video_2019-03-05_21-27-33.mp4.scr

info
MZ
PE
resources
strings
imports
foremost
version info
signature
hexdump
disasm
log
discuss
donate

filename	video_2019-03-05_21-27-33.mp4.scr
size	1397608 (0x155368)
md5	106fe988b136b0c401e8c42eba56fb0a

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x110

Rich Header

lib id	version	times used
225	20806	2
199	41118	1
223	21005	51
224	21005	177
225	21005	53
131	30729	9
147	30729	37
1	0	544
234	40629	80
223	40629	1
219	21005	1
151	0	1
222	40629	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x5d11c515
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x122
Magic	0x10b
LinkerVersion	12.0
SizeOfCode	0x8e000
SizeOfInitializedData	0xc5400
SizeOfUninitializedData	0
AddressOfEntryPoint	0x2800a
BaseOfCode	0x1000
BaseOfData	0x8f000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	0.0
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0x15a000
SizeOfHeaders	0x400
CheckSum	0x107070
Subsystem	2
DllCharacteristics	0x8040
SizeOfStackReserve	0x400000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x400000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x8dfdd	0x8e000	R-X CODE
.rdata	0x8f000	0x2fd8e	0x2fe00	R-- IDATA
.data	0xbf000	0x8f74	0x5200	RW- IDATA
.rsrc	0xc8000	0x890d0	0x89200	R-- IDATA
.reloc	0x152000	0x7134	0x7200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xbc0cc	0x17c
RESOURCE	0xc8000	0x890d0
EXCEPTION	0	0
SECURITY	0x153800	0x1b68
BASERELOC	0x152000	0x7134
DEBUG	0x92bc0	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0xa4b50	0x40
Bound_IAT	0	0
IAT	0x8f000	0x884
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
ICON	#1	296	1252
ICON	#2	296	1252
ICON	#3	296	1252
ICON	#4	34428	1252
ICON	#5	67624	1252
ICON	#6	16936	1252
ICON	#7	9640	1252
ICON	#8	4264	1252
ICON	#9	1128	1252
MENU	#166	80	1252
DIALOG	BVQYKQOJ	32975	1252
DIALOG	GXCSDSXZGQUD	32975	1252
DIALOG	HNRYSMM	32975	1252
DIALOG	LAEWBQEDICJP	32975	1252
DIALOG	LFTE	32975	1252
DIALOG	PTWRNVLFFKJSWYTZZB	32975	1252
DIALOG	PUAPNKBWX	32975	1252
DIALOG	RL	32969	1252
DIALOG	TKXJSMYZLQRHDMCLTHD	32975	1252
DIALOG	UAJOY	32975	1252
STRING	#7	1428	1252
STRING	#8	1674	1252
STRING	#9	1168	1252
STRING	#10	1532	1252
STRING	#11	1628	1252
STRING	#12	1126	1252
STRING	#313	344	1252
RCDATA	SCRIPT	84262	1252
GROUP_ICON	#99	90	1252
GROUP_ICON	#162	20	1252
GROUP_ICON	#164	20	1252
GROUP_ICON	#169	20	1252
VERSION	#1	220	1252
MANIFEST	#1	1007	1252

id	lang	string
101	2057	(Paused)
102	2057	AutoIt Error
103	2057	AutoIt has detected the stack has become corrupt. Stack corruption typically occurs when either the wrong calling convention is used or when the function is called with the wrong number of arguments. AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.
104	2057	"EndWith" missing "With".
105	2057	Badly formatted "Func" statement.
106	2057	"With" missing "EndWith".
107	2057	Missing right bracket ')' in expression.
108	2057	Missing operator in expression.
109	2057	Unbalanced brackets in expression.
110	2057	Error in expression.
111	2057	Error parsing function call.
112	2057	Incorrect number of parameters in function call.
113	2057	"ReDim" used without an array variable.
114	2057	Illegal text at the end of statement (one statement per line).
115	2057	"If" statement has no matching "EndIf" statement.
116	2057	"Else" statement with no matching "If" statement.
117	2057	"EndIf" statement with no matching "If" statement.
118	2057	Too many "Else" statements for matching "If" statement.
119	2057	"While" statement has no matching "Wend" statement.
120	2057	"Wend" statement with no matching "While" statement.
121	2057	Variable used without being declared.
122	2057	Array variable has incorrect number of subscripts or subscript dimension range exceeded.
123	2057	Variable subscript badly formatted.
124	2057	Subscript used on non-accessible variable.
125	2057	Too many subscripts used for an array.
126	2057	Missing subscript dimensions in "Dim" statement.
127	2057	No variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.
128	2057	Expected a "=" operator in assignment statement.
129	2057	Invalid keyword at the start of this line.
130	2057	Array maximum size exceeded.
131	2057	"Func" statement has no matching "EndFunc".
132	2057	Duplicate function name.
133	2057	Unknown function name.
134	2057	Unknown macro.
136	2057	Unable to get a list of running processes.
138	2057	Invalid element in a DllStruct.
139	2057	Unknown option or bad parameter specified.
140	2057	Unable to load the internet libraries.
141	2057	"Struct" statement has no matching "EndStruct".
142	2057	Unable to open file, the maximum number of open files has been exceeded.
143	2057	"ContinueLoop" statement with no matching "While", "Do" or "For" statement.
144	2057	Invalid file filter given.
145	2057	Expected a variable in user function call.
146	2057	"Do" statement has no matching "Until" statement.
147	2057	"Until" statement with no matching "Do" statement.
148	2057	"For" statement is badly formatted.
149	2057	"Next" statement with no matching "For" statement.
150	2057	"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.
151	2057	"For" statement has no matching "Next" statement.
152	2057	"Case" statement with no matching "Select"or "Switch" statement.
153	2057	"EndSelect" statement with no matching "Select" statement.
154	2057	Recursion level has been exceeded - AutoIt will quit to prevent stack overflow.
155	2057	Cannot make existing variables static.
156	2057	Cannot make static variables into regular variables.
157	2057	Badly formated Enum statement
159	2057	This keyword cannot be used after a "Then" keyword.
160	2057	"Select" statement is missing "EndSelect" or "Case" statement.
161	2057	"If" statements must have a "Then" keyword.
162	2057	Badly formated Struct statement.
163	2057	Cannot assign values to constants.
164	2057	Cannot make existing variables into constants.
165	2057	Only Object-type variables allowed in a "With" statement.
166	2057	"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long", "int" and "short*" instead.
167	2057	Object referenced outside a "With" statement.
168	2057	Nested "With" statements are not allowed.
169	2057	Variable must be of type "Object".
170	2057	The requested action with this object has failed.
171	2057	Variable appears more than once in function declaration.
172	2057	ReDim array can not be initialized in this manner.
173	2057	An array variable can not be used in this manner.
174	2057	Can not redeclare a constant.
175	2057	Can not redeclare a parameter inside a user function.
176	2057	Can pass constants by reference only to parameters with "Const" keyword.
177	2057	Can not initialize a variable with itself.
178	2057	Incorrect way to use this parameter.
179	2057	"EndSwitch" statement with no matching "Switch" statement.
180	2057	"Switch" statement is missing "EndSwitch" or "Case" statement.
181	2057	"ContinueCase" statement with no matching "Select"or "Switch" statement.
182	2057	Assert Failed!
184	2057	Obsolete function/parameter.
185	2057	Invalid Exitcode (reserved for AutoIt internal use).
186	2057	Variable cannot be accessed in this manner.
187	2057	Func reassign not allowed.
188	2057	Func reassign on global level not allowed.
5000	2057	Unable to parse line.
5001	2057	Unable to open the script file.
5002	2057	String missing closing quote.
5003	2057	Badly formated variable or macro.
5004	2057	Missing separator character after keyword.

module_name	hint	ord	function_name
WSOCK32.dll		116
WSOCK32.dll		23
WSOCK32.dll		12
WSOCK32.dll		21
WSOCK32.dll		15
WSOCK32.dll		17
WSOCK32.dll		10
WSOCK32.dll		9
WSOCK32.dll		115
WSOCK32.dll		151
WSOCK32.dll		18
WSOCK32.dll		1
WSOCK32.dll		13
WSOCK32.dll		2
WSOCK32.dll		3
WSOCK32.dll		111
WSOCK32.dll		16
WSOCK32.dll		20
WSOCK32.dll		19
WSOCK32.dll		11
WSOCK32.dll		52
WSOCK32.dll		57
WSOCK32.dll		4
VERSION.dll	6		GetFileVersionInfoW
VERSION.dll	5		GetFileVersionInfoSizeW
VERSION.dll	14		VerQueryValueW
WINMM.dll	148		timeGetTime
WINMM.dll	187		waveOutSetVolume
WINMM.dll	50		mciSendStringW
COMCTL32.dll	111		ImageList_ReplaceIcon
COMCTL32.dll	84		ImageList_Destroy
COMCTL32.dll	109		ImageList_Remove
COMCTL32.dll	114		ImageList_SetDragCursorImage
COMCTL32.dll	80		ImageList_BeginDrag
COMCTL32.dll	86		ImageList_DragEnter
COMCTL32.dll	87		ImageList_DragLeave
COMCTL32.dll	94		ImageList_EndDrag
COMCTL32.dll	88		ImageList_DragMove
COMCTL32.dll	123		InitCommonControlsEx
COMCTL32.dll	83		ImageList_Create
MPR.dll	73		WNetUseConnectionW
MPR.dll	12		WNetCancelConnection2W
MPR.dll	36		WNetGetConnectionW
MPR.dll	6		WNetAddConnection2W
WININET.dll	155		InternetQueryDataAvailable
WININET.dll	107		InternetCloseHandle
WININET.dll	154		InternetOpenW
WININET.dll	175		InternetSetOptionW
WININET.dll	116		InternetCrackUrlW
WININET.dll	90		HttpQueryInfoW
WININET.dll	158		InternetQueryOptionW
WININET.dll	88		HttpOpenRequestW
WININET.dll	94		HttpSendRequestW
WININET.dll	53		FtpOpenFileW
WININET.dll	50		FtpGetFileSize
WININET.dll	153		InternetOpenUrlW
WININET.dll	159		InternetReadFile
WININET.dll	114		InternetConnectW
PSAPI.DLL	21		GetProcessMemoryInfo
IPHLPAPI.DLL	133		IcmpCreateFile
IPHLPAPI.DLL	132		IcmpCloseHandle
IPHLPAPI.DLL	135		IcmpSendEcho
USERENV.dll	4		DestroyEnvironmentBlock
USERENV.dll	44		UnloadUserProfile
USERENV.dll			CreateEnvironmentBlock
USERENV.dll	33		LoadUserProfileW
UxTheme.dll	63		IsThemeActive
KERNEL32.dll	232		DuplicateHandle
KERNEL32.dll	181		CreateThread
KERNEL32.dll	1273		WaitForSingleObject
KERNEL32.dll	715		HeapAlloc
KERNEL32.dll	586		GetProcessHeap
KERNEL32.dll	719		HeapFree
KERNEL32.dll	1202		Sleep
KERNEL32.dll	453		GetCurrentThreadId
KERNEL32.dll	871		MultiByteToWideChar
KERNEL32.dll	870		MulDiv
KERNEL32.dll	676		GetVersionExW
KERNEL32.dll	782		IsWow64Process
KERNEL32.dll	627		GetSystemInfo
KERNEL32.dll	354		FreeLibrary
KERNEL32.dll	828		LoadLibraryA
KERNEL32.dll	581		GetProcAddress
KERNEL32.dll	1112		SetErrorMode
KERNEL32.dll	532		GetModuleFileNameW
KERNEL32.dll	1297		WideCharToMultiByte
KERNEL32.dll	1352		lstrcpyW
KERNEL32.dll	1358		lstrlenW
KERNEL32.dll	536		GetModuleHandleW
KERNEL32.dll	935		QueryPerformanceCounter
KERNEL32.dll	1261		VirtualFreeEx
KERNEL32.dll	896		OpenProcess
KERNEL32.dll	1258		VirtualAllocEx
KERNEL32.dll	1326		WriteProcessMemory
KERNEL32.dll	963		ReadProcessMemory
KERNEL32.dll	143		CreateFileW
KERNEL32.dll	1127		SetFilePointerEx
KERNEL32.dll	1107		SetEndOfFile
KERNEL32.dll	960		ReadFile
KERNEL32.dll	1317		WriteFile
KERNEL32.dll	343		FlushFileBuffers
KERNEL32.dll	1216		TerminateProcess
KERNEL32.dll	190		CreateToolhelp32Snapshot
KERNEL32.dll	918		Process32FirstW
KERNEL32.dll	920		Process32NextW
KERNEL32.dll	1130		SetFileTime
KERNEL32.dll	490		GetFileAttributesW
KERNEL32.dll	313		FindFirstFileW
KERNEL32.dll	1101		SetCurrentDirectoryW
KERNEL32.dll	527		GetLongPathNameW
KERNEL32.dll	609		GetShortPathNameW
KERNEL32.dll	214		DeleteFileW
KERNEL32.dll	325		FindNextFileW
KERNEL32.dll	114		CopyFileExW
KERNEL32.dll	867		MoveFileW
KERNEL32.dll	129		CreateDirectoryW
KERNEL32.dll	1027		RemoveDirectoryW
KERNEL32.dll	1162		SetSystemPowerState
KERNEL32.dll	936		QueryPerformanceFrequency
KERNEL32.dll	334		FindResourceW
KERNEL32.dll	833		LoadResource
KERNEL32.dll	852		LockResource
KERNEL32.dll	1201		SizeofResource
KERNEL32.dll	258		EnumResourceNamesW
KERNEL32.dll	906		OutputDebugStringW
KERNEL32.dll	645		GetTempPathW
KERNEL32.dll	643		GetTempFileNameW
KERNEL32.dll	221		DeviceIoControl
KERNEL32.dll	515		GetLocalTime
KERNEL32.dll	100		CompareStringW
KERNEL32.dll	448		GetCurrentProcess
KERNEL32.dll	238		EnterCriticalSection
KERNEL32.dll	825		LeaveCriticalSection
KERNEL32.dll	612		GetStdHandle
KERNEL32.dll	161		CreatePipe
KERNEL32.dll	748		InterlockedExchange
KERNEL32.dll	1217		TerminateThread
KERNEL32.dll	830		LoadLibraryExW
KERNEL32.dll	333		FindResourceExW
KERNEL32.dll	117		CopyFileW
KERNEL32.dll	1260		VirtualFree
KERNEL32.dll	350		FormatMessageW
KERNEL32.dll	479		GetExitCodeProcess
KERNEL32.dll	578		GetPrivateProfileStringW
KERNEL32.dll	1323		WritePrivateProfileStringW
KERNEL32.dll	576		GetPrivateProfileSectionW
KERNEL32.dll	1321		WritePrivateProfileSectionW
KERNEL32.dll	575		GetPrivateProfileSectionNamesW
KERNEL32.dll	292		FileTimeToLocalFileTime
KERNEL32.dll	293		FileTimeToSystemTime
KERNEL32.dll	1213		SystemTimeToFileTime
KERNEL32.dll	838		LocalFileTimeToFileTime
KERNEL32.dll	467		GetDriveTypeW
KERNEL32.dll	462		GetDiskFreeSpaceExW
KERNEL32.dll	463		GetDiskFreeSpaceW
KERNEL32.dll	679		GetVolumeInformationW
KERNEL32.dll	1193		SetVolumeLabelW
KERNEL32.dll	147		CreateHardLinkW
KERNEL32.dll	1121		SetFileAttributesW
KERNEL32.dll	133		CreateEventW
KERNEL32.dll	1113		SetEvent
KERNEL32.dll	476		GetEnvironmentVariableW
KERNEL32.dll	1111		SetEnvironmentVariableW
KERNEL32.dll	702		GlobalLock
KERNEL32.dll	709		GlobalUnlock
KERNEL32.dll	691		GlobalAlloc
KERNEL32.dll	496		GetFileSize
KERNEL32.dll	698		GlobalFree
KERNEL32.dll	704		GlobalMemoryStatusEx
KERNEL32.dll	54		Beep
KERNEL32.dll	624		GetSystemDirectoryW
KERNEL32.dll	722		HeapReAlloc
KERNEL32.dll	724		HeapSize
KERNEL32.dll	399		GetComputerNameW
KERNEL32.dll	687		GetWindowsDirectoryW
KERNEL32.dll	449		GetCurrentProcessId
KERNEL32.dll	590		GetProcessIoCounters
KERNEL32.dll	168		CreateProcessW
KERNEL32.dll	588		GetProcessId
KERNEL32.dll	1149		SetPriorityClass
KERNEL32.dll	831		LoadLibraryW
KERNEL32.dll	1257		VirtualAlloc
KERNEL32.dll	768		IsDebuggerPresent
KERNEL32.dll	447		GetCurrentDirectoryW
KERNEL32.dll	1349		lstrcmpiW
KERNEL32.dll	202		DecodePointer
KERNEL32.dll	514		GetLastError
KERNEL32.dll	945		RaiseException
KERNEL32.dll	739		InitializeCriticalSectionAndSpinCount
KERNEL32.dll	209		DeleteCriticalSection
KERNEL32.dll	747		InterlockedDecrement
KERNEL32.dll	751		InterlockedIncrement
KERNEL32.dll	452		GetCurrentThread
KERNEL32.dll	82		CloseHandle
KERNEL32.dll	507		GetFullPathNameW
KERNEL32.dll	234		EncodePointer
KERNEL32.dll	281		ExitProcess
KERNEL32.dll	535		GetModuleHandleExW
KERNEL32.dll	282		ExitThread
KERNEL32.dll	633		GetSystemTimeAsFileTime
KERNEL32.dll	1043		ResumeThread
KERNEL32.dll	391		GetCommandLineW
KERNEL32.dll	772		IsProcessorFeaturePresent
KERNEL32.dll	778		IsValidCodePage
KERNEL32.dll	360		GetACP
KERNEL32.dll	567		GetOEMCP
KERNEL32.dll	370		GetCPInfo
KERNEL32.dll	1139		SetLastError
KERNEL32.dll	1235		UnhandledExceptionFilter
KERNEL32.dll	1189		SetUnhandledExceptionFilter
KERNEL32.dll	1221		TlsAlloc
KERNEL32.dll	1223		TlsGetValue
KERNEL32.dll	1224		TlsSetValue
KERNEL32.dll	1222		TlsFree
KERNEL32.dll	611		GetStartupInfoW
KERNEL32.dll	617		GetStringTypeW
KERNEL32.dll	1159		SetStdHandle
KERNEL32.dll	499		GetFileType
KERNEL32.dll	410		GetConsoleCP
KERNEL32.dll	428		GetConsoleMode
KERNEL32.dll	1048		RtlUnwind
KERNEL32.dll	958		ReadConsoleW
KERNEL32.dll	664		GetTimeZoneInformation
KERNEL32.dll	456		GetDateFormatW
KERNEL32.dll	663		GetTimeFormatW
KERNEL32.dll	813		LCMapStringW
KERNEL32.dll	474		GetEnvironmentStringsW
KERNEL32.dll	353		FreeEnvironmentStringsW
KERNEL32.dll	1316		WriteConsoleW
KERNEL32.dll	302		FindClose
KERNEL32.dll	1110		SetEnvironmentVariableA
USER32.dll	3		AdjustWindowRectEx
USER32.dll	84		CopyImage
USER32.dll	710		SetWindowPos
USER32.dll	287		GetCursorInfo
USER32.dll	598		RegisterHotKey
USER32.dll	71		ClientToScreen
USER32.dll	321		GetKeyboardLayoutNameW
USER32.dll	452		IsCharAlphaW
USER32.dll	451		IsCharAlphaNumericW
USER32.dll	454		IsCharLowerW
USER32.dll	456		IsCharUpperW
USER32.dll	344		GetMenuStringW
USER32.dll	378		GetSubMenu
USER32.dll	266		GetCaretPos
USER32.dll	482		IsZoomed
USER32.dll	536		MonitorFromPoint
USER32.dll	351		GetMonitorInfoW
USER32.dll	708		SetWindowLongW
USER32.dll	664		SetLayeredWindowAttributes
USER32.dll	251		FlashWindow
USER32.dll	272		GetClassLongW
USER32.dll	762		TranslateAcceleratorW
USER32.dll	461		IsDialogMessageW
USER32.dll	379		GetSysColor
USER32.dll	437		InflateRect
USER32.dll	196		DrawFocusRect
USER32.dll	208		DrawTextW
USER32.dll	253		FrameRect
USER32.dll	198		DrawFrameControl
USER32.dll	246		FillRect
USER32.dll	576		PtInRect
USER32.dll	160		DestroyAcceleratorTable
USER32.dll	88		CreateAcceleratorTableW
USER32.dll	648		SetCursor
USER32.dll	402		GetWindowDC
USER32.dll	382		GetSystemMetrics
USER32.dll	256		GetActiveWindow
USER32.dll	49		CharNextW
USER32.dll	819		wsprintfW
USER32.dll	586		RedrawWindow
USER32.dll	201		DrawMenuBar
USER32.dll	164		DestroyMenu
USER32.dll	668		SetMenu
USER32.dll	418		GetWindowTextLengthW
USER32.dll	106		CreateMenu
USER32.dll	462		IsDlgButtonChecked
USER32.dll	149		DefDlgProcW
USER32.dll	30		CallWindowProcW
USER32.dll	612		ReleaseCapture
USER32.dll	640		SetCapture
USER32.dll	102		CreateIconFromResourceEx
USER32.dll	817		mouse_event
USER32.dll	245		ExitWindowsEx
USER32.dll	639		SetActiveWindow
USER32.dll	249		FindWindowExW
USER32.dll	239		EnumThreadWindows
USER32.dll	670		SetMenuDefaultItem
USER32.dll	441		InsertMenuItemW
USER32.dll	466		IsMenu
USER32.dll	759		TrackPopupMenuEx
USER32.dll	288		GetCursorPos
USER32.dll	158		DeleteMenu
USER32.dll	686		SetRect
USER32.dll	338		GetMenuItemID
USER32.dll	337		GetMenuItemCount
USER32.dll	674		SetMenuItemInfoW
USER32.dll	340		GetMenuItemInfoW
USER32.dll	659		SetForegroundWindow
USER32.dll	465		IsIconic
USER32.dll	250		FindWindowW
USER32.dll	537		MonitorFromRect
USER32.dll	816		keybd_event
USER32.dll	630		SendInput
USER32.dll	263		GetAsyncKeyState
USER32.dll	662		SetKeyboardState
USER32.dll	322		GetKeyboardState
USER32.dll	317		GetKeyState
USER32.dll	801		VkKeyScanW
USER32.dll	506		LoadStringW
USER32.dll	172		DialogBoxParamW
USER32.dll	525		MessageBeep
USER32.dll	218		EndDialog
USER32.dll	627		SendDlgItemMessageW
USER32.dll	295		GetDlgItem
USER32.dll	715		SetWindowTextW
USER32.dll	85		CopyRect
USER32.dll	613		ReleaseDC
USER32.dll	289		GetDC
USER32.dll	220		EndPaint
USER32.dll	14		BeginPaint
USER32.dll	276		GetClientRect
USER32.dll	331		GetMenu
USER32.dll	166		DestroyWindow
USER32.dll	242		EnumWindows
USER32.dll	291		GetDesktopWindow
USER32.dll	475		IsWindow
USER32.dll	476		IsWindowEnabled
USER32.dll	480		IsWindowVisible
USER32.dll	216		EnableWindow
USER32.dll	446		InvalidateRect
USER32.dll	406		GetWindowLongW
USER32.dll	420		GetWindowThreadProcessId
USER32.dll	12		AttachThreadInput
USER32.dll	300		GetFocus
USER32.dll	419		GetWindowTextW
USER32.dll	621		ScreenToClient
USER32.dll	635		SendMessageTimeoutW
USER32.dll	223		EnumChildWindows
USER32.dll	59		CharUpperBuffW
USER32.dll	356		GetParent
USER32.dll	294		GetDlgCtrlID
USER32.dll	636		SendMessageW
USER32.dll	520		MapVirtualKeyW
USER32.dll	566		PostMessageW
USER32.dll	412		GetWindowRect
USER32.dll	702		SetUserObjectSecurity
USER32.dll	74		CloseDesktop
USER32.dll	78		CloseWindowStation
USER32.dll	552		OpenDesktopW
USER32.dll	682		SetProcessWindowStation
USER32.dll	360		GetProcessWindowStation
USER32.dll	557		OpenWindowStationW
USER32.dll	396		GetUserObjectSecurity
USER32.dll	533		MessageBoxW
USER32.dll	156		DefWindowProcW
USER32.dll	646		SetClipboardData
USER32.dll	213		EmptyClipboard
USER32.dll	86		CountClipboardFormats
USER32.dll	73		CloseClipboard
USER32.dll	278		GetClipboardData
USER32.dll	458		IsClipboardFormatAvailable
USER32.dll	550		OpenClipboard
USER32.dll	15		BlockInput
USER32.dll	349		GetMessageW
USER32.dll	509		LockWindowUpdate
USER32.dll	175		DispatchMessageW
USER32.dll	764		TranslateMessage
USER32.dll	563		PeekMessageW
USER32.dll	776		UnregisterHotKey
USER32.dll	64		CheckMenuRadioItem
USER32.dll	45		CharLowerBuffW
USER32.dll	539		MoveWindow
USER32.dll	658		SetFocus
USER32.dll	567		PostQuitMessage
USER32.dll	483		KillTimer
USER32.dll	107		CreatePopupMenu
USER32.dll	611		RegisterWindowMessageW
USER32.dll	699		SetTimer
USER32.dll	735		ShowWindow
USER32.dll	110		CreateWindowExW
USER32.dll	589		RegisterClassExW
USER32.dll	493		LoadIconW
USER32.dll	491		LoadCursorW
USER32.dll	380		GetSysColorBrush
USER32.dll	301		GetForegroundWindow
USER32.dll	526		MessageBoxA
USER32.dll	163		DestroyIcon
USER32.dll	748		SystemParametersInfoW
USER32.dll	495		LoadImageW
USER32.dll	274		GetClassNameW
GDI32.dll	694		StrokePath
GDI32.dll	230		DeleteObject
GDI32.dll	542		GetTextExtentPoint32W
GDI32.dll	306		ExtCreatePen
GDI32.dll	459		GetDeviceCaps
GDI32.dll	243		EndPath
GDI32.dll	667		SetPixel
GDI32.dll	30		CloseFigure
GDI32.dll	47		CreateCompatibleBitmap
GDI32.dll	48		CreateCompatibleDC
GDI32.dll	631		SelectObject
GDI32.dll	691		StretchBlt
GDI32.dll	458		GetDIBits
GDI32.dll	566		LineTo
GDI32.dll	8		AngleArc
GDI32.dll	570		MoveToEx
GDI32.dll	237		Ellipse
GDI32.dll	227		DeleteDC
GDI32.dll	516		GetPixel
GDI32.dll	50		CreateDCW
GDI32.dll	525		GetStockObject
GDI32.dll	548		GetTextFaceW
GDI32.dll	65		CreateFontW
GDI32.dll	678		SetTextColor
GDI32.dll	592		PolyDraw
GDI32.dll	18		BeginPath
GDI32.dll	607		Rectangle
GDI32.dll	681		SetViewportOrgEx
GDI32.dll	509		GetObjectW
GDI32.dll	639		SetBkMode
GDI32.dll	618		RoundRect
GDI32.dll	638		SetBkColor
GDI32.dll	75		CreatePen
GDI32.dll	84		CreateSolidBrush
GDI32.dll	693		StrokeAndFillPath
COMDLG32.dll	12		GetOpenFileNameW
COMDLG32.dll	14		GetSaveFileNameW
ADVAPI32.dll	291		GetAce
ADVAPI32.dll	594		RegEnumValueW
ADVAPI32.dll	584		RegDeleteValueW
ADVAPI32.dll	580		RegDeleteKeyW
ADVAPI32.dll	591		RegEnumKeyExW
ADVAPI32.dll	638		RegSetValueExW
ADVAPI32.dll	609		RegOpenKeyExW
ADVAPI32.dll	560		RegCloseKey
ADVAPI32.dll	622		RegQueryValueExW
ADVAPI32.dll	564		RegConnectRegistryW
ADVAPI32.dll	375		InitializeSecurityDescriptor
ADVAPI32.dll	374		InitializeAcl
ADVAPI32.dll	31		AdjustTokenPrivileges
ADVAPI32.dll	508		OpenThreadToken
ADVAPI32.dll	503		OpenProcessToken
ADVAPI32.dll	407		LookupPrivilegeValueW
ADVAPI32.dll	223		DuplicateTokenEx
ADVAPI32.dll	124		CreateProcessAsUserW
ADVAPI32.dll	125		CreateProcessWithLogonW
ADVAPI32.dll	310		GetLengthSid
ADVAPI32.dll	118		CopySid
ADVAPI32.dll	397		LogonUserW
ADVAPI32.dll	32		AllocateAndInitializeSid
ADVAPI32.dll	81		CheckTokenMembership
ADVAPI32.dll	569		RegCreateKeyExW
ADVAPI32.dll	288		FreeSid
ADVAPI32.dll	346		GetTokenInformation
ADVAPI32.dll	328		GetSecurityDescriptorDacl
ADVAPI32.dll	292		GetAclInformation
ADVAPI32.dll	22		AddAce
ADVAPI32.dll	694		SetSecurityDescriptorDacl
ADVAPI32.dll	357		GetUserNameW
ADVAPI32.dll	381		InitiateSystemShutdownExW
SHELL32.dll	32		DragQueryPoint
SHELL32.dll	289		ShellExecuteExW
SHELL32.dll	31		DragQueryFileW
SHELL32.dll	165		SHEmptyRecycleBinW
SHELL32.dll	215		SHGetPathFromIDListW
SHELL32.dll	123		SHBrowseForFolderW
SHELL32.dll	154		SHCreateShellItem
SHELL32.dll	182		SHGetDesktopFolder
SHELL32.dll	223		SHGetSpecialFolderLocation
SHELL32.dll	195		SHGetFolderPathW
SHELL32.dll	172		SHFileOperationW
SHELL32.dll	42		ExtractIconExW
SHELL32.dll	302		Shell_NotifyIconW
SHELL32.dll	290		ShellExecuteW
SHELL32.dll	27		DragFinish
ole32.dll	103		CoTaskMemAlloc
ole32.dll	104		CoTaskMemFree
ole32.dll	8		CLSIDFromString
ole32.dll	331		ProgIDFromCLSID
ole32.dll	6		CLSIDFromProgID
ole32.dll	327		OleSetMenuDescriptor
ole32.dll	212		MkParseDisplayName
ole32.dll	326		OleSetContainedObject
ole32.dll	16		CoCreateInstance
ole32.dll	205		IIDFromString
ole32.dll	377		StringFromGUID2
ole32.dll	134		CreateStreamOnHGlobal
ole32.dll	306		OleInitialize
ole32.dll	329		OleUninitialize
ole32.dll	62		CoInitialize
ole32.dll	108		CoUninitialize
ole32.dll	151		GetRunningObjectTable
ole32.dll	45		CoGetInstanceFromFile
ole32.dll	53		CoGetObject
ole32.dll	99		CoSetProxyBlanket
ole32.dll	17		CoCreateInstanceEx
ole32.dll	64		CoInitializeSecurity
OLEAUT32.dll		183
OLEAUT32.dll		11
OLEAUT32.dll		3
OLEAUT32.dll		6
OLEAUT32.dll		38
OLEAUT32.dll		39
OLEAUT32.dll		24
OLEAUT32.dll		23
OLEAUT32.dll		37
OLEAUT32.dll		41
OLEAUT32.dll		411
OLEAUT32.dll		163
OLEAUT32.dll		32
OLEAUT32.dll		146
OLEAUT32.dll		12
OLEAUT32.dll		7
OLEAUT32.dll		185
OLEAUT32.dll		220
OLEAUT32.dll		77
OLEAUT32.dll		10
OLEAUT32.dll		9
OLEAUT32.dll		418
OLEAUT32.dll		164
OLEAUT32.dll		442
OLEAUT32.dll		443
OLEAUT32.dll		186
OLEAUT32.dll		31
OLEAUT32.dll		2
OLEAUT32.dll		8

StringTable 080904B0

VS_FIXEDFILEINFO

FileVersion	0.0.0.0
ProductVersion	0.0.0.0
StrucVersion	0x10000
FileFlagsMask	0
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=US/O=Thawte, Inc./CN=Thawte Code Signing CA - G2

serial: 360784576150DB306125D534108D8256

Certificates (5)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
        Validity
            Not Before: Dec 21 00:00:00 2012 GMT
            Not After : Dec 30 23:59:59 2020 GMT
        Subject: C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:b1:ac:b3:49:54:4b:97:1c:12:0a:d8:25:79:91:
                    22:57:2a:6f:dc:b8:26:c4:43:73:6b:c2:bf:2e:50:
                    5a:fb:14:c2:76:8e:43:01:25:43:b4:a1:e2:45:f4:
                    e8:b7:7b:c3:74:cc:22:d7:b4:94:00:02:f7:4d:ed:
                    bf:b4:b7:44:24:6b:cd:5f:45:3b:d1:44:ce:43:12:
                    73:17:82:8b:69:b4:2b:cb:99:1e:ac:72:1b:26:4d:
                    71:1f:b1:31:dd:fb:51:61:02:53:a6:aa:f5:49:2c:
                    05:78:45:a5:2f:89:ce:e7:99:e7:fe:8c:e2:57:3f:
                    3d:c6:92:dc:4a:f8:7b:33:e4:79:0a:fb:f0:75:88:
                    41:9c:ff:c5:03:51:99:aa:d7:6c:9f:93:69:87:65:
                    29:83:85:c2:60:14:c4:c8:c9:3b:14:da:c0:81:f0:
                    1f:0d:74:de:92:22:ab:ca:f7:fb:74:7c:27:e6:f7:
                    4a:1b:7f:a7:c3:9e:2d:ae:8a:ea:a6:e6:aa:27:16:
                    7d:61:f7:98:71:11:bc:e2:50:a1:4b:e5:5d:fa:e5:
                    0e:a7:2c:9f:aa:65:20:d3:d8:96:e8:c8:7c:a5:4e:
                    48:44:ff:19:e2:44:07:92:0b:d7:68:84:80:5d:6a:
                    78:64:45:cd:60:46:7e:54:c1:13:7c:c5:79:f1:c9:
                    c1:71
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                5F:9A:F5:6E:5C:CC:CC:74:9A:D4:DD:7D:EF:3F:DB:EC:4C:80:2E:DD
            Authority Information Access: 
                OCSP - URI:http://ocsp.thawte.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.thawte.com/ThawteTimestampingCA.crl
            X509v3 Extended Key Usage: 
                Time Stamping
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name: 
                DirName:/CN=TimeStamp-2048-1
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        03:09:9b:8f:79:ef:7f:59:30:aa:ef:68:b5:fa:e3:09:1d:bb:
        4f:82:06:5d:37:5f:a6:52:9f:16:8d:ea:1c:92:09:44:6e:f5:
        6d:eb:58:7c:30:e8:f9:69:8d:23:73:0b:12:6f:47:a9:ae:39:
        11:f8:2a:b1:9b:b0:1a:c3:8e:eb:59:96:00:ad:ce:0c:4d:b2:
        d0:31:a6:08:5c:2a:7a:fc:e2:7a:1d:57:4c:a8:65:18:e9:79:
        40:62:25:96:6e:c7:c7:37:6a:83:21:08:8e:41:ea:dd:d9:57:
        3f:1d:77:49:87:2a:16:06:5e:a6:38:6a:22:12:a3:51:19:83:
        7e:b6

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
        Validity
            Not Before: Nov 17 00:00:00 2006 GMT
            Not After : Dec 30 23:59:59 2020 GMT
        Subject: C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:ac:a0:f0:fb:80:59:d4:9c:c7:a4:cf:9d:a1:59:
                    73:09:10:45:0c:0d:2c:6e:68:f1:6c:5b:48:68:49:
                    59:37:fc:0b:33:19:c2:77:7f:cc:10:2d:95:34:1c:
                    e6:eb:4d:09:a7:1c:d2:b8:c9:97:36:02:b7:89:d4:
                    24:5f:06:c0:cc:44:94:94:8d:02:62:6f:eb:5a:dd:
                    11:8d:28:9a:5c:84:90:10:7a:0d:bd:74:66:2f:6a:
                    38:a0:e2:d5:54:44:eb:1d:07:9f:07:ba:6f:ee:e9:
                    fd:4e:0b:29:f5:3e:84:a0:01:f1:9c:ab:f8:1c:7e:
                    89:a4:e8:a1:d8:71:65:0d:a3:51:7b:ee:bc:d2:22:
                    60:0d:b9:5b:9d:df:ba:fc:51:5b:0b:af:98:b2:e9:
                    2e:e9:04:e8:62:87:de:2b:c8:d7:4e:c1:4c:64:1e:
                    dd:cf:87:58:ba:4a:4f:ca:68:07:1d:1c:9d:4a:c6:
                    d5:2f:91:cc:7c:71:72:1c:c5:c0:67:eb:32:fd:c9:
                    92:5c:94:da:85:c0:9b:bf:53:7d:2b:09:f4:8c:9d:
                    91:1f:97:6a:52:cb:de:09:36:a4:77:d8:7b:87:50:
                    44:d5:3e:6e:29:69:fb:39:49:26:1e:09:a5:80:7b:
                    40:2d:eb:e8:27:85:c9:fe:61:fd:7e:e6:7c:97:1d:
                    d5:9d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies: 
                Policy: X509v3 Any Policy
                  CPS: https://www.thawte.com/cps
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier: 
                7B:5B:45:CF:AF:CE:CB:7A:FD:31:92:1A:6A:B6:F3:46:EB:57:48:50
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.thawte.com/ThawtePremiumServerCA.crl
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        84:a8:4c:c9:3e:2a:bc:9a:e2:cc:8f:0b:b2:25:77:c4:61:89:
        89:63:5a:d4:a3:15:40:d4:fb:5e:3f:b4:43:ea:63:17:2b:6b:
        99:74:9e:09:a8:dd:d4:56:15:2e:7a:79:31:5f:63:96:53:1b:
        34:d9:15:ea:4f:6d:70:ca:be:f6:82:a9:ed:da:85:77:cc:76:
        1c:6a:81:0a:21:d8:41:99:7f:5e:2e:82:c1:e8:aa:f7:93:81:
        05:aa:92:b4:1f:b7:9a:c0:07:17:f5:cb:c6:b4:4c:0e:d7:56:
        dc:71:20:74:38:d6:74:c6:d6:8f:6b:af:8b:8d:a0:6c:29:0b:
        61:e0

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA
        Validity
            Not Before: Feb  8 00:00:00 2010 GMT
            Not After : Feb  7 23:59:59 2020 GMT
        Subject: C=US, O=Thawte, Inc., CN=Thawte Code Signing CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:b7:8b:cf:75:5b:9f:25:da:7e:39:b0:93:db:38:
                    d3:a9:23:d0:82:fa:e9:24:7e:5c:0b:8e:83:f8:e6:
                    7a:59:e6:a3:c5:98:a7:99:d2:44:ff:00:a6:a5:39:
                    04:8a:da:29:88:ea:db:a2:f3:1c:99:15:26:c2:b1:
                    f4:fc:e1:0c:47:a9:09:11:06:0a:20:92:b9:c7:a0:
                    04:8c:5c:94:19:ab:5b:25:2c:1d:62:7e:70:0d:ce:
                    61:6c:dd:2b:82:c9:ce:5d:48:5f:f7:c2:be:bc:41:
                    23:1e:4f:29:5d:d7:4f:bc:f4:c5:2a:fc:63:e6:7c:
                    26:4e:99:a7:79:41:9e:10:4a:7a:79:c9:c6:86:f7:
                    86:95:d2:26:ce:3c:18:2a:d6:7c:ce:af:cd:ad:bb:
                    f7:82:2c:70:26:37:45:e5:0f:47:22:c6:01:28:bd:
                    2e:83:5c:6a:a4:47:c1:e7:d0:d8:6b:81:46:3f:21:
                    17:f5:07:c5:43:5a:a6:67:2c:b8:7b:60:11:b5:83:
                    ee:f5:74:0a:72:71:44:3d:58:fe:e8:1a:ab:38:c3:
                    59:db:7f:6e:38:7d:76:c7:72:69:98:36:96:57:d3:
                    66:1c:d2:54:91:04:2e:54:19:b0:dc:3d:b5:22:5e:
                    86:d5:2a:7e:20:df:5d:e6:7a:b1:65:fe:c5:02:4e:
                    31:2d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.thawte.com/ThawtePCA.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            Authority Information Access: 
                OCSP - URI:http://ocsp.thawte.com
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, Code Signing
            X509v3 Subject Alternative Name: 
                DirName:/CN=VeriSignMPKI-2-10
            X509v3 Subject Key Identifier: 
                D4:0D:65:3F:7A:BD:34:C6:FE:47:E7:4C:0D:C0:BD:F2:DE:15:AB:71
            X509v3 Authority Key Identifier: 
                7B:5B:45:CF:AF:CE:CB:7A:FD:31:92:1A:6A:B6:F3:46:EB:57:48:50
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        56:fe:53:5c:e1:c7:9e:bc:a7:ed:7e:53:6d:6a:14:4b:51:8c:
        40:5e:80:5f:aa:a4:e8:2f:ef:38:c8:04:c9:ca:3e:cf:df:3a:
        58:4e:b0:d4:b6:63:c5:29:57:fa:02:05:9a:45:4d:68:db:2a:
        1b:d4:34:3d:9f:00:c3:5a:cb:95:49:a5:6e:e1:b0:c5:fc:41:
        4d:41:4a:6f:d3:77:c8:d7:38:8d:e4:19:de:18:f3:1f:15:65:
        83:6d:45:0c:53:f9:0a:9a:2e:a5:5d:bf:6f:32:81:18:92:19:
        6a:55:00:ad:63:1c:52:06:7e:55:d9:29:68:ae:4a:7c:18:9a:
        79:88:6b:23:23:d8:27:38:2a:29:87:76:ca:fb:c7:b6:62:23:
        1f:ed:7a:56:4c:dd:9c:32:5b:f5:3d:0c:46:18:95:3b:2a:23:
        68:83:64:41:d9:00:6d:0f:19:24:15:68:72:bd:c5:71:67:6e:
        ac:4c:db:90:eb:51:a5:1a:62:07:d0:be:6a:00:47:3c:72:2f:
        ec:4f:61:3e:73:85:ce:5a:0a:b7:ba:c0:1c:13:75:e3:22:39:
        28:dd:6d:1d:09:46:9d:4f:ba:e8:40:81:91:c6:a4:ce:94:72:
        1b:01:cf:2a:6e:15:67:95:89:ae:7d:b7:b7:cd:f9:0a:3d:75:
        b6:6b:3c:25

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA - G2
        Validity
            Not Before: Oct 18 00:00:00 2012 GMT
            Not After : Dec 29 23:59:59 2020 GMT
        Subject: C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer - G4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:a2:63:0b:39:44:b8:bb:23:a7:44:49:bb:0e:ff:
                    a1:f0:61:0a:53:93:b0:98:db:ad:2c:0f:4a:c5:6e:
                    ff:86:3c:53:55:0f:15:ce:04:3f:2b:fd:a9:96:96:
                    d9:be:61:79:0b:5b:c9:4c:86:76:e5:e0:43:4b:22:
                    95:ee:c2:2b:43:c1:9f:d8:68:b4:8e:40:4f:ee:85:
                    38:b9:11:c5:23:f2:64:58:f0:15:32:6f:4e:57:a1:
                    ae:88:a4:02:d7:2a:1e:cd:4b:e1:dd:63:d5:17:89:
                    32:5b:b0:5e:99:5a:a8:9d:28:50:0e:17:ee:96:db:
                    61:3b:45:51:1d:cf:12:56:0b:92:47:fc:ab:ae:f6:
                    66:3d:47:ac:70:72:e7:92:e7:5f:cd:10:b9:c4:83:
                    64:94:19:bd:25:80:e1:e8:d2:22:a5:d0:ba:02:7a:
                    a1:77:93:5b:65:c3:ee:17:74:bc:41:86:2a:dc:08:
                    4c:8c:92:8c:91:2d:9e:77:44:1f:68:d6:a8:74:77:
                    db:0e:5b:32:8b:56:8b:33:bd:d9:63:c8:49:9d:3a:
                    c5:c5:ea:33:0b:d2:f1:a3:1b:f4:8b:be:d9:b3:57:
                    8b:3b:de:04:a7:7a:22:b2:24:ae:2e:c7:70:c5:be:
                    4e:83:26:08:fb:0b:bd:a9:4f:99:08:e1:10:28:72:
                    aa:cd
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Extended Key Usage: critical
                Time Stamping
            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access: 
                OCSP - URI:http://ts-ocsp.ws.symantec.com
                CA Issuers - URI:http://ts-aia.ws.symantec.com/tss-ca-g2.cer
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://ts-crl.ws.symantec.com/tss-ca-g2.crl
            X509v3 Subject Alternative Name: 
                DirName:/CN=TimeStamp-2048-2
            X509v3 Subject Key Identifier: 
                46:C6:69:A3:0E:4A:14:1E:D5:4C:DA:52:63:17:3F:5E:36:BC:0D:E6
            X509v3 Authority Key Identifier: 
                5F:9A:F5:6E:5C:CC:CC:74:9A:D4:DD:7D:EF:3F:DB:EC:4C:80:2E:DD
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        78:3b:b4:91:2a:00:4c:f0:8f:62:30:37:78:a3:84:27:07:6f:
        18:b2:de:25:dc:a0:d4:94:03:aa:86:4e:25:9f:9a:40:03:1c:
        dd:ce:e3:79:cb:21:68:06:da:b6:32:b4:6d:bf:f4:2c:26:63:
        33:e4:49:64:6d:0d:e6:c3:67:0e:f7:05:a4:35:6c:7c:89:16:
        c6:e9:b2:df:b2:e9:dd:20:c6:71:0f:cd:95:74:dc:b6:5c:de:
        bd:37:1f:43:78:e6:78:b5:cd:28:04:20:a3:aa:f1:4b:c4:88:
        29:91:0e:80:d1:11:fc:dd:5c:76:6e:4f:5e:0e:45:46:41:6e:
        0d:b0:ea:38:9a:b1:3a:da:09:71:10:fc:1c:79:b4:80:7b:ac:
        69:f4:fd:9c:b6:0c:16:2b:f1:7f:5b:09:3d:9b:5b:e2:16:ca:
        13:81:6d:00:2e:38:0d:a8:29:8f:2c:e1:b2:f4:5a:a9:01:af:
        15:9c:2c:2f:49:1b:db:22:bb:c3:fe:78:94:51:c3:86:b1:82:
        88:5d:f0:3d:b4:51:a1:79:33:2b:2e:7b:b9:dc:20:09:13:71:
        eb:6a:19:5b:cf:e8:a5:30:57:2c:89:49:3f:b9:cf:7f:c9:bf:
        3e:22:68:63:53:9a:bd:69:74:ac:c5:1d:3c:7f:92:e0:c3:bc:
        1c:d8:04:75

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            36:07:84:57:61:50:db:30:61:25:d5:34:10:8d:82:56
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=Thawte, Inc., CN=Thawte Code Signing CA - G2
        Validity
            Not Before: Jul 14 00:00:00 2014 GMT
            Not After : Jul 13 23:59:59 2016 GMT
        Subject: C=CN, ST=Shaanxi, L=Xi'an, O=No Organization Affiliation, OU=Individual Developer, CN=Di Wu
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:d8:a8:d3:1a:7d:f5:e7:bc:10:2a:78:2b:e6:f2:
                    c1:a1:3e:46:5a:30:e5:c1:bb:e2:f5:d6:64:21:b9:
                    2c:4f:e1:15:cd:12:91:ca:2d:f3:71:90:b6:2d:9e:
                    03:aa:a5:0c:32:36:8c:fe:26:3b:9d:7f:3a:bc:1c:
                    43:f6:5e:a2:73:b1:f3:96:60:2f:aa:01:61:e2:4f:
                    c2:78:a4:62:ea:ce:5f:c6:10:ba:4e:c1:ae:55:32:
                    4c:ad:63:01:2c:ba:08:28:1c:a0:0d:8d:e8:07:2e:
                    1e:c8:ff:2e:3c:46:24:73:c9:14:a0:b7:c3:24:9b:
                    e7:d8:d5:a8:c8:df:cd:12:c8:2e:1a:65:97:5d:8a:
                    3f:97:18:c6:e6:8e:7f:21:dc:c1:a2:1f:7f:ff:80:
                    37:2b:59:c0:81:19:db:84:7b:04:73:35:c5:cc:fd:
                    9a:55:74:b2:2b:87:e9:bf:55:d3:0b:ae:19:3d:56:
                    13:53:81:ba:35:f5:95:e0:b4:d2:57:cd:e0:d0:6d:
                    5d:fb:37:f1:75:d2:ec:52:3b:1b:03:37:82:91:45:
                    4b:dd:48:8b:4e:e4:73:54:96:b3:50:40:18:01:b4:
                    c6:f6:14:1f:3e:b1:f4:be:3b:e8:c8:a6:ac:99:1b:
                    d9:80:9c:89:7e:c7:22:30:92:0c:44:b5:4e:e5:60:
                    9b:f3
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Authority Key Identifier: 
                D4:0D:65:3F:7A:BD:34:C6:FE:47:E7:4C:0D:C0:BD:F2:DE:15:AB:71
            X509v3 Subject Key Identifier: 
                C6:F5:5D:4F:43:13:B9:28:72:99:C7:A7:23:35:BD:9C:87:8D:E0:86
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://th.symcb.com/th.crl
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Extended Key Usage: 
                Code Signing, Microsoft Commercial Code Signing
            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.48.2
                  CPS: https://d.symcb.com/cps
                  User Notice:
                    Explicit Text: https://d.symcb.com/rpa
            2.5.29.4: 
                0.0.0..
+.....7.......
            Authority Information Access: 
                OCSP - URI:http://th.symcd.com
                CA Issuers - URI:http://th.symcb.com/th.crt
            Netscape Cert Type: 
                Object Signing
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        6d:87:56:4a:b4:98:d8:df:ef:35:9c:0a:a1:f3:a1:0d:bd:eb:
        56:d2:9f:cd:35:c1:d4:87:7e:d9:47:d5:59:fd:6b:ce:35:52:
        5c:81:4d:b6:88:d5:c4:54:d0:26:c0:5d:3f:4b:f0:87:bf:48:
        26:2b:7e:38:2a:e9:54:0a:d8:5d:9b:03:81:fc:f2:79:cf:56:
        a6:1b:1c:5a:5d:9a:f4:64:88:00:09:11:07:dc:2f:11:71:fa:
        da:77:58:f3:a0:e1:d2:01:39:c1:d1:9a:09:11:15:65:fe:e3:
        46:0c:e4:67:33:d4:13:12:4a:fa:b5:ca:c4:0e:96:ab:a0:33:
        68:ed:63:0a:b0:6c:99:99:17:ab:99:8c:6e:96:80:a0:3c:55:
        22:ae:59:cc:89:78:3a:03:5b:21:99:f7:5b:a2:29:6f:fb:60:
        5d:3d:ca:8a:93:75:59:cb:9b:30:71:af:60:85:d1:6f:97:5e:
        2f:93:28:41:99:72:50:99:0f:cf:f7:d0:23:f4:b2:cd:40:51:
        55:a2:6b:38:20:70:62:ef:dd:0a:4f:a0:85:c1:73:42:b6:f5:
        f9:33:af:62:81:ff:5b:26:7d:e0:7a:e2:47:2a:03:b9:6c:88:
        41:dd:06:29:9e:f6:94:c9:1d:93:86:19:d7:64:e9:f0:60:f2:
        25:bf:25:9b

pkcs7-signedData

SHA1: nil

1.3.6.1.4.1.311.2.1.4

1.3.6.1.4.1.311.2.1.15

00 3c 00 3c 00 3c 00 4f  00 62 00 73 00 6f 00 6c  |.<.<.<.O.b.s.o.l|
00 65 00 74 00 65 00 3e  00 3e 00 3e              |.e.t.e.>.>.>    |

SHA1

a8 3d 0c c8 30 00 d3 ec d8 0f d3 8a 9e e6 11 63 |.=..0..........c| c2 f9 f6 2a |...* |

Certificates
- Certificate #0
  - 2
    - 7E:93:EB:FB:7C:C6:4E:59:EA:4B:9A:77:D4:06:FC:3B
    - RSA-SHA1: nil
    - Issuer
      - C: ZA
      - ST: Western Cape
      - L: Durbanville
      - O: Thawte
      - OU: Thawte Certification
      - CN: Thawte Timestamping CA
    - 2012-12-21 00:00:00 UTC: 2020-12-30 23:59:59 UTC
    - Subject
      - C: US
      - O: Symantec Corporation
      - CN: Symantec Time Stamping Services CA - G2
    - #5
      - rsaEncryption: nil
      - B1:AC:B3:49:54:4B:97:1C:12:0A:D8:25:79:91:22:57:
        2A:6F:DC:B8:26:C4:43:73:6B:C2:BF:2E:50:5A:FB:14:
        C2:76:8E:43:01:25:43:B4:A1:E2:45:F4:E8:B7:7B:C3:
        74:CC:22:D7:B4:94:00:02:F7:4D:ED:BF:B4:B7:44:24:
        6B:CD:5F:45:3B:D1:44:CE:43:12:73:17:82:8B:69:B4:
        2B:CB:99:1E:AC:72:1B:26:4D:71:1F:B1:31:DD:FB:51:
        61:02:53:A6:AA:F5:49:2C:05:78:45:A5:2F:89:CE:E7:
        99:E7:FE:8C:E2:57:3F:3D:C6:92:DC:4A:F8:7B:33:E4:
        79:0A:FB:F0:75:88:41:9C:FF:C5:03:51:99:AA:D7:6C:
        9F:93:69:87:65:29:83:85:C2:60:14:C4:C8:C9:3B:14:
        DA:C0:81:F0:1F:0D:74:DE:92:22:AB:CA:F7:FB:74:7C:
        27:E6:F7:4A:1B:7F:A7:C3:9E:2D:AE:8A:EA:A6:E6:AA:
        27:16:7D:61:F7:98:71:11:BC:E2:50:A1:4B:E5:5D:FA:
        E5:0E:A7:2C:9F:AA:65:20:D3:D8:96:E8:C8:7C:A5:4E:
        48:44:FF:19:E2:44:07:92:0B:D7:68:84:80:5D:6A:78:
        64:45:CD:60:46:7E:54:C1:13:7C:C5:79:F1:C9:C1:71: 0x010001
    - #6
      - subjectKeyIdentifier:
        5f 9a f5 6e 5c cc cc 74 9a d4 dd 7d ef 3f db ec |_..n\..t...}.?..| 4c 80 2e dd |L... |
      - authorityInfoAccess
        OCSP: http://ocsp.thawte.com
      - basicConstraints
        true
        true: 0
      - crlDistributionPoints: http://crl.thawte.com/ThawteTimestampingCA.crl
      - extendedKeyUsage: timeStamping
      - keyUsage: true, 6
      - subjectAltName
        CN: TimeStamp-2048-1
  - RSA-SHA1:
```
03 09 9b 8f 79 ef 7f 59  30 aa ef 68 b5 fa e3 09  |....y..Y0..h....|
1d bb 4f 82 06 5d 37 5f  a6 52 9f 16 8d ea 1c 92  |..O..]7_.R......|
09 44 6e f5 6d eb 58 7c  30 e8 f9 69 8d 23 73 0b  |.Dn.m.X|0..i.#s.|
12 6f 47 a9 ae 39 11 f8  2a b1 9b b0 1a c3 8e eb  |.oG..9..*.......|
59 96 00 ad ce 0c 4d b2  d0 31 a6 08 5c 2a 7a fc  |Y.....M..1..\*z.|
e2 7a 1d 57 4c a8 65 18  e9 79 40 62 25 96 6e c7  |.z.WL.e..y@b%.n.|
c7 37 6a 83 21 08 8e 41  ea dd d9 57 3f 1d 77 49  |.7j.!..A...W?.wI|
87 2a 16 06 5e a6 38 6a  22 12 a3 51 19 83 7e b6  |.*..^.8j"..Q..~.|
```
- Certificate #1
  - 2
    - 33:65:50:08:79:AD:73:E2:30:B9:E0:1D:0D:7F:AC:91
    - RSA-SHA1: nil
    - Issuer
      - C: ZA
      - ST: Western Cape
      - L: Cape Town
      - O: Thawte Consulting cc
      - OU: Certification Services Division
      - CN: Thawte Premium Server CA
      - emailAddress: premium-server@thawte.com
    - 2006-11-17 00:00:00 UTC: 2020-12-30 23:59:59 UTC
    - Subject
      - C: US
      - O: thawte, Inc.
      - OU: Certification Services Division
      - OU: (c) 2006 thawte, Inc. - For authorized use only
      - CN: thawte Primary Root CA
    - #5
      - rsaEncryption: nil
      - AC:A0:F0:FB:80:59:D4:9C:C7:A4:CF:9D:A1:59:73:09:
        10:45:0C:0D:2C:6E:68:F1:6C:5B:48:68:49:59:37:FC:
        0B:33:19:C2:77:7F:CC:10:2D:95:34:1C:E6:EB:4D:09:
        A7:1C:D2:B8:C9:97:36:02:B7:89:D4:24:5F:06:C0:CC:
        44:94:94:8D:02:62:6F:EB:5A:DD:11:8D:28:9A:5C:84:
        90:10:7A:0D:BD:74:66:2F:6A:38:A0:E2:D5:54:44:EB:
        1D:07:9F:07:BA:6F:EE:E9:FD:4E:0B:29:F5:3E:84:A0:
        01:F1:9C:AB:F8:1C:7E:89:A4:E8:A1:D8:71:65:0D:A3:
        51:7B:EE:BC:D2:22:60:0D:B9:5B:9D:DF:BA:FC:51:5B:
        0B:AF:98:B2:E9:2E:E9:04:E8:62:87:DE:2B:C8:D7:4E:
        C1:4C:64:1E:DD:CF:87:58:BA:4A:4F:CA:68:07:1D:1C:
        9D:4A:C6:D5:2F:91:CC:7C:71:72:1C:C5:C0:67:EB:32:
        FD:C9:92:5C:94:DA:85:C0:9B:BF:53:7D:2B:09:F4:8C:
        9D:91:1F:97:6A:52:CB:DE:09:36:A4:77:D8:7B:87:50:
        44:D5:3E:6E:29:69:FB:39:49:26:1E:09:A5:80:7B:40:
        2D:EB:E8:27:85:C9:FE:61:FD:7E:E6:7C:97:1D:D5:9D: 0x010001
    - X509v3 extensions
      - basicConstraints: true, true
      - certificatePolicies
        anyPolicy
        id-qt-cps: https://www.thawte.com/cps
      - keyUsage: true, 6
      - subjectKeyIdentifier:
        7b 5b 45 cf af ce cb 7a fd 31 92 1a 6a b6 f3 46 |{[E....z.1..j..F| eb 57 48 50 |.WHP |
      - crlDistributionPoints: http://crl.thawte.com/ThawtePremiumServerCA.crl
  - RSA-SHA1:
```
84 a8 4c c9 3e 2a bc 9a  e2 cc 8f 0b b2 25 77 c4  |..L.>*.......%w.|
61 89 89 63 5a d4 a3 15  40 d4 fb 5e 3f b4 43 ea  |a..cZ...@..^?.C.|
63 17 2b 6b 99 74 9e 09  a8 dd d4 56 15 2e 7a 79  |c.+k.t.....V..zy|
31 5f 63 96 53 1b 34 d9  15 ea 4f 6d 70 ca be f6  |1_c.S.4...Omp...|
82 a9 ed da 85 77 cc 76  1c 6a 81 0a 21 d8 41 99  |.....w.v.j..!.A.|
7f 5e 2e 82 c1 e8 aa f7  93 81 05 aa 92 b4 1f b7  |.^..............|
9a c0 07 17 f5 cb c6 b4  4c 0e d7 56 dc 71 20 74  |........L..V.q t|
38 d6 74 c6 d6 8f 6b af  8b 8d a0 6c 29 0b 61 e0  |8.t...k....l).a.|
```
- Certificate #2
  - 2
    - 47:97:4D:78:73:A5:BC:AB:0D:2F:B3:70:19:2F:CE:5E
    - RSA-SHA1: nil
    - Issuer
      - C: US
      - O: thawte, Inc.
      - OU: Certification Services Division
      - OU: (c) 2006 thawte, Inc. - For authorized use only
      - CN: thawte Primary Root CA
    - 2010-02-08 00:00:00 UTC: 2020-02-07 23:59:59 UTC
    - Subject
      - C: US
      - O: Thawte, Inc.
      - CN: Thawte Code Signing CA - G2
    - #5
      - rsaEncryption: nil
      - B7:8B:CF:75:5B:9F:25:DA:7E:39:B0:93:DB:38:D3:A9:
        23:D0:82:FA:E9:24:7E:5C:0B:8E:83:F8:E6:7A:59:E6:
        A3:C5:98:A7:99:D2:44:FF:00:A6:A5:39:04:8A:DA:29:
        88:EA:DB:A2:F3:1C:99:15:26:C2:B1:F4:FC:E1:0C:47:
        A9:09:11:06:0A:20:92:B9:C7:A0:04:8C:5C:94:19:AB:
        5B:25:2C:1D:62:7E:70:0D:CE:61:6C:DD:2B:82:C9:CE:
        5D:48:5F:F7:C2:BE:BC:41:23:1E:4F:29:5D:D7:4F:BC:
        F4:C5:2A:FC:63:E6:7C:26:4E:99:A7:79:41:9E:10:4A:
        7A:79:C9:C6:86:F7:86:95:D2:26:CE:3C:18:2A:D6:7C:
        CE:AF:CD:AD:BB:F7:82:2C:70:26:37:45:E5:0F:47:22:
        C6:01:28:BD:2E:83:5C:6A:A4:47:C1:E7:D0:D8:6B:81:
        46:3F:21:17:F5:07:C5:43:5A:A6:67:2C:B8:7B:60:11:
        B5:83:EE:F5:74:0A:72:71:44:3D:58:FE:E8:1A:AB:38:
        C3:59:DB:7F:6E:38:7D:76:C7:72:69:98:36:96:57:D3:
        66:1C:D2:54:91:04:2E:54:19:B0:DC:3D:B5:22:5E:86:
        D5:2A:7E:20:DF:5D:E6:7A:B1:65:FE:C5:02:4E:31:2D: 0x010001
    - X509v3 extensions
      - basicConstraints
        true
        true: 0
      - crlDistributionPoints: http://crl.thawte.com/ThawtePCA.crl
      - keyUsage: true, 6
      - authorityInfoAccess
        OCSP: http://ocsp.thawte.com
      - extendedKeyUsage
        clientAuth: codeSigning
      - subjectAltName
        CN: VeriSignMPKI-2-10
      - subjectKeyIdentifier:
        d4 0d 65 3f 7a bd 34 c6 fe 47 e7 4c 0d c0 bd f2 |..e?z.4..G.L....| de 15 ab 71 |...q |
      - authorityKeyIdentifier:
        7b 5b 45 cf af ce cb 7a fd 31 92 1a 6a b6 f3 46 |{[E....z.1..j..F| eb 57 48 50 |.WHP |
  - RSA-SHA1:
```
56 fe 53 5c e1 c7 9e bc  a7 ed 7e 53 6d 6a 14 4b  |V.S\......~Smj.K|
51 8c 40 5e 80 5f aa a4  e8 2f ef 38 c8 04 c9 ca  |Q.@^._.../.8....|
3e cf df 3a 58 4e b0 d4  b6 63 c5 29 57 fa 02 05  |>..:XN...c.)W...|
9a 45 4d 68 db 2a 1b d4  34 3d 9f 00 c3 5a cb 95  |.EMh.*..4=...Z..|
49 a5 6e e1 b0 c5 fc 41  4d 41 4a 6f d3 77 c8 d7  |I.n....AMAJo.w..|
38 8d e4 19 de 18 f3 1f  15 65 83 6d 45 0c 53 f9  |8........e.mE.S.|
0a 9a 2e a5 5d bf 6f 32  81 18 92 19 6a 55 00 ad  |....].o2....jU..|
63 1c 52 06 7e 55 d9 29  68 ae 4a 7c 18 9a 79 88  |c.R.~U.)h.J|..y.|
6b 23 23 d8 27 38 2a 29  87 76 ca fb c7 b6 62 23  |k##.'8*).v....b#|
1f ed 7a 56 4c dd 9c 32  5b f5 3d 0c 46 18 95 3b  |..zVL..2[.=.F..;|
2a 23 68 83 64 41 d9 00  6d 0f 19 24 15 68 72 bd  |*#h.dA..m..$.hr.|
c5 71 67 6e ac 4c db 90  eb 51 a5 1a 62 07 d0 be  |.qgn.L...Q..b...|
6a 00 47 3c 72 2f ec 4f  61 3e 73 85 ce 5a 0a b7  |j.Gs..Z..|
ba c0 1c 13 75 e3 22 39  28 dd 6d 1d 09 46 9d 4f  |....u."9(.m..F.O|
ba e8 40 81 91 c6 a4 ce  94 72 1b 01 cf 2a 6e 15  |..@......r...*n.|
67 95 89 ae 7d b7 b7 cd  f9 0a 3d 75 b6 6b 3c 25  |g...}.....=u.k<%|
```
- Certificate #3
  - 2
    - 0E:CF:F4:38:C8:FE:BF:35:6E:04:D8:6A:98:1B:1A:50
    - RSA-SHA1: nil
    - Issuer
      - C: US
      - O: Symantec Corporation
      - CN: Symantec Time Stamping Services CA - G2
    - 2012-10-18 00:00:00 UTC: 2020-12-29 23:59:59 UTC
    - Subject
      - C: US
      - O: Symantec Corporation
      - CN: Symantec Time Stamping Services Signer - G4
    - #5
      - rsaEncryption: nil
      - A2:63:0B:39:44:B8:BB:23:A7:44:49:BB:0E:FF:A1:F0:
        61:0A:53:93:B0:98:DB:AD:2C:0F:4A:C5:6E:FF:86:3C:
        53:55:0F:15:CE:04:3F:2B:FD:A9:96:96:D9:BE:61:79:
        0B:5B:C9:4C:86:76:E5:E0:43:4B:22:95:EE:C2:2B:43:
        C1:9F:D8:68:B4:8E:40:4F:EE:85:38:B9:11:C5:23:F2:
        64:58:F0:15:32:6F:4E:57:A1:AE:88:A4:02:D7:2A:1E:
        CD:4B:E1:DD:63:D5:17:89:32:5B:B0:5E:99:5A:A8:9D:
        28:50:0E:17:EE:96:DB:61:3B:45:51:1D:CF:12:56:0B:
        92:47:FC:AB:AE:F6:66:3D:47:AC:70:72:E7:92:E7:5F:
        CD:10:B9:C4:83:64:94:19:BD:25:80:E1:E8:D2:22:A5:
        D0:BA:02:7A:A1:77:93:5B:65:C3:EE:17:74:BC:41:86:
        2A:DC:08:4C:8C:92:8C:91:2D:9E:77:44:1F:68:D6:A8:
        74:77:DB:0E:5B:32:8B:56:8B:33:BD:D9:63:C8:49:9D:
        3A:C5:C5:EA:33:0B:D2:F1:A3:1B:F4:8B:BE:D9:B3:57:
        8B:3B:DE:04:A7:7A:22:B2:24:AE:2E:C7:70:C5:BE:4E:
        83:26:08:FB:0B:BD:A9:4F:99:08:E1:10:28:72:AA:CD: 0x010001
    - X509v3 extensions
      - basicConstraints
        true
        nil
      - extendedKeyUsage: true, timeStamping
      - keyUsage: true, 0x80
      - authorityInfoAccess
        #0
        OCSP: http://ts-ocsp.ws.symantec.com
        caIssuers: http://ts-aia.ws.symantec.com/tss-ca-g2.cer
      - crlDistributionPoints: http://ts-crl.ws.symantec.com/tss-ca-g2.crl
      - subjectAltName
        CN: TimeStamp-2048-2
      - subjectKeyIdentifier:
        46 c6 69 a3 0e 4a 14 1e d5 4c da 52 63 17 3f 5e |F.i..J...L.Rc.?^| 36 bc 0d e6 |6... |
      - authorityKeyIdentifier:
        5f 9a f5 6e 5c cc cc 74 9a d4 dd 7d ef 3f db ec |_..n\..t...}.?..| 4c 80 2e dd |L... |
  - RSA-SHA1:
```
78 3b b4 91 2a 00 4c f0  8f 62 30 37 78 a3 84 27  |x;..*.L..b07x..'|
07 6f 18 b2 de 25 dc a0  d4 94 03 aa 86 4e 25 9f  |.o...%.......N%.|
9a 40 03 1c dd ce e3 79  cb 21 68 06 da b6 32 b4  |.@.....y.!h...2.|
6d bf f4 2c 26 63 33 e4  49 64 6d 0d e6 c3 67 0e  |m..,&c3.Idm...g.|
f7 05 a4 35 6c 7c 89 16  c6 e9 b2 df b2 e9 dd 20  |...5l|......... |
c6 71 0f cd 95 74 dc b6  5c de bd 37 1f 43 78 e6  |.q...t..\..7.Cx.|
78 b5 cd 28 04 20 a3 aa  f1 4b c4 88 29 91 0e 80  |x..(. ...K..)...|
d1 11 fc dd 5c 76 6e 4f  5e 0e 45 46 41 6e 0d b0  |....\vnO^.EFAn..|
ea 38 9a b1 3a da 09 71  10 fc 1c 79 b4 80 7b ac  |.8..:..q...y..{.|
69 f4 fd 9c b6 0c 16 2b  f1 7f 5b 09 3d 9b 5b e2  |i......+..[.=.[.|
16 ca 13 81 6d 00 2e 38  0d a8 29 8f 2c e1 b2 f4  |....m..8..).,...|
5a a9 01 af 15 9c 2c 2f  49 1b db 22 bb c3 fe 78  |Z.....,/I.."...x|
94 51 c3 86 b1 82 88 5d  f0 3d b4 51 a1 79 33 2b  |.Q.....].=.Q.y3+|
2e 7b b9 dc 20 09 13 71  eb 6a 19 5b cf e8 a5 30  |.{.. ..q.j.[...0|
57 2c 89 49 3f b9 cf 7f  c9 bf 3e 22 68 63 53 9a  |W,.I?.....>"hcS.|
bd 69 74 ac c5 1d 3c 7f  92 e0 c3 bc 1c d8 04 75  |.it...<........u|
```
- Certificate #4
  - 2
    - 36:07:84:57:61:50:DB:30:61:25:D5:34:10:8D:82:56
    - RSA-SHA1: nil
    - Issuer
      - C: US
      - O: Thawte, Inc.
      - CN: Thawte Code Signing CA - G2
    - 2014-07-14 00:00:00 UTC: 2016-07-13 23:59:59 UTC
    - Subject
      - C: CN
      - ST: Shaanxi
      - L: Xi'an
      - O: No Organization Affiliation
      - OU: Individual Developer
      - CN: Di Wu
    - #5
      - rsaEncryption: nil
      - D8:A8:D3:1A:7D:F5:E7:BC:10:2A:78:2B:E6:F2:C1:A1:
        3E:46:5A:30:E5:C1:BB:E2:F5:D6:64:21:B9:2C:4F:E1:
        15:CD:12:91:CA:2D:F3:71:90:B6:2D:9E:03:AA:A5:0C:
        32:36:8C:FE:26:3B:9D:7F:3A:BC:1C:43:F6:5E:A2:73:
        B1:F3:96:60:2F:AA:01:61:E2:4F:C2:78:A4:62:EA:CE:
        5F:C6:10:BA:4E:C1:AE:55:32:4C:AD:63:01:2C:BA:08:
        28:1C:A0:0D:8D:E8:07:2E:1E:C8:FF:2E:3C:46:24:73:
        C9:14:A0:B7:C3:24:9B:E7:D8:D5:A8:C8:DF:CD:12:C8:
        2E:1A:65:97:5D:8A:3F:97:18:C6:E6:8E:7F:21:DC:C1:
        A2:1F:7F:FF:80:37:2B:59:C0:81:19:DB:84:7B:04:73:
        35:C5:CC:FD:9A:55:74:B2:2B:87:E9:BF:55:D3:0B:AE:
        19:3D:56:13:53:81:BA:35:F5:95:E0:B4:D2:57:CD:E0:
        D0:6D:5D:FB:37:F1:75:D2:EC:52:3B:1B:03:37:82:91:
        45:4B:DD:48:8B:4E:E4:73:54:96:B3:50:40:18:01:B4:
        C6:F6:14:1F:3E:B1:F4:BE:3B:E8:C8:A6:AC:99:1B:D9:
        80:9C:89:7E:C7:22:30:92:0C:44:B5:4E:E5:60:9B:F3: 0x010001
    - X509v3 extensions
      - basicConstraints
        nil
      - authorityKeyIdentifier:
        d4 0d 65 3f 7a bd 34 c6 fe 47 e7 4c 0d c0 bd f2 |..e?z.4..G.L....| de 15 ab 71 |...q |
      - subjectKeyIdentifier:
        c6 f5 5d 4f 43 13 b9 28 72 99 c7 a7 23 35 bd 9c |..]OC..(r...#5..| 87 8d e0 86 |.... |
      - crlDistributionPoints: http://th.symcb.com/th.crl
      - keyUsage: true, 0x80
      - extendedKeyUsage
        codeSigning: msCodeCom
      - certificatePolicies
        2.16.840.1.113733.1.7.48.2
        #0
        id-qt-cps: https://d.symcb.com/cps
        id-qt-unotice: https://d.symcb.com/rpa
      - 2.5.29.4
        msCodeCom: 0x80
      - authorityInfoAccess
        #0
        OCSP: http://th.symcd.com
        caIssuers: http://th.symcb.com/th.crt
      - nsCertType: 0x10
  - RSA-SHA1:
```
6d 87 56 4a b4 98 d8 df  ef 35 9c 0a a1 f3 a1 0d  |m.VJ.....5......|
bd eb 56 d2 9f cd 35 c1  d4 87 7e d9 47 d5 59 fd  |..V...5...~.G.Y.|
6b ce 35 52 5c 81 4d b6  88 d5 c4 54 d0 26 c0 5d  |k.5R\.M....T.&.]|
3f 4b f0 87 bf 48 26 2b  7e 38 2a e9 54 0a d8 5d  |?K...H&+~8*.T..]|
9b 03 81 fc f2 79 cf 56  a6 1b 1c 5a 5d 9a f4 64  |.....y.V...Z]..d|
88 00 09 11 07 dc 2f 11  71 fa da 77 58 f3 a0 e1  |....../.q..wX...|
d2 01 39 c1 d1 9a 09 11  15 65 fe e3 46 0c e4 67  |..9......e..F..g|
33 d4 13 12 4a fa b5 ca  c4 0e 96 ab a0 33 68 ed  |3...J........3h.|
63 0a b0 6c 99 99 17 ab  99 8c 6e 96 80 a0 3c 55  |c..l......n...
```

unnamed
- #0
  - C: US
  - O: Thawte, Inc.
  - CN: Thawte Code Signing CA - G2
- 36:07:84:57:61:50:DB:30:61:25:D5:34:10:8D:82:56
SHA1: nil

contentType: 1.3.6.1.4.1.311.2.1.4
1.3.6.1.4.1.311.2.1.11: msCodeCom

messageDigest:

37 33 47 08 fe bc 2e f9  14 1b bf b0 0c 09 bd 1a  |73G.............|
fa 51 7a a0                                       |.Qz.            |

1.3.6.1.4.1.311.2.1.12

00 52 00 65 00 65 00 7a 00 61 00 61 00 20 00 53 |.R.e.e.z.a.a. .S| 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 |.o.f.t.w.a.r.e |
: http://www.Reezaa.com

rsaEncryption:

7f fc 36 0e a8 c5 0c 8e  c9 dd e2 00 71 e3 74 03  |..6.........q.t.|
1a a2 f2 9c 20 41 1d 5b  f7 6e 3e 4f 4e f7 c8 ba  |.... A.[.n>ON...|
c4 0d 3f 4e 31 bf 14 c6  fc f7 9e 51 f5 ff 89 97  |..?N1......Q....|
ea f8 92 48 00 35 89 da  dc 84 a7 ed 60 e2 d8 e9  |...H.5......`...|
84 e8 18 57 b3 7d 3b 97  ff cf 80 59 96 aa 98 78  |...W.};....Y...x|
da 5f 94 28 26 e8 35 e6  7e 9e de 2d 8a 7e 6b bc  |._.(&.5.~..-.~k.|
c5 f6 fd 44 3e c6 a7 fa  e8 c4 01 5a b3 75 8e 00  |...D>......Z.u..|
ed 30 9e 5f 63 b9 a6 bf  30 02 08 e5 18 80 b6 71  |.0._c...0......q|
80 aa 5f fe fd d5 35 fc  40 ef 38 85 a6 b2 5a c9  |.._...5.@.8...Z.|
9c 93 35 9a 05 cb b4 f9  06 51 17 ff 9e c4 51 a1  |..5......Q....Q.|
e4 e9 16 69 ea d0 86 78  4f 65 53 e1 df f9 4f 40  |...i...xOeS...O@|
74 57 e0 a7 e5 a1 f2 cc  c0 b5 c1 1a 05 f7 79 96  |tW............y.|
3d eb 02 9a 88 a4 ac d4  13 cb cb 61 d6 f9 65 78  |=..........a..ex|
8c df 7c d3 d5 7a 8d f8  18 51 02 51 fc 05 ef 67  |..|..z...Q.Q...g|
20 2c 77 2f 91 8d e4 f9  f0 0c 92 c2 7d 51 05 5c  | ,w/........}Q.\|
4d 0d f0 a8 e9 ad 0a ea  5a f3 12 63 ec e8 90 94  |M.......Z..c....|

countersignature

unnamed
- #0
  - C: US
  - O: Symantec Corporation
  - CN: Symantec Time Stamping Services CA - G2
- 0E:CF:F4:38:C8:FE:BF:35:6E:04:D8:6A:98:1B:1A:50
SHA1: nil

contentType: pkcs7-data
signingTime: 2014-12-19 01:43:45 UTC

messageDigest:

35 0f c3 1a 0b 2c 82 e6  8c 1f d6 74 a0 9b 4f 2f  |5....,.....t..O/|
d3 49 29 80                                       |.I).            |

rsaEncryption:

86 33 38 9c 2c bf a4 12  2e 01 07 c4 b9 07 d7 c0  |.38.,...........|
98 a7 b2 2e 0e 2d 13 f6  93 20 53 67 c9 b3 33 d2  |.....-... Sg..3.|
50 fb f9 77 69 9c 2d 21  74 88 3d b5 a3 87 c1 5e  |P..wi.-!t.=....^|
b1 7b 21 d7 93 e2 e3 5e  14 c7 67 4d 28 94 09 ac  |.{!....^..gM(...|
9c dd 25 bb da c8 fa 02  82 cc 91 5b 66 1e 7b a4  |..%........[f.{.|
6c 42 b0 83 2a 11 58 7c  c0 8b 84 66 6e aa 44 67  |lB..*.X|...fn.Dg|
96 57 e1 0f f2 6e e7 5b  7d 18 84 f1 e8 b6 a2 ac  |.W...n.[}.......|
8f 63 97 25 93 1a 69 13  ee a6 f2 4e c6 58 57 c6  |.c.%..i....N.XW.|
14 e0 c0 ab 01 2b 41 7d  73 ee 7f fb 3c 82 15 64  |.....+A}s...<..d|
53 b3 85 15 68 69 e0 cc  59 7a 20 d0 a4 4c 02 38  |S...hi..Yz ..L.8|
53 25 20 64 86 a7 0c 62  b5 cc 26 40 24 89 dd 18  |S% d...b..&@$...|
c6 b8 ed 10 f5 89 1a bf  35 46 45 5a 54 c6 bc 90  |........5FEZT...|
27 70 14 ba c5 44 99 5b  7e e4 2e a0 34 db 07 47  |'p...D.[~...4..G|
4b fd 27 1a 2c 76 8f 57  e2 94 30 5f d6 8a c8 f0  |K.'.,v.W..0_....|
88 f4 be 93 29 e4 fa 3e  18 0d 8d de 14 a7 c8 2c  |....)..>.......,|
90 5b 3a d5 19 bc 22 2e  75 a1 70 5c fe c7 6a 29  |.[:...".u.p\..j)|

show previews

offset	size	type	comment
0	1390592	EXE	06/25/2019 06:54:13	#
15c1	15	HTM		#
c3f8c	34428	PNG	(256 x 256)	#
153800	7016	PKCS7	Authenticode Signature	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER