filenameprocexp.exe
size2724512 (0x2992a0)
md562028945d0ab974e183756ebbb1ca07f
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x118

Rich Header

lib idversiontimes used
199411181
2232100530
2252100578
22421005223
225208067
1313072910
132307291
1473072937
10550
224311012
2253110164
219210051
222311011

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x590673a5
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion12.0
SizeOfCode0xba800
SizeOfInitializedData0x1da800
SizeOfUninitializedData0
AddressOfEntryPoint0x9ba18
BaseOfCode0x1000
BaseOfData0xbc000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x2bd000
SizeOfHeaders0x400
CheckSum0x29c250
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000xba6d80xba800R-X CODE
.rdata0xbc0000x2d4820x2d600R-- IDATA
.data0xea0000x2da680x9200RW- IDATA
.rsrc0x1180000x1978400x197a00R-- IDATA
.reloc0x2b00000xc5300xc600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xe66c40x17c
RESOURCE0x1180000x197840
EXCEPTION00
SECURITY0x2954000x3ea0
BASERELOC0x2b00000xc530
DEBUG0xbc9c00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0xde4900x40
Bound_IAT00
IAT0xbc0000x86c
Delay_IAT00
CLR_Header00
typenamesizecp
BINRES#150366801252
BINRES#15214588561252
CURSOR#13081252
CURSOR#23081252
CURSOR#33081252
CURSOR#43081252
BITMAP#10844241252
ICON#513841252
ICON#611281252
ICON#722161252
ICON#842641252
ICON#937521252
ICON#1096401252
ICON#112961252
ICON#127441252
ICON#132961252
ICON#1416401252
ICON#157441252
ICON#162961252
ICON#1737521252
ICON#1822161252
ICON#1917361252
ICON#2013841252
ICON#2196401252
ICON#2242641252
ICON#2324401252
ICON#2411281252
ICON#257441252
ICON#267441252
ICON#277441252
ICON#282961252
ICON#2916401252
ICON#307441252
ICON#312961252
ICON#3237521252
ICON#3322161252
ICON#3413841252
ICON#3596401252
ICON#3642641252
ICON#3711281252
MENUDLLMENU1401252
MENUHANDLEMENU701252
MENUOPACITY1501252
MENUPRIORITY1081252
MENUPROCESSOR921252
MENUPROCEXPLORER28041252
MENUTRAYMENU1741252
MENUUSERS2301252
DIALOGABOUTBOX4461252
DIALOGCHOOSECOLORS22661252
DIALOGCOLUMNSETS4361252
DIALOGCOLUMNSETSAVE3041252
DIALOGCPUAFFINITY18061252
DIALOGCPUAFFINITY6432161252
DIALOGDIFFDURATION4561252
DIALOGDLLCOLUMNS14321252
DIALOGDLLCOLUMNS957841252
DIALOGDLLINFO12641252
DIALOGDLLSTRINGS4741252
DIALOGFINDDIALOG3921252
DIALOGHANDLECOLUMNS6461252
DIALOGHANDLEINFO11481252
DIALOGHANDLEINFO956401252
DIALOGMEMSCANPROGRESS2881252
DIALOGNETCOLUMNS16741252
DIALOGPREFERENCES2121252
DIALOGPROCCLR2421252
DIALOGPROCCOLUMNS17761252
DIALOGPROCCOLUMNS959861252
DIALOGPROCCPU2901252
DIALOGPROCCPUIO4061252
DIALOGPROCDISKCOLUMNS9921252
DIALOGPROCENV1301252
DIALOGPROCGPU5841252
DIALOGPROCGPUCOLUMNS5201252
DIALOGPROCINFO19321252
DIALOGPROCIOCOLUMNS10881252
DIALOGPROCJOB4061252
DIALOGPROCMEMCOLUMNS15741252
DIALOGPROCNET3441252
DIALOGPROCNETWORKCOLUMNS10081252
DIALOGPROCPERF31821252
DIALOGPROCPERFCOLUMNS10081252
DIALOGPROCPERFETW25901252
DIALOGPROCPROPSHEET2301252
DIALOGPROCSECURITY9041252
DIALOGPROCSERVICES5441252
DIALOGPROCSTRINGS4101252
DIALOGPROCTCPUDP2001252
DIALOGPROCTCPUDPSTACK3481252
DIALOGPROCTHREADS17061252
DIALOGPROCWMIPROVIDERS1301252
DIALOGRUNDLG4441252
DIALOGSECURITY9241252
DIALOGSENDMESSAGE3401252
DIALOGSERVICECONTROL3841252
DIALOGSTATUSBARCOLUMNS13021252
DIALOGSTATUSBARCOLUMNS955921252
DIALOGSYMBOLCONFIG10161252
DIALOGSYMBOLCONFIGWARNING7041252
DIALOGSYMBOLDBGHELPGWARNING9401252
DIALOGSYSINFOPROPSHEET2061252
DIALOGSYSTEMINFOCPU11601252
DIALOGSYSTEMINFOGPU12141252
DIALOGSYSTEMINFOGPUNODES2981252
DIALOGSYSTEMINFOIO8981252
DIALOGSYSTEMINFOIOETW25961252
DIALOGSYSTEMINFOMEM39401252
DIALOGSYSTEMINFOMEMXP23501252
DIALOGSYSTEMINFOSUM5221252
DIALOGSYSTEMINFOSUMETW7521252
DIALOGTHREADSTACK3841252
DIALOGTSINFO7341252
DIALOG#15435201252
STRING#17781252
STRING#23321252
STRING#33201252
STRING#651041252
STRING#662041252
STRING#673741252
STRING#682341252
STRING#695501252
STRING#704221252
STRING#741641252
STRING#754961252
STRING#76561252
STRING#82601252
STRING#831261252
STRING#844181252
STRING#1012681252
STRING#1026081252
STRING#1032741252
STRING#1042381252
STRING#1051161252
STRING#25481281252
ACCELERATORSDLLPROPERTIES641252
ACCELERATORSPROCEXPLORER2881252
ACCELERATORSPROCPROPERTIES1121252
GROUP_CURSORHAND201252
GROUP_CURSOR#10201252
GROUP_CURSOR#105201252
GROUP_CURSOR#106201252
GROUP_ICON#101901252
GROUP_ICON#110201252
GROUP_ICON#111201252
GROUP_ICON#112201252
GROUP_ICON#113201252
GROUP_ICON#1471601252
GROUP_ICON#1541321252
GROUP_ICON#203201252
GROUP_ICON#235341252
VERSION#19561252
MANIFEST#120771252
idlangstring
31033Process
41033PID
51033Priority
61033Threads
71033Cycle CPU Usage
81033GPU
91033Paged Pool
101033Nonpaged Pool
111033Programs (*.exe, *.com, *.bat, *.pif)|*.exe;*.com;*.bat|Executables (*.exe)|*.exe|Command Files (*.com)|*.com|Batch Files (*.bat)|*.bat|Pif Files (*.pif)|*.pif|
121033There is insufficent memory to run the program
131033The file is not a valid executable format
141033Cannot find the specified file
151033Cannot find the specified path
161033Refresh process list
181033Handles
191033User Name
201033Handle
211033Type
221033Name
231033Base
241033Size
251033Version
261033Name
271033Show Unnamed Objects (Ctrl+U)
281033Find (Ctrl+F)
291033View Handles (Ctrl+H)
301033Time
311033Save (Ctrl+S)
321033View DLLs (Ctrl+D)
331033References
341033Parent
351033Window Title
361033Kill Process/Close Handle
371033Properties
381033Description
391033Access
401033Mapping
411033Refresh Now (F5)
421033Description
431033Frame
441033Address
10321033Command Line
10331033Company Name
10371033Share
10391033Service
10421033Description
10441033Display Name
10461033Group
10471033Privilege
10491033Flags
10511033Flags
10521033Handle
10531033Handle or DLL
10541033Show Process Tree
10551033CPU
10561033Session
10571033Variable
10581033Value
10591033Page Faults
10601033Private Bytes
10611033Path
10621033Peak Private Bytes
10631033Working Set
10641033Peak Working Set
10651033Threads
10661033GDI Objects
10671033USER Objects
10681033I/O Reads
10691033I/O Read Bytes
10701033I/O Writes
10711033I/O Write Bytes
10721033I/O Other
10731033I/O Other Bytes
10741033Image Base
10751033Limit
10761033TID
10771033Start Address
10781033Function
10791033User Time
10801033Kernel Time
10861033Start Time
10871033CPU Time
10881033Show Lower Pane (Ctrl+L)
10891033Hide Lower Pane (Ctrl+L)
10901033Show Processes From &All Users
10911033Context Switches
10921033CSwitch Delta
10931033Counter
10941033Methods Jitted
10951033% Time in JIT
10961033AppDomains
10971033Assemblies
10981033Classes Loaded
10991033Total AppDomains
11001033Total Assemblies
11011033Total Classes Loaded
11021033Total Lock Contentions
11031033Heap Bytes
11041033Gen 0 Collections
11051033Gen 1 Collections
11061033Gen 2 Collections
11071033% Time in GC
11081033Allocated Bytes/s
11091033Runtime Checks
11101033Contentions
11111033Path
11121033Find Handle (Ctrl+F)
11131033Find Handle or DLL (Ctrl+F)
11141033Virtual Size
11151033WS Total
11161033WS Private
11181033WS Shared
11791033PF Delta
11801033Desktop Integrity Level
11811033Comment
11821033PROCEXPLORER
11831033Process Explorer
11841033Local Address
11851033Object Address
11861033Remote Address
11871033Verified Signer
11881033State
11891033Protocol
11901033Image Type
11911033CPU History
11921033Private Delta Bytes
11931033Private Bytes History
11941033Share Flags
11951033Cycles
11961033Window Status
11971033Find &Window's Process (drag over window)
11981033System Information (Ctrl+I)
11991033DEP
12001033Cycles Delta
13081033Decoded Access
13171033WS Shareable
13261033I/O Delta Reads
13271033I/O Delta Read Bytes
13281033I/O Delta Writes
13291033I/O Delta Write Bytes
13301033I/O History
13321033I/O Delta Other Bytes
13331033I/O Delta Total Bytes
13351033I/O Delta Other
13361033Integrity
13371033Virtualized
13381033ASLR
13391033Memory Priority
13401033I/O Priority
13411033Min Working Set
13421033Max Working Set
13431033Service
16091033Network Receives
16101033Network Delta Receives
16111033Network Sends
16121033Network Delta Sends
16131033Network Other
16141033Network Delta Others
16151033Network History
16161033Network Delta Receive Bytes
16171033Network Receive Bytes
16181033Network Send Bytes
16191033Network Delta Send Bytes
16201033Network Other Bytes
16211033Network Delta Other Bytes
16221033Network Delta Total Bytes
16231033Disk Reads
16241033Disk Delta Reads
16251033Disk Writes
16261033Disk Delta Writes
16271033Disk Other
16281033Disk Delta Others
16291033Disk History
16301033Disk Read Bytes
16311033Disk Delta Read Bytes
16321033Disk Write Bytes
16331033Disk Delta Write Bytes
16341033Disk Other Bytes
16351033Disk Delta Other Bytes
16361033Disk Delta Total Bytes
16371033Tree CPU Usage
16381033Processor
16501033GPU
16511033GPU System Bytes
16521033GPU Dedicated Bytes
16531033GPU Committed Bytes
16541033Package Name
16551033Process Timeline
16561033Autostart Location
16671033DPI Awareness
16701033VirusTotal
16731033Protection
16741033UI Access
407541033Provider Name
407551033Namespace
407561033DLL Path
407571033Control Flow Guard
module_namehintordfunction_name
SHLWAPI.dll12ColorHLSToRGB
SHLWAPI.dll13ColorRGBToHLS
SHLWAPI.dll176
SHLWAPI.dll363UrlUnescapeW
WS2_32.dll14
WS2_32.dll8
WS2_32.dll9
WS2_32.dll51
WS2_32.dll56
WS2_32.dll115
WS2_32.dll15
MPR.dll36WNetGetConnectionW
COMCTL32.dll83ImageList_Create
COMCTL32.dll12CreateStatusWindowW
COMCTL32.dll9CreatePropertySheetPageW
COMCTL32.dll410
COMCTL32.dll8
COMCTL32.dll413
COMCTL32.dll111ImageList_ReplaceIcon
COMCTL32.dll77ImageList_Add
COMCTL32.dll123InitCommonControlsEx
COMCTL32.dll84ImageList_Destroy
COMCTL32.dll91ImageList_DrawEx
COMCTL32.dll17
COMCTL32.dll133PropertySheetW
VERSION.dll14VerQueryValueW
VERSION.dll6GetFileVersionInfoW
VERSION.dll5GetFileVersionInfoSizeW
credui.dll10CredUIPromptForCredentialsW
SETUPAPI.dll342SetupDiGetClassDevsW
SETUPAPI.dll366SetupDiGetDeviceInterfaceDetailW
SETUPAPI.dll323SetupDiEnumDeviceInterfaces
SETUPAPI.dll319SetupDiDestroyDeviceInfoList
CRYPT32.dll37CertDuplicateCertificateContext
CRYPT32.dll75CertGetNameStringW
KERNEL32.dll1266VirtualQueryEx
KERNEL32.dll582GetProcessAffinityMask
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll1168SetThreadAffinityMask
KERNEL32.dll1126SetFilePointer
KERNEL32.dll624GetSystemDirectoryW
KERNEL32.dll214DeleteFileW
KERNEL32.dll1053SearchPathW
KERNEL32.dll901OpenThread
KERNEL32.dll646GetThreadContext
KERNEL32.dll1210SuspendThread
KERNEL32.dll1043ResumeThread
KERNEL32.dll1219Thread32First
KERNEL32.dll1220Thread32Next
KERNEL32.dll1039ResetEvent
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll936QueryPerformanceFrequency
KERNEL32.dll759IsBadReadPtr
KERNEL32.dll476GetEnvironmentVariableW
KERNEL32.dll703GlobalMemoryStatus
KERNEL32.dll1156SetProcessWorkingSetSize
KERNEL32.dll1216TerminateProcess
KERNEL32.dll588GetProcessId
KERNEL32.dll922PulseEvent
KERNEL32.dll1149SetPriorityClass
KERNEL32.dll399GetComputerNameW
KERNEL32.dll1257VirtualAlloc
KERNEL32.dll1260VirtualFree
KERNEL32.dll596GetProcessWorkingSetSize
KERNEL32.dll221DeviceIoControl
KERNEL32.dll232DuplicateHandle
KERNEL32.dll906OutputDebugStringW
KERNEL32.dll467GetDriveTypeW
KERNEL32.dll447GetCurrentDirectoryW
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll202DecodePointer
KERNEL32.dll945RaiseException
KERNEL32.dll739InitializeCriticalSectionAndSpinCount
KERNEL32.dll627GetSystemInfo
KERNEL32.dll284ExpandEnvironmentStringsA
KERNEL32.dll828LoadLibraryA
KERNEL32.dll567GetOEMCP
KERNEL32.dll360GetACP
KERNEL32.dll778IsValidCodePage
KERNEL32.dll271EnumSystemLocalesW
KERNEL32.dll667GetUserDefaultLCID
KERNEL32.dll780IsValidLocale
KERNEL32.dll813LCMapStringW
KERNEL32.dll100CompareStringW
KERNEL32.dll611GetStartupInfoW
KERNEL32.dll1222TlsFree
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll370GetCPInfo
KERNEL32.dll1085SetConsoleMode
KERNEL32.dll949ReadConsoleInputA
KERNEL32.dll428GetConsoleMode
KERNEL32.dll535GetModuleHandleExW
KERNEL32.dll281ExitProcess
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll772IsProcessorFeaturePresent
KERNEL32.dll1048RtlUnwind
KERNEL32.dll768IsDebuggerPresent
KERNEL32.dll234EncodePointer
KERNEL32.dll617GetStringTypeW
KERNEL32.dll1357lstrlenA
KERNEL32.dll1349lstrcmpiW
KERNEL32.dll1346lstrcmpW
KERNEL32.dll963ReadProcessMemory
KERNEL32.dll885OpenEventW
KERNEL32.dll1139SetLastError
KERNEL32.dll761IsBadStringPtrW
KERNEL32.dll1213SystemTimeToFileTime
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll631GetSystemTime
KERNEL32.dll209DeleteCriticalSection
KERNEL32.dll861Module32NextW
KERNEL32.dll859Module32FirstW
KERNEL32.dll1217TerminateThread
KERNEL32.dll709GlobalUnlock
KERNEL32.dll702GlobalLock
KERNEL32.dll705GlobalReAlloc
KERNEL32.dll691GlobalAlloc
KERNEL32.dll333FindResourceExW
KERNEL32.dll334FindResourceW
KERNEL32.dll1201SizeofResource
KERNEL32.dll833LoadResource
KERNEL32.dll586GetProcessHeap
KERNEL32.dll724HeapSize
KERNEL32.dll719HeapFree
KERNEL32.dll722HeapReAlloc
KERNEL32.dll715HeapAlloc
KERNEL32.dll718HeapDestroy
KERNEL32.dll852LockResource
KERNEL32.dll391GetCommandLineW
KERNEL32.dll499GetFileType
KERNEL32.dll836LocalAlloc
KERNEL32.dll350FormatMessageW
KERNEL32.dll690GlobalAddAtomW
KERNEL32.dll659GetTickCount
KERNEL32.dll870MulDiv
KERNEL32.dll497GetFileSizeEx
KERNEL32.dll480GetExitCodeThread
KERNEL32.dll181CreateThread
KERNEL32.dll133CreateEventW
KERNEL32.dll1271WaitForMultipleObjects
KERNEL32.dll1273WaitForSingleObject
KERNEL32.dll1113SetEvent
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll452GetCurrentThread
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll325FindNextFileW
KERNEL32.dll302FindClose
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll536GetModuleHandleW
KERNEL32.dll960ReadFile
KERNEL32.dll830LoadLibraryExW
KERNEL32.dll354FreeLibrary
KERNEL32.dll578GetPrivateProfileStringW
KERNEL32.dll313FindFirstFileW
KERNEL32.dll490GetFileAttributesW
KERNEL32.dll920Process32NextW
KERNEL32.dll918Process32FirstW
KERNEL32.dll190CreateToolhelp32Snapshot
KERNEL32.dll563GetNumberFormatW
KERNEL32.dll456GetDateFormatW
KERNEL32.dll663GetTimeFormatW
KERNEL32.dll518GetLocaleInfoW
KERNEL32.dll143CreateFileW
KERNEL32.dll507GetFullPathNameW
KERNEL32.dll687GetWindowsDirectoryW
KERNEL32.dll285ExpandEnvironmentStringsW
KERNEL32.dll1111SetEnvironmentVariableW
KERNEL32.dll168CreateProcessW
KERNEL32.dll532GetModuleFileNameW
KERNEL32.dll831LoadLibraryW
KERNEL32.dll140CreateFileMappingW
KERNEL32.dll1224TlsSetValue
KERNEL32.dll1221TlsAlloc
KERNEL32.dll1358lstrlenW
KERNEL32.dll1238UnmapViewOfFile
KERNEL32.dll855MapViewOfFile
KERNEL32.dll349FormatMessageA
KERNEL32.dll293FileTimeToSystemTime
KERNEL32.dll292FileTimeToLocalFileTime
KERNEL32.dll82CloseHandle
KERNEL32.dll498GetFileTime
KERNEL32.dll1317WriteFile
KERNEL32.dll612GetStdHandle
KERNEL32.dll496GetFileSize
KERNEL32.dll1202Sleep
KERNEL32.dll738InitializeCriticalSection
KERNEL32.dll1112SetErrorMode
KERNEL32.dll514GetLastError
KERNEL32.dll282ExitThread
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll896OpenProcess
KERNEL32.dll840LocalFree
KERNEL32.dll674GetVersion
KERNEL32.dll581GetProcAddress
KERNEL32.dll747InterlockedDecrement
KERNEL32.dll751InterlockedIncrement
KERNEL32.dll1223TlsGetValue
KERNEL32.dll343FlushFileBuffers
KERNEL32.dll410GetConsoleCP
KERNEL32.dll474GetEnvironmentStringsW
KERNEL32.dll353FreeEnvironmentStringsW
KERNEL32.dll664GetTimeZoneInformation
KERNEL32.dll1127SetFilePointerEx
KERNEL32.dll1159SetStdHandle
KERNEL32.dll1316WriteConsoleW
KERNEL32.dll958ReadConsoleW
KERNEL32.dll1107SetEndOfFile
KERNEL32.dll1110SetEnvironmentVariableA
USER32.dll84CopyImage
USER32.dll398GetWindow
USER32.dll291GetDesktopWindow
USER32.dll483KillTimer
USER32.dll540MsgWaitForMultipleObjects
USER32.dll294GetDlgCtrlID
USER32.dll65CheckRadioButton
USER32.dll635SendMessageTimeoutW
USER32.dll563PeekMessageW
USER32.dll396GetUserObjectSecurity
USER32.dll702SetUserObjectSecurity
USER32.dll461IsDialogMessageW
USER32.dll200DrawIconEx
USER32.dll64CheckMenuRadioItem
USER32.dll812WindowFromPoint
USER32.dll586RedrawWindow
USER32.dll758TrackPopupMenu
USER32.dll615RemoveMenu
USER32.dll106CreateMenu
USER32.dll201DrawMenuBar
USER32.dll503LoadMenuW
USER32.dll762TranslateAcceleratorW
USER32.dll485LoadAcceleratorsW
USER32.dll476IsWindowEnabled
USER32.dll298GetDlgItemTextW
USER32.dll99CreateDialogParamW
USER32.dll475IsWindow
USER32.dll567PostQuitMessage
USER32.dll245ExitWindowsEx
USER32.dll175DispatchMessageW
USER32.dll764TranslateMessage
USER32.dll349GetMessageW
USER32.dll195DrawEdge
USER32.dll611RegisterWindowMessageW
USER32.dll402GetWindowDC
USER32.dll674SetMenuItemInfoW
USER32.dll465IsIconic
USER32.dll736ShowWindowAsync
USER32.dll748SystemParametersInfoW
USER32.dll242EnumWindows
USER32.dll644SetClassLongW
USER32.dll419GetWindowTextW
USER32.dll447InvalidateRgn
USER32.dll759TrackPopupMenuEx
USER32.dll535ModifyMenuW
USER32.dll10AppendMenuW
USER32.dll337GetMenuItemCount
USER32.dll338GetMenuItemID
USER32.dll214EnableMenuItem
USER32.dll107CreatePopupMenu
USER32.dll216EnableWindow
USER32.dll462IsDlgButtonChecked
USER32.dll62CheckDlgButton
USER32.dll411GetWindowPlacement
USER32.dll493LoadIconW
USER32.dll709SetWindowPlacement
USER32.dll153DefMDIChildProcW
USER32.dll151DefFrameProcW
USER32.dll149DefDlgProcW
USER32.dll103CreateIconIndirect
USER32.dll253FrameRect
USER32.dll71ClientToScreen
USER32.dll480IsWindowVisible
USER32.dll166DestroyWindow
USER32.dll274GetClassNameW
USER32.dll223EnumChildWindows
USER32.dll576PtInRect
USER32.dll769UnionRect
USER32.dll85CopyRect
USER32.dll621ScreenToClient
USER32.dll213EmptyClipboard
USER32.dll646SetClipboardData
USER32.dll73CloseClipboard
USER32.dll550OpenClipboard
USER32.dll482IsZoomed
USER32.dll217EndDeferWindowPos
USER32.dll157DeferWindowPos
USER32.dll13BeginDeferWindowPos
USER32.dll198DrawFrameControl
USER32.dll67ChildWindowFromPoint
USER32.dll656SetDlgItemTextW
USER32.dll172DialogBoxParamW
USER32.dll539MoveWindow
USER32.dll715SetWindowTextW
USER32.dll295GetDlgItem
USER32.dll218EndDialog
USER32.dll170DialogBoxIndirectParamW
USER32.dll373GetScrollInfo
USER32.dll688SetScrollInfo
USER32.dll356GetParent
USER32.dll272GetClassLongW
USER32.dll708SetWindowLongW
USER32.dll406GetWindowLongW
USER32.dll549OffsetRect
USER32.dll445IntersectRect
USER32.dll437InflateRect
USER32.dll246FillRect
USER32.dll380GetSysColorBrush
USER32.dll379GetSysColor
USER32.dll521MapWindowPoints
USER32.dll288GetCursorPos
USER32.dll636SendMessageW
USER32.dll806WaitForInputIdle
USER32.dll735ShowWindow
USER32.dll658SetFocus
USER32.dll382GetSystemMetrics
USER32.dll331GetMenu
USER32.dll63CheckMenuItem
USER32.dll378GetSubMenu
USER32.dll442InsertMenuW
USER32.dll412GetWindowRect
USER32.dll276GetClientRect
USER32.dll363GetPropW
USER32.dll685SetPropW
USER32.dll625ScrollWindowEx
USER32.dll796ValidateRect
USER32.dll446InvalidateRect
USER32.dll392GetUpdateRgn
USER32.dll391GetUpdateRect
USER32.dll220EndPaint
USER32.dll14BeginPaint
USER32.dll785UpdateWindow
USER32.dll208DrawTextW
USER32.dll699SetTimer
USER32.dll612ReleaseCapture
USER32.dll640SetCapture
USER32.dll158DeleteMenu
USER32.dll659SetForegroundWindow
USER32.dll533MessageBoxW
USER32.dll648SetCursor
USER32.dll250FindWindowW
USER32.dll249FindWindowExW
USER32.dll420GetWindowThreadProcessId
USER32.dll491LoadCursorW
USER32.dll163DestroyIcon
USER32.dll495LoadImageW
USER32.dll234EnumDisplaySettingsW
USER32.dll289GetDC
USER32.dll613ReleaseDC
USER32.dll264GetCapture
USER32.dll317GetKeyState
USER32.dll300GetFocus
USER32.dll710SetWindowPos
USER32.dll110CreateWindowExW
USER32.dll589RegisterClassExW
USER32.dll30CallWindowProcW
USER32.dll156DefWindowProcW
USER32.dll566PostMessageW
USER32.dll506LoadStringW
USER32.dll590RegisterClassW
GDI32.dll660SetMapMode
GDI32.dll599Polyline
GDI32.dll631SelectObject
GDI32.dll638SetBkColor
GDI32.dll639SetBkMode
GDI32.dll678SetTextColor
GDI32.dll688StartDocW
GDI32.dll239EndDoc
GDI32.dll690StartPage
GDI32.dll242EndPage
GDI32.dll64CreateFontIndirectW
GDI32.dll542GetTextExtentPoint32W
GDI32.dll550GetTextMetricsW
GDI32.dll570MoveToEx
GDI32.dll671SetROP2
GDI32.dll624SaveDC
GDI32.dll617RestoreDC
GDI32.dll607Rectangle
GDI32.dll566LineTo
GDI32.dll312ExtTextOutW
GDI32.dll53CreateDIBSection
GDI32.dll509GetObjectW
GDI32.dll230DeleteObject
GDI32.dll19BitBlt
GDI32.dll47CreateCompatibleBitmap
GDI32.dll48CreateCompatibleDC
GDI32.dll75CreatePen
GDI32.dll79CreateRectRgn
GDI32.dll80CreateRectRgnIndirect
GDI32.dll84CreateSolidBrush
GDI32.dll227DeleteDC
GDI32.dll425GetBkColor
GDI32.dll426GetBkMode
GDI32.dll459GetDeviceCaps
GDI32.dll525GetStockObject
GDI32.dll605RectInRegion
GDI32.dll629SelectClipRgn
GDI32.dll676SetTextAlign
COMDLG32.dll8FindTextW
COMDLG32.dll1ChooseColorW
COMDLG32.dll14GetSaveFileNameW
COMDLG32.dll12GetOpenFileNameW
COMDLG32.dll21PrintDlgW
COMDLG32.dll3ChooseFontW
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll608RegOpenKeyExA
ADVAPI32.dll621RegQueryValueExA
ADVAPI32.dll405LookupPrivilegeNameW
ADVAPI32.dll685SetKernelObjectSecurity
ADVAPI32.dll389IsValidSecurityDescriptor
ADVAPI32.dll309GetKernelObjectSecurity
ADVAPI32.dll124CreateProcessAsUserW
ADVAPI32.dll564RegConnectRegistryW
ADVAPI32.dll283FlushTraceW
ADVAPI32.dll108ConvertSidToStringSidW
ADVAPI32.dll420LsaEnumerateAccountRights
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll445LsaOpenPolicy
ADVAPI32.dll413LsaClose
ADVAPI32.dll427LsaFreeMemory
ADVAPI32.dll699SetSecurityInfo
ADVAPI32.dll334GetSecurityInfo
ADVAPI32.dll16AddAccessAllowedAce
ADVAPI32.dll291GetAce
ADVAPI32.dll22AddAce
ADVAPI32.dll374InitializeAcl
ADVAPI32.dll344GetSidSubAuthorityCount
ADVAPI32.dll343GetSidSubAuthority
ADVAPI32.dll341GetSidIdentifierAuthority
ADVAPI32.dll390IsValidSid
ADVAPI32.dll706SetTokenInformation
ADVAPI32.dll548QueryServiceConfigW
ADVAPI32.dll118CopySid
ADVAPI32.dll656RevertToSelf
ADVAPI32.dll503OpenProcessToken
ADVAPI32.dll346GetTokenInformation
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll263EqualSid
ADVAPI32.dll32AllocateAndInitializeSid
ADVAPI32.dll310GetLengthSid
ADVAPI32.dll89CloseTrace
ADVAPI32.dll540ProcessTrace
ADVAPI32.dll511OpenTraceW
ADVAPI32.dll96ControlTraceW
ADVAPI32.dll715StartTraceW
ADVAPI32.dll703SetServiceObjectSecurity
ADVAPI32.dll551QueryServiceObjectSecurity
ADVAPI32.dll483MapGenericMask
ADVAPI32.dll572RegCreateKeyW
ADVAPI32.dll713StartServiceW
ADVAPI32.dll552QueryServiceStatus
ADVAPI32.dll288FreeSid
ADVAPI32.dll401LookupAccountSidW
ADVAPI32.dll399LookupAccountNameW
ADVAPI32.dll407LookupPrivilegeValueW
ADVAPI32.dll371ImpersonateLoggedOnUser
ADVAPI32.dll223DuplicateTokenEx
ADVAPI32.dll569RegCreateKeyExW
ADVAPI32.dll580RegDeleteKeyW
ADVAPI32.dll592RegEnumKeyW
ADVAPI32.dll594RegEnumValueW
ADVAPI32.dll602RegLoadKeyW
ADVAPI32.dll612RegOpenKeyW
ADVAPI32.dll616RegQueryInfoKeyW
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll638RegSetValueExW
ADVAPI32.dll641RegUnLoadKeyW
ADVAPI32.dll623RegQueryValueW
ADVAPI32.dll177CryptAcquireContextW
ADVAPI32.dll203CryptReleaseContext
ADVAPI32.dll196CryptGetHashParam
ADVAPI32.dll179CryptCreateHash
ADVAPI32.dll200CryptHashData
ADVAPI32.dll182CryptDestroyHash
ADVAPI32.dll584RegDeleteValueW
ADVAPI32.dll87CloseServiceHandle
ADVAPI32.dll505OpenSCManagerW
ADVAPI32.dll507OpenServiceW
ADVAPI32.dll92ControlService
SHELL32.dll215SHGetPathFromIDListW
SHELL32.dll223SHGetSpecialFolderLocation
SHELL32.dll123SHBrowseForFolderW
SHELL32.dll207SHGetMalloc
SHELL32.dll302Shell_NotifyIconW
SHELL32.dll289ShellExecuteExW
SHELL32.dll189SHGetFileInfoW
SHELL32.dll290ShellExecuteW
ole32.dll49CoGetInterfaceAndReleaseStream
ole32.dll62CoInitialize
ole32.dll63CoInitializeEx
ole32.dll16CoCreateInstance
ole32.dll108CoUninitialize
ole32.dll99CoSetProxyBlanket
ole32.dll73CoMarshalInterThreadInterfaceInStream
ole32.dll104CoTaskMemFree
OLEAUT32.dll20
OLEAUT32.dll4
OLEAUT32.dll25
OLEAUT32.dll24
OLEAUT32.dll23
OLEAUT32.dll2
OLEAUT32.dll6
OLEAUT32.dll7
OLEAUT32.dll150
OLEAUT32.dll8
OLEAUT32.dll9
OLEAUT32.dll12
OLEAUT32.dll16
OLEAUT32.dll19
WINHTTP.dll16WinHttpOpenRequest
WINHTTP.dll26WinHttpSetOption
WINHTTP.dll18WinHttpQueryDataAvailable
WINHTTP.dll23WinHttpSendRequest
WINHTTP.dll21WinHttpReadData
WINHTTP.dll8WinHttpConnect
WINHTTP.dll7WinHttpCloseHandle
WINHTTP.dll15WinHttpOpen
WINHTTP.dll22WinHttpReceiveResponse
WINHTTP.dll19WinHttpQueryHeaders
WINHTTP.dll14WinHttpGetProxyForUrl
WINHTTP.dll31WinHttpWriteData
PSAPI.DLL16GetModuleFileNameExW

StringTable 040904e4

CompanyNameSysinternals - www.sysinternals.com
FileDescriptionSysinternals Process Explorer
FileVersion16.21
InternalNameProcess Explorer
LegalCopyrightCopyright © 1998-2017 Mark Russinovich
LegalTrademarksCopyright (C) 1998-2017 Mark Russinovich
OriginalFilenameProcexp.exe
ProductNameProcess Explorer
ProductVersion16.21

VS_FIXEDFILEINFO

FileVersion16.21.0.0
ProductVersion16.21.0.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags8
FileOS4
FileType1
FileSubtype0

Signers (1)

issuer: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Code Signing PCA
serial: 330000014096A9EE7056FECC07000100000140

Certificates (4)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:cc:cb:b8:13:eb:5d:72:2d:45:00:00:00:00:00:cc
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Time-Stamp PCA
        Validity
            Not Before: Sep  7 17:58:56 2016 GMT
            Not After : Sep  7 17:58:56 2018 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=MOPR, OU=nCipher DSE ESN:148C-C4B9-2066, CN=Microsoft Time-Stamp Service
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:c1:ee:5b:a7:43:c7:ec:d6:ab:2d:e5:03:7e:ad:
                    44:f8:97:78:58:da:46:9b:69:20:11:5c:cb:1a:63:
                    80:8c:c2:fe:c3:94:57:13:34:0e:42:ea:93:97:c4:
                    9f:31:47:2b:83:5f:ad:a3:62:21:6e:ed:e1:7c:f1:
                    45:45:02:6a:d1:c3:c7:fe:2d:78:5f:5c:34:71:63:
                    fa:8d:1a:b2:02:ab:ff:4f:79:52:33:83:b7:74:34:
                    8d:64:af:90:52:c5:2a:d3:25:de:17:e1:66:bd:6d:
                    22:80:11:d4:a4:ea:57:13:2c:47:85:ad:10:37:36:
                    c9:9b:d8:b2:09:74:ae:fd:66:94:b2:d8:1c:ab:cc:
                    07:03:68:2f:b8:b7:6f:48:0e:a9:0e:df:80:80:05:
                    1f:d2:8f:df:d8:dc:25:db:91:ed:94:33:51:88:8d:
                    4f:81:f4:91:77:0f:96:d2:09:d2:6a:59:37:c7:27:
                    2b:0d:51:43:95:52:da:bc:f7:1c:c1:73:5c:d1:8b:
                    0d:ac:a1:6b:f5:3d:7b:6d:ac:f7:c5:83:d3:6f:ff:
                    bd:d0:db:69:52:80:60:49:da:55:d9:1a:fb:7a:fe:
                    e5:f3:4e:a5:cf:89:a5:c4:41:2a:16:ff:f1:c2:4e:
                    d8:c2:ce:01:a3:0b:54:f6:91:35:cd:a3:f2:36:25:
                    76:19
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                F5:A1:9A:66:D5:91:E7:4F:65:AF:AC:D9:14:00:9D:97:42:9B:CF:AA
            X509v3 Authority Key Identifier: 
                keyid:23:34:F8:D9:52:46:70:0A:ED:40:FB:76:FB:B3:2B:B0:C3:35:B3:0F

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt

            X509v3 Extended Key Usage: 
                Time Stamping
    Signature Algorithm: sha1WithRSAEncryption
         96:81:2d:8a:1b:f7:a7:1c:8e:fb:5c:46:a5:25:ff:9d:7e:89:
         0e:93:5f:85:a8:24:26:1b:fa:37:f7:b0:cb:60:40:b7:78:90:
         b3:e9:08:1f:f6:7f:cb:ae:65:e3:df:f7:04:9d:8c:2b:b6:48:
         f1:6d:d4:fc:7a:bc:9c:ac:5e:4d:81:ee:b4:5e:61:1d:c0:f0:
         6d:12:b2:85:2f:fe:70:9d:16:3a:77:76:da:f7:96:6d:b1:90:
         c5:36:c2:fe:4e:c7:80:4e:e0:97:fe:d2:f4:fd:fa:cd:cf:6c:
         b9:cf:64:af:c6:8d:42:75:89:d5:92:1b:4b:0a:a5:78:2a:ee:
         6a:52:c3:d4:95:ee:32:23:8d:d3:34:6e:ea:41:77:6c:4b:08:
         a7:e8:73:18:d8:8a:be:54:60:95:a2:0b:c0:b4:91:bf:ff:e8:
         5f:3f:24:bf:e7:d4:6a:f5:4f:2e:e6:65:d8:85:8d:6e:05:04:
         42:31:4d:4d:eb:d0:49:c0:aa:d3:af:fc:ed:1c:02:92:ee:0b:
         d0:15:d6:91:62:c6:51:a0:41:1a:a5:03:fc:51:40:b2:da:ba:
         2d:e3:e6:a1:8a:78:97:a2:8d:84:b3:44:98:13:63:92:f6:d4:
         86:db:b9:5e:9a:ac:8a:d9:86:92:64:2f:4e:7d:42:88:0a:04:
         58:23:9a:22
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Signing PCA
        Validity
            Not Before: Aug 18 20:17:17 2016 GMT
            Not After : Nov  2 20:17:17 2017 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=MOPR, CN=Microsoft Corporation
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:db:4b:8b:e9:03:6a:5f:c8:1b:5d:0a:05:39:e4:
                    d5:0e:92:d0:c4:e1:8b:e8:a4:0d:05:19:58:c0:3c:
                    d7:29:dd:89:b7:68:6e:4b:9f:7e:bc:9a:bd:54:86:
                    39:a9:f1:38:35:16:e6:1d:ac:fb:ae:6b:dc:09:30:
                    ef:b8:1e:df:6c:f8:4a:9a:55:97:48:c8:23:89:b3:
                    59:27:34:bd:95:31:47:9c:0f:ce:40:35:32:37:fe:
                    e9:f3:4f:a4:1a:a4:b3:79:bc:80:9b:3f:24:98:c4:
                    d1:6f:d5:7f:e7:43:8d:e4:dc:f2:d2:e6:ae:66:ed:
                    04:3a:21:94:a6:57:dc:03:db:2c:c6:1b:ff:2b:39:
                    a8:5d:bf:55:fe:dd:49:df:54:05:94:ab:33:df:a4:
                    7d:31:a6:4d:bd:56:cf:16:31:68:3f:84:6b:1c:6d:
                    f3:ee:d5:30:8a:ee:65:1b:9e:b7:08:1c:29:7e:93:
                    bd:f2:7d:42:76:38:22:d4:7b:7c:f4:b8:b9:71:9e:
                    c3:94:f4:82:86:35:82:a6:74:bd:02:33:fa:54:86:
                    85:a3:25:be:aa:89:5e:e2:39:5f:26:41:98:1a:de:
                    b9:e6:46:85:78:bb:51:32:02:47:ec:e4:f9:1f:bd:
                    04:51:75:e6:12:9b:76:eb:85:97:14:22:0a:a1:13:
                    f7:61
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                Code Signing
            X509v3 Subject Key Identifier: 
                9C:E5:E8:6D:82:57:AE:37:24:DE:EA:5E:A9:C4:5F:90:1D:CE:D9:7B
            X509v3 Subject Alternative Name: 
                DirName:/OU=MOPR/serialNumber=229803+f785b1c0-5d9f-4316-8d6a-74ae642dde1c
            X509v3 Authority Key Identifier: 
                keyid:CB:11:E8:CA:D2:B4:16:58:01:C9:37:2E:33:16:16:B9:4C:9A:0A:1F

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt

    Signature Algorithm: sha1WithRSAEncryption
         6b:e4:56:e3:d7:13:1d:20:40:f9:6d:e9:de:4e:db:5d:1e:c6:
         6c:26:a3:f7:e5:09:80:0c:ff:57:e1:b4:d4:d9:f9:5c:48:e1:
         06:7f:c2:a4:54:b8:96:7a:f5:8d:c9:83:13:0c:71:bf:f8:fc:
         bb:2e:cc:15:73:f3:00:6b:4e:25:aa:f4:c4:0a:72:94:52:9f:
         77:4d:29:93:28:08:31:16:d9:df:6e:74:ab:c4:e8:4e:15:b1:
         99:05:44:4e:1a:49:49:2c:ac:79:ee:bf:85:4f:84:6e:47:ef:
         be:d8:d2:8b:49:69:0e:29:83:f5:a5:bd:a3:1b:21:ad:a2:a5:
         3e:90:20:9c:f5:9f:12:3d:7a:59:75:64:ef:da:a3:85:84:32:
         12:02:02:6a:64:77:01:a6:39:98:b3:ee:a2:28:49:6c:ac:24:
         32:28:3e:a8:8b:66:2c:fb:02:d8:83:2f:23:92:91:f7:57:65:
         ff:a4:d5:e9:51:08:94:f6:d6:fd:c0:d5:c0:20:45:fd:43:49:
         4f:79:ee:64:19:7f:60:4e:e2:c4:ca:53:4e:1f:fb:5a:91:0d:
         5b:cd:24:83:7c:73:e8:c9:42:77:12:5f:31:26:c9:b0:ce:53:
         8a:61:54:f7:c2:8d:72:99:f1:c5:b6:1d:7e:aa:90:84:04:3a:
         97:79:ad:60
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:33:26:1a:00:00:00:00:00:31
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
        Validity
            Not Before: Aug 31 22:19:32 2010 GMT
            Not After : Aug 31 22:29:32 2020 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Signing PCA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b2:72:59:5c:19:30:64:bf:1d:9a:60:20:20:42:
                    99:76:53:6c:3e:1b:d6:6f:cc:cb:f1:ea:6b:fe:97:
                    16:10:e0:df:3a:74:83:1a:b7:2f:a0:32:ec:ff:de:
                    c2:42:4e:23:d5:72:00:db:35:57:0a:89:ca:ae:20:
                    49:f4:f0:68:ac:4d:4b:8d:a5:bd:79:4b:71:9b:47:
                    07:da:fd:25:df:9d:75:88:cf:aa:73:44:7f:d7:81:
                    db:f3:bd:f2:36:a4:c9:5c:45:dc:af:ad:3d:e0:28:
                    68:97:1a:a7:a5:72:73:56:f1:17:94:e4:fd:35:94:
                    72:a0:d6:76:5f:1e:77:45:83:85:38:16:d0:73:5b:
                    05:ba:67:52:8d:a5:b2:69:2f:da:19:0b:fe:92:74:
                    29:e2:76:2f:54:dd:14:30:59:f8:d2:8d:62:fd:cb:
                    c9:5f:46:31:50:b9:27:13:e4:40:30:cf:72:29:10:
                    28:22:c7:37:4e:3d:a0:32:3d:90:cd:a1:38:06:85:
                    5c:4e:56:82:28:2a:05:32:b7:4b:d7:4f:63:e7:d2:
                    2d:62:f1:45:3d:e7:ac:08:00:f6:46:a1:9e:d1:5b:
                    8c:26:53:e8:7a:aa:4a:f2:46:cf:37:3c:38:9e:b4:
                    77:5c:a5:17:9e:8d:cb:11:8f:56:3c:c1:ac:09:5f:
                    03:d3
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier: 
                CB:11:E8:CA:D2:B4:16:58:01:C9:37:2E:33:16:16:B9:4C:9A:0A:1F
            X509v3 Key Usage: 
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1: 
                .....
            1.3.6.1.4.1.311.21.2: 
                ....1N.&....`;.1o.<..-
            1.3.6.1.4.1.311.20.2: 
                .
.S.u.b.C.A
            X509v3 Authority Key Identifier: 
                keyid:0E:AC:82:60:40:56:27:97:E5:25:13:FC:2A:E1:0A:53:95:59:E4:A4

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt

    Signature Algorithm: sha1WithRSAEncryption
         59:39:3e:7f:26:46:af:eb:6f:40:b1:32:b5:6a:eb:0e:2f:6e:
         a8:49:f7:eb:5f:75:ed:4c:3b:2d:d7:43:ad:0b:fe:cb:e9:2d:
         31:a3:23:cc:7c:50:98:80:21:5d:ac:3d:2f:4c:ba:a2:a8:56:
         9c:e3:70:bb:b8:b4:f8:79:b5:49:72:f7:3e:ea:41:7f:ca:e1:
         0c:17:69:cb:a5:9c:20:2d:fa:0b:50:c4:56:cd:2d:e3:4a:d2:
         bc:70:e7:a8:0d:a2:03:a5:56:e0:b8:8a:4b:57:f2:95:42:9c:
         f1:f3:ef:ee:e3:86:1f:34:3c:b8:56:9a:f0:53:23:85:2a:a4:
         82:1c:93:e2:94:07:1d:f2:e2:4e:f8:8c:a1:ca:e8:13:a5:91:
         4e:c8:1b:d2:8f:72:95:2a:71:6d:9b:1a:f8:1c:f0:53:d6:67:
         cc:22:ff:5c:1d:cd:a2:8c:bd:27:b2:79:63:56:44:a2:51:cd:
         f9:e9:a3:58:56:dd:9b:02:45:44:2f:5f:f4:da:ae:d4:82:32:
         6e:fc:a4:95:13:e4:eb:69:e7:a9:a2:2c:be:c8:2b:10:0e:65:
         8e:99:db:f5:a2:fa:12:26:09:65:38:94:f1:7a:1f:4a:bb:d1:
         e1:56:e8:d0:78:96:18:5c:c9:35:16:5f:dd:93:1d:49:8e:2d:
         be:ad:34:44:1c:ee:10:15:1a:00:5d:dd:35:5b:21:ce:98:c7:
         09:ee:85:0e:8c:4f:6d:0e:13:4e:3d:7c:29:48:9c:72:d1:f3:
         6c:ca:c1:ec:70:a3:57:92:57:7d:94:8d:a0:1b:48:03:5a:f7:
         cf:a3:67:0a:74:a5:36:ed:2d:2f:17:c8:e6:72:37:12:f4:6f:
         b1:3c:67:82:f9:52:b2:8d:33:16:65:1e:0e:8a:dd:10:de:64:
         f4:6f:ce:46:d4:d3:17:e9:79:c4:04:b4:d3:fb:2c:df:1f:8a:
         9e:ac:0a:fb:13:27:40:ad:e4:f9:e1:a9:7f:46:bb:07:60:47:
         65:60:40:4e:b0:42:ec:4e:ed:b3:76:79:d8:0a:34:09:6d:1c:
         80:31:1f:e2:0e:54:dd:e5:a1:fb:e5:47:10:ad:64:98:ff:50:
         16:2e:7c:bf:05:21:7a:e2:95:41:27:69:c3:93:8f:95:c9:8d:
         d8:9b:21:ae:0d:5c:9c:f0:a2:ae:86:68:83:0c:6a:2d:bb:76:
         6b:00:1d:96:ad:f2:16:7b:f6:16:83:24:b9:88:cf:6a:a8:47:
         31:2f:9a:dc:e3:71:3d:d7:00:7e:62:47:d1:ce:88:c9:b8:18:
         fa:0e:72:8d:c1:a3:3d:af:02:40:6a:ff:69:9b:96:e2:10:a8:
         10:b4:37:50:08:d6:c3:3d
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:16:68:34:00:00:00:00:00:1c
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
        Validity
            Not Before: Apr  3 12:53:09 2007 GMT
            Not After : Apr  3 13:03:09 2021 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Time-Stamp PCA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:9f:a1:6c:b1:df:db:48:92:2a:7c:6b:2e:19:e1:
                    bd:e2:e3:c5:99:51:23:50:ad:ce:dd:18:4e:24:0f:
                    ee:d1:a7:d1:4c:ad:74:30:20:11:eb:07:d5:54:95:
                    15:49:94:1b:42:92:ae:98:5c:30:26:da:00:6b:e8:
                    7b:bd:ec:89:07:0f:f7:0e:04:98:f0:89:cc:1f:cb:
                    33:24:87:9d:f2:f4:67:1c:2c:fc:7b:e7:88:1d:ea:
                    e7:4e:a3:a1:c1:23:53:ca:8d:fa:45:cf:09:d0:5e:
                    af:d0:b0:42:04:a2:f9:a6:6c:93:67:d7:28:dc:46:
                    53:b0:86:d0:e5:28:46:2e:27:ac:86:4f:55:52:0c:
                    e4:03:2c:fb:6a:90:90:30:6e:87:f3:59:30:9d:fa:
                    7e:d6:97:b3:e8:21:97:7e:f8:d2:13:f3:08:b7:53:
                    6d:52:b4:45:90:9f:48:00:4a:47:66:11:27:29:66:
                    a8:97:e4:d3:06:81:4a:a2:f9:84:a7:11:47:14:09:
                    82:9f:84:ed:55:78:fe:01:9a:1d:50:08:85:00:10:
                    30:46:ed:b7:de:23:46:bb:c4:2d:54:9f:af:1e:78:
                    41:31:77:cc:9b:df:3b:83:93:a1:61:02:b5:1d:0d:
                    b1:fc:f7:9b:b2:01:ce:22:4b:54:ff:f9:05:c3:c2:
                    20:0b
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier: 
                23:34:F8:D9:52:46:70:0A:ED:40:FB:76:FB:B3:2B:B0:C3:35:B3:0F
            X509v3 Key Usage: 
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1: 
                ...
            X509v3 Authority Key Identifier: 
                keyid:0E:AC:82:60:40:56:27:97:E5:25:13:FC:2A:E1:0A:53:95:59:E4:A4
                DirName:/DC=com/DC=microsoft/CN=Microsoft Root Certificate Authority
                serial:79:AD:16:A1:4A:A0:A5:AD:4C:73:58:F4:07:13:2E:65

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt

            X509v3 Extended Key Usage: 
                Time Stamping
    Signature Algorithm: sha1WithRSAEncryption
         10:97:8a:c3:5c:03:44:36:dd:e9:b4:ad:77:db:ce:79:51:4d:
         01:b1:2e:74:71:5b:6d:0c:13:ab:ce:be:7b:8f:b8:2e:d4:12:
         a2:8c:6d:62:b8:57:02:cb:4e:20:13:50:99:dd:7a:40:e2:57:
         bb:af:58:9a:1c:e1:1d:01:86:ac:bb:78:f2:8b:d0:ec:3b:01:
         ee:e2:be:8f:0a:05:c8:8d:48:e2:f0:53:15:dd:4f:ab:92:e4:
         e7:8d:6a:d5:80:c1:e6:94:f2:06:2f:85:03:e9:91:2a:24:22:
         70:fb:f6:fc:e4:78:99:2e:0d:f7:07:e2:70:bc:18:4e:9d:8e:
         6b:0a:72:95:b8:a1:39:9c:67:2d:c5:51:0e:ea:62:5c:3f:16:
         98:8b:20:3f:e2:07:1a:32:f9:cc:31:4a:76:31:3d:2b:72:0b:
         c8:ea:70:3d:ff:85:0a:13:df:c2:0a:61:8e:f0:d7:b8:17:eb:
         4e:8b:7f:c5:35:2b:5e:a3:bf:eb:bc:7d:0b:42:7b:d4:53:72:
         21:ee:30:ca:bb:78:65:5c:5b:01:17:0a:14:0e:d2:da:14:98:
         f5:3c:b9:66:58:b3:2d:2f:e7:f9:85:86:cc:51:56:e8:9d:70:
         94:6c:ac:39:4c:d4:f6:79:bf:aa:18:7a:62:29:ef:a2:9b:29:
         34:06:77:1a:62:c9:3d:1e:6d:1f:82:f0:0b:c7:2c:bb:cf:43:
         b3:e5:f9:ec:7d:b5:e3:a4:a8:74:35:b8:4e:c5:71:23:12:26:
         76:0b:3c:52:8c:71:5a:46:43:14:bc:b3:b3:b0:4d:67:c8:9f:
         42:ff:80:79:21:80:9e:15:30:66:e8:42:12:5e:1a:c8:9e:22:
         21:d0:43:e9:2b:e9:bb:f4:48:cc:2c:d4:d8:32:80:4c:26:2a:
         48:24:5f:5a:ea:56:ef:a6:de:99:9d:ca:3a:6f:bd:81:27:74:
         06:11:ee:76:21:bf:9b:82:c1:27:54:b6:b1:6a:3d:89:a1:76:
         61:b4:6e:a1:13:a6:bf:aa:47:f0:12:6f:fd:8a:32:6c:b2:fe:
         df:51:c8:8c:23:c9:66:bd:9d:1d:87:12:64:02:3d:2d:af:59:
         8f:b8:e4:21:e5:b5:b0:ca:63:b4:78:54:05:d4:41:2e:50:ac:
         94:b0:a5:78:ab:b3:a0:96:75:1a:d9:92:87:13:75:22:2f:32:
         a8:08:6e:a0:5b:8c:25:bf:a0:ef:84:ca:21:d6:eb:1e:4f:c9:
         9a:ee:49:e0:f7:01:65:6f:89:0b:7d:c8:69:c8:e6:6e:ea:a7:
         97:ce:31:29:ff:0e:c5:5b:5c:d8:4d:1b:a1:d8:fa:2f:9e:3f:
         2e:55:16:6b:c9:13:a3:fd

undefined method `first' for #

offsetsizetypecomment
02708480EXE04/30/2017 23:30:45#
15c115HTM#
29540016032PKCS7Authenticode Signature#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK