devenv.exe - Microsoft Visual Studio 2017

info
MZ
PE
resources
strings
imports
exports
foremost
version info
signature
hexdump
disasm
log
discuss
donate

filename	devenv.exe
size	723280 (0xb0950)
md5	eeeaa2d4465cab3b9a5ef16e57af5ddf

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x118

Rich Header

lib id	version	times used
206	65501	5
260	25025	13
147	30729	18
257	24723	4
259	24723	7
260	24723	14
261	25025	50
203	65501	25
1	0	616
261	24723	40
265	25025	71
256	25025	1
255	25025	1
258	25025	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	8
TimeDateStamp	0x5bac42a4
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x122
Magic	0x10b
LinkerVersion	14.10
SizeOfCode	0x63e00
SizeOfInitializedData	0x49200
SizeOfUninitializedData	0
AddressOfEntryPoint	0x27e36
BaseOfCode	0x1000
BaseOfData	0x65000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	10.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0xb3000
SizeOfHeaders	0x400
CheckSum	0xc028f
Subsystem	2
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x2000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x63d8c	0x63e00	R-X CODE
.data	0x65000	0x23b0	0x1a00	RW- IDATA
.idata	0x68000	0x398a	0x3a00	R-- IDATA
.tls	0x6c000	9	0x200	RW- IDATA
.detourc	0x6d000	0x1190	0x1200	R-- IDATA
.detourd	0x6f000	0xc	0x200	RW- IDATA
.rsrc	0x70000	0x3cb10	0x3cc00	R-- IDATA
.reloc	0xad000	0x51fc	0x5200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x1080	0x10c
IMPORT	0x687e8	0x1cc
RESOURCE	0x70000	0x3cb10
EXCEPTION	0	0
SECURITY	0xaca00	0x3f50
BASERELOC	0xad000	0x51fc
DEBUG	0x64cd4	0x54
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x3caec	0x18
LOAD_CONFIG	0x3b580	0x40
Bound_IAT	0	0
IAT	0x68000	0x7e4
Delay_IAT	0x64bfc	0x40
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x46c000	0x46c008	0x465160	0x43cb08	0	0x300000

show previews

type	name	size	cp
XSLT	#101	4284	1252
ICON	#1	5551	1252
ICON	#2	16936	1252
ICON	#3	9640	1252
ICON	#4	6760	1252
ICON	#5	4264	1252
ICON	#6	2440	1252
ICON	#7	1128	1252
ICON	#8	3809	1252
ICON	#9	3752	1252
ICON	#10	2216	1252
ICON	#11	1384	1252
ICON	#12	4083	1252
ICON	#13	16936	1252
ICON	#14	9640	1252
ICON	#15	4264	1252
ICON	#16	1128	1252
ICON	#17	4129	1252
ICON	#18	3752	1252
ICON	#19	2216	1252
ICON	#20	1384	1252
ICON	#21	4486	1252
ICON	#22	16936	1252
ICON	#23	9640	1252
ICON	#24	4264	1252
ICON	#25	1128	1252
ICON	#26	4189	1252
ICON	#27	3752	1252
ICON	#28	2216	1252
ICON	#29	1384	1252
ICON	#30	3829	1252
ICON	#31	16936	1252
ICON	#32	9640	1252
ICON	#33	4264	1252
ICON	#34	1128	1252
ICON	#35	3952	1252
ICON	#36	3752	1252
ICON	#37	2216	1252
ICON	#38	1384	1252
ICON	#39	4339	1252
ICON	#40	16936	1252
ICON	#41	9640	1252
ICON	#42	4264	1252
ICON	#43	1128	1252
STRING	#415	866	1252
MESSAGETABLE	#1	32	1252
GROUP_ICON	#1200	104	1252
GROUP_ICON	#1202	132	1252
GROUP_ICON	#1203	132	1252
GROUP_ICON	#1204	132	1252
GROUP_ICON	#6826	132	1252
VERSION	#1	892	1252
MANIFEST	#1	2310	1252

id	lang	string
6630	1033	Microsoft Visual Studio 2017
6631	1033	Cannot find one or more components. Please reinstall the application.
6633	1033	DevEnv
6634	1033	M18,-0.000299999999999301L18,19.4847 0,17.9377 0,18.4997 18,23.9997 24,21.5057 24,2.4947z M6.187,8.9537L2.867,6.4517 1.5,6.9097 1.5,13.5907 2.867,14.0487 6.187,11.5467 11.699,16.9997 14.999,15.5957 14.999,4.9037 11.699,3.4997z M7.906,10.2497L11.699,7.3917 11.699,13.1087z M2.867,8.2627L4.876,10.2497 2.867,12.2377z

module_name	hint	ord	function_name
ADVAPI32.dll	616		RegDeleteKeyW
ADVAPI32.dll	620		RegDeleteValueW
ADVAPI32.dll	596		RegCloseKey
ADVAPI32.dll	605		RegCreateKeyExW
ADVAPI32.dll	645		RegOpenKeyExW
ADVAPI32.dll	674		RegSetValueExW
ADVAPI32.dll	652		RegQueryInfoKeyW
ADVAPI32.dll	627		RegEnumKeyExW
ADVAPI32.dll	658		RegQueryValueExW
ADVAPI32.dll	199		CryptDestroyKey
ADVAPI32.dll	219		CryptReleaseContext
ADVAPI32.dll	628		RegEnumKeyW
ADVAPI32.dll	630		RegEnumValueW
ADVAPI32.dll	193		CryptAcquireContextW
ADVAPI32.dll	218		CryptImportKey
ADVAPI32.dll	195		CryptCreateHash
ADVAPI32.dll	216		CryptHashData
ADVAPI32.dll	230		CryptVerifySignatureW
ADVAPI32.dll	287		EventProviderEnabled
ADVAPI32.dll	291		EventWrite
ADVAPI32.dll	288		EventRegister
ADVAPI32.dll	651		RegQueryInfoKeyA
ADVAPI32.dll	629		RegEnumValueA
ADVAPI32.dll	626		RegEnumKeyExA
ADVAPI32.dll	617		RegDeleteTreeA
ADVAPI32.dll	619		RegDeleteValueA
ADVAPI32.dll	611		RegDeleteKeyExW
ADVAPI32.dll	610		RegDeleteKeyExA
ADVAPI32.dll	657		RegQueryValueExA
ADVAPI32.dll	644		RegOpenKeyExA
ADVAPI32.dll	604		RegCreateKeyExA
ADVAPI32.dll	636		RegLoadAppKeyW
ADVAPI32.dll	618		RegDeleteTreeW
ADVAPI32.dll	668		RegSaveKeyW
ADVAPI32.dll	632		RegGetKeySecurity
ADVAPI32.dll	31		AdjustTokenPrivileges
ADVAPI32.dll	429		LookupPrivilegeValueW
ADVAPI32.dll	129		ConvertStringSecurityDescriptorToSecurityDescriptorW
ADVAPI32.dll	123		ConvertSidToStringSidW
ADVAPI32.dll	412		IsValidSid
ADVAPI32.dll	367		GetTokenInformation
ADVAPI32.dll	530		OpenProcessToken
ADVAPI32.dll	696		RevertToSelf
ADVAPI32.dll	393		ImpersonateLoggedOnUser
ADVAPI32.dll	307		FreeSid
ADVAPI32.dll	95		CheckTokenMembership
ADVAPI32.dll	32		AllocateAndInitializeSid
ADVAPI32.dll	614		RegDeleteKeyValueA
ADVAPI32.dll	615		RegDeleteKeyValueW
ADVAPI32.dll	609		RegDeleteKeyA
ADVAPI32.dll	198		CryptDestroyHash
ADVAPI32.dll	290		EventUnregister
KERNEL32.dll	259		DeleteAtom
KERNEL32.dll	841		InitializeCriticalSectionEx
KERNEL32.dll	1370		SwitchToThread
KERNEL32.dll	973		MoveFileW
KERNEL32.dll	722		GetSystemPreferredUILanguages
KERNEL32.dll	715		GetSystemDefaultUILanguage
KERNEL32.dll	349		FileTimeToSystemTime
KERNEL32.dll	820		HeapLock
KERNEL32.dll	826		HeapUnlock
KERNEL32.dll	1392		Thread32Next
KERNEL32.dll	1013		OpenThread
KERNEL32.dll	1391		Thread32First
KERNEL32.dll	241		CreateToolhelp32Snapshot
KERNEL32.dll	1449		WaitForSingleObject
KERNEL32.dll	232		CreateThread
KERNEL32.dll	1191		ResumeThread
KERNEL32.dll	1331		SetThreadPriority
KERNEL32.dll	720		GetSystemInfo
KERNEL32.dll	1261		SetEnvironmentVariableW
KERNEL32.dll	717		GetSystemDirectoryW
KERNEL32.dll	818		HeapDestroy
KERNEL32.dll	824		HeapSize
KERNEL32.dll	822		HeapReAlloc
KERNEL32.dll	819		HeapFree
KERNEL32.dll	815		HeapAlloc
KERNEL32.dll	674		GetProcessHeap
KERNEL32.dll	592		GetLastError
KERNEL32.dll	293		EnterCriticalSection
KERNEL32.dll	930		LeaveCriticalSection
KERNEL32.dll	1002		OpenMutexW
KERNEL32.dll	767		GetUserDefaultUILanguage
KERNEL32.dll	360		FindClose
KERNEL32.dll	383		FindNextFileW
KERNEL32.dll	371		FindFirstFileW
KERNEL32.dll	773		GetVersionExW
KERNEL32.dll	143		CompareFileTime
KERNEL32.dll	219		CreateProcessW
KERNEL32.dll	457		GetCommandLineW
KERNEL32.dll	565		GetFileAttributesW
KERNEL32.dll	1371		SystemTimeToFileTime
KERNEL32.dll	724		GetSystemTime
KERNEL32.dll	1360		Sleep
KERNEL32.dll	1544		lstrlenA
KERNEL32.dll	1483		WideCharToMultiByte
KERNEL32.dll	553		GetEnvironmentVariableW
KERNEL32.dll	754		GetTickCount
KERNEL32.dll	936		LoadLibraryW
KERNEL32.dll	1503		WriteFile
KERNEL32.dll	1103		ReadFile
KERNEL32.dll	194		CreateFileW
KERNEL32.dll	1018		OutputDebugStringW
KERNEL32.dll	702		GetStartupInfoW
KERNEL32.dll	871		IsDebuggerPresent
KERNEL32.dll	843		InitializeSListHead
KERNEL32.dll	726		GetSystemTimeAsFileTime
KERNEL32.dll	526		GetCurrentThreadId
KERNEL32.dll	522		GetCurrentProcessId
KERNEL32.dll	1069		QueryPerformanceCounter
KERNEL32.dll	877		IsProcessorFeaturePresent
KERNEL32.dll	1375		TerminateProcess
KERNEL32.dll	1345		SetUnhandledExceptionFilter
KERNEL32.dll	1408		UnhandledExceptionFilter
KERNEL32.dll	182		CreateEventW
KERNEL32.dll	1450		WaitForSingleObjectEx
KERNEL32.dll	1185		ResetEvent
KERNEL32.dll	1263		SetEvent
KERNEL32.dll	414		FreeLibrary
KERNEL32.dll	669		GetProcAddress
KERNEL32.dll	615		GetModuleHandleW
KERNEL32.dll	1536		lstrcmpiW
KERNEL32.dll	1087		RaiseException
KERNEL32.dll	977		MultiByteToWideChar
KERNEL32.dll	1359		SizeofResource
KERNEL32.dll	939		LoadResource
KERNEL32.dll	393		FindResourceW
KERNEL32.dll	935		LoadLibraryExW
KERNEL32.dll	611		GetModuleFileNameW
KERNEL32.dll	823		HeapSetInformation
KERNEL32.dll	1255		SetDllDirectoryW
KERNEL32.dll	254		DecodePointer
KERNEL32.dll	127		CloseHandle
KERNEL32.dll	1464		WerRegisterRuntimeExceptionModule
KERNEL32.dll	1471		WerUnregisterRuntimeExceptionModule
KERNEL32.dll	957		LockResource
KERNEL32.dll	704		GetStdHandle
KERNEL32.dll	261		DeleteCriticalSection
KERNEL32.dll	976		MulDiv
KERNEL32.dll	839		InitializeCriticalSection
KERNEL32.dll	144		CompareStringA
KERNEL32.dll	405		FlushViewOfFile
KERNEL32.dll	614		GetModuleHandleExW
KERNEL32.dll	178		CreateDirectoryW
KERNEL32.dll	1432		VerifyVersionInfoW
KERNEL32.dll	1428		VerSetConditionMask
KERNEL32.dll	666		GetPrivateProfileStringW
KERNEL32.dll	147		CompareStringW
KERNEL32.dll	772		GetVersionExA
KERNEL32.dll	521		GetCurrentProcess
KERNEL32.dll	287		DuplicateHandle
KERNEL32.dll	1312		SetStdHandle
KERNEL32.dll	392		FindResourceExW
KERNEL32.dll	1460		WerRegisterFile
KERNEL32.dll	1442		VirtualQueryEx
KERNEL32.dll	1333		SetThreadStackGuarantee
KERNEL32.dll	289		EncodePointer
KERNEL32.dll	802		GlobalLock
KERNEL32.dll	809		GlobalUnlock
KERNEL32.dll	1411		UnmapViewOfFile
KERNEL32.dll	791		GlobalAlloc
KERNEL32.dll	798		GlobalFree
KERNEL32.dll	191		CreateFileMappingW
KERNEL32.dll	960		MapViewOfFile
KERNEL32.dll	612		GetModuleHandleA
KERNEL32.dll	266		DeleteFileW
KERNEL32.dll	1275		SetFilePointer
KERNEL32.dll	946		LocalFree
KERNEL32.dll	994		OpenEventW
KERNEL32.dll	525		GetCurrentThread
KERNEL32.dll	1368		SuspendThread
KERNEL32.dll	740		GetThreadContext
KERNEL32.dll	1322		SetThreadContext
KERNEL32.dll	403		FlushInstructionCache
KERNEL32.dll	1433		VirtualAlloc
KERNEL32.dll	1436		VirtualFree
KERNEL32.dll	1439		VirtualProtect
KERNEL32.dll	1441		VirtualQuery
KERNEL32.dll	1290		SetLastError
KERNEL32.dll	934		LoadLibraryExA
KERNEL32.dll	1006		OpenProcess
KERNEL32.dll	5		AddAtomW
KERNEL32.dll	359		FindAtomW
KERNEL32.dll	562		GetFileAttributesExW
KERNEL32.dll	366		FindFirstFileExW
KERNEL32.dll	341		ExpandEnvironmentStringsW
KERNEL32.dll	585		GetFullPathNameW
KERNEL32.dll	605		GetLongPathNameW
KERNEL32.dll	739		GetTempPathW
KERNEL32.dll	737		GetTempFileNameW
KERNEL32.dll	165		CopyFileW
KERNEL32.dll	225		CreateSemaphoreW
KERNEL32.dll	1167		ReleaseSemaphore
KERNEL32.dll	1545		lstrlenW
KERNEL32.dll	209		CreateMutexW
KERNEL32.dll	1163		ReleaseMutex
KERNEL32.dll	402		FlushFileBuffers
KERNEL32.dll	186		CreateFileA
KERNEL32.dll	420		GetACP
KERNEL32.dll	882		IsValidCodePage
KERNEL32.dll	571		GetFileSize
VCRUNTIME140.dll	64		_set_purecall_handler
VCRUNTIME140.dll	70		memcpy
VCRUNTIME140.dll	53		_except_handler4_common
VCRUNTIME140.dll	48		__vcrt_InitializeCriticalSectionEx
VCRUNTIME140.dll	16		__CxxFrameHandler3
VCRUNTIME140.dll	35		__std_terminate
VCRUNTIME140.dll	33		__std_exception_copy
VCRUNTIME140.dll	34		__std_exception_destroy
VCRUNTIME140.dll	72		memset
VCRUNTIME140.dll	69		memcmp
VCRUNTIME140.dll	61		_purecall
VCRUNTIME140.dll	80		wcsstr
VCRUNTIME140.dll	71		memmove
VCRUNTIME140.dll	79		wcsrchr
VCRUNTIME140.dll	78		wcschr
VCRUNTIME140.dll	1		_CxxThrowException
api-ms-win-crt-heap-l1-1-0.dll	8		_callnewh
api-ms-win-crt-heap-l1-1-0.dll	21		_recalloc
api-ms-win-crt-heap-l1-1-0.dll	24		free
api-ms-win-crt-heap-l1-1-0.dll	22		_set_new_mode
api-ms-win-crt-heap-l1-1-0.dll	25		malloc
api-ms-win-crt-heap-l1-1-0.dll	23		calloc
api-ms-win-crt-runtime-l1-1-0.dll	54		_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll	25		_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll	53		_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll	45		_get_narrow_winmain_command_line
api-ms-win-crt-runtime-l1-1-0.dll	56		_initterm
api-ms-win-crt-runtime-l1-1-0.dll	57		_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll	88		exit
api-ms-win-crt-runtime-l1-1-0.dll	37		_exit
api-ms-win-crt-runtime-l1-1-0.dll	23		_cexit
api-ms-win-crt-runtime-l1-1-0.dll	22		_c_exit
api-ms-win-crt-runtime-l1-1-0.dll	63		_register_thread_local_exe_atexit_callback
api-ms-win-crt-runtime-l1-1-0.dll	59		_invalid_parameter_noinfo_noreturn
api-ms-win-crt-runtime-l1-1-0.dll	58		_invalid_parameter_noinfo
api-ms-win-crt-runtime-l1-1-0.dll	31		_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll	35		_errno
api-ms-win-crt-runtime-l1-1-0.dll	106		terminate
api-ms-win-crt-runtime-l1-1-0.dll	29		_controlfp_s
api-ms-win-crt-runtime-l1-1-0.dll	68		_set_app_type
api-ms-win-crt-runtime-l1-1-0.dll	66		_seh_filter_exe
api-ms-win-crt-runtime-l1-1-0.dll	64		_resetstkoflw
api-ms-win-crt-runtime-l1-1-0.dll	62		_register_onexit_function
api-ms-win-crt-string-l1-1-0.dll	95		_wcsupr_s
api-ms-win-crt-string-l1-1-0.dll	84		_wcsnicmp
api-ms-win-crt-string-l1-1-0.dll	123		iswspace
api-ms-win-crt-string-l1-1-0.dll	151		tolower
api-ms-win-crt-string-l1-1-0.dll	155		towupper
api-ms-win-crt-string-l1-1-0.dll	157		wcscat_s
api-ms-win-crt-string-l1-1-0.dll	169		wcsnlen
api-ms-win-crt-string-l1-1-0.dll	74		_wcsicmp
api-ms-win-crt-string-l1-1-0.dll	48		_strlwr_s
api-ms-win-crt-string-l1-1-0.dll	170		wcspbrk
api-ms-win-crt-string-l1-1-0.dll	80		_wcslwr_s
api-ms-win-crt-string-l1-1-0.dll	161		wcscpy_s
api-ms-win-crt-string-l1-1-0.dll	171		wcsspn
api-ms-win-crt-string-l1-1-0.dll	162		wcscspn
api-ms-win-crt-string-l1-1-0.dll	176		wmemcpy_s
api-ms-win-crt-string-l1-1-0.dll	108		isprint
api-ms-win-crt-string-l1-1-0.dll	137		strcpy_s
api-ms-win-crt-string-l1-1-0.dll	168		wcsncpy_s
api-ms-win-crt-string-l1-1-0.dll	166		wcsncmp
api-ms-win-crt-stdio-l1-1-0.dll	47		_fseeki64
api-ms-win-crt-stdio-l1-1-0.dll	126		fopen_s
api-ms-win-crt-stdio-l1-1-0.dll	3		__stdio_common_vfprintf
api-ms-win-crt-stdio-l1-1-0.dll	116		fclose
api-ms-win-crt-stdio-l1-1-0.dll	99		_wfopen_s
api-ms-win-crt-stdio-l1-1-0.dll	124		fgetws
api-ms-win-crt-stdio-l1-1-0.dll	17		__stdio_common_vswprintf
api-ms-win-crt-stdio-l1-1-0.dll	19		__stdio_common_vswprintf_s
api-ms-win-crt-stdio-l1-1-0.dll	121		fgetpos
api-ms-win-crt-stdio-l1-1-0.dll	152		setvbuf
api-ms-win-crt-stdio-l1-1-0.dll	119		fflush
api-ms-win-crt-stdio-l1-1-0.dll	138		fwrite
api-ms-win-crt-stdio-l1-1-0.dll	157		ungetc
api-ms-win-crt-stdio-l1-1-0.dll	20		__stdio_common_vswscanf
api-ms-win-crt-stdio-l1-1-0.dll	57		_get_stream_buffer_pointers
api-ms-win-crt-stdio-l1-1-0.dll	120		fgetc
api-ms-win-crt-stdio-l1-1-0.dll	127		fputc
api-ms-win-crt-stdio-l1-1-0.dll	1		__p__commode
api-ms-win-crt-stdio-l1-1-0.dll	84		_set_fmode
api-ms-win-crt-stdio-l1-1-0.dll	136		fsetpos
api-ms-win-crt-convert-l1-1-0.dll	71		_wtoi
api-ms-win-crt-convert-l1-1-0.dll	47		_ui64tow_s
api-ms-win-crt-convert-l1-1-0.dll	62		_wcstoui64
api-ms-win-crt-convert-l1-1-0.dll	26		_itow_s
api-ms-win-crt-convert-l1-1-0.dll	75		_wtol
api-ms-win-crt-convert-l1-1-0.dll	51		_ultow_s
api-ms-win-crt-math-l1-1-0.dll	46		__setusermatherr
api-ms-win-crt-math-l1-1-0.dll	162		ceil
api-ms-win-crt-locale-l1-1-0.dll	8		_configthreadlocale
USER32.dll	650		RegisterClassW
USER32.dll	814		SystemParametersInfoA
USER32.dll	49		CharNextW
USER32.dll	560		LoadStringW
USER32.dll	841		UnregisterClassW
USER32.dll	589		MessageBoxW
USER32.dll	725		SetForegroundWindow
USER32.dll	597		MsgWaitForMultipleObjectsEx
USER32.dll	620		PeekMessageW
USER32.dll	677		ReleaseDC
USER32.dll	308		GetDC
USER32.dll	426		GetSystemMetrics
USER32.dll	831		TranslateMessage
USER32.dll	852		UpdateLayeredWindow
USER32.dll	370		GetMessageTime
USER32.dll	769		SetTimer
USER32.dll	537		KillTimer
USER32.dll	534		IsWindowVisible
USER32.dll	800		ShowWindow
USER32.dll	113		CreateWindowExW
USER32.dll	173		DestroyWindow
USER32.dll	797		ShowScrollBar
USER32.dll	759		SetScrollRange
USER32.dll	758		SetScrollPos
USER32.dll	757		SetScrollInfo
USER32.dll	419		GetScrollRange
USER32.dll	418		GetScrollPos
USER32.dll	417		GetScrollInfo
USER32.dll	416		GetScrollBarInfo
USER32.dll	226		EnableScrollBar
USER32.dll	161		DefWindowProcW
USER32.dll	160		DefWindowProcA
USER32.dll	407		GetQueueStatus
USER32.dll	879		WaitMessage
USER32.dll	371		GetMessageW
USER32.dll	367		GetMessageA
USER32.dll	619		PeekMessageA
USER32.dll	549		LoadImageW
USER32.dll	547		LoadIconW
USER32.dll	181		DispatchMessageW
ole32.dll	35		CoDisconnectObject
ole32.dll	25		CoCreateGuid
ole32.dll	79		CoInitialize
ole32.dll	127		CoUninitialize
ole32.dll	12		CLSIDFromString
ole32.dll	91		CoMarshalInterface
ole32.dll	441		StringFromCLSID
ole32.dll	154		CreateStreamOnHGlobal
ole32.dll	108		CoReleaseMarshalData
ole32.dll	55		CoGetCurrentLogicalThreadId
ole32.dll	382		OleUninitialize
ole32.dll	81		CoInitializeSecurity
ole32.dll	353		OleInitialize
ole32.dll	442		StringFromGUID2
ole32.dll	24		CoCreateFreeThreadedMarshaler
ole32.dll	244		IIDFromString
ole32.dll	26		CoCreateInstance
ole32.dll	122		CoTaskMemAlloc
ole32.dll	124		CoTaskMemRealloc
ole32.dll	123		CoTaskMemFree
ole32.dll	134		CoWaitForMultipleHandles
OLEAUT32.dll		22
OLEAUT32.dll		16
OLEAUT32.dll		15
OLEAUT32.dll		77
OLEAUT32.dll		27
OLEAUT32.dll		21
OLEAUT32.dll		40
OLEAUT32.dll		200
OLEAUT32.dll		201
OLEAUT32.dll		185
OLEAUT32.dll		150
OLEAUT32.dll		184
OLEAUT32.dll		8
OLEAUT32.dll		20
OLEAUT32.dll		2
OLEAUT32.dll		149
OLEAUT32.dll		6
OLEAUT32.dll		277
OLEAUT32.dll		4
OLEAUT32.dll		9
OLEAUT32.dll		7
OLEAUT32.dll		19
OLEAUT32.dll		313
OLEAUT32.dll		35
SHLWAPI.dll	143		PathRemoveFileSpecW
SHLWAPI.dll	61		PathCombineW
SHLWAPI.dll	137		PathRemoveBackslashW
SHLWAPI.dll	73		PathFileExistsW
SHLWAPI.dll	59		PathCanonicalizeW
SHLWAPI.dll	55		PathAppendW
SHLWAPI.dll	51		PathAddBackslashW
SHLWAPI.dll	141		PathRemoveExtensionW
SHLWAPI.dll	77		PathFindFileNameW
SHLWAPI.dll	335		StrStrIW
SHLWAPI.dll	145		PathRenameExtensionW
SHLWAPI.dll	8		AssocQueryStringW
SHLWAPI.dll	153		PathStripPathW
SHLWAPI.dll	95		PathIsDirectoryW
SHLWAPI.dll	75		PathFindExtensionW
SHLWAPI.dll	139		PathRemoveBlanksW
SHLWAPI.dll	291		StrCmpIW
SHLWAPI.dll	127		PathMatchSpecW
SHLWAPI.dll	184		SHDeleteKeyW
SHLWAPI.dll	97		PathIsFileSpecW
SHLWAPI.dll	174		SHCreateStreamOnFileEx
SHLWAPI.dll	340		StrToInt64ExW
SHLWAPI.dll	343		StrToIntExW
SHLWAPI.dll	105		PathIsRelativeW
gdiplus.dll	144		GdipDeleteGraphics
gdiplus.dll	79		GdipCreateBitmapFromResource
gdiplus.dll	536		GdipSetInterpolationMode
gdiplus.dll	405		GdipGraphicsClear
gdiplus.dll	95		GdipCreateHBITMAPFromBitmap
gdiplus.dll	80		GdipCreateBitmapFromScan0
gdiplus.dll	185		GdipDrawImageRectRect
gdiplus.dll	74		GdipCreateBitmapFromFileICM
gdiplus.dll	82		GdipCreateBitmapFromStreamICM
gdiplus.dll	81		GdipCreateBitmapFromStream
gdiplus.dll	295		GdipGetImagePixelFormat
gdiplus.dll	290		GdipGetImageHeight
gdiplus.dll	300		GdipGetImageWidth
gdiplus.dll	289		GdipGetImageGraphicsContext
gdiplus.dll	152		GdipDisposeImage
gdiplus.dll	54		GdipCloneImage
gdiplus.dll	628		GdiplusShutdown
gdiplus.dll	629		GdiplusStartup
gdiplus.dll	73		GdipCreateBitmapFromFile
gdiplus.dll	237		GdipFree
gdiplus.dll	33		GdipAlloc
MSVCP140.dll	669		public: bool __thiscall std::codecvt_base::always_noconv(void)const ?always_noconv@codecvt_base@std@@QBE_NXZ
MSVCP140.dll	1343		public: class std::basic_ostream<char, struct std::char_traits<char> > & __thiscall std::basic_ostream<char, struct std::char_traits<char> >::write(char const *, __int64) ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
MSVCP140.dll	134		public: virtual __thiscall std::basic_ostream<char, struct std::char_traits<char> >::~basic_ostream<char, struct std::char_traits<char> >(void) ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
MSVCP140.dll	1183		public: class std::basic_istream<char, struct std::char_traits<char> > & __thiscall std::basic_istream<char, struct std::char_traits<char> >::seekg(__int64, int) ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
MSVCP140.dll	1165		public: class std::basic_istream<char, struct std::char_traits<char> > & __thiscall std::basic_istream<char, struct std::char_traits<char> >::read(char *, __int64) ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
MSVCP140.dll	1008		public: class std::basic_istream<char, struct std::char_traits<char> > & __thiscall std::basic_istream<char, struct std::char_traits<char> >::ignore(__int64, int) ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
MSVCP140.dll	131		public: virtual __thiscall std::basic_istream<char, struct std::char_traits<char> >::~basic_istream<char, struct std::char_traits<char> >(void) ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
MSVCP140.dll	1350		protected: virtual __int64 __thiscall std::basic_streambuf<char, struct std::char_traits<char> >::xsputn(char const *, __int64) ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
MSVCP140.dll	1347		protected: virtual __int64 __thiscall std::basic_streambuf<char, struct std::char_traits<char> >::xsgetn(char *, __int64) ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
MSVCP140.dll	1237		protected: virtual __int64 __thiscall std::basic_streambuf<char, struct std::char_traits<char> >::showmanyc(void) ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
MSVCP140.dll	137		public: virtual __thiscall std::basic_streambuf<char, struct std::char_traits<char> >::~basic_streambuf<char, struct std::char_traits<char> >(void) ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
MSVCP140.dll	678		public: void __thiscall std::basic_ios<char, struct std::char_traits<char> >::clear(int, bool) ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
MSVCP140.dll	125		public: virtual __thiscall std::basic_ios<char, struct std::char_traits<char> >::~basic_ios<char, struct std::char_traits<char> >(void) ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
MSVCP140.dll	1075		public: int __thiscall std::codecvt<char, char, struct _Mbstatet>::out(struct _Mbstatet &, char const , char const , char const * &, char , char , char * &)const ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
MSVCP140.dll	1018		public: int __thiscall std::codecvt<char, char, struct _Mbstatet>::in(struct _Mbstatet &, char const , char const , char const * &, char , char , char * &)const ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
MSVCP140.dll	37		public: __thiscall std::basic_ostream<char, struct std::char_traits<char> >::basic_ostream<char, struct std::char_traits<char> >(class std::basic_streambuf<char, struct std::char_traits<char> > *, bool) ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
MSVCP140.dll	26		public: __thiscall std::basic_istream<char, struct std::char_traits<char> >::basic_istream<char, struct std::char_traits<char> >(class std::basic_streambuf<char, struct std::char_traits<char> > *, bool) ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
MSVCP140.dll	1417		_Mtx_unlock
MSVCP140.dll	1413		_Mtx_lock
MSVCP140.dll	628		void __cdecl std::_Throw_C_error(int) ?_Throw_C_error@std@@YAXH@Z
MSVCP140.dll	652		void __cdecl std::_Xbad_function_call(void) ?_Xbad_function_call@std@@YAXXZ
MSVCP140.dll	12		protected: __thiscall std::basic_ios<char, struct std::char_traits<char> >::basic_ios<char, struct std::char_traits<char> >(void) ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
MSVCP140.dll	1221		public: void __thiscall std::basic_ios<char, struct std::char_traits<char> >::setstate(int, bool) ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
MSVCP140.dll	1319		public: int __thiscall std::codecvt<char, char, struct _Mbstatet>::unshift(struct _Mbstatet &, char , char , char * &)const ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
MSVCP140.dll	501		protected: void __thiscall std::basic_streambuf<char, struct std::char_traits<char> >::_Init(void) ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
MSVCP140.dll	651		void __cdecl std::_Xbad_alloc(void) ?_Xbad_alloc@std@@YAXXZ
MSVCP140.dll	655		void __cdecl std::_Xout_of_range(char const *) ?_Xout_of_range@std@@YAXPBD@Z
MSVCP140.dll	1412		_Mtx_init_in_situ
MSVCP140.dll	1409		_Mtx_destroy_in_situ
MSVCP140.dll	654		void __cdecl std::_Xlength_error(char const *) ?_Xlength_error@std@@YAXPBD@Z
MSVCP140.dll	109		public: __thiscall std::_Lockit::_Lockit(int) ??0_Lockit@std@@QAE@H@Z
MSVCP140.dll	165		public: __thiscall std::_Lockit::~_Lockit(void) ??1_Lockit@std@@QAE@XZ
MSVCP140.dll	469		private: static class std::locale::_Locimp * __cdecl std::locale::_Getgloballocale(void) ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
MSVCP140.dll	406		__int64 const std::_BADOFF ?_BADOFF@std@@3_JB
MSVCP140.dll	428		struct _iobuf * __cdecl std::_Fiopen(unsigned short const *, int, int) ?_Fiopen@std@@YAPAU_iobuf@@PBGHH@Z
MSVCP140.dll	969		public: static class std::locale::id std::codecvt<char, char, struct _Mbstatet>::id ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
MSVCP140.dll	433		public: static unsigned int __cdecl std::codecvt<char, char, struct _Mbstatet>::_Getcat(class std::locale::facet const * , class std::locale const ) ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
MSVCP140.dll	47		protected: __thiscall std::basic_streambuf<char, struct std::char_traits<char> >::basic_streambuf<char, struct std::char_traits<char> >(void) ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
MSVCP140.dll	960		public: class std::locale __thiscall std::basic_streambuf<char, struct std::char_traits<char> >::getloc(void)const ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
MSVCP140.dll	305		public: __thiscall std::locale::id::operator unsigned int(void) ??Bid@locale@std@@QAEIXZ
CRYPT32.dll	229		CryptUnprotectData
SHELL32.dll	150		SHCreateDirectoryExW
SHELL32.dll	200		SHGetFileInfoW
SHELL32.dll	182		SHFileOperationW
SHELL32.dll	210		SHGetFolderPathW
VERSION.dll	8		GetFileVersionInfoW
VERSION.dll	7		GetFileVersionInfoSizeW
VERSION.dll	16		VerQueryValueW
GDI32.dll	502		GetDeviceCaps
GDI32.dll	552		GetObjectW
GDI32.dll	49		CreateCompatibleDC
GDI32.dll	724		SelectObject
GDI32.dll	267		DeleteDC
GDI32.dll	270		DeleteObject
api-ms-win-crt-filesystem-l1-1-0.dll	49		_wfullpath
api-ms-win-crt-filesystem-l1-1-0.dll	51		_wmakepath_s
api-ms-win-crt-filesystem-l1-1-0.dll	57		_wsplitpath_s
api-ms-win-crt-filesystem-l1-1-0.dll	53		_wremove
api-ms-win-crt-filesystem-l1-1-0.dll	22		_lock_file
api-ms-win-crt-filesystem-l1-1-0.dll	36		_unlock_file
api-ms-win-crt-utility-l1-1-0.dll	14		_swab

ord	entry_va	function_name
1	0x552e	IsAssertEtwEnabled
2	0x41560	SetOnAssertCallback
3	0x41520	WriteAssertEtwEventA
4	0x41540	WriteAssertEtwEventW
5	0x1221	WriteEtwEventForZwAllocateVirtualMemory
6	0x1264	WriteEtwEventForZwFreeVirtualMemory

module_name	devenv.exe
flags	0
timestamp	2018-09-27 02:38:28
version	0.0
ordinal_base	1
nFunctions	6
nNames	6
Names(6)	0x10c0
Functions(6)	0x10a8
NameOrdinals(6)	0x10d8

StringTable 040904b0

CompanyName	Microsoft Corporation
FileDescription	Microsoft Visual Studio 2017
FileVersion	15.8.28010.2041 built by: D15.8
InternalName	devenv.exe
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	devenv.exe
ProductName	Microsoft® Visual Studio®
ProductVersion	15.8.28010.2041

VS_FIXEDFILEINFO

FileVersion	15.8.28010.2041
ProductVersion	15.8.28010.2041
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Code Signing PCA

serial: 33000001B1DDEDBA54E965B85F0001000001B1

Certificates (4)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Signing PCA
        Validity
            Not Before: Jul 12 20:11:19 2018 GMT
            Not After : Jul 26 20:11:19 2019 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:9b:52:be:4f:2c:b4:1d:53:cb:3d:5d:23:1e:b6:
                    83:a3:9f:c0:e5:4a:e0:57:b3:c2:f8:2d:d6:8a:91:
                    5f:cc:12:ce:0c:dd:02:b7:46:78:f4:6b:9b:de:e7:
                    cb:20:21:8f:d4:3e:0e:25:94:72:3a:78:63:66:2e:
                    b5:5f:e1:db:97:fd:88:8e:a8:88:97:55:4c:1d:1e:
                    3e:a9:69:49:2d:13:63:f9:7e:c3:a5:aa:d3:bf:7f:
                    c2:07:39:21:30:66:36:95:97:6f:a7:de:ab:a5:12:
                    f6:85:e9:68:28:69:26:9b:1a:9e:b7:af:ec:53:78:
                    6f:c3:cc:31:30:87:f6:f7:36:2b:30:40:59:48:46:
                    80:51:a8:cd:0c:80:dd:e3:4a:9e:2d:74:55:ec:e6:
                    a7:44:7a:d5:13:be:f4:c2:24:7d:0c:fd:33:cd:e6:
                    23:5f:9a:cd:d4:29:6d:02:d5:32:5a:6a:27:cf:b0:
                    c9:01:8b:94:af:e5:0c:8b:7a:1f:7d:22:13:83:86:
                    f2:5a:4b:d3:84:63:57:1a:6b:49:78:3a:54:e9:8f:
                    e1:85:c6:e5:3f:96:25:e7:5e:f9:c8:cb:c7:a1:f2:
                    f2:1b:0d:22:5b:b9:2f:fc:8c:e9:db:28:c4:55:17:
                    b6:e8:f4:d7:7a:cf:fd:9c:d3:8f:ee:e9:76:2a:82:
                    8c:a1
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                Code Signing
            X509v3 Subject Key Identifier: 
                44:13:B4:02:9D:77:3E:90:55:71:F5:E4:1C:7F:AC:17:14:CF:3E:73
            X509v3 Subject Alternative Name: 
                DirName:/OU=Microsoft Operations Puerto Rico/serialNumber=229803+437950
            X509v3 Authority Key Identifier: 
                keyid:CB:11:E8:CA:D2:B4:16:58:01:C9:37:2E:33:16:16:B9:4C:9A:0A:1F

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt

    Signature Algorithm: sha1WithRSAEncryption
         83:a9:f2:a6:33:c5:a1:7b:1c:d2:5e:80:ae:ec:a4:a6:c3:e9:
         28:5d:57:25:23:8d:dd:25:09:69:70:e8:4d:69:16:2f:94:bb:
         05:d9:9b:80:ec:59:d0:68:64:1b:83:34:a8:dc:cf:63:8d:9d:
         6b:76:00:f5:7b:af:42:74:07:c5:fc:91:c0:e2:ac:45:33:96:
         5d:b1:fd:fa:8e:46:b2:49:e2:43:06:19:98:85:71:78:d3:9e:
         e9:db:95:16:41:31:34:70:2c:43:96:a2:02:77:a9:2f:3d:61:
         4a:63:59:f1:97:7d:d1:52:95:60:85:a8:bc:1b:45:07:3f:d9:
         c1:8f:f7:50:f5:b9:7e:08:89:e4:42:c4:58:8e:41:c0:95:38:
         49:1f:d7:1d:f8:30:4f:29:2f:3b:47:59:92:37:ee:97:21:ed:
         17:66:90:1c:2f:2d:6d:6b:ff:0b:75:e5:aa:12:dd:fa:af:c4:
         11:b4:e0:21:32:5a:bf:05:ce:45:f9:3f:8d:56:ae:ce:51:d6:
         cc:ae:7d:04:19:30:12:f2:bf:9f:48:26:9c:0e:00:0d:28:ad:
         a5:de:44:2d:cc:d4:87:ff:94:49:95:57:0c:4d:34:9c:23:0a:
         dd:c3:8d:32:09:f4:bd:35:28:c5:de:d0:88:3f:a9:12:13:a1:
         30:70:a0:11

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:fb:1b:61:8d:d4:5f:96:36:01:00:00:00:00:00:fb
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Time-Stamp PCA
        Validity
            Not Before: Aug 23 20:20:09 2018 GMT
            Not After : Nov 23 20:20:09 2019 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft Operations Puerto Rico, OU=Thales TSS ESN:B1B7-F67F-FEC2, CN=Microsoft Time-Stamp Service
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b0:75:c2:87:75:04:d4:da:6e:19:fd:47:41:0b:
                    d0:45:fa:b2:52:7d:fe:3c:97:0e:a8:ee:f2:2c:d8:
                    93:49:b2:b0:27:6f:6f:35:83:05:f8:3e:92:45:cd:
                    18:28:78:f7:4e:95:63:93:14:e8:86:b3:4d:4e:64:
                    00:55:e7:b9:76:c8:b1:7d:11:47:db:c0:82:9b:b1:
                    56:b8:f4:26:36:50:c1:f7:a2:5e:fe:17:49:e0:6c:
                    c6:c9:13:2e:8d:26:87:d1:2a:78:00:6f:2d:86:b0:
                    f4:48:5a:00:9d:a9:00:e6:f2:7b:22:97:12:a4:de:
                    41:59:da:4f:69:60:76:fc:79:a0:9b:63:8d:02:87:
                    73:8c:85:d9:4e:2d:d6:e2:0c:7e:ce:59:0d:7a:b2:
                    59:5c:96:74:a5:97:0e:7b:82:a4:3d:5d:25:b8:ea:
                    43:e7:50:fc:e3:0a:53:f8:a0:38:dc:5d:a5:2f:ec:
                    f1:0b:41:9a:d7:fc:4c:61:4e:d6:05:f4:fb:30:ce:
                    90:26:73:a4:ce:9a:9a:39:a0:38:20:b3:93:de:07:
                    b4:aa:99:9e:37:a0:f4:b7:55:f1:50:54:6f:57:72:
                    2c:0c:5a:6e:61:9f:61:20:93:90:53:79:fd:e2:94:
                    ca:8e:94:cc:8c:75:16:39:99:62:66:64:f5:b3:b8:
                    65:73
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                97:B1:49:48:96:32:BB:72:C4:EC:E6:EA:92:17:AE:3A:B3:4E:F5:95
            X509v3 Authority Key Identifier: 
                keyid:23:34:F8:D9:52:46:70:0A:ED:40:FB:76:FB:B3:2B:B0:C3:35:B3:0F

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt

            X509v3 Extended Key Usage: 
                Time Stamping
    Signature Algorithm: sha1WithRSAEncryption
         43:01:1f:7c:f5:e4:06:1d:b9:02:73:53:58:61:77:10:8f:b0:
         a8:a6:9b:70:3a:1a:e8:27:15:95:5d:7f:a2:03:e3:32:d6:af:
         59:2f:fd:e8:8b:21:6c:63:df:b8:40:b0:08:c3:29:73:43:e4:
         77:0e:3b:80:8b:37:1e:45:8b:5f:72:9d:2f:2a:ae:d8:ec:16:
         b1:c8:38:2f:bc:8f:d1:f4:33:f0:ee:c9:3d:2c:cf:89:c5:6b:
         bf:0d:d0:14:10:a3:ce:8c:31:12:15:c6:c6:c4:13:15:c4:49:
         fd:31:4a:80:66:92:00:67:d0:04:df:01:e2:16:53:87:dc:84:
         2e:da:70:d7:55:0c:da:fe:87:f1:22:28:e4:a1:bd:72:cd:63:
         4e:73:e0:7b:a8:9b:0e:d6:f6:e9:de:09:9e:5c:d8:fc:60:a5:
         33:e7:4a:00:ee:bd:8b:a5:ed:27:0d:6e:89:6a:83:7c:11:c5:
         02:45:36:1a:f0:eb:21:23:74:0a:9d:7a:25:a1:68:3c:27:c0:
         94:29:da:53:74:0b:b0:1d:3a:52:f7:d2:3c:23:a9:0e:17:fe:
         b5:eb:f7:fe:bd:77:0f:57:1d:8f:61:8a:1e:90:a0:60:46:39:
         88:d7:7c:76:2b:b3:a5:fd:22:b0:a8:e0:16:28:df:d1:c3:05:
         36:70:e7:83

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:33:26:1a:00:00:00:00:00:31
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
        Validity
            Not Before: Aug 31 22:19:32 2010 GMT
            Not After : Aug 31 22:29:32 2020 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Signing PCA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b2:72:59:5c:19:30:64:bf:1d:9a:60:20:20:42:
                    99:76:53:6c:3e:1b:d6:6f:cc:cb:f1:ea:6b:fe:97:
                    16:10:e0:df:3a:74:83:1a:b7:2f:a0:32:ec:ff:de:
                    c2:42:4e:23:d5:72:00:db:35:57:0a:89:ca:ae:20:
                    49:f4:f0:68:ac:4d:4b:8d:a5:bd:79:4b:71:9b:47:
                    07:da:fd:25:df:9d:75:88:cf:aa:73:44:7f:d7:81:
                    db:f3:bd:f2:36:a4:c9:5c:45:dc:af:ad:3d:e0:28:
                    68:97:1a:a7:a5:72:73:56:f1:17:94:e4:fd:35:94:
                    72:a0:d6:76:5f:1e:77:45:83:85:38:16:d0:73:5b:
                    05:ba:67:52:8d:a5:b2:69:2f:da:19:0b:fe:92:74:
                    29:e2:76:2f:54:dd:14:30:59:f8:d2:8d:62:fd:cb:
                    c9:5f:46:31:50:b9:27:13:e4:40:30:cf:72:29:10:
                    28:22:c7:37:4e:3d:a0:32:3d:90:cd:a1:38:06:85:
                    5c:4e:56:82:28:2a:05:32:b7:4b:d7:4f:63:e7:d2:
                    2d:62:f1:45:3d:e7:ac:08:00:f6:46:a1:9e:d1:5b:
                    8c:26:53:e8:7a:aa:4a:f2:46:cf:37:3c:38:9e:b4:
                    77:5c:a5:17:9e:8d:cb:11:8f:56:3c:c1:ac:09:5f:
                    03:d3
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier: 
                CB:11:E8:CA:D2:B4:16:58:01:C9:37:2E:33:16:16:B9:4C:9A:0A:1F
            X509v3 Key Usage: 
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1: 
                .....
            1.3.6.1.4.1.311.21.2: 
                ....1N.&....`;.1o.<..-
            1.3.6.1.4.1.311.20.2: 
                .
.S.u.b.C.A
            X509v3 Authority Key Identifier: 
                keyid:0E:AC:82:60:40:56:27:97:E5:25:13:FC:2A:E1:0A:53:95:59:E4:A4

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt

    Signature Algorithm: sha1WithRSAEncryption
         59:39:3e:7f:26:46:af:eb:6f:40:b1:32:b5:6a:eb:0e:2f:6e:
         a8:49:f7:eb:5f:75:ed:4c:3b:2d:d7:43:ad:0b:fe:cb:e9:2d:
         31:a3:23:cc:7c:50:98:80:21:5d:ac:3d:2f:4c:ba:a2:a8:56:
         9c:e3:70:bb:b8:b4:f8:79:b5:49:72:f7:3e:ea:41:7f:ca:e1:
         0c:17:69:cb:a5:9c:20:2d:fa:0b:50:c4:56:cd:2d:e3:4a:d2:
         bc:70:e7:a8:0d:a2:03:a5:56:e0:b8:8a:4b:57:f2:95:42:9c:
         f1:f3:ef:ee:e3:86:1f:34:3c:b8:56:9a:f0:53:23:85:2a:a4:
         82:1c:93:e2:94:07:1d:f2:e2:4e:f8:8c:a1:ca:e8:13:a5:91:
         4e:c8:1b:d2:8f:72:95:2a:71:6d:9b:1a:f8:1c:f0:53:d6:67:
         cc:22:ff:5c:1d:cd:a2:8c:bd:27:b2:79:63:56:44:a2:51:cd:
         f9:e9:a3:58:56:dd:9b:02:45:44:2f:5f:f4:da:ae:d4:82:32:
         6e:fc:a4:95:13:e4:eb:69:e7:a9:a2:2c:be:c8:2b:10:0e:65:
         8e:99:db:f5:a2:fa:12:26:09:65:38:94:f1:7a:1f:4a:bb:d1:
         e1:56:e8:d0:78:96:18:5c:c9:35:16:5f:dd:93:1d:49:8e:2d:
         be:ad:34:44:1c:ee:10:15:1a:00:5d:dd:35:5b:21:ce:98:c7:
         09:ee:85:0e:8c:4f:6d:0e:13:4e:3d:7c:29:48:9c:72:d1:f3:
         6c:ca:c1:ec:70:a3:57:92:57:7d:94:8d:a0:1b:48:03:5a:f7:
         cf:a3:67:0a:74:a5:36:ed:2d:2f:17:c8:e6:72:37:12:f4:6f:
         b1:3c:67:82:f9:52:b2:8d:33:16:65:1e:0e:8a:dd:10:de:64:
         f4:6f:ce:46:d4:d3:17:e9:79:c4:04:b4:d3:fb:2c:df:1f:8a:
         9e:ac:0a:fb:13:27:40:ad:e4:f9:e1:a9:7f:46:bb:07:60:47:
         65:60:40:4e:b0:42:ec:4e:ed:b3:76:79:d8:0a:34:09:6d:1c:
         80:31:1f:e2:0e:54:dd:e5:a1:fb:e5:47:10:ad:64:98:ff:50:
         16:2e:7c:bf:05:21:7a:e2:95:41:27:69:c3:93:8f:95:c9:8d:
         d8:9b:21:ae:0d:5c:9c:f0:a2:ae:86:68:83:0c:6a:2d:bb:76:
         6b:00:1d:96:ad:f2:16:7b:f6:16:83:24:b9:88:cf:6a:a8:47:
         31:2f:9a:dc:e3:71:3d:d7:00:7e:62:47:d1:ce:88:c9:b8:18:
         fa:0e:72:8d:c1:a3:3d:af:02:40:6a:ff:69:9b:96:e2:10:a8:
         10:b4:37:50:08:d6:c3:3d

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:16:68:34:00:00:00:00:00:1c
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
        Validity
            Not Before: Apr  3 12:53:09 2007 GMT
            Not After : Apr  3 13:03:09 2021 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Time-Stamp PCA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:9f:a1:6c:b1:df:db:48:92:2a:7c:6b:2e:19:e1:
                    bd:e2:e3:c5:99:51:23:50:ad:ce:dd:18:4e:24:0f:
                    ee:d1:a7:d1:4c:ad:74:30:20:11:eb:07:d5:54:95:
                    15:49:94:1b:42:92:ae:98:5c:30:26:da:00:6b:e8:
                    7b:bd:ec:89:07:0f:f7:0e:04:98:f0:89:cc:1f:cb:
                    33:24:87:9d:f2:f4:67:1c:2c:fc:7b:e7:88:1d:ea:
                    e7:4e:a3:a1:c1:23:53:ca:8d:fa:45:cf:09:d0:5e:
                    af:d0:b0:42:04:a2:f9:a6:6c:93:67:d7:28:dc:46:
                    53:b0:86:d0:e5:28:46:2e:27:ac:86:4f:55:52:0c:
                    e4:03:2c:fb:6a:90:90:30:6e:87:f3:59:30:9d:fa:
                    7e:d6:97:b3:e8:21:97:7e:f8:d2:13:f3:08:b7:53:
                    6d:52:b4:45:90:9f:48:00:4a:47:66:11:27:29:66:
                    a8:97:e4:d3:06:81:4a:a2:f9:84:a7:11:47:14:09:
                    82:9f:84:ed:55:78:fe:01:9a:1d:50:08:85:00:10:
                    30:46:ed:b7:de:23:46:bb:c4:2d:54:9f:af:1e:78:
                    41:31:77:cc:9b:df:3b:83:93:a1:61:02:b5:1d:0d:
                    b1:fc:f7:9b:b2:01:ce:22:4b:54:ff:f9:05:c3:c2:
                    20:0b
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier: 
                23:34:F8:D9:52:46:70:0A:ED:40:FB:76:FB:B3:2B:B0:C3:35:B3:0F
            X509v3 Key Usage: 
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1: 
                ...
            X509v3 Authority Key Identifier: 
                keyid:0E:AC:82:60:40:56:27:97:E5:25:13:FC:2A:E1:0A:53:95:59:E4:A4
                DirName:/DC=com/DC=microsoft/CN=Microsoft Root Certificate Authority
                serial:79:AD:16:A1:4A:A0:A5:AD:4C:73:58:F4:07:13:2E:65

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt

            X509v3 Extended Key Usage: 
                Time Stamping
    Signature Algorithm: sha1WithRSAEncryption
         10:97:8a:c3:5c:03:44:36:dd:e9:b4:ad:77:db:ce:79:51:4d:
         01:b1:2e:74:71:5b:6d:0c:13:ab:ce:be:7b:8f:b8:2e:d4:12:
         a2:8c:6d:62:b8:57:02:cb:4e:20:13:50:99:dd:7a:40:e2:57:
         bb:af:58:9a:1c:e1:1d:01:86:ac:bb:78:f2:8b:d0:ec:3b:01:
         ee:e2:be:8f:0a:05:c8:8d:48:e2:f0:53:15:dd:4f:ab:92:e4:
         e7:8d:6a:d5:80:c1:e6:94:f2:06:2f:85:03:e9:91:2a:24:22:
         70:fb:f6:fc:e4:78:99:2e:0d:f7:07:e2:70:bc:18:4e:9d:8e:
         6b:0a:72:95:b8:a1:39:9c:67:2d:c5:51:0e:ea:62:5c:3f:16:
         98:8b:20:3f:e2:07:1a:32:f9:cc:31:4a:76:31:3d:2b:72:0b:
         c8:ea:70:3d:ff:85:0a:13:df:c2:0a:61:8e:f0:d7:b8:17:eb:
         4e:8b:7f:c5:35:2b:5e:a3:bf:eb:bc:7d:0b:42:7b:d4:53:72:
         21:ee:30:ca:bb:78:65:5c:5b:01:17:0a:14:0e:d2:da:14:98:
         f5:3c:b9:66:58:b3:2d:2f:e7:f9:85:86:cc:51:56:e8:9d:70:
         94:6c:ac:39:4c:d4:f6:79:bf:aa:18:7a:62:29:ef:a2:9b:29:
         34:06:77:1a:62:c9:3d:1e:6d:1f:82:f0:0b:c7:2c:bb:cf:43:
         b3:e5:f9:ec:7d:b5:e3:a4:a8:74:35:b8:4e:c5:71:23:12:26:
         76:0b:3c:52:8c:71:5a:46:43:14:bc:b3:b3:b0:4d:67:c8:9f:
         42:ff:80:79:21:80:9e:15:30:66:e8:42:12:5e:1a:c8:9e:22:
         21:d0:43:e9:2b:e9:bb:f4:48:cc:2c:d4:d8:32:80:4c:26:2a:
         48:24:5f:5a:ea:56:ef:a6:de:99:9d:ca:3a:6f:bd:81:27:74:
         06:11:ee:76:21:bf:9b:82:c1:27:54:b6:b1:6a:3d:89:a1:76:
         61:b4:6e:a1:13:a6:bf:aa:47:f0:12:6f:fd:8a:32:6c:b2:fe:
         df:51:c8:8c:23:c9:66:bd:9d:1d:87:12:64:02:3d:2d:af:59:
         8f:b8:e4:21:e5:b5:b0:ca:63:b4:78:54:05:d4:41:2e:50:ac:
         94:b0:a5:78:ab:b3:a0:96:75:1a:d9:92:87:13:75:22:2f:32:
         a8:08:6e:a0:5b:8c:25:bf:a0:ef:84:ca:21:d6:eb:1e:4f:c9:
         9a:ee:49:e0:f7:01:65:6f:89:0b:7d:c8:69:c8:e6:6e:ea:a7:
         97:ce:31:29:ff:0e:c5:5b:5c:d8:4d:1b:a1:d8:fa:2f:9e:3f:
         2e:55:16:6b:c9:13:a3:fd

undefined method `first' for #

show previews

offset	size	type	comment
0	707072	EXE	09/27/2018 02:38:28	#
15c1	15	HTM		#
6c770	5551	PNG	(256 x 256)	#
77df0	3809	PNG	(256 x 256)	#
7a98c	4083	PNG	(256 x 256)	#
83660	4129	PNG	(256 x 256)	#
8633c	4486	PNG	(256 x 256)	#
8f1a4	4189	PNG	(256 x 256)	#
91ebc	3829	PNG	(256 x 256)	#
9aa94	3952	PNG	(256 x 256)	#
9d6bc	4339	PNG	(256 x 256)	#
aca00	16208	PKCS7	Authenticode Signature	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

devenv.exe- Microsoft Visual Studio 2017

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

TLS

StringTable 040904b0

VS_FIXEDFILEINFO

Signers (1)

Certificates (4)

devenv.exe
- Microsoft Visual Studio 2017