DhMachineSvc.exe - DhMachineiSvc.exe - 微软设备健康助手服务

info
MZ
PE
resources
imports
foremost
version info
signature
hexdump
disasm
log
discuss
donate

filename	DhMachineSvc.exe
size	85664 (0x14ea0)
md5	471271ad75cfe552b29a118f3c571a9f

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe8

Rich Header

lib id	version	times used
149	30729	11
131	30729	72
147	30729	31
1	0	296
132	30729	73
126	50727	1
148	30729	1
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x539271f3
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0xf800
SizeOfInitializedData	0x3e00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x442f
BaseOfCode	0x1000
BaseOfData	0x11000
ImageBase	0x1000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.1
ImageVersion	6.1
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0x17000
SizeOfHeaders	0x400
CheckSum	0x1aac0
Subsystem	3
DllCharacteristics	0x8140
SizeOfStackReserve	0x40000
SizeOfStackCommit	0x2000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xf794	0xf800	R-X CODE
.data	0x11000	0xa80	0x600	RW- IDATA
.idata	0x12000	0x196e	0x1a00	R-- IDATA
.rsrc	0x14000	0x378	0x400	R-- IDATA
.reloc	0x15000	0x13ba	0x1400	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x12000	0x118
RESOURCE	0x14000	0x378
EXCEPTION	0	0
SECURITY	0x13400	0x1aa0
BASERELOC	0x15000	0xb2c
DEBUG	0x1040	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x2610	0x40
Bound_IAT	0	0
IAT	0x12474	0x35c
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
VERSION	#1	792	0

module_name	hint	ord	function_name
ADVAPI32.dll	371		ImpersonateLoggedOnUser
ADVAPI32.dll	656		RevertToSelf
ADVAPI32.dll	288		FreeSid
ADVAPI32.dll	706		SetTokenInformation
ADVAPI32.dll	310		GetLengthSid
ADVAPI32.dll	32		AllocateAndInitializeSid
ADVAPI32.dll	223		DuplicateTokenEx
ADVAPI32.dll	503		OpenProcessToken
ADVAPI32.dll	205		CryptSetKeyParam
ADVAPI32.dll	186		CryptEncrypt
ADVAPI32.dll	197		CryptGetKeyParam
ADVAPI32.dll	179		CryptCreateHash
ADVAPI32.dll	204		CryptSetHashParam
ADVAPI32.dll	200		CryptHashData
ADVAPI32.dll	196		CryptGetHashParam
ADVAPI32.dll	182		CryptDestroyHash
ADVAPI32.dll	177		CryptAcquireContextW
ADVAPI32.dll	192		CryptGenKey
ADVAPI32.dll	203		CryptReleaseContext
ADVAPI32.dll	183		CryptDestroyKey
ADVAPI32.dll	191		CryptExportKey
ADVAPI32.dll	346		GetTokenInformation
ADVAPI32.dll	108		ConvertSidToStringSidW
ADVAPI32.dll	712		StartServiceCtrlDispatcherW
ADVAPI32.dll	647		RegisterServiceCtrlHandlerExW
ADVAPI32.dll	704		SetServiceStatus
ADVAPI32.dll	114		ConvertStringSecurityDescriptorToSecurityDescriptorW
ADVAPI32.dll	193		CryptGenRandom
KERNEL32.dll	826		LeaveCriticalSection
KERNEL32.dll	239		EnterCriticalSection
KERNEL32.dll	210		DeleteCriticalSection
KERNEL32.dll	740		InitializeCriticalSection
KERNEL32.dll	314		FindFirstFileW
KERNEL32.dll	326		FindNextFileW
KERNEL32.dll	303		FindClose
KERNEL32.dll	832		LoadLibraryW
KERNEL32.dll	580		GetProcAddress
KERNEL32.dll	355		FreeLibrary
KERNEL32.dll	1276		WaitForMultipleObjects
KERNEL32.dll	1221		TerminateThread
KERNEL32.dll	149		CreateIoCompletionPort
KERNEL32.dll	606		GetQueuedCompletionStatus
KERNEL32.dll	226		DisconnectNamedPipe
KERNEL32.dll	102		ConnectNamedPipe
KERNEL32.dll	910		PostQueuedCompletionStatus
KERNEL32.dll	161		CreateNamedPipeW
KERNEL32.dll	960		ReadFile
KERNEL32.dll	1257		VerSetConditionMask
KERNEL32.dll	1261		VerifyVersionInfoW
KERNEL32.dll	719		HeapDestroy
KERNEL32.dll	1322		WriteFile
KERNEL32.dll	1131		SetFileTime
KERNEL32.dll	496		GetFileSizeEx
KERNEL32.dll	1127		SetFilePointer
KERNEL32.dll	1109		SetEndOfFile
KERNEL32.dll	344		FlushFileBuffers
KERNEL32.dll	141		CreateFileMappingW
KERNEL32.dll	723		HeapReAlloc
KERNEL32.dll	725		HeapSize
KERNEL32.dll	945		RaiseException
KERNEL32.dll	675		GetVersionExA
KERNEL32.dll	191		CreateToolhelp32Snapshot
KERNEL32.dll	859		Module32FirstW
KERNEL32.dll	861		Module32NextW
KERNEL32.dll	896		OpenProcess
KERNEL32.dll	1040		ResetEvent
KERNEL32.dll	182		CreateThread
KERNEL32.dll	1278		WaitForSingleObject
KERNEL32.dll	1115		SetEvent
KERNEL32.dll	83		CloseHandle
KERNEL32.dll	134		CreateEventW
KERNEL32.dll	513		GetLastError
KERNEL32.dll	531		GetModuleFileNameW
KERNEL32.dll	724		HeapSetInformation
KERNEL32.dll	749		InterlockedExchange
KERNEL32.dll	1205		Sleep
KERNEL32.dll	746		InterlockedCompareExchange
KERNEL32.dll	905		OutputDebugStringA
KERNEL32.dll	1049		RtlUnwind
KERNEL32.dll	1191		SetUnhandledExceptionFilter
KERNEL32.dll	532		GetModuleHandleA
KERNEL32.dll	935		QueryPerformanceCounter
KERNEL32.dll	659		GetTickCount
KERNEL32.dll	454		GetCurrentThreadId
KERNEL32.dll	450		GetCurrentProcessId
KERNEL32.dll	633		GetSystemTimeAsFileTime
KERNEL32.dll	1220		TerminateProcess
KERNEL32.dll	449		GetCurrentProcess
KERNEL32.dll	1240		UnhandledExceptionFilter
KERNEL32.dll	716		HeapAlloc
KERNEL32.dll	585		GetProcessHeap
KERNEL32.dll	720		HeapFree
KERNEL32.dll	936		QueryPerformanceFrequency
KERNEL32.dll	1204		SizeofResource
KERNEL32.dll	852		LockResource
KERNEL32.dll	834		LoadResource
KERNEL32.dll	335		FindResourceW
KERNEL32.dll	334		FindResourceExW
KERNEL32.dll	841		LocalFree
KERNEL32.dll	144		CreateFileW
KERNEL32.dll	347		FlushViewOfFile
KERNEL32.dll	1216		SystemTimeToFileTime
KERNEL32.dll	631		GetSystemTime
KERNEL32.dll	839		LocalFileTimeToFileTime
KERNEL32.dll	233		DuplicateHandle
KERNEL32.dll	159		CreateMutexW
KERNEL32.dll	893		OpenMutexW
KERNEL32.dll	1018		ReleaseMutex
KERNEL32.dll	1243		UnmapViewOfFile
KERNEL32.dll	814		LCMapStringW
KERNEL32.dll	506		GetFullPathNameW
KERNEL32.dll	855		MapViewOfFile
msvcrt.dll	1258		memcpy
msvcrt.dll	17		public: virtual __thiscall type_info::~type_info(void) ??1type_info@@UAE@XZ
msvcrt.dll	210		__set_app_type
msvcrt.dll	190		__p__fmode
msvcrt.dll	185		__p__commode
msvcrt.dll	212		__setusermatherr
msvcrt.dll	257		_amsg_exit
msvcrt.dll	469		_initterm
msvcrt.dll	1167		exit
msvcrt.dll	106		_XcptFilter
msvcrt.dll	133		__badioinfo
msvcrt.dll	207		__pioinfo
msvcrt.dll	367		_fileno
msvcrt.dll	587		_lseeki64
msvcrt.dll	1260		memmove
msvcrt.dll	934		_unlock
msvcrt.dll	141		__dllonexit
msvcrt.dll	578		_lock
msvcrt.dll	815		_snprintf
msvcrt.dll	1216		isdigit
msvcrt.dll	1255		mbtowc
msvcrt.dll	747		_onexit
msvcrt.dll	1218		isleadbyte
msvcrt.dll	475		_iob
msvcrt.dll	1096		_write
msvcrt.dll	478		_isatty
msvcrt.dll	55		void __cdecl terminate(void) ?terminate@@YAXXZ
msvcrt.dll	295		_controlfp
msvcrt.dll	1172		ferror
msvcrt.dll	561		_itoa
msvcrt.dll	354		_exit
msvcrt.dll	276		_cexit
msvcrt.dll	225		__wgetmainargs
msvcrt.dll	274		_callnewh
msvcrt.dll	1246		malloc
msvcrt.dll	1190		free
msvcrt.dll	11		public: __thiscall exception::exception(class exception const &) ??0exception@@QAE@ABV0@@Z
msvcrt.dll	16		public: virtual __thiscall exception::~exception(void) ??1exception@@UAE@XZ
msvcrt.dll	57		public: virtual char const * __thiscall exception::what(void)const ?what@exception@@UBEPBDXZ
msvcrt.dll	12		public: __thiscall exception::exception(void) ??0exception@@QAE@XZ
msvcrt.dll	342		_errno
msvcrt.dll	113		__CxxFrameHandler
msvcrt.dll	1007		_wcsicmp
msvcrt.dll	99		_CxxThrowException
msvcrt.dll	1262		memset
msvcrt.dll	1376		wcsrchr
msvcrt.dll	764		_purecall
msvcrt.dll	1371		wcsncmp
msvcrt.dll	965		_vscwprintf
msvcrt.dll	974		_vsnwprintf
msvcrt.dll	176		__mb_cur_max
WTSAPI32.dll	17		WTSEnumerateSessionsW
WTSAPI32.dll	31		WTSQuerySessionInformationW
WTSAPI32.dll	34		WTSQueryUserToken
WTSAPI32.dll	18		WTSFreeMemory
PSAPI.DLL	16		GetModuleFileNameExW
msvcp60.dll	297		public: __thiscall std::basic_string<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> >::basic_string<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> >(class std::basic_string<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> > const &) ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
msvcp60.dll	1232		public: class std::basic_string<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> > & __thiscall std::basic_string<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> >::append(unsigned short const *) ?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
msvcp60.dll	822		public: class std::basic_string<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> > & __thiscall std::basic_string<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> >::operator+=(unsigned short) ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
msvcp60.dll	821		public: class std::basic_string<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> > & __thiscall std::basic_string<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> >::operator+=(class std::basic_string<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> > const &) ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
msvcp60.dll	2146		public: class std::basic_string<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> > __thiscall std::basic_string<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> >::substr(unsigned int, unsigned int)const ?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
msvcp60.dll	302		public: __thiscall std::basic_string<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> >::basic_string<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> >(unsigned short const *, class std::allocator<unsigned short> const &) ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
msvcp60.dll	1820		public: static unsigned int const std::basic_string<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> >::npos ?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
msvcp60.dll	454		public: __thiscall std::basic_string<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> >::~basic_string<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> >(void) ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
msvcp60.dll	1011		unsigned short const `private: static unsigned short const * __cdecl std::basic_string<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> >::_Nullstr(void)'::`2'::_C ?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
msvcp60.dll	823		public: class std::basic_string<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> > & __thiscall std::basic_string<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> >::operator+=(unsigned short const *) ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
msvcp60.dll	299		public: __thiscall std::basic_string<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> >::basic_string<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> >(class std::allocator<unsigned short> const &) ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
OLEAUT32.dll		9
OLEAUT32.dll		2
OLEAUT32.dll		7
OLEAUT32.dll		6
CRYPT32.dll	164		CryptImportPublicKeyInfo
CRYPT32.dll	87		CertOpenStore
CRYPT32.dll	191		CryptQueryObject
CRYPT32.dll	182		CryptMsgGetParam
CRYPT32.dll	18		CertCloseStore
CRYPT32.dll	175		CryptMsgClose
CRYPT32.dll	53		CertFindCertificateInStore
CRYPT32.dll	64		CertFreeCertificateContext
CRYPT32.dll	75		CertGetNameStringW
CRYPT32.dll	69		CertGetCertificateChain
CRYPT32.dll	116		CertVerifyCertificateChainPolicy
CRYPT32.dll	61		CertFreeCertificateChain
USER32.dll	773		UnregisterClassA
SHLWAPI.dll	69		PathFileExistsW
SHELL32.dll	195		SHGetFolderPathW
ole32.dll	62		CoInitialize
ole32.dll	16		CoCreateInstance
ole32.dll	108		CoUninitialize
WINTRUST.dll	115		WinVerifyTrust

StringTable 040904b0

CompanyName	Microsoft Corporation
FileDescription	微软设备健康助手服务
FileVersion	1.0.16.0
InternalName	DhMachineiSvc.exe
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	DhMachineiSvc.exe
ProductName	微软设备健康助手
ProductVersion	1.0.16.0

VS_FIXEDFILEINFO

FileVersion	1.0.16.0
ProductVersion	1.0.16.0
StrucVersion	0x10000
FileFlagsMask	0
FileFlags	0
FileOS	0
FileType	0
FileSubtype	0

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Code Signing PCA

serial: 33000000CA6CD5321235C4E1550001000000CA

Certificates (4)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:4c:a1:e8:4d:cc:b4:74:7b:3b:00:00:00:00:00:4c
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Time-Stamp PCA
        Validity
            Not Before: Nov 11 22:11:31 2013 GMT
            Not After : Feb 11 22:11:31 2015 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=MOPR, OU=nCipher DSE ESN:C0F4-3086-DEF8, CN=Microsoft Time-Stamp Service
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b1:d8:fa:1b:06:2b:77:a8:e4:94:5d:7c:0f:e6:
                    7a:a6:92:ee:8a:54:1d:a4:f9:84:75:85:97:cc:cb:
                    5c:96:d0:d7:75:2d:d9:08:fb:5b:d2:ee:2d:25:c6:
                    37:3e:f5:ab:7e:1a:53:e5:57:be:6b:e8:bf:ca:96:
                    0a:dc:46:f1:5a:1e:3e:02:d2:b2:e0:26:8e:00:64:
                    7b:be:3c:93:f8:58:32:79:87:d2:1a:5d:23:bc:9c:
                    51:c4:0f:10:fa:04:58:b5:16:76:6e:ec:bc:c6:e5:
                    be:fc:ad:ac:c1:41:db:aa:ce:79:f5:1c:b2:99:41:
                    a7:7a:25:2b:ff:ab:78:0d:58:3a:b1:5e:50:de:64:
                    4c:e0:ca:15:2a:df:a6:e9:fe:a4:66:2f:5b:10:09:
                    09:26:21:d4:3f:0d:2f:6d:d2:f8:77:90:03:6c:de:
                    14:12:a5:8c:e7:36:1f:f4:87:a5:b0:41:17:6f:e3:
                    4d:74:66:c2:fd:a2:71:46:35:51:cc:6b:17:51:63:
                    fa:15:94:92:9a:5f:4b:28:ba:e6:16:45:49:e9:2c:
                    b5:fe:8b:87:af:fc:a5:6d:43:dc:a6:30:fa:29:28:
                    ef:9b:0d:2c:5c:83:de:12:8d:6a:b4:db:71:ef:5c:
                    14:5a:2a:23:28:ff:81:70:57:f1:8c:07:9a:13:d8:
                    2a:53
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                B9:0D:AD:B3:4D:F4:DA:9F:1A:B2:27:26:55:0D:20:44:D8:98:E2:F4
            X509v3 Authority Key Identifier: 
                keyid:23:34:F8:D9:52:46:70:0A:ED:40:FB:76:FB:B3:2B:B0:C3:35:B3:0F

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt

            X509v3 Extended Key Usage: 
                Time Stamping
    Signature Algorithm: sha1WithRSAEncryption
         09:8a:4e:06:af:e8:ed:82:cf:1d:07:7e:d7:2a:a7:24:0b:2d:
         af:9a:5b:24:7f:94:71:0c:55:88:24:1a:52:15:63:e2:90:4d:
         05:4a:98:4a:9c:fb:e1:a7:6d:68:55:82:b9:29:ea:69:a9:b2:
         d5:e3:0c:da:d1:d6:7a:25:37:78:67:1c:0c:fb:db:29:5a:1a:
         97:38:2a:39:56:46:fb:35:81:b9:e4:3d:46:5a:8e:e4:fc:75:
         37:58:59:49:8b:4e:db:3c:15:9d:73:52:4b:eb:7b:0c:3a:c2:
         2d:c1:b3:9b:52:2d:e0:35:c5:b9:c1:57:b3:e8:3d:a1:3c:44:
         f2:23:16:1e:0a:aa:59:37:27:d0:95:52:5e:a8:7f:3f:54:f0:
         81:e1:dc:9a:bd:65:d5:78:f6:f7:4c:39:bb:dd:e0:d6:37:0e:
         91:9a:87:8c:73:e7:71:64:52:f7:3e:03:d8:c6:cd:72:b8:34:
         34:98:5b:8c:d3:f5:08:a6:eb:78:c6:51:a0:0d:0e:6f:f4:6b:
         3c:40:1a:60:16:2c:a9:06:52:9d:1c:13:90:ce:6f:02:1e:ea:
         7b:9c:b3:f6:f8:97:60:f2:65:d1:d1:1f:87:3a:c1:75:f0:42:
         8d:7a:ed:8c:72:b2:7b:fb:2c:8a:b4:91:47:54:e2:2e:69:cc:
         16:54:1a:59

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Signing PCA
        Validity
            Not Before: Apr 22 17:39:00 2014 GMT
            Not After : Jul 22 17:39:00 2015 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=MOPR, CN=Microsoft Corporation
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:96:71:5d:ed:06:46:fa:84:cb:9d:5b:b7:46:c7:
                    b0:e1:b4:11:39:03:ad:b1:15:73:60:9c:eb:a7:b6:
                    6e:1a:3c:3f:ff:65:e3:34:f1:a6:a5:21:5e:56:99:
                    6c:58:e4:92:a1:0a:5c:c2:d3:dc:52:2f:0c:65:9a:
                    20:61:40:53:31:9c:6c:8f:21:7d:ba:f9:fe:13:50:
                    52:60:95:3a:5b:b9:58:a5:74:61:41:a9:94:e0:ad:
                    26:4e:4c:a1:97:70:49:27:5e:7c:67:ca:4f:1e:71:
                    84:46:bc:1d:4b:b6:e2:0f:c5:c6:27:c9:07:e6:7a:
                    0a:a5:17:00:19:4c:70:45:38:2d:81:b4:50:aa:c5:
                    67:d1:fa:79:bc:c5:cc:a1:72:9b:f4:25:34:98:f8:
                    54:df:12:39:38:12:2f:a4:6b:a5:9a:7e:c7:62:d1:
                    dc:cf:ed:3d:34:f8:b9:df:35:30:ba:ec:79:32:a9:
                    e1:a9:ac:55:4d:4c:7f:4c:56:c3:13:0b:76:f1:07:
                    f9:cc:47:ac:fb:88:d5:52:a5:1e:28:fa:3d:2d:cf:
                    cf:84:98:86:71:65:11:cf:85:c9:09:44:86:e1:6f:
                    e7:b1:fc:ac:40:44:a5:a9:8b:23:3f:82:49:9d:d5:
                    96:59:50:13:59:18:73:ff:43:0c:ad:2b:d4:7f:30:
                    40:67
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                Code Signing
            X509v3 Subject Key Identifier: 
                1F:5E:E2:5D:50:8D:56:86:BE:4A:3C:CF:04:E8:A7:87:B5:CB:BF:83
            X509v3 Subject Alternative Name: 
                DirName:/OU=MOPR/serialNumber=31595+b4218f13-6fca-490f-9c47-3fc557dfc440
            X509v3 Authority Key Identifier: 
                keyid:CB:11:E8:CA:D2:B4:16:58:01:C9:37:2E:33:16:16:B9:4C:9A:0A:1F

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt

    Signature Algorithm: sha1WithRSAEncryption
         77:5c:eb:d7:91:3d:cd:bd:7b:83:d9:85:a9:b0:43:9d:73:7c:
         17:c9:0f:ed:36:db:c7:b5:2c:1b:5e:fb:54:05:3a:83:71:40:
         81:09:a2:b7:71:26:5e:d6:7d:b6:6c:3b:c9:aa:5f:5d:03:18:
         2a:1d:27:7e:07:e9:c5:65:1f:b5:cf:0d:b7:54:c7:28:38:5a:
         88:e7:7b:c1:19:b6:56:32:ba:e2:cc:cb:93:db:af:6e:0f:5d:
         44:f5:d4:b0:ef:1b:d5:4e:c1:af:0e:ef:20:9b:f2:e1:fe:27:
         5d:e8:c5:ff:61:f6:19:d2:28:0a:22:9d:df:cd:70:82:9e:18:
         72:d8:23:cc:7a:2c:43:ee:ff:ea:c0:e0:e6:1d:aa:9e:97:33:
         00:52:6f:07:b8:d3:88:6c:de:a4:06:35:a7:c2:53:86:65:11:
         77:09:8f:35:59:b9:d8:86:a8:00:fe:f8:31:7d:2c:f4:8c:05:
         9d:c0:c1:d5:77:72:6c:e9:4d:59:26:83:f1:c2:b2:88:57:93:
         35:00:7c:50:2b:bc:59:fc:fe:1c:29:38:82:d3:de:52:97:45:
         29:18:4e:96:5b:9d:ba:5f:1b:a3:f1:27:50:ea:07:95:e8:6d:
         34:0d:38:57:dc:37:28:35:95:3a:38:9c:d4:ed:6a:85:5d:0e:
         22:11:5e:7b

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:33:26:1a:00:00:00:00:00:31
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
        Validity
            Not Before: Aug 31 22:19:32 2010 GMT
            Not After : Aug 31 22:29:32 2020 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Signing PCA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b2:72:59:5c:19:30:64:bf:1d:9a:60:20:20:42:
                    99:76:53:6c:3e:1b:d6:6f:cc:cb:f1:ea:6b:fe:97:
                    16:10:e0:df:3a:74:83:1a:b7:2f:a0:32:ec:ff:de:
                    c2:42:4e:23:d5:72:00:db:35:57:0a:89:ca:ae:20:
                    49:f4:f0:68:ac:4d:4b:8d:a5:bd:79:4b:71:9b:47:
                    07:da:fd:25:df:9d:75:88:cf:aa:73:44:7f:d7:81:
                    db:f3:bd:f2:36:a4:c9:5c:45:dc:af:ad:3d:e0:28:
                    68:97:1a:a7:a5:72:73:56:f1:17:94:e4:fd:35:94:
                    72:a0:d6:76:5f:1e:77:45:83:85:38:16:d0:73:5b:
                    05:ba:67:52:8d:a5:b2:69:2f:da:19:0b:fe:92:74:
                    29:e2:76:2f:54:dd:14:30:59:f8:d2:8d:62:fd:cb:
                    c9:5f:46:31:50:b9:27:13:e4:40:30:cf:72:29:10:
                    28:22:c7:37:4e:3d:a0:32:3d:90:cd:a1:38:06:85:
                    5c:4e:56:82:28:2a:05:32:b7:4b:d7:4f:63:e7:d2:
                    2d:62:f1:45:3d:e7:ac:08:00:f6:46:a1:9e:d1:5b:
                    8c:26:53:e8:7a:aa:4a:f2:46:cf:37:3c:38:9e:b4:
                    77:5c:a5:17:9e:8d:cb:11:8f:56:3c:c1:ac:09:5f:
                    03:d3
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier: 
                CB:11:E8:CA:D2:B4:16:58:01:C9:37:2E:33:16:16:B9:4C:9A:0A:1F
            X509v3 Key Usage: 
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1: 
                .....
            1.3.6.1.4.1.311.21.2: 
                ....1N.&....`;.1o.<..-
            1.3.6.1.4.1.311.20.2: 
                .
.S.u.b.C.A
            X509v3 Authority Key Identifier: 
                keyid:0E:AC:82:60:40:56:27:97:E5:25:13:FC:2A:E1:0A:53:95:59:E4:A4

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt

    Signature Algorithm: sha1WithRSAEncryption
         59:39:3e:7f:26:46:af:eb:6f:40:b1:32:b5:6a:eb:0e:2f:6e:
         a8:49:f7:eb:5f:75:ed:4c:3b:2d:d7:43:ad:0b:fe:cb:e9:2d:
         31:a3:23:cc:7c:50:98:80:21:5d:ac:3d:2f:4c:ba:a2:a8:56:
         9c:e3:70:bb:b8:b4:f8:79:b5:49:72:f7:3e:ea:41:7f:ca:e1:
         0c:17:69:cb:a5:9c:20:2d:fa:0b:50:c4:56:cd:2d:e3:4a:d2:
         bc:70:e7:a8:0d:a2:03:a5:56:e0:b8:8a:4b:57:f2:95:42:9c:
         f1:f3:ef:ee:e3:86:1f:34:3c:b8:56:9a:f0:53:23:85:2a:a4:
         82:1c:93:e2:94:07:1d:f2:e2:4e:f8:8c:a1:ca:e8:13:a5:91:
         4e:c8:1b:d2:8f:72:95:2a:71:6d:9b:1a:f8:1c:f0:53:d6:67:
         cc:22:ff:5c:1d:cd:a2:8c:bd:27:b2:79:63:56:44:a2:51:cd:
         f9:e9:a3:58:56:dd:9b:02:45:44:2f:5f:f4:da:ae:d4:82:32:
         6e:fc:a4:95:13:e4:eb:69:e7:a9:a2:2c:be:c8:2b:10:0e:65:
         8e:99:db:f5:a2:fa:12:26:09:65:38:94:f1:7a:1f:4a:bb:d1:
         e1:56:e8:d0:78:96:18:5c:c9:35:16:5f:dd:93:1d:49:8e:2d:
         be:ad:34:44:1c:ee:10:15:1a:00:5d:dd:35:5b:21:ce:98:c7:
         09:ee:85:0e:8c:4f:6d:0e:13:4e:3d:7c:29:48:9c:72:d1:f3:
         6c:ca:c1:ec:70:a3:57:92:57:7d:94:8d:a0:1b:48:03:5a:f7:
         cf:a3:67:0a:74:a5:36:ed:2d:2f:17:c8:e6:72:37:12:f4:6f:
         b1:3c:67:82:f9:52:b2:8d:33:16:65:1e:0e:8a:dd:10:de:64:
         f4:6f:ce:46:d4:d3:17:e9:79:c4:04:b4:d3:fb:2c:df:1f:8a:
         9e:ac:0a:fb:13:27:40:ad:e4:f9:e1:a9:7f:46:bb:07:60:47:
         65:60:40:4e:b0:42:ec:4e:ed:b3:76:79:d8:0a:34:09:6d:1c:
         80:31:1f:e2:0e:54:dd:e5:a1:fb:e5:47:10:ad:64:98:ff:50:
         16:2e:7c:bf:05:21:7a:e2:95:41:27:69:c3:93:8f:95:c9:8d:
         d8:9b:21:ae:0d:5c:9c:f0:a2:ae:86:68:83:0c:6a:2d:bb:76:
         6b:00:1d:96:ad:f2:16:7b:f6:16:83:24:b9:88:cf:6a:a8:47:
         31:2f:9a:dc:e3:71:3d:d7:00:7e:62:47:d1:ce:88:c9:b8:18:
         fa:0e:72:8d:c1:a3:3d:af:02:40:6a:ff:69:9b:96:e2:10:a8:
         10:b4:37:50:08:d6:c3:3d

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:16:68:34:00:00:00:00:00:1c
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
        Validity
            Not Before: Apr  3 12:53:09 2007 GMT
            Not After : Apr  3 13:03:09 2021 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Time-Stamp PCA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:9f:a1:6c:b1:df:db:48:92:2a:7c:6b:2e:19:e1:
                    bd:e2:e3:c5:99:51:23:50:ad:ce:dd:18:4e:24:0f:
                    ee:d1:a7:d1:4c:ad:74:30:20:11:eb:07:d5:54:95:
                    15:49:94:1b:42:92:ae:98:5c:30:26:da:00:6b:e8:
                    7b:bd:ec:89:07:0f:f7:0e:04:98:f0:89:cc:1f:cb:
                    33:24:87:9d:f2:f4:67:1c:2c:fc:7b:e7:88:1d:ea:
                    e7:4e:a3:a1:c1:23:53:ca:8d:fa:45:cf:09:d0:5e:
                    af:d0:b0:42:04:a2:f9:a6:6c:93:67:d7:28:dc:46:
                    53:b0:86:d0:e5:28:46:2e:27:ac:86:4f:55:52:0c:
                    e4:03:2c:fb:6a:90:90:30:6e:87:f3:59:30:9d:fa:
                    7e:d6:97:b3:e8:21:97:7e:f8:d2:13:f3:08:b7:53:
                    6d:52:b4:45:90:9f:48:00:4a:47:66:11:27:29:66:
                    a8:97:e4:d3:06:81:4a:a2:f9:84:a7:11:47:14:09:
                    82:9f:84:ed:55:78:fe:01:9a:1d:50:08:85:00:10:
                    30:46:ed:b7:de:23:46:bb:c4:2d:54:9f:af:1e:78:
                    41:31:77:cc:9b:df:3b:83:93:a1:61:02:b5:1d:0d:
                    b1:fc:f7:9b:b2:01:ce:22:4b:54:ff:f9:05:c3:c2:
                    20:0b
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier: 
                23:34:F8:D9:52:46:70:0A:ED:40:FB:76:FB:B3:2B:B0:C3:35:B3:0F
            X509v3 Key Usage: 
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1: 
                ...
            X509v3 Authority Key Identifier: 
                keyid:0E:AC:82:60:40:56:27:97:E5:25:13:FC:2A:E1:0A:53:95:59:E4:A4
                DirName:/DC=com/DC=microsoft/CN=Microsoft Root Certificate Authority
                serial:79:AD:16:A1:4A:A0:A5:AD:4C:73:58:F4:07:13:2E:65

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt

            X509v3 Extended Key Usage: 
                Time Stamping
    Signature Algorithm: sha1WithRSAEncryption
         10:97:8a:c3:5c:03:44:36:dd:e9:b4:ad:77:db:ce:79:51:4d:
         01:b1:2e:74:71:5b:6d:0c:13:ab:ce:be:7b:8f:b8:2e:d4:12:
         a2:8c:6d:62:b8:57:02:cb:4e:20:13:50:99:dd:7a:40:e2:57:
         bb:af:58:9a:1c:e1:1d:01:86:ac:bb:78:f2:8b:d0:ec:3b:01:
         ee:e2:be:8f:0a:05:c8:8d:48:e2:f0:53:15:dd:4f:ab:92:e4:
         e7:8d:6a:d5:80:c1:e6:94:f2:06:2f:85:03:e9:91:2a:24:22:
         70:fb:f6:fc:e4:78:99:2e:0d:f7:07:e2:70:bc:18:4e:9d:8e:
         6b:0a:72:95:b8:a1:39:9c:67:2d:c5:51:0e:ea:62:5c:3f:16:
         98:8b:20:3f:e2:07:1a:32:f9:cc:31:4a:76:31:3d:2b:72:0b:
         c8:ea:70:3d:ff:85:0a:13:df:c2:0a:61:8e:f0:d7:b8:17:eb:
         4e:8b:7f:c5:35:2b:5e:a3:bf:eb:bc:7d:0b:42:7b:d4:53:72:
         21:ee:30:ca:bb:78:65:5c:5b:01:17:0a:14:0e:d2:da:14:98:
         f5:3c:b9:66:58:b3:2d:2f:e7:f9:85:86:cc:51:56:e8:9d:70:
         94:6c:ac:39:4c:d4:f6:79:bf:aa:18:7a:62:29:ef:a2:9b:29:
         34:06:77:1a:62:c9:3d:1e:6d:1f:82:f0:0b:c7:2c:bb:cf:43:
         b3:e5:f9:ec:7d:b5:e3:a4:a8:74:35:b8:4e:c5:71:23:12:26:
         76:0b:3c:52:8c:71:5a:46:43:14:bc:b3:b3:b0:4d:67:c8:9f:
         42:ff:80:79:21:80:9e:15:30:66:e8:42:12:5e:1a:c8:9e:22:
         21:d0:43:e9:2b:e9:bb:f4:48:cc:2c:d4:d8:32:80:4c:26:2a:
         48:24:5f:5a:ea:56:ef:a6:de:99:9d:ca:3a:6f:bd:81:27:74:
         06:11:ee:76:21:bf:9b:82:c1:27:54:b6:b1:6a:3d:89:a1:76:
         61:b4:6e:a1:13:a6:bf:aa:47:f0:12:6f:fd:8a:32:6c:b2:fe:
         df:51:c8:8c:23:c9:66:bd:9d:1d:87:12:64:02:3d:2d:af:59:
         8f:b8:e4:21:e5:b5:b0:ca:63:b4:78:54:05:d4:41:2e:50:ac:
         94:b0:a5:78:ab:b3:a0:96:75:1a:d9:92:87:13:75:22:2f:32:
         a8:08:6e:a0:5b:8c:25:bf:a0:ef:84:ca:21:d6:eb:1e:4f:c9:
         9a:ee:49:e0:f7:01:65:6f:89:0b:7d:c8:69:c8:e6:6e:ea:a7:
         97:ce:31:29:ff:0e:c5:5b:5c:d8:4d:1b:a1:d8:fa:2f:9e:3f:
         2e:55:16:6b:c9:13:a3:fd

pkcs7-signedData

SHA1: nil

1.3.6.1.4.1.311.2.1.4

1.3.6.1.4.1.311.2.1.15
- :

SHA1

fb a9 17 cd 70 23 35 33 f7 21 ec fc 8b b1 8d 2e |....p#53.!......| 71 88 85 21 |q..! |

unnamed

Certificate #0
- 2
  - 33:00:00:00:4C:A1:E8:4D:CC:B4:74:7B:3B:00:00:00:
    00:00:4C
  - RSA-SHA1: nil
  - Issuer
    - C: US
    - ST: Washington
    - L: Redmond
    - O: Microsoft Corporation
    - CN: Microsoft Time-Stamp PCA
  - 2013-11-11 22:11:31 UTC: 2015-02-11 22:11:31 UTC
  - Subject
    - C: US
    - ST: Washington
    - L: Redmond
    - O: Microsoft Corporation
    - OU: MOPR
    - OU: nCipher DSE ESN:C0F4-3086-DEF8
    - CN: Microsoft Time-Stamp Service
  - #5
    - rsaEncryption: nil
    - B1:D8:FA:1B:06:2B:77:A8:E4:94:5D:7C:0F:E6:7A:A6:
      92:EE:8A:54:1D:A4:F9:84:75:85:97:CC:CB:5C:96:D0:
      D7:75:2D:D9:08:FB:5B:D2:EE:2D:25:C6:37:3E:F5:AB:
      7E:1A:53:E5:57:BE:6B:E8:BF:CA:96:0A:DC:46:F1:5A:
      1E:3E:02:D2:B2:E0:26:8E:00:64:7B:BE:3C:93:F8:58:
      32:79:87:D2:1A:5D:23:BC:9C:51:C4:0F:10:FA:04:58:
      B5:16:76:6E:EC:BC:C6:E5:BE:FC:AD:AC:C1:41:DB:AA:
      CE:79:F5:1C:B2:99:41:A7:7A:25:2B:FF:AB:78:0D:58:
      3A:B1:5E:50:DE:64:4C:E0:CA:15:2A:DF:A6:E9:FE:A4:
      66:2F:5B:10:09:09:26:21:D4:3F:0D:2F:6D:D2:F8:77:
      90:03:6C:DE:14:12:A5:8C:E7:36:1F:F4:87:A5:B0:41:
      17:6F:E3:4D:74:66:C2:FD:A2:71:46:35:51:CC:6B:17:
      51:63:FA:15:94:92:9A:5F:4B:28:BA:E6:16:45:49:E9:
      2C:B5:FE:8B:87:AF:FC:A5:6D:43:DC:A6:30:FA:29:28:
      EF:9B:0D:2C:5C:83:DE:12:8D:6A:B4:DB:71:EF:5C:14:
      5A:2A:23:28:FF:81:70:57:F1:8C:07:9A:13:D8:2A:53: 0x010001
  - #6
    - subjectKeyIdentifier:
```
b9 0d ad b3 4d f4 da 9f  1a b2 27 26 55 0d 20 44  |....M.....'&U. D|
d8 98 e2 f4                                       |....            |
```
    - authorityKeyIdentifier:
```
23 34 f8 d9 52 46 70 0a  ed 40 fb 76 fb b3 2b b0  |#4..RFp..@.v..+.|
c3 35 b3 0f                                       |.5..            |
```
    - crlDistributionPoints: http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
    - authorityInfoAccess
      - caIssuers: http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt
    - extendedKeyUsage: timeStamping
- RSA-SHA1:
```
09 8a 4e 06 af e8 ed 82  cf 1d 07 7e d7 2a a7 24  |..N........~.*.$|
0b 2d af 9a 5b 24 7f 94  71 0c 55 88 24 1a 52 15  |.-..[$..q.U.$.R.|
63 e2 90 4d 05 4a 98 4a  9c fb e1 a7 6d 68 55 82  |c..M.J.J....mhU.|
b9 29 ea 69 a9 b2 d5 e3  0c da d1 d6 7a 25 37 78  |.).i........z%7x|
67 1c 0c fb db 29 5a 1a  97 38 2a 39 56 46 fb 35  |g....)Z..8*9VF.5|
81 b9 e4 3d 46 5a 8e e4  fc 75 37 58 59 49 8b 4e  |...=FZ...u7XYI.N|
db 3c 15 9d 73 52 4b eb  7b 0c 3a c2 2d c1 b3 9b  |.<..sRK.{.:.-...|
52 2d e0 35 c5 b9 c1 57  b3 e8 3d a1 3c 44 f2 23  |R-.5...W..=....|
cd 72 b8 34 34 98 5b 8c  d3 f5 08 a6 eb 78 c6 51  |.r.44.[......x.Q|
a0 0d 0e 6f f4 6b 3c 40  1a 60 16 2c a9 06 52 9d  |...o.k<@.`.,..R.|
1c 13 90 ce 6f 02 1e ea  7b 9c b3 f6 f8 97 60 f2  |....o...{.....`.|
65 d1 d1 1f 87 3a c1 75  f0 42 8d 7a ed 8c 72 b2  |e....:.u.B.z..r.|
7b fb 2c 8a b4 91 47 54  e2 2e 69 cc 16 54 1a 59  |{.,...GT..i..T.Y|
```
Certificate #1
- 2
  - 33:00:00:00:CA:6C:D5:32:12:35:C4:E1:55:00:01:00:
    00:00:CA
  - RSA-SHA1: nil
  - Issuer
    - C: US
    - ST: Washington
    - L: Redmond
    - O: Microsoft Corporation
    - CN: Microsoft Code Signing PCA
  - 2014-04-22 17:39:00 UTC: 2015-07-22 17:39:00 UTC
  - Subject
    - C: US
    - ST: Washington
    - L: Redmond
    - O: Microsoft Corporation
    - OU: MOPR
    - CN: Microsoft Corporation
  - #5
    - rsaEncryption: nil
    - 96:71:5D:ED:06:46:FA:84:CB:9D:5B:B7:46:C7:B0:E1:
      B4:11:39:03:AD:B1:15:73:60:9C:EB:A7:B6:6E:1A:3C:
      3F:FF:65:E3:34:F1:A6:A5:21:5E:56:99:6C:58:E4:92:
      A1:0A:5C:C2:D3:DC:52:2F:0C:65:9A:20:61:40:53:31:
      9C:6C:8F:21:7D:BA:F9:FE:13:50:52:60:95:3A:5B:B9:
      58:A5:74:61:41:A9:94:E0:AD:26:4E:4C:A1:97:70:49:
      27:5E:7C:67:CA:4F:1E:71:84:46:BC:1D:4B:B6:E2:0F:
      C5:C6:27:C9:07:E6:7A:0A:A5:17:00:19:4C:70:45:38:
      2D:81:B4:50:AA:C5:67:D1:FA:79:BC:C5:CC:A1:72:9B:
      F4:25:34:98:F8:54:DF:12:39:38:12:2F:A4:6B:A5:9A:
      7E:C7:62:D1:DC:CF:ED:3D:34:F8:B9:DF:35:30:BA:EC:
      79:32:A9:E1:A9:AC:55:4D:4C:7F:4C:56:C3:13:0B:76:
      F1:07:F9:CC:47:AC:FB:88:D5:52:A5:1E:28:FA:3D:2D:
      CF:CF:84:98:86:71:65:11:CF:85:C9:09:44:86:E1:6F:
      E7:B1:FC:AC:40:44:A5:A9:8B:23:3F:82:49:9D:D5:96:
      59:50:13:59:18:73:FF:43:0C:AD:2B:D4:7F:30:40:67: 0x010001
  - #6
    - extendedKeyUsage: codeSigning
    - subjectKeyIdentifier:
```
1f 5e e2 5d 50 8d 56 86  be 4a 3c cf 04 e8 a7 87  |.^.]P.V..J<.....|
b5 cb bf 83                                       |....            |
```
    - subjectAltName
      - #0
        OU: MOPR
        serialNumber: 31595+b4218f13-6fca-490f-9c47-3fc557dfc440
    - authorityKeyIdentifier:
```
cb 11 e8 ca d2 b4 16 58  01 c9 37 2e 33 16 16 b9  |.......X..7.3...|
4c 9a 0a 1f                                       |L...            |
```
    - crlDistributionPoints: http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
    - authorityInfoAccess
      - caIssuers: http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt
- RSA-SHA1:
```
77 5c eb d7 91 3d cd bd  7b 83 d9 85 a9 b0 43 9d  |w\...=..{.....C.|
73 7c 17 c9 0f ed 36 db  c7 b5 2c 1b 5e fb 54 05  |s|....6...,.^.T.|
3a 83 71 40 81 09 a2 b7  71 26 5e d6 7d b6 6c 3b  |:.q@....q&^.}.l;|
c9 aa 5f 5d 03 18 2a 1d  27 7e 07 e9 c5 65 1f b5  |.._]..*.'~...e..|
cf 0d b7 54 c7 28 38 5a  88 e7 7b c1 19 b6 56 32  |...T.(8Z..{...V2|
ba e2 cc cb 93 db af 6e  0f 5d 44 f5 d4 b0 ef 1b  |.......n.]D.....|
d5 4e c1 af 0e ef 20 9b  f2 e1 fe 27 5d e8 c5 ff  |.N.... ....']...|
61 f6 19 d2 28 0a 22 9d  df cd 70 82 9e 18 72 d8  |a...(."...p...r.|
23 cc 7a 2c 43 ee ff ea  c0 e0 e6 1d aa 9e 97 33  |#.z,C..........3|
00 52 6f 07 b8 d3 88 6c  de a4 06 35 a7 c2 53 86  |.Ro....l...5..S.|
65 11 77 09 8f 35 59 b9  d8 86 a8 00 fe f8 31 7d  |e.w..5Y.......1}|
2c f4 8c 05 9d c0 c1 d5  77 72 6c e9 4d 59 26 83  |,.......wrl.MY&.|
f1 c2 b2 88 57 93 35 00  7c 50 2b bc 59 fc fe 1c  |....W.5.|P+.Y...|
29 38 82 d3 de 52 97 45  29 18 4e 96 5b 9d ba 5f  |)8...R.E).N.[.._|
1b a3 f1 27 50 ea 07 95  e8 6d 34 0d 38 57 dc 37  |...'P....m4.8W.7|
28 35 95 3a 38 9c d4 ed  6a 85 5d 0e 22 11 5e 7b  |(5.:8...j.].".^{|
```

2
- 61:33:26:1A:00:00:00:00:00:31
- RSA-SHA1: nil
- #2
  - DC: com
  - DC: microsoft
  - CN: Microsoft Root Certificate Authority
- 2010-08-31 22:19:32 UTC: 2020-08-31 22:29:32 UTC
- Subject
  - C: US
  - ST: Washington
  - L: Redmond
  - O: Microsoft Corporation
  - CN: Microsoft Code Signing PCA
- #5
  - rsaEncryption: nil
  - B2:72:59:5C:19:30:64:BF:1D:9A:60:20:20:42:99:76:
    53:6C:3E:1B:D6:6F:CC:CB:F1:EA:6B:FE:97:16:10:E0:
    DF:3A:74:83:1A:B7:2F:A0:32:EC:FF:DE:C2:42:4E:23:
    D5:72:00:DB:35:57:0A:89:CA:AE:20:49:F4:F0:68:AC:
    4D:4B:8D:A5:BD:79:4B:71:9B:47:07:DA:FD:25:DF:9D:
    75:88:CF:AA:73:44:7F:D7:81:DB:F3:BD:F2:36:A4:C9:
    5C:45:DC:AF:AD:3D:E0:28:68:97:1A:A7:A5:72:73:56:
    F1:17:94:E4:FD:35:94:72:A0:D6:76:5F:1E:77:45:83:
    85:38:16:D0:73:5B:05:BA:67:52:8D:A5:B2:69:2F:DA:
    19:0B:FE:92:74:29:E2:76:2F:54:DD:14:30:59:F8:D2:
    8D:62:FD:CB:C9:5F:46:31:50:B9:27:13:E4:40:30:CF:
    72:29:10:28:22:C7:37:4E:3D:A0:32:3D:90:CD:A1:38:
    06:85:5C:4E:56:82:28:2A:05:32:B7:4B:D7:4F:63:E7:
    D2:2D:62:F1:45:3D:E7:AC:08:00:F6:46:A1:9E:D1:5B:
    8C:26:53:E8:7A:AA:4A:F2:46:CF:37:3C:38:9E:B4:77:
    5C:A5:17:9E:8D:CB:11:8F:56:3C:C1:AC:09:5F:03:D3: 0x010001
- X509v3 extensions
  - basicConstraints: true, true
  - subjectKeyIdentifier:
```
cb 11 e8 ca d2 b4 16 58  01 c9 37 2e 33 16 16 b9  |.......X..7.3...|
4c 9a 0a 1f                                       |L...            |
```
  - keyUsage: 0x86
  - 1.3.6.1.4.1.311.21.1: 0x010001
  - 1.3.6.1.4.1.311.21.2:
```
fd d1 31 4e d3 26 8a 95  e1 98 60 3b a8 31 6f a6  |..1N.&....`;.1o.|
3c bc d8 2d                                       |<..-            |
```
  - 1.3.6.1.4.1.311.20.2:
```
00 53 00 75 00 62 00 43  00 41                    |.S.u.b.C.A      |
```
  - authorityKeyIdentifier:
```
0e ac 82 60 40 56 27 97  e5 25 13 fc 2a e1 0a 53  |...`@V'..%..*..S|
95 59 e4 a4                                       |.Y..            |
```
  - crlDistributionPoints: http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
  - authorityInfoAccess
    - caIssuers: http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt

RSA-SHA1:

59 39 3e 7f 26 46 af eb  6f 40 b1 32 b5 6a eb 0e  |Y9>.&F..o@.2.j..|
2f 6e a8 49 f7 eb 5f 75  ed 4c 3b 2d d7 43 ad 0b  |/n.I.._u.L;-.C..|
fe cb e9 2d 31 a3 23 cc  7c 50 98 80 21 5d ac 3d  |...-1.#.|P..!].=|
2f 4c ba a2 a8 56 9c e3  70 bb b8 b4 f8 79 b5 49  |/L...V..p....y.I|
72 f7 3e ea 41 7f ca e1  0c 17 69 cb a5 9c 20 2d  |r.>.A.....i... -|
fa 0b 50 c4 56 cd 2d e3  4a d2 bc 70 e7 a8 0d a2  |..P.V.-.J..p....|
03 a5 56 e0 b8 8a 4b 57  f2 95 42 9c f1 f3 ef ee  |..V...KW..B.....|
e3 86 1f 34 3c b8 56 9a  f0 53 23 85 2a a4 82 1c  |...4<.V..S#.*...|
93 e2 94 07 1d f2 e2 4e  f8 8c a1 ca e8 13 a5 91  |.......N........|
4e c8 1b d2 8f 72 95 2a  71 6d 9b 1a f8 1c f0 53  |N....r.*qm.....S|
d6 67 cc 22 ff 5c 1d cd  a2 8c bd 27 b2 79 63 56  |.g.".\.....'.ycV|
44 a2 51 cd f9 e9 a3 58  56 dd 9b 02 45 44 2f 5f  |D.Q....XV...ED/_|
f4 da ae d4 82 32 6e fc  a4 95 13 e4 eb 69 e7 a9  |.....2n......i..|
a2 2c be c8 2b 10 0e 65  8e 99 db f5 a2 fa 12 26  |.,..+..e.......&|
09 65 38 94 f1 7a 1f 4a  bb d1 e1 56 e8 d0 78 96  |.e8..z.J...V..x.|
18 5c c9 35 16 5f dd 93  1d 49 8e 2d be ad 34 44  |.\.5._...I.-..4D|
1c ee 10 15 1a 00 5d dd  35 5b 21 ce 98 c7 09 ee  |......].5[!.....|
85 0e 8c 4f 6d 0e 13 4e  3d 7c 29 48 9c 72 d1 f3  |...Om..N=|)H.r..|
6c ca c1 ec 70 a3 57 92  57 7d 94 8d a0 1b 48 03  |l...p.W.W}....H.|
5a f7 cf a3 67 0a 74 a5  36 ed 2d 2f 17 c8 e6 72  |Z...g.t.6.-/...r|
37 12 f4 6f b1 3c 67 82  f9 52 b2 8d 33 16 65 1e  |7..o.

2
- 61:16:68:34:00:00:00:00:00:1C
- RSA-SHA1: nil
- #2
  - DC: com
  - DC: microsoft
  - CN: Microsoft Root Certificate Authority
- 2007-04-03 12:53:09 UTC: 2021-04-03 13:03:09 UTC
- Subject
  - C: US
  - ST: Washington
  - L: Redmond
  - O: Microsoft Corporation
  - CN: Microsoft Time-Stamp PCA
- #5
  - rsaEncryption: nil
  - 9F:A1:6C:B1:DF:DB:48:92:2A:7C:6B:2E:19:E1:BD:E2:
    E3:C5:99:51:23:50:AD:CE:DD:18:4E:24:0F:EE:D1:A7:
    D1:4C:AD:74:30:20:11:EB:07:D5:54:95:15:49:94:1B:
    42:92:AE:98:5C:30:26:DA:00:6B:E8:7B:BD:EC:89:07:
    0F:F7:0E:04:98:F0:89:CC:1F:CB:33:24:87:9D:F2:F4:
    67:1C:2C:FC:7B:E7:88:1D:EA:E7:4E:A3:A1:C1:23:53:
    CA:8D:FA:45:CF:09:D0:5E:AF:D0:B0:42:04:A2:F9:A6:
    6C:93:67:D7:28:DC:46:53:B0:86:D0:E5:28:46:2E:27:
    AC:86:4F:55:52:0C:E4:03:2C:FB:6A:90:90:30:6E:87:
    F3:59:30:9D:FA:7E:D6:97:B3:E8:21:97:7E:F8:D2:13:
    F3:08:B7:53:6D:52:B4:45:90:9F:48:00:4A:47:66:11:
    27:29:66:A8:97:E4:D3:06:81:4A:A2:F9:84:A7:11:47:
    14:09:82:9F:84:ED:55:78:FE:01:9A:1D:50:08:85:00:
    10:30:46:ED:B7:DE:23:46:BB:C4:2D:54:9F:AF:1E:78:
    41:31:77:CC:9B:DF:3B:83:93:A1:61:02:B5:1D:0D:B1:
    FC:F7:9B:B2:01:CE:22:4B:54:FF:F9:05:C3:C2:20:0B: 0x010001
- X509v3 extensions
  - basicConstraints: true, true
  - subjectKeyIdentifier:
```
23 34 f8 d9 52 46 70 0a  ed 40 fb 76 fb b3 2b b0  |#4..RFp..@.v..+.|
c3 35 b3 0f                                       |.5..            |
```
  - keyUsage: 0x86
  - 1.3.6.1.4.1.311.21.1: 0
  - authorityKeyIdentifier
    - 0e ac 82 60 40 56 27 97 e5 25 13 fc 2a e1 0a 53 |...`@V'..%..*..S| 95 59 e4 a4 |.Y.. |
      - #0
        DC: com
        DC: microsoft
        CN: Microsoft Root Certificate Authority
      - 79 ad 16 a1 4a a0 a5 ad 4c 73 58 f4 07 13 2e 65 |y...J...LsX....e|
  - crlDistributionPoints: http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
  - authorityInfoAccess
    - caIssuers: http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt
  - extendedKeyUsage: timeStamping

RSA-SHA1:

10 97 8a c3 5c 03 44 36  dd e9 b4 ad 77 db ce 79  |....\.D6....w..y|
51 4d 01 b1 2e 74 71 5b  6d 0c 13 ab ce be 7b 8f  |QM...tq[m.....{.|
b8 2e d4 12 a2 8c 6d 62  b8 57 02 cb 4e 20 13 50  |......mb.W..N .P|
99 dd 7a 40 e2 57 bb af  58 9a 1c e1 1d 01 86 ac  |..z@.W..X.......|
bb 78 f2 8b d0 ec 3b 01  ee e2 be 8f 0a 05 c8 8d  |.x....;.........|
48 e2 f0 53 15 dd 4f ab  92 e4 e7 8d 6a d5 80 c1  |H..S..O.....j...|
e6 94 f2 06 2f 85 03 e9  91 2a 24 22 70 fb f6 fc  |..../....*$"p...|
e4 78 99 2e 0d f7 07 e2  70 bc 18 4e 9d 8e 6b 0a  |.x......p..N..k.|
72 95 b8 a1 39 9c 67 2d  c5 51 0e ea 62 5c 3f 16  |r...9.g-.Q..b\?.|
98 8b 20 3f e2 07 1a 32  f9 cc 31 4a 76 31 3d 2b  |.. ?...2..1Jv1=+|
72 0b c8 ea 70 3d ff 85  0a 13 df c2 0a 61 8e f0  |r...p=.......a..|
d7 b8 17 eb 4e 8b 7f c5  35 2b 5e a3 bf eb bc 7d  |....N...5+^....}|
0b 42 7b d4 53 72 21 ee  30 ca bb 78 65 5c 5b 01  |.B{.Sr!.0..xe\[.|
17 0a 14 0e d2 da 14 98  f5 3c b9 66 58 b3 2d 2f  |.........<.fX.-/|
e7 f9 85 86 cc 51 56 e8  9d 70 94 6c ac 39 4c d4  |.....QV..p.l.9L.|
f6 79 bf aa 18 7a 62 29  ef a2 9b 29 34 06 77 1a  |.y...zb)...)4.w.|
62 c9 3d 1e 6d 1f 82 f0  0b c7 2c bb cf 43 b3 e5  |b.=.m.....,..C..|
f9 ec 7d b5 e3 a4 a8 74  35 b8 4e c5 71 23 12 26  |..}....t5.N.q#.&|
76 0b 3c 52 8c 71 5a 46  43 14 bc b3 b3 b0 4d 67  |v.

Signer

1
unnamed
- #0
  - C: US
  - ST: Washington
  - L: Redmond
  - O: Microsoft Corporation
  - CN: Microsoft Code Signing PCA
- 33:00:00:00:CA:6C:D5:32:12:35:C4:E1:55:00:01:00:
  00:00:CA
SHA1: nil

contentType: 1.3.6.1.4.1.311.2.1.4
1.3.6.1.4.1.311.2.1.11: msCodeInd

messageDigest:

57 d9 b5 92 0c ac d2 08  df 35 a0 92 3c 4e 0a a0  |W........5..1.3.6.1.4.1.311.2.1.128b be 59 07 50 65 5e b7  52 a9 62 4b              |..Y.Pe^.R.bK    |: http://go.microsoft.com/fwlink/?LinkId=392991

rsaEncryption:

6a bf 13 eb 8e e8 81 61  50 24 a4 91 89 09 e7 3d  |j......aP$.....=|
23 2d 80 3b d1 50 19 13  a1 8a e7 83 0c 79 a5 c4  |#-.;.P.......y..|
06 67 56 ac 1c bb f8 69  d1 6b 04 93 01 06 27 ce  |.gV....i.k....'.|
84 f2 73 da 6e 2e af e6  7b cd 13 f3 75 9a d1 bb  |..s.n...{...u...|
6a bf 5a 6c 48 87 b8 96  8f 2b d6 43 58 fc 06 8c  |j.ZlH....+.CX...|
88 c9 1e b9 de 0f df af  98 9c 6e 21 6a ad 1f e8  |..........n!j...|
ca ae 74 28 87 7a 77 2a  8f 2b b9 4a 0d 26 53 1a  |..t(.zw*.+.J.&S.|
3f 74 49 dd 00 3d d4 4d  b8 99 9c bc 93 7c a4 8f  |?tI..=.M.....|..|
c6 ca 1e 3a e8 c2 48 38  cf 35 34 38 db 03 a9 b9  |...:..H8.548....|
3c 1e fe 45 0d a7 5b e0  9d fc 17 12 db 35 f6 5d  |<..E..[......5.]|
05 a0 96 81 f7 a7 08 00  c5 db 9a 4b cc 21 9b 4f  |...........K.!.O|
15 f5 3c c5 7a 34 a2 35  9c 69 bb 49 99 96 62 3a  |..<.z4.5.i.I..b:|
af ea 6d 77 8f 93 1b 55  d4 69 f9 70 99 ec 13 12  |..mw...U.i.p....|
57 46 2d c2 53 ba b7 e2  df da 4a 72 e3 6b c5 63  |WF-.S.....Jr.k.c|
38 54 e0 fb b2 75 5a 12  d2 17 9c 01 cf 4a 44 25  |8T...uZ......JD%|
77 9b 36 2e a2 6c 13 92  5a 59 4a 5e 63 23 08 39  |w.6..l..ZYJ^c#.9|

countersignature

unnamed
- #0
  - C: US
  - ST: Washington
  - L: Redmond
  - O: Microsoft Corporation
  - CN: Microsoft Time-Stamp PCA
- 33:00:00:00:4C:A1:E8:4D:CC:B4:74:7B:3B:00:00:00:
  00:00:4C
SHA1: nil

contentType: pkcs7-data
signingTime: 2014-06-07 04:38:50 UTC

messageDigest:

32 78 61 00 3a ac 9d e7  de 94 cc 77 96 10 4a 2d  |2xa.:......w..J-|
1b 79 53 43                                       |.ySC            |

RSA-SHA1:

4e 6d 52 27 f2 a2 ee c8  99 ad ee d5 fc a0 df 01  |NmR'............|
27 79 3a 82 b8 92 1d bc  81 86 61 83 7d 4b 3e 8d  |'y:.......a.}K>.|
b8 97 d0 b5 67 45 93 ab  13 66 df df 97 56 82 a5  |....gE...f...V..|
38 04 6b 0a 41 ea f4 14  b9 d2 89 63 77 10 ef d8  |8.k.A......cw...|
06 14 b8 5d 9b 03 da d2  21 74 b1 1e 46 61 b6 a0  |...]....!t..Fa..|
49 c2 bc 66 4d c7 bf ff  be 86 b6 1f 5e d9 ac b0  |I..fM.......^...|
44 77 a1 33 1b f3 75 1d  6e e4 d7 cf 90 58 01 5f  |Dw.3..u.n....X._|
96 43 96 55 2a a0 59 2b  c5 8b c1 88 a6 0f 62 57  |.C.U*.Y+......bW|
39 77 7b 7a 91 b4 ba 67  b0 e8 6e fc c0 90 0b 84  |9w{z...g..n.....|
60 27 61 c2 d1 76 04 4d  92 2d 1a 16 82 de 8f 75  |`'a..v.M.-.....u|
b6 70 ee 7e f7 d5 a5 9e  55 0c a1 4a db b1 19 d3  |.p.~....U..J....|
27 25 2b dd 1a f7 79 02  c6 5d e2 d0 26 55 b3 cd  |'%+...y..]..&U..|
89 59 5d 8f 4f 39 43 cf  f1 23 0f 2d b5 52 d5 e9  |.Y].O9C..#.-.R..|
0a 27 21 7d 95 db dd 6f  c9 76 2e bc 97 e8 14 e4  |.'!}...o.v......|
99 5b 38 24 8b 3a a6 e5  20 86 d8 89 d3 37 4b 1e  |.[8$.:.. ....7K.|
d2 82 c2 f7 a3 17 b9 a2  bb 79 5b 6f 36 7c 9d c7  |.........y[o6|..|

show previews

offset	size	type	comment
0	78848	EXE	06/07/2014 01:59:15	#
15c1	15	HTM		#
13400	6816	PKCS7	Authenticode Signature	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

DhMachineSvc.exe- DhMachineiSvc.exe - 微软设备健康助手服务

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904b0

VS_FIXEDFILEINFO

Signers (1)

Certificates (4)

DhMachineSvc.exe
- DhMachineiSvc.exe - 微软设备健康助手服务