i640[.]cab | Triage™

resource
unpack001/vcruntime140_1.dll
unpack001/vcruntime140.dll
unpack001/msvcp140.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/api-ms-win-crt-math-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/api-ms-win-crt-time-l1-1-0.dll
unpack001/vcruntime140_1.dll
unpack001/vcruntime140.dll
unpack001/msvcp140.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-filesystem-l1-1-0.dll
unpack001/api-ms-win-crt-math-l1-1-0.dll
unpack001/api-ms-win-core-file-l1-2-0.dll
unpack001/api-ms-win-core-localization-l1-2-0.dll
unpack001/api-ms-win-core-processthreads-l1-1-1.dll
unpack001/api-ms-win-core-timezone-l1-1-0.dll
unpack001/api-ms-win-core-file-l2-1-0.dll
unpack001/api-ms-win-core-synch-l1-2-0.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/api-ms-win-crt-math-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/api-ms-win-crt-time-l1-1-0.dll
unpack001/api-ms-win-crt-utility-l1-1-0.dll
unpack001/vcruntime140_1.dll
unpack001/vcruntime140.dll
unpack001/msvcp140.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/vcruntime140_1.dll
unpack001/vcruntime140.dll
unpack001/msvcp140.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/api-ms-win-crt-math-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/api-ms-win-crt-time-l1-1-0.dll
unpack001/vcruntime140_1.dll
unpack001/vcruntime140.dll
unpack001/msvcp140.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-filesystem-l1-1-0.dll
unpack001/api-ms-win-crt-utility-l1-1-0.dll
unpack001/api-ms-win-crt-time-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-math-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-filesystem-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/api-ms-win-crt-math-l1-1-0.dll
unpack001/api-ms-win-crt-time-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/vcruntime140_1.dll
unpack001/vcruntime140.dll
unpack001/msvcp140.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-filesystem-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/api-ms-win-crt-math-l1-1-0.dll
unpack001/vcruntime140_1.dll
unpack001/vcruntime140.dll
unpack001/msvcp140.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-filesystem-l1-1-0.dll
unpack001/api-ms-win-crt-utility-l1-1-0.dll
unpack001/api-ms-win-crt-time-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/api-ms-win-crt-math-l1-1-0.dll
unpack001/vcruntime140_1.dll
unpack001/vcruntime140.dll
unpack001/msvcp140.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-filesystem-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/api-ms-win-crt-utility-l1-1-0.dll
unpack001/api-ms-win-crt-time-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/api-ms-win-crt-math-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/api-ms-win-crt-time-l1-1-0.dll
unpack001/vcruntime140_1.dll
unpack001/vcruntime140.dll
unpack001/msvcp140.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/api-ms-win-crt-filesystem-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/api-ms-win-crt-math-l1-1-0.dll
unpack001/vcruntime140.dll
unpack001/msvcp140.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-math-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/vcruntime140_1.dll
unpack001/vcruntime140.dll
unpack001/msvcp140.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/api-ms-win-crt-math-l1-1-0.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/vcruntime140_1.dll
unpack001/vcruntime140.dll
unpack001/msvcp140.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-time-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/api-ms-win-crt-math-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/api-ms-win-crt-filesystem-l1-1-0.dll
unpack001/vcruntime140_1.dll
unpack001/vcruntime140.dll
unpack001/msvcp140.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/api-ms-win-crt-math-l1-1-0.dll
unpack001/vcruntime140_1.dll
unpack001/vcruntime140.dll
unpack001/msvcp140.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/api-ms-win-crt-time-l1-1-0.dll
unpack001/api-ms-win-crt-math-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/api-ms-win-crt-filesystem-l1-1-0.dll
unpack001/vcruntime140_1.dll
unpack001/vcruntime140.dll
unpack001/msvcp140.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-math-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/vcruntime140_1.dll
unpack001/vcruntime140.dll
unpack001/msvcp140.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/api-ms-win-crt-time-l1-1-0.dll
unpack001/api-ms-win-crt-utility-l1-1-0.dll
unpack001/api-ms-win-crt-math-l1-1-0.dll
unpack001/api-ms-win-crt-filesystem-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/vcruntime140_1.dll
unpack001/vcruntime140.dll
unpack001/msvcp140.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/api-ms-win-crt-math-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/api-ms-win-crt-time-l1-1-0.dll
unpack001/api-ms-win-crt-utility-l1-1-0.dll
unpack001/vcruntime140_1.dll
unpack001/vcruntime140.dll
unpack001/msvcp140.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/api-ms-win-crt-math-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/api-ms-win-crt-filesystem-l1-1-0.dll
unpack001/api-ms-win-crt-time-l1-1-0.dll
unpack001/api-ms-win-crt-utility-l1-1-0.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/vcruntime140_1.dll
unpack001/vcruntime140.dll
unpack001/msvcp140.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/vcruntime140_1.dll
unpack001/vcruntime140.dll
unpack001/msvcp140.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/api-ms-win-crt-math-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/api-ms-win-crt-time-l1-1-0.dll
unpack001/vcruntime140_1.dll
unpack001/vcruntime140.dll
unpack001/msvcp140.dll
unpack001/msvcp140_atomic_wait.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-math-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/api-ms-win-crt-time-l1-1-0.dll
unpack001/api-ms-win-crt-filesystem-l1-1-0.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-math-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll

resource
unpack001/api-ms-win-core-file-l1-2-0.dll
unpack001/api-ms-win-core-file-l2-1-0.dll
unpack001/api-ms-win-core-localization-l1-2-0.dll
unpack001/api-ms-win-core-processthreads-l1-1-1.dll
unpack001/api-ms-win-core-synch-l1-2-0.dll
unpack001/api-ms-win-core-timezone-l1-1-0.dll
unpack001/api-ms-win-crt-conio-l1-1-0.dll
unpack001/api-ms-win-crt-convert-l1-1-0.dll
unpack001/api-ms-win-crt-environment-l1-1-0.dll
unpack001/api-ms-win-crt-filesystem-l1-1-0.dll
unpack001/api-ms-win-crt-heap-l1-1-0.dll
unpack001/api-ms-win-crt-locale-l1-1-0.dll
unpack001/api-ms-win-crt-math-l1-1-0.dll
unpack001/api-ms-win-crt-multibyte-l1-1-0.dll
unpack001/api-ms-win-crt-private-l1-1-0.dll
unpack001/api-ms-win-crt-process-l1-1-0.dll
unpack001/api-ms-win-crt-runtime-l1-1-0.dll
unpack001/api-ms-win-crt-stdio-l1-1-0.dll
unpack001/api-ms-win-crt-string-l1-1-0.dll
unpack001/api-ms-win-crt-time-l1-1-0.dll
unpack001/api-ms-win-crt-utility-l1-1-0.dll
unpack001/concrt140.dll
unpack001/msvcp140.dll
unpack001/msvcp140_1.dll
unpack001/msvcp140_2.dll
unpack001/msvcp140_atomic_wait.dll
unpack001/msvcp140_codecvt_ids.dll
unpack001/vccorlib140.dll
unpack001/vcruntime140.dll
unpack001/vcruntime140_1.dll
unpack001/vcruntime140_threads.dll

i640.cab

SHA256 55271ed0c745a80bce683ca57fb27608016010a71e847ecf3cf30dea857df920
MD5 268dc02f8524605dad27ea8e0f5b8477
SHA1 c398293b20d3ed55033cfbd5c5890e424ad009a1
SHA512 8792a7288d10d4254efb885079da818507eb1426362d62b621842170bb09fb4fb0583be9cc72ffb8b0d68e52318fea9a63c2c917e6e91d2c694860e00d89f291
SSDEEP 786432:lut+tdu91FUuAx2Tr8TKYCueIgbaj6ofQ6xIVaftZWtgw:UtUdu9DAx2nIDleifQ62VaCtF
TLSH
T1B3773382437DC63ACE8FC1F9A4688F632215662A4B1275696C30F0EA7B5D7307CF59B4
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

14798868189cd234e6aa93ae497e5d9fd943166dbdf8453a3e46f517a1311a35

Digest Algorithm

sha256

Digest Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 30, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:23:4f:d9:60:24:53:cf:fe:2b:00:01:00:00:02:23

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

ApiClient.dll

IMPHASH 9907fc6c7f703f4b6b54409dcf3938f0
SHA256 72f4614196570969975123af1dd2e2c7a28726342edded20c6ea11d592ad6eca
MD5 611c8c2619ee94241d740ea4e6045566
SHA1 29c7caa83cf3737110eb2b63c40208a586efe36a
SHA512 70a2b3d8e1ae943d0c1be281ec4db1b3568c641b87f9e0926ec5dafd1851bfe414e658c89935e3f44569fecc433af732b5714548cb519276bc9a28c8961f3a78
SSDEEP 3072:CpYpvpepZpiYAvQFGG72UJWS34b0mdCYEtgr:CpYpvpepZpiYAvQkG7L94bNdf
TLSH
T12DD33961F22451EBD1ABD170C1AB9C77FB72BCAA0952A30F47B2D1161EA37407F1EA41
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

24:e3:47:7d:f5:1e:06:0f:29:c2:8f:3d:e5:b4:14:9e:08:32:74:b8:13:b2:e1:71:87:87:55:7e:8a:ff:6c:00

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

24:e3:47:7d:f5:1e:06:0f:29:c2:8f:3d:e5:b4:14:9e:08:32:74:b8:13:b2:e1:71:87:87:55:7e:8a:ff:6c:00

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:26:35:b4:3e:67:43:93:f6:1f:00:01:00:00:02:26

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1f:3a:70:69:e4:a2:30:2e:95:00:01:00:00:02:1f

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

42912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d:\dbs\el\omr\target\x64\ship\click2run\x-none\ApiClient.pdb

kernel32

Sleep SetLastError GetLastError FreeLibrary ReleaseSRWLockExclusive AcquireSRWLockExclusive GetProcAddress GetModuleHandleW LoadLibraryExW GetCurrentProcess TryAcquireSRWLockExclusive GetCurrentThreadId QueryPerformanceCounter InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer GetSystemTimeAsFileTime RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent RtlUnwindEx InterlockedFlushSList RtlPcToFileHeader RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree VirtualQuery VirtualProtect GetSystemInfo LoadLibraryExA

api-ms-win-crt-heap-l1-1-0

calloc free malloc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table _initialize_narrow_environment _execute_onexit_table _configure_narrow_argv _crt_atexit _cexit _seh_filter_dll terminate _invoke_watson abort _initterm _initterm_e

api-ms-win-crt-string-l1-1-0

strcmp wcsncpy_s strlen strcpy_s wcsncmp

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char

?Activate@@YAJV?$shared_ptr@VORpcClient@@@std@@PEBU_GUID@@@Z ?ActivateEx@@YAJV?$shared_ptr@VORpcClient@@@std@@PEBU_GUID@@K@Z ?ApplyPolicy@@YA_NV?$shared_ptr@VORpcClient@@@std@@HPEB_W111H@Z ?C2RCheckProcessForCorruption@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W1@Z ?CallReArm@@YAJV?$shared_ptr@VORpcClient@@@std@@PEBU_GUID@@@Z ?CancelUpdate@@YAJV?$shared_ptr@VORpcClient@@@std@@@Z ?CleanupWindowsDefenderFirewallRules@@YAJV?$shared_ptr@VORpcClient@@@std@@@Z ?CollectFileDiagnostics@@YA_NV?$shared_ptr@VORpcClient@@@std@@PEB_WPEA_WKPEAK@Z ?CompleteUpdateRegistration@@YAJV?$shared_ptr@VORpcClient@@@std@@@Z ?DetectWindowsDefenderFirewallRules@@YAJV?$shared_ptr@VORpcClient@@@std@@PEAH@Z ?DetermineIsRepairRequired@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_WAEAH@Z ?DetermineIsRepairRequiredEx@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_WAEAHK@Z ?DoRepairForApp@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W@Z ?DoRepairForAppEx@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_WK@Z ?EnableC2RUpdate@@YAJV?$shared_ptr@VORpcClient@@@std@@@Z ?EnsurePerpetualLicensesFolderExists@@YAJV?$shared_ptr@VORpcClient@@@std@@K@Z ?FetchDBSLicense@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W@Z ?GetClickToRunData@@YAJV?$shared_ptr@VORpcClient@@@std@@HPEB_WPEA_WK@Z ?GetClickToRunDataEx@@YAJV?$shared_ptr@VORpcClient@@@std@@HPEB_WPEA_WKK@Z ?GetPipelineStreamedMegabytes@@YAJV?$shared_ptr@VORpcClient@@@std@@PEAK@Z ?GetPipelineTotalMegabytes@@YAJV?$shared_ptr@VORpcClient@@@std@@PEAK@Z ?GetProcessPoolProcessId@@YAJV?$shared_ptr@VORpcClient@@@std@@PEAK@Z ?GetServiceVersion@@YAJV?$shared_ptr@VORpcClient@@@std@@PEA_WK@Z ?HandleHeartbeatScheduledTask@@YAJV?$shared_ptr@VORpcClient@@@std@@H@Z ?HandleHeartbeatScheduledTaskEx@@YAJV?$shared_ptr@VORpcClient@@@std@@HK@Z ?HandleMigrateOSPPToSPP@@YAJV?$shared_ptr@VORpcClient@@@std@@@Z ?HrOnNotification@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W1@Z ?HrSetTenantAssociationKey@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W1@Z ?HrStartUpdatesDiscoveryPeriod@@YAJV?$shared_ptr@VORpcClient@@@std@@@Z ?HrStartUpdatesDiscoveryPeriodEx@@YAJV?$shared_ptr@VORpcClient@@@std@@K@Z ?InstallPOP@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_WHHPEA_WHH@Z ?InstallPOPEx@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_WHHPEA_WHHK@Z ?InstallProtectedGraceLicense@@YAJV?$shared_ptr@VORpcClient@@@std@@@Z ?InvokeProcessKiller@@YAJV?$shared_ptr@VORpcClient@@@std@@HHHPEB_WPEAK@Z ?InvokeProcessKillerEx@@YAJV?$shared_ptr@VORpcClient@@@std@@HHHPEB_W1PEAK@Z ?IsFileInVirtualFolder@@YA_NV?$shared_ptr@VORpcClient@@@std@@PEB_W@Z ?KillQueuedProcesses@@YAJV?$shared_ptr@VORpcClient@@@std@@@Z ?ModifyOfficeProducts@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W1111KH@Z ?PromptUser@@YAJV?$shared_ptr@VORpcClient@@@std@@KPEAKPEB_W@Z ?QueueTaskItem@@YAJV?$shared_ptr@VORpcClient@@@std@@U_GUID@@@Z ?QueueUpdate@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W@Z ?QueueUpdateEx@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_WK@Z ?QueueUpdateOnlyApply@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W@Z ?RaiseTaskDialogEvent@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W1@Z ?RaiseTaskErrorEvent2@@YAJV?$shared_ptr@VORpcClient@@@std@@KKKPEB_W@Z ?RaiseTaskErrorEvent3@@YAJV?$shared_ptr@VORpcClient@@@std@@KKKKPEB_W@Z ?RaiseTaskErrorEvent@@YAJV?$shared_ptr@VORpcClient@@@std@@KKK@Z ?RaiseTaskProgressEvent@@YAJV?$shared_ptr@VORpcClient@@@std@@U_GUID@@K@Z ?RaiseTaskToastEvent@@YAJV?$shared_ptr@VORpcClient@@@std@@H@Z ?RestartKilledProcesses@@YAJV?$shared_ptr@VORpcClient@@@std@@@Z ?SetC2RProperty@@YA_NV?$shared_ptr@VORpcClient@@@std@@PEB_WK1KK@Z ?SetFeatureFlightValues@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W1@Z ?SetPolicyOverride@@YA_NV?$shared_ptr@VORpcClient@@@std@@PEB_W111@Z ?SetPolicyUserDisplayName@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W@Z ?SetPolicyUserName@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W@Z ?SetPrivacySettings@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_WKKK1KK1KK1KK1KK1@Z ?UninstallPOP@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W@Z ?UninstallPOPEx@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_WK@Z ?UpdateLicensingStateData@@YAJV?$shared_ptr@VORpcClient@@@std@@KHK@Z Activate ActivateEx ApplyPolicy C2RCheckProcessForCorruption CancelUpdate CleanupWindowsDefenderFirewallRules CollectFileDiagnostics CompleteUpdateRegistration DeleteAFOTask DetectWindowsDefenderFirewallRules DetermineIsRepairRequired DetermineIsRepairRequiredEx DoRepairForApp DoRepairForAppEx EnableC2RUpdate GetClickToRunData GetClickToRunDataEx GetPipelineStreamedMegabytes GetPipelineTotalMegabytes GetProcessPoolProcessId GetServiceVersion HrSetTenantAssociationKey HrStartUpdatesDiscoveryPeriod HrStartUpdatesDiscoveryPeriodEx InvokeProcessKiller InvokeProcessKillerEx IsFileInVirtualFolder KillQueuedProcesses ModifyOfficeProducts OnNotification PromptUser QueueTaskItem QueueUpdate QueueUpdateEx QueueUpdateOnlyApply RaiseTaskDialogEvent RaiseTaskErrorEvent RaiseTaskErrorEvent2 RaiseTaskErrorEvent3 RaiseTaskProgressEvent RaiseTaskToastEvent RestartKilledProcesses SetFeatureFlightValues SetPolicyOverride SetPolicyUserDisplayName SetPolicyUserName UpdateLicensingStateData

Name

.text

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

404B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ApiClient_arm64.dll

SHA256 816a4dacca2172c7f267ef67b12ee5c8515c0613e27175abfd84bdebc7623904
MD5 28320404b33c88ad5eceb0f1e1bc0312
SHA1 200bacfb26609b34d12dcd7cc39406c4e2b6010e
SHA512 04a0f6e329dfed252a0779478f812a7ec83ad864ecf45702c115693715725d7b4965483dd2bc1f2e4b2f9921215776d43a52a0d507a7a67149bd1733eeeba1ab
SSDEEP 6144:tIELIJB6jbcY/BtiIxRvR/ameFh51NXvCQORDeGvEc6XXgIhBrPcPP:tjIRTI/4C
TLSH
T10264E6953ACE9CE2D7C2923D8C228650367BB95D4E24DB03B193231FDE7E6C19EA0457
MD5 SHA1 SHA512 SSDEEP TLSH

AppVCatalog.dll

IMPHASH eb5150559814fa3aae297f1b5f507258
SHA256 26da69d6ece289a73e3e9a1659d201d10fee1160ca04bcd6ec174fc68665aaf8
MD5 0655c81cb6d4dd676afaab0ab59e0927
SHA1 7237ae89d9766c34a6fb52032eae95e830b56219
SHA512 fa9d955ff9b8f77078c09c873d8a6e6298dbc28d4e4b978318abbb0f9eadfecba4139454abedfbb2a6c97f831729169b02f4c1624e795e57bc125f9894200e12
SSDEEP 6144:IxYdnG2XQbLEiBjddKEDGFxV20iRbEk3W7lWGNU6ITLz4cdCGOXbP9UQrmFd:HQbNBfKEyF720SmkGNUbTgGA9UeQd
TLSH
T11AB43C29DA609625E1BBD9F89B33C631EB737C415270930AE3E1D1167E33F906A1AF11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

9e:0c:d3:f2:ff:c6:98:dd:f2:4a:f7:56:94:45:01:58:23:be:6d:3d:9f:96:e7:28:f7:97:c5:bb:7e:c5:07:c1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

9e:0c:d3:f2:ff:c6:98:dd:f2:4a:f7:56:94:45:01:58:23:be:6d:3d:9f:96:e7:28:f7:97:c5:bb:7e:c5:07:c1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:431A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1d:4b:c0:92:87:38:85:7e:39:00:01:00:00:02:1d

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:10:ab:cd:e4:16:18:ef:39:b0:00:01:00:00:02:10

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Minor OS version

1

Major OS version

6

Entry point

266800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d:\dbs\el\omr\target\x64\ship\appvisv\x-none\appv\AppVCatalog.pdb

kernel32

InitializeCriticalSectionEx GetFileAttributesW Sleep GetLastError GetProcAddress DeleteCriticalSection GetModuleHandleW InitializeSRWLock GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockShared GetLocalTime AcquireSRWLockShared SystemTimeToFileTime GetModuleFileNameA CreateSemaphoreExW HeapFree ReleaseSemaphore WaitForSingleObject CreateFileW ReleaseMutex FormatMessageW OutputDebugStringW GetCurrentThread WaitForSingleObjectEx OpenSemaphoreW CloseHandle RaiseException HeapAlloc CreateMutexExW GetCurrentProcessId GetProcessHeap DebugBreak IsDebuggerPresent FindFirstFileExW FindNextFileW FindClose RemoveDirectoryW CreateHardLinkW DeleteFileW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DisableThreadLibraryCalls FileTimeToSystemTime IsWow64Process GetModuleHandleExW SetLastError LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo InitializeSListHead QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter FindFirstFileW SetFileTime GetTempPathW SetFileAttributesW GetFileAttributesExW MoveFileExW GetTempFileNameW GetSystemTimeAsFileTime GetCurrentProcess FreeLibrary RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter

appvmanifest

ord3

appvpolicy

ord7 ord8 ord6 ord3

vcruntime140_1

__CxxFrameHandler4

vcruntime140

wcschr __C_specific_handler __std_exception_destroy __std_exception_copy __std_terminate _purecall memcpy memcmp _CxxThrowException __C_specific_handler_noexcept __RTDynamicCast __current_exception __current_exception_context __std_type_info_destroy_list memset memmove strrchr

msvcp140

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z ?good@ios_base@std@@QEBA_NXZ ?exceptions@ios_base@std@@QEAAXH@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?uncaught_exceptions@std@@YAHXZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ

api-ms-win-crt-heap-l1-1-0

free malloc

api-ms-win-crt-runtime-l1-1-0

_initterm terminate _invoke_watson _cexit _errno _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _initterm_e _invalid_parameter_noinfo

api-ms-win-crt-string-l1-1-0

wcsncmp iswalpha _wcsnicmp towupper iswdigit wcscpy_s _wcsupr_s _stricmp _wcsicmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf __stdio_common_vswprintf_s __stdio_common_vsnprintf_s

api-ms-win-crt-convert-l1-1-0

_ultow_s _wtoi

api-ms-win-crt-filesystem-l1-1-0

_waccess

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char

oleaut32

SysAllocString VariantClear SysFreeString VariantCopy

api-ms-win-crt-math-l1-1-0

ceilf

Name

.text

Size

272KB

Virtual Size

271KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

189KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

AppVClient.man

SHA256 c88a8b2a37f07b406d54b6a976c9de1a21e5197fb4d07252d021cf4823f68db2
MD5 ce709b1facdb6ab5415c088f1debc846
SHA1 fa289e1c9a94e915dc5319ce5c732b9c7190c5cc
SHA512 cc3d1c41abeb2fee6c97837ae90d5944f2ca9e24f0ec691b7062c2121a6549b44bd0a18653e5e4a7450057eaab7cd829e455e4dddf3463592b75f5611812d9a9
SSDEEP 1536:5bNnyhxwgUhlj5ZT2fp44n5hKbcjhmI3qwYH6C2tfgMgjvHhDziDHvL8:Bqxwg8ZT0n5hKbcVmQxC2tgHE8
TLSH
T125445481B5C07D514AB4870BEAF82004EA6C70A713AE90DE3CDC46551F3AA5B93BB77D
MD5 SHA1 SHA512 SSDEEP TLSH

AppVClientIsv.man

SHA256 2163cdf0700b8428bd0891bbbc19af454730d81a7f2c8707c42dfa7d0525df78
MD5 2ab90d4553c2fc3de453a29dae04d3ca
SHA1 9dbdfa5e6127ec5d468ce7628c7283d88ebaee4d
SHA512 d0ef7cf4ad1232ba6bf023e8197d8a209a05e262a58d34c4a38b9b64bd55d2330a8edd77c537b839712e439b447707182684a450992f57066ea57c64a38e6e3f
SSDEEP 1536:f0dk4ScZStYdGhrx7YoJCFk/yyqf5jiMHGyX1oSdN0+gJVBftZyWMgzd:kj8hjJCFk/yyqxBoSdMBfd
TLSH
T1401482A1B6687D520D54171BEBFC4000253CF1FA87EC90FEB8ED497A515DE6A233AB24
MD5 SHA1 SHA512 SSDEEP TLSH

AppVFileSystemMetadata.dll

IMPHASH 6d6d68e2565e0ea57d5864b27f20ae1b
SHA256 5b28a8458d805865ff1a8c47eced122f4f9341474bf284ef02494d34c76e29c5
MD5 33f18561080f0b8cffe3f0bcba92a134
SHA1 3727cea87922bea8abfcd3ae699e33d73a1b027a
SHA512 e024bea659f36942b28e7b34c280d33f9af85e1fcf18bd910b2b900eb2a2db6e0c0acd1b86baf34bfa17a2efb743a2334a9fbc8066900e0a0dd10b603a819bba
SSDEEP 3072:QmQQiKfLty64XeX4gBY43hJWGNU6ITL4ABSqMqn5x8jrR86L8wPuzw:QEzcpOXs43HWGNU6ITLrx81
TLSH
T19A440777CEA5E413DABF6DB45B338620EB3278104670930DC268D12D9E477D0AE69F29
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

fd:2c:0c:46:ef:07:71:34:a6:9d:b1:18:77:99:0c:7b:1b:f0:57:97:2c:0c:0f:1e:a5:79:90:19:4c:3c:33:e3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

fd:2c:0c:46:ef:07:71:34:a6:9d:b1:18:77:99:0c:7b:1b:f0:57:97:2c:0c:0f:1e:a5:79:90:19:4c:3c:33:e3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:26:35:b4:3e:67:43:93:f6:1f:00:01:00:00:02:26

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:25:80:c7:37:c6:cd:aa:77:49:00:01:00:00:02:25

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

72192

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d:\dbs\el\omr\target\x64\ship\appvisv\x-none\appv\AppVFileSystemMetadata.pdb

kernel32

CreateActCtxW ActivateActCtx SetLastError GetModuleHandleExW OutputDebugStringA GetModuleFileNameW FindActCtxSectionStringW InitializeCriticalSectionEx DeactivateActCtx QueryActCtxW GetLastError LoadLibraryW DeleteCriticalSection FreeLibrary DebugBreak IsDebuggerPresent OutputDebugStringW RaiseException FindFirstFileW FindNextFileW LoadLibraryExA GetProcAddress VirtualQuery VirtualProtect GetSystemInfo GetModuleHandleW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext FindResourceW LoadResource LockResource SizeofResource RemoveDirectoryW GetTempPathW FindClose SetFileAttributesW DeleteFileW MoveFileExW GetTempFileNameW CopyFileExW

oleaut32

VariantClear SysAllocString SysFreeString VariantInit VariantCopy

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate strrchr memmove memset wcschr memcpy __std_exception_copy __std_exception_destroy __C_specific_handler _purecall __current_exception __current_exception_context __std_type_info_destroy_list _CxxThrowException __C_specific_handler_noexcept

msvcp140

?good@ios_base@std@@QEBA_NXZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Xbad_alloc@std@@YAXXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xinvalid_argument@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

terminate _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _invoke_watson _initterm _errno _cexit _initterm_e

api-ms-win-crt-string-l1-1-0

iswdigit wcsncmp iswalpha wcscpy_s _stricmp _wcsicmp

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

Name

.text

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

117KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

AppVIntegration.dll

IMPHASH 4199ede7ca5cd149d3dfb013f2225b6b
SHA256 005be5975a82b238a0208b0b777478b24a334c076583e61f56aa7ba52a9ea840
MD5 e3ba94f9efcd9d98e68e35b7f4f1e2e2
SHA1 a267a2e649375a942959322c2b58848d7875e4cd
SHA512 4e14b38438258bebcb3c49137f9fc3e8e3f08e0f979ce9b6af6cfd278131678d98b9394fff72fe20695484c22907e4408b3bc1703f13c3de01b791fd970fc650
SSDEEP 24576:IIoBkQS2/mJMsNV1wZ8Xqn4edZPlrPVkXCg7aVGd:IIoMMokZ8qnFzVkXCg5
TLSH
T178653A16A6E48668F1F7E7F8DE374932E77378495630830F43A2C6197E237605929F22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

1d:9e:16:3a:13:71:33:4b:d4:2d:2b:ff:79:72:6a:7b:44:57:8a:fd:b9:6e:d7:35:59:0b:6a:29:4c:0f:e4:ca

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

1d:9e:16:3a:13:71:33:4b:d4:2d:2b:ff:79:72:6a:7b:44:57:8a:fd:b9:6e:d7:35:59:0b:6a:29:4c:0f:e4:ca

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:29:0e:d5:64:2a:b4:97:f2:1a:00:01:00:00:02:29

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:27:d5:c0:83:c3:b1:2e:57:2d:00:01:00:00:02:27

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

907872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d:\dbs\el\omr\target\x64\ship\appvisv\x-none\appv\AppVIntegration.pdb

kernel32

CreateActCtxW ActivateActCtx SetLastError GetModuleHandleExW OutputDebugStringA GetModuleFileNameW FindActCtxSectionStringW InitializeCriticalSectionEx DeactivateActCtx QueryActCtxW GetLastError DisableThreadLibraryCalls LoadLibraryW DeleteCriticalSection HeapFree HeapSize HeapReAlloc HeapAlloc HeapDestroy GetProcessHeap IsDebuggerPresent OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo InitializeSListHead GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive CopyFileW GetDriveTypeW GetModuleFileNameA MoveFileW GetTempPathW GetEnvironmentVariableW GetShortPathNameW GetLongPathNameW SearchPathW GetCurrentDirectoryW FormatMessageW GetComputerNameExW LoadLibraryA GetSystemDirectoryW WideCharToMultiByte MultiByteToWideChar GetSystemTimeAsFileTime MoveFileExW DeleteFileW GetFileAttributesW FindClose GetFinalPathNameByHandleW FindNextFileW FindFirstFileW IsWow64Process GetSystemWow64DirectoryW ExpandEnvironmentStringsW GetNativeSystemInfo FreeLibrary GetModuleHandleW GetProcAddress GetVersionExW ResetEvent LocalFree CreateFileW DeviceIoControl CreateProcessW CreateThreadpoolWork GetExitCodeProcess SubmitThreadpoolWork CreateThreadpoolCleanupGroup SetThreadpoolThreadMaximum Sleep CloseThreadpoolCleanupGroupMembers CloseThreadpoolCleanupGroup SetThreadpoolThreadMinimum TerminateProcess CreateThreadpool CloseThreadpool CloseThreadpoolWork RemoveDirectoryW DebugBreak CloseHandle GetCurrentThread SetEvent CreateEventW DuplicateHandle GetCurrentThreadId WaitForSingleObject InitializeCriticalSection GetCurrentProcess SetFileAttributesW GetTempFileNameW CopyFileExW Wow64RevertWow64FsRedirection Wow64DisableWow64FsRedirection

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy _CxxThrowException __std_exception_copy __C_specific_handler_noexcept __RTDynamicCast __C_specific_handler strchr __std_terminate memcmp memcpy strrchr __std_type_info_destroy_list __current_exception_context __current_exception wcsstr wcschr __std_type_info_compare _purecall memset memmove

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?fail@ios_base@std@@QEBA_NXZ ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAI@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ _Wcsxfrm ?id@?$collate@_W@std@@2V0locale@2@A ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z _Wcscoll ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?exceptions@ios_base@std@@QEAAXH@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?_Xbad_function_call@std@@YAXXZ ?widen@?$ctype@_W@std@@QEBA_WD@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ?_Id_cnt@id@locale@std@@0HA ?id@?$ctype@_W@std@@2V0locale@2@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_N@Z ?good@ios_base@std@@QEBA_NXZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?uncaught_exceptions@std@@YAHXZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Xbad_alloc@std@@YAXXZ

api-ms-win-crt-heap-l1-1-0

free realloc calloc malloc

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo _resetstkoflw _errno terminate _invoke_watson _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _initterm_e _initterm

api-ms-win-crt-string-l1-1-0

iswctype wcsncmp iswalpha towupper iswdigit _stricmp iswspace _wcsicmp _wcsnicmp wcscpy_s wcscmp _wcslwr_s _wcsupr_s

api-ms-win-crt-filesystem-l1-1-0

_wmakepath_s _wsplitpath_s

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-convert-l1-1-0

wcstol wcstoul _ultow_s _wtoi

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf __stdio_common_vsnprintf_s __stdio_common_vswscanf __stdio_common_vswprintf_s

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char

ntdll

NtQueryKey

oleaut32

VariantChangeType VariantCopy VariantInit SysFreeString SysAllocString VariantClear

api-ms-win-core-path-l1-1-0

PathCchCanonicalize

api-ms-win-crt-math-l1-1-0

ceilf

Name

.text

Size

944KB

Virtual Size

944KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

444KB

Virtual Size

444KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

49KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

824B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

AppVIsvApi.dll

IMPHASH 04134ee02e71c32831193b6ad5b659a3
SHA256 4b2af96928e174ed97031c3859b16e879ca54c3972b10ffcb6048e3d31ac55bd
MD5 88b91b6010799857ee56f18cf04b4cbd
SHA1 bbacb5c2628bb29211b60e55680bd272303efcf3
SHA512 7436079fef579d874796b3d2e5824c238710bf2277ffb0736d7c3d8b395fb15b3a4eddb86bdae49aa5eba86f1608e4080f4f198979480dc4b69f9a37f51ed3ef
SSDEEP 6144:5tllGjuqSeZ9F8MBWOkRwADpHm5BWGNU6ITLizGqIN5Iw:GaeZ9FjQDo5cGNUbTnqIj
TLSH
T195741926DFA0E521EABB9EBC9B37C630D7B774511231D30EC2A1C109BE173D06A59E25
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

95:d2:5c:23:82:11:46:00:6d:ff:22:7f:9a:c6:1f:71:14:ce:e7:e1:26:d4:ec:23:eb:40:d5:4f:08:d7:06:12

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

95:d2:5c:23:82:11:46:00:6d:ff:22:7f:9a:c6:1f:71:14:ce:e7:e1:26:d4:ec:23:eb:40:d5:4f:08:d7:06:12

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:26:35:b4:3e:67:43:93:f6:1f:00:01:00:00:02:26

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Minor OS version

1

Major OS version

6

Entry point

153728

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d:\dbs\el\omr\target\x64\ship\appvisv\x-none\appv\AppVIsvApi.pdb

kernel32

GetModuleFileNameW FindActCtxSectionStringW InitializeCriticalSectionEx GetCurrentThreadId DeactivateActCtx QueryActCtxW GetLastError ReleaseSRWLockExclusive DisableThreadLibraryCalls AcquireSRWLockExclusive ReleaseSRWLockShared LoadLibraryW AcquireSRWLockShared DeleteCriticalSection OutputDebugStringA LeaveCriticalSection InitializeCriticalSection WaitForSingleObject CreateEventW SetEvent CloseHandle ResetEvent GetLocalTime SystemTimeToFileTime GetSystemTime IsDebuggerPresent OutputDebugStringW RaiseException GetModuleHandleExW SetLastError ActivateActCtx CreateActCtxW EnterCriticalSection InitializeSRWLock LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo GetModuleHandleW InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetExitCodeThread WaitForMultipleObjects FreeLibrary GetProcAddress CreateThreadpoolWork SubmitThreadpoolWork CreateThreadpoolCleanupGroup SetThreadpoolThreadMaximum CloseThreadpoolCleanupGroupMembers CloseThreadpoolCleanupGroup CallbackMayRunLong SetThreadpoolThreadMinimum CreateThreadpool CloseThreadpool CloseThreadpoolWork GetCurrentThread GetCurrentProcess LocalFree GetComputerNameExW

appvpolicy

ord4 ord3 ord6 ord8 ord1

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception memset memmove _CxxThrowException strrchr __std_terminate __std_exception_copy __std_exception_destroy __C_specific_handler memcpy __std_type_info_destroy_list __C_specific_handler_noexcept _purecall __RTDynamicCast

msvcp140

?widen@?$ctype@_W@std@@QEBA_WD@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?id@?$ctype@_W@std@@2V0locale@2@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?exceptions@ios_base@std@@QEAAXH@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?good@ios_base@std@@QEBA_NXZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-heap-l1-1-0

malloc free

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _initterm_e _initterm _invoke_watson _errno terminate _cexit _execute_onexit_table _beginthreadex _crt_atexit _invalid_parameter_noinfo

api-ms-win-crt-string-l1-1-0

iswdigit iswspace _wcsicmp _stricmp towupper

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char

Name

.text

Size

155KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

156KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

AppVIsvStreamingManager.dll

IMPHASH 98f10f5929df2fefb9bd84fcde13fe23
SHA256 91dccc2e5f92f8c70747c41617d1f4f3953ce2ca2cb3861dbb27001be116878a
MD5 c27fca7bf8a26a6ac5187c0c0c6eaafe
SHA1 5e0f037ae0e3bd422edfc2e2a2a4637200dedf1a
SHA512 f7ea9a25ae2d63afbfddffedd95cd6044fd8e7967e99bab7865349de76e681e27276218ca7c08ede54b56cb73248c5feab387fc181d2786ea18fec9860636109
SSDEEP 3072:kT8//4KypQhxoWGNU6ITLmP00u1tlFVNFVNdt7Zw1BsOGjHbK6R:K8//phCWGNU6ITLmP002eY5R
TLSH
T1FB04A4BBCD34E413C3BE5CB49763CF20AB76E2605681220AD275D16D1D433D1AF9AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

dd:5f:62:5b:5a:e6:85:fe:4b:35:85:cb:ac:cf:c9:de:53:76:e4:b7:44:12:14:72:a4:24:6e:be:5d:e9:1c:a5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

dd:5f:62:5b:5a:e6:85:fe:4b:35:85:cb:ac:cf:c9:de:53:76:e4:b7:44:12:14:72:a4:24:6e:be:5d:e9:1c:a5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:29:0e:d5:64:2a:b4:97:f2:1a:00:01:00:00:02:29

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:2b:bb:00:50:ff:4d:3b:9a:a1:00:01:00:00:02:2b

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

36848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d:\dbs\el\omr\target\x64\ship\appvisv\x-none\appv\AppVIsvStreamingManager.pdb

kernel32

SetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSection InitializeCriticalSectionEx GetCurrentThreadId GetLastError GetProcAddress DeleteCriticalSection GetModuleHandleW IsDebuggerPresent OutputDebugStringW RaiseException DisableThreadLibraryCalls Wow64RevertWow64FsRedirection Wow64DisableWow64FsRedirection CopyFileExW GetTempFileNameW MoveFileExW GetTempPathW LoadLibraryExA FreeLibrary VirtualQuery VirtualProtect GetSystemInfo InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CompareStringW DeleteFileW SetFileAttributesW FindClose RemoveDirectoryW FindNextFileW FindFirstFileW

appvmanifest

ord2

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy wcschr __RTDynamicCast _CxxThrowException __std_type_info_destroy_list memset memmove strrchr __std_terminate __std_exception_copy __std_exception_destroy __C_specific_handler memcmp __C_specific_handler_noexcept

msvcp140

?_Xbad_function_call@std@@YAXXZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _execute_onexit_table _configure_narrow_argv _crt_atexit _seh_filter_dll _initterm _cexit _initterm_e _invoke_watson _initialize_narrow_environment

api-ms-win-crt-string-l1-1-0

iswalpha _wcsnicmp wcscpy_s wcsncmp _stricmp

oleaut32

VariantCopy SysFreeString VariantClear SysAllocString

Name

.text

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

106KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

AppVIsvSubsystemController.dll

IMPHASH 7e7c3b378ec950eae8091663013611f7
SHA256 5da89a3c8c14c63f318bb836a1fbebe4d89fc225c31c8884ef982cbe42070088
MD5 a23d6077fc48a6551ce4ddb0b054f6f1
SHA1 af24e2d3a3ee0190d3e09586e69e68353b30bff6
SHA512 4ffd4bd8f2adcf147859a394cb2e40637e354d7172912b3132a50084cfc615dbc683c46c465bf06bf1dc7d930e74995d018309c69b7123915d1666e0289d7eaf
SSDEEP 12288:6ceu/Rs1dlghuQ2Oe5aKyfo0IYQCoHvdu9bGNUbTA796858Mngc7gI:a0Rs1d+KyA0IAoHs9+ngc7gI
TLSH
T18C156D2FDBA88165F5BBD6F69A73C532E7F3B4451230530742A1C60A7F237A05A1DB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

6f:1a:58:71:6d:12:92:c4:b1:04:6b:9d:5b:58:62:e5:9d:c0:dc:36:cc:5d:a7:a2:e3:61:f3:cb:64:31:03:1f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

6f:1a:58:71:6d:12:92:c4:b1:04:6b:9d:5b:58:62:e5:9d:c0:dc:36:cc:5d:a7:a2:e3:61:f3:cb:64:31:03:1f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:431A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1d:4b:c0:92:87:38:85:7e:39:00:01:00:00:02:1d

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6F1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1c:09:55:15:d7:c3:59:07:d1:00:01:00:00:02:1c

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Minor OS version

1

Major OS version

6

Entry point

560464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d:\dbs\el\omr\target\x64\ship\appvisv\x-none\appv\AppVIsvSubsystemController.pdb

kernel32

CreateActCtxW ActivateActCtx HeapFree SetLastError EnterCriticalSection GetModuleHandleExW OutputDebugStringA GetModuleFileNameW LeaveCriticalSection InitializeCriticalSection CreateMutexW FindActCtxSectionStringW InitializeCriticalSectionEx WaitForSingleObject GetCurrentThreadId ReleaseMutex DeactivateActCtx HeapSize QueryActCtxW GetLastError HeapReAlloc CloseHandle LoadLibraryW HeapAlloc InitializeSRWLock HeapDestroy DeleteCriticalSection GetProcessHeap GetModuleHandleW GetCurrentProcess OpenProcess GetCurrentThread RaiseException LocalFree CreateProcessW WideCharToMultiByte IsWow64Process GetExitCodeProcess WaitForMultipleObjects CreateEventW ReleaseSRWLockExclusive SetEvent AcquireSRWLockExclusive ReleaseSRWLockShared ResetEvent AcquireSRWLockShared IsDebuggerPresent OutputDebugStringW DisableThreadLibraryCalls CompareStringW InitializeCriticalSectionAndSpinCount VirtualProtect MapViewOfFile CreateFileMappingW QueryFullProcessImageNameW UnmapViewOfFile GetEnvironmentVariableW Sleep Wow64RevertWow64FsRedirection Wow64DisableWow64FsRedirection GetNativeSystemInfo ExpandEnvironmentStringsW LoadLibraryA GetSystemDirectoryW GetShortPathNameW GetLongPathNameW SearchPathW GetSystemTimeAsFileTime FindClose FindNextFileW FindFirstFileW FormatMessageW DuplicateHandle GetModuleFileNameA GetVersionExW ResumeThread TransactNamedPipe GetOverlappedResult QueueUserWorkItem DisconnectNamedPipe CreateFileW PeekNamedPipe ReadFile TerminateProcess ReleaseSemaphore GetFileAttributesW GetVolumePathNameW DebugBreak ReadProcessMemory WriteProcessMemory GetTickCount FreeLibrary GetProcAddress OpenFileMappingW FlushViewOfFile FlushFileBuffers VirtualProtectEx VirtualAllocEx VirtualQueryEx VirtualQuery LoadLibraryExA WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId InitializeSListHead GetSystemInfo

appvfilesystemmetadata

ord1

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_type_info_compare wcschr memset memmove strchr __C_specific_handler __current_exception __std_exception_destroy __std_exception_copy __current_exception_context _purecall memcmp memcpy _CxxThrowException __std_type_info_destroy_list __std_terminate __C_specific_handler_noexcept __RTDynamicCast strrchr

msvcp140

?_Xbad_function_call@std@@YAXXZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z _Wcscoll ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?id@?$ctype@_W@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_J@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?exceptions@ios_base@std@@QEAAXH@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?good@ios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z

api-ms-win-crt-heap-l1-1-0

realloc free calloc malloc

api-ms-win-crt-runtime-l1-1-0

terminate _errno _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _initterm_e _initterm _invalid_parameter_noinfo _resetstkoflw _invoke_watson

api-ms-win-crt-string-l1-1-0

wcscmp _wcsupr_s towupper _stricmp wmemcpy_s iswspace wcsncpy_s iswalpha iswdigit wcsncmp _wcslwr_s wcscpy_s _wcsnicmp _wcsicmp

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s __stdio_common_vswprintf __stdio_common_vsnwprintf_s

api-ms-win-crt-convert-l1-1-0

_wtoi wcstol

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char

ntdll

RtlInitUnicodeString RtlNtStatusToDosError NtQueryInformationProcess NtOpenJobObject

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

api-ms-win-crt-math-l1-1-0

ceilf

Name

.text

Size

564KB

Virtual Size

564KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

262KB

Virtual Size

261KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

720B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.mrdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

AppVIsvVirtualization.dll

IMPHASH 4b65e2bcc07b42faad8c5450a5ee5f7b
SHA256 18beb1ccc4fef771ab6c8b0b2ab8f808bf9099a75993d7c60f82296472f5df92
MD5 8c97e8fac3a5a3402b5aef471ccafc94
SHA1 bc354086249dbadb50d11e8677cabfd3db68c0e1
SHA512 8d7905650d2fd185ff89bc617f780dc590cec5beb368364eab97693f7ca11586e6ee68eeea9e2af45d08693f7683a0251317c7d17816204d628ae10533186b51
SSDEEP 6144:Zh9hVzg+HkFfLECfKiYsAm6fTUhByfNNdiWGNU6ITLIpwDgNg5Um7l:XkFfNCHse7UrydjGNUbTGgvl
TLSH
T1EFA45B76DE649821E2BB99B89B73CB31EA727C1502609307F3A1E1562F33FD06609F15
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

b4:c4:dd:7c:04:4b:f9:2d:fe:57:7f:89:17:12:1b:cb:40:57:73:46:0e:b2:15:4d:85:3e:f3:57:1f:af:e6:4b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

b4:c4:dd:7c:04:4b:f9:2d:fe:57:7f:89:17:12:1b:cb:40:57:73:46:0e:b2:15:4d:85:3e:f3:57:1f:af:e6:4b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:321A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1a:a9:a0:1d:06:a0:0f:43:aa:00:01:00:00:02:1a

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:14:8d:cd:23:44:ee:06:df:72:00:01:00:00:02:14

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Minor OS version

1

Major OS version

6

Entry point

209152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d:\dbs\el\omr\target\x64\ship\appvisv\x-none\appv\AppVIsvVirtualization.pdb

kernel32

DisableThreadLibraryCalls InitializeSRWLock HeapFree SetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSection InitializeCriticalSectionEx GetCurrentThreadId HeapSize GetLastError HeapReAlloc HeapAlloc HeapDestroy DeleteCriticalSection GetProcessHeap RegisterWaitForSingleObject UnregisterWait OpenProcess ProcessIdToSessionId ReleaseSRWLockExclusive AcquireSRWLockExclusive CloseHandle ReleaseSRWLockShared UnregisterWaitEx LocalFree AcquireSRWLockShared IsDebuggerPresent OutputDebugStringW RaiseException GetSystemTimeAsFileTime MoveFileExW DeleteFileW SetFileAttributesW GetFileAttributesW CreateFileW FindClose RemoveDirectoryW WriteFile FindNextFileW FindFirstFileW ReadFile WideCharToMultiByte MultiByteToWideChar GetSystemTime QueueUserWorkItem SystemTimeToFileTime GetLocalTime GetCurrentProcess Sleep SetEvent CreateEventW WaitForSingleObject GetModuleHandleW GetProcAddress GetCurrentThread FreeLibrary GetVersionExW QueryFullProcessImageNameW Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection LocalFileTimeToFileTime SetFileInformationByHandle DosDateTimeToFileTime GetFileInformationByHandleEx FileTimeToLocalFileTime FileTimeToDosDateTime SetFilePointer WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId InitializeSListHead GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp __std_type_info_destroy_list __current_exception_context __current_exception memcpy _CxxThrowException wcschr memset memmove strrchr __std_terminate _purecall __std_exception_copy __std_exception_destroy __C_specific_handler __C_specific_handler_noexcept __RTDynamicCast

msvcp140

?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?_Xbad_function_call@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z ?fail@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAI@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_N@Z ?exceptions@ios_base@std@@QEAAXH@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ?good@ios_base@std@@QEBA_NXZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ

api-ms-win-crt-heap-l1-1-0

free calloc malloc

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _seh_filter_dll _initterm_e _initterm terminate _initialize_narrow_environment _cexit _crt_atexit _errno _invalid_parameter_noinfo _execute_onexit_table _invoke_watson _initialize_onexit_table _register_onexit_function _resetstkoflw

api-ms-win-crt-string-l1-1-0

_wcsicmp wcsncmp _wcsnicmp _wcslwr_s iswalpha iswdigit towupper _stricmp wcscpy_s

api-ms-win-crt-filesystem-l1-1-0

_waccess _wsplitpath_s

api-ms-win-crt-stdio-l1-1-0

ferror fopen fread _fseeki64 fwrite fclose __stdio_common_vswprintf_s _ftelli64

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char

Name

.text

Size

241KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

170KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

616B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

AppVManifest.dll

IMPHASH 6fc8b3c853aa38c9a943f708ee292612
SHA256 26b092d6651bf7df19ef13fdc8b6f4edc23f716f44da9b306315b00e68e8a4bb
MD5 08988de4b86569035b887dc58277bf3e
SHA1 a9fa3a9b9db6a51fd19166ff3ac8f5d657115ed2
SHA512 1e5c6cb02c0dd22725e0530c8eff6d34de75807ff4c0c29a2b7ae6e6d0f4e73d8a9a0d552c4291bc19aff93d114523aa842d7141a4bccac09bd0ab25cfce9724
SSDEEP 6144:OOwlecZe1QcdtTmqz2XKTPRnc84tufOFaUtcYVdoPmOFa1KWGNU6ITLNlY5fe5F3:3cZJcdRDVscsdXJGNUbTbp2cXm8
TLSH
T1B915B503BAEE4610F2B79AB8DA738560EB777C411934D30D01A9954E4FA3F409DA7F62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

9e:50:d5:8c:db:51:b3:16:ca:0f:65:4a:d7:05:b8:3f:d6:ac:fd:86:9a:95:c2:2c:2d:d7:ec:f6:e3:93:24:1f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

9e:50:d5:8c:db:51:b3:16:ca:0f:65:4a:d7:05:b8:3f:d6:ac:fd:86:9a:95:c2:2c:2d:d7:ec:f6:e3:93:24:1f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1e:a3:ac:a4:6e:39:6f:7c:49:00:01:00:00:02:1e

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:27:d5:c0:83:c3:b1:2e:57:2d:00:01:00:00:02:27

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

296720

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d:\dbs\el\omr\target\x64\ship\appvisv\x-none\appv\AppVManifest.pdb

kernel32

CreateActCtxW ActivateActCtx SetLastError GetModuleHandleExW OutputDebugStringA GetModuleFileNameW FindActCtxSectionStringW InitializeCriticalSectionEx DeactivateActCtx QueryActCtxW GetLastError LoadLibraryW DeleteCriticalSection DeleteFileW FreeLibrary DebugBreak WideCharToMultiByte lstrcmpiW IsDebuggerPresent OutputDebugStringW RaiseException FindResourceW LoadResource LockResource SizeofResource GetCurrentProcess CopyFileExW GetSystemTimeAsFileTime GetTempFileNameW MoveFileExW SetFileAttributesW FindClose GetTempPathW RemoveDirectoryW FindNextFileW FindFirstFileW GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead GetModuleHandleW GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA

oleaut32

SysAllocString SysFreeString VariantInit GetErrorInfo VariantCopy VariantClear VariantChangeType

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_type_info_destroy_list __current_exception_context __current_exception __C_specific_handler_noexcept memset memmove _purecall strrchr __std_terminate __std_exception_copy __std_exception_destroy __C_specific_handler __RTDynamicCast _CxxThrowException memcpy memcmp wcschr

msvcp140

?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?id@?$ctype@_W@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ??0_Lockit@std@@QEAA@H@Z ?good@ios_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?uncaught_exceptions@std@@YAHXZ ?fail@ios_base@std@@QEBA_NXZ ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAI@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??1_Lockit@std@@QEAA@XZ

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _initterm_e _register_onexit_function _execute_onexit_table _invoke_watson _crt_atexit _cexit terminate _errno _initterm

api-ms-win-crt-string-l1-1-0

wcscpy_s _wcsicmp iswalpha wcsncmp _stricmp _wcsupr_s iswdigit

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

Name

.text

Size

297KB

Virtual Size

297KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

234KB

Virtual Size

233KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

80KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

204KB

Virtual Size

204KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

AppVOrchestration.dll

IMPHASH 4312b51ea8a489a218814be58928c8bf
SHA256 0c2eb6902b9b45a5b9426dd047b7ee8c66359b456286d411ba0360fa74458c9f
MD5 db9c54c1bf931f37bb8c9b5529cb3d1a
SHA1 f773db9837324da9dce2a7ef61adb65fa54a9908
SHA512 e7a154021f56ca0e1c4b72bc720785bc7db520e8d099fb124876f8d3fb0bfb4bfde5468b0596328d9cba3a7eabc3f308ac6404d0b06ea199f5392f3b2cf35708
SSDEEP 6144:lLBH8o9ezpjKm1E524HuvqoswpOQG+7V+wB0XNWMPyy/aUe55E3Hiyt7eBa5p3O5:8o9/oTh2RV1d3OY7BGNUbTu9J
TLSH
T146F43A259AA49664F1FBDBF59A338631FB73B8895230930B4391D13B3E23790591DF22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

29:cf:d7:de:3f:4e:4f:4e:e3:01:03:ea:d5:e5:76:32:59:1d:78:ae:e4:39:64:22:9a:17:81:2d:12:3d:9f:4c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

29:cf:d7:de:3f:4e:4f:4e:e3:01:03:ea:d5:e5:76:32:59:1d:78:ae:e4:39:64:22:9a:17:81:2d:12:3d:9f:4c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:4C1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:18:25:d9:92:05:e2:e7:e5:e4:00:01:00:00:02:18

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2D1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:12:d1:08:06:3c:ca:18:4f:aa:00:01:00:00:02:12

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Minor OS version

1

Major OS version

6

Entry point

411568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d:\dbs\el\omr\target\x64\ship\appvisv\x-none\appv\AppVOrchestration.pdb

kernel32

ActivateActCtx HeapFree SetLastError EnterCriticalSection GetCurrentProcess GetModuleHandleExW OutputDebugStringA GetModuleFileNameW LeaveCriticalSection InitializeCriticalSection FindActCtxSectionStringW InitializeCriticalSectionEx WaitForSingleObject GetCurrentThreadId DeactivateActCtx HeapSize QueryActCtxW Sleep GetLastError ReleaseSRWLockExclusive GetCurrentThread AcquireSRWLockExclusive HeapReAlloc CloseHandle ReleaseSRWLockShared CreateActCtxW HeapAlloc GetLocalTime HeapDestroy LocalFree AcquireSRWLockShared DeleteCriticalSection GetProcessHeap SystemTimeToFileTime CreateEventW SetEvent ResetEvent GetProcAddress FreeLibrary DisableThreadLibraryCalls TlsSetValue QueueUserWorkItem FileTimeToSystemTime TlsAlloc RaiseException TlsGetValue TlsFree DebugBreak DuplicateHandle IsProcessorFeaturePresent LoadLibraryW InitializeSRWLock TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable GetTempPathW GetSystemTimeAsFileTime MoveFileExW DeleteFileW FindClose FindNextFileW FindFirstFileW RemoveDirectoryW GetModuleHandleW GetCurrentProcessId CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx FormatMessageW ReleaseMutex ReleaseSemaphore CreateSemaphoreExW GetModuleFileNameA OutputDebugStringW IsDebuggerPresent InitializeSListHead GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA SetFileAttributesW QueryPerformanceCounter GetTempFileNameW

appvpolicy

ord6

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate memcmp memcpy strrchr memmove memset wcschr _purecall __C_specific_handler __std_exception_destroy __current_exception _CxxThrowException __C_specific_handler_noexcept __std_exception_copy __RTDynamicCast __current_exception_context __std_type_info_destroy_list

msvcp140

??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?uncaught_exceptions@std@@YAHXZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?_Xlength_error@std@@YAXPEBD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_N@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Id_cnt@id@locale@std@@0HA ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??1_Lockit@std@@QEAA@XZ ?good@ios_base@std@@QEBA_NXZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?exceptions@ios_base@std@@QEAAXH@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?id@?$ctype@_W@std@@2V0locale@2@A

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv terminate _initterm_e _initterm _resetstkoflw _invoke_watson _invalid_parameter_noinfo _errno

api-ms-win-crt-heap-l1-1-0

malloc free

api-ms-win-crt-string-l1-1-0

iswalpha towupper iswdigit _wcsupr_s wcsncmp wcscpy_s _stricmp _wcsicmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s __stdio_common_vswprintf __stdio_common_vswprintf_s

api-ms-win-crt-convert-l1-1-0

_wtoi _ultow_s

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char

oleaut32

VariantCopy SysAllocString VariantClear

api-ms-win-crt-math-l1-1-0

ceilf

Name

.text

Size

410KB

Virtual Size

409KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

263KB

Virtual Size

263KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

AppVPolicy.dll

IMPHASH 22be30f620d496e11eaeb2419b02a1ea
SHA256 67616e4012d8c6471d98f6da1e41854ccf2d7795c27e3c0234dff5fdbe235ae3
MD5 71d8b0e0702f251b5a4cdd7365674faa
SHA1 88d21aaba5f60b13ebf3bff9d182f230b94ee27e
SHA512 6bd2c34ec7670ddd64e7726bc9d6f9b16cf13c6188b110b88af2266ddad2e3d42328c0c71a013eb77ea5c54c957075349cf81c298ed66b4662b36a28ae378746
SSDEEP 12288:LAlU6Wls12ZnMncFoTfcGNUbTzGUUzZ8/BYSzePkXpWACfE:gcnMncFYfWGUUzZ8/BYSzePkXpWACfE
TLSH
T1DF2583036AEE4210F2B79EB9DA734460AB777C414934E30D419D694D8FA3F40D9A7FA2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

c7:1c:0f:c0:6e:4d:e4:69:8c:44:c0:5f:7f:b5:94:1c:dc:75:76:61:ac:19:a9:d1:3a:a6:d9:ae:7b:b3:a6:d7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

c7:1c:0f:c0:6e:4d:e4:69:8c:44:c0:5f:7f:b5:94:1c:dc:75:76:61:ac:19:a9:d1:3a:a6:d9:ae:7b:b3:a6:d7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:401A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:19:5e:b2:d8:54:75:f4:b1:8d:00:01:00:00:02:19

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Minor OS version

1

Major OS version

6

Entry point

315776

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d:\dbs\el\omr\target\x64\ship\appvisv\x-none\appv\AppVPolicy.pdb

kernel32

CreateActCtxW ActivateActCtx SetLastError GetModuleHandleExW OutputDebugStringA GetModuleFileNameW FindActCtxSectionStringW InitializeCriticalSectionEx DeactivateActCtx QueryActCtxW GetLastError LoadLibraryW DeleteCriticalSection GetLocalTime SystemTimeToFileTime FreeLibrary DebugBreak IsDebuggerPresent OutputDebugStringW RaiseException FindResourceW LoadResource LockResource SizeofResource GetCurrentProcess CopyFileExW GetSystemTimeAsFileTime GetTempFileNameW MoveFileExW DeleteFileW SetFileAttributesW FindClose GetTempPathW RemoveDirectoryW FindNextFileW FindFirstFileW WideCharToMultiByte RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead GetModuleHandleW GetSystemInfo VirtualProtect VirtualQuery GetProcAddress LoadLibraryExA

oleaut32

SysAllocString SysFreeString VariantClear VariantChangeType VariantCopy VariantInit

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove memcpy __C_specific_handler_noexcept __C_specific_handler __RTDynamicCast memcmp __std_exception_destroy __std_exception_copy __std_terminate _purecall strrchr memset wcschr _CxxThrowException __std_type_info_destroy_list __current_exception_context __current_exception

msvcp140

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ?exceptions@ios_base@std@@QEAAXH@Z ?good@ios_base@std@@QEBA_NXZ ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAI@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?fail@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc

api-ms-win-crt-runtime-l1-1-0

_invoke_watson _errno terminate _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _initterm_e _initterm

api-ms-win-crt-string-l1-1-0

wcsncmp iswalpha _wcsupr_s iswdigit _wcslwr_s _stricmp _wcsicmp wcscpy_s _wcsnicmp

api-ms-win-crt-convert-l1-1-0

_wtoi wcstoul

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s __stdio_common_vswscanf

api-ms-win-crt-filesystem-l1-1-0

_waccess

api-ms-win-crt-math-l1-1-0

ceilf

Name

.text

Size

316KB

Virtual Size

316KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

242KB

Virtual Size

242KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

72KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

271KB

Virtual Size

270KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

AppVScripting.dll

IMPHASH bc40de9873a2cebbe6dd6a14be5b2dd5
SHA256 de15828fbba0ba640dc393bd49cb1afa90c40ace0224c912d629268801bcd968
MD5 d5784326b322ceafb3451a3b6620d9ab
SHA1 7b2c790a617d28caf6954aca5ccf142cb7286654
SHA512 bfbadd3be7258fb98075d1907e4d3d3489983dba5e440f1af195ccd093882d921f250c8ae8f5a051cb5a649320c8a5b60b77262fb44c06b097afe7b65c373a02
SSDEEP 6144:dE5pVuup6FmCWQ80IYUdRpS2Wr0RFWGNU6ITLfdjtcaXuM:SZMYC80+dRpzWrq4GNUbT5Ga+M
TLSH
T173844B7AEE64E465E6BF9DBC9B23C721EBF274110220E30AC3B5C14A7E173D06619E15
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

42:d1:f0:04:f6:5a:27:6c:9d:58:d3:a8:a9:47:a0:76:52:26:31:86:6b:4e:24:9f:93:87:93:64:d4:68:63:d1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

42:d1:f0:04:f6:5a:27:6c:9d:58:d3:a8:a9:47:a0:76:52:26:31:86:6b:4e:24:9f:93:87:93:64:d4:68:63:d1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:25:80:c7:37:c6:cd:aa:77:49:00:01:00:00:02:25

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:27:d5:c0:83:c3:b1:2e:57:2d:00:01:00:00:02:27

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

167488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d:\dbs\el\omr\target\x64\ship\appvisv\x-none\appv\AppVScripting.pdb

kernel32

DisableThreadLibraryCalls SetLastError GetCurrentProcess InitializeCriticalSectionEx GetLastError DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThreadId GetCurrentThread CloseHandle RaiseException InitializeCriticalSection TerminateProcess WaitForSingleObject CloseThreadpoolWait CreateThreadpoolWait SetThreadpoolWait CreateProcessW GetExitCodeProcess IsDebuggerPresent OutputDebugStringW LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentVariableW GetShortPathNameW OpenProcess LocalFree Wow64RevertWow64FsRedirection Wow64DisableWow64FsRedirection GetProcAddress GetModuleHandleW FreeLibrary QueryFullProcessImageNameW GetComputerNameExW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler __std_exception_destroy memmove memset __std_exception_copy _purecall strrchr memcpy memcmp _CxxThrowException __C_specific_handler_noexcept __RTDynamicCast __std_terminate strchr __current_exception __current_exception_context __std_type_info_destroy_list

msvcp140

_Wcscoll ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?id@?$ctype@_W@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Xbad_function_call@std@@YAXXZ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z ?good@ios_base@std@@QEBA_NXZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?uncaught_exceptions@std@@YAHXZ ?is@?$ctype@_W@std@@QEBA_NF_W@Z

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll _initterm _initterm_e _invoke_watson _configure_narrow_argv _initialize_narrow_environment terminate _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table

api-ms-win-crt-string-l1-1-0

wcsncmp wcscmp iswdigit _wcsicmp _wcsnicmp _stricmp wcscpy_s

api-ms-win-crt-heap-l1-1-0

free malloc realloc

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char

api-ms-win-crt-math-l1-1-0

ceilf

Name

.text

Size

171KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

147KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

272B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

AppVShNotify.exe

IMPHASH 8fd97afc8ea1018a4bef6e1fd9073216
SHA256 4f18c152852ca08bec2584e049ce76639cb14e38087a5537dbe31dc64f5e891e
MD5 151591f0d362fbe99f8e19bfffcb4d6b
SHA1 bc56561cd7ff70f7d8613f50ca99a16e3a6074b6
SHA512 048e1c6216e418e2e93435731baffef81eab90121142dafa3a812a1abe25e2c4b0b2d3a5d8aa85de8657d5612a4fc40d2b9f86c2ff6b001e0b820cb6de466908
SSDEEP 3072:MvR1+1joGhlCLi86me8JJ7WGNU6ITLNl8wPNTBglLnUbBOJ6HF45g:MZkKGGO8ZewWGNU6ITLj8wDgdUa
TLSH
T12524E67BDD74F8E2C2BF9DB4AB61C720EB71B5714391230AC274C26A5E022D05E99D29
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

2f:db:7a:b6:a1:4e:81:e7:b2:fc:fe:f4:50:f8:c5:d9:af:c1:a4:f4:cb:5f:d8:ae:bb:5a:e0:0c:36:87:3f:09

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

2f:db:7a:b6:a1:4e:81:e7:b2:fc:fe:f4:50:f8:c5:d9:af:c1:a4:f4:cb:5f:d8:ae:bb:5a:e0:0c:36:87:3f:09

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:28:f0:a5:87:d7:f3:c8:1e:40:00:01:00:00:02:28

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1f:3a:70:69:e4:a2:30:2e:95:00:01:00:00:02:1f

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

58768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\dbs\el\omr\target\x64\ship\appvisv\x-none\appv\AppVShNotify.pdb

kernel32

CreateThreadpool EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetCurrentThreadId SetThreadpoolThreadMinimum CloseThreadpoolCleanupGroupMembers SetThreadpoolThreadMaximum CreateThreadpoolCleanupGroup HeapSetInformation DeleteCriticalSection DebugBreak GetLastError GetProcessHeap LocalFree GetProcAddress HeapDestroy HeapAlloc CloseHandle HeapReAlloc GetCurrentThread Sleep HeapSize GetCurrentProcess HeapFree InitializeCriticalSectionEx CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetCurrentProcessId FreeLibrary GetSystemTimeAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetModuleHandleW IsProcessorFeaturePresent OutputDebugStringW LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo RaiseException GetStartupInfoW IsDebuggerPresent InitializeSListHead QueryPerformanceCounter

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy _CxxThrowException memset __current_exception_context __current_exception _purecall __C_specific_handler strrchr __std_terminate __std_exception_copy __std_exception_destroy __C_specific_handler_noexcept memcmp memmove

msvcp140

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ?good@ios_base@std@@QEBA_NXZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?_Xbad_alloc@std@@YAXXZ

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit _invoke_watson exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _initialize_onexit_table _exit _register_onexit_function _crt_atexit terminate _resetstkoflw _invalid_parameter_noinfo _errno _cexit

api-ms-win-crt-string-l1-1-0

_stricmp iswdigit _wcsicmp

api-ms-win-crt-heap-l1-1-0

calloc free malloc _set_new_mode

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char _configthreadlocale

Name

.text

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

119KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

408B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

AppvIsvSubsystems32.dll

SHA256 10fe48686fdb3d5d144bae3bfe8e2a39508812e116b2802d3afa6af0709b7ed0
MD5 074a92570849392cd28c061503b3a1e0
SHA1 5ac663ce317f74818c4f37edd831bd347c873d4f
SHA512 c2070e173d3585693bcf704bd6e3d423a2e50b5e3b570643500e1f7e623fb52dfe1fdf8c611238c1573853f63975f84ff6eb9c723a3a6cca77e9a52d8c9c2ff5
SSDEEP 24576:a/lVKSvUo0xeMQ64ZUNJvRPuTTwPdogUB74WalxX:0N34eMQ64ZmRPuTACgbWalxX
TLSH
T11E256D73B658C439F27E06711A35E7B44266B8710EB1820BB7E4979D2E709D1DB2BB03
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

47:43:73:78:86:8f:42:86:57:4f:3b:06:35:c9:7f:81:e0:07:10:97:08:53:92:60:a2:e5:8e:fb:a5:c1:fb:76

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

47:43:73:78:86:8f:42:86:57:4f:3b:06:35:c9:7f:81:e0:07:10:97:08:53:92:60:a2:e5:8e:fb:a5:c1:fb:76

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:23:4f:d9:60:24:53:cf:fe:2b:00:01:00:00:02:23

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:29:0e:d5:64:2a:b4:97:f2:1a:00:01:00:00:02:29

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

540626

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\dbs\el\omr\build\x86\ship\appvisv\subsystems\composite\dll_isv\obj\i386\AppVISVSubsystems32.pdb

Name

.text

Size

591KB

Virtual Size

591KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

299KB

Virtual Size

299KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

47KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.mrdata

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.c2r

Size

512B

Virtual Size

346B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

AppvIsvSubsystems64.dll

SHA256 5216fc0458fe9ed5c84aa6dfed853428c2fbc53ee1d472e031a72a8ad28f23b1
MD5 dbf2e0d2fc165b6b5d689627faa4ff5a
SHA1 2ea13458bdb6dcfbec74c81a8804c32395d133cf
SHA512 a0d1c0c272e32a2f948d80a90de55faf6e760f4af5d232983b71754dd21202ac75426ba9edfb4ccabfa8c8afa174dbbc564ebd9d7958981135575bfc015d63de
SSDEEP 24576:ohirqyNNG0LvbunfW/CeygBdmyKxRZBmj9AS2lBqg4+7/:m7y7zvbunfW/Cxkdmy8bGANKg9
TLSH
T189658D1AD694C534E5FBD2B4D9338916E7B234450370D38B52B5864EAF277E08E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

f2:b3:ca:43:5b:67:98:8f:ab:e3:ad:e5:56:c6:75:84:87:06:48:d6:78:8f:b2:71:93:7a:8a:35:6f:d5:2c:fc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

f2:b3:ca:43:5b:67:98:8f:ab:e3:ad:e5:56:c6:75:84:87:06:48:d6:78:8f:b2:71:93:7a:8a:35:6f:d5:2c:fc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:28:f0:a5:87:d7:f3:c8:1e:40:00:01:00:00:02:28

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:F002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:20:24:e1:e6:e0:17:b9:b4:8e:00:01:00:00:02:20

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

854528

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d:\dbs\el\omr\build\x64\ship\appvisv\subsystems\composite\dll_isv\obj\x64\AppVISVSubsystems64.pdb

Name

.text

Size

870KB

Virtual Size

870KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

404KB

Virtual Size

404KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

52KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

704B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.mrdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourd

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.c2r

Size

512B

Virtual Size

382B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

AppvIsvSubsystems64_arm64x.dll

SHA256 f71048601657f56ce2ee96eb65fd7ce87f7288b0d75446bb92917cc6c34401f0
MD5 ff5687fed33e97077f6996a9e6b6a977
SHA1 024de829de37868f66bee590bb133a2a5a9ef0d4
SHA512 2b67fffa4218f791e8662d102ca12257457363fdfb42ba986eb31b2884386c1621ddfd57c46ebd8c7585e73366e9ddfbb07b41da4cd3ca41a95501dd8720d048
SSDEEP 24576:IBojX7hlzr3J0ViBtdTDqpNCdrxNTACRQ61z/TwoAfa1Em9Ig2U5d:zX7hFeVVCdACH1z/T7jh9Ig/d
TLSH
T1B8E52A925F8DA8F4C3CAD73CDE228A843037B5BD8871928770A7660FDD9E7D08591267
MD5 SHA1 SHA512 SSDEEP TLSH

C2R32.dll

IMPHASH a909dd720fca00edd48b5fb05ea7f73b
SHA256 21bdddf5c8758e65a46cf950c5d5683579a76dbf86cb27a1c94cc31594dbba58
MD5 bd04c6147602a6c55bb1ec89fa46408e
SHA1 266db4ff4ed74776565326e74980113138c4c8cd
SHA512 dae83c208e63a5b57e9a7b2bdd775c094075f9dccd4ff812a37b80434966d2ba26a5c56735211231318e8b6764392d25d7360358c1866430e55b0849809739cf
SSDEEP 49152:hOR36VINAAGkYzeh7b21AgGfUAHMU5X3:u3DN6ehf2W
TLSH
T14C957C6267E4493AF6BB17706F39A79F447EFEB15870C04F238C054E19B2D819A22727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

59:3b:29:ae:8d:b2:50:19:30:9f:a5:0c:ec:b2:c3:e1:9f:cb:4c:e9:39:af:60:94:48:68:2e:83:c0:87:8c:b0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 30, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

59:3b:29:ae:8d:b2:50:19:30:9f:a5:0c:ec:b2:c3:e1:9f:cb:4c:e9:39:af:60:94:48:68:2e:83:c0:87:8c:b0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 30, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6B05-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:11:45:18:39:9b:43:cf:fc:6c:00:01:00:00:02:11

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2D1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:12:d1:08:06:3c:ca:18:4f:aa:00:01:00:00:02:12

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Minor OS version

1

Major OS version

6

Entry point

129081

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\dbs\el\omr\target\x86\ship\click2run\x-none\c2r32.pdb

kernel32

DecodePointer GetLocaleInfoEx TryAcquireSRWLockExclusive GetCurrentProcess GetModuleHandleExW InitializeCriticalSectionEx GetLastError CompareStringEx GetProcAddress DeleteCriticalSection FreeLibrary FlsFree FlsAlloc IsWow64Process GetCommandLineW ExpandEnvironmentStringsW GetTickCount64 GetModuleFileNameW GetCurrentProcessId MultiByteToWideChar CreateEventExW CloseHandle SetEvent TerminateProcess GetTempPathW WerRegisterRuntimeExceptionModule DisableThreadLibraryCalls WerUnregisterRuntimeExceptionModule GetModuleHandleW Sleep FindClose UnmapViewOfFile MapViewOfFile SetLastError OutputDebugStringA GetStringTypeExW LoadLibraryW LocalFree FormatMessageA LocalAlloc GetSystemTimeAsFileTime GetUserDefaultLocaleName IsValidCodePage WideCharToMultiByte GetSystemTime SystemTimeToFileTime FileTimeToSystemTime ResetEvent GetFileAttributesExW FindFirstFileExW WriteFile GetFileSizeEx ReadFile DeleteFileW FindNextFileW RaiseException OpenProcess GetExitCodeProcess GetProcessTimes GetModuleFileNameA GetShortPathNameA K32GetModuleFileNameExW CreateProcessW LoadLibraryExW FindResourceW SizeofResource LoadResource GlobalMemoryStatusEx GetVersionExW CreateFileW DeviceIoControl GetComputerNameW GetNativeSystemInfo GetSystemDirectoryW HeapFree HeapAlloc GetProcessHeap ReleaseSemaphore WaitForSingleObjectEx CreateEventW WaitForSingleObject AcquireSRWLockExclusive ReleaseSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared CreateThread WaitForMultipleObjectsEx WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork GetCurrentThreadId OpenEventW ReleaseMutex CreateMutexExW OpenMutexW GetLongPathNameW GetFinalPathNameByHandleW SystemTimeToTzSpecificLocalTime QueryUnbiasedInterruptTime CreateDirectoryW SetFileAttributesW GetFileType SetFilePointerEx GetOverlappedResult GetFileTime SetFileInformationByHandle QueryPerformanceCounter QueryPerformanceFrequency GlobalFree GlobalAlloc SetEndOfFile SetFileTime FlushFileBuffers CancelIoEx GetTempFileNameW GetProcessAffinityMask CreateWaitableTimerW SetWaitableTimerEx CancelWaitableTimer QueryDepthSList EnterCriticalSection LeaveCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList RtlCaptureStackBackTrace GetTickCount InitOnceExecuteOnce WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetCurrentThread GetQueuedCompletionStatus FlsSetValue FlsGetValue IsDebuggerPresent CreateMemoryResourceNotification GetSystemPowerStatus QueryProcessCycleTime OpenThread QueryThreadCycleTime IsSystemResumeAutomatic OutputDebugStringW CreateMutexW OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA CreateFileMappingA LocaleNameToLCID GetUserGeoID K32GetProcessMemoryInfo FindFirstFileW GetPriorityClass GetTimeZoneInformation GetLocalTime LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedFlushSList RtlUnwind IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringEx EncodePointer GetStringTypeW InitOnceComplete InitOnceBeginInitialize GetFileInformationByHandleEx

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s __stdio_common_vswscanf __stdio_common_vsnwprintf_s __stdio_common_vswprintf_s

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table terminate _invoke_watson _clearfp _crt_atexit _cexit _invalid_parameter_noinfo abort _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _initterm_e _initterm _errno

api-ms-win-crt-heap-l1-1-0

malloc calloc realloc free

api-ms-win-crt-string-l1-1-0

strcspn _wcsdup _stricmp strnlen wcscmp strncpy_s strcmp wcsnlen wcscpy_s wcsncmp islower isdigit isupper strcpy_s __strncnt towlower wmemcpy_s wcsncpy_s

api-ms-win-crt-convert-l1-1-0

wcstol _ui64toa_s wcstoul _wcstoi64 _wtoi _wcstoui64 _itow_s _i64tow_s wcstod

api-ms-win-crt-math-l1-1-0

ceil _ldsign _ldclass _dclass _libm_sse2_pow_precise floor round _libm_sse2_log_precise _libm_sse2_log10_precise _dsign _fdsign _libm_sse2_exp_precise _fdclass frexp

api-ms-win-crt-locale-l1-1-0

_lock_locales _unlock_locales ___lc_codepage_func __pctype_func __initialize_lconv_for_unsigned_char localeconv ___lc_locale_name_func ___lc_collate_cp_func ___mb_cur_max_func setlocale

api-ms-win-crt-time-l1-1-0

_time64 _localtime64_s wcsftime

AddOfficeProduct AddOfficeProductEx ApplyCloudPolicy ApplyCloudPolicyForIdentity C2rVersion CheckProcessForCorruption CleanupWindowsDefenderFirewallRulesForOffice ClearPropertyBagValue CollectFileInformation DeleteAFOScheduledTask DetectWindowsDefenderFirewallRulesForOffice EnableUpdate EnsureConnection EnsurePerpetualLicensesFolderExists FetchDBSLicense GetInstalledProducts GetInstalledProductsEx GetPackageRoot GetProperty GetPropertyEx GetStatusValue GetStatusValueEx GetTotalProgress GetUpdateStatus HandleError HandleErrorEx HandleScheduledHeartbeat HandleScheduledHeartbeatEx HrActivate HrActivateEx HrApplyUpdatesNow HrApplyUpdatesNowEx HrBeginUpdatesDiscoveryPeriod HrBeginUpdatesDiscoveryPeriodEx HrDownloadUpdatesNow HrDownloadUpdatesNowEx HrGetAppVFlight HrGetAreUpdatesCOMManaged HrGetAreUpdatesEnabled HrGetAreUpdatesEnabledEx HrGetAreUpdatesFromAdminSource HrGetAreUpdatesFromAdminSourceEx HrGetAreUpdatesLate HrGetAreUpdatesLateEx HrGetAreUpdatesReadyForDownload HrGetAreUpdatesReadyForDownloadEx HrGetAreUpdatesReadyToApply HrGetAreUpdatesReadyToApplyEx HrGetChannelIdForDisplay HrGetClientFolder HrGetContainerInstallCommand HrGetDeviceBasedLicensing HrGetExecutingScenario HrGetInstallationPath HrGetPendingModifyOfficeProducts HrGetPendingUpdateDeadline HrGetPendingUpdateDeadlineEx HrInstallProtectedGraceLicense HrModifyOfficeProducts HrOnNotification HrRefreshState HrRegisterForRealtimeExitReporting HrSetAreUpdatesEnabled HrSetAreUpdatesEnabledEx HrSetAreUpdatesFromAdminSource HrSetAreUpdatesFromAdminSourceEx HrSetPolicyUserDisplayName HrSetPolicyUserName HrSetPrivacySettings HrUpdateLicensingStateData HrUpdateNow HrUpdateNowEx HrUpdateNowWithParameters InstallProofOfPurchase InstallProofOfPurchaseEx IsClick2Run IsFileInVirtualFolder_DllExport IsOSPPReady IsOSPPReadyEx IsRepairRequired IsRepairRequiredEx IsRoaming IsStreaming Launch LicenseRepair MigrateOSPPToSPP OverridePolicy ReArm Repair RepairEx SetProperty SetPropertyBagToken SetTenantAssociationKey SetUpdateBranch SetUpdateUrl SetUpdateUrlSetByUser StartFB StartScenario UninstallProofOfPurchase UninstallProofOfPurchaseEx

C2R64.dll

IMPHASH 8b4d8425fca55c718f23237c983bd438
SHA256 74a7c2c4805d8726d940936376257365ae0edeccd7eb28576e64eb8caf69358e
MD5 13c46f4c9d27b70120bc608b69ba1fa4
SHA1 fea44f730bf717651bd94f7dd1798f4bb5882888
SHA512 c0fcc47b47b70be3d0aeae69938bce6a22487a9ab7629e1ac17f312aa72d828e04c539b62c06e9db2bac489846a9ec24b78ccb880c1cd013208adc13f1b71c15
SSDEEP 24576:Z2L/TN0wyh+cPH4o0XXMGwDroaQBjieThZBYup89wSF3Vh0lhSMXlUw5U+WGDOH2:Z2LR0wwHoMGxBGeTlx8iSCP5U+WGi5M
TLSH
T1DDB5594563F905F6F1BAE278CA77443BE6B278564A31D30E0571C64B1F337218A7AB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

3f:95:7d:26:c5:61:12:e5:f1:06:67:d0:b1:9a:96:16:69:e4:89:6f:0a:8b:b8:c3:22:71:ae:25:7b:f1:f6:96

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 30, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

3f:95:7d:26:c5:61:12:e5:f1:06:67:d0:b1:9a:96:16:69:e4:89:6f:0a:8b:b8:c3:22:71:ae:25:7b:f1:f6:96

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 30, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1f:3a:70:69:e4:a2:30:2e:95:00:01:00:00:02:1f

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:25:80:c7:37:c6:cd:aa:77:49:00:01:00:00:02:25

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

256688

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d:\dbs\el\omr\target\x64\ship\click2run\x-none\c2r64.pdb

kernel32

DecodePointer GetLocaleInfoEx TryAcquireSRWLockExclusive GetCurrentProcess GetModuleHandleExW InitializeCriticalSectionEx GetLastError CompareStringEx GetProcAddress DeleteCriticalSection FreeLibrary FlsFree FlsAlloc IsWow64Process GetCommandLineW ExpandEnvironmentStringsW GetTickCount64 GetModuleFileNameW GetCurrentProcessId MultiByteToWideChar CreateEventExW CloseHandle SetEvent TerminateProcess GetTempPathW WerRegisterRuntimeExceptionModule DisableThreadLibraryCalls WerUnregisterRuntimeExceptionModule GetModuleHandleW Sleep FindClose UnmapViewOfFile MapViewOfFile CreateActCtxW ActivateActCtx SetLastError OutputDebugStringA GetStringTypeExW FindActCtxSectionStringW DeactivateActCtx QueryActCtxW LoadLibraryW LocalFree FormatMessageA LocalAlloc GetSystemTimeAsFileTime GetUserDefaultLocaleName IsValidCodePage WideCharToMultiByte GetSystemTime SystemTimeToFileTime FileTimeToSystemTime ResetEvent GetFileAttributesExW FindFirstFileExW WriteFile GetFileSizeEx ReadFile DeleteFileW FindNextFileW RaiseException OpenProcess GetExitCodeProcess GetProcessTimes GetModuleFileNameA GetShortPathNameA K32GetModuleFileNameExW CreateProcessW LoadLibraryExW FindResourceW SizeofResource LoadResource GlobalMemoryStatusEx GetVersionExW CreateFileW DeviceIoControl GetComputerNameW GetNativeSystemInfo GetSystemDirectoryW HeapFree HeapAlloc GetProcessHeap ReleaseSemaphore WaitForSingleObjectEx CreateEventW WaitForSingleObject AcquireSRWLockExclusive ReleaseSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared CreateThread WaitForMultipleObjectsEx WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork GetCurrentThreadId OpenEventW ReleaseMutex CreateMutexExW OpenMutexW GetLongPathNameW GetFinalPathNameByHandleW SystemTimeToTzSpecificLocalTime QueryUnbiasedInterruptTime CreateDirectoryW SetFileAttributesW GetFileType SetFilePointerEx GetOverlappedResult GetFileTime SetFileInformationByHandle QueryPerformanceCounter QueryPerformanceFrequency GlobalFree GlobalAlloc SetEndOfFile SetFileTime FlushFileBuffers CancelIoEx GetTempFileNameW GetProcessAffinityMask CreateWaitableTimerW SetWaitableTimerEx CancelWaitableTimer QueryDepthSList EnterCriticalSection LeaveCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList RtlCaptureStackBackTrace GetTickCount InitOnceExecuteOnce WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetCurrentThread GetQueuedCompletionStatus FlsSetValue FlsGetValue IsDebuggerPresent CreateMemoryResourceNotification GetSystemPowerStatus QueryProcessCycleTime OpenThread QueryThreadCycleTime IsSystemResumeAutomatic OutputDebugStringW RtlCaptureContext CreateMutexW OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA CreateFileMappingA LocaleNameToLCID GetUserGeoID K32GetProcessMemoryInfo FindFirstFileW GetPriorityClass GetTimeZoneInformation GetLocalTime LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedFlushSList RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry LCMapStringEx EncodePointer RtlPcToFileHeader GetStringTypeW InitOnceComplete InitOnceBeginInitialize GetFileInformationByHandleEx

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnwprintf_s __stdio_common_vsprintf_s __stdio_common_vswscanf __stdio_common_vswprintf_s

api-ms-win-crt-runtime-l1-1-0

abort _invoke_watson terminate _initterm_e _invalid_parameter_noinfo _errno _clearfp _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _initterm

api-ms-win-crt-heap-l1-1-0

calloc realloc malloc free

api-ms-win-crt-string-l1-1-0

wcsncmp strlen _wcsdup strcspn _stricmp wcscmp strnlen strncpy_s strcmp wcsnlen islower isdigit wmemcpy_s isupper strcpy_s towlower __strncnt wcsncpy_s wcscpy_s

api-ms-win-crt-convert-l1-1-0

_i64tow_s _wcstoui64 wcstoul _wtoi _itow_s wcstod wcstol _ui64toa_s _wcstoi64

api-ms-win-crt-math-l1-1-0

pow ceilf floor _fdclass frexp _fdsign _ldclass _dclass _dsign log10 logf round _ldsign expf

api-ms-win-crt-locale-l1-1-0

_lock_locales _unlock_locales setlocale __pctype_func localeconv ___lc_locale_name_func ___mb_cur_max_func ___lc_collate_cp_func __initialize_lconv_for_unsigned_char ___lc_codepage_func

api-ms-win-crt-time-l1-1-0

_time64 _localtime64_s wcsftime

AddOfficeProduct AddOfficeProductEx ApplyCloudPolicy ApplyCloudPolicyForIdentity C2rVersion CheckProcessForCorruption CleanupWindowsDefenderFirewallRulesForOffice ClearPropertyBagValue CollectFileInformation DeleteAFOScheduledTask DetectWindowsDefenderFirewallRulesForOffice EnableUpdate EnsureConnection EnsurePerpetualLicensesFolderExists FetchDBSLicense GetInstalledProducts GetInstalledProductsEx GetPackageRoot GetProperty GetPropertyEx GetStatusValue GetStatusValueEx GetTotalProgress GetUpdateStatus HandleError HandleErrorEx HandleScheduledHeartbeat HandleScheduledHeartbeatEx HrActivate HrActivateEx HrApplyUpdatesNow HrApplyUpdatesNowEx HrBeginUpdatesDiscoveryPeriod HrBeginUpdatesDiscoveryPeriodEx HrDownloadUpdatesNow HrDownloadUpdatesNowEx HrGetAppVFlight HrGetAreUpdatesCOMManaged HrGetAreUpdatesEnabled HrGetAreUpdatesEnabledEx HrGetAreUpdatesFromAdminSource HrGetAreUpdatesFromAdminSourceEx HrGetAreUpdatesLate HrGetAreUpdatesLateEx HrGetAreUpdatesReadyForDownload HrGetAreUpdatesReadyForDownloadEx HrGetAreUpdatesReadyToApply HrGetAreUpdatesReadyToApplyEx HrGetChannelIdForDisplay HrGetClientFolder HrGetContainerInstallCommand HrGetDeviceBasedLicensing HrGetExecutingScenario HrGetInstallationPath HrGetPendingModifyOfficeProducts HrGetPendingUpdateDeadline HrGetPendingUpdateDeadlineEx HrInstallProtectedGraceLicense HrModifyOfficeProducts HrOnNotification HrRefreshState HrRegisterForRealtimeExitReporting HrSetAreUpdatesEnabled HrSetAreUpdatesEnabledEx HrSetAreUpdatesFromAdminSource HrSetAreUpdatesFromAdminSourceEx HrSetPolicyUserDisplayName HrSetPolicyUserName HrSetPrivacySettings HrUpdateLicensingStateData HrUpdateNow HrUpdateNowEx HrUpdateNowWithParameters InstallProofOfPurchase InstallProofOfPurchaseEx IsClick2Run IsFileInVirtualFolder_DllExport IsOSPPReady IsOSPPReadyEx IsRepairRequired IsRepairRequiredEx IsRoaming IsStreaming Launch LicenseRepair MigrateOSPPToSPP OverridePolicy ReArm Repair RepairEx SetProperty SetPropertyBagToken SetTenantAssociationKey SetUpdateBranch SetUpdateUrl SetUpdateUrlSetByUser StartFB StartScenario UninstallProofOfPurchase UninstallProofOfPurchaseEx

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

796KB

Virtual Size

795KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

43KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

C2R64_arm64x.dll

SHA256 9918c34d4f06da6407c706853806dd12d9025becd4081d30c8a516e3da20356c
MD5 9f01fcb895cd683bd53cfde47488d47d
SHA1 b2a8bb0a29178202201f696cd1b9fc85194f5f70
SHA512 0d052ea51caf0c8c92f55560b31d57eb34a6adb475794c257da6fc8c711120e87f4b5429f9d4755df0025ecc13c4c0cc6a341dfa405aa8a497fd2b3ac5011a17
SSDEEP 49152:xmPBWg/nd4okcLlE7/h5e3ag3zMgoh5aXkz9NUdYDm3T3mZ+MUiLG52a:MPBWg/nW3UE7/ho3aQzMpvaYU3
TLSH
T1174618916FDEA465E2D69B3CCE76C944753BB86E8D71C54F3056031FCDA8BC18AA0223
MD5 SHA1 SHA512 SSDEEP TLSH

C2RHeartbeatConfig.xml

SHA256 dcd0aab257eb6514847f82070f947fd3c5a760f9a510084db980f6fdee53c9b0
MD5 cdd1fb1c46f6c3b304625a288dbf7c99
SHA1 d33313e52f6c34762c3ae41657e4f0cec7c436c2
SHA512 f0f1fc5329e5f04da123db1041e81e5f9717ab0ca4e8bf3278722c33462c04c4336d812684f2fd3720a402f1ffc097f218f94bbb14cb214d025e6fbda0b17f18
SSDEEP 96:cKQg4iruAGWyh4vGdQipcmq9ll79YoWFhx/:p42u1WaavXDWzx/
TLSH
T163814A5367EA1119F2F72B6CAEB650228E67BC515D39C46D00AC200DCBF3E22C9607B7
MD5 SHA1 SHA512 SSDEEP TLSH

C2RINTL.ar-sa.dll

SHA256 ea5327939553334accc8dabf87e32930c8835fa6e19811e508e7d22780c20d94
MD5 c21a82be3de384049d47830066d185b4
SHA1 1d59e52d92f81355348eeeedf7899efaab147e1b
SHA512 4f5238854c0441b71709c088f8f8852f9a717225ab55e8cace6108eb7b8816c200f0578f6eb180ad6fce7f7cfb00b3b71fda6bcc51e64e1e4425db9d792b585b
SSDEEP 768:Si87fnHQ+yonQxyOzCY17hsLoRA7hbb45qzrjZ9zzqPO59zu:SiAw+yonQxywP17W8a7hbkofzY4z
TLSH
T136333AD34A1ED201E9DFEAF0CE88CC62BD3A07471CB659B297BDB4641D40792861693B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

65:8c:e4:ca:d9:b5:47:35:a5:1f:12:6f:b5:c1:35:9f:38:4c:8d:76:f9:c8:74:9b:63:3c:40:22:13:01:ac:3e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

65:8c:e4:ca:d9:b5:47:35:a5:1f:12:6f:b5:c1:35:9f:38:4c:8d:76:f9:c8:74:9b:63:3c:40:22:13:01:ac:3e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1e:a3:ac:a4:6e:39:6f:7c:49:00:01:00:00:02:1e

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:21:33:c0:35:fb:d2:0f:21:a4:00:01:00:00:02:21

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.bg-bg.dll

SHA256 bfaa42294162e754ab729ef172ea2ebe675a6f22223f2d78260ba4d41af8b9cd
MD5 b7dbe439795471d4d93e9d89c006abcc
SHA1 b85c87bdeb299058409c91a8cabeb4f51eae473f
SHA512 64ef8100c2763105fa1fe7a4be9f17269d1c5ce2504143ce215a711e370914de0c5b3dcd4f6398c9616ac2e0c9372c35f762f1881222cbac4c417030bccd40e5
SSDEEP 768:PKsq1J0IYLQl3dsuVUaugcGh717cbb45FlU+9zZf+CTs9ziL2:PKsqb0Iz3d+PESbk66z0ziL2
TLSH
T1B9435CC2586FE342D4DF6C707CD89963AFF8426B1EA1087A8639EC2416F135BDC25876
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

7b:0d:0c:00:db:67:49:2b:c4:b0:a9:b2:18:9e:cd:3c:72:ad:37:9d:82:a8:2d:c8:ce:d4:06:89:53:4f:61:e9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

7b:0d:0c:00:db:67:49:2b:c4:b0:a9:b2:18:9e:cd:3c:72:ad:37:9d:82:a8:2d:c8:ce:d4:06:89:53:4f:61:e9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:28:f0:a5:87:d7:f3:c8:1e:40:00:01:00:00:02:28

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:27:d5:c0:83:c3:b1:2e:57:2d:00:01:00:00:02:27

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.cs-cz.dll

SHA256 32b644f1f687035829c6eb8f0a149002c4afc31740fcf1cb6bd4a44199a24b39
MD5 376732af1f5cb5cd10998d4733728a44
SHA1 617338845aed6b99fdae2b90026b27fd573469a2
SHA512 deda63d10f7e514ef39b93b8ea5e4e83d81a470ee429d2a5743d0f04520136cc1fcd9176e8e1f3b2947f2e5ebb150467301d5a6a88aaa7d2f5ff892966a7394a
SSDEEP 768:4uAkiyqYjjaJtRDyqzVnUXjQw2Pb45Y8P79zKzSIo9z4z:4uAkJqc0RDlUXjQw2PkS8PRzK3gz4z
TLSH
T165436CF4077CA585ED7B3874C9D0BCD13B386A8A7E24BA03E7D5D5689483368E52C92C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

32:bf:0d:f3:e0:d5:b2:37:9b:75:7f:f8:dc:d9:1a:57:5e:dd:90:e9:7c:04:a2:a0:78:00:16:47:ad:9e:ce:0f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

32:bf:0d:f3:e0:d5:b2:37:9b:75:7f:f8:dc:d9:1a:57:5e:dd:90:e9:7c:04:a2:a0:78:00:16:47:ad:9e:ce:0f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:25:80:c7:37:c6:cd:aa:77:49:00:01:00:00:02:25

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1f:3a:70:69:e4:a2:30:2e:95:00:01:00:00:02:1f

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.da-dk.dll

SHA256 752503a1ee95e44c1fac0c0be9659206aa95eec68dda42c4e943cb4c2f640682
MD5 d90ab69c1eb2b52250a4f3026880b208
SHA1 dbda5576918a899fc8df12ca2728e96dadfbda97
SHA512 bb51c5b28c635f62cbb28a6c3c38ca0753465aef212029a2849508e56bed074de1b93add75db0ba38ab14e5625001c46ecdab5f2dc178ccc5c003e44cef399f9
SSDEEP 1536:jjEb5MH6uCgGSC5382S7Mw4MJQZnr9A5KJVhsz9Xvzv:jQlMH6uCgGSC538T7Mw4Mynr9A5KPuhD
TLSH
T138338E8FC1A4D007EF460AB79241DDABFE7D938B75C0CA2F589EE0691483F94B22D195
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

27:44:1d:d1:62:af:e8:15:dc:45:cb:35:3e:30:c2:b4:f3:41:68:48:eb:1d:79:0e:a8:5e:20:cc:20:65:94:56

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

27:44:1d:d1:62:af:e8:15:dc:45:cb:35:3e:30:c2:b4:f3:41:68:48:eb:1d:79:0e:a8:5e:20:cc:20:65:94:56

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:4C1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:18:25:d9:92:05:e2:e7:e5:e4:00:01:00:00:02:18

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:10:ab:cd:e4:16:18:ef:39:b0:00:01:00:00:02:10

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.de-de.dll

SHA256 0d8f7d8798fb5433a49694da23e7d1ff486f7680624ccd3cd9df940f7c5fda50
MD5 9f6be60e8840d2bf1157b6c465304c96
SHA1 6ebe54eb9abf33831dd9f588dd35171f86c44709
SHA512 f1d9c24ec574b56d49be207a3d4d09b6c5de9a9826d14cf68f15c8363f6b895cb1ee8535767ebf2c6cb90a5ca6e322d72c09f20ac08012b4c134aa20d60bfe32
SSDEEP 768:yI2/egtZ1UKKMAEeiOhXz6/AB58r+rspiyXb45vM2s9z9AA9zzG:y1/ntZGKKHEjqz6/kiAspiqkbkztzzG
TLSH
T120538D87C8F6A0A6EA832B74D265DD633F7D93D721446A2BC8DEC02502437E6CB1E171
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

0d:54:44:d5:6f:04:1c:4b:4e:d7:48:16:2b:54:6b:0c:dd:9f:b7:16:5a:db:70:49:df:a6:8a:15:69:4a:28:f6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

0d:54:44:d5:6f:04:1c:4b:4e:d7:48:16:2b:54:6b:0c:dd:9f:b7:16:5a:db:70:49:df:a6:8a:15:69:4a:28:f6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8900-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:22:41:d2:f6:aa:ff:c8:b5:ff:00:01:00:00:02:22

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:24:3b:84:21:b0:2c:ac:64:22:00:01:00:00:02:24

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.el-gr.dll

SHA256 157723b607d2e3f68a1395b4244c5ef50d7a905fdae3081a04c5261981e0fbc9
MD5 8cffc10399098a339149d9a0255ec24f
SHA1 1989a7aa1e03913b0ea4a560638a22d8fdea63cb
SHA512 f97a1c7cb844f6506b5c838a6a7f13dae374f68d79503496a67ba06acc70cb8b4b5f6835fbb13e4b25056adf5172ad05f90754be6e065bc3aea5872433154878
SSDEEP 768:/xLjmeAnblm4VXp/+AzdtPbQ4WbxVwMbyrMP+5yRN+Qb45t9zqdc5rrjZ9zV:5LbAn04VXpNtPktyrMGinkpzqe9zV
TLSH
T1505317A787795857C7D22873E9E1F9517C3D038330C8AF97217AEA4D18933C2E5886B9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

da:35:8c:c2:49:d2:02:14:45:76:ca:f4:e2:ca:9b:09:c2:be:5b:33:8a:a3:8e:ea:62:a0:98:33:fa:61:0d:c6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

da:35:8c:c2:49:d2:02:14:45:76:ca:f4:e2:ca:9b:09:c2:be:5b:33:8a:a3:8e:ea:62:a0:98:33:fa:61:0d:c6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:29:0e:d5:64:2a:b4:97:f2:1a:00:01:00:00:02:29

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1e:a3:ac:a4:6e:39:6f:7c:49:00:01:00:00:02:1e

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.en-gb.dll

SHA256 74bed89db5b27e0f7427d6d11d64b32327b87b87adad7f12bf569cac19a85947
MD5 9c74f813c8f7f902fc54b8e40740795a
SHA1 51f9b4b562c3bc03adf44680806fe20453397edd
SHA512 84dd0b8a8746f34bf1a015f193e6cbdec89e7af53c3201f61c8b755ff02727233b7b94f34ecb48f2280576399b290bb4f3b908f95f9cfb00822b4c84362773e3
SSDEEP 768:B/Ombc5yj2lA4G6/wkbGYe6/xJk2J4LLENakv3/bdWyG2X9zrVF9zU:BmmbLjilOsoLEN/P/huUzxz
TLSH
T1C3337E8FC3A4C057EB8326725595E9A27F3C52C73580856748BEE01811A37DAF33B6AD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

6a:bb:d2:07:95:3a:82:fa:ad:cd:f3:5d:78:67:f1:49:8b:eb:47:d9:ef:cf:bb:f6:fc:66:49:cb:82:30:89:0b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

6a:bb:d2:07:95:3a:82:fa:ad:cd:f3:5d:78:67:f1:49:8b:eb:47:d9:ef:cf:bb:f6:fc:66:49:cb:82:30:89:0b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:3605-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:13:b0:43:35:66:cf:af:95:e8:00:01:00:00:02:13

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:321A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1a:a9:a0:1d:06:a0:0f:43:aa:00:01:00:00:02:1a

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.en-us.dll

SHA256 b12a2d565283ab34df96c78ef89b1db0b50f9a1ed5f61e983df0657ded413f6a
MD5 f551f80edfc4bc5c92f85b9517604e17
SHA1 bc6ad24db0e4c3184e8ab0b5faf4284651995463
SHA512 cd8354a7b2525347efec657a76b555a1aef6f5c4bf09a0c9aa88a785575ed5a42f6b0c681c10834acd10e589186409b2c5344e2900d9d72b578c32a3359600fe
SSDEEP 768:SDVGFkDmQ2lThXkJkIE3/lNmQcjLgxUu/3c3qbdWy2CX9zqQgE9zo7L6:SJqkFiN0ojwLgPPuqhOgzqQPzo6
TLSH
T1D3338E5FC3A1C15BFA52263255C5ECA27E3C52CB35908D6B45BAD01811937CAF33B2AE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

ec:5b:5b:03:6d:cf:f8:b5:d4:e8:ed:ae:3e:8c:83:44:af:a6:2d:c4:f2:77:17:89:d1:4b:de:dc:84:6d:39:ef

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

ec:5b:5b:03:6d:cf:f8:b5:d4:e8:ed:ae:3e:8c:83:44:af:a6:2d:c4:f2:77:17:89:d1:4b:de:dc:84:6d:39:ef

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:3605-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:13:b0:43:35:66:cf:af:95:e8:00:01:00:00:02:13

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:431A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1d:4b:c0:92:87:38:85:7e:39:00:01:00:00:02:1d

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.es-es.dll

SHA256 ea253675f562540da7c911498557439dbc223187cf5213bb6251aa8e466a31a3
MD5 9f3dd6ac1e642e183b122fa30a5b8662
SHA1 4e98aab5228e48ba2ed623cbe583ca83c2f9eec0
SHA512 51584901bc814c6f86b263738d0bf247287f147f4015fd96a0d6e41b5bd3ab1110035d4bb7975f0c705752aff0e5fa2f0c2d57ee7e3240f6e9ce972287538de6
SSDEEP 768:Nwxdft6WltnyVcoFFazhjPrNhExoC9AICQXKA67PHpd0qpbdWy+ePF9zU7X9zp:NsdftEVg94gICQXU7vpCqphWePz4zp
TLSH
T142439F9AC6D94943EAA368B543C1DD57FE3C46C73844C66399EFD42900C37C8E33AA69
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

30:98:25:2f:60:1c:0a:8f:55:51:9d:6b:f9:09:68:b4:0d:30:69:80:14:91:15:14:f9:78:dd:7c:56:6c:64:b3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

30:98:25:2f:60:1c:0a:8f:55:51:9d:6b:f9:09:68:b4:0d:30:69:80:14:91:15:14:f9:78:dd:7c:56:6c:64:b3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:321A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1a:a9:a0:1d:06:a0:0f:43:aa:00:01:00:00:02:1a

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:3605-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:13:b0:43:35:66:cf:af:95:e8:00:01:00:00:02:13

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.es-mx.dll

SHA256 a76fd35e04572a66bada8dbb7eee2986f6f88d701f74341e9098e989d1c8ce50
MD5 b726523fb607e3f86174f5100e3e0bcb
SHA1 8fecd885e93846154c06b1f4ead81722ff9da268
SHA512 7f575887853e327e8ca8c48df367eb54e2649682868b973f45e5e4d28bd0ea3f19e117466f3ad7a64e979ca5a6c9bcef774824aaea2146df2a182d1028f61dd1
SSDEEP 768:4CkmqNIPC4V8izN6XO/xXnnqkoHNSpqS4txd0hb45Crr9zwbp1rz9zQc:4Ckkh5keZXn48QS6xChkkBzEZz
TLSH
T117437DAACAE84983E6A365B547C1ED07B93C87CB3844C66384EFE52914C37C4D33B659
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

58:98:d8:a4:32:38:c8:20:a3:96:7b:73:57:89:47:ab:d5:5d:9f:42:b8:61:12:b7:11:83:61:fe:a8:2c:4b:8d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

58:98:d8:a4:32:38:c8:20:a3:96:7b:73:57:89:47:ab:d5:5d:9f:42:b8:61:12:b7:11:83:61:fe:a8:2c:4b:8d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:2b:bb:00:50:ff:4d:3b:9a:a1:00:01:00:00:02:2b

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:23:4f:d9:60:24:53:cf:fe:2b:00:01:00:00:02:23

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.et-ee.dll

SHA256 bdddd9bcf7aaac288ca4c607f70e123c1c43b321bb9a7489cbd3d626a32d4a48
MD5 3f7ca3738b0f43d1b2b6b5c0c209b71a
SHA1 4db98b7c45eab1d0935115e75cf47d2af7f6f9f5
SHA512 31dca1e172337bf2838ef6e021234aaf0bf37330b452cb42df1066c3cbf4fd4c74e38dbddd5b74bb4510a3a20bed82ea211742e2606c13b6cf8c07f1952bf9d8
SSDEEP 768:33WDAcJlbe9Y6HpGRibbcyzhb4551o9zI3SlU+9zZfs7:332JReWWGROP9kP1gz06ze
TLSH
T1D1339F8ACF74900EEDE97AB59651DD836D3C83CF2C80997E6A8CE4054FA3FC5A234159
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

5d:7c:f8:8d:5c:e8:b6:80:6b:7b:33:31:81:0c:03:65:38:c4:75:61:c6:e2:31:a1:86:fd:a1:57:a7:02:3f:3b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

5d:7c:f8:8d:5c:e8:b6:80:6b:7b:33:31:81:0c:03:65:38:c4:75:61:c6:e2:31:a1:86:fd:a1:57:a7:02:3f:3b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1f:3a:70:69:e4:a2:30:2e:95:00:01:00:00:02:1f

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:28:f0:a5:87:d7:f3:c8:1e:40:00:01:00:00:02:28

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.fi-fi.dll

SHA256 24b9eaa69dbee7dd60e82b0e5f9f52169f81383deb256a480c85adeb69952ce4
MD5 0a182bd0dbadcb3107fb1ffd508e952c
SHA1 f71ecd5e6ec2e57c79a9d9a631cd8603f379bfdb
SHA512 6ce9b6edca12fe7e4aa46ee4ae05c59b2f21c1fed07280d86e4cc0aedca580452a268219d361ca448aef3ae81603369774d7e03f74b8280df0b7397f4853920b
SSDEEP 768:/QV7DjWJoMeNOTM/jIAmLHxu1udRyx/Snb45yLo9zI258lU+9zZfy:/ODYONX7TmLHo1udR8/YkMLgz36zc
TLSH
T135339FA64FB8C213F9D5B5B0C990E8BF7E7CE7CB1854C9A5198AE48448437C4FB21578
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

90:f5:a2:31:d7:f6:03:74:39:19:33:77:66:09:b3:4b:74:26:9e:88:ef:07:21:e1:df:fc:ef:d9:7d:7a:19:de

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

90:f5:a2:31:d7:f6:03:74:39:19:33:77:66:09:b3:4b:74:26:9e:88:ef:07:21:e1:df:fc:ef:d9:7d:7a:19:de

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1f:3a:70:69:e4:a2:30:2e:95:00:01:00:00:02:1f

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:28:f0:a5:87:d7:f3:c8:1e:40:00:01:00:00:02:28

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.fr-ca.dll

SHA256 e1b7a4b286be5310f16d6375786c270233a4cdf67d3bcbcc0399c8dbb7856c24
MD5 cfbdf8d5203a2c6f9d3f2c645969d586
SHA1 b9e093b0aaa83902a9f315ab72e476474ea31b96
SHA512 7cea2d960c78bb47ec2e300a8bb1f5bb7f457a9a26ef13cb448023a34de0ee430693ab45d8c7498fa57742b57e36f0544a584b7f3b526e523017619d3bd89d0c
SSDEEP 768:QGg6HypXByRqURutOojfbhPkzYhM9bdWy0O9zgl3A9zE:QCypXByXdojfbhPk0M9hcKzs3IzE
TLSH
T1A5536D5181AC3243F7EB28BA6CC0D2E33C7F9386DDC5A442D6FBC1981793B95A618764
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

33:c4:04:11:dd:1d:d0:58:62:c3:c1:ae:9d:a4:fe:08:4a:8e:c6:f9:0a:af:69:bf:3f:33:1d:8c:bf:e3:28:2a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

33:c4:04:11:dd:1d:d0:58:62:c3:c1:ae:9d:a4:fe:08:4a:8e:c6:f9:0a:af:69:bf:3f:33:1d:8c:bf:e3:28:2a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:651A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:15:18:03:d3:81:07:26:7c:53:00:01:00:00:02:15

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:14:8d:cd:23:44:ee:06:df:72:00:01:00:00:02:14

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.fr-fr.dll

SHA256 d9eb81740217005cfd01a4cf7babdc78f58e2a67e9633509c64dd3e8f45ff2d1
MD5 8dbdfc494cb5cd7491aeb9a688f6e6ab
SHA1 f3b39159b93caa368abf2d476c87c679eba923a7
SHA512 8a1015b169aa863eef133b31a00be52010b54532a6c6b35f27d349a07101f97739f12dfe7c6049fd43affeae3c7f172e10e94b2247e10b4ff35095f191a82a57
SSDEEP 768:bqLbNVVN5Fmf4SjdZO4uc4wwEubXFNP1d3yItzb45UrjZ9zEq8y9zC:bYbNVVNjmgSJA4u2uLFAItzkAzEOzC
TLSH
T12B535DAA49B90D03EDD3763463A0C846BCFD435ED8B4C1AE9B4DC88C5F76BA1C1A5718
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

b1:0b:f1:b8:27:cb:82:a3:d3:11:fb:60:87:95:ee:17:ed:ed:ad:ac:b8:51:b9:d9:2b:ad:18:19:7b:20:e3:f0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

b1:0b:f1:b8:27:cb:82:a3:d3:11:fb:60:87:95:ee:17:ed:ed:ad:ac:b8:51:b9:d9:2b:ad:18:19:7b:20:e3:f0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1e:a3:ac:a4:6e:39:6f:7c:49:00:01:00:00:02:1e

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:29:0e:d5:64:2a:b4:97:f2:1a:00:01:00:00:02:29

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.he-il.dll

SHA256 abcabcf357d9cc0cdb1986ad7be581b2d691773c7de9ecda50d84fb9e605f7f5
MD5 b22009ce31dba1cafd1b6c7a5289da15
SHA1 5608d10549cf86c3762d8712ba5781dab89615c8
SHA512 164b602e577caf197b9479e2cc2197176762d020ddda23ab16a6f033d644c3cf873187c425820f21b1208ac6e41461eca58a94f1cc27e50a0c4e9c8515f74332
SSDEEP 768:ARcaTJ4EdFH7Ox9XZmmDJjE5b45r79zKa9Dh9z:AxJnbyImDJY5k5RzKmz
TLSH
T1BF334A4B899BD843CA663BB18AC4ED667C7C53D36905EE73057BD0040433F86FAAA0E5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

9b:18:38:a5:00:90:06:2e:e0:5c:76:27:0d:72:5d:bc:88:0a:fd:fe:3c:42:24:ca:68:74:60:2f:15:27:a1:78

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

9b:18:38:a5:00:90:06:2e:e0:5c:76:27:0d:72:5d:bc:88:0a:fd:fe:3c:42:24:ca:68:74:60:2f:15:27:a1:78

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:25:80:c7:37:c6:cd:aa:77:49:00:01:00:00:02:25

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:29:0e:d5:64:2a:b4:97:f2:1a:00:01:00:00:02:29

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.hi-in.dll

SHA256 f452e162061d3dd46218905ee924830adf1fd788ba9eb58330173f71b97b33ce
MD5 7a488e14c99219bf3087bff05767e930
SHA1 221fafd3bdabbc4c1a2682ce199788e396d7251c
SHA512 7dc6d9734dad8e3e33679168e46a7379e47bb7cf340ef1734c95502170cfe42423761e4fc94e66c3ab8b227df6674d3c7a14d56dda15effa06621959207b35cb
SSDEEP 768:qyYa2BYe32kUlBCGdm8LTMkygVAAumdCoPnbZOT3zgr3PbdWyk9zgltqOlfe9zW+:qyYYVV3TMwVA8CRjgr/hkzstqrzW+
TLSH
T11B537D11C8AED242CDE7B87485D8E49B6E78AE8BDCC074191AF7F83921873E54B60C5D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

04:e2:b3:d0:30:00:5e:28:34:18:0d:8d:85:07:8c:a8:67:ce:fc:52:c3:3f:2e:b0:61:dd:63:2e:e6:13:bb:42

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

04:e2:b3:d0:30:00:5e:28:34:18:0d:8d:85:07:8c:a8:67:ce:fc:52:c3:3f:2e:b0:61:dd:63:2e:e6:13:bb:42

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:651A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:15:18:03:d3:81:07:26:7c:53:00:01:00:00:02:15

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6B05-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:11:45:18:39:9b:43:cf:fc:6c:00:01:00:00:02:11

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.hr-hr.dll

SHA256 44648574b6a69abe02d559e831c764613c25b488c13861486d81cb78b23a6042
MD5 b1b66dbf789399fbf2d375798f6af7a7
SHA1 71ca9fd889ce17bd35eef71d02a919d5aba96826
SHA512 b9ef3b891ed53cf69d14720949b3aa0a0d40eb24a7d8cd93bb5976a40be3329aebd613eef68876d85ddc4cdca6980eda237ce6b374a82ecd0e569e8b968d13c3
SSDEEP 768:tWNfjizndZ3csTAUrAP+J2jZJh576zotxrHA2736OMdTWhb45AULi9zfYrr9zwbC:t+jiZinUrAm25ogvdBhkO1zIBz
TLSH
T116436E6E4939F111D7FB0C3048D5ECA29F3CB3AB2C829A9207B8711419727D93E15D7A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

61:2d:9e:f8:07:fc:5b:26:b3:f5:76:53:e5:64:90:87:ef:15:7f:27:fd:e4:a3:a0:3c:d2:1a:a7:6d:51:90:69

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

61:2d:9e:f8:07:fc:5b:26:b3:f5:76:53:e5:64:90:87:ef:15:7f:27:fd:e4:a3:a0:3c:d2:1a:a7:6d:51:90:69

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:F002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:20:24:e1:e6:e0:17:b9:b4:8e:00:01:00:00:02:20

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:2b:bb:00:50:ff:4d:3b:9a:a1:00:01:00:00:02:2b

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.hu-hu.dll

SHA256 30294e1b1cb88b55bc041cb61c55b546292791ebcb4efeab36486f1c3cb88724
MD5 8f053eec26dfd300be2c036767610dfa
SHA1 3daa4593a7c4d7867813b6c4ed92324ca48b09aa
SHA512 cd67dfdbf3c16b8a64f62279aa622d900201290dafb009ad814f3a7131553ef1ed3b77ef86dbbe071d5ed2c7ccf1c675ecc3078f80d6b8cc204d806b212771a8
SSDEEP 768:lONdhkDY77OE1Uf4IybXfqUagYHLCrmGng+LRcVsUm6b455/9zqKRiPdz9zglW:lONXbq6/rbSr1WOVsUm6ktzTi1Zzgl
TLSH
T1CE439EC652BC9992ED436B7533F4DC86BD3E434F58F0D1EA4B48E4442676F885628A3C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

51:1f:0b:73:a8:66:0d:8c:7b:06:12:50:13:ec:6f:43:fa:e8:33:37:97:85:11:cd:c1:09:eb:7b:35:92:50:64

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

51:1f:0b:73:a8:66:0d:8c:7b:06:12:50:13:ec:6f:43:fa:e8:33:37:97:85:11:cd:c1:09:eb:7b:35:92:50:64

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:26:35:b4:3e:67:43:93:f6:1f:00:01:00:00:02:26

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:23:4f:d9:60:24:53:cf:fe:2b:00:01:00:00:02:23

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.id-id.dll

SHA256 cd9bbca9180f40b24f27349a8621f6c2b321d4287195f650b1318faf132ffa64
MD5 0380a25c81acab9a3cfaa31fa873297a
SHA1 5b43313d4b949f223fa43a213a5735bc20ba6d9b
SHA512 03b32ead9d1ae4c42fcb69ff65b9158c475f61fc83e598138551bd489989bd741278ad50fd3b21d47fed0fdbe5de3336a953db20a948e1c632c77e5bc560a085
SSDEEP 768:CtoFqx1jM1qrcCwijtCC74AEPrTGHmDD79CbdWyOEE9zrJD9zzr:CIqxeqrXwisC74bPPGg/8hmpzrHzX
TLSH
T198338D47C9D8A50BEE2A16F1D1C1EE263C7D03972F809A5A4855DF750883BA9F32C3D9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

fd:71:8c:bc:eb:8d:8c:b7:85:53:85:64:c6:49:36:63:ab:b8:0e:71:16:4e:aa:0f:12:9b:a6:3d:b6:c4:1c:e6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

fd:71:8c:bc:eb:8d:8c:b7:85:53:85:64:c6:49:36:63:ab:b8:0e:71:16:4e:aa:0f:12:9b:a6:3d:b6:c4:1c:e6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:4C1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:18:25:d9:92:05:e2:e7:e5:e4:00:01:00:00:02:18

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2D1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:12:d1:08:06:3c:ca:18:4f:aa:00:01:00:00:02:12

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.it-it.dll

SHA256 1292ceae151332952e47d2d969396e667f62d9eca0622327530f165a1eec1076
MD5 9d40e631ee900e869e243e3f6454f6ba
SHA1 2874d219646fa59d94dae572b6b799a62ab1fd8b
SHA512 ecf52042641aa467c568854f3389ae6de6e88d09ff11ac626fa108c5f34b242c99c4820b3d9193fde39066eeff8dee3bed4b03fa32385a1321e562aac8a32b9a
SSDEEP 768:JeKMGjaGBYw1cwGOkOzdja8FbBg9Ub45eyrr9zwbs1pHNEo9zI:JVR670aEbBgekBBzhZNEgz
TLSH
T18B439DB6C5A9C403E59B27BCC291FD82BE7DA3DB3C44A51604EBD24815C3BC4E35A66C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

42:dd:ad:27:7c:d1:41:2b:fa:e4:7e:18:d0:d8:05:0f:77:2e:28:2d:ac:13:3d:80:7e:45:cc:db:da:05:ed:64

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

42:dd:ad:27:7c:d1:41:2b:fa:e4:7e:18:d0:d8:05:0f:77:2e:28:2d:ac:13:3d:80:7e:45:cc:db:da:05:ed:64

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:2b:bb:00:50:ff:4d:3b:9a:a1:00:01:00:00:02:2b

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1f:3a:70:69:e4:a2:30:2e:95:00:01:00:00:02:1f

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.ja-jp.dll

SHA256 d2e7e7357d9f601765e1c86e4c4d02da65e39de4ed86dd5d5f7844b2b56ae7b1
MD5 34c7f628be88a9d0405050ae95da4e67
SHA1 2be35f65edb50aaaaf0f14b06d45f15b883b83b3
SHA512 aea7b232aa226fa43007dff4627bf6377033ec4f5b505d6afcb81524bbfb239f617888507021835f18b40b0e73094b5a2bed2d363a5ed46e0439f849c0fada4c
SSDEEP 768:rUIrcXPL2QXQCTf43obVjppJCFUewbbb4569zU8xDgP2s9z:rpcL2QAMxZjPJCFckQzU87kz
TLSH
T12B534AC86B944E4BF4F75DB201B0AA907E3EFD5159E248561782E44F2128FCE9B1A37C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

62:97:b9:5d:f0:40:d2:2a:f3:64:87:4d:22:6d:27:e8:90:f4:07:a6:94:33:01:f3:37:6c:21:55:fc:0c:c8:79

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

62:97:b9:5d:f0:40:d2:2a:f3:64:87:4d:22:6d:27:e8:90:f4:07:a6:94:33:01:f3:37:6c:21:55:fc:0c:c8:79

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:29:0e:d5:64:2a:b4:97:f2:1a:00:01:00:00:02:29

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8900-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:22:41:d2:f6:aa:ff:c8:b5:ff:00:01:00:00:02:22

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.kk-kz.dll

SHA256 af6bb0cbf223dcae437284890e43ba0858d5495560b3aa6ad213081ed5c1c6d3
MD5 e82d2bebf79a7dfab32cb8e33bb126dc
SHA1 5076093746f7154cd13990902b6cc6cf61415db7
SHA512 a33d460af8c4ebeefe81b62457d5fa7fb1349d3c20aa679c0afb5251eb23c3ae511dac224d623a736e08444f90c4efea39008ea9243f026326823d6f014f94f8
SSDEEP 768:twc4LAtJOWKMM09LDTkaSqVJ0lHQfQ5jb45Dk/9zpb0lU+9zZfL:twDLAtvKMMYIyIjkNmzJV6zh
TLSH
T15F434A51D937A145EA521DB08DF578907F2319D35CA081AB8F4CF799E8837DAFE2E208
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

65:42:3b:56:10:d5:f3:ea:0a:6b:99:4f:67:52:38:a0:d7:52:79:be:81:47:d1:91:7a:ff:69:49:31:de:00:18

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

65:42:3b:56:10:d5:f3:ea:0a:6b:99:4f:67:52:38:a0:d7:52:79:be:81:47:d1:91:7a:ff:69:49:31:de:00:18

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:26:35:b4:3e:67:43:93:f6:1f:00:01:00:00:02:26

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:28:f0:a5:87:d7:f3:c8:1e:40:00:01:00:00:02:28

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.ko-kr.dll

SHA256 43333a86a5b904c11602a0e371eeffdcc03136b4c9d906cdc1ff7933dac97f77
MD5 da04f75ab3ff8b89fe04d3a5aa2834d9
SHA1 49d1267dfbc490d1e5d767372df7762eb22d17d6
SHA512 5f99c0ec74e6c020e98143a5f00ea177d244e7396469068b70f9cf6aa9e83b1d350e99ba73e6f6b053cdc9ce8bf2966154378752859bf74ca513cccab909fc4b
SSDEEP 768:/Aqcid7ZqPpqWlyzUEMZ0oAEh2etf8iAb45mzrjZ9zwRFo9zI:/AkdqRkUEMLp24PAkGzggz
TLSH
T1DB435DA6E1B5E102F891AEB257F14B97BA3F05821D6798169281735C06E3FD0EB303DD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

94:d0:df:af:56:59:f3:5d:2d:cd:4c:ca:51:d1:7d:0c:4c:f7:43:1c:68:8a:c8:6a:bc:29:92:c3:56:69:e5:05

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

94:d0:df:af:56:59:f3:5d:2d:cd:4c:ca:51:d1:7d:0c:4c:f7:43:1c:68:8a:c8:6a:bc:29:92:c3:56:69:e5:05

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1e:a3:ac:a4:6e:39:6f:7c:49:00:01:00:00:02:1e

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1f:3a:70:69:e4:a2:30:2e:95:00:01:00:00:02:1f

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.lt-lt.dll

SHA256 a57d7025de42f5d676bd8d0788401a52178cacd954594474b100e1ce86f3e364
MD5 7594793f8d5555e4bd3acca1c6644ac9
SHA1 f62a13af0dd09f4433c03993ffe5ec14ca1386ce
SHA512 5b477bf4653f54f9b177acf642c893cea7048a8754e28bbe6b129e4c02de37b593fbaf74b3e51c6a1ddd4d803bfefed43a1fc5b0a64b12e97b7acaaa2c19183b
SSDEEP 768:VsJjPam8nFuqW+xpBRUq6PiBiM590uZyVpFxwJlNZX0ELLWdb45OkW9zjT9zC:eemVqpz6TuZ0xwJF0ELL2kxizdzC
TLSH
T1EE437DC1CD298086F6D66DB069E5FD732F3C23C31C81951705A1E25238A6FEAAA2D53D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

64:8d:e7:a0:2b:02:0e:48:44:37:7c:5a:c6:57:99:f8:e2:3c:8e:ce:19:1f:52:b4:1e:3f:41:4b:8c:72:41:03

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

64:8d:e7:a0:2b:02:0e:48:44:37:7c:5a:c6:57:99:f8:e2:3c:8e:ce:19:1f:52:b4:1e:3f:41:4b:8c:72:41:03

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:24:3b:84:21:b0:2c:ac:64:22:00:01:00:00:02:24

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.lv-lv.dll

SHA256 bb8af3c0aa74c9851e7cc1501e8588d33e4d12c50ee947a2b5ca2d78bffa6182
MD5 b658eee577448551a39333dacbc490c4
SHA1 20c204bed45824d8cb014822f7f3c52fd776ae1f
SHA512 b79b4cae3d336c11482e983a3d979a2821d90ad19791c9aebf5aeee7f6f4cbcba60b962f524234c118692cd9f5946b0d63f5af7d18fb37887ba28220d9430d66
SSDEEP 768:KD9xPYwxOL4fSw2YKlXPyau92ZibdWySCf9zLkaz09zv3:Kcl0oJfynoZihqozL9zczP
TLSH
T118437E8A8B3CD109D3DF09F0858A98A7FE3C239B1C50D75641D5A0D018F379E9E667BA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

03:f5:25:17:1f:0e:5d:de:b5:64:31:87:62:78:32:65:a9:c6:5d:89:7a:d4:07:c0:94:8d:80:12:ec:8c:ca:ac

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

03:f5:25:17:1f:0e:5d:de:b5:64:31:87:62:78:32:65:a9:c6:5d:89:7a:d4:07:c0:94:8d:80:12:ec:8c:ca:ac

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6F1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1c:09:55:15:d7:c3:59:07:d1:00:01:00:00:02:1c

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:521A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:17:71:fb:2e:a5:af:01:1d:ea:00:01:00:00:02:17

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.ms-my.dll

SHA256 15e5aa319caddcadcb92eba3228d1d9f251260654552d237c7999d6d7bce82aa
MD5 d2952ab52a4e6eb7fcb51bb5985060cf
SHA1 e8ea794eb3ff13c64c2005b0c3863a1ea38569ae
SHA512 d67d68cebe991e557992c55000b1b7457a75b54a004f1c951c3b6dfd54e6a8fa0824973f707fee4851e9154c363ec966a6572bdb6865301fa6d40f18d1dea968
SSDEEP 768:fM2z9WrVLATO7EHOCHUg1Cyun6V4D7Bh3F67SlgzXpMwRp1cmp9sbbdWyFF9zUwJ:fM2zU7wHU5k4vfFEbcmzQhlzA5izsAR
TLSH
T1A8438B438A9DA207D6A727F191C0E9173DBE13F73B409E2A0A64DBB60857BD467093CD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

32:b3:0e:b5:ea:5b:48:1c:5a:d9:f9:78:87:d2:9f:bb:f1:d8:66:80:4a:fc:e2:54:d8:42:64:4a:97:cb:88:d6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

32:b3:0e:b5:ea:5b:48:1c:5a:d9:f9:78:87:d2:9f:bb:f1:d8:66:80:4a:fc:e2:54:d8:42:64:4a:97:cb:88:d6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:321A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1a:a9:a0:1d:06:a0:0f:43:aa:00:01:00:00:02:1a

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:651A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:15:18:03:d3:81:07:26:7c:53:00:01:00:00:02:15

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.nb-no.dll

SHA256 7915e594d6e7d60431bba458a3c9a5071d1f0273526d904c15a4f5c6aeeb20f3
MD5 dc79143f4b8004f814fc154b51ec947c
SHA1 87cdfa0dae787201ad82595bfaaa4a66113a7dd6
SHA512 14225d7848677da278e29940f2d3ed0831fc7ba9eab2caed4e8cb5c38f189f5dccb704aeaa7581001599bf5383ae233235af71d021324ad929aa80f5b9a4c308
SSDEEP 1536:2RGKLhiy+SgwLPApVh7x4+3jSjU3gC8kKRzK4Zz:2kKdiybgwLPApVh7x4+3jSjU3gC8b20
TLSH
T1A833AF8BCA95D047FE8217B58155ECBBBE7DA787A94086EF348EE01904D3BC1F61E190
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

12:1f:f6:dc:b7:0f:78:b2:b7:7d:c8:76:c1:64:fc:8d:1f:33:06:fb:02:f3:da:be:73:d2:78:7b:5a:b0:78:f3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

12:1f:f6:dc:b7:0f:78:b2:b7:7d:c8:76:c1:64:fc:8d:1f:33:06:fb:02:f3:da:be:73:d2:78:7b:5a:b0:78:f3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:25:80:c7:37:c6:cd:aa:77:49:00:01:00:00:02:25

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:23:4f:d9:60:24:53:cf:fe:2b:00:01:00:00:02:23

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.nl-nl.dll

SHA256 919fc828b28ca0ed9eb73f41f526e24be39627bc8e96c890fc29c8af85fb167e
MD5 4c413c198cde61208eea4e37cb00c849
SHA1 e196d4252b3054dfac2817c56dd1a078f154e75a
SHA512 ec4cbd0f7cb469a5bce0785cfbf95415269237c111237de5290ed894c787a398511a835aa392f7558e2b38187ae565d25ea62ec6aee1f3d8b02b337f939f02ef
SSDEEP 768:8m2icf7juyH824nYDRe3U187LuTEToiKRIb45po9zIAIjDOH/9z:8Dtf7jlMSRe3JvuuKekTgzYOlz
TLSH
T125439F9B8969825BFAC257B29184DCF77F3D93CF16C4963F8D9AD0241403B84A31D2DA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

86:c4:9c:02:3a:cd:0d:67:fe:5b:a0:78:24:35:4a:b6:99:17:89:13:26:27:92:6f:92:72:c4:a5:f5:c6:b9:43

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

86:c4:9c:02:3a:cd:0d:67:fe:5b:a0:78:24:35:4a:b6:99:17:89:13:26:27:92:6f:92:72:c4:a5:f5:c6:b9:43

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1f:3a:70:69:e4:a2:30:2e:95:00:01:00:00:02:1f

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:26:35:b4:3e:67:43:93:f6:1f:00:01:00:00:02:26

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.pl-pl.dll

SHA256 f3abe939afa2f852b9827c2ec73d5fc8cfacf75d225c5a546ff25079fa783af0
MD5 2feb87d834ec9af9cb90d8002261b06d
SHA1 169f0e58874a79fe62014e0550b3f6a40faf13c8
SHA512 8f47899f7055449b337d324737e8b14fa349dc2c84fe7f5316369c18a6af5c3d916b17531104c0dacba976e539310157b44e5a489b6ab3ac1370c5246adf7759
SSDEEP 768:D+e8aGanjokW43L/b4vri9K0XLIj0OxLzckfWxnHmcM/1O+YN2bdWy5Q9zqmN9zz:D58Yn33TbrKEIYnnHnMzq2h+zfz
TLSH
T1A1538ED902FA9045F55A2CB05A4F8C832D3C715BBAE0571EC2D5F0840AE33EF766A57A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

14:ac:2c:ca:d7:74:7c:62:c9:70:73:e9:6f:b4:0d:c7:c3:38:07:34:fb:80:bf:fc:60:6e:36:c9:db:9b:c9:8d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

14:ac:2c:ca:d7:74:7c:62:c9:70:73:e9:6f:b4:0d:c7:c3:38:07:34:fb:80:bf:fc:60:6e:36:c9:db:9b:c9:8d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:4C1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:18:25:d9:92:05:e2:e7:e5:e4:00:01:00:00:02:18

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2D1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:12:d1:08:06:3c:ca:18:4f:aa:00:01:00:00:02:12

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.pt-br.dll

SHA256 1fe91b109a6ed87b25097bfb3ef2d5b2d30eb0034d7bc6dc59ba7e325f621905
MD5 3e9210ddec242e07c32ea552ce07f2a8
SHA1 2b37d4946bc24efca3431ffdb22e3a4db218da4f
SHA512 b0227fe94a32fc0f076ef68f634f8171ac7f9af8f5dd40dafa139d2903dd23703593ba3bce6eb1292f470d267b47219800d209e7b4f7fd40c956a0c699e2f748
SSDEEP 768:S8d4ECN2XwRFFGZ25Nr27CXdClyTmY1gbuyYsFgNbdWyuflfe9zWzS7N9z11:SYd2RFFYgNS7yClyz1FXgyhJzWSvzb
TLSH
T185437B6A86D88443EB2327B452C2D903FD3D87DB2A54CD6358EFD51510C7BC8E32E96A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

c7:64:3f:9e:62:b0:5b:9b:89:73:7e:4e:2d:23:62:3e:c8:db:21:6c:91:0e:90:2b:9d:46:12:97:dc:b0:5e:bd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

c7:64:3f:9e:62:b0:5b:9b:89:73:7e:4e:2d:23:62:3e:c8:db:21:6c:91:0e:90:2b:9d:46:12:97:dc:b0:5e:bd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6B05-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:11:45:18:39:9b:43:cf:fc:6c:00:01:00:00:02:11

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:10:ab:cd:e4:16:18:ef:39:b0:00:01:00:00:02:10

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.pt-pt.dll

SHA256 9f048293f996872b30f2441c4206ba3276e3a6e362a19e8075b1a704c95522e9
MD5 92a60a4367ac3e4b674cb80973c702db
SHA1 7b1ae7b5e2cbf2c96174911906e40c0d23a0242d
SHA512 db86f8fbb7c33b12785722715269b4e9a32a95ed8672d70c0ee3ae2d5cc608a6b13a9879a6d61a1900a909171afd7e7aedae0a8eb40d6198eacf91b0189d9fb5
SSDEEP 1536:aOK1R/o8654cet4gzOWTIRhYBhzsTIePzoR:aFo8654bLzdsOBhoMePy
TLSH
T147436B6E8BC84143EF2226B55282D943FEBC47C72894CD5798DFC54520C3BCCE71AA6A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

71:50:69:b7:f2:09:e1:27:7e:70:94:02:f3:fd:ce:cb:c9:7a:bf:da:75:bf:73:fe:08:2e:c6:b5:15:26:85:10

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

71:50:69:b7:f2:09:e1:27:7e:70:94:02:f3:fd:ce:cb:c9:7a:bf:da:75:bf:73:fe:08:2e:c6:b5:15:26:85:10

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:651A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:15:18:03:d3:81:07:26:7c:53:00:01:00:00:02:15

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:431A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1d:4b:c0:92:87:38:85:7e:39:00:01:00:00:02:1d

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.ro-ro.dll

SHA256 b2b21a6817d7f4c8f424fa6047b15cb02616079be7a0aa2c55a6adae2c76d5f4
MD5 aaf142546f9e936d1b7266818764dcfb
SHA1 66313535ae8bf1e4c9b93a66d348d938311546c7
SHA512 4ec2b46a63bfcde35b90265f19b6217378c1d0e5b94a0e315afafb85d8061587bdc1f63b36978a36e48bfe76c1fed357ce01ad36ab51910c3183671044ef707f
SSDEEP 768:ZVLP295eiM6d5f8HSsDNij8W79cTaqwH/nA+Xh0PhGaeYVQyehl/WbdWykCf9zh9:ZFQNMm50Hnij8lIA+xeeQehQh8oz7zO8
TLSH
T176434B7B4A088019F787597496457C8B2E3A733FB9D48223CB269C973B8CBE8B535518
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

79:5e:1f:d6:e7:6e:06:a8:fe:fa:64:ce:d6:c4:b4:af:9c:82:5d:1d:2f:0a:c9:6f:06:68:64:17:0b:a0:fd:3a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

79:5e:1f:d6:e7:6e:06:a8:fe:fa:64:ce:d6:c4:b4:af:9c:82:5d:1d:2f:0a:c9:6f:06:68:64:17:0b:a0:fd:3a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6F1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1c:09:55:15:d7:c3:59:07:d1:00:01:00:00:02:1c

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:401A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:19:5e:b2:d8:54:75:f4:b1:8d:00:01:00:00:02:19

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.ru-ru.dll

SHA256 fc41b7dd10604b2574e74ef3f91a40f947dc3ee5ce3f17937721982456ef8b61
MD5 72f50cee0d836ee18c3fdaf29f2d0c27
SHA1 009d4980a4ca4092c72b5b456b5fff151fe5c798
SHA512 cdcc752c73c7edeafe35a47b53555718272f2451aea1b8d35319b790e9951621a244f81b9bedb30d4fa11fe79eca6dccc2ba69251d3b48dce317f3987f8c0595
SSDEEP 1536:/rCJ5+8fEZtgd0ntXusSLl5kkFBzWpf1zn:/uJ080tgdItXuscl5Xuf1z
TLSH
T1F9436CE5851DE351E8EBACB86852ADB37A7C035F2DD29869023FF95414623E3C93C874
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

de:6a:86:52:51:b0:f0:c3:76:6c:be:e0:d3:74:0a:24:ef:7f:f8:23:d4:8a:a8:dc:58:86:c6:21:34:64:b1:a6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

de:6a:86:52:51:b0:f0:c3:76:6c:be:e0:d3:74:0a:24:ef:7f:f8:23:d4:8a:a8:dc:58:86:c6:21:34:64:b1:a6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:2b:bb:00:50:ff:4d:3b:9a:a1:00:01:00:00:02:2b

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:F002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:20:24:e1:e6:e0:17:b9:b4:8e:00:01:00:00:02:20

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.sk-sk.dll

SHA256 abff207439d431d326a665f932803aaf4f96f55523e8851c96adc147e1ee23b0
MD5 aa66424689f77228ca67a4e8ae2b2f6b
SHA1 81c6e75e54c2ca00901ecbb0cfccd844972dd9de
SHA512 ecdc2d72bc3cabc56af4ad011d34f7bccad8fe767a08985f741e6d6d2196341847cc07efaaaafa8ac51bdf0f3a6ab43158f944b910996146bd14bb4c634b7b80
SSDEEP 768:pwMKv0YYBhVd+ikZlOHP6s/cmYoLdd0v2ZqSh3h3hrhyh7hXhAhOVTTNgIihHhJh:pUcIZZlOHEv2ZqzikNuz/dzJR
TLSH
T150437CF185582150CBE1ADF176B0DC7EF83813F16F9E42134A27EA0A2496F5E9A107BD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

ef:d4:55:fd:66:84:c8:44:19:0f:48:e4:24:6e:67:3f:75:22:11:c5:50:55:6b:39:b5:c1:17:ba:7a:72:af:be

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

ef:d4:55:fd:66:84:c8:44:19:0f:48:e4:24:6e:67:3f:75:22:11:c5:50:55:6b:39:b5:c1:17:ba:7a:72:af:be

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:27:d5:c0:83:c3:b1:2e:57:2d:00:01:00:00:02:27

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1e:a3:ac:a4:6e:39:6f:7c:49:00:01:00:00:02:1e

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.sl-si.dll

SHA256 800833de0f7c07a578455182bad509afd1f7a00514f4cdb4749dd0f13f10b045
MD5 eef2ba8d65ff62d7d09cbee82af48524
SHA1 d807430bae27487b2661a2a77f220ed3ad5d5d3a
SHA512 c47b8b43f24ef0eb038e6ba966dd64ba6ce2c3051e4750ea699660ef608b76e97b8c2d4905be6735b1ab95756353fc064ca244a1873c44b3f1e4952d27022c08
SSDEEP 768:/BU3lqsXEL+0OQQ5VYVnKHTBvvVs8fyOdQt3ryJ9rKb45F9zVkafs9zb:/BUMWELD1WVYVATRfKt3rKrKklzarzb
TLSH
T1FB439E464B3CC041DADB59B058E9FC83BE35B3AE2C466962027DF4D419A37D9FF10A29
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

db:a7:7c:e7:8a:28:3c:44:ea:f6:bf:43:c8:88:1e:94:87:25:c2:97:e8:3d:2b:1f:25:fc:54:1b:6b:58:7f:35

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

db:a7:7c:e7:8a:28:3c:44:ea:f6:bf:43:c8:88:1e:94:87:25:c2:97:e8:3d:2b:1f:25:fc:54:1b:6b:58:7f:35

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:29:0e:d5:64:2a:b4:97:f2:1a:00:01:00:00:02:29

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:27:d5:c0:83:c3:b1:2e:57:2d:00:01:00:00:02:27

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.sr-latn-rs.dll

SHA256 85141f4eef297a37f944144e7abe78c8b24d316bf3830c217dc26c40d67733b2
MD5 28711beea11bb423b2fdff1905b235fc
SHA1 1b9ec19d3e544946009b920197674f1ddfbb0b64
SHA512 3e0acde03150c967ea36894282d0107d586d48d9a8c1ca4ad3f4cb05f7fd77f285017d52e19c727765613d8ed42e1a50a1eb8480b176b5d0aba31f1539d6686e
SSDEEP 768:sykAmHLj7H1GCwBkETlkCkh7/k+twxJ4KiJBbdWyIAo9zrXXlfe9zWpP:scmrj5GprBL8twxqKqBhzgzrXozWpP
TLSH
T18F438DA745399041E7D70D79C498E8236F3873B73E42FEA21B64B1541CB37D9BE04A2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

46:ce:41:29:dc:0c:9b:05:8a:db:79:83:f2:c4:48:ae:99:08:fd:8a:23:8d:58:c9:0c:82:00:50:b2:bb:e6:45

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

46:ce:41:29:dc:0c:9b:05:8a:db:79:83:f2:c4:48:ae:99:08:fd:8a:23:8d:58:c9:0c:82:00:50:b2:bb:e6:45

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:551A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1b:d0:b2:b8:02:67:f7:72:cf:00:01:00:00:02:1b

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6B05-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:11:45:18:39:9b:43:cf:fc:6c:00:01:00:00:02:11

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.sv-se.dll

SHA256 aa1267c0974b3165d46af3d46001f3be0b3890ab3cb823d4603441eac30d097e
MD5 e896a57652449fc21739abf6a6af9bf1
SHA1 f94d69336ba42872316e7e7551d48019c85b25ac
SHA512 36b290515961036e83941abb673baf5b02e6bbbc51b31bf89290a09728e92c75dea9ee33512c4db117a4ae64b3db3f30720f3667b8b2633628b7fd2cb1773a79
SSDEEP 768:PxOrPWk8w5hsSHpL5X0KFsV+IYsR2yjb45bxts9zwt0s7PO59zNK8:PQrukZ56GpL5ng+IBkNxmzwx4zQ8
TLSH
T18933AF46CEA1C857EB533AB68685EC5A3C7DA38336A4C47F658FD00C1083BC5A37E265
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

c4:39:0b:4f:8a:6d:d0:34:22:66:fe:d3:ef:df:39:09:33:cc:01:da:5b:91:5f:7c:45:59:8c:53:3b:ba:2f:65

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

c4:39:0b:4f:8a:6d:d0:34:22:66:fe:d3:ef:df:39:09:33:cc:01:da:5b:91:5f:7c:45:59:8c:53:3b:ba:2f:65

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:27:d5:c0:83:c3:b1:2e:57:2d:00:01:00:00:02:27

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:21:33:c0:35:fb:d2:0f:21:a4:00:01:00:00:02:21

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.th-th.dll

SHA256 a87256d62f4601f9963736e36937283974e08e26160d9d7ab2da18e596cf8ea3
MD5 290a532603c8c13e7f16e683397aa46d
SHA1 07d9b6aac4a451c0afe97233b4b91f5f1f59f558
SHA512 14effe78778d1f5f12f0c6a17f172bbb8702808b4cdfb0fd05d4588044639c54493d2c2963f6b433d8a1fe1868e172233cdad1150e37000d7ea82ef4442e6c2c
SSDEEP 768:BBVPDuBGXXFlFysIZUhbaIh1VZ42SCNjat+6MGb45LUPO59ztV/O9zNJ:BBVPDu+FLgIaMqBMGks4zKzD
TLSH
T160435CAA6BCFDE12E89F3C74E56C8912663893CB5D85062E7772B47438C0FD1CE50926
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

1c:0f:99:6d:61:19:b9:9b:b7:e6:67:27:62:3c:82:ed:eb:3d:51:6a:26:10:30:4b:4f:96:33:2f:e1:ed:d7:63

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

1c:0f:99:6d:61:19:b9:9b:b7:e6:67:27:62:3c:82:ed:eb:3d:51:6a:26:10:30:4b:4f:96:33:2f:e1:ed:d7:63

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:21:33:c0:35:fb:d2:0f:21:a4:00:01:00:00:02:21

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:24:3b:84:21:b0:2c:ac:64:22:00:01:00:00:02:24

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.tr-tr.dll

SHA256 e3a9d25e2690d55f545b155f5401be4c7b14bb0d2c63c7bde45921d497c7540e
MD5 0b2aeab134e1160c2923b36e8d7ceaef
SHA1 c004bd057597eef0a80eda95e461092d9d85c7c4
SHA512 9d7e94c2fd15c66fd98914a290d50ab445f4b8aa12203ea8ba4590788ff5fe86e6ce158154fbfaf59e7f8c918c9955d70db0c2bee752c2a9d9e08b16e07a41eb
SSDEEP 1536:bnKpy5ainKjfvwiWBMSI3sNhjDw0oCEZ1Io+kQZzqz:bKpy5amKjfvwiWBi3sNZDwuEZT+je
TLSH
T13B435BC753D49482FEE27BB2ADDBDD852974D2C3CC16E06B34D2FD9818D2BD88144AA4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

71:db:dd:fb:e8:82:81:21:3d:01:9b:b3:f5:38:78:b6:5f:cf:f4:ec:9d:8d:59:ce:ea:8e:1d:c9:99:de:9e:69

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

71:db:dd:fb:e8:82:81:21:3d:01:9b:b3:f5:38:78:b6:5f:cf:f4:ec:9d:8d:59:ce:ea:8e:1d:c9:99:de:9e:69

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:23:4f:d9:60:24:53:cf:fe:2b:00:01:00:00:02:23

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:29:0e:d5:64:2a:b4:97:f2:1a:00:01:00:00:02:29

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.uk-ua.dll

SHA256 3e85f93619345ceae1ec1df7e442cbbb94a645d7d0e000482307edec0220b824
MD5 4a9dcd1dee873d0f876b9b29f4c7f924
SHA1 76d2dd758eac1ba885339f94838e15402a8c3282
SHA512 4008798d1753b80d569f76babd5818d41bc69068febc6b8226520525834e4291cc9ea457b7d59717d65d3ece7855692c0baafb5d2856279a37bcb929862582ce
SSDEEP 768:oCQDUNOu2jM5ItPzmjcsq8CTP3ySfjB7x7PvHb45CrjZ9zwqMlU+9zZf08:oCQDUNF2A5Il2Cr3/B7xDvHkCzwK6z6
TLSH
T105439E81859EC201D9EF2DF498ACA4A36FF8079F3CD96AA64367FD1538D07564E2403A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

c3:f0:90:95:2a:a4:a8:a7:f4:6a:35:45:ab:ff:1d:cc:0e:6e:36:6d:de:36:88:58:11:ec:a8:48:be:8b:0a:23

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

c3:f0:90:95:2a:a4:a8:a7:f4:6a:35:45:ab:ff:1d:cc:0e:6e:36:6d:de:36:88:58:11:ec:a8:48:be:8b:0a:23

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1e:a3:ac:a4:6e:39:6f:7c:49:00:01:00:00:02:1e

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:28:f0:a5:87:d7:f3:c8:1e:40:00:01:00:00:02:28

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.vi-vn.dll

SHA256 b42ef749a2f92c4c12e6e22cb92998715bbb49b27bc212e8e6a3afe890ebe072
MD5 9eab43027884d797dc7a2fa909ac6574
SHA1 e4fed87c1c0b8ae7e06af7b3ae812b40260c52ce
SHA512 84d3c421f2b8a8f22e1b04536c4b11867958b74d104e7c59fea428cd09c947e986debfb38dd29a451957a24e06c674f9b8143c76cd527227979794007f5e5251
SSDEEP 1536:PjHsihDEg/cO9kOCDMYHP6skMbNueU9rVBU9DggGBMxhx6ozl1zWT:PjHsihDZ/cO9FCDMYHP6skMbNux9rVBl
TLSH
T164433A8689993808F86ACFB5D600598E583E026D795C8489DC77EFAC0053FE797B573C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

8f:7f:a5:bd:fd:7b:d6:f1:07:91:60:c8:65:8e:bf:cd:c2:87:e5:c6:82:25:bc:0c:5f:29:4e:e2:7a:71:c0:5b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

8f:7f:a5:bd:fd:7b:d6:f1:07:91:60:c8:65:8e:bf:cd:c2:87:e5:c6:82:25:bc:0c:5f:29:4e:e2:7a:71:c0:5b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6F1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1c:09:55:15:d7:c3:59:07:d1:00:01:00:00:02:1c

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6B05-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:11:45:18:39:9b:43:cf:fc:6c:00:01:00:00:02:11

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.zh-cn.dll

SHA256 ebfe079d4043fe30659896878ebf792f7b5fec34510cc21372c6531a4d751a3d
MD5 0293c97ac8bb856c0c6146927718d952
SHA1 be8d484d40f4d4dcfb5d1c9fab2fe1112a6b3d40
SHA512 e6f41dd31e2487968210071c82d529d98be757531caccf708747b123540aec328bd40b41a8e12877b63e2c2f36be61df85305845d37a01529fdd221d9931ae53
SSDEEP 768:j6Fs62jpcRECNSwDjcuXvPj3b45tmLqULi9zeOgF49zW:j69EOSwDjFPj3kTmm1zeLFwz
TLSH
T1C0336AC147A55D42E9F63E31C5F2CA62BE3B56D20824C54B8B82F60C146AFC5D93E72B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

aa:33:d6:4e:2b:4f:6c:0e:72:5f:45:7a:c0:44:1b:a6:75:ff:69:d1:39:ee:10:38:8f:03:e1:8c:17:7c:09:68

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

aa:33:d6:4e:2b:4f:6c:0e:72:5f:45:7a:c0:44:1b:a6:75:ff:69:d1:39:ee:10:38:8f:03:e1:8c:17:7c:09:68

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:F002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:20:24:e1:e6:e0:17:b9:b4:8e:00:01:00:00:02:20

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:29:0e:d5:64:2a:b4:97:f2:1a:00:01:00:00:02:29

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RINTL.zh-tw.dll

SHA256 900596a36a878df21fe41683045ffed8aefb5b046a7cbcf4b3e4a00d6922d267
MD5 596aaef57670590c032fdd70d0acf84f
SHA1 b568e2e2866693b8d41c84ef12f2855218c757de
SHA512 b992537c62b57f05318c480b70f774af0dea6eca0ae0810c89b76743e3f17bb5562ac0f2869b6d86919a03ce6cd76d5c48b69c49e117b7fe0ca2385c09c9aa58
SSDEEP 768:Nio0JqZjLEU+aG0eXvPwGcnIh4whMUqb45QWGrjZ9zkRW9a/9zG:NG0ZjLD+aG0eXvPwPIhvqkmWYzoW9kz
TLSH
T105334BC187E95E01E8F72E7085F1CC26FE3B12D22D2544A74692BA0C1979FC5993D72B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

d0:4e:f3:f7:3e:19:62:ba:7b:c2:ec:a8:54:52:fe:34:a3:03:ae:12:47:ed:68:f0:da:ff:0c:6b:e6:c3:6d:07

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

d0:4e:f3:f7:3e:19:62:ba:7b:c2:ec:a8:54:52:fe:34:a3:03:ae:12:47:ed:68:f0:da:ff:0c:6b:e6:c3:6d:07

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1e:a3:ac:a4:6e:39:6f:7c:49:00:01:00:00:02:1e

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:26:35:b4:3e:67:43:93:f6:1f:00:01:00:00:02:26

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C2RUI.dll

IMPHASH 113dbaf25a4674d6921808fe229fd35f
SHA256 89161a1e25ffd96b8ad0bf9a3947d3db50a7e122c97b9f8b7d112c5d424d8f11
MD5 edbca936c0b36bbacd8b9737d84e72bf
SHA1 c9acb6e471b806eb3d04c418091909b57c1777a5
SHA512 b3bd7bdbdf7f45e0a3c7ee462cd4b2eaff4983d805373e55cdf7677c9efbef836584f207d49d7f1b3996a59ee93d0f349ff06957618e9ff604702416b9c734fc
SSDEEP 49152:3c5PsAmRd+UiAeDpwZLHRGazgeypvpInSJkrrkVodkUL3sl41w3wy5bzhc:s5UJcmzgMwkbkhtc
TLSH
T159E56C1667F806A9F4BBE6B4CA778532EB727C061631934F0661C68A1F377214E3D722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

d1:d1:ab:2c:f2:a3:05:85:3b:79:4f:97:01:94:ad:42:89:e1:29:5d:10:9c:9c:50:1c:5d:f1:05:f4:2f:60:80

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 30, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

d1:d1:ab:2c:f2:a3:05:85:3b:79:4f:97:01:94:ad:42:89:e1:29:5d:10:9c:9c:50:1c:5d:f1:05:f4:2f:60:80

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 30, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:14:8d:cd:23:44:ee:06:df:72:00:01:00:00:02:14

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6B05-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:11:45:18:39:9b:43:cf:fc:6c:00:01:00:00:02:11

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Minor OS version

1

Major OS version

6

Entry point

1904448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d:\dbs\el\omr\target\x64\ship\click2run\x-none\c2rui.pdb

oleaut32

SysStringLen SetErrorInfo SysAllocString GetErrorInfo SysFreeString

kernel32

SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcess GetModuleHandleExW InitializeCriticalSectionEx GetLastError CompareStringEx GetProcAddress DeleteCriticalSection FreeLibrary FlsFree FlsAlloc IsWow64Process CloseHandle SetEvent OpenThread WaitForSingleObject GetExitCodeThread CreateEventW ResetEvent GetTempPathW DisableThreadLibraryCalls FindClose UnmapViewOfFile MapViewOfFile Sleep CreateActCtxW ActivateActCtx SetLastError OutputDebugStringA GetStringTypeExW GetModuleFileNameW FindActCtxSectionStringW DeactivateActCtx QueryActCtxW LoadLibraryW LocalFree FormatMessageA GetUserDefaultLocaleName IsValidCodePage MultiByteToWideChar WideCharToMultiByte GetSystemTime FileTimeToSystemTime ReleaseSemaphore WaitForSingleObjectEx CreateEventExW AcquireSRWLockExclusive ReleaseSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared CreateThread WaitForMultipleObjectsEx WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetModuleHandleW CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork GetSystemTimeAsFileTime TlsAlloc TlsFree FlsGetValue TlsGetValue FlsSetValue TlsSetValue GetCurrentThreadId EnterCriticalSection LeaveCriticalSection RaiseException ExpandEnvironmentStringsW OpenProcess GetExitCodeProcess GetProcessTimes GetTickCount64 TerminateProcess GetModuleFileNameA GetShortPathNameA K32GetModuleFileNameExW CreateProcessW LoadLibraryExW FindResourceW SizeofResource LoadResource VerSetConditionMask VerifyVersionInfoW GetCurrentProcessId GlobalMemoryStatusEx GetVersionExW GetDiskFreeSpaceExW CreateFileW DeviceIoControl GetComputerNameW MulDiv FormatMessageW GetNativeSystemInfo GetSystemDirectoryW HeapFree HeapAlloc GetProcessHeap ReleaseMutex GetLongPathNameW GetFinalPathNameByHandleW SystemTimeToTzSpecificLocalTime QueryUnbiasedInterruptTime IsDebuggerPresent GetFileAttributesExW FindFirstFileExW MoveFileExW DeleteFileW FindNextFileW CreateDirectoryW RemoveDirectoryW SetFileAttributesW WriteFile ReadFile SetFilePointerEx SetEndOfFile GetFileSizeEx FlushFileBuffers LockFileEx UnlockFileEx GetFileInformationByHandleEx GetCurrentDirectoryW GetTempFileNameW CopyFileExW GetVolumePathNamesForVolumeNameW SetFileInformationByHandle K32EnumProcessModulesEx RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlVirtualUnwind GetFileType GetOverlappedResult GetFileTime QueryPerformanceCounter QueryPerformanceFrequency GlobalFree GlobalAlloc SetFileTime CancelIoEx GetProcessAffinityMask CreateWaitableTimerW SetWaitableTimerEx CancelWaitableTimer QueryDepthSList InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList GetTickCount InitOnceExecuteOnce WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetCurrentThread GetQueuedCompletionStatus CreateMemoryResourceNotification GetSystemPowerStatus QueryProcessCycleTime QueryThreadCycleTime IsSystemResumeAutomatic OutputDebugStringW RtlCaptureContext OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA CreateFileMappingA LocalAlloc GetUserGeoID GetLocaleInfoEx LCIDToLocaleName LocaleNameToLCID GetUserPreferredUILanguages GetACP LockResource EnumSystemLocalesEx GetSystemDefaultLocaleName UnhandledExceptionFilter LoadLibraryExA K32GetProcessMemoryInfo FindFirstFileW lstrcmpW ProcessIdToSessionId GetPriorityClass GetTimeZoneInformation InitOnceBeginInitialize InitOnceComplete GetLocalTime GetSystemInfo VirtualProtect VirtualQuery

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strchr memcmp memchr __std_type_info_name wcschr __C_specific_handler_noexcept _CxxThrowException memcpy wcsrchr __std_exception_destroy __std_exception_copy __std_terminate _purecall wcsstr memset __std_type_info_destroy_list __current_exception memmove __std_type_info_compare __current_exception_context __C_specific_handler

msvcp140

?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Incref@facet@locale@std@@UEAAXXZ ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Mtx_unlock ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ _Mtx_init_in_situ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@F@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_J@Z ?uncaught_exceptions@std@@YAHXZ ?good@ios_base@std@@QEBA_NXZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z _Thrd_id _Cnd_init_in_situ _Cnd_wait _Cnd_do_broadcast_at_thread_exit _Query_perf_frequency _Query_perf_counter _Xtime_get_ticks _Cnd_broadcast ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ??Bios_base@std@@QEBA_NXZ ?_Xbad_function_call@std@@YAXXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Xinvalid_argument@std@@YAXPEBD@Z _Thrd_join ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?id@?$ctype@_W@std@@2V0locale@2@A ?id@?$collate@_W@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z _Wcsxfrm _Wcscoll ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ?toupper@?$ctype@_W@std@@QEBA_W_W@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ

api-ms-win-crt-heap-l1-1-0

free realloc malloc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s __stdio_common_vswscanf __stdio_common_vsnwprintf_s __stdio_common_vsprintf_s

api-ms-win-crt-runtime-l1-1-0

abort _invalid_parameter_noinfo terminate _beginthreadex _errno _clearfp _invoke_watson _cexit _initterm _initterm_e _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit

api-ms-win-crt-string-l1-1-0

tolower isxdigit wcsncpy_s isdigit wcstok_s wcsncat_s towlower _stricmp strnlen strcmp iswspace strncpy_s _wcsicmp wcsnlen wcscmp wmemcpy_s wcscpy_s

api-ms-win-crt-convert-l1-1-0

wcstoul _itow_s _wtoi wcstol _i64tow_s wcstod _ui64toa_s _ui64tow_s strtol _ultow_s

api-ms-win-crt-math-l1-1-0

ceilf expf _dclass round log10 floor _fdclass logf pow

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char

api-ms-win-crt-time-l1-1-0

_difftime64 _mktime64 _time64 _localtime64_s wcsftime

?CloseC2RUI@@YAXXZ ?ConfirmDialog@@YA_NKKKK@Z ?ConfirmOnlineRepairDialog@@YA_NXZ ?CreateC2RSplashScreen@@YAXAEAV?$shared_ptr@UIC2RSplashScreen@@@std@@PEAUHWND__@@@Z ?DestroyAdminUpdateDeadlineProgressAgent@@YAXXZ ?DestroyC2RSplashScreen@@YAXAEAV?$shared_ptr@UIC2RSplashScreen@@@std@@@Z ?DestroyErrorBagUI@@YAXXZ ?DestroyPackageLockedDialog@@YAXXZ ?DestroyProgressAgent@@YAXXZ ?GetLocalizedCountValue@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0HAEAV12@@Z ?GetString@@YA_NKPEA_WPEA_K@Z ?LoadC2RUIString@@YAXIAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z ?SetupAdminUpdateDeadlineProgressAgent@@YAXPEAUUpdatesAreLateState@@@Z ?ShowAdminUpdateDeadlineProgressAgent@@YAXXZ ?ShowBlockingDialog@@YAXPEB_W0_N@Z ?ShowC2RSplashScreen@@YAKAEAV?$shared_ptr@UIC2RSplashScreen@@@std@@H@Z ?ShowDisconnectedToast@@YAX_N@Z ?ShowDuringProcessShutDownDialog@@YAKP6AKPEAXPEAUIC2RWindow@@@Z0PEAUHWND__@@@Z ?ShowEnforcedUpdateDialog@@YAKP6AKPEAXPEAUIC2RWindow@@@Z0KW4PostponeScreenType@@@Z ?ShowErrorBagUI@@YAPEAXPEB_W0@Z ?ShowErrorDialog@@YAXPEB_W00@Z ?ShowFeatureBlockStreamingUI@@YAXHP6AKPEAXPEAUIC2RSplashScreen@@@Z0PEAKPEAUHWND__@@@Z ?ShowLessAggressiveProcessKillerDialog@@YA?AW4RET_BCLICK_PROCKILL_UI@@_N@Z ?ShowModificationInProgressDialog@@YAXPEB_W@Z ?ShowOffice15InstallationBlockedUI@@YAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?ShowPackageLockedDialog@@YAPEAXXZ ?ShowPartialRepairDialog@@YAXP6AKPEAXPEAUIC2RWindow@@@Z0@Z ?ShowPostPartialRepairDialog@@YAXXZ ?ShowPostUninstallDialog@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?ShowPrePartialRepairDialog@@YAXPEA_N@Z ?ShowPreUninstallDialog@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEA_N_N@Z ?ShowPrereqFailureDialog@@YA_NPEB_W00V?$shared_ptr@UIResourceStringLoader@@@std@@K0@Z ?ShowProcessKillerDialog@@YA?AW4RET_BCLICK_PROCKILL_UI@@AEBV?$list@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@_NV?$shared_ptr@UIResourceStringLoader@@@3@@Z ?ShowProcessKillerFailureDialog@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?ShowProgressAgent@@YAPEAUINotificationIcon@@XZ ?ShowProgressAgentInstallationBlocked@@YAPEAUINotificationIcon@@PEAXP6AX0PEAU1@@Z@Z ?ShowRepairDialog@@YA_NP6AKPEAXPEAUIC2RWindow@@@ZPEAUHWND__@@0@Z ?ShowRepairTypePickerDialog@@YA?AW4RepairType@@XZ ?ShowRestartNotifyDialog@@YAXXZ ?ShowRetryUI@@YAKKKK@Z ?ShowStreamingCompleteToast@@YAXXZ ?ShowSxSAppRemovalNotifyDialog@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_NPEA_N@Z ?ShowTouchlessAttachNotification@@YAXPEAUTouchlessAttachState@@@Z ?ShowUninstallDialog@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@P6AKPEAXPEAUIC2RWindow@@@Z1_N@Z ?ShowUnsupportedSxSConfigDialog@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?ShowUpdatesAreLateProgressAgent@@YAXPEAUUpdatesAreLateState@@_N@Z ?ShowUpdatesCompleteProgressAgent@@YAXXZ ?ShowUpdatesInProgressProgressAgent@@YAX_N@Z ?ShowUpdatesReadyToApplyDialog@@YAXPEB_WPEA_NK_N@Z ?ShowWaitingPackageLockedDialog@@YAXPEB_W0@Z ?StartApplyProgress@@YAXP6AKPEAXPEAUIC2RWindow@@@Z0@Z ?StartClientDownloadProgress@@YAXP6AKPEAXPEAUIC2RWindow@@@Z0@Z ?StartDetectionProgress@@YAXP6AKPEAXPEAUIC2RWindow@@@Z0@Z ?StartDownloadProgress@@YAXP6AKPEAXPEAUIC2RWindow@@@Z0@Z ?StartFullRepairProgress@@YAXP6AKPEAXPEAUIC2RWindow@@@Z0@Z ?StartPartialRepairProgress@@YAXP6AKPEAXPEAUIC2RWindow@@@Z0@Z ?StartProcessShutDownProgress@@YAXP6AKPEAXPEAUIC2RWindow@@@Z0@Z ?StartUninstallProgress@@YAXP6AKPEAXPEAUIC2RWindow@@@Z0@Z ?UpdateLabelForC2RSplashScreen@@YAXAEAV?$shared_ptr@UIC2RSplashScreen@@@std@@H@Z

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

763KB

Virtual Size

762KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

60KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

78KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

83KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ClientCapabilities.json

SHA256 0f3a635894e56d558346837a983473090c866b909872c482c2e9fac65b298ddb
MD5 96ce107c5fb9ce67de12d7df7a9275e8
SHA1 c08ce7c70789098bdc0270efb8b5d9384a97bb1e
SHA512 f78cdc665a4a1f43d1b461a29e7cc0a12c214a52f65fde73912436bec2cac063b6e59c273fdd2499bfbbe76e4ed56f0e903e262d3e6d2cc87428088beb9cea9a
TLSH
T1C4A00213E55358E2E7B8A75159394543E620014F2940417E3068914C5B745B90668715
MD5 SHA1 SHA512 TLSH

ClientEventLogMessages.man

SHA256 5ebff4d1844c5e7daaa7324c4980a1d5dca78aa2822d89c08342cddf1f20a29d
MD5 b276d756999dd883f62f167d87341759
SHA1 4805c936e0faafd6b46d0c52b175209ff8a46633
SHA512 1f9b27e55da435e2ded5ea3d92016a59f4a9f6857c1d596f89a65b89ad113a96b824256a2207a6d23d024987b9028768c4bb6b9ecc7691587fafec39adbeebd0
SSDEEP 96:MoT5kbWhuMLzLQL89nmROiiuxiGU3k9VPKG5KfV/AsJhmdhu9:XaWowmgfVx9
TLSH
T11ED1AE84F5E09D619EB59602EAE4A808F46C12E30616B4D9BCDD06571F37A07CEA732F
MD5 SHA1 SHA512 SSDEEP TLSH

FrequentOfficeUpdateSchedule.xml

SHA256 b46c64d3b367765dd4c5b94ee185f32fb1cda55e9ed4277d7a077b1004b85bc5
MD5 212010389bfbe93f1792da69b7b90cf0
SHA1 afbc1efc2c888e07f256e7eb68820475c1e80ebd
SHA512 c50fbf65f3451d5d800663ad6b23183ed07369a791306553d0a2271f901538a2332c526ad8e12fb8fa2ad0d392427d685dfb4364c37df06fd1b1f64059b63136
SSDEEP 96:tz2Hg4iX4U4y1mi0uYJknmi0Qpi0ZiGdiaipVMll7di0A4zrn+:pT4YEh6m9Qp9cxaee9n+
TLSH
T105A1385367EE1109F2F36A6CAEB654228E63BC515839C47D00AC640DCFF3E6299607B7
MD5 SHA1 SHA512 SSDEEP TLSH

InspectorOfficeGadget.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 d7fb6a56366cf6082b5f1a828e07a07c50cd72f5ac3e67d1e4551e1b21dfa5db
MD5 e683691ce46eebdae1fbdc538acb3335
SHA1 bab65744b63136b02a52ecfe7a716a7f169ebbf3
SHA512 dff0d33e8a908583817f834fd7ac6d827d9058333106aee10fdfd9d15e829270001fc6dd1ee4b7bba12963b58833b1955eb0ba505f9b34fddc8fc28e0be6a1ff
SSDEEP 1536:muEiyDAkvNyNG1zt4EUTdkxKL5+43zjvlzbyxlZzfpTY9zfo:Svj43zTlzbOlZ29k
TLSH
T1D0334A4167BC9202EABF1F70B1B5D5132D7CBB863930E92F0998E0991C633C19A6177B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

57:83:ef:66:30:46:b9:ca:29:48:97:a4:de:39:01:27:9c:1a:a4:83:3d:14:e2:4b:46:bc:0a:d5:c0:c7:60:5c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 30, 2025

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

57:83:ef:66:30:46:b9:ca:29:48:97:a4:de:39:01:27:9c:1a:a4:83:3d:14:e2:4b:46:bc:0a:d5:c0:c7:60:5c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 30, 2025

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c3:33:ab:2c:1a:f5:42:f2:c8:00:00:00:00:00:c3

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2025 - Jun 18, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:06:d7:bc:51:38:98:23:ec:2c:00:01:00:00:02:06

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 30, 2025 - Apr 22, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c0:5c:75:ff:f0:2a:66:b5:35:00:00:00:00:00:c0

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2025 - Jun 18, 2026

Minor OS version

0

Major OS version

4

Entry point

34562

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\dbs\el\omr\Target\x64\ship\click2run\x-none\InspectorOfficeGadget.pdb

IntegratedOffice.exe

IMPHASH b7960b34960ca229dcd8bd102a27476a
SHA256 98cae553a91bdb119a0c63482393299eb71448a9425023b659ec00354de1a1a6
MD5 3eae34c221f161cec8eabdbc6da0c0b6
SHA1 528f3f45f6721203f6eef9104a1dbffb231ae528
SHA512 8f5ab4436a973b950db71eae3f382642217c1b0cbf097d900fa31740f72c90f83208b9cc440bb1703b807554782c7e9c5984e5d11a7c232d08c3bba787a948e2
SSDEEP 49152:2FTddBMU1S2qb9xrQZBU0YjKDnwJDziRa/QSEMsz/9lON7bqK1IV5ITqlYAm+4Xg:eMU89SEzic4VMC/PwdX6ZqTK
TLSH
T143267D5662E405E9F0FBD2B9CA778533EBB2B8470631974F06A0C65B1F376205E2D722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

51:a2:94:bb:71:e5:91:9a:24:70:3b:8b:e5:3a:0b:3c:68:24:24:5b:cb:e0:ff:bf:3b:83:40:5d:d1:d7:6e:22

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 30, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

51:a2:94:bb:71:e5:91:9a:24:70:3b:8b:e5:3a:0b:3c:68:24:24:5b:cb:e0:ff:bf:3b:83:40:5d:d1:d7:6e:22

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 30, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:28:f0:a5:87:d7:f3:c8:1e:40:00:01:00:00:02:28

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:2b:bb:00:50:ff:4d:3b:9a:a1:00:01:00:00:02:2b

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

3327696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\dbs\el\omr\target\x64\ship\click2run\x-none\IntegratedOffice.pdb

oleaut32

VariantClear VariantInit

kernel32

GetUserGeoID GetLocaleInfoEx TryAcquireSRWLockExclusive SwitchToThread GetCurrentProcess GetModuleHandleExW GetLastError CompareStringEx GetProcAddress FreeLibrary IsWow64Process MultiByteToWideChar InitializeCriticalSectionEx DeleteCriticalSection DecodePointer SetLastError DeactivateActCtx ActivateActCtx LoadLibraryW FindActCtxSectionStringW CreateActCtxW GetModuleFileNameW QueryActCtxW OutputDebugStringA LocalFree FindClose UnmapViewOfFile CreateFileA CloseHandle GetFileSize CreateFileMappingW MapViewOfFile Sleep GetStringTypeExW LoadLibraryA FormatMessageA LocalAlloc GetSystemTimeAsFileTime GetUserDefaultLocaleName IsValidCodePage WideCharToMultiByte GetSystemTime SystemTimeToFileTime FileTimeToSystemTime GetCPInfoExW GetCurrentThreadId CreateEventExW ResetEvent SetEvent WaitForSingleObjectEx EnterCriticalSection LeaveCriticalSection ReleaseSemaphore CreateEventW WaitForSingleObject AcquireSRWLockExclusive ReleaseSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared CreateThread WaitForMultipleObjectsEx WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetModuleHandleW CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork OpenProcess GetExitCodeProcess GetProcessTimes GetTickCount64 TerminateProcess GetModuleFileNameA GetShortPathNameA K32GetModuleFileNameExW CreateProcessW LoadLibraryExW FindResourceW SizeofResource LoadResource VerSetConditionMask VerifyVersionInfoW GetCurrentProcessId GetDiskFreeSpaceExW CreateFileW DeviceIoControl GetComputerNameW RaiseException FormatMessageW GetLogicalProcessorInformation GetNativeSystemInfo GetSystemDirectoryW GetVersionExW HeapFree HeapAlloc GetProcessHeap ExpandEnvironmentStringsW GlobalMemoryStatusEx ReleaseMutex GetTempPathW GetLongPathNameW GetFinalPathNameByHandleW QueryDepthSList TryEnterCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList RtlCaptureStackBackTrace GetSystemPowerStatus GetTimeZoneInformation GetFileSizeEx GetFileAttributesW DeleteFileW AreFileApisANSI ReadFile HeapCreate GetFullPathNameW WriteFile GetDiskFreeSpaceW LockFile InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx CreateMutexW HeapValidate HeapSize GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile DeleteFileA HeapReAlloc GetSystemInfo HeapCompact HeapDestroy UnlockFile LockFileEx QueryPerformanceCounter GetTickCount FlushFileBuffers InitOnceExecuteOnce CreateDirectoryW GetCurrentThread OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA CreateFileMappingA GlobalAlloc GlobalFree QueryPerformanceFrequency QueryUnbiasedInterruptTime GetFileTime SetFilePointerEx SetFileTime GetOverlappedResult CancelIoEx FindFirstFileExW FindNextFileW GetFileType SetFileInformationByHandle GetTempFileNameW GetProcessAffinityMask CreateWaitableTimerW SetWaitableTimerEx CancelWaitableTimer WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetQueuedCompletionStatus FlsFree FlsSetValue FlsGetValue FlsAlloc IsDebuggerPresent WaitForMultipleObjects GetStartupInfoW CreateMemoryResourceNotification QueryProcessCycleTime OpenThread QueryThreadCycleTime IsSystemResumeAutomatic RtlCaptureContext K32GetProcessMemoryInfo LCMapStringEx GetPhysicallyInstalledSystemMemory GetProductInfo FindFirstFileW InitOnceBeginInitialize ProcessIdToSessionId GetExitCodeThread GetPriorityClass InitOnceComplete GetLocalTime LoadLibraryExA VirtualQuery VirtualProtect TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry GetCPInfo EncodePointer GetFileInformationByHandleEx RtlPcToFileHeader GetStringTypeW GetSystemDefaultLCID

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s __stdio_common_vswscanf __stdio_common_vsprintf_s __stdio_common_vswprintf_s __stdio_common_vsprintf _set_fmode __stdio_common_vsscanf __stdio_common_vsnwprintf_s _wfopen_s __p__commode fclose fgets fputs

api-ms-win-crt-runtime-l1-1-0

_clearfp _invalid_parameter_noinfo _errno abort _crt_atexit _endthreadex _register_onexit_function _initialize_onexit_table terminate _register_thread_local_exe_atexit_callback _c_exit _cexit _exit exit _initterm_e _initterm _invoke_watson _get_wide_winmain_command_line _initialize_wide_environment _beginthreadex _configure_wide_argv _set_app_type _seh_filter_exe

api-ms-win-crt-heap-l1-1-0

realloc calloc malloc free _set_new_mode _msize

api-ms-win-crt-string-l1-1-0

_stricmp strcspn isalnum strlen strnlen strncpy_s strcmp wcsnlen towlower wcsncmp wmemcpy_s wcscmp wcsncpy_s strncmp __strncnt wcscpy_s iswalpha iswspace _wcsicmp islower isdigit isspace _wcsdup isxdigit isalpha tolower isupper strcpy_s

api-ms-win-crt-convert-l1-1-0

_wtoi _itow_s strtof wcstoul wcstol strtol _i64tow_s _ui64toa_s strtod _wcstoi64 strtoll _wcstoui64 strtoull wcstod

api-ms-win-crt-math-l1-1-0

pow logf _ldclass _dclass round frexp log10 floor __setusermatherr _fdclass _dsign ceilf expf

api-ms-win-crt-locale-l1-1-0

localeconv _unlock_locales setlocale __initialize_lconv_for_unsigned_char _lock_locales __pctype_func ___lc_collate_cp_func _configthreadlocale ___mb_cur_max_func ___lc_locale_name_func ___lc_codepage_func

api-ms-win-crt-time-l1-1-0

_gmtime64_s _time64 wcsftime _localtime64_s

api-ms-win-crt-utility-l1-1-0

rand_s qsort rand

Name

.text

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

953KB

Virtual Size

953KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

129KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

MavInject32.exe

IMPHASH f1be5484ed0df9069f8a74a53c7fa301
SHA256 1bc0049a204bd7e91438fcfd130a9cd71dacc69e8e7c12722361ec3c64471b0b
MD5 b6c1fa0820c3d788c418254a1c80bcd4
SHA1 0530a3d1a2e6bc61b856693f29ac2cab4551b697
SHA512 6fdf26e8d9e0eee72d5eb0ad14d22fe8e76e5456116ede5698777a637703c442f14a19385b23ba1f8b5666d28ad68631d7c9e00979f25457ccf873a7480bac89
SSDEEP 3072:iCHGmrgTCeXNysmmt0fSoD7GSBcqF+FEH16D77B:iOGCu/mmt0fSoD7FJNe
TLSH
T10FF30977EF79F421D3BE1DB43B61E350CD7AB63004C11613E2B8D5ED0841AE1AB9692A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

f4:b5:b2:72:32:f2:67:27:20:b4:86:a1:21:3f:50:38:58:fd:8b:95:eb:c2:02:d1:cf:25:c8:67:33:1e:14:aa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

f4:b5:b2:72:32:f2:67:27:20:b4:86:a1:21:3f:50:38:58:fd:8b:95:eb:c2:02:d1:cf:25:c8:67:33:1e:14:aa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:2b:bb:00:50:ff:4d:3b:9a:a1:00:01:00:00:02:2b

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:29:0e:d5:64:2a:b4:97:f2:1a:00:01:00:00:02:29

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

31366

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\dbs\el\omr\target\x86\ship\appvisv\x-none\appv\mavinject32.pdb

kernel32

WriteProcessMemory SetLastError OutputDebugStringA GetModuleFileNameW InitializeCriticalSectionEx OpenProcess GetLastError CloseHandle LoadLibraryW HeapSetInformation GetProcAddress LocalFree DeleteCriticalSection ReadProcessMemory GetModuleHandleW WideCharToMultiByte IsDebuggerPresent OutputDebugStringW RaiseException GetCurrentProcess GetSystemInfo IsProcessorFeaturePresent GetStartupInfoW UnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetCurrentThreadId VirtualQuery LoadLibraryExA WaitForSingleObject DuplicateHandle VirtualAllocEx CreateRemoteThread VirtualFreeEx FreeLibrary TerminateProcess VirtualProtectEx VirtualQueryEx VirtualProtect SetUnhandledExceptionFilter

ntdll

NtQueryInformationProcess RtlNtStatusToDosError

vcruntime140

_CxxThrowException memcpy __current_exception _except_handler4_common memset memmove strrchr __CxxFrameHandler3 __std_terminate wcsstr _purecall __std_exception_copy __std_exception_destroy __current_exception_context

msvcp140

??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAK@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?eof@ios_base@std@@QBE_NXZ ?good@ios_base@std@@QBE_NXZ ??7ios_base@std@@QBE_NXZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PBX@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Xinvalid_argument@std@@YAXPBD@Z ?_Xbad_alloc@std@@YAXXZ ?uncaught_exceptions@std@@YAHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z

api-ms-win-crt-heap-l1-1-0

_callnewh malloc _set_new_mode free

api-ms-win-crt-runtime-l1-1-0

_c_exit _register_thread_local_exe_atexit_callback terminate _cexit _exit _crt_atexit _register_onexit_function exit _initialize_onexit_table _initterm_e _initterm _get_wide_winmain_command_line _errno _initialize_wide_environment _configure_wide_argv _invoke_watson _controlfp_s _set_app_type _seh_filter_exe

api-ms-win-crt-string-l1-1-0

_stricmp _wcsicmp _wcsupr_s iswdigit _wcslwr_s _wcsnicmp

api-ms-win-crt-convert-l1-1-0

wcstoul

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

OfficeC2RClient.exe

IMPHASH ceadbe173fc3df59c99eda779f7c475a
SHA256 7a6860861b976afdba17007f58bfb6ea8db7a8a959a07555abc967e7b6e06ee1
MD5 4c2b2ed7e67e4993f89cd42209308373
SHA1 940484ad7c3e7ac8b75aa3d8caeafc5986ac2369
SHA512 938142e74c56ed36cc77942e8531e421665fbdf43fb9b4e0b58cb0655d0e0da7d28366c7b156bf4d637d4be39061b5587a0999e90acb15fd932b3ff1c1dbfce6
SSDEEP 196608:TLB7hMQ29gsn2qCdGAhGXrAFr/YzcdgSJdEfvxEXftktBtttDhtEtttkTtttystU:/B5snYdGHXr4r/YzcdgodEfvKgY
TLSH
T126573756B2A807D6F2A6D13085765233F6B27C1D1B21D32B0D35F50ADEB72932C29F26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

23:cc:96:30:01:fa:b2:5c:67:69:89:fa:60:e9:2a:99:4b:c8:58:f2:a3:12:21:70:88:b1:04:fa:c6:b4:d8:01

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 30, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

23:cc:96:30:01:fa:b2:5c:67:69:89:fa:60:e9:2a:99:4b:c8:58:f2:a3:12:21:70:88:b1:04:fa:c6:b4:d8:01

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 30, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:24:3b:84:21:b0:2c:ac:64:22:00:01:00:00:02:24

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:F002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:20:24:e1:e6:e0:17:b9:b4:8e:00:01:00:00:02:20

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

12690512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\dbs\el\omr\target\x64\ship\click2run\x-none\OfficeC2RClient.pdb

kernel32

FlsFree FlsAlloc MultiByteToWideChar GetDriveTypeW CloseHandle CreateEventExW GetProcessHeap HeapFree GetCurrentProcessId CreateMutexW OpenThread CreateThread GetExitCodeThread GetCurrentThreadId GetTickCount64 Sleep FileTimeToSystemTime GetTimeFormatW GetModuleFileNameW ExpandEnvironmentStringsW LocaleNameToLCID TerminateProcess LoadLibraryExW SetLastError DeactivateActCtx ActivateActCtx LoadLibraryW FindActCtxSectionStringW CreateActCtxW QueryActCtxW OutputDebugStringA GetModuleHandleW SetEvent LocalFree GetSystemTime SystemTimeToFileTime SetProcessMitigationPolicy GetSystemPowerStatus ResetEvent DeleteFileW SetFileAttributesW FindClose UnmapViewOfFile CreateFileA GetFileSize CreateFileMappingW MapViewOfFile GetStringTypeExW GetUserDefaultLCID LoadLibraryA FormatMessageA WideCharToMultiByte OpenProcess GetExitCodeProcess GetProcessTimes GetSystemTimeAsFileTime GetModuleFileNameA GetShortPathNameA K32GetModuleFileNameExW CreateProcessW FindResourceW SizeofResource LoadResource VerSetConditionMask VerifyVersionInfoW HeapAlloc GetWindowsDirectoryW GetFileAttributesW GetSystemDirectoryW SearchPathW GetModuleHandleA VirtualProtect VirtualFree VirtualAlloc SuspendThread ResumeThread GetCurrentThread GetThreadContext FlushInstructionCache SetThreadContext VirtualQuery VirtualQueryEx LoadLibraryExA WaitForSingleObjectEx EnterCriticalSection LeaveCriticalSection CreateSemaphoreExW ReleaseSemaphore CreateEventW WaitForSingleObject AcquireSRWLockExclusive ReleaseSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared WaitForMultipleObjectsEx WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork GetFileAttributesA SetErrorMode CreateFileW GetComputerNameW ProcessIdToSessionId WaitForMultipleObjects OpenMutexW ReleaseMutex FindFirstFileExW SetFilePointerEx FindNextFileW GetFileType SetFilePointer CopyFileExW GetOverlappedResult GetFileTime GetFileAttributesExW SetFileInformationByHandle CreateDirectoryW MoveFileExW FindFirstFileW lstrcmpW RemoveDirectoryW DeviceIoControl ReadFile GetFileSizeEx CopyFileW GetTempFileNameW CompareFileTime FlushViewOfFile GetTempPathW GetFullPathNameW lstrlenW OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA CreateFileMappingA GlobalAlloc GlobalFree LocalAlloc GetUserDefaultLocaleName IsValidCodePage GetCPInfoExW CreateMutexExW GetProcessAffinityMask CreateWaitableTimerW SetWaitableTimerEx CancelWaitableTimer DeleteCriticalSection RaiseException GetVersionExW GetDiskFreeSpaceExW MulDiv FormatMessageW GetLogicalProcessorInformation GetNativeSystemInfo QueryDepthSList TryEnterCriticalSection IsWow64Process InterlockedPushEntrySList InterlockedPopEntrySList RtlCaptureStackBackTrace CompareStringOrdinal GetEnvironmentVariableW GetLongPathNameW GetFinalPathNameByHandleW OpenEventW K32GetProcessImageFileNameW CreateMemoryResourceNotification QueryProcessCycleTime QueryThreadCycleTime IsSystemResumeAutomatic GetTickCount QueryUnbiasedInterruptTime OutputDebugStringW RtlCaptureContext GetTimeZoneInformation AreFileApisANSI HeapCreate WriteFile GetDiskFreeSpaceW LockFile InitializeCriticalSection GetFullPathNameA SetEndOfFile UnlockFileEx HeapValidate HeapSize GetTempPathA GetDiskFreeSpaceA DeleteFileA HeapReAlloc GetSystemInfo HeapCompact HeapDestroy UnlockFile LockFileEx QueryPerformanceCounter FlushFileBuffers LCMapStringEx InitOnceExecuteOnce QueryPerformanceFrequency TzSpecificLocalTimeToSystemTime SetFileTime CancelIoEx WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetQueuedCompletionStatus FlsSetValue FlsGetValue IsDebuggerPresent GetStartupInfoW K32EnumProcessModulesEx RtlLookupFunctionEntry RtlVirtualUnwind GetLocalTime GetCurrentDirectoryW InitializeSRWLock InitializeConditionVariable K32GetModuleBaseNameW Thread32Next Thread32First CreateToolhelp32Snapshot GetThreadPriority Module32FirstW GetPriorityClass IsProcessorFeaturePresent ReadProcessMemory GetThreadTimes Module32NextW K32GetProcessMemoryInfo GetPhysicallyInstalledSystemMemory GetProductInfo Process32FirstW Process32NextW GlobalLock GlobalUnlock ReleaseActCtx GetUserGeoID GetLocaleInfoEx LCIDToLocaleName GetLocaleInfoW GetUserPreferredUILanguages GetACP IsValidLocale GetNumberFormatW LockResource EnumSystemLocalesEx GetSystemDefaultLocaleName GetDateFormatEx GetCalendarInfoEx GetThreadUILanguage GetSystemDefaultLCID GetTimeFormatEx K32EnumProcesses GetThreadLocale GlobalSize TlsGetValue TlsAlloc TlsFree FindAtomW GetAtomNameA GetAtomNameW GlobalFindAtomW DeleteAtom InitializeCriticalSectionAndSpinCount TlsSetValue AddAtomW GlobalAddAtomW GlobalDeleteAtom GetCurrencyFormatW InterlockedFlushSList SetWaitableTimer WerRegisterRuntimeExceptionModule WerUnregisterRuntimeExceptionModule GetFileInformationByHandleEx GetVolumePathNamesForVolumeNameW GetSystemDefaultLangID IsDBCSLeadByte FreeLibrary GlobalMemoryStatusEx InitializeCriticalSectionEx InitOnceComplete InitOnceBeginInitialize TryAcquireSRWLockShared TryAcquireSRWLockExclusive CreateSymbolicLinkW GetFileInformationByHandle UnhandledExceptionFilter WerRegisterFile SetUnhandledExceptionFilter EncodePointer SwitchToThread SetThreadPriority DeleteTimerQueueTimer CreateTimerQueueTimer ExpandEnvironmentStringsA GetProcAddress CompareStringEx GetLastError GetModuleHandleExW InitializeSListHead GetCurrentProcess

d3dcompiler_47

D3DCompile

oleaut32

SafeArrayUnlock SetErrorInfo GetErrorInfo SysAllocStringLen SysFreeString VariantInit VariantClear VariantChangeType VariantCopy VarCmp SysStringLen SysAllocString SysStringByteLen VarDecCmp VariantTimeToSystemTime VarDecFromR8 VarDecFromI4 VariantChangeTypeEx VarBstrCmp VarR8FromDec SafeArrayUnaccessData OleCreateFontIndirect VarDecRound VarR8FromStr VarR4FromStr VarDecSu VarDecAdd VarDecMul VarDecInt VarDecDiv SysAllocStringByteLen SafeArrayPutElement SafeArrayGetElement SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetDim SafeArrayLock SafeArrayCreate SafeArrayAccessData SafeArrayCreateVector SafeArrayDestroy

apiclient

?GetPipelineStreamedMegabytes@@YAJV?$shared_ptr@VORpcClient@@@std@@PEAK@Z ?GetClickToRunData@@YAJV?$shared_ptr@VORpcClient@@@std@@HPEB_WPEA_WK@Z ?QueueUpdateOnlyApply@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W@Z ?QueueUpdateEx@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_WK@Z ?ModifyOfficeProducts@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W1111KH@Z ?GetPipelineTotalMegabytes@@YAJV?$shared_ptr@VORpcClient@@@std@@PEAK@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy _purecall __C_specific_handler _set_se_translator __std_type_info_compare __RTtypeid __std_type_info_name __std_terminate wcsrchr wcschr strchr strrchr wcsstr strstr memset memcpy memmove __current_exception __current_exception_context __C_specific_handler_noexcept _CxxThrowException memcmp memchr __RTDynamicCast

msvcp140

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@N@Z ?tellp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?narrow@?$ctype@_W@std@@QEBAD_WD@Z ?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@M@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PEAV32@@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ _Mtx_init_in_situ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uncaught_exceptions@std@@YAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?exceptions@ios_base@std@@QEAAXH@Z ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?widen@?$ctype@D@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?narrow@?$ctype@D@std@@QEBADDD@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?_Xbad_function_call@std@@YAXXZ ?classic@locale@std@@SAAEBV12@XZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Mtx_unlock _Thrd_id ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z _Mbrtowc ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?id@?$numpunct@_W@std@@2V0locale@2@A _Cnd_init_in_situ ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z _Thrd_detach _Cnd_wait _Cnd_do_broadcast_at_thread_exit _Query_perf_frequency _Query_perf_counter _Xtime_get_ticks ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ?toupper@?$ctype@_W@std@@QEBA_W_W@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$ctype@_W@std@@2V0locale@2@A ?__ExceptionPtrToBool@@YA_NPEBX@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z _Thrd_yield ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?id@?$collate@_W@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z _Wcsxfrm _Wcscoll ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAG@Z ?ignore@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_JG@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@F@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_J@Z ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ?id@?$collate@D@std@@2V0locale@2@A _Strxfrm _Strcoll ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?_Random_device@std@@YAIXZ _Cnd_broadcast ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ _Mtx_trylock _Thrd_join _Cnd_signal ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?widen@?$ctype@_W@std@@QEBA_WD@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z

api-ms-win-crt-heap-l1-1-0

_set_new_mode _msize calloc realloc free malloc

api-ms-win-crt-stdio-l1-1-0

_wfopen_s fclose __stdio_common_vfwprintf_s __stdio_common_vsprintf __stdio_common_vsnprintf_s __acrt_iob_func __stdio_common_vsscanf fgets fputs _write __stdio_common_vswscanf __stdio_common_vswprintf __stdio_common_vsprintf_s __stdio_common_vsnwprintf_s fflush _set_fmode fopen_s __p__commode fwrite __stdio_common_vswprintf_s __stdio_common_vfprintf

api-ms-win-crt-runtime-l1-1-0

_exit _register_onexit_function _initialize_onexit_table _register_thread_local_exe_atexit_callback _invoke_watson _c_exit _cexit _initterm_e _endthreadex _errno _invalid_parameter_noinfo _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv abort _set_app_type _seh_filter_exe terminate _beginthreadex strerror_s _crt_atexit _initterm _resetstkoflw _invalid_parameter_noinfo_noreturn _clearfp exit

api-ms-win-crt-string-l1-1-0

wcsncpy_s strncmp strcspn strncpy_s towlower strcpy_s isgraph isalnum strcat_s strspn strpbrk strcoll isupper tolower isalpha isxdigit iscntrl wcsncat_s wcsncmp wcstok_s wcscat_s _stricmp strnlen strcmp wcsnlen iswalnum _wcsicmp wcscmp isspace wmemcpy_s ispunct wcscpy_s iswalpha iswspace towupper toupper islower isdigit

api-ms-win-crt-convert-l1-1-0

_ui64toa_s _wtof wcstof strtof wcstoull _ui64tow_s _itow_s _ultow_s _wtoi wcstol strtol strtoul _wtoi64 _i64tow_s mbstowcs_s wcstombs_s _wcstoui64 wcstoll _wtol strtoull strtod _wcstoi64 wcstoul wcstod strtoll _wcstod_l

api-ms-win-crt-math-l1-1-0

sqrt sinf sin logf _fdsign fmodf pow fmod _ldsign log log10 roundf powf _dsign __setusermatherr trunc round sqrtf _isnan floorf _finite floor expf exp cosf cos ceilf ceil atanf _dclass _fdclass _ldclass acos ldexp tan acosf asin asinf atan2 atan2f frexp nan

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char ___lc_codepage_func _create_locale _free_locale localeconv _configthreadlocale

api-ms-win-crt-filesystem-l1-1-0

_wmakepath_s _wsplitpath_s

api-ms-win-crt-time-l1-1-0

_difftime64 wcsftime _gmtime64_s clock _localtime64_s _time64 _mktime64

api-ms-win-crt-utility-l1-1-0

qsort rand_s bsearch rand

Name

.text

Size

12.4MB

Virtual Size

12.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8.3MB

Virtual Size

8.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

445KB

Virtual Size

477KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

492KB

Virtual Size

492KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5.3MB

Virtual Size

5.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

256KB

Virtual Size

256KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=6, id=257, version=35207,

count=7, id=259, version=35207,

count=10, id=260, version=35207,

count=51, id=261, version=35207,

count=8, id=109, productName=VS2005 build 50727, version=50727,

count=1, id=125, productName=VS2005 build 50727, version=50727,

count=2, id=257, version=35214,

count=1, id=263, version=33145,

count=1, id=262, version=33145,

count=3, id=259, version=33145,

count=3, id=261, version=33145,

count=31, id=260, version=33145,

count=7, id=257, version=33145,

count=2188, id=1, productName=Unmarked objects,

count=1, id=259, version=35214,

count=3802, id=265, version=35214,

count=1, id=255, version=35214,

count=1, id=151,

count=1, id=258, version=35214,

OfficeC2RCom.dll

IMPHASH 923065e5fa7d9bef5eaa7eeb8b18ff88
SHA256 96ed066a7f91ec59ae6d2012c80a4dc47b267b49efadc97df319379548437e41
MD5 2ce04d348a90e30e56c60fa2fc2b47e5
SHA1 8738b4bd42bd49f6d8ce595c0fe57ade50988832
SHA512 09c964b2a5f6719a5b8de58c66754cac02ae88d12faaf705c178f139809fa13f62e75f74f250c3bbaf18b58804e792028cc3b535d6da691fca584bddc8ce07f7
SSDEEP 6144:wdl0+h1d1Hq2Rq812lV6eheyHnkgbeXl0K2:wdl0gdFAV6ehpeVI
TLSH
T1D194A641A7F91555F5F3ABB8AEB78431DAB2BCA65A31C20E1260954E4E33F40DD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x64 arch:x64

Digest

8c:4d:fa:ed:5a:51:7d:b7:01:8b:06:75:e9:d1:d6:4c:28:d8:10:65:fd:92:08:7a:b7:c2:a4:f7:e5:79:cf:91

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 30, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

8c:4d:fa:ed:5a:51:7d:b7:01:8b:06:75:e9:d1:d6:4c:28:d8:10:65:fd:92:08:7a:b7:c2:a4:f7:e5:79:cf:91

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 30, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:10:ab:cd:e4:16:18:ef:39:b0:00:01:00:00:02:10

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:321A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1a:a9:a0:1d:06:a0:0f:43:aa:00:01:00:00:02:1a

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Minor OS version

1

Major OS version

6

Entry point

154912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d:\dbs\el\omr\target\x64\ship\click2run\x-none\OfficeC2RCom.pdb

oleaut32

SysAllocString

kernel32

LoadLibraryExA GetLastError CompareStringEx GetCurrentProcess IsWow64Process FreeLibrary GetProcAddress CloseHandle SetLastError GetModuleFileNameW LocalFree GetSystemTimeAsFileTime GetCurrentThreadId GetModuleHandleW K32GetProcessMemoryInfo GlobalMemoryStatusEx GetCurrentProcessId FileTimeToSystemTime IsValidCodePage MultiByteToWideChar WideCharToMultiByte TerminateProcess GetModuleFileNameA GetShortPathNameA LoadLibraryExW InitializeCriticalSectionEx DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateEventExW HeapFree GetProcessHeap QueryPerformanceCounter GlobalFree CreateWaitableTimerW RaiseException QueryDepthSList InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList InitOnceBeginInitialize InitOnceComplete TryAcquireSRWLockExclusive AcquireSRWLockExclusive VirtualQuery VirtualProtect GetSystemInfo TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedFlushSList RtlUnwindEx IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WakeAllConditionVariable DecodePointer EncodePointer RtlPcToFileHeader SleepConditionVariableSRW AcquireSRWLockShared ReleaseSRWLockShared ReleaseSRWLockExclusive

apiclient

?QueueUpdateEx@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_WK@Z ?GetClickToRunDataEx@@YAJV?$shared_ptr@VORpcClient@@@std@@HPEB_WPEA_WKK@Z ?CancelUpdate@@YAJV?$shared_ptr@VORpcClient@@@std@@@Z

api-ms-win-crt-heap-l1-1-0

free malloc calloc

api-ms-win-crt-runtime-l1-1-0

terminate _invoke_watson _initterm _initterm_e _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _cexit abort

api-ms-win-crt-string-l1-1-0

strcmp wcscmp wcsnlen wcsncmp wcscpy_s wcsncpy_s isdigit strcpy_s towlower strlen

api-ms-win-crt-convert-l1-1-0

wcstoul

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnwprintf_s __stdio_common_vswprintf_s

api-ms-win-crt-math-l1-1-0

pow log10 floor _dclass _fdclass round

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char

Name

.text

Size

173KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

205KB

Virtual Size

205KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

OfficeC2RCom_arm64.dll

SHA256 9edba7d8ad2b98dcf2cf250d39ab49833fe31a95419baaff846a5f6a2174f79c
MD5 295f11e6d0097e50bb8709c6afff1e13
SHA1 7aa2d612efaf96164bf864f9d5e4ff799495b8e7
SHA512 bcbd892c70427f74af5e0c5e230f4cc14a185bfca56c3bbaf34f91d3b4bcb75e8b1172c180d175d0f632d8e4edb3bb0f4cca335bc22d67193d03e4a8f7dd640a
SSDEEP 12288:GYGGX/LYjMph0lhSMXl+B5IXwvaa5jQPa:K6/Lhh0lhSMXlu5IXw7b
TLSH
T1F625D5916BEE6955F2F3AB789E778550297BBCBA5931C10F3052110E8D7AFC0CA60723
MD5 SHA1 SHA512 SSDEEP TLSH

OfficeClickToRun.exe

IMPHASH 2fb65e410e938ac6d20a6e081954fe8f
SHA256 9cfb2ad81cc46d5d1f861cdd927a4385a4056431f32523ff2da2fedaa712a624
MD5 1dd5c0ff4d553bc7921b4291b48b7053
SHA1 ffe00b4bc7e5d33a8514a5e00e976e3a52c3f95f
SHA512 c4b8a0da0d17dd5c37ed842ee5cbb82f95ec426d9dcafc671c7c2464b4592eb305d5392941cc81518c0248046c33961b014496f8be54e3c4fe9ea21c41254467
SSDEEP 196608:+lvpPEKrGsk0WiKj390jB3KgP4PEKheFn4Raj:+lJrGsk0Wiy3iB3/P4PEKheVbj
TLSH
T131D64A85A2E921E5E1F6E1B8C96E44B2EE727C16D530A31E0AF1C6C61F373509F39712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

80:7e:59:87:82:bb:20:40:82:86:b0:22:0f:5c:ef:16:9e:2f:ef:59:a7:00:25:85:81:38:71:21:d3:2d:35:96

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 30, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

80:7e:59:87:82:bb:20:40:82:86:b0:22:0f:5c:ef:16:9e:2f:ef:59:a7:00:25:85:81:38:71:21:d3:2d:35:96

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 30, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:26:35:b4:3e:67:43:93:f6:1f:00:01:00:00:02:26

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:2b:bb:00:50:ff:4d:3b:9a:a1:00:01:00:00:02:2b

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

4046512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\dbs\el\omr\target\x64\ship\click2run\x-none\OfficeClickToRun.pdb

kernel32

GetCurrentProcessId ReleaseMutex LocaleNameToLCID FindClose UnmapViewOfFile CreateFileA CloseHandle GetFileSize CreateFileMappingW MapViewOfFile GetStringTypeExW LoadLibraryA FormatMessageA EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection TlsAlloc TlsFree VerSetConditionMask VerifyVersionInfoW ReadFile GetFileSizeEx WriteFile SetFilePointer CreateFileW GetOverlappedResult GetModuleHandleA FormatMessageW FileTimeToSystemTime SystemTimeToFileTime GetSystemTimeAsFileTime GetSystemTime TlsSetValue CreateWaitableTimerW WaitForMultipleObjects GetQueuedCompletionStatus WaitForSingleObject PostQueuedCompletionStatus WideCharToMultiByte TlsGetValue CreateIoCompletionPort GlobalMemoryStatusEx QueryPerformanceCounter GetStdHandle GetCurrentThreadId GetFileType FindFirstFileW FindNextFileW FlsGetValue FlsSetValue CreateEventExW ResetEvent WaitForSingleObjectEx ReleaseSemaphore AcquireSRWLockExclusive ReleaseSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared CreateThread WaitForMultipleObjectsEx WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork RaiseException OpenProcess GetExitCodeProcess GetProcessTimes GetTickCount64 TerminateProcess GetModuleFileNameA GetShortPathNameA K32GetModuleFileNameExW CreateProcessW FindResourceW SizeofResource LoadResource GetVersionExW GetUserDefaultLocaleName IsValidCodePage GetCPInfoExW GetDiskFreeSpaceExW GetWindowsDirectoryW DeviceIoControl SetErrorMode GetComputerNameW MulDiv GetLogicalProcessorInformation GetNativeSystemInfo GetSystemDirectoryW HeapFree HeapAlloc GetProcessHeap OpenEventW CreateMutexExW OpenMutexW GetTempPathW CompareStringOrdinal GetLongPathNameW GetFinalPathNameByHandleW TzSpecificLocalTimeToSystemTime QueryUnbiasedInterruptTime IsDebuggerPresent GetFileAttributesExW FindFirstFileExW MoveFileExW CreateDirectoryW RemoveDirectoryW SetFileAttributesW SetFilePointerEx SetEndOfFile FlushFileBuffers LockFileEx UnlockFileEx GetFileInformationByHandleEx GetCurrentDirectoryW GetTempFileNameW CopyFileExW GetVolumePathNamesForVolumeNameW SetFileInformationByHandle K32EnumProcessModulesEx RtlCaptureStackBackTrace OpenThread RtlLookupFunctionEntry GlobalAddAtomW GetFileAttributesW GetFileTime QueryPerformanceFrequency GlobalFree GlobalAlloc SetFileTime CancelIoEx GetShortPathNameW GetProcessAffinityMask SetWaitableTimerEx CancelWaitableTimer QueryDepthSList TryEnterCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList InitOnceExecuteOnce WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW GetThreadIOPendingFlag GetCurrentThread lstrlenW GetStartupInfoW CreateMemoryResourceNotification GetSystemPowerStatus QueryProcessCycleTime QueryThreadCycleTime IsSystemResumeAutomatic OutputDebugStringW RtlCaptureContext CreateMutexW VirtualAlloc OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA CreateFileMappingA LocalAlloc LCMapStringEx K32GetProcessMemoryInfo GetLocalTime GetThreadLocale DeleteFileA GetTempPathA lstrcmpW CopyFileW FlushViewOfFile GetFullPathNameW GetPriorityClass K32EnumProcesses ProcessIdToSessionId GetTimeZoneInformation GetVolumeInformationW GetExitCodeThread GetGeoInfoW GetUserGeoID GetLocaleInfoEx LCIDToLocaleName GetUserPreferredUILanguages GetACP LockResource EnumSystemLocalesEx GetSystemDefaultLocaleName GetFileAttributesA LoadLibraryExA GetSystemDefaultLCID GetUserDefaultUILanguage AreFileApisANSI HeapCreate GetDiskFreeSpaceW LockFile InitializeCriticalSection GetFullPathNameA HeapValidate HeapSize GetDiskFreeSpaceA HeapReAlloc GetSystemInfo HeapCompact HeapDestroy UnlockFile InitializeSRWLock InitializeConditionVariable K32GetModuleBaseNameW lstrcmpiW IsProcessorFeaturePresent VirtualQuery GetPhysicallyInstalledSystemMemory GetProductInfo WerRegisterRuntimeExceptionModule WerUnregisterRuntimeExceptionModule GetTimeFormatW GetDateFormatW GetFileInformationByHandle GetDriveTypeW ExpandEnvironmentStringsW GlobalFindAtomW CreateEventW SetEvent GetCurrentProcess DeleteFileW FlsAlloc FlsFree GetTickCount SetProcessMitigationPolicy Sleep OutputDebugStringA QueryActCtxW CreateActCtxW FindActCtxSectionStringW LoadLibraryW ActivateActCtx DeactivateActCtx SetLastError VirtualProtect InitOnceBeginInitialize InitOnceComplete CreateSymbolicLinkW CreateHardLinkW SetUnhandledExceptionFilter UnhandledExceptionFilter DeleteTimerQueueTimer LocalFree GetModuleFileNameW GetModuleHandleW MultiByteToWideChar DeleteCriticalSection InitializeCriticalSectionEx LoadLibraryExW IsWow64Process FreeLibrary GetProcAddress CompareStringEx GetLastError GetModuleHandleExW RtlVirtualUnwind CreateTimerQueueTimer SetCurrentDirectoryW

oleaut32

GetErrorInfo UnRegisterTypeLi RegisterTypeLi SysAllocString SysStringLen SetErrorInfo LoadTypeLi SysFreeString VariantInit VariantClear

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__RTDynamicCast wcsstr memset memcmp _CxxThrowException wcsrchr wcschr memcpy __C_specific_handler_noexcept __current_exception __current_exception_context __std_exception_destroy __std_exception_copy __std_terminate __C_specific_handler _purecall __std_type_info_compare __RTtypeid __std_type_info_name strchr strrchr strstr memchr memmove

msvcp140

?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?flags@ios_base@std@@QEBAHXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?good@ios_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?width@ios_base@std@@QEBA_JXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?exceptions@ios_base@std@@QEAAXH@Z ?flags@ios_base@std@@QEAAHH@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ?precision@ios_base@std@@QEAA_J_J@Z ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?widen@?$ctype@D@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?narrow@?$ctype@D@std@@QEBADDD@Z ?is@?$ctype@D@std@@QEBA_NFD@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Throw_Cpp_error@std@@YAXH@Z _Thrd_join _Thrd_id ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z _Mtx_unlock _Mtx_lock _Cnd_do_broadcast_at_thread_exit ?classic@locale@std@@SAAEBV12@XZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ ?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z ?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ??0task_continuation_context@Concurrency@@AEAA@XZ ?__ExceptionPtrCreate@@YAXPEAX@Z _Cnd_init_in_situ ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?_Xbad_function_call@std@@YAXXZ ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z _Mtx_init_in_situ _Cnd_wait _Cnd_broadcast ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEA_K@Z ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?fail@ios_base@std@@QEBA_NXZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?id@?$ctype@_W@std@@2V0locale@2@A ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ??Bios_base@std@@QEBA_NXZ ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_J@Z _Query_perf_frequency ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Random_device@std@@YAIXZ _Query_perf_counter ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?toupper@?$ctype@_W@std@@QEBA_W_W@Z _Xtime_get_ticks ?is@?$ctype@_W@std@@QEBA_NF_W@Z _Mbrtowc ?id@?$numpunct@_W@std@@2V0locale@2@A ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?_Xinvalid_argument@std@@YAXPEBD@Z _Thrd_detach _Cnd_register_at_thread_exit ?id@?$collate@_W@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z _Wcsxfrm _Wcscoll ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?setf@ios_base@std@@QEAAHH@Z ?setf@ios_base@std@@QEAAHHH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@F@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA_W_W@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?tellp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?id@?$collate@D@std@@2V0locale@2@A _Strxfrm _Strcoll ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ _Thrd_yield ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ _Mtx_trylock _Cnd_signal ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QEBA_JXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PEAV32@@Z ?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ _Cnd_unregister_at_thread_exit ?narrow@?$ctype@_W@std@@QEBAD_WD@Z ?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ ?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ?getline@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEA_W_J@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Id_cnt@id@locale@std@@0HA ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?pubsync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?pubimbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ?pubseekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?sgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEAD_J@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@AEAD@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ?width@ios_base@std@@QEAA_J_J@Z

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode _msize realloc calloc free

api-ms-win-crt-stdio-l1-1-0

fsetpos _fseeki64 _get_stream_buffer_pointers ungetc __stdio_common_vsscanf setvbuf fgetpos _write fgetc fputc fgetwc ungetwc fputwc fread __stdio_common_vswprintf_s fputs __acrt_iob_func _set_fmode fwrite __stdio_common_vswscanf __stdio_common_vsnwprintf_s fgets __p__commode __stdio_common_vsnprintf_s __stdio_common_vswprintf __stdio_common_vsprintf_s _wfopen_s __stdio_common_vsprintf fflush fclose

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function strerror_s _invalid_parameter_noinfo _clearfp _initialize_onexit_table _errno _beginthreadex terminate strerror abort _register_thread_local_exe_atexit_callback _c_exit _endthreadex _cexit exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _crt_atexit _invoke_watson _exit raise

api-ms-win-crt-string-l1-1-0

wcsncat_s wcsncmp strncpy_s wmemcpy_s _stricmp towupper strcmp isalnum isupper tolower wcscmp strncmp _strnicmp isalpha strcspn isxdigit wcscat_s strnlen wcsnlen isdigit _wcsnicmp wcstok_s _wcsicmp wcsncpy_s wcscpy_s iswalpha iswspace towlower

api-ms-win-crt-convert-l1-1-0

_wcstoi64 _ui64tow_s strtod _ui64toa_s _wcstoui64 strtoull _i64tow_s strtoll strtof wcstoul strtoul _itow_s atoi _wtoi64 _ultow_s _wtol strtol wcstol wcstod wcstoull _wtof _wtoi wcstoll

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char localeconv ___lc_codepage_func _configthreadlocale

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64 _mktime64 _difftime64 _gmtime64_s wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s qsort srand rand

api-ms-win-crt-math-l1-1-0

frexp __setusermatherr _fdsign _dsign _ldsign nan _dclass _fdclass round _ldclass pow ceilf expf floor log10 logf ldexp

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s _unlock_file _lock_file

ntdll

NtSetInformationKey

apiclient

?QueueTaskItem@@YAJV?$shared_ptr@VORpcClient@@@std@@U_GUID@@@Z ?KillQueuedProcesses@@YAJV?$shared_ptr@VORpcClient@@@std@@@Z ?RestartKilledProcesses@@YAJV?$shared_ptr@VORpcClient@@@std@@@Z ?InvokeProcessKillerEx@@YAJV?$shared_ptr@VORpcClient@@@std@@HHHPEB_W1PEAK@Z ?InvokeProcessKiller@@YAJV?$shared_ptr@VORpcClient@@@std@@HHHPEB_WPEAK@Z ?GetClickToRunData@@YAJV?$shared_ptr@VORpcClient@@@std@@HPEB_WPEA_WK@Z ?PromptUser@@YAJV?$shared_ptr@VORpcClient@@@std@@KPEAKPEB_W@Z ?RaiseTaskErrorEvent3@@YAJV?$shared_ptr@VORpcClient@@@std@@KKKKPEB_W@Z ?RaiseTaskToastEvent@@YAJV?$shared_ptr@VORpcClient@@@std@@H@Z ?RaiseTaskDialogEvent@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W1@Z ?RaiseTaskProgressEvent@@YAJV?$shared_ptr@VORpcClient@@@std@@U_GUID@@K@Z ?GetServiceVersion@@YAJV?$shared_ptr@VORpcClient@@@std@@PEA_WK@Z ?SetFeatureFlightValues@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W1@Z ?GetProcessPoolProcessId@@YAJV?$shared_ptr@VORpcClient@@@std@@PEAK@Z ?CompleteUpdateRegistration@@YAJV?$shared_ptr@VORpcClient@@@std@@@Z

Name

.text

Size

8.1MB

Virtual Size

8.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

356KB

Virtual Size

405KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

391KB

Virtual Size

390KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

215KB

Virtual Size

215KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

OfficeOEMPlugin.dll

IMPHASH 402ee1adee90bb9f7913eb8a758c1de4
SHA256 7f5e190160d1d7f2be0cfbe4a9da4f667e5a51bc5a238590b5e281bcaeebede5
MD5 d9bd103d3f2ecf6c0df9f3309be8340f
SHA1 0e66a37831febb037036d9c04cb6266bc72afeee
SHA512 0f4c067a2cffd082056da08883ca0d2e2fd45f4debfddf95c410d5de4aeaddca27c908ca2142f6c644512808651a6e1f76df60f1ea9b4c5071a694972a33c1bc
SSDEEP 3072:Yp7v/nyaT8y8cx9C+J2Yob9gQeU3WzzbON791ON:Onn9AyzE1bveBvCNJG
TLSH
T1E9E31742B3E841A6E1AB967489B79931EB77BD510831D30F336CE24E1F73B619D24322
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x64 arch:x64

Digest

ed:d2:f2:6c:9d:02:6d:66:2c:70:54:f0:0b:d4:e6:10:79:da:1f:0a:ad:9e:d5:11:5c:2b:c4:44:06:85:37:3c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 7, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

ed:d2:f2:6c:9d:02:6d:66:2c:70:54:f0:0b:d4:e6:10:79:da:1f:0a:ad:9e:d5:11:5c:2b:c4:44:06:85:37:3c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 7, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c3:33:ab:2c:1a:f5:42:f2:c8:00:00:00:00:00:c3

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2025 - Jun 18, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:24:3b:84:21:b0:2c:ac:64:22:00:01:00:00:02:24

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:F002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:20:24:e1:e6:e0:17:b9:b4:8e:00:01:00:00:02:20

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

45456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d:\dbs\el\omr\target\x64\ship\click2run\x-none\OfficeOEMPlugin.pdb

oleaut32

LoadRegTypeLi VariantInit SysAllocStringByteLen VariantChangeType VariantClear UnRegisterTypeLi LoadTypeLi RegisterTypeLi SysAllocString SysStringLen VarUI4FromStr SysFreeString

kernel32

LocalFree SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive QueryPerformanceFrequency QueryPerformanceCounter OutputDebugStringW IsDebuggerPresent GetCurrentThreadId TlsFree CreateActCtxW ActivateActCtx SetLastError GetModuleHandleExW OutputDebugStringA GetModuleFileNameW FindActCtxSectionStringW InitializeCriticalSectionEx DeactivateActCtx QueryActCtxW GetLastError RaiseException LoadLibraryW DecodePointer DeleteCriticalSection SizeofResource SetThreadLocale EnterCriticalSection GetThreadLocale EncodePointer LeaveCriticalSection MultiByteToWideChar LoadResource FindResourceW GetProcAddress GetModuleHandleW FreeLibrary lstrcmpiW LoadLibraryExW WriteFile ExpandEnvironmentStringsW CreateFileW CloseHandle SystemTimeToFileTime GetSystemTime GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedFlushSList RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId WakeAllConditionVariable IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetSystemTimeAsFileTime Sleep

api-ms-win-crt-heap-l1-1-0

free _recalloc calloc malloc _callnewh

api-ms-win-crt-string-l1-1-0

wcsncpy_s strlen strcpy_s wcsncmp wcscat_s wcscpy_s _wcsnicmp strcmp

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo _invoke_watson _initterm abort _initialize_onexit_table _errno _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll terminate _initterm_e

api-ms-win-crt-convert-l1-1-0

_ui64tow_s

Name

.text

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

540B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

OfficeOEMPlugin_arm64.dll

SHA256 a49ad21c28f4f72022ab2500714675988946042e82f33507b1b47f27a3400110
MD5 486f17c0910c127fc4abffa773ab6df3
SHA1 45e19ca1062a4447ab0f2744b54b35a8f13c22ef
SHA512 105faf5c037998139b0e9991726675948354bb1943f18c59c906f3ff30a7fdddda573d04ca5b5519ce524244309ef9a6e60eed78dd4e9ae040036d3d98784681
SSDEEP 3072:VpNU1PnRsaL1hVo6ujy2KhwDBnI+653t9nc3bXpQ6WAmOi3gm+ONCVwlszkeWGNq:xU1fLroqwtIv9nc3VNtOkwazEGHXc
TLSH
T14D64B48277CD6891E6D3A23C8D7685403637B9690A31D247326E220EDFBFBC5CD60766
MD5 SHA1 SHA512 SSDEEP TLSH

PushRegistrationTask.xml

SHA256 1255b4ef092af177b482c7691c81683c5d89547c00b99f036a39c2ee378cabbe
MD5 fa572be944e90c6a3c630ac822918512
SHA1 f7e28a4c08aa3e6c5d2ed6e2454c69da7c71e36d
SHA512 2e7b40d17932d3348d0c00b99e06d3aeba107aa621148a519432bd8c083e931933a8638a1b9caef13588fb69eb8eba5abfc7cd163b7b7d77c7a7e5b1545ad18a
SSDEEP 96:cbCLO4iruAGWyhknRi9EpKGdQipcmq9ll79YoWFRQ/:JO42u1Wa6Rf0vXDWDQ/
TLSH
T154913A5367EA1119F2F32B6CAEB654228E67BC555D38C46D00AC610DCBF3E2285607B7
MD5 SHA1 SHA512 SSDEEP TLSH

ServiceWatcherSchedule.xml

SHA256 f3b0dc236db906b513e7faa2185ee38112079a71cfb8dcf489f8c022f292c82d
MD5 eebd1ed93f54772302324ae7fc741ac7
SHA1 d7fcd6ebb69ae3f025a71244e83cfab25c1ee6e4
SHA512 5719a553213d3e64bb618a86b6766407cfcc4db1ab44acb2cc3768241ce151f105108de3b23d03181cfc61c9c27227b79e229ed906e7b865b476772014abcb96
TLSH
T18381474367EE1119F1F76B6CAEB750228E67BC415938C42D00AC240DCBF7E2289607BB
MD5 SHA1 SHA512 TLSH

SharedPerformance.man

SHA256 ee9d74a95d2d3f93f0eb49a136dc930d3ee16d66ec1fa0113524142329296d2f
MD5 bf931a880c7e1c82eb008e3d4b01fa7d
SHA1 8ad81f6f496bac7581241ab1965dd1dd3875c935
SHA512 eaf8c3b42ea635a246b95dcc2329e574b1f0795e1c43d9a69b77af4ec6db19e5ad06616cce5018f90f459e4503822647c4e804af1f3d26596edd3676d032a820
SSDEEP 12288:ANpv3z/gtiHRJO1Qht/cAJ7FPLsKsqhdL5qoGIzFRkYxtM9wZ8xm/ihQqmiU37K0:6/gtiHRJO1QhCQ7FPYKsqhdL5qoGIvqU
TLSH
T1DDF40080F8D4BD425DB48607A3F93018D56D3097156AE0EE3DCE22151F79A37A2B2BBD
MD5 SHA1 SHA512 SSDEEP TLSH

SubsystemController.man

SHA256 7c112558cd5777f787e3d4bcced67b08cc63541294635e8bdbc0063c3c7fa081
MD5 aacf231fb3529afd5b2488704f8f9b82
SHA1 94d3c6c0a709eea63f36cb73bcdc632e96069903
SHA512 b34916c7c9d38fc24c81cbc448ba37de3aec98ee17bead2a1ded3b0caceefb921350003bc1ff638bb3ab0bf7a8fdbc7cac2cd3a5826ea012afe6b1977e1515f3
SSDEEP 384:NlGP5Uh0FCVMOUZCcRZnS/MF6ZLizWVROi3X+oyC/+Sc/NJ2zy3lsU1NEB+fbbrI:NlGP53CBMdTbV2y2Esn
TLSH
T15AC2D2C0F57CBCB55A86251BE7F85C5451BEBBE203A810E6B4F83937B31A6954B30B21
MD5 SHA1 SHA512 SSDEEP TLSH

api-ms-win-core-file-l1-2-0.dll

SHA256 f2e91f5b935dc6381d7ebfc6eebedf614bc69f8d1ed9138bc67d2236725586ae
MD5 30bd387ef95e8eeb72d8f7222e06e6f9
SHA1 3c06e221bd1cf78b25f01a132d20f31eb4b504ce
SHA512 0d652c52aedc9aa2987601fb567d71bdd667e4532237ab652efd3fff35e87da3747b1bdfeb07a227e149b015823b800daa9449c80b935218666e6983106ac0c0
SSDEEP 384:ULW2hWWgbCA0GftpBj0JDGlPJVHcaGAEcUDC7tGkeR9z+RN:Uds8i1BbTUDDkC9zMN
TLSH
T1A4D22AD68A7C9083ED97AD70A3E8E9937C3D97C71950942211AAF4D82CC33D5EB2452D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

DLL Hijacking vulnerability

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-file-l1-2-0.pdb

api-ms-win-core-file-l2-1-0.dll

SHA256 affa776eb2a674b7d9c8c70490da8e19d5def541604ee71c3066a8d87ff222ea
MD5 25eb82272390eae57a2a5fea1ce8e88d
SHA1 87948db4c3e414526dd7007faf1536f654143f40
SHA512 0b4edfa7ea4321deca537e8f05e3aecc9a3bd14275491ccf5d5b8300ee55ee46848cc9c67ba0f145bfee3f852a99db89a6fdb0f816bd53bd101127994695cb24
SSDEEP 384:QV6W2hWFSUA0GftpBjPvIrlBRAkIPcaGAEcUDDYGR9zzI0k:QVCwixwvRATbTUD79zXk
TLSH
T143D23AD28A7CD083FD97AC7062E8EA837C3CA3C70950946611AAF5E82DD33D5EB1456D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

DLL Hijacking vulnerability

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-file-l2-1-0.pdb

api-ms-win-core-localization-l1-2-0.dll

SHA256 ad5c627c5d349a3807f54128113ef597b44ca53cce305f55bd8795bc1e7cb1b8
MD5 3cce4bd0371c284be721e13827b0f322
SHA1 6753bfd064de717ff2772f14be12159fa61bf932
SHA512 75c0c29adb7fb8714512eba95306308a637ed6b9b66cf6c465c79fcc5fe1735ad2d30ca8c96299f617123136e17a42dd28ea2f30b0a8ffe7a1c79808ac5c8e7c
SSDEEP 768:BOMwBprwjGjue9/0jCRrndbM9iH66klbTUDStU9zVx:BOMwBprwjGjue9/0jCVdA9h6klvURzL
TLSH
T122E24B92CABCE143FD8EAD7072A8E9837C3CA7C70810945212EAF9942DD33D5DB5462D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

DLL Hijacking vulnerability

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-localization-l1-2-0.pdb

api-ms-win-core-processthreads-l1-1-1.dll

SHA256 e5e33d230be380ce30a450875027a763e9d61c7e783a2e0092a3921fb9890336
MD5 f450528cc1df12497caa2fc762bede8a
SHA1 75e161430a642e3cee135731664b972de6251eac
SHA512 961caebd7e0f9fea895b6d986671dc044860a55f8e47327e6e9ece549c716273ccc46c81358dc9adf9fe5b11392bc46e6fde9dca04e254739e709e0078b8116d
SSDEEP 384:CDfIeWW2hWKSUA0GftpBjvIs+rlBRAkxncaGAEcUD7Y5WKtq/R9zVQ0:te+/iZyRAURbTUDcAKtU9zVp
TLSH
T1EAD23AC28A7C9083FD97ADB062E8EA937C3CA7C71D20946611A9F5E81DC33D5AB1452D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

DLL Hijacking vulnerability

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-processthreads-l1-1-1.pdb

api-ms-win-core-synch-l1-2-0.dll

SHA256 9e4e787f9ffcc66d5ba89e36424ee3132e1b17ac8d2419e29885a852bed868fb
MD5 ee138f889bf0c262eec2dd3ef2dc987d
SHA1 49488ff9b4db00aaa17fe5ae3332fb2102339b8e
SHA512 8dd47b0052255da0e9dddad3135a67e3d777bbdb164f4a6ec8711e5c789291d9513a9942d3060b0bcdd5dc14f1af00ac20fd8c1038655a8c2e9152f0c87acaa0
SSDEEP 384:ltZ3zW2hWC7QA0GftpBjo8hGmAhll7PedGCg/ocaGACPvwEIC9FbR9zgtIr2:7byiGoGNkGcbLCB9zQM2
TLSH
T12FD24AE6CA7C9143ED86AD7063D8D9837C3C97C71D50986222AAF0E92CD33D5EB0492D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

DLL Hijacking vulnerability

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-synch-l1-2-0.pdb

api-ms-win-core-timezone-l1-1-0.dll

SHA256 57cee86e79faaf7e63ec8ee192854c4955483bfd6eb06060787a933efbd06622
MD5 20b91f95865d47551162d5354dd75b1e
SHA1 8cb1c773deeff8cf0d35ad08763d1b68523e7a25
SHA512 b5d75267ff7257eb12bdab7b39cde1194559753eb321e4bfc45dd627b228d213e39b6dd31cd4aae8edc96dd0b4df8eb2859e464c8d44ee76c4dbc7926fa654ae
SSDEEP 384:BW2hWcgbCA0GftpBj9QMJIlXBtFwuBl+caGAEcUD6hH7wGOrjR9zdmhUej:P68iwyQqbTUDy7wGOrF9zkhUej
TLSH
T112D238D28A7C9043EC9BAEB063E8E9837C3C97C31950956611EAF5D82CD33D5EB2452D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

DLL Hijacking vulnerability

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-timezone-l1-1-0.pdb

api-ms-win-core-xstate-l2-1-0.dll

SHA256 42b1dc1c87cd5d37ee94b97adb9a7253ad4fc6df9d4660e011780398a8c1c3c2
MD5 289316d1164d81500275510d76e2e4ac
SHA1 46f76de517761d44206b7b8f193041a31d1089d2
SHA512 c0d8148fc19365282c85e23dc28ee1ef5c25e9eca66b3526b435ac8bc3a5b76740eb7711c06b3fec521e60c30433728da3b7d1ca9eae3770628df9bf9d324168
SSDEEP 384:zf5bIW2hW7DBRJccNLlI663U/caGAEcUDHn9wGOrjR9zd65/1:zf5bcG1Pc66kpbTUDdwGOrF9zY5d
TLSH
T191A24AD28A7C9003ED977CB063E8E9873D3CA7C71890856611AAF9992CD33C5EB1457E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Digest

cc:05:27:00:cd:67:65:a4:01:9b:49:30:59:fa:7a:9e:6f:65:ed:c3:a1:90:59:7b:42:42:d7:10:2b:f3:f0:b6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 6, 2026

CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

cc:05:27:00:cd:67:65:a4:01:9b:49:30:59:fa:7a:9e:6f:65:ed:c3:a1:90:59:7b:42:42:d7:10:2b:f3:f0:b6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 10, 2015

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:4e:a1:d8:07:70:a9:bb:e9:44:00:00:00:00:00:4e

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 1, 2014 - Oct 1, 2015

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:57:29:61:51:29:c9:95:06:f9:00:00:00:00:00:57

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:f6:92:aa:c4:74:34:c6:03:13:00:00:00:00:00:f6

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 24, 2025 - Jul 23, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:08:78:9d:58:5d:92:c7:d9:52:00:01:00:00:02:08

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 30, 2025 - Apr 22, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-xstate-l2-1-0.pdb

api-ms-win-crt-conio-l1-1-0.dll

SHA256 53c5d63e2983e10c7dde436abde0ab6ad869e4ace440e169a4935e42d0f5443c
MD5 50b31b9c4a18953cb0f9bc6a7bf33100
SHA1 6e876189fc93ae996fd5c8e6f40e7c5b02de68d2
SHA512 b89e6a26c8ec3d13351c006a6a1a8a92ab95ad42b9c395e94f320cb6df580cdf49238d38cd7c5fe1cc32240c7c1ff5fe8a9da9c41d7f440564633b34a65167cb
SSDEEP 384:9LW2hWRgbCA0GftpBj87h+klBRAkjcaGAEcUDkv8tq/R9zVQ/:z98i0hRRA+bTUDNtU9zV2
TLSH
T1ABD24BC24ABC9443ED97AE70A3E8EAC37D3C97C71850606615AAF4E42DC33D9AB1452D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-conio-l1-1-0.pdb

api-ms-win-crt-convert-l1-1-0.dll

SHA256 e9bc9fcd9a8de179539d377f9b7f9e25f721f52488389edbaf70b0886892f2ff
MD5 02036b7f1277ae2ec50dcd030ece7201
SHA1 2127e515a4e44deacb7dcdbb28e243431765a2a2
SHA512 464e1a993cdb3b341f541cf2468a7f6897540071b73af4e251a021b182a1c2cee92f0044c7fc8e5fbdf3207f858c41acc2768bcf468e9c0b4ec63d3bbfb46b46
SSDEEP 384:wDynW2hWE7QA0GftpBj0kiVlXBtFwUscaGAEcUD9evDyR9zFk+rz+:ttyiqfylbTUDWD+9z6+rz+
TLSH
T18EE22A8746F86642EDCB6B7162EDDBC33D3857C2099042758257E49838833D6BF2682E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

DLL Hijacking vulnerability

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-convert-l1-1-0.pdb

__toascii _atodbl _atodbl_l _atof_l _atoflt _atoflt_l _atoi64 _atoi64_l _atoi_l _atol_l _atoldbl _atoldbl_l _atoll_l _ecvt _ecvt_s _fcvt _fcvt_s _gcvt _gcvt_s _i64toa _i64toa_s _i64tow _i64tow_s _itoa _itoa_s _itow _itow_s _ltoa _ltoa_s _ltow _ltow_s _strtod_l _strtof_l _strtoi64 _strtoi64_l _strtoimax_l _strtol_l _strtold_l _strtoll_l _strtoui64 _strtoui64_l _strtoul_l _strtoull_l _strtoumax_l _ui64toa _ui64toa_s _ui64tow _ui64tow_s _ultoa _ultoa_s _ultow _ultow_s _wcstod_l _wcstof_l _wcstoi64 _wcstoi64_l _wcstoimax_l _wcstol_l _wcstold_l _wcstoll_l _wcstombs_l _wcstombs_s_l _wcstoui64 _wcstoui64_l _wcstoul_l _wcstoull_l _wcstoumax_l _wctomb_l _wctomb_s_l _wtof _wtof_l _wtoi _wtoi64 _wtoi64_l _wtoi_l _wtol _wtol_l _wtoll _wtoll_l atof atoi atol atoll btowc c16rtomb c32rtomb mbrtoc16 mbrtoc32 mbrtowc mbsrtowcs mbsrtowcs_s mbstowcs mbstowcs_s mbtowc strtod strtof strtoimax strtol strtold strtoll strtoul strtoull strtoumax wcrtomb wcrtomb_s wcsrtombs wcsrtombs_s wcstod wcstof wcstoimax wcstol wcstold wcstoll wcstombs wcstombs_s wcstoul wcstoull wcstoumax wctob wctomb wctomb_s wctrans

api-ms-win-crt-environment-l1-1-0.dll

SHA256 ab4ab17a2789f9cf219b564b6a9aa536444db7a6da8b445b3bea34e303c7627c
MD5 92bcb54bb68d3b59499d03955cbf3bad
SHA1 21113496eedcd5d620c0bc1cb4383b1bad2369eb
SHA512 2847bed2cc6d1f83cf615a00251c9753ae7f9649f84286a909b665b24d60a074255e5161bff0f60672265fa85951452e3f9fab6fbf165b48f397b69f076a3ec6
SSDEEP 384:ZW2hWtSUA0GftpBjaaM1flXBtFwUycaGAEcUD3m/cvDyR9zFk+rtP:3oilMjyHbTUDWGD+9z6+rtP
TLSH
T184D23A868A7C9083FD97ADB052E8EA837C3C97C31D50952611AAF9E81DC33D5EF2452D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-environment-l1-1-0.pdb

api-ms-win-crt-filesystem-l1-1-0.dll

SHA256 aa514da78fac2340df0e3280be098af8267b00e7d0987487e5d1aad7d61867e0
MD5 d9e652074edbb3a96b71b489314c105a
SHA1 cf57370756dd39a8e4ff5983c8caeb8b7c52cdaf
SHA512 b5a66fff51ef5300e582815909d6e0b51090ac22cad0d8a75eee7b5540a4aae7546d07387fbfa511e29f4af8ca65beaf66c4e0e85cdb3783216223e2cc2f7ee1
SSDEEP 384:n81nWm5C0W2hWdSUA0GftpBjqg0nQlXBtFwiHocaGAEcUDMumwP3U0R9z6bxLd1W:nOnWm5Co8iCKyjbTUDMHN49zgLdc
TLSH
T1C1E24A834ABCA583ED976F70A2F8EBD73D3C97C209509126506AF4A829C33D1BF1542D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

DLL Hijacking vulnerability

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-filesystem-l1-1-0.pdb

api-ms-win-crt-heap-l1-1-0.dll

SHA256 7ca3c9d5fc8cbdfee9254b138d3256507d2ace02db776ae530237b1f34d93632
MD5 b595e825536ecf784469eeb969454d93
SHA1 b06788f288d19ad161ff3529312717d016d00fce
SHA512 51202247bd4e612b8bbcb7ff27e26509b439576c89cac6c954178cf7d0d96e55be9b9bb34fdc7a68496474f9052ce06019496917c2187fd75cf414b40c8bb686
SSDEEP 384:8fW2hW37QA0GftpBjTLxfUll7PedGsEcaGAEcUDctxtq/R9zVQdFg:8BAyiJFUkGnbTUDmtU9zVl
TLSH
T113D25BD28A7CE043ED93AE70A2E8EA837D3C97C71C50842651AAF4E42DC33D4EB1452D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

DLL Hijacking vulnerability

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-heap-l1-1-0.pdb

api-ms-win-crt-locale-l1-1-0.dll

SHA256 6dfd17ffb318e4ae4aa9abf6839c88e5cb090ac583c7698079e5d3ff86e163b5
MD5 8554f5e1f97cad24386fad370747f427
SHA1 29af3de18dedb72ea06d8e91116a694c1f914fac
SHA512 06152cecac5122ca796ea3ffc08c1d7385fb5147043bc57d87e18e59e8b195f069c51532768bd2ad6ea880a1bed0a5b13ac5e42b9d2e0cd52ca6570c4a9ce6d1
SSDEEP 384:p9kW2hWa56SUA0GftpBj4jlXBtFwKrycaGAEcUDyQ8EzR9zHKzz:kZ5siSyxbTUD59zs
TLSH
T1A1D24BC68A7CA083EDD76DB052A8EE877C3DA3C71950942611AAF8D81CC33D9EF1552D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

DLL Hijacking vulnerability

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-locale-l1-1-0.pdb

api-ms-win-crt-math-l1-1-0.dll

SHA256 9dca1b2ff1dcbc076119e42d9e1900fe7f59ca29083e34c408377ac4c0686a01
MD5 4e5326aca4f2dd69250ff8c6025a1294
SHA1 bd5cedca7f315c510a0db77784927315eae5e110
SHA512 7da183377dd8061d0ba05b93e0fd14454e7e4854e32653277c1fd192affc6e85f356a5127df488ace9e3bd677a9ef8621b7436fc1c0c0ee7c9bbc9b020de5307
SSDEEP 384:NZVacWM4Oe59Ckb1hgmLtW2hWFgbCA0GftpBjrhlXBtFwFFscaGACPvwL9ROifXX:NZVJWMq59Bb1jbp8i1ycbXF9zULij
TLSH
T17903F5834AECBF83D98B5BB212F4CBCB7D385BD20890A571C45BE48438923D4BE5695D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

DLL Hijacking vulnerability

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-math-l1-1-0.pdb

_Cbuild _Cmulcc _Cmulcr _FCbuild _FCmulcc _FCmulcr _LCbuild _LCmulcc _LCmulcr __setusermatherr _cabs _chgsign _chgsignf _copysign _copysignf _d_int _dclass _dexp _dlog _dnorm _dpcomp _dpoly _dscale _dsign _dsin _dtest _dunscale _except1 _fd_int _fdclass _fdexp _fdlog _fdnorm _fdopen _fdpcomp _fdpoly _fdscale _fdsign _fdsin _fdtest _fdunscale _finite _finitef _fpclass _fpclassf _get_FMA3_enable _hypot _hypotf _isnan _isnanf _j0 _j1 _jn _ld_int _ldclass _ldexp _ldlog _ldpcomp _ldpoly _ldscale _ldsign _ldsin _ldtest _ldunscale _logb _logbf _nextafter _nextafterf _scalb _scalbf _set_FMA3_enable _y0 _y1 _yn acos acosf acosh acoshf acoshl asin asinf asinh asinhf asinhl atan atan2 atan2f atanf atanh atanhf atanhl cabs cabsf cabsl cacos cacosf cacosh cacoshf cacoshl cacosl carg cargf cargl casin casinf casinh casinhf casinhl casinl catan catanf catanh catanhf catanhl catanl cbrt cbrtf cbrtl ccos ccosf ccosh ccoshf ccoshl ccosl ceil ceilf cexp cexpf cexpl cimag cimagf cimagl clog clog10 clog10f clog10l clogf clogl conj conjf conjl copysign copysignf copysignl cos cosf cosh coshf cpow cpowf cpowl cproj cprojf cprojl creal crealf creall csin csinf csinh csinhf csinhl csinl csqrt csqrtf csqrtl ctan ctanf ctanh ctanhf ctanhl ctanl erf erfc erfcf erfcl erff erfl exp exp2 exp2f exp2l expf expm1 expm1f expm1l fabs fdim fdimf fdiml floor floorf fma fmaf fmal fmax fmaxf fmaxl fmin fminf fminl fmod fmodf frexp hypot ilogb ilogbf ilogbl ldexp lgamma lgammaf lgammal llrint llrintf llrintl llround llroundf llroundl log log10 log10f log1p log1pf log1pl log2 log2f log2l logb logbf logbl logf lrint lrintf lrintl lround lroundf lroundl modf modff nan nanf nanl nearbyint nearbyintf nearbyintl nextafter nextafterf nextafterl nexttoward nexttowardf nexttowardl norm normf norml pow powf remainder remainderf remainderl remquo remquof remquol rint rintf rintl round roundf roundl scalbln scalblnf scalblnl scalbn scalbnf scalbnl sin sinf sinh sinhf sqrt sqrtf tan tanf tanh tanhf tgamma tgammaf tgammal trunc truncf truncl

api-ms-win-crt-multibyte-l1-1-0.dll

SHA256 fc5628511b54abb5a1ef9cf7d8925ae7f5b68cf8542c43259959db104f3ee051
MD5 90ba2034cd827422648a8dbf56d5ccfc
SHA1 704fdda83773bec3e8671b3d5881554451eabff8
SHA512 67c054ab73e3c02128f959078d3d640d721cc3a5c18667bab6eb896d2f09dee050186550ee362e0e307e80054cbdd2c9d6419e313cbabed12852a85a5448d544
SSDEEP 384:TF7vLPmIHJI6/CpG3t2G3t4odXLeW2hW4gbCA0GftpBjseflI663U6ocaGAEcUDs:B/PmIHJI6QW8ig66k60bTUDNTA/9z2g
TLSH
T1E0F2EA5B4EB86A42E58BDBF2B1F4DBC73E384FC204C062759167D5883842BD9BE06D19
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-multibyte-l1-1-0.pdb

__p__mbcasemap __p__mbctype _ismbbalnum _ismbbalnum_l _ismbbalpha _ismbbalpha_l _ismbbblank _ismbbblank_l _ismbbgraph _ismbbgraph_l _ismbbkalnum _ismbbkalnum_l _ismbbkana _ismbbkana_l _ismbbkprint _ismbbkprint_l _ismbbkpunct _ismbbkpunct_l _ismbblead _ismbblead_l _ismbbprint _ismbbprint_l _ismbbpunct _ismbbpunct_l _ismbbtrail _ismbbtrail_l _ismbcalnum _ismbcalnum_l _ismbcalpha _ismbcalpha_l _ismbcblank _ismbcblank_l _ismbcdigit _ismbcdigit_l _ismbcgraph _ismbcgraph_l _ismbchira _ismbchira_l _ismbckata _ismbckata_l _ismbcl0 _ismbcl0_l _ismbcl1 _ismbcl1_l _ismbcl2 _ismbcl2_l _ismbclegal _ismbclegal_l _ismbclower _ismbclower_l _ismbcprint _ismbcprint_l _ismbcpunct _ismbcpunct_l _ismbcspace _ismbcspace_l _ismbcsymbol _ismbcsymbol_l _ismbcupper _ismbcupper_l _ismbslead _ismbslead_l _ismbstrail _ismbstrail_l _mbbtombc _mbbtombc_l _mbbtype _mbbtype_l _mbcasemap _mbccpy _mbccpy_l _mbccpy_s _mbccpy_s_l _mbcjistojms _mbcjistojms_l _mbcjmstojis _mbcjmstojis_l _mbclen _mbclen_l _mbctohira _mbctohira_l _mbctokata _mbctokata_l _mbctolower _mbctolower_l _mbctombb _mbctombb_l _mbctoupper _mbctoupper_l _mblen_l _mbsbtype _mbsbtype_l _mbscat_s _mbscat_s_l _mbschr _mbschr_l _mbscmp _mbscmp_l _mbscoll _mbscoll_l _mbscpy_s _mbscpy_s_l _mbscspn _mbscspn_l _mbsdec _mbsdec_l _mbsdup _mbsicmp _mbsicmp_l _mbsicoll _mbsicoll_l _mbsinc _mbsinc_l _mbslen _mbslen_l _mbslwr _mbslwr_l _mbslwr_s _mbslwr_s_l _mbsnbcat _mbsnbcat_l _mbsnbcat_s _mbsnbcat_s_l _mbsnbcmp _mbsnbcmp_l _mbsnbcnt _mbsnbcnt_l _mbsnbcoll _mbsnbcoll_l _mbsnbcpy _mbsnbcpy_l _mbsnbcpy_s _mbsnbcpy_s_l _mbsnbicmp _mbsnbicmp_l _mbsnbicoll _mbsnbicoll_l _mbsnbset _mbsnbset_l _mbsnbset_s _mbsnbset_s_l _mbsncat _mbsncat_l _mbsncat_s _mbsncat_s_l _mbsnccnt _mbsnccnt_l _mbsncmp _mbsncmp_l _mbsncoll _mbsncoll_l _mbsncpy _mbsncpy_l _mbsncpy_s _mbsncpy_s_l _mbsnextc _mbsnextc_l _mbsnicmp _mbsnicmp_l _mbsnicoll _mbsnicoll_l _mbsninc _mbsninc_l _mbsnlen _mbsnlen_l _mbsnset _mbsnset_l _mbsnset_s _mbsnset_s_l _mbspbrk _mbspbrk_l _mbsrchr _mbsrchr_l _mbsrev _mbsrev_l _mbsset _mbsset_l _mbsset_s _mbsset_s_l _mbsspn _mbsspn_l _mbsspnp _mbsspnp_l _mbsstr _mbsstr_l _mbstok _mbstok_l _mbstok_s _mbstok_s_l _mbstowcs_l _mbstowcs_s_l _mbstrlen _mbstrlen_l _mbstrnlen _mbstrnlen_l _mbsupr _mbsupr_l _mbsupr_s _mbsupr_s_l _mbtowc_l

api-ms-win-crt-private-l1-1-0.dll

SHA256 5a1dfe5559a56b878b10c9b2802b2eb3497941f271fa4da976fbb41991920746
MD5 f91d06d7414fa3729d283be952ba3b24
SHA1 460e3c2dc74e8ea43bc6dc25ab6a19b91b66d505
SHA512 9b5c7d1165be34fdfbd8310d1dc8d369f1e29b947a27b9d06564a8c1edfeedbccaf4ea87e23698ff80bc4af6261250671bb5caac60ef9bf3d426c80df712981f
SSDEEP 1536:uW2wDe5c4bFR2JyhcvxXWpD7d3334BkZn+Pzey3qevUsWz6VNW:uW2wDe5c4bFR2JyhcvxXWpD7d3334BkL
TLSH
T1B2836DDB49E93F11E58FF7B367FA57CA1B243B4408806134E9C795AB34823A9BC13A15
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-private-l1-1-0.pdb

_CreateFrameInfo _CxxThrowException _FindAndUnlinkFrame _GetImageBase _GetThrowImageBase _IsExceptionObjectToBeDestroyed _SetImageBase _SetThrowImageBase _SetWinRTOutOfMemoryExceptionCallback __AdjustPointer __BuildCatchObject __BuildCatchObjectHelper __C_specific_handler __CxxDetectRethrow __CxxExceptionFilter __CxxFrameHandler __CxxFrameHandler2 __CxxFrameHandler3 __CxxQueryExceptionSize __CxxRegisterExceptionObject __CxxUnregisterExceptionObject __DestructExceptionObject __FrameUnwindFilter __GetPlatformExceptionInfo __NLG_Dispatch2 __NLG_Return2 __RTCastToVoid __RTDynamicCast __RTtypeid __TypeMatch __current_exception __current_exception_context __dcrt_get_wide_environment_from_os __dcrt_initial_narrow_environment __intrinsic_setjmp __intrinsic_setjmpex __processing_throw __report_gsfailure __std_exception_copy __std_exception_destroy __std_type_info_compare __std_type_info_destroy_list __std_type_info_hash __std_type_info_name __unDName __unDNameEx __uncaught_exception _get_purecall_handler _get_unexpected _is_exception_typeof _local_unwind _o__Getdays _o__Getmonths _o__Gettnames _o__Strftime _o__W_Getdays _o__W_Getmonths _o__W_Gettnames _o__Wcsftime _o____lc_codepage_func _o____lc_collate_cp_func _o____lc_locale_name_func _o____mb_cur_max_func _o___acrt_iob_func _o___conio_common_vcprintf _o___conio_common_vcprintf_p _o___conio_common_vcprintf_s _o___conio_common_vcscanf _o___conio_common_vcwprintf _o___conio_common_vcwprintf_p _o___conio_common_vcwprintf_s _o___conio_common_vcwscanf _o___daylight _o___dstbias _o___fpe_flt_rounds _o___p___argc _o___p___argv _o___p___wargv _o___p__acmdln _o___p__commode _o___p__environ _o___p__fmode _o___p__mbcasemap _o___p__mbctype _o___p__pgmptr _o___p__wcmdln _o___p__wenviron _o___p__wpgmptr _o___pctype_func _o___pwctype_func _o___std_exception_copy _o___std_exception_destroy _o___std_type_info_destroy_list _o___std_type_info_name _o___stdio_common_vfprintf _o___stdio_common_vfprintf_p _o___stdio_common_vfprintf_s _o___stdio_common_vfscanf _o___stdio_common_vfwprintf _o___stdio_common_vfwprintf_p _o___stdio_common_vfwprintf_s _o___stdio_common_vfwscanf _o___stdio_common_vsnprintf_s _o___stdio_common_vsnwprintf_s _o___stdio_common_vsprintf _o___stdio_common_vsprintf_p _o___stdio_common_vsprintf_s _o___stdio_common_vsscanf _o___stdio_common_vswprintf _o___stdio_common_vswprintf_p _o___stdio_common_vswprintf_s _o___stdio_common_vswscanf _o___timezone _o___tzname _o___wcserror _o__access _o__access_s _o__aligned_free _o__aligned_malloc _o__aligned_msize _o__aligned_offset_malloc _o__aligned_offset_realloc _o__aligned_offset_recalloc _o__aligned_realloc _o__aligned_recalloc _o__atodbl _o__atodbl_l _o__atof_l _o__atoflt _o__atoflt_l _o__atoi64 _o__atoi64_l _o__atoi_l _o__atol_l _o__atoldbl _o__atoldbl_l _o__atoll_l _o__beep _o__beginthread _o__beginthreadex _o__cabs _o__callnewh _o__calloc_base _o__cexit _o__cgets _o__cgets_s _o__cgetws _o__cgetws_s _o__chdir _o__chdrive _o__chmod _o__chsize _o__chsize_s _o__close _o__commit _o__configthreadlocale _o__configure_narrow_argv _o__configure_wide_argv _o__controlfp_s _o__cputs _o__cputws _o__creat _o__create_locale _o__crt_atexit _o__ctime32_s _o__ctime64_s _o__cwait _o__d_int _o__dclass _o__difftime32 _o__difftime64 _o__dlog _o__dnorm _o__dpcomp _o__dpoly _o__dscale _o__dsign _o__dsin _o__dtest _o__dunscale _o__dup _o__dup2 _o__dupenv_s _o__ecvt _o__ecvt_s _o__endthread _o__endthreadex _o__eof _o__errno _o__except1 _o__execute_onexit_table _o__execv _o__execve _o__execvp _o__execvpe _o__exit _o__expand _o__fclose_nolock _o__fcloseall _o__fcvt _o__fcvt_s _o__fd_int _o__fdclass _o__fdexp _o__fdlog _o__fdopen _o__fdpcomp _o__fdpoly _o__fdscale _o__fdsign _o__fdsin _o__fflush_nolock _o__fgetc_nolock _o__fgetchar _o__fgetwc_nolock _o__fgetwchar _o__filelength _o__filelengthi64 _o__fileno _o__findclose _o__findfirst32 _o__findfirst32i64 _o__findfirst64 _o__findfirst64i32 _o__findnext32 _o__findnext32i64 _o__findnext64 _o__findnext64i32 _o__flushall _o__fpclass _o__fpclassf _o__fputc_nolock _o__fputchar _o__fputwc_nolock _o__fputwchar _o__fread_nolock _o__fread_nolock_s _o__free_base _o__free_locale _o__fseek_nolock _o__fseeki64 _o__fseeki64_nolock _o__fsopen _o__fstat32 _o__fstat32i64 _o__fstat64 _o__fstat64i32 _o__ftell_nolock _o__ftelli64 _o__ftelli64_nolock _o__ftime32 _o__ftime32_s _o__ftime64 _o__ftime64_s _o__fullpath _o__futime32 _o__futime64 _o__fwrite_nolock _o__gcvt _o__gcvt_s _o__get_daylight _o__get_doserrno _o__get_dstbias _o__get_errno _o__get_fmode _o__get_heap_handle _o__get_initial_narrow_environment _o__get_initial_wide_environment _o__get_invalid_parameter_handler _o__get_narrow_winmain_command_line _o__get_osfhandle _o__get_pgmptr _o__get_stream_buffer_pointers _o__get_terminate _o__get_thread_local_invalid_parameter_handler _o__get_timezone _o__get_tzname _o__get_wide_winmain_command_line _o__get_wpgmptr _o__getc_nolock _o__getch _o__getch_nolock _o__getche _o__getche_nolock _o__getcwd _o__getdcwd _o__getdiskfree _o__getdllprocaddr _o__getdrive _o__getdrives _o__getmbcp _o__getsystime _o__getw _o__getwc_nolock _o__getwch _o__getwch_nolock _o__getwche _o__getwche_nolock _o__getws _o__getws_s _o__gmtime32 _o__gmtime32_s _o__gmtime64 _o__gmtime64_s _o__heapchk _o__heapmin _o__hypot _o__hypotf _o__i64toa _o__i64toa_s _o__i64tow _o__i64tow_s _o__initialize_narrow_environment _o__initialize_onexit_table _o__initialize_wide_environment _o__invalid_parameter_noinfo _o__invalid_parameter_noinfo_noreturn _o__isatty _o__isctype _o__isctype_l _o__isleadbyte_l _o__ismbbalnum _o__ismbbalnum_l _o__ismbbalpha _o__ismbbalpha_l _o__ismbbblank _o__ismbbblank_l _o__ismbbgraph _o__ismbbgraph_l _o__ismbbkalnum _o__ismbbkalnum_l _o__ismbbkana _o__ismbbkana_l _o__ismbbkprint _o__ismbbkprint_l _o__ismbbkpunct _o__ismbbkpunct_l _o__ismbblead _o__ismbblead_l _o__ismbbprint _o__ismbbprint_l _o__ismbbpunct _o__ismbbpunct_l _o__ismbbtrail _o__ismbbtrail_l _o__ismbcalnum _o__ismbcalnum_l _o__ismbcalpha _o__ismbcalpha_l _o__ismbcblank _o__ismbcblank_l _o__ismbcdigit _o__ismbcdigit_l _o__ismbcgraph _o__ismbcgraph_l _o__ismbchira _o__ismbchira_l _o__ismbckata _o__ismbckata_l _o__ismbcl0 _o__ismbcl0_l _o__ismbcl1 _o__ismbcl1_l _o__ismbcl2 _o__ismbcl2_l _o__ismbclegal _o__ismbclegal_l _o__ismbclower _o__ismbclower_l _o__ismbcprint _o__ismbcprint_l _o__ismbcpunct _o__ismbcpunct_l _o__ismbcspace _o__ismbcspace_l _o__ismbcsymbol _o__ismbcsymbol_l _o__ismbcupper _o__ismbcupper_l _o__ismbslead _o__ismbslead_l _o__ismbstrail _o__ismbstrail_l _o__iswctype_l _o__itoa _o__itoa_s _o__itow _o__itow_s _o__j0 _o__j1 _o__jn _o__kbhit _o__ld_int _o__ldclass _o__ldexp _o__ldlog _o__ldpcomp _o__ldpoly _o__ldscale _o__ldsign _o__ldsin _o__ldtest _o__ldunscale _o__lfind _o__lfind_s _o__loaddll _o__localtime32 _o__localtime32_s _o__localtime64 _o__localtime64_s _o__lock_file _o__locking _o__logb _o__logbf _o__lsearch _o__lsearch_s _o__lseek _o__lseeki64 _o__ltoa _o__ltoa_s _o__ltow _o__ltow_s _o__makepath _o__makepath_s _o__malloc_base _o__mbbtombc _o__mbbtombc_l _o__mbbtype _o__mbbtype_l _o__mbccpy _o__mbccpy_l _o__mbccpy_s _o__mbccpy_s_l _o__mbcjistojms _o__mbcjistojms_l _o__mbcjmstojis _o__mbcjmstojis_l _o__mbclen _o__mbclen_l _o__mbctohira _o__mbctohira_l _o__mbctokata _o__mbctokata_l _o__mbctolower _o__mbctolower_l _o__mbctombb _o__mbctombb_l _o__mbctoupper _o__mbctoupper_l _o__mblen_l _o__mbsbtype _o__mbsbtype_l _o__mbscat_s _o__mbscat_s_l _o__mbschr _o__mbschr_l _o__mbscmp _o__mbscmp_l _o__mbscoll _o__mbscoll_l _o__mbscpy_s _o__mbscpy_s_l _o__mbscspn _o__mbscspn_l _o__mbsdec _o__mbsdec_l _o__mbsicmp _o__mbsicmp_l _o__mbsicoll _o__mbsicoll_l _o__mbsinc _o__mbsinc_l _o__mbslen _o__mbslen_l _o__mbslwr _o__mbslwr_l _o__mbslwr_s _o__mbslwr_s_l _o__mbsnbcat _o__mbsnbcat_l _o__mbsnbcat_s _o__mbsnbcat_s_l _o__mbsnbcmp _o__mbsnbcmp_l _o__mbsnbcnt _o__mbsnbcnt_l _o__mbsnbcoll _o__mbsnbcoll_l _o__mbsnbcpy _o__mbsnbcpy_l _o__mbsnbcpy_s _o__mbsnbcpy_s_l _o__mbsnbicmp _o__mbsnbicmp_l _o__mbsnbicoll _o__mbsnbicoll_l _o__mbsnbset _o__mbsnbset_l _o__mbsnbset_s _o__mbsnbset_s_l _o__mbsncat _o__mbsncat_l _o__mbsncat_s _o__mbsncat_s_l _o__mbsnccnt _o__mbsnccnt_l _o__mbsncmp _o__mbsncmp_l _o__mbsncoll _o__mbsncoll_l _o__mbsncpy _o__mbsncpy_l _o__mbsncpy_s _o__mbsncpy_s_l _o__mbsnextc _o__mbsnextc_l _o__mbsnicmp _o__mbsnicmp_l _o__mbsnicoll _o__mbsnicoll_l _o__mbsninc _o__mbsninc_l _o__mbsnlen _o__mbsnlen_l _o__mbsnset _o__mbsnset_l _o__mbsnset_s _o__mbsnset_s_l _o__mbspbrk _o__mbspbrk_l _o__mbsrchr _o__mbsrchr_l _o__mbsrev _o__mbsrev_l _o__mbsset _o__mbsset_l _o__mbsset_s _o__mbsset_s_l _o__mbsspn _o__mbsspn_l _o__mbsspnp _o__mbsspnp_l _o__mbsstr _o__mbsstr_l _o__mbstok _o__mbstok_l _o__mbstok_s _o__mbstok_s_l _o__mbstowcs_l _o__mbstowcs_s_l _o__mbstrlen _o__mbstrlen_l _o__mbstrnlen _o__mbstrnlen_l _o__mbsupr _o__mbsupr_l _o__mbsupr_s _o__mbsupr_s_l _o__mbtowc_l _o__memicmp _o__memicmp_l _o__mkdir _o__mkgmtime32 _o__mkgmtime64 _o__mktemp _o__mktemp_s _o__mktime32 _o__mktime64 _o__msize _o__nextafter _o__nextafterf _o__open_osfhandle _o__pclose _o__pipe _o__popen _o__purecall _o__putc_nolock _o__putch _o__putch_nolock _o__putenv _o__putenv_s _o__putw _o__putwc_nolock _o__putwch _o__putwch_nolock _o__putws _o__read _o__realloc_base _o__recalloc _o__register_onexit_function _o__resetstkoflw _o__rmdir _o__rmtmp _o__scalb _o__scalbf _o__searchenv _o__searchenv_s _o__seh_filter_dll _o__seh_filter_exe _o__set_abort_behavior _o__set_app_type _o__set_doserrno _o__set_errno _o__set_fmode _o__set_invalid_parameter_handler _o__set_new_handler _o__set_new_mode _o__set_thread_local_invalid_parameter_handler _o__seterrormode _o__setmbcp _o__setmode _o__setsystime _o__sleep _o__sopen _o__sopen_dispatch _o__sopen_s _o__spawnv _o__spawnve _o__spawnvp _o__spawnvpe _o__splitpath _o__splitpath_s _o__stat32 _o__stat32i64 _o__stat64 _o__stat64i32 _o__strcoll_l _o__strdate _o__strdate_s _o__strdup _o__strerror _o__strerror_s _o__strftime_l _o__stricmp _o__stricmp_l _o__stricoll _o__stricoll_l _o__strlwr _o__strlwr_l _o__strlwr_s _o__strlwr_s_l _o__strncoll _o__strncoll_l _o__strnicmp _o__strnicmp_l _o__strnicoll _o__strnicoll_l _o__strnset_s _o__strset_s _o__strtime _o__strtime_s _o__strtod_l _o__strtof_l _o__strtoi64 _o__strtoi64_l _o__strtol_l _o__strtold_l _o__strtoll_l _o__strtoui64 _o__strtoui64_l _o__strtoul_l _o__strtoull_l _o__strupr _o__strupr_l _o__strupr_s _o__strupr_s_l _o__strxfrm_l _o__swab _o__tell _o__telli64 _o__timespec32_get _o__timespec64_get _o__tolower _o__tolower_l _o__toupper _o__toupper_l _o__towlower_l _o__towupper_l _o__tzset _o__ui64toa _o__ui64toa_s _o__ui64tow _o__ui64tow_s _o__ultoa _o__ultoa_s _o__ultow _o__ultow_s _o__umask _o__umask_s _o__ungetc_nolock _o__ungetch _o__ungetch_nolock _o__ungetwc_nolock _o__ungetwch _o__ungetwch_nolock _o__unlink _o__unloaddll _o__unlock_file _o__utime32 _o__utime64 _o__waccess _o__waccess_s _o__wasctime _o__wasctime_s _o__wchdir _o__wchmod _o__wcreat _o__wcreate_locale _o__wcscoll_l _o__wcsdup _o__wcserror _o__wcserror_s _o__wcsftime_l _o__wcsicmp _o__wcsicmp_l _o__wcsicoll _o__wcsicoll_l _o__wcslwr _o__wcslwr_l _o__wcslwr_s _o__wcslwr_s_l _o__wcsncoll _o__wcsncoll_l _o__wcsnicmp _o__wcsnicmp_l _o__wcsnicoll _o__wcsnicoll_l _o__wcsnset _o__wcsnset_s _o__wcsset _o__wcsset_s _o__wcstod_l _o__wcstof_l _o__wcstoi64 _o__wcstoi64_l _o__wcstol_l _o__wcstold_l _o__wcstoll_l _o__wcstombs_l _o__wcstombs_s_l _o__wcstoui64 _o__wcstoui64_l _o__wcstoul_l _o__wcstoull_l _o__wcsupr _o__wcsupr_l _o__wcsupr_s _o__wcsupr_s_l _o__wcsxfrm_l _o__wctime32 _o__wctime32_s _o__wctime64 _o__wctime64_s _o__wctomb_l _o__wctomb_s_l _o__wdupenv_s _o__wexecv _o__wexecve _o__wexecvp _o__wexecvpe _o__wfdopen _o__wfindfirst32 _o__wfindfirst32i64 _o__wfindfirst64 _o__wfindfirst64i32 _o__wfindnext32 _o__wfindnext32i64 _o__wfindnext64 _o__wfindnext64i32 _o__wfopen _o__wfopen_s _o__wfreopen _o__wfreopen_s _o__wfsopen _o__wfullpath _o__wgetcwd _o__wgetdcwd _o__wgetenv _o__wgetenv_s _o__wmakepath _o__wmakepath_s _o__wmkdir _o__wmktemp _o__wmktemp_s _o__wperror _o__wpopen _o__wputenv _o__wputenv_s _o__wremove _o__wrename _o__write _o__wrmdir _o__wsearchenv _o__wsearchenv_s _o__wsetlocale _o__wsopen_dispatch _o__wsopen_s _o__wspawnv _o__wspawnve _o__wspawnvp _o__wspawnvpe _o__wsplitpath _o__wsplitpath_s _o__wstat32 _o__wstat32i64 _o__wstat64 _o__wstat64i32 _o__wstrdate _o__wstrdate_s _o__wstrtime _o__wstrtime_s _o__wsystem _o__wtmpnam_s _o__wtof _o__wtof_l _o__wtoi _o__wtoi64 _o__wtoi64_l _o__wtoi_l _o__wtol _o__wtol_l _o__wtoll _o__wtoll_l _o__wunlink _o__wutime32 _o__wutime64 _o__y0 _o__y1 _o__yn _o_abort _o_acos _o_acosf _o_acosh _o_acoshf _o_acoshl _o_asctime _o_asctime_s _o_asin _o_asinf _o_asinh _o_asinhf _o_asinhl _o_atan _o_atan2 _o_atan2f _o_atanf _o_atanh _o_atanhf _o_atanhl _o_atof _o_atoi _o_atol _o_atoll _o_bsearch _o_bsearch_s _o_btowc _o_calloc _o_cbrt _o_cbrtf _o_ceil _o_ceilf _o_clearerr _o_clearerr_s _o_cos _o_cosf _o_cosh _o_coshf _o_erf _o_erfc _o_erfcf _o_erfcl _o_erff _o_erfl _o_exit _o_exp _o_exp2 _o_exp2f _o_exp2l _o_expf _o_fabs _o_fclose _o_feof _o_ferror _o_fflush _o_fgetc _o_fgetpos _o_fgets _o_fgetwc _o_fgetws _o_floor _o_floorf _o_fma _o_fmaf _o_fmal _o_fmod _o_fmodf _o_fopen _o_fopen_s _o_fputc _o_fputs _o_fputwc _o_fputws _o_fread _o_fread_s _o_free _o_freopen _o_freopen_s _o_frexp _o_fseek _o_fsetpos _o_ftell _o_fwrite _o_getc _o_getchar _o_getenv _o_getenv_s _o_gets _o_gets_s _o_getwc _o_getwchar _o_hypot _o_is_wctype _o_isalnum _o_isalpha _o_isblank _o_iscntrl _o_isdigit _o_isgraph _o_isleadbyte _o_islower _o_isprint _o_ispunct _o_isspace _o_isupper _o_iswalnum _o_iswalpha _o_iswascii _o_iswblank _o_iswcntrl _o_iswctype _o_iswdigit _o_iswgraph _o_iswlower _o_iswprint _o_iswpunct _o_iswspace _o_iswupper _o_iswxdigit _o_isxdigit _o_ldexp _o_lgamma _o_lgammaf _o_lgammal _o_llrint _o_llrintf _o_llrintl _o_llround _o_llroundf _o_llroundl _o_localeconv _o_log _o_log10 _o_log10f _o_log1p _o_log1pf _o_log1pl _o_log2 _o_log2f _o_log2l _o_logb _o_logbf _o_logbl _o_logf _o_lrint _o_lrintf _o_lrintl _o_lround _o_lroundf _o_lroundl _o_malloc _o_mblen _o_mbrlen _o_mbrtoc16 _o_mbrtoc32 _o_mbrtowc _o_mbsrtowcs _o_mbsrtowcs_s _o_mbstowcs _o_mbstowcs_s _o_mbtowc _o_memcpy_s _o_memset _o_modf _o_modff _o_nan _o_nanf _o_nanl _o_nearbyint _o_nearbyintf _o_nearbyintl _o_nextafter _o_nextafterf _o_nextafterl _o_nexttoward _o_nexttowardf _o_nexttowardl _o_pow _o_powf _o_putc _o_putchar _o_puts _o_putwc _o_putwchar _o_qsort _o_qsort_s _o_raise _o_rand _o_rand_s _o_realloc _o_remainder _o_remainderf _o_remainderl _o_remove _o_remquo _o_remquof _o_remquol _o_rename _o_rewind _o_rint _o_rintf _o_rintl _o_round _o_roundf _o_roundl _o_scalbln _o_scalblnf _o_scalblnl _o_scalbn _o_scalbnf _o_scalbnl _o_set_terminate _o_setbuf _o_setlocale _o_setvbuf _o_sin _o_sinf _o_sinh _o_sinhf _o_sqrt _o_sqrtf _o_srand _o_strcat_s _o_strcoll _o_strcpy_s _o_strerror _o_strerror_s _o_strftime _o_strncat_s _o_strncpy_s _o_strtod _o_strtof _o_strtok _o_strtok_s _o_strtol _o_strtold _o_strtoll _o_strtoul _o_strtoull _o_system _o_tan _o_tanf _o_tanh _o_tanhf _o_terminate _o_tgamma _o_tgammaf _o_tgammal _o_tmpfile_s _o_tmpnam_s _o_tolower _o_toupper _o_towlower _o_towupper _o_ungetc _o_ungetwc _o_wcrtomb _o_wcrtomb_s _o_wcscat_s _o_wcscoll _o_wcscpy _o_wcscpy_s _o_wcsftime _o_wcsncat_s _o_wcsncpy_s _o_wcsrtombs _o_wcsrtombs_s _o_wcstod _o_wcstof _o_wcstok _o_wcstok_s _o_wcstol _o_wcstold _o_wcstoll _o_wcstombs _o_wcstombs_s _o_wcstoul _o_wcstoull _o_wctob _o_wctomb _o_wctomb_s _o_wmemcpy_s _o_wmemmove_s _purecall _set_purecall_handler _set_se_translator longjmp memchr memcmp memcpy memmove set_unexpected setjmp strchr strrchr strstr unexpected wcschr wcsrchr wcsstr

api-ms-win-crt-process-l1-1-0.dll

SHA256 e58a3d7cbc417a872a2637e32bdaa3b8a6d4e135efd23daae409d4366a3cd893
MD5 7b53938f3321b1979c4193dc077f9d48
SHA1 99d5467982bed8d8f0d57a647a8d61c240703ca2
SHA512 e28a649164612a6da0653df1b3feebf7f6f8e11fdac9fbf5df8cdd6ea9fbb3d11d491caeed5f37803087ceb133b5b6f7964f06374e2fe13f869396ce46c059f4
SSDEEP 384:iitIDW2hW5gbCA0GftpBjUKKy4lXBtFwyIhcaGACPvwFRyR9zS3sYY:zmt8iyyb7b7+9zusYY
TLSH
T163D25CC78ABC9483EA976E7092F8EE837D3D93C35850952551AAF0D92CC33D5EB2442D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-process-l1-1-0.pdb

api-ms-win-crt-runtime-l1-1-0.dll

SHA256 2d38ad5d17550138586de4dca3c2bc00a334d8a825f5e3e707298defbc985a04
MD5 626024c39c8ce96fb537412aed32b36f
SHA1 4514c84c2af1211c0f608ea91f4fbe0ccd9c5407
SHA512 70571380f285cbc5b777de6ed3d82967dc11d4b103058795174a02fc9009f17d8ed207dc5de444925963b64c1b9d8380e67107f881ffee4a255cd2c6593afc8f
SSDEEP 384:P42r7eW2hWOgbCA0GftpBjglVlXBtFwUecaGACPvwrYFbR9zgtp3Iq:P42r72k8iIyrbs9zQiq
TLSH
T1C7E228838AFCAA43E9876F7252F8DAC37D3993C31950946650A7F0D828C33D5BE1651D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

DLL Hijacking vulnerability

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-runtime-l1-1-0.pdb

_Exit __doserrno __fpe_flt_rounds __fpecode __p___argc __p___argv __p___wargv __p__acmdln __p__pgmptr __p__wcmdln __p__wpgmptr __pxcptinfoptrs __sys_errlist __sys_nerr __threadhandle __threadid __wcserror __wcserror_s _assert _beginthread _beginthreadex _c_exit _cexit _clearfp _configure_narrow_argv _configure_wide_argv _control87 _controlfp _controlfp_s _crt_at_quick_exit _crt_atexit _endthread _endthreadex _errno _execute_onexit_table _exit _fpieee_flt _fpreset _get_doserrno _get_errno _get_initial_narrow_environment _get_initial_wide_environment _get_invalid_parameter_handler _get_narrow_winmain_command_line _get_pgmptr _get_terminate _get_thread_local_invalid_parameter_handler _get_wide_winmain_command_line _get_wpgmptr _getdllprocaddr _getpid _initialize_narrow_environment _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _invalid_parameter_noinfo _invalid_parameter_noinfo_noreturn _invoke_watson _query_app_type _register_onexit_function _register_thread_local_exe_atexit_callback _resetstkoflw _seh_filter_dll _seh_filter_exe _set_abort_behavior _set_app_type _set_controlfp _set_doserrno _set_errno _set_error_mode _set_invalid_parameter_handler _set_new_handler _set_thread_local_invalid_parameter_handler _seterrormode _sleep _statusfp _strerror _strerror_s _wassert _wcserror _wcserror_s _wperror _wsystem abort exit feclearexcept fegetenv fegetexceptflag fegetround feholdexcept fesetenv fesetexceptflag fesetround fetestexcept perror quick_exit raise set_terminate signal strerror strerror_s system terminate

api-ms-win-crt-stdio-l1-1-0.dll

SHA256 68cae5643b6f4309147cc0bac6dbd6dc14ae7755f01187769908fe3483d1ea93
MD5 3a5f1423647d76059f4194fccb5841d3
SHA1 4ad551940f7c6f009851290d0377edb2468bc7d1
SHA512 f01433070b4f02160467d324576126c6baa0f73cbb1c412c60079cf90ccbd7916d722443fa20b96fd751d5093fd880b0c0cfda4abdc93b70430f4db3e2cac26d
SSDEEP 384:L3vAmiFVhEW2hW2gbCA0GftpBji8n4lPJhcaGAEcUDhbl8BR9z43jiw:7vYW48i48KdbTUDw9zJw
TLSH
T119F21A8389FCAA42E9879B7166F8EBD76D3883C3280064758157F8943AC73D9BF1641D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

DLL Hijacking vulnerability

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-stdio-l1-1-0.pdb

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfprintf_p __stdio_common_vfprintf_s __stdio_common_vfscanf __stdio_common_vfwprintf __stdio_common_vfwprintf_p __stdio_common_vfwprintf_s __stdio_common_vfwscanf __stdio_common_vsnprintf_s __stdio_common_vsnwprintf_s __stdio_common_vsprintf __stdio_common_vsprintf_p __stdio_common_vsprintf_s __stdio_common_vsscanf __stdio_common_vswprintf __stdio_common_vswprintf_p __stdio_common_vswprintf_s __stdio_common_vswscanf _chsize _chsize_s _close _commit _creat _dup _dup2 _eof _fclose_nolock _fcloseall _fflush_nolock _fgetc_nolock _fgetchar _fgetwc_nolock _fgetwchar _filelength _filelengthi64 _fileno _flushall _fputc_nolock _fputchar _fputwc_nolock _fputwchar _fread_nolock _fread_nolock_s _fseek_nolock _fseeki64 _fseeki64_nolock _fsopen _ftell_nolock _ftelli64 _ftelli64_nolock _fwrite_nolock _get_fmode _get_osfhandle _get_printf_count_output _get_stream_buffer_pointers _getc_nolock _getcwd _getdcwd _getmaxstdio _getw _getwc_nolock _getws _getws_s _isatty _kbhit _locking _lseek _lseeki64 _mktemp _mktemp_s _open _open_osfhandle _pclose _pipe _popen _putc_nolock _putw _putwc_nolock _putws _read _rmtmp _set_fmode _set_printf_count_output _setmaxstdio _setmode _sopen _sopen_dispatch _sopen_s _tell _telli64 _tempnam _ungetc_nolock _ungetwc_nolock _wcreat _wfdopen _wfopen _wfopen_s _wfreopen _wfreopen_s _wfsopen _wmktemp _wmktemp_s _wopen _wpopen _write _wsopen _wsopen_dispatch _wsopen_s _wtempnam _wtmpnam _wtmpnam_s clearerr clearerr_s fclose feof ferror fflush fgetc fgetpos fgets fgetwc fgetws fopen fopen_s fputc fputs fputwc fputws fread fread_s freopen freopen_s fseek fsetpos ftell fwrite getc getchar gets gets_s getwc getwchar putc putchar puts putwc putwchar rewind setbuf setvbuf tmpfile tmpfile_s tmpnam tmpnam_s ungetc ungetwc

api-ms-win-crt-string-l1-1-0.dll

SHA256 8030006659478df9912892a54f5a01aff1bfb92eff406db56ad404c345926eff
MD5 9e9b92d5f8aa6b1c1040eb588f079271
SHA1 19e69a8f1f7dd7a5ddc45028ee5f20ed2a0cefc3
SHA512 bebbe765965162a5344adc5df4ff0a0dbc888355439cb1a00e70a0b4a921540a1a77b6b29428f5ceea9b2c64025df8b517e4a183c719a75a35cf79a085072670
SSDEEP 768:E5yguNvZ5VQgx3SbwA71IkFCF8iHyaZNibTUD4/9z9:E5yguNvZ5VQgx3SbwA71I96qcvUcz9
TLSH
T193F219834AF87A42DD8B5BB252F8DBC33D388B861940527190A7F4D838837D5BF6691D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

DLL Hijacking vulnerability

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-string-l1-1-0.pdb

__isascii __iscsym __iscsymf __iswcsym __iswcsymf __strncnt __wcsncnt _isalnum_l _isalpha_l _isblank_l _iscntrl_l _isctype _isctype_l _isdigit_l _isgraph_l _isleadbyte_l _islower_l _isprint_l _ispunct_l _isspace_l _isupper_l _iswalnum_l _iswalpha_l _iswblank_l _iswcntrl_l _iswcsym_l _iswcsymf_l _iswctype_l _iswdigit_l _iswgraph_l _iswlower_l _iswprint_l _iswpunct_l _iswspace_l _iswupper_l _iswxdigit_l _isxdigit_l _memccpy _memicmp _memicmp_l _strcoll_l _strdup _stricmp _stricmp_l _stricoll _stricoll_l _strlwr _strlwr_l _strlwr_s _strlwr_s_l _strncoll _strncoll_l _strnicmp _strnicmp_l _strnicoll _strnicoll_l _strnset _strnset_s _strrev _strset _strset_s _strupr _strupr_l _strupr_s _strupr_s_l _strxfrm_l _tolower _tolower_l _toupper _toupper_l _towlower_l _towupper_l _wcscoll_l _wcsdup _wcsicmp _wcsicmp_l _wcsicoll _wcsicoll_l _wcslwr _wcslwr_l _wcslwr_s _wcslwr_s_l _wcsncoll _wcsncoll_l _wcsnicmp _wcsnicmp_l _wcsnicoll _wcsnicoll_l _wcsnset _wcsnset_s _wcsrev _wcsset _wcsset_s _wcsupr _wcsupr_l _wcsupr_s _wcsupr_s_l _wcsxfrm_l _wctype is_wctype isalnum isalpha isblank iscntrl isdigit isgraph isleadbyte islower isprint ispunct isspace isupper iswalnum iswalpha iswascii iswblank iswcntrl iswctype iswdigit iswgraph iswlower iswprint iswpunct iswspace iswupper iswxdigit isxdigit mblen mbrlen memcpy_s memmove_s memset strcat strcat_s strcmp strcoll strcpy strcpy_s strcspn strlen strncat strncat_s strncmp strncpy strncpy_s strnlen strpbrk strspn strtok strtok_s strxfrm tolower toupper towctrans towlower towupper wcscat wcscat_s wcscmp wcscoll wcscpy wcscpy_s wcscspn wcslen wcsncat wcsncat_s wcsncmp wcsncpy wcsncpy_s wcsnlen wcspbrk wcsspn wcstok wcstok_s wcsxfrm wctype wmemcpy_s wmemmove_s

api-ms-win-crt-time-l1-1-0.dll

SHA256 45ce2c228f3a1fe6374508b17f6ef6f114aec20133915f1edc8436474bc3af64
MD5 f61cf89fb199f59f2e41a09d34de3ae0
SHA1 91cf2d25a3e347282d568b486827f84b8700af6f
SHA512 4eb927758fd2f18cf5c32effda6e57ba2a0330be3274b682d08c12c7b307b1ca6b180274f7406d476928ffad0b3474691302a6b2d8afe29f62ddcbcfa47c7d56
SSDEEP 384:8PEzgW2hW67QA0GftpBjutT5lXBtFwgGcaGAEcUDUjzwGOrjR9zdQjf:i0EHyiwNyrbTUDcwGOrF9zyb
TLSH
T133E2298389BCA543EDDB5F7063F8EAD77E3887C21990602641A6E49839C33D4BF2542D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

DLL Hijacking vulnerability

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-time-l1-1-0.pdb

api-ms-win-crt-utility-l1-1-0.dll

SHA256 19cc7f1782a95df41018ce440850d88ecf383b377dc5c15507da95d19b8cedbc
MD5 690ef0915a56670239aa5c9acd08b265
SHA1 40b124674d90f70937c27a0cb8eb54b1df2fc430
SHA512 39523a8e174506ac525fca89c3af694160d53d9e843213055baab7d42d1c378250a53cde5b2175f4813497f78138b68fc566dac0da670e47d55bdd6f46924c29
SSDEEP 384:QBfKW2hWOgbCA0GftpBjTt1lI663UyxcaGACPvwGGdcDR9zMcj+:+fSk8i866k2bJg9zM4+
TLSH
T17AD25AD68ABC9143ED876E7063E8EA837C3C97C31C50986601AAF4E928837D5EF1552D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

DLL Hijacking vulnerability

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-utility-l1-1-0.pdb

appvcleaner.exe

IMPHASH aabf5fc8b3f5e73a2933848c9378444b
SHA256 a875f5a09833fe812297ab22f9c2e9328c56a95c2cecdc2afb6a0bb7f0e9322f
MD5 1477ed2cb039d5b287f843ba31dbba0b
SHA1 e29db30fa80ea93356b0820be3b04d8dd5b5931d
SHA512 4a579d52ccd185f17b82bb44624221c61bf7973c9ddf2cef1ff98bf74d8f0a02539aa0e3a430c3def41380bd2fcae850d33634894bb9fd724584dbebca191fe8
SSDEEP 24576:lqdoAnEwXLSnSP8K5Y2IGmIoDI/apo52/zamb4ulImTv0:4d5nY6Qp/Ifio52/9ImD0
TLSH
T1FA654B16A6D486E8F1F7D7F8EE328472EB3378495631830B4396D6067E237509D29F22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

ce:c7:20:3f:71:c4:73:1c:af:e5:f8:f2:9b:fd:c1:4c:bb:7d:28:32:c7:52:90:69:61:ef:f3:5f:85:f9:80:28

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

ce:c7:20:3f:71:c4:73:1c:af:e5:f8:f2:9b:fd:c1:4c:bb:7d:28:32:c7:52:90:69:61:ef:f3:5f:85:f9:80:28

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:2b:bb:00:50:ff:4d:3b:9a:a1:00:01:00:00:02:2b

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:F002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:20:24:e1:e6:e0:17:b9:b4:8e:00:01:00:00:02:20

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

889520

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\dbs\el\omr\target\x64\ship\appvisv\x-none\appv\AppVCleaner.pdb

kernel32

GetModuleHandleExW OutputDebugStringA GetModuleFileNameW FindActCtxSectionStringW InitializeCriticalSectionEx DeactivateActCtx QueryActCtxW GetLastError LockResource LoadLibraryW HeapSetInformation LoadResource FindResourceW SetLastError DeleteCriticalSection HeapFree HeapAlloc GetProcessHeap DebugBreak IsDebuggerPresent OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection LoadLibraryExA ActivateActCtx CreateActCtxW SizeofResource VirtualQuery VirtualProtect GetSystemInfo InitializeSListHead GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive CopyFileW GetDriveTypeW GetModuleFileNameA MoveFileW FormatMessageW GetComputerNameExW GetCurrentDirectoryW GetTempPathW GetEnvironmentVariableW GetShortPathNameW GetLongPathNameW SearchPathW Wow64RevertWow64FsRedirection Wow64DisableWow64FsRedirection LoadLibraryA GetSystemDirectoryW ExpandEnvironmentStringsW GetSystemTimeAsFileTime MoveFileExW DeleteFileW GetFileAttributesW FindClose GetFinalPathNameByHandleW FindNextFileW FindFirstFileW GetNativeSystemInfo WideCharToMultiByte MultiByteToWideChar FreeLibrary GetModuleHandleW GetProcAddress GetVersionExW ResetEvent CreateThreadpoolWork SubmitThreadpoolWork Sleep TerminateProcess CloseThreadpoolWork CreateFileW RemoveDirectoryW DeviceIoControl CreateThreadpoolCleanupGroup SetThreadpoolThreadMaximum CloseThreadpoolCleanupGroupMembers CloseThreadpoolCleanupGroup SetThreadpoolThreadMinimum CreateThreadpool CloseThreadpool LocalFree CreateEventW DuplicateHandle GetCurrentThreadId InitializeCriticalSection GetCurrentProcess GetExitCodeProcess CreateProcessW CloseHandle GetCurrentThread SetEvent WaitForSingleObject SetFileAttributesW GetTempFileNameW CopyFileExW

appvmanifest

ord3

appvpolicy

ord3

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context memcmp memcpy _CxxThrowException __C_specific_handler_noexcept __current_exception strchr wcschr __std_type_info_compare __C_specific_handler __std_exception_destroy __std_exception_copy __std_terminate strrchr _purecall memmove memset __RTDynamicCast

msvcp140

??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAI@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?_Xbad_alloc@std@@YAXXZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ??0_Locinfo@std@@QEAA@PEBD@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ _Wcsxfrm ?id@?$collate@_W@std@@2V0locale@2@A ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z _Wcscoll ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ??1_Lockit@std@@QEAA@XZ ?is@?$ctype@_W@std@@QEBA_NF_W@Z ??0_Lockit@std@@QEAA@H@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$ctype@_W@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?exceptions@ios_base@std@@QEAAXH@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?_Xbad_function_call@std@@YAXXZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_N@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ?fail@ios_base@std@@QEBA_NXZ

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc realloc

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo terminate _crt_atexit _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit _exit _errno __p___argc __p___wargv _invoke_watson _cexit _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _initialize_onexit_table

api-ms-win-crt-string-l1-1-0

_stricmp _wcsicmp wcscpy_s _wcsupr_s wcsncmp iswalpha iswctype wcscmp towupper iswdigit _wcslwr_s _wcsnicmp iswspace

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s _wmakepath_s

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-convert-l1-1-0

_ultow_s wcstoul wcstol _wtoi

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s __stdio_common_vswscanf __stdio_common_vswprintf __stdio_common_vswprintf_s _set_fmode __p__commode

api-ms-win-crt-math-l1-1-0

ceilf __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale __initialize_lconv_for_unsigned_char

ntdll

NtQueryKey

oleaut32

SysAllocString SysFreeString VariantCopy VariantInit VariantChangeType VariantClear

api-ms-win-core-path-l1-1-0

PathCchCanonicalize

Name

.text

Size

922KB

Virtual Size

921KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

427KB

Virtual Size

427KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

41KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

616B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

c2r32werhandler.dll

IMPHASH 6011e2a9bc1677a404f89377e95bf1ff
SHA256 7d0f7b572eb74c8e0300e535ec290b7462ef1cf46de3c3dec1b709bbbffc041c
MD5 3a0e0df39b73e1376e0c8a0d91ffc26f
SHA1 4d44c8c3bf87ad36894c396cb2993c7c3c739f72
SHA512 2f62576faedcb89742096c43a13fe8aa958e35517ae284dba94e12ae62a1bbbd68485cce1f424f1a4662f80203b13dc76c4a0896a6a0e19ebac25c611a5e34bb
SSDEEP 1536:RyBcbopq2hUBCkTkBGCGh1/rll7rxrp7ohozyMzy2:RyzJuRh1/rllJrp7oqWMW2
TLSH
T148737C83B7A681F1DA4F05B0FA79FB1B287CB6510CF059E327C9A54A18A3B85D71121F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

4a:62:67:c6:48:e6:f4:03:69:14:18:b8:e2:39:34:2c:17:ec:b2:6c:3e:81:cb:5d:e6:32:89:ef:2f:31:94:05

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

4a:62:67:c6:48:e6:f4:03:69:14:18:b8:e2:39:34:2c:17:ec:b2:6c:3e:81:cb:5d:e6:32:89:ef:2f:31:94:05

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6B05-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:11:45:18:39:9b:43:cf:fc:6c:00:01:00:00:02:11

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Minor OS version

1

Major OS version

6

Entry point

24618

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\dbs\el\omr\target\x86\ship\click2run\x-none\c2r32werhandler.pdb

kernel32

QueryDosDeviceW SetLastError ExpandEnvironmentStringsW GetModuleFileNameW K32GetModuleFileNameExW GetLogicalDriveStringsW GetLastError CompareStringEx GetProcAddress GetModuleHandleW K32GetMappedFileNameW LoadLibraryExW VirtualQueryEx FreeLibrary VirtualQuery VirtualProtect GetSystemInfo TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RaiseException InterlockedFlushSList RtlUnwind IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LoadLibraryExA

api-ms-win-crt-string-l1-1-0

wcscpy_s towlower wcsncmp strcpy_s

api-ms-win-crt-runtime-l1-1-0

_initterm_e _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _initterm _execute_onexit_table _crt_atexit _cexit terminate _register_onexit_function abort _invoke_watson

api-ms-win-crt-heap-l1-1-0

calloc malloc free

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char

c2r64werhandler.dll

IMPHASH 7c81ecd2882ba3c24a0b1b7b11581fda
SHA256 7e58a181012e840e7b42f3d428e7e441c5b4d73e735aeb8b484242396da9d8e1
MD5 c3c03b5bfca807d34c2b8e5c5d49b426
SHA1 d2fc49c5c97bf731009e6743bfafe60aecfeb838
SHA512 ad0246927a84d303cd95318b4ceec564fb1354cfde9b2e34658ce832b0167f9a8d208e8f671baf2c900bb45314a029dadaa2f604af47ca3107db7872c340f96a
SSDEEP 1536:a7Bk8PvYLGmw+yTdD+SCHk4O6bel6C6r0HGXVqyPykrzDXc4zv:aFHPvrmw+yT4tEGbel6zr0H00yaQE4j
TLSH
T176A38D49D69480F9E487D5B4C9A5AD73FF35B19B2460A30F07E2DA432F137909E2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

0d:19:86:6e:a4:9c:81:42:0a:31:4b:06:77:75:bf:65:87:13:53:e3:ea:15:a5:59:6e:c4:45:76:e9:c2:19:d3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

0d:19:86:6e:a4:9c:81:42:0a:31:4b:06:77:75:bf:65:87:13:53:e3:ea:15:a5:59:6e:c4:45:76:e9:c2:19:d3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:24:3b:84:21:b0:2c:ac:64:22:00:01:00:00:02:24

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:21:33:c0:35:fb:d2:0f:21:a4:00:01:00:00:02:21

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

37072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d:\dbs\el\omr\target\x64\ship\click2run\x-none\c2r64werhandler.pdb

kernel32

QueryDosDeviceW SetLastError ExpandEnvironmentStringsW GetModuleFileNameW K32GetModuleFileNameExW GetLogicalDriveStringsW GetLastError CompareStringEx GetProcAddress GetModuleHandleW K32GetMappedFileNameW LoadLibraryExW VirtualQueryEx FreeLibrary VirtualQuery VirtualProtect GetSystemInfo TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RaiseException RtlPcToFileHeader InterlockedFlushSList RtlUnwindEx IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LoadLibraryExA

api-ms-win-crt-string-l1-1-0

towlower wcscpy_s strcmp strcpy_s wcsncmp strlen

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _initterm_e abort terminate _initterm _invoke_watson _cexit

api-ms-win-crt-heap-l1-1-0

malloc calloc free

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char

Name

.text

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

concrt140.dll

IMPHASH e370725b8dd7cc8a534df3e729377a73
SHA256 f16dcef510af634e9b96e12d091ff6a7600824b3d910db56027127814eee86bc
MD5 e3faa3c1431b2c4fee1313324f8a2ed5
SHA1 eff94b7bf48e4a042e9322131f3cbc38f55bc63a
SHA512 21cfbad94bb5537aab49e19897b685de33036b3830b610f14b412dc61585a6fdcaae1cc84586233b6530fdd6c57de743bcd0404befa91056bcff2a8c5cb27314
SSDEEP 6144:BfjSd54rw5k9cZW1Cbfpri5/IwHlRz7nWzg/pIrVU:1OP4rwK9c0gkqzA
TLSH
T1E764398A76140CE6F96BE039C553891BE6F2BD412352D3CB0264939E1F637D1E93A732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

181520

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\concrt140.amd64.pdb

msvcp140

?_Xbad_function_call@std@@YAXXZ ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ _Mtx_lock _Mtx_unlock _Cnd_wait _Cnd_broadcast ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_type_info_destroy_list _purecall __std_terminate __std_exception_copy __std_exception_destroy _CxxThrowException memcpy memset __uncaught_exception __C_specific_handler __RTDynamicCast __current_exception __current_exception_context

api-ms-win-crt-runtime-l1-1-0

_initterm_e _initterm _cexit _invoke_watson terminate _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh

api-ms-win-crt-math-l1-1-0

sqrt exp

api-ms-win-crt-string-l1-1-0

wcslen wcsncpy_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s __stdio_common_vfwprintf __acrt_iob_func fflush

kernel32

GetCurrentThreadId DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleHandleA GetModuleFileNameW FreeLibraryAndExitThread FreeLibrary CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer FreeLibraryWhenCallbackReturns GetThreadTimes EncodePointer OutputDebugStringW LoadLibraryW LoadLibraryExW GetProcAddress SetLastError SetThreadpoolTimer CreateSemaphoreExW ReleaseSemaphore InitializeSListHead VerifyVersionInfoW SetProcessAffinityMask GetProcessAffinityMask VirtualFree FlushProcessWriteBuffers VerSetConditionMask DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection SetThreadGroupAffinity GetThreadGroupAffinity GetNumaHighestNodeNumber GetLogicalProcessorInformationEx GetTickCount64 GetCurrentProcessorNumberEx TlsFree TlsSetValue InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList GetCurrentThread CloseHandle DuplicateHandle GetLastError SetEvent WaitForSingleObjectEx GetCurrentProcess TlsAlloc InitializeCriticalSectionEx CreateEventExW Sleep SignalObjectAndWait SwitchToThread CreateThread SetThreadPriority GetThreadPriority TlsGetValue

??0?$_SpinWait@$00@details@Concurrency@@QEAA@P6AXXZ@Z ??0?$_SpinWait@$0A@@details@Concurrency@@QEAA@P6AXXZ@Z ??0SchedulerPolicy@Concurrency@@QEAA@AEBV01@@Z ??0SchedulerPolicy@Concurrency@@QEAA@XZ ??0SchedulerPolicy@Concurrency@@QEAA@_KZZ ??0_Cancellation_beacon@details@Concurrency@@QEAA@XZ ??0_Concurrent_queue_base_v4@details@Concurrency@@IEAA@_K@Z ??0_Concurrent_queue_iterator_base_v4@details@Concurrency@@IEAA@AEBV_Concurrent_queue_base_v4@12@@Z ??0_Condition_variable@details@Concurrency@@QEAA@XZ ??0_Context@details@Concurrency@@QEAA@PEAVContext@2@@Z ??0_NonReentrantBlockingLock@details@Concurrency@@QEAA@XZ ??0_NonReentrantPPLLock@details@Concurrency@@QEAA@XZ ??0_ReaderWriterLock@details@Concurrency@@QEAA@XZ ??0_ReentrantBlockingLock@details@Concurrency@@QEAA@XZ ??0_ReentrantLock@details@Concurrency@@QEAA@XZ ??0_ReentrantPPLLock@details@Concurrency@@QEAA@XZ ??0_Runtime_object@details@Concurrency@@QEAA@H@Z ??0_Runtime_object@details@Concurrency@@QEAA@XZ ??0_Scheduler@details@Concurrency@@QEAA@PEAVScheduler@2@@Z ??0_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QEAA@AEAV123@@Z ??0_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QEAA@AEAV123@@Z ??0_SpinLock@details@Concurrency@@QEAA@AECJ@Z ??0_StructuredTaskCollection@details@Concurrency@@QEAA@PEAV_CancellationTokenState@12@@Z ??0_TaskCollection@details@Concurrency@@QEAA@PEAV_CancellationTokenState@12@@Z ??0_TaskCollection@details@Concurrency@@QEAA@XZ ??0_Timer@details@Concurrency@@IEAA@I_N@Z ??0agent@Concurrency@@QEAA@AEAVScheduleGroup@1@@Z ??0agent@Concurrency@@QEAA@AEAVScheduler@1@@Z ??0agent@Concurrency@@QEAA@XZ ??0bad_target@Concurrency@@QEAA@PEBD@Z ??0bad_target@Concurrency@@QEAA@XZ ??0context_self_unblock@Concurrency@@QEAA@PEBD@Z ??0context_self_unblock@Concurrency@@QEAA@XZ ??0context_unblock_unbalanced@Concurrency@@QEAA@PEBD@Z ??0context_unblock_unbalanced@Concurrency@@QEAA@XZ ??0critical_section@Concurrency@@QEAA@XZ ??0default_scheduler_exists@Concurrency@@QEAA@PEBD@Z ??0default_scheduler_exists@Concurrency@@QEAA@XZ ??0event@Concurrency@@QEAA@XZ ??0improper_lock@Concurrency@@QEAA@PEBD@Z ??0improper_lock@Concurrency@@QEAA@XZ ??0improper_scheduler_attach@Concurrency@@QEAA@PEBD@Z ??0improper_scheduler_attach@Concurrency@@QEAA@XZ ??0improper_scheduler_detach@Concurrency@@QEAA@PEBD@Z ??0improper_scheduler_detach@Concurrency@@QEAA@XZ ??0improper_scheduler_reference@Concurrency@@QEAA@PEBD@Z ??0improper_scheduler_reference@Concurrency@@QEAA@XZ ??0invalid_link_target@Concurrency@@QEAA@PEBD@Z ??0invalid_link_target@Concurrency@@QEAA@XZ ??0invalid_multiple_scheduling@Concurrency@@QEAA@PEBD@Z ??0invalid_multiple_scheduling@Concurrency@@QEAA@XZ ??0invalid_oversubscribe_operation@Concurrency@@QEAA@PEBD@Z ??0invalid_oversubscribe_operation@Concurrency@@QEAA@XZ ??0invalid_scheduler_policy_key@Concurrency@@QEAA@PEBD@Z ??0invalid_scheduler_policy_key@Concurrency@@QEAA@XZ ??0invalid_scheduler_policy_thread_specification@Concurrency@@QEAA@PEBD@Z ??0invalid_scheduler_policy_thread_specification@Concurrency@@QEAA@XZ ??0invalid_scheduler_policy_value@Concurrency@@QEAA@PEBD@Z ??0invalid_scheduler_policy_value@Concurrency@@QEAA@XZ ??0message_not_found@Concurrency@@QEAA@PEBD@Z ??0message_not_found@Concurrency@@QEAA@XZ ??0missing_wait@Concurrency@@QEAA@PEBD@Z ??0missing_wait@Concurrency@@QEAA@XZ ??0nested_scheduler_missing_detach@Concurrency@@QEAA@PEBD@Z ??0nested_scheduler_missing_detach@Concurrency@@QEAA@XZ ??0operation_timed_out@Concurrency@@QEAA@PEBD@Z ??0operation_timed_out@Concurrency@@QEAA@XZ ??0reader_writer_lock@Concurrency@@QEAA@XZ ??0scheduler_not_attached@Concurrency@@QEAA@PEBD@Z ??0scheduler_not_attached@Concurrency@@QEAA@XZ ??0scheduler_resource_allocation_error@Concurrency@@QEAA@J@Z ??0scheduler_resource_allocation_error@Concurrency@@QEAA@PEBDJ@Z ??0scheduler_worker_creation_error@Concurrency@@QEAA@J@Z ??0scheduler_worker_creation_error@Concurrency@@QEAA@PEBDJ@Z ??0scoped_lock@critical_section@Concurrency@@QEAA@AEAV12@@Z ??0scoped_lock@reader_writer_lock@Concurrency@@QEAA@AEAV12@@Z ??0scoped_lock_read@reader_writer_lock@Concurrency@@QEAA@AEAV12@@Z ??0unsupported_os@Concurrency@@QEAA@PEBD@Z ??0unsupported_os@Concurrency@@QEAA@XZ ??1SchedulerPolicy@Concurrency@@QEAA@XZ ??1_Cancellation_beacon@details@Concurrency@@QEAA@XZ ??1_Concurrent_queue_base_v4@details@Concurrency@@MEAA@XZ ??1_Concurrent_queue_iterator_base_v4@details@Concurrency@@IEAA@XZ ??1_Concurrent_vector_base_v4@details@Concurrency@@IEAA@XZ ??1_Condition_variable@details@Concurrency@@QEAA@XZ ??1_NonReentrantBlockingLock@details@Concurrency@@QEAA@XZ ??1_ReentrantBlockingLock@details@Concurrency@@QEAA@XZ ??1_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QEAA@XZ ??1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QEAA@XZ ??1_SpinLock@details@Concurrency@@QEAA@XZ ??1_StructuredTaskCollection@details@Concurrency@@QEAA@XZ ??1_TaskCollection@details@Concurrency@@QEAA@XZ ??1_Timer@details@Concurrency@@MEAA@XZ ??1agent@Concurrency@@UEAA@XZ ??1critical_section@Concurrency@@QEAA@XZ ??1event@Concurrency@@QEAA@XZ ??1reader_writer_lock@Concurrency@@QEAA@XZ ??1scoped_lock@critical_section@Concurrency@@QEAA@XZ ??1scoped_lock@reader_writer_lock@Concurrency@@QEAA@XZ ??1scoped_lock_read@reader_writer_lock@Concurrency@@QEAA@XZ ??4?$_SpinWait@$00@details@Concurrency@@QEAAAEAV012@$$QEAV012@@Z ??4?$_SpinWait@$00@details@Concurrency@@QEAAAEAV012@AEBV012@@Z ??4?$_SpinWait@$0A@@details@Concurrency@@QEAAAEAV012@$$QEAV012@@Z ??4?$_SpinWait@$0A@@details@Concurrency@@QEAAAEAV012@AEBV012@@Z ??4SchedulerPolicy@Concurrency@@QEAAAEAV01@AEBV01@@Z ??_F?$_SpinWait@$00@details@Concurrency@@QEAAXXZ ??_F?$_SpinWait@$0A@@details@Concurrency@@QEAAXXZ ??_F_Context@details@Concurrency@@QEAAXXZ ??_F_Scheduler@details@Concurrency@@QEAAXXZ ?AgentEventGuid@Concurrency@@3U_GUID@@B ?Alloc@Concurrency@@YAPEAX_K@Z ?Block@Context@Concurrency@@SAXXZ ?ChoreEventGuid@Concurrency@@3U_GUID@@B ?ConcRTEventGuid@Concurrency@@3U_GUID@@B ?ConcRT_ProviderGuid@Concurrency@@3U_GUID@@B ?ContextEventGuid@Concurrency@@3U_GUID@@B ?Create@CurrentScheduler@Concurrency@@SAXAEBVSchedulerPolicy@2@@Z ?Create@Scheduler@Concurrency@@SAPEAV12@AEBVSchedulerPolicy@2@@Z ?CreateResourceManager@Concurrency@@YAPEAUIResourceManager@1@XZ ?CreateScheduleGroup@CurrentScheduler@Concurrency@@SAPEAVScheduleGroup@2@AEAVlocation@2@@Z ?CreateScheduleGroup@CurrentScheduler@Concurrency@@SAPEAVScheduleGroup@2@XZ ?CurrentContext@Context@Concurrency@@SAPEAV12@XZ ?Detach@CurrentScheduler@Concurrency@@SAXXZ ?DisableTracing@Concurrency@@YAJXZ ?EnableTracing@Concurrency@@YAJXZ ?Free@Concurrency@@YAXPEAX@Z ?Get@CurrentScheduler@Concurrency@@SAPEAVScheduler@2@XZ ?GetExecutionContextId@Concurrency@@YAIXZ ?GetNumberOfVirtualProcessors@CurrentScheduler@Concurrency@@SAIXZ ?GetOSVersion@Concurrency@@YA?AW4OSVersion@IResourceManager@1@XZ ?GetPolicy@CurrentScheduler@Concurrency@@SA?AVSchedulerPolicy@2@XZ ?GetPolicyValue@SchedulerPolicy@Concurrency@@QEBAIW4PolicyElementKey@2@@Z ?GetProcessorCount@Concurrency@@YAIXZ ?GetProcessorNodeCount@Concurrency@@YAIXZ ?GetSchedulerId@Concurrency@@YAIXZ ?GetSharedTimerQueue@details@Concurrency@@YAPEAXXZ ?Id@Context@Concurrency@@SAIXZ ?Id@CurrentScheduler@Concurrency@@SAIXZ ?IsAvailableLocation@CurrentScheduler@Concurrency@@SA_NAEBVlocation@2@@Z ?IsCurrentTaskCollectionCanceling@Context@Concurrency@@SA_NXZ ?LockEventGuid@Concurrency@@3U_GUID@@B ?Log2@details@Concurrency@@YAK_K@Z ?NFS_Allocate@details@Concurrency@@YAPEAX_K0PEAX@Z ?NFS_Free@details@Concurrency@@YAXPEAX@Z ?NFS_GetLineSize@details@Concurrency@@YA_KXZ ?Oversubscribe@Context@Concurrency@@SAX_N@Z ?PPLParallelForEventGuid@Concurrency@@3U_GUID@@B ?PPLParallelForeachEventGuid@Concurrency@@3U_GUID@@B ?PPLParallelInvokeEventGuid@Concurrency@@3U_GUID@@B ?RegisterShutdownEvent@CurrentScheduler@Concurrency@@SAXPEAX@Z ?ResetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXXZ ?ResourceManagerEventGuid@Concurrency@@3U_GUID@@B ?ScheduleGroupEventGuid@Concurrency@@3U_GUID@@B ?ScheduleGroupId@Context@Concurrency@@SAIXZ ?ScheduleTask@CurrentScheduler@Concurrency@@SAXP6AXPEAX@Z0@Z ?ScheduleTask@CurrentScheduler@Concurrency@@SAXP6AXPEAX@Z0AEAVlocation@2@@Z ?SchedulerEventGuid@Concurrency@@3U_GUID@@B ?SetConcurrencyLimits@SchedulerPolicy@Concurrency@@QEAAXII@Z ?SetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXAEBVSchedulerPolicy@2@@Z ?SetPolicyValue@SchedulerPolicy@Concurrency@@QEAAIW4PolicyElementKey@2@I@Z ?VirtualProcessorEventGuid@Concurrency@@3U_GUID@@B ?VirtualProcessorId@Context@Concurrency@@SAIXZ ?Yield@Context@Concurrency@@SAXXZ ?_Abort@_StructuredTaskCollection@details@Concurrency@@AEAAXXZ ?_Acquire@_NonReentrantBlockingLock@details@Concurrency@@QEAAXXZ ?_Acquire@_NonReentrantPPLLock@details@Concurrency@@QEAAXPEAX@Z ?_Acquire@_ReentrantBlockingLock@details@Concurrency@@QEAAXXZ ?_Acquire@_ReentrantLock@details@Concurrency@@QEAAXXZ ?_Acquire@_ReentrantPPLLock@details@Concurrency@@QEAAXPEAX@Z ?_AcquireRead@_ReaderWriterLock@details@Concurrency@@QEAAXXZ ?_AcquireWrite@_ReaderWriterLock@details@Concurrency@@QEAAXXZ ?_Advance@_Concurrent_queue_iterator_base_v4@details@Concurrency@@IEAAXXZ ?_Assign@_Concurrent_queue_iterator_base_v4@details@Concurrency@@IEAAXAEBV123@@Z ?_Byte_reverse_table@details@Concurrency@@3QBEB ?_Cancel@_StructuredTaskCollection@details@Concurrency@@QEAAXXZ ?_Cancel@_TaskCollection@details@Concurrency@@QEAAXXZ ?_CheckTaskCollection@_UnrealizedChore@details@Concurrency@@IEAAXXZ ?_CleanupToken@_StructuredTaskCollection@details@Concurrency@@AEAAXXZ ?_ConcRT_CoreAssert@details@Concurrency@@YAXPEBD0H@Z ?_ConcRT_Trace@details@Concurrency@@YAXHPEB_WZZ ?_Confirm_cancel@_Cancellation_beacon@details@Concurrency@@QEAA_NXZ ?_CurrentContext@_Context@details@Concurrency@@SA?AV123@XZ ?_Current_node@location@Concurrency@@SA?AV12@XZ ?_Destroy@_AsyncTaskCollection@details@Concurrency@@EEAAXXZ ?_DoYield@?$_SpinWait@$00@details@Concurrency@@IEAAXXZ ?_DoYield@?$_SpinWait@$0A@@details@Concurrency@@IEAAXXZ ?_Get@_CurrentScheduler@details@Concurrency@@SA?AV_Scheduler@23@XZ ?_GetCombinableSize@details@Concurrency@@YA_KXZ ?_GetConcRTTraceInfo@Concurrency@@YAPEBU_CONCRT_TRACE_INFO@details@1@XZ ?_GetConcurrency@details@Concurrency@@YAIXZ ?_GetCurrentInlineDepth@_StackGuard@details@Concurrency@@CAAEA_KXZ ?_GetNumberOfVirtualProcessors@_CurrentScheduler@details@Concurrency@@SAIXZ ?_GetScheduler@_Scheduler@details@Concurrency@@QEAAPEAVScheduler@3@XZ ?_Id@_CurrentScheduler@details@Concurrency@@SAIXZ ?_Internal_assign@_Concurrent_vector_base_v4@details@Concurrency@@IEAAXAEBV123@_KP6AXPEAX1@ZP6AX2PEBX1@Z5@Z ?_Internal_capacity@_Concurrent_vector_base_v4@details@Concurrency@@IEBA_KXZ ?_Internal_clear@_Concurrent_vector_base_v4@details@Concurrency@@IEAA_KP6AXPEAX_K@Z@Z ?_Internal_compact@_Concurrent_vector_base_v4@details@Concurrency@@IEAAPEAX_KPEAXP6AX10@ZP6AX1PEBX0@Z@Z ?_Internal_copy@_Concurrent_vector_base_v4@details@Concurrency@@IEAAXAEBV123@_KP6AXPEAXPEBX1@Z@Z ?_Internal_empty@_Concurrent_queue_base_v4@details@Concurrency@@IEBA_NXZ ?_Internal_finish_clear@_Concurrent_queue_base_v4@details@Concurrency@@IEAAXXZ ?_Internal_grow_by@_Concurrent_vector_base_v4@details@Concurrency@@IEAA_K_K0P6AXPEAXPEBX0@Z2@Z ?_Internal_grow_to_at_least_with_result@_Concurrent_vector_base_v4@details@Concurrency@@IEAA_K_K0P6AXPEAXPEBX0@Z2@Z ?_Internal_move_push@_Concurrent_queue_base_v4@details@Concurrency@@IEAAXPEAX@Z ?_Internal_pop_if_present@_Concurrent_queue_base_v4@details@Concurrency@@IEAA_NPEAX@Z ?_Internal_push@_Concurrent_queue_base_v4@details@Concurrency@@IEAAXPEBX@Z ?_Internal_push_back@_Concurrent_vector_base_v4@details@Concurrency@@IEAAPEAX_KAEA_K@Z ?_Internal_reserve@_Concurrent_vector_base_v4@details@Concurrency@@IEAAX_K00@Z ?_Internal_resize@_Concurrent_vector_base_v4@details@Concurrency@@IEAAX_K00P6AXPEAX0@ZP6AX1PEBX0@Z3@Z ?_Internal_size@_Concurrent_queue_base_v4@details@Concurrency@@IEBA_KXZ ?_Internal_swap@_Concurrent_queue_base_v4@details@Concurrency@@IEAAXAEAV123@@Z ?_Internal_swap@_Concurrent_vector_base_v4@details@Concurrency@@IEAAXAEAV123@@Z ?_Internal_throw_exception@_Concurrent_queue_base_v4@details@Concurrency@@IEBAXXZ ?_Internal_throw_exception@_Concurrent_vector_base_v4@details@Concurrency@@IEBAX_K@Z ?_IsCanceling@_StructuredTaskCollection@details@Concurrency@@QEAA_NXZ ?_IsCanceling@_TaskCollection@details@Concurrency@@QEAA_NXZ ?_IsSynchronouslyBlocked@_Context@details@Concurrency@@QEBA_NXZ ?_NewCollection@_AsyncTaskCollection@details@Concurrency@@SAPEAV123@PEAV_CancellationTokenState@23@@Z ?_NumberOfSpins@?$_SpinWait@$00@details@Concurrency@@IEAAKXZ ?_NumberOfSpins@?$_SpinWait@$0A@@details@Concurrency@@IEAAKXZ ?_Oversubscribe@_Context@details@Concurrency@@SAX_N@Z ?_Reference@_Scheduler@details@Concurrency@@QEAAIXZ ?_Release@_NonReentrantBlockingLock@details@Concurrency@@QEAAXXZ ?_Release@_NonReentrantPPLLock@details@Concurrency@@QEAAXXZ ?_Release@_ReentrantBlockingLock@details@Concurrency@@QEAAXXZ ?_Release@_ReentrantLock@details@Concurrency@@QEAAXXZ ?_Release@_ReentrantPPLLock@details@Concurrency@@QEAAXXZ ?_Release@_Scheduler@details@Concurrency@@QEAAIXZ ?_ReleaseRead@_ReaderWriterLock@details@Concurrency@@QEAAXXZ ?_ReleaseWrite@_ReaderWriterLock@details@Concurrency@@QEAAXXZ ?_Reset@?$_SpinWait@$00@details@Concurrency@@IEAAXXZ ?_Reset@?$_SpinWait@$0A@@details@Concurrency@@IEAAXXZ ?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QEAA?AW4_TaskCollectionStatus@23@PEAV_UnrealizedChore@23@@Z ?_RunAndWait@_TaskCollection@details@Concurrency@@QEAA?AW4_TaskCollectionStatus@23@PEAV_UnrealizedChore@23@@Z ?_Schedule@_StructuredTaskCollection@details@Concurrency@@QEAAXPEAV_UnrealizedChore@23@@Z ?_Schedule@_StructuredTaskCollection@details@Concurrency@@QEAAXPEAV_UnrealizedChore@23@PEAVlocation@3@@Z ?_Schedule@_TaskCollection@details@Concurrency@@QEAAXPEAV_UnrealizedChore@23@@Z ?_Schedule@_TaskCollection@details@Concurrency@@QEAAXPEAV_UnrealizedChore@23@PEAVlocation@3@@Z ?_ScheduleTask@_CurrentScheduler@details@Concurrency@@SAXP6AXPEAX@Z0@Z ?_Segment_index_of@_Concurrent_vector_base_v4@details@Concurrency@@KA_K_K@Z ?_SetSpinCount@?$_SpinWait@$00@details@Concurrency@@QEAAXI@Z ?_SetSpinCount@?$_SpinWait@$0A@@details@Concurrency@@QEAAXI@Z ?_ShouldSpinAgain@?$_SpinWait@$00@details@Concurrency@@IEAA_NXZ ?_ShouldSpinAgain@?$_SpinWait@$0A@@details@Concurrency@@IEAA_NXZ ?_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QEAA_NXZ ?_SpinOnce@?$_SpinWait@$0A@@details@Concurrency@@QEAA_NXZ ?_SpinYield@Context@Concurrency@@SAXXZ ?_Start@_Timer@details@Concurrency@@IEAAXXZ ?_Stop@_Timer@details@Concurrency@@IEAAXXZ ?_Trace_agents@Concurrency@@YAXW4Agents_EventType@1@_JZZ ?_Trace_ppl_function@Concurrency@@YAXAEBU_GUID@@EW4ConcRT_EventType@1@@Z ?_TryAcquire@_NonReentrantBlockingLock@details@Concurrency@@QEAA_NXZ ?_TryAcquire@_ReentrantBlockingLock@details@Concurrency@@QEAA_NXZ ?_TryAcquire@_ReentrantLock@details@Concurrency@@QEAA_NXZ ?_TryAcquireWrite@_ReaderWriterLock@details@Concurrency@@QEAA_NXZ ?_UnderlyingYield@details@Concurrency@@YAXXZ ?_Value@_SpinCount@details@Concurrency@@SAIXZ ?_Yield@_Context@details@Concurrency@@SAXXZ ?cancel@agent@Concurrency@@QEAA_NXZ ?current@location@Concurrency@@SA?AV12@XZ ?done@agent@Concurrency@@IEAA_NXZ ?from_numa_node@location@Concurrency@@SA?AV12@G@Z ?get_error_code@scheduler_resource_allocation_error@Concurrency@@QEBAJXZ ?is_current_task_group_canceling@Concurrency@@YA_NXZ ?lock@critical_section@Concurrency@@QEAAXXZ ?lock@reader_writer_lock@Concurrency@@QEAAXXZ ?lock_read@reader_writer_lock@Concurrency@@QEAAXXZ ?native_handle@critical_section@Concurrency@@QEAAAEAV12@XZ ?notify_all@_Condition_variable@details@Concurrency@@QEAAXXZ ?notify_one@_Condition_variable@details@Concurrency@@QEAAXXZ ?reset@event@Concurrency@@QEAAXXZ ?set@event@Concurrency@@QEAAXXZ ?set_task_execution_resources@Concurrency@@YAXGPEAU_GROUP_AFFINITY@@@Z ?set_task_execution_resources@Concurrency@@YAX_K@Z ?start@agent@Concurrency@@QEAA_NXZ ?status@agent@Concurrency@@QEAA?AW4agent_status@2@XZ ?status_port@agent@Concurrency@@QEAAPEAV?$ISource@W4agent_status@Concurrency@@@2@XZ ?try_lock@critical_section@Concurrency@@QEAA_NXZ ?try_lock@reader_writer_lock@Concurrency@@QEAA_NXZ ?try_lock_for@critical_section@Concurrency@@QEAA_NI@Z ?try_lock_read@reader_writer_lock@Concurrency@@QEAA_NXZ ?unlock@critical_section@Concurrency@@QEAAXXZ ?unlock@reader_writer_lock@Concurrency@@QEAAXXZ ?wait@Concurrency@@YAXI@Z ?wait@_Condition_variable@details@Concurrency@@QEAAXAEAVcritical_section@3@@Z ?wait@agent@Concurrency@@SA?AW4agent_status@2@PEAV12@I@Z ?wait@event@Concurrency@@QEAA_KI@Z ?wait_for@_Condition_variable@details@Concurrency@@QEAA_NAEAVcritical_section@3@I@Z ?wait_for_all@agent@Concurrency@@SAX_KPEAPEAV12@PEAW4agent_status@2@I@Z ?wait_for_multiple@event@Concurrency@@SA_KPEAPEAV12@_K_NI@Z ?wait_for_one@agent@Concurrency@@SAX_KPEAPEAV12@AEAW4agent_status@2@AEA_KI@Z

i640.cab.cat

SHA256 97b7d04831178e83ff2a73c18de744bf04a486fe09ab718ae662d6c30fed9f84
MD5 0357975259894a9f076ef78cdc434c8c
SHA1 b715fffca7635d601ce965954b7ee696a77ddb34
SHA512 2febdc2383b9f0ebe50b83c00911afb301ad7ce38553716e4fd782a13c32c6bf44cbf28268155fd3efc78f456a4e54aeb0925857675fc5db2902e95d7ed54321
SSDEEP 384:bKlKyHQQ3aI36nuax7ui9UURp0I/J/bSWk8ub+WflNwmb29RjuO9R9zptUzL:m4yHTKI36mi9UURp0IhbG8ubdq9z+
TLSH
T1FDE2DC21940006C3C14B693854AAFA2ED0FB9FBE9065613E75B7B6740973291FB6FA13
MD5 SHA1 SHA512 SSDEEP TLSH

i640.hash

SHA256 e2e2c9b8b1eeea49dca58800b0dfa594908823e90085c05881f4550033c2ae8b
MD5 a360fe7377d0127ab5d3a973608ce1aa
SHA1 c87dcf8cde6434fcb3ba0302b92030d5507c0ef0
SHA512 227ad17ee12f630f6853c9288e65c6f36c50ef5e9a9545d5382b9681237b3a586805b0b95d68114b2ad744595d59061b20cbf6a6e10a6d9fb2449a506989af7e
TLSH
T137B0127E68A8133680B1C2308FC08167D1110403C0090E2C60C30F8B03C6A837CC28BF
MD5 SHA1 SHA512 TLSH

inventory.dll

IMPHASH d37c152dc256b8651b3821669fd6e521
SHA256 893d376b3155bd769f9498c75e0509224d3246ad2200b3ffc29fc82d370db4a2
MD5 61c89bc66aa3bf3cd7a40a8611d14132
SHA1 1a09e9543ccbe993d7c80109344ee140071aeb67
SHA512 711ef0f649c8f515f94db2fc072b6932733a0ffd0de64be6cf5ac895c633125908e7a6cf1000773b94e54e0b7b810f224001c30d314262939be0f32e58151fb3
SSDEEP 49152:QRCSa8fwqjD6l/5/WOboBhiCAIxLkP3CCHLNPVEZOD0jSSjD4Y5GCb/p7wrmhSZE:ufn6dVWQUx2yd/7QbZWspJkKOC/jR
TLSH
T13C667D55A2F446A9F0B7D2F8CA3B8532FB727C551632934B0661C65A2F37B208D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x64 arch:x64

Digest

21:25:02:b6:37:04:4e:bf:71:c1:ab:62:62:2c:8c:37:90:53:38:1b:2c:1c:63:13:90:17:3b:8d:64:a0:0c:07

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 30, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

21:25:02:b6:37:04:4e:bf:71:c1:ab:62:62:2c:8c:37:90:53:38:1b:2c:1c:63:13:90:17:3b:8d:64:a0:0c:07

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 30, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:431A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1d:4b:c0:92:87:38:85:7e:39:00:01:00:00:02:1d

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Minor OS version

1

Major OS version

6

Entry point

4319792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d:\dbs\el\omr\target\x64\ship\c2rsvcmgr\x-none\Inventory.pdb

kernel32

GetLastError CompareStringEx GetModuleHandleExW GetProcAddress GetCurrentProcess IsWow64Process FreeLibrary MultiByteToWideChar GetDiskFreeSpaceExW CloseHandle CreatePipe CreateProcessW PeekNamedPipe ReadFile GetGeoInfoW HeapFree GetProcessHeap SetFilePointerEx RaiseException ExpandEnvironmentStringsW WideCharToMultiByte OpenProcess GetProcessTimes GetTickCount64 GetSystemTimeAsFileTime TerminateProcess GetModuleFileNameA GetShortPathNameA GetModuleFileNameW LoadLibraryExW FindResourceW SizeofResource LoadResource GetModuleHandleW VerSetConditionMask VerifyVersionInfoW GetCurrentProcessId GlobalMemoryStatusEx GetVersionExW GetUserDefaultLocaleName IsValidCodePage SetLastError GetSystemTime SystemTimeToFileTime FileTimeToSystemTime GetStringTypeExW CreateFileW DeviceIoControl GetComputerNameW FormatMessageA LocalFree GetNativeSystemInfo GetSystemDirectoryW CreateActCtxW ActivateActCtx OutputDebugStringA FindActCtxSectionStringW DeactivateActCtx QueryActCtxW LoadLibraryW HeapAlloc ReleaseSemaphore WaitForSingleObjectEx CreateEventExW SetEvent CreateEventW WaitForSingleObject AcquireSRWLockExclusive ReleaseSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared CreateThread WaitForMultipleObjectsEx WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork GetCurrentThreadId OpenEventW ReleaseMutex CreateMutexExW OpenMutexW GetTempPathW GetLongPathNameW GetFinalPathNameByHandleW DeleteFileW CreateDirectoryW GetFileAttributesExW SetFileAttributesW DisableThreadLibraryCalls FindFirstFileExW FindNextFileW FindClose GetFileType GetOverlappedResult GetFileTime SetFileInformationByHandle ResetEvent QueryPerformanceCounter QueryPerformanceFrequency GlobalFree GlobalAlloc QueryUnbiasedInterruptTime GetFileSizeEx SetEndOfFile WriteFile SetFileTime FlushFileBuffers CancelIoEx GetTempFileNameW GetProcessAffinityMask CreateWaitableTimerW SetWaitableTimerEx CancelWaitableTimer QueryDepthSList InitializeCriticalSectionEx DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList RtlCaptureStackBackTrace GetTickCount InitOnceExecuteOnce GetLocalTime UnmapViewOfFile MapViewOfFile WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetCurrentThread GetQueuedCompletionStatus Sleep FlsFree FlsSetValue FlsGetValue FlsAlloc IsDebuggerPresent WaitForMultipleObjects CreateMemoryResourceNotification GetSystemPowerStatus QueryProcessCycleTime OpenThread QueryThreadCycleTime IsSystemResumeAutomatic OutputDebugStringW RtlCaptureContext OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA CreateFileMappingA LocalAlloc FindFirstFileW lstrcmpW ProcessIdToSessionId GetLocaleInfoEx LCIDToLocaleName LocaleNameToLCID GetLocaleInfoW ResolveLocaleName GetUserPreferredUILanguages GetACP LockResource EnumSystemLocalesEx GetSystemDefaultLocaleName LoadLibraryExA GetSystemDefaultLCID GetStringTypeW K32GetProcessMemoryInfo VirtualQuery VirtualProtect GetSystemInfo GetFileInformationByHandleEx InitOnceComplete InitOnceBeginInitialize IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry

oleaut32

SysAllocStringLen DispInvoke DispGetIDsOfNames LoadRegTypeLi VariantInit SysStringLen SysFreeString VariantClear

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __std_type_info_destroy_list __current_exception memmove memset wcsstr wcschr __C_specific_handler wcsrchr __RTDynamicCast __C_specific_handler_noexcept __std_terminate __std_exception_copy memcpy memcmp __std_exception_destroy memchr _CxxThrowException _purecall __std_type_info_compare strchr

msvcp140

?id@?$numpunct@D@std@@2V0locale@2@A ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xbad_alloc@std@@YAXXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ _Xtime_get_ticks ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?good@ios_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_init_in_situ _Mtx_lock _Mtx_unlock ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ??1_Locinfo@std@@QEAA@XZ ??1_Lockit@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??0_Lockit@std@@QEAA@H@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?id@?$ctype@_W@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?id@?$collate@_W@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z _Wcsxfrm _Wcscoll ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Xbad_function_call@std@@YAXXZ _Thrd_id _Mbrtowc ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?id@?$numpunct@_W@std@@2V0locale@2@A ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z _Cnd_init_in_situ _Cnd_wait _Query_perf_frequency _Query_perf_counter ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ?_Syserror_map@std@@YAPEBDH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ?toupper@?$ctype@_W@std@@QEBA_W_W@Z ?_Winerror_map@std@@YAHH@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z ?_Random_device@std@@YAIXZ ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z _Cnd_broadcast ?fail@ios_base@std@@QEBA_NXZ ?id@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ?_Getcat@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?get@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEB_W4@Z ?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBUtm@@PEB_W4@Z ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A ?tolower@?$ctype@D@std@@QEBADD@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z _Strxfrm _Strcoll ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z _Mtx_trylock _Thrd_yield ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??Bios_base@std@@QEBA_NXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

msvcp140_atomic_wait

__std_atomic_notify_all_direct __std_atomic_wait_direct

api-ms-win-crt-heap-l1-1-0

realloc malloc free calloc

api-ms-win-crt-runtime-l1-1-0

abort _invalid_parameter_noinfo _errno _cexit _crt_atexit _execute_onexit_table _register_onexit_function _invoke_watson _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _initterm_e _initterm terminate _clearfp

api-ms-win-crt-string-l1-1-0

wcscmp wcstok_s wcsncpy_s strcmp strncpy_s tolower wcsncat_s wmemcpy_s strncmp _stricmp strnlen isspace isblank towupper towlower isdigit _wcsnicmp wcscpy_s toupper _wcsicmp wcsnlen isxdigit isalnum

api-ms-win-crt-convert-l1-1-0

_itow_s atoi _i64tow_s wcstoull wcstoll strtoull strtol _wtoi _wcstoui64 strtoll _wcstoi64 strtod _ui64toa_s wcstombs_s wcstoul wcstod wcstol _ui64tow_s _wtoi64

api-ms-win-crt-stdio-l1-1-0

ungetc _get_stream_buffer_pointers fgetc fread fwrite fgetpos _fseeki64 fsetpos setvbuf fflush fclose __stdio_common_vswprintf __stdio_common_vsnwprintf_s __stdio_common_vsscanf __stdio_common_vsnprintf_s __stdio_common_vswscanf fputc __stdio_common_vswprintf_s __stdio_common_vsprintf __stdio_common_vsprintf_s

api-ms-win-crt-math-l1-1-0

floor expf ceilf log10 ceil _ldclass _fdclass _dclass _fdsign logf pow _dsign _ldsign round

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char localeconv

api-ms-win-crt-time-l1-1-0

_gmtime64_s wcsftime _mktime64 _time64 _localtime64_s

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

Name

.text

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

72KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

144KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

logcollector.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 669eee3e6d8363ce8ab1699055fb299e25b3334d7ae2eb893ceff77ad67e6830
MD5 d5476ced5267a7be9c3b26cd77630911
SHA1 2347bee550a7205f70b2bf91ca6219e22f9a284a
SHA512 d64ee08ef57a0978fd8e6cec770701901b27c5da6ee157e3724d278bc926f7a06b9b0578e3b9f0cd6ca2778ebbcf26ffdf3def9f8046762ab1bc4916e243214f
SSDEEP 1536:tNhtExpV6tv+7v8jnHxs5upvFjwVclWzbyx942ZzqRzN:XEXV6tv+7cnHxs5u/jqYWzbO9/EJ
TLSH
T18DA33B082BFC134AF6FA9EB0ACF149111E7BB6679820D21E6424610E157BFE5CE11B77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

30:d2:a5:39:2f:90:96:57:1d:b6:9d:33:75:31:21:58:ea:f6:70:2f:10:ca:f8:db:6f:bc:78:99:9a:a1:dc:93

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 7, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

30:d2:a5:39:2f:90:96:57:1d:b6:9d:33:75:31:21:58:ea:f6:70:2f:10:ca:f8:db:6f:bc:78:99:9a:a1:dc:93

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 7, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c3:33:ab:2c:1a:f5:42:f2:c8:00:00:00:00:00:c3

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2025 - Jun 18, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:23:4f:d9:60:24:53:cf:fe:2b:00:01:00:00:02:23

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:25:80:c7:37:c6:cd:aa:77:49:00:01:00:00:02:25

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

0

Major OS version

4

Entry point

48178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\dbs\el\omr\Target\x64\ship\click2runtools\x-none\logcollector.pdb

manageability.dll

IMPHASH a91e07ed0a92db968fa34f2c88998a80
SHA256 59d6ee0cc09cc15ce730c1a63257959a23190b1ea5156b0f69040e08546e5b9d
MD5 19e56f80e48ae484a9df3245e0b3035b
SHA1 1091e8d3598d7d825a7836ab1c5992327b9c0d85
SHA512 432c0290fee6add33686bba73ae14cec4af87245c84eaac4972c4633d9bfa11449a6eacea8e8a9a9bde526e517da07ba3a3123a6651f28a99fff6e492f761c56
SSDEEP 24576:nTuaDd3Opa7Wakcn5yRZN3JHbwRu19UPIpNJedPplgWa/qGT8:yOOpa7L15OzbwK9UwpydP/gbg
TLSH
T1B2753B5263F402ADF5FBE6B8DA778936EAB278561D31D30F0261C64A5F33B104939722
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x64 arch:x64

Digest

1e:6a:f5:30:e3:12:7f:21:cf:8f:27:61:93:c4:d6:7e:1b:66:6d:ad:b3:42:02:36:31:83:2e:82:a1:d3:6b:6e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 30, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

1e:6a:f5:30:e3:12:7f:21:cf:8f:27:61:93:c4:d6:7e:1b:66:6d:ad:b3:42:02:36:31:83:2e:82:a1:d3:6b:6e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 30, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:651A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:15:18:03:d3:81:07:26:7c:53:00:01:00:00:02:15

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Minor OS version

1

Major OS version

6

Entry point

1091216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d:\dbs\el\omr\target\x64\ship\c2rsvcmgr\x-none\Manageability.pdb

kernel32

GetCurrentProcess GetModuleHandleExW GetLastError CompareStringEx GetProcAddress FreeLibrary IsWow64Process ExpandEnvironmentStringsW FindClose FindFirstFileExW CreateDirectoryW DisableThreadLibraryCalls GetModuleFileNameW CreateEventExW CloseHandle ResetEvent SetEvent QueryPerformanceCounter QueryPerformanceFrequency GetUserDefaultLocaleName GlobalFree GlobalAlloc GlobalMemoryStatusEx RaiseException LoadLibraryExW GetVersionExW MultiByteToWideChar WideCharToMultiByte OpenProcess GetExitCodeProcess GetProcessTimes GetTickCount64 GetSystemTimeAsFileTime TerminateProcess GetModuleFileNameA GetShortPathNameA CreateProcessW FindResourceW SizeofResource LoadResource GetModuleHandleW VerSetConditionMask VerifyVersionInfoW GetCurrentProcessId IsValidCodePage SetLastError FileTimeToSystemTime GetStringTypeExW CreateFileW DeviceIoControl GetComputerNameW LocalFree GetNativeSystemInfo GetSystemDirectoryW CreateActCtxW ActivateActCtx HeapFree OutputDebugStringA FindActCtxSectionStringW DeactivateActCtx QueryActCtxW LoadLibraryW HeapAlloc GetProcessHeap QueryUnbiasedInterruptTime GetCurrentThreadId GetFileTime GetFileSizeEx SetEndOfFile WriteFile ReadFile SetFilePointerEx GetTempPathW SetFileTime CreateEventW GetOverlappedResult FlushFileBuffers CancelIoEx DeleteFileW GetFileAttributesExW SetFileAttributesW FindNextFileW GetFileType GetTempFileNameW WaitForSingleObject WaitForSingleObjectEx WaitForMultipleObjectsEx GetProcessAffinityMask CreateWaitableTimerW SetWaitableTimerEx CancelWaitableTimer QueryDepthSList InitializeCriticalSectionEx DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList RtlCaptureStackBackTrace ReleaseMutex GetLongPathNameW GetFinalPathNameByHandleW GetTickCount InitOnceExecuteOnce GetLocalTime ReleaseSemaphore AcquireSRWLockExclusive ReleaseSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared CreateThread WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork UnmapViewOfFile MapViewOfFile WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetCurrentThread GetQueuedCompletionStatus Sleep FlsFree FlsSetValue FlsGetValue FlsAlloc IsDebuggerPresent WaitForMultipleObjects CreateMemoryResourceNotification GetSystemPowerStatus QueryProcessCycleTime OpenThread QueryThreadCycleTime IsSystemResumeAutomatic RtlCaptureContext OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA CreateFileMappingA LocalAlloc GetPriorityClass ProcessIdToSessionId FindFirstFileW lstrcmpW K32GetProcessMemoryInfo GetSystemDefaultLCID RtlVirtualUnwind LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo InitOnceComplete InitOnceBeginInitialize IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlLookupFunctionEntry

oleaut32

LoadRegTypeLi DispInvoke DispGetIDsOfNames SysAllocString SysStringLen

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_purecall __std_terminate __std_exception_copy __std_exception_destroy wcsrchr __std_type_info_compare wcschr memmove __C_specific_handler_noexcept _CxxThrowException memcpy memcmp wcsstr memset __current_exception strchr __current_exception_context __std_type_info_destroy_list __C_specific_handler

msvcp140

?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z _Thrd_id ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_init_in_situ _Mtx_lock _Mtx_unlock _Xtime_get_ticks _Query_perf_counter _Query_perf_frequency ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ??1_Locinfo@std@@QEAA@XZ ??1_Lockit@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??0_Lockit@std@@QEAA@H@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?id@?$ctype@_W@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?id@?$collate@_W@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z _Wcsxfrm _Wcscoll ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uncaught_exceptions@std@@YAHXZ ?good@ios_base@std@@QEBA_NXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?seekp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_JH@Z ?_Xbad_function_call@std@@YAXXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?toupper@?$ctype@_W@std@@QEBA_W_W@Z _Cnd_init_in_situ _Cnd_wait ??7ios_base@std@@QEBA_NXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?always_noconv@codecvt_base@std@@QEBA_NXZ

api-ms-win-crt-heap-l1-1-0

realloc free malloc

api-ms-win-crt-stdio-l1-1-0

fputc ungetc fgetc fread fwrite fgetpos _fseeki64 fsetpos __stdio_common_vsprintf_s _get_stream_buffer_pointers setvbuf __stdio_common_vswprintf_s __stdio_common_vsnwprintf_s fclose fflush

api-ms-win-crt-runtime-l1-1-0

_clearfp abort _invoke_watson _invalid_parameter_noinfo _errno terminate _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _initterm_e _initterm

api-ms-win-crt-string-l1-1-0

_stricmp strnlen strcmp wcscpy_s wcsnlen isdigit strncpy_s wmemcpy_s wcscmp wcsncpy_s

api-ms-win-crt-time-l1-1-0

_localtime64_s _difftime64 _time64 wcsftime

api-ms-win-crt-convert-l1-1-0

wcstoll _ui64toa_s _i64tow_s wcstoul

api-ms-win-crt-math-l1-1-0

expf floor logf log10 round _dclass _fdclass ceilf pow

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

434KB

Virtual Size

434KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

msix.dll

IMPHASH a6c7266e8aa349d3ff36476adca65c39
SHA256 cd443b5645bf2c66c883cbf0df091a3d5519c9f534fc6003867b10af0bb499e8
MD5 499a1a771d95cac5174c44c8314e9e09
SHA1 bbab3646c3147c9815fd97a8a7583c570fb034c0
SHA512 72421dd277cd336f043448d4652b633fd5d81d87f177fe41f78da96726c16e1995be7ee373db6d5f564b6837126ac8b52e2f2e5831a2bead623d5daa06fe6791
SSDEEP 12288:MVtleLjozn6qBXCiQnprBPzGnjST2l8crdHp+f:MVv5zn6qBSiQnplEj82lNtpK
TLSH
T143E48D3AEAAC4026D1F6D17CC9A34526FBB678050372A7DB47A056892F277E01F3D721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

55:b7:4e:7d:af:09:b1:cf:08:5f:05:9a:b7:25:f8:12:f4:50:c1:80:58:7d:6e:1b:47:61:ff:a5:e6:0d:fc:9f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

55:b7:4e:7d:af:09:b1:cf:08:5f:05:9a:b7:25:f8:12:f4:50:c1:80:58:7d:6e:1b:47:61:ff:a5:e6:0d:fc:9f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1e:a3:ac:a4:6e:39:6f:7c:49:00:01:00:00:02:1e

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:21:33:c0:35:fb:d2:0f:21:a4:00:01:00:00:02:21

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

345488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\dbs\el\omr\Target\x64\ship\repoman\x-none\msix.pdb

kernel32

MultiByteToWideChar WideCharToMultiByte GetLastError RaiseException CreateDirectoryW FindFirstFileW GetFullPathNameW FindNextFileW FindClose GetFileAttributesW LocalFree InitOnceExecuteOnce VirtualQuery VirtualProtect GetSystemInfo LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError InterlockedFlushSList RtlPcToFileHeader RtlUnwindEx IsDebuggerPresent InitializeSListHead GetCurrentProcessId IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable GetProcAddress GetModuleHandleW GetSystemTimeAsFileTime GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetStringTypeW QueryPerformanceCounter GetCurrentThreadId TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive LoadLibraryExA

oleaut32

SysFreeString SysAllocStringLen VariantClear GetErrorInfo VariantInit

api-ms-win-crt-heap-l1-1-0

calloc free _callnewh malloc realloc

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _cexit _configure_narrow_argv abort _seh_filter_dll terminate _initterm_e _initterm _errno _initialize_narrow_environment _invoke_watson

api-ms-win-crt-stdio-l1-1-0

fwrite fopen_s feof _ftelli64 _fsopen _get_stream_buffer_pointers fsetpos ungetc setvbuf fgetpos fseek fread fgetc fflush fputc __stdio_common_vsprintf_s _wfopen_s _fseeki64 fclose

api-ms-win-crt-filesystem-l1-1-0

_lock_file remove _unlock_file

api-ms-win-crt-string-l1-1-0

strcpy_s tolower wcsncmp towlower strcspn strncmp strlen wcsnlen __strncnt islower _wcsdup strcmp isupper

api-ms-win-crt-locale-l1-1-0

___lc_collate_cp_func __initialize_lconv_for_unsigned_char ___mb_cur_max_func __pctype_func setlocale ___lc_codepage_func localeconv _lock_locales ___lc_locale_name_func _unlock_locales

api-ms-win-crt-math-l1-1-0

frexp _dclass _ldclass

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-convert-l1-1-0

strtol strtoull strtoul

Name

.text

Size

377KB

Virtual Size

376KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

229KB

Virtual Size

229KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

296B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

msvcp140.dll

IMPHASH a29913e289925d243ffca4cf74f9992a
SHA256 b30327d49edc035869ce340ee60680d2bbd0684cc359bf5771695fca9aafbb42
MD5 f852e4ce8718e3f70317a713997d9c89
SHA1 f7b8966b18a5f29a46d931d7076da2af649045b8
SHA512 151880d00db1db6ec34b23541ebbd3f8160b32750ffaefc7bbeff2943bd536f2e2b786dbd45eaf3cd2de63ac14875f4f485dfc5efb8bf9e04b0c6b5732e1fdaa
SSDEEP 12288:fdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa6b:fdnGoU/7m/V5WZkdQEKZm+jWodEER7b
TLSH
T116C41A27F74906E0E195E3B8A1838702D7F1BC4A8322E3C752EB955D2F573D0A67B690
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

DLL Hijacking vulnerability

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

318128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb

vcruntime140

__current_exception_context __C_specific_handler memcmp __uncaught_exceptions __uncaught_exception memchr memmove __std_terminate _purecall memset memcpy _CxxThrowException __AdjustPointer __current_exception __std_exception_destroy __std_type_info_destroy_list __std_exception_copy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-heap-l1-1-0

free malloc realloc calloc _callnewh

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initterm_e _initterm _execute_onexit_table _initialize_onexit_table _configure_narrow_argv _crt_atexit _seh_filter_dll _endthreadex _beginthreadex _set_new_handler _errno _cexit abort _invoke_watson terminate _initialize_narrow_environment

api-ms-win-crt-string-l1-1-0

iswxdigit iswdigit tolower isalnum wcsnlen __strncnt strlen wcscpy_s isxdigit isspace isdigit wcslen strcmp isupper iswspace islower _wcsdup strcspn iswalnum

api-ms-win-crt-locale-l1-1-0

setlocale localeconv ___mb_cur_max_func _lock_locales _unlock_locales ___lc_codepage_func __pctype_func ___lc_collate_cp_func ___lc_locale_name_func

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers fputs fgetwc fseek _fsopen _wfsopen fclose fputwc ungetwc __stdio_common_vsprintf_s fgetc fgetpos fputc fread fsetpos _fseeki64 fwrite __acrt_iob_func setvbuf ungetc fflush

api-ms-win-crt-filesystem-l1-1-0

_wchdir _wrmdir _wrename _unlock_file _wremove _lock_file

api-ms-win-crt-time-l1-1-0

_W_Getdays _Getmonths _W_Gettnames _Wcsftime _Strftime _W_Getmonths _Gettnames _Getdays

api-ms-win-crt-environment-l1-1-0

_wgetcwd

api-ms-win-crt-math-l1-1-0

_dclass _ldclass frexp logf copysign ldexp log

api-ms-win-crt-convert-l1-1-0

strtof btowc strtod

api-ms-win-crt-utility-l1-1-0

rand_s

kernel32

EnterCriticalSection RaiseException CompareStringEx MultiByteToWideChar GetCPInfo InitializeSListHead WideCharToMultiByte LCMapStringEx GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive CreateDirectoryW CreateFileW FindClose FindFirstFileExW FindNextFileW GetDiskFreeSpaceExW GetFileAttributesExW GetCurrentProcessId TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetFileInformationByHandleEx GetProcAddress GetModuleHandleW CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer GetTickCount64 GetSystemTimeAsFileTime GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW GetTempPathW InitOnceExecuteOnce GetStringTypeW DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection RtlPcToFileHeader QueryPerformanceFrequency QueryPerformanceCounter GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent RtlCaptureStackBackTrace TryAcquireSRWLockExclusive GetNativeSystemInfo GetExitCodeThread SwitchToThread Sleep WaitForSingleObjectEx GetCurrentThreadId SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable FormatMessageA LocalFree DecodePointer EncodePointer CreateSymbolicLinkW CreateHardLinkW CopyFileW GetLastError CloseHandle AreFileApisANSI SetFileTime SetFileInformationByHandle SetFileAttributesW GetFileInformationByHandle

??$_Getvals@_W@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z ??$_Getvals@_W@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z ??$_Getvals@_W@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z ??0?$_Yarn@D@std@@QEAA@AEBV01@@Z ??0?$_Yarn@D@std@@QEAA@PEBD@Z ??0?$_Yarn@D@std@@QEAA@XZ ??0?$_Yarn@G@std@@QEAA@AEBV01@@Z ??0?$_Yarn@G@std@@QEAA@PEBG@Z ??0?$_Yarn@G@std@@QEAA@XZ ??0?$_Yarn@_W@std@@QEAA@AEBV01@@Z ??0?$_Yarn@_W@std@@QEAA@PEB_W@Z ??0?$_Yarn@_W@std@@QEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ ??0?$basic_ios@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@IEAA@$$QEAV01@@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_iostream@GU?$char_traits@G@std@@@std@@IEAA@$$QEAV01@@Z ??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@IEAA@$$QEAV01@@Z ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@IEAA@$$QEAV01@@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N1@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@W4_Uninitialized@1@@Z ??0?$basic_istream@GU?$char_traits@G@std@@@std@@IEAA@$$QEAV01@@Z ??0?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N1@Z ??0?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z ??0?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA@W4_Uninitialized@1@@Z ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@IEAA@$$QEAV01@@Z ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N1@Z ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@W4_Uninitialized@1@@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@IEAA@$$QEAV01@@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@W4_Uninitialized@1@_N@Z ??0?$basic_ostream@GU?$char_traits@G@std@@@std@@IEAA@$$QEAV01@@Z ??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z ??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@W4_Uninitialized@1@_N@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@IEAA@$$QEAV01@@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@W4_Uninitialized@1@_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@AEBV01@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@W4_Uninitialized@1@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@AEBV01@@Z ??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@W4_Uninitialized@1@@Z ??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@AEBV01@@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@W4_Uninitialized@1@@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$codecvt@DDU_Mbstatet@@@std@@QEAA@AEBV_Locinfo@1@_K@Z ??0?$codecvt@DDU_Mbstatet@@@std@@QEAA@_K@Z ??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@AEBV_Locinfo@1@_K@Z ??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z ??0?$codecvt@_SDU_Mbstatet@@@std@@QEAA@AEBV_Locinfo@1@KW4_Codecvt_mode@1@_K@Z ??0?$codecvt@_SDU_Mbstatet@@@std@@QEAA@AEBV_Locinfo@1@_K@Z ??0?$codecvt@_SDU_Mbstatet@@@std@@QEAA@_K@Z ??0?$codecvt@_UDU_Mbstatet@@@std@@QEAA@AEBV_Locinfo@1@KW4_Codecvt_mode@1@_K@Z ??0?$codecvt@_UDU_Mbstatet@@@std@@QEAA@AEBV_Locinfo@1@_K@Z ??0?$codecvt@_UDU_Mbstatet@@@std@@QEAA@_K@Z ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@AEBV_Locinfo@1@_K@Z ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z ??0?$ctype@D@std@@QEAA@AEBV_Locinfo@1@_K@Z ??0?$ctype@D@std@@QEAA@PEBF_N_K@Z ??0?$ctype@G@std@@QEAA@AEBV_Locinfo@1@_K@Z ??0?$ctype@G@std@@QEAA@_K@Z ??0?$ctype@_W@std@@QEAA@AEBV_Locinfo@1@_K@Z ??0?$ctype@_W@std@@QEAA@_K@Z ??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z ??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@_K@Z ??0?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z ??0?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@_K@Z ??0?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z ??0?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@_K@Z ??0?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z ??0?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@_K@Z ??0?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z ??0?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@_K@Z ??0?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z ??0?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@_K@Z ??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAA@PEBD_K@Z ??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z ??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@_K@Z ??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IEAA@PEBD_K@Z ??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z ??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@_K@Z ??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAA@PEBD_K@Z ??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z ??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@_K@Z ??0?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z ??0?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@_K@Z ??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IEAA@PEBD_K@Z ??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z ??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@_K@Z ??0?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAA@PEBD_K@Z ??0?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z ??0?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@_K@Z ??0Init@ios_base@std@@QEAA@XZ ??0_Facet_base@std@@QEAA@AEBV01@@Z ??0_Facet_base@std@@QEAA@XZ ??0_Init_locks@std@@QEAA@XZ ??0_Locimp@locale@std@@AEAA@AEBV012@@Z ??0_Locimp@locale@std@@AEAA@_N@Z ??0_Locinfo@std@@QEAA@HPEBD@Z ??0_Locinfo@std@@QEAA@PEBD@Z ??0_Lockit@std@@QEAA@H@Z ??0_Lockit@std@@QEAA@XZ ??0_Timevec@std@@QEAA@AEBV01@@Z ??0_Timevec@std@@QEAA@PEAX@Z ??0_UShinit@std@@QEAA@XZ ??0_Winit@std@@QEAA@XZ ??0codecvt_base@std@@QEAA@_K@Z ??0ctype_base@std@@QEAA@_K@Z ??0facet@locale@std@@IEAA@_K@Z ??0id@locale@std@@QEAA@_K@Z ??0ios_base@std@@IEAA@XZ ??0task_continuation_context@Concurrency@@AEAA@XZ ??0time_base@std@@QEAA@_K@Z ??1?$_Yarn@D@std@@QEAA@XZ ??1?$_Yarn@G@std@@QEAA@XZ ??1?$_Yarn@_W@std@@QEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@GU?$char_traits@G@std@@@std@@UEAA@XZ ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$codecvt@DDU_Mbstatet@@@std@@MEAA@XZ ??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ ??1?$codecvt@_SDU_Mbstatet@@@std@@MEAA@XZ ??1?$codecvt@_UDU_Mbstatet@@@std@@MEAA@XZ ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ ??1?$ctype@D@std@@MEAA@XZ ??1?$ctype@G@std@@MEAA@XZ ??1?$ctype@_W@std@@MEAA@XZ ??1?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEAA@XZ ??1?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEAA@XZ ??1?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEAA@XZ ??1?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEAA@XZ ??1?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEAA@XZ ??1?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEAA@XZ ??1?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEAA@XZ ??1?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEAA@XZ ??1?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEAA@XZ ??1?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEAA@XZ ??1?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEAA@XZ ??1?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEAA@XZ ??1Init@ios_base@std@@QEAA@XZ ??1_Facet_base@std@@UEAA@XZ ??1_Init_locks@std@@QEAA@XZ ??1_Locimp@locale@std@@MEAA@XZ ??1_Locinfo@std@@QEAA@XZ ??1_Lockit@std@@QEAA@XZ ??1_Timevec@std@@QEAA@XZ ??1_UShinit@std@@QEAA@XZ ??1_Winit@std@@QEAA@XZ ??1codecvt_base@std@@UEAA@XZ ??1ctype_base@std@@UEAA@XZ ??1facet@locale@std@@MEAA@XZ ??1ios_base@std@@UEAA@XZ ??1time_base@std@@UEAA@XZ ??4?$_Iosb@H@std@@QEAAAEAV01@$$QEAV01@@Z ??4?$_Iosb@H@std@@QEAAAEAV01@AEBV01@@Z ??4?$_Yarn@D@std@@QEAAAEAV01@AEBV01@@Z ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ??4?$_Yarn@G@std@@QEAAAEAV01@AEBV01@@Z ??4?$_Yarn@G@std@@QEAAAEAV01@PEBG@Z ??4?$_Yarn@_W@std@@QEAAAEAV01@AEBV01@@Z ??4?$_Yarn@_W@std@@QEAAAEAV01@PEB_W@Z ??4?$basic_iostream@DU?$char_traits@D@std@@@std@@IEAAAEAV01@$$QEAV01@@Z ??4?$basic_iostream@GU?$char_traits@G@std@@@std@@IEAAAEAV01@$$QEAV01@@Z ??4?$basic_iostream@_WU?$char_traits@_W@std@@@std@@IEAAAEAV01@$$QEAV01@@Z ??4?$basic_istream@DU?$char_traits@D@std@@@std@@IEAAAEAV01@$$QEAV01@@Z ??4?$basic_istream@GU?$char_traits@G@std@@@std@@IEAAAEAV01@$$QEAV01@@Z ??4?$basic_istream@_WU?$char_traits@_W@std@@@std@@IEAAAEAV01@$$QEAV01@@Z ??4?$basic_ostream@DU?$char_traits@D@std@@@std@@IEAAAEAV01@$$QEAV01@@Z ??4?$basic_ostream@GU?$char_traits@G@std@@@std@@IEAAAEAV01@$$QEAV01@@Z ??4?$basic_ostream@_WU?$char_traits@_W@std@@@std@@IEAAAEAV01@$$QEAV01@@Z ??4?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAAEAV01@AEBV01@@Z ??4?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAAEAV01@AEBV01@@Z ??4?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAAEAV01@AEBV01@@Z ??4Init@ios_base@std@@QEAAAEAV012@AEBV012@@Z ??4_Crt_new_delete@std@@QEAAAEAU01@$$QEAU01@@Z ??4_Crt_new_delete@std@@QEAAAEAU01@AEBU01@@Z ??4_Facet_base@std@@QEAAAEAV01@AEBV01@@Z ??4_Init_locks@std@@QEAAAEAV01@AEBV01@@Z ??4_Timevec@std@@QEAAAEAV01@AEBV01@@Z ??4_UShinit@std@@QEAAAEAV01@AEBV01@@Z ??4_Winit@std@@QEAAAEAV01@AEBV01@@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAF@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAG@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAJ@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAK@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAO@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAPEAX@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_J@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV?$basic_ios@DU?$char_traits@D@std@@@1@AEAV21@@Z@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAF@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAG@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAH@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAI@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAJ@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAK@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAM@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAN@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAO@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAPEAX@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEA_J@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEA_K@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEA_N@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV?$basic_ios@GU?$char_traits@G@std@@@1@AEAV21@@Z@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAF@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAG@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAI@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAJ@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAK@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAM@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAN@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAO@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAPEAX@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEA_J@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEA_K@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEA_N@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV?$basic_ios@_WU?$char_traits@_W@std@@@1@AEAV21@@Z@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@F@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@O@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV?$basic_ios@DU?$char_traits@D@std@@@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@F@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@M@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@N@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@O@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV?$basic_ios@GU?$char_traits@G@std@@@1@AEAV21@@Z@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@PEBX@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@F@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@M@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@O@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV?$basic_ios@_WU?$char_traits@_W@std@@@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_N@Z ??7ios_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ??Bios_base@std@@QEBA_NXZ ??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@ ??_7?$basic_ios@GU?$char_traits@G@std@@@std@@6B@ ??_7?$basic_ios@_WU?$char_traits@_W@std@@@std@@6B@ ??_7?$basic_iostream@DU?$char_traits@D@std@@@std@@6B@ ??_7?$basic_iostream@GU?$char_traits@G@std@@@std@@6B@ ??_7?$basic_iostream@_WU?$char_traits@_W@std@@@std@@6B@ ??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@ ??_7?$basic_istream@GU?$char_traits@G@std@@@std@@6B@ ??_7?$basic_istream@_WU?$char_traits@_W@std@@@std@@6B@ ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ??_7?$basic_ostream@GU?$char_traits@G@std@@@std@@6B@ ??_7?$basic_ostream@_WU?$char_traits@_W@std@@@std@@6B@ ??_7?$basic_streambuf@DU?$char_traits@D@std@@@std@@6B@ ??_7?$basic_streambuf@GU?$char_traits@G@std@@@std@@6B@ ??_7?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@6B@ ??_7?$codecvt@DDU_Mbstatet@@@std@@6B@ ??_7?$codecvt@GDU_Mbstatet@@@std@@6B@ ??_7?$codecvt@_SDU_Mbstatet@@@std@@6B@ ??_7?$codecvt@_UDU_Mbstatet@@@std@@6B@ ??_7?$codecvt@_WDU_Mbstatet@@@std@@6B@ ??_7?$ctype@D@std@@6B@ ??_7?$ctype@G@std@@6B@ ??_7?$ctype@_W@std@@6B@ ??_7?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@ ??_7?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@ ??_7?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@ ??_7?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@ ??_7?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@ ??_7?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@ ??_7?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@ ??_7?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@ ??_7?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@ ??_7?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@ ??_7?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@ ??_7?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@ ??_7_Facet_base@std@@6B@ ??_7_Locimp@locale@std@@6B@ ??_7codecvt_base@std@@6B@ ??_7ctype_base@std@@6B@ ??_7facet@locale@std@@6B@ ??_7ios_base@std@@6B@ ??_7time_base@std@@6B@ ??_8?$basic_iostream@DU?$char_traits@D@std@@@std@@7B?$basic_istream@DU?$char_traits@D@std@@@1@@ ??_8?$basic_iostream@DU?$char_traits@D@std@@@std@@7B?$basic_ostream@DU?$char_traits@D@std@@@1@@ ??_8?$basic_iostream@GU?$char_traits@G@std@@@std@@7B?$basic_istream@GU?$char_traits@G@std@@@1@@ ??_8?$basic_iostream@GU?$char_traits@G@std@@@std@@7B?$basic_ostream@GU?$char_traits@G@std@@@1@@ ??_8?$basic_iostream@_WU?$char_traits@_W@std@@@std@@7B?$basic_istream@_WU?$char_traits@_W@std@@@1@@ ??_8?$basic_iostream@_WU?$char_traits@_W@std@@@std@@7B?$basic_ostream@_WU?$char_traits@_W@std@@@1@@ ??_8?$basic_istream@DU?$char_traits@D@std@@@std@@7B@ ??_8?$basic_istream@GU?$char_traits@G@std@@@std@@7B@ ??_8?$basic_istream@_WU?$char_traits@_W@std@@@std@@7B@ ??_8?$basic_ostream@DU?$char_traits@D@std@@@std@@7B@ ??_8?$basic_ostream@GU?$char_traits@G@std@@@std@@7B@ ??_8?$basic_ostream@_WU?$char_traits@_W@std@@@std@@7B@ ??_D?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??_D?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAAXXZ ??_D?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??_D?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAXXZ ??_D?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??_D?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ ??_D?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ??_F?$codecvt@DDU_Mbstatet@@@std@@QEAAXXZ ??_F?$codecvt@GDU_Mbstatet@@@std@@QEAAXXZ ??_F?$codecvt@_SDU_Mbstatet@@@std@@QEAAXXZ ??_F?$codecvt@_UDU_Mbstatet@@@std@@QEAAXXZ ??_F?$codecvt@_WDU_Mbstatet@@@std@@QEAAXXZ ??_F?$ctype@D@std@@QEAAXXZ ??_F?$ctype@G@std@@QEAAXXZ ??_F?$ctype@_W@std@@QEAAXXZ ??_F?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAAXXZ ??_F?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAAXXZ ??_F?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAAXXZ ??_F?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAAXXZ ??_F?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAAXXZ ??_F?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAAXXZ ??_F?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAAXXZ ??_F?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAAXXZ ??_F?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAAXXZ ??_F?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAAXXZ ??_F?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAAXXZ ??_F?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAAXXZ ??_F_Locinfo@std@@QEAAXXZ ??_F_Timevec@std@@QEAAXXZ ??_Fcodecvt_base@std@@QEAAXXZ ??_Fctype_base@std@@QEAAXXZ ??_Ffacet@locale@std@@QEAAXXZ ??_Fid@locale@std@@QEAAXXZ ??_Ftime_base@std@@QEAAXXZ ?CaptureCallstack@platform@details@Concurrency@@YA_KPEAPEAX_K1@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?GetNextAsyncId@platform@details@Concurrency@@YAIXZ ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Addcats@_Locinfo@std@@QEAAAEAV12@HPEBD@Z ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z ?_Addstd@ios_base@std@@SAXPEAV12@@Z ?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z ?_Atexit@@YAXP6AXXZ@Z ?_BADOFF@std@@3_JB ?_C_str@?$_Yarn@D@std@@QEBAPEBDXZ ?_C_str@?$_Yarn@G@std@@QEBAPEBGXZ ?_C_str@?$_Yarn@_W@std@@QEBAPEB_WXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ?_Callfns@ios_base@std@@AEAAXW4event@12@@Z ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Clocptr@_Locimp@locale@std@@0PEAV123@EA ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Donarrow@?$ctype@G@std@@IEBADGD@Z ?_Donarrow@?$ctype@_W@std@@IEBAD_WD@Z ?_Dowiden@?$ctype@G@std@@IEBAGD@Z ?_Dowiden@?$ctype@_W@std@@IEBA_WD@Z ?_Empty@?$_Yarn@D@std@@QEBA_NXZ ?_Empty@?$_Yarn@G@std@@QEBA_NXZ ?_Empty@?$_Yarn@_W@std@@QEBA_NXZ ?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z ?_Ffmt@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBAPEADPEADDH@Z ?_Ffmt@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBAPEADPEADDH@Z ?_Ffmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBAPEADPEADDH@Z ?_Findarr@ios_base@std@@AEAAAEAU_Iosarray@12@H@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBGHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Fput@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBD_K@Z ?_Fput@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GPEBD_K@Z ?_Fput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBD_K@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$codecvt@GDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$codecvt@_SDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$codecvt@_UDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@facet@locale@std@@SA_KPEAPEBV123@PEBV23@@Z ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Getctype@_Locinfo@std@@QEBA?AU_Ctypevec@@XZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Getdateorder@_Locinfo@std@@QEBAHXZ ?_Getdays@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getffld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1AEAVios_base@2@PEAH@Z ?_Getffld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1AEAVios_base@2@PEAH@Z ?_Getffld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1AEAVios_base@2@PEAH@Z ?_Getffldx@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1AEAVios_base@2@PEAH@Z ?_Getffldx@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1AEAVios_base@2@PEAH@Z ?_Getffldx@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1AEAVios_base@2@PEAH@Z ?_Getfmt@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD@Z ?_Getfmt@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD@Z ?_Getfmt@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Getifld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1HAEBVlocale@2@@Z ?_Getifld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1HAEBVlocale@2@@Z ?_Getifld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1HAEBVlocale@2@@Z ?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBAHAEAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAEAHAEBV?$ctype@D@2@@Z ?_Getint@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBAHAEAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@0HHAEAHAEBV?$ctype@G@2@@Z ?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBAHAEAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAEAHAEBV?$ctype@_W@2@@Z ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?_Getmonths@_Locinfo@std@@QEBAPEBDXZ ?_Getname@_Locinfo@std@@QEBAPEBDXZ ?_Getptr@_Timevec@std@@QEBAPEAXXZ ?_Gettnames@_Locinfo@std@@QEBA?AV_Timevec@2@XZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Gnavail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBA_JXZ ?_Gnavail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBA_JXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gndec@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ ?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ ?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ?_Gnpreinc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnpreinc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ ?_Gnpreinc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ?_Id_cnt@id@locale@std@@0HA ?_Ifmt@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBAPEADPEADPEBDH@Z ?_Ifmt@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBAPEADPEADPEBDH@Z ?_Ifmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBAPEADPEADPEBDH@Z ?_Incref@facet@locale@std@@UEAAXXZ ?_Index@ios_base@std@@0HA ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAPEAG0PEAH001@Z ?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEAPEA_W0PEAH001@Z ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ ?_Init@?$codecvt@DDU_Mbstatet@@@std@@IEAAXAEBV_Locinfo@2@@Z ?_Init@?$codecvt@GDU_Mbstatet@@@std@@IEAAXAEBV_Locinfo@2@@Z ?_Init@?$codecvt@_SDU_Mbstatet@@@std@@IEAAXAEBV_Locinfo@2@@Z ?_Init@?$codecvt@_UDU_Mbstatet@@@std@@IEAAXAEBV_Locinfo@2@@Z ?_Init@?$codecvt@_WDU_Mbstatet@@@std@@IEAAXAEBV_Locinfo@2@@Z ?_Init@?$ctype@D@std@@IEAAXAEBV_Locinfo@2@@Z ?_Init@?$ctype@G@std@@IEAAXAEBV_Locinfo@2@@Z ?_Init@?$ctype@_W@std@@IEAAXAEBV_Locinfo@2@@Z ?_Init@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAAXAEBV_Locinfo@2@@Z ?_Init@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IEAAXAEBV_Locinfo@2@@Z ?_Init@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAAXAEBV_Locinfo@2@@Z ?_Init@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAAXAEBV_Locinfo@2@@Z ?_Init@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IEAAXAEBV_Locinfo@2@@Z ?_Init@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAAXAEBV_Locinfo@2@@Z ?_Init@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAAXAEBV_Locinfo@2@@Z ?_Init@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IEAAXAEBV_Locinfo@2@@Z ?_Init@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAAXAEBV_Locinfo@2@@Z ?_Init@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAAXAEBV_Locinfo@2@@Z ?_Init@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IEAAXAEBV_Locinfo@2@@Z ?_Init@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAAXAEBV_Locinfo@2@@Z ?_Init@ios_base@std@@IEAAXXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Init_cnt@Init@ios_base@std@@0HA ?_Init_cnt@_UShinit@std@@0HA ?_Init_cnt@_Winit@std@@0HA ?_Init_cnt_func@Init@ios_base@std@@CAAEAHXZ ?_Init_ctor@Init@ios_base@std@@CAXPEAV123@@Z ?_Init_dtor@Init@ios_base@std@@CAXPEAV123@@Z ?_Init_locks_ctor@_Init_locks@std@@CAXPEAV12@@Z ?_Init_locks_dtor@_Init_locks@std@@CAXPEAV12@@Z ?_Ios_base_dtor@ios_base@std@@CAXPEAV12@@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA_N_N@Z ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ?_Iput@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEAD_K@Z ?_Iput@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GPEAD_K@Z ?_Iput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEAD_K@Z ?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ ?_IsNonBlockingThread@_Task_impl_base@details@Concurrency@@SA_NXZ ?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z ?_Locimp_ctor@_Locimp@locale@std@@CAXPEAV123@AEBV123@@Z ?_Locimp_dtor@_Locimp@locale@std@@CAXPEAV123@@Z ?_Locinfo_Addcats@_Locinfo@std@@SAAEAV12@PEAV12@HPEBD@Z ?_Locinfo_ctor@_Locinfo@std@@SAXPEAV12@HPEBD@Z ?_Locinfo_ctor@_Locinfo@std@@SAXPEAV12@PEBD@Z ?_Locinfo_dtor@_Locinfo@std@@SAXPEAV12@@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lockit_ctor@_Lockit@std@@CAXPEAV12@@Z ?_Lockit_ctor@_Lockit@std@@CAXPEAV12@H@Z ?_Lockit_ctor@_Lockit@std@@SAXH@Z ?_Lockit_dtor@_Lockit@std@@CAXPEAV12@@Z ?_Lockit_dtor@_Lockit@std@@SAXH@Z ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_MP_Add@std@@YAXQEA_K_K@Z ?_MP_Get@std@@YA_KQEA_K@Z ?_MP_Mul@std@@YAXQEA_K_K1@Z ?_MP_Rem@std@@YAXQEA_K_K@Z ?_Makeloc@_Locimp@locale@std@@CAPEAV123@AEBV_Locinfo@3@HPEAV123@PEBV23@@Z ?_Makeushloc@_Locimp@locale@std@@CAXAEBV_Locinfo@3@HPEAV123@PEBV23@@Z ?_Makewloc@_Locimp@locale@std@@CAXAEBV_Locinfo@3@HPEAV123@PEBV23@@Z ?_Makexloc@_Locimp@locale@std@@CAXAEBV_Locinfo@3@HPEAV123@PEBV23@@Z ?_Mtx_delete@threads@stdext@@YAXPEAX@Z ?_Mtx_lock@threads@stdext@@YAXPEAX@Z ?_Mtx_new@threads@stdext@@YAXAEAPEAX@Z ?_Mtx_unlock@threads@stdext@@YAXPEAX@Z ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pnavail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBA_JXZ ?_Pnavail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ?_Ptr_cerr@std@@3PEAV?$basic_ostream@DU?$char_traits@D@std@@@1@EA ?_Ptr_cin@std@@3PEAV?$basic_istream@DU?$char_traits@D@std@@@1@EA ?_Ptr_clog@std@@3PEAV?$basic_ostream@DU?$char_traits@D@std@@@1@EA ?_Ptr_cout@std@@3PEAV?$basic_ostream@DU?$char_traits@D@std@@@1@EA ?_Ptr_wcerr@std@@3PEAV?$basic_ostream@GU?$char_traits@G@std@@@1@EA ?_Ptr_wcerr@std@@3PEAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@EA ?_Ptr_wcin@std@@3PEAV?$basic_istream@GU?$char_traits@G@std@@@1@EA ?_Ptr_wcin@std@@3PEAV?$basic_istream@_WU?$char_traits@_W@std@@@1@EA ?_Ptr_wclog@std@@3PEAV?$basic_ostream@GU?$char_traits@G@std@@@1@EA ?_Ptr_wclog@std@@3PEAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@EA ?_Ptr_wcout@std@@3PEAV?$basic_ostream@GU?$char_traits@G@std@@@1@EA ?_Ptr_wcout@std@@3PEAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@EA ?_Put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@PEBD_K@Z ?_Put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@PEBG_K@Z ?_Put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@PEB_W_K@Z ?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA ?_Random_device@std@@YAIXZ ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?_Rep@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@D_K@Z ?_Rep@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@G_K@Z ?_Rep@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_W_K@Z ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Reschedule_chore@details@Concurrency@@YAHPEBU_Threadpool_chore@12@@Z ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z ?_Rng_abort@std@@YAXPEBD@Z ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_Setgloballocale@locale@std@@CAXPEAX@Z ?_Src@?1??_Getffld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@DU?$char_traits@D@std@@@3@1AEAVios_base@3@PEAH@Z@4QBDB ?_Src@?1??_Getffld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@GU?$char_traits@G@std@@@3@1AEAVios_base@3@PEAH@Z@4QBDB ?_Src@?1??_Getffld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@3@1AEAVios_base@3@PEAH@Z@4QBDB ?_Src@?1??_Getffldx@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@DU?$char_traits@D@std@@@3@1AEAVios_base@3@PEAH@Z@4QBDB ?_Src@?1??_Getffldx@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@GU?$char_traits@G@std@@@3@1AEAVios_base@3@PEAH@Z@4QBDB ?_Src@?1??_Getffldx@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@3@1AEAVios_base@3@PEAH@Z@4QBDB ?_Src@?1??_Getifld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@DU?$char_traits@D@std@@@3@1HAEBVlocale@3@@Z@4QBDB ?_Src@?1??_Getifld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@GU?$char_traits@G@std@@@3@1HAEBVlocale@3@@Z@4QBDB ?_Src@?1??_Getifld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@3@1HAEBVlocale@3@@Z@4QBDB ?_Sync@ios_base@std@@0_NA ?_Syserror_map@std@@YAPEBDH@Z ?_Throw_C_error@std@@YAXH@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Throw_future_error@std@@YAXAEBVerror_code@1@@Z ?_Tidy@?$_Yarn@D@std@@AEAAXXZ ?_Tidy@?$_Yarn@G@std@@AEAAXXZ ?_Tidy@?$_Yarn@_W@std@@AEAAXXZ ?_Tidy@?$ctype@D@std@@IEAAXXZ ?_Tidy@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEAAXXZ ?_Tidy@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEAAXXZ ?_Tidy@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEAAXXZ ?_Tidy@ios_base@std@@AEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ ?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ ?_W_Gettnames@_Locinfo@std@@QEBA?AV_Timevec@2@XZ ?_Winerror_map@std@@YAHH@Z ?_Winerror_message@std@@YAKKPEADK@Z ?_XGetLastError@std@@YAXXZ ?_XLgamma@std@@YAMM@Z ?_XLgamma@std@@YANN@Z ?_XLgamma@std@@YAOO@Z ?_Xbad_alloc@std@@YAXXZ ?_Xbad_function_call@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xoverflow_error@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Xruntime_error@std@@YAXPEBD@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?__ExceptionPtrCompare@@YA_NPEBX0@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrSwap@@YAXPEAX0@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?bad@ios_base@std@@QEBA_NXZ ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ ?c_str@?$_Yarn@G@std@@QEBAPEBGXZ ?c_str@?$_Yarn@_W@std@@QEBAPEB_WXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?classic@locale@std@@SAAEBV12@XZ ?classic_table@?$ctype@D@std@@SAPEBFXZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXI@Z ?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z ?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXI@Z ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXI@Z ?clear@ios_base@std@@QEAAXH@Z ?clear@ios_base@std@@QEAAXH_N@Z ?clear@ios_base@std@@QEAAXI@Z ?clog@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?copyfmt@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAAEAV12@AEBV12@@Z ?copyfmt@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAAEAV12@AEBV12@@Z ?copyfmt@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@AEBV12@@Z ?copyfmt@ios_base@std@@QEAAAEAV12@AEBV12@@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?date_order@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AW4dateorder@time_base@2@XZ ?date_order@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AW4dateorder@time_base@2@XZ ?date_order@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AW4dateorder@time_base@2@XZ ?do_always_noconv@?$codecvt@DDU_Mbstatet@@@std@@MEBA_NXZ ?do_always_noconv@?$codecvt@GDU_Mbstatet@@@std@@MEBA_NXZ ?do_always_noconv@?$codecvt@_SDU_Mbstatet@@@std@@MEBA_NXZ ?do_always_noconv@?$codecvt@_UDU_Mbstatet@@@std@@MEBA_NXZ ?do_always_noconv@?$codecvt@_WDU_Mbstatet@@@std@@MEBA_NXZ ?do_always_noconv@codecvt_base@std@@MEBA_NXZ ?do_date_order@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AW4dateorder@time_base@2@XZ ?do_date_order@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AW4dateorder@time_base@2@XZ ?do_date_order@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AW4dateorder@time_base@2@XZ ?do_encoding@?$codecvt@GDU_Mbstatet@@@std@@MEBAHXZ ?do_encoding@?$codecvt@_SDU_Mbstatet@@@std@@MEBAHXZ ?do_encoding@?$codecvt@_UDU_Mbstatet@@@std@@MEBAHXZ ?do_encoding@?$codecvt@_WDU_Mbstatet@@@std@@MEBAHXZ ?do_encoding@codecvt_base@std@@MEBAHXZ ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAG@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAI@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAJ@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAK@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAM@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAN@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAO@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAPEAX@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEA_J@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEA_K@Z ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEA_N@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAG@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAI@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAJ@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAK@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAM@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAN@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAO@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAPEAX@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEA_J@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEA_K@Z ?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEA_N@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAG@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAI@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAJ@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAK@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAM@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAN@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAO@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAPEAX@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEA_J@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEA_K@Z ?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEA_N@Z ?do_get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@DD@Z ?do_get@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@DD@Z ?do_get@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@DD@Z ?do_get_date@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?do_get_date@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?do_get_date@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?do_get_monthname@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?do_get_monthname@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?do_get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?do_get_time@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?do_get_time@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?do_get_time@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?do_get_weekday@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?do_get_weekday@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?do_get_weekday@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?do_get_year@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?do_get_year@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?do_get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?do_in@?$codecvt@DDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?do_in@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z ?do_in@?$codecvt@_SDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_S3AEAPEA_S@Z ?do_in@?$codecvt@_UDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_U3AEAPEA_U@Z ?do_in@?$codecvt@_WDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?do_is@?$ctype@G@std@@MEBAPEBGPEBG0PEAF@Z ?do_is@?$ctype@G@std@@MEBA_NFG@Z ?do_is@?$ctype@_W@std@@MEBAPEB_WPEB_W0PEAF@Z ?do_is@?$ctype@_W@std@@MEBA_NF_W@Z ?do_length@?$codecvt@DDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1_K@Z ?do_length@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1_K@Z ?do_length@?$codecvt@_SDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1_K@Z ?do_length@?$codecvt@_UDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1_K@Z ?do_length@?$codecvt@_WDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1_K@Z ?do_max_length@?$codecvt@GDU_Mbstatet@@@std@@MEBAHXZ ?do_max_length@?$codecvt@_SDU_Mbstatet@@@std@@MEBAHXZ ?do_max_length@?$codecvt@_UDU_Mbstatet@@@std@@MEBAHXZ ?do_max_length@?$codecvt@_WDU_Mbstatet@@@std@@MEBAHXZ ?do_max_length@codecvt_base@std@@MEBAHXZ ?do_narrow@?$ctype@D@std@@MEBADDD@Z ?do_narrow@?$ctype@D@std@@MEBAPEBDPEBD0DPEAD@Z ?do_narrow@?$ctype@G@std@@MEBADGD@Z ?do_narrow@?$ctype@G@std@@MEBAPEBGPEBG0DPEAD@Z ?do_narrow@?$ctype@_W@std@@MEBAD_WD@Z ?do_narrow@?$ctype@_W@std@@MEBAPEB_WPEB_W0DPEAD@Z ?do_out@?$codecvt@DDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?do_out@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z ?do_out@?$codecvt@_SDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEB_S1AEAPEB_SPEAD3AEAPEAD@Z ?do_out@?$codecvt@_UDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEB_U1AEAPEB_UPEAD3AEAPEAD@Z ?do_out@?$codecvt@_WDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DJ@Z ?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DK@Z ?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DN@Z ?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DO@Z ?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBX@Z ?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@D_J@Z ?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@D_K@Z ?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@D_N@Z ?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GJ@Z ?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GK@Z ?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GN@Z ?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GO@Z ?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GPEBX@Z ?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@G_J@Z ?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@G_K@Z ?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@G_N@Z ?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WJ@Z ?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WK@Z ?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WN@Z ?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WO@Z ?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBX@Z ?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_W_J@Z ?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_W_K@Z ?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_W_N@Z ?do_put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@DD@Z ?do_put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GPEBUtm@@DD@Z ?do_put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBUtm@@DD@Z ?do_scan_is@?$ctype@G@std@@MEBAPEBGFPEBG0@Z ?do_scan_is@?$ctype@_W@std@@MEBAPEB_WFPEB_W0@Z ?do_scan_not@?$ctype@G@std@@MEBAPEBGFPEBG0@Z ?do_scan_not@?$ctype@_W@std@@MEBAPEB_WFPEB_W0@Z ?do_tolower@?$ctype@D@std@@MEBADD@Z ?do_tolower@?$ctype@D@std@@MEBAPEBDPEADPEBD@Z ?do_tolower@?$ctype@G@std@@MEBAGG@Z ?do_tolower@?$ctype@G@std@@MEBAPEBGPEAGPEBG@Z ?do_tolower@?$ctype@_W@std@@MEBAPEB_WPEA_WPEB_W@Z ?do_tolower@?$ctype@_W@std@@MEBA_W_W@Z ?do_toupper@?$ctype@D@std@@MEBADD@Z ?do_toupper@?$ctype@D@std@@MEBAPEBDPEADPEBD@Z ?do_toupper@?$ctype@G@std@@MEBAGG@Z ?do_toupper@?$ctype@G@std@@MEBAPEBGPEAGPEBG@Z ?do_toupper@?$ctype@_W@std@@MEBAPEB_WPEA_WPEB_W@Z ?do_toupper@?$ctype@_W@std@@MEBA_W_W@Z ?do_unshift@?$codecvt@DDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?do_unshift@?$codecvt@GDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?do_unshift@?$codecvt@_SDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?do_unshift@?$codecvt@_UDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?do_unshift@?$codecvt@_WDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?do_widen@?$ctype@D@std@@MEBADD@Z ?do_widen@?$ctype@D@std@@MEBAPEBDPEBD0PEAD@Z ?do_widen@?$ctype@G@std@@MEBAGD@Z ?do_widen@?$ctype@G@std@@MEBAPEBDPEBD0PEAG@Z ?do_widen@?$ctype@_W@std@@MEBAPEBDPEBD0PEA_W@Z ?do_widen@?$ctype@_W@std@@MEBA_WD@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ ?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ ?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?empty@?$_Yarn@D@std@@QEBA_NXZ ?empty@?$_Yarn@G@std@@QEBA_NXZ ?empty@?$_Yarn@_W@std@@QEBA_NXZ ?empty@locale@std@@SA?AV12@XZ ?encoding@codecvt_base@std@@QEBAHXZ ?eof@ios_base@std@@QEBA_NXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ ?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?exceptions@ios_base@std@@QEAAXH@Z ?exceptions@ios_base@std@@QEAAXI@Z ?exceptions@ios_base@std@@QEBAHXZ ?fail@ios_base@std@@QEBA_NXZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAGG@Z ?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ ?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA_W_W@Z ?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ ?flags@ios_base@std@@QEAAHH@Z ?flags@ios_base@std@@QEBAHXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z ?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z ?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QEBA_JXZ ?gcount@?$basic_istream@GU?$char_traits@G@std@@@std@@QEBA_JXZ ?gcount@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEBA_JXZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@AEAD@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@AEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@AEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@D@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_JD@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@AEAG@Z ?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@AEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@@Z ?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@AEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@G@Z ?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@PEAG_J@Z ?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@PEAG_JG@Z ?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAGXZ ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@AEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@@Z ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@AEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@_W@Z ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@AEA_W@Z ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEA_W_J@Z ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEA_W_J_W@Z ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAG@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAI@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAJ@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAK@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAM@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAN@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAO@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAPEAX@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEA_J@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEA_K@Z ?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEA_N@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAG@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAI@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAJ@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAK@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAM@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAN@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAO@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAPEAX@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEA_J@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEA_K@Z ?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEA_N@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAG@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAI@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAJ@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAK@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAM@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAN@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAO@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAPEAX@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEA_J@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEA_K@Z ?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEA_N@Z ?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@DD@Z ?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD4@Z ?get@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@DD@Z ?get@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBG4@Z ?get@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@DD@Z ?get@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEB_W4@Z ?get_date@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?get_date@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?get_date@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?get_monthname@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?get_monthname@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?get_new_handler@std@@YAP6AXXZXZ ?get_time@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?get_time@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?get_time@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?get_weekday@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?get_weekday@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?get_weekday@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?get_year@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?get_year@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z ?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_JD@Z ?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@PEAG_J@Z ?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@PEAG_JG@Z ?getline@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEA_W_J@Z ?getline@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEA_W_J_W@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?getloc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEBA?AVlocale@2@XZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?global@locale@std@@SA?AV12@AEBV12@@Z ?good@ios_base@std@@QEBA_NXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ ?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A ?id@?$collate@G@std@@2V0locale@2@A ?id@?$collate@_W@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$ctype@G@std@@2V0locale@2@A ?id@?$ctype@_W@std@@2V0locale@2@A ?id@?$messages@D@std@@2V0locale@2@A ?id@?$messages@G@std@@2V0locale@2@A ?id@?$messages@_W@std@@2V0locale@2@A ?id@?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?id@?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A ?id@?$money_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?id@?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?id@?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A ?id@?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?id@?$moneypunct@D$00@std@@2V0locale@2@A ?id@?$moneypunct@D$0A@@std@@2V0locale@2@A ?id@?$moneypunct@G$00@std@@2V0locale@2@A ?id@?$moneypunct@G$0A@@std@@2V0locale@2@A ?id@?$moneypunct@_W$00@std@@2V0locale@2@A ?id@?$moneypunct@_W$0A@@std@@2V0locale@2@A ?id@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?id@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A ?id@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?id@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?id@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A ?id@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?id@?$numpunct@D@std@@2V0locale@2@A ?id@?$numpunct@G@std@@2V0locale@2@A ?id@?$numpunct@_W@std@@2V0locale@2@A ?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?id@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A ?id@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?id@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A ?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?ignore@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@_JG@Z ?ignore@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_JG@Z ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ?imbue@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?imbue@ios_base@std@@QEAA?AVlocale@2@AEBV32@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z ?in@?$codecvt@_SDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_S3AEAPEA_S@Z ?in@?$codecvt@_UDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_U3AEAPEA_U@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?in_avail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JXZ ?in_avail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JXZ ?in_avail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JXZ ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?init@?$basic_ios@GU?$char_traits@G@std@@@std@@IEAAXPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@_N@Z ?init@?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAAXPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@_N@Z ?intl@?$moneypunct@D$00@std@@2_NB ?intl@?$moneypunct@D$0A@@std@@2_NB ?intl@?$moneypunct@G$00@std@@2_NB ?intl@?$moneypunct@G$0A@@std@@2_NB ?intl@?$moneypunct@_W$00@std@@2_NB ?intl@?$moneypunct@_W$0A@@std@@2_NB ?ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA_N_N@Z ?ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ?is@?$ctype@D@std@@QEBAPEBDPEBD0PEAF@Z ?is@?$ctype@D@std@@QEBA_NFD@Z ?is@?$ctype@G@std@@QEBAPEBGPEBG0PEAF@Z ?is@?$ctype@G@std@@QEBA_NFG@Z ?is@?$ctype@_W@std@@QEBAPEB_WPEB_W0PEAF@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?isfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?isfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAXXZ ?isfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?iword@ios_base@std@@QEAAAEAJH@Z ?length@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1_K@Z ?length@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1_K@Z ?length@?$codecvt@_SDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1_K@Z ?length@?$codecvt@_UDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1_K@Z ?length@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1_K@Z ?max_length@codecvt_base@std@@QEBAHXZ ?move@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAX$$QEAV12@@Z ?move@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXAEAV12@@Z ?move@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAX$$QEAV12@@Z ?move@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXAEAV12@@Z ?move@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAX$$QEAV12@@Z ?move@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXAEAV12@@Z ?narrow@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADDD@Z ?narrow@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBADGD@Z ?narrow@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAD_WD@Z ?narrow@?$ctype@D@std@@QEBADDD@Z ?narrow@?$ctype@D@std@@QEBAPEBDPEBD0DPEAD@Z ?narrow@?$ctype@G@std@@QEBADGD@Z ?narrow@?$ctype@G@std@@QEBAPEBGPEBG0DPEAD@Z ?narrow@?$ctype@_W@std@@QEBAD_WD@Z ?narrow@?$ctype@_W@std@@QEBAPEB_WPEB_W0DPEAD@Z ?opfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA_NXZ ?opfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA_NXZ ?opfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA_NXZ ?osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ ?osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z ?out@?$codecvt@_SDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_S1AEAPEB_SPEAD3AEAPEAD@Z ?out@?$codecvt@_UDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_U1AEAPEB_UPEAD3AEAPEAD@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?overflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGG@Z ?overflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGG@Z ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?pbackfail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGG@Z ?pbackfail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGG@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ ?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z ?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z ?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?peek@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAGXZ ?peek@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ ?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?precision@ios_base@std@@QEAA_J_J@Z ?precision@ios_base@std@@QEBA_JXZ ?pubimbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ?pubimbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ?pubimbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ?pubseekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?pubseekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@_JII@Z ?pubseekoff@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?pubseekoff@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@_JII@Z ?pubseekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?pubseekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@_JII@Z ?pubseekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?pubseekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@V32@I@Z ?pubseekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?pubseekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@V32@I@Z ?pubseekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?pubseekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@V32@I@Z ?pubsetbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAPEAV12@PEAD_J@Z ?pubsetbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAPEAV12@PEAG_J@Z ?pubsetbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAPEAV12@PEA_W_J@Z ?pubsync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?pubsync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAHXZ ?pubsync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAHXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@G@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DJ@Z ?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DK@Z ?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DN@Z ?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DO@Z ?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBX@Z ?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@D_J@Z ?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@D_K@Z ?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@D_N@Z ?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GJ@Z ?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GK@Z ?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GN@Z ?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GO@Z ?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GPEBX@Z ?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@G_J@Z ?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@G_K@Z ?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@G_N@Z ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WJ@Z ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WK@Z ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WN@Z ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WO@Z ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBX@Z ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_W_J@Z ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_W_K@Z ?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_W_N@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@DD@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ?put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GPEBUtm@@DD@Z ?put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GPEBUtm@@PEBG3@Z ?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBUtm@@DD@Z ?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBUtm@@PEB_W4@Z ?putback@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?putback@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@G@Z ?putback@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?pword@ios_base@std@@QEAAAEAPEAXH@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PEAV32@@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@PEAV32@@Z ?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ ?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@PEAV32@@Z ?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ ?rdstate@ios_base@std@@QEBAHXZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?read@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@PEAG_J@Z ?read@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEA_W_J@Z ?readsome@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_JPEAD_J@Z ?readsome@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA_JPEAG_J@Z ?readsome@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_JPEA_W_J@Z ?register_callback@ios_base@std@@QEAAXP6AXW4event@12@AEAV12@H@ZH@Z ?resetiosflags@std@@YA?AU?$_Smanip@H@1@H@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?scan_is@?$ctype@D@std@@QEBAPEBDFPEBD0@Z ?scan_is@?$ctype@G@std@@QEBAPEBGFPEBG0@Z ?scan_is@?$ctype@_W@std@@QEBAPEB_WFPEB_W0@Z ?scan_not@?$ctype@D@std@@QEBAPEBDFPEBD0@Z ?scan_not@?$ctype@G@std@@QEBAPEBGFPEBG0@Z ?scan_not@?$ctype@_W@std@@QEBAPEB_WFPEB_W0@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?seekg@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekg@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@_JH@Z ?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_JH@Z ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?seekoff@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?seekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?seekp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@_JH@Z ?seekp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_JH@Z ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?seekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?seekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?set_new_handler@std@@YAP6AXXZP6AXXZ@Z ?set_rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@@Z ?set_rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@@Z ?set_rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@@Z ?setbase@std@@YA?AU?$_Smanip@H@1@H@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?setf@ios_base@std@@QEAAHH@Z ?setf@ios_base@std@@QEAAHHH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z ?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z ?setiosflags@std@@YA?AU?$_Smanip@H@1@H@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z ?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z ?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z ?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXI@Z ?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z ?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXI@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXI@Z ?setstate@ios_base@std@@QEAAXH@Z ?setstate@ios_base@std@@QEAAXH_N@Z ?setstate@ios_base@std@@QEAAXI@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEAD_J@Z ?sgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEAG_J@Z ?sgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEA_W_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sputbackc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputbackc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z ?sputbackc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?stossc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAXXZ ?stossc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAXXZ ?stossc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?sungetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sungetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ ?sungetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?swap@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXAEAV12@@Z ?swap@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXAEAV12@@Z ?swap@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXAEAV12@@Z ?swap@?$basic_iostream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z ?swap@?$basic_iostream@GU?$char_traits@G@std@@@std@@IEAAXAEAV12@@Z ?swap@?$basic_iostream@_WU?$char_traits@_W@std@@@std@@IEAAXAEAV12@@Z ?swap@?$basic_istream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z ?swap@?$basic_istream@GU?$char_traits@G@std@@@std@@IEAAXAEAV12@@Z ?swap@?$basic_istream@_WU?$char_traits@_W@std@@@std@@IEAAXAEAV12@@Z ?swap@?$basic_ostream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z ?swap@?$basic_ostream@GU?$char_traits@G@std@@@std@@IEAAXAEAV12@@Z ?swap@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@IEAAXAEAV12@@Z ?swap@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z ?swap@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXAEAV12@@Z ?swap@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXAEAV12@@Z ?swap@ios_base@std@@QEAAXAEAV12@@Z ?sync@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sync@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAHXZ ?sync@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAHXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?sync_with_stdio@ios_base@std@@SA_N_N@Z ?table@?$ctype@D@std@@QEBAPEBFXZ ?table_size@?$ctype@D@std@@2_KB ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?tellg@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?tellg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?tellp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?tellp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@PEAV32@@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@PEAV32@@Z ?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ ?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@PEAV32@@Z ?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ ?tolower@?$ctype@D@std@@QEBADD@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@G@std@@QEBAGG@Z ?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?toupper@?$ctype@D@std@@QEBADD@Z ?toupper@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?toupper@?$ctype@G@std@@QEBAGG@Z ?toupper@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z ?toupper@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?toupper@?$ctype@_W@std@@QEBA_W_W@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?uncaught_exception@std@@YA_NXZ ?uncaught_exceptions@std@@YAHXZ ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?underflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ ?underflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?unget@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unget@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ ?unget@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?unsetf@ios_base@std@@QEAAXH@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?unshift@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?unshift@?$codecvt@_SDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?unshift@?$codecvt@_UDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?wcerr@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A ?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?wcin@std@@3V?$basic_istream@GU?$char_traits@G@std@@@1@A ?wcin@std@@3V?$basic_istream@_WU?$char_traits@_W@std@@@1@A ?wclog@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A ?wclog@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?wcout@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGD@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?widen@?$ctype@D@std@@QEBADD@Z ?widen@?$ctype@D@std@@QEBAPEBDPEBD0PEAD@Z ?widen@?$ctype@G@std@@QEBAGD@Z ?widen@?$ctype@G@std@@QEBAPEBDPEBD0PEAG@Z ?widen@?$ctype@_W@std@@QEBAPEBDPEBD0PEA_W@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?write@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@PEBG_J@Z ?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z ?xalloc@ios_base@std@@SAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z _Chmod _Close_dir _Cnd_broadcast _Cnd_destroy _Cnd_destroy_in_situ _Cnd_do_broadcast_at_thread_exit _Cnd_init _Cnd_init_in_situ _Cnd_register_at_thread_exit _Cnd_signal _Cnd_timedwait _Cnd_unregister_at_thread_exit _Cnd_wait _Copy_file _Cosh _Current_get _Current_set _Denorm _Dtest _Equivalent _Exp _FCosh _FDenorm _FDtest _FExp _FInf _FNan _FSinh _FSnan _File_size _Getcoll _Getctype _Getcvt _Getdateorder _Getwctype _Getwctypes _Hard_links _Hugeval _Inf _LCosh _LDenorm _LDtest _LExp _LInf _LNan _LSinh _LSnan _Last_write_time _Link _Lock_shared_ptr_spin_lock _Lstat _Make_dir _Mbrtowc _Mtx_clear_owner _Mtx_current_owns _Mtx_destroy _Mtx_destroy_in_situ _Mtx_getconcrtcs _Mtx_init _Mtx_init_in_situ _Mtx_lock _Mtx_reset_owner _Mtx_timedlock _Mtx_trylock _Mtx_unlock _Mtxdst _Mtxinit _Mtxlock _Mtxunlock _Nan _Open_dir _Query_perf_counter _Query_perf_frequency _Read_dir _Remove_dir _Rename _Resize _Set_last_write_time _Sinh _Snan _Stat _Statvfs _Stod _Stodx _Stof _Stofx _Stold _Stoldx _Stoll _Stollx _Stolx _Stoul _Stoull _Stoullx _Stoulx _Strcoll _Strxfrm _Symlink _Symlink_get _Temp_get _Thrd_abort _Thrd_create _Thrd_current _Thrd_detach _Thrd_equal _Thrd_exit _Thrd_hardware_concurrency _Thrd_id _Thrd_join _Thrd_sleep _Thrd_start _Thrd_yield _To_byte _To_wide _Tolower _Toupper _Towlower _Towupper _Unlink _Unlock_shared_ptr_spin_lock _WStod _WStodx _WStof _WStofx _WStold _WStoldx _Wcrtomb _Wcscoll _Wcsxfrm _Xtime_diff_to_millis _Xtime_diff_to_millis2 _Xtime_get_ticks __Wcrtomb_lk __crtCloseThreadpoolTimer __crtCloseThreadpoolWait __crtCompareStringA __crtCompareStringEx __crtCompareStringW __crtCreateEventExW __crtCreateSemaphoreExW __crtCreateSymbolicLinkW __crtCreateThreadpoolTimer __crtCreateThreadpoolWait __crtFlushProcessWriteBuffers __crtFreeLibraryWhenCallbackReturns __crtGetCurrentProcessorNumber __crtGetFileInformationByHandleEx __crtGetLocaleInfoEx __crtGetSystemTimePreciseAsFileTime __crtGetTickCount64 __crtInitOnceExecuteOnce __crtInitializeCriticalSectionEx __crtIsPackagedApp __crtLCMapStringA __crtLCMapStringEx __crtLCMapStringW __crtSetFileInformationByHandle __crtSetThreadpoolTimer __crtSetThreadpoolWait __crtWaitForThreadpoolTimerCallbacks __set_stl_sync_api_mode xtime_get

msvcp140_1.dll

IMPHASH 20717227ccb65afbaea7feeb74196ea2
SHA256 4ca07628eff5c1e0cd5e0164fef90e84a64ce611507438b099acd0b7389c7eac
MD5 8adc114bacb4d54a5b372981a4a1b279
SHA1 0d47b94e28b0d5f41459531dfea780b8393fb94c
SHA512 dc5afdcd250338f3f784883cb55c9b2f8682fdbe11eb666c701eac7b8e489621b89c80246327f354989ab1a3f4139773b48e8aa3b4f3a0fcb40298f133b4483a
SSDEEP 768:l8QH+Roj0PmLyw4DYEio9zbgoaoAwGOrF9zKa1cbTUDIwGOrF9z/L5:WQ2oAPmLygBgzbgVHyLzjyvUMyLz9
TLSH
T1AF235AC5AA2C8483ED6658708299ED837C3CB7C25B50A69B52E5FA4C0DD33C5FB3462D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\msvcp140_1.amd64.pdb

msvcp140_2.dll

IMPHASH f7f30d1d1d3097d294aaf3c2c0088792
SHA256 f118c2c4753cd51d40afdd0e7f4265e022ff6af45f71a4e85816ad8ff9a249f5
MD5 a47c63662489293a70028079cda3d04e
SHA1 c93b09adc9832f596ace81d981c31f654d4e30c1
SHA512 4f0409acec7ce5724d5561c8ea56103651c2dad1bece60e0a9fe033cc58203a36394b694e403eaa4cf88bea4c8088c839f41c6e0b2a87cd2d8659d8ab14a0f07
SSDEEP 3072:HJ51P7emwi1j+XZi7b1dbqtH0h6XV3Q0JPQo07ICl3Sg2xmygdCg2LMeDh5FD79y:HJbjwvnQo/iy5L/UxTWrTGT
TLSH
T199542912B51A2EBFC9D7A8B04939B816FC2636418771C48A57C31C8D9E1BB437FE3529
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

197072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\msvcp140_2.amd64.pdb

msvcp140

?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?clear@ios_base@std@@QEAAXH_N@Z ?rdstate@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?precision@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?widen@?$ctype@D@std@@QEBAPEBDPEBD0PEAD@Z ?_Addstd@ios_base@std@@SAXPEAV12@@Z ??0ios_base@std@@IEAA@XZ ?_Init@ios_base@std@@IEAAXXZ ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$numpunct@D@std@@2V0locale@2@A ?widen@?$ctype@D@std@@QEBADD@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?uncaught_exceptions@std@@YAHXZ ??1_Lockit@std@@QEAA@XZ ??1ios_base@std@@UEAA@XZ ??0_Lockit@std@@QEAA@H@Z

vcruntime140

memcpy __std_exception_destroy memmove memcmp __std_terminate memset __C_specific_handler __std_type_info_destroy_list _CxxThrowException __std_exception_copy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _invoke_watson _initterm_e _cexit _initterm _errno

api-ms-win-crt-math-l1-1-0

sin tan pow log fmod sqrtf sqrt _dclass _fdclass _ldclass atan ceil cos ldexp frexp cosh floor exp sinh

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free calloc

api-ms-win-crt-string-l1-1-0

strcspn strlen

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s

api-ms-win-crt-locale-l1-1-0

localeconv

kernel32

DisableThreadLibraryCalls RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent

msvcp140_atomic_wait.dll

IMPHASH 4f990e5a824dbd8d56855b48ecbf1310
SHA256 7c26818aeb5fcb096ac9a4acfcbb3385f55a27052eaa80a8b9750e545a24b492
MD5 5704a8a1d5dc6ccdccde870138bb40f7
SHA1 390628a9a9a258678d1c262700ef835738aa0cd8
SHA512 abc37501d43e13a660aef1bead5fc124353ab0b0d1fa3d4831a6495acb65ff07addf97b3993efb9bce7ac67c8737feb48b36281aa5fcb9a3d54aad239c561250
SSDEEP 768:WyMsqh8UGchsJr3Fb0A5XeDxDw4DYs1kC9z6huL9zsMbTUDow9z/UP:6+UjCFb75XelDgsSez6hiztvUk4zu
TLSH
T1D4536DD9A7285082E9A79A30C194E917FD3A77D20B10D6EF4252F4890FA37D1AF34A1D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

DLL Hijacking vulnerability

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

15936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\msvcp140_atomic_wait.amd64.pdb

msvcp140

??0_Init_locks@std@@QEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ??1_Init_locks@std@@QEAA@XZ _Thrd_hardware_concurrency

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy _CxxThrowException __std_exception_destroy __std_terminate memset __C_specific_handler __std_type_info_destroy_list __std_exception_copy

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _seh_filter_dll _cexit _initterm _initterm_e abort _crt_atexit

api-ms-win-crt-heap-l1-1-0

_callnewh malloc calloc free

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW

kernel32

TerminateProcess GetCurrentProcess InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WideCharToMultiByte AreFileApisANSI MultiByteToWideChar GetLastError ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetTickCount64 GetModuleHandleW GetProcAddress CreateThreadpoolWork SubmitThreadpoolWork WaitForThreadpoolWorkCallbacks CloseThreadpoolWork SetLastError LoadLibraryExW DisableThreadLibraryCalls GetCurrentThreadId

msvcp140_codecvt_ids.dll

IMPHASH 8e3190ca5b1dfe3662e83fefed12f437
SHA256 be98716fa5b602089f1c208c2ddd6833f364e6c2cf94c4f79f1d7215aadc4946
MD5 4200caef24f0a3559d8351f94de4ec15
SHA1 ee952f3415c88a31649c99d0aa90b7c4d10db95d
SHA512 4425d428c5d06f2ee335b07cce7aadeab303f306f1b0ee626f98ac62c83a904d10b39b7a8336cf28e8e94ab305a7570e3344f7e640fd57f5ffb64f22296eef17
SSDEEP 768:LGVzEcyw4DYY3jIT9z0WoOa9zD1mbqCf9zKPE:LGzE7ggM5zF2zMuozgE
TLSH
T125135CD6DA3C8086EDAB9C7093A8DE877C3D67C70E1065A702E1F5541D933C6EB2816D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\msvcp140_codecvt_ids.amd64.pdb

officeinventory.dll

IMPHASH 9ff9c1d56d71654a2953a9115e738477
SHA256 b9a0a226653ab073bedf97f749a616360f8e89aac64bd6295144995fbdb6bc19
MD5 44d1253d97c2454cb5c47c7c11f93191
SHA1 25a03332798284c49569e6d380259758eda24ced
SHA512 0417f4aa46a4556d1af5431955757352ef814c2cfbd7ad8be6464e164f1caa44518ca6dc29d6dd9ff28ce004127905028dc42ca8a5c1e7c244de413e1ea082b3
SSDEEP 12288:E21bjXD+Wh+OHhx3PX+tU1i/7PrkPb5jHBLvaA7fPzKsFnJ5tmAUoVS1g:h+Wh5uOfPz1nJ54/aS1
TLSH
T180D47E16A2ED01B9E1B7D13889974913FA77780603709AEF03E156671F27BE09F3A721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

b4:de:3a:ef:24:29:1e:61:98:86:3a:4e:0b:0e:f2:ac:63:99:6e:80:8a:a8:e1:b5:dd:2d:19:46:41:ca:83:e2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 6, 2026

CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

b4:de:3a:ef:24:29:1e:61:98:86:3a:4e:0b:0e:f2:ac:63:99:6e:80:8a:a8:e1:b5:dd:2d:19:46:41:ca:83:e2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 6, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 2, 2021 - Sep 1, 2022

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:E5A6-E27C-592E,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:95:b7:fc:0d:d6:e3:37:31:25:00:01:00:00:01:95

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 2, 2021 - Feb 28, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:f5:d6:77:f7:71:00:9c:08:ef:00:00:00:00:00:f5

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 24, 2025 - Jul 23, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:431A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1d:4b:c0:92:87:38:85:7e:39:00:01:00:00:02:1d

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Minor OS version

0

Major OS version

6

Entry point

258568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\target\x64\Release\OfficeInventory.pdb

kernel32

LoadLibraryW CompareStringOrdinal LCIDToLocaleName GetFileAttributesW GetModuleHandleW GetProcAddress CreateFileW ReadFile SetFilePointer GetSystemTimeAsFileTime ReleaseMutex WaitForSingleObject CreateMutexW GetFileInformationByHandleEx GlobalFree GlobalAlloc SetDefaultDllDirectories FreeLibrary CloseHandle GetLongPathNameW AreFileApisANSI GetFileAttributesExW GetFileSize ExpandEnvironmentStringsW WideCharToMultiByte CompareFileTime FormatMessageA MultiByteToWideChar GetStringTypeW LocalFree InitOnceBeginInitialize InitOnceComplete EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess RtlPcToFileHeader RaiseException RtlUnwindEx InterlockedFlushSList GetLastError SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameA HeapAlloc HeapFree GetACP GetStdHandle GetFileType CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FindClose FindFirstFileExA FindFirstFileExW FindNextFileA FindNextFileW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize WriteFile GetConsoleCP GetConsoleMode SetFilePointerEx FlushFileBuffers WriteConsoleW OutputDebugStringW

user32

CharLowerW

advapi32

RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegCloseKey

ole32

IIDFromString CLSIDFromString StringFromGUID2 CoCreateInstance CreateStreamOnHGlobal CoTaskMemFree CoSetProxyBlanket

shell32

SHGetKnownFolderPath

shlwapi

SHCreateStreamOnFileW PathRemoveFileSpecW PathAddExtensionW StrStrIW PathFindFileNameW StrTrimW PathFindExtensionW PathCreateFromUrlW PathAppendW PathFileExistsW

wininet

InternetCrackUrlW

crypt32

CryptStringToBinaryW CryptBinaryToStringW

oleaut32

VariantChangeType SysAllocString SysFreeString VariantInit VariantClear

urlmon

URLOpenBlockingStreamW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

430KB

Virtual Size

430KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

133KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

officesvcmgr.exe

IMPHASH 132fcad5933b9ce62ef22e85c2b4f2b9
SHA256 d40a873ffc93abf1ff6913f207b6d8afca3c98b7dac0f232844918b01141c61f
MD5 4f503a25ef8e68c1543d3eb823c82b89
SHA1 6fa38e0116db65b14b79b2c9098f39228a930d50
SHA512 0d0a22cc3f465d986ba7a1dd7a75715415c3bcee24f611e377e78a627adc759edf58bf0adc732c8a3af5fcb010de7b6c5c6f4e826a20f2798d1c645b9082b1a9
SSDEEP 49152:RBQc46MkZhBzsL3ykhaZIB7oqc1E1z6do1MRGZwUq1DcewTK99DdJ/kNNcAl32dh:RLkUpdL9PxEC
TLSH
T140F54B1667F401E9F1F7D2B8DA7B8533EA7278464631A34F06A1C6562F337206D2DB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

eb:77:a5:d9:69:0a:9b:06:e1:d5:89:ef:f1:1d:72:c2:bb:4b:a3:88:25:d2:e6:66:ef:32:bf:2c:73:49:d5:4e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 30, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

eb:77:a5:d9:69:0a:9b:06:e1:d5:89:ef:f1:1d:72:c2:bb:4b:a3:88:25:d2:e6:66:ef:32:bf:2c:73:49:d5:4e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 30, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:21:33:c0:35:fb:d2:0f:21:a4:00:01:00:00:02:21

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:23:4f:d9:60:24:53:cf:fe:2b:00:01:00:00:02:23

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

2500880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\dbs\el\omr\target\x64\ship\c2rsvcmgr\x-none\OfficeSvcMgr.pdb

kernel32

GetCurrentProcess GetModuleHandleExW GetLastError CompareStringEx GetProcAddress FreeLibrary IsWow64Process SetProcessMitigationPolicy ExpandEnvironmentStringsW GetModuleFileNameW CreateEventW MultiByteToWideChar SetEvent CloseHandle FindClose FindFirstFileExW GetComputerNameExW SetFilePointerEx GetProcessHeap HeapFree ReadFile GetFileSizeEx WriteFile GetSystemTime SystemTimeToFileTime Sleep GetFileAttributesExW GetTempPathW CreateDirectoryW DeleteFileW SetFileAttributesW RaiseException GetSystemDirectoryW WideCharToMultiByte OpenProcess GetExitCodeProcess GetProcessTimes GetTickCount64 GetSystemTimeAsFileTime TerminateProcess GetModuleFileNameA GetShortPathNameA K32GetModuleFileNameExW CreateProcessW LoadLibraryExW FindResourceW SizeofResource LoadResource GetModuleHandleW VerSetConditionMask VerifyVersionInfoW GetCurrentProcessId GetUserDefaultLocaleName IsValidCodePage SetLastError FileTimeToSystemTime GetStringTypeExW FindNextFileW GetFileType CreateFileW CopyFileExW GetOverlappedResult GetFileTime SetFileInformationByHandle CreateEventExW ResetEvent QueryPerformanceCounter QueryPerformanceFrequency GlobalFree GlobalAlloc GlobalMemoryStatusEx GetVersionExW GetDiskFreeSpaceExW DeviceIoControl GetComputerNameW FormatMessageW FormatMessageA LocalFree GetNativeSystemInfo CreateActCtxW ActivateActCtx OutputDebugStringA FindActCtxSectionStringW DeactivateActCtx QueryActCtxW LoadLibraryW HeapAlloc QueryUnbiasedInterruptTime GetCurrentThreadId SetEndOfFile SetFileTime FlushFileBuffers CancelIoEx GetTempFileNameW WaitForSingleObject WaitForSingleObjectEx WaitForMultipleObjectsEx GetProcessAffinityMask CreateWaitableTimerW SetWaitableTimerEx CancelWaitableTimer QueryDepthSList InitializeCriticalSectionEx DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList RtlCaptureStackBackTrace ReleaseMutex GetLongPathNameW GetFinalPathNameByHandleW GetTickCount InitOnceExecuteOnce GetLocalTime ReleaseSemaphore AcquireSRWLockExclusive ReleaseSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared CreateThread WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork UnmapViewOfFile MapViewOfFile WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetCurrentThread GetQueuedCompletionStatus FlsFree FlsSetValue FlsGetValue FlsAlloc IsDebuggerPresent WaitForMultipleObjects CreateMemoryResourceNotification GetSystemPowerStatus QueryProcessCycleTime OpenThread QueryThreadCycleTime IsSystemResumeAutomatic RtlCaptureContext OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA CreateFileMappingA LocalAlloc TlsAlloc TlsFree TlsGetValue TlsSetValue MoveFileExW RemoveDirectoryW LockFileEx UnlockFileEx GetFileInformationByHandleEx GetCurrentDirectoryW GetVolumePathNamesForVolumeNameW K32EnumProcessModulesEx RtlLookupFunctionEntry RtlVirtualUnwind K32GetProcessMemoryInfo ProcessIdToSessionId FindFirstFileW lstrcmpW CopyFileW GetCommandLineW GetPriorityClass K32EnumProcesses LCMapStringEx GetSystemDefaultLCID SetUnhandledExceptionFilter LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo InitOnceComplete InitOnceBeginInitialize GetLocaleInfoEx AreFileApisANSI IsProcessorFeaturePresent UnhandledExceptionFilter

oleaut32

UnRegisterTypeLi RegisterTypeLi LoadTypeLi VariantClear SysFreeString VariantInit SysAllocString GetErrorInfo SetErrorInfo SysStringLen

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_purecall memmove wcsrchr _CxxThrowException __C_specific_handler __std_exception_copy memcmp memchr wcschr __std_terminate strchr __std_type_info_compare wcsstr __std_type_info_name memset __current_exception __current_exception_context __std_exception_destroy __C_specific_handler_noexcept memcpy

msvcp140

?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ??7ios_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Syserror_map@std@@YAPEBDH@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Winerror_map@std@@YAHH@Z _Xtime_get_ticks _Query_perf_counter _Query_perf_frequency ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Mtx_unlock _Mtx_init_in_situ ?_Xbad_function_call@std@@YAXXZ _Thrd_id ?_Xinvalid_argument@std@@YAXPEBD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?uncaught_exceptions@std@@YAHXZ ?good@ios_base@std@@QEBA_NXZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?_Incref@facet@locale@std@@UEAAXXZ ??1_Locinfo@std@@QEAA@XZ ??1_Lockit@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??0_Lockit@std@@QEAA@H@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?id@?$ctype@_W@std@@2V0locale@2@A ?id@?$collate@_W@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z _Wcsxfrm _Wcscoll ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?widen@?$ctype@_W@std@@QEBA_WD@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_J@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z ?toupper@?$ctype@_W@std@@QEBA_W_W@Z _Cnd_init_in_situ _Cnd_wait _Cnd_do_broadcast_at_thread_exit ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ??Bios_base@std@@QEBA_NXZ _Thrd_join ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@F@Z ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?tellp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z

api-ms-win-crt-heap-l1-1-0

free malloc realloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

fputc ungetc fgetc fread fwrite fgetpos _fseeki64 _set_fmode fsetpos setvbuf fflush __acrt_iob_func __stdio_common_vfwprintf __stdio_common_vswscanf __p__commode __stdio_common_vswprintf_s __stdio_common_vsnwprintf_s fclose _get_stream_buffer_pointers __stdio_common_vsnprintf_s __stdio_common_vsprintf_s

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table _clearfp _beginthreadex abort _errno _invalid_parameter_noinfo _register_thread_local_exe_atexit_callback _c_exit terminate _cexit __p___wargv __p___argc _exit exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _invoke_watson _crt_atexit _seh_filter_exe _set_app_type

api-ms-win-crt-string-l1-1-0

_wcsicmp wcsnlen iswalpha isdigit wcscmp tolower wmemcpy_s strncpy_s strcmp iswspace wcscpy_s strnlen isxdigit wcsncmp towlower wcsncpy_s _stricmp

api-ms-win-crt-convert-l1-1-0

wcstoul wcstol _itow_s wcstoll wcstod _wtoi _i64tow_s _ultow_s _ui64tow_s strtol _ui64toa_s _wcstoi64 _wcstoui64

api-ms-win-crt-time-l1-1-0

wcsftime _mktime64 _localtime64_s _time64 _difftime64

api-ms-win-crt-math-l1-1-0

round _fdclass _dclass _dsign ceilf expf floor log10 logf pow __setusermatherr

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char _configthreadlocale ___lc_codepage_func

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

823KB

Virtual Size

823KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

60KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

officesvcmgrschedule.xml

SHA256 349ecdee7be9351674666c4bc5911321b33862ffc7a8f126932da5e4d8c62f5a
MD5 672e8f3db14b563f2cb22c34d1b8dfea
SHA1 c99a28dfb1f443ef2195a0eadffd8683c7f8923d
SHA512 7f6138e340cc1cd857b07a9dc443a3428e31794ec8ed6d3aa30a8123218722329fd8c50e36131f72337962803235c062925c3a8952c300c9a72b4d3c5c1c5940
SSDEEP 96:tOWBGqyATo7qUHvct6CNRdRiM6h4iGdiaipVMll7di0A4z1i+:rQKmDCNRdR0nxaee9Ri+
TLSH
T125A1595367EA1519F1F76B6CAEB614228E67BC516D38C46D00AC200DCBF7E6288707B7
MD5 SHA1 SHA512 SSDEEP TLSH

offreg.dll

IMPHASH f9dab6cc9fcac2e4ad27fa85f13493b8
SHA256 a1d3a2a412ab6ca9b1367b0539adcb8328cafc744074caad97a02c78a80e468a
MD5 5135d9b80b60ea72a699f4abbfb32e2f
SHA1 9e643d2c800a44db5dbf0c0fd149c4a493f30e7c
SHA512 c58c42755c344bd93068072bea35a2652d91fbc2eb06893f67a997b47ed675af7e88ec031293ba7cc12c64f81142018b117a19d2ffb3ebf8d9e1e8c473d73adf
SSDEEP 1536:U727gS3CrXu2WLTkDRBkPiRg7NxdtA6TtovUrzT:UegqCbu2WyPgLQamkf
TLSH
T16C938E1AF79820B3E92A8AB487598657F735B81613102BEF01F5D27A1F47BC57E3A304
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Digest

29:d2:a2:a4:d9:63:a0:de:95:3e:d8:f3:78:5d:67:2d:fa:5d:f5:f7:86:53:1e:2d:39:b4:d1:31:6e:5b:f3:ca

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 6, 2026

CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

29:d2:a2:a4:d9:63:a0:de:95:3e:d8:f3:78:5d:67:2d:fa:5d:f5:f7:86:53:1e:2d:39:b4:d1:31:6e:5b:f3:ca

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 19, 2019

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:39:b2:b4:e8:2a:22:34:49:2f:00:00:00:00:02:39

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 12, 2018 - Aug 8, 2019

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 6, 2010 - Jul 6, 2025

Subject

CN=Microsoft Time-Stamp service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:0842-4BE6-C29A,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Serial Number

33:00:00:00:d8:1a:e4:cc:3f:7a:11:fa:e1:00:00:00:00:00:d8

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 23, 2018 - Nov 23, 2019

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:f6:92:aa:c4:74:34:c6:03:13:00:00:00:00:00:f6

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 24, 2025 - Jul 23, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:F002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:05:3c:75:6c:82:44:87:cd:fe:00:01:00:00:02:05

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 30, 2025 - Apr 22, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

10

Entry point

55184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

offreg.pdb

msvcrt

_XcptFilter _amsg_exit free malloc _initterm memmove _wcsnicmp wcsncpy_s wcscat_s wcsnlen _aligned_malloc _aligned_free _wcsicmp __C_specific_handler memcpy memcmp memset

kernel32

CloseHandle CreateFileW WriteFile GetFileSizeEx ReadFile TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetTickCount GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter Sleep GetFinalPathNameByHandleW TlsSetValue TlsFree TlsGetValue TlsAlloc EnterCriticalSection InitializeCriticalSectionAndSpinCount GetModuleHandleW DeleteCriticalSection GetProcAddress GetLastError FlushFileBuffers LeaveCriticalSection

advapi32

GetAce GetSidSubAuthority GetSidLengthRequired CreatePrivateObjectSecurityWithMultipleInheritance InitializeSid IsValidSid InitializeAcl SetPrivateObjectSecurityEx GetLengthSid AddAccessAllowedAce SetSecurityDescriptorDacl SetSecurityDescriptorOwner GetSecurityDescriptorControl InitializeSecurityDescriptor MakeSelfRelativeSD SetSecurityDescriptorGroup DestroyPrivateObjectSecurity IsValidSecurityDescriptor GetSecurityDescriptorLength

ntdll

RtlUpcaseUnicodeChar RtlRunOnceComplete RtlRunOnceBeginInitialize RtlFindNextForwardRunClear RtlNumberOfSetBits RtlInitializeSRWLock RtlReleaseSRWLockExclusive RtlAcquireSRWLockExclusive RtlFreeHeap RtlAllocateHeap RtlNtStatusToDosError

Name

.text

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

PAGE

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

1016B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

28B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

policy.dll

IMPHASH 07809849fa7b8d783c36ec3646051ee9
SHA256 64f9121eb871bd4a468b640fe7ab79021138decd40a5c45044e40f99a1d89e44
MD5 d5aeb0685beed22878075e691450bbb5
SHA1 bac2cc51b307df850b59dbf081ec4b4e88f1f722
SHA512 bde3a94ce2a872427270e6f82e581021ee641419cd3d4df0a92148f70d9f670a44acb76f12211625c3f3079e3a7b39786aa29198fd350d85e12ca65c38572ae3
SSDEEP 24576:kCmkk4C82E5ywjLeYoh1cuBkKAn2mGiwM0QOoG6mgpa5eQys3x:gkk4C9wneXHcokKAncM0QNG6mgLe
TLSH
T1A5753B4763F505A9F5FAE678DA778939EAB27C021A31D34F0660C64A5F33B104D39B22
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x64 arch:x64

Digest

25:50:fb:79:09:0d:1d:bc:31:63:53:b5:1a:84:6f:68:3d:75:01:2d:25:00:62:9f:57:38:fd:c0:60:00:05:a6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 30, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

25:50:fb:79:09:0d:1d:bc:31:63:53:b5:1a:84:6f:68:3d:75:01:2d:25:00:62:9f:57:38:fd:c0:60:00:05:a6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 30, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4c:07:fe:3f:0c:56:ec:41:43:00:00:00:00:01:4c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:651A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:15:18:03:d3:81:07:26:7c:53:00:01:00:00:02:15

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b8:f9:b5:51:0a:d7:7c:9d:93:00:00:00:00:00:b8

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:401A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:19:5e:b2:d8:54:75:f4:b1:8d:00:01:00:00:02:19

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Minor OS version

1

Major OS version

6

Entry point

1032352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d:\dbs\el\omr\target\x64\ship\c2rsvcmgr\x-none\Policy.pdb

kernel32

MultiByteToWideChar GetLastError CloseHandle GetModuleHandleExW GetProcAddress CompareStringEx HeapFree GetProcessHeap GetCurrentProcess SetFilePointerEx IsWow64Process FreeLibrary ExpandEnvironmentStringsW GetSystemTimeAsFileTime GetTickCount64 GetCurrentProcessId GetCurrentThreadId GetUserDefaultLocaleName IsValidCodePage SetLastError WideCharToMultiByte FileTimeToSystemTime GetStringTypeExW DisableThreadLibraryCalls GetModuleFileNameW FindFirstFileExW DeleteFileW FindNextFileW FindClose GetFileType CreateFileW GetOverlappedResult GetFileTime GetFileAttributesExW SetFileAttributesW CreateEventExW SetEvent WriteFile WaitForSingleObjectEx GetLocalTime GetComputerNameW GetTempPathW GetSystemDirectoryW CreateDirectoryW OpenProcess GetProcessTimes TerminateProcess GetModuleFileNameA GetShortPathNameA LoadLibraryExW FindResourceW SizeofResource LoadResource GetModuleHandleW ReleaseSemaphore CreateEventW WaitForSingleObject AcquireSRWLockExclusive ReleaseSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared CreateThread WaitForMultipleObjectsEx WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW DeactivateActCtx ActivateActCtx LoadLibraryW FindActCtxSectionStringW CreateActCtxW QueryActCtxW OutputDebugStringA CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork GetTempFileNameW ResetEvent QueryPerformanceCounter GlobalFree GlobalAlloc GlobalMemoryStatusEx RaiseException GetVersionExW DeviceIoControl LocalFree GetNativeSystemInfo HeapAlloc QueryUnbiasedInterruptTime GetFileSizeEx SetEndOfFile ReadFile SetFileTime FlushFileBuffers CancelIoEx GetProcessAffinityMask CreateWaitableTimerW SetWaitableTimerEx CancelWaitableTimer QueryDepthSList InitializeCriticalSectionEx DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList RtlCaptureStackBackTrace ReleaseMutex GetLongPathNameW GetFinalPathNameByHandleW GetTickCount InitOnceExecuteOnce UnmapViewOfFile MapViewOfFile WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetCurrentThread GetQueuedCompletionStatus Sleep FlsFree FlsSetValue FlsGetValue FlsAlloc IsDebuggerPresent WaitForMultipleObjects CreateMemoryResourceNotification GetSystemPowerStatus QueryProcessCycleTime OpenThread QueryThreadCycleTime IsSystemResumeAutomatic RtlCaptureContext OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA CreateFileMappingA LocalAlloc FindFirstFileW lstrcmpW ProcessIdToSessionId K32GetProcessMemoryInfo RtlLookupFunctionEntry LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo InitOnceComplete InitOnceBeginInitialize IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind GetSystemDefaultLCID

oleaut32

DispInvoke DispGetIDsOfNames LoadRegTypeLi SysStringLen

vcruntime140_1

__CxxFrameHandler4

vcruntime140

wcsstr memset __current_exception __current_exception_context __std_terminate __std_exception_copy __std_exception_destroy __std_type_info_compare memmove __C_specific_handler_noexcept _CxxThrowException _purecall wcschr memcpy memcmp __std_type_info_destroy_list strchr wcsrchr __C_specific_handler

msvcp140

?toupper@?$ctype@_W@std@@QEBA_W_W@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xinvalid_argument@std@@YAXPEBD@Z _Xtime_get_ticks ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_init_in_situ _Mtx_lock _Mtx_unlock ?uncaught_exceptions@std@@YAHXZ ?good@ios_base@std@@QEBA_NXZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?_Incref@facet@locale@std@@UEAAXXZ ??1_Locinfo@std@@QEAA@XZ ??1_Lockit@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??0_Lockit@std@@QEAA@H@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z _Thrd_id ?_Xbad_function_call@std@@YAXXZ ?_Syserror_map@std@@YAPEBDH@Z _Cnd_init_in_situ _Cnd_wait _Query_perf_frequency _Query_perf_counter ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?id@?$ctype@_W@std@@2V0locale@2@A ?id@?$collate@_W@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z _Wcsxfrm _Wcscoll ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z

api-ms-win-crt-heap-l1-1-0

malloc free realloc

api-ms-win-crt-runtime-l1-1-0

abort _clearfp _invalid_parameter_noinfo _execute_onexit_table terminate _errno _invoke_watson _initterm _initterm_e _cexit _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s __stdio_common_vsnwprintf_s __stdio_common_vsprintf_s

api-ms-win-crt-string-l1-1-0

isdigit wcsncpy_s strncpy_s strcmp strnlen wcscpy_s wcsnlen wcscmp _stricmp strncmp wmemcpy_s

api-ms-win-crt-convert-l1-1-0

_i64tow_s wcstoul strtoull strtod strtoll wcstol _ui64toa_s wcstoll

api-ms-win-crt-math-l1-1-0

round floor log10 expf ceilf _fdclass pow logf _dclass

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char

api-ms-win-crt-time-l1-1-0

wcsftime _time64 _localtime64_s

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

415KB

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

992B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

repoman.dll

IMPHASH 3a2b77c3de6ba3814dd4d6979416140c
SHA256 c0522ff864e01f07d55208476e998de7b1e435c8aee21b493c94643a5e330fdd
MD5 109c1d73700eb47ba44b184518170cd4
SHA1 71adc54cf22b05a2dc075c701f49da5725ab7cd3
SHA512 acba93c58aa93f2f4afac273b276cbd8eceedf780df16bbfc0f4e2972ecd7258ab7f8d5cd36f8c8b37eab172c2a66b30dcc4da7d8cba005ba583c00c0ca6a9e2
SSDEEP 49152:Qtdc1neeKRQhAfFwmc83QlGaQ0H17x5Al:hKLOmcLlG10V8
TLSH
T199C57C2BB36C40E4E076D279C98A25A7F7B2305B937163CB02E0DB595F637B2553AB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

8f:82:32:16:00:1c:c0:e9:9f:86:9c:fe:36:72:4e:9e:ce:0b:57:27:16:49:70:77:45:22:af:d8:07:5a:d9:94

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

8f:82:32:16:00:1c:c0:e9:9f:86:9c:fe:36:72:4e:9e:ce:0b:57:27:16:49:70:77:45:22:af:d8:07:5a:d9:94

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 4, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4d:67:f3:0e:1c:99:8f:b5:78:00:00:00:00:01:4d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 23, 2026 - Apr 21, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:2b:bb:00:50:ff:4d:3b:9a:a1:00:01:00:00:02:2b

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:77:d5:eb:af:db:70:7b:64:00:00:00:00:00:b9

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:27:d5:c0:83:c3:b1:2e:57:2d:00:01:00:00:02:27

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Minor OS version

1

Major OS version

6

Entry point

1682960

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\dbs\el\omr\Target\x64\ship\repoman\x-none\Repoman.pdb

msix

MsixGetLogTextUTF8 CoCreateAppxFactoryWithHeap

kernel32

WakeConditionVariable GetLocalTime GetLastError MultiByteToWideChar SetLastError WideCharToMultiByte GetSystemTime SystemTimeToFileTime AreFileApisANSI ReadFile TryEnterCriticalSection CreateActCtxW ActivateActCtx HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile GetModuleHandleExW GetDiskFreeSpaceW OutputDebugStringA GetModuleFileNameW LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW FindActCtxSectionStringW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId DeactivateActCtx UnmapViewOfFile HeapValidate HeapSize QueryActCtxW Sleep GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap FreeLibrary GetSystemTimeAsFileTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers InitOnceExecuteOnce CreateDirectoryW FindFirstFileW GetFileSizeEx FindNextFileW RemoveDirectoryW CreateHardLinkW FindClose GetDiskFreeSpaceExW SetFilePointerEx GetModuleHandleW LoadLibraryExW OpenProcess QueryFullProcessImageNameW WakeAllConditionVariable SleepConditionVariableSRW IsProcessorFeaturePresent FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork InitOnceComplete InitOnceBeginInitialize GetStringTypeW RtlPcToFileHeader LoadLibraryExA VirtualQuery VirtualProtect TlsFree GetExitCodeThread TlsSetValue InitializeCriticalSectionEx RaiseException TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedFlushSList RtlUnwindEx IsDebuggerPresent InitializeSListHead QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TerminateProcess GetCurrentProcess TryAcquireSRWLockExclusive SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext LCMapStringEx DecodePointer EncodePointer

oleaut32

SysFreeString SysAllocStringLen VariantClear VariantInit

api-ms-win-crt-heap-l1-1-0

calloc realloc malloc free _msize

api-ms-win-crt-runtime-l1-1-0

_errno abort _invoke_watson terminate _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _initterm_e _initterm _endthreadex _beginthreadex

api-ms-win-crt-string-l1-1-0

isupper _wcsdup islower strcmp __strncnt isdigit strlen strcspn strncmp wcsncpy_s tolower wcsncmp strcpy_s wcsnlen

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s fread feof ftell fseek fclose _wfopen_s ferror fwrite

api-ms-win-crt-locale-l1-1-0

setlocale ___lc_codepage_func ___lc_locale_name_func __pctype_func __initialize_lconv_for_unsigned_char localeconv _unlock_locales _lock_locales ___mb_cur_max_func

api-ms-win-crt-math-l1-1-0

_ldclass _dclass pow round frexp ceilf floor log10 _fdclass

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-utility-l1-1-0

qsort

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

404KB

Virtual Size

403KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

297KB

Virtual Size

302KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

184B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ucrtbase.dll

IMPHASH 1d85fb9ce80726bda08caf2946ef5f93
SHA256 c0ff49a9ff953575e1fa6baee2d22f796cd8bf95f3b5a254886385cda5d6dbd8
MD5 64f42f56d73a23e7fcfe1de4117ae3c4
SHA1 3e87fa6c01a08c9aa43eb9e6cb84d939836c5404
SHA512 8a501521bb3549338b737fe90f154842c4a4589cb544fa2c045ee5a25cb81236e547d6d17c1bd816490801733e31d4a4f3b83245e53ce6bed13304d1fb2ef62e
SSDEEP 24576:XJG9DZM19Y7ieC9dQ8ODtLV8+BaC6EOxPcUz1RmxvSZX0ypHNHf:I/q1vOhq+BaPHxhpZ
TLSH
T1F4359E28B75C02AAD97BE17CC523550AF973380147709ACB03A74BBA3E277E956B7311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Digest

2b:28:89:d9:fa:dd:ce:38:d3:8a:37:15:ce:05:48:97:ff:11:98:3d:29:ac:cb:5d:ae:6a:45:0f:e8:9a:23:43

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 6, 2026

CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

2b:28:89:d9:fa:dd:ce:38:d3:8a:37:15:ce:05:48:97:ff:11:98:3d:29:ac:cb:5d:ae:6a:45:0f:e8:9a:23:43

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 6, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:04:3a:75:e5:2f:9e:0b:29:98:1e:00:00:00:00:04:3a

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 2, 2021 - Sep 1, 2022

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 6, 2010 - Jul 6, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:3E7A-E359-A25D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:a0:e9:bb:8c:bb:0e:a2:d1:7a:00:01:00:00:01:a0

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 2, 2021 - Feb 28, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:f6:92:aa:c4:74:34:c6:03:13:00:00:00:00:00:f6

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 24, 2025 - Jul 23, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:07:2c:11:39:89:cd:85:fb:c5:00:01:00:00:02:07

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 30, 2025 - Apr 22, 2026

Minor OS version

0

Major OS version

10

Entry point

96000

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ucrtbase.pdb

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter UnhandledExceptionFilter GetLastError SetErrorMode SetLastError RaiseException

api-ms-win-core-heap-l1-1-0

HeapCompact HeapReAlloc HeapSize HeapQueryInformation HeapAlloc HeapWalk HeapValidate GetProcessHeap HeapFree

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId TlsFree TlsSetValue TlsGetValue TlsAlloc GetStartupInfoW GetCurrentProcess GetCurrentThread GetExitCodeProcess GetCurrentThreadId CreateThread ExitProcess CreateProcessW ResumeThread ExitThread TerminateProcess

api-ms-win-core-libraryloader-l1-1-0

FreeLibraryAndExitThread GetProcAddress FreeLibrary GetModuleHandleW GetModuleHandleExW LoadLibraryExW GetModuleFileNameW

api-ms-win-core-synch-l1-1-0

WaitForSingleObject DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection

api-ms-win-core-debug-l1-1-0

OutputDebugStringW IsDebuggerPresent

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW FreeEnvironmentStringsW SetEnvironmentVariableW SetCurrentDirectoryW GetEnvironmentStringsW GetCurrentDirectoryW SetStdHandle GetStdHandle GetCommandLineA

api-ms-win-core-file-l1-1-0

GetFullPathNameW SetFilePointerEx GetFileType CreateFileW FindNextFileW FindFirstFileExW GetFileInformationByHandle GetFileSizeEx GetDriveTypeW FindClose SetFileAttributesW GetFileAttributesExW CreateDirectoryW GetDiskFreeSpaceW GetLogicalDrives RemoveDirectoryW SetFileTime DeleteFileW WriteFile LockFileEx UnlockFileEx FlushFileBuffers SetEndOfFile ReadFile

api-ms-win-core-string-l1-1-0

GetStringTypeW WideCharToMultiByte MultiByteToWideChar CompareStringW

api-ms-win-core-fibers-l1-1-0

FlsAlloc FlsGetValue FlsFree FlsSetValue

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-localization-l1-2-0

LCMapStringW IsValidCodePage GetACP GetOEMCP GetLocaleInfoW GetUserDefaultLCID GetCPInfo IsValidLocale EnumSystemLocalesW

api-ms-win-core-datetime-l1-1-0

GetDateFormatW GetTimeFormatW

api-ms-win-core-sysinfo-l1-1-0

SetLocalTime GetSystemInfo GetSystemTimeAsFileTime GetLocalTime

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext RtlVirtualUnwind RtlUnwindEx RtlUnwind RtlPcToFileHeader RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-console-l1-1-0

ReadConsoleInputW SetConsoleCtrlHandler WriteConsoleW GetConsoleCP SetConsoleMode PeekConsoleInputA GetConsoleOutputCP GetNumberOfConsoleInputEvents ReadConsoleW GetConsoleMode

api-ms-win-core-handle-l1-1-0

CloseHandle DuplicateHandle

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe CreatePipe

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime TzSpecificLocalTimeToSystemTime GetTimeZoneInformation

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter QueryPerformanceFrequency

api-ms-win-core-memory-l1-1-0

VirtualAlloc VirtualProtect VirtualQuery

api-ms-win-core-util-l1-1-0

Beep EncodePointer

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList InterlockedFlushSList

_Cbuild _Cmulcc _Cmulcr _CreateFrameInfo _CxxThrowException _Exit _FCbuild _FCmulcc _FCmulcr _FindAndUnlinkFrame _GetImageBase _GetThrowImageBase _Getdays _Getmonths _Gettnames _IsExceptionObjectToBeDestroyed _LCbuild _LCmulcc _LCmulcr _SetImageBase _SetThrowImageBase _SetWinRTOutOfMemoryExceptionCallback _Strftime _W_Getdays _W_Getmonths _W_Gettnames _Wcsftime __AdjustPointer __BuildCatchObject __BuildCatchObjectHelper __C_specific_handler __C_specific_handler_noexcept __CxxDetectRethrow __CxxExceptionFilter __CxxFrameHandler __CxxFrameHandler2 __CxxFrameHandler3 __CxxFrameHandler4 __CxxQueryExceptionSize __CxxRegisterExceptionObject __CxxUnregisterExceptionObject __DestructExceptionObject __FrameUnwindFilter __GetPlatformExceptionInfo __NLG_Dispatch2 __NLG_Return2 __RTCastToVoid __RTDynamicCast __RTtypeid __TypeMatch ___lc_codepage_func ___lc_collate_cp_func ___lc_locale_name_func ___mb_cur_max_func ___mb_cur_max_l_func __acrt_iob_func __conio_common_vcprintf __conio_common_vcprintf_p __conio_common_vcprintf_s __conio_common_vcscanf __conio_common_vcwprintf __conio_common_vcwprintf_p __conio_common_vcwprintf_s __conio_common_vcwscanf __current_exception __current_exception_context __daylight __dcrt_get_wide_environment_from_os __dcrt_initial_narrow_environment __doserrno __dstbias __fpe_flt_rounds __fpecode __initialize_lconv_for_unsigned_char __intrinsic_setjmp __intrinsic_setjmpex __isascii __iscsym __iscsymf __iswcsym __iswcsymf __p___argc __p___argv __p___wargv __p__acmdln __p__commode __p__environ __p__fmode __p__mbcasemap __p__mbctype __p__pgmptr __p__wcmdln __p__wenviron __p__wpgmptr __pctype_func __processing_throw __pwctype_func __pxcptinfoptrs __report_gsfailure __setusermatherr __std_exception_copy __std_exception_destroy __std_terminate __std_type_info_compare __std_type_info_destroy_list __std_type_info_hash __std_type_info_name __stdio_common_vfprintf __stdio_common_vfprintf_p __stdio_common_vfprintf_s __stdio_common_vfscanf __stdio_common_vfwprintf __stdio_common_vfwprintf_p __stdio_common_vfwprintf_s __stdio_common_vfwscanf __stdio_common_vsnprintf_s __stdio_common_vsnwprintf_s __stdio_common_vsprintf __stdio_common_vsprintf_p __stdio_common_vsprintf_s __stdio_common_vsscanf __stdio_common_vswprintf __stdio_common_vswprintf_p __stdio_common_vswprintf_s __stdio_common_vswscanf __strncnt __sys_errlist __sys_nerr __threadhandle __threadid __timezone __toascii __tzname __unDName __unDNameEx __uncaught_exception __uncaught_exceptions __wcserror __wcserror_s __wcsncnt _abs64 _access _access_s _aligned_free _aligned_malloc _aligned_msize _aligned_offset_malloc _aligned_offset_realloc _aligned_offset_recalloc _aligned_realloc _aligned_recalloc _assert _atodbl _atodbl_l _atof_l _atoflt _atoflt_l _atoi64 _atoi64_l _atoi_l _atol_l _atoldbl _atoldbl_l _atoll_l _beep _beginthread _beginthreadex _byteswap_uint64 _byteswap_ulong _byteswap_ushort _c_exit _cabs _callnewh _calloc_base _cexit _cgets _cgets_s _cgetws _cgetws_s _chdir _chdrive _chgsign _chgsignf _chmod _chsize _chsize_s _clearfp _close _commit _configthreadlocale _configure_narrow_argv _configure_wide_argv _control87 _controlfp _controlfp_s _copysign _copysignf _cputs _cputws _creat _create_locale _crt_at_quick_exit _crt_atexit _ctime32 _ctime32_s _ctime64 _ctime64_s _cwait _d_int _dclass _dexp _difftime32 _difftime64 _dlog _dnorm _dpcomp _dpoly _dscale _dsign _dsin _dtest _dunscale _dup _dup2 _dupenv_s _ecvt _ecvt_s _endthread _endthreadex _eof _errno _except1 _execl _execle _execlp _execlpe _execute_onexit_table _execv _execve _execvp _execvpe _exit _expand _fclose_nolock _fcloseall _fcvt _fcvt_s _fd_int _fdclass _fdexp _fdlog _fdnorm _fdopen _fdpcomp _fdpoly _fdscale _fdsign _fdsin _fdtest _fdunscale _fflush_nolock _fgetc_nolock _fgetchar _fgetwc_nolock _fgetwchar _filelength _filelengthi64 _fileno _findclose _findfirst32 _findfirst32i64 _findfirst64 _findfirst64i32 _findnext32 _findnext32i64 _findnext64 _findnext64i32 _finite _finitef _flushall _fpclass _fpclassf _fpieee_flt _fpreset _fputc_nolock _fputchar _fputwc_nolock _fputwchar _fread_nolock _fread_nolock_s _free_base _free_locale _fseek_nolock _fseeki64 _fseeki64_nolock _fsopen _fstat32 _fstat32i64 _fstat64 _fstat64i32 _ftell_nolock _ftelli64 _ftelli64_nolock _ftime32 _ftime32_s _ftime64 _ftime64_s _fullpath _futime32 _futime64 _fwrite_nolock _gcvt _gcvt_s _get_FMA3_enable _get_current_locale _get_daylight _get_doserrno _get_dstbias _get_errno _get_fmode _get_heap_handle _get_initial_narrow_environment _get_initial_wide_environment _get_invalid_parameter_handler _get_narrow_winmain_command_line _get_osfhandle _get_pgmptr _get_printf_count_output _get_purecall_handler _get_stream_buffer_pointers _get_terminate _get_thread_local_invalid_parameter_handler _get_timezone _get_tzname _get_unexpected _get_wide_winmain_command_line _get_wpgmptr _getc_nolock _getch _getch_nolock _getche _getche_nolock _getcwd _getdcwd _getdiskfree _getdllprocaddr _getdrive _getdrives _getmaxstdio _getmbcp _getpid _getsystime _getw _getwc_nolock _getwch _getwch_nolock _getwche _getwche_nolock _getws _getws_s _gmtime32 _gmtime32_s _gmtime64 _gmtime64_s _heapchk _heapmin _heapwalk _hypot _hypotf _i64toa _i64toa_s _i64tow _i64tow_s _initialize_narrow_environment _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _invalid_parameter_noinfo _invalid_parameter_noinfo_noreturn _invoke_watson _is_exception_typeof _isalnum_l _isalpha_l _isatty _isblank_l _iscntrl_l _isctype _isctype_l _isdigit_l _isgraph_l _isleadbyte_l _islower_l _ismbbalnum _ismbbalnum_l _ismbbalpha _ismbbalpha_l _ismbbblank _ismbbblank_l _ismbbgraph _ismbbgraph_l _ismbbkalnum _ismbbkalnum_l _ismbbkana _ismbbkana_l _ismbbkprint _ismbbkprint_l _ismbbkpunct _ismbbkpunct_l _ismbblead _ismbblead_l _ismbbprint _ismbbprint_l _ismbbpunct _ismbbpunct_l _ismbbtrail _ismbbtrail_l _ismbcalnum _ismbcalnum_l _ismbcalpha _ismbcalpha_l _ismbcblank _ismbcblank_l _ismbcdigit _ismbcdigit_l _ismbcgraph _ismbcgraph_l _ismbchira _ismbchira_l _ismbckata _ismbckata_l _ismbcl0 _ismbcl0_l _ismbcl1 _ismbcl1_l _ismbcl2 _ismbcl2_l _ismbclegal _ismbclegal_l _ismbclower _ismbclower_l _ismbcprint _ismbcprint_l _ismbcpunct _ismbcpunct_l _ismbcspace _ismbcspace_l _ismbcsymbol _ismbcsymbol_l _ismbcupper _ismbcupper_l _ismbslead _ismbslead_l _ismbstrail _ismbstrail_l _isnan _isnanf _isprint_l _ispunct_l _isspace_l _isupper_l _iswalnum_l _iswalpha_l _iswblank_l _iswcntrl_l _iswcsym_l _iswcsymf_l _iswctype_l _iswdigit_l _iswgraph_l _iswlower_l _iswprint_l _iswpunct_l _iswspace_l _iswupper_l _iswxdigit_l _isxdigit_l _itoa _itoa_s _itow _itow_s _j0 _j1 _jn _kbhit _ld_int _ldclass _ldexp _ldlog _ldpcomp _ldpoly _ldscale _ldsign _ldsin _ldtest _ldunscale _lfind _lfind_s _loaddll _local_unwind _localtime32 _localtime32_s _localtime64 _localtime64_s _lock_file _lock_locales _locking _logb _logbf _lrotl _lrotr _lsearch _lsearch_s _lseek _lseeki64 _ltoa _ltoa_s _ltow _ltow_s _makepath _makepath_s _malloc_base _mbbtombc _mbbtombc_l _mbbtype _mbbtype_l _mbcasemap _mbccpy _mbccpy_l _mbccpy_s _mbccpy_s_l _mbcjistojms _mbcjistojms_l _mbcjmstojis _mbcjmstojis_l _mbclen _mbclen_l _mbctohira _mbctohira_l _mbctokata _mbctokata_l _mbctolower _mbctolower_l _mbctombb _mbctombb_l _mbctoupper _mbctoupper_l _mblen_l _mbsbtype _mbsbtype_l _mbscat_s _mbscat_s_l _mbschr _mbschr_l _mbscmp _mbscmp_l _mbscoll _mbscoll_l _mbscpy_s _mbscpy_s_l _mbscspn _mbscspn_l _mbsdec _mbsdec_l _mbsdup _mbsicmp _mbsicmp_l _mbsicoll _mbsicoll_l _mbsinc _mbsinc_l _mbslen _mbslen_l _mbslwr _mbslwr_l _mbslwr_s _mbslwr_s_l _mbsnbcat _mbsnbcat_l _mbsnbcat_s _mbsnbcat_s_l _mbsnbcmp _mbsnbcmp_l _mbsnbcnt _mbsnbcnt_l _mbsnbcoll _mbsnbcoll_l _mbsnbcpy _mbsnbcpy_l _mbsnbcpy_s _mbsnbcpy_s_l _mbsnbicmp _mbsnbicmp_l _mbsnbicoll _mbsnbicoll_l _mbsnbset _mbsnbset_l _mbsnbset_s _mbsnbset_s_l _mbsncat _mbsncat_l _mbsncat_s _mbsncat_s_l _mbsnccnt _mbsnccnt_l _mbsncmp _mbsncmp_l _mbsncoll _mbsncoll_l _mbsncpy _mbsncpy_l _mbsncpy_s _mbsncpy_s_l _mbsnextc _mbsnextc_l _mbsnicmp _mbsnicmp_l _mbsnicoll _mbsnicoll_l _mbsninc _mbsninc_l _mbsnlen _mbsnlen_l _mbsnset _mbsnset_l _mbsnset_s _mbsnset_s_l _mbspbrk _mbspbrk_l _mbsrchr _mbsrchr_l _mbsrev _mbsrev_l _mbsset _mbsset_l _mbsset_s _mbsset_s_l _mbsspn _mbsspn_l _mbsspnp _mbsspnp_l _mbsstr _mbsstr_l _mbstok _mbstok_l _mbstok_s _mbstok_s_l _mbstowcs_l _mbstowcs_s_l _mbstrlen _mbstrlen_l _mbstrnlen _mbstrnlen_l _mbsupr _mbsupr_l _mbsupr_s _mbsupr_s_l _mbtowc_l _memccpy _memicmp _memicmp_l _mkdir _mkgmtime32 _mkgmtime64 _mktemp _mktemp_s _mktime32 _mktime64 _msize _nextafter _nextafterf _o__Getdays _o__Getmonths _o__Gettnames _o__Strftime _o__W_Getdays _o__W_Getmonths _o__W_Gettnames _o__Wcsftime _o____lc_codepage_func _o____lc_collate_cp_func _o____lc_locale_name_func _o____mb_cur_max_func _o___acrt_iob_func _o___conio_common_vcprintf _o___conio_common_vcprintf_p _o___conio_common_vcprintf_s _o___conio_common_vcscanf _o___conio_common_vcwprintf _o___conio_common_vcwprintf_p _o___conio_common_vcwprintf_s _o___conio_common_vcwscanf _o___daylight _o___dstbias _o___fpe_flt_rounds _o___p___argc _o___p___argv _o___p___wargv _o___p__acmdln _o___p__commode _o___p__environ _o___p__fmode _o___p__mbcasemap _o___p__mbctype _o___p__pgmptr _o___p__wcmdln _o___p__wenviron _o___p__wpgmptr _o___pctype_func _o___pwctype_func _o___std_exception_copy _o___std_exception_destroy _o___std_type_info_destroy_list _o___std_type_info_name _o___stdio_common_vfprintf _o___stdio_common_vfprintf_p _o___stdio_common_vfprintf_s _o___stdio_common_vfscanf _o___stdio_common_vfwprintf _o___stdio_common_vfwprintf_p _o___stdio_common_vfwprintf_s _o___stdio_common_vfwscanf _o___stdio_common_vsnprintf_s _o___stdio_common_vsnwprintf_s _o___stdio_common_vsprintf _o___stdio_common_vsprintf_p _o___stdio_common_vsprintf_s _o___stdio_common_vsscanf _o___stdio_common_vswprintf _o___stdio_common_vswprintf_p _o___stdio_common_vswprintf_s _o___stdio_common_vswscanf _o___timezone _o___tzname _o___wcserror _o__access _o__access_s _o__aligned_free _o__aligned_malloc _o__aligned_msize _o__aligned_offset_malloc _o__aligned_offset_realloc _o__aligned_offset_recalloc _o__aligned_realloc _o__aligned_recalloc _o__atodbl _o__atodbl_l _o__atof_l _o__atoflt _o__atoflt_l _o__atoi64 _o__atoi64_l _o__atoi_l _o__atol_l _o__atoldbl _o__atoldbl_l _o__atoll_l _o__beep _o__beginthread _o__beginthreadex _o__cabs _o__callnewh _o__calloc_base _o__cexit _o__cgets _o__cgets_s _o__cgetws _o__cgetws_s _o__chdir _o__chdrive _o__chmod _o__chsize _o__chsize_s _o__close _o__commit _o__configthreadlocale _o__configure_narrow_argv _o__configure_wide_argv _o__controlfp_s _o__cputs _o__cputws _o__creat _o__create_locale _o__crt_atexit _o__ctime32_s _o__ctime64_s _o__cwait _o__d_int _o__dclass _o__difftime32 _o__difftime64 _o__dlog _o__dnorm _o__dpcomp _o__dpoly _o__dscale _o__dsign _o__dsin _o__dtest _o__dunscale _o__dup _o__dup2 _o__dupenv_s _o__ecvt _o__ecvt_s _o__endthread _o__endthreadex _o__eof _o__errno _o__except1 _o__execute_onexit_table _o__execv _o__execve _o__execvp _o__execvpe _o__exit _o__expand _o__fclose_nolock _o__fcloseall _o__fcvt _o__fcvt_s _o__fd_int _o__fdclass _o__fdexp _o__fdlog _o__fdopen _o__fdpcomp _o__fdpoly _o__fdscale _o__fdsign _o__fdsin _o__fflush_nolock _o__fgetc_nolock _o__fgetchar _o__fgetwc_nolock _o__fgetwchar _o__filelength _o__filelengthi64 _o__fileno _o__findclose _o__findfirst32 _o__findfirst32i64 _o__findfirst64 _o__findfirst64i32 _o__findnext32 _o__findnext32i64 _o__findnext64 _o__findnext64i32 _o__flushall _o__fpclass _o__fpclassf _o__fputc_nolock _o__fputchar _o__fputwc_nolock _o__fputwchar _o__fread_nolock _o__fread_nolock_s _o__free_base _o__free_locale _o__fseek_nolock _o__fseeki64 _o__fseeki64_nolock _o__fsopen _o__fstat32 _o__fstat32i64 _o__fstat64 _o__fstat64i32 _o__ftell_nolock _o__ftelli64 _o__ftelli64_nolock _o__ftime32 _o__ftime32_s _o__ftime64 _o__ftime64_s _o__fullpath _o__futime32 _o__futime64 _o__fwrite_nolock _o__gcvt _o__gcvt_s _o__get_daylight _o__get_doserrno _o__get_dstbias _o__get_errno _o__get_fmode _o__get_heap_handle _o__get_initial_narrow_environment _o__get_initial_wide_environment _o__get_invalid_parameter_handler _o__get_narrow_winmain_command_line _o__get_osfhandle _o__get_pgmptr _o__get_stream_buffer_pointers _o__get_terminate _o__get_thread_local_invalid_parameter_handler _o__get_timezone _o__get_tzname _o__get_wide_winmain_command_line _o__get_wpgmptr _o__getc_nolock _o__getch _o__getch_nolock _o__getche _o__getche_nolock _o__getcwd _o__getdcwd _o__getdiskfree _o__getdllprocaddr _o__getdrive _o__getdrives _o__getmbcp _o__getsystime _o__getw _o__getwc_nolock _o__getwch _o__getwch_nolock _o__getwche _o__getwche_nolock _o__getws _o__getws_s _o__gmtime32 _o__gmtime32_s _o__gmtime64 _o__gmtime64_s _o__heapchk _o__heapmin _o__hypot _o__hypotf _o__i64toa _o__i64toa_s _o__i64tow _o__i64tow_s _o__initialize_narrow_environment _o__initialize_onexit_table _o__initialize_wide_environment _o__invalid_parameter_noinfo _o__invalid_parameter_noinfo_noreturn _o__isatty _o__isctype _o__isctype_l _o__isleadbyte_l _o__ismbbalnum _o__ismbbalnum_l _o__ismbbalpha _o__ismbbalpha_l _o__ismbbblank _o__ismbbblank_l _o__ismbbgraph _o__ismbbgraph_l _o__ismbbkalnum _o__ismbbkalnum_l _o__ismbbkana _o__ismbbkana_l _o__ismbbkprint _o__ismbbkprint_l _o__ismbbkpunct _o__ismbbkpunct_l _o__ismbblead _o__ismbblead_l _o__ismbbprint _o__ismbbprint_l _o__ismbbpunct _o__ismbbpunct_l _o__ismbbtrail _o__ismbbtrail_l _o__ismbcalnum _o__ismbcalnum_l _o__ismbcalpha _o__ismbcalpha_l _o__ismbcblank _o__ismbcblank_l _o__ismbcdigit _o__ismbcdigit_l _o__ismbcgraph _o__ismbcgraph_l _o__ismbchira _o__ismbchira_l _o__ismbckata _o__ismbckata_l _o__ismbcl0 _o__ismbcl0_l _o__ismbcl1 _o__ismbcl1_l _o__ismbcl2 _o__ismbcl2_l _o__ismbclegal _o__ismbclegal_l _o__ismbclower _o__ismbclower_l _o__ismbcprint _o__ismbcprint_l _o__ismbcpunct _o__ismbcpunct_l _o__ismbcspace _o__ismbcspace_l _o__ismbcsymbol _o__ismbcsymbol_l _o__ismbcupper _o__ismbcupper_l _o__ismbslead _o__ismbslead_l _o__ismbstrail _o__ismbstrail_l _o__iswctype_l _o__itoa _o__itoa_s _o__itow _o__itow_s _o__j0 _o__j1 _o__jn _o__kbhit _o__ld_int _o__ldclass _o__ldexp _o__ldlog _o__ldpcomp _o__ldpoly _o__ldscale _o__ldsign _o__ldsin _o__ldtest _o__ldunscale _o__lfind _o__lfind_s _o__loaddll _o__localtime32 _o__localtime32_s _o__localtime64 _o__localtime64_s _o__lock_file _o__locking _o__logb _o__logbf _o__lsearch _o__lsearch_s _o__lseek _o__lseeki64 _o__ltoa _o__ltoa_s _o__ltow _o__ltow_s _o__makepath _o__makepath_s _o__malloc_base _o__mbbtombc _o__mbbtombc_l _o__mbbtype _o__mbbtype_l _o__mbccpy _o__mbccpy_l _o__mbccpy_s _o__mbccpy_s_l _o__mbcjistojms _o__mbcjistojms_l _o__mbcjmstojis _o__mbcjmstojis_l _o__mbclen _o__mbclen_l _o__mbctohira _o__mbctohira_l _o__mbctokata _o__mbctokata_l _o__mbctolower _o__mbctolower_l _o__mbctombb _o__mbctombb_l _o__mbctoupper _o__mbctoupper_l _o__mblen_l _o__mbsbtype _o__mbsbtype_l _o__mbscat_s _o__mbscat_s_l _o__mbschr _o__mbschr_l _o__mbscmp _o__mbscmp_l _o__mbscoll _o__mbscoll_l _o__mbscpy_s _o__mbscpy_s_l _o__mbscspn _o__mbscspn_l _o__mbsdec _o__mbsdec_l _o__mbsicmp _o__mbsicmp_l _o__mbsicoll _o__mbsicoll_l _o__mbsinc _o__mbsinc_l _o__mbslen _o__mbslen_l _o__mbslwr _o__mbslwr_l _o__mbslwr_s _o__mbslwr_s_l _o__mbsnbcat _o__mbsnbcat_l _o__mbsnbcat_s _o__mbsnbcat_s_l _o__mbsnbcmp _o__mbsnbcmp_l _o__mbsnbcnt _o__mbsnbcnt_l _o__mbsnbcoll _o__mbsnbcoll_l _o__mbsnbcpy _o__mbsnbcpy_l _o__mbsnbcpy_s _o__mbsnbcpy_s_l _o__mbsnbicmp _o__mbsnbicmp_l _o__mbsnbicoll _o__mbsnbicoll_l _o__mbsnbset _o__mbsnbset_l _o__mbsnbset_s _o__mbsnbset_s_l _o__mbsncat _o__mbsncat_l _o__mbsncat_s _o__mbsncat_s_l _o__mbsnccnt _o__mbsnccnt_l _o__mbsncmp _o__mbsncmp_l _o__mbsncoll _o__mbsncoll_l _o__mbsncpy _o__mbsncpy_l _o__mbsncpy_s _o__mbsncpy_s_l _o__mbsnextc _o__mbsnextc_l _o__mbsnicmp _o__mbsnicmp_l _o__mbsnicoll _o__mbsnicoll_l _o__mbsninc _o__mbsninc_l _o__mbsnlen _o__mbsnlen_l _o__mbsnset _o__mbsnset_l _o__mbsnset_s _o__mbsnset_s_l _o__mbspbrk _o__mbspbrk_l _o__mbsrchr _o__mbsrchr_l _o__mbsrev _o__mbsrev_l _o__mbsset _o__mbsset_l _o__mbsset_s _o__mbsset_s_l _o__mbsspn _o__mbsspn_l _o__mbsspnp _o__mbsspnp_l _o__mbsstr _o__mbsstr_l _o__mbstok _o__mbstok_l _o__mbstok_s _o__mbstok_s_l _o__mbstowcs_l _o__mbstowcs_s_l _o__mbstrlen _o__mbstrlen_l _o__mbstrnlen _o__mbstrnlen_l _o__mbsupr _o__mbsupr_l _o__mbsupr_s _o__mbsupr_s_l _o__mbtowc_l _o__memicmp _o__memicmp_l _o__mkdir _o__mkgmtime32 _o__mkgmtime64 _o__mktemp _o__mktemp_s _o__mktime32 _o__mktime64 _o__msize _o__nextafter _o__nextafterf _o__open_osfhandle _o__pclose _o__pipe _o__popen _o__purecall _o__putc_nolock _o__putch _o__putch_nolock _o__putenv _o__putenv_s _o__putw _o__putwc_nolock _o__putwch _o__putwch_nolock _o__putws _o__read _o__realloc_base _o__recalloc _o__register_onexit_function _o__resetstkoflw _o__rmdir _o__rmtmp _o__scalb _o__scalbf _o__searchenv _o__searchenv_s _o__seh_filter_dll _o__seh_filter_exe _o__set_abort_behavior _o__set_app_type _o__set_doserrno _o__set_errno _o__set_fmode _o__set_invalid_parameter_handler _o__set_new_handler _o__set_new_mode _o__set_thread_local_invalid_parameter_handler _o__seterrormode _o__setmbcp _o__setmode _o__setsystime _o__sleep _o__sopen _o__sopen_dispatch _o__sopen_s _o__spawnv _o__spawnve _o__spawnvp _o__spawnvpe _o__splitpath _o__splitpath_s _o__stat32 _o__stat32i64 _o__stat64 _o__stat64i32 _o__strcoll_l _o__strdate _o__strdate_s _o__strdup _o__strerror _o__strerror_s _o__strftime_l _o__stricmp _o__stricmp_l _o__stricoll _o__stricoll_l _o__strlwr _o__strlwr_l _o__strlwr_s _o__strlwr_s_l _o__strncoll _o__strncoll_l _o__strnicmp _o__strnicmp_l _o__strnicoll _o__strnicoll_l _o__strnset_s _o__strset_s _o__strtime _o__strtime_s _o__strtod_l _o__strtof_l _o__strtoi64 _o__strtoi64_l _o__strtol_l _o__strtold_l _o__strtoll_l _o__strtoui64 _o__strtoui64_l _o__strtoul_l _o__strtoull_l _o__strupr _o__strupr_l _o__strupr_s _o__strupr_s_l _o__strxfrm_l _o__swab _o__tell _o__telli64 _o__timespec32_get _o__timespec64_get _o__tolower _o__tolower_l _o__toupper _o__toupper_l _o__towlower_l _o__towupper_l _o__tzset _o__ui64toa _o__ui64toa_s _o__ui64tow _o__ui64tow_s _o__ultoa _o__ultoa_s _o__ultow _o__ultow_s _o__umask _o__umask_s _o__ungetc_nolock _o__ungetch _o__ungetch_nolock _o__ungetwc_nolock _o__ungetwch _o__ungetwch_nolock _o__unlink _o__unloaddll _o__unlock_file _o__utime32 _o__utime64 _o__waccess _o__waccess_s _o__wasctime _o__wasctime_s _o__wchdir _o__wchmod _o__wcreat _o__wcreate_locale _o__wcscoll_l _o__wcsdup _o__wcserror _o__wcserror_s _o__wcsftime_l _o__wcsicmp _o__wcsicmp_l _o__wcsicoll _o__wcsicoll_l _o__wcslwr _o__wcslwr_l _o__wcslwr_s _o__wcslwr_s_l _o__wcsncoll _o__wcsncoll_l _o__wcsnicmp _o__wcsnicmp_l _o__wcsnicoll _o__wcsnicoll_l _o__wcsnset _o__wcsnset_s _o__wcsset _o__wcsset_s _o__wcstod_l _o__wcstof_l _o__wcstoi64 _o__wcstoi64_l _o__wcstol_l _o__wcstold_l _o__wcstoll_l _o__wcstombs_l _o__wcstombs_s_l _o__wcstoui64 _o__wcstoui64_l _o__wcstoul_l _o__wcstoull_l _o__wcsupr _o__wcsupr_l _o__wcsupr_s _o__wcsupr_s_l _o__wcsxfrm_l _o__wctime32 _o__wctime32_s _o__wctime64 _o__wctime64_s _o__wctomb_l _o__wctomb_s_l _o__wdupenv_s _o__wexecv _o__wexecve _o__wexecvp _o__wexecvpe _o__wfdopen _o__wfindfirst32 _o__wfindfirst32i64 _o__wfindfirst64 _o__wfindfirst64i32 _o__wfindnext32 _o__wfindnext32i64 _o__wfindnext64 _o__wfindnext64i32 _o__wfopen _o__wfopen_s _o__wfreopen _o__wfreopen_s _o__wfsopen _o__wfullpath _o__wgetcwd _o__wgetdcwd _o__wgetenv _o__wgetenv_s _o__wmakepath _o__wmakepath_s _o__wmkdir _o__wmktemp _o__wmktemp_s _o__wperror _o__wpopen _o__wputenv _o__wputenv_s _o__wremove _o__wrename _o__write _o__wrmdir _o__wsearchenv _o__wsearchenv_s _o__wsetlocale _o__wsopen_dispatch _o__wsopen_s _o__wspawnv _o__wspawnve _o__wspawnvp _o__wspawnvpe _o__wsplitpath _o__wsplitpath_s _o__wstat32 _o__wstat32i64 _o__wstat64 _o__wstat64i32 _o__wstrdate _o__wstrdate_s _o__wstrtime _o__wstrtime_s _o__wsystem _o__wtmpnam_s _o__wtof _o__wtof_l _o__wtoi _o__wtoi64 _o__wtoi64_l _o__wtoi_l _o__wtol _o__wtol_l _o__wtoll _o__wtoll_l _o__wunlink _o__wutime32 _o__wutime64 _o__y0 _o__y1 _o__yn _o_abort _o_acos _o_acosf _o_acosh _o_acoshf _o_acoshl _o_asctime _o_asctime_s _o_asin _o_asinf _o_asinh _o_asinhf _o_asinhl _o_atan _o_atan2 _o_atan2f _o_atanf _o_atanh _o_atanhf _o_atanhl _o_atof _o_atoi _o_atol _o_atoll _o_bsearch _o_bsearch_s _o_btowc _o_calloc _o_cbrt _o_cbrtf _o_ceil _o_ceilf _o_clearerr _o_clearerr_s _o_cos _o_cosf _o_cosh _o_coshf _o_erf _o_erfc _o_erfcf _o_erfcl _o_erff _o_erfl _o_exit _o_exp _o_exp2 _o_exp2f _o_exp2l _o_expf _o_fabs _o_fclose _o_feof _o_ferror _o_fflush _o_fgetc _o_fgetpos _o_fgets _o_fgetwc _o_fgetws _o_floor _o_floorf _o_fma _o_fmaf _o_fmal _o_fmod _o_fmodf _o_fopen _o_fopen_s _o_fputc _o_fputs _o_fputwc _o_fputws _o_fread _o_fread_s _o_free _o_freopen _o_freopen_s _o_frexp _o_fseek _o_fsetpos _o_ftell _o_fwrite _o_getc _o_getchar _o_getenv _o_getenv_s _o_gets _o_gets_s _o_getwc _o_getwchar _o_hypot _o_is_wctype _o_isalnum _o_isalpha _o_isblank _o_iscntrl _o_isdigit _o_isgraph _o_isleadbyte _o_islower _o_isprint _o_ispunct _o_isspace _o_isupper _o_iswalnum _o_iswalpha _o_iswascii _o_iswblank _o_iswcntrl _o_iswctype _o_iswdigit _o_iswgraph _o_iswlower _o_iswprint _o_iswpunct _o_iswspace _o_iswupper _o_iswxdigit _o_isxdigit _o_ldexp _o_lgamma _o_lgammaf _o_lgammal _o_llrint _o_llrintf _o_llrintl _o_llround _o_llroundf _o_llroundl _o_localeconv _o_log _o_log10 _o_log10f _o_log1p _o_log1pf _o_log1pl _o_log2 _o_log2f _o_log2l _o_logb _o_logbf _o_logbl _o_logf _o_lrint _o_lrintf _o_lrintl _o_lround _o_lroundf _o_lroundl _o_malloc _o_mblen _o_mbrlen _o_mbrtoc16 _o_mbrtoc32 _o_mbrtowc _o_mbsrtowcs _o_mbsrtowcs_s _o_mbstowcs _o_mbstowcs_s _o_mbtowc _o_memcpy_s _o_memset _o_modf _o_modff _o_nan _o_nanf _o_nanl _o_nearbyint _o_nearbyintf _o_nearbyintl _o_nextafter _o_nextafterf _o_nextafterl _o_nexttoward _o_nexttowardf _o_nexttowardl _o_pow _o_powf _o_putc _o_putchar _o_puts _o_putwc _o_putwchar _o_qsort _o_qsort_s _o_raise _o_rand _o_rand_s _o_realloc _o_remainder _o_remainderf _o_remainderl _o_remove _o_remquo _o_remquof _o_remquol _o_rename _o_rewind _o_rint _o_rintf _o_rintl _o_round _o_roundf _o_roundl _o_scalbln _o_scalblnf _o_scalblnl _o_scalbn _o_scalbnf _o_scalbnl _o_set_terminate _o_setbuf _o_setlocale _o_setvbuf _o_sin _o_sinf _o_sinh _o_sinhf _o_sqrt _o_sqrtf _o_srand _o_strcat_s _o_strcoll _o_strcpy_s _o_strerror _o_strerror_s _o_strftime _o_strncat_s _o_strncpy_s _o_strtod _o_strtof _o_strtok _o_strtok_s _o_strtol _o_strtold _o_strtoll _o_strtoul _o_strtoull _o_system _o_tan _o_tanf _o_tanh _o_tanhf _o_terminate _o_tgamma _o_tgammaf _o_tgammal _o_tmpfile_s _o_tmpnam_s _o_tolower _o_toupper _o_towlower _o_towupper _o_ungetc _o_ungetwc _o_wcrtomb _o_wcrtomb_s _o_wcscat_s _o_wcscoll _o_wcscpy _o_wcscpy_s _o_wcsftime _o_wcsncat_s _o_wcsncpy_s _o_wcsrtombs _o_wcsrtombs_s _o_wcstod _o_wcstof _o_wcstok _o_wcstok_s _o_wcstol _o_wcstold _o_wcstoll _o_wcstombs _o_wcstombs_s _o_wcstoul _o_wcstoull _o_wctob _o_wctomb _o_wctomb_s _o_wmemcpy_s _o_wmemmove_s _open _open_osfhandle _pclose _pipe _popen _purecall _putc_nolock _putch _putch_nolock _putenv _putenv_s _putw _putwc_nolock _putwch _putwch_nolock _putws _query_app_type _query_new_handler _query_new_mode _read _realloc_base _recalloc _register_onexit_function _register_thread_local_exe_atexit_callback _resetstkoflw _rmdir _rmtmp _rotl _rotl64 _rotr _rotr64 _scalb _scalbf _searchenv _searchenv_s _seh_filter_dll _seh_filter_exe _set_FMA3_enable _set_abort_behavior _set_app_type _set_controlfp _set_doserrno _set_errno _set_error_mode _set_fmode _set_invalid_parameter_handler _set_new_handler _set_new_mode _set_printf_count_output _set_purecall_handler _set_se_translator _set_thread_local_invalid_parameter_handler _seterrormode _setmaxstdio _setmbcp _setmode _setsystime _sleep _sopen _sopen_dispatch _sopen_s _spawnl _spawnle _spawnlp _spawnlpe _spawnv _spawnve _spawnvp _spawnvpe _splitpath _splitpath_s _stat32 _stat32i64 _stat64 _stat64i32 _statusfp _strcoll_l _strdate _strdate_s _strdup _strerror _strerror_s _strftime_l _stricmp _stricmp_l _stricoll _stricoll_l _strlwr _strlwr_l _strlwr_s _strlwr_s_l _strncoll _strncoll_l _strnicmp _strnicmp_l _strnicoll _strnicoll_l _strnset _strnset_s _strrev _strset _strset_s _strtime _strtime_s _strtod_l _strtof_l _strtoi64 _strtoi64_l _strtoimax_l _strtol_l _strtold_l _strtoll_l _strtoui64 _strtoui64_l _strtoul_l _strtoull_l _strtoumax_l _strupr _strupr_l _strupr_s _strupr_s_l _strxfrm_l _swab _tell _telli64 _tempnam _time32 _time64 _timespec32_get _timespec64_get _tolower _tolower_l _toupper _toupper_l _towlower_l _towupper_l _tzset _ui64toa _ui64toa_s _ui64tow _ui64tow_s _ultoa _ultoa_s _ultow _ultow_s _umask _umask_s _ungetc_nolock _ungetch _ungetch_nolock _ungetwc_nolock _ungetwch _ungetwch_nolock _unlink _unloaddll _unlock_file _unlock_locales _utime32 _utime64 _waccess _waccess_s _wasctime _wasctime_s _wassert _wchdir _wchmod _wcreat _wcreate_locale _wcscoll_l _wcsdup _wcserror _wcserror_s _wcsftime_l _wcsicmp _wcsicmp_l _wcsicoll _wcsicoll_l _wcslwr _wcslwr_l _wcslwr_s _wcslwr_s_l _wcsncoll _wcsncoll_l _wcsnicmp _wcsnicmp_l _wcsnicoll _wcsnicoll_l _wcsnset _wcsnset_s _wcsrev _wcsset _wcsset_s _wcstod_l _wcstof_l _wcstoi64 _wcstoi64_l _wcstoimax_l _wcstol_l _wcstold_l _wcstoll_l _wcstombs_l _wcstombs_s_l _wcstoui64 _wcstoui64_l _wcstoul_l _wcstoull_l _wcstoumax_l _wcsupr _wcsupr_l _wcsupr_s _wcsupr_s_l _wcsxfrm_l _wctime32 _wctime32_s _wctime64 _wctime64_s _wctomb_l _wctomb_s_l _wctype _wdupenv_s _wexecl _wexecle _wexeclp _wexeclpe _wexecv _wexecve _wexecvp _wexecvpe _wfdopen _wfindfirst32 _wfindfirst32i64 _wfindfirst64 _wfindfirst64i32 _wfindnext32 _wfindnext32i64 _wfindnext64 _wfindnext64i32 _wfopen _wfopen_s _wfreopen _wfreopen_s _wfsopen _wfullpath _wgetcwd _wgetdcwd _wgetenv _wgetenv_s _wmakepath _wmakepath_s _wmkdir _wmktemp _wmktemp_s _wopen _wperror _wpopen _wputenv _wputenv_s _wremove _wrename _write _wrmdir _wsearchenv _wsearchenv_s _wsetlocale _wsopen _wsopen_dispatch _wsopen_s _wspawnl _wspawnle _wspawnlp _wspawnlpe _wspawnv _wspawnve _wspawnvp _wspawnvpe _wsplitpath _wsplitpath_s _wstat32 _wstat32i64 _wstat64 _wstat64i32 _wstrdate _wstrdate_s _wstrtime _wstrtime_s _wsystem _wtempnam _wtmpnam _wtmpnam_s _wtof _wtof_l _wtoi _wtoi64 _wtoi64_l _wtoi_l _wtol _wtol_l _wtoll _wtoll_l _wunlink _wutime32 _wutime64 _y0 _y1 _yn abort abs acos acosf acosh acoshf acoshl asctime asctime_s asin asinf asinh asinhf asinhl atan atan2 atan2f atanf atanh atanhf atanhl atof atoi atol atoll bsearch bsearch_s btowc c16rtomb c32rtomb cabs cabsf cabsl cacos cacosf cacosh cacoshf cacoshl cacosl calloc carg cargf cargl casin casinf casinh casinhf casinhl casinl catan catanf catanh catanhf catanhl catanl cbrt cbrtf cbrtl ccos ccosf ccosh ccoshf ccoshl ccosl ceil ceilf cexp cexpf cexpl cimag cimagf cimagl clearerr clearerr_s clock clog clog10 clog10f clog10l clogf clogl conj conjf conjl copysign copysignf copysignl cos cosf cosh coshf cpow cpowf cpowl cproj cprojf cprojl creal crealf creall csin csinf csinh csinhf csinhl csinl csqrt csqrtf csqrtl ctan ctanf ctanh ctanhf ctanhl ctanl div erf erfc erfcf erfcl erff erfl exit exp exp2 exp2f exp2l expf expm1 expm1f expm1l fabs fclose fdim fdimf fdiml feclearexcept fegetenv fegetexceptflag fegetround feholdexcept feof ferror fesetenv fesetexceptflag fesetround fetestexcept fflush fgetc fgetpos fgets fgetwc fgetws floor floorf fma fmaf fmal fmax fmaxf fmaxl fmin fminf fminl fmod fmodf fopen fopen_s fputc fputs fputwc fputws fread fread_s free freopen freopen_s frexp fseek fsetpos ftell fwrite getc getchar getenv getenv_s gets gets_s getwc getwchar hypot ilogb ilogbf ilogbl imaxabs imaxdiv is_wctype isalnum isalpha isblank iscntrl isdigit isgraph isleadbyte islower isprint ispunct isspace isupper iswalnum iswalpha iswascii iswblank iswcntrl iswctype iswdigit iswgraph iswlower iswprint iswpunct iswspace iswupper iswxdigit isxdigit labs ldexp ldiv lgamma lgammaf lgammal llabs lldiv llrint llrintf llrintl llround llroundf llroundl localeconv log log10 log10f log1p log1pf log1pl log2 log2f log2l logb logbf logbl logf longjmp lrint lrintf lrintl lround lroundf lroundl malloc mblen mbrlen mbrtoc16 mbrtoc32 mbrtowc mbsrtowcs mbsrtowcs_s mbstowcs mbstowcs_s mbtowc memchr memcmp memcpy memcpy_s memmove memmove_s memset modf modff nan nanf nanl nearbyint nearbyintf nearbyintl nextafter nextafterf nextafterl nexttoward nexttowardf nexttowardl norm normf norml perror pow powf putc putchar puts putwc putwchar qsort qsort_s quick_exit raise rand rand_s realloc remainder remainderf remainderl remove remquo remquof remquol rename rewind rint rintf rintl round roundf roundl scalbln scalblnf scalblnl scalbn scalbnf scalbnl set_terminate set_unexpected setbuf setjmp setlocale setvbuf signal sin sinf sinh sinhf sqrt sqrtf srand strcat strcat_s strchr strcmp strcoll strcpy strcpy_s strcspn strerror strerror_s strftime strlen strncat strncat_s strncmp strncpy strncpy_s strnlen strpbrk strrchr strspn strstr strtod strtof strtoimax strtok strtok_s strtol strtold strtoll strtoul strtoull strtoumax strxfrm system tan tanf tanh tanhf terminate tgamma tgammaf tgammal tmpfile tmpfile_s tmpnam tmpnam_s tolower toupper towctrans towlower towupper trunc truncf truncl unexpected ungetc ungetwc wcrtomb wcrtomb_s wcscat wcscat_s wcschr wcscmp wcscoll wcscpy wcscpy_s wcscspn wcsftime wcslen wcsncat wcsncat_s wcsncmp wcsncpy wcsncpy_s wcsnlen wcspbrk wcsrchr wcsrtombs wcsrtombs_s wcsspn wcsstr wcstod wcstof wcstoimax wcstok wcstok_s wcstol wcstold wcstoll wcstombs wcstombs_s wcstoul wcstoull wcstoumax wcsxfrm wctob wctomb wctomb_s wctrans wctype wmemcpy_s wmemmove_s

vccorlib140.dll

IMPHASH 4b8a73c69b5df9623905e0e06e504347
SHA256 9ab7fae1a185ce1735b52f846d02773b27cde346cabfde71a8041de118751891
MD5 b1d457528e65fd7ea57e380e37095827
SHA1 d6f019c9ac3595008db46fe80596407f952fff5a
SHA512 5f769d19642a937f6ef554c38cf75ded01ca16a8d3aa2a08b3f186faac315af2137f1976edea216b678b94bf05e924834bfdc18f8cc30c7c398e89a2c7c49b52
SSDEEP 6144:hpVeNd1C++IAU1qsxEW5QcT2Xgs4hiWi/GDhmVejWXaV+GpfOqmIzt/mtBag2M0D:hp0+Xgs4hiWi/GDhmVejWXabO/Izgt/U
TLSH
T18274E4277A9C4CC3CD31A0794E97830AE372695207A0D3CB0691970E5F7B7E8AD3B665
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

167296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\binaries\amd64ret\bin\amd64\vccorlib140.amd64.pdb

kernel32

RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockShared FormatMessageW GetProcAddress LoadLibraryExW HeapFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx GetLastError OutputDebugStringW HeapAlloc DeleteCriticalSection GetProcessHeap CreateEventExW WaitForMultipleObjectsEx SetEvent CloseHandle DecodePointer InitializeSRWLock TryAcquireSRWLockShared RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime DisableThreadLibraryCalls InitializeSListHead

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove __std_type_info_destroy_list memcpy memcmp _purecall memset _CxxThrowException __C_specific_handler __current_exception_context __current_exception _SetWinRTOutOfMemoryExceptionCallback __GetPlatformExceptionInfo __std_exception_copy __std_exception_destroy __std_terminate

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vswprintf_s __stdio_common_vfprintf

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_onexit_function _execute_onexit_table _invoke_watson __p___wargv __p___argc _configure_wide_argv terminate _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _cexit _initterm_e _initterm _initialize_onexit_table

api-ms-win-crt-heap-l1-1-0

free _aligned_offset_malloc _aligned_free malloc _callnewh

api-ms-win-crt-string-l1-1-0

wcscpy_s

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

ole32

CoTaskMemFree CoGetContextToken CoAddRefServerProcess CoReleaseServerProcess CoTaskMemAlloc CoCreateFreeThreadedMarshaler CoGetApartmentType CoMarshalInterThreadInterfaceInStream CoGetInterfaceAndReleaseStream CoGetObjectContext

oleaut32

SysFreeString SysAllocStringLen

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference WindowsIsStringEmpty WindowsGetStringRawBuffer WindowsGetStringLen WindowsCompareStringOrdinal WindowsStringHasEmbeddedNull WindowsCreateString WindowsDuplicateString WindowsDeleteString

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo SetRestrictedErrorInfo RoOriginateError RoTransformError

api-ms-win-core-winrt-l1-1-0

RoRegisterActivationFactories RoUninitialize RoInitialize RoUnregisterForApartmentShutdown RoGetActivationFactory RoRegisterForApartmentShutdown RoGetApartmentIdentifier RoRevokeActivationFactories

api-ms-win-crt-math-l1-1-0

ceilf

?<Dispose>@Exception@Platform@@UE$AAAXXZ ?<Dispose>@String@Platform@@UE$AAAXXZ ?<Dispose>@Type@Platform@@UE$AAAXXZ ??0AccessDeniedException@Platform@@QE$AAA@PE$AAVString@1@@Z ??0AccessDeniedException@Platform@@QE$AAA@XZ ??0Attribute@Metadata@Platform@@QE$AAA@XZ ??0Boolean@Platform@@QEAA@_N@Z ??0COMException@Platform@@QE$AAA@H@Z ??0COMException@Platform@@QE$AAA@HPE$AAVString@1@@Z ??0ChangedStateException@Platform@@QE$AAA@PE$AAVString@1@@Z ??0ChangedStateException@Platform@@QE$AAA@XZ ??0ClassNotRegisteredException@Platform@@QE$AAA@PE$AAVString@1@@Z ??0ClassNotRegisteredException@Platform@@QE$AAA@XZ ??0Delegate@Platform@@QE$AAA@XZ ??0DisconnectedException@Platform@@QE$AAA@PE$AAVString@1@@Z ??0DisconnectedException@Platform@@QE$AAA@XZ ??0Enum@Platform@@QE$AAA@XZ ??0Exception@Platform@@QE$AAA@H@Z ??0Exception@Platform@@QE$AAA@HPE$AAVString@1@@Z ??0FailureException@Platform@@QE$AAA@PE$AAVString@1@@Z ??0FailureException@Platform@@QE$AAA@XZ ??0GridLength@Xaml@UI@Windows@@QEAA@NW4GridUnitType@123@@Z ??0IntPtr@Platform@@QEAA@H@Z ??0IntPtr@Platform@@QEAA@PEAX@Z ??0InvalidArgumentException@Platform@@QE$AAA@PE$AAVString@1@@Z ??0InvalidArgumentException@Platform@@QE$AAA@XZ ??0InvalidCastException@Platform@@QE$AAA@PE$AAVString@1@@Z ??0InvalidCastException@Platform@@QE$AAA@XZ ??0MTAThreadAttribute@Platform@@QE$AAA@XZ ??0NotImplementedException@Platform@@QE$AAA@PE$AAVString@1@@Z ??0NotImplementedException@Platform@@QE$AAA@XZ ??0NullReferenceException@Platform@@QE$AAA@PE$AAVString@1@@Z ??0NullReferenceException@Platform@@QE$AAA@XZ ??0Object@Platform@@QE$AAA@XZ ??0ObjectDisposedException@Platform@@QE$AAA@PE$AAVString@1@@Z ??0ObjectDisposedException@Platform@@QE$AAA@XZ ??0OnePhaseConstructedAttribute@CompilerServices@Runtime@Platform@@QE$AAA@XZ ??0OperationCanceledException@Platform@@QE$AAA@PE$AAVString@1@@Z ??0OperationCanceledException@Platform@@QE$AAA@XZ ??0OutOfBoundsException@Platform@@QE$AAA@PE$AAVString@1@@Z ??0OutOfBoundsException@Platform@@QE$AAA@XZ ??0OutOfMemoryException@Platform@@QE$AAA@PE$AAVString@1@@Z ??0OutOfMemoryException@Platform@@QE$AAA@XZ ??0Rect@Foundation@Windows@@QEAA@VPoint@12@0@Z ??0Rect@Foundation@Windows@@QEAA@VPoint@12@VSize@12@@Z ??0RepeatBehavior@Animation@Media@Xaml@UI@Windows@@QEAA@N@Z ??0STAThreadAttribute@Platform@@QE$AAA@XZ ??0SizeT@Platform@@QEAA@H@Z ??0SizeT@Platform@@QEAA@PEAX@Z ??0Type@Platform@@QE$AAA@PE$AAVObject@1@@Z ??0Type@Platform@@QE$AAA@VIntPtr@1@@Z ??0Type@Platform@@QE$AAA@VTypeName@Interop@Xaml@UI@Windows@@@Z ??0ValueType@Platform@@QE$AAA@XZ ??0WrongThreadException@Platform@@QE$AAA@PE$AAVString@1@@Z ??0WrongThreadException@Platform@@QE$AAA@XZ ??0char16@default@@QEAA@_W@Z ??0float32@default@@QEAA@M@Z ??0float64@default@@QEAA@N@Z ??0int16@default@@QEAA@F@Z ??0int32@default@@QEAA@H@Z ??0int64@default@@QEAA@_J@Z ??0int8@default@@QEAA@C@Z ??0uint16@default@@QEAA@G@Z ??0uint32@default@@QEAA@I@Z ??0uint64@default@@QEAA@_K@Z ??0uint8@default@@QEAA@E@Z ??BIntPtr@Platform@@SA?AV01@H@Z ??BIntPtr@Platform@@SA?AV01@PEAX@Z ??BIntPtr@Platform@@SAPEAXV01@@Z ??BType@Platform@@SA?AVTypeName@Interop@Xaml@UI@Windows@@PE$AAV01@@Z ??BType@Platform@@SAPE$AAV01@VTypeName@Interop@Xaml@UI@Windows@@@Z ??DMatrix3D@Media3D@Media@Xaml@UI@Windows@@SA?AV012345@V012345@0@Z ??GDuration@Xaml@UI@Windows@@SA?AV0123@V0123@0@Z ??HDuration@Xaml@UI@Windows@@SA?AV0123@V0123@0@Z ??MDuration@Xaml@UI@Windows@@SA_NV0123@0@Z ??NDuration@Xaml@UI@Windows@@SA_NV0123@0@Z ??ODuration@Xaml@UI@Windows@@SA_NV0123@0@Z ??PDuration@Xaml@UI@Windows@@SA_NV0123@0@Z ?AlignedAllocate@Heap@Details@Platform@@SAPEAX_K00@Z ?AlignedAllocate@Heap@Details@Platform@@SAPEAX_K0@Z ?AlignedAllocateException@Heap@Details@Platform@@SAPEAX_K00@Z ?AlignedAllocateException@Heap@Details@Platform@@SAPEAX_K0@Z ?AlignedFree@Heap@Details@Platform@@SAXPEAX@Z ?AlignedFreeException@Heap@Details@Platform@@SAXPEAX@Z ?Allocate@Heap@Details@Platform@@SAPEAX_K0@Z ?Allocate@Heap@Details@Platform@@SAPEAX_K@Z ?AllocateException@Heap@Details@Platform@@SAPEAX_K0@Z ?AllocateException@Heap@Details@Platform@@SAPEAX_K@Z ?Compare@Duration@Xaml@UI@Windows@@SAHV1234@0@Z ?Contains@Rect@Foundation@Windows@@QEAA_NVPoint@23@@Z ?CreateException@Exception@Platform@@SAPE$AAV12@H@Z ?CreateException@Exception@Platform@@SAPE$AAV12@HPE$AAVString@2@@Z ?CreateValue@Details@Platform@@YAPE$AAVObject@2@W4TypeCode@2@PEBX@Z ?EnableFactoryCache@@YAXXZ ?EnumerateAllocatedObjects@Heap@Details@Platform@@SAXPE$AAVHeapEntryHandler@23@@Z ?Equals@Attribute@Metadata@Platform@@QE$AAA_NPE$AAVObject@3@@Z ?Equals@Boolean@Platform@@QEAA_NPE$AAVObject@2@@Z ?Equals@Delegate@Platform@@QE$AAA_NPE$AAVObject@2@@Z ?Equals@Enum@Platform@@QE$AAA_NPE$AAVObject@2@@Z ?Equals@Exception@Platform@@UE$AAA_NPE$AAVObject@2@@Z ?Equals@MTAThreadAttribute@Platform@@QE$AAA_NPE$AAVObject@2@@Z ?Equals@Object@Platform@@QE$AAA_NPE$AAV12@@Z ?Equals@OnePhaseConstructedAttribute@CompilerServices@Runtime@Platform@@QE$AAA_NPE$AAVObject@4@@Z ?Equals@STAThreadAttribute@Platform@@QE$AAA_NPE$AAVObject@2@@Z ?Equals@Type@Platform@@UE$AAA_NPE$AAVObject@2@@Z ?Equals@ValueType@Platform@@QE$AAA_NPE$AAVObject@2@@Z ?Equals@char16@default@@QEAA_NPE$AAVObject@Platform@@@Z ?Equals@float32@default@@QEAA_NPE$AAVObject@Platform@@@Z ?Equals@float64@default@@QEAA_NPE$AAVObject@Platform@@@Z ?Equals@int16@default@@QEAA_NPE$AAVObject@Platform@@@Z ?Equals@int32@default@@QEAA_NPE$AAVObject@Platform@@@Z ?Equals@int64@default@@QEAA_NPE$AAVObject@Platform@@@Z ?Equals@int8@default@@QEAA_NPE$AAVObject@Platform@@@Z ?Equals@uint16@default@@QEAA_NPE$AAVObject@Platform@@@Z ?Equals@uint32@default@@QEAA_NPE$AAVObject@Platform@@@Z ?Equals@uint64@default@@QEAA_NPE$AAVObject@Platform@@@Z ?Equals@uint8@default@@QEAA_NPE$AAVObject@Platform@@@Z ?EventSourceAdd@Details@Platform@@YA?AVEventRegistrationToken@Foundation@Windows@@PEAPEAXPEAUEventLock@12@PE$AAVDelegate@2@@Z ?EventSourceGetTargetArray@Details@Platform@@YAPEAXPEAXPEAUEventLock@12@@Z ?EventSourceGetTargetArrayEvent@Details@Platform@@YAPEAXPEAXIPEBXPEA_J@Z ?EventSourceGetTargetArraySize@Details@Platform@@YAIPEAX@Z ?EventSourceInitialize@Details@Platform@@YAXPEAPEAX@Z ?EventSourceRemove@Details@Platform@@YAXPEAPEAXPEAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z ?EventSourceUninitialize@Details@Platform@@YAXPEAPEAX@Z ?FlushFactoryCache@@YAXXZ ?Free@Heap@Details@Platform@@SAXPEAX@Z ?FreeException@Heap@Details@Platform@@SAXPEAX@Z ?GetActivationFactory@Details@Platform@@YAJPEAVModuleBase@1WRL@Microsoft@@PEAUHSTRING__@@PEAPEAUIActivationFactory@@@Z ?GetActivationFactoryByPCWSTR@@YAJPEAXAEAVGuid@Platform@@PEAPEAX@Z ?GetCmdArguments@Details@Platform@@YAPEAPEA_WPEAH@Z ?GetHashCode@Attribute@Metadata@Platform@@QE$AAAHXZ ?GetHashCode@Boolean@Platform@@QEAAHXZ ?GetHashCode@Delegate@Platform@@QE$AAAHXZ ?GetHashCode@Enum@Platform@@QE$AAAHXZ ?GetHashCode@Exception@Platform@@UE$AAAHXZ ?GetHashCode@Guid@Platform@@QEAAHXZ ?GetHashCode@MTAThreadAttribute@Platform@@QE$AAAHXZ ?GetHashCode@Object@Platform@@QE$AAAHXZ ?GetHashCode@OnePhaseConstructedAttribute@CompilerServices@Runtime@Platform@@QE$AAAHXZ ?GetHashCode@STAThreadAttribute@Platform@@QE$AAAHXZ ?GetHashCode@Type@Platform@@UE$AAAHXZ ?GetHashCode@ValueType@Platform@@QE$AAAHXZ ?GetHashCode@char16@default@@QEAAHXZ ?GetHashCode@float32@default@@QEAAHXZ ?GetHashCode@float64@default@@QEAAHXZ ?GetHashCode@int16@default@@QEAAHXZ ?GetHashCode@int32@default@@QEAAHXZ ?GetHashCode@int64@default@@QEAAHXZ ?GetHashCode@int8@default@@QEAAHXZ ?GetHashCode@uint16@default@@QEAAHXZ ?GetHashCode@uint32@default@@QEAAHXZ ?GetHashCode@uint64@default@@QEAAHXZ ?GetHashCode@uint8@default@@QEAAHXZ ?GetIBoxArrayVtable@Details@Platform@@YAPEAXPEAX@Z ?GetIBoxVtable@Details@Platform@@YAPEAXPEAX@Z ?GetIidsFn@@YAJHPEAKPEBU__s_GUID@@PEAPEAVGuid@Platform@@@Z ?GetObjectContext@Details@Platform@@YAPEAUIUnknown@@XZ ?GetProxyImpl@Details@Platform@@YAJPEAUIUnknown@@AEBU_GUID@@0PEAPEAU3@@Z ?GetType@Boolean@Platform@@QEAAPE$AAVType@2@XZ ?GetType@Guid@Platform@@QEAAPE$AAVType@2@XZ ?GetType@Object@Platform@@QE$AAAPE$AAVType@2@XZ ?GetType@char16@default@@QEAAPE$AAVType@Platform@@XZ ?GetType@float32@default@@QEAAPE$AAVType@Platform@@XZ ?GetType@float64@default@@QEAAPE$AAVType@Platform@@XZ ?GetType@int16@default@@QEAAPE$AAVType@Platform@@XZ ?GetType@int32@default@@QEAAPE$AAVType@Platform@@XZ ?GetType@int64@default@@QEAAPE$AAVType@Platform@@XZ ?GetType@int8@default@@QEAAPE$AAVType@Platform@@XZ ?GetType@uint16@default@@QEAAPE$AAVType@Platform@@XZ ?GetType@uint32@default@@QEAAPE$AAVType@Platform@@XZ ?GetType@uint64@default@@QEAAPE$AAVType@Platform@@XZ ?GetType@uint8@default@@QEAAPE$AAVType@Platform@@XZ ?GetTypeCode@Type@Platform@@SA?AW4TypeCode@2@PE$AAV12@@Z ?GetWeakReference@Details@Platform@@YAPEAU__abi_IUnknown@@QE$ADVObject@2@@Z ?InitControlBlock@ControlBlock@Details@Platform@@AEAAXPEAX_N11@Z ?InitializeData@Details@Platform@@YAJH@Z ?Intersect@Rect@Foundation@Windows@@QEAAXV123@@Z ?IntersectsWith@Rect@Foundation@Windows@@QEAA_NV123@@Z ?Invert@Matrix3D@Media3D@Media@Xaml@UI@Windows@@QEAAXXZ ?ReCreateException@Exception@Platform@@SAPE$AAV12@H@Z ?ReferenceEquals@Object@Platform@@SA_NPE$AAV12@0@Z ?ReferenceEquals@Object@Platform@@SA_NPE$AAVString@2@0@Z ?RegisterFactories@Details@Platform@@YAPE$AAVObject@2@PEAPEAVModuleBase@1WRL@Microsoft@@PEAPEAU__abi_Module@@P6AXXZ@Z ?ReleaseInContextImpl@Details@Platform@@YAJPEAUIUnknown@@0@Z ?ReleaseTarget@ControlBlock@Details@Platform@@AEAAXXZ ?ResolveWeakReference@Details@Platform@@YAPE$AAVObject@2@AEBU_GUID@@PEAPEAU__abi_IUnknown@@@Z ?RunApplicationServer@Details@Platform@@YAXPEAPEAVModuleBase@1WRL@Microsoft@@PEAPEAU__abi_Module@@PEB_W@Z ?RunServer@Details@Platform@@YAXPEAPEAVModuleBase@1WRL@Microsoft@@PEAPEAU__abi_Module@@PEB_W@Z ?TerminateModule@Details@Platform@@YA_NPEAVModuleBase@1WRL@Microsoft@@@Z ?ToInt32@IntPtr@Platform@@QEAAHXZ ?ToString@Attribute@Metadata@Platform@@QE$AAAPE$AAVString@3@XZ ?ToString@Boolean@Platform@@QEAAPE$AAVString@2@XZ ?ToString@Delegate@Platform@@QE$AAAPE$AAVString@2@XZ ?ToString@Enum@Platform@@QE$AAAPE$AAVString@2@XZ ?ToString@Exception@Platform@@UE$AAAPE$AAVString@2@XZ ?ToString@Guid@Platform@@QEAAPE$AAVString@2@XZ ?ToString@MTAThreadAttribute@Platform@@QE$AAAPE$AAVString@2@XZ ?ToString@OnePhaseConstructedAttribute@CompilerServices@Runtime@Platform@@QE$AAAPE$AAVString@4@XZ ?ToString@STAThreadAttribute@Platform@@QE$AAAPE$AAVString@2@XZ ?ToString@Type@Platform@@UE$AAAPE$AAVString@2@XZ ?ToString@ValueType@Platform@@QE$AAAPE$AAVString@2@XZ ?ToString@char16@default@@QEAAPE$AAVString@Platform@@XZ ?ToString@float32@default@@QEAAPE$AAVString@Platform@@XZ ?ToString@float64@default@@QEAAPE$AAVString@Platform@@XZ ?ToString@int16@default@@QEAAPE$AAVString@Platform@@XZ ?ToString@int32@default@@QEAAPE$AAVString@Platform@@XZ ?ToString@int64@default@@QEAAPE$AAVString@Platform@@XZ ?ToString@int8@default@@QEAAPE$AAVString@Platform@@XZ ?ToString@uint16@default@@QEAAPE$AAVString@Platform@@XZ ?ToString@uint32@default@@QEAAPE$AAVString@Platform@@XZ ?ToString@uint64@default@@QEAAPE$AAVString@Platform@@XZ ?ToString@uint8@default@@QEAAPE$AAVString@Platform@@XZ ?UninitializeData@Details@Platform@@YAXH@Z ?Union@Rect@Foundation@Windows@@QEAAXV123@@Z ?Union@Rect@Foundation@Windows@@QEAAXVPoint@23@@Z ?WriteLine@Console@Details@Platform@@SAXPE$AAVObject@3@@Z ?WriteLine@Console@Details@Platform@@SAXPE$AAVString@3@@Z ?WriteLine@Console@Details@Platform@@SAXXZ ?__abi_FailFast@@YAXXZ ?__abi_ObjectToString@__abi_details@@YAPE$AAVString@Platform@@PE$AAVObject@3@_N@Z ?__abi_Resolve@ControlBlock@Details@Platform@@UEAAJAEAVGuid@3@PEAPEAU__abi_IInspectable@@@Z ?__abi_WinRTraiseAccessDeniedException@@YAXXZ ?__abi_WinRTraiseCOMException@@YAXJ@Z ?__abi_WinRTraiseChangedStateException@@YAXXZ ?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ ?__abi_WinRTraiseDisconnectedException@@YAXXZ ?__abi_WinRTraiseFailureException@@YAXXZ ?__abi_WinRTraiseInvalidArgumentException@@YAXXZ ?__abi_WinRTraiseInvalidCastException@@YAXXZ ?__abi_WinRTraiseNotImplementedException@@YAXXZ ?__abi_WinRTraiseNullReferenceException@@YAXXZ ?__abi_WinRTraiseObjectDisposedException@@YAXXZ ?__abi_WinRTraiseOperationCanceledException@@YAXXZ ?__abi_WinRTraiseOutOfBoundsException@@YAXXZ ?__abi_WinRTraiseOutOfMemoryException@@YAXXZ ?__abi_WinRTraiseWrongThreadException@@YAXXZ ?__abi_cast_Object_to_String@__abi_details@@YAPE$AAVString@Platform@@_NPE$AAVObject@3@@Z ?__abi_cast_String_to_Object@__abi_details@@YAPE$AAVObject@Platform@@PE$AAVString@3@@Z ?__abi_make_type_id@@YAPE$AAVType@Platform@@AEBU__abi_type_descriptor@@@Z ?__abi_translateCurrentException@@YAJ_N@Z ?__getActivationFactoryByHSTRING@@YAJPEAUHSTRING__@@AEAVGuid@Platform@@PEAPEAX@Z ?get@Bottom@Rect@Foundation@Windows@@QEAAMXZ ?get@BreakOnAllocationId@Heap@Details@Platform@@SAHXZ ?get@BreakOnFreeId@Heap@Details@Platform@@SAHXZ ?get@CurrentAllocationId@Heap@Details@Platform@@SAHXZ ?get@Empty@Rect@Foundation@Windows@@SA?AV234@XZ ?get@Empty@Size@Foundation@Windows@@SA?AV234@XZ ?get@FullName@Type@Platform@@QE$AAAPE$AAVString@3@XZ ?get@HasInverse@Matrix3D@Media3D@Media@Xaml@UI@Windows@@QEAA_NXZ ?get@Message@Exception@Platform@@QE$AAAPE$AAVString@3@XZ ?get@ObjectCount@Heap@Details@Platform@@SAHXZ ?get@Right@Rect@Foundation@Windows@@QEAAMXZ ?get@TrackingLevel@Heap@Details@Platform@@SA?AW4HeapAllocationTrackingLevel@34@XZ ?set@BreakOnAllocationId@Heap@Details@Platform@@SAXH@Z ?set@BreakOnFreeId@Heap@Details@Platform@@SAXH@Z ?set@TrackingLevel@Heap@Details@Platform@@SAXW4HeapAllocationTrackingLevel@34@@Z

vcruntime140.dll

IMPHASH 6b799efc51fdd03aa3707013f22955b8
SHA256 b573edb6f63037c8ca94cbb333b48111b5679b59dbf081c8ba5d62053111ea3e
MD5 70c0d3f99d77a04c0881f9ef448d77de
SHA1 39c49abcf5686d29e99bfd4a24d1f48ca0188d29
SHA512 de3840d628f9690fac01d3435cf96b77ca01626950ae02f51e7e36a502b8e4a5da9700228b636a7935b1da3f8458be15825651a6939e1dee6802968c9a115459
SSDEEP 3072:ctkenID0f6aifkHWBXjGVBuecbfmzZT7w+ywS:lWSIHWBXjGiecbf4PSv
TLSH
T158D38C42B2B801FBC16BD174C2A2AE23FB76B546476097DF03A99A640F637D06D3D349
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

DLL Hijacking vulnerability

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

66448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb

_CreateFrameInfo _CxxThrowException _FindAndUnlinkFrame _IsExceptionObjectToBeDestroyed _SetWinRTOutOfMemoryExceptionCallback __AdjustPointer __BuildCatchObject __BuildCatchObjectHelper __C_specific_handler __C_specific_handler_noexcept __CxxDetectRethrow __CxxExceptionFilter __CxxFrameHandler __CxxFrameHandler2 __CxxFrameHandler3 __CxxQueryExceptionSize __CxxRegisterExceptionObject __CxxUnregisterExceptionObject __DestructExceptionObject __FrameUnwindFilter __GetPlatformExceptionInfo __NLG_Dispatch2 __NLG_Return2 __RTCastToVoid __RTDynamicCast __RTtypeid __TypeMatch __current_exception __current_exception_context __intrinsic_setjmp __intrinsic_setjmpex __processing_throw __report_gsfailure __std_exception_copy __std_exception_destroy __std_terminate __std_type_info_compare __std_type_info_destroy_list __std_type_info_hash __std_type_info_name __telemetry_main_invoke_trigger __telemetry_main_return_trigger __unDName __unDNameEx __uncaught_exception __uncaught_exceptions __vcrt_GetModuleFileNameW __vcrt_GetModuleHandleW __vcrt_InitializeCriticalSectionEx __vcrt_LoadLibraryExW _get_purecall_handler _get_unexpected _is_exception_typeof _local_unwind _purecall _set_purecall_handler _set_se_translator longjmp memchr memcmp memcpy memmove memset set_unexpected strchr strrchr strstr unexpected wcschr wcsrchr wcsstr

Name

.text

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

fothk

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

504B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

976B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

744B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

vcruntime140_1.dll

IMPHASH faf1de4e688195ca9bd5697cb1dccd29
SHA256 4d7f36ff507edb8b712129500b2b2c405db44818a5ceeaf82f6f46d73639a071
MD5 50fb26d12be84d962a41ef4f497e29cc
SHA1 7ae2368b0bca9e2e41b637aae3a641fac1e67971
SHA512 65cd3ba610a943e6ff4bd3f59a326d64c06814bd79f4f0cbb65078099e1f2899e25f90b1bc9db284b30d0656fcf3660dc46203d0168d0b43585770c2b481894a
SSDEEP 768:73oZYctpzcx0pdESj95Q8cTgU9GOa9zv2QZs49znbTUDM/9zU:Dc6MjVcT3Azv6wznvUYzU
TLSH
T138437CE157785083E8ABE87081D6EE577D38F3931B50925B06A5E5481FA37C0FB3922E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

DLL Hijacking vulnerability

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

16656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb

vcruntime140_threads.dll

IMPHASH 5ec0377a6cf6fab1a21b56f09428ef6a
SHA256 b5d34d13e408da8e394ca112a87f54c33741d451524865c94470a34cf3f91b6e
MD5 d7734fc611ee356e32e7937c7acaffff
SHA1 73132d673f2af614cc946add5494e433708c998a
SHA512 0c4dd8b0a9b4afafe552788f95c82794824552c26b6cf10c785c3e8576e39011ca80b42efa0c2452f4edc9af9fbd0ffa61d26401445beab455c0113b58b7a39b
SSDEEP 768:LjJ+AiHEFeLUIHotcrFPLw4DYOUj9zEP0QZs49zpbTUDMH49zg90:HuHEwLUIHocrFPLgOQzEcwzpvUIQz20
TLSH
T1C1236C8297385487EDEB9C70D2A9EA47BD3D77C20B4090DF4291F9480DA33C6EA3965D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

9104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_threads.amd64.pdb

Sharing

General

Malware Config

Signatures

File Explorer

i640.cab

ApiClient.dll

kernel32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic

ApiClient_arm64.dll

AppVCatalog.dll

kernel32

appvmanifest

appvpolicy

vcruntime140_1

vcruntime140

msvcp140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

oleaut32

api-ms-win-crt-math-l1-1-0

generic

AppVClient.man

AppVClientIsv.man

AppVFileSystemMetadata.dll

kernel32

oleaut32

vcruntime140_1

vcruntime140

msvcp140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

generic

AppVIntegration.dll

kernel32

vcruntime140_1

vcruntime140

msvcp140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

ntdll

oleaut32

api-ms-win-core-path-l1-1-0

api-ms-win-crt-math-l1-1-0

generic

AppVIsvApi.dll

kernel32

appvpolicy

vcruntime140_1

vcruntime140

msvcp140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic

AppVIsvStreamingManager.dll

kernel32

appvmanifest