bin150.sys - procexp.Sys - Process Explorer

info
MZ
PE
resources
imports
foremost
version info
signature
hexdump
disasm
log
discuss
donate

filename	bin150.sys
size	35720 (0x8b88)
md5	1fb0b1ce80ecec8fb0cea4a53535ecfe

type	PE32+ executable (DLL) (native) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe8

Rich Header

lib id	version	times used
149	30729	1
135	30729	6
1	0	65
123	40310	3
125	40310	2
131	30729	4
148	30729	1
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	8
TimeDateStamp	0x50087757
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x2022
Magic	0x20b
LinkerVersion	9.0
SizeOfCode	0x5800
SizeOfInitializedData	0x1e00
SizeOfUninitializedData	0
AddressOfEntryPoint	0xa058
BaseOfCode	0x1000
ImageBase	0x180000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.2
ImageVersion	0.0
SubsystemVersion	5.2
Reserved1	0
SizeOfImage	0xd000
SizeOfHeaders	0x400
CheckSum	0x13990
Subsystem	1
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x3193	0x3200	R-X CODE
.rdata	0x5000	0x8b8	0xa00	R-- IDATA
.data	0x6000	0x9d0	0xa00	RW- IDATA
.pdata	0x7000	0x300	0x400	R-- IDATA
PAGE	0x8000	0x1a1b	0x1c00	R-X CODE
INIT	0xa000	0x83c	0xa00	RWX CODE DISCARDABLE
.rsrc	0xb000	0x380	0x400	R-- IDATA DISCARDABLE
.reloc	0xc000	0x60	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xa078	0x28
RESOURCE	0xb000	0x380
EXCEPTION	0x7000	0x300
SECURITY	0x7a00	0x1188
BASERELOC	0xc000	0x18
DEBUG	0x5210	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x5000	0x210
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
VERSION	#1	796	0

module_name	hint	function_name
ntoskrnl.exe	850	ObfDereferenceObject
ntoskrnl.exe	839	ObOpenObjectByPointer
ntoskrnl.exe	842	ObReferenceObjectByHandle
ntoskrnl.exe	1430	__C_specific_handler
ntoskrnl.exe	1057	RtlFreeAnsiString
ntoskrnl.exe	1202	RtlUnicodeStringToAnsiString
ntoskrnl.exe	840	ObQueryNameString
ntoskrnl.exe	88	ExFreePoolWithTag
ntoskrnl.exe	1480	strlen
ntoskrnl.exe	1483	strncpy
ntoskrnl.exe	1500	wcslen
ntoskrnl.exe	70	ExAllocatePoolWithTag
ntoskrnl.exe	1387	ZwQueryObject
ntoskrnl.exe	654	KeUnstackDetachProcess
ntoskrnl.exe	646	KeStackAttachProcess
ntoskrnl.exe	937	PsLookupProcessByProcessId
ntoskrnl.exe	1317	ZwClose
ntoskrnl.exe	1335	ZwDuplicateObject
ntoskrnl.exe	1360	ZwOpenProcess
ntoskrnl.exe	827	ObCloseHandle
ntoskrnl.exe	364	IoFileObjectType
ntoskrnl.exe	1391	ZwQuerySystemInformation
ntoskrnl.exe	710	MmIsAddressValid
ntoskrnl.exe	965	PsThreadType
ntoskrnl.exe	1382	ZwQueryInformationProcess
ntoskrnl.exe	940	PsProcessType
ntoskrnl.exe	660	KeWaitForSingleObject
ntoskrnl.exe	1361	ZwOpenProcessToken
ntoskrnl.exe	502	IofCompleteRequest
ntoskrnl.exe	1275	SeReleaseSubjectContext
ntoskrnl.exe	1266	SePrivilegeCheck
ntoskrnl.exe	93	ExGetPreviousMode
ntoskrnl.exe	1249	SeCaptureSubjectContext
ntoskrnl.exe	351	IoDeleteDevice
ntoskrnl.exe	353	IoDeleteSymbolicLink
ntoskrnl.exe	1086	RtlInitUnicodeString
ntoskrnl.exe	838	ObOpenObjectByName
ntoskrnl.exe	341	IoCreateSymbolicLink
ntoskrnl.exe	706	MmGetSystemRoutineAddress
ntoskrnl.exe	770	NtBuildNumber
ntoskrnl.exe	462	IoCreateDevice
ntoskrnl.exe	1961	ZwSetSecurityObject
ntoskrnl.exe	489	IoDeviceObjectType
ntoskrnl.exe	2000	_snwprintf
ntoskrnl.exe	1514	RtlLengthSecurityDescriptor
ntoskrnl.exe	1667	SeCaptureSecurityDescriptor
ntoskrnl.exe	1367	RtlCreateSecurityDescriptor
ntoskrnl.exe	1579	RtlSetDaclSecurityDescriptor
ntoskrnl.exe	1314	RtlAbsoluteToSelfRelativeSD
ntoskrnl.exe	556	IoIsWdmVersionAvailable
ntoskrnl.exe	1682	SeExports
ntoskrnl.exe	2093	wcschr
ntoskrnl.exe	2026	_wcsnicmp
ntoskrnl.exe	1515	RtlLengthSid
ntoskrnl.exe	1315	RtlAddAccessAllowedAce
ntoskrnl.exe	1451	RtlGetSaclSecurityDescriptor
ntoskrnl.exe	1437	RtlGetDaclSecurityDescriptor
ntoskrnl.exe	1443	RtlGetGroupSecurityDescriptor
ntoskrnl.exe	1449	RtlGetOwnerSecurityDescriptor
ntoskrnl.exe	1870	ZwOpenKey
ntoskrnl.exe	1822	ZwCreateKey
ntoskrnl.exe	1923	ZwQueryValueKey
ntoskrnl.exe	1966	ZwSetValueKey
ntoskrnl.exe	1431	RtlFreeUnicodeString
ntoskrnl.exe	531	KeBugCheckEx

StringTable 040904b0

CompanyName	Sysinternals - www.sysinternals.com
FileDescription	Process Explorer
FileVersion	15.00
InternalName	procexp.sys
LegalCopyright	Copyright (C) M. Russinovich 1996-2011
OriginalFilename	procexp.Sys
ProductName	Process Explorer
ProductVersion	15.00

VS_FIXEDFILEINFO

FileVersion	15.0.0.0
ProductVersion	15.0.0.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	3
FileSubtype	7

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)09/CN=VeriSign Class 3 Code Signing 2009-2 CA

serial: 4112E632C7B18A029A3A1FAC803AB89F

Certificates (3)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            41:12:e6:32:c7:b1:8a:02:9a:3a:1f:ac:80:3a:b8:9f
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009-2 CA
        Validity
            Not Before: Mar  4 00:00:00 2010 GMT
            Not After : Apr 18 23:59:59 2013 GMT
        Subject: C=US, ST=Texas, L=Austin, O=Sysinternals, OU=Digital ID Class 3 - Microsoft Software Validation v2, OU=Headquarters, CN=Sysinternals
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    00:b2:a3:01:89:b8:8f:f5:51:c8:0b:9a:a9:ea:f6:
                    aa:91:f5:ea:ae:b9:a7:15:9b:73:2e:18:45:25:17:
                    1f:95:65:60:3e:02:c4:93:63:a3:65:b8:e7:96:c1:
                    1d:0a:2d:6b:ed:7b:c6:e9:92:a0:e7:af:e6:69:8b:
                    da:97:a4:2b:92:15:3e:69:eb:d2:82:b3:68:7b:b4:
                    26:6d:44:8d:95:cc:2d:5c:5d:2a:82:61:db:ee:a0:
                    33:e9:8f:ff:db:bc:9a:00:5a:c7:34:e0:9a:79:b1:
                    34:81:e3:89:95:fd:be:67:4a:9f:61:d6:e6:fe:1a:
                    a2:f5:e9:f6:00:97:ab:31:c5
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://csc3-2009-2-crl.verisign.com/CSC3-2009-2.crl

            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/rpa

            X509v3 Extended Key Usage: 
                Code Signing
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
                CA Issuers - URI:http://csc3-2009-2-aia.verisign.com/CSC3-2009-2.cer

            X509v3 Authority Key Identifier: 
                keyid:97:D0:6B:A8:26:70:C8:A1:3F:94:1F:08:2D:C4:35:9B:A4:A1:1E:F2

            Netscape Cert Type: 
                Object Signing
            1.3.6.1.4.1.311.2.1.27: 
                0.......
    Signature Algorithm: sha1WithRSAEncryption
         69:9b:1e:86:26:5a:98:79:a8:22:a8:a6:69:9a:8c:10:44:59:
         51:bf:2b:4f:57:3e:73:a1:d6:1d:4c:b8:27:9a:80:69:fc:69:
         f0:09:28:09:08:b4:91:82:f4:70:1c:79:28:c3:c2:b6:d5:86:
         36:5f:50:27:8e:f3:5f:08:b6:cd:f8:20:8a:12:e1:ac:53:1e:
         f3:54:a0:cc:d6:e3:e3:f2:f4:6c:b6:24:ad:8e:38:a4:01:43:
         79:39:50:d6:c4:da:6a:9a:eb:34:20:d1:6f:7e:db:f1:e9:39:
         44:64:e6:4d:d6:8c:3a:22:7d:c7:e3:92:17:e3:53:9b:63:0a:
         b8:2a:9f:fe:d2:52:b8:a8:9d:32:c2:d3:73:e5:3b:bf:c4:d7:
         11:0f:58:a7:a8:fb:88:fd:b9:d9:18:25:1a:d2:a6:e1:31:57:
         25:00:75:97:a4:49:2e:e3:9b:51:3e:0d:de:05:fe:42:1f:e4:
         ef:18:cf:7b:86:f5:16:5a:e7:1a:6f:e4:09:48:f0:fa:39:e3:
         a9:d6:81:be:27:6f:20:29:5d:21:32:e5:30:43:f5:db:8a:1e:
         d0:2e:bb:f7:f3:2b:57:4e:95:cb:60:7a:af:ac:1b:a4:1c:77:
         15:1a:de:19:84:53:2d:f7:ac:19:0f:b5:7e:17:f7:30:a1:97:
         05:0c:0e:32

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
        Validity
            Not Before: May 21 00:00:00 2009 GMT
            Not After : May 20 23:59:59 2019 GMT
        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009-2 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:be:67:1d:b4:60:aa:10:49:6f:56:17:7c:66:c9:
                    5e:86:0d:d5:f1:ac:a7:71:83:8e:8b:89:f8:88:04:
                    89:15:06:ba:2d:84:21:95:e4:d1:9c:50:4c:fb:d2:
                    22:bd:da:f2:b2:35:3b:1e:8f:c3:09:fb:fc:13:2e:
                    5a:bf:89:7c:3d:3b:25:1e:f6:f3:58:7b:9c:f4:01:
                    b5:c6:0a:b8:80:ce:be:27:74:61:67:27:4d:6a:e5:
                    ec:81:61:58:79:a3:e0:17:10:12:15:27:b0:e1:4d:
                    34:7f:2b:47:20:44:b9:de:66:24:66:8a:cd:4f:ba:
                    1f:c5:38:c8:54:90:e1:72:f6:19:66:75:6a:b9:49:
                    68:cf:38:79:0d:aa:30:a8:db:2c:60:48:9e:d7:aa:
                    14:01:a9:83:d7:38:91:30:39:13:96:03:3a:7c:40:
                    54:b6:ad:e0:2f:1b:83:dc:a8:11:52:3e:02:b3:d7:
                    2b:fd:21:b6:a7:5c:a3:0f:0b:a9:a6:10:50:0e:34:
                    2e:4d:a7:ce:c9:5e:25:d4:8c:bc:f3:6e:7c:29:bc:
                    01:5d:fc:31:87:5a:d5:8c:85:67:58:88:19:a0:bf:
                    35:f0:ea:2b:a3:21:e7:90:f6:83:e5:a8:ed:60:78:
                    5e:7b:60:83:fd:57:0b:5d:41:0d:63:54:60:d6:43:
                    21:ef
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/cps
                  User Notice:
                    Explicit Text: https://www.verisign.com/rpa

            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            1.3.6.1.5.5.7.1.12: 
                0_.].[0Y0W0U..image/gif0!0.0...+..............k...j.H.,{..0%.#http://logo.verisign.com/vslogo.gif
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, Code Signing
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.verisign.com/pca3.crl

            X509v3 Subject Alternative Name: 
                DirName:/CN=Class3CA2048-1-55
            X509v3 Subject Key Identifier: 
                97:D0:6B:A8:26:70:C8:A1:3F:94:1F:08:2D:C4:35:9B:A4:A1:1E:F2
    Signature Algorithm: sha1WithRSAEncryption
         8b:03:c0:dd:94:d8:41:a2:61:69:b0:15:a8:78:c7:30:c6:90:
         3c:7e:42:f7:24:b6:e4:83:73:17:04:7f:04:10:9c:a1:e2:fa:
         81:2f:eb:c0:ca:44:e7:72:e0:50:b6:55:10:20:83:6e:96:92:
         e4:9a:51:6a:b4:37:31:dc:a5:2d:eb:8c:00:c7:1d:4f:e7:4d:
         32:ba:85:f8:4e:be:fa:67:55:65:f0:6a:be:7a:ca:64:38:1a:
         10:10:78:45:76:31:f3:86:7a:03:0f:60:c2:b3:5d:9d:f6:8b:
         66:76:82:1b:59:e1:83:e5:bd:49:a5:38:56:e5:de:41:77:0e:
         58:0f

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:0c:12:06:00:00:00:00:00:1b
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Verification Root
        Validity
            Not Before: May 23 17:01:29 2006 GMT
            Not After : May 23 17:11:29 2016 GMT
        Subject: C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    00:c9:5c:59:9e:f2:1b:8a:01:14:b4:10:df:04:40:
                    db:e3:57:af:6a:45:40:8f:84:0c:0b:d1:33:d9:d9:
                    11:cf:ee:02:58:1f:25:f7:2a:a8:44:05:aa:ec:03:
                    1f:78:7f:9e:93:b9:9a:00:aa:23:7d:d6:ac:85:a2:
                    63:45:c7:72:27:cc:f4:4c:c6:75:71:d2:39:ef:4f:
                    42:f0:75:df:0a:90:c6:8e:20:6f:98:0f:f8:ac:23:
                    5f:70:29:36:a4:c9:86:e7:b1:9a:20:cb:53:a5:85:
                    e7:3d:be:7d:9a:fe:24:45:33:dc:76:15:ed:0f:a2:
                    71:64:4c:65:2e:81:68:45:a7
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Certificate Policies: 
                Policy: X509v3 Any Policy

            1.3.6.1.4.1.311.21.7: 
                0'..+.....7......N...................n...
            X509v3 Key Usage: 
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier: 
                E2:7F:7B:D8:77:D5:DF:9E:0A:3F:9E:B4:CB:0E:2E:A9:EF:DB:69:77
            1.3.6.1.4.1.311.20.2: 
                ...C.r.o.s.s.C.A
            X509v3 Authority Key Identifier: 
                keyid:62:FB:0A:21:5B:7F:43:6E:11:DA:09:54:50:6B:F5:D2:96:71:F1:9E

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl

    Signature Algorithm: sha1WithRSAEncryption
         01:e4:46:b3:3b:45:7f:75:13:87:7e:5f:43:de:46:8e:cb:8a:
         bd:b6:47:41:bc:cc:cc:74:91:d8:ce:39:51:95:a4:a6:b5:47:
         c0:ef:d2:da:7b:8f:57:11:f4:32:8c:7c:cd:3f:ee:42:da:04:
         21:4a:f7:c8:43:88:4a:6f:5c:ca:14:fc:4b:d1:9f:4c:bd:d4:
         55:6e:cc:02:be:0d:a6:88:8f:86:09:ba:a4:25:bd:e8:b0:f0:
         fa:8b:71:4e:67:b0:cb:82:a8:d7:8e:55:f7:37:eb:f0:3e:88:
         ef:e4:e0:8a:fd:1c:6e:2e:61:41:48:75:b4:b0:2c:1d:28:d8:
         49:0f:d7:15:f0:24:73:25:3c:cc:88:0c:de:28:4c:65:54:fe:
         5e:ae:8c:ea:19:ad:2c:51:b2:9b:3a:47:f5:3c:80:35:01:17:
         e2:49:87:d6:54:4a:fb:4b:ab:07:bc:bf:7d:79:cf:bf:35:00:
         5c:bb:9e:cf:fc:82:89:1b:39:a0:51:97:b6:de:c0:b3:07:ff:
         44:96:44:c0:34:2a:19:5c:ab:ee:f0:3b:ec:29:4e:b5:13:c5:
         37:85:7e:75:d5:b4:d6:0d:06:6e:b5:d2:6c:23:71:67:ea:f1:
         71:8e:af:4e:74:aa:0c:f9:ec:bf:4c:58:fa:5e:90:9b:6d:39:
         cb:86:88:3f:8b:1c:a8:16:32:d5:fe:6d:b9:f1:f8:b3:ea:d7:
         91:f6:36:47:78:c0:27:2a:15:c7:68:d6:f4:c5:fc:4f:4e:c8:
         67:3f:10:2d:40:9f:f1:1e:c9:61:48:e7:a7:03:fc:31:73:0c:
         f0:46:88:fe:56:da:49:29:95:ef:09:da:a3:e5:be:ef:60:ec:
         d9:54:a0:59:9c:28:bd:54:ef:66:15:7f:87:4c:84:db:a6:0e:
         95:67:2e:51:7b:34:39:b6:41:c2:8c:84:68:26:dc:24:02:09:
         e7:81:8e:0a:97:2d:ef:ee:a7:b9:98:a6:0f:81:8d:c7:10:b5:
         e1:ed:98:2f:48:6f:53:85:49:64:78:9b:ec:5d:ac:97:0b:55:
         26:c3:ef:ba:8d:c8:d1:a5:2f:5a:7f:93:6b:61:1a:33:9b:18:
         b8:a2:62:10:de:24:ea:76:e1:2f:43:eb:ec:dd:7c:12:34:24:
         89:da:28:55:ae:e5:75:4e:31:2b:67:63:b6:a8:d7:ab:73:0a:
         03:ce:c5:ea:59:3f:c7:eb:2a:45:ae:a8:62:5b:2f:00:99:39:
         ab:b4:5f:73:c3:08:ec:80:11:8f:47:0e:8f:2a:13:43:e1:91:
         06:62:55:bb:ff:ba:3d:a9:a9:3d:26:0f:ae:ca:7d:62:8b:15:
         55:89:d6:94:34:4d:d6:65

pkcs7-signedData

SHA1: nil

1.3.6.1.4.1.311.2.1.4

1.3.6.1.4.1.311.2.1.15

00 3c 00 3c 00 3c 00 4f  00 62 00 73 00 6f 00 6c  |.<.<.<.O.b.s.o.l|
00 65 00 74 00 65 00 3e  00 3e 00 3e              |.e.t.e.>.>.>    |

SHA1

57 e1 b6 6c 8e ec 0f c6 87 05 ac 8d 14 99 bf f6 |W..l............| 2d c7 19 8e |-... |

Certificates

Certificate #0
- 2
  - 41:12:E6:32:C7:B1:8A:02:9A:3A:1F:AC:80:3A:B8:9F
  - RSA-SHA1: nil
  - Issuer
    - C: US
    - O: VeriSign, Inc.
    - OU: VeriSign Trust Network
    - OU: Terms of use at https://www.verisign.com/rpa (c)09
    - CN: VeriSign Class 3 Code Signing 2009-2 CA
  - 2010-03-04 00:00:00 UTC: 2013-04-18 23:59:59 UTC
  - Subject
    - C: US
    - ST: Texas
    - L: Austin
    - O: Sysinternals
    - OU: Digital ID Class 3 - Microsoft Software Validation v2
    - OU: Headquarters
    - CN: Sysinternals
  - #5
    - rsaEncryption: nil
    - B2:A3:01:89:B8:8F:F5:51:C8:0B:9A:A9:EA:F6:AA:91:
      F5:EA:AE:B9:A7:15:9B:73:2E:18:45:25:17:1F:95:65:
      60:3E:02:C4:93:63:A3:65:B8:E7:96:C1:1D:0A:2D:6B:
      ED:7B:C6:E9:92:A0:E7:AF:E6:69:8B:DA:97:A4:2B:92:
      15:3E:69:EB:D2:82:B3:68:7B:B4:26:6D:44:8D:95:CC:
      2D:5C:5D:2A:82:61:DB:EE:A0:33:E9:8F:FF:DB:BC:9A:
      00:5A:C7:34:E0:9A:79:B1:34:81:E3:89:95:FD:BE:67:
      4A:9F:61:D6:E6:FE:1A:A2:F5:E9:F6:00:97:AB:31:C5: 0x010001
  - X509v3 extensions
    - basicConstraints
      - nil
    - keyUsage: true, 0x80
    - crlDistributionPoints: http://csc3-2009-2-crl.verisign.com/CSC3-2009-2.crl
    - certificatePolicies
      - 2.16.840.1.113733.1.7.23.3
        id-qt-cps: https://www.verisign.com/rpa
    - extendedKeyUsage: codeSigning
    - authorityInfoAccess
      - #0
        OCSP: http://ocsp.verisign.com
        caIssuers: http://csc3-2009-2-aia.verisign.com/CSC3-2009-2.cer
    - authorityKeyIdentifier:
```
97 d0 6b a8 26 70 c8 a1  3f 94 1f 08 2d c4 35 9b  |..k.&p..?...-.5.|
a4 a1 1e f2                                       |....            |
```
    - nsCertType: 0x10
    - 1.3.6.1.4.1.311.2.1.27
      - false: true
- RSA-SHA1:
```
69 9b 1e 86 26 5a 98 79  a8 22 a8 a6 69 9a 8c 10  |i...&Z.y."..i...|
44 59 51 bf 2b 4f 57 3e  73 a1 d6 1d 4c b8 27 9a  |DYQ.+OW>s...L.'.|
80 69 fc 69 f0 09 28 09  08 b4 91 82 f4 70 1c 79  |.i.i..(......p.y|
28 c3 c2 b6 d5 86 36 5f  50 27 8e f3 5f 08 b6 cd  |(.....6_P'.._...|
f8 20 8a 12 e1 ac 53 1e  f3 54 a0 cc d6 e3 e3 f2  |. ....S..T......|
f4 6c b6 24 ad 8e 38 a4  01 43 79 39 50 d6 c4 da  |.l.$..8..Cy9P...|
6a 9a eb 34 20 d1 6f 7e  db f1 e9 39 44 64 e6 4d  |j..4 .o~...9Dd.M|
d6 8c 3a 22 7d c7 e3 92  17 e3 53 9b 63 0a b8 2a  |..:"}.....S.c..*|
9f fe d2 52 b8 a8 9d 32  c2 d3 73 e5 3b bf c4 d7  |...R...2..s.;...|
11 0f 58 a7 a8 fb 88 fd  b9 d9 18 25 1a d2 a6 e1  |..X........%....|
31 57 25 00 75 97 a4 49  2e e3 9b 51 3e 0d de 05  |1W%.u..I...Q>...|
fe 42 1f e4 ef 18 cf 7b  86 f5 16 5a e7 1a 6f e4  |.B.....{...Z..o.|
09 48 f0 fa 39 e3 a9 d6  81 be 27 6f 20 29 5d 21  |.H..9.....'o )]!|
32 e5 30 43 f5 db 8a 1e  d0 2e bb f7 f3 2b 57 4e  |2.0C.........+WN|
95 cb 60 7a af ac 1b a4  1c 77 15 1a de 19 84 53  |..`z.....w.....S|
2d f7 ac 19 0f b5 7e 17  f7 30 a1 97 05 0c 0e 32  |-.....~..0.....2|
```
Certificate #1
- 2
  - 65:52:26:E1:B2:2E:18:E1:59:0F:29:85:AC:22:E7:5C
  - RSA-SHA1: nil
  - Issuer
    - C: US
    - O: VeriSign, Inc.
    - OU: Class 3 Public Primary Certification Authority
  - 2009-05-21 00:00:00 UTC: 2019-05-20 23:59:59 UTC
  - Subject
    - C: US
    - O: VeriSign, Inc.
    - OU: VeriSign Trust Network
    - OU: Terms of use at https://www.verisign.com/rpa (c)09
    - CN: VeriSign Class 3 Code Signing 2009-2 CA
  - #5
    - rsaEncryption: nil
    - BE:67:1D:B4:60:AA:10:49:6F:56:17:7C:66:C9:5E:86:
      0D:D5:F1:AC:A7:71:83:8E:8B:89:F8:88:04:89:15:06:
      BA:2D:84:21:95:E4:D1:9C:50:4C:FB:D2:22:BD:DA:F2:
      B2:35:3B:1E:8F:C3:09:FB:FC:13:2E:5A:BF:89:7C:3D:
      3B:25:1E:F6:F3:58:7B:9C:F4:01:B5:C6:0A:B8:80:CE:
      BE:27:74:61:67:27:4D:6A:E5:EC:81:61:58:79:A3:E0:
      17:10:12:15:27:B0:E1:4D:34:7F:2B:47:20:44:B9:DE:
      66:24:66:8A:CD:4F:BA:1F:C5:38:C8:54:90:E1:72:F6:
      19:66:75:6A:B9:49:68:CF:38:79:0D:AA:30:A8:DB:2C:
      60:48:9E:D7:AA:14:01:A9:83:D7:38:91:30:39:13:96:
      03:3A:7C:40:54:B6:AD:E0:2F:1B:83:DC:A8:11:52:3E:
      02:B3:D7:2B:FD:21:B6:A7:5C:A3:0F:0B:A9:A6:10:50:
      0E:34:2E:4D:A7:CE:C9:5E:25:D4:8C:BC:F3:6E:7C:29:
      BC:01:5D:FC:31:87:5A:D5:8C:85:67:58:88:19:A0:BF:
      35:F0:EA:2B:A3:21:E7:90:F6:83:E5:A8:ED:60:78:5E:
      7B:60:83:FD:57:0B:5D:41:0D:63:54:60:D6:43:21:EF: 0x010001
  - X509v3 extensions
    - basicConstraints
      - true
      - true: 0
    - certificatePolicies
      - 2.16.840.1.113733.1.7.23.3
        #0
        id-qt-cps: https://www.verisign.com/cps
        id-qt-unotice: https://www.verisign.com/rpa
    - keyUsage: true, 6
    - 1.3.6.1.5.5.7.1.12
      - image/gif
        SHA1:
        8f e5 d3 1a 86 ac 8d 8e 6b c3 cf 80 6a d4 48 18 |........k...j.H.| 2c 7b 19 2e |,{.. |
        http://logo.verisign.com/vslogo.gif
    - extendedKeyUsage
      - clientAuth: codeSigning
    - authorityInfoAccess
      - OCSP: http://ocsp.verisign.com
    - crlDistributionPoints: http://crl.verisign.com/pca3.crl
    - subjectAltName
      - CN: Class3CA2048-1-55
    - subjectKeyIdentifier:
```
97 d0 6b a8 26 70 c8 a1  3f 94 1f 08 2d c4 35 9b  |..k.&p..?...-.5.|
a4 a1 1e f2                                       |....            |
```
- RSA-SHA1:
```
8b 03 c0 dd 94 d8 41 a2  61 69 b0 15 a8 78 c7 30  |......A.ai...x.0|
c6 90 3c 7e 42 f7 24 b6  e4 83 73 17 04 7f 04 10  |..<~B.$...s.....|
9c a1 e2 fa 81 2f eb c0  ca 44 e7 72 e0 50 b6 55  |...../...D.r.P.U|
10 20 83 6e 96 92 e4 9a  51 6a b4 37 31 dc a5 2d  |. .n....Qj.71..-|
eb 8c 00 c7 1d 4f e7 4d  32 ba 85 f8 4e be fa 67  |.....O.M2...N..g|
55 65 f0 6a be 7a ca 64  38 1a 10 10 78 45 76 31  |Ue.j.z.d8...xEv1|
f3 86 7a 03 0f 60 c2 b3  5d 9d f6 8b 66 76 82 1b  |..z..`..]...fv..|
59 e1 83 e5 bd 49 a5 38  56 e5 de 41 77 0e 58 0f  |Y....I.8V..Aw.X.|
```

Certificate #2

2
- 61:0C:12:06:00:00:00:00:00:1B
- RSA-SHA1: nil
- Issuer
  - C: US
  - ST: Washington
  - L: Redmond
  - O: Microsoft Corporation
  - CN: Microsoft Code Verification Root
- 2006-05-23 17:01:29 UTC: 2016-05-23 17:11:29 UTC
- Subject
  - C: US
  - O: VeriSign, Inc.
  - OU: Class 3 Public Primary Certification Authority
- #5
  - rsaEncryption: nil
  - C9:5C:59:9E:F2:1B:8A:01:14:B4:10:DF:04:40:DB:E3:
    57:AF:6A:45:40:8F:84:0C:0B:D1:33:D9:D9:11:CF:EE:
    02:58:1F:25:F7:2A:A8:44:05:AA:EC:03:1F:78:7F:9E:
    93:B9:9A:00:AA:23:7D:D6:AC:85:A2:63:45:C7:72:27:
    CC:F4:4C:C6:75:71:D2:39:EF:4F:42:F0:75:DF:0A:90:
    C6:8E:20:6F:98:0F:F8:AC:23:5F:70:29:36:A4:C9:86:
    E7:B1:9A:20:CB:53:A5:85:E7:3D:BE:7D:9A:FE:24:45:
    33:DC:76:15:ED:0F:A2:71:64:4C:65:2E:81:68:45:A7: 0x010001
- #6
  - certificatePolicies: anyPolicy
  - 1.3.6.1.4.1.311.21.7
    - 1.3.6.1.4.1.311.21.8.3692315854.1256661383.1690418588.4201632533.1.25: 0x6E, 0
  - keyUsage: 0x86
  - basicConstraints: true, true
  - subjectKeyIdentifier:
```
e2 7f 7b d8 77 d5 df 9e  0a 3f 9e b4 cb 0e 2e a9  |..{.w....?......|
ef db 69 77                                       |..iw            |
```
  - 1.3.6.1.4.1.311.20.2:
```
00 43 00 72 00 6f 00 73  00 73 00 43 00 41        |.C.r.o.s.s.C.A  |
```
  - authorityKeyIdentifier:
```
62 fb 0a 21 5b 7f 43 6e  11 da 09 54 50 6b f5 d2  |b..![.Cn...TPk..|
96 71 f1 9e                                       |.q..            |
```
  - crlDistributionPoints: http://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl

RSA-SHA1:

01 e4 46 b3 3b 45 7f 75  13 87 7e 5f 43 de 46 8e  |..F.;E.u..~_C.F.|
cb 8a bd b6 47 41 bc cc  cc 74 91 d8 ce 39 51 95  |....GA...t...9Q.|
a4 a6 b5 47 c0 ef d2 da  7b 8f 57 11 f4 32 8c 7c  |...G....{.W..2.||
cd 3f ee 42 da 04 21 4a  f7 c8 43 88 4a 6f 5c ca  |.?.B..!J..C.Jo\.|
14 fc 4b d1 9f 4c bd d4  55 6e cc 02 be 0d a6 88  |..K..L..Un......|
8f 86 09 ba a4 25 bd e8  b0 f0 fa 8b 71 4e 67 b0  |.....%......qNg.|
cb 82 a8 d7 8e 55 f7 37  eb f0 3e 88 ef e4 e0 8a  |.....U.7..>.....|
fd 1c 6e 2e 61 41 48 75  b4 b0 2c 1d 28 d8 49 0f  |..n.aAHu..,.(.I.|
d7 15 f0 24 73 25 3c cc  88 0c de 28 4c 65 54 fe  |...$s%<....(LeT.|
5e ae 8c ea 19 ad 2c 51  b2 9b 3a 47 f5 3c 80 35  |^.....,Q..:G.<.5|
01 17 e2 49 87 d6 54 4a  fb 4b ab 07 bc bf 7d 79  |...I..TJ.K....}y|
cf bf 35 00 5c bb 9e cf  fc 82 89 1b 39 a0 51 97  |..5.\.......9.Q.|
b6 de c0 b3 07 ff 44 96  44 c0 34 2a 19 5c ab ee  |......D.D.4*.\..|
f0 3b ec 29 4e b5 13 c5  37 85 7e 75 d5 b4 d6 0d  |.;.)N...7.~u....|
06 6e b5 d2 6c 23 71 67  ea f1 71 8e af 4e 74 aa  |.n..l#qg..q..Nt.|
0c f9 ec bf 4c 58 fa 5e  90 9b 6d 39 cb 86 88 3f  |....LX.^..m9...?|
8b 1c a8 16 32 d5 fe 6d  b9 f1 f8 b3 ea d7 91 f6  |....2..m........|
36 47 78 c0 27 2a 15 c7  68 d6 f4 c5 fc 4f 4e c8  |6Gx.'*..h....ON.|
67 3f 10 2d 40 9f f1 1e  c9 61 48 e7 a7 03 fc 31  |g?.-@....aH....1|
73 0c f0 46 88 fe 56 da  49 29 95 ef 09 da a3 e5  |s..F..V.I)......|
be ef 60 ec d9 54 a0 59  9c 28 bd 54 ef 66 15 7f  |..`..T.Y.(.T.f..|
87 4c 84 db a6 0e 95 67  2e 51 7b 34 39 b6 41 c2  |.L.....g.Q{49.A.|
8c 84 68 26 dc 24 02 09  e7 81 8e 0a 97 2d ef ee  |..h&.$.......-..|
a7 b9 98 a6 0f 81 8d c7  10 b5 e1 ed 98 2f 48 6f  |............./Ho|
53 85 49 64 78 9b ec 5d  ac 97 0b 55 26 c3 ef ba  |S.Idx..]...U&...|
8d c8 d1 a5 2f 5a 7f 93  6b 61 1a 33 9b 18 b8 a2  |..../Z..ka.3....|
62 10 de 24 ea 76 e1 2f  43 eb ec dd 7c 12 34 24  |b..$.v./C...|.4$|
89 da 28 55 ae e5 75 4e  31 2b 67 63 b6 a8 d7 ab  |..(U..uN1+gc....|
73 0a 03 ce c5 ea 59 3f  c7 eb 2a 45 ae a8 62 5b  |s.....Y?..*E..b[|
2f 00 99 39 ab b4 5f 73  c3 08 ec 80 11 8f 47 0e  |/..9.._s......G.|
8f 2a 13 43 e1 91 06 62  55 bb ff ba 3d a9 a9 3d  |.*.C...bU...=..=|
26 0f ae ca 7d 62 8b 15  55 89 d6 94 34 4d d6 65  |&...}b..U...4M.e|

Signer

1
unnamed
- #0
  - C: US
  - O: VeriSign, Inc.
  - OU: VeriSign Trust Network
  - OU: Terms of use at https://www.verisign.com/rpa (c)09
  - CN: VeriSign Class 3 Code Signing 2009-2 CA
- 41:12:E6:32:C7:B1:8A:02:9A:3A:1F:AC:80:3A:B8:9F
SHA1: nil

1.3.6.1.4.1.311.2.1.12
- nil
contentType: 1.3.6.1.4.1.311.2.1.4
1.3.6.1.4.1.311.2.1.11: msCodeInd

messageDigest:

17 e8 b9 08 14 31 63 bd  e5 49 87 c3 56 25 b7 25  |.....1c..I..V%.%|
a0 55 9e fa                                       |.U..            |

rsaEncryption:

5a 3e 73 9e e7 92 a8 eb  05 ad c2 aa e6 20 b3 e0  |Z>s.......... ..|
9e b5 e6 21 65 73 5c aa  fe 44 72 b2 32 8a d0 5b  |...!es\..Dr.2..[|
0c c8 f1 d9 26 45 b8 16  12 c2 38 1d e2 e6 ec 1c  |....&E....8.....|
ec 26 f2 ae c5 95 e4 22  ed 09 1d ac ee fe 4f 2e  |.&....."......O.|
89 20 9c 21 ed 00 e3 02  1b cb a4 2d 19 1e 3d 2c  |. .!.......-..=,|
7f ac e6 60 e1 fe e0 ce  63 6f b4 49 a3 8a 20 85  |...`....co.I.. .|
45 87 c4 b8 0d 98 2e c6  70 76 f3 ce 13 e4 df b6  |E.......pv......|
51 c3 fa 8c f6 c2 e0 f2  be 1a c6 66 15 2e be 2f  |Q..........f.../|