LoadResource

OpenProcess

CreateFileW

DeviceIoControl

GetComputerNameW

GetNativeSystemInfo

CreateActCtxW

FreeEnvironmentStringsW

HeapFree

SetLastError

OutputDebugStringA

FindActCtxSectionStringW

DeactivateActCtx

QueryActCtxW

LoadLibraryW

HeapAlloc

GetProcessHeap

GetUserDefaultLocaleName

IsValidCodePage

FileTimeToSystemTime

ReleaseMutex

WaitForSingleObjectEx

InitializeCriticalSectionEx

DeleteCriticalSection

EnterCriticalSection

TryEnterCriticalSection

LeaveCriticalSection

SetEvent

GetFileAttributesExW

FindFirstFileExW

DeleteFileW

FindNextFileW

GetFileTime

ReadFile

GetFileSizeEx

SetFilePointerEx

GetTempFileNameW

GetFileType

WriteFile

SetEndOfFile

GetOverlappedResult

ExpandEnvironmentStringsW

GetTempPathW

ReleaseSemaphore

GetCurrentThread

WaitForMultipleObjectsEx

GetProcessAffinityMask

CreateWaitableTimerW

SetWaitableTimerEx

CancelWaitableTimer

QueryDepthSList

InitializeSListHead

InterlockedPushEntrySList

InterlockedPopEntrySList

RtlCaptureStackBackTrace

OpenEventA

CreateEventA

OpenMutexA

CreateMutexA

OpenSemaphoreA

CreateSemaphoreA

OpenFileMappingA

GlobalAlloc

GlobalFree

GetTimeZoneInformation

IsValidLocale

GetTickCount

SetEnvironmentVariableW

WriteConsoleW

GetSystemInfo

ActivateActCtx

VirtualProtect

LCMapStringEx

EncodePointer

LoadLibraryExA

InitializeSRWLock

CreateThread

GetUserGeoID

DecodePointer

GetLocalTime

CreateEventW

CloseThreadpoolTimer

SetThreadpoolTimer

WaitForThreadpoolTimerCallbacks

CreateThreadpoolTimer

CloseThreadpoolWait

SetThreadpoolWait

WaitForThreadpoolWaitCallbacks

CreateThreadpoolWait

CreateThreadpoolWork

SubmitThreadpoolWork

WakeConditionVariable

WakeAllConditionVariable

SleepConditionVariableSRW

WaitForSingleObject

QueryPerformanceCounter

QueryPerformanceFrequency

ResetEvent

SetFileTime

FlushFileBuffers

CancelIoEx

GetLongPathNameW

CreateIoCompletionPort

PostQueuedCompletionStatus

GetThreadIOPendingFlag

GetQueuedCompletionStatus

IsDebuggerPresent

WerRegisterMemoryBlock

WerUnregisterMemoryBlock

QueryFullProcessImageNameW

CreateMemoryResourceNotification

GetSystemPowerStatus

IsSystemResumeAutomatic

OutputDebugStringW

InitOnceComplete

InitOnceBeginInitialize

GetStringTypeW

RtlPcToFileHeader

apiclient

?GetClickToRunDataEx@@YAJV?$shared_ptr@VORpcClient@@@std@@HPEB_WPEA_WKK@Z

?CancelUpdate@@YAJV?$shared_ptr@VORpcClient@@@std@@@Z

?QueueUpdateEx@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_WK@Z

Exports

DllCanUnloadNow

DllGetClassObject

DllRegisterServer

DllUnregisterServer

Sections

.text
Size: 1009KB - Virtual size: 1009KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 441KB - Virtual size: 440KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

OfficeClickToRun.exe

.exe windows x64

f3849e9444171aa6cd0c1913cc044ff2

Code Sign

33:00:00:05:00:27:d6:32:6f:43:73:7b:87:00:00:00:00:05:00
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/02/2023, 20:11

Not After

31/01/2024, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/02/2023, 20:10

Not After

31/01/2024, 20:10

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

35:e4:10:3b:8f:09:df:a4:d1:45:d6:e9:9e:e9:4c:38:4f:19:37:ea:bf:59:1e:1b:3f:59:8b:9e:0d:6c:aa:6e
Signer

Actual PE Digest

35:e4:10:3b:8f:09:df:a4:d1:45:d6:e9:9e:e9:4c:38:4f:19:37:ea:bf:59:1e:1b:3f:59:8b:9e:0d:6c:aa:6e

Digest Algorithm

sha256

PE Digest Matches

true

35:e4:10:3b:8f:09:df:a4:d1:45:d6:e9:9e:e9:4c:38:4f:19:37:ea:bf:59:1e:1b:3f:59:8b:9e:0d:6c:aa:6e
Signer

Actual PE Digest

35:e4:10:3b:8f:09:df:a4:d1:45:d6:e9:9e:e9:4c:38:4f:19:37:ea:bf:59:1e:1b:3f:59:8b:9e:0d:6c:aa:6e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCreateKeyExW

RegCloseKey

RegOpenKeyExW

RegSetValueExW

RegQueryValueExW

StartServiceCtrlDispatcherW

RegisterServiceCtrlHandlerExW

SetServiceStatus

CreateWellKnownSid

CheckTokenMembership

RegEnumKeyExW

RegQueryInfoKeyW

RegEnumValueW

RegDeleteTreeW

RegDeleteKeyW

RegGetValueW

RegDeleteValueW

GetTokenInformation

IsValidSid

GetSidSubAuthorityCount

GetSidSubAuthority

ReportEventW

RegisterEventSourceW

DeregisterEventSource

EventWriteTransfer

EventRegister

EventUnregister

CryptReleaseContext

CryptAcquireContextW

CryptDestroyHash

CryptGetHashParam

CryptCreateHash

GetFileSecurityW

SetFileSecurityW

RegNotifyChangeKeyValue

RevertToSelf

RegQueryValueW

OpenThreadToken

OpenProcessToken

GetLengthSid

CopySid

InitializeAcl

AddAccessAllowedAce

AllocateAndInitializeSid

FreeSid

InitializeSecurityDescriptor

SetSecurityDescriptorDacl

GetSecurityDescriptorDacl

ConvertStringSecurityDescriptorToSecurityDescriptorW

ConvertSidToStringSidA

ConvertSidToStringSidW

EqualSid

EventWrite

RegEnumValueA

RegDeleteValueA

CreateProcessAsUserW

RegCopyTreeW

ConvertStringSidToSidW

LookupAccountSidW

ImpersonateLoggedOnUser

LookupPrivilegeValueW

AdjustTokenPrivileges

OpenSCManagerW

CloseServiceHandle

OpenServiceW

QueryServiceStatusEx

QueryServiceConfigW

StartServiceW

ControlService

EnumDependentServicesW

DeleteService

CreateServiceW

ChangeServiceConfig2W

ChangeServiceConfigW

SetServiceObjectSecurity

RegGetValueA

DuplicateTokenEx

SetTokenInformation

SetThreadToken

ControlTraceW

StartTraceW

OpenTraceW

CloseTrace

ProcessTrace

EnableTraceEx

RegSaveKeyExW

RegRestoreKeyW

RegGetKeySecurity

RegSetKeySecurity

RegRenameKey

RegOpenCurrentUser

DuplicateToken

gdi32

GetFontData

RemoveFontResourceW

CreateFontIndirectW

AddFontResourceW

EnumFontFamiliesExW

DeleteObject

GetDeviceCaps

SelectObject

iphlpapi

GetAdaptersInfo

CreateSortedAddressPairs

FreeMibTable

kernel32

LoadLibraryA

FormatMessageA

GetSystemTimeAsFileTime

GetTickCount64

GetCurrentThreadId

GetUserDefaultLocaleName

IsValidCodePage

WideCharToMultiByte

GetSystemTime

SystemTimeToFileTime

FileTimeToSystemTime

GetCPInfoExW

AcquireSRWLockExclusive

ReleaseSRWLockExclusive

AcquireSRWLockShared

ReleaseSRWLockShared

TlsAlloc

TlsFree

FlsGetValue

TlsGetValue

FlsSetValue

TlsSetValue

InitializeSRWLock

GetProcessTimes

TerminateProcess

GetModuleFileNameA

GetShortPathNameA

K32GetModuleFileNameExW

CreateProcessW

FindResourceW

SizeofResource

LoadResource

VerSetConditionMask

VerifyVersionInfoW

OpenProcess

GlobalMemoryStatusEx

GetVersionExW

GetDiskFreeSpaceExW

GetWindowsDirectoryW

CreateFileW

DeviceIoControl

SetErrorMode

GetComputerNameW

MulDiv

FormatMessageW

GetLogicalProcessorInformation

GetNativeSystemInfo

GetSystemDirectoryW

HeapFree

HeapAlloc

GetProcessHeap

WaitForSingleObject

CreateThread

WaitForMultipleObjectsEx

CreateEventExW

WakeConditionVariable

WakeAllConditionVariable

SleepConditionVariableSRW

CloseThreadpoolTimer

SetThreadpoolTimer

WaitForThreadpoolTimerCallbacks

CreateThreadpoolTimer

CloseThreadpoolWait

SetThreadpoolWait

WaitForThreadpoolWaitCallbacks

CreateThreadpoolWait

CreateThreadpoolWork

SubmitThreadpoolWork

ReleaseSemaphore

WaitForSingleObjectEx

QueryDepthSList

TryEnterCriticalSection

EnterCriticalSection

LeaveCriticalSection

InitializeSListHead

InterlockedPushEntrySList

InterlockedPopEntrySList

RtlCaptureStackBackTrace

TzSpecificLocalTimeToSystemTime

OpenEventW

OpenMutexW

GetTempPathW

GetLongPathNameW

ResetEvent

IsDebuggerPresent

GetFileAttributesExW

FindFirstFileExW

MoveFileExW

FindNextFileW

CreateDirectoryW

RemoveDirectoryW

SetFileAttributesW

WriteFile

ReadFile

SetFilePointerEx

SetEndOfFile

GetFileSizeEx

FlushFileBuffers

LockFileEx

UnlockFileEx

CopyFileExW

GetVolumePathNamesForVolumeNameW

SetFileInformationByHandle

CreateFileMappingW

WaitForMultipleObjects

RtlLookupFunctionEntry

RtlVirtualUnwind

GetFileType

SetFilePointer

LockFile

GetOverlappedResult

GetFileAttributesW

GetFileTime

ReplaceFileW

CopyFileW

GetTempFileNameW

GetShortPathNameW

QueryPerformanceCounter

QueryPerformanceFrequency

GlobalFree

GlobalAlloc

GetFileSize

LockResource

SetFileTime

CancelIoEx

GetProcessAffinityMask

CreateWaitableTimerW

SetWaitableTimerEx

CancelWaitableTimer

WerRegisterMemoryBlock

WerUnregisterMemoryBlock

QueryFullProcessImageNameW

CreateIoCompletionPort

PostQueuedCompletionStatus

GetThreadIOPendingFlag

GetCurrentThread

GetQueuedCompletionStatus

lstrlenW

GetStartupInfoW

CreateMemoryResourceNotification

GetSystemPowerStatus

IsSystemResumeAutomatic

QueryUnbiasedInterruptTime

OutputDebugStringW

RtlCaptureContext

CreateMutexW

OpenEventA

CreateEventA

OpenMutexA

CreateMutexA

OpenSemaphoreA

CreateSemaphoreA

OpenFileMappingA

LocalAlloc

LCMapStringEx

LCIDToLocaleName

K32GetProcessMemoryInfo

GetPhysicallyInstalledSystemMemory

GetProductInfo

GetLocalTime

GetLocaleInfoEx

ResolveLocaleName

GetUserPreferredUILanguages

GetACP

GetSystemDefaultLCID

EnumSystemLocalesEx

GetSystemDefaultLocaleName

GetUserGeoID

GetGeoInfoW

GetUserDefaultUILanguage

GetTimeZoneInformation

GetThreadLocale

DeleteFileA

GetTempPathA

FindFirstFileW

lstrcmpW

FlushViewOfFile

GetFullPathNameW

GetPriorityClass

GetExitCodeProcess

K32EnumProcesses

ProcessIdToSessionId

GetVolumeInformationW

GetExitCodeThread

AreFileApisANSI

HeapCreate

GetDiskFreeSpaceW

InitializeCriticalSection

GetFullPathNameA

HeapValidate

HeapSize

GetDiskFreeSpaceA

GetFileAttributesA

GetModuleHandleW

GetSystemInfo

HeapCompact

HeapDestroy

CreateFileMappingA

DeleteTimerQueueTimer

CreateTimerQueueTimer

CloseHandle

GetStringTypeExW

UnlockFile

MapViewOfFile

GetCurrentProcess

GetModuleHandleExW

GetLastError

CompareStringEx

GetProcAddress

FreeLibrary

CreateFileA

UnmapViewOfFile

FindClose

LocaleNameToLCID

ReleaseMutex

GetCurrentProcessId

GlobalAddAtomW

GlobalFindAtomW

CreateEventW

SetEvent

DeleteFileW

FlsAlloc

LoadLibraryExA

VirtualQuery

VirtualProtect

InitOnceBeginInitialize

InitOnceComplete

CreateSymbolicLinkW

GetFileInformationByHandleEx

CreateHardLinkW

GetFileInformationByHandle

FlsFree

GetTickCount

Sleep

OutputDebugStringA

QueryActCtxW

IsProcessorFeaturePresent

SetUnhandledExceptionFilter

UnhandledExceptionFilter

InitializeCriticalSectionAndSpinCount

GetDriveTypeW

lstrcmpiW

GetDateFormatW

GetTimeFormatW

SetCurrentDirectoryW

CreateActCtxW

FindActCtxSectionStringW

LoadLibraryW

ActivateActCtx

DeactivateActCtx

SetLastError

RaiseException

LocalFree

GetModuleFileNameW

MultiByteToWideChar

DeleteCriticalSection

InitializeCriticalSectionEx

LoadLibraryExW

ExpandEnvironmentStringsW

IsWow64Process

HeapReAlloc

oleaut32

RegisterTypeLi

LoadTypeLi

UnRegisterTypeLi

GetErrorInfo

SetErrorInfo

SysStringLen

SysAllocString

VariantInit

VariantClear

SysFreeString

rpcrt4

RpcRevertToSelf

RpcImpersonateClient

UuidToStringW

RpcMgmtStopServerListening

NdrServerCall2

RpcBindingInqAuthClientW

RpcServerUnregisterIf

RpcStringBindingComposeW

RpcBindingFromStringBindingW

RpcStringFreeW

RpcMgmtWaitServerListen

RpcBindingSetAuthInfoW

RpcBindingFree

RpcMgmtIsServerListening

RpcServerRegisterIf2

RpcServerListen

RpcServerUseProtseqEpW

RpcServerRegisterAuthInfoW

UuidCreate

ws2_32

WSAStartup

GetAddrInfoW

FreeAddrInfoW

rstrtmgr

RmShutdown

RmAddFilter

RmRestart

RmStartSession

RmRegisterResources

RmGetList

RmEndSession

cabinet

ord13

ord14

wintrust

WTHelperGetProvSignerFromChain

WTHelperProvDataFromStateData

WinVerifyTrust

wtsapi32

WTSEnumerateSessionsW

WTSFreeMemory

WTSSendMessageW

WTSQuerySessionInformationW

WTSQueryUserToken

setupapi

SetupIterateCabinetW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException

memcpy

__std_terminate

__C_specific_handler_noexcept

__RTDynamicCast

memchr

memcmp

_purecall

wcsrchr

strstr

__std_exception_copy

__std_exception_destroy

__C_specific_handler

memmove

__std_type_info_compare

__RTtypeid

__current_exception

__std_type_info_name

wcschr

strchr

__current_exception_context

memset

wcsstr

msvcp140

?pubimbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z

_Mbrtowc

?_Xbad_alloc@std@@YAXXZ

?_Xout_of_range@std@@YAXPEBD@Z

?_Xlength_error@std@@YAXPEBD@Z

?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ

?_Syserror_map@std@@YAPEBDH@Z

?_Winerror_map@std@@YAHH@Z

?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z

??1_Lockit@std@@QEAA@XZ

??0_Lockit@std@@QEAA@H@Z

?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ

??Bid@locale@std@@QEAA_KXZ

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

?width@ios_base@std@@QEAA_J_J@Z

?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ

?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ

?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z

?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

?flags@ios_base@std@@QEBAHXZ

?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

?good@ios_base@std@@QEBA_NXZ

?uncaught_exception@std@@YA_NXZ

?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ

?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

?width@ios_base@std@@QEBA_JXZ

?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z

?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

?exceptions@ios_base@std@@QEAAXH@Z

?flags@ios_base@std@@QEAAHH@Z

?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z

?precision@ios_base@std@@QEAA_J_J@Z

?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z

?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z

??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ

??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

?id@?$ctype@D@std@@2V0locale@2@A

?widen@?$ctype@D@std@@QEBADD@Z

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

?narrow@?$ctype@D@std@@QEBADDD@Z

?is@?$ctype@D@std@@QEBA_NFD@Z

?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z

?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z

?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ

?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z

?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z

?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

_Mtx_lock

?_Throw_C_error@std@@YAXH@Z

_Mtx_unlock

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z

?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z

_Thrd_id

?classic@locale@std@@SAAEBV12@XZ

?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z

??1facet@locale@std@@MEAA@XZ

??0facet@locale@std@@IEAA@_K@Z

?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ

?_Incref@facet@locale@std@@UEAAXXZ

??0id@locale@std@@QEAA@_K@Z

_Mtx_init_in_situ

_Mtx_destroy_in_situ

??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ

?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ

?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ