consent.exe - Consent UI for administrative applications

info
MZ
PE
resources
imports
foremost
version info
signature
hexdump
disasm
log
discuss
donate

filename	consent.exe
size	112000 (0x1b580)
md5	0b5511674394666e9d221f8681b2c2e6

type	PE32+ executable (GUI) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

Rich Header

lib id	version	times used
132	30729	1
149	30729	1
147	30729	33
1	0	216
131	30729	19
138	30729	11
148	30729	1
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	6
TimeDateStamp	0x4ce79e79
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	9.0
SizeOfCode	0xc000
SizeOfInitializedData	0xda00
SizeOfUninitializedData	0
AddressOfEntryPoint	0xa1d0
BaseOfCode	0x1000
ImageBase	0x100000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.1
ImageVersion	6.1
SubsystemVersion	6.1
Reserved1	0
SizeOfImage	0x1e000
SizeOfHeaders	0x600
CheckSum	0x25f67
Subsystem	2
DllCharacteristics	0x81c0
SizeOfStackReserve	0x80000
SizeOfStackCommit	0x2000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ 8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xbf28	0xc000	R-X CODE
.data	0xd000	0x8a0	0x400	RW- IDATA
.pdata	0xe000	0x498	0x600	R-- IDATA
consent	0xf000	0x62	0x200	RW- IDATA
.rsrc	0x10000	0xc5f8	0xc600	R-- IDATA
.reloc	0x1d000	0x162	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xb9c8	0x154
RESOURCE	0x10000	0xc5f8
EXCEPTION	0xe000	0x498
SECURITY	0x19a00	0x1b80
BASERELOC	0x1d000	0x50
DEBUG	0x1670	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0x2e8	0x158
IAT	0x1000	0x638
Delay_IAT	0xb4bc	0x100
CLR_Header	0	0

show previews

type	name	size
MUI	#1	216
ICON	#1	744
ICON	#2	296
ICON	#3	3752
ICON	#4	2216
ICON	#5	1384
ICON	#6	9640
ICON	#7	4264
ICON	#8	1128
ICON	#9	744
ICON	#10	296
ICON	#11	3752
ICON	#12	2216
ICON	#13	1384
ICON	#14	9640
ICON	#15	4264
ICON	#16	1128
GROUP_ICON	#107	118
GROUP_ICON	#108	118
VERSION	#1	956
MANIFEST	#1	1257

module_name	hint	ord	function_name
ADVAPI32.dll	346		GetTokenInformation
ADVAPI32.dll	371		ImpersonateLoggedOnUser
ADVAPI32.dll	656		RevertToSelf
ADVAPI32.dll	480		MakeAbsoluteSD
ADVAPI32.dll	598		RegGetValueW
ADVAPI32.dll	114		ConvertStringSecurityDescriptorToSecurityDescriptorW
ADVAPI32.dll	343		GetSidSubAuthority
ADVAPI32.dll	342		GetSidLengthRequired
ADVAPI32.dll	376		InitializeSid
KERNEL32.dll	1127		SetEvent
KERNEL32.dll	665		GetTickCount
KERNEL32.dll	834		LoadLibraryW
KERNEL32.dll	1217		Sleep
KERNEL32.dll	487		GetExitCodeThread
KERNEL32.dll	133		CreateEventW
KERNEL32.dll	1287		WaitForMultipleObjects
KERNEL32.dll	1289		WaitForSingleObject
KERNEL32.dll	1021		ReleaseMutex
KERNEL32.dll	455		GetCurrentProcessId
KERNEL32.dll	1046		ResumeThread
KERNEL32.dll	522		GetLocaleInfoW
KERNEL32.dll	680		GetUserPreferredUILanguages
KERNEL32.dll	143		CreateFileW
KERNEL32.dll	707		GlobalFree
KERNEL32.dll	732		HeapSetInformation
KERNEL32.dll	857		MapViewOfFile
KERNEL32.dll	1254		UnmapViewOfFile
KERNEL32.dll	1281		VirtualQuery
KERNEL32.dll	140		CreateFileMappingW
KERNEL32.dll	586		GetProcAddress
KERNEL32.dll	832		LoadLibraryExA
KERNEL32.dll	207		DelayLoadFailureHook
KERNEL32.dll	833		LoadLibraryExW
KERNEL32.dll	360		FreeLibrary
KERNEL32.dll	474		GetDriveTypeW
KERNEL32.dll	180		CreateThread
KERNEL32.dll	843		LocalFree
KERNEL32.dll	82		CloseHandle
KERNEL32.dll	947		QueueUserWorkItem
KERNEL32.dll	839		LocalAlloc
KERNEL32.dll	518		GetLastError
KERNEL32.dll	397		GetCommandLineW
KERNEL32.dll	1189		SetThreadPreferredUILanguages
KERNEL32.dll	1161		SetPriorityClass
KERNEL32.dll	540		GetModuleHandleW
KERNEL32.dll	454		GetCurrentProcess
KERNEL32.dll	459		GetCurrentThreadId
KERNEL32.dll	616		GetStartupInfoW
KERNEL32.dll	1199		SetUnhandledExceptionFilter
KERNEL32.dll	934		QueryPerformanceCounter
KERNEL32.dll	638		GetSystemTimeAsFileTime
KERNEL32.dll	1227		TerminateProcess
KERNEL32.dll	1247		UnhandledExceptionFilter
KERNEL32.dll	338		FindResourceExW
KERNEL32.dll	835		LoadResource
KERNEL32.dll	853		LockResource
GDI32.dll	493		GetLayout
GDI32.dll	227		DeleteDC
GDI32.dll	53		CreateDIBSection
GDI32.dll	645		SetDCBrushColor
GDI32.dll	230		DeleteObject
GDI32.dll	631		SelectObject
GDI32.dll	48		CreateCompatibleDC
GDI32.dll	47		CreateCompatibleBitmap
GDI32.dll	525		GetStockObject
GDI32.dll	19		BitBlt
USER32.dll	14		BeginPaint
USER32.dll	74		CloseDesktop
USER32.dll	556		OpenDesktopW
USER32.dll	558		OpenInputDesktop
USER32.dll	495		LoadCursorW
USER32.dll	358		GetParent
USER32.dll	570		PostMessageW
USER32.dll	782		UnregisterClassW
USER32.dll	246		FillRect
USER32.dll	388		GetThreadDesktop
USER32.dll	303		GetForegroundWindow
USER32.dll	571		PostQuitMessage
USER32.dll	351		GetMessageW
USER32.dll	416		GetWindowRect
USER32.dll	166		DestroyWindow
USER32.dll	220		EndPaint
USER32.dll	640		SendMessageW
USER32.dll	510		LoadStringW
USER32.dll	163		DestroyIcon
USER32.dll	384		GetSystemMetrics
USER32.dll	291		GetDC
USER32.dll	404		GetWindowDC
USER32.dll	772		TranslateMessage
USER32.dll	497		LoadIconW
USER32.dll	175		DispatchMessageW
USER32.dll	156		DefWindowProcW
USER32.dll	365		GetPropW
USER32.dll	397		GetUserObjectInformationW
USER32.dll	594		RegisterClassW
USER32.dll	110		CreateWindowExW
USER32.dll	704		SetThreadDesktop
USER32.dll	743		ShowWindow
USER32.dll	293		GetDesktopWindow
USER32.dll	716		SetWindowLongW
USER32.dll	617		ReleaseDC
USER32.dll	260		GetAncestor
USER32.dll	410		GetWindowLongW
USER32.dll	252		FlashWindowEx
USER32.dll	691		SetPropW
msvcrt.dll	148		_acmdln
msvcrt.dll	1056		exit
msvcrt.dll	179		_cexit
msvcrt.dll	392		_ismbblead
msvcrt.dll	255		_exit
msvcrt.dll	82		_XcptFilter
msvcrt.dll	83		__C_specific_handler
msvcrt.dll	196		_commode
msvcrt.dll	1228		swscanf_s
msvcrt.dll	1278		wcsrchr
msvcrt.dll	364		_initterm
msvcrt.dll	889		_wcsicmp
msvcrt.dll	1015		_wtol
msvcrt.dll	856		_vsnwprintf
msvcrt.dll	246		_errno
msvcrt.dll	280		_fmode
msvcrt.dll	1156		memset
msvcrt.dll	160		_amsg_exit
msvcrt.dll	1263		wcschr
msvcrt.dll	130		__setusermatherr
msvcrt.dll	113		__getmainargs
msvcrt.dll	48		void __cdecl terminate(void) ?terminate@@YAXXZ
msvcrt.dll	1011		_wtoi
msvcrt.dll	128		__set_app_type
msvcrt.dll	1152		memcpy
ntdll.dll	1196		RtlSubAuthoritySid
ntdll.dll	1004		RtlLengthRequiredSid
ntdll.dll	798		RtlEqualSid
ntdll.dll	930		RtlInitString
ntdll.dll	1045		RtlNtStatusToDosError
ntdll.dll	214		NtClose
ntdll.dll	609		RtlAdjustPrivilege
ntdll.dll	635		RtlCaptureContext
ntdll.dll	1026		RtlLookupFunctionEntry
ntdll.dll	1265		RtlVirtualUnwind
ntdll.dll	1388		WinSqmAddToStreamEx
ntdll.dll	917		RtlImageNtHeaderEx
ntdll.dll	275		NtDuplicateObject
ntdll.dll	355		NtOpenProcess
ntdll.dll	67		EtwGetTraceLoggerHandle
ntdll.dll	81		EtwUnregisterTraceGuids
ntdll.dll	56		EtwEventUnregister
ntdll.dll	74		EtwRegisterTraceGuidsW
ntdll.dll	613		RtlAllocateHeap
ntdll.dll	442		NtReadVirtualMemory
ntdll.dll	55		EtwEventRegister
ntdll.dll	433		NtQueryVolumeInformationFile
ntdll.dll	564		NtWriteVirtualMemory
ntdll.dll	65		EtwGetTraceEnableFlags
ntdll.dll	843		RtlFreeHeap
ntdll.dll	66		EtwGetTraceEnableLevel
ntdll.dll	76		EtwSendNotification
ntdll.dll	57		EtwEventWrite
ntdll.dll	179		NtAllocateLocallyUniqueId
ntdll.dll	402		NtQueryInformationToken
ntdll.dll	276		NtDuplicateToken
ntdll.dll	950		RtlInitializeSid
ntdll.dll	1046		RtlNtStatusToDosErrorNoTeb
ntdll.dll	79		EtwTraceMessage
ole32.dll	67		CoInitializeEx
ole32.dll	68		CoInitializeSecurity
ole32.dll	112		CoUninitialize
ole32.dll	437		StringFromGUID2
ole32.dll	20		CoCreateInstance
ole32.dll	107		CoTaskMemAlloc
ole32.dll	108		CoTaskMemFree
MSIMG32.dll			AlphaBlend
WMsgAPI.dll	4		WmsgSendMessage
WTSAPI32.dll	31		WTSQuerySessionInformationW
WTSAPI32.dll	18		WTSFreeMemory
WINMM.dll	8		PlaySoundW
USERENV.dll	44		UnloadUserProfile
USERENV.dll	33		LoadUserProfileW
WINSTA.dll	74		WinStationQueryInformationW
CRYPT32.dll	64		CertFreeCertificateContext
MsCtfMonitor.DLL	5		InitLocalMsCtfMonitor
MsCtfMonitor.DLL	6		UninitLocalMsCtfMonitor
COMCTL32.dll		345

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Consent UI for administrative applications
FileVersion	6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalName	consent
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	consent.exe
ProductName	Microsoft® Windows® Operating System
ProductVersion	6.1.7601.17514

VS_FIXEDFILEINFO

FileVersion	6.1.7601.17514
ProductVersion	6.1.7601.17514
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Verification PCA

serial: 6115230F00000000000A

Certificates (4)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:03:dc:f6:00:00:00:00:00:0c
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Time-Stamp PCA
        Validity
            Not Before: Jul 25 19:12:50 2008 GMT
            Not After : Jul 25 19:22:50 2011 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=MOPR, OU=nCipher DSE ESN:159C-A3F7-2570, CN=Microsoft Time-Stamp Service
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:c0:ed:81:14:a1:5e:77:c0:5b:f4:76:89:62:fa:
                    ad:7c:68:14:b4:f7:bd:35:d8:13:79:5a:17:ca:d9:
                    6c:51:45:62:26:7a:2f:1f:d8:ea:c1:6e:01:17:f9:
                    c3:a6:1f:67:db:51:b0:2c:de:8a:17:ed:ff:20:ad:
                    34:ea:98:fb:a5:d6:2a:d2:f1:44:27:07:5a:2d:3a:
                    93:ff:56:53:b0:c8:f5:f3:03:f2:49:cc:16:d0:f5:
                    00:4c:58:f8:9b:f5:07:25:b1:66:17:c0:bd:c8:d2:
                    52:85:8d:c2:2b:38:b2:c3:36:be:f9:87:da:f4:8e:
                    5d:43:d7:06:bf:99:05:9f:a4:ce:fe:ab:8d:61:63:
                    e7:39:c5:f3:18:f6:d8:fc:31:36:69:72:5a:a2:1a:
                    4c:3e:ea:87:25:42:9d:d1:3e:f1:97:d2:18:32:93:
                    70:55:53:81:1e:e3:3b:0d:e8:be:82:78:6d:e6:fa:
                    cd:98:a4:6f:db:ee:66:f4:95:c8:cd:35:c9:9e:bb:
                    36:0d:83:96:94:26:a7:90:e0:a9:34:3b:d5:c0:9e:
                    3e:f0:d4:47:8d:86:0c:82:a4:58:30:3a:1c:76:e3:
                    ad:95:66:b4:b7:fd:09:8a:05:60:0f:a3:0f:e2:93:
                    96:58:22:9c:9d:2b:db:a2:94:18:90:95:02:bd:06:
                    40:95
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                D2:ED:0D:1E:24:BB:37:A9:D8:20:6A:4D:1D:D2:16:D5:2E:BE:9E:EB
            X509v3 Authority Key Identifier: 
                23:34:F8:D9:52:46:70:0A:ED:40:FB:76:FB:B3:2B:B0:C3:35:B3:0F
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt
            X509v3 Extended Key Usage: 
                Time Stamping
            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        9c:0a:55:c8:cc:44:13:34:0c:d8:63:27:76:7d:3e:fa:38:32:
        83:53:9d:f2:08:f9:32:f5:c5:6e:70:a1:c9:b1:63:6b:19:9d:
        09:67:d9:9d:eb:8a:6a:db:60:66:e9:e9:52:26:f3:3b:c6:6a:
        d3:c2:52:be:a8:b9:eb:6a:aa:78:8c:c9:16:7d:90:95:a0:cc:
        21:b3:9e:81:bd:cd:c1:8b:29:bd:62:25:ef:09:57:e7:86:4e:
        2a:ec:80:ca:bb:fc:21:16:c4:3f:4e:52:19:e6:0e:b1:d8:c1:
        c2:79:90:64:b4:50:73:10:35:5e:5d:11:c1:b8:ba:aa:cf:52:
        f6:80:91:00:e6:ef:51:43:46:e9:d0:e8:94:f6:2c:24:0d:8a:
        c6:b2:31:8a:a3:7e:36:6c:a4:05:4c:67:07:2a:bb:bb:10:a5:
        a5:30:1a:72:d0:06:20:3b:24:93:5b:15:d9:39:93:d3:73:2d:
        1a:c4:d4:6c:1e:a1:08:ec:f6:31:b8:6b:4b:ec:ee:5c:33:02:
        14:32:8c:7c:11:20:2f:20:03:7f:f9:0c:9d:b8:d3:9e:5f:d6:
        08:fc:81:a0:99:b8:bb:55:6e:cd:42:4b:3a:4d:8c:14:2b:ca:
        c8:12:d3:62:6e:ea:0d:0a:9d:09:a3:66:d9:79:4f:8e:1a:a2:
        ff:cc:98:04

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:15:23:0f:00:00:00:00:00:0a
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Verification PCA
        Validity
            Not Before: Dec  7 21:57:40 2009 GMT
            Not After : Mar  7 21:57:40 2011 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=MOPR, CN=Microsoft Windows
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:c8:1b:d8:7a:64:c9:96:44:e3:78:d4:07:00:fb:
                    1c:ca:97:3d:cb:72:9a:81:02:a5:ae:5a:a0:a6:fe:
                    73:31:2c:43:47:63:4f:28:d7:9f:47:9b:33:d5:39:
                    35:a9:81:ad:cf:5d:ea:18:bd:bb:c9:28:af:32:10:
                    97:48:e4:dc:ef:1d:33:21:1b:48:57:3e:aa:f1:8a:
                    52:d4:5f:3a:30:20:b6:07:5d:6e:05:50:11:92:c2:
                    b6:ec:3c:b0:8a:ee:3c:95:06:45:8c:48:c5:8d:cc:
                    69:74:26:28:49:d7:d3:07:db:ab:da:46:5d:99:59:
                    60:bc:ac:3a:56:85:68:7a:a2:4a:4c:ea:96:b9:2a:
                    5c:f8:c0:2b:4e:52:f6:1a:40:ec:dd:f5:18:97:b9:
                    c0:41:6a:ba:d8:de:4d:f9:8f:cf:4a:81:53:23:ed:
                    ef:fb:53:b9:69:34:63:f5:ea:a0:80:06:bb:89:bf:
                    57:d4:b6:f6:a5:1c:22:97:96:8e:e7:22:ae:66:87:
                    5b:a6:83:fc:e5:b9:72:a0:de:98:38:ff:ff:67:6c:
                    d5:5c:4e:e6:ad:3f:04:d0:64:d0:aa:55:a9:76:ff:
                    a2:67:d2:20:5d:67:94:43:1b:fe:8a:96:94:0f:9d:
                    ee:ca:bd:6c:12:bb:a0:19:a2:77:ae:61:0d:c8:cd:
                    2e:09
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                Code Signing, 1.3.6.1.4.1.311.10.3.6
            X509v3 Subject Key Identifier: 
                0F:DA:55:93:00:34:F9:45:DC:6B:DF:A3:E6:DD:C0:E3:72:08:BC:FE
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Authority Key Identifier: 
                90:8B:11:A5:70:ED:E0:F9:A9:C0:AC:08:C7:B5:F4:82:B1:3C:C5:4A
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/WinPCA.crl
                  URI:http://www.microsoft.com/pki/crl/products/WinPCA.crl
            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicrosoftWinPCA.crt
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        31:35:c2:99:69:a6:97:b6:08:d0:5d:5e:7f:76:c2:dc:13:35:
        95:6f:26:1b:9f:dd:2d:61:00:37:6d:67:cb:01:a5:54:ec:2c:
        d4:b5:64:fc:d4:95:f5:be:0f:d4:a2:31:1e:7e:34:ca:2a:ed:
        01:30:dc:2f:00:f6:91:88:70:97:7e:d4:71:fb:62:6c:6c:46:
        ed:94:33:a8:99:d1:82:c1:41:d2:5c:ef:d4:6e:0d:6d:5b:b3:
        47:7f:80:7e:8c:82:73:b7:e9:5f:56:22:63:73:6f:5b:11:3c:
        ff:de:db:9a:ff:96:8c:74:17:f5:e0:84:54:d1:6d:64:64:2c:
        93:47:39:4b:9e:04:e1:7a:c3:fd:9f:07:7b:f8:fa:f7:6e:f1:
        d5:13:5a:95:fe:d5:b0:3d:7a:ce:87:66:49:69:15:2d:a5:c5:
        3c:3a:7b:08:62:45:2f:56:72:ed:00:6c:d4:50:75:c5:ec:5e:
        ca:cf:33:0a:36:c7:34:fb:e1:43:49:3a:e9:13:b0:c3:35:ff:
        57:f5:73:4e:77:40:b9:95:d0:48:90:88:8b:3c:c1:c8:10:fd:
        0f:f7:87:77:01:cc:89:30:e9:34:c5:35:e8:3f:78:15:6a:45:
        90:d0:e8:d7:e3:03:2b:5a:ac:89:b2:fa:52:8a:30:48:6d:06:
        6d:2c:12:1c

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:16:68:34:00:00:00:00:00:1c
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
        Validity
            Not Before: Apr  3 12:53:09 2007 GMT
            Not After : Apr  3 13:03:09 2021 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Time-Stamp PCA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:9f:a1:6c:b1:df:db:48:92:2a:7c:6b:2e:19:e1:
                    bd:e2:e3:c5:99:51:23:50:ad:ce:dd:18:4e:24:0f:
                    ee:d1:a7:d1:4c:ad:74:30:20:11:eb:07:d5:54:95:
                    15:49:94:1b:42:92:ae:98:5c:30:26:da:00:6b:e8:
                    7b:bd:ec:89:07:0f:f7:0e:04:98:f0:89:cc:1f:cb:
                    33:24:87:9d:f2:f4:67:1c:2c:fc:7b:e7:88:1d:ea:
                    e7:4e:a3:a1:c1:23:53:ca:8d:fa:45:cf:09:d0:5e:
                    af:d0:b0:42:04:a2:f9:a6:6c:93:67:d7:28:dc:46:
                    53:b0:86:d0:e5:28:46:2e:27:ac:86:4f:55:52:0c:
                    e4:03:2c:fb:6a:90:90:30:6e:87:f3:59:30:9d:fa:
                    7e:d6:97:b3:e8:21:97:7e:f8:d2:13:f3:08:b7:53:
                    6d:52:b4:45:90:9f:48:00:4a:47:66:11:27:29:66:
                    a8:97:e4:d3:06:81:4a:a2:f9:84:a7:11:47:14:09:
                    82:9f:84:ed:55:78:fe:01:9a:1d:50:08:85:00:10:
                    30:46:ed:b7:de:23:46:bb:c4:2d:54:9f:af:1e:78:
                    41:31:77:cc:9b:df:3b:83:93:a1:61:02:b5:1d:0d:
                    b1:fc:f7:9b:b2:01:ce:22:4b:54:ff:f9:05:c3:c2:
                    20:0b
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier: 
                23:34:F8:D9:52:46:70:0A:ED:40:FB:76:FB:B3:2B:B0:C3:35:B3:0F
            X509v3 Key Usage: 
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1: 
                ...
            X509v3 Authority Key Identifier: 
                keyid:0E:AC:82:60:40:56:27:97:E5:25:13:FC:2A:E1:0A:53:95:59:E4:A4
                DirName:/DC=com/DC=microsoft/CN=Microsoft Root Certificate Authority
                serial:79:AD:16:A1:4A:A0:A5:AD:4C:73:58:F4:07:13:2E:65
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt
            X509v3 Extended Key Usage: 
                Time Stamping
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        10:97:8a:c3:5c:03:44:36:dd:e9:b4:ad:77:db:ce:79:51:4d:
        01:b1:2e:74:71:5b:6d:0c:13:ab:ce:be:7b:8f:b8:2e:d4:12:
        a2:8c:6d:62:b8:57:02:cb:4e:20:13:50:99:dd:7a:40:e2:57:
        bb:af:58:9a:1c:e1:1d:01:86:ac:bb:78:f2:8b:d0:ec:3b:01:
        ee:e2:be:8f:0a:05:c8:8d:48:e2:f0:53:15:dd:4f:ab:92:e4:
        e7:8d:6a:d5:80:c1:e6:94:f2:06:2f:85:03:e9:91:2a:24:22:
        70:fb:f6:fc:e4:78:99:2e:0d:f7:07:e2:70:bc:18:4e:9d:8e:
        6b:0a:72:95:b8:a1:39:9c:67:2d:c5:51:0e:ea:62:5c:3f:16:
        98:8b:20:3f:e2:07:1a:32:f9:cc:31:4a:76:31:3d:2b:72:0b:
        c8:ea:70:3d:ff:85:0a:13:df:c2:0a:61:8e:f0:d7:b8:17:eb:
        4e:8b:7f:c5:35:2b:5e:a3:bf:eb:bc:7d:0b:42:7b:d4:53:72:
        21:ee:30:ca:bb:78:65:5c:5b:01:17:0a:14:0e:d2:da:14:98:
        f5:3c:b9:66:58:b3:2d:2f:e7:f9:85:86:cc:51:56:e8:9d:70:
        94:6c:ac:39:4c:d4:f6:79:bf:aa:18:7a:62:29:ef:a2:9b:29:
        34:06:77:1a:62:c9:3d:1e:6d:1f:82:f0:0b:c7:2c:bb:cf:43:
        b3:e5:f9:ec:7d:b5:e3:a4:a8:74:35:b8:4e:c5:71:23:12:26:
        76:0b:3c:52:8c:71:5a:46:43:14:bc:b3:b3:b0:4d:67:c8:9f:
        42:ff:80:79:21:80:9e:15:30:66:e8:42:12:5e:1a:c8:9e:22:
        21:d0:43:e9:2b:e9:bb:f4:48:cc:2c:d4:d8:32:80:4c:26:2a:
        48:24:5f:5a:ea:56:ef:a6:de:99:9d:ca:3a:6f:bd:81:27:74:
        06:11:ee:76:21:bf:9b:82:c1:27:54:b6:b1:6a:3d:89:a1:76:
        61:b4:6e:a1:13:a6:bf:aa:47:f0:12:6f:fd:8a:32:6c:b2:fe:
        df:51:c8:8c:23:c9:66:bd:9d:1d:87:12:64:02:3d:2d:af:59:
        8f:b8:e4:21:e5:b5:b0:ca:63:b4:78:54:05:d4:41:2e:50:ac:
        94:b0:a5:78:ab:b3:a0:96:75:1a:d9:92:87:13:75:22:2f:32:
        a8:08:6e:a0:5b:8c:25:bf:a0:ef:84:ca:21:d6:eb:1e:4f:c9:
        9a:ee:49:e0:f7:01:65:6f:89:0b:7d:c8:69:c8:e6:6e:ea:a7:
        97:ce:31:29:ff:0e:c5:5b:5c:d8:4d:1b:a1:d8:fa:2f:9e:3f:
        2e:55:16:6b:c9:13:a3:fd

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:07:02:dc:00:00:00:00:00:0b
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
        Validity
            Not Before: Sep 15 21:55:41 2005 GMT
            Not After : Mar 15 22:05:41 2016 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Verification PCA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:c5:ac:93:4e:e6:4a:11:9e:37:d0:35:d2:b0:06:
                    5c:83:14:a5:61:92:fc:fe:b3:89:c1:e6:cd:c8:1f:
                    31:84:09:91:34:46:92:2c:b8:ee:2c:c5:20:73:c4:
                    e8:1a:d8:8d:ce:7a:68:b5:66:78:8b:e5:60:15:a2:
                    f6:29:5a:1d:5e:5d:fc:62:d3:c1:5c:29:89:fb:33:
                    f8:16:95:36:dd:b1:46:74:69:72:53:d5:aa:e8:8a:
                    99:1a:d8:f7:67:09:d9:09:20:22:38:7a:d6:03:23:
                    d7:89:9f:1c:01:b7:51:df:98:66:2a:02:8b:06:ec:
                    e4:29:ef:5b:42:17:15:97:51:8d:7d:25:0a:af:25:
                    e8:de:dc:9b:67:16:0a:56:73:9d:b3:1d:85:83:0b:
                    7e:33:2b:62:33:ce:1c:20:81:4b:5e:d3:c6:49:b8:
                    f6:2e:d3:4e:b0:71:44:46:64:3e:de:43:66:04:b9:
                    cc:83:48:3a:c5:36:7a:04:48:0b:89:02:3d:63:a2:
                    01:76:29:97:75:e9:01:e6:00:97:09:92:f8:e2:27:
                    f0:29:67:43:77:c3:50:96:53:31:e1:b6:71:8b:ec:
                    77:c7:7c:31:48:d5:b8:25:22:8c:00:f7:28:38:7a:
                    bd:7c:c7:3f:cd:40:26:77:dd:00:00:11:9a:95:be:
                    1f:db
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            1.3.6.1.4.1.311.21.1: 
                ...
            X509v3 Subject Key Identifier: 
                90:8B:11:A5:70:ED:E0:F9:A9:C0:AC:08:C7:B5:F4:82:B1:3C:C5:4A
            X509v3 Key Usage: 
                Digital Signature, Non Repudiation, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier: 
                keyid:0E:AC:82:60:40:56:27:97:E5:25:13:FC:2A:E1:0A:53:95:59:E4:A4
                DirName:/DC=com/DC=microsoft/CN=Microsoft Root Certificate Authority
                serial:79:AD:16:A1:4A:A0:A5:AD:4C:73:58:F4:07:13:2E:65
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt
            X509v3 Certificate Policies: 
                Policy: 1.3.6.1.4.1.311.21.47
                  User Notice:
                    Explicit Text: 
            X509v3 Extended Key Usage: 
                Code Signing, 1.3.6.1.4.1.311.10.3.6
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        25:31:a1:58:ea:52:e5:e1:17:0c:e6:f1:3f:78:a3:3f:72:af:
        a7:57:10:53:89:10:5e:32:9c:b6:70:c3:15:2b:4d:15:30:34:
        e8:c0:6a:e4:1c:d3:2e:20:65:48:d7:1b:98:62:21:ba:45:9f:
        4a:ec:db:2f:09:19:51:e5:ed:32:19:51:2f:e1:dd:fb:c6:52:
        fd:eb:c6:82:25:42:03:09:a6:38:b6:36:1f:cc:c9:80:bb:5a:
        69:18:31:c3:b3:a0:b3:67:47:be:9d:c7:e2:3f:96:b3:88:f8:
        19:be:39:b9:e9:95:ce:fc:7c:af:a8:cd:d0:41:90:e0:d5:b3:
        1c:2f:68:bb:db:0f:6c:6a:dd:f2:af:de:f2:b5:de:0d:b6:a6:
        5a:f0:86:0a:b9:6d:99:4b:3f:7b:2d:01:84:6c:8f:87:dc:7f:
        8f:ab:14:88:d0:06:91:34:be:1b:82:22:a4:bc:55:8a:ad:9b:
        fc:73:14:10:c4:c9:19:1e:07:7d:9b:0e:c0:95:26:5d:c6:1f:
        ac:b4:f2:7e:ba:25:70:4a:7b:d7:8e:d1:9d:a0:13:49:7a:b0:
        02:52:52:24:f4:af:dd:40:2d:e5:3e:32:58:b3:4a:6a:dd:11:
        59:aa:2d:bc:a4:a0:73:38:f9:40:77:6b:34:19:57:cd:38:68:
        27:82:f8:d1:6f:eb:23:c0:3f:52:f3:4e:d5:02:3e:6a:9a:2b:
        c1:f5:31:71:db:41:4d:3b:de:ef:ad:af:1f:88:65:43:1b:51:
        b7:9a:75:ca:8e:69:49:10:8f:78:8a:74:45:b9:09:8e:73:77:
        07:32:4a:4b:d7:68:2b:98:c5:ba:54:ea:3f:cb:a2:00:8c:bb:
        d8:10:58:f2:db:dc:9b:cd:d8:ea:48:43:e2:4a:7e:65:b2:dc:
        f5:2d:4e:25:67:a8:e0:b5:ba:a7:dd:7e:5e:c1:4c:02:74:c9:
        b3:6e:e3:f8:f0:0b:ed:fc:b9:29:c5:5b:c9:36:51:90:db:78:
        7d:b9:32:0f:5e:76:d2:15:5c:3b:37:21:c6:db:c9:19:6e:ed:
        74:2a:5c:2c:0b:51:49:45:53:b0:b2:b3:23:d4:a1:b0:5f:0d:
        19:cd:14:a7:e3:3c:9b:97:72:94:14:df:ff:c1:90:1b:a5:df:
        f5:a9:f3:1b:17:da:b5:fc:44:e0:e8:e2:3c:a2:7a:bb:bb:65:
        e6:4d:b1:b5:15:a1:d9:67:3b:b0:0c:7d:3b:e9:ee:51:2a:47:
        f5:15:0f:8c:ad:5d:2e:35:df:f4:a4:2e:f6:13:37:5a:2b:e8:
        55:9a:49:2c:97:ce:9d:01:9e:97:46:5c:d9:2d:bc:24:5a:95:
        59:6f:4d:ca:9d:d6:57:26

pkcs7-signedData

SHA1: nil

1.3.6.1.4.1.311.2.1.4

1.3.6.1.4.1.311.2.1.15

00 3c 00 3c 00 3c 00 4f  00 62 00 73 00 6f 00 6c  |.<.<.<.O.b.s.o.l|
00 65 00 74 00 65 00 3e  00 3e 00 3e              |.e.t.e.>.>.>    |

SHA1

75 2f 90 52 ba 55 7b 7a 4a 37 56 26 3f 59 4f 86 |u/.R.U{zJ7V&?YO.| a3 44 6c b5 |.Dl. |

unnamed

Certificate #0
- 2
  - 61:03:DC:F6:00:00:00:00:00:0C
  - RSA-SHA1: nil
  - Issuer
    - C: US
    - ST: Washington
    - L: Redmond
    - O: Microsoft Corporation
    - CN: Microsoft Time-Stamp PCA
  - 2008-07-25 19:12:50 UTC: 2011-07-25 19:22:50 UTC
  - Subject
    - C: US
    - ST: Washington
    - L: Redmond
    - O: Microsoft Corporation
    - OU: MOPR
    - OU: nCipher DSE ESN:159C-A3F7-2570
    - CN: Microsoft Time-Stamp Service
  - #5
    - rsaEncryption: nil
    - C0:ED:81:14:A1:5E:77:C0:5B:F4:76:89:62:FA:AD:7C:
      68:14:B4:F7:BD:35:D8:13:79:5A:17:CA:D9:6C:51:45:
      62:26:7A:2F:1F:D8:EA:C1:6E:01:17:F9:C3:A6:1F:67:
      DB:51:B0:2C:DE:8A:17:ED:FF:20:AD:34:EA:98:FB:A5:
      D6:2A:D2:F1:44:27:07:5A:2D:3A:93:FF:56:53:B0:C8:
      F5:F3:03:F2:49:CC:16:D0:F5:00:4C:58:F8:9B:F5:07:
      25:B1:66:17:C0:BD:C8:D2:52:85:8D:C2:2B:38:B2:C3:
      36:BE:F9:87:DA:F4:8E:5D:43:D7:06:BF:99:05:9F:A4:
      CE:FE:AB:8D:61:63:E7:39:C5:F3:18:F6:D8:FC:31:36:
      69:72:5A:A2:1A:4C:3E:EA:87:25:42:9D:D1:3E:F1:97:
      D2:18:32:93:70:55:53:81:1E:E3:3B:0D:E8:BE:82:78:
      6D:E6:FA:CD:98:A4:6F:DB:EE:66:F4:95:C8:CD:35:C9:
      9E:BB:36:0D:83:96:94:26:A7:90:E0:A9:34:3B:D5:C0:
      9E:3E:F0:D4:47:8D:86:0C:82:A4:58:30:3A:1C:76:E3:
      AD:95:66:B4:B7:FD:09:8A:05:60:0F:A3:0F:E2:93:96:
      58:22:9C:9D:2B:DB:A2:94:18:90:95:02:BD:06:40:95: 0x010001
  - #6
    - subjectKeyIdentifier:
```
d2 ed 0d 1e 24 bb 37 a9  d8 20 6a 4d 1d d2 16 d5  |....$.7.. jM....|
2e be 9e eb                                       |....            |
```
    - authorityKeyIdentifier:
```
23 34 f8 d9 52 46 70 0a  ed 40 fb 76 fb b3 2b b0  |#4..RFp..@.v..+.|
c3 35 b3 0f                                       |.5..            |
```
    - crlDistributionPoints: http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
    - authorityInfoAccess
      - caIssuers: http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt
    - extendedKeyUsage: timeStamping
    - keyUsage: true, 0xc0
- RSA-SHA1:
```
9c 0a 55 c8 cc 44 13 34  0c d8 63 27 76 7d 3e fa  |..U..D.4..c'v}>.|
38 32 83 53 9d f2 08 f9  32 f5 c5 6e 70 a1 c9 b1  |82.S....2..np...|
63 6b 19 9d 09 67 d9 9d  eb 8a 6a db 60 66 e9 e9  |ck...g....j.`f..|
52 26 f3 3b c6 6a d3 c2  52 be a8 b9 eb 6a aa 78  |R&.;.j..R....j.x|
8c c9 16 7d 90 95 a0 cc  21 b3 9e 81 bd cd c1 8b  |...}....!.......|
29 bd 62 25 ef 09 57 e7  86 4e 2a ec 80 ca bb fc  |).b%..W..N*.....|
21 16 c4 3f 4e 52 19 e6  0e b1 d8 c1 c2 79 90 64  |!..?NR.......y.d|
b4 50 73 10 35 5e 5d 11  c1 b8 ba aa cf 52 f6 80  |.Ps.5^]......R..|
91 00 e6 ef 51 43 46 e9  d0 e8 94 f6 2c 24 0d 8a  |....QCF.....,$..|
c6 b2 31 8a a3 7e 36 6c  a4 05 4c 67 07 2a bb bb  |..1..~6l..Lg.*..|
10 a5 a5 30 1a 72 d0 06  20 3b 24 93 5b 15 d9 39  |...0.r.. ;$.[..9|
93 d3 73 2d 1a c4 d4 6c  1e a1 08 ec f6 31 b8 6b  |..s-...l.....1.k|
4b ec ee 5c 33 02 14 32  8c 7c 11 20 2f 20 03 7f  |K..\3..2.|. / ..|
f9 0c 9d b8 d3 9e 5f d6  08 fc 81 a0 99 b8 bb 55  |......_........U|
6e cd 42 4b 3a 4d 8c 14  2b ca c8 12 d3 62 6e ea  |n.BK:M..+....bn.|
0d 0a 9d 09 a3 66 d9 79  4f 8e 1a a2 ff cc 98 04  |.....f.yO.......|
```
Certificate #1
- 2
  - 61:15:23:0F:00:00:00:00:00:0A
  - RSA-SHA1: nil
  - Issuer
    - C: US
    - ST: Washington
    - L: Redmond
    - O: Microsoft Corporation
    - CN: Microsoft Windows Verification PCA
  - 2009-12-07 21:57:40 UTC: 2011-03-07 21:57:40 UTC
  - Subject
    - C: US
    - ST: Washington
    - L: Redmond
    - O: Microsoft Corporation
    - OU: MOPR
    - CN: Microsoft Windows
  - #5
    - rsaEncryption: nil
    - C8:1B:D8:7A:64:C9:96:44:E3:78:D4:07:00:FB:1C:CA:
      97:3D:CB:72:9A:81:02:A5:AE:5A:A0:A6:FE:73:31:2C:
      43:47:63:4F:28:D7:9F:47:9B:33:D5:39:35:A9:81:AD:
      CF:5D:EA:18:BD:BB:C9:28:AF:32:10:97:48:E4:DC:EF:
      1D:33:21:1B:48:57:3E:AA:F1:8A:52:D4:5F:3A:30:20:
      B6:07:5D:6E:05:50:11:92:C2:B6:EC:3C:B0:8A:EE:3C:
      95:06:45:8C:48:C5:8D:CC:69:74:26:28:49:D7:D3:07:
      DB:AB:DA:46:5D:99:59:60:BC:AC:3A:56:85:68:7A:A2:
      4A:4C:EA:96:B9:2A:5C:F8:C0:2B:4E:52:F6:1A:40:EC:
      DD:F5:18:97:B9:C0:41:6A:BA:D8:DE:4D:F9:8F:CF:4A:
      81:53:23:ED:EF:FB:53:B9:69:34:63:F5:EA:A0:80:06:
      BB:89:BF:57:D4:B6:F6:A5:1C:22:97:96:8E:E7:22:AE:
      66:87:5B:A6:83:FC:E5:B9:72:A0:DE:98:38:FF:FF:67:
      6C:D5:5C:4E:E6:AD:3F:04:D0:64:D0:AA:55:A9:76:FF:
      A2:67:D2:20:5D:67:94:43:1B:FE:8A:96:94:0F:9D:EE:
      CA:BD:6C:12:BB:A0:19:A2:77:AE:61:0D:C8:CD:2E:09: 0x010001
  - #6
    - extendedKeyUsage
      - codeSigning: 1.3.6.1.4.1.311.10.3.6
    - subjectKeyIdentifier:
```
0f da 55 93 00 34 f9 45  dc 6b df a3 e6 dd c0 e3  |..U..4.E.k......|
72 08 bc fe                                       |r...            |
```
    - keyUsage: true, 0x80
    - authorityKeyIdentifier:
```
90 8b 11 a5 70 ed e0 f9  a9 c0 ac 08 c7 b5 f4 82  |....p...........|
b1 3c c5 4a                                       |.<.J            |
```
    - crlDistributionPoints
      - http://crl.microsoft.com/pki/crl/products/WinPCA.crl: http://www.microsoft.com/pki/crl/products/WinPCA.crl
    - authorityInfoAccess
      - caIssuers: http://www.microsoft.com/pki/certs/MicrosoftWinPCA.crt
- RSA-SHA1:
```
31 35 c2 99 69 a6 97 b6  08 d0 5d 5e 7f 76 c2 dc  |15..i.....]^.v..|
13 35 95 6f 26 1b 9f dd  2d 61 00 37 6d 67 cb 01  |.5.o&...-a.7mg..|
a5 54 ec 2c d4 b5 64 fc  d4 95 f5 be 0f d4 a2 31  |.T.,..d........1|
1e 7e 34 ca 2a ed 01 30  dc 2f 00 f6 91 88 70 97  |.~4.*..0./....p.|
7e d4 71 fb 62 6c 6c 46  ed 94 33 a8 99 d1 82 c1  |~.q.bllF..3.....|
41 d2 5c ef d4 6e 0d 6d  5b b3 47 7f 80 7e 8c 82  |A.\..n.m[.G..~..|
73 b7 e9 5f 56 22 63 73  6f 5b 11 3c ff de db 9a  |s.._V"cso[.<....|
ff 96 8c 74 17 f5 e0 84  54 d1 6d 64 64 2c 93 47  |...t....T.mdd,.G|
39 4b 9e 04 e1 7a c3 fd  9f 07 7b f8 fa f7 6e f1  |9K...z....{...n.|
d5 13 5a 95 fe d5 b0 3d  7a ce 87 66 49 69 15 2d  |..Z....=z..fIi.-|
a5 c5 3c 3a 7b 08 62 45  2f 56 72 ed 00 6c d4 50  |..<:{.bE/Vr..l.P|
75 c5 ec 5e ca cf 33 0a  36 c7 34 fb e1 43 49 3a  |u..^..3.6.4..CI:|
e9 13 b0 c3 35 ff 57 f5  73 4e 77 40 b9 95 d0 48  |....5.W.sNw@...H|
90 88 8b 3c c1 c8 10 fd  0f f7 87 77 01 cc 89 30  |...<.......w...0|
e9 34 c5 35 e8 3f 78 15  6a 45 90 d0 e8 d7 e3 03  |.4.5.?x.jE......|
2b 5a ac 89 b2 fa 52 8a  30 48 6d 06 6d 2c 12 1c  |+Z....R.0Hm.m,..|
```

2
- 61:16:68:34:00:00:00:00:00:1C
- RSA-SHA1: nil
- #2
  - DC: com
  - DC: microsoft
  - CN: Microsoft Root Certificate Authority
- 2007-04-03 12:53:09 UTC: 2021-04-03 13:03:09 UTC
- Subject
  - C: US
  - ST: Washington
  - L: Redmond
  - O: Microsoft Corporation
  - CN: Microsoft Time-Stamp PCA
- #5
  - rsaEncryption: nil
  - 9F:A1:6C:B1:DF:DB:48:92:2A:7C:6B:2E:19:E1:BD:E2:
    E3:C5:99:51:23:50:AD:CE:DD:18:4E:24:0F:EE:D1:A7:
    D1:4C:AD:74:30:20:11:EB:07:D5:54:95:15:49:94:1B:
    42:92:AE:98:5C:30:26:DA:00:6B:E8:7B:BD:EC:89:07:
    0F:F7:0E:04:98:F0:89:CC:1F:CB:33:24:87:9D:F2:F4:
    67:1C:2C:FC:7B:E7:88:1D:EA:E7:4E:A3:A1:C1:23:53:
    CA:8D:FA:45:CF:09:D0:5E:AF:D0:B0:42:04:A2:F9:A6:
    6C:93:67:D7:28:DC:46:53:B0:86:D0:E5:28:46:2E:27:
    AC:86:4F:55:52:0C:E4:03:2C:FB:6A:90:90:30:6E:87:
    F3:59:30:9D:FA:7E:D6:97:B3:E8:21:97:7E:F8:D2:13:
    F3:08:B7:53:6D:52:B4:45:90:9F:48:00:4A:47:66:11:
    27:29:66:A8:97:E4:D3:06:81:4A:A2:F9:84:A7:11:47:
    14:09:82:9F:84:ED:55:78:FE:01:9A:1D:50:08:85:00:
    10:30:46:ED:B7:DE:23:46:BB:C4:2D:54:9F:AF:1E:78:
    41:31:77:CC:9B:DF:3B:83:93:A1:61:02:B5:1D:0D:B1:
    FC:F7:9B:B2:01:CE:22:4B:54:FF:F9:05:C3:C2:20:0B: 0x010001
- X509v3 extensions
  - basicConstraints: true, true
  - subjectKeyIdentifier:
```
23 34 f8 d9 52 46 70 0a  ed 40 fb 76 fb b3 2b b0  |#4..RFp..@.v..+.|
c3 35 b3 0f                                       |.5..            |
```
  - keyUsage: 0x86
  - 1.3.6.1.4.1.311.21.1: 0
  - authorityKeyIdentifier
    - 0e ac 82 60 40 56 27 97 e5 25 13 fc 2a e1 0a 53 |...`@V'..%..*..S| 95 59 e4 a4 |.Y.. |
      - #0
        DC: com
        DC: microsoft
        CN: Microsoft Root Certificate Authority
      - 79 ad 16 a1 4a a0 a5 ad 4c 73 58 f4 07 13 2e 65 |y...J...LsX....e|
  - crlDistributionPoints: http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
  - authorityInfoAccess
    - caIssuers: http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt
  - extendedKeyUsage: timeStamping

RSA-SHA1:

10 97 8a c3 5c 03 44 36  dd e9 b4 ad 77 db ce 79  |....\.D6....w..y|
51 4d 01 b1 2e 74 71 5b  6d 0c 13 ab ce be 7b 8f  |QM...tq[m.....{.|
b8 2e d4 12 a2 8c 6d 62  b8 57 02 cb 4e 20 13 50  |......mb.W..N .P|
99 dd 7a 40 e2 57 bb af  58 9a 1c e1 1d 01 86 ac  |..z@.W..X.......|
bb 78 f2 8b d0 ec 3b 01  ee e2 be 8f 0a 05 c8 8d  |.x....;.........|
48 e2 f0 53 15 dd 4f ab  92 e4 e7 8d 6a d5 80 c1  |H..S..O.....j...|
e6 94 f2 06 2f 85 03 e9  91 2a 24 22 70 fb f6 fc  |..../....*$"p...|
e4 78 99 2e 0d f7 07 e2  70 bc 18 4e 9d 8e 6b 0a  |.x......p..N..k.|
72 95 b8 a1 39 9c 67 2d  c5 51 0e ea 62 5c 3f 16  |r...9.g-.Q..b\?.|
98 8b 20 3f e2 07 1a 32  f9 cc 31 4a 76 31 3d 2b  |.. ?...2..1Jv1=+|
72 0b c8 ea 70 3d ff 85  0a 13 df c2 0a 61 8e f0  |r...p=.......a..|
d7 b8 17 eb 4e 8b 7f c5  35 2b 5e a3 bf eb bc 7d  |....N...5+^....}|
0b 42 7b d4 53 72 21 ee  30 ca bb 78 65 5c 5b 01  |.B{.Sr!.0..xe\[.|
17 0a 14 0e d2 da 14 98  f5 3c b9 66 58 b3 2d 2f  |.........<.fX.-/|
e7 f9 85 86 cc 51 56 e8  9d 70 94 6c ac 39 4c d4  |.....QV..p.l.9L.|
f6 79 bf aa 18 7a 62 29  ef a2 9b 29 34 06 77 1a  |.y...zb)...)4.w.|
62 c9 3d 1e 6d 1f 82 f0  0b c7 2c bb cf 43 b3 e5  |b.=.m.....,..C..|
f9 ec 7d b5 e3 a4 a8 74  35 b8 4e c5 71 23 12 26  |..}....t5.N.q#.&|
76 0b 3c 52 8c 71 5a 46  43 14 bc b3 b3 b0 4d 67  |v.

2
- 61:07:02:DC:00:00:00:00:00:0B
- RSA-SHA1: nil
- #2
  - DC: com
  - DC: microsoft
  - CN: Microsoft Root Certificate Authority
- 2005-09-15 21:55:41 UTC: 2016-03-15 22:05:41 UTC
- Subject
  - C: US
  - ST: Washington
  - L: Redmond
  - O: Microsoft Corporation
  - CN: Microsoft Windows Verification PCA
- #5
  - rsaEncryption: nil
  - C5:AC:93:4E:E6:4A:11:9E:37:D0:35:D2:B0:06:5C:83:
    14:A5:61:92:FC:FE:B3:89:C1:E6:CD:C8:1F:31:84:09:
    91:34:46:92:2C:B8:EE:2C:C5:20:73:C4:E8:1A:D8:8D:
    CE:7A:68:B5:66:78:8B:E5:60:15:A2:F6:29:5A:1D:5E:
    5D:FC:62:D3:C1:5C:29:89:FB:33:F8:16:95:36:DD:B1:
    46:74:69:72:53:D5:AA:E8:8A:99:1A:D8:F7:67:09:D9:
    09:20:22:38:7A:D6:03:23:D7:89:9F:1C:01:B7:51:DF:
    98:66:2A:02:8B:06:EC:E4:29:EF:5B:42:17:15:97:51:
    8D:7D:25:0A:AF:25:E8:DE:DC:9B:67:16:0A:56:73:9D:
    B3:1D:85:83:0B:7E:33:2B:62:33:CE:1C:20:81:4B:5E:
    D3:C6:49:B8:F6:2E:D3:4E:B0:71:44:46:64:3E:DE:43:
    66:04:B9:CC:83:48:3A:C5:36:7A:04:48:0B:89:02:3D:
    63:A2:01:76:29:97:75:E9:01:E6:00:97:09:92:F8:E2:
    27:F0:29:67:43:77:C3:50:96:53:31:E1:B6:71:8B:EC:
    77:C7:7C:31:48:D5:B8:25:22:8C:00:F7:28:38:7A:BD:
    7C:C7:3F:CD:40:26:77:DD:00:00:11:9A:95:BE:1F:DB: 0x010001
- #6
  - 1.3.6.1.4.1.311.21.1: 0
  - subjectKeyIdentifier:
```
90 8b 11 a5 70 ed e0 f9  a9 c0 ac 08 c7 b5 f4 82  |....p...........|
b1 3c c5 4a                                       |.<.J            |
```
  - keyUsage: 0xc6
  - basicConstraints: true, true
  - authorityKeyIdentifier
    - 0e ac 82 60 40 56 27 97 e5 25 13 fc 2a e1 0a 53 |...`@V'..%..*..S| 95 59 e4 a4 |.Y.. |
      - #0
        DC: com
        DC: microsoft
        CN: Microsoft Root Certificate Authority
      - 79 ad 16 a1 4a a0 a5 ad 4c 73 58 f4 07 13 2e 65 |y...J...LsX....e|
  - crlDistributionPoints: http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
  - authorityInfoAccess
    - caIssuers: http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt
  - certificatePolicies
    - 1.3.6.1.4.1.311.21.47
      - id-qt-unotice:
        00 43 00 6f 00 70 00 79 00 72 00 69 00 67 00 68 |.C.o.p.y.r.i.g.h| 00 74 00 20 00 a9 00 20 00 31 00 39 00 39 00 39 |.t. ... .1.9.9.9| 00 2d 00 32 00 30 00 30 00 35 00 20 00 4d 00 69 |.-.2.0.0.5. .M.i| 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 |.c.r.o.s.o.f.t. | 00 43 00 6f 00 72 00 70 00 6f 00 72 00 61 00 74 |.C.o.r.p.o.r.a.t| 00 69 00 6f 00 6e 00 2e |.i.o.n.. |
  - extendedKeyUsage
    - codeSigning: 1.3.6.1.4.1.311.10.3.6

RSA-SHA1:

25 31 a1 58 ea 52 e5 e1  17 0c e6 f1 3f 78 a3 3f  |%1.X.R......?x.?|
72 af a7 57 10 53 89 10  5e 32 9c b6 70 c3 15 2b  |r..W.S..^2..p..+|
4d 15 30 34 e8 c0 6a e4  1c d3 2e 20 65 48 d7 1b  |M.04..j.... eH..|
98 62 21 ba 45 9f 4a ec  db 2f 09 19 51 e5 ed 32  |.b!.E.J../..Q..2|
19 51 2f e1 dd fb c6 52  fd eb c6 82 25 42 03 09  |.Q/....R....%B..|
a6 38 b6 36 1f cc c9 80  bb 5a 69 18 31 c3 b3 a0  |.8.6.....Zi.1...|
b3 67 47 be 9d c7 e2 3f  96 b3 88 f8 19 be 39 b9  |.gG....?......9.|
e9 95 ce fc 7c af a8 cd  d0 41 90 e0 d5 b3 1c 2f  |....|....A...../|
68 bb db 0f 6c 6a dd f2  af de f2 b5 de 0d b6 a6  |h...lj..........|
5a f0 86 0a b9 6d 99 4b  3f 7b 2d 01 84 6c 8f 87  |Z....m.K?{-..l..|
dc 7f 8f ab 14 88 d0 06  91 34 be 1b 82 22 a4 bc  |.........4..."..|
55 8a ad 9b fc 73 14 10  c4 c9 19 1e 07 7d 9b 0e  |U....s.......}..|
c0 95 26 5d c6 1f ac b4  f2 7e ba 25 70 4a 7b d7  |..&].....~.%pJ{.|
8e d1 9d a0 13 49 7a b0  02 52 52 24 f4 af dd 40  |.....Iz..RR$...@|
2d e5 3e 32 58 b3 4a 6a  dd 11 59 aa 2d bc a4 a0  |-.>2X.Jj..Y.-...|
73 38 f9 40 77 6b 34 19  57 cd 38 68 27 82 f8 d1  |s8.@wk4.W.8h'...|
6f eb 23 c0 3f 52 f3 4e  d5 02 3e 6a 9a 2b c1 f5  |o.#.?R.N..>j.+..|
31 71 db 41 4d 3b de ef  ad af 1f 88 65 43 1b 51  |1q.AM;......eC.Q|
b7 9a 75 ca 8e 69 49 10  8f 78 8a 74 45 b9 09 8e  |..u..iI..x.tE...|
73 77 07 32 4a 4b d7 68  2b 98 c5 ba 54 ea 3f cb  |sw.2JK.h+...T.?.|
a2 00 8c bb d8 10 58 f2  db dc 9b cd d8 ea 48 43  |......X.......HC|
e2 4a 7e 65 b2 dc f5 2d  4e 25 67 a8 e0 b5 ba a7  |.J~e...-N%g.....|
dd 7e 5e c1 4c 02 74 c9  b3 6e e3 f8 f0 0b ed fc  |.~^.L.t..n......|
b9 29 c5 5b c9 36 51 90  db 78 7d b9 32 0f 5e 76  |.).[.6Q..x}.2.^v|
d2 15 5c 3b 37 21 c6 db  c9 19 6e ed 74 2a 5c 2c  |..\;7!....n.t*\,|
0b 51 49 45 53 b0 b2 b3  23 d4 a1 b0 5f 0d 19 cd  |.QIES...#..._...|
14 a7 e3 3c 9b 97 72 94  14 df ff c1 90 1b a5 df  |...<..r.........|
f5 a9 f3 1b 17 da b5 fc  44 e0 e8 e2 3c a2 7a bb  |........D...<.z.|
bb 65 e6 4d b1 b5 15 a1  d9 67 3b b0 0c 7d 3b e9  |.e.M.....g;..};.|
ee 51 2a 47 f5 15 0f 8c  ad 5d 2e 35 df f4 a4 2e  |.Q*G.....].5....|
f6 13 37 5a 2b e8 55 9a  49 2c 97 ce 9d 01 9e 97  |..7Z+.U.I,......|
46 5c d9 2d bc 24 5a 95  59 6f 4d ca 9d d6 57 26  |F\.-.$Z.YoM...W&|

Signer

1
unnamed
- #0
  - C: US
  - ST: Washington
  - L: Redmond
  - O: Microsoft Corporation
  - CN: Microsoft Windows Verification PCA
- 61:15:23:0F:00:00:00:00:00:0A
SHA1: nil

contentType: 1.3.6.1.4.1.311.2.1.4
1.3.6.1.4.1.311.2.1.11: msCodeInd

messageDigest:

f4 a7 d4 c0 9f 39 29 72  bb 4e 54 fd f0 6d f1 4f  |.....9)r.NT..m.O|
c8 8c 37 c7                                       |..7.            |

1.3.6.1.4.1.311.2.1.12

00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 |.M.i.c.r.o.s.o.f| 00 74 00 20 00 57 00 69 00 6e 00 64 00 6f 00 77 |.t. .W.i.n.d.o.w| 00 73 |.s |
: http://www.microsoft.com

rsaEncryption:

12 77 4b 75 35 76 29 86  b9 74 f1 fd 31 08 ac 30  |.wKu5v)..t..1..0|
63 e4 7d 1c 47 38 df 08  dd 0d 25 32 f0 bd 93 71  |c.}.G8....%2...q|
20 1e a2 fd 3a cc 58 f6  60 f8 79 02 ff 23 3d 4f  | ...:.X.`.y..#=O|
eb 55 74 76 18 5c 2d fe  a6 fb 18 24 c2 3a f9 f2  |.Utv.\-....$.:..|
e8 19 36 ef c8 28 37 04  2c 62 dc 66 1c 93 46 c1  |..6..(7.,b.f..F.|
6e 72 01 58 00 e9 fe 33  88 31 cb b6 b3 ec b8 d6  |nr.X...3.1......|
0d 78 1f 5b 95 8c 6f 1a  4b ed d5 34 26 c5 51 df  |.x.[..o.K..4&.Q.|
e3 a6 98 98 e0 8f f3 b7  2d ef a2 06 42 d5 eb e1  |........-...B...|
2a d0 96 96 71 35 8e 0b  ea 8c b9 3c d3 c2 ad 10  |*...q5.....<....|
42 ef 39 90 d6 8e dd d2  0f 38 bd f3 ec 13 2d de  |B.9......8....-.|
9d b7 2a 8b 0e a1 1f 39  10 a5 c2 0c 15 90 85 10  |..*....9........|
40 d7 22 ce 88 b3 df 86  de 12 b5 b2 7a 21 3c 33  |@.".........z!<3|
ad 40 ce 59 fa 95 09 cb  ab d8 11 15 90 9b f4 3b  |.@.Y...........;|
31 e3 aa 08 0d d6 3d ed  19 af 8b 2a 67 e1 cc 99  |1.....=....*g...|
00 ed 94 2a 75 03 f8 b7  00 b9 f7 ac 32 37 a7 94  |...*u.......27..|
82 20 dd b7 87 c7 71 73  42 27 b4 cb e1 dd 0a d4  |. ....qsB'......|

countersignature

unnamed
- #0
  - C: US
  - ST: Washington
  - L: Redmond
  - O: Microsoft Corporation
  - CN: Microsoft Time-Stamp PCA
- 61:03:DC:F6:00:00:00:00:00:0C
SHA1

contentType: pkcs7-data
signingTime: 2010-11-20 13:32:57 UTC

messageDigest:

9e 28 54 98 49 6d 43 a5  b7 3d e0 73 3e 0d f3 a0  |.(T.ImC..=.s>...|
c1 90 f3 24                                       |...$            |

RSA-SHA1:

57 9b e2 ad 0a a2 4d 4f  e4 d3 ae fa 5f ee 90 b7  |W.....MO...._...|
fb 80 08 c9 52 09 bf b4  ff e9 d2 53 32 12 95 df  |....R......S2...|
cf 1f 48 bc 98 85 6d b3  83 7e 04 2a 79 e1 28 1d  |..H...m..~.*y.(.|
c6 d3 d5 24 36 33 a9 35  8a fb 71 b4 d5 02 23 eb  |...$63.5..q...#.|
26 a9 d6 80 cc d4 b2 44  7c 75 64 66 fe 32 ea 4d  |&......D|udf.2.M|
bb 84 90 b0 27 15 a9 46  d5 55 d9 08 4e b9 30 eb  |....'..F.U..N.0.|
e0 f3 32 09 a0 4e ce ac  1b fb 8f f5 ec 34 04 32  |..2..N.......4.2|
1a d2 c4 b0 9e 74 e6 04  6d 31 56 63 1d 23 e9 a1  |.....t..m1Vc.#..|
9f 94 8d c7 12 f4 2e a2  39 08 9d 4f c0 48 a3 3d  |........9..O.H.=|
65 4b 4d f0 39 95 5c 05  19 23 95 ac 67 58 e7 9e  |eKM.9.\..#..gX..|
7f ad b1 6c 01 15 77 3d  88 a4 da 4f 5a a8 d3 64  |...l..w=...OZ..d|
47 7a 5a 1c 15 a3 0c 16  c6 5b ed ee d5 2c 25 a8  |GzZ......[...,%.|
56 58 68 e4 52 fe 3d 7e  70 07 de ee bb 3d 3c f2  |VXh.R.=~p....=<.|
15 d2 82 c2 11 fd 0c 86  d5 e8 f2 95 ca 1c d7 0d  |................|
62 c4 1f 41 d8 94 05 76  cb f5 70 7f 6c ec dc 7a  |b..A...v..p.l..z|
11 03 f3 b3 b8 3f b7 5c  c1 77 1c 5e e4 6b eb f2  |.....?.\.w.^.k..|

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	106416	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x2e8

consent.exe-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904B0

VS_FIXEDFILEINFO

Signers (1)

Certificates (4)

consent.exe
-