filenamewindbg.exe
size598304 (0x92120)
md523f1502716b8d687860c9ccb508f50e2
typePE32+ executable (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
259289004
2602890023
2612890011
2572890033
10342
2642890033
255289001
258289001

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x6262231a
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion14.26
SizeOfCode0x4f000
SizeOfInitializedData0x55000
SizeOfUninitializedData0
AddressOfEntryPoint0x4c640
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion10.0
ImageVersion10.0
SubsystemVersion6.1
Reserved10
SizeOfImage0xa5000
SizeOfHeaders0x1000
CheckSum0x9d29c
Subsystem2
DllCharacteristics0xc160
SizeOfStackReserve0x80000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x4e80f0x4f000R-X CODE
.rdata0x500000x181ec0x19000R-- IDATA
.data0x690000x180b80x5000RW- IDATA
.pdata0x820000x2cb80x3000R-- IDATA
.rsrc0x850000x1d7600x1e000R-- IDATA
.reloc0xa30000x10700x2000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x65f440x154
RESOURCE0x850000x1d760
EXCEPTION0x820000x2cb8
SECURITY0x910000x1120
BASERELOC0xa30000x1070
DEBUG0x614100x54
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x532000x138
Bound_IAT00
IAT0x533380xae0
Delay_IAT00
CLR_Header00
typenamesizecp
CURSOR#13080
BITMAP#304038240
ICON#22960
ICON#37440
ICON#47440
ICON#52960
ICON#63040
ICON#77440
ICON#82960
ICON#97440
ICON#102960
ICON#117440
ICON#122960
ICON#137440
ICON#142960
ICON#152960
ICON#167440
ICON#177440
ICON#182960
ICON#197440
ICON#202960
ICON#217440
ICON#222960
ICON#237440
ICON#242960
ICON#252960
ICON#267440
ICON#272960
ICON#287440
MENU#305047760
DIALOG#22502960
DIALOG#23004980
DIALOG#23102340
DIALOG#23152420
DIALOG#23201640
DIALOG#23302940
DIALOG#24003680
DIALOG#24503920
DIALOG#25003620
DIALOG#25103820
DIALOG#25203620
DIALOG#26007080
DIALOG#30136520
DIALOG#30145660
DIALOG#30152300
DIALOG#30164580
DIALOG#30173020
DIALOG#30184540
DIALOG#30192060
DIALOG#41002480
DIALOG#42002640
DIALOG#43003900
DIALOG#44505640
DIALOG#44997140
DIALOG#45006300
DIALOG#45122680
DIALOG#45133600
DIALOG#455012060
DIALOG#46005620
DIALOG#46252380
DIALOG#46503600
DIALOG#46752720
DIALOG#47002260
DIALOG#48002400
DIALOG#48103920
DIALOG#48204900
DIALOG#48501940
DIALOG#49003020
DIALOG#49252620
DIALOG#49507100
STRING#643440
STRING#6520320
STRING#6620520
STRING#6742320
STRING#6826560
STRING#893680
STRING#9024900
STRING#9119720
STRING#973080
STRING#981060
STRING#1262080
STRING#1272560
STRING#128780
STRING#2016140
STRING#638700
STRING#639680
STRING#6894200
STRING#6901360
STRING#6911300
STRING#6922340
STRING#694520
STRING#7515580
STRING#7524740
STRING#10315900
STRING#10326980
STRING#1033540
STRING#10377340
STRING#10388360
STRING#10432380
STRING#10444060
STRING#10456520
STRING#10461960
STRING#105010340
STRING#10568580
STRING#10573020
STRING#1061700
STRING#10624260
STRING#16503840
ACCELERATORS#30516240
RCDATA#3041199960
GROUP_CURSOR#3001200
GROUP_ICON#3002340
GROUP_ICON#3003480
GROUP_ICON#3004340
GROUP_ICON#3005340
GROUP_ICON#3006340
GROUP_ICON#3007340
GROUP_ICON#3008340
GROUP_ICON#3009340
GROUP_ICON#3010340
GROUP_ICON#3012340
GROUP_ICON#3013340
GROUP_ICON#3014340
GROUP_ICON#3015340
VERSION#19320
MANIFEST#121150
#17476#30583236480
idlangstring
10191033Out of memory
10201033Debugger did not start - please check your initialization parameters
10211033Assertion Failed
10221033WinDbg cannot be initialized
10231033'%s' is too long for a filename
10241033An internal debugger error (%s) occurred in component '%s'. Please contact Microsoft Technical Support. %s
10251033The file '%s' cannot be opened
10261033The maximum length for a path is %d characters. Please truncate the following path: %s
10271033Invalid Process Name %s
10281033Invalid process ID %ld
10291033The command line arguments passed to WinDbg are invalid
10301033The remote debugger connection to (%s) failed
10311033The debugger could not connect using '%s', %s %s
10321033Could not find the %s Dump File, %s %s
10331033Could not attach to process %d, %s %s
10341033Could not start kernel debugging using %s parameters, %s %s
10351033Registers are not yet known
10361033The 'server' command was not given the correct parameters. Please consult the documentation for a description of the 'server' command parameters
10371033The 'remote' command was not given the correct parameters. Please consult the documentation for a description of the 'remote' command parameters
10391033WinDbg was not successfully installed as the default postmortem debugger. This operation requires administrative privileges.
10401033WinDbg was successfully installed as the default postmortem debugger.
10411033Could not create process '%s', %s %s
10421033Failure when opening dump file '%s', %s It may be corrupt or in a format not understood by the debugger. %s
10431033The remoting connection is already in use
10441033The debugger could not contact the specified process server ('%s').%s
10451033Unable to find process '%s', %s %s
10461033Please enter a value for the path
10471033The syntax of the '-premote' parameters is invalid. Please consult the documentation for a description of the '-premote' parameters.
10481033The system does not support detach on exit
10491033Code not found, breakpoint not set
10501033No symbolic information was found for this file. A deferred breakpoint has been set
10511033Unable to open workspace, %s %s
10521033Workspace %s already exists. Overwrite?
10531033Unable to save workspace, %s %s
10541033%s has changed since it was opened. This may result in invalid breakpoints or other incorrect behavior. Do you want to reload the file? NOTE: This will not update breakpoint locations
10551033Process %d is not a sleeping debugger
10561033The debugger doesn't support additional dump information files
10571033Unable to use '%s', %s %s
10581033The selected workspace will start a new debugging session. Please stop the current debugging session first.
10591033The client cannot communicate with the server. The session will be shut down.
10601033There is more than one '%s' process running. Find the process ID of the instance you are interested in and use -p <pid>.
10611033The file you selected has an executable file or crash dump file extension. File.Open Executable and File.Open Crash Dump should be used to open such files. Do you want to open this file as a source file?
10621033Unable to retrieve drag-and-drop filename, %s %s
10631033WinDbg could not register file associations. This operation requires administrative privileges.
10641033WinDbg successfully registered file associations for .DMP, .HDMP, .MDMP, .KDMP and .WEW.
10651033The file '%s' cannot be opened. Cancel to prevent further file opening.
10661033A window could not be updated, so the operation is only partially complete. You can manually move windows that are not in the desired state.
10671033Watch window update took %.2g seconds. This can be caused by slow symbol loading or by stale variables in the watch window. If you don't need the watch window close it, or review its contents for validity. Prefixing local variables with $! and global variables with <module>! will avoid any unnecessary lookup time.
10681033Complex sessions that have multiple debuggees, multiple types of debugging or extremely long command lines cannot be restarted.
10691033Attached processes can only be restarted by shutting down the existing process and creating a new one. This may lose specific characteristics of the current process as the debugger cannot perfectly recreate the environment that existed when the current process was created. The command line that will be used for creation is '%s' You can choose to proceed with shutdown and recreation, change nothing and retry the existing attach or cancel the retry attempt.
10701033WinDbg could not register URL protocols. This operation requires administrative privileges.
10711033WinDbg successfully registered URL protocols for remdbgeng.
10721033%s failed, %s %s
10731033Unable to get information, the engine is busy. Please wait until the engine finishes, or use Ctrl+Break to interrupt the engine.
10741033The command line arguments cannot specify more than one kind of debugging to start
10751033The trace file, %s, could not be opened. It was created using a version of TTT that is different from the version used for replay. Either recreate the trace with your current version of TTT, use the paired replay version of the trace file, or set IDNA_IGNORE_BUILD_VERSION=1 as a workaround. Note: using the workaround may lead to issues with replay due to version differences. Refer to the Command window for more information including version details.
10761033Could not open the 0x%p dump file handle, %s %s
10771033Failure when opening dump file handle 0x%p, %s It may be corrupt or in a format not understood by the debugger. %s
10781033The trace file with handle 0x%p, could not be opened. It was created using a version of TTT that is different from the version used for replay. Either recreate the trace with your current version of TTT, use the paired replay version of the trace file, or set IDNA_IGNORE_BUILD_VERSION=1 as a workaround. Note: using the workaround may lead to issues with replay due to version differences. Refer to the Command window for more information including version details.
14101033Debuggee must be stopped before breakpoints can be modified.
14191033Workspace could not be created
14201033Unable to retrieve information, %s: %s
14211033Retrieving information...
14221033Can't find '%s'
14251033The debugger could not contact the specified remote server ('%s').%s
14261033The client is not using the same version of the remoting protocol as the server
14271033The system does not support local kernel debugging. Local kernel debugging requires Administrative privileges, and is not supported by WOW64. Only a single local kernel debugging session can run at a time. Local kernel debugging is disabled by default. You must run 'bcdedit -debug on' and reboot to enable it.
14281033Unable to debug the local kernel, %s %s
14301033Exiting without using 'q' or Stop Debugging may leave the debuggee in an unusable state. Continue?
14311033Symbol information for the current line could not be located in the currently loaded symbols. Do you want the debugger to load and search the remaining symbols? Yes performs the search immediately. No returns to the UI while the search proceeds. Cancel exits the operation.
14321033The debugger is still working and cannot stop. Continue waiting? Answer Yes to continue to wait or No to exit.
14341033Cannot query debuggee as it is running or has exited or shut down
14351033Unable to create file '%s', %s %s
14361033Unable to write window text to file '%s', %s %s
14371033Workspace not found. Create it?
14381033Too many dump files specified, %s ignored
14391033Unable to secure operation
14401033User interface suspended, use .suspend_ui 0 to re-enable
14411033Tiling would produce windows below the minimum allowed size
14421033Toggling MDI emulation mode requires that all current windows be closed and all window settings be reset. Proceed?
14431033Window placement information in this workspace is corrupt. Windows may not be displayed as expected. Window placement information will not be saved.
14451033The connection attempt timed out. The server name/address may be invalid. Ensure that the server specified is correct and that no firewalls are blocking connections.
14461033The server was reached but it refused the connection attempt. Ensure that the server specified is correct and that it is listening at the specified port.
14471033The pipe server was not found. Ensure that both the server and pipe name specified are correct.
14481033The server was reached but the pipe specified could not be found. Ensure that both the server and pipe name specified are correct.
14491033The specified server host name cannot be found.
15501033Missing application name or background task id for PLM package '%s'
15511033Could not launch PLM package '%s', appName '%s', arguments '%s', %s %s
15521033Unrecognized target architecture '%s'
20001033WinDbg:10.0.20226.1000 AMD64
20021033debugger.chm
20101033WinDbgFrameClass
20111033DockClass
20121033WinBaseClass
20131033GhostClass
20201033Invalid
20211033Source
20221033Watch
20231033Locals
20241033Registers
20251033Disassembly
20261033Command
20271033Scratch Pad
20281033Memory
20291033ObsoleteQuickWatch
20301033Calls
20311033Processes and Threads
20321033Commands
20331033Command Browser
32001033Open Source File
32031033Browse For File
32041033Browse For DLL
32051033Open Symbol File For
32061033Browse For Log File
32071033Open Executable
32081033Open Crash Dump
32091033Add Symbol Path Directory
32101033Add Source Path Directory
32111033Add Image Path Directory
32121033Write Window Text to File
32131033Open Workspace in File
32141033Save Workspace to File
32151033Associate File with Scratch Pad
102011033 OVR
102031033 CAPS
102041033 NUM
102051033 Ln
102061033Col
102081033 Proc
102091033 Thrd
102101033 ASM
102111033 Sys
110111033C/C++ Source Files
110121033C/C++ Include Files
110131033Assembly Source Files
110141033Assembly Include Files
110151033Resource Files
110161033Dialog Files
110171033Definition Files
110181033Project Files
110191033Executable Files
110201033Log Files
110211033Crash Dump Files
110221033DLL Files
110231033All Files
110241033Symbol Files
110251033Text Files
110261033Workspace Files
110271033C# Source Files
110511033*.C;*.CPP;*.CXX
110521033*.H;*.HPP;*.HXX
110531033*.ASM;*.S
110541033*.INC
110551033*.EXE
110561033*.LOG
110571033*.DMP;*.HDMP;*.MDMP;*.KDMP;*.CAB;*.RUN
110581033*.RC
110591033*.DLG
110601033*.DEF
110611033*.MAK
110621033*.DLL
110631033*.*
110641033*.PDB;*.DBG;*.SYM
110651033*.TXT
110661033*.WEW
110671033*.CS
110901033MEMORY.DMP
120001033Open source file (Ctrl+O)
120021033Cut (Ctrl+X)
120031033Copy (Ctrl+C)
120041033Paste (Ctrl+V)
120051033Go (F5)
120061033Restart (Ctrl+Shift+F5)
120071033Stop debugging (Shift+F5)
120081033Break (Ctrl+Break)
120091033Step into (F11 or F8)
120101033Step over (F10)
120111033Run to cursor (Ctrl+F10 or F7)
120121033Insert or remove breakpoint (F9)
120141033Command (Alt+1)
120151033Watch (Alt+2)
120161033Call stack (Alt+6)
120171033Memory window (Alt+5)
120181033Locals (Alt+3)
120191033Registers (Alt+4)
120201033Disassembly (Alt+7)
120211033Scratch Pad (Alt+8)
120221033Processes and Threads (Alt+9)
120231033Command Browser (Ctrl+N)
120241033Source mode on
120251033Source mode off
120261033Font
120271033Options
120281033Step out (Shift+F11)
164841033File operations
164851033Open a source file
164861033Close active window
164881033Open an executable to debug
164891033Attach to a running process
164901033Open a crash dump to debug
164911033Connect to a remote session
164921033Redirect debugging activity through a remote stub server (like -premote)
164931033Start kernel debugging
164951033Set the symbol search path
164961033Set the source search path
164971033Set the image search path
164991033Open a saved workspace
165001033Save the current workspace
165011033Save the current workspace with a new name
165021033Remove entries from the current workspace
165031033Delete workspaces from the system
165041033Open a workspace saved in a file
165051033Save the current workspace to a file
165071033Map a remote drive
165081033Disconnect a mapped remote drive
165261033Exit WinDbg
165841033Edit operations
165851033Move the selected text to the clipboard
165861033Copy the selected text to the clipboard as plain text
165871033Copy the selection and any formatting to the clipboard
165881033Paste the clipboard text at the insertion point
165891033Select all of the text in the active window
165901033Write a textual representation of the window contents to a file
165911033Copy all window text to the clipboard
165921033Add a line to the command history text
165931033Clear the command history text
165941033Evaluate current selection text in the command window
165951033Display the currently selected type in the command window
165961033Find some text
165971033Repeat the last find
165981033Move to the specified address
165991033Move to a specified line number
166001033Move to the currently executing code
166011033Set instruction pointer to current source line
166021033Edit program breakpoints
166031033Open or close a log file
166841033File navigation, status and toolbars
166851033Open the watch window
166861033Open the call stack window
166871033Open a memory window
166881033Open the locals window
166891033Open the registers window
166901033Open the disassembly window
166911033Open the command window
166921033Open the scratch pad window
166931033Open the process and thread window
166941033Open a command browser window
167111033Set the initial command for new command browser windows
167121033Toggle the verbose output setting
167131033Display the debugger time for every debuggee event
167141033Display debugger and debuggee version information
167151033Toggle the toolbar on or off
167161033Toggle the status bar on or off
167171033View or edit the font for the current window
167191033View program options
167201033Configure mapping from file extension to source language
167211033View WinDbg's command line
167841033Debug operations
167851033Run the Program
167861033Handle the exception and continue running
167871033Do not handle the exception, but continue running
167881033Restart the Program
167891033Stop debugging the current program
167901033Detach the current program
167911033Halt the current program
167921033Trace into the next statement
167931033Step over the next statement
167941033Step out of the current function
167951033Run the program to the line containing the cursor
167961033Display source when possible
167971033Perform symbol resolution for symbol strings without a module qualifier
167981033Manage event filters
167991033View the module list
168841033Window arrangement and selection
168851033Close all source windows
168861033Close all windows that are error placeholders
168871033Open a new docked window container
168881033Dock all undocked windows
168891033Undock all docked windows
168901033Cascade all floating windows
168911033Horizontally tile all floating windows
168921033Vertically tile all floating windows
168941033Manage windows using the Multiple Document Interface style
168951033Automatically open a disassembly window when source is not available
168971033Activate window
168981033Activate window
168991033Activate window
169001033Activate window
169011033Activate window
169021033Activate window
169031033Activate window
169041033Activate window
169051033Activate window
169741033Manage open windows
169841033Help contents and searches
169851033Open the help table of contents
169861033Open the help for the current window type
169871033Open help for the currently selected text
169881033Open the help index
169891033Open the help search dialog
169901033About WinDbg
263841033Kernel debugging control
263851033Cycle through the available baud rate settings
263871033Cycle through the possible initial break settings
263881033Request that the debugger resynchronize with the debuggee
module_namehintordfunction_name
ADVAPI32.dll662RegOpenKeyExW
ADVAPI32.dll647RegEnumValueW
ADVAPI32.dll613RegCloseKey
ADVAPI32.dll651RegGetValueW
ADVAPI32.dll675RegQueryValueExW
ADVAPI32.dll691RegSetValueExW
ADVAPI32.dll637RegDeleteValueW
ADVAPI32.dll622RegCreateKeyExW
ADVAPI32.dll674RegQueryValueExA
ADVAPI32.dll661RegOpenKeyExA
KERNEL32.dll479GetCommandLineW
KERNEL32.dll244CreateThread
KERNEL32.dll358ExitProcess
KERNEL32.dll598GetFileTime
KERNEL32.dll153CompareFileTime
KERNEL32.dll877InitializeCriticalSection
KERNEL32.dll275DeleteCriticalSection
KERNEL32.dll788GetTickCount
KERNEL32.dll414FindResourceW
KERNEL32.dll977LoadResource
KERNEL32.dll997LockResource
KERNEL32.dll1427SizeofResource
KERNEL32.dll1057OutputDebugStringW
KERNEL32.dll537GetCurrentDirectoryW
KERNEL32.dll967LeaveCriticalSection
KERNEL32.dll544GetCurrentProcessId
KERNEL32.dll835GlobalFree
KERNEL32.dll810GetVersionExW
KERNEL32.dll843GlobalSize
KERNEL32.dll435FreeLibrary
KERNEL32.dll974LoadLibraryW
KERNEL32.dll1519WaitForSingleObject
KERNEL32.dll231CreateProcessW
KERNEL32.dll581GetExitCodeProcess
KERNEL32.dll590GetFileAttributesW
KERNEL32.dll686GetPriorityClass
KERNEL32.dll636GetModuleFileNameW
KERNEL32.dll1321SetEnvironmentVariableW
KERNEL32.dll190CreateEventA
KERNEL32.dll1323SetEvent
KERNEL32.dll486GetComputerNameExW
KERNEL32.dll972LoadLibraryExA
KERNEL32.dll1428Sleep
KERNEL32.dll1360SetPriorityClass
KERNEL32.dll1101QueryDosDeviceW
KERNEL32.dll623GetLogicalDriveStringsW
KERNEL32.dll543GetCurrentProcess
KERNEL32.dll1000MapViewOfFile
KERNEL32.dll202CreateFileMappingW
KERNEL32.dll1480UnmapViewOfFile
KERNEL32.dll640GetModuleHandleW
KERNEL32.dll635GetModuleFileNameA
KERNEL32.dll431FormatMessageW
KERNEL32.dll973LoadLibraryExW
KERNEL32.dll697GetProcAddress
KERNEL32.dll362ExpandEnvironmentStringsW
KERNEL32.dll839GlobalLock
KERNEL32.dll311EnterCriticalSection
KERNEL32.dll756GetSystemTimeAsFileTime
KERNEL32.dll1109QueryPerformanceCounter
KERNEL32.dll1443TerminateProcess
KERNEL32.dll1412SetUnhandledExceptionFilter
KERNEL32.dll280DeleteFileW
KERNEL32.dll548GetCurrentThreadId
KERNEL32.dll1578WriteFile
KERNEL32.dll103Beep
KERNEL32.dll136CloseHandle
KERNEL32.dll1016MulDiv
KERNEL32.dll1017MultiByteToWideChar
KERNEL32.dll1149ReadFile
KERNEL32.dll596GetFileSize
KERNEL32.dll205CreateFileW
KERNEL32.dll617GetLastError
KERNEL32.dll1558WideCharToMultiByte
KERNEL32.dll846GlobalUnlock
KERNEL32.dll1477UnhandledExceptionFilter
KERNEL32.dll265DebugBreak
KERNEL32.dll828GlobalAlloc
KERNEL32.dll361ExpandEnvironmentStringsA
GDI32.dll90CreateSolidBrush
GDI32.dll79CreatePen
GDI32.dll705GetStockObject
GDI32.dll638GetDeviceCaps
GDI32.dll55CreateDIBSection
GDI32.dll937TextOutW
GDI32.dll748LineTo
GDI32.dll768MoveToEx
GDI32.dll797Polyline
GDI32.dll725GetTextExtentPointW
GDI32.dll722GetTextExtentPoint32W
GDI32.dll730GetTextMetricsW
GDI32.dll871SelectObject
GDI32.dll390DeleteObject
GDI32.dll67CreateFontIndirectW
GDI32.dll780PatBlt
GDI32.dll878SetBkColor
GDI32.dll918SetTextColor
GDI32.dll800PtVisible
USER32.dll891SetWindowPos
USER32.dll321GetCursorPos
USER32.dll775ScreenToClient
USER32.dll766RemoveMenu
USER32.dll215DrawMenuBar
USER32.dll652ModifyMenuW
USER32.dll936TrackPopupMenu
USER32.dll325GetDesktopWindow
USER32.dll178DestroyMenu
USER32.dll888SetWindowLongPtrW
USER32.dll19BringWindowToTop
USER32.dll793SetActiveWindow
USER32.dll910ShowWindow
USER32.dll504GetWindowThreadProcessId
USER32.dll344GetForegroundWindow
USER32.dll91CopyRect
USER32.dll463GetTitleBarInfo
USER32.dll728RedrawWindow
USER32.dll167DefWindowProcW
USER32.dll589IsWindowVisible
USER32.dll323GetDCEx
USER32.dll480GetWindowDC
USER32.dll452GetSysColorBrush
USER32.dll858SetRect
USER32.dll272FillRect
USER32.dll214DrawIconEx
USER32.dll762ReleaseDC
USER32.dll695PtInRect
USER32.dll806SetCursor
USER32.dll591IsZoomed
USER32.dll282GetActiveWindow
USER32.dll488GetWindowLongPtrW
USER32.dll16BeginDeferWindowPos
USER32.dll240EndDeferWindowPos
USER32.dll638MapWindowPoints
USER32.dll615LoadStringW
USER32.dll600LoadCursorW
USER32.dll732RegisterClassExW
USER32.dll602LoadIconW
USER32.dll926SystemParametersInfoW
USER32.dll889SetWindowLongW
USER32.dll845SetParent
USER32.dll670OpenIcon
USER32.dll585IsWindowEnabled
USER32.dll17BeginPaint
USER32.dll244EndPaint
USER32.dll74ChildWindowFromPointEx
USER32.dll829SetLayeredWindowAttributes
USER32.dll996WindowFromPoint
USER32.dll322GetDC
USER32.dll293GetCapture
USER32.dll890SetWindowPlacement
USER32.dll942TranslateMessage
USER32.dll189DispatchMessageW
USER32.dll781SendDlgItemMessageW
USER32.dll818SetDlgItemTextW
USER32.dll335GetDlgItemTextW
USER32.dll400GetParent
USER32.dll558IsClipboardFormatAvailable
USER32.dll381GetMenuItemCount
USER32.dll171DeleteMenu
USER32.dll384GetMenuItemInfoW
USER32.dll332GetDlgItem
USER32.dll333GetDlgItemInt
USER32.dll242EndDialog
USER32.dll66CheckDlgButton
USER32.dll562IsDlgButtonChecked
USER32.dll71CheckRadioButton
USER32.dll816SetDlgItemInt
USER32.dll386GetMenuState
USER32.dll375GetMenu
USER32.dll3AdjustWindowRect
USER32.dll686PostQuitMessage
USER32.dll451GetSysColor
USER32.dll222DrawTextW
USER32.dll31CallNextHookEx
USER32.dll968UpdateWindow
USER32.dll650MessageBoxW
USER32.dll186DialogBoxParamW
USER32.dll940TranslateAcceleratorW
USER32.dll681PeekMessageW
USER32.dll561IsDialogMessageW
USER32.dll667OpenClipboard
USER32.dll232EmptyClipboard
USER32.dll802SetClipboardData
USER32.dll79CloseClipboard
USER32.dll310GetClipboardData
USER32.dll114CreatePopupMenu
USER32.dll444GetScrollInfo
USER32.dll735RegisterClipboardFormatW
USER32.dll760RegisterWindowMessageW
USER32.dll594LoadAcceleratorsW
USER32.dll450GetSubMenu
USER32.dll901SetWindowsHookExW
USER32.dll991WaitMessage
USER32.dll522InflateRect
USER32.dll494GetWindowPlacement
USER32.dll496GetWindowRect
USER32.dll642MessageBeep
USER32.dll541InsertMenuItemW
USER32.dll113CreateMenu
USER32.dll656MoveWindow
USER32.dll565IsIconic
USER32.dll360GetKeyState
USER32.dll77ClientToScreen
USER32.dll393GetMessageW
USER32.dll455GetSystemMetrics
USER32.dll761ReleaseCapture
USER32.dll794SetCapture
USER32.dll841SetMenuItemInfoW
USER32.dll489GetWindowLongW
USER32.dll181DestroyWindow
USER32.dll546InvalidateRect
USER32.dll239EnableWindow
USER32.dll875SetTimer
USER32.dll592KillTimer
USER32.dll896SetWindowTextW
USER32.dll503GetWindowTextW
USER32.dll502GetWindowTextLengthW
USER32.dll821SetFocus
USER32.dll557IsChild
USER32.dll307GetClientRect
USER32.dll233EnableMenuItem
USER32.dll685PostMessageW
USER32.dll666OffsetRect
USER32.dll118CreateWindowExW
USER32.dll67CheckMenuItem
USER32.dll790SendMessageW
USER32.dll343GetFocus
USER32.dll168DeferWindowPos
msvcrt.dll927_wcstoi64
msvcrt.dll1117getenv
msvcrt.dll868_vsnprintf
msvcrt.dll738_spawnlp
msvcrt.dll475_itow_s
msvcrt.dll85_XcptFilter
msvcrt.dll175_amsg_exit
msvcrt.dll158__wgetmainargs
msvcrt.dll143__set_app_type
msvcrt.dll271_exit
msvcrt.dll194_cexit
msvcrt.dll1031_wtoi64
msvcrt.dll382_initterm
msvcrt.dll296_fmode
msvcrt.dll211_commode
msvcrt.dll487_lock
msvcrt.dll834_unlock
msvcrt.dll124__dllonexit
msvcrt.dll657_onexit
msvcrt.dll18public: virtual __cdecl type_info::~type_info(void) __ptr64

??1type_info@@UEAA@XZ

msvcrt.dll47void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll1175memset
msvcrt.dll1170memcmp
msvcrt.dll1173memmove
msvcrt.dll876_vsnwprintf_s
msvcrt.dll75_CxxThrowException
msvcrt.dll49public: virtual char const * __ptr64 __cdecl exception::what(void)const __ptr64

?what@exception@@UEBAPEBDXZ

msvcrt.dll87__C_specific_handler
msvcrt.dll1075exit
msvcrt.dll1194realloc
msvcrt.dll1135iswalnum
msvcrt.dll145__setusermatherr
msvcrt.dll1286wcscpy_s
msvcrt.dll11public: __cdecl exception::exception(char const * __ptr64 const & __ptr64, int) __ptr64

??0exception@@QEAA@AEBQEBDH@Z

msvcrt.dll10public: __cdecl exception::exception(char const * __ptr64 const & __ptr64) __ptr64

??0exception@@QEAA@AEBQEBD@Z

msvcrt.dll192_callnewh
msvcrt.dll1283wcscmp
msvcrt.dll940_wctime
msvcrt.dll1140iswdigit
msvcrt.dll973_wgetenv
msvcrt.dll1030_wtoi
msvcrt.dll474_itow
msvcrt.dll1260towlower
msvcrt.dll1143iswprint
msvcrt.dll1301wcsstr
msvcrt.dll12public: __cdecl exception::exception(class exception const & __ptr64) __ptr64

??0exception@@QEAA@AEBV0@@Z

msvcrt.dll17public: virtual __cdecl exception::~exception(void) __ptr64

??1exception@@UEAA@XZ

msvcrt.dll1136iswalpha
msvcrt.dll1261towupper
msvcrt.dll917_wcsnicmp
msvcrt.dll1297wcsrchr
msvcrt.dll671_purecall
msvcrt.dll35void __cdecl operator delete[](void * __ptr64)

??_V@YAXPEAX@Z

msvcrt.dll1303wcstok
msvcrt.dll902_wcsdup
msvcrt.dll1246swscanf
msvcrt.dll907_wcsicmp
msvcrt.dll1171memcpy
msvcrt.dll1308wcstoul
msvcrt.dll1145iswspace
msvcrt.dll1079fclose
msvcrt.dll1094fprintf
msvcrt.dll964_wfopen
msvcrt.dll1062calloc
msvcrt.dll874_vsnwprintf
msvcrt.dll1282wcschr
msvcrt.dll1292wcsncmp
msvcrt.dll1101free
msvcrt.dll1159malloc
msvcrt.dll20void __cdecl operator delete(void * __ptr64)

??3@YAXPEAX@Z

msvcrt.dll91__CxxFrameHandler3
ntdll.dll998RtlFindMessage
ntdll.dll761RtlCaptureContext
ntdll.dll1266RtlLookupFunctionEntry
ntdll.dll1585RtlVirtualUnwind
dbgeng.dll2DebugCreate
dbgeng.dll1DebugConnectWide
dbghelp.dll171SymMatchFileNameW
dbghelp.dll194SymSetParentWindow
ole32.dll145CoUninitialize
ole32.dll140CoTaskMemFree
ole32.dll43CoCreateInstance
ole32.dll97CoInitializeEx
SHELL32.dll356SHGetPathFromIDListW
SHELL32.dll42DragQueryFileW
SHELL32.dll424ShellAboutW
SHELL32.dll37DragAcceptFiles
SHELL32.dll137SHBrowseForFolderW
COMDLG32.dll12GetOpenFileNameW
COMDLG32.dll8FindTextW
COMDLG32.dll1ChooseColorW
COMDLG32.dll3ChooseFontW
COMDLG32.dll14GetSaveFileNameW
COMCTL32.dll106ImageList_LoadImageW
COMCTL32.dll78ImageList_Add
COMCTL32.dll84ImageList_Create
COMCTL32.dll12CreateStatusWindowW
COMCTL32.dll134PropertySheetW
COMCTL32.dll124InitCommonControlsEx
MPR.dll32WNetDisconnectDialog
MPR.dll28WNetConnectionDialog1W
WINMM.dll8PlaySoundW
PSAPI.DLL12GetMappedFileNameW
SHLWAPI.dll77PathFindFileNameW

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWindows GUI symbolic debugger
FileVersion10.0.20226.1000 (WinBuild.160101.0800)
InternalNamewindbg.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamewindbg.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion10.0.20226.1000

VS_FIXEDFILEINFO

FileVersion10.0.20226.1000
ProductVersion10.0.20226.1000
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0

Signers (1)

issuer: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Development PCA 2014
serial: 330000054BF9BA5F5E59831ABC00000000054B

Certificates (2)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:05:4b:f9:ba:5f:5e:59:83:1a:bc:00:00:00:00:05:4b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Development PCA 2014
        Validity
            Not Before: Apr  1 19:27:50 2020 GMT
            Not After : Jan 31 19:27:50 2021 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:99:ae:e3:58:c5:74:ee:1c:55:04:da:3c:96:b2:
                    9a:0e:4c:24:ea:7b:21:e1:54:10:ab:4d:e9:c8:7b:
                    6c:01:23:c1:e6:88:74:5d:8e:60:c8:99:2f:be:50:
                    79:cf:04:e2:2c:8f:12:1b:76:48:26:48:4f:17:00:
                    96:c4:87:99:91:43:f2:93:ef:f2:b5:22:82:23:d1:
                    26:9e:09:86:99:c0:fa:b1:9a:72:7c:89:9d:fd:55:
                    cb:7c:6e:24:a5:88:48:2b:e4:12:80:8b:d1:0f:a4:
                    80:dd:fa:a3:5c:82:01:be:5f:aa:bf:39:d0:f2:03:
                    9b:c0:80:0b:b2:93:cd:9f:45:10:ff:e8:76:58:a9:
                    7d:4d:4e:33:ba:ac:a6:b6:79:e5:57:3b:c5:56:4c:
                    ad:c0:45:a9:97:df:66:e5:06:ef:b0:21:81:f2:9f:
                    4f:2f:b3:fb:59:a1:4a:52:39:cb:32:39:36:d1:ff:
                    42:05:b3:0c:30:6f:d9:3d:b4:dc:da:b6:c5:93:d7:
                    f2:6b:88:62:f1:bc:2e:55:a3:e8:9f:d8:1c:62:5d:
                    04:cb:87:e9:75:fb:2d:da:e4:5f:c9:d9:e9:bd:4d:
                    5a:5d:1c:2b:7d:65:e1:d5:ec:89:dc:fd:b0:d3:ef:
                    a7:0f:7b:2d:99:19:87:56:0b:c8:80:9f:68:73:87:
                    5c:d5
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                1.3.6.1.4.1.311.10.3.13, 1.3.6.1.4.1.311.10.3.27, 1.3.6.1.4.1.311.61.6.1, Code Signing
            X509v3 Subject Key Identifier: 
                46:D3:A6:0C:6E:16:70:06:14:2E:C6:5E:36:52:AA:93:63:10:2C:BA
            X509v3 Subject Alternative Name: 
                DirName:/OU=Microsoft Corporation/serialNumber=231105\+459560
            X509v3 Authority Key Identifier: 
                84:DD:10:36:7B:0B:D2:08:A3:26:56:9F:22:95:25:41:85:2C:09:C0
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20Development%20PCA%202014.crl
            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20Development%20PCA%202014.crt
            X509v3 Basic Constraints: critical
                CA:FALSE
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        5b:77:71:37:36:98:a0:46:05:f7:4d:7f:b5:91:08:0a:c0:2b:
        00:be:a2:cb:fa:0f:27:20:01:6c:20:45:a3:75:78:fe:5a:f4:
        4d:33:25:df:ff:02:a2:c8:7a:82:7d:7c:2e:ee:71:48:f5:17:
        75:d7:0a:21:47:af:52:b7:19:ad:bf:fa:c9:06:9e:1a:b0:e2:
        ad:13:c4:06:f5:f3:d6:83:74:8a:48:fe:33:ac:be:d0:89:52:
        b9:77:6d:fa:14:c4:5e:cd:de:9c:6c:65:37:bc:1a:56:a0:55:
        cf:76:0c:3f:6f:c5:53:0d:8b:1f:6b:18:2f:ee:aa:75:a5:d2:
        01:c8:8c:6f:e4:02:1e:7b:51:59:85:df:09:4d:ee:6a:91:57:
        1b:87:e6:80:a2:2b:7d:86:63:9f:ed:96:0b:d7:69:47:71:2e:
        f1:4a:5f:7c:db:7b:8a:ba:c9:46:84:bd:e8:f9:09:04:5a:ff:
        0e:0e:10:3b:f8:02:f1:19:b2:ba:ee:32:49:c9:9d:f3:51:19:
        c5:71:a2:9c:86:3c:48:c2:f8:4e:da:f6:2a:d5:81:38:cf:9a:
        4a:5e:13:d9:d0:b7:4c:84:e9:8f:f1:a3:da:5c:32:ac:9c:39:
        77:2f:fc:1d:3a:30:87:8f:83:1b:0c:1b:c4:34:be:c4:dc:ae:
        7b:35:bd:d0:9b:78:44:a5:8c:6e:5c:9e:c4:f4:f3:32:0d:2e:
        7f:e1:69:cd:40:73:b2:99:45:43:d7:2b:51:17:4b:f0:78:79:
        94:28:7f:eb:8a:b2:84:68:3a:21:c3:25:07:ad:39:a9:d5:d6:
        0f:a1:89:5b:cd:88:a3:5b:84:41:10:dc:be:48:a5:21:a5:86:
        84:d8:2c:8e:6b:7a:65:e2:56:72:10:b3:0f:f8:e1:c5:6f:8d:
        bd:05:88:21:50:fb:2e:3f:a4:89:77:2c:82:f0:bf:a6:c4:43:
        2b:fb:90:46:a2:7f:bb:a6:d4:b7:8f:ae:2d:ac:ef:c8:8f:95:
        21:e9:aa:a0:34:43:66:24:34:e3:f4:c6:c8:69:2d:b7:19:ab:
        e3:dd:fc:77:aa:11:70:ed:d5:9e:c7:ea:1e:5e:99:c5:57:a9:
        66:03:fc:e9:cb:de:56:de:60:25:3d:0a:83:58:56:65:ff:34:
        ae:c3:8e:cc:a8:42:39:19:58:ea:66:a9:34:9d:25:d3:f0:3d:
        78:7d:c4:0e:15:3a:18:ee:da:29:d1:08:1d:bd:58:81:af:10:
        d9:a5:40:0d:db:79:95:3b:61:ba:37:84:8a:74:fc:a7:c4:20:
        2d:6e:4e:e2:7a:9d:e6:88:63:27:a4:b8:48:a5:f3:5b:de:9a:
        18:23:ce:c0:bc:5d:ee:8c

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:03:c6:f9:b4:c3:ae:be:59:4b:00:00:00:00:00:03
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Development Root Certificate Authority 2014
        Validity
            Not Before: May 28 17:33:33 2014 GMT
            Not After : May 28 17:43:33 2029 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Development PCA 2014
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:
                    00:cb:53:0c:41:f9:4d:44:24:c8:da:65:4e:66:6c:
                    c5:82:95:70:72:33:f3:b7:2e:86:ae:16:41:bc:dc:
                    d4:b8:69:fb:12:c0:94:be:af:94:c2:7f:76:9c:3c:
                    d3:54:d4:b5:88:ed:8f:b1:0c:1b:51:4a:8f:ea:90:
                    e3:ac:4e:f7:df:d2:12:7b:8e:7f:72:d0:35:3c:ac:
                    e8:e9:67:cc:e9:32:32:31:e8:43:5f:df:14:9a:40:
                    8f:18:0b:99:07:13:3b:71:92:9b:1d:19:f9:9b:95:
                    f7:4f:35:61:38:56:32:b2:ed:64:84:18:fa:5a:85:
                    b1:92:bf:01:b8:c6:96:93:04:3a:a8:ea:ec:82:ea:
                    cd:1e:82:c2:e6:00:e4:99:3d:89:a5:dd:71:20:9e:
                    88:dd:5e:4d:ad:6d:cf:09:f3:a8:a6:13:6f:0c:03:
                    e1:0c:2e:98:b4:c2:a3:07:9c:1a:6f:5f:d3:76:2f:
                    be:99:ee:95:c6:b0:94:5f:b1:b8:a6:4b:93:2f:02:
                    f1:cc:23:c2:43:96:38:a5:bf:9b:7c:2d:6c:1c:35:
                    47:b8:80:3c:e7:fa:9f:0c:9c:ef:df:5e:8c:cf:74:
                    0b:0c:33:97:7f:ea:04:d5:c5:33:d3:0f:9e:b0:90:
                    25:da:ba:fd:68:9e:c9:b4:01:6e:a9:ef:63:33:30:
                    e9:08:c8:eb:93:cf:5b:99:bf:a1:ca:54:3a:c0:8a:
                    1d:93:6c:8a:d0:bc:2f:c7:22:fe:40:e3:44:76:9a:
                    d2:94:df:17:65:4b:7b:26:80:ce:d9:47:33:4d:f5:
                    66:e4:fc:c6:cd:72:ac:7e:f1:70:92:83:3e:72:21:
                    90:c0:ec:8d:ff:59:b1:5b:b3:32:50:94:c5:c1:6c:
                    7b:6a:56:c8:f9:10:7c:4b:1a:9e:61:2c:a2:21:ee:
                    5f:9c:a4:64:ec:32:d2:b4:7b:9a:88:42:a9:2c:56:
                    2e:17:96:fe:93:2b:44:0c:5e:9f:23:ce:02:f6:3b:
                    89:98:c0:41:fc:41:d7:fa:28:7d:44:01:f2:91:b2:
                    d1:ba:62:9e:d8:05:63:06:56:a6:c2:18:01:66:fd:
                    bd:44:2b:4d:59:c2:f0:9b:2c:10:74:34:6f:20:a1:
                    2a:3d:58:ce:5c:f0:51:e1:25:a1:e9:bf:b3:35:71:
                    c9:0d:65:c5:6c:75:01:b7:c3:fc:b3:96:93:c2:d8:
                    af:4d:59:2a:fd:cc:cf:a6:f3:c3:b5:96:92:7a:ab:
                    b4:4a:ae:38:a2:02:3d:e6:91:90:dd:a3:ec:a9:25:
                    c9:08:c1:51:b1:a9:20:5c:8c:6a:3a:91:e7:09:12:
                    7f:ce:ca:78:cf:28:43:aa:74:0b:5c:9e:11:70:ff:
                    c4:59:35
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            1.3.6.1.4.1.311.21.1: 
                ...
            X509v3 Subject Key Identifier: 
                84:DD:10:36:7B:0B:D2:08:A3:26:56:9F:22:95:25:41:85:2C:09:C0
            X509v3 Certificate Policies: 
                Policy: X509v3 Any Policy
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            1.3.6.1.4.1.311.20.2: 
                .
.S.u.b.C.A
            X509v3 Key Usage: 
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier: 
                85:70:00:9F:77:59:1E:8C:AC:3C:9F:77:26:28:19:CC:9A:C1:8F:32
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20Development%20Root%20Certificate%20Authority%202014.crl
            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20Development%20Root%20Certificate%20Authority%202014.crt
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        4e:ea:1d:0c:fe:d3:82:d1:75:5f:f0:30:df:77:8d:ac:83:56:
        b0:34:cd:be:a7:07:f3:74:ac:ee:3c:4a:5d:1f:da:bd:2a:f6:
        68:fb:2a:37:43:97:09:79:2c:01:bd:a1:d4:9a:75:38:94:97:
        62:c8:eb:73:bc:89:94:43:cb:28:b4:4b:55:b9:f1:56:d5:24:
        e2:cb:a7:f0:46:40:d6:fe:30:fe:29:32:53:ed:39:21:03:73:
        30:95:2d:6a:b1:87:03:df:51:7c:f1:46:13:f9:f5:05:44:dd:
        0f:92:63:3a:71:cc:cf:a0:55:f1:6d:2d:95:21:e0:76:54:64:
        95:d9:66:8f:7f:6b:25:c5:8a:86:19:71:34:c5:53:22:f6:dc:
        55:9b:da:ba:e6:a5:f2:f7:f6:2c:76:46:d2:61:de:48:da:e3:
        70:1e:55:e0:31:8c:5b:f4:b3:c2:1d:fa:ff:7e:b1:8d:b5:de:
        fe:94:fd:01:4a:cb:fa:1f:4c:0d:b4:5a:72:22:82:b6:2b:23:
        53:0a:9d:2e:df:55:3d:fc:18:b3:32:5b:4e:b1:af:00:bf:9a:
        f8:91:56:2e:71:4e:44:52:c7:35:79:d3:75:4a:b8:44:a5:a5:
        f9:67:44:cf:27:30:dc:78:4f:7e:09:d5:a1:51:c0:6b:3f:8a:
        e3:59:0b:71:ef:ca:92:35:9d:d1:2a:b7:8c:75:20:43:92:74:
        2e:12:df:4e:7a:7b:59:a6:0c:65:87:ca:9b:69:53:75:22:ac:
        d9:f6:d9:0f:39:be:c6:93:49:e1:6d:d8:63:72:e5:86:5c:29:
        c7:d5:db:a5:f9:5e:93:39:b0:c5:84:c9:71:e2:15:54:a6:cc:
        8a:a9:1e:46:24:4d:e4:3c:9f:c1:05:df:8c:34:33:6e:05:c1:
        a1:40:d9:a8:0b:95:49:73:0c:03:4f:cc:c3:7c:52:23:de:a4:
        36:c5:cd:82:3d:cb:f8:f0:12:7c:d8:1c:2d:5d:b7:ba:05:7e:
        c0:0e:19:9f:52:7b:53:3f:06:9a:bd:94:27:62:4f:55:03:96:
        e2:89:af:f3:cc:67:95:30:2d:1a:b4:00:bb:55:c7:6f:8b:90:
        7d:4d:4f:2c:42:50:84:63:3e:2b:76:c3:04:f7:56:e0:e0:31:
        76:50:e5:02:0c:00:aa:0e:4f:f4:a4:29:1f:12:96:62:a8:64:
        dc:f1:c3:0e:26:d7:62:e3:c6:ad:a4:68:00:67:30:41:01:17:
        1f:df:61:64:8b:83:1d:37:ba:82:f1:68:9d:b4:69:9f:ad:82:
        dc:db:13:52:d6:4c:55:0b:0c:cd:f3:d5:b9:59:c6:f7:71:8b:
        7d:ff:71:5e:3d:d9:de:00
pkcs7-signedData
  • 1
    • SHA256: nil
    • 1.3.6.1.4.1.311.2.1.4
      • #0
        • 1.3.6.1.4.1.311.2.1.15
          • :
        • SHA256
          • 40 8a c1 8c 6c 05 e7 55  90 cd 79 e9 85 85 8d af  |@...l..U..y.....|
9c 3b 5b 7b 91 80 e1 51  ed 26 a8 7e 74 9a 21 4b  |.;[{...Q.&.~t.!K|
    • Certificates
      • Certificate #0
        • 2
          • 33:00:00:05:4B:F9:BA:5F:5E:59:83:1A:BC:00:00:00:
            00:05:4B
          • RSA-SHA256: nil
          • Issuer
            • C: US
            • ST: Washington
            • L: Redmond
            • O: Microsoft Corporation
            • CN: Microsoft Development PCA 2014
          • 2020-04-01 19:27:50 UTC: 2021-01-31 19:27:50 UTC
          • Subject
            • C: US
            • ST: Washington
            • L: Redmond
            • O: Microsoft Corporation
            • CN: Microsoft Corporation
          • #5
            • rsaEncryption: nil
            • 99:AE:E3:58:C5:74:EE:1C:55:04:DA:3C:96:B2:9A:0E:
              4C:24:EA:7B:21:E1:54:10:AB:4D:E9:C8:7B:6C:01:23:
              C1:E6:88:74:5D:8E:60:C8:99:2F:BE:50:79:CF:04:E2:
              2C:8F:12:1B:76:48:26:48:4F:17:00:96:C4:87:99:91:
              43:F2:93:EF:F2:B5:22:82:23:D1:26:9E:09:86:99:C0:
              FA:B1:9A:72:7C:89:9D:FD:55:CB:7C:6E:24:A5:88:48:
              2B:E4:12:80:8B:D1:0F:A4:80:DD:FA:A3:5C:82:01:BE:
              5F:AA:BF:39:D0:F2:03:9B:C0:80:0B:B2:93:CD:9F:45:
              10:FF:E8:76:58:A9:7D:4D:4E:33:BA:AC:A6:B6:79:E5:
              57:3B:C5:56:4C:AD:C0:45:A9:97:DF:66:E5:06:EF:B0:
              21:81:F2:9F:4F:2F:B3:FB:59:A1:4A:52:39:CB:32:39:
              36:D1:FF:42:05:B3:0C:30:6F:D9:3D:B4:DC:DA:B6:C5:
              93:D7:F2:6B:88:62:F1:BC:2E:55:A3:E8:9F:D8:1C:62:
              5D:04:CB:87:E9:75:FB:2D:DA:E4:5F:C9:D9:E9:BD:4D:
              5A:5D:1C:2B:7D:65:E1:D5:EC:89:DC:FD:B0:D3:EF:A7:
              0F:7B:2D:99:19:87:56:0B:C8:80:9F:68:73:87:5C:D5              : 0x010001
          • #6
            • extendedKeyUsage
              • 1.3.6.1.4.1.311.10.3.13: 1.3.6.1.4.1.311.10.3.27, 1.3.6.1.4.1.311.61.6.1, codeSigning
            • subjectKeyIdentifier: 
              46 d3 a6 0c 6e 16 70 06  14 2e c6 5e 36 52 aa 93  |F...n.p....^6R..|
63 10 2c ba                                       |c.,.            |
            • subjectAltName
              • #0
                • OU: Microsoft Corporation
                • serialNumber: 231105+459560
            • authorityKeyIdentifier: 
              84 dd 10 36 7b 0b d2 08  a3 26 56 9f 22 95 25 41  |...6{....&V.".%A|
85 2c 09 c0                                       |.,..            |
            • crlDistributionPoints: http://www.microsoft.com/pkiops/crl/Microsoft%20Development%20PCA%202014.crl
            • authorityInfoAccess
              • caIssuers: http://www.microsoft.com/pkiops/certs/Microsoft%20Development%20PCA%202014.crt
            • basicConstraints
              • true
              • nil
        • RSA-SHA256: 
          5b 77 71 37 36 98 a0 46  05 f7 4d 7f b5 91 08 0a  |[wq76..F..M.....|
c0 2b 00 be a2 cb fa 0f  27 20 01 6c 20 45 a3 75  |.+......' .l E.u|
78 fe 5a f4 4d 33 25 df  ff 02 a2 c8 7a 82 7d 7c  |x.Z.M3%.....z.}||
2e ee 71 48 f5 17 75 d7  0a 21 47 af 52 b7 19 ad  |..qH..u..!G.R...|
bf fa c9 06 9e 1a b0 e2  ad 13 c4 06 f5 f3 d6 83  |................|
74 8a 48 fe 33 ac be d0  89 52 b9 77 6d fa 14 c4  |t.H.3....R.wm...|
5e cd de 9c 6c 65 37 bc  1a 56 a0 55 cf 76 0c 3f  |^...le7..V.U.v.?|
6f c5 53 0d 8b 1f 6b 18  2f ee aa 75 a5 d2 01 c8  |o.S...k./..u....|
8c 6f e4 02 1e 7b 51 59  85 df 09 4d ee 6a 91 57  |.o...{QY...M.j.W|
1b 87 e6 80 a2 2b 7d 86  63 9f ed 96 0b d7 69 47  |.....+}.c.....iG|
71 2e f1 4a 5f 7c db 7b  8a ba c9 46 84 bd e8 f9  |q..J_|.{...F....|
09 04 5a ff 0e 0e 10 3b  f8 02 f1 19 b2 ba ee 32  |..Z....;.......2|
49 c9 9d f3 51 19 c5 71  a2 9c 86 3c 48 c2 f8 4e  |I...Q..q...
      • Certificate #1
        • 2
          • 33:00:00:00:03:C6:F9:B4:C3:AE:BE:59:4B:00:00:00:
            00:00:03
          • RSA-SHA256: nil
          • Issuer
            • C: US
            • ST: Washington
            • L: Redmond
            • O: Microsoft Corporation
            • CN: Microsoft Development Root Certificate Authority 2014
          • 2014-05-28 17:33:33 UTC: 2029-05-28 17:43:33 UTC
          • Subject
            • C: US
            • ST: Washington
            • L: Redmond
            • O: Microsoft Corporation
            • CN: Microsoft Development PCA 2014
          • #5
            • rsaEncryption: nil
            • CB:53:0C:41:F9:4D:44:24:C8:DA:65:4E:66:6C:C5:82:
              95:70:72:33:F3:B7:2E:86:AE:16:41:BC:DC:D4:B8:69:
              FB:12:C0:94:BE:AF:94:C2:7F:76:9C:3C:D3:54:D4:B5:
              88:ED:8F:B1:0C:1B:51:4A:8F:EA:90:E3:AC:4E:F7:DF:
              D2:12:7B:8E:7F:72:D0:35:3C:AC:E8:E9:67:CC:E9:32:
              32:31:E8:43:5F:DF:14:9A:40:8F:18:0B:99:07:13:3B:
              71:92:9B:1D:19:F9:9B:95:F7:4F:35:61:38:56:32:B2:
              ED:64:84:18:FA:5A:85:B1:92:BF:01:B8:C6:96:93:04:
              3A:A8:EA:EC:82:EA:CD:1E:82:C2:E6:00:E4:99:3D:89:
              A5:DD:71:20:9E:88:DD:5E:4D:AD:6D:CF:09:F3:A8:A6:
              13:6F:0C:03:E1:0C:2E:98:B4:C2:A3:07:9C:1A:6F:5F:
              D3:76:2F:BE:99:EE:95:C6:B0:94:5F:B1:B8:A6:4B:93:
              2F:02:F1:CC:23:C2:43:96:38:A5:BF:9B:7C:2D:6C:1C:
              35:47:B8:80:3C:E7:FA:9F:0C:9C:EF:DF:5E:8C:CF:74:
              0B:0C:33:97:7F:EA:04:D5:C5:33:D3:0F:9E:B0:90:25:
              DA:BA:FD:68:9E:C9:B4:01:6E:A9:EF:63:33:30:E9:08:
              C8:EB:93:CF:5B:99:BF:A1:CA:54:3A:C0:8A:1D:93:6C:
              8A:D0:BC:2F:C7:22:FE:40:E3:44:76:9A:D2:94:DF:17:
              65:4B:7B:26:80:CE:D9:47:33:4D:F5:66:E4:FC:C6:CD:
              72:AC:7E:F1:70:92:83:3E:72:21:90:C0:EC:8D:FF:59:
              B1:5B:B3:32:50:94:C5:C1:6C:7B:6A:56:C8:F9:10:7C:
              4B:1A:9E:61:2C:A2:21:EE:5F:9C:A4:64:EC:32:D2:B4:
              7B:9A:88:42:A9:2C:56:2E:17:96:FE:93:2B:44:0C:5E:
              9F:23:CE:02:F6:3B:89:98:C0:41:FC:41:D7:FA:28:7D:
              44:01:F2:91:B2:D1:BA:62:9E:D8:05:63:06:56:A6:C2:
              18:01:66:FD:BD:44:2B:4D:59:C2:F0:9B:2C:10:74:34:
              6F:20:A1:2A:3D:58:CE:5C:F0:51:E1:25:A1:E9:BF:B3:
              35:71:C9:0D:65:C5:6C:75:01:B7:C3:FC:B3:96:93:C2:
              D8:AF:4D:59:2A:FD:CC:CF:A6:F3:C3:B5:96:92:7A:AB:
              B4:4A:AE:38:A2:02:3D:E6:91:90:DD:A3:EC:A9:25:C9:
              08:C1:51:B1:A9:20:5C:8C:6A:3A:91:E7:09:12:7F:CE:
              CA:78:CF:28:43:AA:74:0B:5C:9E:11:70:FF:C4:59:35              : 0x010001
          • #6
            • 1.3.6.1.4.1.311.21.1: 0
            • subjectKeyIdentifier: 
              84 dd 10 36 7b 0b d2 08  a3 26 56 9f 22 95 25 41  |...6{....&V.".%A|
85 2c 09 c0                                       |.,..            |
            • certificatePolicies
              • anyPolicy
                • 1.3.6.1.4.1.311.76.509.1.1
                  • id-qt-cps: http://www.microsoft.com/pkiops/Docs/Repository.htm
            • 1.3.6.1.4.1.311.20.2: 
              00 53 00 75 00 62 00 43  00 41                    |.S.u.b.C.A      |
            • keyUsage: 0x86
            • basicConstraints: true, true
            • authorityKeyIdentifier: 
              85 70 00 9f 77 59 1e 8c  ac 3c 9f 77 26 28 19 cc  |.p..wY...<.w&(..|
9a c1 8f 32                                       |...2            |
            • crlDistributionPoints: http://www.microsoft.com/pkiops/crl/Microsoft%20Development%20Root%20Certificate%20Authority%202014.crl
            • authorityInfoAccess
              • caIssuers: http://www.microsoft.com/pkiops/certs/Microsoft%20Development%20Root%20Certificate%20Authority%202014.crt
        • RSA-SHA256: 
          4e ea 1d 0c fe d3 82 d1  75 5f f0 30 df 77 8d ac  |N.......u_.0.w..|
83 56 b0 34 cd be a7 07  f3 74 ac ee 3c 4a 5d 1f  |.V.4.....t..+v...V..1|
76 50 e5 02 0c 00 aa 0e  4f f4 a4 29 1f 12 96 62  |vP......O..)...b|
a8 64 dc f1 c3 0e 26 d7  62 e3 c6 ad a4 68 00 67  |.d....&.b....h.g|
30 41 01 17 1f df 61 64  8b 83 1d 37 ba 82 f1 68  |0A....ad...7...h|
9d b4 69 9f ad 82 dc db  13 52 d6 4c 55 0b 0c cd  |..i......R.LU...|
f3 d5 b9 59 c6 f7 71 8b  7d ff 71 5e 3d d9 de 00  |...Y..q.}.q^=...|
    • Signer
      • 1
      • unnamed
        • #0
          • C: US
          • ST: Washington
          • L: Redmond
          • O: Microsoft Corporation
          • CN: Microsoft Development PCA 2014
        • 33:00:00:05:4B:F9:BA:5F:5E:59:83:1A:BC:00:00:00:
          00:05:4B
      • SHA256: nil
      • #3
        • contentType: 1.3.6.1.4.1.311.2.1.4
        • 1.3.6.1.4.1.311.2.1.11: msCodeInd
        • messageDigest: 
          06 13 b7 11 9e 44 c4 19  98 b9 09 be 10 34 19 55  |.....D.......4.U|
93 ab d7 da b8 c5 d8 44  a0 6a 9c 7a ab 30 4b a2  |.......D.j.z.0K.|
        • 1.3.6.1.4.1.311.10.3.28: sPY7xPB7hT5g5HHrYt8rDLSM9VuZRuWZaef2e22Rs54=
        • 1.3.6.1.4.1.311.2.1.12
          • 00 4d 00 69 00 63 00 72  00 6f 00 73 00 6f 00 66  |.M.i.c.r.o.s.o.f|
00 74 00 20 00 57 00 69  00 6e 00 64 00 6f 00 77  |.t. .W.i.n.d.o.w|
00 73                                             |.s              |
            : http://www.microsoft.com/windows
      • rsaEncryption: 
        0d 34 e8 2f 3c 31 06 9f  2a cb 60 c0 4a b3 c9 22  |.4./<1..*.`.J.."|
c1 60 0b 93 bb df 03 c4  56 b3 20 1f 27 c0 dc 5b  |.`......V. .'..[|
89 a1 a5 4b 9a 71 d1 4c  d9 0c 5c 56 cc e5 66 c2  |...K.q.L..\V..f.|
cc 3a c6 ea fe 64 73 9d  7d 79 a9 d2 54 d2 42 68  |.:...ds.}y..T.Bh|
63 45 05 83 82 c4 21 87  ba b0 c5 a3 d6 e4 20 06  |cE....!....... .|
96 9b 7f 6f a1 14 00 1d  7b 8f cd 38 9b 1a 4e 47  |...o....{..8..NG|
27 1a ce d4 a6 9b b3 20  0f 78 61 97 5a 65 0e 39  |'...... .xa.Ze.9|
d9 22 d9 01 16 d8 dc 69  58 92 8e fc 22 ac 52 59  |.".....iX...".RY|
17 a4 11 d4 03 d9 df 70  4c ba 0b f7 fc c4 e0 71  |.......pL......q|
6a 84 8e 20 37 77 f8 7e  30 96 4a 99 cf 7c a5 ee  |j.. 7w.~0.J..|..|
92 b7 14 ed a9 81 00 65  b4 36 c7 55 8d f9 fe 5c  |.......e.6.U...\|
62 d0 01 7a 83 cf 6a ed  82 e3 c7 6c 9a 9e d2 d5  |b..z..j....l....|
ee a4 42 f2 c8 95 e2 42  b3 a8 cd fe 25 0e 5e 72  |..B....B....%.^r|
12 38 6a bc 19 b7 60 0c  f7 ea 13 19 3d 51 cc 24  |.8j...`.....=Q.$|
8b 6b 76 5f e8 3d ce 13  44 cc b9 c2 05 5d 47 ae  |.kv_.=..D....]G.|
bc 81 12 fe b2 8a 19 4b  08 1b be be ce 52 db e4  |.......K.....R..|
offsetsizetypecomment
15c115HTM#
818f019996PNG(992 x 32)#
8670c47636BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK