nigga.sys

info
MZ
PE
imports
foremost
signature
hexdump
disasm
log
discuss
donate

filename	nigga.sys
size	2698280 (0x292c28)
md5	6a998acb9fe3ef176249ec7736896e21

type	PE32+ executable (native) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	9
TimeDateStamp	0x5dae2e3a
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.16
SizeOfCode	0x3c00
SizeOfInitializedData	0x1ba00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x2649e9
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	10.0
ImageVersion	10.0
SubsystemVersion	10.0
Reserved1	0
SizeOfImage	0x403000
SizeOfHeaders	0x400
CheckSum	0x29bbe7
Subsystem	1
DllCharacteristics	0x160
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x34ef	0	R-X CODE
.rdata	0x5000	0x6cc	0	R-- IDATA
.data	0x6000	0x1ab48	0	RW- IDATA
.pdata	0x21000	0x204	0	R-- IDATA
INIT	0x22000	0x48a	0	R-X CODE
.vmp0	0x23000	0x14c1cf	0	R-X CODE IDATA
.vmp1	0x170000	8	0x200	RW- IDATA
.vmp2	0x171000	0x290f48	0x291000	R-X CODE IDATA
.reloc	0x402000	0xc4	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x2952d0	0x64
RESOURCE	0	0
EXCEPTION	0x401bd0	0x378
SECURITY	0x291800	0x1428
BASERELOC	0x402000	0xc4
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x401ac0	0x108
Bound_IAT	0	0
IAT	0x2a2000	0x98
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	ord	function_name
ntoskrnl.exe			MmUnlockPages
WDFLDR.SYS			WdfVersionUnbind
ntoskrnl.exe			ExAllocatePool
ntoskrnl.exe			NtQuerySystemInformation
ntoskrnl.exe			ExFreePoolWithTag
ntoskrnl.exe			IoAllocateMdl
ntoskrnl.exe			MmProbeAndLockPages
ntoskrnl.exe			MmMapLockedPagesSpecifyCache
ntoskrnl.exe			MmUnlockPages
ntoskrnl.exe			IoFreeMdl
ntoskrnl.exe			KeQueryActiveProcessors
ntoskrnl.exe			KeSetSystemAffinityThread
ntoskrnl.exe			KeRevertToUserAffinityThread
ntoskrnl.exe			DbgPrint
HAL.dll			KeQueryPerformanceCounter

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Code Signing 2010 CA

serial: 5F78149EB4F75EB17404A8143AAEAED7

Certificates (3)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5f:78:14:9e:b4:f7:5e:b1:74:04:a8:14:3a:ae:ae:d7
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
        Validity
            Not Before: Mar 23 00:00:00 2011 GMT
            Not After : Mar 22 23:59:59 2012 GMT
        Subject: C=CN, ST=Shanghai, L=Shanghai, O=\xE4\xB8\x8A\xE6\xB5\xB7\xE5\x9F\x9F\xE8\x81\x94\xE8\xBD\xAF\xE4\xBB\xB6\xE6\x8A\x80\xE6\x9C\xAF\xE6\x9C\x89\xE9\x99\x90\xE5\x85\xAC\xE5\x8F\xB8, OU=Digital ID Class 3 - Microsoft Software Validation v2, CN=\xE4\xB8\x8A\xE6\xB5\xB7\xE5\x9F\x9F\xE8\x81\x94\xE8\xBD\xAF\xE4\xBB\xB6\xE6\x8A\x80\xE6\x9C\xAF\xE6\x9C\x89\xE9\x99\x90\xE5\x85\xAC\xE5\x8F\xB8
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:eb:f4:21:e5:22:65:71:57:ad:04:53:09:94:91:
                    8a:0c:fc:5b:86:68:fd:f8:3a:d9:cd:19:5e:dc:81:
                    41:89:b4:e8:eb:23:f0:81:28:4c:1b:29:bd:52:7d:
                    ac:f4:dc:68:fe:bb:3b:4a:e1:49:a9:17:80:3d:4a:
                    2b:af:1e:0e:16:78:33:3c:2e:c8:4c:8a:99:cc:64:
                    c2:78:24:f1:f9:c1:6e:92:98:2b:dd:97:aa:cb:65:
                    09:bd:d8:c6:b9:d8:92:f0:20:14:3a:c5:51:0e:9c:
                    45:5b:38:e2:b9:89:94:89:9d:26:cb:cb:89:a5:b9:
                    02:b9:15:3a:d5:db:a2:08:9a:38:17:33:e1:3f:c8:
                    fe:93:0d:05:21:a4:aa:41:3e:31:e3:79:cc:60:43:
                    89:c7:01:a3:1b:aa:0b:54:c6:0e:1f:eb:ae:c4:20:
                    44:fe:f7:21:2e:e7:46:a7:66:33:aa:d5:44:b3:30:
                    87:27:90:4a:7d:b5:d7:26:26:03:c9:b6:72:9a:28:
                    34:b2:e9:a9:fc:39:f8:5e:9b:aa:3e:48:1d:bd:ce:
                    bb:19:0f:1a:9c:51:c0:f4:f9:66:be:59:89:34:0f:
                    16:7b:08:1a:88:e4:23:a8:e5:fd:d5:27:15:0b:16:
                    52:35:9b:cc:bd:b0:20:be:a1:bd:53:58:98:51:e9:
                    e7:05
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://csc3-2010-crl.verisign.com/CSC3-2010.crl

            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/rpa

            X509v3 Extended Key Usage: 
                Code Signing
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
                CA Issuers - URI:http://csc3-2010-aia.verisign.com/CSC3-2010.cer

            X509v3 Authority Key Identifier: 
                keyid:CF:99:A9:EA:7B:26:F4:4B:C9:8E:8F:D7:F0:05:26:EF:E3:D2:A7:9D

            Netscape Cert Type: 
                Object Signing
            1.3.6.1.4.1.311.2.1.27: 
                0.......
    Signature Algorithm: sha1WithRSAEncryption
         1d:cd:f3:05:c0:80:e4:03:f1:87:f6:9a:76:4e:a4:e6:0b:9d:
         1a:20:11:57:14:18:1d:ca:05:9a:2e:10:d1:2f:11:f4:04:40:
         5c:01:f3:ca:5f:5d:1e:35:6c:b7:84:8a:8e:5a:2c:ae:d5:a3:
         98:44:fd:54:59:e3:a1:b3:90:11:29:3e:93:6e:80:9d:b5:62:
         fa:2a:67:32:99:03:5c:26:43:08:9d:e4:8e:2e:48:e7:2b:20:
         7b:5e:74:bb:62:51:44:24:17:a4:b4:ce:18:ed:53:32:6b:69:
         34:1c:ca:49:ab:81:e8:1a:51:e3:01:93:19:c2:de:8a:39:df:
         72:d7:c1:c9:3f:b1:b4:46:f6:78:20:59:f0:83:5e:ec:fa:fa:
         33:28:7f:44:dc:a9:c5:ce:41:ab:02:cb:c7:d0:14:58:3b:54:
         88:5b:0e:25:54:34:cc:80:d8:d8:3f:40:8b:63:a2:af:25:51:
         0e:48:e6:51:f4:50:4f:b7:8c:2a:51:14:32:96:b3:93:00:7b:
         5e:db:38:80:ae:1c:bf:b8:41:3e:ce:0d:1c:ca:8a:be:e6:bb:
         48:d7:7f:b6:cd:2a:7b:84:81:51:63:e2:17:44:bf:d8:f8:34:
         ad:e6:1e:dc:9c:22:f0:4b:c6:76:4e:58:a7:e1:01:d9:4d:72:
         d7:1d:7a:68

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:19:93:e4:00:00:00:00:00:1c
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Verification Root
        Validity
            Not Before: Feb 22 19:25:17 2011 GMT
            Not After : Feb 22 19:35:17 2021 GMT
        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:af:24:08:08:29:7a:35:9e:60:0c:aa:e7:4b:3b:
                    4e:dc:7c:bc:3c:45:1c:bb:2b:e0:fe:29:02:f9:57:
                    08:a3:64:85:15:27:f5:f1:ad:c8:31:89:5d:22:e8:
                    2a:aa:a6:42:b3:8f:f8:b9:55:b7:b1:b7:4b:b3:fe:
                    8f:7e:07:57:ec:ef:43:db:66:62:15:61:cf:60:0d:
                    a4:d8:de:f8:e0:c3:62:08:3d:54:13:eb:49:ca:59:
                    54:85:26:e5:2b:8f:1b:9f:eb:f5:a1:91:c2:33:49:
                    d8:43:63:6a:52:4b:d2:8f:e8:70:51:4d:d1:89:69:
                    7b:c7:70:f6:b3:dc:12:74:db:7b:5d:4b:56:d3:96:
                    bf:15:77:a1:b0:f4:a2:25:f2:af:1c:92:67:18:e5:
                    f4:06:04:ef:90:b9:e4:00:e4:dd:3a:b5:19:ff:02:
                    ba:f4:3c:ee:e0:8b:eb:37:8b:ec:f4:d7:ac:f2:f6:
                    f0:3d:af:dd:75:91:33:19:1d:1c:40:cb:74:24:19:
                    21:93:d9:14:fe:ac:2a:52:c7:8f:d5:04:49:e4:8d:
                    63:47:88:3c:69:83:cb:fe:47:bd:2b:7e:4f:c5:95:
                    ae:0e:9d:d4:d1:43:c0:67:73:e3:14:08:7e:e5:3f:
                    9f:73:b8:33:0a:cf:5d:3f:34:87:96:8a:ee:53:e8:
                    25:15
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Certificate Policies: 
                Policy: X509v3 Any Policy

            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: 
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier: 
                7F:D3:65:A7:C2:DD:EC:BB:F0:30:09:F3:43:39:FA:02:AF:33:31:33
            X509v3 Authority Key Identifier: 
                keyid:62:FB:0A:21:5B:7F:43:6E:11:DA:09:54:50:6B:F5:D2:96:71:F1:9E

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl

    Signature Algorithm: sha1WithRSAEncryption
         81:2a:82:16:8c:34:67:2b:e5:03:eb:34:7b:8c:a2:a3:50:8a:
         f4:55:86:f1:1e:8c:8e:ae:7d:ee:03:19:ce:72:95:18:48:ad:
         62:11:fd:20:fd:3f:47:06:01:5a:e2:e0:6f:8c:15:2c:4e:3c:
         6a:50:6c:0b:36:a3:cf:7a:0d:9c:42:bc:5c:f8:19:d5:60:e3:
         69:e6:e2:23:41:67:8c:68:83:76:2b:8f:93:a3:2a:b5:7f:be:
         59:fb:a9:c9:b2:26:8f:ca:a2:f3:82:1b:98:3e:91:95:27:97:
         86:61:ee:5b:5d:07:6b:cd:86:a8:e2:65:80:a8:e2:15:e2:b2:
         be:23:05:6a:ba:0c:f3:47:93:4d:ac:a4:8c:07:79:39:c0:61:
         12:3a:05:0d:89:a3:ec:9f:57:89:84:fb:ec:ca:7c:47:66:14:
         91:d8:b6:0f:19:5d:e6:b8:4a:ac:bc:47:c8:71:43:96:e6:32:
         20:a5:dc:77:86:fd:3c:e3:8b:71:db:7b:9b:03:fc:b7:1d:32:
         64:eb:16:52:a0:43:a3:fa:2e:ad:59:92:4e:7c:c7:f2:33:42:
         48:38:51:3a:7c:38:c7:1b:24:22:28:40:1e:1a:46:1f:17:db:
         18:f7:f0:27:35:6c:b8:63:d9:cd:b9:64:5d:2b:a5:5e:ef:c6:
         29:b4:f2:c7:f8:21:cc:04:ba:57:fd:01:b6:ab:c6:67:f9:e7:
         d3:99:7f:f4:f5:22:fa:72:f5:fd:ff:3a:1c:42:3a:a1:f9:80:
         18:a5:ee:8d:1c:d4:66:9e:45:01:fe:aa:ee:ff:fb:17:8f:30:
         f7:f1:cd:29:c5:9d:ec:b5:d5:49:00:3d:85:b8:cb:bb:93:3a:
         27:6a:49:c0:30:ae:66:c9:f7:23:28:32:76:f9:a4:83:56:c8:
         48:ce:5a:96:aa:a0:cc:0c:c4:7f:b4:8e:97:af:6d:e3:54:27:
         c3:9f:86:c0:d6:e4:73:08:97:05:db:d0:54:62:5e:03:48:c2:
         d5:9f:7f:a7:66:8c:d0:9d:b0:4f:d4:d3:98:5f:4b:7a:c9:7f:
         b2:29:52:d0:12:80:c7:0f:54:b6:1e:67:cd:c6:a0:6c:11:03:
         84:d3:48:75:e7:2a:fe:b0:3b:6e:0a:3a:a6:6b:76:99:05:a3:
         f1:77:68:61:33:14:47:06:fc:53:7f:52:bd:92:14:5c:4a:24:
         6a:67:8c:af:8d:90:aa:d0:f6:79:21:1b:93:26:7c:c3:ce:1e:
         bd:88:38:92:ae:45:c6:19:6a:49:50:b3:05:f8:ae:59:37:8a:
         6a:25:03:94:b1:59:81:50:e8:ba:83:80:b7:23:35:f4:76:b9:
         67:1d:59:18:ad:20:8d:94

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
        Validity
            Not Before: Feb  8 00:00:00 2010 GMT
            Not After : Feb  7 23:59:59 2020 GMT
        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:f5:23:4b:5e:a5:d7:8a:bb:32:e9:d4:57:f7:ef:
                    e4:c7:26:7e:ad:19:98:fe:a8:9d:7d:94:f6:36:6b:
                    10:d7:75:81:30:7f:04:68:7f:cb:2b:75:1e:cd:1d:
                    08:8c:df:69:94:a7:37:a3:9c:7b:80:e0:99:e1:ee:
                    37:4d:5f:ce:3b:14:ee:86:d4:d0:f5:27:35:bc:25:
                    0b:38:a7:8c:63:9d:17:a3:08:a5:ab:b0:fb:cd:6a:
                    62:82:4c:d5:21:da:1b:d9:f1:e3:84:3b:8a:2a:4f:
                    85:5b:90:01:4f:c9:a7:76:10:7f:27:03:7c:be:ae:
                    7e:7d:c1:dd:f9:05:bc:1b:48:9c:69:e7:c0:a4:3c:
                    3c:41:00:3e:df:96:e5:c5:e4:94:71:d6:55:01:c7:
                    00:26:4a:40:3c:b5:a1:26:a9:0c:a7:6d:80:8e:90:
                    25:7b:cf:bf:3f:1c:eb:2f:96:fa:e5:87:77:c6:b5:
                    56:b2:7a:3b:54:30:53:1b:df:62:34:ff:1e:d1:f4:
                    5a:93:28:85:e5:4c:17:4e:7e:5b:fd:a4:93:99:7f:
                    df:cd:ef:a4:75:ef:ef:15:f6:47:e7:f8:19:72:d8:
                    2e:34:1a:a6:b4:a7:4c:7e:bd:bb:4f:0c:3d:57:f1:
                    30:d6:a6:36:8e:d6:80:76:d7:19:2e:a5:cd:7e:34:
                    2d:89
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/cps
                  User Notice:
                    Explicit Text: https://www.verisign.com/rpa

            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            1.3.6.1.5.5.7.1.12: 
                0_.].[0Y0W0U..image/gif0!0.0...+..............k...j.H.,{..0%.#http://logo.verisign.com/vslogo.gif
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.verisign.com/pca3-g5.crl

            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com

            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, Code Signing
            X509v3 Subject Alternative Name: 
                DirName:/CN=VeriSignMPKI-2-8
            X509v3 Subject Key Identifier: 
                CF:99:A9:EA:7B:26:F4:4B:C9:8E:8F:D7:F0:05:26:EF:E3:D2:A7:9D
            X509v3 Authority Key Identifier: 
                keyid:7F:D3:65:A7:C2:DD:EC:BB:F0:30:09:F3:43:39:FA:02:AF:33:31:33

    Signature Algorithm: sha1WithRSAEncryption
         56:22:e6:34:a4:c4:61:cb:48:b9:01:ad:56:a8:64:0f:d9:8c:
         91:c4:bb:cc:0c:e5:ad:7a:a0:22:7f:df:47:38:4a:2d:6c:d1:
         7f:71:1a:7c:ec:70:a9:b1:f0:4f:e4:0f:0c:53:fa:15:5e:fe:
         74:98:49:24:85:81:26:1c:91:14:47:b0:4c:63:8c:bb:a1:34:
         d4:c6:45:e8:0d:85:26:73:03:d0:a9:8c:64:6d:dc:71:92:e6:
         45:05:60:15:59:51:39:fc:58:14:6b:fe:d4:a4:ed:79:6b:08:
         0c:41:72:e7:37:22:06:09:be:23:e9:3f:44:9a:1e:e9:61:9d:
         cc:b1:90:5c:fc:3d:d2:8d:ac:42:3d:65:36:d4:b4:3d:40:28:
         8f:9b:10:cf:23:26:cc:4b:20:cb:90:1f:5d:8c:4c:34:ca:3c:
         d8:e5:37:d6:6f:a5:20:bd:34:eb:26:d9:ae:0d:e7:c5:9a:f7:
         a1:b4:21:91:33:6f:86:e8:58:bb:25:7c:74:0e:58:fe:75:1b:
         63:3f:ce:31:7c:9b:8f:1b:96:9e:c5:53:76:84:5b:9c:ad:91:
         fa:ac:ed:93:ba:5d:c8:21:53:c2:82:53:63:af:12:0d:50:87:
         11:1b:3d:54:52:96:8a:2c:9c:3d:92:1a:08:9a:05:2e:c7:93:
         a5:48:91:d3

pkcs7-signedData

SHA1: nil

1.3.6.1.4.1.311.2.1.4

1.3.6.1.4.1.311.2.1.15
- :

SHA1

ad 77 f7 b8 a4 c1 00 b2 6a ed e5 e4 f8 6c c6 71 |.w......j....l.q| 2d 1f b6 ff |-... |

Certificates

Certificate #0

2
- 5F:78:14:9E:B4:F7:5E:B1:74:04:A8:14:3A:AE:AE:D7
- RSA-SHA1: nil
- Issuer
  - C: US
  - O: VeriSign, Inc.
  - OU: VeriSign Trust Network
  - OU: Terms of use at https://www.verisign.com/rpa (c)10
  - CN: VeriSign Class 3 Code Signing 2010 CA
- 2011-03-23 00:00:00 UTC: 2012-03-22 23:59:59 UTC
- Subject
  - C: CN
  - ST: Shanghai
  - L: Shanghai
  - O:
```
e4 b8 8a e6 b5 b7 e5 9f  9f e8 81 94 e8 bd af e4  |................|
bb b6 e6 8a 80 e6 9c af  e6 9c 89 e9 99 90 e5 85  |................|
ac e5 8f b8                                       |....            |
```
  - OU: Digital ID Class 3 - Microsoft Software Validation v2
  - CN:
```
e4 b8 8a e6 b5 b7 e5 9f  9f e8 81 94 e8 bd af e4  |................|
bb b6 e6 8a 80 e6 9c af  e6 9c 89 e9 99 90 e5 85  |................|
ac e5 8f b8                                       |....            |
```
- #5
  - rsaEncryption: nil
  - EB:F4:21:E5:22:65:71:57:AD:04:53:09:94:91:8A:0C:
    FC:5B:86:68:FD:F8:3A:D9:CD:19:5E:DC:81:41:89:B4:
    E8:EB:23:F0:81:28:4C:1B:29:BD:52:7D:AC:F4:DC:68:
    FE:BB:3B:4A:E1:49:A9:17:80:3D:4A:2B:AF:1E:0E:16:
    78:33:3C:2E:C8:4C:8A:99:CC:64:C2:78:24:F1:F9:C1:
    6E:92:98:2B:DD:97:AA:CB:65:09:BD:D8:C6:B9:D8:92:
    F0:20:14:3A:C5:51:0E:9C:45:5B:38:E2:B9:89:94:89:
    9D:26:CB:CB:89:A5:B9:02:B9:15:3A:D5:DB:A2:08:9A:
    38:17:33:E1:3F:C8:FE:93:0D:05:21:A4:AA:41:3E:31:
    E3:79:CC:60:43:89:C7:01:A3:1B:AA:0B:54:C6:0E:1F:
    EB:AE:C4:20:44:FE:F7:21:2E:E7:46:A7:66:33:AA:D5:
    44:B3:30:87:27:90:4A:7D:B5:D7:26:26:03:C9:B6:72:
    9A:28:34:B2:E9:A9:FC:39:F8:5E:9B:AA:3E:48:1D:BD:
    CE:BB:19:0F:1A:9C:51:C0:F4:F9:66:BE:59:89:34:0F:
    16:7B:08:1A:88:E4:23:A8:E5:FD:D5:27:15:0B:16:52:
    35:9B:CC:BD:B0:20:BE:A1:BD:53:58:98:51:E9:E7:05: 0x010001
- X509v3 extensions
  - basicConstraints
    - nil
  - keyUsage: true, 0x80
  - crlDistributionPoints: http://csc3-2010-crl.verisign.com/CSC3-2010.crl
  - certificatePolicies
    - 2.16.840.1.113733.1.7.23.3
      - id-qt-cps: https://www.verisign.com/rpa
  - extendedKeyUsage: codeSigning
  - authorityInfoAccess
    - #0
      - OCSP: http://ocsp.verisign.com
      - caIssuers: http://csc3-2010-aia.verisign.com/CSC3-2010.cer
  - authorityKeyIdentifier:
```
cf 99 a9 ea 7b 26 f4 4b  c9 8e 8f d7 f0 05 26 ef  |....{&.K......&.|
e3 d2 a7 9d                                       |....            |
```
  - nsCertType: 0x10
  - 1.3.6.1.4.1.311.2.1.27
    - false: true

RSA-SHA1:

1d cd f3 05 c0 80 e4 03  f1 87 f6 9a 76 4e a4 e6  |............vN..|
0b 9d 1a 20 11 57 14 18  1d ca 05 9a 2e 10 d1 2f  |... .W........./|
11 f4 04 40 5c 01 f3 ca  5f 5d 1e 35 6c b7 84 8a  |...@\..._].5l...|
8e 5a 2c ae d5 a3 98 44  fd 54 59 e3 a1 b3 90 11  |.Z,....D.TY.....|
29 3e 93 6e 80 9d b5 62  fa 2a 67 32 99 03 5c 26  |)>.n...b.*g2..\&|
43 08 9d e4 8e 2e 48 e7  2b 20 7b 5e 74 bb 62 51  |C.....H.+ {^t.bQ|
44 24 17 a4 b4 ce 18 ed  53 32 6b 69 34 1c ca 49  |D$......S2ki4..I|
ab 81 e8 1a 51 e3 01 93  19 c2 de 8a 39 df 72 d7  |....Q.......9.r.|
c1 c9 3f b1 b4 46 f6 78  20 59 f0 83 5e ec fa fa  |..?..F.x Y..^...|
33 28 7f 44 dc a9 c5 ce  41 ab 02 cb c7 d0 14 58  |3(.D....A......X|
3b 54 88 5b 0e 25 54 34  cc 80 d8 d8 3f 40 8b 63  |;T.[.%T4....?@.c|
a2 af 25 51 0e 48 e6 51  f4 50 4f b7 8c 2a 51 14  |..%Q.H.Q.PO..*Q.|
32 96 b3 93 00 7b 5e db  38 80 ae 1c bf b8 41 3e  |2....{^.8.....A>|
ce 0d 1c ca 8a be e6 bb  48 d7 7f b6 cd 2a 7b 84  |........H....*{.|
81 51 63 e2 17 44 bf d8  f8 34 ad e6 1e dc 9c 22  |.Qc..D...4....."|
f0 4b c6 76 4e 58 a7 e1  01 d9 4d 72 d7 1d 7a 68  |.K.vNX....Mr..zh|

Certificate #1

2
- 61:19:93:E4:00:00:00:00:00:1C
- RSA-SHA1: nil
- Issuer
  - C: US
  - ST: Washington
  - L: Redmond
  - O: Microsoft Corporation
  - CN: Microsoft Code Verification Root
- 2011-02-22 19:25:17 UTC: 2021-02-22 19:35:17 UTC
- Subject
  - C: US
  - O: VeriSign, Inc.
  - OU: VeriSign Trust Network
  - OU: (c) 2006 VeriSign, Inc. - For authorized use only
  - CN: VeriSign Class 3 Public Primary Certification Authority - G5
- #5
  - rsaEncryption: nil
  - AF:24:08:08:29:7A:35:9E:60:0C:AA:E7:4B:3B:4E:DC:
    7C:BC:3C:45:1C:BB:2B:E0:FE:29:02:F9:57:08:A3:64:
    85:15:27:F5:F1:AD:C8:31:89:5D:22:E8:2A:AA:A6:42:
    B3:8F:F8:B9:55:B7:B1:B7:4B:B3:FE:8F:7E:07:57:EC:
    EF:43:DB:66:62:15:61:CF:60:0D:A4:D8:DE:F8:E0:C3:
    62:08:3D:54:13:EB:49:CA:59:54:85:26:E5:2B:8F:1B:
    9F:EB:F5:A1:91:C2:33:49:D8:43:63:6A:52:4B:D2:8F:
    E8:70:51:4D:D1:89:69:7B:C7:70:F6:B3:DC:12:74:DB:
    7B:5D:4B:56:D3:96:BF:15:77:A1:B0:F4:A2:25:F2:AF:
    1C:92:67:18:E5:F4:06:04:EF:90:B9:E4:00:E4:DD:3A:
    B5:19:FF:02:BA:F4:3C:EE:E0:8B:EB:37:8B:EC:F4:D7:
    AC:F2:F6:F0:3D:AF:DD:75:91:33:19:1D:1C:40:CB:74:
    24:19:21:93:D9:14:FE:AC:2A:52:C7:8F:D5:04:49:E4:
    8D:63:47:88:3C:69:83:CB:FE:47:BD:2B:7E:4F:C5:95:
    AE:0E:9D:D4:D1:43:C0:67:73:E3:14:08:7E:E5:3F:9F:
    73:B8:33:0A:CF:5D:3F:34:87:96:8A:EE:53:E8:25:15: 0x010001
- #6
  - certificatePolicies: anyPolicy
  - basicConstraints: true, true
  - keyUsage: 0x86
  - subjectKeyIdentifier:
```
7f d3 65 a7 c2 dd ec bb  f0 30 09 f3 43 39 fa 02  |..e......0..C9..|
af 33 31 33                                       |.313            |
```
  - authorityKeyIdentifier:
```
62 fb 0a 21 5b 7f 43 6e  11 da 09 54 50 6b f5 d2  |b..![.Cn...TPk..|
96 71 f1 9e                                       |.q..            |
```
  - crlDistributionPoints: http://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl

RSA-SHA1:

81 2a 82 16 8c 34 67 2b  e5 03 eb 34 7b 8c a2 a3  |.*...4g+...4{...|
50 8a f4 55 86 f1 1e 8c  8e ae 7d ee 03 19 ce 72  |P..U......}....r|
95 18 48 ad 62 11 fd 20  fd 3f 47 06 01 5a e2 e0  |..H.b.. .?G..Z..|
6f 8c 15 2c 4e 3c 6a 50  6c 0b 36 a3 cf 7a 0d 9c  |o..,N..'..a.[|
5d 07 6b cd 86 a8 e2 65  80 a8 e2 15 e2 b2 be 23  |].k....e.......#|
05 6a ba 0c f3 47 93 4d  ac a4 8c 07 79 39 c0 61  |.j...G.M....y9.a|
12 3a 05 0d 89 a3 ec 9f  57 89 84 fb ec ca 7c 47  |.:......W.....|G|
66 14 91 d8 b6 0f 19 5d  e6 b8 4a ac bc 47 c8 71  |f......]..J..G.q|
43 96 e6 32 20 a5 dc 77  86 fd 3c e3 8b 71 db 7b  |C..2 ..w..<..q.{|
9b 03 fc b7 1d 32 64 eb  16 52 a0 43 a3 fa 2e ad  |.....2d..R.C....|
59 92 4e 7c c7 f2 33 42  48 38 51 3a 7c 38 c7 1b  |Y.N|..3BH8Q:|8..|
24 22 28 40 1e 1a 46 1f  17 db 18 f7 f0 27 35 6c  |$"(@..F......'5l|
b8 63 d9 cd b9 64 5d 2b  a5 5e ef c6 29 b4 f2 c7  |.c...d]+.^..)...|
f8 21 cc 04 ba 57 fd 01  b6 ab c6 67 f9 e7 d3 99  |.!...W.....g....|
7f f4 f5 22 fa 72 f5 fd  ff 3a 1c 42 3a a1 f9 80  |...".r...:.B:...|
18 a5 ee 8d 1c d4 66 9e  45 01 fe aa ee ff fb 17  |......f.E.......|
8f 30 f7 f1 cd 29 c5 9d  ec b5 d5 49 00 3d 85 b8  |.0...).....I.=..|
cb bb 93 3a 27 6a 49 c0  30 ae 66 c9 f7 23 28 32  |...:'jI.0.f..#(2|
76 f9 a4 83 56 c8 48 ce  5a 96 aa a0 cc 0c c4 7f  |v...V.H.Z.......|
b4 8e 97 af 6d e3 54 27  c3 9f 86 c0 d6 e4 73 08  |....m.T'......s.|
97 05 db d0 54 62 5e 03  48 c2 d5 9f 7f a7 66 8c  |....Tb^.H.....f.|
d0 9d b0 4f d4 d3 98 5f  4b 7a c9 7f b2 29 52 d0  |...O..._Kz...)R.|
12 80 c7 0f 54 b6 1e 67  cd c6 a0 6c 11 03 84 d3  |....T..g...l....|
48 75 e7 2a fe b0 3b 6e  0a 3a a6 6b 76 99 05 a3  |Hu.*..;n.:.kv...|
f1 77 68 61 33 14 47 06  fc 53 7f 52 bd 92 14 5c  |.wha3.G..S.R...\|
4a 24 6a 67 8c af 8d 90  aa d0 f6 79 21 1b 93 26  |J$jg.......y!..&|
7c c3 ce 1e bd 88 38 92  ae 45 c6 19 6a 49 50 b3  ||.....8..E..jIP.|
05 f8 ae 59 37 8a 6a 25  03 94 b1 59 81 50 e8 ba  |...Y7.j%...Y.P..|
83 80 b7 23 35 f4 76 b9  67 1d 59 18 ad 20 8d 94  |...#5.v.g.Y.. ..|

Certificate #2
- 2
  - 52:00:E5:AA:25:56:FC:1A:86:ED:96:C9:D4:4B:33:C7
  - RSA-SHA1: nil
  - Issuer
    - C: US
    - O: VeriSign, Inc.
    - OU: VeriSign Trust Network
    - OU: (c) 2006 VeriSign, Inc. - For authorized use only
    - CN: VeriSign Class 3 Public Primary Certification Authority - G5
  - 2010-02-08 00:00:00 UTC: 2020-02-07 23:59:59 UTC
  - Subject
    - C: US
    - O: VeriSign, Inc.
    - OU: VeriSign Trust Network
    - OU: Terms of use at https://www.verisign.com/rpa (c)10
    - CN: VeriSign Class 3 Code Signing 2010 CA
  - #5
    - rsaEncryption: nil
    - F5:23:4B:5E:A5:D7:8A:BB:32:E9:D4:57:F7:EF:E4:C7:
      26:7E:AD:19:98:FE:A8:9D:7D:94:F6:36:6B:10:D7:75:
      81:30:7F:04:68:7F:CB:2B:75:1E:CD:1D:08:8C:DF:69:
      94:A7:37:A3:9C:7B:80:E0:99:E1:EE:37:4D:5F:CE:3B:
      14:EE:86:D4:D0:F5:27:35:BC:25:0B:38:A7:8C:63:9D:
      17:A3:08:A5:AB:B0:FB:CD:6A:62:82:4C:D5:21:DA:1B:
      D9:F1:E3:84:3B:8A:2A:4F:85:5B:90:01:4F:C9:A7:76:
      10:7F:27:03:7C:BE:AE:7E:7D:C1:DD:F9:05:BC:1B:48:
      9C:69:E7:C0:A4:3C:3C:41:00:3E:DF:96:E5:C5:E4:94:
      71:D6:55:01:C7:00:26:4A:40:3C:B5:A1:26:A9:0C:A7:
      6D:80:8E:90:25:7B:CF:BF:3F:1C:EB:2F:96:FA:E5:87:
      77:C6:B5:56:B2:7A:3B:54:30:53:1B:DF:62:34:FF:1E:
      D1:F4:5A:93:28:85:E5:4C:17:4E:7E:5B:FD:A4:93:99:
      7F:DF:CD:EF:A4:75:EF:EF:15:F6:47:E7:F8:19:72:D8:
      2E:34:1A:A6:B4:A7:4C:7E:BD:BB:4F:0C:3D:57:F1:30:
      D6:A6:36:8E:D6:80:76:D7:19:2E:A5:CD:7E:34:2D:89: 0x010001
  - X509v3 extensions
    - basicConstraints
      - true
      - true: 0
    - certificatePolicies
      - 2.16.840.1.113733.1.7.23.3
        #0
        id-qt-cps: https://www.verisign.com/cps
        id-qt-unotice: https://www.verisign.com/rpa
    - keyUsage: true, 6
    - 1.3.6.1.5.5.7.1.12
      - image/gif
        SHA1:
        8f e5 d3 1a 86 ac 8d 8e 6b c3 cf 80 6a d4 48 18 |........k...j.H.| 2c 7b 19 2e |,{.. |
        http://logo.verisign.com/vslogo.gif
    - crlDistributionPoints: http://crl.verisign.com/pca3-g5.crl
    - authorityInfoAccess
      - OCSP: http://ocsp.verisign.com
    - extendedKeyUsage
      - clientAuth: codeSigning
    - subjectAltName
      - CN: VeriSignMPKI-2-8
    - subjectKeyIdentifier:
```
cf 99 a9 ea 7b 26 f4 4b  c9 8e 8f d7 f0 05 26 ef  |....{&.K......&.|
e3 d2 a7 9d                                       |....            |
```
    - authorityKeyIdentifier:
```
7f d3 65 a7 c2 dd ec bb  f0 30 09 f3 43 39 fa 02  |..e......0..C9..|
af 33 31 33                                       |.313            |
```
- RSA-SHA1:
```
56 22 e6 34 a4 c4 61 cb  48 b9 01 ad 56 a8 64 0f  |V".4..a.H...V.d.|
d9 8c 91 c4 bb cc 0c e5  ad 7a a0 22 7f df 47 38  |.........z."..G8|
4a 2d 6c d1 7f 71 1a 7c  ec 70 a9 b1 f0 4f e4 0f  |J-l..q.|.p...O..|
0c 53 fa 15 5e fe 74 98  49 24 85 81 26 1c 91 14  |.S..^.t.I$..&...|
47 b0 4c 63 8c bb a1 34  d4 c6 45 e8 0d 85 26 73  |G.Lc...4..E...&s|
03 d0 a9 8c 64 6d dc 71  92 e6 45 05 60 15 59 51  |....dm.q..E.`.YQ|
39 fc 58 14 6b fe d4 a4  ed 79 6b 08 0c 41 72 e7  |9.X.k....yk..Ar.|
37 22 06 09 be 23 e9 3f  44 9a 1e e9 61 9d cc b1  |7"...#.?D...a...|
90 5c fc 3d d2 8d ac 42  3d 65 36 d4 b4 3d 40 28  |.\.=...B=e6..=@(|
8f 9b 10 cf 23 26 cc 4b  20 cb 90 1f 5d 8c 4c 34  |....#&.K ...].L4|
ca 3c d8 e5 37 d6 6f a5  20 bd 34 eb 26 d9 ae 0d  |.<..7.o. .4.&...|
e7 c5 9a f7 a1 b4 21 91  33 6f 86 e8 58 bb 25 7c  |......!.3o..X.%||
74 0e 58 fe 75 1b 63 3f  ce 31 7c 9b 8f 1b 96 9e  |t.X.u.c?.1|.....|
c5 53 76 84 5b 9c ad 91  fa ac ed 93 ba 5d c8 21  |.Sv.[........].!|
53 c2 82 53 63 af 12 0d  50 87 11 1b 3d 54 52 96  |S..Sc...P...=TR.|
8a 2c 9c 3d 92 1a 08 9a  05 2e c7 93 a5 48 91 d3  |.,.=.........H..|
```

Signer

1
unnamed
- #0
  - C: US
  - O: VeriSign, Inc.
  - OU: VeriSign Trust Network
  - OU: Terms of use at https://www.verisign.com/rpa (c)10
  - CN: VeriSign Class 3 Code Signing 2010 CA
- 5F:78:14:9E:B4:F7:5E:B1:74:04:A8:14:3A:AE:AE:D7
SHA1: nil

1.3.6.1.4.1.311.2.1.12
- nil
contentType: 1.3.6.1.4.1.311.2.1.4
1.3.6.1.4.1.311.2.1.11: msCodeInd

messageDigest:

14 a1 e2 73 d1 f5 df b7  34 05 12 23 18 24 ef 4c  |...s....4..#.$.L|
03 bb 17 77                                       |...w            |

rsaEncryption:

b9 db 03 7b 01 0b 2e b2  0a 64 08 c1 1c f0 5e 90  |...{.....d....^.|
56 1a 6c b1 ae 99 4f c1  c8 4c 99 6e 40 8a e2 e8  |V.l...O..L.n@...|
1d 6b ff 8a a0 9e 62 0e  a0 71 40 df de ef 56 67  |.k....b..q@...Vg|
03 17 f8 14 b0 73 04 93  6f 06 a5 bd 53 8e bc 7f  |.....s..o...S...|
98 d1 23 4a db 63 be 55  ba ad 51 cb 90 21 e4 dc  |..#J.c.U..Q..!..|
b1 94 fb 64 7f ff 60 a6  d8 95 23 e9 64 aa 88 e9  |...d..`...#.d...|
0a 5b fb a9 1c c7 73 25  17 9c 41 b8 45 1c a7 ab  |.[....s%..A.E...|
49 f4 c4 72 01 07 a1 42  5b 4a 86 46 ee f0 96 35  |I..r...B[J.F...5|
c0 70 d3 0e 97 24 f2 8f  b0 67 26 8a 0c 94 da d6  |.p...$...g&.....|
20 a5 55 8a 83 1c ef d0  c4 e6 c8 ca b7 86 1d b4  | .U.............|
b9 99 f6 34 0c 2d c2 90  b0 0c 39 92 9d fb 9a db  |...4.-....9.....|
d1 32 8a 54 e7 48 50 d7  16 2b 9c 91 e9 52 fd f6  |.2.T.HP..+...R..|
aa 38 19 73 0f e4 3c e5  1a a6 7d 0e 38 d1 7d 62  |.8.s..<...}.8.}b|
7e 18 26 5b 20 d2 d1 91  f2 a1 35 e3 0b 60 c9 b9  |~.&[ .....5..`..|
51 d4 95 fe d4 75 61 e3  64 08 0c 5c 84 96 cc be  |Q....ua.d..\....|
db c5 b1 6c 44 67 e2 07  b5 2e 2f 7c 72 81 7c 6b  |...lDg..../|r.|k|

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	2692696	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK