filename32fsu43.exe
size2214752 (0x21cb60)
md5f0720151179071b2201872b77ec2ebd4
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

Rich Header

lib idversiontimes used
126503277
95403511
1255072731
10950727207
9640351
93403529
10647
11050727410
124507271
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x542455f2
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion8.0
SizeOfCode0x11c000
SizeOfInitializedData0xfe000
SizeOfUninitializedData0
AddressOfEntryPoint0xefaa0
BaseOfCode0x1000
BaseOfData0x11d000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x233000
SizeOfHeaders0x1000
CheckSum0x21f051
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x11b8ad0x11c000R-X CODE
.rdata0x11d0000x432340x44000R-- IDATA
.data0x1610000x20e580x9000RW- IDATA
.rsrc0x1820000xb03fc0xb1000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x15d5d40x12c
RESOURCE0x1820000xb03fc
EXCEPTION00
SECURITY0x21b0000x1b60
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x148dc00x40
Bound_IAT00
IAT0x11d0000x874
Delay_IAT0x15d5240x40
CLR_Header00
typenamesizecp
BIN#3512000611252
CURSOR#533081252
CURSOR#541801252
CURSOR#553081252
CURSOR#563081252
CURSOR#573081252
CURSOR#583081252
CURSOR#593081252
CURSOR#603081252
CURSOR#613081252
CURSOR#623081252
CURSOR#633081252
CURSOR#643081252
CURSOR#653081252
CURSOR#663081252
CURSOR#673081252
CURSOR#683081252
BITMAP#15531121252
BITMAP#1599441252
BITMAP#203161681252
BITMAP#204161681252
BITMAP#27477201252
BITMAP#27777201252
BITMAP#2863481252
BITMAP#318113801252
BITMAP#3199081252
BITMAP#320110061252
BITMAP#32299761252
BITMAP#3361674661252
BITMAP#36362021252
BITMAP#364525601252
BITMAP#37612401252
BITMAP#309941841252
BITMAP#309963241252
ICON#137521252
ICON#222161252
ICON#313841252
ICON#496401252
ICON#542641252
ICON#611281252
ICON#77441252
ICON#813841252
ICON#911281252
ICON#1022161252
ICON#1132401252
ICON#1242641252
ICON#1313841252
ICON#1411281252
ICON#1513841252
ICON#1611281252
ICON#1713841252
ICON#1811281252
ICON#1922161252
ICON#2032401252
ICON#2142641252
ICON#2222161252
ICON#2332401252
ICON#2442641252
ICON#2522161252
ICON#2632401252
ICON#2742641252
ICON#2822161252
ICON#2932401252
ICON#3042641252
ICON#3122161252
ICON#3232401252
ICON#3342641252
ICON#3422161252
ICON#3532401252
ICON#3642641252
ICON#3722161252
ICON#3832401252
ICON#3942641252
ICON#4022161252
ICON#4132401252
ICON#4242641252
ICON#4322161252
ICON#4432401252
ICON#4542641252
ICON#4613841252
ICON#4711281252
ICON#4813841252
ICON#4911281252
ICON#5011281252
ICON#5111281252
ICON#5211281252
MENU#12813441252
MENU#1632421252
MENU#1641861252
MENU#213661252
MENU#2141961252
MENU#2161781252
MENU#2171541252
MENU#372841252
MENU#3741061252
MENU#379661252
DIALOG#10013241252
DIALOG#1018861252
DIALOG#14117461252
DIALOG#14518421252
DIALOG#14814561252
DIALOG#1505241252
DIALOG#15116121252
DIALOG#1575841252
DIALOG#1582661252
DIALOG#1697881252
DIALOG#17213501252
DIALOG#17519121252
DIALOG#1768521252
DIALOG#1788601252
DIALOG#22113521252
DIALOG#22310041252
DIALOG#2276861252
DIALOG#2308561252
DIALOG#2813121252
DIALOG#28210641252
DIALOG#2835661252
DIALOG#2982721252
DIALOG#3002681252
DIALOG#3031881252
DIALOG#3319641252
DIALOG#33515761252
DIALOG#35310981252
DIALOG#354961252
DIALOG#3556001252
DIALOG#3574601252
DIALOG#3587161252
DIALOG#3593881252
DIALOG#3611721252
DIALOG#3624001252
DIALOG#3676401252
DIALOG#3718681252
DIALOG#37312001252
DIALOG#37515681252
DIALOG#3775041252
DIALOG#3787121252
DIALOG#3809081252
DIALOG#3811881252
DIALOG#3837721252
DIALOG#3846801252
DIALOG#307212321252
DIALOG#30734521252
STRING#7421252
STRING#91361252
STRING#20491881252
STRING#20504121252
STRING#20512961252
STRING#20524941252
STRING#20532341252
STRING#20541021252
STRING#20551301252
STRING#35851421252
STRING#3601941252
STRING#36034481252
STRING#36041121252
STRING#36055101252
STRING#36062181252
STRING#3697701252
STRING#37132001252
STRING#38255041252
STRING#38261341252
STRING#38411301252
STRING#3842421252
STRING#38434021252
STRING#385712501252
STRING#38587941252
STRING#38597321252
STRING#38601381252
STRING#38651721252
STRING#38662221252
STRING#386712201252
STRING#38686121252
STRING#3869441252
STRING#3887661252
GROUP_CURSOR#30977341252
GROUP_CURSOR#30998201252
GROUP_CURSOR#30999201252
GROUP_CURSOR#31000201252
GROUP_CURSOR#31001201252
GROUP_CURSOR#31002201252
GROUP_CURSOR#31003201252
GROUP_CURSOR#31004201252
GROUP_CURSOR#31005201252
GROUP_CURSOR#31006201252
GROUP_CURSOR#31007201252
GROUP_CURSOR#31008201252
GROUP_CURSOR#31009201252
GROUP_CURSOR#31010201252
GROUP_CURSOR#31011201252
GROUP_ICON#128901252
GROUP_ICON#130201252
GROUP_ICON#280341252
GROUP_ICON#305481252
GROUP_ICON#306341252
GROUP_ICON#307341252
GROUP_ICON#308341252
GROUP_ICON#309481252
GROUP_ICON#310481252
GROUP_ICON#311481252
GROUP_ICON#312481252
GROUP_ICON#313481252
GROUP_ICON#314481252
GROUP_ICON#315481252
GROUP_ICON#316481252
GROUP_ICON#317481252
GROUP_ICON#365341252
GROUP_ICON#366341252
GROUP_ICON#368201252
GROUP_ICON#369201252
GROUP_ICON#370201252
VERSION#110561252
MANIFEST#111521252
#240#1481301252
#240#371601252
#240#3751061252
#240#380231252
#241#159241252
idlangstring
1021033
1031033
1041033
1051033
1061033
1281033filescav Filesc Filescav.Document Filesc Document
327781033Toggle Use folder name option
327811033Scan for files Scan
327831033Save selected files Save files
327841033Stop scanning or saving Stop
327851033Generate debug file
327911033Find a string in this window
327931033Display the properties of the selected item Properties
327941033Invert item selection Invert Selection
327961033Toggle View Toggle view
328041033Properties Properties
328051033Sort list items Sort list items
328131033Display or edit license information Licenses
328141033Select partition/volume for recovery
328161033Limit the number of files to scan for
328171033Creates or loads a disk image file
328201033Creates or loads a session file
328211033Load a previously saved File Scavenger session file
328221033Create a file to store the current state of this session
328231033Load a disk image file
328341033Check the selected item Select
328351033Uncheck the selected item Deselect
328361033Deselect the entire list Deselect All
328481033Filter list items Filter list items
328641033Show or hide the status panel Toggle status panel
573451033For Help, press F1
573461033Select an object on which to get Help
576021033Close the active document Close
576361033Find the specified text Find
576371033Insert Clipboard contents Paste
576401033Repeat the last action Repeat
576411033Replace specific text with different text Replace
576421033Select the entire list Select All
576441033Redo the previously undone action Redo
576531033Split the active window into panes Split
576641033Display version number and copyright statement
576651033Quit File Scavenger
576661033Opens Help
576671033List Help topics Help topics
576681033Display instructions about how to use help
576691033Display help for clicked on buttons, menus and windows
576701033Display help for current task or command
576801033Switch to the next window pane Next Pane
576811033Switch back to the previous window pane Previous Pane
591361033EXT
591371033CAP
591381033NUM
591391033SCRL
591401033OVR
591411033REC
593921033Show or hide the toolbar Toggle toolBar
593931033Show or hide the status bar Toggle status bar
611841033Change the window size
611851033Change the window position
611861033Reduce the window to an icon
611871033Enlarge the window to full size
611881033Switch to the next document window
611891033Switch to the previous document window
611901033Close the active window and prompts to save the documents
612021033Restore the window to normal size
612031033Activate Task List
614401033Open
614411033Save As
614421033All Files (*.*)
614431033Untitled
614461033an unnamed file
614571033&Hide
614721033No error message is available.
614731033An unsupported operation was attempted.
614741033A required resource was unavailable.
614751033Out of memory.
614761033An unknown error has occurred.
614771033An invalid argument was encountered.
616961033Invalid filename.
616971033Failed to open document.
616981033Failed to save document.
616991033Save changes to %1?
617001033Failed to create empty document.
617011033The file is too large to open.
617021033Could not start print job.
617031033Failed to launch help.
617041033Internal application error.
617051033Command failed.
617061033Insufficient memory to perform operation.
617071033System registry entries have been removed and the INI file (if any) was deleted.
617081033Not all of the system registry entries (or INI file) were removed.
617091033This program requires the file %s, which was not found on this system.
617101033This program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.
617121033Please enter an integer.
617131033Please enter a number.
617141033Please enter an integer between %1 and %2.
617151033Please enter a number between %1 and %2.
617161033Please enter no more than %1 characters.
617171033Please select a button.
617181033Please enter an integer between 0 and 255.
617191033Please enter a positive integer.
617201033Please enter a date and/or time.
617211033Please enter a currency.
617221033Please enter a GUID.
617231033Please enter a time.
617241033Please enter a date.
617281033Unexpected file format.
617291033%1 Cannot find this file. Please verify that the correct path and file name are given.
617301033Destination disk drive is full.
617311033Unable to read from %1, it is opened by someone else.
617321033Unable to write to %1, it is read-only or opened by someone else.
617331033An unexpected error occurred while reading %1.
617341033An unexpected error occurred while writing %1.
617441033%1: %2 Continue running script?
617451033Dispatch exception: %1
618361033Unable to read write-only property.
618371033Unable to write read-only property.
618401033Unable to load mail system support.
618411033Mail system DLL is invalid.
618421033Send Mail failed to send message.
618561033No error occurred.
618571033An unknown error occurred while accessing %1.
618581033%1 was not found.
618591033%1 contains an invalid path.
618601033%1 could not be opened because there are too many open files.
618611033Access to %1 was denied.
618621033An invalid file handle was associated with %1.
618631033%1 could not be removed because it is the current directory.
618641033%1 could not be created because the directory is full.
618651033Seek failed on %1
618661033A hardware I/O error was reported while accessing %1.
618671033A sharing violation occurred while accessing %1.
618681033A locking violation occurred while accessing %1.
618691033Disk full while accessing %1.
618701033An attempt was made to access %1 past its end.
618721033No error occurred.
618731033An unknown error occurred while accessing %1.
618741033An attempt was made to write to the reading %1.
618751033An attempt was made to access %1 past its end.
618761033An attempt was made to read from the writing %1.
618771033%1 has a bad format.
618781033%1 contained an unexpected object.
618791033%1 contains an incorrect schema.
618881033pixels
621771033Uncheck
621781033Check
621791033Mixed
module_namehintordfunction_name
NETAPI32.dll264Netbios
KERNEL32.dll938WritePrivateProfileStringW
KERNEL32.dll444GetStringTypeExW
KERNEL32.dll964lstrcmpiW
KERNEL32.dll238FlushFileBuffers
KERNEL32.dll611LockFile
KERNEL32.dll879UnlockFile
KERNEL32.dll147DuplicateHandle
KERNEL32.dll438GetShortPathNameW
KERNEL32.dll229FindResourceExW
KERNEL32.dll789SetErrorMode
KERNEL32.dll534HeapFree
KERNEL32.dll528HeapAlloc
KERNEL32.dll419GetProcessHeap
KERNEL32.dll440GetStartupInfoW
KERNEL32.dll727RtlUnwind
KERNEL32.dll538HeapReAlloc
KERNEL32.dll679RaiseException
KERNEL32.dll354GetFileInformationByHandle
KERNEL32.dll657PeekNamedPipe
KERNEL32.dll358GetFileType
KERNEL32.dll290GetConsoleCP
KERNEL32.dll307GetConsoleMode
KERNEL32.dll210FindFirstFileA
KERNEL32.dll186ExitThread
KERNEL32.dll111CreateThread
KERNEL32.dll185ExitProcess
KERNEL32.dll540HeapSize
KERNEL32.dll453GetSystemInfo
KERNEL32.dll904VirtualQuery
KERNEL32.dll842SetUnhandledExceptionFilter
KERNEL32.dll441GetStdHandle
KERNEL32.dll381GetModuleFileNameA
KERNEL32.dll246FreeEnvironmentStringsA
KERNEL32.dll247FreeEnvironmentStringsW
KERNEL32.dll343GetEnvironmentStringsW
KERNEL32.dll272GetCommandLineA
KERNEL32.dll273GetCommandLineW
KERNEL32.dll804SetHandleCount
KERNEL32.dll439GetStartupInfoA
KERNEL32.dll532HeapDestroy
KERNEL32.dll530HeapCreate
KERNEL32.dll862TerminateProcess
KERNEL32.dll878UnhandledExceptionFilter
KERNEL32.dll569IsDebuggerPresent
KERNEL32.dll260GetCPInfo
KERNEL32.dll253GetACP
KERNEL32.dll403GetOEMCP
KERNEL32.dll575IsValidCodePage
KERNEL32.dll580LCMapStringA
KERNEL32.dll581LCMapStringW
KERNEL32.dll823SetStdHandle
KERNEL32.dll320GetCurrentDirectoryA
KERNEL32.dll482GetTimeZoneInformation
KERNEL32.dll921WriteConsoleA
KERNEL32.dll309GetConsoleOutputCP
KERNEL32.dll931WriteConsoleW
KERNEL32.dll361GetFullPathNameA
KERNEL32.dll442GetStringTypeA
KERNEL32.dll445GetStringTypeW
KERNEL32.dll372GetLocaleInfoA
KERNEL32.dll787SetEnvironmentVariableA
KERNEL32.dll474GetThreadLocale
KERNEL32.dll556InterlockedIncrement
KERNEL32.dll868TlsFree
KERNEL32.dll129DeleteCriticalSection
KERNEL32.dll607LocalReAlloc
KERNEL32.dll870TlsSetValue
KERNEL32.dll867TlsAlloc
KERNEL32.dll547InitializeCriticalSection
KERNEL32.dll514GlobalHandle
KERNEL32.dll518GlobalReAlloc
KERNEL32.dll152EnterCriticalSection
KERNEL32.dll869TlsGetValue
KERNEL32.dll593LeaveCriticalSection
KERNEL32.dll600LocalAlloc
KERNEL32.dll510GlobalFlags
KERNEL32.dll972lstrlenA
KERNEL32.dll513GlobalGetAtomNameW
KERNEL32.dll362GetFullPathNameW
KERNEL32.dll357GetFileTime
KERNEL32.dll902VirtualProtect
KERNEL32.dll325GetCurrentThread
KERNEL32.dll63ConvertDefaultLocale
KERNEL32.dll488GetVersion
KERNEL32.dll164EnumResourceLanguagesW
KERNEL32.dll960lstrcmpA
KERNEL32.dll58CompareStringA
KERNEL32.dll553InterlockedExchange
KERNEL32.dll80CreateEventW
KERNEL32.dll856SuspendThread
KERNEL32.dll722ResumeThread
KERNEL32.dll836SetThreadPriority
KERNEL32.dll383GetModuleHandleA
KERNEL32.dll552InterlockedDecrement
KERNEL32.dll326GetCurrentThreadId
KERNEL32.dll503GlobalAddAtomW
KERNEL32.dll508GlobalFindAtomW
KERNEL32.dll506GlobalDeleteAtom
KERNEL32.dll59CompareStringW
KERNEL32.dll961lstrcmpW
KERNEL32.dll489GetVersionExA
KERNEL32.dll604LocalFree
KERNEL32.dll973lstrlenW
KERNEL32.dll628MulDiv
KERNEL32.dll250FreeResource
KERNEL32.dll594LoadLibraryA
KERNEL32.dll490GetVersionExW
KERNEL32.dll322GetCurrentProcess
KERNEL32.dll373GetLocaleInfoW
KERNEL32.dll470GetTempPathW
KERNEL32.dll353GetFileAttributesW
KERNEL32.dll719ResetEvent
KERNEL32.dll784SetEndOfFile
KERNEL32.dll522GlobalUnlock
KERNEL32.dll511GlobalFree
KERNEL32.dll504GlobalAlloc
KERNEL32.dll515GlobalLock
KERNEL32.dll371GetLocalTime
KERNEL32.dll412GetPrivateProfileStringA
KERNEL32.dll189ExpandEnvironmentStringsW
KERNEL32.dll78CreateDirectoryW
KERNEL32.dll625MoveFileW
KERNEL32.dll967lstrcpyW
KERNEL32.dll244FormatMessageW
KERNEL32.dll970lstrcpynW
KERNEL32.dll916WideCharToMultiByte
KERNEL32.dll132DeleteFileW
KERNEL32.dll709RemoveDirectoryW
KERNEL32.dll854Sleep
KERNEL32.dll468GetTempFileNameW
KERNEL32.dll323GetCurrentProcessId
KERNEL32.dll105CreateProcessW
KERNEL32.dll799SetFileTime
KERNEL32.dll340GetDriveTypeW
KERNEL32.dll779SetCurrentDirectoryW
KERNEL32.dll382GetModuleFileNameW
KERNEL32.dll374GetLogicalDriveStringsA
KERNEL32.dll335GetDiskFreeSpaceExW
KERNEL32.dll492GetVolumeInformationW
KERNEL32.dll646OpenProcess
KERNEL32.dll624MoveFileExW
KERNEL32.dll629MultiByteToWideChar
KERNEL32.dll197FileTimeToSystemTime
KERNEL32.dll328GetDateFormatW
KERNEL32.dll481GetTimeFormatW
KERNEL32.dll675QueryPerformanceCounter
KERNEL32.dll479GetTickCount
KERNEL32.dll339GetDriveTypeA
KERNEL32.dll83CreateFileA
KERNEL32.dll456GetSystemTime
KERNEL32.dll859SystemTimeToFileTime
KERNEL32.dll790SetEvent
KERNEL32.dll336GetDiskFreeSpaceW
KERNEL32.dll795SetFilePointer
KERNEL32.dll671QueryDosDeviceA
KERNEL32.dll500GetWindowsDirectoryW
KERNEL32.dll693ReadFile
KERNEL32.dll355GetFileSize
KERNEL32.dll206FindClose
KERNEL32.dll912WaitForSingleObject
KERNEL32.dll458GetSystemTimeAsFileTime
KERNEL32.dll196FileTimeToLocalFileTime
KERNEL32.dll602LocalFileTimeToFileTime
KERNEL32.dll676QueryPerformanceFrequency
KERNEL32.dll138DeviceIoControl
KERNEL32.dll86CreateFileW
KERNEL32.dll932WriteFile
KERNEL32.dll52CloseHandle
KERNEL32.dll248FreeLibrary
KERNEL32.dll897VirtualAlloc
KERNEL32.dll899VirtualFree
KERNEL32.dll213FindFirstFileW
KERNEL32.dll221FindNextFileW
KERNEL32.dll369GetLastError
KERNEL32.dll808SetLastError
KERNEL32.dll416GetProcAddress
KERNEL32.dll386GetModuleHandleW
KERNEL32.dll597LoadLibraryW
KERNEL32.dll230FindResourceW
KERNEL32.dll599LoadResource
KERNEL32.dll613LockResource
KERNEL32.dll853SizeofResource
KERNEL32.dll341GetEnvironmentStrings
USER32.dll44CharNextW
USER32.dll71CopyAcceleratorTableW
USER32.dll404InvalidateRgn
USER32.dll322GetNextDlgGroupItem
USER32.dll478MessageBeep
USER32.dll614SetParent
USER32.dll269GetDCEx
USER32.dll463LockWindowUpdate
USER32.dll539RegisterClipboardFormatW
USER32.dll518PostThreadMessageW
USER32.dll230FindWindowW
USER32.dll639SetWindowContextHelpId
USER32.dll469MapDialogRect
USER32.dll242GetAsyncKeyState
USER32.dll655ShowOwnedPopups
USER32.dll516PostQuitMessage
USER32.dll318GetMessageW
USER32.dll682TranslateMessage
USER32.dll708ValidateRect
USER32.dll151DestroyMenu
USER32.dll364GetWindowDC
USER32.dll379GetWindowThreadProcessId
USER32.dll609SetMenuItemBitmaps
USER32.dll57CheckMenuItem
USER32.dll552RegisterWindowMessageW
USER32.dll566SendDlgItemMessageA
USER32.dll722WinHelpW
USER32.dll414IsChild
USER32.dll651SetWindowsHookExW
USER32.dll26CallNextHookEx
USER32.dll251GetClassLongW
USER32.dll253GetClassNameW
USER32.dll619SetPropW
USER32.dll331GetPropW
USER32.dll557RemovePropW
USER32.dll279GetForegroundWindow
USER32.dll296GetLastActivePopup
USER32.dll162DispatchMessageW
USER32.dll12BeginDeferWindowPos
USER32.dll197EndDeferWindowPos
USER32.dll355GetTopWindow
USER32.dll686UnhookWindowsHookEx
USER32.dll317GetMessageTime
USER32.dll513PeekMessageW
USER32.dll474MapWindowPoints
USER32.dll676TrackPopupMenu
USER32.dll624SetScrollRange
USER32.dll343GetScrollRange
USER32.dll599SetForegroundWindow
USER32.dll656ShowScrollBar
USER32.dll248GetClassInfoExW
USER32.dll537RegisterClassW
USER32.dll2AdjustWindowRectEx
USER32.dll223EqualRect
USER32.dll144DeferWindowPos
USER32.dll402IntersectRect
USER32.dll665SystemParametersInfoA
USER32.dll371GetWindowPlacement
USER32.dll418IsDialogMessageW
USER32.dll596SetDlgItemTextW
USER32.dll567SendDlgItemMessageW
USER32.dll55CharUpperW
USER32.dll342GetScrollPos
USER32.dll623SetScrollPos
USER32.dll362GetWindow
USER32.dll313GetMenuStringW
USER32.dll235GetActiveWindow
USER32.dll579SetActiveWindow
USER32.dll84CreateDialogIndirectParamW
USER32.dll429IsWindow
USER32.dll430IsWindowEnabled
USER32.dll323GetNextDlgTabItem
USER32.dll198EndDialog
USER32.dll249GetClassInfoW
USER32.dll143DefWindowProcW
USER32.dll193EmptyClipboard
USER32.dll66CloseClipboard
USER32.dll502OpenClipboard
USER32.dll302GetMenuCheckMarkDimensions
USER32.dll605SetMenu
USER32.dll311GetMenuState
USER32.dll307GetMenuItemID
USER32.dll9AppendMenuW
USER32.dll93CreateMenu
USER32.dll611SetMenuItemInfoW
USER32.dll666SystemParametersInfoW
USER32.dll435IsZoomed
USER32.dll422IsIconic
USER32.dll178DrawEdge
USER32.dll347GetSysColorBrush
USER32.dll263GetComboBoxInfo
USER32.dll724WindowFromPoint
USER32.dll233FrameRect
USER32.dll226FillRect
USER32.dll181DrawFrameControl
USER32.dll394InflateRect
USER32.dll187DrawStateW
USER32.dll267GetCursorPos
USER32.dll150DestroyIcon
USER32.dll382GrayStringW
USER32.dll190DrawTextExW
USER32.dll668TabbedTextOutW
USER32.dll243GetCapture
USER32.dll433IsWindowVisible
USER32.dll300GetMenu
USER32.dll309GetMenuItemInfoW
USER32.dll306GetMenuItemCount
USER32.dll194EnableMenuItem
USER32.dll486MessageBoxW
USER32.dll97CreateWindowExW
USER32.dll153DestroyWindow
USER32.dll316GetMessagePos
USER32.dll492MoveWindow
USER32.dll647SetWindowTextW
USER32.dll598SetFocus
USER32.dll289GetKeyState
USER32.dll277GetDoubleClickTime
USER32.dll658ShowWindow
USER32.dll437KillTimer
USER32.dll403InvalidateRect
USER32.dll341GetScrollInfo
USER32.dll533RedrawWindow
USER32.dll356GetUpdateRect
USER32.dll13BeginPaint
USER32.dll179DrawFocusRect
USER32.dll191DrawTextW
USER32.dll200EndPaint
USER32.dll622SetScrollInfo
USER32.dll564ScrollWindow
USER32.dll700UpdateWindow
USER32.dll692UnregisterClassW
USER32.dll719WaitMessage
USER32.dll620SetRect
USER32.dll690UnpackDDElParam
USER32.dll560ReuseDDElParam
USER32.dll439LoadAcceleratorsW
USER32.dll399InsertMenuItemW
USER32.dll94CreatePopupMenu
USER32.dll272GetDlgCtrlID
USER32.dll641SetWindowLongW
USER32.dll28CallWindowProcW
USER32.dll378GetWindowTextW
USER32.dll643SetWindowPos
USER32.dll268GetDC
USER32.dll554ReleaseDC
USER32.dll621SetRectEmpty
USER32.dll15BringWindowToTop
USER32.dll680TranslateAcceleratorW
USER32.dll644SetWindowRgn
USER32.dll377GetWindowTextLengthW
USER32.dll425IsRectEmpty
USER32.dll367GetWindowLongW
USER32.dll74CopyRect
USER32.dll499OemToCharBuffW
USER32.dll501OffsetRect
USER32.dll634SetTimer
USER32.dll515PostMessageW
USER32.dll346GetSysColor
USER32.dll589SetCursor
USER32.dll553ReleaseCapture
USER32.dll445LoadCursorW
USER32.dll580SetCapture
USER32.dll561ScreenToClient
USER32.dll64ClientToScreen
USER32.dll325GetParent
USER32.dll273GetDlgItem
USER32.dll51CharToOemW
USER32.dll447LoadIconW
USER32.dll182DrawIcon
USER32.dll500OemToCharW
USER32.dll270GetDesktopWindow
USER32.dll449LoadImageW
USER32.dll524PtInRect
USER32.dll349GetSystemMetrics
USER32.dll278GetFocus
USER32.dll255GetClientRect
USER32.dll372GetWindowRect
USER32.dll457LoadMenuW
USER32.dll488ModifyMenuW
USER32.dll345GetSubMenu
USER32.dll441LoadBitmapW
USER32.dll196EnableWindow
USER32.dll576SendMessageW
USER32.dll586SetClipboardData
USER32.dll691UnregisterClassA
GDI32.dll578SetWindowExtEx
GDI32.dll521ScaleWindowExtEx
GDI32.dll519SaveDC
GDI32.dll220ExtSelectClipRgn
GDI32.dll566SetRectRgn
GDI32.dll397GetMapMode
GDI32.dll81DPtoLP
GDI32.dll53CreateEllipticRgn
GDI32.dll459LPtoDP
GDI32.dll148Ellipse
GDI32.dll349GetCharWidthW
GDI32.dll586StretchDIBits
GDI32.dll203EnumFontFamiliesExW
GDI32.dll431GetTextColor
GDI32.dll420GetRgnBox
GDI32.dll477PatBlt
GDI32.dll76CreateRectRgnIndirect
GDI32.dll352GetClipBox
GDI32.dll363GetDeviceCaps
GDI32.dll412GetPixel
GDI32.dll579SetWindowOrgEx
GDI32.dll520ScaleViewportExtEx
GDI32.dll574SetViewportExtEx
GDI32.dll469OffsetViewportOrgEx
GDI32.dll575SetViewportOrgEx
GDI32.dll450GetWindowExtEx
GDI32.dll447GetViewportExtEx
GDI32.dll75CreateRectRgn
GDI32.dll524SelectClipRgn
GDI32.dll455IntersectClipRect
GDI32.dll215ExcludeClipRect
GDI32.dll555SetMapMode
GDI32.dll61CreateFontIndirectW
GDI32.dll33CombineRgn
GDI32.dll437GetTextExtentPoint32W
GDI32.dll513RoundRect
GDI32.dll39CreateBitmap
GDI32.dll62CreateFontW
GDI32.dll212Escape
GDI32.dll591TextOutW
GDI32.dll501RectVisible
GDI32.dll497PtVisible
GDI32.dll421GetStockObject
GDI32.dll537SetBrushOrgEx
GDI32.dll70CreatePatternBrush
GDI32.dll18BitBlt
GDI32.dll44CreateCompatibleBitmap
GDI32.dll140DeleteDC
GDI32.dll534SetBkMode
GDI32.dll533SetBkColor
GDI32.dll222ExtTextOutW
GDI32.dll572SetTextColor
GDI32.dll332GetBkColor
GDI32.dll80CreateSolidBrush
GDI32.dll71CreatePen
GDI32.dll502Rectangle
GDI32.dll465MoveToEx
GDI32.dll461LineTo
GDI32.dll460LineDDA
GDI32.dll440GetTextExtentPointW
GDI32.dll143DeleteObject
GDI32.dll563SetPixelV
GDI32.dll526SelectObject
GDI32.dll445GetTextMetricsW
GDI32.dll585StretchBlt
GDI32.dll45CreateCompatibleDC
GDI32.dll407GetObjectW
GDI32.dll512RestoreDC
comdlg32.dll4CommDlgExtendedError
comdlg32.dll8GetFileTitleW
comdlg32.dll10GetOpenFileNameW
WINSPOOL.DRV126OpenPrinterW
WINSPOOL.DRV71DocumentPropertiesW
WINSPOOL.DRV27ClosePrinter
ADVAPI32.dll517RegSetValueExW
ADVAPI32.dll494RegOpenKeyW
ADVAPI32.dll493RegOpenKeyExW
ADVAPI32.dll504RegQueryValueExW
ADVAPI32.dll479RegEnumKeyExW
ADVAPI32.dll498RegQueryInfoKeyW
ADVAPI32.dll467RegCreateKeyW
ADVAPI32.dll241GetFileSecurityW
ADVAPI32.dll559SetFileSecurityW
ADVAPI32.dll505RegQueryValueW
ADVAPI32.dll480RegEnumKeyW
ADVAPI32.dll518RegSetValueW
ADVAPI32.dll471RegDeleteKeyW
ADVAPI32.dll459RegCloseKey
ADVAPI32.dll516RegSetValueExA
ADVAPI32.dll466RegCreateKeyExW
ADVAPI32.dll465RegCreateKeyExA
ADVAPI32.dll503RegQueryValueExA
ADVAPI32.dll514RegSetKeySecurity
ADVAPI32.dll491RegOpenKeyA
ADVAPI32.dll492RegOpenKeyExA
ADVAPI32.dll484RegGetKeySecurity
SHELL32.dll49ExtractIconW
SHELL32.dll189SHGetPathFromIDListW
SHELL32.dll122SHBrowseForFolderW
SHELL32.dll267ShellExecuteW
SHELL32.dll46ExtractIconExW
SHELL32.dll173SHGetFileInfoW
SHELL32.dll183SHGetMalloc
SHELL32.dll35DragQueryFileW
SHELL32.dll31DragFinish
COMCTL32.dll61ImageList_Draw
COMCTL32.dll52ImageList_AddMasked
COMCTL32.dll55ImageList_Create
COMCTL32.dll17
COMCTL32.dll70ImageList_GetIconSize
COMCTL32.dll108_TrackMouseEvent
SHLWAPI.dll50PathFindFileNameW
SHLWAPI.dll126PathStripToRootW
SHLWAPI.dll48PathFindExtensionW
SHLWAPI.dll90PathIsUNCW
oledlg.dll3OleUIBusyW
ole32.dll100CoTaskMemAlloc
ole32.dll131CreateStreamOnHGlobal
ole32.dll16CoCreateInstance
ole32.dll59CoInitialize
ole32.dll105CoUninitialize
ole32.dll34CoGetClassObject
ole32.dll305StgOpenStorageOnILockBytes
ole32.dll292StgCreateDocfileOnILockBytes
ole32.dll125CreateILockBytesOnHGlobal
ole32.dll6CLSIDFromProgID
ole32.dll101CoTaskMemFree
ole32.dll8CLSIDFromString
ole32.dll261OleUninitialize
ole32.dll28CoFreeUnusedLibraries
ole32.dll238OleInitialize
ole32.dll92CoRevokeClassObject
ole32.dll83CoRegisterMessageFilter
ole32.dll233OleFlushClipboard
ole32.dll240OleIsCurrentClipboard
OLEAUT32.dll2
OLEAUT32.dll420
OLEAUT32.dll16
OLEAUT32.dll10
OLEAUT32.dll184
OLEAUT32.dll185
OLEAUT32.dll8
OLEAUT32.dll12
OLEAUT32.dll9
OLEAUT32.dll4
OLEAUT32.dll6
OLEAUT32.dll7
WS2_32.dll4
WS2_32.dll115
WS2_32.dll23
WS2_32.dll3
WS2_32.dll116
WS2_32.dll9
WS2_32.dll52
WS2_32.dll16
WS2_32.dll111
WS2_32.dll19
WS2_32.dll18

StringTable 040904e4

CompanyNameQueTek Consulting Corporation
FileDescriptionFile Scavenger (R) - Premium data recovery tool
FileVersion4.3.1.0
InternalNameFileScav.exe
LegalCopyrightCopyrights (c) 1998-2014 QueTek Consulting Corporation. All rights reserved.
LegalTrademarksFile Scavenger
OriginalFilenameFileScav.exe
ProductNameFile Scavenger
ProductVersion4.3.1.0
SpecialBuild4.3.1.0

VS_FIXEDFILEINFO

FileVersion4.3.1.0
ProductVersion4.3.1.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0x20
FileOS4
FileType1
FileSubtype0

Signers (1)

issuer: /C=US/O=Thawte, Inc./CN=Thawte Code Signing CA - G2
serial: 64D0C2EB67DD04240DF6D1DC65F91095

Certificates (5)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
        Validity
            Not Before: Dec 21 00:00:00 2012 GMT
            Not After : Dec 30 23:59:59 2020 GMT
        Subject: C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b1:ac:b3:49:54:4b:97:1c:12:0a:d8:25:79:91:
                    22:57:2a:6f:dc:b8:26:c4:43:73:6b:c2:bf:2e:50:
                    5a:fb:14:c2:76:8e:43:01:25:43:b4:a1:e2:45:f4:
                    e8:b7:7b:c3:74:cc:22:d7:b4:94:00:02:f7:4d:ed:
                    bf:b4:b7:44:24:6b:cd:5f:45:3b:d1:44:ce:43:12:
                    73:17:82:8b:69:b4:2b:cb:99:1e:ac:72:1b:26:4d:
                    71:1f:b1:31:dd:fb:51:61:02:53:a6:aa:f5:49:2c:
                    05:78:45:a5:2f:89:ce:e7:99:e7:fe:8c:e2:57:3f:
                    3d:c6:92:dc:4a:f8:7b:33:e4:79:0a:fb:f0:75:88:
                    41:9c:ff:c5:03:51:99:aa:d7:6c:9f:93:69:87:65:
                    29:83:85:c2:60:14:c4:c8:c9:3b:14:da:c0:81:f0:
                    1f:0d:74:de:92:22:ab:ca:f7:fb:74:7c:27:e6:f7:
                    4a:1b:7f:a7:c3:9e:2d:ae:8a:ea:a6:e6:aa:27:16:
                    7d:61:f7:98:71:11:bc:e2:50:a1:4b:e5:5d:fa:e5:
                    0e:a7:2c:9f:aa:65:20:d3:d8:96:e8:c8:7c:a5:4e:
                    48:44:ff:19:e2:44:07:92:0b:d7:68:84:80:5d:6a:
                    78:64:45:cd:60:46:7e:54:c1:13:7c:c5:79:f1:c9:
                    c1:71
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                5F:9A:F5:6E:5C:CC:CC:74:9A:D4:DD:7D:EF:3F:DB:EC:4C:80:2E:DD
            Authority Information Access: 
                OCSP - URI:http://ocsp.thawte.com

            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.thawte.com/ThawteTimestampingCA.crl

            X509v3 Extended Key Usage: 
                Time Stamping
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name: 
                DirName:/CN=TimeStamp-2048-1
    Signature Algorithm: sha1WithRSAEncryption
         03:09:9b:8f:79:ef:7f:59:30:aa:ef:68:b5:fa:e3:09:1d:bb:
         4f:82:06:5d:37:5f:a6:52:9f:16:8d:ea:1c:92:09:44:6e:f5:
         6d:eb:58:7c:30:e8:f9:69:8d:23:73:0b:12:6f:47:a9:ae:39:
         11:f8:2a:b1:9b:b0:1a:c3:8e:eb:59:96:00:ad:ce:0c:4d:b2:
         d0:31:a6:08:5c:2a:7a:fc:e2:7a:1d:57:4c:a8:65:18:e9:79:
         40:62:25:96:6e:c7:c7:37:6a:83:21:08:8e:41:ea:dd:d9:57:
         3f:1d:77:49:87:2a:16:06:5e:a6:38:6a:22:12:a3:51:19:83:
         7e:b6
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
        Validity
            Not Before: Nov 17 00:00:00 2006 GMT
            Not After : Dec 30 23:59:59 2020 GMT
        Subject: C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:ac:a0:f0:fb:80:59:d4:9c:c7:a4:cf:9d:a1:59:
                    73:09:10:45:0c:0d:2c:6e:68:f1:6c:5b:48:68:49:
                    59:37:fc:0b:33:19:c2:77:7f:cc:10:2d:95:34:1c:
                    e6:eb:4d:09:a7:1c:d2:b8:c9:97:36:02:b7:89:d4:
                    24:5f:06:c0:cc:44:94:94:8d:02:62:6f:eb:5a:dd:
                    11:8d:28:9a:5c:84:90:10:7a:0d:bd:74:66:2f:6a:
                    38:a0:e2:d5:54:44:eb:1d:07:9f:07:ba:6f:ee:e9:
                    fd:4e:0b:29:f5:3e:84:a0:01:f1:9c:ab:f8:1c:7e:
                    89:a4:e8:a1:d8:71:65:0d:a3:51:7b:ee:bc:d2:22:
                    60:0d:b9:5b:9d:df:ba:fc:51:5b:0b:af:98:b2:e9:
                    2e:e9:04:e8:62:87:de:2b:c8:d7:4e:c1:4c:64:1e:
                    dd:cf:87:58:ba:4a:4f:ca:68:07:1d:1c:9d:4a:c6:
                    d5:2f:91:cc:7c:71:72:1c:c5:c0:67:eb:32:fd:c9:
                    92:5c:94:da:85:c0:9b:bf:53:7d:2b:09:f4:8c:9d:
                    91:1f:97:6a:52:cb:de:09:36:a4:77:d8:7b:87:50:
                    44:d5:3e:6e:29:69:fb:39:49:26:1e:09:a5:80:7b:
                    40:2d:eb:e8:27:85:c9:fe:61:fd:7e:e6:7c:97:1d:
                    d5:9d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies: 
                Policy: X509v3 Any Policy
                  CPS: https://www.thawte.com/cps

            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier: 
                7B:5B:45:CF:AF:CE:CB:7A:FD:31:92:1A:6A:B6:F3:46:EB:57:48:50
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.thawte.com/ThawtePremiumServerCA.crl

    Signature Algorithm: sha1WithRSAEncryption
         84:a8:4c:c9:3e:2a:bc:9a:e2:cc:8f:0b:b2:25:77:c4:61:89:
         89:63:5a:d4:a3:15:40:d4:fb:5e:3f:b4:43:ea:63:17:2b:6b:
         99:74:9e:09:a8:dd:d4:56:15:2e:7a:79:31:5f:63:96:53:1b:
         34:d9:15:ea:4f:6d:70:ca:be:f6:82:a9:ed:da:85:77:cc:76:
         1c:6a:81:0a:21:d8:41:99:7f:5e:2e:82:c1:e8:aa:f7:93:81:
         05:aa:92:b4:1f:b7:9a:c0:07:17:f5:cb:c6:b4:4c:0e:d7:56:
         dc:71:20:74:38:d6:74:c6:d6:8f:6b:af:8b:8d:a0:6c:29:0b:
         61:e0
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA
        Validity
            Not Before: Feb  8 00:00:00 2010 GMT
            Not After : Feb  7 23:59:59 2020 GMT
        Subject: C=US, O=Thawte, Inc., CN=Thawte Code Signing CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b7:8b:cf:75:5b:9f:25:da:7e:39:b0:93:db:38:
                    d3:a9:23:d0:82:fa:e9:24:7e:5c:0b:8e:83:f8:e6:
                    7a:59:e6:a3:c5:98:a7:99:d2:44:ff:00:a6:a5:39:
                    04:8a:da:29:88:ea:db:a2:f3:1c:99:15:26:c2:b1:
                    f4:fc:e1:0c:47:a9:09:11:06:0a:20:92:b9:c7:a0:
                    04:8c:5c:94:19:ab:5b:25:2c:1d:62:7e:70:0d:ce:
                    61:6c:dd:2b:82:c9:ce:5d:48:5f:f7:c2:be:bc:41:
                    23:1e:4f:29:5d:d7:4f:bc:f4:c5:2a:fc:63:e6:7c:
                    26:4e:99:a7:79:41:9e:10:4a:7a:79:c9:c6:86:f7:
                    86:95:d2:26:ce:3c:18:2a:d6:7c:ce:af:cd:ad:bb:
                    f7:82:2c:70:26:37:45:e5:0f:47:22:c6:01:28:bd:
                    2e:83:5c:6a:a4:47:c1:e7:d0:d8:6b:81:46:3f:21:
                    17:f5:07:c5:43:5a:a6:67:2c:b8:7b:60:11:b5:83:
                    ee:f5:74:0a:72:71:44:3d:58:fe:e8:1a:ab:38:c3:
                    59:db:7f:6e:38:7d:76:c7:72:69:98:36:96:57:d3:
                    66:1c:d2:54:91:04:2e:54:19:b0:dc:3d:b5:22:5e:
                    86:d5:2a:7e:20:df:5d:e6:7a:b1:65:fe:c5:02:4e:
                    31:2d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.thawte.com/ThawtePCA.crl

            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            Authority Information Access: 
                OCSP - URI:http://ocsp.thawte.com

            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, Code Signing
            X509v3 Subject Alternative Name: 
                DirName:/CN=VeriSignMPKI-2-10
            X509v3 Subject Key Identifier: 
                D4:0D:65:3F:7A:BD:34:C6:FE:47:E7:4C:0D:C0:BD:F2:DE:15:AB:71
            X509v3 Authority Key Identifier: 
                keyid:7B:5B:45:CF:AF:CE:CB:7A:FD:31:92:1A:6A:B6:F3:46:EB:57:48:50

    Signature Algorithm: sha1WithRSAEncryption
         56:fe:53:5c:e1:c7:9e:bc:a7:ed:7e:53:6d:6a:14:4b:51:8c:
         40:5e:80:5f:aa:a4:e8:2f:ef:38:c8:04:c9:ca:3e:cf:df:3a:
         58:4e:b0:d4:b6:63:c5:29:57:fa:02:05:9a:45:4d:68:db:2a:
         1b:d4:34:3d:9f:00:c3:5a:cb:95:49:a5:6e:e1:b0:c5:fc:41:
         4d:41:4a:6f:d3:77:c8:d7:38:8d:e4:19:de:18:f3:1f:15:65:
         83:6d:45:0c:53:f9:0a:9a:2e:a5:5d:bf:6f:32:81:18:92:19:
         6a:55:00:ad:63:1c:52:06:7e:55:d9:29:68:ae:4a:7c:18:9a:
         79:88:6b:23:23:d8:27:38:2a:29:87:76:ca:fb:c7:b6:62:23:
         1f:ed:7a:56:4c:dd:9c:32:5b:f5:3d:0c:46:18:95:3b:2a:23:
         68:83:64:41:d9:00:6d:0f:19:24:15:68:72:bd:c5:71:67:6e:
         ac:4c:db:90:eb:51:a5:1a:62:07:d0:be:6a:00:47:3c:72:2f:
         ec:4f:61:3e:73:85:ce:5a:0a:b7:ba:c0:1c:13:75:e3:22:39:
         28:dd:6d:1d:09:46:9d:4f:ba:e8:40:81:91:c6:a4:ce:94:72:
         1b:01:cf:2a:6e:15:67:95:89:ae:7d:b7:b7:cd:f9:0a:3d:75:
         b6:6b:3c:25
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA - G2
        Validity
            Not Before: Oct 18 00:00:00 2012 GMT
            Not After : Dec 29 23:59:59 2020 GMT
        Subject: C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer - G4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:a2:63:0b:39:44:b8:bb:23:a7:44:49:bb:0e:ff:
                    a1:f0:61:0a:53:93:b0:98:db:ad:2c:0f:4a:c5:6e:
                    ff:86:3c:53:55:0f:15:ce:04:3f:2b:fd:a9:96:96:
                    d9:be:61:79:0b:5b:c9:4c:86:76:e5:e0:43:4b:22:
                    95:ee:c2:2b:43:c1:9f:d8:68:b4:8e:40:4f:ee:85:
                    38:b9:11:c5:23:f2:64:58:f0:15:32:6f:4e:57:a1:
                    ae:88:a4:02:d7:2a:1e:cd:4b:e1:dd:63:d5:17:89:
                    32:5b:b0:5e:99:5a:a8:9d:28:50:0e:17:ee:96:db:
                    61:3b:45:51:1d:cf:12:56:0b:92:47:fc:ab:ae:f6:
                    66:3d:47:ac:70:72:e7:92:e7:5f:cd:10:b9:c4:83:
                    64:94:19:bd:25:80:e1:e8:d2:22:a5:d0:ba:02:7a:
                    a1:77:93:5b:65:c3:ee:17:74:bc:41:86:2a:dc:08:
                    4c:8c:92:8c:91:2d:9e:77:44:1f:68:d6:a8:74:77:
                    db:0e:5b:32:8b:56:8b:33:bd:d9:63:c8:49:9d:3a:
                    c5:c5:ea:33:0b:d2:f1:a3:1b:f4:8b:be:d9:b3:57:
                    8b:3b:de:04:a7:7a:22:b2:24:ae:2e:c7:70:c5:be:
                    4e:83:26:08:fb:0b:bd:a9:4f:99:08:e1:10:28:72:
                    aa:cd
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Extended Key Usage: critical
                Time Stamping
            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access: 
                OCSP - URI:http://ts-ocsp.ws.symantec.com
                CA Issuers - URI:http://ts-aia.ws.symantec.com/tss-ca-g2.cer

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://ts-crl.ws.symantec.com/tss-ca-g2.crl

            X509v3 Subject Alternative Name: 
                DirName:/CN=TimeStamp-2048-2
            X509v3 Subject Key Identifier: 
                46:C6:69:A3:0E:4A:14:1E:D5:4C:DA:52:63:17:3F:5E:36:BC:0D:E6
            X509v3 Authority Key Identifier: 
                keyid:5F:9A:F5:6E:5C:CC:CC:74:9A:D4:DD:7D:EF:3F:DB:EC:4C:80:2E:DD

    Signature Algorithm: sha1WithRSAEncryption
         78:3b:b4:91:2a:00:4c:f0:8f:62:30:37:78:a3:84:27:07:6f:
         18:b2:de:25:dc:a0:d4:94:03:aa:86:4e:25:9f:9a:40:03:1c:
         dd:ce:e3:79:cb:21:68:06:da:b6:32:b4:6d:bf:f4:2c:26:63:
         33:e4:49:64:6d:0d:e6:c3:67:0e:f7:05:a4:35:6c:7c:89:16:
         c6:e9:b2:df:b2:e9:dd:20:c6:71:0f:cd:95:74:dc:b6:5c:de:
         bd:37:1f:43:78:e6:78:b5:cd:28:04:20:a3:aa:f1:4b:c4:88:
         29:91:0e:80:d1:11:fc:dd:5c:76:6e:4f:5e:0e:45:46:41:6e:
         0d:b0:ea:38:9a:b1:3a:da:09:71:10:fc:1c:79:b4:80:7b:ac:
         69:f4:fd:9c:b6:0c:16:2b:f1:7f:5b:09:3d:9b:5b:e2:16:ca:
         13:81:6d:00:2e:38:0d:a8:29:8f:2c:e1:b2:f4:5a:a9:01:af:
         15:9c:2c:2f:49:1b:db:22:bb:c3:fe:78:94:51:c3:86:b1:82:
         88:5d:f0:3d:b4:51:a1:79:33:2b:2e:7b:b9:dc:20:09:13:71:
         eb:6a:19:5b:cf:e8:a5:30:57:2c:89:49:3f:b9:cf:7f:c9:bf:
         3e:22:68:63:53:9a:bd:69:74:ac:c5:1d:3c:7f:92:e0:c3:bc:
         1c:d8:04:75
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            64:d0:c2:eb:67:dd:04:24:0d:f6:d1:dc:65:f9:10:95
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=Thawte, Inc., CN=Thawte Code Signing CA - G2
        Validity
            Not Before: Aug 11 00:00:00 2014 GMT
            Not After : Nov  4 23:59:59 2015 GMT
        Subject: C=US, ST=Texas, L=Houston, O=QueTek Consulting Corporation, OU=SALES, CN=QueTek Consulting Corporation
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b9:1d:b7:9b:80:f3:81:df:29:6c:da:c7:c4:7b:
                    b9:59:0e:31:ce:6b:e3:29:f7:2b:0f:9c:00:26:e0:
                    a9:5a:db:0a:d5:82:dc:47:af:6e:d1:cf:df:18:dd:
                    d8:2b:23:02:6b:bf:a2:e4:95:bb:03:29:59:74:a3:
                    92:e8:d6:e3:88:4c:2e:d9:fb:de:f4:d4:be:e5:af:
                    13:ad:0c:e1:a3:6f:ed:f2:72:fc:b1:60:05:d2:88:
                    d5:f0:a9:9a:50:03:5b:f2:90:06:f3:23:2e:6b:89:
                    6f:47:70:be:77:21:f1:66:f3:7a:81:4f:1e:90:d8:
                    85:9b:93:bf:b5:f0:95:41:cd:e9:0a:b2:f3:6e:aa:
                    47:0f:ab:6f:0c:80:06:02:dd:cc:53:24:c2:2f:dc:
                    2a:f9:2d:8a:90:bf:37:3c:6b:a2:56:51:bb:0a:c9:
                    c8:0b:d5:16:05:54:1a:04:08:e8:9f:23:23:55:a8:
                    5d:29:97:93:17:6f:e1:2d:29:dd:d1:f3:77:0f:dc:
                    54:cf:65:80:3f:b7:d6:6f:2b:c1:c6:5b:f9:93:fc:
                    c8:8d:02:f9:ac:51:fc:62:84:a5:b7:80:c7:67:d8:
                    ba:05:7f:44:8a:14:b3:60:a0:b9:76:58:59:ba:e6:
                    5e:32:b9:0a:6b:e5:2f:3f:2b:04:53:00:7c:d3:96:
                    7f:43
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Authority Key Identifier: 
                keyid:D4:0D:65:3F:7A:BD:34:C6:FE:47:E7:4C:0D:C0:BD:F2:DE:15:AB:71

            X509v3 Subject Key Identifier: 
                3F:DF:F7:80:58:C8:CE:62:A6:8A:A3:30:4A:7F:95:41:C8:CE:3E:0C
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://th.symcb.com/th.crl

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Extended Key Usage: 
                Code Signing, Microsoft Commercial Code Signing
            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.48.2
                  CPS: https://d.symcb.com/cps
                  User Notice:
                    Explicit Text: https://d.symcb.com/rpa

            2.5.29.4: 
                0.0.0..
+.....7.......
            Authority Information Access: 
                OCSP - URI:http://th.symcd.com
                CA Issuers - URI:http://th.symcb.com/th.crt

            Netscape Cert Type: 
                Object Signing
    Signature Algorithm: sha1WithRSAEncryption
         6c:6d:0b:e0:97:83:b6:99:5a:d3:b0:30:13:61:a7:ac:c4:c9:
         c9:1a:e9:56:67:23:9f:3a:aa:36:d1:ee:31:ad:06:33:18:2a:
         e8:0d:a4:a0:56:58:0a:13:77:5b:26:37:6b:bd:1d:5d:57:63:
         48:87:71:44:1f:79:9f:5c:10:e5:36:cc:87:29:70:84:b9:6e:
         3d:73:d3:2e:49:46:e4:d1:78:5a:7d:23:e8:53:aa:a9:48:52:
         c6:9b:45:15:f1:3c:c5:f1:2b:5a:c8:bb:48:9b:54:d3:e6:31:
         10:c5:02:9f:95:43:02:a1:4d:55:a7:1d:99:c2:73:fa:2a:c8:
         e7:40:0f:de:42:2c:5d:d5:2c:06:39:5e:cb:eb:d9:9d:8e:6a:
         d6:0f:ac:f2:f6:0d:f4:b8:0d:bd:9e:0e:51:d5:8d:59:bd:e6:
         18:e6:eb:6c:16:81:bc:7e:e0:2b:ea:e0:33:e0:8c:62:40:76:
         2d:f5:07:f1:1f:1c:92:d7:1b:cf:6d:12:ba:2c:81:6e:96:4f:
         27:53:6b:35:9d:36:e4:ea:17:da:6e:6e:01:a8:98:1c:d2:1d:
         3c:5e:7d:f6:32:87:be:69:8e:2c:2f:c4:a8:00:73:0b:a0:f2:
         31:bf:12:d8:f2:28:58:70:55:24:49:ca:a2:33:bc:a3:e7:37:
         58:34:fd:bf
pkcs7-signedData
  • 1
    • SHA1: nil
    • 1.3.6.1.4.1.311.2.1.4
      • #0
        • 1.3.6.1.4.1.311.2.1.15
          • :
        • SHA1
          • 5e 72 e9 a9 65 d5 5a 38  a8 18 f4 9d c8 0d 37 c2  |^r..e.Z8......7.|
08 0f 59 16                                       |..Y.            |
    • Certificates
      • Certificate #0
        • 2
          • 7E:93:EB:FB:7C:C6:4E:59:EA:4B:9A:77:D4:06:FC:3B
          • RSA-SHA1: nil
          • Issuer
            • C: ZA
            • ST: Western Cape
            • L: Durbanville
            • O: Thawte
            • OU: Thawte Certification
            • CN: Thawte Timestamping CA
          • 2012-12-21 00:00:00 UTC: 2020-12-30 23:59:59 UTC
          • Subject
            • C: US
            • O: Symantec Corporation
            • CN: Symantec Time Stamping Services CA - G2
          • #5
            • rsaEncryption: nil
            • B1:AC:B3:49:54:4B:97:1C:12:0A:D8:25:79:91:22:57:
              2A:6F:DC:B8:26:C4:43:73:6B:C2:BF:2E:50:5A:FB:14:
              C2:76:8E:43:01:25:43:B4:A1:E2:45:F4:E8:B7:7B:C3:
              74:CC:22:D7:B4:94:00:02:F7:4D:ED:BF:B4:B7:44:24:
              6B:CD:5F:45:3B:D1:44:CE:43:12:73:17:82:8B:69:B4:
              2B:CB:99:1E:AC:72:1B:26:4D:71:1F:B1:31:DD:FB:51:
              61:02:53:A6:AA:F5:49:2C:05:78:45:A5:2F:89:CE:E7:
              99:E7:FE:8C:E2:57:3F:3D:C6:92:DC:4A:F8:7B:33:E4:
              79:0A:FB:F0:75:88:41:9C:FF:C5:03:51:99:AA:D7:6C:
              9F:93:69:87:65:29:83:85:C2:60:14:C4:C8:C9:3B:14:
              DA:C0:81:F0:1F:0D:74:DE:92:22:AB:CA:F7:FB:74:7C:
              27:E6:F7:4A:1B:7F:A7:C3:9E:2D:AE:8A:EA:A6:E6:AA:
              27:16:7D:61:F7:98:71:11:BC:E2:50:A1:4B:E5:5D:FA:
              E5:0E:A7:2C:9F:AA:65:20:D3:D8:96:E8:C8:7C:A5:4E:
              48:44:FF:19:E2:44:07:92:0B:D7:68:84:80:5D:6A:78:
              64:45:CD:60:46:7E:54:C1:13:7C:C5:79:F1:C9:C1:71              : 0x010001
          • #6
            • subjectKeyIdentifier: 
              5f 9a f5 6e 5c cc cc 74  9a d4 dd 7d ef 3f db ec  |_..n\..t...}.?..|
4c 80 2e dd                                       |L...            |
            • authorityInfoAccess
              • OCSP: http://ocsp.thawte.com
            • basicConstraints
              • true
              • true: 0
            • crlDistributionPoints: http://crl.thawte.com/ThawteTimestampingCA.crl
            • extendedKeyUsage: timeStamping
            • keyUsage: true, 6
            • subjectAltName
              • CN: TimeStamp-2048-1
        • RSA-SHA1: 
          03 09 9b 8f 79 ef 7f 59  30 aa ef 68 b5 fa e3 09  |....y..Y0..h....|
1d bb 4f 82 06 5d 37 5f  a6 52 9f 16 8d ea 1c 92  |..O..]7_.R......|
09 44 6e f5 6d eb 58 7c  30 e8 f9 69 8d 23 73 0b  |.Dn.m.X|0..i.#s.|
12 6f 47 a9 ae 39 11 f8  2a b1 9b b0 1a c3 8e eb  |.oG..9..*.......|
59 96 00 ad ce 0c 4d b2  d0 31 a6 08 5c 2a 7a fc  |Y.....M..1..\*z.|
e2 7a 1d 57 4c a8 65 18  e9 79 40 62 25 96 6e c7  |.z.WL.e..y@b%.n.|
c7 37 6a 83 21 08 8e 41  ea dd d9 57 3f 1d 77 49  |.7j.!..A...W?.wI|
87 2a 16 06 5e a6 38 6a  22 12 a3 51 19 83 7e b6  |.*..^.8j"..Q..~.|
      • Certificate #1
        • 2
          • 33:65:50:08:79:AD:73:E2:30:B9:E0:1D:0D:7F:AC:91
          • RSA-SHA1: nil
          • Issuer
            • C: ZA
            • ST: Western Cape
            • L: Cape Town
            • O: Thawte Consulting cc
            • OU: Certification Services Division
            • CN: Thawte Premium Server CA
            • emailAddress: premium-server@thawte.com
          • 2006-11-17 00:00:00 UTC: 2020-12-30 23:59:59 UTC
          • Subject
            • C: US
            • O: thawte, Inc.
            • OU: Certification Services Division
            • OU: (c) 2006 thawte, Inc. - For authorized use only
            • CN: thawte Primary Root CA
          • #5
            • rsaEncryption: nil
            • AC:A0:F0:FB:80:59:D4:9C:C7:A4:CF:9D:A1:59:73:09:
              10:45:0C:0D:2C:6E:68:F1:6C:5B:48:68:49:59:37:FC:
              0B:33:19:C2:77:7F:CC:10:2D:95:34:1C:E6:EB:4D:09:
              A7:1C:D2:B8:C9:97:36:02:B7:89:D4:24:5F:06:C0:CC:
              44:94:94:8D:02:62:6F:EB:5A:DD:11:8D:28:9A:5C:84:
              90:10:7A:0D:BD:74:66:2F:6A:38:A0:E2:D5:54:44:EB:
              1D:07:9F:07:BA:6F:EE:E9:FD:4E:0B:29:F5:3E:84:A0:
              01:F1:9C:AB:F8:1C:7E:89:A4:E8:A1:D8:71:65:0D:A3:
              51:7B:EE:BC:D2:22:60:0D:B9:5B:9D:DF:BA:FC:51:5B:
              0B:AF:98:B2:E9:2E:E9:04:E8:62:87:DE:2B:C8:D7:4E:
              C1:4C:64:1E:DD:CF:87:58:BA:4A:4F:CA:68:07:1D:1C:
              9D:4A:C6:D5:2F:91:CC:7C:71:72:1C:C5:C0:67:EB:32:
              FD:C9:92:5C:94:DA:85:C0:9B:BF:53:7D:2B:09:F4:8C:
              9D:91:1F:97:6A:52:CB:DE:09:36:A4:77:D8:7B:87:50:
              44:D5:3E:6E:29:69:FB:39:49:26:1E:09:A5:80:7B:40:
              2D:EB:E8:27:85:C9:FE:61:FD:7E:E6:7C:97:1D:D5:9D              : 0x010001
          • X509v3 extensions
            • basicConstraints: true, true
            • certificatePolicies
              • anyPolicy
                • id-qt-cps: https://www.thawte.com/cps
            • keyUsage: true, 6
            • subjectKeyIdentifier: 
              7b 5b 45 cf af ce cb 7a  fd 31 92 1a 6a b6 f3 46  |{[E....z.1..j..F|
eb 57 48 50                                       |.WHP            |
            • crlDistributionPoints: http://crl.thawte.com/ThawtePremiumServerCA.crl
        • RSA-SHA1: 
          84 a8 4c c9 3e 2a bc 9a  e2 cc 8f 0b b2 25 77 c4  |..L.>*.......%w.|
61 89 89 63 5a d4 a3 15  40 d4 fb 5e 3f b4 43 ea  |a..cZ...@..^?.C.|
63 17 2b 6b 99 74 9e 09  a8 dd d4 56 15 2e 7a 79  |c.+k.t.....V..zy|
31 5f 63 96 53 1b 34 d9  15 ea 4f 6d 70 ca be f6  |1_c.S.4...Omp...|
82 a9 ed da 85 77 cc 76  1c 6a 81 0a 21 d8 41 99  |.....w.v.j..!.A.|
7f 5e 2e 82 c1 e8 aa f7  93 81 05 aa 92 b4 1f b7  |.^..............|
9a c0 07 17 f5 cb c6 b4  4c 0e d7 56 dc 71 20 74  |........L..V.q t|
38 d6 74 c6 d6 8f 6b af  8b 8d a0 6c 29 0b 61 e0  |8.t...k....l).a.|
      • Certificate #2
        • 2
          • 47:97:4D:78:73:A5:BC:AB:0D:2F:B3:70:19:2F:CE:5E
          • RSA-SHA1: nil
          • Issuer
            • C: US
            • O: thawte, Inc.
            • OU: Certification Services Division
            • OU: (c) 2006 thawte, Inc. - For authorized use only
            • CN: thawte Primary Root CA
          • 2010-02-08 00:00:00 UTC: 2020-02-07 23:59:59 UTC
          • Subject
            • C: US
            • O: Thawte, Inc.
            • CN: Thawte Code Signing CA - G2
          • #5
            • rsaEncryption: nil
            • B7:8B:CF:75:5B:9F:25:DA:7E:39:B0:93:DB:38:D3:A9:
              23:D0:82:FA:E9:24:7E:5C:0B:8E:83:F8:E6:7A:59:E6:
              A3:C5:98:A7:99:D2:44:FF:00:A6:A5:39:04:8A:DA:29:
              88:EA:DB:A2:F3:1C:99:15:26:C2:B1:F4:FC:E1:0C:47:
              A9:09:11:06:0A:20:92:B9:C7:A0:04:8C:5C:94:19:AB:
              5B:25:2C:1D:62:7E:70:0D:CE:61:6C:DD:2B:82:C9:CE:
              5D:48:5F:F7:C2:BE:BC:41:23:1E:4F:29:5D:D7:4F:BC:
              F4:C5:2A:FC:63:E6:7C:26:4E:99:A7:79:41:9E:10:4A:
              7A:79:C9:C6:86:F7:86:95:D2:26:CE:3C:18:2A:D6:7C:
              CE:AF:CD:AD:BB:F7:82:2C:70:26:37:45:E5:0F:47:22:
              C6:01:28:BD:2E:83:5C:6A:A4:47:C1:E7:D0:D8:6B:81:
              46:3F:21:17:F5:07:C5:43:5A:A6:67:2C:B8:7B:60:11:
              B5:83:EE:F5:74:0A:72:71:44:3D:58:FE:E8:1A:AB:38:
              C3:59:DB:7F:6E:38:7D:76:C7:72:69:98:36:96:57:D3:
              66:1C:D2:54:91:04:2E:54:19:B0:DC:3D:B5:22:5E:86:
              D5:2A:7E:20:DF:5D:E6:7A:B1:65:FE:C5:02:4E:31:2D              : 0x010001
          • X509v3 extensions
            • basicConstraints
              • true
              • true: 0
            • crlDistributionPoints: http://crl.thawte.com/ThawtePCA.crl
            • keyUsage: true, 6
            • authorityInfoAccess
              • OCSP: http://ocsp.thawte.com
            • extendedKeyUsage
              • clientAuth: codeSigning
            • subjectAltName
              • CN: VeriSignMPKI-2-10
            • subjectKeyIdentifier: 
              d4 0d 65 3f 7a bd 34 c6  fe 47 e7 4c 0d c0 bd f2  |..e?z.4..G.L....|
de 15 ab 71                                       |...q            |
            • authorityKeyIdentifier: 
              7b 5b 45 cf af ce cb 7a  fd 31 92 1a 6a b6 f3 46  |{[E....z.1..j..F|
eb 57 48 50                                       |.WHP            |
        • RSA-SHA1: 
          56 fe 53 5c e1 c7 9e bc  a7 ed 7e 53 6d 6a 14 4b  |V.S\......~Smj.K|
51 8c 40 5e 80 5f aa a4  e8 2f ef 38 c8 04 c9 ca  |Q.@^._.../.8....|
3e cf df 3a 58 4e b0 d4  b6 63 c5 29 57 fa 02 05  |>..:XN...c.)W...|
9a 45 4d 68 db 2a 1b d4  34 3d 9f 00 c3 5a cb 95  |.EMh.*..4=...Z..|
49 a5 6e e1 b0 c5 fc 41  4d 41 4a 6f d3 77 c8 d7  |I.n....AMAJo.w..|
38 8d e4 19 de 18 f3 1f  15 65 83 6d 45 0c 53 f9  |8........e.mE.S.|
0a 9a 2e a5 5d bf 6f 32  81 18 92 19 6a 55 00 ad  |....].o2....jU..|
63 1c 52 06 7e 55 d9 29  68 ae 4a 7c 18 9a 79 88  |c.R.~U.)h.J|..y.|
6b 23 23 d8 27 38 2a 29  87 76 ca fb c7 b6 62 23  |k##.'8*).v....b#|
1f ed 7a 56 4c dd 9c 32  5b f5 3d 0c 46 18 95 3b  |..zVL..2[.=.F..;|
2a 23 68 83 64 41 d9 00  6d 0f 19 24 15 68 72 bd  |*#h.dA..m..$.hr.|
c5 71 67 6e ac 4c db 90  eb 51 a5 1a 62 07 d0 be  |.qgn.L...Q..b...|
6a 00 47 3c 72 2f ec 4f  61 3e 73 85 ce 5a 0a b7  |j.Gs..Z..|
ba c0 1c 13 75 e3 22 39  28 dd 6d 1d 09 46 9d 4f  |....u."9(.m..F.O|
ba e8 40 81 91 c6 a4 ce  94 72 1b 01 cf 2a 6e 15  |..@......r...*n.|
67 95 89 ae 7d b7 b7 cd  f9 0a 3d 75 b6 6b 3c 25  |g...}.....=u.k<%|
      • Certificate #3
        • 2
          • 0E:CF:F4:38:C8:FE:BF:35:6E:04:D8:6A:98:1B:1A:50
          • RSA-SHA1: nil
          • Issuer
            • C: US
            • O: Symantec Corporation
            • CN: Symantec Time Stamping Services CA - G2
          • 2012-10-18 00:00:00 UTC: 2020-12-29 23:59:59 UTC
          • Subject
            • C: US
            • O: Symantec Corporation
            • CN: Symantec Time Stamping Services Signer - G4
          • #5
            • rsaEncryption: nil
            • A2:63:0B:39:44:B8:BB:23:A7:44:49:BB:0E:FF:A1:F0:
              61:0A:53:93:B0:98:DB:AD:2C:0F:4A:C5:6E:FF:86:3C:
              53:55:0F:15:CE:04:3F:2B:FD:A9:96:96:D9:BE:61:79:
              0B:5B:C9:4C:86:76:E5:E0:43:4B:22:95:EE:C2:2B:43:
              C1:9F:D8:68:B4:8E:40:4F:EE:85:38:B9:11:C5:23:F2:
              64:58:F0:15:32:6F:4E:57:A1:AE:88:A4:02:D7:2A:1E:
              CD:4B:E1:DD:63:D5:17:89:32:5B:B0:5E:99:5A:A8:9D:
              28:50:0E:17:EE:96:DB:61:3B:45:51:1D:CF:12:56:0B:
              92:47:FC:AB:AE:F6:66:3D:47:AC:70:72:E7:92:E7:5F:
              CD:10:B9:C4:83:64:94:19:BD:25:80:E1:E8:D2:22:A5:
              D0:BA:02:7A:A1:77:93:5B:65:C3:EE:17:74:BC:41:86:
              2A:DC:08:4C:8C:92:8C:91:2D:9E:77:44:1F:68:D6:A8:
              74:77:DB:0E:5B:32:8B:56:8B:33:BD:D9:63:C8:49:9D:
              3A:C5:C5:EA:33:0B:D2:F1:A3:1B:F4:8B:BE:D9:B3:57:
              8B:3B:DE:04:A7:7A:22:B2:24:AE:2E:C7:70:C5:BE:4E:
              83:26:08:FB:0B:BD:A9:4F:99:08:E1:10:28:72:AA:CD              : 0x010001
          • X509v3 extensions
            • basicConstraints
              • true
              • nil
            • extendedKeyUsage: true, timeStamping
            • keyUsage: true, 0x80
            • authorityInfoAccess
              • #0
                • OCSP: http://ts-ocsp.ws.symantec.com
                • caIssuers: http://ts-aia.ws.symantec.com/tss-ca-g2.cer
            • crlDistributionPoints: http://ts-crl.ws.symantec.com/tss-ca-g2.crl
            • subjectAltName
              • CN: TimeStamp-2048-2
            • subjectKeyIdentifier: 
              46 c6 69 a3 0e 4a 14 1e  d5 4c da 52 63 17 3f 5e  |F.i..J...L.Rc.?^|
36 bc 0d e6                                       |6...            |
            • authorityKeyIdentifier: 
              5f 9a f5 6e 5c cc cc 74  9a d4 dd 7d ef 3f db ec  |_..n\..t...}.?..|
4c 80 2e dd                                       |L...            |
        • RSA-SHA1: 
          78 3b b4 91 2a 00 4c f0  8f 62 30 37 78 a3 84 27  |x;..*.L..b07x..'|
07 6f 18 b2 de 25 dc a0  d4 94 03 aa 86 4e 25 9f  |.o...%.......N%.|
9a 40 03 1c dd ce e3 79  cb 21 68 06 da b6 32 b4  |.@.....y.!h...2.|
6d bf f4 2c 26 63 33 e4  49 64 6d 0d e6 c3 67 0e  |m..,&c3.Idm...g.|
f7 05 a4 35 6c 7c 89 16  c6 e9 b2 df b2 e9 dd 20  |...5l|......... |
c6 71 0f cd 95 74 dc b6  5c de bd 37 1f 43 78 e6  |.q...t..\..7.Cx.|
78 b5 cd 28 04 20 a3 aa  f1 4b c4 88 29 91 0e 80  |x..(. ...K..)...|
d1 11 fc dd 5c 76 6e 4f  5e 0e 45 46 41 6e 0d b0  |....\vnO^.EFAn..|
ea 38 9a b1 3a da 09 71  10 fc 1c 79 b4 80 7b ac  |.8..:..q...y..{.|
69 f4 fd 9c b6 0c 16 2b  f1 7f 5b 09 3d 9b 5b e2  |i......+..[.=.[.|
16 ca 13 81 6d 00 2e 38  0d a8 29 8f 2c e1 b2 f4  |....m..8..).,...|
5a a9 01 af 15 9c 2c 2f  49 1b db 22 bb c3 fe 78  |Z.....,/I.."...x|
94 51 c3 86 b1 82 88 5d  f0 3d b4 51 a1 79 33 2b  |.Q.....].=.Q.y3+|
2e 7b b9 dc 20 09 13 71  eb 6a 19 5b cf e8 a5 30  |.{.. ..q.j.[...0|
57 2c 89 49 3f b9 cf 7f  c9 bf 3e 22 68 63 53 9a  |W,.I?.....>"hcS.|
bd 69 74 ac c5 1d 3c 7f  92 e0 c3 bc 1c d8 04 75  |.it...<........u|
      • Certificate #4
        • 2
          • 64:D0:C2:EB:67:DD:04:24:0D:F6:D1:DC:65:F9:10:95
          • RSA-SHA1: nil
          • Issuer
            • C: US
            • O: Thawte, Inc.
            • CN: Thawte Code Signing CA - G2
          • 2014-08-11 00:00:00 UTC: 2015-11-04 23:59:59 UTC
          • Subject
            • C: US
            • ST: Texas
            • L: Houston
            • O: QueTek Consulting Corporation
            • OU: SALES
            • CN: QueTek Consulting Corporation
          • #5
            • rsaEncryption: nil
            • B9:1D:B7:9B:80:F3:81:DF:29:6C:DA:C7:C4:7B:B9:59:
              0E:31:CE:6B:E3:29:F7:2B:0F:9C:00:26:E0:A9:5A:DB:
              0A:D5:82:DC:47:AF:6E:D1:CF:DF:18:DD:D8:2B:23:02:
              6B:BF:A2:E4:95:BB:03:29:59:74:A3:92:E8:D6:E3:88:
              4C:2E:D9:FB:DE:F4:D4:BE:E5:AF:13:AD:0C:E1:A3:6F:
              ED:F2:72:FC:B1:60:05:D2:88:D5:F0:A9:9A:50:03:5B:
              F2:90:06:F3:23:2E:6B:89:6F:47:70:BE:77:21:F1:66:
              F3:7A:81:4F:1E:90:D8:85:9B:93:BF:B5:F0:95:41:CD:
              E9:0A:B2:F3:6E:AA:47:0F:AB:6F:0C:80:06:02:DD:CC:
              53:24:C2:2F:DC:2A:F9:2D:8A:90:BF:37:3C:6B:A2:56:
              51:BB:0A:C9:C8:0B:D5:16:05:54:1A:04:08:E8:9F:23:
              23:55:A8:5D:29:97:93:17:6F:E1:2D:29:DD:D1:F3:77:
              0F:DC:54:CF:65:80:3F:B7:D6:6F:2B:C1:C6:5B:F9:93:
              FC:C8:8D:02:F9:AC:51:FC:62:84:A5:B7:80:C7:67:D8:
              BA:05:7F:44:8A:14:B3:60:A0:B9:76:58:59:BA:E6:5E:
              32:B9:0A:6B:E5:2F:3F:2B:04:53:00:7C:D3:96:7F:43              : 0x010001
          • X509v3 extensions
            • basicConstraints
              • nil
            • authorityKeyIdentifier: 
              d4 0d 65 3f 7a bd 34 c6  fe 47 e7 4c 0d c0 bd f2  |..e?z.4..G.L....|
de 15 ab 71                                       |...q            |
            • subjectKeyIdentifier: 
              3f df f7 80 58 c8 ce 62  a6 8a a3 30 4a 7f 95 41  |?...X..b...0J..A|
c8 ce 3e 0c                                       |..>.            |
            • crlDistributionPoints: http://th.symcb.com/th.crl
            • keyUsage: true, 0x80
            • extendedKeyUsage
              • codeSigning: msCodeCom
            • certificatePolicies
              • 2.16.840.1.113733.1.7.48.2
                • #0
                  • id-qt-cps: https://d.symcb.com/cps
                  • id-qt-unotice: https://d.symcb.com/rpa
            • 2.5.29.4
              • msCodeCom: 0x80
            • authorityInfoAccess
              • #0
                • OCSP: http://th.symcd.com
                • caIssuers: http://th.symcb.com/th.crt
            • nsCertType: 0x10
        • RSA-SHA1: 
          6c 6d 0b e0 97 83 b6 99  5a d3 b0 30 13 61 a7 ac  |lm......Z..0.a..|
c4 c9 c9 1a e9 56 67 23  9f 3a aa 36 d1 ee 31 ad  |.....Vg#.:.6..1.|
06 33 18 2a e8 0d a4 a0  56 58 0a 13 77 5b 26 37  |.3.*....VX..w[&7|
6b bd 1d 5d 57 63 48 87  71 44 1f 79 9f 5c 10 e5  |k..]WcH.qD.y.\..|
36 cc 87 29 70 84 b9 6e  3d 73 d3 2e 49 46 e4 d1  |6..)p..n=s..IF..|
78 5a 7d 23 e8 53 aa a9  48 52 c6 9b 45 15 f1 3c  |xZ}#.S..HR..E..<|
c5 f1 2b 5a c8 bb 48 9b  54 d3 e6 31 10 c5 02 9f  |..+Z..H.T..1....|
95 43 02 a1 4d 55 a7 1d  99 c2 73 fa 2a c8 e7 40  |.C..MU....s.*..@|
0f de 42 2c 5d d5 2c 06  39 5e cb eb d9 9d 8e 6a  |..B,].,.9^.....j|
d6 0f ac f2 f6 0d f4 b8  0d bd 9e 0e 51 d5 8d 59  |............Q..Y|
bd e6 18 e6 eb 6c 16 81  bc 7e e0 2b ea e0 33 e0  |.....l...~.+..3.|
8c 62 40 76 2d f5 07 f1  1f 1c 92 d7 1b cf 6d 12  |.b@v-.........m.|
ba 2c 81 6e 96 4f 27 53  6b 35 9d 36 e4 ea 17 da  |.,.n.O'Sk5.6....|
6e 6e 01 a8 98 1c d2 1d  3c 5e 7d f6 32 87 be 69  |nn......<^}.2..i|
8e 2c 2f c4 a8 00 73 0b  a0 f2 31 bf 12 d8 f2 28  |.,/...s...1....(|
58 70 55 24 49 ca a2 33  bc a3 e7 37 58 34 fd bf  |XpU$I..3...7X4..|
    • 1
      • unnamed
        • #0
          • C: US
          • O: Thawte, Inc.
          • CN: Thawte Code Signing CA - G2
        • 64:D0:C2:EB:67:DD:04:24:0D:F6:D1:DC:65:F9:10:95
      • SHA1: nil
      • #2
        • contentType: 1.3.6.1.4.1.311.2.1.4
        • 1.3.6.1.4.1.311.2.1.11: msCodeCom
        • messageDigest: 
          01 2d 9f 85 ef 9f 07 35  2f 5f bb 69 d8 8a 7d bb  |.-.....5/_.i..}.|
eb 8b a7 eb                                       |....            |
        • 1.3.6.1.4.1.311.2.1.12
          • 00 46 00 69 00 6c 00 65  00 20 00 53 00 63 00 61  |.F.i.l.e. .S.c.a|
00 76 00 65 00 6e 00 67  00 65 00 72 00 20 00 56  |.v.e.n.g.e.r. .V|
00 34 00 2e 00 33                                 |.4...3          |
            : http://www.quetek.com
      • rsaEncryption: 
        9e 21 fd c5 be c4 96 0b  21 43 66 65 bf 65 61 a7  |.!......!Cfe.ea.|
ff 4d c1 19 3b eb b8 32  1a 50 fc 14 b8 49 1b f3  |.M..;..2.P...I..|
4a 03 73 fd b4 65 3e 68  0d ba f0 78 01 e6 9e 84  |J.s..e>h...x....|
13 8b b0 cc 5e 40 8a 90  f3 1e 1a d4 96 e0 27 d1  |....^@........'.|
96 14 f7 c8 40 8d 44 72  6e 01 51 7b 7b 51 22 cd  |....@.Drn.Q{{Q".|
69 80 fb 01 9b 03 89 6c  30 5d 27 73 ec 45 70 d2  |i......l0]'s.Ep.|
76 23 6b b1 f6 a1 dc 2b  88 d4 cb 3e 5b fa 9f 37  |v#k....+...>[..7|
ad b5 78 28 16 fc f7 46  cb 4d db 3f 7f 3a 22 8d  |..x(...F.M.?.:".|
94 5c 03 5b 7a c4 a0 fa  f1 c0 9d 00 42 5a 59 b6  |.\.[z.......BZY.|
f7 7c 59 55 b6 ef 1d 4b  0a 93 10 e6 83 93 69 49  |.|YU...K......iI|
29 7f 70 ae 24 77 a7 f6  e6 b8 3a 50 ee 79 db 71  |).p.$w....:P.y.q|
2e 20 28 e9 db 2f 90 81  eb e3 82 83 0e 00 f6 30  |. (../.........0|
2c 64 09 f3 88 51 e8 a7  c4 0e 77 87 f9 fc ff a8  |,d...Q....w.....|
19 2c 2f da e3 98 24 99  fd 37 0e 1a 6d f1 99 55  |.,/...$..7..m..U|
33 7b 01 3e 81 dc e9 e5  1e 2d 36 99 d7 71 03 2d  |3{.>.....-6..q.-|
9b 08 fa 15 58 c8 0c d3  80 b7 08 e0 6a 8d 9a 64  |....X.......j..d|
      • countersignature
        • 1
          • unnamed
            • #0
              • C: US
              • O: Symantec Corporation
              • CN: Symantec Time Stamping Services CA - G2
            • 0E:CF:F4:38:C8:FE:BF:35:6E:04:D8:6A:98:1B:1A:50
          • SHA1: nil
          • #2
            • contentType: pkcs7-data
            • signingTime: 2014-09-25 17:52:27 UTC
            • messageDigest: 
              a2 01 60 fb 5c 5a 67 56  ff a9 f5 21 db 6b 2b 2f  |..`.\ZgV...!.k+/|
1b 0f cf 26                                       |...&            |
          • rsaEncryption: 
            54 37 4c 2e 7f 80 66 68  1f f1 e2 83 fb a4 3a 6c  |T7L...fh......:l|
fb ce 7a 55 ac cb c8 cf  cc 53 d8 2d af f2 4d f2  |..zU.....S.-..M.|
8c d8 ee ea b3 c2 91 55  16 a9 16 65 05 1b 87 c0  |.......U...e....|
29 ee ec fc 0d 00 88 48  7d 91 8d ff 4c b6 5e 5c  |)......H}...L.^\|
82 4e f5 32 14 8d 2b 1d  1e 6c 75 fb 1e bd ae a6  |.N.2..+..lu.....|
bd 3e 6f ee ef 33 45 c9  a6 2a a2 34 05 e8 06 eb  |.>o..3E..*.4....|
d6 cc 50 f8 e5 6c d8 10  8c fc eb 07 ba 9f 0d 41  |..P..l.........A|
79 cd db 20 11 de 94 18  5c ec eb cc 8f 55 fb ae  |y.. ....\....U..|
05 47 42 c1 74 ee 87 55  f2 93 c8 92 f1 12 ed bf  |.GB.t..U........|
40 16 68 79 0a 81 7f 15  ac 42 c0 d5 bb bc 4d dd  |@.hy.....B....M.|
1a 96 3a 2d b9 89 b9 48  1e 5c 66 11 62 78 cd 41  |..:-...H.\f.bx.A|
d7 43 0a ba 52 73 57 b3  c3 4e a0 cd f9 d2 97 e2  |.C..RsW..N......|
46 50 6f f5 13 6f fe 77  76 2b 28 ad be d7 cc 03  |FPo..o.wv+(.....|
7e 17 cd 15 c2 8b b2 ca  cd 55 8a e5 ff 8c 83 39  |~........U.....9|
83 ba bd 82 c4 29 eb a3  24 19 f8 28 2f 2d 66 6c  |.....)..$..(/-fl|
9c d8 cb 91 ca 02 57 55  63 78 51 23 09 92 60 b5  |......WUcxQ#..`.|
offsetsizetypecomment
02207744EXE09/25/2014 17:50:42#
15c115HTM#
21b0007008PKCS7Authenticode Signature#
Scanning the drive for archives:
1 file, 2214752 bytes (2163 KiB)


--
Type = PE
Physical Size = 2214752
CPU = x86
Characteristics = Executable 32-bit NoRelocs
Created = 2014-09-25 17:50:42
Headers Size = 4096
Checksum = 2224209
Name = FileScav.exe
Image Size = 2306048
Section Alignment = 4096
File Alignment = 4096
Code Size = 1163264
Initialized Data Size = 1040384
Uninitialized Data Size = 0
Linker Version = 8.0
OS Version = 4.0
Image Version = 0.0
Subsystem Version = 4.0
Subsystem = Windows GUI
Stack Reserve = 1048576
Stack Commit = 4096
Heap Reserve = 1048576
Heap Commit = 4096
Image Base = 4194304
Comment = FileVersion: 4.3.1.0
ProductVersion: 4.3.1.0
CompanyName: QueTek Consulting Corporation
FileDescription: File Scavenger (R) - Premium data recovery tool
InternalName: FileScav.exe
LegalCopyright: Copyrights (c) 1998-2014 QueTek Consulting Corporation.  All rights reserved. 
LegalTrademarks: File Scavenger
OriginalFilename: FileScav.exe
ProductName: File Scavenger
SpecialBuild: 4.3.1.0
----
Path = .rsrc/BIN/351
Size = 200061
Packed Size = 200061
--
Path = .rsrc/BIN/351
Type = Chm
Physical Size = 200061

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
                    D....            0               $WWAssociativeLinks
                    D....            0               $WWKeywordLinks
                    D....            0               html
                    D....            0               html/Images
                    D....            0               images
                    .....            0               #ITBITS
                    .....         4299               #SYSTEM
                    .....            0               $FIftiMain
                    .....        14004               filescav.hhc
                    .....        77822               FileScav.hhk
                    .....         1839               html/acknowledge.htm
                    .....         2250               html/afxc01ta.htm
                    .....        30153               html/afxc04z5a.htm
                    .....         2294               html/afxc078l.htm
                    .....         1246               html/afxc0853.htm
                    .....         1191               html/afxc09wy.htm
                    .....         7159               html/afxc0ynh.htm
                    .....         3019               html/afxc0yta.htm
                    .....          710               html/afxc0ytb.htm
                    .....         1539               html/afxc0zmt.htm
                    .....         1854               html/afxc11b9.htm
                    .....          795               html/afxc181c.htm
                    .....         4945               html/afxc1d0l.htm
                    .....         1995               html/afxc1d0x.htm
                    .....          733               html/afxc2xio.htm
                    .....         2005               html/afxc36xx.htm
                    .....         2517               html/afxc3f78.htm
                    .....         1654               html/afxc3ky7.htm
                    .....          484               html/afxc3ol4.htm
                    .....         4338               html/afxc3wmk.htm
                    .....          782               html/afxc49x0.htm
                    .....         2690               html/afxc4a3o.htm
                    .....         2643               html/afxc57sj.htm
                    .....         1616               html/afxc5hkj.htm
                    .....         5450               html/afxc5htl.htm
                    .....         3864               html/afxc6fms.htm
                    .....         1792               html/afxc6ir8.htm
                    .....         1426               html/afxc6of9.htm
                    .....         1218               html/afxc6s2v.htm
                    .....          339               html/afxc7bqf.htm
                    .....         4817               html/afxc7gkk.htm
                    .....         1609               html/afxc7j77.htm
                    .....         2320               html/afxc7jdz.htm
                    .....         3609               html/afxc7u79.htm
                    .....         1536               html/afxc83mt.htm
                    .....         5984               html/afxc86r7.htm
                    .....         1138               html/afxc888e.htm
                    .....          858               html/afxc888f.htm
                    .....         2224               html/afxc888g.htm
                    .....         2079               html/afxc8d7p.htm
                    .....         1418               html/afxc8o50.htm
                    .....         1781               html/afxc8o51.htm
                    .....         1141               html/afxc90h4.htm
                    .....         3481               html/afxc90u1.htm
                    .....         3105               html/afxc92b7.htm
                    .....         1152               html/afxc9pwk.htm
                    .....         2416               html/afxc9y91.htm
                    .....         1073               html/afxcnas1.htm
                    .....         1206               html/afxcrb01.htm
                    .....         1308               html/afxcview.htm
                    .....         1098               html/filescav.css
                    .....         4630               html/optimal_boot.htm
                    .....         1822               html/optimal_corrupt.htm
                    .....          880               html/optimal_crash.htm
                    .....         4634               html/optimal_delete.htm
                    .....         1424               html/optimal_diskman.htm
                    .....         4218               html/optimal_format.htm
                    .....         3138               html/optimal_hang.htm
                    .....          448               html/optimal_nas.htm
                    .....         1254               html/optimal_network.htm
                    .....         1064               html/optimal_overwrite.htm
                    .....          449               html/optimal_raid.htm
                    .....         2837               html/optimal_rb.htm
                    .....         2321               html/optimal_recovery_disc.htm
                    .....          753               html/optimal_replace.htm
                    .....         2537               html/optimal_undetectable.htm
                    .....          954               html/schmfile.htm
                    .....         2216               html/trying_demo.htm
                    .....         1440               html/why_fs.htm
                    .....          283               html/Images/ParagraphHiddenArrowBlue.gif
                    .....          283               html/Images/ParagraphVisibleArrowBlue.gif
                    .....         8881               images/corrupt_drive_1.jpg
                    .....        10467               images/NeedFormat.jpg
                    .....          321               images/download.gif
                    .....        16041               images/corrupt_drive_2.jpg
                    .....        13295               images/optimal_delete.jpg
                    .....        12889               images/optimal_delete_data_drive.jpg
                    .....        12950               images/formatted_drive_1.jpg
                    .....        15498               images/disk_recoup.jpg
                    .....        14785               images/restored_to_factory_settings.jpg
                    .....        27166               images/preview.jpg
                    .....        19071               images/preview2.jpg
                    .....        17871               images/preview_corrupt.jpg
                    .....        18508               $WWKeywordLinks/BTree
                    .....         3653               $WWKeywordLinks/Data
                    .....           66               $WWKeywordLinks/Map
                    .....           32               $WWKeywordLinks/Property
                    .....            4               $WWAssociativeLinks/Property
                    .....         2751               $OBJINST
                    .....         4096               #IDXHDR
                    .....         1760               #TOPICS
                    .....         1320               #URLTBL
                    .....         3080               #URLSTR
                    .....         2277               #STRINGS
------------------- ----- ------------ ------------  ------------------------
                                480385      2214752  99 files, 5 folders
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK