NgcIso.exe - Windows Hello Security Process

info
MZ
PE
resources
imports
exports
foremost
version info
signature
hexdump
disasm
log
discuss
donate

filename	NgcIso.exe
size	461280 (0x709e0)
md5	05f0634d33b92451da96168ec03704f2

type	PE32+ executable (GUI) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

Rich Header

lib id	version	times used
147	30729	50
260	26213	11
259	26213	3
261	26213	36
1	0	1199
257	26213	5
265	26213	49
253	26213	1
256	26213	1
255	26213	1
258	26213	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	8
TimeDateStamp	0x28e59ac1
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.13
SizeOfCode	0x4c400
SizeOfInitializedData	0x21a00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x47ab0
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	10.0
ImageVersion	10.0
SubsystemVersion	10.0
Reserved1	0
SizeOfImage	0x73000
SizeOfHeaders	0x400
CheckSum	0x73048
Subsystem	2
DllCharacteristics	0xc160
SizeOfStackReserve	0x80000
SizeOfStackCommit	0x2000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ 8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x4c26c	0x4c400	R-X CODE
.rdata	0x4e000	0x1a532	0x1a600	R-- IDATA
.data	0x69000	0x1ee8	0x1600	RW- IDATA
.pdata	0x6b000	0x3ba0	0x3c00	R-- IDATA
.didat	0x6f000	0xa8	0x200	RW- IDATA
.tPolicy	0x70000	0x4e0	0x600	R-- IDATA
.rsrc	0x71000	0x410	0x600	R-- IDATA
.reloc	0x72000	0x844	0xa00	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x668d0	0x54
IMPORT	0x66924	0x230
RESOURCE	0x71000	0x410
EXCEPTION	0x6b000	0x3ba0
SECURITY	0x6d800	0x31e0
BASERELOC	0x72000	0x844
DEBUG	0x56e10	0x54
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x50c48	0x28
LOAD_CONFIG	0x50b40	0x108
Bound_IAT	0	0
IAT	0x50c70	0x5b8
Delay_IAT	0x66584	0x40
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x14005e280	0x14005e288	0x14006aaa4	0x140051300	0	0x300000

show previews

type	name	size	cp
VERSION	#1	940	0

module_name	hint	function_name
msvcp_win.dll	1230	struct std::_Smanip<__int64> __cdecl std::setw(__int64) ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
msvcp_win.dll	264	public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::operator<<(class std::ios_base & __ptr64 (__cdecl*)(class std::ios_base & __ptr64)) __ptr64 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
msvcp_win.dll	255	public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::operator<<(int) __ptr64 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
msvcp_win.dll	12	protected: __cdecl std::basic_ios<char, struct std::char_traits<char> >::basic_ios<char, struct std::char_traits<char> >(void) __ptr64 ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
msvcp_win.dll	125	public: virtual __cdecl std::basic_ios<char, struct std::char_traits<char> >::~basic_ios<char, struct std::char_traits<char> >(void) __ptr64 ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
msvcp_win.dll	655	void __cdecl std::_Xout_of_range(char const * __ptr64) ?_Xout_of_range@std@@YAXPEBD@Z
msvcp_win.dll	128	public: virtual __cdecl std::basic_iostream<char, struct std::char_traits<char> >::~basic_iostream<char, struct std::char_traits<char> >(void) __ptr64 ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
msvcp_win.dll	47	protected: __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::basic_streambuf<char, struct std::char_traits<char> >(void) __ptr64 ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
msvcp_win.dll	552	public: virtual void __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::_Lock(void) __ptr64 ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
msvcp_win.dll	639	public: virtual void __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::_Unlock(void) __ptr64 ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
msvcp_win.dll	586	protected: char * __ptr64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::_Pninc(void) __ptr64 ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
msvcp_win.dll	1237	protected: virtual __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::showmanyc(void) __ptr64 ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
msvcp_win.dll	1307	protected: virtual int __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::uflow(void) __ptr64 ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
msvcp_win.dll	1347	protected: virtual __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::xsgetn(char * __ptr64, __int64) __ptr64 ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
msvcp_win.dll	1350	protected: virtual __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::xsputn(char const * __ptr64, __int64) __ptr64 ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
msvcp_win.dll	875	protected: void __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::gbump(int) __ptr64 ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
msvcp_win.dll	1089	protected: void __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::pbump(int) __ptr64 ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
msvcp_win.dll	406	__int64 const std::_BADOFF ?_BADOFF@std@@3_JB
msvcp_win.dll	1205	protected: virtual class std::basic_streambuf<char, struct std::char_traits<char> > * __ptr64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::setbuf(char * __ptr64, __int64) __ptr64 ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
msvcp_win.dll	1277	protected: virtual int __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::sync(void) __ptr64 ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
msvcp_win.dll	1014	protected: virtual void __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::imbue(class std::locale const & __ptr64) __ptr64 ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
msvcp_win.dll	137	public: virtual __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::~basic_streambuf<char, struct std::char_traits<char> >(void) __ptr64 ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
msvcp_win.dll	19	public: __cdecl std::basic_iostream<char, struct std::char_traits<char> >::basic_iostream<char, struct std::char_traits<char> >(class std::basic_streambuf<char, struct std::char_traits<char> > * __ptr64) __ptr64 ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
msvcp_win.dll	654	void __cdecl std::_Xlength_error(char const * __ptr64) ?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0.dll	21	_c_exit
api-ms-win-crt-runtime-l1-1-0.dll	61	_register_thread_local_exe_atexit_callback
api-ms-win-crt-runtime-l1-1-0.dll	55	_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll	54	_initterm
api-ms-win-crt-string-l1-1-0.dll	131	memset
api-ms-win-crt-string-l1-1-0.dll	158	wcscmp
api-ms-win-crt-private-l1-1-0.dll	144	_o__callnewh
api-ms-win-crt-private-l1-1-0.dll	146	_o__cexit
api-ms-win-crt-private-l1-1-0.dll	158	_o__configthreadlocale
api-ms-win-crt-private-l1-1-0.dll	160	_o__configure_wide_argv
api-ms-win-crt-private-l1-1-0.dll	166	_o__crt_atexit
api-ms-win-crt-private-l1-1-0.dll	191	_o__errno
api-ms-win-crt-private-l1-1-0.dll	198	_o__exit
api-ms-win-crt-private-l1-1-0.dll	270	_o__get_initial_wide_environment
api-ms-win-crt-private-l1-1-0.dll	316	_o__initialize_onexit_table
api-ms-win-crt-private-l1-1-0.dll	317	_o__initialize_wide_environment
api-ms-win-crt-private-l1-1-0.dll	318	_o__invalid_parameter_noinfo
api-ms-win-crt-private-l1-1-0.dll	319	_o__invalid_parameter_noinfo_noreturn
api-ms-win-crt-private-l1-1-0.dll	578	_o__purecall
api-ms-win-crt-private-l1-1-0.dll	592	_o__register_onexit_function
api-ms-win-crt-private-l1-1-0.dll	601	_o__seh_filter_exe
api-ms-win-crt-private-l1-1-0.dll	603	_o__set_app_type
api-ms-win-crt-private-l1-1-0.dll	606	_o__set_fmode
api-ms-win-crt-private-l1-1-0.dll	609	_o__set_new_mode
api-ms-win-crt-private-l1-1-0.dll	1122	memmove
api-ms-win-crt-private-l1-1-0.dll	876	_o_exit
api-ms-win-crt-private-l1-1-0.dll	907	_o_free
api-ms-win-crt-private-l1-1-0.dll	952	_o_ldexp
api-ms-win-crt-private-l1-1-0.dll	982	_o_malloc
api-ms-win-crt-private-l1-1-0.dll	993	_o_memcpy_s
api-ms-win-crt-private-l1-1-0.dll	1076	_o_terminate
api-ms-win-crt-private-l1-1-0.dll	1	_CxxThrowException
api-ms-win-crt-private-l1-1-0.dll	82	_o___p__commode
api-ms-win-crt-private-l1-1-0.dll	80	_o___p___wargv
api-ms-win-crt-private-l1-1-0.dll	111	_o___stdio_common_vswprintf
api-ms-win-crt-private-l1-1-0.dll	78	_o___p___argc
api-ms-win-crt-private-l1-1-0.dll	105	_o___stdio_common_vsnprintf_s
api-ms-win-crt-private-l1-1-0.dll	12	__C_specific_handler
api-ms-win-crt-private-l1-1-0.dll	41	__std_terminate
api-ms-win-crt-private-l1-1-0.dll	94	_o___std_exception_destroy
api-ms-win-crt-private-l1-1-0.dll	93	_o___std_exception_copy
api-ms-win-crt-private-l1-1-0.dll	18	__CxxFrameHandler3
api-ms-win-crt-private-l1-1-0.dll	28	__RTDynamicCast
api-ms-win-crt-private-l1-1-0.dll	1120	memcmp
api-ms-win-crt-private-l1-1-0.dll	1121	memcpy
api-ms-win-core-libraryloader-l1-2-0.dll	19	GetModuleHandleExW
api-ms-win-core-libraryloader-l1-2-0.dll	21	GetProcAddress
api-ms-win-core-libraryloader-l1-2-0.dll	20	GetModuleHandleW
api-ms-win-core-libraryloader-l1-2-0.dll	15	GetModuleFileNameA
api-ms-win-core-synch-l1-1-0.dll	17	EnterCriticalSection
api-ms-win-core-synch-l1-1-0.dll	38	ReleaseSemaphore
api-ms-win-core-synch-l1-1-0.dll	6	CreateEventW
api-ms-win-core-synch-l1-1-0.dll	11	CreateSemaphoreExW
api-ms-win-core-synch-l1-1-0.dll	31	OpenEventW
api-ms-win-core-synch-l1-1-0.dll	41	SetEvent
api-ms-win-core-synch-l1-1-0.dll	5	CreateEventExW
api-ms-win-core-synch-l1-1-0.dll	29	LeaveCriticalSection
api-ms-win-core-synch-l1-1-0.dll	26	InitializeCriticalSectionEx
api-ms-win-core-synch-l1-1-0.dll	39	ResetEvent
api-ms-win-core-synch-l1-1-0.dll	15	DeleteCriticalSection
api-ms-win-core-synch-l1-1-0.dll	25	InitializeCriticalSectionAndSpinCount
api-ms-win-core-synch-l1-1-0.dll	9	CreateMutexExW
api-ms-win-core-synch-l1-1-0.dll	37	ReleaseSRWLockShared
api-ms-win-core-synch-l1-1-0.dll	33	OpenSemaphoreW
api-ms-win-core-synch-l1-1-0.dll	55	WaitForSingleObjectEx
api-ms-win-core-synch-l1-1-0.dll		AcquireSRWLockExclusive
api-ms-win-core-synch-l1-1-0.dll	36	ReleaseSRWLockExclusive
api-ms-win-core-synch-l1-1-0.dll	1	AcquireSRWLockShared
api-ms-win-core-synch-l1-1-0.dll	35	ReleaseMutex
api-ms-win-core-synch-l1-1-0.dll	54	WaitForSingleObject
api-ms-win-core-heap-l1-1-0.dll		GetProcessHeap
api-ms-win-core-heap-l1-1-0.dll	11	HeapSize
api-ms-win-core-heap-l1-1-0.dll	6	HeapFree
api-ms-win-core-heap-l1-1-0.dll	2	HeapAlloc
api-ms-win-core-errorhandling-l1-1-0.dll	13	SetLastError
api-ms-win-core-errorhandling-l1-1-0.dll	5	GetLastError
api-ms-win-core-errorhandling-l1-1-0.dll	17	UnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-0.dll	15	SetUnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0.dll	26	SetThreadpoolTimer
api-ms-win-core-threadpool-l1-2-0.dll	6	CloseThreadpoolTimer
api-ms-win-core-threadpool-l1-2-0.dll	34	WaitForThreadpoolTimerCallbacks
api-ms-win-core-threadpool-l1-2-0.dll	12	CreateThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0.dll	13	GetCurrentProcessId
api-ms-win-core-processthreads-l1-1-0.dll	17	GetCurrentThreadId
api-ms-win-core-processthreads-l1-1-0.dll	12	GetCurrentProcess
api-ms-win-core-processthreads-l1-1-0.dll	77	TerminateProcess
api-ms-win-core-string-l1-1-0.dll	6	MultiByteToWideChar
api-ms-win-core-string-l1-1-0.dll	7	WideCharToMultiByte
api-ms-win-core-localization-l1-2-0.dll	9	FormatMessageW
api-ms-win-core-debug-l1-1-0.dll	4	DebugBreak
api-ms-win-core-debug-l1-1-0.dll	7	OutputDebugStringW
api-ms-win-core-debug-l1-1-0.dll	5	IsDebuggerPresent
api-ms-win-core-handle-l1-1-0.dll		CloseHandle
RPCRT4.dll	482	RpcServerUnregisterIf
RPCRT4.dll	303	NdrServerCall2
RPCRT4.dll	499	RpcServerUseProtseqIfW
RPCRT4.dll	415	RpcExceptionFilter
RPCRT4.dll	473	RpcServerListen
RPCRT4.dll	441	RpcMgmtStopServerListening
RPCRT4.dll	162	NdrClientCall3
RPCRT4.dll	454	RpcRaiseException
RPCRT4.dll	304	NdrServerCallAll
RPCRT4.dll	476	RpcServerRegisterIf
api-ms-win-eventing-provider-l1-1-0.dll	4	EventSetInformation
api-ms-win-eventing-provider-l1-1-0.dll	3	EventRegister
api-ms-win-eventing-provider-l1-1-0.dll	9	EventWriteTransfer
api-ms-win-eventing-provider-l1-1-0.dll	5	EventUnregister
api-ms-win-eventing-provider-l1-1-0.dll		EventActivityIdControl
api-ms-win-core-synch-l1-2-0.dll	45	Sleep
api-ms-win-core-synch-l1-2-0.dll	20	InitOnceComplete
api-ms-win-core-synch-l1-2-0.dll	19	InitOnceBeginInitialize
api-ms-win-core-heap-obsolete-l1-1-0.dll	13	LocalSize
api-ms-win-core-heap-l2-1-0.dll	10	LocalFree
api-ms-win-core-heap-l2-1-0.dll	8	LocalAlloc
api-ms-win-core-profile-l1-1-0.dll		QueryPerformanceCounter
api-ms-win-core-profile-l1-1-0.dll	1	QueryPerformanceFrequency
api-ms-win-core-rtlsupport-l1-1-0.dll	15	RtlVirtualUnwind
api-ms-win-core-rtlsupport-l1-1-0.dll	2	RtlCaptureContext
api-ms-win-core-rtlsupport-l1-1-0.dll	9	RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1.dll	47	IsProcessorFeaturePresent
api-ms-win-core-sysinfo-l1-1-0.dll	21	GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0.dll		InitializeSListHead
IumSdk.dll	26	EncryptData
IumSdk.dll	20	DecryptData
IumSdk.dll	65	GetTaggedDataSize
IumSdk.dll	64	GetTaggedData
IumSdk.dll	70	GetTpmBindingInfo
IumSdk.dll	147	RtlNtStatusToDosError
IumSdk.dll	56	GetSecureIdentitySigningKey
IumSdk.dll	58	GetSignedReport
api-ms-win-core-delayload-l1-1-1.dll	1	ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0.dll		DelayLoadFailureHook

ord	entry_va	function_name
1	0x70470	__ImagePolicyMetadata

module_name	NgcIso.exe
flags	0
timestamp	1991-09-29 09:20:01
version	0.0
ordinal_base	1
nFunctions	1
nNames	1
Names(1)	0x668fc
Functions(1)	0x668f8
NameOrdinals(1)	0x66900

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Windows Hello Security Process
FileVersion	10.0.17763.1 (WinBuild.160101.0800)
InternalName	NgcIso.exe
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	NgcIso.exe
ProductName	Microsoft® Windows® Operating System
ProductVersion	10.0.17763.1

VS_FIXEDFILEINFO

FileVersion	10.0.17763.1
ProductVersion	10.0.17763.1
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Production PCA 2011

serial: 33000001BB34D5EE6978E694DB0000000001BB

Certificates (2)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:01:bb:34:d5:ee:69:78:e6:94:db:00:00:00:00:01:bb
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Production PCA 2011
        Validity
            Not Before: Jun  6 18:57:55 2018 GMT
            Not After : May 29 18:57:55 2019 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:a5:ac:9a:a9:dc:65:75:69:6d:02:17:20:b9:84:
                    4c:c4:c7:da:dc:88:51:3a:c5:6b:00:e4:0c:83:b8:
                    da:5c:63:98:7f:f4:f6:29:1f:5e:62:e7:a6:d6:c0:
                    15:bf:02:dc:97:fe:09:b2:fb:7f:a8:92:a0:35:1f:
                    98:75:05:fe:9e:98:12:61:ed:36:49:66:61:21:5d:
                    f4:28:c3:b7:ee:db:3d:6b:73:d8:f3:07:58:7d:f7:
                    74:21:cc:14:0e:56:3d:18:da:c1:48:74:1b:f5:1b:
                    26:e7:57:1f:94:a0:53:58:98:48:e0:6f:56:a7:bb:
                    dd:8c:30:48:22:46:17:dd:c5:dd:38:9d:2e:25:63:
                    00:20:06:6c:d8:2f:a6:1d:4b:3e:94:da:02:bf:42:
                    d8:a9:b1:8e:bd:5c:a6:6c:a3:bd:0d:db:4a:4b:b3:
                    48:5d:c4:04:e9:5c:c9:03:34:ac:0b:4c:31:0c:4d:
                    6a:56:13:b3:1a:f8:9b:fe:36:2e:4c:7b:15:38:84:
                    35:f9:d7:c3:2f:1e:40:75:8e:73:e4:4d:e6:ea:69:
                    f3:88:f0:f8:53:e1:54:bd:e8:7b:58:2e:d4:3f:c4:
                    69:ec:5f:07:f6:49:fb:9a:68:5a:8c:bb:9c:85:db:
                    3b:a0:90:ad:71:7d:fa:a6:ba:a8:5f:be:97:47:82:
                    08:93
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                1.3.6.1.4.1.311.10.3.24, 1.3.6.1.4.1.311.10.3.37, 1.3.6.1.4.1.311.10.3.6, Code Signing
            X509v3 Subject Key Identifier: 
                49:C7:FC:8A:8A:4E:03:E6:15:7B:A5:78:94:03:E5:6A:61:3F:81:28
            X509v3 Subject Alternative Name: 
                DirName:/OU=Microsoft Ireland Operations Limited/serialNumber=232770+436225
            X509v3 Authority Key Identifier: 
                keyid:A9:29:02:39:8E:16:C4:97:78:CD:90:F9:9E:4F:9A:E1:7C:55:AF:53

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt

            X509v3 Basic Constraints: critical
                CA:FALSE
    Signature Algorithm: sha256WithRSAEncryption
         0e:dc:60:54:07:f0:d3:61:89:6c:6a:84:ed:7f:56:c4:92:21:
         5b:1e:d2:59:82:61:9a:78:12:a6:a2:3b:d7:52:41:2e:09:5d:
         8d:11:43:df:46:e1:8e:42:9b:d2:66:14:82:59:f9:87:8d:42:
         2e:9e:48:8c:30:41:19:ce:5a:82:bb:be:fc:85:ff:25:8f:e1:
         46:d2:7c:a0:43:c1:1f:90:90:a2:c1:0c:96:2b:7f:db:4b:19:
         e4:b2:51:02:67:54:4a:70:36:44:74:63:fc:13:0b:b2:e8:ad:
         16:27:47:e6:d8:e5:05:81:e9:2d:e8:2f:cc:be:e6:99:45:36:
         d4:46:9f:b5:0c:e8:f2:26:0a:f9:ef:b4:50:46:46:56:ef:bc:
         90:b5:17:e1:da:86:37:ba:09:ab:42:c3:05:14:44:e3:e0:b0:
         ce:65:bf:4c:d8:73:f7:61:e1:ed:d0:3c:10:54:da:34:73:f3:
         1f:79:6d:d0:63:7c:58:a6:42:6b:bc:0d:c3:e9:39:54:2a:4c:
         f3:76:a9:80:59:3b:83:32:95:a1:2f:0d:7d:16:9b:2b:de:cc:
         ad:f8:db:fc:cf:48:0f:fc:d4:0f:90:40:ab:59:a2:04:0f:ee:
         b3:c3:bd:c1:87:0f:1c:18:59:a2:f5:aa:31:3a:8c:c9:a9:23:
         69:10:27:00

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:07:76:56:00:00:00:00:00:08
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2010
        Validity
            Not Before: Oct 19 18:41:42 2011 GMT
            Not After : Oct 19 18:51:42 2026 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Production PCA 2011
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:dd:0c:bb:a2:e4:2e:09:e3:e7:c5:f7:96:69:bc:
                    00:21:bd:69:33:33:ef:ad:04:cb:54:80:ee:06:83:
                    bb:c5:20:84:d9:f7:d2:8b:f3:38:b0:ab:a4:ad:2d:
                    7c:62:79:05:ff:e3:4a:3f:04:35:20:70:e3:c4:e7:
                    6b:e0:9c:c0:36:75:e9:8a:31:dd:8d:70:e5:dc:37:
                    b5:74:46:96:28:5b:87:60:23:2c:bf:dc:47:a5:67:
                    f7:51:27:9e:72:eb:07:a6:c9:b9:1e:3b:53:35:7c:
                    e5:d3:ec:27:b9:87:1c:fe:b9:c9:23:09:6f:a8:46:
                    91:c1:6e:96:3c:41:d3:cb:a3:3f:5d:02:6a:4d:ec:
                    69:1f:25:28:5c:36:ff:fd:43:15:0a:94:e0:19:b4:
                    cf:df:c2:12:e2:c2:5b:27:ee:27:78:30:8b:5b:2a:
                    09:6b:22:89:53:60:16:2c:c0:68:1d:53:ba:ec:49:
                    f3:9d:61:8c:85:68:09:73:44:5d:7d:a2:54:2b:dd:
                    79:f7:15:cf:35:5d:6c:1c:2b:5c:ce:bc:9c:23:8b:
                    6f:6e:b5:26:d9:36:13:c3:4f:d6:27:ae:b9:32:3b:
                    41:92:2c:e1:c7:cd:77:e8:aa:54:4e:f7:5c:0b:04:
                    87:65:b4:43:18:a8:b2:e0:6d:19:77:ec:5a:24:fa:
                    48:03
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            1.3.6.1.4.1.311.21.1: 
                ...
            X509v3 Subject Key Identifier: 
                A9:29:02:39:8E:16:C4:97:78:CD:90:F9:9E:4F:9A:E1:7C:55:AF:53
            1.3.6.1.4.1.311.20.2: 
                .
.S.u.b.C.A
            X509v3 Key Usage: 
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier: 
                keyid:D5:F6:56:CB:8F:E8:A2:5C:62:68:D1:3D:94:90:5B:D7:CE:9A:18:C4

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

    Signature Algorithm: sha256WithRSAEncryption
         14:fc:7c:71:51:a5:79:c2:6e:b2:ef:39:3e:bc:3c:52:0f:6e:
         2b:3f:10:13:73:fe:a8:68:d0:48:a6:34:4d:8a:96:05:26:ee:
         31:46:90:61:79:d6:ff:38:2e:45:6b:f4:c0:e5:28:b8:da:1d:
         8f:8a:db:09:d7:1a:c7:4c:0a:36:66:6a:8c:ec:1b:d7:04:90:
         a8:18:17:a4:9b:b9:e2:40:32:36:76:c4:c1:5a:c6:bf:e4:04:
         c0:ea:16:d3:ac:c3:68:ef:62:ac:dd:54:6c:50:30:58:a6:eb:
         7c:fe:94:a7:4e:8e:f4:ec:7c:86:73:57:c2:52:21:73:34:5a:
         f3:a3:8a:56:c8:04:da:07:09:ed:f8:8b:e3:ce:f4:7e:8e:ae:
         f0:f6:0b:8a:08:fb:3f:c9:1d:72:7f:53:b8:eb:be:63:e0:e3:
         3d:31:65:b0:81:e5:f2:ac:cd:16:a4:9f:3d:a8:b1:9b:c2:42:
         d0:90:84:5f:54:1d:ff:89:ea:ba:1d:47:90:6f:b0:73:4e:41:
         9f:40:9f:5f:e5:a1:2a:b2:11:91:73:8a:21:28:f0:ce:de:73:
         39:5f:3e:ab:5c:60:ec:df:03:10:a8:d3:09:e9:f4:f6:96:85:
         b6:7f:51:88:66:47:19:8d:a2:b0:12:3d:81:2a:68:05:77:bb:
         91:4c:62:7b:b6:c1:07:c7:ba:7a:87:34:03:0e:4b:62:7a:99:
         e9:ca:fc:ce:4a:37:c9:2d:a4:57:7c:1c:fe:3d:dc:b8:0f:5a:
         fa:d6:c4:b3:02:85:02:3a:ea:b3:d9:6e:e4:69:21:37:de:81:
         d1:f6:75:19:05:67:d3:93:57:5e:29:1b:39:c8:ee:2d:e1:cd:
         e4:45:73:5b:d0:d2:ce:7a:ab:16:19:82:46:58:d0:5e:9d:81:
         b3:67:af:6c:35:f2:bc:e5:3f:24:e2:35:a2:0a:75:06:f6:18:
         56:99:d4:78:2c:d1:05:1b:eb:d0:88:01:9d:aa:10:f1:05:df:
         ba:7e:2c:63:b7:06:9b:23:21:c4:f9:78:6c:e2:58:17:06:36:
         2b:91:12:03:cc:a4:d9:f2:2d:ba:f9:94:9d:40:ed:18:45:f1:
         ce:8a:5c:6b:3e:ab:03:d3:70:18:2a:0a:6a:e0:5f:47:d1:d5:
         63:0a:32:f2:af:d7:36:1f:2a:70:5a:e5:42:59:08:71:4b:57:
         ba:7e:83:81:f0:21:3c:f4:1c:c1:c5:b9:90:93:0e:88:45:93:
         86:e9:b1:20:99:be:98:cb:c5:95:a4:5d:62:d6:a0:63:08:20:
         bd:75:10:77:7d:3d:f3:45:b9:9f:97:9f:cb:57:80:6f:33:a9:
         04:cf:77:a4:62:1c:59:7e

undefined method `first' for #

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	455696	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x6aaa4

NgcIso.exe- Windows Hello Security Process

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

TLS

StringTable 040904B0

VS_FIXEDFILEINFO

Signers (1)

Certificates (2)

NgcIso.exe
- Windows Hello Security Process