fa05ded17c97fbb2d9e378adf6e4faf3df91ec76.bin

info
MZ
PE
resources
imports
foremost
signature
hexdump
disasm
log
discuss
donate

filename	fa05ded17c97fbb2d9e378adf6e4faf3df91ec76.bin
size	127920 (0x1f3b0)
md5	16ac01292a94b86ecb1453330a2c893d

type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

Rich Header

lib id	version	times used
147	30729	20
156	21202	2
257	26706	4
261	26706	30
260	26706	12
259	26706	5
123	50727	2
257	26213	17
1	0	239
265	27034	8
255	27034	1
258	27034	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x5e1b585f
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	14.16
SizeOfCode	0x1e000
SizeOfInitializedData	0x1000
SizeOfUninitializedData	0x25000
AddressOfEntryPoint	0x43660
BaseOfCode	0x26000
BaseOfData	0x44000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x45000
SizeOfHeaders	0x1000
CheckSum	0x217c9
Subsystem	2
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

UPX v0.89.6 - v1.02 / v1.05 -v1.22 (Delphi) stub

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
UPX0	0x1000	0x25000	0	RWX UDATA
UPX1	0x26000	0x1e000	0x1da00	RWX IDATA
.rsrc	0x44000	0x1000	0x800	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x441dc	0x57c
RESOURCE	0x44000	0x1dc
EXCEPTION	0	0
SECURITY	0x1e600	0xdb0
BASERELOC	0x44758	0x24
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x4382c	0x18
LOAD_CONFIG	0x4384c	0xa0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x443844	0x44384c	0x43cce0	0	0	0x300000

show previews

type	name	size	cp
MANIFEST	#1	381	0

module_name	hint	ord	function_name
ADVAPI32.dll			GetUserNameA
api-ms-win-crt-filesystem-l1-1-0.dll			remove
api-ms-win-crt-heap-l1-1-0.dll			free
api-ms-win-crt-locale-l1-1-0.dll			_configthreadlocale
api-ms-win-crt-math-l1-1-0.dll			ceil
api-ms-win-crt-runtime-l1-1-0.dll			exit
api-ms-win-crt-stdio-l1-1-0.dll			ftell
api-ms-win-crt-string-l1-1-0.dll			strncpy
api-ms-win-crt-time-l1-1-0.dll			_time64
api-ms-win-crt-utility-l1-1-0.dll			rand
d3d9.dll			Direct3DCreate9
d3dx9_43.dll			D3DXCreateTextureFromFileInMemoryEx
GDI32.dll			GetStockObject
IMM32.dll			ImmGetContext
KERNEL32.DLL			LoadLibraryA
KERNEL32.DLL			ExitProcess
KERNEL32.DLL			GetProcAddress
KERNEL32.DLL			VirtualProtect
MSVCP140.dll			void __cdecl std::_Xout_of_range(char const *) ?_Xout_of_range@std@@YAXPBD@Z
SHELL32.dll			ShellExecuteA
urlmon.dll			URLDownloadToFileW
USER32.dll			SetFocus
VCRUNTIME140.dll			strstr
WINHTTP.dll			WinHttpOpen

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=GB/O=Ascertia/CN=Ascertia Public CA 1

serial: 752A9A52C4DC2C082E5A5F64EC9362C98772EB29

Certificates (2)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:2a:9a:52:c4:dc:2c:08:2e:5a:5f:64:ec:93:62:c9:87:72:eb:29
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=GB, O=Ascertia, CN=Ascertia Public CA 1
        Validity
            Not Before: Jun 20 12:51:27 2017 GMT
            Not After : Jun 20 12:51:27 2018 GMT
        Subject: C=Russia/emailAddress=recordov.kniga@yandex.ru, ST=Moscow, L=Moscow, O=LTD KosmoSoft, CN=Anton Petrov
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:8b:59:f9:94:80:c2:f5:b3:38:96:c4:6b:e3:7f:
                    3f:86:ae:34:7e:00:6b:bb:3b:42:e8:ff:a5:68:8a:
                    8c:1f:5d:ed:aa:cd:02:5e:33:2a:bc:a7:e8:4c:8c:
                    26:21:13:6a:f7:1c:58:2a:e7:2f:8d:4e:38:e4:88:
                    5f:9f:a7:64:12:ca:c5:11:88:30:7e:a3:9d:eb:30:
                    ea:4a:c2:2e:81:b3:a1:f1:27:02:f8:80:86:1f:33:
                    0c:50:53:97:97:d3:7d:8c:96:67:38:3a:8d:fe:d3:
                    fe:98:7e:89:b5:8e:f5:d1:34:89:a0:46:59:50:b2:
                    30:e6:cf:e9:d7:0b:80:07:95
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation
            X509v3 Basic Constraints: critical
                CA:FALSE
            Authority Information Access: 
                OCSP - URI:http://ocsp.globaltrustfinder.com
            X509v3 Certificate Policies: 
                Policy: 1.3.6.1.4.1.15945.1.1.1
                  User Notice:
                    Explicit Text: Warning: Certificates are issued under this policy to individuals that have not had their identity confirmed. Do not use these certificates for valuable transactions. NO LIABILITY IS ACCEPTED.
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://www.globaltrustfinder.com/crls/AscertiaPublicCA1.crl
            X509v3 Extended Key Usage: 
                Code Signing
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        6e:7d:ab:e7:89:b0:93:da:f1:8e:aa:b8:41:98:9e:cd:51:b3:
        f8:05:2a:d6:a3:d0:34:d2:5c:61:38:e7:54:a6:9d:b0:f6:47:
        fa:dd:6c:a3:1c:b7:67:c7:cc:92:bc:a6:2e:1b:91:0f:3c:aa:
        af:61:a1:1f:37:13:b7:4b:8d:c1:c2:a7:b7:35:b8:eb:ea:aa:
        82:9a:5c:19:d2:38:99:a2:8b:f1:d2:aa:36:73:ca:7c:81:fe:
        62:de:3b:f6:72:8d:6e:e6:ea:98:09:54:3f:e0:8b:ff:ca:9b:
        22:27:81:2a:ad:ca:2e:9c:c0:e5:b5:36:47:c7:c7:6a:72:43:
        d5:00:86:50:5a:c2:6c:2c:5a:ac:7e:07:50:53:41:e5:5d:52:
        4d:80:a7:36:f5:8f:04:3b:50:9b:63:ff:8d:6d:e8:d3:5a:d7:
        30:c9:0f:30:2a:d6:11:9a:2f:c7:f5:59:1f:95:1a:62:56:30:
        09:d9:b3:51:cc:8e:93:73:f9:28:42:9b:8c:cb:d4:c8:26:37:
        73:e6:64:79:23:6f:5c:12:d2:07:89:17:27:db:0f:4e:9a:db:
        e6:80:d1:59:dd:e8:40:2f:30:7d:4b:14:12:7b:1d:a3:4b:7e:
        8f:af:78:f7:32:d4:77:a4:d7:ff:64:2b:ee:48:6c:31:18:77:
        00:44:ea:0f

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 230 (0xe6)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=GB, O=Ascertia, CN=Ascertia Root CA 2
        Validity
            Not Before: Apr 21 12:15:17 2009 GMT
            Not After : Apr 14 23:59:59 2028 GMT
        Subject: C=GB, O=Ascertia, CN=Ascertia Public CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:cf:58:f2:33:c4:b3:d9:1d:f9:4f:11:db:b8:e3:
                    b6:d6:bc:a7:21:37:57:2e:7b:a9:0c:94:b3:cb:12:
                    f0:47:5a:ce:21:70:5e:13:83:9c:3e:cc:a3:fe:9e:
                    bd:53:d6:d8:30:64:3f:8a:6e:5d:c4:1b:52:b0:11:
                    f5:d9:08:d0:4e:f6:04:4f:fe:ff:24:72:5f:0d:ac:
                    b4:aa:7c:34:f8:db:0a:58:26:6b:34:bb:ac:69:34:
                    28:cc:f1:85:6b:92:17:90:95:de:9f:8b:f1:df:a3:
                    8a:d5:10:48:56:78:71:39:5e:34:9d:68:bb:9a:b3:
                    09:f3:fd:64:0e:27:5d:88:9e:3a:ce:c4:e7:6e:f1:
                    fb:f2:1d:51:ed:eb:87:d6:d3:b9:c1:30:8f:8d:a7:
                    c9:cd:5d:0f:eb:7e:7f:04:9b:5f:46:c6:07:b3:3f:
                    cd:ba:95:b1:57:f4:9b:6f:e6:b4:8a:18:65:2a:e0:
                    0f:40:00:0e:44:70:c0:7e:f8:06:7a:b5:6a:33:17:
                    f4:9b:31:19:35:44:bd:1b:06:39:fa:96:69:e7:a2:
                    55:94:69:df:21:8d:c1:d1:09:f6:9e:eb:98:a6:73:
                    20:a1:d5:99:77:08:22:b9:fc:e9:1d:b3:e8:59:f0:
                    d2:10:70:9a:29:0e:2d:ce:ec:44:38:73:17:72:41:
                    37:65
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:2
            X509v3 Certificate Policies: 
                Policy: 1.3.6.1.4.1.15945.1.1.1
                  User Notice:
                    Explicit Text: Warning: Certificates are issued under this policy to individuals that have not had their identity confirmed. Do not use these certificates for valuable transactions. NO LIABILITY IS ACCEPTED.
            X509v3 Subject Key Identifier: 
                30:82:01:22:30:0D:06:09:2A:86:48:86:F7:0D:01:01:01:05:00:03:82:01:0F:00:30:82:01:0A:02:82:01:01:00:CF:58:F2:33:C4:B3:D9:1D:F9:4F:11:DB:B8:E3:B6:D6:BC:A7:21:37:57:2E:7B:A9:0C:94:B3:CB:12:F0:47:5A:CE:21:70:5E:13:83:9C:3E:CC:A3:FE:9E:BD:53:D6:D8:30:64:3F:8A:6E:5D:C4:1B:52:B0:11:F5:D9:08:D0:4E:F6:04:4F:FE:FF:24:72:5F:0D:AC:B4:AA:7C:34:F8:DB:0A:58:26:6B:34:BB:AC:69:34:28:CC:F1:85:6B:92:17:90:95:DE:9F:8B:F1:DF:A3:8A:D5:10:48:56:78:71:39:5E:34:9D:68:BB:9A:B3:09:F3:FD:64:0E:27:5D:88:9E:3A:CE:C4:E7:6E:F1:FB:F2:1D:51:ED:EB:87:D6:D3:B9:C1:30:8F:8D:A7:C9:CD:5D:0F:EB:7E:7F:04:9B:5F:46:C6:07:B3:3F:CD:BA:95:B1:57:F4:9B:6F:E6:B4:8A:18:65:2A:E0:0F:40:00:0E:44:70:C0:7E:F8:06:7A:B5:6A:33:17:F4:9B:31:19:35:44:BD:1B:06:39:FA:96:69:E7:A2:55:94:69:DF:21:8D:C1:D1:09:F6:9E:EB:98:A6:73:20:A1:D5:99:77:08:22:B9:FC:E9:1D:B3:E8:59:F0:D2:10:70:9A:29:0E:2D:CE:EC:44:38:73:17:72:41:37:65:02:03:01:00:01
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://www.ascertia.com/OnlineCA/crls/AscertiaRootCA2/AscertiaRootCA2.crl
            Authority Information Access: 
                OCSP - URI:http://ocsp.globaltrustfinder.com
            X509v3 Authority Key Identifier: 
                30:82:01:22:30:0D:06:09:2A:86:48:86:F7:0D:01:01:01:05:00:03:82:01:0F:00:30:82:01:0A:02:82:01:01:00:96:37:BE:9E:E0:D9:3E:A6:86:13:17:F6:4A:F3:A9:07:F3:16:68:D5:7F:44:16:47:F3:21:9F:7D:FC:E4:FF:A4:F4:0B:BE:CD:F4:C2:06:03:E2:EC:A1:44:14:C5:90:A1:9F:D1:D1:F7:1E:32:B3:D4:DF:52:14:9B:9D:D1:EA:9B:C6:D1:F7:60:FA:FC:AD:48:C7:93:18:EB:5F:7E:0B:C4:21:56:04:DA:23:E1:3D:C5:C3:72:C6:9D:3A:46:78:EE:B1:11:A1:03:01:DB:DD:22:79:B7:04:9B:E9:1B:85:56:11:2D:D9:ED:22:6D:79:A2:1B:90:D9:AA:0E:7D:03:85:1A:4C:15:78:8D:2A:06:4A:35:62:1C:24:CD:59:19:6F:7E:39:93:BB:BF:15:19:AC:E3:C1:7D:C7:A9:95:68:3B:D1:3A:2B:73:C4:C1:60:BE:CF:BF:5F:E0:EA:4B:99:08:EE:C3:C7:59:C5:E9:A8:22:F4:60:88:1D:19:0C:AD:C8:E0:B8:8A:A4:83:CA:92:2F:E2:96:C7:05:AE:2A:2F:18:1C:11:B8:8B:BB:C8:82:F1:CE:28:BD:A5:9E:67:68:7B:AD:D6:44:01:BD:C1:41:DB:EB:C7:6E:C0:17:35:B4:80:0F:A9:A9:BD:D0:C4:2B:33:28:53:1B:38:70:23:B6:83:02:03:01:00:01
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        94:94:97:a1:a3:13:99:ba:86:4a:5c:8b:65:8b:3e:82:4c:ac:
        6f:74:4c:02:db:8a:01:99:4b:5c:d3:60:bb:08:c1:4c:5f:c7:
        45:67:76:14:7f:61:4e:dd:51:07:f9:bc:53:e1:cd:07:fd:9b:
        09:bd:be:27:53:f5:6c:1d:e9:68:34:86:60:e2:4f:c2:e1:e7:
        2e:d3:e1:7c:aa:8e:e3:0a:37:77:29:ed:e0:c5:92:b4:82:52:
        1b:d3:f0:b8:36:9f:fa:b1:79:e2:4c:0f:78:21:b4:58:68:c9:
        7b:48:e4:0f:fa:0a:63:c7:06:47:0d:32:d4:19:02:13:91:2a:
        3a:49:e3:5c:12:6b:eb:c7:ea:fd:53:cc:2f:28:b7:0f:b1:bb:
        18:32:02:43:bf:85:19:a6:98:12:20:18:3b:b0:c4:a7:cb:ad:
        d0:50:45:95:9e:05:19:96:a8:7e:e0:ad:09:44:d2:06:18:a4:
        11:52:e0:59:68:af:00:6a:8e:22:03:a7:a1:47:e7:63:ab:2d:
        2f:60:2d:5d:9f:d5:e9:b1:31:00:25:c2:1d:cb:30:19:b0:bd:
        4b:53:42:cf:be:f0:cf:28:5f:61:29:5d:90:88:1d:ea:0e:10:
        51:0c:6f:39:84:bf:82:3c:f3:2a:28:1c:9c:5c:4c:bd:36:ea:
        f7:25:ff:52

pkcs7-signedData

1
- SHA1: nil
- 1.3.6.1.4.1.311.2.1.4
  - #0
    - 1.3.6.1.4.1.311.2.1.15
      - :
    - SHA1
      - 73 00 75 8e e7 25 0a 99 49 c7 4b 2f f7 e0 97 ea |s.u..%..I.K/....| ec 76 1c 82 |.v.. |
- Certificates
  - Certificate #0
    - 2
      - 75:2A:9A:52:C4:DC:2C:08:2E:5A:5F:64:EC:93:62:C9:
        87:72:EB:29
      - RSA-SHA1: nil
      - Issuer
        C: GB
        O: Ascertia
        CN: Ascertia Public CA 1
      - 2017-06-20 12:51:27 UTC: 2018-06-20 12:51:27 UTC
      - Subject
        C: Russia
        emailAddress: recordov.kniga@yandex.ru
        ST: Moscow
        L: Moscow
        O: LTD KosmoSoft
        CN: Anton Petrov
      - #5
        rsaEncryption: nil
        8B:59:F9:94:80:C2:F5:B3:38:96:C4:6B:E3:7F:3F:86:
        AE:34:7E:00:6B:BB:3B:42:E8:FF:A5:68:8A:8C:1F:5D:
        ED:AA:CD:02:5E:33:2A:BC:A7:E8:4C:8C:26:21:13:6A:
        F7:1C:58:2A:E7:2F:8D:4E:38:E4:88:5F:9F:A7:64:12:
        CA:C5:11:88:30:7E:A3:9D:EB:30:EA:4A:C2:2E:81:B3:
        A1:F1:27:02:F8:80:86:1F:33:0C:50:53:97:97:D3:7D:
        8C:96:67:38:3A:8D:FE:D3:FE:98:7E:89:B5:8E:F5:D1:
        34:89:A0:46:59:50:B2:30:E6:CF:E9:D7:0B:80:07:95: 0x010001
      - #6
        keyUsage: true, 0xc0
        basicConstraints
        true
        nil
        authorityInfoAccess
        OCSP: http://ocsp.globaltrustfinder.com
        certificatePolicies
        1.3.6.1.4.1.15945.1.1.1
        id-qt-unotice: Warning: Certificates are issued under this policy to individuals that have not had their identity confirmed. Do not use these certificates for valuable transactions. NO LIABILITY IS ACCEPTED.
        crlDistributionPoints: http://www.globaltrustfinder.com/crls/AscertiaPublicCA1.crl
        extendedKeyUsage: codeSigning
    - RSA-SHA1:
```
6e 7d ab e7 89 b0 93 da  f1 8e aa b8 41 98 9e cd  |n}..........A...|
51 b3 f8 05 2a d6 a3 d0  34 d2 5c 61 38 e7 54 a6  |Q...*...4.\a8.T.|
9d b0 f6 47 fa dd 6c a3  1c b7 67 c7 cc 92 bc a6  |...G..l...g.....|
2e 1b 91 0f 3c aa af 61  a1 1f 37 13 b7 4b 8d c1  |....<..a..7..K..|
c2 a7 b7 35 b8 eb ea aa  82 9a 5c 19 d2 38 99 a2  |...5......\..8..|
8b f1 d2 aa 36 73 ca 7c  81 fe 62 de 3b f6 72 8d  |....6s.|..b.;.r.|
6e e6 ea 98 09 54 3f e0  8b ff ca 9b 22 27 81 2a  |n....T?....."'.*|
ad ca 2e 9c c0 e5 b5 36  47 c7 c7 6a 72 43 d5 00  |.......6G..jrC..|
86 50 5a c2 6c 2c 5a ac  7e 07 50 53 41 e5 5d 52  |.PZ.l,Z.~.PSA.]R|
4d 80 a7 36 f5 8f 04 3b  50 9b 63 ff 8d 6d e8 d3  |M..6...;P.c..m..|
5a d7 30 c9 0f 30 2a d6  11 9a 2f c7 f5 59 1f 95  |Z.0..0*.../..Y..|
1a 62 56 30 09 d9 b3 51  cc 8e 93 73 f9 28 42 9b  |.bV0...Q...s.(B.|
8c cb d4 c8 26 37 73 e6  64 79 23 6f 5c 12 d2 07  |....&7s.dy#o\...|
89 17 27 db 0f 4e 9a db  e6 80 d1 59 dd e8 40 2f  |..'..N.....Y..@/|
30 7d 4b 14 12 7b 1d a3  4b 7e 8f af 78 f7 32 d4  |0}K..{..K~..x.2.|
77 a4 d7 ff 64 2b ee 48  6c 31 18 77 00 44 ea 0f  |w...d+.Hl1.w.D..|
```
  - Certificate #1
    - 2
      - 0xE6
      - RSA-SHA1: nil
      - Issuer
        C: GB
        O: Ascertia
        CN: Ascertia Root CA 2
      - 2009-04-21 12:15:17 UTC: 2028-04-14 23:59:59 UTC
      - Subject
        C: GB
        O: Ascertia
        CN: Ascertia Public CA 1
      - #5
        rsaEncryption: nil
        CF:58:F2:33:C4:B3:D9:1D:F9:4F:11:DB:B8:E3:B6:D6:
        BC:A7:21:37:57:2E:7B:A9:0C:94:B3:CB:12:F0:47:5A:
        CE:21:70:5E:13:83:9C:3E:CC:A3:FE:9E:BD:53:D6:D8:
        30:64:3F:8A:6E:5D:C4:1B:52:B0:11:F5:D9:08:D0:4E:
        F6:04:4F:FE:FF:24:72:5F:0D:AC:B4:AA:7C:34:F8:DB:
        0A:58:26:6B:34:BB:AC:69:34:28:CC:F1:85:6B:92:17:
        90:95:DE:9F:8B:F1:DF:A3:8A:D5:10:48:56:78:71:39:
        5E:34:9D:68:BB:9A:B3:09:F3:FD:64:0E:27:5D:88:9E:
        3A:CE:C4:E7:6E:F1:FB:F2:1D:51:ED:EB:87:D6:D3:B9:
        C1:30:8F:8D:A7:C9:CD:5D:0F:EB:7E:7F:04:9B:5F:46:
        C6:07:B3:3F:CD:BA:95:B1:57:F4:9B:6F:E6:B4:8A:18:
        65:2A:E0:0F:40:00:0E:44:70:C0:7E:F8:06:7A:B5:6A:
        33:17:F4:9B:31:19:35:44:BD:1B:06:39:FA:96:69:E7:
        A2:55:94:69:DF:21:8D:C1:D1:09:F6:9E:EB:98:A6:73:
        20:A1:D5:99:77:08:22:B9:FC:E9:1D:B3:E8:59:F0:D2:
        10:70:9A:29:0E:2D:CE:EC:44:38:73:17:72:41:37:65: 0x010001
      - #6
        keyUsage: true, 6
        basicConstraints
        true
        true: 2
        certificatePolicies
        1.3.6.1.4.1.15945.1.1.1
        id-qt-unotice: Warning: Certificates are issued under this policy to individuals that have not had their identity confirmed. Do not use these certificates for valuable transactions. NO LIABILITY IS ACCEPTED.
        subjectKeyIdentifier
        #0
        rsaEncryption: nil
        CF:58:F2:33:C4:B3:D9:1D:F9:4F:11:DB:B8:E3:B6:D6:
        BC:A7:21:37:57:2E:7B:A9:0C:94:B3:CB:12:F0:47:5A:
        CE:21:70:5E:13:83:9C:3E:CC:A3:FE:9E:BD:53:D6:D8:
        30:64:3F:8A:6E:5D:C4:1B:52:B0:11:F5:D9:08:D0:4E:
        F6:04:4F:FE:FF:24:72:5F:0D:AC:B4:AA:7C:34:F8:DB:
        0A:58:26:6B:34:BB:AC:69:34:28:CC:F1:85:6B:92:17:
        90:95:DE:9F:8B:F1:DF:A3:8A:D5:10:48:56:78:71:39:
        5E:34:9D:68:BB:9A:B3:09:F3:FD:64:0E:27:5D:88:9E:
        3A:CE:C4:E7:6E:F1:FB:F2:1D:51:ED:EB:87:D6:D3:B9:
        C1:30:8F:8D:A7:C9:CD:5D:0F:EB:7E:7F:04:9B:5F:46:
        C6:07:B3:3F:CD:BA:95:B1:57:F4:9B:6F:E6:B4:8A:18:
        65:2A:E0:0F:40:00:0E:44:70:C0:7E:F8:06:7A:B5:6A:
        33:17:F4:9B:31:19:35:44:BD:1B:06:39:FA:96:69:E7:
        A2:55:94:69:DF:21:8D:C1:D1:09:F6:9E:EB:98:A6:73:
        20:A1:D5:99:77:08:22:B9:FC:E9:1D:B3:E8:59:F0:D2:
        10:70:9A:29:0E:2D:CE:EC:44:38:73:17:72:41:37:65: 0x010001
        crlDistributionPoints: http://www.ascertia.com/OnlineCA/crls/AscertiaRootCA2/AscertiaRootCA2.crl
        authorityInfoAccess
        OCSP: http://ocsp.globaltrustfinder.com
        authorityKeyIdentifier
        #0
        rsaEncryption: nil
        96:37:BE:9E:E0:D9:3E:A6:86:13:17:F6:4A:F3:A9:07:
        F3:16:68:D5:7F:44:16:47:F3:21:9F:7D:FC:E4:FF:A4:
        F4:0B:BE:CD:F4:C2:06:03:E2:EC:A1:44:14:C5:90:A1:
        9F:D1:D1:F7:1E:32:B3:D4:DF:52:14:9B:9D:D1:EA:9B:
        C6:D1:F7:60:FA:FC:AD:48:C7:93:18:EB:5F:7E:0B:C4:
        21:56:04:DA:23:E1:3D:C5:C3:72:C6:9D:3A:46:78:EE:
        B1:11:A1:03:01:DB:DD:22:79:B7:04:9B:E9:1B:85:56:
        11:2D:D9:ED:22:6D:79:A2:1B:90:D9:AA:0E:7D:03:85:
        1A:4C:15:78:8D:2A:06:4A:35:62:1C:24:CD:59:19:6F:
        7E:39:93:BB:BF:15:19:AC:E3:C1:7D:C7:A9:95:68:3B:
        D1:3A:2B:73:C4:C1:60:BE:CF:BF:5F:E0:EA:4B:99:08:
        EE:C3:C7:59:C5:E9:A8:22:F4:60:88:1D:19:0C:AD:C8:
        E0:B8:8A:A4:83:CA:92:2F:E2:96:C7:05:AE:2A:2F:18:
        1C:11:B8:8B:BB:C8:82:F1:CE:28:BD:A5:9E:67:68:7B:
        AD:D6:44:01:BD:C1:41:DB:EB:C7:6E:C0:17:35:B4:80:
        0F:A9:A9:BD:D0:C4:2B:33:28:53:1B:38:70:23:B6:83: 0x010001
    - RSA-SHA1:
```
94 94 97 a1 a3 13 99 ba  86 4a 5c 8b 65 8b 3e 82  |.........J\.e.>.|
4c ac 6f 74 4c 02 db 8a  01 99 4b 5c d3 60 bb 08  |L.otL.....K\.`..|
c1 4c 5f c7 45 67 76 14  7f 61 4e dd 51 07 f9 bc  |.L_.Egv..aN.Q...|
53 e1 cd 07 fd 9b 09 bd  be 27 53 f5 6c 1d e9 68  |S........'S.l..h|
34 86 60 e2 4f c2 e1 e7  2e d3 e1 7c aa 8e e3 0a  |4.`.O......|....|
37 77 29 ed e0 c5 92 b4  82 52 1b d3 f0 b8 36 9f  |7w)......R....6.|
fa b1 79 e2 4c 0f 78 21  b4 58 68 c9 7b 48 e4 0f  |..y.L.x!.Xh.{H..|
fa 0a 63 c7 06 47 0d 32  d4 19 02 13 91 2a 3a 49  |..c..G.2.....*:I|
e3 5c 12 6b eb c7 ea fd  53 cc 2f 28 b7 0f b1 bb  |.\.k....S./(....|
18 32 02 43 bf 85 19 a6  98 12 20 18 3b b0 c4 a7  |.2.C...... .;...|
cb ad d0 50 45 95 9e 05  19 96 a8 7e e0 ad 09 44  |...PE......~...D|
d2 06 18 a4 11 52 e0 59  68 af 00 6a 8e 22 03 a7  |.....R.Yh..j."..|
a1 47 e7 63 ab 2d 2f 60  2d 5d 9f d5 e9 b1 31 00  |.G.c.-/`-]....1.|
25 c2 1d cb 30 19 b0 bd  4b 53 42 cf be f0 cf 28  |%...0...KSB....(|
5f 61 29 5d 90 88 1d ea  0e 10 51 0c 6f 39 84 bf  |_a)]......Q.o9..|
82 3c f3 2a 28 1c 9c 5c  4c bd 36 ea f7 25 ff 52  |.<.*(..\L.6..%.R|
```
- Signer
  - 1
  - unnamed
    - #0
      - C: GB
      - O: Ascertia
      - CN: Ascertia Public CA 1
    - 75:2A:9A:52:C4:DC:2C:08:2E:5A:5F:64:EC:93:62:C9:
      87:72:EB:29
  - SHA1: nil
  - #3
    - 1.3.6.1.4.1.311.2.1.12
      - nil
    - contentType: 1.3.6.1.4.1.311.2.1.4
    - 1.3.6.1.4.1.311.2.1.11: msCodeInd
    - messageDigest:
```
09 2a 99 52 cf ea f4 cb  ab 62 fb e4 5d b3 11 9f  |.*.R.....b..]...|
98 53 b4 cc                                       |.S..            |
```
  - rsaEncryption:
```
06 ed 2d 18 ec ef f9 7e  b0 34 3d 8e 5a e1 df d4  |..-....~.4=.Z...|
89 5e 3d 5c b7 28 14 73  20 c8 07 17 91 a8 96 f4  |.^=\.(.s .......|
ce 4b c0 16 3c 5d 96 62  1f 6f 5d 62 09 c0 e7 62  |.K..<].b.o]b...b|
3a c3 c6 7f 1b e9 17 08  f0 c9 a9 8c fe 55 27 f1  |:............U'.|
eb ff ae f6 c2 78 0b 62  d9 8f 64 f5 33 7a fe 3d  |.....x.b..d.3z.=|
9c 12 59 bb 88 42 74 da  92 2c 96 16 df 61 5c 97  |..Y..Bt..,...a\.|
95 84 8b ca a7 fa 9d c0  f7 be a2 a5 ca 2f 2f b8  |.............//.|
5b 13 00 68 e5 d9 a6 9d  ef 75 09 4f c7 61 1b 8c  |[..h.....u.O.a..|
```

show previews

offset	size	type	comment
0	124416	EXE	01/12/2020 17:33:19	#
15c1	15	HTM		#
1e600	3504	PKCS7	Authenticode Signature	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK