1.zip - WEXTRACT.EXE - Win32 Cabinet Self-Extractor

info
MZ
PE
resources
strings
imports
foremost
7zip
version info
signature
hexdump
disasm
log
discuss
donate

filename	1.zip
size	122592 (0x1dee0)
md5	1c26a826b6ad262ad400a40cd754793b

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd0

Rich Header

lib id	version	times used
93	4035	13
1	0	134
94	4035	1
95	4035	27
90	4035	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x480251cd
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	7.10
SizeOfCode	0x9a00
SizeOfInitializedData	0x12e00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x645c
BaseOfCode	0x1000
BaseOfData	0xb000
ImageBase	0x1000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	5.1
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x20000
SizeOfHeaders	0x400
CheckSum	0x202fe
Subsystem	2
DllCharacteristics	0x8400
SizeOfStackReserve	0x40000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS CAB SFX

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x99c8	0x9a00	R-X CODE
.data	0xb000	0x1be4	0x400	RW- IDATA
.rsrc	0xd000	0x13000	0x12a00	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x9d80	0x8c
RESOURCE	0xd000	0x12964
EXCEPTION	0	0
SECURITY	0x1cc00	0x12e0
BASERELOC	0	0
DEBUG	0x1230	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x1000	0x230
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
AVI	#3001	11802	1252
ICON	#1	744	1252
ICON	#2	296	1252
DIALOG	#2001	412	1252
DIALOG	#2002	272	1252
DIALOG	#2003	264	1252
DIALOG	#2004	364	1252
DIALOG	#2005	220	1252
DIALOG	#2006	212	1252
STRING	#63	68	1252
STRING	#76	444	1252
STRING	#77	664	1252
STRING	#80	540	1252
STRING	#83	444	1252
STRING	#85	308	1252
RCDATA	ADMQCMD	7	1252
RCDATA	CABINET	55896	1252
RCDATA	EXTRACTOPT	4	1252
RCDATA	FILESIZES	36	1252
RCDATA	FINISHMSG	7	1252
RCDATA	LICENSE	7	1252
RCDATA	PACKINSTSPACE	4	1252
RCDATA	POSTRUNPROGRAM	7	1252
RCDATA	REBOOT	4	1252
RCDATA	RUNPROGRAM	14	1252
RCDATA	SHOWWINDOW	4	1252
RCDATA	TITLE	2	1252
RCDATA	UPROMPT	7	1252
RCDATA	USRQCMD	7	1252
GROUP_ICON	#3000	34	1252
VERSION	#1	1072	1252

id	lang	string
1000	2052	请选择用于存放提取文件的文件夹。
1001	2052	%s
1200	2052	从 %s 获取磁盘空间信息失败。系统消息: %s。
1201	2052	未找到所需的资源。
1202	2052	是否取消?
1204	2052	无法检索到操作系统的版本信息。
1205	2052	内存分配请求失败。
1208	2052	无法创建解压缩线程。
1210	2052	CAB 文件无效。
1211	2052	文件表已满。
1212	2052	无法更改目标文件夹。
1213	2052	安装程序没有找到含 %s KB 可用磁盘空间的驱动器，安装过程无法进行。请释放部分空间，然后单击“重试”，或者单击“取消”退出安装程序。
1214	2052	文件夹无效。请确认文件夹是否存在而且可写。
1215	2052	必须指定文件夹路径或选择“取消”。
1216	2052	无法更新文件夹编辑框。
1217	2052	无法加载浏览器对话框所需的函数。
1218	2052	无法加载浏览器对话框所需的 Shell32.dll。
1220	2052	创建进程 <%s> 时出错。原因: %s
1221	2052	不支持此系统的簇大小。
1222	2052	所需的资源可能已被破坏。
1223	2052	此安装程序要求 Windows 95、Windows NT 4.0 Beta 2 或更高版本的操作系统。
1224	2052	加载 %s 时出错
1225	2052	GetProcAddress() 在执行函数 %s 时失败。可能的原因: 所用的 advpack.dll 版本不对。
1226	2052	需要安装 Windows 95 或 Windows NT
1227	2052	无法创建“%s”文件夹
1228	2052	要安装该程序，需要有 %s KB 的磁盘空间保留在驱动器 %s 上。建议在继续安装之前释放出所需的磁盘空间。是否继续?
1264	2052	检索 Windows 文件夹时出错
1269	2052	NT 系统关闭: OpenProcessToken 出错。
1270	2052	NT 系统关闭: AdjustTokenPrivileges 出错。
1271	2052	NT 系统关闭: ExitWindowsEx 出错。
1272	2052	无法提取文件。很可能是由于内存不足(用于交换文件的磁盘空间不足)或 CAB 文件已损坏。
1273	2052	安装程序无法获取驱动器(%s)的卷标信息。系统消息: %s。
1274	2052	安装程序无法找到含 %s KB 可用磁盘空间的驱动器，安装过程无法进行。请释放部分空间，然后再试。
1275	2052	安装程序可能已损坏。请与该应用程序的供应商联系。
1312	2052	命令行选项语法错误。键入“命令 /?”可获得帮助信息。
1313	2052	命令行选项: /Q -- 无提示安装方式， /T:<full path> -- 指定临时工作文件夹， /C -- (与 /T 并用)仅将文件提取到指定文件夹。 /C:<Cmd> -- 忽略作者定义的安装命令。
1314	2052	必须重新启动计算机才能使新的设置生效。是否现在重新启动计算机?
1316	2052	正在运行“%s”软件包的另一副本。是否运行新的副本?
1317	2052	无法找到文件 %s。
1351	2052	您没有该计算机的管理员权限。如果不是由管理员运行，部分程序无法正确安装。
1354	2052	文件夹“%s”不存在，是否创建该文件夹?
1355	2052	正在运行“%s”软件包的另一副本。是否要运行新的副本?
1356	2052	“%s”软件包与您的 Windows 版本不兼容。
1357	2052	“%s”软件包与您计算机系统中的文件 %s 的版本不兼容。

module_name	hint	ord	function_name
ADVAPI32.dll	225		FreeSid
ADVAPI32.dll	29		AllocateAndInitializeSid
ADVAPI32.dll	216		EqualSid
ADVAPI32.dll	281		GetTokenInformation
ADVAPI32.dll	426		OpenProcessToken
ADVAPI32.dll	28		AdjustTokenPrivileges
ADVAPI32.dll	333		LookupPrivilegeValueA
ADVAPI32.dll	458		RegCloseKey
ADVAPI32.dll	467		RegDeleteValueA
ADVAPI32.dll	484		RegOpenKeyExA
ADVAPI32.dll	507		RegSetValueExA
ADVAPI32.dll	494		RegQueryValueExA
ADVAPI32.dll	462		RegCreateKeyExA
ADVAPI32.dll	489		RegQueryInfoKeyA
KERNEL32.dll	590		LocalFree
KERNEL32.dll	586		LocalAlloc
KERNEL32.dll	360		GetLastError
KERNEL32.dll	315		GetCurrentProcess
KERNEL32.dll	951		lstrlenA
KERNEL32.dll	372		GetModuleFileNameA
KERNEL32.dll	441		GetSystemDirectoryA
KERNEL32.dll	929		_lclose
KERNEL32.dll	931		_llseek
KERNEL32.dll	932		_lopen
KERNEL32.dll	916		WritePrivateProfileStringA
KERNEL32.dll	488		GetWindowsDirectoryA
KERNEL32.dll	71		CreateDirectoryA
KERNEL32.dll	342		GetFileAttributesA
KERNEL32.dll	185		ExpandEnvironmentStringsA
KERNEL32.dll	945		lstrcpyA
KERNEL32.dll	500		GlobalFree
KERNEL32.dll	511		GlobalUnlock
KERNEL32.dll	504		GlobalLock
KERNEL32.dll	493		GlobalAlloc
KERNEL32.dll	555		IsDBCSLeadByte
KERNEL32.dll	428		GetShortPathNameA
KERNEL32.dll	404		GetPrivateProfileStringA
KERNEL32.dll	398		GetPrivateProfileIntA
KERNEL32.dll	942		lstrcmpiA
KERNEL32.dll	693		RemoveDirectoryA
KERNEL32.dll	204		FindClose
KERNEL32.dll	217		FindNextFileA
KERNEL32.dll	129		DeleteFileA
KERNEL32.dll	775		SetFileAttributesA
KERNEL32.dll	939		lstrcmpA
KERNEL32.dll	208		FindFirstFileA
KERNEL32.dll	242		FreeResource
KERNEL32.dll	408		GetProcAddress
KERNEL32.dll	585		LoadResource
KERNEL32.dll	833		SizeofResource
KERNEL32.dll	223		FindResourceA
KERNEL32.dll	936		lstrcatA
KERNEL32.dll	49		CloseHandle
KERNEL32.dll	911		WriteFile
KERNEL32.dll	777		SetFilePointer
KERNEL32.dll	781		SetFileTime
KERNEL32.dll	588		LocalFileTimeToFileTime
KERNEL32.dll	141		DosDateTimeToFileTime
KERNEL32.dll	762		SetCurrentDirectoryA
KERNEL32.dll	457		GetTempFileNameA
KERNEL32.dll	182		ExitProcess
KERNEL32.dll	79		CreateFileA
KERNEL32.dll	581		LoadLibraryExA
KERNEL32.dll	948		lstrcpynA
KERNEL32.dll	480		GetVolumeInformationA
KERNEL32.dll	235		FormatMessageA
KERNEL32.dll	313		GetCurrentDirectoryA
KERNEL32.dll	478		GetVersionExA
KERNEL32.dll	338		GetExitCodeProcess
KERNEL32.dll	894		WaitForSingleObject
KERNEL32.dll	98		CreateProcessA
KERNEL32.dll	459		GetTempPathA
KERNEL32.dll	443		GetSystemInfo
KERNEL32.dll	92		CreateMutexA
KERNEL32.dll	772		SetEvent
KERNEL32.dll	75		CreateEventA
KERNEL32.dll	108		CreateThread
KERNEL32.dll	703		ResetEvent
KERNEL32.dll	843		TerminateThread
KERNEL32.dll	331		GetDriveTypeA
KERNEL32.dll	374		GetModuleHandleA
KERNEL32.dll	430		GetStartupInfoA
KERNEL32.dll	265		GetCommandLineA
KERNEL32.dll	660		QueryPerformanceCounter
KERNEL32.dll	468		GetTickCount
KERNEL32.dll	318		GetCurrentThreadId
KERNEL32.dll	316		GetCurrentProcessId
KERNEL32.dll	448		GetSystemTimeAsFileTime
KERNEL32.dll	842		TerminateProcess
KERNEL32.dll	859		UnhandledExceptionFilter
KERNEL32.dll	822		SetUnhandledExceptionFilter
KERNEL32.dll	678		ReadFile
KERNEL32.dll	580		LoadLibraryA
KERNEL32.dll	325		GetDiskFreeSpaceA
KERNEL32.dll	614		MulDiv
KERNEL32.dll	161		EnumResourceLanguagesA
KERNEL32.dll	240		FreeLibrary
KERNEL32.dll	599		LockResource
GDI32.dll	364		GetDeviceCaps
USER32.dll	225		ExitWindowsEx
USER32.dll	728		wsprintfA
USER32.dll	42		CharNextA
USER32.dll	52		CharUpperA
USER32.dll	45		CharPrevA
USER32.dll	640		SetWindowLongA
USER32.dll	366		GetWindowLongA
USER32.dll	27		CallWindowProcA
USER32.dll	161		DispatchMessageA
USER32.dll	490		MsgWaitForMultipleObjects
USER32.dll	509		PeekMessageA
USER32.dll	571		SendMessageA
USER32.dll	643		SetWindowPos
USER32.dll	554		ReleaseDC
USER32.dll	268		GetDC
USER32.dll	372		GetWindowRect
USER32.dll	566		SendDlgItemMessageA
USER32.dll	273		GetDlgItem
USER32.dll	599		SetForegroundWindow
USER32.dll	646		SetWindowTextA
USER32.dll	476		MessageBoxA
USER32.dll	155		DialogBoxIndirectParamA
USER32.dll	658		ShowWindow
USER32.dll	196		EnableWindow
USER32.dll	275		GetDlgItemTextA
USER32.dll	198		EndDialog
USER32.dll	270		GetDesktopWindow
USER32.dll	475		MessageBeep
USER32.dll	595		SetDlgItemTextA
USER32.dll	456		LoadStringA
USER32.dll	349		GetSystemMetrics
COMCTL32.dll		17
VERSION.dll			GetFileVersionInfoA
VERSION.dll	10		VerQueryValueA
VERSION.dll	1		GetFileVersionInfoSizeA

StringTable 080404B0

CompanyName	Microsoft Corporation
FileDescription	Win32 Cabinet Self-Extractor
FileVersion	6.00.2900.5512 (xpsp.080413-2105)
InternalName	Wextract
LegalCopyright	(C) Microsoft Corporation. All rights reserved.
OriginalFilename	WEXTRACT.EXE
ProductName	Microsoft(R) Windows(R) Operating System
ProductVersion	6.00.2900.5512

VS_FIXEDFILEINFO

FileVersion	6.0.2900.5512
ProductVersion	6.0.2900.5512
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=US/O=Thawte, Inc./CN=Thawte Code Signing CA - G2

serial: 2EDFB9FDCFA00CCB5AB009EE3ADB97B9

Certificates (4)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            36:12:22:96:c5:e3:38:a5:20:a1:d2:5f:4c:d7:09:54
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
        Validity
            Not Before: Aug  1 00:00:00 1996 GMT
            Not After : Jan  1 23:59:59 2021 GMT
        Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:d2:36:36:6a:8b:d7:c2:5b:9e:da:81:41:62:8f:
                    38:ee:49:04:55:d6:d0:ef:1c:1b:95:16:47:ef:18:
                    48:35:3a:52:f4:2b:6a:06:8f:3b:2f:ea:56:e3:af:
                    86:8d:9e:17:f7:9e:b4:65:75:02:4d:ef:cb:09:a2:
                    21:51:d8:9b:d0:67:d0:ba:0d:92:06:14:73:d4:93:
                    cb:97:2a:00:9c:5c:4e:0c:bc:fa:15:52:fc:f2:44:
                    6e:da:11:4a:6e:08:9f:2f:2d:e3:f9:aa:3a:86:73:
                    b6:46:53:58:c8:89:05:bd:83:11:b8:73:3f:aa:07:
                    8d:f4:42:4d:e7:40:9d:1c:37
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        65:90:ac:88:0f:56:d9:e6:30:34:d4:26:c7:d0:50:f1:92:de:
        6b:d4:39:88:09:22:c6:a6:63:83:03:f7:99:77:d8:b2:e5:18:
        b8:5d:63:f3:d4:73:fb:6c:9c:99:78:f1:4b:78:7d:19:24:c3:
        2b:02:84:f8:bc:22:d9:8a:22:d7:a0:fc:71:ec:91:87:20:f1:
        b8:ec:b1:e5:55:80:ac:3d:52:c8:39:0e:c2:f0:c0:05:4f:d6:
        82:75:8c:bd:5f:d2:dc:76:9a:05:12:c9:af:72:c3:dc:25:7e:
        a4:4d:8e:17:a5:e0:87:7f:e1:9a:5a:e1:60:dc:64:23:3c:42:
        2e:4d

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2e:df:b9:fd:cf:a0:0c:cb:5a:b0:09:ee:3a:db:97:b9
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=Thawte, Inc., CN=Thawte Code Signing CA - G2
        Validity
            Not Before: Oct 18 00:00:00 2012 GMT
            Not After : Nov 13 23:59:59 2014 GMT
        Subject: C=KR, ST=Seoul, L=Gangnam-gu, O=QTI International Inc, CN=QTI International Inc
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:c0:16:75:0a:d3:04:81:0c:20:c9:c5:89:28:51:
                    33:30:4e:db:38:3f:64:18:b0:3c:0f:0f:3b:db:48:
                    82:4b:dc:e2:39:3a:53:b4:2a:81:c2:02:03:96:56:
                    df:52:c3:a5:6b:af:a7:ae:f9:da:5d:02:81:b5:b2:
                    94:d9:19:e9:72:9e:87:c7:b3:5b:1f:a1:fe:1f:16:
                    b2:2e:0f:fb:f1:47:03:65:2b:ca:75:a4:b7:41:bf:
                    67:89:03:a7:01:f7:8c:cd:2c:f7:d6:be:ed:12:2d:
                    56:a0:ff:d1:b0:0a:81:38:af:51:9b:a4:81:35:aa:
                    b0:f7:37:b0:a2:c7:c9:75:87:0a:fd:36:45:17:c1:
                    f9:4c:0b:88:27:e7:a7:78:63:43:3a:68:6f:87:01:
                    12:91:c3:f6:a5:2a:89:51:9c:da:30:76:28:ce:00:
                    6f:44:48:ce:4f:d4:fd:43:33:f9:78:0c:d6:20:3f:
                    5c:13:81:ec:3e:d9:21:5f:d4:2f:c6:ff:24:b6:3c:
                    33:e2:a5:1e:61:7b:cb:af:64:c5:4f:8f:5d:88:4c:
                    76:5e:51:59:bb:5a:99:68:a2:d2:29:64:ef:ba:88:
                    ae:fa:5b:a8:6d:fe:f3:58:c3:0e:8f:7a:26:7e:9a:
                    0a:d8:1c:7b:94:ed:b7:2e:b2:af:7c:e5:fe:cd:9d:
                    18:19
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://cs-g2-crl.thawte.com/ThawteCSG2.crl
            X509v3 Extended Key Usage: 
                Code Signing, Microsoft Commercial Code Signing
            2.5.29.4: 
                0.0.0..
+.....7.......
            Authority Information Access: 
                OCSP - URI:http://ocsp.thawte.com
            Netscape Cert Type: 
                Object Signing
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        10:90:18:a4:53:f7:11:e1:ab:3d:87:48:37:38:65:b4:7f:bb:
        d4:a4:c4:bd:d0:5b:21:e9:87:c2:6e:c3:90:4c:2c:5d:90:c6:
        22:65:0c:ab:0e:1f:46:13:49:9d:6c:55:78:71:67:e1:f1:67:
        7d:17:57:41:8e:d8:8c:ce:75:48:59:24:98:e7:4c:22:b3:d7:
        18:10:d0:13:dc:ac:d4:89:b4:de:bb:c1:2d:89:fa:31:13:06:
        0f:79:ce:72:57:81:0d:3f:20:f9:b5:bb:45:9f:15:b4:02:34:
        f8:34:df:74:92:5e:05:2b:56:93:c0:4f:b4:95:f9:ad:21:30:
        60:ea:cf:e8:13:09:d6:e9:7f:c4:3e:20:12:8c:cc:24:1d:40:
        0d:b4:43:0f:5a:de:9c:32:64:ed:18:25:dd:31:8b:fd:b5:fd:
        90:66:29:40:ab:ac:3b:f2:a5:46:c9:2f:11:ff:00:eb:a8:d2:
        35:a2:0a:d5:d6:9c:77:cf:ba:58:24:d9:58:05:81:e4:6d:43:
        22:cb:f0:2b:5f:7a:51:95:75:89:9a:cb:bd:b0:a7:fe:09:2c:
        6d:41:83:16:c1:ef:81:85:cf:0f:c8:fe:22:ae:57:9a:43:ca:
        f0:c4:48:ec:88:30:13:d8:39:26:44:37:69:9c:0a:af:f0:a8:
        75:73:fe:a4

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
        Validity
            Not Before: Nov 17 00:00:00 2006 GMT
            Not After : Dec 30 23:59:59 2020 GMT
        Subject: C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:ac:a0:f0:fb:80:59:d4:9c:c7:a4:cf:9d:a1:59:
                    73:09:10:45:0c:0d:2c:6e:68:f1:6c:5b:48:68:49:
                    59:37:fc:0b:33:19:c2:77:7f:cc:10:2d:95:34:1c:
                    e6:eb:4d:09:a7:1c:d2:b8:c9:97:36:02:b7:89:d4:
                    24:5f:06:c0:cc:44:94:94:8d:02:62:6f:eb:5a:dd:
                    11:8d:28:9a:5c:84:90:10:7a:0d:bd:74:66:2f:6a:
                    38:a0:e2:d5:54:44:eb:1d:07:9f:07:ba:6f:ee:e9:
                    fd:4e:0b:29:f5:3e:84:a0:01:f1:9c:ab:f8:1c:7e:
                    89:a4:e8:a1:d8:71:65:0d:a3:51:7b:ee:bc:d2:22:
                    60:0d:b9:5b:9d:df:ba:fc:51:5b:0b:af:98:b2:e9:
                    2e:e9:04:e8:62:87:de:2b:c8:d7:4e:c1:4c:64:1e:
                    dd:cf:87:58:ba:4a:4f:ca:68:07:1d:1c:9d:4a:c6:
                    d5:2f:91:cc:7c:71:72:1c:c5:c0:67:eb:32:fd:c9:
                    92:5c:94:da:85:c0:9b:bf:53:7d:2b:09:f4:8c:9d:
                    91:1f:97:6a:52:cb:de:09:36:a4:77:d8:7b:87:50:
                    44:d5:3e:6e:29:69:fb:39:49:26:1e:09:a5:80:7b:
                    40:2d:eb:e8:27:85:c9:fe:61:fd:7e:e6:7c:97:1d:
                    d5:9d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies: 
                Policy: X509v3 Any Policy
                  CPS: https://www.thawte.com/cps
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier: 
                7B:5B:45:CF:AF:CE:CB:7A:FD:31:92:1A:6A:B6:F3:46:EB:57:48:50
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.thawte.com/ThawtePremiumServerCA.crl
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        84:a8:4c:c9:3e:2a:bc:9a:e2:cc:8f:0b:b2:25:77:c4:61:89:
        89:63:5a:d4:a3:15:40:d4:fb:5e:3f:b4:43:ea:63:17:2b:6b:
        99:74:9e:09:a8:dd:d4:56:15:2e:7a:79:31:5f:63:96:53:1b:
        34:d9:15:ea:4f:6d:70:ca:be:f6:82:a9:ed:da:85:77:cc:76:
        1c:6a:81:0a:21:d8:41:99:7f:5e:2e:82:c1:e8:aa:f7:93:81:
        05:aa:92:b4:1f:b7:9a:c0:07:17:f5:cb:c6:b4:4c:0e:d7:56:
        dc:71:20:74:38:d6:74:c6:d6:8f:6b:af:8b:8d:a0:6c:29:0b:
        61:e0

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA
        Validity
            Not Before: Feb  8 00:00:00 2010 GMT
            Not After : Feb  7 23:59:59 2020 GMT
        Subject: C=US, O=Thawte, Inc., CN=Thawte Code Signing CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:b7:8b:cf:75:5b:9f:25:da:7e:39:b0:93:db:38:
                    d3:a9:23:d0:82:fa:e9:24:7e:5c:0b:8e:83:f8:e6:
                    7a:59:e6:a3:c5:98:a7:99:d2:44:ff:00:a6:a5:39:
                    04:8a:da:29:88:ea:db:a2:f3:1c:99:15:26:c2:b1:
                    f4:fc:e1:0c:47:a9:09:11:06:0a:20:92:b9:c7:a0:
                    04:8c:5c:94:19:ab:5b:25:2c:1d:62:7e:70:0d:ce:
                    61:6c:dd:2b:82:c9:ce:5d:48:5f:f7:c2:be:bc:41:
                    23:1e:4f:29:5d:d7:4f:bc:f4:c5:2a:fc:63:e6:7c:
                    26:4e:99:a7:79:41:9e:10:4a:7a:79:c9:c6:86:f7:
                    86:95:d2:26:ce:3c:18:2a:d6:7c:ce:af:cd:ad:bb:
                    f7:82:2c:70:26:37:45:e5:0f:47:22:c6:01:28:bd:
                    2e:83:5c:6a:a4:47:c1:e7:d0:d8:6b:81:46:3f:21:
                    17:f5:07:c5:43:5a:a6:67:2c:b8:7b:60:11:b5:83:
                    ee:f5:74:0a:72:71:44:3d:58:fe:e8:1a:ab:38:c3:
                    59:db:7f:6e:38:7d:76:c7:72:69:98:36:96:57:d3:
                    66:1c:d2:54:91:04:2e:54:19:b0:dc:3d:b5:22:5e:
                    86:d5:2a:7e:20:df:5d:e6:7a:b1:65:fe:c5:02:4e:
                    31:2d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.thawte.com/ThawtePCA.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            Authority Information Access: 
                OCSP - URI:http://ocsp.thawte.com
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, Code Signing
            X509v3 Subject Alternative Name: 
                DirName:/CN=VeriSignMPKI-2-10
            X509v3 Subject Key Identifier: 
                D4:0D:65:3F:7A:BD:34:C6:FE:47:E7:4C:0D:C0:BD:F2:DE:15:AB:71
            X509v3 Authority Key Identifier: 
                7B:5B:45:CF:AF:CE:CB:7A:FD:31:92:1A:6A:B6:F3:46:EB:57:48:50
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        56:fe:53:5c:e1:c7:9e:bc:a7:ed:7e:53:6d:6a:14:4b:51:8c:
        40:5e:80:5f:aa:a4:e8:2f:ef:38:c8:04:c9:ca:3e:cf:df:3a:
        58:4e:b0:d4:b6:63:c5:29:57:fa:02:05:9a:45:4d:68:db:2a:
        1b:d4:34:3d:9f:00:c3:5a:cb:95:49:a5:6e:e1:b0:c5:fc:41:
        4d:41:4a:6f:d3:77:c8:d7:38:8d:e4:19:de:18:f3:1f:15:65:
        83:6d:45:0c:53:f9:0a:9a:2e:a5:5d:bf:6f:32:81:18:92:19:
        6a:55:00:ad:63:1c:52:06:7e:55:d9:29:68:ae:4a:7c:18:9a:
        79:88:6b:23:23:d8:27:38:2a:29:87:76:ca:fb:c7:b6:62:23:
        1f:ed:7a:56:4c:dd:9c:32:5b:f5:3d:0c:46:18:95:3b:2a:23:
        68:83:64:41:d9:00:6d:0f:19:24:15:68:72:bd:c5:71:67:6e:
        ac:4c:db:90:eb:51:a5:1a:62:07:d0:be:6a:00:47:3c:72:2f:
        ec:4f:61:3e:73:85:ce:5a:0a:b7:ba:c0:1c:13:75:e3:22:39:
        28:dd:6d:1d:09:46:9d:4f:ba:e8:40:81:91:c6:a4:ce:94:72:
        1b:01:cf:2a:6e:15:67:95:89:ae:7d:b7:b7:cd:f9:0a:3d:75:
        b6:6b:3c:25

pkcs7-signedData

1
- MD5: nil
- 1.3.6.1.4.1.311.2.1.4
  - #0
    - 1.3.6.1.4.1.311.2.1.15
      - :
        00 3c 00 3c 00 3c 00 4f 00 62 00 73 00 6f 00 6c |.<.<.<.O.b.s.o.l| 00 65 00 74 00 65 00 3e 00 3e 00 3e |.e.t.e.>.>.> |
    - MD5
      - ad c8 77 df 00 03 81 49 79 34 f7 af 45 f0 66 c6 |..w....Iy4..E.f.|
- Certificates
  - Certificate #0
    - 2
      - 36:12:22:96:C5:E3:38:A5:20:A1:D2:5F:4C:D7:09:54
      - RSA-SHA1: nil
      - Issuer
        C: ZA
        ST: Western Cape
        L: Cape Town
        O: Thawte Consulting cc
        OU: Certification Services Division
        CN: Thawte Premium Server CA
        emailAddress: premium-server@thawte.com
      - 1996-08-01 00:00:00 UTC: 2021-01-01 23:59:59 UTC
      - Subject
        C: ZA
        ST: Western Cape
        L: Cape Town
        O: Thawte Consulting cc
        OU: Certification Services Division
        CN: Thawte Premium Server CA
        emailAddress: premium-server@thawte.com
      - #5
        rsaEncryption: nil
        D2:36:36:6A:8B:D7:C2:5B:9E:DA:81:41:62:8F:38:EE:
        49:04:55:D6:D0:EF:1C:1B:95:16:47:EF:18:48:35:3A:
        52:F4:2B:6A:06:8F:3B:2F:EA:56:E3:AF:86:8D:9E:17:
        F7:9E:B4:65:75:02:4D:EF:CB:09:A2:21:51:D8:9B:D0:
        67:D0:BA:0D:92:06:14:73:D4:93:CB:97:2A:00:9C:5C:
        4E:0C:BC:FA:15:52:FC:F2:44:6E:DA:11:4A:6E:08:9F:
        2F:2D:E3:F9:AA:3A:86:73:B6:46:53:58:C8:89:05:BD:
        83:11:B8:73:3F:AA:07:8D:F4:42:4D:E7:40:9D:1C:37: 0x010001
      - basicConstraints: true, true
    - RSA-SHA1:
```
65 90 ac 88 0f 56 d9 e6  30 34 d4 26 c7 d0 50 f1  |e....V..04.&..P.|
92 de 6b d4 39 88 09 22  c6 a6 63 83 03 f7 99 77  |..k.9.."..c....w|
d8 b2 e5 18 b8 5d 63 f3  d4 73 fb 6c 9c 99 78 f1  |.....]c..s.l..x.|
4b 78 7d 19 24 c3 2b 02  84 f8 bc 22 d9 8a 22 d7  |Kx}.$.+...."..".|
a0 fc 71 ec 91 87 20 f1  b8 ec b1 e5 55 80 ac 3d  |..q... .....U..=|
52 c8 39 0e c2 f0 c0 05  4f d6 82 75 8c bd 5f d2  |R.9.....O..u.._.|
dc 76 9a 05 12 c9 af 72  c3 dc 25 7e a4 4d 8e 17  |.v.....r..%~.M..|
a5 e0 87 7f e1 9a 5a e1  60 dc 64 23 3c 42 2e 4d  |......Z.`.d#
```
  - Certificate #1
    - 2
      - 2E:DF:B9:FD:CF:A0:0C:CB:5A:B0:09:EE:3A:DB:97:B9
      - RSA-SHA1: nil
      - Issuer
        C: US
        O: Thawte, Inc.
        CN: Thawte Code Signing CA - G2
      - 2012-10-18 00:00:00 UTC: 2014-11-13 23:59:59 UTC
      - Subject
        C: KR
        ST: Seoul
        L: Gangnam-gu
        O: QTI International Inc
        CN: QTI International Inc
      - #5
        rsaEncryption: nil
        C0:16:75:0A:D3:04:81:0C:20:C9:C5:89:28:51:33:30:
        4E:DB:38:3F:64:18:B0:3C:0F:0F:3B:DB:48:82:4B:DC:
        E2:39:3A:53:B4:2A:81:C2:02:03:96:56:DF:52:C3:A5:
        6B:AF:A7:AE:F9:DA:5D:02:81:B5:B2:94:D9:19:E9:72:
        9E:87:C7:B3:5B:1F:A1:FE:1F:16:B2:2E:0F:FB:F1:47:
        03:65:2B:CA:75:A4:B7:41:BF:67:89:03:A7:01:F7:8C:
        CD:2C:F7:D6:BE:ED:12:2D:56:A0:FF:D1:B0:0A:81:38:
        AF:51:9B:A4:81:35:AA:B0:F7:37:B0:A2:C7:C9:75:87:
        0A:FD:36:45:17:C1:F9:4C:0B:88:27:E7:A7:78:63:43:
        3A:68:6F:87:01:12:91:C3:F6:A5:2A:89:51:9C:DA:30:
        76:28:CE:00:6F:44:48:CE:4F:D4:FD:43:33:F9:78:0C:
        D6:20:3F:5C:13:81:EC:3E:D9:21:5F:D4:2F:C6:FF:24:
        B6:3C:33:E2:A5:1E:61:7B:CB:AF:64:C5:4F:8F:5D:88:
        4C:76:5E:51:59:BB:5A:99:68:A2:D2:29:64:EF:BA:88:
        AE:FA:5B:A8:6D:FE:F3:58:C3:0E:8F:7A:26:7E:9A:0A:
        D8:1C:7B:94:ED:B7:2E:B2:AF:7C:E5:FE:CD:9D:18:19: 0x010001
      - X509v3 extensions
        basicConstraints
        true
        nil
        crlDistributionPoints: http://cs-g2-crl.thawte.com/ThawteCSG2.crl
        extendedKeyUsage
        codeSigning: msCodeCom
        2.5.29.4
        msCodeCom: 0x80
        authorityInfoAccess
        OCSP: http://ocsp.thawte.com
        nsCertType: 0x10
    - RSA-SHA1:
```
10 90 18 a4 53 f7 11 e1  ab 3d 87 48 37 38 65 b4  |....S....=.H78e.|
7f bb d4 a4 c4 bd d0 5b  21 e9 87 c2 6e c3 90 4c  |.......[!...n..L|
2c 5d 90 c6 22 65 0c ab  0e 1f 46 13 49 9d 6c 55  |,].."e....F.I.lU|
78 71 67 e1 f1 67 7d 17  57 41 8e d8 8c ce 75 48  |xqg..g}.WA....uH|
59 24 98 e7 4c 22 b3 d7  18 10 d0 13 dc ac d4 89  |Y$..L"..........|
b4 de bb c1 2d 89 fa 31  13 06 0f 79 ce 72 57 81  |....-..1...y.rW.|
0d 3f 20 f9 b5 bb 45 9f  15 b4 02 34 f8 34 df 74  |.? ...E....4.4.t|
92 5e 05 2b 56 93 c0 4f  b4 95 f9 ad 21 30 60 ea  |.^.+V..O....!0`.|
cf e8 13 09 d6 e9 7f c4  3e 20 12 8c cc 24 1d 40  |........> ...$.@|
0d b4 43 0f 5a de 9c 32  64 ed 18 25 dd 31 8b fd  |..C.Z..2d..%.1..|
b5 fd 90 66 29 40 ab ac  3b f2 a5 46 c9 2f 11 ff  |...f)@..;..F./..|
00 eb a8 d2 35 a2 0a d5  d6 9c 77 cf ba 58 24 d9  |....5.....w..X$.|
58 05 81 e4 6d 43 22 cb  f0 2b 5f 7a 51 95 75 89  |X...mC"..+_zQ.u.|
9a cb bd b0 a7 fe 09 2c  6d 41 83 16 c1 ef 81 85  |.......,mA......|
cf 0f c8 fe 22 ae 57 9a  43 ca f0 c4 48 ec 88 30  |....".W.C...H..0|
13 d8 39 26 44 37 69 9c  0a af f0 a8 75 73 fe a4  |..9&D7i.....us..|
```
  - Certificate #2
    - 2
      - 33:65:50:08:79:AD:73:E2:30:B9:E0:1D:0D:7F:AC:91
      - RSA-SHA1: nil
      - Issuer
        C: ZA
        ST: Western Cape
        L: Cape Town
        O: Thawte Consulting cc
        OU: Certification Services Division
        CN: Thawte Premium Server CA
        emailAddress: premium-server@thawte.com
      - 2006-11-17 00:00:00 UTC: 2020-12-30 23:59:59 UTC
      - Subject
        C: US
        O: thawte, Inc.
        OU: Certification Services Division
        OU: (c) 2006 thawte, Inc. - For authorized use only
        CN: thawte Primary Root CA
      - #5
        rsaEncryption: nil
        AC:A0:F0:FB:80:59:D4:9C:C7:A4:CF:9D:A1:59:73:09:
        10:45:0C:0D:2C:6E:68:F1:6C:5B:48:68:49:59:37:FC:
        0B:33:19:C2:77:7F:CC:10:2D:95:34:1C:E6:EB:4D:09:
        A7:1C:D2:B8:C9:97:36:02:B7:89:D4:24:5F:06:C0:CC:
        44:94:94:8D:02:62:6F:EB:5A:DD:11:8D:28:9A:5C:84:
        90:10:7A:0D:BD:74:66:2F:6A:38:A0:E2:D5:54:44:EB:
        1D:07:9F:07:BA:6F:EE:E9:FD:4E:0B:29:F5:3E:84:A0:
        01:F1:9C:AB:F8:1C:7E:89:A4:E8:A1:D8:71:65:0D:A3:
        51:7B:EE:BC:D2:22:60:0D:B9:5B:9D:DF:BA:FC:51:5B:
        0B:AF:98:B2:E9:2E:E9:04:E8:62:87:DE:2B:C8:D7:4E:
        C1:4C:64:1E:DD:CF:87:58:BA:4A:4F:CA:68:07:1D:1C:
        9D:4A:C6:D5:2F:91:CC:7C:71:72:1C:C5:C0:67:EB:32:
        FD:C9:92:5C:94:DA:85:C0:9B:BF:53:7D:2B:09:F4:8C:
        9D:91:1F:97:6A:52:CB:DE:09:36:A4:77:D8:7B:87:50:
        44:D5:3E:6E:29:69:FB:39:49:26:1E:09:A5:80:7B:40:
        2D:EB:E8:27:85:C9:FE:61:FD:7E:E6:7C:97:1D:D5:9D: 0x010001
      - X509v3 extensions
        basicConstraints: true, true
        certificatePolicies
        anyPolicy
        id-qt-cps: https://www.thawte.com/cps
        keyUsage: true, 6
        subjectKeyIdentifier:
        7b 5b 45 cf af ce cb 7a fd 31 92 1a 6a b6 f3 46 |{[E....z.1..j..F| eb 57 48 50 |.WHP |
        crlDistributionPoints: http://crl.thawte.com/ThawtePremiumServerCA.crl
    - RSA-SHA1:
```
84 a8 4c c9 3e 2a bc 9a  e2 cc 8f 0b b2 25 77 c4  |..L.>*.......%w.|
61 89 89 63 5a d4 a3 15  40 d4 fb 5e 3f b4 43 ea  |a..cZ...@..^?.C.|
63 17 2b 6b 99 74 9e 09  a8 dd d4 56 15 2e 7a 79  |c.+k.t.....V..zy|
31 5f 63 96 53 1b 34 d9  15 ea 4f 6d 70 ca be f6  |1_c.S.4...Omp...|
82 a9 ed da 85 77 cc 76  1c 6a 81 0a 21 d8 41 99  |.....w.v.j..!.A.|
7f 5e 2e 82 c1 e8 aa f7  93 81 05 aa 92 b4 1f b7  |.^..............|
9a c0 07 17 f5 cb c6 b4  4c 0e d7 56 dc 71 20 74  |........L..V.q t|
38 d6 74 c6 d6 8f 6b af  8b 8d a0 6c 29 0b 61 e0  |8.t...k....l).a.|
```
  - Certificate #3
    - 2
      - 47:97:4D:78:73:A5:BC:AB:0D:2F:B3:70:19:2F:CE:5E
      - RSA-SHA1: nil
      - Issuer
        C: US
        O: thawte, Inc.
        OU: Certification Services Division
        OU: (c) 2006 thawte, Inc. - For authorized use only
        CN: thawte Primary Root CA
      - 2010-02-08 00:00:00 UTC: 2020-02-07 23:59:59 UTC
      - Subject
        C: US
        O: Thawte, Inc.
        CN: Thawte Code Signing CA - G2
      - #5
        rsaEncryption: nil
        B7:8B:CF:75:5B:9F:25:DA:7E:39:B0:93:DB:38:D3:A9:
        23:D0:82:FA:E9:24:7E:5C:0B:8E:83:F8:E6:7A:59:E6:
        A3:C5:98:A7:99:D2:44:FF:00:A6:A5:39:04:8A:DA:29:
        88:EA:DB:A2:F3:1C:99:15:26:C2:B1:F4:FC:E1:0C:47:
        A9:09:11:06:0A:20:92:B9:C7:A0:04:8C:5C:94:19:AB:
        5B:25:2C:1D:62:7E:70:0D:CE:61:6C:DD:2B:82:C9:CE:
        5D:48:5F:F7:C2:BE:BC:41:23:1E:4F:29:5D:D7:4F:BC:
        F4:C5:2A:FC:63:E6:7C:26:4E:99:A7:79:41:9E:10:4A:
        7A:79:C9:C6:86:F7:86:95:D2:26:CE:3C:18:2A:D6:7C:
        CE:AF:CD:AD:BB:F7:82:2C:70:26:37:45:E5:0F:47:22:
        C6:01:28:BD:2E:83:5C:6A:A4:47:C1:E7:D0:D8:6B:81:
        46:3F:21:17:F5:07:C5:43:5A:A6:67:2C:B8:7B:60:11:
        B5:83:EE:F5:74:0A:72:71:44:3D:58:FE:E8:1A:AB:38:
        C3:59:DB:7F:6E:38:7D:76:C7:72:69:98:36:96:57:D3:
        66:1C:D2:54:91:04:2E:54:19:B0:DC:3D:B5:22:5E:86:
        D5:2A:7E:20:DF:5D:E6:7A:B1:65:FE:C5:02:4E:31:2D: 0x010001
      - X509v3 extensions
        basicConstraints
        true
        true: 0
        crlDistributionPoints: http://crl.thawte.com/ThawtePCA.crl
        keyUsage: true, 6
        authorityInfoAccess
        OCSP: http://ocsp.thawte.com
        extendedKeyUsage
        clientAuth: codeSigning
        subjectAltName
        CN: VeriSignMPKI-2-10
        subjectKeyIdentifier:
        d4 0d 65 3f 7a bd 34 c6 fe 47 e7 4c 0d c0 bd f2 |..e?z.4..G.L....| de 15 ab 71 |...q |
        authorityKeyIdentifier:
        7b 5b 45 cf af ce cb 7a fd 31 92 1a 6a b6 f3 46 |{[E....z.1..j..F| eb 57 48 50 |.WHP |
    - RSA-SHA1:
```
56 fe 53 5c e1 c7 9e bc  a7 ed 7e 53 6d 6a 14 4b  |V.S\......~Smj.K|
51 8c 40 5e 80 5f aa a4  e8 2f ef 38 c8 04 c9 ca  |Q.@^._.../.8....|
3e cf df 3a 58 4e b0 d4  b6 63 c5 29 57 fa 02 05  |>..:XN...c.)W...|
9a 45 4d 68 db 2a 1b d4  34 3d 9f 00 c3 5a cb 95  |.EMh.*..4=...Z..|
49 a5 6e e1 b0 c5 fc 41  4d 41 4a 6f d3 77 c8 d7  |I.n....AMAJo.w..|
38 8d e4 19 de 18 f3 1f  15 65 83 6d 45 0c 53 f9  |8........e.mE.S.|
0a 9a 2e a5 5d bf 6f 32  81 18 92 19 6a 55 00 ad  |....].o2....jU..|
63 1c 52 06 7e 55 d9 29  68 ae 4a 7c 18 9a 79 88  |c.R.~U.)h.J|..y.|
6b 23 23 d8 27 38 2a 29  87 76 ca fb c7 b6 62 23  |k##.'8*).v....b#|
1f ed 7a 56 4c dd 9c 32  5b f5 3d 0c 46 18 95 3b  |..zVL..2[.=.F..;|
2a 23 68 83 64 41 d9 00  6d 0f 19 24 15 68 72 bd  |*#h.dA..m..$.hr.|
c5 71 67 6e ac 4c db 90  eb 51 a5 1a 62 07 d0 be  |.qgn.L...Q..b...|
6a 00 47 3c 72 2f ec 4f  61 3e 73 85 ce 5a 0a b7  |j.Gs..Z..|
ba c0 1c 13 75 e3 22 39  28 dd 6d 1d 09 46 9d 4f  |....u."9(.m..F.O|
ba e8 40 81 91 c6 a4 ce  94 72 1b 01 cf 2a 6e 15  |..@......r...*n.|
67 95 89 ae 7d b7 b7 cd  f9 0a 3d 75 b6 6b 3c 25  |g...}.....=u.k<%|
```
- 1
  - unnamed
    - #0
      - C: US
      - O: Thawte, Inc.
      - CN: Thawte Code Signing CA - G2
    - 2E:DF:B9:FD:CF:A0:0C:CB:5A:B0:09:EE:3A:DB:97:B9
  - MD5: nil
  - #2
    - 1.3.6.1.4.1.311.2.1.12
      - nil
    - contentType: 1.3.6.1.4.1.311.2.1.4
    - 1.3.6.1.4.1.311.2.1.11: msCodeCom
    - messageDigest:
```
2b 13 6b 33 2c 9b 04 8e  86 71 5b 53 a5 d8 cc 4c  |+.k3,....q[S...L|
```
  - rsaEncryption:
```
5c 5c 2e f1 59 f6 5e c7  ed c7 72 91 f2 86 94 12  |\\..Y.^...r.....|
5a ec a1 8b 9f eb c7 61  5b 63 7d d6 3a 58 b7 5f  |Z......a[c}.:X._|
25 e8 43 96 a6 1c 6c 19  26 74 99 42 18 0f 61 45  |%.C...l.&t.B..aE|
50 bd 9f 7d 74 59 ca df  12 81 67 62 a0 8f 66 f4  |P..}tY....gb..f.|
c9 40 d3 3d f7 93 f8 67  69 8c 15 19 e9 fb 73 de  |.@.=...gi.....s.|
9d 34 0d 9a 87 2f ff c3  00 10 a2 9f d5 2b 33 2e  |.4.../.......+3.|
4d 7f 86 7e fd c7 26 75  c1 58 97 7e 34 b5 16 04  |M..~..&u.X.~4...|
d1 0c 72 b4 08 c7 7a 63  4a 1b 70 fa a9 39 a9 3a  |..r...zcJ.p..9.:|
6b ab ba 40 55 e6 13 a7  fe 2a 7d 52 03 8c f7 a9  |k..@U....*}R....|
72 7d f1 95 1a df 74 fa  2c 8d 1f 6c fe 3b 2d 34  |r}....t.,..l.;-4|
98 3b 44 53 52 d5 4c b9  21 2c 07 ae 4a 71 bc 8f  |.;DSR.L.!,..Jq..|
f0 ce 2e 74 49 2f b1 4c  a5 dd a9 29 c8 48 55 39  |...tI/.L...).HU9|
bf 35 0a 8d fa 7b 4a f7  97 de 87 89 5c 1f 1f bc  |.5...{J.....\...|
07 bc 8d c3 4f ce 38 e2  a0 a1 99 a2 99 8c 8d fd  |....O.8.........|
1d 4f 94 28 b2 ae 40 52  38 74 48 1d 1e 2c 1f 92  |.O.(..@R8tH..,..|
20 2f fb 60 7d 43 90 64  c6 fa 5e c8 ba 5d f9 d2  | /.`}C.d..^..]..|
```

show previews

offset	size	type	comment
0	117760	EXE	04/13/2008 18:32:45	#
15c1	15	HTM		#
a9a0	11794	AVI		#
1cc00	4832	PKCS7	Authenticode Signature	#

Scanning the drive for archives:
1 file, 122592 bytes (120 KiB)


--
Type = PE
Physical Size = 122592
CPU = x86
Characteristics = Executable 32-bit NoRelocs NoLineNums NoLocalSyms
Created = 2008-04-13 18:32:45
Headers Size = 1024
Checksum = 131838
Name = WEXTRACT.EXE            
Image Size = 131072
Section Alignment = 4096
File Alignment = 512
Code Size = 39424
Initialized Data Size = 77312
Uninitialized Data Size = 0
Linker Version = 7.10
OS Version = 5.1
Image Version = 5.1
Subsystem Version = 4.0
Subsystem = Windows GUI
DLL Characteristics = NoSEH TerminalServerAware
Stack Reserve = 262144
Stack Commit = 4096
Heap Reserve = 1048576
Heap Commit = 4096
Image Base = 16777216
Comment = FileVersion: 6.0.2900.5512
FileVersion: 6.00.2900.5512 (xpsp.080413-2105)
ProductVersion: 6.0.2900.5512
ProductVersion: 6.00.2900.5512
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor                                           
InternalName: Wextract                
LegalCopyright: (C) Microsoft Corporation. All rights reserved.
OriginalFilename: WEXTRACT.EXE            
ProductName: Microsoft(R) Windows(R) Operating System
----
Path = .rsrc/1033/RCDATA/CABINET
Size = 55896
Packed Size = 55896
--
Path = .rsrc/1033/RCDATA/CABINET
Type = Cab
Physical Size = 55896
Method = LZX:21
Blocks = 1
Volumes = 1
Volume Index = 0
ID = 3095

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2014-07-18 11:42:40 ....A        14048               dbgeng.dll
2014-07-18 11:42:40 ....A        31584               dllhost.exe
2014-07-18 11:42:40 ....A        66631               Readme.txt
------------------- ----- ------------ ------------  ------------------------
2014-07-18 11:42:40             112263       122592  3 files

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

1.zip-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 080404B0

VS_FIXEDFILEINFO

Signers (1)

Certificates (4)

1.zip
-