CSuserPlugin.exe

info
MZ
PE
resources
strings
imports
foremost
7zip
signature
hexdump
disasm
log
discuss
donate

filename	CSuserPlugin.exe
size	1602168 (0x187278)
md5	e5bee0d99c6bfacc4283879cd86504ae

type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, RAR self-extracting archive
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x50
blocks_in_file	2
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0xf
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0x1a
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x200

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001c0:

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x400fd1c6
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	5.0
SizeOfCode	0xb000
SizeOfInitializedData	0x2000
SizeOfUninitializedData	0x15000
AddressOfEntryPoint	0x20ad0
BaseOfCode	0x16000
BaseOfData	0x21000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x23000
SizeOfHeaders	0x1000
CheckSum	0x192159
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x2000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

UPX v0.89.6 - v1.02 / v1.05 - v1.22

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
UPX0	0x1000	0x15000	0	RWX UDATA
UPX1	0x16000	0xb000	0xae00	RWX IDATA
.rsrc	0x21000	0x2000	0x1c00	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x228e8	0x1dc
RESOURCE	0x21000	0x18e8
EXCEPTION	0	0
SECURITY	0x186058	0x1220
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
BITMAP	#101	2998
ICON	#1	296
ICON	#2	1384
ICON	#3	744
ICON	#4	2216
DIALOG	ASKNEXTVOL	702
DIALOG	GETPASSWORD1	310
DIALOG	LICENSEDLG	242
DIALOG	RENAMEDLG	334
DIALOG	REPLACEFILEDLG	800
DIALOG	STARTDLG	538
STRING	#7	596
STRING	#8	910
STRING	#9	482
STRING	#10	634
GROUP_ICON	#100	62
MANIFEST	#1	531

id	lang	string
96	1049	81 39 8d e2 b2 95 88 26 fa 29 17 59 6f ce 41 bc \|.9.....&.).Yo.A.\| 81 44 57 20 3b 0a 8a 90 68 6e 93 89 d4 10 0e 91 \|.DW ;...hn......\| 58 36 1d 6c 2d 42 d1 cd 53 d8 f7 6c 6a 16 0b d7 \|X6.l-B..S..lj...\| 88 da 37 5e c6 08 23 34 a8 31 83 e8 50 64 5e 00 \|..7^..#4.1..Pd^.\| a2 f1 af 50 0c 0b 5a 2b 48 0c dd 60 a0 da 0b 48 \|...P..Z+H..`...H\| d7 60 f2 c7 eb c9 60 ec 2e f8 b3 88 22 81 3e 33 \|.`....`.....".>3\| c6 dc c1 d8 e0 16 ff 13 4e 31 93 74 20 d6 1d 1b \|........N1.t ...\| 01 cb 83 0a a3 78 05 08 06 88 df 67 cf 70 8b 62 \|.....x.....g.p.b\| d0 03 93 15 33 d0 47 f0 de 95 3b 99 72 a8 81 bb \|....3.G...;.r...\| 0f 07 19 f8 57 6a 73 1a bd 23 b0 01 f7 d9 e6 2c \|....Wjs..#.....,\| f4 73 d5 67 84 b4 1d 75 82 ba 5c 35 47 11 3a de \|.s.g...u..\5G.:.\| a5 5e 16 c5 c2 22 e3 08 32 0f 16 23 0e c6 af a2 \|.^..."..2..#....\| fe 74 c2 37 f5 84 16 42 83 2c 59 1f f3 8a bd 8e \|.t.7...B.,Y.....\| 3a c6 50 a6 84 46 a8 83 0c da f7 3e b2 12 5c b6 \|:.P..F.....>..\.\| 30 75 28 11 3a 02 60 50 3b d6 c6 7b 17 b8 10 41 \|0u(.:.`P;..{...A\| 02 f9 d5 b1 f8 8c 9b 83 eb 6b 03 f7 e4 6a c1 e2 \|.........k...j..\| b9 ea 6c 0a 5b 20 79 1a 82 44 32 45 a4 5e bb f9 \|..l.[ y..D2E.^..\| 93 41 46 3f c7 17 ff 07 8b 4f a3 57 04 20 57 eb \|.AF?.....O.W. W.\| 3b 4b 0b 2f 8b da 3c 47 43 ab 6c a0 46 af 6f 84 \|;K./..\| 78 0a 30 45 \|x.0E \|
112	1049	82 64 bf 7e f8 b6 99 f2 28 3e c6 94 10 6b 07 0f \|.d.~....(>...k..\| 09 2b cf df 5d a0 e1 0f 6c 0d d0 3b 2d 0f 9f c1 \|.+..]...l..;-...\| 6b ff 5b 17 94 a1 0b aa 30 d1 19 4e 8e 9d 04 1b \|k.[.....0..N....\| f8 cf e5 c9 12 8b 88 21 36 0b f6 62 2a 27 17 e5 \|.......!6..b'..\| e8 3f d8 a1 88 78 37 3a 8a 4a 02 d3 ff 89 7c a9 \|.?...x7:.J....\|.\| 72 7f f4 42 47 29 0a 83 0b b0 a0 e8 b0 3b 03 11 \|r..BG).......;..\| 89 88 5e 82 f7 d7 5b f2 80 07 b7 8d 90 40 bc d0 \|..^...[......@..\| 55 80 21 1b 55 46 54 74 64 b8 0f c0 fa a3 42 c0 \|U.!.UFTtd.....B.\| 47 78 58 38 01 df 0b 99 3a a9 74 ea 3a 1a 36 70 \|GxX8....:.t.:.6p\| 12 17 01 2f 02 50 ff 1f ae 22 ee ec 75 d7 8b a3 \|.../.P..."..u...\| c9 01 8e 0e 8a 20 f6 4f c6 13 18 cb c7 89 47 c3 \|..... .O......G.\| 47 07 c2 f7 b8 50 0b be da 71 3b 03 b8 8d a4 b9 \|G....P...q;.....\| 1b f0 2a be 73 eb 05 58 5c 78 40 db 11 b6 78 66 \|...s..X\x@...xf\| 81 09 7d ed 14 7a 13 4e 2c f8 7e b0 5b 14 b8 20 \|..}..z.N,.~.[.. \| f6 b4 36 07 40 74 8b dd 73 31 ec 08 fe b1 8a 51 \|..6.@t..s1.....Q\| de b1 ed 75 e6 23 0d ff 11 06 01 11 25 ef 56 ad \|...u.#......%.V.\| 1a 16 fe db 70 d2 e2 14 2c 63 38 b6 88 26 8b 39 \|....p...,c8..&.9\| 2f 4a c1 0e 8e 4a b3 4a 46 94 f3 05 70 3c bc cc \|/J...J.JF...p<..\| f3 fe c3 4c ec a3 23 9d 8b 44 eb 58 4d 83 7c 91 \|...L..#..D.XM.\|.\| 8c e7 5e ca 16 95 03 4e df a3 51 ee 06 c1 0a 1c \|..^....N..Q.....\| 46 38 1b 33 df dc 03 2d e4 a5 6d 46 ac ed e5 9c \|F8.3...-..mF....\| 02 19 02 d8 78 9c 16 eb 4e 14 80 83 04 b3 ce 0f \|....x...N.......\| a0 8b 8e 85 46 71 cd 83 b7 14 bc 8e a0 4c 98 50 \|....Fq.......L.P\| f7 77 7f c0 03 e2 1f 0f 83 d8 82 8b 58 08 59 a2 \|.w..........X.Y.\| 34 10 ee 8b c6 3b ba 2d 95 68 75 e7 52 3a 32 74 \|4....;.-.hu.R:2t\| 5a f1 4d 17 6e 3b 8a 0e 3a 62 75 f6 30 3a 46 fb \|Z.M.n;..:bu.0:F.\| 72 48 c1 f4 d1 0b 23 14 8d 56 e7 18 82 0e a9 43 \|rH....#..V.....C\| 46 aa 14 6c 1c 20 bf be 3a fb dc a4 16 02 14 42 \|F..l. ..:......B\| 7b 18 af b6 57 a7 d0 8d 06 20 8e f0 6a 7b 13 74 \|{...W.... ..j{.t\| 73 73 1b 80 55 02 7d 69 62 a9 45 ea 62 02 88 20 \|ss..U.}ib.E.b.. \| ac 2d da 57 7d 00 17 89 5c 42 63 00 b0 55 db ce \|.-.W}...\Bc..U..\| cb 01 19 59 3e f0 19 f4 8b 97 c6 89 42 87 87 3b \|...Y>.......B..;\| d6 87 c5 b2 84 0b 04 7d fc f9 26 4b c4 fb 40 f5 \|.......}..&K..@.\| ff 87 05 f4 88 de 00 b1 52 12 0a 33 3b 87 e8 4b \|........R..3;..K\| 8d e7 25 08 1a 83 df 03 02 92 e4 76 53 b3 4d 2d \|..%........vS.M-\| a6 02 72 17 6b 33 d2 76 4d 55 17 2d 02 e6 b5 29 \|..r.k3.vMU.-...)\| ff 8f df 03 d4 fd 8b 75 39 c7 02 91 8f 7e 3b ec \|.......u9....~;.\| d8 09 9d 8f 2a 29 61 eb 17 a1 7b 13 b6 c7 25 e3 \|....)a...{...%.\| 02 5e 48 09 93 03 c3 c3 e7 50 b1 2e e1 bc b9 3a \|.^H......P.....:\| da 8a 16 89 48 83 50 10 8b 9f 36 6d b4 ef bc cd \|....H.P...6m....\| 20 0b fd fa 96 01 b9 7a 50 50 d4 f8 08 76 1d 6a \| ......zPP...v.j\| 87 e5 7d d1 ea eb 0e 1d 04 df 8d b7 bd 68 28 4e \|..}..........h(N\| 69 c6 e8 55 36 f0 2c 28 4c b9 56 a6 2a 60 0f 6c \|i..U6.,(L.V.`.l\| f7 ed ba 25 0e 09 15 24 5b fa f8 2e 41 1b ca 9d \|...%...$[...A...\| 6a 4d 38 38 e9 98 4b a7 4e b6 fa 20 3c 5c 8e 2e \|jM88..K.N.. <\..\| fb 6d 96 b2 72 4b 60 12 07 59 f0 01 ab 0a 5e eb \|.m..rK`..Y....^.\| 59 8b 96 89 52 2c c4 de 48 45 8b ee d0 86 43 9e \|Y...R,..HE....C.\| 2f 38 01 96 8d 8e 8e 2e 70 a5 06 02 62 75 b9 0b \|/8......p...bu..\| de f3 90 16 29 86 c6 19 93 ef 2d 0d dd 82 34 a1 \|....).....-...4.\| 34 3f b6 c3 1a b0 ea 5c a5 3e 34 c4 2c 0e ab d3 \|4?.....\.>4.,...\| bd 99 1e 4c c8 02 0c 30 3b c4 10 27 10 4d ed 61 \|...L...0;..'.M.a\| c7 07 a8 7b 04 24 e6 01 87 4b 23 43 ee c2 b7 c5 \|...{.$...K#C....\| 77 03 3b c8 8b 6f 96 c2 57 fc 0b 1c de 01 1d 0e \|w.;..o..W.......\| ce 36 66 02 67 bc d2 23 d0 ee 12 90 66 68 98 f0 \|.6f.g..#....fh..\| 60 80 e5 a1 32 7a 0b 06 e8 3e 43 2a a4 50 10 3d \|`...2z...>C*.P.=\| 96 75 72 ab 21 84 50 89 54 56 af 88 61 6a 38 97 \|.ur.!.P.TV..aj8.\| 2f c0 ac 69 8a 94 94 00 eb 5b 8b 17 c2 e9 \|/..i.....[.... \|
128	1049	45 5c 11 01 d5 64 64 84 86 3d 96 96 68 18 69 f8 \|E\...dd..=..h.i.\| e2 eb 25 bd 50 04 2f ca 84 78 e6 84 cd 8e 45 d1 \|..%.P./..x....E.\| e9 6d 86 68 c8 46 ee f7 14 5f 32 51 73 70 89 06 \|.m.h.F..._2Qsp..\| bb 03 f7 54 98 be 64 db 5c 3c 1e 73 05 63 51 f7 \|...T..d.\<.s.cQ.\| 62 6b f6 04 78 09 e0 97 79 3b 6f e0 90 ef 0c 03 \|bk..x...y;o.....\| 0f 97 f2 d1 66 89 3f 5a 73 41 17 eb 66 af 83 c1 \|....f.?ZsA..f...\| ea e3 a5 06 70 12 af c1 03 b2 ca c3 83 e8 1b 34 \|....p..........4\| 49 3b c1 73 1f 29 f2 74 84 4b 39 34 55 0f 93 40 \|I;.s.).t.K94U..@\| c8 41 6b 4b ed f6 d7 03 cc eb 39 25 53 f2 27 18 \|.AkK......9%S.'.\| d5 05 3a 5b 23 e6 5b 3b c6 02 ad fd 13 5f 73 01 \|..:[#.[;....._s.\| 4e 03 ce 1b 3a e3 15 0c 6d d9 d6 39 65 03 6d 37 \|N...:...m..9e.m7\| 03 fd ba 3d 8b f5 ed 03 f6 8c b6 45 89 4b 6f ed \|...=.......E.Ko.\| d3 56 02 cd 0e 88 b3 98 2b 8b 5b cc 9f e4 28 e0 \|.V......+.[...(.\| 48 55 85 c9 1b 9c 9e 35 cb 65 0f 1b eb 0e c7 16 \|HU.....5.e......\| 88 50 43 e0 87 dc 0e 60 10 8a 06 24 7f f2 ce 5c \|.PC....`...$...\\| e8 18 c0 a7 e8 a8 f3 00 4c 96 27 cb ae 0a 93 38 \|........L.'....8\| 34 fd 74 40 5e c4 93 4b 4c dd dc ab 47 02 62 8b \|4.t@^..KL...G.b.\| 76 57 51 5c 57 e7 e4 64 2b 06 68 69 6a 10 42 02 \|vWQ\W..d+.hij.B.\| 66 6f 97 15 f5 5e b4 9d 86 13 47 a8 a1 d7 c8 d3 \|fo...^....G.....\| 86 49 34 50 98 7d a8 07 54 59 8c 18 24 78 9d ec \|.I4P.}..TY..$x..\| 2d 09 bf 93 0f fe 1c 77 40 2e ec ae 0f 00 93 4c \|-......w@......L\| e1 8c a2 24 40 05 fc a0 47 20 01 2b eb 56 4e 55 \|...$@...G .+.VNU\| 99 70 25 27 8b d8 46 c5 80 1c 57 b3 c6 4c 38 09 \|.p%'..F...W..L8.\| f5 f6 75 19 aa eb 0d 24 36 d5 67 27 22 01 7b 01 \|..u....$6.g'".{.\| 17 88 88 ea 1d a3 36 13 d4 e7 a8 5d 68 9b e6 7f \|......6....]h...\| 81 07 98 b0 55 a4 2b d9 8b cb 81 f9 fc fe 3f b3 \|....U.+.......?.\| df eb a2 81 bf b8 15 0f 73 75 21 af 7d 16 dc ff \|........su!.}...\| 80 05 36 b0 03 f3 13 07 51 f6 5b 10 01 41 88 1e \|..6.....Q.[..A..\| eb 20 21 6d a9 66 ff 4a 75 dd eb 37 8b d9 1a 39 \|. !m.f.Ju..7...9\| ff 56 b3 5f 10 b1 8b 60 57 1c 3e 3f 4d 40 bd b3 \|.V._...`W.>?M@..\| 43 19 \|C. \|
144	1049	b2 c2 04 0b 2e 05 7f 75 c9 0b db 1a d0 56 91 30 \|.......u.....V.0\| ac 30 31 05 dc 88 52 85 18 35 31 01 1f 03 3a 44 \|.01...R..51...:D\| 67 c2 31 02 0b d9 be fb de 21 eb 4a 6a fe 05 3b \|g.1......!.Jj..;\| 5a 24 73 61 91 5e 5e de 04 14 73 31 0c 73 19 08 \|Z$sa.^^...s1.s..\| 73 0a 07 f4 36 ec 86 e9 06 30 be 02 09 18 10 73 \|s...6....0.....s\| 07 6f 23 63 55 6b 7f 78 12 1c 73 13 db f3 d3 6c \|.o#cUk.x..s....l\| 17 18 05 67 be 06 60 12 20 f6 f2 fc 34 07 54 be \|...g..`. ...4.T.\| 08 4d 34 73 2b 2f ee fc 74 cf 2c 28 1c 09 37 be \|.M4s+/..t.,(..7.\| 0a 5a 67 7b 7e ba 30 12 0b 24 be 0c 1d 2a 3c 64 \|.Zg{~.0..$...."<....TL..\| 14 c4 a3 17 6d 9d cd 41 75 3c 96 e7 ee c2 23 46 \|....m..Au<....#F\| a3 36 0d 09 93 bc 0b 2e 16 0d d8 7e 0f 4d 6c 19 \|.6.........~.Ml.\| 16 2b 28 46 03 56 93 a5 79 0b ec 36 da 2e a9 04 \|.+(F.V..y..6....\| b2 73 47 01 74 d9 44 b7 b3 43 30 98 28 6c 57 82 \|.sG.t.D..C0.(lW.\| 70 57 df b0 fb ae 64 05 75 0d 3b 83 60 07 76 0b \|pW....d.u.;.`.v.\| dd 07 ac 0f 8f 23 8f 9d 3d 7b 7f c1 74 0c d1 00 \|.....#..={..t...\| 1a 83 bb 54 e8 59 6e 7b dd 94 66 55 99 f0 34 fc \|...T.Yn{..fU..4.\| fb 5c a4 ef 27 b0 01 27 a5 3b b3 fc 17 01 d9 5c \|.\..'..'.;.....\\| 6d 26 23 dd 76 40 b6 86 24 08 ea 14 b1 05 5a f2 \|m&#.v@..$.....Z.\| 99 ed 3b 01 16 1a 02 0f a1 0a ff 79 0e 36 c8 96 \|..;........y.6..\| 03 30 0a 38 80 90 2a b6 03 04 62 8a bd c7 a8 d8 \|.0.8.....b.....\| 5a 80 60 14 db 18 eb 0d aa 19 b0 44 75 1c 1c 2f \|Z.`........Du../\| 40 e9 36 78 1f 51 26 52 18 ea 17 ed 15 b2 16 db \|@.6x.Q&R........\| eb 13 2a 35 68 26 72 38 d5 33 40 2f 0a 38 03 df \|..5h&r8.3@/.8..\| fd aa 8e fe 0c 00 29 04 7d 07 8f 14 c2 54 b8 57 \|......).}....T.W\| e1 06 d2 a2 ae 5a c5 8c f3 c5 25 60 4f 76 ac 20 \|.....Z....%`Ov. \| b0 fe 98 94 05 75 2f 7d e7 2a 4c 37 20 cd 20 56 \|.....u/}.L7 . V\| 33 60 a7 c8 54 20 3b 14 35 02 23 3d 61 b3 ff 83 \|3`..T ;.5.#=a...\| ce 8b b6 1f 2b 10 34 c6 3f 1b 8d 93 60 4c b2 23 \|....+.4.?...`L.#\| d1 60 2d ff a4 7d 1e 2f ea d8 6f b1 cc 11 52 59 \|.`-..}./..o...RY\| 88 01 31 3d 0f a9 bd ee a3 fb \|..1=...... \|

module_name	ord	function_name
KERNEL32.DLL		LoadLibraryA
KERNEL32.DLL		GetProcAddress
KERNEL32.DLL		ExitProcess
ADVAPI32.DLL		RegCloseKey
COMCTL32.DLL	17
COMDLG32.DLL		GetOpenFileNameA
GDI32.DLL		DeleteObject
OLE32.DLL		OleInitialize
SHELL32.DLL		SHGetMalloc
USER32.DLL		SetMenu

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=US/O=Thawte, Inc./CN=Thawte Code Signing CA - G2

serial: 3B5013EB90725082EC7755EA3FC36E90

Certificates (3)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3b:50:13:eb:90:72:50:82:ec:77:55:ea:3f:c3:6e:90
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=Thawte, Inc., CN=Thawte Code Signing CA - G2
        Validity
            Not Before: Mar 29 00:00:00 2011 GMT
            Not After : Mar 28 23:59:59 2012 GMT
        Subject: C=RU, ST=Moscow, L=Moscow, O=Rostelecom, CN=Rostelecom
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b1:53:e7:3e:30:5a:8f:06:74:a5:c1:f1:7f:0f:
                    c9:61:2b:1e:06:84:68:38:3b:36:33:9f:c1:d4:04:
                    14:28:19:f2:2a:64:ea:57:d1:10:ed:e1:d6:61:85:
                    1e:26:39:cb:05:bd:b1:33:46:f7:cb:8f:ca:d0:ad:
                    5a:17:ce:b8:d3:9d:3a:9c:cb:7e:1b:2e:5b:23:cf:
                    e3:82:99:7d:a3:bd:87:96:a8:45:8e:05:5e:6a:11:
                    87:24:db:b5:a4:1b:49:19:81:d4:4d:9f:91:c6:d0:
                    bd:07:13:93:75:80:a3:1c:6d:4d:df:85:87:4b:5f:
                    8d:8b:68:7d:d5:ef:b5:a2:b0:e6:66:19:52:ec:ee:
                    a4:fb:a9:ff:2b:88:59:8e:c5:fd:1d:74:60:2c:6b:
                    d4:7c:1d:1d:e7:a9:71:7d:20:99:14:f5:69:4b:6a:
                    95:38:a7:e6:8a:14:72:f6:c3:fa:3b:27:e5:56:be:
                    7c:d9:fd:89:af:7e:66:d5:a3:9d:a4:38:6d:11:eb:
                    50:3e:f7:34:26:61:3f:e5:04:69:f0:2b:01:06:d7:
                    bb:ab:aa:60:cd:45:dd:e5:57:df:77:e2:94:a6:75:
                    25:d5:2b:17:6b:7d:11:76:29:29:0b:b7:7c:2b:d0:
                    ec:9c:55:1a:d2:6c:a3:23:cd:89:88:e3:a9:cf:ef:
                    0d:67
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://cs-g2-crl.thawte.com/ThawteCSG2.crl

            X509v3 Extended Key Usage: 
                Code Signing, Microsoft Commercial Code Signing
            2.5.29.4: 
                0.0.0..
+.....7.......
            Authority Information Access: 
                OCSP - URI:http://ocsp.thawte.com

            Netscape Cert Type: 
                Object Signing
    Signature Algorithm: sha1WithRSAEncryption
         ac:be:84:a5:28:31:6f:d9:c0:ee:ef:3b:14:9b:86:07:9d:bc:
         23:46:c6:01:ad:50:b7:a0:58:a6:bb:6b:b6:7d:72:c7:74:ed:
         47:ef:40:08:9b:29:89:63:03:8c:01:92:47:c9:8e:0e:5f:32:
         8a:d4:f4:d6:11:f2:ae:25:d9:7d:cb:1e:5a:ea:ee:11:30:70:
         2e:eb:1a:f5:b7:83:53:a3:9e:d4:5a:ad:f8:05:6e:f5:94:ee:
         12:36:c0:31:88:21:30:45:79:20:47:ed:38:5f:cd:55:a9:a6:
         ed:a8:16:08:a6:ae:0b:1f:0c:9a:d9:50:f7:f7:f0:77:0c:5e:
         cb:d0:8a:02:fa:de:3a:27:9a:e5:d1:48:87:47:24:da:fb:78:
         95:26:b8:03:b4:37:94:f0:15:3d:ac:6b:0e:5d:6a:0c:10:1a:
         34:99:55:94:fe:db:3d:e6:bb:ba:dc:51:7f:bb:c0:b9:15:05:
         ed:c6:91:38:f8:65:4d:3a:0d:d9:b9:f8:0d:8c:ef:25:87:0f:
         c9:42:e8:d5:76:10:b6:45:21:81:fc:1d:19:82:56:49:30:33:
         88:8d:44:f5:e9:93:cd:83:8b:5f:b6:1c:88:bd:29:b3:df:19:
         a0:97:5f:4a:52:0f:f5:63:29:9e:4f:4c:66:9e:03:67:c8:5f:
         f7:4b:17:d6

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Object
        Validity
            Not Before: May 10 00:00:00 2010 GMT
            Not After : May 10 23:59:59 2015 GMT
        Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Time Stamping Signer
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:bc:35:a0:36:70:22:81:11:c3:b2:83:b9:d3:28:
                    c6:36:cd:25:6b:a9:7b:b2:1c:f6:9b:51:9c:ef:35:
                    f4:ed:08:8e:5e:38:08:f8:77:3c:0a:42:e0:f3:70:
                    dc:a3:d7:ca:f5:4c:0b:cf:ff:22:9c:0a:7e:68:d6:
                    09:a2:2a:84:7b:a6:9d:b4:a9:c1:33:e2:ef:1f:17:
                    48:ca:3a:cd:46:e6:c5:aa:77:bd:e3:77:9a:fa:47:
                    53:40:28:59:43:93:f1:a4:81:ea:ef:80:b5:4f:a7:
                    08:ce:ba:6e:bc:ca:76:0c:97:64:59:86:24:bb:3d:
                    82:90:a8:55:b1:92:d3:a0:a7:05:ac:9f:53:25:08:
                    10:47:99:cd:98:de:68:e5:b4:50:78:a3:af:01:cc:
                    59:43:58:e4:76:6e:7e:ac:c7:e2:9e:1f:4f:b0:47:
                    2d:c8:0c:a3:49:27:80:75:8c:bb:06:91:65:0f:90:
                    9b:f4:ba:d1:81:c8:5c:6a:ec:14:e9:25:09:bf:23:
                    16:f4:95:46:40:40:21:bb:83:96:fd:86:1f:7a:c8:
                    0d:10:8e:a2:f8:19:07:58:7f:9f:bd:37:02:60:f2:
                    a4:e9:9d:44:3f:30:05:e4:a7:70:99:51:9a:e8:17:
                    f1:55:ca:b2:61:89:65:46:a7:6a:f2:58:46:7e:aa:
                    a0:07
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier: 
                keyid:DA:ED:64:74:14:9C:14:3C:AB:DD:99:A9:BD:5B:28:4D:8B:3C:C9:D8

            X509v3 Subject Key Identifier: 
                2E:2D:B0:0A:44:4A:D3:87:C0:02:07:CE:97:7D:50:62:20:FD:0F:83
            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Extended Key Usage: critical
                Time Stamping
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.usertrust.com/UTN-USERFirst-Object.crl

            Authority Information Access: 
                OCSP - URI:http://ocsp.usertrust.com

    Signature Algorithm: sha1WithRSAEncryption
         c8:fb:63:f8:0b:75:75:2c:3a:f1:f2:13:a7:2d:b6:a3:1a:9c:
         ad:01:07:d3:34:8e:77:e0:c2:6e:ae:02:5d:48:4f:a4:d2:21:
         b6:36:fd:2a:35:43:7c:6b:df:80:87:0b:15:f0:76:32:00:b4:
         ce:b5:67:a4:2f:2f:20:1b:9c:54:9e:83:3f:1f:5f:14:95:62:
         82:0f:22:41:22:1f:70:b3:f3:f7:42:de:6c:51:cd:4b:f8:21:
         ac:9b:3b:8c:b1:e5:e6:28:8f:ce:2a:8a:f9:aa:52:4d:8c:5b:
         77:ba:4d:5a:58:db:bb:6a:04:cc:52:1e:9d:e2:28:37:0e:bb:
         e7:0e:91:c7:f8:db:f1:81:98:eb:cd:37:b3:0e:ab:65:d3:62:
         ec:3a:a5:76:eb:13:a8:35:93:c9:2e:0a:01:ec:c0:e8:cc:3d:
         7e:b6:eb:e2:c1:ec:d3:14:92:82:66:87:50:dc:fd:50:97:ac:
         b3:4a:76:73:06:c4:86:11:3a:b3:5f:43:04:52:6f:ea:b3:d0:
         74:36:4c:ca:f1:1b:79:84:37:70:63:ad:74:b9:aa:0e:f3:98:
         b0:86:08:eb:db:e0:1f:8c:10:f2:39:64:9b:ae:4f:0a:2c:92:
         8a:4f:18:b5:91:e5:8d:1a:93:5f:1f:ae:f1:a6:f0:2e:97:d0:
         d2:f6:2b:3c

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA
        Validity
            Not Before: Feb  8 00:00:00 2010 GMT
            Not After : Feb  7 23:59:59 2020 GMT
        Subject: C=US, O=Thawte, Inc., CN=Thawte Code Signing CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b7:8b:cf:75:5b:9f:25:da:7e:39:b0:93:db:38:
                    d3:a9:23:d0:82:fa:e9:24:7e:5c:0b:8e:83:f8:e6:
                    7a:59:e6:a3:c5:98:a7:99:d2:44:ff:00:a6:a5:39:
                    04:8a:da:29:88:ea:db:a2:f3:1c:99:15:26:c2:b1:
                    f4:fc:e1:0c:47:a9:09:11:06:0a:20:92:b9:c7:a0:
                    04:8c:5c:94:19:ab:5b:25:2c:1d:62:7e:70:0d:ce:
                    61:6c:dd:2b:82:c9:ce:5d:48:5f:f7:c2:be:bc:41:
                    23:1e:4f:29:5d:d7:4f:bc:f4:c5:2a:fc:63:e6:7c:
                    26:4e:99:a7:79:41:9e:10:4a:7a:79:c9:c6:86:f7:
                    86:95:d2:26:ce:3c:18:2a:d6:7c:ce:af:cd:ad:bb:
                    f7:82:2c:70:26:37:45:e5:0f:47:22:c6:01:28:bd:
                    2e:83:5c:6a:a4:47:c1:e7:d0:d8:6b:81:46:3f:21:
                    17:f5:07:c5:43:5a:a6:67:2c:b8:7b:60:11:b5:83:
                    ee:f5:74:0a:72:71:44:3d:58:fe:e8:1a:ab:38:c3:
                    59:db:7f:6e:38:7d:76:c7:72:69:98:36:96:57:d3:
                    66:1c:d2:54:91:04:2e:54:19:b0:dc:3d:b5:22:5e:
                    86:d5:2a:7e:20:df:5d:e6:7a:b1:65:fe:c5:02:4e:
                    31:2d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.thawte.com/ThawtePCA.crl

            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            Authority Information Access: 
                OCSP - URI:http://ocsp.thawte.com

            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, Code Signing
            X509v3 Subject Alternative Name: 
                DirName:/CN=VeriSignMPKI-2-10
            X509v3 Subject Key Identifier: 
                D4:0D:65:3F:7A:BD:34:C6:FE:47:E7:4C:0D:C0:BD:F2:DE:15:AB:71
            X509v3 Authority Key Identifier: 
                keyid:7B:5B:45:CF:AF:CE:CB:7A:FD:31:92:1A:6A:B6:F3:46:EB:57:48:50

    Signature Algorithm: sha1WithRSAEncryption
         56:fe:53:5c:e1:c7:9e:bc:a7:ed:7e:53:6d:6a:14:4b:51:8c:
         40:5e:80:5f:aa:a4:e8:2f:ef:38:c8:04:c9:ca:3e:cf:df:3a:
         58:4e:b0:d4:b6:63:c5:29:57:fa:02:05:9a:45:4d:68:db:2a:
         1b:d4:34:3d:9f:00:c3:5a:cb:95:49:a5:6e:e1:b0:c5:fc:41:
         4d:41:4a:6f:d3:77:c8:d7:38:8d:e4:19:de:18:f3:1f:15:65:
         83:6d:45:0c:53:f9:0a:9a:2e:a5:5d:bf:6f:32:81:18:92:19:
         6a:55:00:ad:63:1c:52:06:7e:55:d9:29:68:ae:4a:7c:18:9a:
         79:88:6b:23:23:d8:27:38:2a:29:87:76:ca:fb:c7:b6:62:23:
         1f:ed:7a:56:4c:dd:9c:32:5b:f5:3d:0c:46:18:95:3b:2a:23:
         68:83:64:41:d9:00:6d:0f:19:24:15:68:72:bd:c5:71:67:6e:
         ac:4c:db:90:eb:51:a5:1a:62:07:d0:be:6a:00:47:3c:72:2f:
         ec:4f:61:3e:73:85:ce:5a:0a:b7:ba:c0:1c:13:75:e3:22:39:
         28:dd:6d:1d:09:46:9d:4f:ba:e8:40:81:91:c6:a4:ce:94:72:
         1b:01:cf:2a:6e:15:67:95:89:ae:7d:b7:b7:cd:f9:0a:3d:75:
         b6:6b:3c:25

pkcs7-signedData

SHA1: nil

1.3.6.1.4.1.311.2.1.4

1.3.6.1.4.1.311.2.1.15

00 3c 00 3c 00 3c 00 4f  00 62 00 73 00 6f 00 6c  |.<.<.<.O.b.s.o.l|
00 65 00 74 00 65 00 3e  00 3e 00 3e              |.e.t.e.>.>.>    |

SHA1

93 72 66 e5 3e a1 df 2d 76 f7 3d 84 57 af 81 d1 |.rf.>..-v.=.W...| 47 e8 4b 65 |G.Ke |

Certificates
- Certificate #0
  - 2
    - 3B:50:13:EB:90:72:50:82:EC:77:55:EA:3F:C3:6E:90
    - RSA-SHA1: nil
    - Issuer
      - C: US
      - O: Thawte, Inc.
      - CN: Thawte Code Signing CA - G2
    - 2011-03-29 00:00:00 UTC: 2012-03-28 23:59:59 UTC
    - Subject
      - C: RU
      - ST: Moscow
      - L: Moscow
      - O: Rostelecom
      - CN: Rostelecom
    - #5
      - rsaEncryption: nil
      - B1:53:E7:3E:30:5A:8F:06:74:A5:C1:F1:7F:0F:C9:61:
        2B:1E:06:84:68:38:3B:36:33:9F:C1:D4:04:14:28:19:
        F2:2A:64:EA:57:D1:10:ED:E1:D6:61:85:1E:26:39:CB:
        05:BD:B1:33:46:F7:CB:8F:CA:D0:AD:5A:17:CE:B8:D3:
        9D:3A:9C:CB:7E:1B:2E:5B:23:CF:E3:82:99:7D:A3:BD:
        87:96:A8:45:8E:05:5E:6A:11:87:24:DB:B5:A4:1B:49:
        19:81:D4:4D:9F:91:C6:D0:BD:07:13:93:75:80:A3:1C:
        6D:4D:DF:85:87:4B:5F:8D:8B:68:7D:D5:EF:B5:A2:B0:
        E6:66:19:52:EC:EE:A4:FB:A9:FF:2B:88:59:8E:C5:FD:
        1D:74:60:2C:6B:D4:7C:1D:1D:E7:A9:71:7D:20:99:14:
        F5:69:4B:6A:95:38:A7:E6:8A:14:72:F6:C3:FA:3B:27:
        E5:56:BE:7C:D9:FD:89:AF:7E:66:D5:A3:9D:A4:38:6D:
        11:EB:50:3E:F7:34:26:61:3F:E5:04:69:F0:2B:01:06:
        D7:BB:AB:AA:60:CD:45:DD:E5:57:DF:77:E2:94:A6:75:
        25:D5:2B:17:6B:7D:11:76:29:29:0B:B7:7C:2B:D0:EC:
        9C:55:1A:D2:6C:A3:23:CD:89:88:E3:A9:CF:EF:0D:67: 0x010001
    - X509v3 extensions
      - basicConstraints
        true
        nil
      - crlDistributionPoints: http://cs-g2-crl.thawte.com/ThawteCSG2.crl
      - extendedKeyUsage
        codeSigning: msCodeCom
      - 2.5.29.4
        msCodeCom: 0x80
      - authorityInfoAccess
        OCSP: http://ocsp.thawte.com
      - nsCertType: 0x10
  - RSA-SHA1:
```
ac be 84 a5 28 31 6f d9  c0 ee ef 3b 14 9b 86 07  |....(1o....;....|
9d bc 23 46 c6 01 ad 50  b7 a0 58 a6 bb 6b b6 7d  |..#F...P..X..k.}|
72 c7 74 ed 47 ef 40 08  9b 29 89 63 03 8c 01 92  |r.t.G.@..).c....|
47 c9 8e 0e 5f 32 8a d4  f4 d6 11 f2 ae 25 d9 7d  |G..._2.......%.}|
cb 1e 5a ea ee 11 30 70  2e eb 1a f5 b7 83 53 a3  |..Z...0p......S.|
9e d4 5a ad f8 05 6e f5  94 ee 12 36 c0 31 88 21  |..Z...n....6.1.!|
30 45 79 20 47 ed 38 5f  cd 55 a9 a6 ed a8 16 08  |0Ey G.8_.U......|
a6 ae 0b 1f 0c 9a d9 50  f7 f7 f0 77 0c 5e cb d0  |.......P...w.^..|
8a 02 fa de 3a 27 9a e5  d1 48 87 47 24 da fb 78  |....:'...H.G$..x|
95 26 b8 03 b4 37 94 f0  15 3d ac 6b 0e 5d 6a 0c  |.&...7...=.k.]j.|
10 1a 34 99 55 94 fe db  3d e6 bb ba dc 51 7f bb  |..4.U...=....Q..|
c0 b9 15 05 ed c6 91 38  f8 65 4d 3a 0d d9 b9 f8  |.......8.eM:....|
0d 8c ef 25 87 0f c9 42  e8 d5 76 10 b6 45 21 81  |...%...B..v..E!.|
fc 1d 19 82 56 49 30 33  88 8d 44 f5 e9 93 cd 83  |....VI03..D.....|
8b 5f b6 1c 88 bd 29 b3  df 19 a0 97 5f 4a 52 0f  |._....)....._JR.|
f5 63 29 9e 4f 4c 66 9e  03 67 c8 5f f7 4b 17 d6  |.c).OLf..g._.K..|
```
- Certificate #1
  - 2
    - 47:8A:8E:FB:59:E1:D8:3F:0C:E1:42:D2:A2:87:07:BE
    - RSA-SHA1: nil
    - Issuer
      - C: US
      - ST: UT
      - L: Salt Lake City
      - O: The USERTRUST Network
      - OU: http://www.usertrust.com
      - CN: UTN-USERFirst-Object
    - 2010-05-10 00:00:00 UTC: 2015-05-10 23:59:59 UTC
    - Subject
      - C: GB
      - ST: Greater Manchester
      - L: Salford
      - O: COMODO CA Limited
      - CN: COMODO Time Stamping Signer
    - #5
      - rsaEncryption: nil
      - BC:35:A0:36:70:22:81:11:C3:B2:83:B9:D3:28:C6:36:
        CD:25:6B:A9:7B:B2:1C:F6:9B:51:9C:EF:35:F4:ED:08:
        8E:5E:38:08:F8:77:3C:0A:42:E0:F3:70:DC:A3:D7:CA:
        F5:4C:0B:CF:FF:22:9C:0A:7E:68:D6:09:A2:2A:84:7B:
        A6:9D:B4:A9:C1:33:E2:EF:1F:17:48:CA:3A:CD:46:E6:
        C5:AA:77:BD:E3:77:9A:FA:47:53:40:28:59:43:93:F1:
        A4:81:EA:EF:80:B5:4F:A7:08:CE:BA:6E:BC:CA:76:0C:
        97:64:59:86:24:BB:3D:82:90:A8:55:B1:92:D3:A0:A7:
        05:AC:9F:53:25:08:10:47:99:CD:98:DE:68:E5:B4:50:
        78:A3:AF:01:CC:59:43:58:E4:76:6E:7E:AC:C7:E2:9E:
        1F:4F:B0:47:2D:C8:0C:A3:49:27:80:75:8C:BB:06:91:
        65:0F:90:9B:F4:BA:D1:81:C8:5C:6A:EC:14:E9:25:09:
        BF:23:16:F4:95:46:40:40:21:BB:83:96:FD:86:1F:7A:
        C8:0D:10:8E:A2:F8:19:07:58:7F:9F:BD:37:02:60:F2:
        A4:E9:9D:44:3F:30:05:E4:A7:70:99:51:9A:E8:17:F1:
        55:CA:B2:61:89:65:46:A7:6A:F2:58:46:7E:AA:A0:07: 0x010001
    - #6
      - authorityKeyIdentifier:
        da ed 64 74 14 9c 14 3c ab dd 99 a9 bd 5b 28 4d |..dt...<.....[(M| 8b 3c c9 d8 |.<.. |
      - subjectKeyIdentifier:
        2e 2d b0 0a 44 4a d3 87 c0 02 07 ce 97 7d 50 62 |.-..DJ.......}Pb| 20 fd 0f 83 | ... |
      - keyUsage: true, 0xc0
      - basicConstraints
        true
        nil
      - extendedKeyUsage: true, timeStamping
      - crlDistributionPoints: http://crl.usertrust.com/UTN-USERFirst-Object.crl
      - authorityInfoAccess
        OCSP: http://ocsp.usertrust.com
  - RSA-SHA1:
```
c8 fb 63 f8 0b 75 75 2c  3a f1 f2 13 a7 2d b6 a3  |..c..uu,:....-..|
1a 9c ad 01 07 d3 34 8e  77 e0 c2 6e ae 02 5d 48  |......4.w..n..]H|
4f a4 d2 21 b6 36 fd 2a  35 43 7c 6b df 80 87 0b  |O..!.6.*5C|k....|
15 f0 76 32 00 b4 ce b5  67 a4 2f 2f 20 1b 9c 54  |..v2....g.// ..T|
9e 83 3f 1f 5f 14 95 62  82 0f 22 41 22 1f 70 b3  |..?._..b.."A".p.|
f3 f7 42 de 6c 51 cd 4b  f8 21 ac 9b 3b 8c b1 e5  |..B.lQ.K.!..;...|
e6 28 8f ce 2a 8a f9 aa  52 4d 8c 5b 77 ba 4d 5a  |.(..*...RM.[w.MZ|
58 db bb 6a 04 cc 52 1e  9d e2 28 37 0e bb e7 0e  |X..j..R...(7....|
91 c7 f8 db f1 81 98 eb  cd 37 b3 0e ab 65 d3 62  |.........7...e.b|
ec 3a a5 76 eb 13 a8 35  93 c9 2e 0a 01 ec c0 e8  |.:.v...5........|
cc 3d 7e b6 eb e2 c1 ec  d3 14 92 82 66 87 50 dc  |.=~.........f.P.|
fd 50 97 ac b3 4a 76 73  06 c4 86 11 3a b3 5f 43  |.P...Jvs....:._C|
04 52 6f ea b3 d0 74 36  4c ca f1 1b 79 84 37 70  |.Ro...t6L...y.7p|
63 ad 74 b9 aa 0e f3 98  b0 86 08 eb db e0 1f 8c  |c.t.............|
10 f2 39 64 9b ae 4f 0a  2c 92 8a 4f 18 b5 91 e5  |..9d..O.,..O....|
8d 1a 93 5f 1f ae f1 a6  f0 2e 97 d0 d2 f6 2b 3c  |..._..........+<|
```
- Certificate #2
  - 2
    - 47:97:4D:78:73:A5:BC:AB:0D:2F:B3:70:19:2F:CE:5E
    - RSA-SHA1: nil
    - Issuer
      - C: US
      - O: thawte, Inc.
      - OU: Certification Services Division
      - OU: (c) 2006 thawte, Inc. - For authorized use only
      - CN: thawte Primary Root CA
    - 2010-02-08 00:00:00 UTC: 2020-02-07 23:59:59 UTC
    - Subject
      - C: US
      - O: Thawte, Inc.
      - CN: Thawte Code Signing CA - G2
    - #5
      - rsaEncryption: nil
      - B7:8B:CF:75:5B:9F:25:DA:7E:39:B0:93:DB:38:D3:A9:
        23:D0:82:FA:E9:24:7E:5C:0B:8E:83:F8:E6:7A:59:E6:
        A3:C5:98:A7:99:D2:44:FF:00:A6:A5:39:04:8A:DA:29:
        88:EA:DB:A2:F3:1C:99:15:26:C2:B1:F4:FC:E1:0C:47:
        A9:09:11:06:0A:20:92:B9:C7:A0:04:8C:5C:94:19:AB:
        5B:25:2C:1D:62:7E:70:0D:CE:61:6C:DD:2B:82:C9:CE:
        5D:48:5F:F7:C2:BE:BC:41:23:1E:4F:29:5D:D7:4F:BC:
        F4:C5:2A:FC:63:E6:7C:26:4E:99:A7:79:41:9E:10:4A:
        7A:79:C9:C6:86:F7:86:95:D2:26:CE:3C:18:2A:D6:7C:
        CE:AF:CD:AD:BB:F7:82:2C:70:26:37:45:E5:0F:47:22:
        C6:01:28:BD:2E:83:5C:6A:A4:47:C1:E7:D0:D8:6B:81:
        46:3F:21:17:F5:07:C5:43:5A:A6:67:2C:B8:7B:60:11:
        B5:83:EE:F5:74:0A:72:71:44:3D:58:FE:E8:1A:AB:38:
        C3:59:DB:7F:6E:38:7D:76:C7:72:69:98:36:96:57:D3:
        66:1C:D2:54:91:04:2E:54:19:B0:DC:3D:B5:22:5E:86:
        D5:2A:7E:20:DF:5D:E6:7A:B1:65:FE:C5:02:4E:31:2D: 0x010001
    - X509v3 extensions
      - basicConstraints
        true
        true: 0
      - crlDistributionPoints: http://crl.thawte.com/ThawtePCA.crl
      - keyUsage: true, 6
      - authorityInfoAccess
        OCSP: http://ocsp.thawte.com
      - extendedKeyUsage
        clientAuth: codeSigning
      - subjectAltName
        CN: VeriSignMPKI-2-10
      - subjectKeyIdentifier:
        d4 0d 65 3f 7a bd 34 c6 fe 47 e7 4c 0d c0 bd f2 |..e?z.4..G.L....| de 15 ab 71 |...q |
      - authorityKeyIdentifier:
        7b 5b 45 cf af ce cb 7a fd 31 92 1a 6a b6 f3 46 |{[E....z.1..j..F| eb 57 48 50 |.WHP |
  - RSA-SHA1:
```
56 fe 53 5c e1 c7 9e bc  a7 ed 7e 53 6d 6a 14 4b  |V.S\......~Smj.K|
51 8c 40 5e 80 5f aa a4  e8 2f ef 38 c8 04 c9 ca  |Q.@^._.../.8....|
3e cf df 3a 58 4e b0 d4  b6 63 c5 29 57 fa 02 05  |>..:XN...c.)W...|
9a 45 4d 68 db 2a 1b d4  34 3d 9f 00 c3 5a cb 95  |.EMh.*..4=...Z..|
49 a5 6e e1 b0 c5 fc 41  4d 41 4a 6f d3 77 c8 d7  |I.n....AMAJo.w..|
38 8d e4 19 de 18 f3 1f  15 65 83 6d 45 0c 53 f9  |8........e.mE.S.|
0a 9a 2e a5 5d bf 6f 32  81 18 92 19 6a 55 00 ad  |....].o2....jU..|
63 1c 52 06 7e 55 d9 29  68 ae 4a 7c 18 9a 79 88  |c.R.~U.)h.J|..y.|
6b 23 23 d8 27 38 2a 29  87 76 ca fb c7 b6 62 23  |k##.'8*).v....b#|
1f ed 7a 56 4c dd 9c 32  5b f5 3d 0c 46 18 95 3b  |..zVL..2[.=.F..;|
2a 23 68 83 64 41 d9 00  6d 0f 19 24 15 68 72 bd  |*#h.dA..m..$.hr.|
c5 71 67 6e ac 4c db 90  eb 51 a5 1a 62 07 d0 be  |.qgn.L...Q..b...|
6a 00 47 3c 72 2f ec 4f  61 3e 73 85 ce 5a 0a b7  |j.Gs..Z..|
ba c0 1c 13 75 e3 22 39  28 dd 6d 1d 09 46 9d 4f  |....u."9(.m..F.O|
ba e8 40 81 91 c6 a4 ce  94 72 1b 01 cf 2a 6e 15  |..@......r...*n.|
67 95 89 ae 7d b7 b7 cd  f9 0a 3d 75 b6 6b 3c 25  |g...}.....=u.k<%|
```

unnamed
- #0
  - C: US
  - O: Thawte, Inc.
  - CN: Thawte Code Signing CA - G2
- 3B:50:13:EB:90:72:50:82:EC:77:55:EA:3F:C3:6E:90
SHA1: nil

1.3.6.1.4.1.311.2.1.12
- nil
contentType: 1.3.6.1.4.1.311.2.1.4
1.3.6.1.4.1.311.2.1.11: msCodeCom

messageDigest:

ea f3 bc ff 8f a9 86 a8  d3 ab 1d a7 d8 89 7d 1a  |..............}.|
45 44 31 aa                                       |ED1.            |

rsaEncryption:

4e 11 ca 5c 66 58 9d a4  f5 8a 00 ee 53 f1 8a f6  |N..\fX......S...|
fe 2e 6d 1f dc f4 57 02  05 13 5c 84 e9 b3 6c 11  |..m...W...\...l.|
a8 7e 5e 4c a0 31 f2 c2  9b 9f df af 88 a8 98 5e  |.~^L.1.........^|
de 54 ac dc b6 1e 5f d2  51 3a 5a f6 4e 91 22 09  |.T...._.Q:Z.N.".|
31 3f 9a d0 f4 a2 4c 3b  2d 3c 4e a2 e1 13 ad a9  |1?....L;-.%.l<.y..|D.|
a9 40 a0 b8 16 4a 11 f9  05 a3 26 0c e1 67 41 16  |.@...J....&..gA.|
8a b0 60 cb fb 64 47 07  1b 52 ee 82 60 9f 2e a5  |..`..dG..R..`...|
b6 cc fc 8e 55 40 c0 d4  c2 3f c1 27 60 2e d3 f0  |....U@...?.'`...|
f0 60 aa d2 14 c8 0d 76  e1 1f 7b 82 75 a0 d1 fa  |.`.....v..{.u...|
3a d6 55 c0 9d c3 c8 a4  be 02 20 bc 9b 9e 29 c5  |:.U....... ...).|
f1 46 32 bd d6 0f ca be  66 3d a1 09 ff 2e 96 ac  |.F2.....f=......|
a5 30 80 92 d2 d3 d9 54  a7 8a 58 87 b1 b1 54 d6  |.0.....T..X...T.|

countersignature

unnamed
- #0
  - C: US
  - ST: UT
  - L: Salt Lake City
  - O: The USERTRUST Network
  - OU: http://www.usertrust.com
  - CN: UTN-USERFirst-Object
- 47:8A:8E:FB:59:E1:D8:3F:0C:E1:42:D2:A2:87:07:BE
SHA1: nil

contentType: pkcs7-data
signingTime: 2011-11-15 15:20:57 UTC

messageDigest:

5e f3 ed 3c 50 73 36 08  3e 75 0d 83 e3 64 b8 c3  |^..u...d..|
69 e6 3b 4e                                       |i.;N            |

rsaEncryption:

a7 19 c6 ab ea 54 5b 3e  54 f4 79 6d 08 b1 0d f1  |.....T[>T.ym....|
08 da 5b 4f 85 2e 99 42  fd 75 4a d7 ab d5 9c df  |..[O...B.uJ.....|
bd 94 60 63 d1 0e 31 04  cc 38 36 62 0b e2 9c 37  |..`c..1..86b...7|
68 92 0c b9 b6 2e ec 63  2c b7 2a e3 ce 44 89 54  |h......c,.*..D.T|
bb 05 6c 46 86 09 47 51  fd 99 a5 b0 e2 33 e1 65  |..lF..GQ.....3.e|
08 03 28 d4 4b 48 ec 4f  6c ae 13 a1 63 45 30 eb  |..(.KH.Ol...cE0.|
61 d7 ed a9 7c 73 bd 62  5e 40 bd 87 de 56 66 79  |a...|s.b^@...Vfy|
36 d1 f0 c6 52 d9 0d 18  5a ef eb a9 ea 2c 65 ad  |6...R...Z....,e.|
52 5f 9a 12 b2 a1 d8 51  1e 29 eb 14 a4 2a 13 d8  |R_.....Q.)...*..|
33 c9 bb d1 f0 60 12 d8  cb f8 93 d4 65 97 26 17  |3....`......e.&.|
84 5c 73 76 4b 38 5b 10  de e3 f5 ac 02 7e 3c b4  |.\svK8[......~<.|
ad 72 b7 b4 d8 3a de 00  c0 b9 db fe 79 3a d6 68  |.r...:......y:.h|
4a 70 ed 2d ae a2 87 57  59 13 16 62 ae bf 3c a5  |Jp.-...WY..b..<.|
1c 7b 9d 1f ea 08 26 33  4e 57 50 3b ae 8b 05 4b  |.{....&3NWP;...K|
35 f8 24 d6 13 32 fb 49  4e da fe 73 09 63 c5 45  |5.$..2.IN..s.c.E|
3a e2 18 fb ad 3c d9 a0  bc 59 3b 0e e3 cb 6c 0c  |:....<...Y;...l.|

show previews

offset	size	type	comment
0	52736	EXE	01/22/2004 13:36:06	#
15c1	15	HTM		#
ce00	1544792	RAR		#
186058	4640	PKCS7	Authenticode Signature	#

Scanning the drive for archives:
1 file, 1602168 bytes (1565 KiB)


--
Type = PE
Physical Size = 1602168
CPU = x86
Characteristics = Executable 32-bit NoRelocs NoLineNums NoLocalSyms
Created = 2004-01-22 13:36:06
Headers Size = 4096
Checksum = 1646937
Image Size = 143360
Section Alignment = 4096
File Alignment = 512
Code Size = 45056
Initialized Data Size = 8192
Uninitialized Data Size = 86016
Linker Version = 5.0
OS Version = 4.0
Image Version = 0.0
Subsystem Version = 4.0
Subsystem = Windows GUI
Stack Reserve = 1048576
Stack Commit = 8192
Heap Reserve = 1048576
Heap Commit = 4096
Image Base = 4194304
----
Path = [0]
Size = 1544792
Packed Size = 1544792
Virtual Size = 1544792
Offset = 52736
--
Path = [0]
Type = Rar
Physical Size = 1544792
Solid = -
Blocks = 1
Multivolume = -
Volumes = 1

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2011-11-15 19:21:02 ....A      1654784      1544578  CSuser.msi
------------------- ----- ------------ ------------  ------------------------
2011-11-15 19:21:02            1654784      1544578  1 files

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[!] string size(29442) > stringtable size(596). truncated to 594

[!] cannot convert "\x8D\xE2\xB2\x95\x88&\xFA)\x17Yo\xCEA\xBC\x81D"... to UTF-16

[!] string size(51460) > stringtable size(910). truncated to 908

[!] cannot convert "\xBF~\xF8\xB6\x99\xF2(>\xC6\x94\x10k\a\x0F\t+"... to UTF-16

[!] string size(47242) > stringtable size(482). truncated to 480

[!] cannot convert "\x11\x01\xD5dd\x84\x86=\x96\x96h\x18i\xF8\xE2\xEB"... to UTF-16

[!] string size(99684) > stringtable size(634). truncated to 632

[!] cannot convert "\x04\v.\x05\x7Fu\xC9\v\xDB\x1A\xD0V\x910\xAC0"... to UTF-16