filenamexpsanalyzer.exe
size245704 (0x3bfc8)
md52cbea1c68580137bcda2732075843729
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
187307162
1883071620
1893071621
1853071613
10140
1933071614
183307161
186307161

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x501090c9
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion10.10
SizeOfCode0x33a00
SizeOfInitializedData0x4c00
SizeOfUninitializedData0
AddressOfEntryPoint0x2a0cb
BaseOfCode0x1000
BaseOfData0x35000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.2
ImageVersion6.2
SubsystemVersion6.0
Reserved10
SizeOfImage0x3b000
SizeOfHeaders0x400
CheckSum0x4232e
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x3397c0x33a00R-X CODE
.data0x350000x6680x200RW- IDATA
.idata0x360000xdc60xe00R-- IDATA
.rsrc0x370000x5e80x600R-- IDATA
.reloc0x380000x2e680x3000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x360000x8c
RESOURCE0x370000x5e8
EXCEPTION00
SECURITY0x384000x3bc8
BASERELOC0x380000x2468
DEBUG0x10300x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0xbdc00x40
Bound_IAT00
IAT0x362bc0x230
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#19200
MANIFEST#14270
module_namehintordfunction_name
KERNEL32.dll286DeleteCriticalSection
KERNEL32.dll957LeaveCriticalSection
KERNEL32.dll320EnterCriticalSection
KERNEL32.dll276DebugBreak
KERNEL32.dll1004MultiByteToWideChar
KERNEL32.dll1501WideCharToMultiByte
KERNEL32.dll973LocalFree
KERNEL32.dll869InitializeCriticalSection
KERNEL32.dll411FindNextFileW
KERNEL32.dll693GetProcAddress
KERNEL32.dll963LoadLibraryW
KERNEL32.dll142CloseHandle
KERNEL32.dll1427UnmapViewOfFile
KERNEL32.dll987MapViewOfFile
KERNEL32.dll853HeapSetInformation
KERNEL32.dll596GetFileSize
KERNEL32.dll214CreateFileW
KERNEL32.dll803GetVersionExW
KERNEL32.dll1256SetConsoleTextAttribute
KERNEL32.dll733GetStdHandle
KERNEL32.dll1391TerminateProcess
KERNEL32.dll547GetCurrentProcess
KERNEL32.dll1424UnhandledExceptionFilter
KERNEL32.dll784GetTickCount
KERNEL32.dll756GetSystemTimeAsFileTime
KERNEL32.dll552GetCurrentThreadId
KERNEL32.dll548GetCurrentProcessId
KERNEL32.dll1084QueryPerformanceCounter
KERNEL32.dll638GetModuleHandleA
KERNEL32.dll1360SetUnhandledExceptionFilter
KERNEL32.dll1044OutputDebugStringA
KERNEL32.dll875InterlockedCompareExchange
KERNEL32.dll878InterlockedExchange
KERNEL32.dll1375Sleep
KERNEL32.dll388FindClose
KERNEL32.dll618GetLastError
KERNEL32.dll1045OutputDebugStringW
KERNEL32.dll877InterlockedDecrement
KERNEL32.dll881InterlockedIncrement
KERNEL32.dll211CreateFileMappingW
KERNEL32.dll399FindFirstFileW
msvcrt.dll472_initterm
msvcrt.dll212__setusermatherr
msvcrt.dll190__p__fmode
msvcrt.dll276_cexit
msvcrt.dll355_exit
msvcrt.dll1171exit
msvcrt.dll210__set_app_type
msvcrt.dll225__wgetmainargs
msvcrt.dll257_amsg_exit
msvcrt.dll185__p__commode
msvcrt.dll106_XcptFilter
msvcrt.dll115__CxxFrameHandler3
msvcrt.dll99_CxxThrowException
msvcrt.dll274_callnewh
msvcrt.dll1250malloc
msvcrt.dll1194free
msvcrt.dll1263memcpy_s
msvcrt.dll11public: __thiscall exception::exception(class exception const &)

??0exception@@QAE@ABV0@@Z

msvcrt.dll1174fclose
msvcrt.dll1205fwrite
msvcrt.dll1191fputwc
msvcrt.dll128___mb_cur_max_func
msvcrt.dll5public: __thiscall bad_cast::bad_cast(class bad_cast const &)

??0bad_cast@@QAE@ABV0@@Z

msvcrt.dll14public: virtual __thiscall bad_cast::~bad_cast(void)

??1bad_cast@@UAE@XZ

msvcrt.dll1177fflush
msvcrt.dll1291setvbuf
msvcrt.dll1179fgetpos
msvcrt.dll1200fseek
msvcrt.dll1201fsetpos
msvcrt.dll1345ungetc
msvcrt.dll1178fgetc
msvcrt.dll17public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

msvcrt.dll1346ungetwc
msvcrt.dll1189fputc
msvcrt.dll566_itow
msvcrt.dll1296sprintf_s
msvcrt.dll1245localeconv
msvcrt.dll1260memchr
msvcrt.dll1308strcspn
msvcrt.dll1119_wstat
msvcrt.dll1043_wctime
msvcrt.dll343_errno
msvcrt.dll127___lc_handle_func
msvcrt.dll125___lc_codepage_func
msvcrt.dll1290setlocale
msvcrt.dll206__pctype_func
msvcrt.dll176__mb_cur_max
msvcrt.dll396_fsopen
msvcrt.dll1071_wfsopen
msvcrt.dll1227isupper
msvcrt.dll138__crtLCMapStringA
msvcrt.dll1223islower
msvcrt.dll139__crtLCMapStringW
msvcrt.dll137__crtGetStringTypeW
msvcrt.dll1146abort
msvcrt.dll219__uncaught_exception
msvcrt.dll407_ftol2_sse
msvcrt.dll406_ftol2
msvcrt.dll1265memmove_s
msvcrt.dll1010_wcsicmp
msvcrt.dll1396wprintf
msvcrt.dll1271printf
msvcrt.dll995_waccess
msvcrt.dll581_lock
msvcrt.dll937_unlock
msvcrt.dll141__dllonexit
msvcrt.dll750_onexit
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll295_controlfp
msvcrt.dll346_except_handler4_common
msvcrt.dll1181fgetwc
msvcrt.dll9public: __thiscall exception::exception(char const * const &)

??0exception@@QAE@ABQBD@Z

msvcrt.dll12public: __thiscall exception::exception(void)

??0exception@@QAE@XZ

msvcrt.dll16public: virtual __thiscall exception::~exception(void)

??1exception@@UAE@XZ

msvcrt.dll57public: virtual char const * __thiscall exception::what(void)const

?what@exception@@UBEPBDXZ

msvcrt.dll767_purecall
msvcrt.dll1266memset
ADVAPI32.dll198CryptDestroyHash
ADVAPI32.dll216CryptHashData
ADVAPI32.dll195CryptCreateHash
ADVAPI32.dll193CryptAcquireContextW
ADVAPI32.dll219CryptReleaseContext
ADVAPI32.dll212CryptGetHashParam
ole32.dll426StgIsStorageFile
ole32.dll152CreateStreamOnHGlobal
ole32.dll25CoCreateInstance
ole32.dll125CoUninitialize
ole32.dll78CoInitialize
ole32.dll121CoTaskMemFree
OLEAUT32.dll9
OLEAUT32.dll2
OLEAUT32.dll6
CRYPT32.dll64CertFreeCertificateContext

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionXPS Analysis Tool
FileVersion6.2.9200.16384 (win8_rtm.120725-1247)
InternalNameXpsAnalyzer.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameXpsAnalyzer.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.2.9200.16384

VS_FIXEDFILEINFO

FileVersion6.2.9200.16384
ProductVersion6.2.9200.16384
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0

Signers (1)

issuer: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Code Signing PCA
serial: 6119CC93000100000066

Certificates (4)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:19:cc:93:00:01:00:00:00:66
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Signing PCA
        Validity
            Not Before: Oct 10 20:32:25 2011 GMT
            Not After : Jan 10 20:32:25 2013 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=MOPR, CN=Microsoft Corporation
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:ee:5b:be:7d:11:24:e3:86:06:e0:66:ff:48:b5:
                    17:bd:02:e4:b4:0c:32:f0:72:3e:7d:2e:87:d7:4e:
                    a1:b1:a7:43:2f:f7:65:9e:31:e1:32:31:45:ae:d7:
                    c1:24:84:21:d7:2e:b5:84:7e:fa:35:d3:53:1c:d7:
                    b6:51:1e:4f:ce:66:b9:eb:b7:0c:02:fd:29:5c:ad:
                    a8:87:f6:ca:22:b4:d5:bf:08:75:f5:8a:70:8f:63:
                    d7:ef:8a:1e:e9:8f:43:24:64:5a:d3:87:7d:90:6d:
                    3b:ac:76:cd:57:36:7d:e8:bc:10:56:ac:98:f0:89:
                    5d:2e:64:c6:af:26:09:5e:1e:63:15:f1:3d:bf:16:
                    8f:99:88:02:c3:30:b7:c1:0b:60:1f:0f:72:cc:d6:
                    b7:a8:35:12:86:9b:a1:0b:0a:e6:93:5b:8e:fa:54:
                    9c:c1:f3:19:5f:42:8d:12:9f:1d:3f:90:b7:27:13:
                    83:19:32:82:1d:f3:d9:87:d4:21:b2:3c:a2:b6:07:
                    4f:d7:24:aa:ee:8d:f5:b3:d9:fa:f9:39:4f:a7:e9:
                    f2:af:59:52:f4:dc:41:9b:2f:11:70:63:dd:ea:de:
                    aa:f1:6d:21:04:10:53:33:bb:b2:4f:c5:e1:53:b2:
                    41:65:47:6e:37:f6:bc:e9:9b:16:41:91:6b:2e:5b:
                    30:c3
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                Code Signing
            X509v3 Subject Key Identifier: 
                1B:52:0E:F3:11:2A:B7:C0:89:C3:11:81:3D:D4:96:58:B9:A3:53:6E
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Authority Key Identifier: 
                keyid:CB:11:E8:CA:D2:B4:16:58:01:C9:37:2E:33:16:16:B9:4C:9A:0A:1F

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt

    Signature Algorithm: sha1WithRSAEncryption
         a5:5b:36:6c:ad:4e:9b:69:12:e3:6f:8a:02:9b:69:77:c3:6c:
         64:72:28:88:d9:3d:45:6d:2c:18:7b:d4:28:2f:13:e2:59:6a:
         1b:c2:0b:34:b7:8a:fd:ea:b9:94:ec:07:31:e6:6a:f4:75:04:
         d3:a7:da:5e:3a:06:9e:10:fd:a9:0d:bd:9c:51:43:6f:ff:67:
         94:9c:e1:cf:7c:f0:24:b0:35:cc:83:5d:ee:da:c0:6f:36:49:
         c0:5a:0a:57:f6:73:e1:9e:f3:e3:08:4c:3b:3e:2f:cc:d2:cd:
         ee:4f:22:70:f7:04:1f:02:a6:4b:9b:b8:8f:5c:88:0e:36:94:
         6c:33:07:b8:a9:ad:51:a0:d0:c2:dc:8e:22:12:bd:c3:df:82:
         d7:56:a1:f7:dd:f0:a5:20:57:10:10:9d:ee:ac:86:74:6c:71:
         9b:c1:f0:f2:c2:70:5e:a7:db:6d:4d:37:58:99:4d:79:40:d0:
         34:5d:5a:25:ae:67:eb:1b:4e:46:06:b0:8c:29:1f:a3:10:8f:
         a5:33:9f:23:d5:f8:b5:46:7d:e0:ee:63:98:90:4b:3e:05:a8:
         2f:b0:18:b3:59:a4:af:41:53:8e:08:05:10:2d:2a:c9:3a:06:
         4c:1c:2e:a9:31:51:56:64:ac:9a:cc:ac:97:98:29:8a:97:90:
         87:ea:9d:b6
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:05:13:36:00:00:00:00:00:1a
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Time-Stamp PCA
        Validity
            Not Before: Jul 25 20:42:17 2011 GMT
            Not After : Oct 25 20:42:17 2012 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=MOPR, OU=nCipher DSE ESN:159C-A3F7-2570, CN=Microsoft Time-Stamp Service
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:9c:34:98:19:c9:09:29:63:99:02:16:75:a8:88:
                    57:7d:a1:bb:a9:41:12:fc:64:91:a5:d6:05:78:bf:
                    77:dc:ec:e6:ae:b8:50:4e:c0:e3:1a:bd:ed:b7:fd:
                    f8:20:8a:71:39:aa:72:92:72:9f:8a:09:e5:13:ef:
                    91:41:ed:61:25:6b:51:ad:ee:a8:43:b5:61:42:2c:
                    9d:f2:1d:b1:d2:fc:b7:f5:7b:a3:73:76:13:b3:2b:
                    a3:db:94:61:80:55:a1:0f:6d:dd:d8:ec:16:ff:85:
                    7f:96:9e:88:7f:00:2e:8e:7a:24:ba:68:9d:8f:c6:
                    ca:f4:90:79:7a:e1:9b:ef:06:5d:7e:f8:2e:c3:6a:
                    15:9c:3c:14:2f:e7:d5:94:c8:22:1b:51:cb:a9:55:
                    86:21:b7:5a:f3:41:12:39:9f:f0:55:a9:4e:aa:25:
                    2b:63:fb:91:72:3c:0f:7c:c0:96:72:dc:c1:a3:c1:
                    08:ca:de:c5:c9:b5:c0:0a:5f:a5:9c:0b:aa:72:0a:
                    5d:0a:40:7d:2e:98:d0:ab:b2:88:8f:86:80:e8:7d:
                    d1:be:55:6b:e0:58:2c:c8:36:3f:f9:e6:11:c3:f0:
                    43:05:85:78:03:17:e5:2c:a7:29:7c:d3:e2:95:17:
                    00:6c:db:dc:ad:3c:19:3a:02:e0:7d:62:d4:ce:f6:
                    1d:3d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                F6:83:8B:20:87:11:EE:83:CB:DB:DE:85:A2:D2:68:86:37:61:74:90
            X509v3 Authority Key Identifier: 
                keyid:23:34:F8:D9:52:46:70:0A:ED:40:FB:76:FB:B3:2B:B0:C3:35:B3:0F

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt

            X509v3 Extended Key Usage: 
                Time Stamping
    Signature Algorithm: sha1WithRSAEncryption
         62:f4:05:0d:4f:e7:1b:6b:82:e7:52:0c:df:79:8c:a8:55:81:
         33:97:d3:a4:ca:c9:fe:af:48:db:7b:da:6f:7a:28:4f:c7:d0:
         b7:89:d8:d1:a6:99:cc:91:56:00:3b:38:e8:b7:32:2f:ee:f9:
         cf:6b:d9:98:de:d6:02:f5:42:58:52:6b:8e:da:40:dc:16:a0:
         b3:d4:bf:26:15:cb:48:42:cc:d3:fd:b4:fa:e4:44:89:66:0f:
         42:0e:5e:f7:04:9f:23:48:5b:b4:89:41:c4:da:6c:f8:36:f4:
         3f:c2:1e:15:df:98:4c:00:c4:b2:ec:de:5f:01:01:43:9c:b8:
         42:d6:22:c8:93:9a:9e:c9:a5:18:67:fc:47:84:1e:91:5d:9b:
         f2:76:f7:b1:8e:72:1d:80:76:3c:36:11:46:ca:7e:3a:48:f3:
         af:e3:49:f6:17:33:8d:bb:00:63:82:9c:57:a3:56:a7:c3:6e:
         90:a3:3e:95:b7:fc:64:d1:5d:18:c2:0b:01:50:63:a7:fc:f3:
         d1:80:9e:84:e3:32:34:dd:57:95:40:a3:6d:7e:da:eb:2e:5a:
         08:b4:10:06:5e:32:c9:09:e9:32:82:71:16:a7:fa:c6:af:66:
         98:89:f9:d9:9e:b5:5f:10:23:a3:77:80:f2:4d:d6:28:00:72:
         50:85:bc:e5
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:33:26:1a:00:00:00:00:00:31
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
        Validity
            Not Before: Aug 31 22:19:32 2010 GMT
            Not After : Aug 31 22:29:32 2020 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Signing PCA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b2:72:59:5c:19:30:64:bf:1d:9a:60:20:20:42:
                    99:76:53:6c:3e:1b:d6:6f:cc:cb:f1:ea:6b:fe:97:
                    16:10:e0:df:3a:74:83:1a:b7:2f:a0:32:ec:ff:de:
                    c2:42:4e:23:d5:72:00:db:35:57:0a:89:ca:ae:20:
                    49:f4:f0:68:ac:4d:4b:8d:a5:bd:79:4b:71:9b:47:
                    07:da:fd:25:df:9d:75:88:cf:aa:73:44:7f:d7:81:
                    db:f3:bd:f2:36:a4:c9:5c:45:dc:af:ad:3d:e0:28:
                    68:97:1a:a7:a5:72:73:56:f1:17:94:e4:fd:35:94:
                    72:a0:d6:76:5f:1e:77:45:83:85:38:16:d0:73:5b:
                    05:ba:67:52:8d:a5:b2:69:2f:da:19:0b:fe:92:74:
                    29:e2:76:2f:54:dd:14:30:59:f8:d2:8d:62:fd:cb:
                    c9:5f:46:31:50:b9:27:13:e4:40:30:cf:72:29:10:
                    28:22:c7:37:4e:3d:a0:32:3d:90:cd:a1:38:06:85:
                    5c:4e:56:82:28:2a:05:32:b7:4b:d7:4f:63:e7:d2:
                    2d:62:f1:45:3d:e7:ac:08:00:f6:46:a1:9e:d1:5b:
                    8c:26:53:e8:7a:aa:4a:f2:46:cf:37:3c:38:9e:b4:
                    77:5c:a5:17:9e:8d:cb:11:8f:56:3c:c1:ac:09:5f:
                    03:d3
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier: 
                CB:11:E8:CA:D2:B4:16:58:01:C9:37:2E:33:16:16:B9:4C:9A:0A:1F
            X509v3 Key Usage: 
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1: 
                .....
            1.3.6.1.4.1.311.21.2: 
                ....1N.&....`;.1o.<..-
            1.3.6.1.4.1.311.20.2: 
                .
.S.u.b.C.A
            X509v3 Authority Key Identifier: 
                keyid:0E:AC:82:60:40:56:27:97:E5:25:13:FC:2A:E1:0A:53:95:59:E4:A4

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt

    Signature Algorithm: sha1WithRSAEncryption
         59:39:3e:7f:26:46:af:eb:6f:40:b1:32:b5:6a:eb:0e:2f:6e:
         a8:49:f7:eb:5f:75:ed:4c:3b:2d:d7:43:ad:0b:fe:cb:e9:2d:
         31:a3:23:cc:7c:50:98:80:21:5d:ac:3d:2f:4c:ba:a2:a8:56:
         9c:e3:70:bb:b8:b4:f8:79:b5:49:72:f7:3e:ea:41:7f:ca:e1:
         0c:17:69:cb:a5:9c:20:2d:fa:0b:50:c4:56:cd:2d:e3:4a:d2:
         bc:70:e7:a8:0d:a2:03:a5:56:e0:b8:8a:4b:57:f2:95:42:9c:
         f1:f3:ef:ee:e3:86:1f:34:3c:b8:56:9a:f0:53:23:85:2a:a4:
         82:1c:93:e2:94:07:1d:f2:e2:4e:f8:8c:a1:ca:e8:13:a5:91:
         4e:c8:1b:d2:8f:72:95:2a:71:6d:9b:1a:f8:1c:f0:53:d6:67:
         cc:22:ff:5c:1d:cd:a2:8c:bd:27:b2:79:63:56:44:a2:51:cd:
         f9:e9:a3:58:56:dd:9b:02:45:44:2f:5f:f4:da:ae:d4:82:32:
         6e:fc:a4:95:13:e4:eb:69:e7:a9:a2:2c:be:c8:2b:10:0e:65:
         8e:99:db:f5:a2:fa:12:26:09:65:38:94:f1:7a:1f:4a:bb:d1:
         e1:56:e8:d0:78:96:18:5c:c9:35:16:5f:dd:93:1d:49:8e:2d:
         be:ad:34:44:1c:ee:10:15:1a:00:5d:dd:35:5b:21:ce:98:c7:
         09:ee:85:0e:8c:4f:6d:0e:13:4e:3d:7c:29:48:9c:72:d1:f3:
         6c:ca:c1:ec:70:a3:57:92:57:7d:94:8d:a0:1b:48:03:5a:f7:
         cf:a3:67:0a:74:a5:36:ed:2d:2f:17:c8:e6:72:37:12:f4:6f:
         b1:3c:67:82:f9:52:b2:8d:33:16:65:1e:0e:8a:dd:10:de:64:
         f4:6f:ce:46:d4:d3:17:e9:79:c4:04:b4:d3:fb:2c:df:1f:8a:
         9e:ac:0a:fb:13:27:40:ad:e4:f9:e1:a9:7f:46:bb:07:60:47:
         65:60:40:4e:b0:42:ec:4e:ed:b3:76:79:d8:0a:34:09:6d:1c:
         80:31:1f:e2:0e:54:dd:e5:a1:fb:e5:47:10:ad:64:98:ff:50:
         16:2e:7c:bf:05:21:7a:e2:95:41:27:69:c3:93:8f:95:c9:8d:
         d8:9b:21:ae:0d:5c:9c:f0:a2:ae:86:68:83:0c:6a:2d:bb:76:
         6b:00:1d:96:ad:f2:16:7b:f6:16:83:24:b9:88:cf:6a:a8:47:
         31:2f:9a:dc:e3:71:3d:d7:00:7e:62:47:d1:ce:88:c9:b8:18:
         fa:0e:72:8d:c1:a3:3d:af:02:40:6a:ff:69:9b:96:e2:10:a8:
         10:b4:37:50:08:d6:c3:3d
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:16:68:34:00:00:00:00:00:1c
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
        Validity
            Not Before: Apr  3 12:53:09 2007 GMT
            Not After : Apr  3 13:03:09 2021 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Time-Stamp PCA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:9f:a1:6c:b1:df:db:48:92:2a:7c:6b:2e:19:e1:
                    bd:e2:e3:c5:99:51:23:50:ad:ce:dd:18:4e:24:0f:
                    ee:d1:a7:d1:4c:ad:74:30:20:11:eb:07:d5:54:95:
                    15:49:94:1b:42:92:ae:98:5c:30:26:da:00:6b:e8:
                    7b:bd:ec:89:07:0f:f7:0e:04:98:f0:89:cc:1f:cb:
                    33:24:87:9d:f2:f4:67:1c:2c:fc:7b:e7:88:1d:ea:
                    e7:4e:a3:a1:c1:23:53:ca:8d:fa:45:cf:09:d0:5e:
                    af:d0:b0:42:04:a2:f9:a6:6c:93:67:d7:28:dc:46:
                    53:b0:86:d0:e5:28:46:2e:27:ac:86:4f:55:52:0c:
                    e4:03:2c:fb:6a:90:90:30:6e:87:f3:59:30:9d:fa:
                    7e:d6:97:b3:e8:21:97:7e:f8:d2:13:f3:08:b7:53:
                    6d:52:b4:45:90:9f:48:00:4a:47:66:11:27:29:66:
                    a8:97:e4:d3:06:81:4a:a2:f9:84:a7:11:47:14:09:
                    82:9f:84:ed:55:78:fe:01:9a:1d:50:08:85:00:10:
                    30:46:ed:b7:de:23:46:bb:c4:2d:54:9f:af:1e:78:
                    41:31:77:cc:9b:df:3b:83:93:a1:61:02:b5:1d:0d:
                    b1:fc:f7:9b:b2:01:ce:22:4b:54:ff:f9:05:c3:c2:
                    20:0b
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier: 
                23:34:F8:D9:52:46:70:0A:ED:40:FB:76:FB:B3:2B:B0:C3:35:B3:0F
            X509v3 Key Usage: 
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1: 
                ...
            X509v3 Authority Key Identifier: 
                keyid:0E:AC:82:60:40:56:27:97:E5:25:13:FC:2A:E1:0A:53:95:59:E4:A4
                DirName:/DC=com/DC=microsoft/CN=Microsoft Root Certificate Authority
                serial:79:AD:16:A1:4A:A0:A5:AD:4C:73:58:F4:07:13:2E:65

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt

            X509v3 Extended Key Usage: 
                Time Stamping
    Signature Algorithm: sha1WithRSAEncryption
         10:97:8a:c3:5c:03:44:36:dd:e9:b4:ad:77:db:ce:79:51:4d:
         01:b1:2e:74:71:5b:6d:0c:13:ab:ce:be:7b:8f:b8:2e:d4:12:
         a2:8c:6d:62:b8:57:02:cb:4e:20:13:50:99:dd:7a:40:e2:57:
         bb:af:58:9a:1c:e1:1d:01:86:ac:bb:78:f2:8b:d0:ec:3b:01:
         ee:e2:be:8f:0a:05:c8:8d:48:e2:f0:53:15:dd:4f:ab:92:e4:
         e7:8d:6a:d5:80:c1:e6:94:f2:06:2f:85:03:e9:91:2a:24:22:
         70:fb:f6:fc:e4:78:99:2e:0d:f7:07:e2:70:bc:18:4e:9d:8e:
         6b:0a:72:95:b8:a1:39:9c:67:2d:c5:51:0e:ea:62:5c:3f:16:
         98:8b:20:3f:e2:07:1a:32:f9:cc:31:4a:76:31:3d:2b:72:0b:
         c8:ea:70:3d:ff:85:0a:13:df:c2:0a:61:8e:f0:d7:b8:17:eb:
         4e:8b:7f:c5:35:2b:5e:a3:bf:eb:bc:7d:0b:42:7b:d4:53:72:
         21:ee:30:ca:bb:78:65:5c:5b:01:17:0a:14:0e:d2:da:14:98:
         f5:3c:b9:66:58:b3:2d:2f:e7:f9:85:86:cc:51:56:e8:9d:70:
         94:6c:ac:39:4c:d4:f6:79:bf:aa:18:7a:62:29:ef:a2:9b:29:
         34:06:77:1a:62:c9:3d:1e:6d:1f:82:f0:0b:c7:2c:bb:cf:43:
         b3:e5:f9:ec:7d:b5:e3:a4:a8:74:35:b8:4e:c5:71:23:12:26:
         76:0b:3c:52:8c:71:5a:46:43:14:bc:b3:b3:b0:4d:67:c8:9f:
         42:ff:80:79:21:80:9e:15:30:66:e8:42:12:5e:1a:c8:9e:22:
         21:d0:43:e9:2b:e9:bb:f4:48:cc:2c:d4:d8:32:80:4c:26:2a:
         48:24:5f:5a:ea:56:ef:a6:de:99:9d:ca:3a:6f:bd:81:27:74:
         06:11:ee:76:21:bf:9b:82:c1:27:54:b6:b1:6a:3d:89:a1:76:
         61:b4:6e:a1:13:a6:bf:aa:47:f0:12:6f:fd:8a:32:6c:b2:fe:
         df:51:c8:8c:23:c9:66:bd:9d:1d:87:12:64:02:3d:2d:af:59:
         8f:b8:e4:21:e5:b5:b0:ca:63:b4:78:54:05:d4:41:2e:50:ac:
         94:b0:a5:78:ab:b3:a0:96:75:1a:d9:92:87:13:75:22:2f:32:
         a8:08:6e:a0:5b:8c:25:bf:a0:ef:84:ca:21:d6:eb:1e:4f:c9:
         9a:ee:49:e0:f7:01:65:6f:89:0b:7d:c8:69:c8:e6:6e:ea:a7:
         97:ce:31:29:ff:0e:c5:5b:5c:d8:4d:1b:a1:d8:fa:2f:9e:3f:
         2e:55:16:6b:c9:13:a3:fd

undefined method `first' for #

offsetsizetypecomment
0230400EXE07/26/2012 00:35:21#
15c115HTM#
3840015304PKCS7Authenticode Signature#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK