EhSvc.dll

info
MZ
PE
resources
imports
exports
foremost
version info
signature
hexdump
disasm
log
discuss
donate

filename	EhSvc.dll
size	2874048 (0x2bdac0)
md5	4a9d020b1c18bd1563ec4e54bb1b51e2

type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0xa5c75586
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

Rich Header

lib id	version	times used
11	8047	11
10	8047	6
12	7291	7
14	7299	31
0	0	3
1	0	346
93	4035	25
10	9782	167
11	9782	113
6	1735	1
4	8447	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	6
TimeDateStamp	0x4c381928
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x210e
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0xc2000
SizeOfInitializedData	0xe2000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x59d000
BaseOfCode	0x1000
BaseOfData	0xc3000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x59e000
SizeOfHeaders	0x1000
CheckSum	0x2c4265
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
	0x1000	0xec000	0x6d000	RWX IDATA
.rsrc	0xed000	0xa9168	0x74000	RW- IDATA
.idata	0x197000	0x1000	0x1000	RW- IDATA
	0x198000	0x22e000	0x1000	RWX IDATA
kntegkbq	0x3c6000	0x1d7000	0x1d7000	RWX IDATA
puotrqej	0x59d000	0x1000	0x1000	RWX IDATA

Data Directory

type	va	size
EXPORT	0x595dd8	0x17f
IMPORT	0x19706d	0x95
RESOURCE	0xed000	0xa9168
EXCEPTION	0	0
SECURITY	0x2bc060	0x1a60
BASERELOC	0x197ff8	8
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
BINRES	#102	471136
BINRES	#103	27704
BITMAP	#105	165720
ICON	#1	1384
ICON	#2	1736
ICON	#3	2216
ICON	#4	3752
ICON	#5	1128
ICON	#6	2440
ICON	#7	3240
ICON	#8	9640
DIALOG	#104	294
DIALOG	#106	40
DIALOG	#107	32
GROUP_ICON	#128	118
VERSION	#1	1056

module_name	hint	ord	function_name
kernel32.dll			lstrcpy
comctl32.dll			InitCommonControls

ord	entry_va	function_name
1	0x12f70	1
2	0x158c0	2
3	0x12540	3
4	0x152e0	4
5	0x12570	5
6	0x10190	6
7	0x12590	7
8	0x15ac0	8
9	0x12b90	9
10	0x15b20	10
12	0x15ae0	12
13	0x12ce0	13
14	0x154b0	14
15	0x10870	15
16	0x15530	16
17	0x129f0	17
18	0x15b00	18
19	0x15110	19
20	0x16120	20
21	0x165b0	21
22	0x16260	22
23	0x13820	23
24	0x13180	24
25	0x165c0	25
26	0x16280	26
27	0x159b0	27

module_name	EHSvc.dll
flags	0
timestamp	2010-07-10 06:54:32
version	0.0
ordinal_base	1
nFunctions	27
nNames	26
Names(26)	0x595e6c
Functions(27)	0x595e00
NameOrdinals(26)	0x595ed4

VS_FIXEDFILEINFO

dwSignature	0xfeef
FileVersion	1079.5.0.19
ProductVersion	0.5.63.0
StrucVersion	0x30001
FileFlagsMask	0
FileFlags	0x40000
FileOS	0x20004
FileType	0
FileSubtype	0

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https:\/\/www.verisign.com\/rpa (c)09/CN=VeriSign Class 3 Code Signing 2009-2 CA

serial: 6D1F15C8B89225B9BBFFE923241A6AC4

Certificates (5)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
        Validity
            Not Before: Jun 15 00:00:00 2007 GMT
            Not After : Jun 14 23:59:59 2012 GMT
        Subject: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:c4:b5:f2:52:15:bc:88:86:60:29:16:4a:5b:2f:
                    4b:91:6b:87:91:f3:35:54:58:35:ea:d1:36:5e:62:
                    4d:52:51:34:71:c2:7b:66:1d:89:c8:dd:2a:c4:6a:
                    0a:f6:37:d9:98:74:91:f6:92:ae:b0:b5:76:96:f1:
                    a9:4a:63:45:47:2e:6b:0b:92:4e:4b:2b:8c:ee:58:
                    4a:8b:d4:07:e4:1a:2c:f8:82:aa:58:d9:cd:42:f3:
                    2d:c0:75:de:8d:ab:c7:8e:1d:9a:6c:4c:08:95:1e:
                    de:db:ef:67:e1:72:c2:49:c2:9e:60:3c:e1:e2:be:
                    16:a3:63:78:69:14:7b:ad:2d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.verisign.com/tss-ca.crl
            X509v3 Extended Key Usage: critical
                Time Stamping
            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation
            X509v3 Subject Alternative Name: 
                DirName:/CN=TSA1-2
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        50:c5:4b:c8:24:80:df:e4:0d:24:c2:de:1a:b1:a1:02:a1:a6:
        82:2d:0c:83:15:81:37:0a:82:0e:2c:b0:5a:17:61:b5:d8:05:
        fe:88:db:f1:91:91:b3:56:1a:40:a6:eb:92:be:38:39:b0:75:
        36:74:3a:98:4f:e4:37:ba:99:89:ca:95:42:1d:b0:b9:c7:a0:
        8d:57:e0:fa:d5:64:04:42:35:4e:01:d1:33:a2:17:c8:4d:aa:
        27:c7:f2:e1:86:4c:02:38:4d:83:78:c6:fc:53:e0:eb:e0:06:
        87:dd:a4:96:9e:5e:0c:98:e2:a5:be:bf:82:85:c3:60:e1:df:
        ad:28:d8:c7:a5:4b:64:da:c7:1b:5b:bd:ac:39:08:d5:38:22:
        a1:33:8b:2f:8a:9a:eb:bc:07:21:3f:44:41:09:07:b5:65:1c:
        24:bc:48:d3:44:80:eb:a1:cf:c9:02:b4:14:cf:54:c7:16:a3:
        80:5c:f9:79:3e:5d:72:7d:88:17:9e:2c:43:a2:ca:53:ce:7d:
        3d:f6:2a:3a:b8:4f:94:00:a5:6d:0a:83:5d:f9:5e:53:f4:18:
        b3:57:0f:70:c3:fb:f5:ad:95:a0:0e:17:de:c4:16:80:60:c9:
        0f:2b:6e:86:04:f1:eb:f4:78:27:d1:05:c5:ee:34:5b:5e:b9:
        49:32:f2:33

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
        Validity
            Not Before: Dec  4 00:00:00 2003 GMT
            Not After : Dec  3 23:59:59 2013 GMT
        Subject: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:a9:ca:b2:a4:cc:cd:20:af:0a:7d:89:ac:87:75:
                    f0:b4:4e:f1:df:c1:0f:bf:67:61:bd:a3:64:1c:da:
                    bb:f9:ca:33:ab:84:30:89:58:7e:8c:db:6b:dd:36:
                    9e:0f:bf:d1:ec:78:f2:77:a6:7e:6f:3c:bf:93:af:
                    0d:ba:68:f4:6c:94:ca:bd:52:2d:ab:48:3d:f5:b6:
                    d5:5d:5f:1b:02:9f:fa:2f:6b:1e:a4:f7:a3:9a:a6:
                    1a:c8:02:e1:7f:4c:52:e3:0e:60:ec:40:1c:7e:b9:
                    0d:de:3f:c7:b4:df:87:bd:5f:7a:6a:31:2e:03:99:
                    81:13:a8:47:20:ce:31:73:0d:57:2d:cd:78:34:33:
                    95:12:99:12:b9:de:68:2f:aa:e6:e3:c2:8a:8c:2a:
                    c3:8b:21:87:66:bd:83:58:57:6f:75:bf:3c:aa:26:
                    87:5d:ca:10:15:3c:9f:84:ea:54:c1:0a:6e:c4:fe:
                    c5:4a:dd:b9:07:11:97:22:7c:db:3e:27:d1:1e:78:
                    ec:9f:31:c9:f1:e6:22:19:db:c4:b3:47:43:9a:1a:
                    5f:a0:1e:90:e4:5e:f5:ee:7c:f1:7d:ab:62:01:8f:
                    f5:4d:0b:de:d0:22:56:a8:95:cd:ae:88:76:ae:ee:
                    ba:0d:f3:e4:4d:d9:a0:fb:68:a0:ae:14:3b:b3:87:
                    c1:bb
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.verisign.com/ThawteTimestampingCA.crl
            X509v3 Extended Key Usage: 
                Time Stamping
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name: 
                DirName:/CN=TSA2048-1-53
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        4a:6b:f9:ea:58:c2:44:1c:31:89:79:99:2b:96:bf:82:ac:01:
        d6:1c:4c:cd:b0:8a:58:6e:df:08:29:a3:5e:c8:ca:93:13:e7:
        04:52:0d:ef:47:27:2f:00:38:b0:e4:c9:93:4e:9a:d4:22:62:
        15:f7:3f:37:21:4f:70:31:80:f1:8b:38:87:b3:e8:e8:97:00:
        fe:cf:55:96:4e:24:d2:a9:27:4e:7a:ae:b7:61:41:f3:2a:ce:
        e7:c9:d9:5e:dd:bb:2b:85:3e:b5:9d:b5:d9:e1:57:ff:be:b4:
        c5:7e:f5:cf:0c:9e:f0:97:fe:2b:d3:3b:52:1b:1b:38:27:f7:
        3f:4a

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6d:1f:15:c8:b8:92:25:b9:bb:ff:e9:23:24:1a:6a:c4
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https:\/\/www.verisign.com\/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009-2 CA
        Validity
            Not Before: Oct  6 00:00:00 2009 GMT
            Not After : Oct  6 23:59:59 2010 GMT
        Subject: C=KR, ST=SEOUL, L=Yeongdeungpo-gu , O=AhnLab, Inc., OU=Digital ID Class 3 - Microsoft Software Validation v2, CN=AhnLab, Inc.
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:f1:34:4d:a3:56:c9:eb:c2:5c:df:7b:79:bd:58:
                    72:e7:f2:d2:32:4c:b4:83:df:4e:90:7b:14:ae:ac:
                    d8:66:a8:5b:c0:b8:6d:94:91:be:84:cd:28:d3:a6:
                    0a:26:76:74:f7:87:43:fe:ed:d0:63:54:63:c1:c0:
                    a2:8c:9a:76:60:d2:ce:e4:9d:4a:f3:be:83:2f:5f:
                    52:24:f6:d4:79:60:f3:8f:0c:94:3e:f0:ec:04:76:
                    4e:7e:9b:83:af:18:4c:b7:ac:ee:5b:b4:07:27:d4:
                    3f:1a:30:77:f3:37:db:05:d0:44:57:6d:56:39:f9:
                    ad:9f:c4:ac:89:b7:40:4a:9b
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://csc3-2009-2-crl.verisign.com/CSC3-2009-2.crl
            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/rpa
            X509v3 Extended Key Usage: 
                Code Signing
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
                CA Issuers - URI:http://csc3-2009-2-aia.verisign.com/CSC3-2009-2.cer
            X509v3 Authority Key Identifier: 
                97:D0:6B:A8:26:70:C8:A1:3F:94:1F:08:2D:C4:35:9B:A4:A1:1E:F2
            Netscape Cert Type: 
                Object Signing
            1.3.6.1.4.1.311.2.1.27: 
                0.......
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        b2:64:74:00:04:e9:bc:b8:db:4c:e0:ff:b3:6c:3a:3f:6b:40:
        c8:76:c5:c0:5b:ae:e9:5a:7a:64:2f:b1:4b:c4:4e:98:c2:f8:
        af:77:9c:c8:22:ec:1c:83:9b:ee:61:f6:0e:ce:ff:70:05:4f:
        bd:bf:25:a2:65:c8:72:e8:38:ca:82:16:81:5a:dd:97:f5:fa:
        f9:e5:90:7a:86:7d:df:d3:c3:dc:f6:84:8f:7b:99:39:14:13:
        bf:f5:e8:ec:d8:50:63:9e:1a:66:54:19:9c:a3:52:bc:9b:c4:
        81:47:d9:e4:21:f0:ee:4a:7e:4e:7b:fe:ac:fd:43:25:9c:58:
        38:bc:82:a6:7f:96:d4:b0:9c:dd:71:16:df:33:dd:bc:95:c3:
        0b:03:53:98:89:38:d7:c0:85:a3:13:af:ec:17:62:64:cf:d5:
        23:26:87:75:f2:09:a9:ec:e4:13:85:05:92:2d:d7:3b:e5:39:
        f7:7b:d8:79:50:e2:82:83:93:96:25:fc:e9:ae:98:b0:7d:5c:
        b2:87:5c:b1:f3:87:ac:82:3e:62:bf:72:a5:8e:73:c5:7c:31:
        17:10:0b:09:e3:c1:ad:4a:53:ea:63:ad:75:9c:ff:ca:8b:6e:
        ee:db:b6:4e:eb:c6:30:7d:dd:11:4a:f4:c7:71:85:69:ac:18:
        20:b9:31:fe

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
        Validity
            Not Before: May 21 00:00:00 2009 GMT
            Not After : May 20 23:59:59 2019 GMT
        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https:\/\/www.verisign.com\/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009-2 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:be:67:1d:b4:60:aa:10:49:6f:56:17:7c:66:c9:
                    5e:86:0d:d5:f1:ac:a7:71:83:8e:8b:89:f8:88:04:
                    89:15:06:ba:2d:84:21:95:e4:d1:9c:50:4c:fb:d2:
                    22:bd:da:f2:b2:35:3b:1e:8f:c3:09:fb:fc:13:2e:
                    5a:bf:89:7c:3d:3b:25:1e:f6:f3:58:7b:9c:f4:01:
                    b5:c6:0a:b8:80:ce:be:27:74:61:67:27:4d:6a:e5:
                    ec:81:61:58:79:a3:e0:17:10:12:15:27:b0:e1:4d:
                    34:7f:2b:47:20:44:b9:de:66:24:66:8a:cd:4f:ba:
                    1f:c5:38:c8:54:90:e1:72:f6:19:66:75:6a:b9:49:
                    68:cf:38:79:0d:aa:30:a8:db:2c:60:48:9e:d7:aa:
                    14:01:a9:83:d7:38:91:30:39:13:96:03:3a:7c:40:
                    54:b6:ad:e0:2f:1b:83:dc:a8:11:52:3e:02:b3:d7:
                    2b:fd:21:b6:a7:5c:a3:0f:0b:a9:a6:10:50:0e:34:
                    2e:4d:a7:ce:c9:5e:25:d4:8c:bc:f3:6e:7c:29:bc:
                    01:5d:fc:31:87:5a:d5:8c:85:67:58:88:19:a0:bf:
                    35:f0:ea:2b:a3:21:e7:90:f6:83:e5:a8:ed:60:78:
                    5e:7b:60:83:fd:57:0b:5d:41:0d:63:54:60:d6:43:
                    21:ef
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/cps
                  User Notice:
                    Explicit Text: https://www.verisign.com/rpa
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            1.3.6.1.5.5.7.1.12: 
                0_.].[0Y0W0U..image/gif0!0.0...+..............k...j.H.,{..0%.#http://logo.verisign.com/vslogo.gif
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, Code Signing
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.verisign.com/pca3.crl
            X509v3 Subject Alternative Name: 
                DirName:/CN=Class3CA2048-1-55
            X509v3 Subject Key Identifier: 
                97:D0:6B:A8:26:70:C8:A1:3F:94:1F:08:2D:C4:35:9B:A4:A1:1E:F2
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        8b:03:c0:dd:94:d8:41:a2:61:69:b0:15:a8:78:c7:30:c6:90:
        3c:7e:42:f7:24:b6:e4:83:73:17:04:7f:04:10:9c:a1:e2:fa:
        81:2f:eb:c0:ca:44:e7:72:e0:50:b6:55:10:20:83:6e:96:92:
        e4:9a:51:6a:b4:37:31:dc:a5:2d:eb:8c:00:c7:1d:4f:e7:4d:
        32:ba:85:f8:4e:be:fa:67:55:65:f0:6a:be:7a:ca:64:38:1a:
        10:10:78:45:76:31:f3:86:7a:03:0f:60:c2:b3:5d:9d:f6:8b:
        66:76:82:1b:59:e1:83:e5:bd:49:a5:38:56:e5:de:41:77:0e:
        58:0f

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:0c:12:06:00:00:00:00:00:1b
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Verification Root
        Validity
            Not Before: May 23 17:01:29 2006 GMT
            Not After : May 23 17:11:29 2016 GMT
        Subject: C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:c9:5c:59:9e:f2:1b:8a:01:14:b4:10:df:04:40:
                    db:e3:57:af:6a:45:40:8f:84:0c:0b:d1:33:d9:d9:
                    11:cf:ee:02:58:1f:25:f7:2a:a8:44:05:aa:ec:03:
                    1f:78:7f:9e:93:b9:9a:00:aa:23:7d:d6:ac:85:a2:
                    63:45:c7:72:27:cc:f4:4c:c6:75:71:d2:39:ef:4f:
                    42:f0:75:df:0a:90:c6:8e:20:6f:98:0f:f8:ac:23:
                    5f:70:29:36:a4:c9:86:e7:b1:9a:20:cb:53:a5:85:
                    e7:3d:be:7d:9a:fe:24:45:33:dc:76:15:ed:0f:a2:
                    71:64:4c:65:2e:81:68:45:a7
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Certificate Policies: 
                Policy: X509v3 Any Policy
            1.3.6.1.4.1.311.21.7: 
                0'..+.....7......N...................n...
            X509v3 Key Usage: 
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier: 
                E2:7F:7B:D8:77:D5:DF:9E:0A:3F:9E:B4:CB:0E:2E:A9:EF:DB:69:77
            1.3.6.1.4.1.311.20.2: 
                ...C.r.o.s.s.C.A
            X509v3 Authority Key Identifier: 
                62:FB:0A:21:5B:7F:43:6E:11:DA:09:54:50:6B:F5:D2:96:71:F1:9E
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        01:e4:46:b3:3b:45:7f:75:13:87:7e:5f:43:de:46:8e:cb:8a:
        bd:b6:47:41:bc:cc:cc:74:91:d8:ce:39:51:95:a4:a6:b5:47:
        c0:ef:d2:da:7b:8f:57:11:f4:32:8c:7c:cd:3f:ee:42:da:04:
        21:4a:f7:c8:43:88:4a:6f:5c:ca:14:fc:4b:d1:9f:4c:bd:d4:
        55:6e:cc:02:be:0d:a6:88:8f:86:09:ba:a4:25:bd:e8:b0:f0:
        fa:8b:71:4e:67:b0:cb:82:a8:d7:8e:55:f7:37:eb:f0:3e:88:
        ef:e4:e0:8a:fd:1c:6e:2e:61:41:48:75:b4:b0:2c:1d:28:d8:
        49:0f:d7:15:f0:24:73:25:3c:cc:88:0c:de:28:4c:65:54:fe:
        5e:ae:8c:ea:19:ad:2c:51:b2:9b:3a:47:f5:3c:80:35:01:17:
        e2:49:87:d6:54:4a:fb:4b:ab:07:bc:bf:7d:79:cf:bf:35:00:
        5c:bb:9e:cf:fc:82:89:1b:39:a0:51:97:b6:de:c0:b3:07:ff:
        44:96:44:c0:34:2a:19:5c:ab:ee:f0:3b:ec:29:4e:b5:13:c5:
        37:85:7e:75:d5:b4:d6:0d:06:6e:b5:d2:6c:23:71:67:ea:f1:
        71:8e:af:4e:74:aa:0c:f9:ec:bf:4c:58:fa:5e:90:9b:6d:39:
        cb:86:88:3f:8b:1c:a8:16:32:d5:fe:6d:b9:f1:f8:b3:ea:d7:
        91:f6:36:47:78:c0:27:2a:15:c7:68:d6:f4:c5:fc:4f:4e:c8:
        67:3f:10:2d:40:9f:f1:1e:c9:61:48:e7:a7:03:fc:31:73:0c:
        f0:46:88:fe:56:da:49:29:95:ef:09:da:a3:e5:be:ef:60:ec:
        d9:54:a0:59:9c:28:bd:54:ef:66:15:7f:87:4c:84:db:a6:0e:
        95:67:2e:51:7b:34:39:b6:41:c2:8c:84:68:26:dc:24:02:09:
        e7:81:8e:0a:97:2d:ef:ee:a7:b9:98:a6:0f:81:8d:c7:10:b5:
        e1:ed:98:2f:48:6f:53:85:49:64:78:9b:ec:5d:ac:97:0b:55:
        26:c3:ef:ba:8d:c8:d1:a5:2f:5a:7f:93:6b:61:1a:33:9b:18:
        b8:a2:62:10:de:24:ea:76:e1:2f:43:eb:ec:dd:7c:12:34:24:
        89:da:28:55:ae:e5:75:4e:31:2b:67:63:b6:a8:d7:ab:73:0a:
        03:ce:c5:ea:59:3f:c7:eb:2a:45:ae:a8:62:5b:2f:00:99:39:
        ab:b4:5f:73:c3:08:ec:80:11:8f:47:0e:8f:2a:13:43:e1:91:
        06:62:55:bb:ff:ba:3d:a9:a9:3d:26:0f:ae:ca:7d:62:8b:15:
        55:89:d6:94:34:4d:d6:65

pkcs7-signedData

SHA1: nil

1.3.6.1.4.1.311.2.1.4

1.3.6.1.4.1.311.2.1.15

00 3c 00 3c 00 3c 00 4f  00 62 00 73 00 6f 00 6c  |.<.<.<.O.b.s.o.l|
00 65 00 74 00 65 00 3e  00 3e 00 3e              |.e.t.e.>.>.>    |

SHA1

4c ac 03 bc 75 00 36 b9 b5 c2 22 65 45 f7 d7 ba |L...u.6..."eE...| f2 32 f4 90 |.2.. |

Certificates

Certificate #0

2
- 38:25:D7:FA:F8:61:AF:9E:F4:90:E7:26:B5:D6:5A:D5
- RSA-SHA1: nil
- Issuer
  - C: US
  - O: VeriSign, Inc.
  - CN: VeriSign Time Stamping Services CA
- 2007-06-15 00:00:00 UTC: 2012-06-14 23:59:59 UTC
- Subject
  - C: US
  - O: VeriSign, Inc.
  - CN: VeriSign Time Stamping Services Signer - G2
- #5
  - rsaEncryption: nil
  - C4:B5:F2:52:15:BC:88:86:60:29:16:4A:5B:2F:4B:91:
    6B:87:91:F3:35:54:58:35:EA:D1:36:5E:62:4D:52:51:
    34:71:C2:7B:66:1D:89:C8:DD:2A:C4:6A:0A:F6:37:D9:
    98:74:91:F6:92:AE:B0:B5:76:96:F1:A9:4A:63:45:47:
    2E:6B:0B:92:4E:4B:2B:8C:EE:58:4A:8B:D4:07:E4:1A:
    2C:F8:82:AA:58:D9:CD:42:F3:2D:C0:75:DE:8D:AB:C7:
    8E:1D:9A:6C:4C:08:95:1E:DE:DB:EF:67:E1:72:C2:49:
    C2:9E:60:3C:E1:E2:BE:16:A3:63:78:69:14:7B:AD:2D: 0x010001
- X509v3 extensions
  - authorityInfoAccess
    - OCSP: http://ocsp.verisign.com
  - basicConstraints
    - true
    - nil
  - crlDistributionPoints: http://crl.verisign.com/tss-ca.crl
  - extendedKeyUsage: true, timeStamping
  - keyUsage: true, 0xc0
  - subjectAltName
    - CN: TSA1-2

RSA-SHA1:

50 c5 4b c8 24 80 df e4  0d 24 c2 de 1a b1 a1 02  |P.K.$....$......|
a1 a6 82 2d 0c 83 15 81  37 0a 82 0e 2c b0 5a 17  |...-....7...,.Z.|
61 b5 d8 05 fe 88 db f1  91 91 b3 56 1a 40 a6 eb  |a..........V.@..|
92 be 38 39 b0 75 36 74  3a 98 4f e4 37 ba 99 89  |..89.u6t:.O.7...|
ca 95 42 1d b0 b9 c7 a0  8d 57 e0 fa d5 64 04 42  |..B......W...d.B|
35 4e 01 d1 33 a2 17 c8  4d aa 27 c7 f2 e1 86 4c  |5N..3...M.'....L|
02 38 4d 83 78 c6 fc 53  e0 eb e0 06 87 dd a4 96  |.8M.x..S........|
9e 5e 0c 98 e2 a5 be bf  82 85 c3 60 e1 df ad 28  |.^.........`...(|
d8 c7 a5 4b 64 da c7 1b  5b bd ac 39 08 d5 38 22  |...Kd...[..9..8"|
a1 33 8b 2f 8a 9a eb bc  07 21 3f 44 41 09 07 b5  |.3./.....!?DA...|
65 1c 24 bc 48 d3 44 80  eb a1 cf c9 02 b4 14 cf  |e.$.H.D.........|
54 c7 16 a3 80 5c f9 79  3e 5d 72 7d 88 17 9e 2c  |T....\.y>]r}...,|
43 a2 ca 53 ce 7d 3d f6  2a 3a b8 4f 94 00 a5 6d  |C..S.}=.*:.O...m|
0a 83 5d f9 5e 53 f4 18  b3 57 0f 70 c3 fb f5 ad  |..].^S...W.p....|
95 a0 0e 17 de c4 16 80  60 c9 0f 2b 6e 86 04 f1  |........`..+n...|
eb f4 78 27 d1 05 c5 ee  34 5b 5e b9 49 32 f2 33  |..x'....4[^.I2.3|

Certificate #1
- 2
  - 47:BF:19:95:DF:8D:52:46:43:F7:DB:6D:48:0D:31:A4
  - RSA-SHA1: nil
  - Issuer
    - C: ZA
    - ST: Western Cape
    - L: Durbanville
    - O: Thawte
    - OU: Thawte Certification
    - CN: Thawte Timestamping CA
  - 2003-12-04 00:00:00 UTC: 2013-12-03 23:59:59 UTC
  - Subject
    - C: US
    - O: VeriSign, Inc.
    - CN: VeriSign Time Stamping Services CA
  - #5
    - rsaEncryption: nil
    - A9:CA:B2:A4:CC:CD:20:AF:0A:7D:89:AC:87:75:F0:B4:
      4E:F1:DF:C1:0F:BF:67:61:BD:A3:64:1C:DA:BB:F9:CA:
      33:AB:84:30:89:58:7E:8C:DB:6B:DD:36:9E:0F:BF:D1:
      EC:78:F2:77:A6:7E:6F:3C:BF:93:AF:0D:BA:68:F4:6C:
      94:CA:BD:52:2D:AB:48:3D:F5:B6:D5:5D:5F:1B:02:9F:
      FA:2F:6B:1E:A4:F7:A3:9A:A6:1A:C8:02:E1:7F:4C:52:
      E3:0E:60:EC:40:1C:7E:B9:0D:DE:3F:C7:B4:DF:87:BD:
      5F:7A:6A:31:2E:03:99:81:13:A8:47:20:CE:31:73:0D:
      57:2D:CD:78:34:33:95:12:99:12:B9:DE:68:2F:AA:E6:
      E3:C2:8A:8C:2A:C3:8B:21:87:66:BD:83:58:57:6F:75:
      BF:3C:AA:26:87:5D:CA:10:15:3C:9F:84:EA:54:C1:0A:
      6E:C4:FE:C5:4A:DD:B9:07:11:97:22:7C:DB:3E:27:D1:
      1E:78:EC:9F:31:C9:F1:E6:22:19:DB:C4:B3:47:43:9A:
      1A:5F:A0:1E:90:E4:5E:F5:EE:7C:F1:7D:AB:62:01:8F:
      F5:4D:0B:DE:D0:22:56:A8:95:CD:AE:88:76:AE:EE:BA:
      0D:F3:E4:4D:D9:A0:FB:68:A0:AE:14:3B:B3:87:C1:BB: 0x010001
  - X509v3 extensions
    - authorityInfoAccess
      - OCSP: http://ocsp.verisign.com
    - basicConstraints
      - true
      - true: 0
    - crlDistributionPoints: http://crl.verisign.com/ThawteTimestampingCA.crl
    - extendedKeyUsage: timeStamping
    - keyUsage: true, 6
    - subjectAltName
      - CN: TSA2048-1-53
- RSA-SHA1:
```
4a 6b f9 ea 58 c2 44 1c  31 89 79 99 2b 96 bf 82  |Jk..X.D.1.y.+...|
ac 01 d6 1c 4c cd b0 8a  58 6e df 08 29 a3 5e c8  |....L...Xn..).^.|
ca 93 13 e7 04 52 0d ef  47 27 2f 00 38 b0 e4 c9  |.....R..G'/.8...|
93 4e 9a d4 22 62 15 f7  3f 37 21 4f 70 31 80 f1  |.N.."b..?7!Op1..|
8b 38 87 b3 e8 e8 97 00  fe cf 55 96 4e 24 d2 a9  |.8........U.N$..|
27 4e 7a ae b7 61 41 f3  2a ce e7 c9 d9 5e dd bb  |'Nz..aA.*....^..|
2b 85 3e b5 9d b5 d9 e1  57 ff be b4 c5 7e f5 cf  |+.>.....W....~..|
0c 9e f0 97 fe 2b d3 3b  52 1b 1b 38 27 f7 3f 4a  |.....+.;R..8'.?J|
```
Certificate #2
- 2
  - 6D:1F:15:C8:B8:92:25:B9:BB:FF:E9:23:24:1A:6A:C4
  - RSA-SHA1: nil
  - Issuer
    - C: US
    - O: VeriSign, Inc.
    - OU: VeriSign Trust Network
    - OU: Terms of use at https://www.verisign.com/rpa (c)09
    - CN: VeriSign Class 3 Code Signing 2009-2 CA
  - 2009-10-06 00:00:00 UTC: 2010-10-06 23:59:59 UTC
  - Subject
    - C: KR
    - ST: SEOUL
    - L: Yeongdeungpo-gu
    - O: AhnLab, Inc.
    - OU: Digital ID Class 3 - Microsoft Software Validation v2
    - CN: AhnLab, Inc.
  - #5
    - rsaEncryption: nil
    - F1:34:4D:A3:56:C9:EB:C2:5C:DF:7B:79:BD:58:72:E7:
      F2:D2:32:4C:B4:83:DF:4E:90:7B:14:AE:AC:D8:66:A8:
      5B:C0:B8:6D:94:91:BE:84:CD:28:D3:A6:0A:26:76:74:
      F7:87:43:FE:ED:D0:63:54:63:C1:C0:A2:8C:9A:76:60:
      D2:CE:E4:9D:4A:F3:BE:83:2F:5F:52:24:F6:D4:79:60:
      F3:8F:0C:94:3E:F0:EC:04:76:4E:7E:9B:83:AF:18:4C:
      B7:AC:EE:5B:B4:07:27:D4:3F:1A:30:77:F3:37:DB:05:
      D0:44:57:6D:56:39:F9:AD:9F:C4:AC:89:B7:40:4A:9B: 0x010001
  - X509v3 extensions
    - basicConstraints
      - nil
    - keyUsage: true, 0x80
    - crlDistributionPoints: http://csc3-2009-2-crl.verisign.com/CSC3-2009-2.crl
    - certificatePolicies
      - 2.16.840.1.113733.1.7.23.3
        id-qt-cps: https://www.verisign.com/rpa
    - extendedKeyUsage: codeSigning
    - authorityInfoAccess
      - #0
        OCSP: http://ocsp.verisign.com
        caIssuers: http://csc3-2009-2-aia.verisign.com/CSC3-2009-2.cer
    - authorityKeyIdentifier:
```
97 d0 6b a8 26 70 c8 a1  3f 94 1f 08 2d c4 35 9b  |..k.&p..?...-.5.|
a4 a1 1e f2                                       |....            |
```
    - nsCertType: 0x10
    - 1.3.6.1.4.1.311.2.1.27
      - false: true
- RSA-SHA1:
```
b2 64 74 00 04 e9 bc b8  db 4c e0 ff b3 6c 3a 3f  |.dt......L...l:?|
6b 40 c8 76 c5 c0 5b ae  e9 5a 7a 64 2f b1 4b c4  |k@.v..[..Zzd/.K.|
4e 98 c2 f8 af 77 9c c8  22 ec 1c 83 9b ee 61 f6  |N....w..".....a.|
0e ce ff 70 05 4f bd bf  25 a2 65 c8 72 e8 38 ca  |...p.O..%.e.r.8.|
82 16 81 5a dd 97 f5 fa  f9 e5 90 7a 86 7d df d3  |...Z.......z.}..|
c3 dc f6 84 8f 7b 99 39  14 13 bf f5 e8 ec d8 50  |.....{.9.......P|
63 9e 1a 66 54 19 9c a3  52 bc 9b c4 81 47 d9 e4  |c..fT...R....G..|
21 f0 ee 4a 7e 4e 7b fe  ac fd 43 25 9c 58 38 bc  |!..J~N{...C%.X8.|
82 a6 7f 96 d4 b0 9c dd  71 16 df 33 dd bc 95 c3  |........q..3....|
0b 03 53 98 89 38 d7 c0  85 a3 13 af ec 17 62 64  |..S..8........bd|
cf d5 23 26 87 75 f2 09  a9 ec e4 13 85 05 92 2d  |..#&.u.........-|
d7 3b e5 39 f7 7b d8 79  50 e2 82 83 93 96 25 fc  |.;.9.{.yP.....%.|
e9 ae 98 b0 7d 5c b2 87  5c b1 f3 87 ac 82 3e 62  |....}\..\.....>b|
bf 72 a5 8e 73 c5 7c 31  17 10 0b 09 e3 c1 ad 4a  |.r..s.|1.......J|
53 ea 63 ad 75 9c ff ca  8b 6e ee db b6 4e eb c6  |S.c.u....n...N..|
30 7d dd 11 4a f4 c7 71  85 69 ac 18 20 b9 31 fe  |0}..J..q.i.. .1.|
```
Certificate #3
- 2
  - 65:52:26:E1:B2:2E:18:E1:59:0F:29:85:AC:22:E7:5C
  - RSA-SHA1: nil
  - Issuer
    - C: US
    - O: VeriSign, Inc.
    - OU: Class 3 Public Primary Certification Authority
  - 2009-05-21 00:00:00 UTC: 2019-05-20 23:59:59 UTC
  - Subject
    - C: US
    - O: VeriSign, Inc.
    - OU: VeriSign Trust Network
    - OU: Terms of use at https://www.verisign.com/rpa (c)09
    - CN: VeriSign Class 3 Code Signing 2009-2 CA
  - #5
    - rsaEncryption: nil
    - BE:67:1D:B4:60:AA:10:49:6F:56:17:7C:66:C9:5E:86:
      0D:D5:F1:AC:A7:71:83:8E:8B:89:F8:88:04:89:15:06:
      BA:2D:84:21:95:E4:D1:9C:50:4C:FB:D2:22:BD:DA:F2:
      B2:35:3B:1E:8F:C3:09:FB:FC:13:2E:5A:BF:89:7C:3D:
      3B:25:1E:F6:F3:58:7B:9C:F4:01:B5:C6:0A:B8:80:CE:
      BE:27:74:61:67:27:4D:6A:E5:EC:81:61:58:79:A3:E0:
      17:10:12:15:27:B0:E1:4D:34:7F:2B:47:20:44:B9:DE:
      66:24:66:8A:CD:4F:BA:1F:C5:38:C8:54:90:E1:72:F6:
      19:66:75:6A:B9:49:68:CF:38:79:0D:AA:30:A8:DB:2C:
      60:48:9E:D7:AA:14:01:A9:83:D7:38:91:30:39:13:96:
      03:3A:7C:40:54:B6:AD:E0:2F:1B:83:DC:A8:11:52:3E:
      02:B3:D7:2B:FD:21:B6:A7:5C:A3:0F:0B:A9:A6:10:50:
      0E:34:2E:4D:A7:CE:C9:5E:25:D4:8C:BC:F3:6E:7C:29:
      BC:01:5D:FC:31:87:5A:D5:8C:85:67:58:88:19:A0:BF:
      35:F0:EA:2B:A3:21:E7:90:F6:83:E5:A8:ED:60:78:5E:
      7B:60:83:FD:57:0B:5D:41:0D:63:54:60:D6:43:21:EF: 0x010001
  - X509v3 extensions
    - basicConstraints
      - true
      - true: 0
    - certificatePolicies
      - 2.16.840.1.113733.1.7.23.3
        #0
        id-qt-cps: https://www.verisign.com/cps
        id-qt-unotice: https://www.verisign.com/rpa
    - keyUsage: true, 6
    - 1.3.6.1.5.5.7.1.12
      - image/gif
        SHA1:
        8f e5 d3 1a 86 ac 8d 8e 6b c3 cf 80 6a d4 48 18 |........k...j.H.| 2c 7b 19 2e |,{.. |
        http://logo.verisign.com/vslogo.gif
    - extendedKeyUsage
      - clientAuth: codeSigning
    - authorityInfoAccess
      - OCSP: http://ocsp.verisign.com
    - crlDistributionPoints: http://crl.verisign.com/pca3.crl
    - subjectAltName
      - CN: Class3CA2048-1-55
    - subjectKeyIdentifier:
```
97 d0 6b a8 26 70 c8 a1  3f 94 1f 08 2d c4 35 9b  |..k.&p..?...-.5.|
a4 a1 1e f2                                       |....            |
```
- RSA-SHA1:
```
8b 03 c0 dd 94 d8 41 a2  61 69 b0 15 a8 78 c7 30  |......A.ai...x.0|
c6 90 3c 7e 42 f7 24 b6  e4 83 73 17 04 7f 04 10  |..<~B.$...s.....|
9c a1 e2 fa 81 2f eb c0  ca 44 e7 72 e0 50 b6 55  |...../...D.r.P.U|
10 20 83 6e 96 92 e4 9a  51 6a b4 37 31 dc a5 2d  |. .n....Qj.71..-|
eb 8c 00 c7 1d 4f e7 4d  32 ba 85 f8 4e be fa 67  |.....O.M2...N..g|
55 65 f0 6a be 7a ca 64  38 1a 10 10 78 45 76 31  |Ue.j.z.d8...xEv1|
f3 86 7a 03 0f 60 c2 b3  5d 9d f6 8b 66 76 82 1b  |..z..`..]...fv..|
59 e1 83 e5 bd 49 a5 38  56 e5 de 41 77 0e 58 0f  |Y....I.8V..Aw.X.|
```

Certificate #4

2
- 61:0C:12:06:00:00:00:00:00:1B
- RSA-SHA1: nil
- Issuer
  - C: US
  - ST: Washington
  - L: Redmond
  - O: Microsoft Corporation
  - CN: Microsoft Code Verification Root
- 2006-05-23 17:01:29 UTC: 2016-05-23 17:11:29 UTC
- Subject
  - C: US
  - O: VeriSign, Inc.
  - OU: Class 3 Public Primary Certification Authority
- #5
  - rsaEncryption: nil
  - C9:5C:59:9E:F2:1B:8A:01:14:B4:10:DF:04:40:DB:E3:
    57:AF:6A:45:40:8F:84:0C:0B:D1:33:D9:D9:11:CF:EE:
    02:58:1F:25:F7:2A:A8:44:05:AA:EC:03:1F:78:7F:9E:
    93:B9:9A:00:AA:23:7D:D6:AC:85:A2:63:45:C7:72:27:
    CC:F4:4C:C6:75:71:D2:39:EF:4F:42:F0:75:DF:0A:90:
    C6:8E:20:6F:98:0F:F8:AC:23:5F:70:29:36:A4:C9:86:
    E7:B1:9A:20:CB:53:A5:85:E7:3D:BE:7D:9A:FE:24:45:
    33:DC:76:15:ED:0F:A2:71:64:4C:65:2E:81:68:45:A7: 0x010001
- #6
  - certificatePolicies: anyPolicy
  - 1.3.6.1.4.1.311.21.7
    - 1.3.6.1.4.1.311.21.8.3692315854.1256661383.1690418588.4201632533.1.25: 0x6E, 0
  - keyUsage: 0x86
  - basicConstraints: true, true
  - subjectKeyIdentifier:
```
e2 7f 7b d8 77 d5 df 9e  0a 3f 9e b4 cb 0e 2e a9  |..{.w....?......|
ef db 69 77                                       |..iw            |
```
  - 1.3.6.1.4.1.311.20.2:
```
00 43 00 72 00 6f 00 73  00 73 00 43 00 41        |.C.r.o.s.s.C.A  |
```
  - authorityKeyIdentifier:
```
62 fb 0a 21 5b 7f 43 6e  11 da 09 54 50 6b f5 d2  |b..![.Cn...TPk..|
96 71 f1 9e                                       |.q..            |
```
  - crlDistributionPoints: http://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl

RSA-SHA1:

01 e4 46 b3 3b 45 7f 75  13 87 7e 5f 43 de 46 8e  |..F.;E.u..~_C.F.|
cb 8a bd b6 47 41 bc cc  cc 74 91 d8 ce 39 51 95  |....GA...t...9Q.|
a4 a6 b5 47 c0 ef d2 da  7b 8f 57 11 f4 32 8c 7c  |...G....{.W..2.||
cd 3f ee 42 da 04 21 4a  f7 c8 43 88 4a 6f 5c ca  |.?.B..!J..C.Jo\.|
14 fc 4b d1 9f 4c bd d4  55 6e cc 02 be 0d a6 88  |..K..L..Un......|
8f 86 09 ba a4 25 bd e8  b0 f0 fa 8b 71 4e 67 b0  |.....%......qNg.|
cb 82 a8 d7 8e 55 f7 37  eb f0 3e 88 ef e4 e0 8a  |.....U.7..>.....|
fd 1c 6e 2e 61 41 48 75  b4 b0 2c 1d 28 d8 49 0f  |..n.aAHu..,.(.I.|
d7 15 f0 24 73 25 3c cc  88 0c de 28 4c 65 54 fe  |...$s%<....(LeT.|
5e ae 8c ea 19 ad 2c 51  b2 9b 3a 47 f5 3c 80 35  |^.....,Q..:G.<.5|
01 17 e2 49 87 d6 54 4a  fb 4b ab 07 bc bf 7d 79  |...I..TJ.K....}y|
cf bf 35 00 5c bb 9e cf  fc 82 89 1b 39 a0 51 97  |..5.\.......9.Q.|
b6 de c0 b3 07 ff 44 96  44 c0 34 2a 19 5c ab ee  |......D.D.4*.\..|
f0 3b ec 29 4e b5 13 c5  37 85 7e 75 d5 b4 d6 0d  |.;.)N...7.~u....|
06 6e b5 d2 6c 23 71 67  ea f1 71 8e af 4e 74 aa  |.n..l#qg..q..Nt.|
0c f9 ec bf 4c 58 fa 5e  90 9b 6d 39 cb 86 88 3f  |....LX.^..m9...?|
8b 1c a8 16 32 d5 fe 6d  b9 f1 f8 b3 ea d7 91 f6  |....2..m........|
36 47 78 c0 27 2a 15 c7  68 d6 f4 c5 fc 4f 4e c8  |6Gx.'*..h....ON.|
67 3f 10 2d 40 9f f1 1e  c9 61 48 e7 a7 03 fc 31  |g?.-@....aH....1|
73 0c f0 46 88 fe 56 da  49 29 95 ef 09 da a3 e5  |s..F..V.I)......|
be ef 60 ec d9 54 a0 59  9c 28 bd 54 ef 66 15 7f  |..`..T.Y.(.T.f..|
87 4c 84 db a6 0e 95 67  2e 51 7b 34 39 b6 41 c2  |.L.....g.Q{49.A.|
8c 84 68 26 dc 24 02 09  e7 81 8e 0a 97 2d ef ee  |..h&.$.......-..|
a7 b9 98 a6 0f 81 8d c7  10 b5 e1 ed 98 2f 48 6f  |............./Ho|
53 85 49 64 78 9b ec 5d  ac 97 0b 55 26 c3 ef ba  |S.Idx..]...U&...|
8d c8 d1 a5 2f 5a 7f 93  6b 61 1a 33 9b 18 b8 a2  |..../Z..ka.3....|
62 10 de 24 ea 76 e1 2f  43 eb ec dd 7c 12 34 24  |b..$.v./C...|.4$|
89 da 28 55 ae e5 75 4e  31 2b 67 63 b6 a8 d7 ab  |..(U..uN1+gc....|
73 0a 03 ce c5 ea 59 3f  c7 eb 2a 45 ae a8 62 5b  |s.....Y?..*E..b[|
2f 00 99 39 ab b4 5f 73  c3 08 ec 80 11 8f 47 0e  |/..9.._s......G.|
8f 2a 13 43 e1 91 06 62  55 bb ff ba 3d a9 a9 3d  |.*.C...bU...=..=|
26 0f ae ca 7d 62 8b 15  55 89 d6 94 34 4d d6 65  |&...}b..U...4M.e|

Signer

1
unnamed
- #0
  - C: US
  - O: VeriSign, Inc.
  - OU: VeriSign Trust Network
  - OU: Terms of use at https://www.verisign.com/rpa (c)09
  - CN: VeriSign Class 3 Code Signing 2009-2 CA
- 6D:1F:15:C8:B8:92:25:B9:BB:FF:E9:23:24:1A:6A:C4
SHA1: nil

contentType: 1.3.6.1.4.1.311.2.1.4
1.3.6.1.4.1.311.2.1.11: msCodeInd

messageDigest:

9f 85 cb 55 bf bf d3 49  08 0a 9c 35 fb e2 e8 cc  |...U...I...5....|
7a 18 e0 74                                       |z..t            |

1.3.6.1.4.1.311.2.1.12:

00 48 00 61 00 63 00 6b  00 53 00 68 00 69 00 65  |.H.a.c.k.S.h.i.e|
00 6c 00 64                                       |.l.d            |

rsaEncryption:

e0 b4 f7 06 bf 17 d4 20  ad 72 f0 14 69 2c 10 e2  |....... .r..i,..|
92 9f 92 7a 60 6c 49 ce  63 06 3c 94 cb 11 83 4c  |...z`lI.c.<....L|
81 e3 fb cc 09 49 8a 75  b3 8a 99 b0 71 f8 c5 2c  |.....I.u....q..,|
fc 36 81 2b d7 79 0b 14  77 7e 5e e4 7a d1 aa 5b  |.6.+.y..w~^.z..[|
a3 98 60 aa 84 f3 b7 3e  9a 90 ff 01 88 b7 cf 43  |..`....>.......C|
c7 85 eb 7c 15 5b 42 1b  73 d8 10 21 91 85 f7 8e  |...|.[B.s..!....|
a6 22 4f cd 7d 2e a5 62  4e 67 43 34 7a d3 eb cd  |."O.}..bNgC4z...|
ed c1 f1 1e 4e 4c 04 0f  76 ac e4 84 d8 cc 6a c1  |....NL..v.....j.|

countersignature

unnamed
- #0
  - C: US
  - O: VeriSign, Inc.
  - CN: VeriSign Time Stamping Services CA
- 38:25:D7:FA:F8:61:AF:9E:F4:90:E7:26:B5:D6:5A:D5
SHA1: nil

contentType: pkcs7-data
signingTime: 2010-07-10 07:18:27 UTC

messageDigest:

73 f9 07 9b 8f a5 99 fb  fd 2e 45 75 3c 8a 7b 44  |s.........Eu<.{D|
0e c5 26 0a                                       |..&.            |

rsaEncryption:

a1 45 59 e5 8f c8 7b ca  c4 1f 03 5a d7 93 c3 6c  |.EY...{....Z...l|
ed bb 9e e2 7c 55 ab 36  fc 74 09 4c 8c 1c d2 67  |....|U.6.t.L...g|
4e 6a d4 d9 90 1b bc 08  af aa f3 96 12 16 43 82  |Nj............C.|
14 64 29 3d f7 a6 bc a2  72 b1 43 c7 07 c7 37 c2  |.d)=....r.C...7.|
65 b1 33 43 de 45 a4 52  b3 52 0a 83 9e 9d 8c 2f  |e.3C.E.R.R...../|
cf 65 f0 03 f3 9a f7 5f  9c f3 cc 4c 27 28 4f 65  |.e....._...L'(Oe|
99 97 f6 2f b7 04 3a ac  e0 81 32 f3 8f c8 b9 f7  |.../..:...2.....|
3b 3b c1 84 5a fa 5a c5  41 f2 0a 1d 4d 3b b0 5f  |;;..Z.Z.A...M;._|

show previews

offset	size	type	comment
0	2867200	DLL	07/10/2010 06:54:32	#
15c1	15	HTM		#
2bc000	6848	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x1675d8

[?] can't find file_offset of VA 0x167468

[?] can't find file_offset of VA 0x167590

[?] can't find file_offset of VA 0x1675b8

[?] invalid VS_VERSIONINFO child type "t\x00r\x00i\x00"