drop pe file · read pe timestamp · map to timezone bands · business hours inference · runs locally
reads TimeDateStamp only — never executes code
drop PE executable or DLL