Tu,2.exe

info
MZ
PE
resources
imports
foremost
version info
signature
hexdump
disasm
log
discuss
donate

filename	Tu,2.exe
size	6257704 (0x5f7c28)
md5	2b453b794c59afc7ab5d07b5b2145e90

type	PE32+ executable (GUI) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x50
blocks_in_file	2
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0xf
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0x1a
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 36 34 0d 0a 24 37  00 00 00 00 00 00 00 00  |in64..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	6
TimeDateStamp	0x51d6fb1a
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x2f
Magic	0x20b
LinkerVersion	8.0
SizeOfCode	0x5a3800
SizeOfInitializedData	0xf4200
SizeOfUninitializedData	0
AddressOfEntryPoint	0xfcd000
BaseOfCode	0x1000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.2
ImageVersion	5.2
SubsystemVersion	5.2
Reserved1	0
SizeOfImage	0xfce000
SizeOfHeaders	0x400
CheckSum	0x601e06
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x4000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x2000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
	0x1000	0x653000	0x1fd200	RWX IDATA
.rsrc	0x654000	0x54e00	0x15a00	RW- IDATA
.idata	0x6a9000	0x1000	0x200	RW- IDATA
	0x6aa000	0x541000	0x200	RWX IDATA
npowokio	0xbeb000	0x3e2000	0x3e1e00	RWX IDATA
qxemjajx	0xfcd000	0x1000	0x200	RWX IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x6a908d	0xb5
RESOURCE	0x654000	0x54e00
EXCEPTION	0x61a000	0x39c18
SECURITY	0x5f6000	0x1c28
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0xfc7a80	0x28
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0x617000	0xd9a
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0xa18000	0xa181e4	0x9a83c8	0xa19020	0	0

show previews

type	name	size
CURSOR	#1	308
CURSOR	#2	308
CURSOR	#3	308
CURSOR	#4	308
CURSOR	#5	308
CURSOR	#6	308
CURSOR	#7	308
CURSOR	#8	748
CURSOR	#9	748
CURSOR	#10	748
CURSOR	#11	748
CURSOR	#12	308
CURSOR	#13	308
CURSOR	#14	308
CURSOR	#15	748
CURSOR	#16	748
CURSOR	#17	748
CURSOR	#18	748
CURSOR	#19	748
CURSOR	#20	748
CURSOR	#21	308
BITMAP	ADVCHECKITEM	1064
BITMAP	ADVRADIOITEM	808
BITMAP	ADVSUBMENUITEM	76
BITMAP	BBABORT	464
BITMAP	BBALL	484
BITMAP	BBCANCEL	464
BITMAP	BBCLOSE	464
BITMAP	BBHELP	464
BITMAP	BBIGNORE	464
BITMAP	BBNO	464
BITMAP	BBOK	464
BITMAP	BBRETRY	464
BITMAP	BBYES	464
BITMAP	COLORBTN_ARROW	124
BITMAP	COLORBTN_ARROW_DISABLED	124
BITMAP	DBBTNCANCEL	208
BITMAP	DBBTNCANCELD	208
BITMAP	DBBTNDELETE	208
BITMAP	DBBTNDELETED	208
BITMAP	DBBTNEDIT	208
BITMAP	DBBTNEDITD	208
BITMAP	DBBTNFIRST	208
BITMAP	DBBTNFIRSTD	208
BITMAP	DBBTNINSERT	208
BITMAP	DBBTNINSERTD	208
BITMAP	DBBTNLAST	208
BITMAP	DBBTNLASTD	208
BITMAP	DBBTNNEXT	208
BITMAP	DBBTNNEXTD	208
BITMAP	DBBTNPOST	208
BITMAP	DBBTNPOSTD	208
BITMAP	DBBTNPRIOR	208
BITMAP	DBBTNPRIORD	208
BITMAP	DBBTNREFRESH	208
BITMAP	DBBTNREFRESHD	208
BITMAP	TD_TNTARW	1320
BITMAP	TD_TNTARWDOWN	1320
BITMAP	TD_TNTARWHOT	1320
BITMAP	TD_TNTCOLP	1444
BITMAP	TD_TNTCOLPDOWN	1444
BITMAP	TD_TNTCOLPHOT	1444
BITMAP	TD_TNTEXP	1444
BITMAP	TD_TNTEXPDOWN	1444
BITMAP	TD_TNTEXPHOT	1444
BITMAP	TD_TNTSHIELD	2088
BITMAP	VT_CHECK_DARK	3304
BITMAP	VT_CHECK_LIGHT	3304
BITMAP	VT_FLAT	3304
BITMAP	VT_MOVEALL	616
BITMAP	VT_MOVEEW	616
BITMAP	VT_MOVENS	616
BITMAP	VT_TICK_DARK	3304
BITMAP	VT_TICK_LIGHT	3304
BITMAP	VT_UTILITIES	3368
BITMAP	VT_XP	19242
BITMAP	VT_XPBUTTONMINUS	294
BITMAP	VT_XPBUTTONPLUS	294
ICON	#1	9640
ICON	#2	4264
ICON	#3	2440
ICON	#4	1128
ICON	#5	768
ICON	#6	768
STRING	#12	942
STRING	#13	902
STRING	#4048	500
STRING	#4049	960
STRING	#4050	1324
STRING	#4051	2968
STRING	#4052	1480
STRING	#4053	852
STRING	#4054	1136
STRING	#4055	664
STRING	#4056	996
STRING	#4057	680
STRING	#4058	1316
STRING	#4059	580
STRING	#4060	820
STRING	#4061	568
STRING	#4062	824
STRING	#4063	1288
STRING	#4064	888
STRING	#4065	1220
STRING	#4066	652
STRING	#4067	664
STRING	#4068	920
STRING	#4069	688
STRING	#4070	664
STRING	#4071	556
STRING	#4072	1056
STRING	#4073	888
STRING	#4074	844
STRING	#4075	1312
STRING	#4076	1180
STRING	#4077	1064
STRING	#4078	892
STRING	#4079	156
STRING	#4080	244
STRING	#4081	328
STRING	#4082	1040
STRING	#4083	996
STRING	#4084	1208
STRING	#4085	728
STRING	#4086	1036
STRING	#4087	1096
STRING	#4088	904
STRING	#4089	920
STRING	#4090	872
STRING	#4091	212
STRING	#4092	164
STRING	#4093	708
STRING	#4094	940
STRING	#4095	876
STRING	#4096	756
RCDATA	DVCLAL	16
RCDATA	PACKAGEINFO	3960
RCDATA	PLATFORMTARGETS	2
RCDATA	TCOLORBUTTONPALETTE	648
RCDATA	TDLGADDINSTALLEDPRG	4913
RCDATA	TDLGASKDELITEM	2169
RCDATA	TDLGCHANGEICON	1139
RCDATA	TDLGCHECKUPDATES	18827
RCDATA	TDLGCOMPARESNS	1403
RCDATA	TDLGEXPORTREGISTRY	2232
RCDATA	TDLGGROUPPROP	882
RCDATA	TDLGINPUTMEMO	792
RCDATA	TDLGINPUTTEXT	653
RCDATA	TDLGMERGELOGS	1754
RCDATA	TDLGPENDINGFILERENAME	2084
RCDATA	TDLGREGISTER	1472
RCDATA	TDLGRESTRICTEDFEATURE	4469
RCDATA	TDLGRMVSHARED	1581
RCDATA	TDLGSELECT	667
RCDATA	TDLGSELECTLIBICON	1270
RCDATA	TDLGSYSBROWSER	2747
RCDATA	TDLGTUABOUT	2519
RCDATA	TDLGTUNBACKUP	2309
RCDATA	TDLGTUNRESTORE	3947
RCDATA	TDLGTUOPTIONS	47623
RCDATA	TDLGUNINSTALL	9454
RCDATA	TFRMINSTALL	6648
RCDATA	TFRMTUMAIN	64026
GROUP_CURSOR	HAND	20
GROUP_CURSOR	VT_HEADERSPLIT	20
GROUP_CURSOR	VT_MOVEALL	20
GROUP_CURSOR	VT_MOVEE	20
GROUP_CURSOR	VT_MOVEEW	20
GROUP_CURSOR	VT_MOVEN	20
GROUP_CURSOR	VT_MOVENE	20
GROUP_CURSOR	VT_MOVENS	20
GROUP_CURSOR	VT_MOVENW	20
GROUP_CURSOR	VT_MOVES	20
GROUP_CURSOR	VT_MOVESE	20
GROUP_CURSOR	VT_MOVESW	20
GROUP_CURSOR	VT_MOVEW	20
GROUP_CURSOR	VT_VERTSPLIT	20
GROUP_CURSOR	#32761	20
GROUP_CURSOR	#32762	20
GROUP_CURSOR	#32763	20
GROUP_CURSOR	#32764	20
GROUP_CURSOR	#32765	20
GROUP_ICON	MAINICON	62
GROUP_ICON	X_CMD_BTN_HOT	20
GROUP_ICON	X_CMD_BTN_NORMAL	20
VERSION	#1	784
MANIFEST	#1	1224

module_name	hint	ord	function_name
kernel32.dll			lstrcpy
comctl32.dll			InitCommonControls

VS_FIXEDFILEINFO

dwSignature	0xfeef
FileVersion	80.6.3.1
ProductVersion	0.6.63.1
StrucVersion	0x30001
FileFlagsMask	0
FileFlags	0x40000
FileOS	0x10000
FileType	0
FileSubtype	0

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO Code Signing CA 2

serial: 30175C6A9921761EB012B83D011731D8

Certificates (5)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
        Validity
            Not Before: Dec 21 00:00:00 2012 GMT
            Not After : Dec 30 23:59:59 2020 GMT
        Subject: C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:b1:ac:b3:49:54:4b:97:1c:12:0a:d8:25:79:91:
                    22:57:2a:6f:dc:b8:26:c4:43:73:6b:c2:bf:2e:50:
                    5a:fb:14:c2:76:8e:43:01:25:43:b4:a1:e2:45:f4:
                    e8:b7:7b:c3:74:cc:22:d7:b4:94:00:02:f7:4d:ed:
                    bf:b4:b7:44:24:6b:cd:5f:45:3b:d1:44:ce:43:12:
                    73:17:82:8b:69:b4:2b:cb:99:1e:ac:72:1b:26:4d:
                    71:1f:b1:31:dd:fb:51:61:02:53:a6:aa:f5:49:2c:
                    05:78:45:a5:2f:89:ce:e7:99:e7:fe:8c:e2:57:3f:
                    3d:c6:92:dc:4a:f8:7b:33:e4:79:0a:fb:f0:75:88:
                    41:9c:ff:c5:03:51:99:aa:d7:6c:9f:93:69:87:65:
                    29:83:85:c2:60:14:c4:c8:c9:3b:14:da:c0:81:f0:
                    1f:0d:74:de:92:22:ab:ca:f7:fb:74:7c:27:e6:f7:
                    4a:1b:7f:a7:c3:9e:2d:ae:8a:ea:a6:e6:aa:27:16:
                    7d:61:f7:98:71:11:bc:e2:50:a1:4b:e5:5d:fa:e5:
                    0e:a7:2c:9f:aa:65:20:d3:d8:96:e8:c8:7c:a5:4e:
                    48:44:ff:19:e2:44:07:92:0b:d7:68:84:80:5d:6a:
                    78:64:45:cd:60:46:7e:54:c1:13:7c:c5:79:f1:c9:
                    c1:71
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                5F:9A:F5:6E:5C:CC:CC:74:9A:D4:DD:7D:EF:3F:DB:EC:4C:80:2E:DD
            Authority Information Access: 
                OCSP - URI:http://ocsp.thawte.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.thawte.com/ThawteTimestampingCA.crl
            X509v3 Extended Key Usage: 
                Time Stamping
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name: 
                DirName:/CN=TimeStamp-2048-1
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        03:09:9b:8f:79:ef:7f:59:30:aa:ef:68:b5:fa:e3:09:1d:bb:
        4f:82:06:5d:37:5f:a6:52:9f:16:8d:ea:1c:92:09:44:6e:f5:
        6d:eb:58:7c:30:e8:f9:69:8d:23:73:0b:12:6f:47:a9:ae:39:
        11:f8:2a:b1:9b:b0:1a:c3:8e:eb:59:96:00:ad:ce:0c:4d:b2:
        d0:31:a6:08:5c:2a:7a:fc:e2:7a:1d:57:4c:a8:65:18:e9:79:
        40:62:25:96:6e:c7:c7:37:6a:83:21:08:8e:41:ea:dd:d9:57:
        3f:1d:77:49:87:2a:16:06:5e:a6:38:6a:22:12:a3:51:19:83:
        7e:b6

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root
        Validity
            Not Before: Jun  7 08:09:10 2005 GMT
            Not After : May 30 10:48:38 2020 GMT
        Subject: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http:\/\/www.usertrust.com, CN=UTN-USERFirst-Object
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:ce:aa:81:3f:a3:a3:61:78:aa:31:00:55:95:11:
                    9e:27:0f:1f:1c:df:3a:9b:82:68:30:c0:4a:61:1d:
                    f1:2f:0e:fa:be:79:f7:a5:23:ef:55:51:96:84:cd:
                    db:e3:b9:6e:3e:31:d8:0a:20:67:c7:f4:d9:bf:94:
                    eb:47:04:3e:02:ce:2a:a2:5d:87:04:09:f6:30:9d:
                    18:8a:97:b2:aa:1c:fc:41:d2:a1:36:cb:fb:3d:91:
                    ba:e7:d9:70:35:fa:e4:e7:90:c3:9b:a3:9b:d3:3c:
                    f5:12:99:77:b1:b7:09:e0:68:e6:1c:b8:f3:94:63:
                    88:6a:6a:fe:0b:76:c9:be:f4:22:e4:67:b9:ab:1a:
                    5e:77:c1:85:07:dd:0d:6c:bf:ee:06:c7:77:6a:41:
                    9e:a7:0f:d7:fb:ee:94:17:b7:fc:85:be:a4:ab:c4:
                    1c:31:dd:d7:b6:d1:e4:f0:ef:df:16:8f:b2:52:93:
                    d7:a1:d4:89:a1:07:2e:bf:e1:01:12:42:1e:1a:e1:
                    d8:95:34:db:64:79:28:ff:ba:2e:11:c2:e5:e8:5b:
                    92:48:fb:47:0b:c2:6c:da:ad:32:83:41:f3:a5:e5:
                    41:70:fd:65:90:6d:fa:fa:51:c4:f9:bd:96:2b:19:
                    04:2c:d3:6d:a7:dc:f0:7f:6f:83:65:e2:6a:ab:87:
                    86:75
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier: 
                AD:BD:98:7A:34:B4:26:F7:FA:C4:26:54:EF:03:BD:E0:24:CB:54:1A
            X509v3 Subject Key Identifier: 
                DA:ED:64:74:14:9C:14:3C:AB:DD:99:A9:BD:5B:28:4D:8B:3C:C9:D8
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies: 
                Policy: X509v3 Any Policy
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.usertrust.com/AddTrustExternalCARoot.crl
            Authority Information Access: 
                OCSP - URI:http://ocsp.usertrust.com
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        4d:42:2f:a6:c1:8a:eb:07:80:90:58:46:8c:f8:19:39:66:2a:
        3c:5a:2c:6d:cf:d4:d9:87:55:8d:79:0b:12:88:7b:40:8f:d5:
        c7:f8:4b:8d:55:16:63:ad:b7:57:dc:3b:2b:bd:d3:c1:4f:1e:
        03:87:4b:44:9b:e3:e2:40:45:26:f3:26:49:2b:6a:84:f1:54:
        7a:d4:42:da:fc:d3:6a:bb:66:7e:ca:9e:ea:e9:bb:dc:07:c7:
        c3:92:4e:83:3c:81:49:9f:92:d5:32:09:ea:49:2e:a1:11:71:
        9a:36:d2:c5:4e:68:b6:cb:0e:1b:25:16:af:6c:de:5d:76:d8:
        1f:72:b1:93:26:86:17:db:18:de:af:45:e9:df:fb:98:af:14:
        18:ed:a4:5e:f6:89:94:45:f0:55:04:4a:dd:ff:27:dd:06:4a:
        40:f6:b4:bc:f1:e4:0f:99:02:bb:fd:5d:0e:2e:28:c1:be:3b:
        5f:1a:3f:97:10:84:bc:16:3e:d8:a3:9c:63:1d:66:cb:5c:5f:
        da:3e:f3:0f:0a:09:35:22:db:db:c0:3f:00:f9:e6:0d:5d:67:
        d1:fd:a0:1e:03:2b:d9:40:f7:be:cc:87:66:54:80:a6:a3:b8:
        f5:19:62:d5:d2:26:b1:98:26:ee:9a:cb:44:a7:45:5a:81:95:
        15:1a:f5:51

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA - G2
        Validity
            Not Before: Oct 18 00:00:00 2012 GMT
            Not After : Dec 29 23:59:59 2020 GMT
        Subject: C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer - G4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:a2:63:0b:39:44:b8:bb:23:a7:44:49:bb:0e:ff:
                    a1:f0:61:0a:53:93:b0:98:db:ad:2c:0f:4a:c5:6e:
                    ff:86:3c:53:55:0f:15:ce:04:3f:2b:fd:a9:96:96:
                    d9:be:61:79:0b:5b:c9:4c:86:76:e5:e0:43:4b:22:
                    95:ee:c2:2b:43:c1:9f:d8:68:b4:8e:40:4f:ee:85:
                    38:b9:11:c5:23:f2:64:58:f0:15:32:6f:4e:57:a1:
                    ae:88:a4:02:d7:2a:1e:cd:4b:e1:dd:63:d5:17:89:
                    32:5b:b0:5e:99:5a:a8:9d:28:50:0e:17:ee:96:db:
                    61:3b:45:51:1d:cf:12:56:0b:92:47:fc:ab:ae:f6:
                    66:3d:47:ac:70:72:e7:92:e7:5f:cd:10:b9:c4:83:
                    64:94:19:bd:25:80:e1:e8:d2:22:a5:d0:ba:02:7a:
                    a1:77:93:5b:65:c3:ee:17:74:bc:41:86:2a:dc:08:
                    4c:8c:92:8c:91:2d:9e:77:44:1f:68:d6:a8:74:77:
                    db:0e:5b:32:8b:56:8b:33:bd:d9:63:c8:49:9d:3a:
                    c5:c5:ea:33:0b:d2:f1:a3:1b:f4:8b:be:d9:b3:57:
                    8b:3b:de:04:a7:7a:22:b2:24:ae:2e:c7:70:c5:be:
                    4e:83:26:08:fb:0b:bd:a9:4f:99:08:e1:10:28:72:
                    aa:cd
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Extended Key Usage: critical
                Time Stamping
            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access: 
                OCSP - URI:http://ts-ocsp.ws.symantec.com
                CA Issuers - URI:http://ts-aia.ws.symantec.com/tss-ca-g2.cer
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://ts-crl.ws.symantec.com/tss-ca-g2.crl
            X509v3 Subject Alternative Name: 
                DirName:/CN=TimeStamp-2048-2
            X509v3 Subject Key Identifier: 
                46:C6:69:A3:0E:4A:14:1E:D5:4C:DA:52:63:17:3F:5E:36:BC:0D:E6
            X509v3 Authority Key Identifier: 
                5F:9A:F5:6E:5C:CC:CC:74:9A:D4:DD:7D:EF:3F:DB:EC:4C:80:2E:DD
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        78:3b:b4:91:2a:00:4c:f0:8f:62:30:37:78:a3:84:27:07:6f:
        18:b2:de:25:dc:a0:d4:94:03:aa:86:4e:25:9f:9a:40:03:1c:
        dd:ce:e3:79:cb:21:68:06:da:b6:32:b4:6d:bf:f4:2c:26:63:
        33:e4:49:64:6d:0d:e6:c3:67:0e:f7:05:a4:35:6c:7c:89:16:
        c6:e9:b2:df:b2:e9:dd:20:c6:71:0f:cd:95:74:dc:b6:5c:de:
        bd:37:1f:43:78:e6:78:b5:cd:28:04:20:a3:aa:f1:4b:c4:88:
        29:91:0e:80:d1:11:fc:dd:5c:76:6e:4f:5e:0e:45:46:41:6e:
        0d:b0:ea:38:9a:b1:3a:da:09:71:10:fc:1c:79:b4:80:7b:ac:
        69:f4:fd:9c:b6:0c:16:2b:f1:7f:5b:09:3d:9b:5b:e2:16:ca:
        13:81:6d:00:2e:38:0d:a8:29:8f:2c:e1:b2:f4:5a:a9:01:af:
        15:9c:2c:2f:49:1b:db:22:bb:c3:fe:78:94:51:c3:86:b1:82:
        88:5d:f0:3d:b4:51:a1:79:33:2b:2e:7b:b9:dc:20:09:13:71:
        eb:6a:19:5b:cf:e8:a5:30:57:2c:89:49:3f:b9:cf:7f:c9:bf:
        3e:22:68:63:53:9a:bd:69:74:ac:c5:1d:3c:7f:92:e0:c3:bc:
        1c:d8:04:75

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http:\/\/www.usertrust.com, CN=UTN-USERFirst-Object
        Validity
            Not Before: Aug 24 00:00:00 2011 GMT
            Not After : May 30 10:48:38 2020 GMT
        Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Code Signing CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:cb:f8:e7:a7:e8:f1:97:28:40:68:80:37:d2:c8:
                    3f:8e:92:8a:92:37:87:47:80:ea:4c:99:cf:6e:f9:
                    15:47:bd:ee:75:f4:44:ac:d0:c3:d4:4d:f7:19:c0:
                    d3:3c:4d:c1:47:b9:59:65:16:93:8c:d9:0a:84:9b:
                    9f:e8:f6:6a:63:58:fe:5f:dc:d1:7f:4b:51:9f:00:
                    1c:00:87:54:20:07:57:a0:82:c9:2f:98:af:33:8a:
                    bb:7b:80:22:25:6a:6c:af:c2:2c:6c:79:13:bd:a3:
                    2a:48:d6:b5:8e:61:55:e9:6b:e8:3d:80:bf:14:03:
                    85:18:8e:7e:4c:e9:c2:19:88:73:92:72:cd:fa:ff:
                    50:4d:cb:2c:a6:7b:1a:73:b1:00:90:2c:d9:32:e2:
                    fb:fd:ac:95:42:36:ec:34:c5:13:53:68:b2:c1:9f:
                    40:9f:da:7b:c8:9d:62:6c:93:a2:42:d7:79:9f:97:
                    4f:31:5b:50:21:a1:ab:af:d9:1c:b2:ce:75:be:5b:
                    2c:56:00:24:8d:11:c1:75:1f:f0:fe:d2:95:fe:f0:
                    e1:31:23:18:67:c0:5b:13:fd:5a:98:94:94:ff:ff:
                    59:02:1f:00:ac:e6:f1:f2:fa:3a:73:b3:1d:42:fc:
                    54:75:cf:51:31:2f:e3:db:81:d9:77:23:2a:4f:59:
                    ce:23
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier: 
                DA:ED:64:74:14:9C:14:3C:AB:DD:99:A9:BD:5B:28:4D:8B:3C:C9:D8
            X509v3 Subject Key Identifier: 
                1E:C5:B1:2C:7D:87:DA:02:68:7C:25:BC:0C:07:84:3F:B6:CF:DE:F1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage: 
                Code Signing
            X509v3 Certificate Policies: 
                Policy: X509v3 Any Policy
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.usertrust.com/UTN-USERFirst-Object.crl
            Authority Information Access: 
                CA Issuers - URI:http://crt.usertrust.com/UTNAddTrustObject_CA.crt
                OCSP - URI:http://ocsp.usertrust.com
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        95:89:77:93:68:01:5e:7c:d9:2d:37:07:90:5d:5a:42:5e:0c:
        64:b4:36:b5:0f:f6:ab:d5:39:27:de:22:46:a4:49:1c:66:4b:
        46:19:59:2e:79:49:03:f6:9c:92:df:6d:50:35:5c:0c:91:2e:
        60:03:59:d0:f1:64:f7:69:09:f6:7e:fe:eb:34:b3:6d:b1:bf:
        66:9c:a3:ba:31:78:b9:87:35:61:3d:92:31:1b:ef:f4:e8:9e:
        d6:ac:45:fa:0c:36:3c:80:67:bb:bd:ef:2e:c2:90:e1:3d:71:
        2f:3b:c1:b0:58:7e:45:c3:52:71:03:07:f6:f3:39:4d:8b:36:
        21:1b:01:df:d9:da:5e:2b:eb:0e:97:80:1e:44:1c:50:88:f5:
        c6:12:33:4a:a8:4d:a5:8d:2f:94:0c:7b:c6:bf:9a:2c:c3:32:
        cd:bd:8c:27:26:f0:e1:30:03:50:06:82:bc:f4:3b:b3:83:75:
        06:c6:ef:ba:ee:d3:80:f8:52:c6:ac:cb:79:f2:38:9e:7b:b0:
        92:58:42:91:05:c8:96:21:ad:b9:4b:16:81:14:69:f1:37:b0:
        fe:34:f7:dc:b0:df:97:f5:43:10:9b:76:8f:b4:65:f5:e8:9f:
        13:b7:1e:ac:6f:c4:69:8a:5f:ba:3c:61:7e:5e:49:86:23:13:
        2e:af:15:48

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            30:17:5c:6a:99:21:76:1e:b0:12:b8:3d:01:17:31:d8
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Code Signing CA 2
        Validity
            Not Before: Sep  9 00:00:00 2011 GMT
            Not After : Sep  8 23:59:59 2014 GMT
        Subject: C=RO/postalCode=427070, ST=BISTRITA-NASAUD, L=COSBUC/street=297A, O=Gavrila Martau, CN=Gavrila Martau
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:b5:7e:d9:89:07:3f:db:4f:8a:67:c7:6b:72:d2:
                    6d:ae:2d:f1:85:a0:32:27:26:74:6d:9a:d9:de:52:
                    7d:3f:20:fa:81:e4:22:83:ef:fc:66:8f:53:34:c8:
                    36:1d:62:e5:91:41:82:35:b3:8f:d1:5a:5f:45:e2:
                    e5:f5:8f:87:a7:7e:91:78:02:b9:83:52:ce:54:27:
                    33:23:81:f9:98:d3:1a:98:90:22:75:48:8e:1b:8e:
                    ce:6f:3e:8e:6c:80:e9:08:c4:c0:b1:66:d2:02:de:
                    da:20:e2:1d:ff:8a:4a:cf:bd:aa:eb:a6:b5:4a:e2:
                    40:98:cf:4a:25:47:4a:e2:75:bd:cb:68:12:d9:c7:
                    68:2d:2a:28:41:dd:99:bc:66:aa:85:41:a1:81:fb:
                    ad:10:53:99:18:c4:3c:1b:fd:d7:3b:fe:77:78:a6:
                    44:6e:59:39:6b:19:d0:8e:12:7b:87:61:03:50:b1:
                    4a:9b:f1:df:33:d6:01:5c:c0:65:59:79:76:3e:b5:
                    bb:e7:61:aa:fa:dd:15:3f:78:90:a2:a0:5f:11:1d:
                    6f:b3:22:a8:92:ae:78:20:d2:c5:a7:66:6b:8b:7c:
                    6f:1b:4a:cb:05:6f:5a:0e:c5:2e:6c:14:94:73:32:
                    f6:f2:16:5f:57:96:b8:29:05:fc:df:a4:83:77:04:
                    1b:0f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier: 
                1E:C5:B1:2C:7D:87:DA:02:68:7C:25:BC:0C:07:84:3F:B6:CF:DE:F1
            X509v3 Subject Key Identifier: 
                D4:51:01:7A:73:34:B0:32:EB:D4:80:48:15:D2:99:E5:3F:D3:7A:A9
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Extended Key Usage: 
                Code Signing
            Netscape Cert Type: 
                Object Signing
            X509v3 Certificate Policies: 
                Policy: 1.3.6.1.4.1.6449.1.2.1.3.2
                  CPS: https://secure.comodo.net/CPS
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.comodoca.com/COMODOCodeSigningCA2.crl
            Authority Information Access: 
                CA Issuers - URI:http://crt.comodoca.com/COMODOCodeSigningCA2.crt
                OCSP - URI:http://ocsp.comodoca.com
            X509v3 Subject Alternative Name: 
                email:support@martau.com
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        c7:03:cf:66:b5:43:8b:f1:70:0d:17:f9:88:00:95:4c:8b:2c:
        d7:07:76:55:2b:84:b1:a6:12:6a:bc:30:19:36:83:83:25:2b:
        4e:08:66:eb:7a:2d:55:90:86:41:ba:5d:9e:29:43:f2:1c:fd:
        e2:90:02:29:93:f3:0b:f1:c6:fc:46:74:41:18:7b:6a:27:3f:
        23:7c:4c:6d:79:d8:44:cf:f9:2f:11:c5:a0:c0:7a:cb:e8:6d:
        be:60:2c:d1:0f:26:8e:c5:8d:fb:a6:1f:49:c0:23:1e:a9:16:
        cf:0d:79:c0:ed:c0:43:4e:30:c9:9a:9a:46:c8:af:4f:4f:c4:
        74:f3:ec:59:4e:48:84:8a:38:19:e8:d6:3b:72:ec:d4:92:45:
        6b:f4:a4:03:8f:6e:8f:00:48:c4:3a:1c:f8:ee:96:fe:8a:7a:
        72:ab:7b:52:ab:fe:0f:82:e9:6c:e9:76:de:3d:00:9f:f9:24:
        ce:45:73:68:2e:b1:81:99:41:08:51:fc:3f:91:e9:f2:df:47:
        5e:5a:21:8a:f8:72:db:4e:96:09:1c:f7:d9:8b:b1:66:53:19:
        72:59:6d:94:46:b1:7a:dc:67:d9:25:ee:c9:76:09:84:ca:f3:
        08:84:60:84:66:e8:29:64:3c:0e:d1:cd:21:34:fd:79:24:45:
        4f:b7:c6:3a

pkcs7-signedData

SHA1: nil

1.3.6.1.4.1.311.2.1.4

1.3.6.1.4.1.311.2.1.15

00 3c 00 3c 00 3c 00 4f  00 62 00 73 00 6f 00 6c  |.<.<.<.O.b.s.o.l|
00 65 00 74 00 65 00 3e  00 3e 00 3e              |.e.t.e.>.>.>    |

SHA1

2e 41 61 3c c9 1a 52 85 d7 92 f7 e0 8e de bb 0e |.Aa<..R.........| 1a ca a7 44 |...D |

Certificates
- Certificate #0
  - 2
    - 7E:93:EB:FB:7C:C6:4E:59:EA:4B:9A:77:D4:06:FC:3B
    - RSA-SHA1: nil
    - Issuer
      - C: ZA
      - ST: Western Cape
      - L: Durbanville
      - O: Thawte
      - OU: Thawte Certification
      - CN: Thawte Timestamping CA
    - 2012-12-21 00:00:00 UTC: 2020-12-30 23:59:59 UTC
    - Subject
      - C: US
      - O: Symantec Corporation
      - CN: Symantec Time Stamping Services CA - G2
    - #5
      - rsaEncryption: nil
      - B1:AC:B3:49:54:4B:97:1C:12:0A:D8:25:79:91:22:57:
        2A:6F:DC:B8:26:C4:43:73:6B:C2:BF:2E:50:5A:FB:14:
        C2:76:8E:43:01:25:43:B4:A1:E2:45:F4:E8:B7:7B:C3:
        74:CC:22:D7:B4:94:00:02:F7:4D:ED:BF:B4:B7:44:24:
        6B:CD:5F:45:3B:D1:44:CE:43:12:73:17:82:8B:69:B4:
        2B:CB:99:1E:AC:72:1B:26:4D:71:1F:B1:31:DD:FB:51:
        61:02:53:A6:AA:F5:49:2C:05:78:45:A5:2F:89:CE:E7:
        99:E7:FE:8C:E2:57:3F:3D:C6:92:DC:4A:F8:7B:33:E4:
        79:0A:FB:F0:75:88:41:9C:FF:C5:03:51:99:AA:D7:6C:
        9F:93:69:87:65:29:83:85:C2:60:14:C4:C8:C9:3B:14:
        DA:C0:81:F0:1F:0D:74:DE:92:22:AB:CA:F7:FB:74:7C:
        27:E6:F7:4A:1B:7F:A7:C3:9E:2D:AE:8A:EA:A6:E6:AA:
        27:16:7D:61:F7:98:71:11:BC:E2:50:A1:4B:E5:5D:FA:
        E5:0E:A7:2C:9F:AA:65:20:D3:D8:96:E8:C8:7C:A5:4E:
        48:44:FF:19:E2:44:07:92:0B:D7:68:84:80:5D:6A:78:
        64:45:CD:60:46:7E:54:C1:13:7C:C5:79:F1:C9:C1:71: 0x010001
    - #6
      - subjectKeyIdentifier:
        5f 9a f5 6e 5c cc cc 74 9a d4 dd 7d ef 3f db ec |_..n\..t...}.?..| 4c 80 2e dd |L... |
      - authorityInfoAccess
        OCSP: http://ocsp.thawte.com
      - basicConstraints
        true
        true: 0
      - crlDistributionPoints: http://crl.thawte.com/ThawteTimestampingCA.crl
      - extendedKeyUsage: timeStamping
      - keyUsage: true, 6
      - subjectAltName
        CN: TimeStamp-2048-1
  - RSA-SHA1:
```
03 09 9b 8f 79 ef 7f 59  30 aa ef 68 b5 fa e3 09  |....y..Y0..h....|
1d bb 4f 82 06 5d 37 5f  a6 52 9f 16 8d ea 1c 92  |..O..]7_.R......|
09 44 6e f5 6d eb 58 7c  30 e8 f9 69 8d 23 73 0b  |.Dn.m.X|0..i.#s.|
12 6f 47 a9 ae 39 11 f8  2a b1 9b b0 1a c3 8e eb  |.oG..9..*.......|
59 96 00 ad ce 0c 4d b2  d0 31 a6 08 5c 2a 7a fc  |Y.....M..1..\*z.|
e2 7a 1d 57 4c a8 65 18  e9 79 40 62 25 96 6e c7  |.z.WL.e..y@b%.n.|
c7 37 6a 83 21 08 8e 41  ea dd d9 57 3f 1d 77 49  |.7j.!..A...W?.wI|
87 2a 16 06 5e a6 38 6a  22 12 a3 51 19 83 7e b6  |.*..^.8j"..Q..~.|
```
- Certificate #1
  - 2
    - 42:1A:F2:94:09:84:19:1F:52:0A:4B:C6:24:26:A7:4B
    - RSA-SHA1: nil
    - Issuer
      - C: SE
      - O: AddTrust AB
      - OU: AddTrust External TTP Network
      - CN: AddTrust External CA Root
    - 2005-06-07 08:09:10 UTC: 2020-05-30 10:48:38 UTC
    - Subject
      - C: US
      - ST: UT
      - L: Salt Lake City
      - O: The USERTRUST Network
      - OU: http://www.usertrust.com
      - CN: UTN-USERFirst-Object
    - #5
      - rsaEncryption: nil
      - CE:AA:81:3F:A3:A3:61:78:AA:31:00:55:95:11:9E:27:
        0F:1F:1C:DF:3A:9B:82:68:30:C0:4A:61:1D:F1:2F:0E:
        FA:BE:79:F7:A5:23:EF:55:51:96:84:CD:DB:E3:B9:6E:
        3E:31:D8:0A:20:67:C7:F4:D9:BF:94:EB:47:04:3E:02:
        CE:2A:A2:5D:87:04:09:F6:30:9D:18:8A:97:B2:AA:1C:
        FC:41:D2:A1:36:CB:FB:3D:91:BA:E7:D9:70:35:FA:E4:
        E7:90:C3:9B:A3:9B:D3:3C:F5:12:99:77:B1:B7:09:E0:
        68:E6:1C:B8:F3:94:63:88:6A:6A:FE:0B:76:C9:BE:F4:
        22:E4:67:B9:AB:1A:5E:77:C1:85:07:DD:0D:6C:BF:EE:
        06:C7:77:6A:41:9E:A7:0F:D7:FB:EE:94:17:B7:FC:85:
        BE:A4:AB:C4:1C:31:DD:D7:B6:D1:E4:F0:EF:DF:16:8F:
        B2:52:93:D7:A1:D4:89:A1:07:2E:BF:E1:01:12:42:1E:
        1A:E1:D8:95:34:DB:64:79:28:FF:BA:2E:11:C2:E5:E8:
        5B:92:48:FB:47:0B:C2:6C:DA:AD:32:83:41:F3:A5:E5:
        41:70:FD:65:90:6D:FA:FA:51:C4:F9:BD:96:2B:19:04:
        2C:D3:6D:A7:DC:F0:7F:6F:83:65:E2:6A:AB:87:86:75: 0x010001
    - #6
      - authorityKeyIdentifier:
        ad bd 98 7a 34 b4 26 f7 fa c4 26 54 ef 03 bd e0 |...z4.&...&T....| 24 cb 54 1a |$.T. |
      - subjectKeyIdentifier:
        da ed 64 74 14 9c 14 3c ab dd 99 a9 bd 5b 28 4d |..dt...<.....[(M| 8b 3c c9 d8 |.<.. |
      - keyUsage: true, 6
      - basicConstraints: true, true
      - certificatePolicies: anyPolicy
      - crlDistributionPoints: http://crl.usertrust.com/AddTrustExternalCARoot.crl
      - authorityInfoAccess
        OCSP: http://ocsp.usertrust.com
  - RSA-SHA1:
```
4d 42 2f a6 c1 8a eb 07  80 90 58 46 8c f8 19 39  |MB/.......XF...9|
66 2a 3c 5a 2c 6d cf d4  d9 87 55 8d 79 0b 12 88  |f*...|
63 1d 66 cb 5c 5f da 3e  f3 0f 0a 09 35 22 db db  |c.f.\_.>....5"..|
c0 3f 00 f9 e6 0d 5d 67  d1 fd a0 1e 03 2b d9 40  |.?....]g.....+.@|
f7 be cc 87 66 54 80 a6  a3 b8 f5 19 62 d5 d2 26  |....fT......b..&|
b1 98 26 ee 9a cb 44 a7  45 5a 81 95 15 1a f5 51  |..&...D.EZ.....Q|
```
- Certificate #2
  - 2
    - 0E:CF:F4:38:C8:FE:BF:35:6E:04:D8:6A:98:1B:1A:50
    - RSA-SHA1: nil
    - Issuer
      - C: US
      - O: Symantec Corporation
      - CN: Symantec Time Stamping Services CA - G2
    - 2012-10-18 00:00:00 UTC: 2020-12-29 23:59:59 UTC
    - Subject
      - C: US
      - O: Symantec Corporation
      - CN: Symantec Time Stamping Services Signer - G4
    - #5
      - rsaEncryption: nil
      - A2:63:0B:39:44:B8:BB:23:A7:44:49:BB:0E:FF:A1:F0:
        61:0A:53:93:B0:98:DB:AD:2C:0F:4A:C5:6E:FF:86:3C:
        53:55:0F:15:CE:04:3F:2B:FD:A9:96:96:D9:BE:61:79:
        0B:5B:C9:4C:86:76:E5:E0:43:4B:22:95:EE:C2:2B:43:
        C1:9F:D8:68:B4:8E:40:4F:EE:85:38:B9:11:C5:23:F2:
        64:58:F0:15:32:6F:4E:57:A1:AE:88:A4:02:D7:2A:1E:
        CD:4B:E1:DD:63:D5:17:89:32:5B:B0:5E:99:5A:A8:9D:
        28:50:0E:17:EE:96:DB:61:3B:45:51:1D:CF:12:56:0B:
        92:47:FC:AB:AE:F6:66:3D:47:AC:70:72:E7:92:E7:5F:
        CD:10:B9:C4:83:64:94:19:BD:25:80:E1:E8:D2:22:A5:
        D0:BA:02:7A:A1:77:93:5B:65:C3:EE:17:74:BC:41:86:
        2A:DC:08:4C:8C:92:8C:91:2D:9E:77:44:1F:68:D6:A8:
        74:77:DB:0E:5B:32:8B:56:8B:33:BD:D9:63:C8:49:9D:
        3A:C5:C5:EA:33:0B:D2:F1:A3:1B:F4:8B:BE:D9:B3:57:
        8B:3B:DE:04:A7:7A:22:B2:24:AE:2E:C7:70:C5:BE:4E:
        83:26:08:FB:0B:BD:A9:4F:99:08:E1:10:28:72:AA:CD: 0x010001
    - X509v3 extensions
      - basicConstraints
        true
        nil
      - extendedKeyUsage: true, timeStamping
      - keyUsage: true, 0x80
      - authorityInfoAccess
        #0
        OCSP: http://ts-ocsp.ws.symantec.com
        caIssuers: http://ts-aia.ws.symantec.com/tss-ca-g2.cer
      - crlDistributionPoints: http://ts-crl.ws.symantec.com/tss-ca-g2.crl
      - subjectAltName
        CN: TimeStamp-2048-2
      - subjectKeyIdentifier:
        46 c6 69 a3 0e 4a 14 1e d5 4c da 52 63 17 3f 5e |F.i..J...L.Rc.?^| 36 bc 0d e6 |6... |
      - authorityKeyIdentifier:
        5f 9a f5 6e 5c cc cc 74 9a d4 dd 7d ef 3f db ec |_..n\..t...}.?..| 4c 80 2e dd |L... |
  - RSA-SHA1:
```
78 3b b4 91 2a 00 4c f0  8f 62 30 37 78 a3 84 27  |x;..*.L..b07x..'|
07 6f 18 b2 de 25 dc a0  d4 94 03 aa 86 4e 25 9f  |.o...%.......N%.|
9a 40 03 1c dd ce e3 79  cb 21 68 06 da b6 32 b4  |.@.....y.!h...2.|
6d bf f4 2c 26 63 33 e4  49 64 6d 0d e6 c3 67 0e  |m..,&c3.Idm...g.|
f7 05 a4 35 6c 7c 89 16  c6 e9 b2 df b2 e9 dd 20  |...5l|......... |
c6 71 0f cd 95 74 dc b6  5c de bd 37 1f 43 78 e6  |.q...t..\..7.Cx.|
78 b5 cd 28 04 20 a3 aa  f1 4b c4 88 29 91 0e 80  |x..(. ...K..)...|
d1 11 fc dd 5c 76 6e 4f  5e 0e 45 46 41 6e 0d b0  |....\vnO^.EFAn..|
ea 38 9a b1 3a da 09 71  10 fc 1c 79 b4 80 7b ac  |.8..:..q...y..{.|
69 f4 fd 9c b6 0c 16 2b  f1 7f 5b 09 3d 9b 5b e2  |i......+..[.=.[.|
16 ca 13 81 6d 00 2e 38  0d a8 29 8f 2c e1 b2 f4  |....m..8..).,...|
5a a9 01 af 15 9c 2c 2f  49 1b db 22 bb c3 fe 78  |Z.....,/I.."...x|
94 51 c3 86 b1 82 88 5d  f0 3d b4 51 a1 79 33 2b  |.Q.....].=.Q.y3+|
2e 7b b9 dc 20 09 13 71  eb 6a 19 5b cf e8 a5 30  |.{.. ..q.j.[...0|
57 2c 89 49 3f b9 cf 7f  c9 bf 3e 22 68 63 53 9a  |W,.I?.....>"hcS.|
bd 69 74 ac c5 1d 3c 7f  92 e0 c3 bc 1c d8 04 75  |.it...<........u|
```
- Certificate #3
  - 2
    - 10:70:9D:4F:F5:54:08:D7:30:60:01:D8:EA:91:75:BB
    - RSA-SHA1: nil
    - Issuer
      - C: US
      - ST: UT
      - L: Salt Lake City
      - O: The USERTRUST Network
      - OU: http://www.usertrust.com
      - CN: UTN-USERFirst-Object
    - 2011-08-24 00:00:00 UTC: 2020-05-30 10:48:38 UTC
    - Subject
      - C: GB
      - ST: Greater Manchester
      - L: Salford
      - O: COMODO CA Limited
      - CN: COMODO Code Signing CA 2
    - #5
      - rsaEncryption: nil
      - CB:F8:E7:A7:E8:F1:97:28:40:68:80:37:D2:C8:3F:8E:
        92:8A:92:37:87:47:80:EA:4C:99:CF:6E:F9:15:47:BD:
        EE:75:F4:44:AC:D0:C3:D4:4D:F7:19:C0:D3:3C:4D:C1:
        47:B9:59:65:16:93:8C:D9:0A:84:9B:9F:E8:F6:6A:63:
        58:FE:5F:DC:D1:7F:4B:51:9F:00:1C:00:87:54:20:07:
        57:A0:82:C9:2F:98:AF:33:8A:BB:7B:80:22:25:6A:6C:
        AF:C2:2C:6C:79:13:BD:A3:2A:48:D6:B5:8E:61:55:E9:
        6B:E8:3D:80:BF:14:03:85:18:8E:7E:4C:E9:C2:19:88:
        73:92:72:CD:FA:FF:50:4D:CB:2C:A6:7B:1A:73:B1:00:
        90:2C:D9:32:E2:FB:FD:AC:95:42:36:EC:34:C5:13:53:
        68:B2:C1:9F:40:9F:DA:7B:C8:9D:62:6C:93:A2:42:D7:
        79:9F:97:4F:31:5B:50:21:A1:AB:AF:D9:1C:B2:CE:75:
        BE:5B:2C:56:00:24:8D:11:C1:75:1F:F0:FE:D2:95:FE:
        F0:E1:31:23:18:67:C0:5B:13:FD:5A:98:94:94:FF:FF:
        59:02:1F:00:AC:E6:F1:F2:FA:3A:73:B3:1D:42:FC:54:
        75:CF:51:31:2F:E3:DB:81:D9:77:23:2A:4F:59:CE:23: 0x010001
    - #6
      - authorityKeyIdentifier:
        da ed 64 74 14 9c 14 3c ab dd 99 a9 bd 5b 28 4d |..dt...<.....[(M| 8b 3c c9 d8 |.<.. |
      - subjectKeyIdentifier:
        1e c5 b1 2c 7d 87 da 02 68 7c 25 bc 0c 07 84 3f |...,}...h|%....?| b6 cf de f1 |.... |
      - keyUsage: true, 6
      - basicConstraints
        true
        true: 0
      - extendedKeyUsage: codeSigning
      - certificatePolicies: anyPolicy
      - crlDistributionPoints: http://crl.usertrust.com/UTN-USERFirst-Object.crl
      - authorityInfoAccess
        #0
        caIssuers: http://crt.usertrust.com/UTNAddTrustObject_CA.crt
        OCSP: http://ocsp.usertrust.com
  - RSA-SHA1:
```
95 89 77 93 68 01 5e 7c  d9 2d 37 07 90 5d 5a 42  |..w.h.^|.-7..]ZB|
5e 0c 64 b4 36 b5 0f f6  ab d5 39 27 de 22 46 a4  |^.d.6.....9'."F.|
49 1c 66 4b 46 19 59 2e  79 49 03 f6 9c 92 df 6d  |I.fKF.Y.yI.....m|
50 35 5c 0c 91 2e 60 03  59 d0 f1 64 f7 69 09 f6  |P5\...`.Y..d.i..|
7e fe eb 34 b3 6d b1 bf  66 9c a3 ba 31 78 b9 87  |~..4.m..f...1x..|
35 61 3d 92 31 1b ef f4  e8 9e d6 ac 45 fa 0c 36  |5a=.1.......E..6|
3c 80 67 bb bd ef 2e c2  90 e1 3d 71 2f 3b c1 b0  |<.g.......=q/;..|
58 7e 45 c3 52 71 03 07  f6 f3 39 4d 8b 36 21 1b  |X~E.Rq....9M.6!.|
01 df d9 da 5e 2b eb 0e  97 80 1e 44 1c 50 88 f5  |....^+.....D.P..|
c6 12 33 4a a8 4d a5 8d  2f 94 0c 7b c6 bf 9a 2c  |..3J.M../..{...,|
c3 32 cd bd 8c 27 26 f0  e1 30 03 50 06 82 bc f4  |.2...'&..0.P....|
3b b3 83 75 06 c6 ef ba  ee d3 80 f8 52 c6 ac cb  |;..u........R...|
79 f2 38 9e 7b b0 92 58  42 91 05 c8 96 21 ad b9  |y.8.{..XB....!..|
4b 16 81 14 69 f1 37 b0  fe 34 f7 dc b0 df 97 f5  |K...i.7..4......|
43 10 9b 76 8f b4 65 f5  e8 9f 13 b7 1e ac 6f c4  |C..v..e.......o.|
69 8a 5f ba 3c 61 7e 5e  49 86 23 13 2e af 15 48  |i._.
```
- Certificate #4
  - 2
    - 30:17:5C:6A:99:21:76:1E:B0:12:B8:3D:01:17:31:D8
    - RSA-SHA1: nil
    - Issuer
      - C: GB
      - ST: Greater Manchester
      - L: Salford
      - O: COMODO CA Limited
      - CN: COMODO Code Signing CA 2
    - 2011-09-09 00:00:00 UTC: 2014-09-08 23:59:59 UTC
    - Subject
      - C: RO
      - postalCode: 427070
      - ST: BISTRITA-NASAUD
      - L: COSBUC
      - street: 297A
      - O: Gavrila Martau
      - CN: Gavrila Martau
    - #5
      - rsaEncryption: nil
      - B5:7E:D9:89:07:3F:DB:4F:8A:67:C7:6B:72:D2:6D:AE:
        2D:F1:85:A0:32:27:26:74:6D:9A:D9:DE:52:7D:3F:20:
        FA:81:E4:22:83:EF:FC:66:8F:53:34:C8:36:1D:62:E5:
        91:41:82:35:B3:8F:D1:5A:5F:45:E2:E5:F5:8F:87:A7:
        7E:91:78:02:B9:83:52:CE:54:27:33:23:81:F9:98:D3:
        1A:98:90:22:75:48:8E:1B:8E:CE:6F:3E:8E:6C:80:E9:
        08:C4:C0:B1:66:D2:02:DE:DA:20:E2:1D:FF:8A:4A:CF:
        BD:AA:EB:A6:B5:4A:E2:40:98:CF:4A:25:47:4A:E2:75:
        BD:CB:68:12:D9:C7:68:2D:2A:28:41:DD:99:BC:66:AA:
        85:41:A1:81:FB:AD:10:53:99:18:C4:3C:1B:FD:D7:3B:
        FE:77:78:A6:44:6E:59:39:6B:19:D0:8E:12:7B:87:61:
        03:50:B1:4A:9B:F1:DF:33:D6:01:5C:C0:65:59:79:76:
        3E:B5:BB:E7:61:AA:FA:DD:15:3F:78:90:A2:A0:5F:11:
        1D:6F:B3:22:A8:92:AE:78:20:D2:C5:A7:66:6B:8B:7C:
        6F:1B:4A:CB:05:6F:5A:0E:C5:2E:6C:14:94:73:32:F6:
        F2:16:5F:57:96:B8:29:05:FC:DF:A4:83:77:04:1B:0F: 0x010001
    - #6
      - authorityKeyIdentifier:
        1e c5 b1 2c 7d 87 da 02 68 7c 25 bc 0c 07 84 3f |...,}...h|%....?| b6 cf de f1 |.... |
      - subjectKeyIdentifier:
        d4 51 01 7a 73 34 b0 32 eb d4 80 48 15 d2 99 e5 |.Q.zs4.2...H....| 3f d3 7a a9 |?.z. |
      - keyUsage: true, 0x80
      - basicConstraints
        true
        nil
      - extendedKeyUsage: codeSigning
      - nsCertType: 0x10
      - certificatePolicies
        1.3.6.1.4.1.6449.1.2.1.3.2
        id-qt-cps: https://secure.comodo.net/CPS
      - crlDistributionPoints: http://crl.comodoca.com/COMODOCodeSigningCA2.crl
      - authorityInfoAccess
        #0
        caIssuers: http://crt.comodoca.com/COMODOCodeSigningCA2.crt
        OCSP: http://ocsp.comodoca.com
      - subjectAltName: support@martau.com
  - RSA-SHA1:
```
c7 03 cf 66 b5 43 8b f1  70 0d 17 f9 88 00 95 4c  |...f.C..p......L|
8b 2c d7 07 76 55 2b 84  b1 a6 12 6a bc 30 19 36  |.,..vU+....j.0.6|
83 83 25 2b 4e 08 66 eb  7a 2d 55 90 86 41 ba 5d  |..%+N.f.z-U..A.]|
9e 29 43 f2 1c fd e2 90  02 29 93 f3 0b f1 c6 fc  |.)C......)......|
46 74 41 18 7b 6a 27 3f  23 7c 4c 6d 79 d8 44 cf  |FtA.{j'?#|Lmy.D.|
f9 2f 11 c5 a0 c0 7a cb  e8 6d be 60 2c d1 0f 26  |./....z..m.`,..&|
8e c5 8d fb a6 1f 49 c0  23 1e a9 16 cf 0d 79 c0  |......I.#.....y.|
ed c0 43 4e 30 c9 9a 9a  46 c8 af 4f 4f c4 74 f3  |..CN0...F..OO.t.|
ec 59 4e 48 84 8a 38 19  e8 d6 3b 72 ec d4 92 45  |.YNH..8...;r...E|
6b f4 a4 03 8f 6e 8f 00  48 c4 3a 1c f8 ee 96 fe  |k....n..H.:.....|
8a 7a 72 ab 7b 52 ab fe  0f 82 e9 6c e9 76 de 3d  |.zr.{R.....l.v.=|
00 9f f9 24 ce 45 73 68  2e b1 81 99 41 08 51 fc  |...$.Esh....A.Q.|
3f 91 e9 f2 df 47 5e 5a  21 8a f8 72 db 4e 96 09  |?....G^Z!..r.N..|
1c f7 d9 8b b1 66 53 19  72 59 6d 94 46 b1 7a dc  |.....fS.rYm.F.z.|
67 d9 25 ee c9 76 09 84  ca f3 08 84 60 84 66 e8  |g.%..v......`.f.|
29 64 3c 0e d1 cd 21 34  fd 79 24 45 4f b7 c6 3a  |)d<...!4.y$EO..:|
```

Signer

1
unnamed
- #0
  - C: GB
  - ST: Greater Manchester
  - L: Salford
  - O: COMODO CA Limited
  - CN: COMODO Code Signing CA 2
- 30:17:5C:6A:99:21:76:1E:B0:12:B8:3D:01:17:31:D8
SHA1: nil

1.3.6.1.4.1.311.2.1.12
- nil
contentType: 1.3.6.1.4.1.311.2.1.4
1.3.6.1.4.1.311.2.1.11: msCodeInd

messageDigest:

51 5d 1d c8 3e 0e 15 56  9c 75 95 a7 8a fd 9a 55  |Q]..>..V.u.....U|
30 8d 5a cf                                       |0.Z.            |

rsaEncryption:

06 6d 63 1b c2 62 5a 5c  67 a8 8d eb 93 9c fb b7  |.mc..bZ\g.......|
21 04 fa 13 72 d6 be 13  53 ec 6b 53 fe fc a1 d8  |!...r...S.kS....|
f6 66 0c f1 5e f6 07 9a  3e 9f 5f e6 c1 55 0f 6d  |.f..^...>._..U.m|
ea 89 9e 03 5a f3 48 61  27 ba 59 dc 8e 01 40 38  |....Z.Ha'.Y...@8|
5e b9 81 09 99 c4 ea 4e  49 b7 70 b5 20 1a 62 21  |^......NI.p. .b!|
c6 80 92 1f 51 09 56 2a  70 e6 28 17 60 c8 f1 af  |....Q.V*p.(.`...|
ec 12 16 a4 a9 83 15 e6  ed 72 4c 22 a3 57 f2 66  |.........rL".W.f|
cc 73 a1 e7 d5 11 55 85  aa b2 62 ff 0d a2 90 fa  |.s....U...b.....|
6b 41 ee 72 3c eb 2d 30  f9 53 ca 43 01 fc 0a 13  |kA.r<.-0.S.C....|
7f 25 45 32 c1 10 81 3a  28 a3 62 d3 c9 b8 d8 4d  |.%E2...:(.b....M|
33 0a ac 7c 1b 8e da a5  c5 9f ec c8 ca 32 78 ea  |3..|.........2x.|
e6 f9 ac 63 8a 35 e6 a4  60 bb 27 df 69 3b 56 d7  |...c.5..`.'.i;V.|
f4 dc 12 0c 9c c1 6e 35  48 46 b7 a7 e1 85 4b 16  |......n5HF....K.|
58 f3 36 a1 0e a2 c8 3a  52 44 1d 6e ba c2 98 d3  |X.6....:RD.n....|
99 2d 6b 30 63 d6 ff d8  66 31 71 8e 0e 1b 2c 09  |.-k0c...f1q...,.|
d8 d4 4d 49 da 50 33 22  dc 94 c2 e9 e4 0f 8b 02  |..MI.P3"........|

countersignature

unnamed
- #0
  - C: US
  - O: Symantec Corporation
  - CN: Symantec Time Stamping Services CA - G2
- 0E:CF:F4:38:C8:FE:BF:35:6E:04:D8:6A:98:1B:1A:50
SHA1: nil

contentType: pkcs7-data
signingTime: 2013-07-05 16:59:43 UTC

messageDigest:

ac 75 16 d6 73 68 ee bb  94 5c 32 22 2d 05 71 e4  |.u..sh...\2"-.q.|
69 e4 f1 1a                                       |i...            |

rsaEncryption:

38 44 8b df 3b b5 57 1e  0e 49 0f e4 a7 dd ed 48  |8D..;.W..I.....H|
48 14 e9 d3 18 a6 3e a8  32 00 49 2f c3 55 bf d7  |H.....>.2.I/.U..|
8a 46 32 0a 22 6b 7b e2  46 ca f2 9f e0 2e 0d 67  |.F2."k{.F......g|
73 d0 c4 26 5e aa 7a b7  01 ed da 58 a0 ad 6e da  |s..&^.z....X..n.|
b5 7f 76 01 e4 59 b5 3d  57 e8 d0 de a9 0e ef 9d  |..v..Y.=W.......|
50 76 b6 63 e2 e7 4d 91  0f 60 68 40 a3 13 1c 65  |Pv.c..M..`h@...e|
fc b9 fb 7e a7 dc af 90  d2 d2 93 cc 80 e7 6d 67  |...~..........mg|
99 5d 92 ce 50 a3 82 6e  8c 2e 83 b8 50 b0 59 04  |.]..P..n....P.Y.|
51 d1 92 74 d9 a9 35 03  c1 d3 d7 f5 53 4c 31 93  |Q..t..5.....SL1.|
2f 62 0c eb a6 04 a0 96  ff 59 70 72 16 93 7e 28  |/b.......Ypr..~(|
b4 35 7b 00 5c 09 09 9c  28 a9 08 88 5c ed a7 40  |.5{.\...(...\..@|
f6 e2 e2 ef 6e c4 2c d8  bd be bc 7a 08 9d 9c 3c  |....n.,....z...<|
0c 60 ac a7 29 5e 08 04  8f 86 87 16 8e 8e 21 55  |.`..)^........!U|
09 3e a5 f3 24 23 ff 85  7e 9e f9 8f af f3 82 59  |.>..$#..~......Y|
9d b9 11 24 0f 6f 02 40  b5 67 4d e7 ce fb a0 a6  |...$.o.@.gM.....|
b5 8d 5e 98 99 08 04 c2  62 4c 25 c6 4b 95 79 f3  |..^.....bL%.K.y.|

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	6252120	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x669d30

[?] can't find file_offset of VA 0x669e58

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x66e9c0

[?] can't find file_offset of VA 0x66ed70

[?] can't find file_offset of VA 0x66f0f8

[?] can't find file_offset of VA 0x66f2ec

[?] can't find file_offset of VA 0x66f6ac

[?] can't find file_offset of VA 0x66fbd8

[?] can't find file_offset of VA 0x670770

[?] can't find file_offset of VA 0x670d38

[?] can't find file_offset of VA 0x67108c

[?] can't find file_offset of VA 0x6714fc

[?] can't find file_offset of VA 0x671794

[?] can't find file_offset of VA 0x671b78

[?] can't find file_offset of VA 0x671e20

[?] can't find file_offset of VA 0x672344

[?] can't find file_offset of VA 0x672588

[?] can't find file_offset of VA 0x6728bc

[?] can't find file_offset of VA 0x672af4

[?] can't find file_offset of VA 0x672e2c

[?] can't find file_offset of VA 0x673334

[?] can't find file_offset of VA 0x6736ac

[?] can't find file_offset of VA 0x673b70

[?] can't find file_offset of VA 0x673dfc

[?] can't find file_offset of VA 0x674094

[?] can't find file_offset of VA 0x67442c

[?] can't find file_offset of VA 0x6746dc

[?] can't find file_offset of VA 0x674974

[?] can't find file_offset of VA 0x674ba0

[?] can't find file_offset of VA 0x674fc0

[?] can't find file_offset of VA 0x675338

[?] can't find file_offset of VA 0x675684

[?] can't find file_offset of VA 0x675ba4

[?] can't find file_offset of VA 0x676040

[?] can't find file_offset of VA 0x676468

[?] can't find file_offset of VA 0x6767e4

[?] can't find file_offset of VA 0x676880

[?] can't find file_offset of VA 0x676974

[?] can't find file_offset of VA 0x676abc

[?] can't find file_offset of VA 0x676ecc

[?] can't find file_offset of VA 0x6772b0

[?] can't find file_offset of VA 0x677768

[?] can't find file_offset of VA 0x677a40

[?] can't find file_offset of VA 0x677e4c

[?] can't find file_offset of VA 0x678294

[?] can't find file_offset of VA 0x67861c

[?] can't find file_offset of VA 0x6789b4

[?] can't find file_offset of VA 0x678d1c

[?] can't find file_offset of VA 0x678df0

[?] can't find file_offset of VA 0x678e94

[?] can't find file_offset of VA 0x679158

[?] can't find file_offset of VA 0x679504

[?] can't find file_offset of VA 0x679870

[?] can't find file_offset of VA 0x679b64

[?] can't find file_offset of VA 0x679b74

[?] can't find file_offset of VA 0x67aaec

[?] can't find file_offset of VA 0x67aaf0

[?] can't find file_offset of VA 0x67ad78

[?] can't find file_offset of VA 0x67c0ac

[?] can't find file_offset of VA 0x67c928

[?] can't find file_offset of VA 0x67cd9c

[?] can't find file_offset of VA 0x681728

[?] can't find file_offset of VA 0x681ca4

[?] can't find file_offset of VA 0x68255c

[?] can't find file_offset of VA 0x6828d0

[?] can't find file_offset of VA 0x682be8

[?] can't find file_offset of VA 0x682e78

[?] can't find file_offset of VA 0x683554

[?] can't find file_offset of VA 0x683d78

[?] can't find file_offset of VA 0x684338

[?] can't find file_offset of VA 0x6854b0

[?] can't find file_offset of VA 0x685ae0

[?] can't find file_offset of VA 0x685d7c

[?] can't find file_offset of VA 0x686274

[?] can't find file_offset of VA 0x686d30

[?] can't find file_offset of VA 0x687708

[?] can't find file_offset of VA 0x688010

[?] can't find file_offset of VA 0x688f7c

[?] can't find file_offset of VA 0x694984

[?] can't find file_offset of VA 0x696e74

[?] can't find file_offset of VA 0x69886c

[?] can't find file_offset of VA 0x6a8288

[?] can't find file_offset of VA 0x6a829c

[?] can't find file_offset of VA 0x6a82b0

[?] can't find file_offset of VA 0x6a82c4

[?] can't find file_offset of VA 0x6a82d8

[?] can't find file_offset of VA 0x6a82ec

[?] can't find file_offset of VA 0x6a8300

[?] can't find file_offset of VA 0x6a8314

[?] can't find file_offset of VA 0x6a8328

[?] can't find file_offset of VA 0x6a833c

[?] can't find file_offset of VA 0x6a8350

[?] can't find file_offset of VA 0x6a8364

[?] can't find file_offset of VA 0x6a8378

[?] can't find file_offset of VA 0x6a838c

[?] can't find file_offset of VA 0x6a83a0

[?] can't find file_offset of VA 0x6a83b4

[?] can't find file_offset of VA 0x6a83c8

[?] can't find file_offset of VA 0x6a83dc

[?] can't find file_offset of VA 0x6a83f0

[?] can't find file_offset of VA 0x6a8404

[?] too many errors getting resource data, stopped on 0 of 1

[?] invalid VS_VERSIONINFO child type "t\x00r\x00i\x00"

[?] can't find file_offset of VA 0x5a83c8

[?] can't find file_offset of VA 0x61a000

[?] can't find file_offset of VA 0x617000