filenamefarflt.sys
size53464 (0xd0d8)
md551da9e16ecb45f588a03240a1dd5c266
typePE32+ executable (native) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
131307291
149307292
206655014
205655011
147307295
10105
2242100510
219210051
222210051

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections8
TimeDateStamp0x569ff5fa
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion12.0
SizeOfCode0x8200
SizeOfInitializedData0x2e00
SizeOfUninitializedData0
AddressOfEntryPoint0xc43c
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.3
ImageVersion6.3
SubsystemVersion6.1
Reserved10
SizeOfImage0x10000
SizeOfHeaders0x400
CheckSum0x142b2
Subsystem1
DllCharacteristics0x1e0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

namevavsizeraw sizeflags
.text0x10000x5f8b0x6000R-X CODE
.rdata0x70000x155c0x1600R-- IDATA
.data0x90000x9400x800RW- IDATA
.pdata0xa0000x4140x600R-- IDATA
PAGE0xb0000xb940xc00R-X CODE
INIT0xc0000x15780x1600RWX CODE DISCARDABLE
.rsrc0xe0000x3900x400R-- IDATA DISCARDABLE
.reloc0xf0000x2140x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xc7a00x3c
RESOURCE0xe0000x390
EXCEPTION0xa0000x414
SECURITY0xb2000x1ed8
BASERELOC0xf0000x214
DEBUG0x73600x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x7e100x94
Bound_IAT00
IAT0x70080x358
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#18160
module_namehintordfunction_name
FLTMGR.SYS92FltGetFileNameInformation
FLTMGR.SYS93FltGetFileNameInformationUnsafe
FLTMGR.SYS182FltReleaseFileNameInformation
FLTMGR.SYS160FltParseFileNameInformation
FLTMGR.SYS87FltGetDestinationFileNameInformation
FLTMGR.SYS137FltIsDirectory
FLTMGR.SYS169FltQueryInformationFile
FLTMGR.SYS114FltGetStreamHandleContext
FLTMGR.SYS180FltReleaseContext
FLTMGR.SYS122FltGetVolumeFromFileObject
FLTMGR.SYS71FltEnumerateInstances
FLTMGR.SYS150FltObjectDereference
FLTMGR.SYS192FltSendMessage
FLTMGR.SYS109FltGetRequestorProcessId
FLTMGR.SYS74FltFindExtraCreateParameter
FLTMGR.SYS90FltGetEcpListFromCallbackData
FLTMGR.SYS139FltIsEcpFromUserMode
FLTMGR.SYS178FltRegisterFilter
FLTMGR.SYS218FltUnregisterFilter
FLTMGR.SYS209FltStartFiltering
FLTMGR.SYS45FltCreateCommunicationPort
FLTMGR.SYS39FltCloseCommunicationPort
FLTMGR.SYS38FltCloseClientPort
FLTMGR.SYS19FltBuildDefaultSecurityDescriptor
FLTMGR.SYS83FltFreeSecurityDescriptor
FLTMGR.SYS15FltAllocatePoolAlignedWithTag
FLTMGR.SYS82FltFreePoolAlignedWithTag
FLTMGR.SYS175FltReadFile
FLTMGR.SYS8FltAllocateContext
FLTMGR.SYS199FltSetInstanceContext
FLTMGR.SYS205FltSetStreamHandleContext
FLTMGR.SYS98FltGetInstanceContext
FLTMGR.SYS123FltGetVolumeFromInstance
FLTMGR.SYS129FltGetVolumeProperties
FLTMGR.SYS94FltGetFileSystemType
FLTMGR.SYS145FltIsVolumeSnapshot
ntoskrnl.exe759KeInitializeEvent
ntoskrnl.exe869KeSetEvent
ntoskrnl.exe903KeWaitForSingleObject
ntoskrnl.exe115ExAllocatePoolWithTag
ntoskrnl.exe139ExFreePoolWithTag
ntoskrnl.exe2024_wcsicmp
ntoskrnl.exe686KeAcquireGuardedMutex
ntoskrnl.exe830KeReleaseGuardedMutex
ntoskrnl.exe144ExGetPreviousMode
ntoskrnl.exe675IofCompleteRequest
ntoskrnl.exe516IoGetCurrentProcess
ntoskrnl.exe542IoGetTopLevelIrp
ntoskrnl.exe1868ZwOpenFile
ntoskrnl.exe1905ZwQueryInformationFile
ntoskrnl.exe1810ZwClose
ntoskrnl.exe1476RtlInsertElementGenericTableAvl
ntoskrnl.exe1378RtlDeleteElementGenericTableAvl
ntoskrnl.exe1521RtlLookupElementGenericTableAvl
ntoskrnl.exe1221PsGetCurrentProcessId
ntoskrnl.exe1226PsGetCurrentThreadId
ntoskrnl.exe1243PsGetProcessId
ntoskrnl.exe1258PsGetThreadId
ntoskrnl.exe1874ZwOpenProcess
ntoskrnl.exe637IoThreadToProcess
ntoskrnl.exe1279PsProcessType
ntoskrnl.exe1311PsThreadType
ntoskrnl.exe1466RtlInitUnicodeString
ntoskrnl.exe63DbgPrint
ntoskrnl.exe760KeInitializeGuardedMutex
ntoskrnl.exe150ExInitializeResourceLite
ntoskrnl.exe122ExDeleteResourceLite
ntoskrnl.exe959MmGetSystemRoutineAddress
ntoskrnl.exe462IoCreateDevice
ntoskrnl.exe472IoCreateSymbolicLink
ntoskrnl.exe483IoDeleteDevice
ntoskrnl.exe485IoDeleteSymbolicLink
ntoskrnl.exe1154ObRegisterCallbacks
ntoskrnl.exe1159ObUnRegisterCallbacks
ntoskrnl.exe1471RtlInitializeGenericTableAvl
ntoskrnl.exe1296PsSetCreateProcessNotifyRoutineEx
ntoskrnl.exe1297PsSetCreateThreadNotifyRoutine
ntoskrnl.exe1285PsRemoveCreateThreadNotifyRoutine
ntoskrnl.exe1301PsSetLoadImageNotifyRoutine
ntoskrnl.exe1286PsRemoveLoadImageNotifyRoutine
ntoskrnl.exe1346RtlCompareUnicodeString
ntoskrnl.exe1361RtlCopyUnicodeString
ntoskrnl.exe1326RtlAppendUnicodeStringToString
ntoskrnl.exe1764VerSetConditionMask
ntoskrnl.exe1638RtlVerifyVersionInfo
ntoskrnl.exe728KeEnterCriticalRegion
ntoskrnl.exe788KeLeaveCriticalRegion
ntoskrnl.exe112ExAllocatePool
ntoskrnl.exe98ExAcquireResourceExclusiveLite
ntoskrnl.exe189ExReleaseResourceLite
ntoskrnl.exe58CmUnRegisterCallback
ntoskrnl.exe56CmRegisterCallbackEx
ntoskrnl.exe1160ObfDereferenceObject
ntoskrnl.exe1440RtlGetElementGenericTableAvl
ntoskrnl.exe1506RtlIsGenericTableEmptyAvl
ntoskrnl.exe1591RtlSubAuthoritySid
ntoskrnl.exe1590RtlSubAuthorityCountSid
ntoskrnl.exe1276PsLookupProcessByProcessId
ntoskrnl.exe1143ObOpenObjectByPointer
ntoskrnl.exe315FsRtlIsNtstatusExpected
ntoskrnl.exe314FsRtlIsNameInExpression
ntoskrnl.exe1876ZwOpenProcessTokenEx
ntoskrnl.exe1910ZwQueryInformationToken
ntoskrnl.exe1981__C_specific_handler
ntoskrnl.exe712KeBugCheckEx

StringTable 040904E4

CompanyNameMalwarebytes
FileVersion3.0.0.120
FileDescriptionAnti-RansomWare SDK
InternalNamefarflt.sys
LegalCopyright(C) Malwarebytes. All rights reserved.
LegalTrademarks
OriginalFilenamefarflt.sys
ProductNameAnti-RansomWare SDK
ProductVersion3.0.0.120

VS_FIXEDFILEINFO

FileVersion3.0.0.120
ProductVersion3.0.0.120
StrucVersion0x10000
FileFlagsMask0
FileFlags0
FileOS0
FileType3
FileSubtype7

Signers (1)

issuer: /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https:\/\/www.verisign.com\/rpa (c)10/CN=VeriSign Class 3 Code Signing 2010 CA
serial: 6F36C4B74B4F8AB001F039D692A75B49

Certificates (5)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
        Validity
            Not Before: Dec 21 00:00:00 2012 GMT
            Not After : Dec 30 23:59:59 2020 GMT
        Subject: C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:b1:ac:b3:49:54:4b:97:1c:12:0a:d8:25:79:91:
                    22:57:2a:6f:dc:b8:26:c4:43:73:6b:c2:bf:2e:50:
                    5a:fb:14:c2:76:8e:43:01:25:43:b4:a1:e2:45:f4:
                    e8:b7:7b:c3:74:cc:22:d7:b4:94:00:02:f7:4d:ed:
                    bf:b4:b7:44:24:6b:cd:5f:45:3b:d1:44:ce:43:12:
                    73:17:82:8b:69:b4:2b:cb:99:1e:ac:72:1b:26:4d:
                    71:1f:b1:31:dd:fb:51:61:02:53:a6:aa:f5:49:2c:
                    05:78:45:a5:2f:89:ce:e7:99:e7:fe:8c:e2:57:3f:
                    3d:c6:92:dc:4a:f8:7b:33:e4:79:0a:fb:f0:75:88:
                    41:9c:ff:c5:03:51:99:aa:d7:6c:9f:93:69:87:65:
                    29:83:85:c2:60:14:c4:c8:c9:3b:14:da:c0:81:f0:
                    1f:0d:74:de:92:22:ab:ca:f7:fb:74:7c:27:e6:f7:
                    4a:1b:7f:a7:c3:9e:2d:ae:8a:ea:a6:e6:aa:27:16:
                    7d:61:f7:98:71:11:bc:e2:50:a1:4b:e5:5d:fa:e5:
                    0e:a7:2c:9f:aa:65:20:d3:d8:96:e8:c8:7c:a5:4e:
                    48:44:ff:19:e2:44:07:92:0b:d7:68:84:80:5d:6a:
                    78:64:45:cd:60:46:7e:54:c1:13:7c:c5:79:f1:c9:
                    c1:71
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                5F:9A:F5:6E:5C:CC:CC:74:9A:D4:DD:7D:EF:3F:DB:EC:4C:80:2E:DD
            Authority Information Access: 
                OCSP - URI:http://ocsp.thawte.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.thawte.com/ThawteTimestampingCA.crl
            X509v3 Extended Key Usage: 
                Time Stamping
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name: 
                DirName:/CN=TimeStamp-2048-1
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        03:09:9b:8f:79:ef:7f:59:30:aa:ef:68:b5:fa:e3:09:1d:bb:
        4f:82:06:5d:37:5f:a6:52:9f:16:8d:ea:1c:92:09:44:6e:f5:
        6d:eb:58:7c:30:e8:f9:69:8d:23:73:0b:12:6f:47:a9:ae:39:
        11:f8:2a:b1:9b:b0:1a:c3:8e:eb:59:96:00:ad:ce:0c:4d:b2:
        d0:31:a6:08:5c:2a:7a:fc:e2:7a:1d:57:4c:a8:65:18:e9:79:
        40:62:25:96:6e:c7:c7:37:6a:83:21:08:8e:41:ea:dd:d9:57:
        3f:1d:77:49:87:2a:16:06:5e:a6:38:6a:22:12:a3:51:19:83:
        7e:b6

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA - G2
        Validity
            Not Before: Oct 18 00:00:00 2012 GMT
            Not After : Dec 29 23:59:59 2020 GMT
        Subject: C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer - G4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:a2:63:0b:39:44:b8:bb:23:a7:44:49:bb:0e:ff:
                    a1:f0:61:0a:53:93:b0:98:db:ad:2c:0f:4a:c5:6e:
                    ff:86:3c:53:55:0f:15:ce:04:3f:2b:fd:a9:96:96:
                    d9:be:61:79:0b:5b:c9:4c:86:76:e5:e0:43:4b:22:
                    95:ee:c2:2b:43:c1:9f:d8:68:b4:8e:40:4f:ee:85:
                    38:b9:11:c5:23:f2:64:58:f0:15:32:6f:4e:57:a1:
                    ae:88:a4:02:d7:2a:1e:cd:4b:e1:dd:63:d5:17:89:
                    32:5b:b0:5e:99:5a:a8:9d:28:50:0e:17:ee:96:db:
                    61:3b:45:51:1d:cf:12:56:0b:92:47:fc:ab:ae:f6:
                    66:3d:47:ac:70:72:e7:92:e7:5f:cd:10:b9:c4:83:
                    64:94:19:bd:25:80:e1:e8:d2:22:a5:d0:ba:02:7a:
                    a1:77:93:5b:65:c3:ee:17:74:bc:41:86:2a:dc:08:
                    4c:8c:92:8c:91:2d:9e:77:44:1f:68:d6:a8:74:77:
                    db:0e:5b:32:8b:56:8b:33:bd:d9:63:c8:49:9d:3a:
                    c5:c5:ea:33:0b:d2:f1:a3:1b:f4:8b:be:d9:b3:57:
                    8b:3b:de:04:a7:7a:22:b2:24:ae:2e:c7:70:c5:be:
                    4e:83:26:08:fb:0b:bd:a9:4f:99:08:e1:10:28:72:
                    aa:cd
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Extended Key Usage: critical
                Time Stamping
            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access: 
                OCSP - URI:http://ts-ocsp.ws.symantec.com
                CA Issuers - URI:http://ts-aia.ws.symantec.com/tss-ca-g2.cer
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://ts-crl.ws.symantec.com/tss-ca-g2.crl
            X509v3 Subject Alternative Name: 
                DirName:/CN=TimeStamp-2048-2
            X509v3 Subject Key Identifier: 
                46:C6:69:A3:0E:4A:14:1E:D5:4C:DA:52:63:17:3F:5E:36:BC:0D:E6
            X509v3 Authority Key Identifier: 
                5F:9A:F5:6E:5C:CC:CC:74:9A:D4:DD:7D:EF:3F:DB:EC:4C:80:2E:DD
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        78:3b:b4:91:2a:00:4c:f0:8f:62:30:37:78:a3:84:27:07:6f:
        18:b2:de:25:dc:a0:d4:94:03:aa:86:4e:25:9f:9a:40:03:1c:
        dd:ce:e3:79:cb:21:68:06:da:b6:32:b4:6d:bf:f4:2c:26:63:
        33:e4:49:64:6d:0d:e6:c3:67:0e:f7:05:a4:35:6c:7c:89:16:
        c6:e9:b2:df:b2:e9:dd:20:c6:71:0f:cd:95:74:dc:b6:5c:de:
        bd:37:1f:43:78:e6:78:b5:cd:28:04:20:a3:aa:f1:4b:c4:88:
        29:91:0e:80:d1:11:fc:dd:5c:76:6e:4f:5e:0e:45:46:41:6e:
        0d:b0:ea:38:9a:b1:3a:da:09:71:10:fc:1c:79:b4:80:7b:ac:
        69:f4:fd:9c:b6:0c:16:2b:f1:7f:5b:09:3d:9b:5b:e2:16:ca:
        13:81:6d:00:2e:38:0d:a8:29:8f:2c:e1:b2:f4:5a:a9:01:af:
        15:9c:2c:2f:49:1b:db:22:bb:c3:fe:78:94:51:c3:86:b1:82:
        88:5d:f0:3d:b4:51:a1:79:33:2b:2e:7b:b9:dc:20:09:13:71:
        eb:6a:19:5b:cf:e8:a5:30:57:2c:89:49:3f:b9:cf:7f:c9:bf:
        3e:22:68:63:53:9a:bd:69:74:ac:c5:1d:3c:7f:92:e0:c3:bc:
        1c:d8:04:75

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6f:36:c4:b7:4b:4f:8a:b0:01:f0:39:d6:92:a7:5b:49
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https:\/\/www.verisign.com\/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
        Validity
            Not Before: Apr 30 00:00:00 2013 GMT
            Not After : Jun 19 23:59:59 2016 GMT
        Subject: C=US, ST=California, L=San Jose, O=Malwarebytes Corporation, OU=Digital ID Class 3 - Microsoft Software Validation v2, CN=Malwarebytes Corporation
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:b8:52:bd:06:aa:ae:86:8b:c3:b8:60:2a:6a:87:
                    69:ad:a0:67:ef:3e:4d:27:dd:b0:ea:10:62:6b:eb:
                    ad:40:fa:9f:86:f3:24:78:c0:2f:a8:29:22:76:78:
                    c1:b1:eb:ef:cb:99:5c:0a:b8:e1:80:de:d8:13:bb:
                    5e:ec:8a:ab:01:fe:a1:fa:8c:d1:ab:94:c8:d1:20:
                    60:e7:fa:c6:46:7b:ec:4b:26:1f:9c:5f:f4:ba:aa:
                    e7:31:98:5c:87:8a:ce:dc:b7:96:b8:16:eb:9d:92:
                    27:ff:a6:3e:4a:99:a6:54:cb:f3:bc:33:4b:32:8b:
                    1f:0e:8e:c0:5d:0e:f4:30:b4:9c:2c:ea:63:95:09:
                    97:d5:21:eb:91:1b:c7:fe:88:2a:0e:00:ab:d3:aa:
                    04:97:a1:47:c4:e1:f9:61:e7:a3:69:55:1a:c1:74:
                    67:f2:a7:32:6e:fb:1e:0c:10:aa:61:e1:35:cf:50:
                    94:32:22:c7:25:ac:62:b6:fe:61:a5:8a:4f:60:d1:
                    00:27:bd:6f:00:e2:9a:87:a8:f5:0a:68:43:b1:f7:
                    36:a7:29:47:12:a0:87:85:0f:fb:64:41:ce:47:f1:
                    9c:55:73:f1:c8:89:25:9a:1b:ad:af:5d:9e:fd:30:
                    f9:58:27:27:19:8a:3c:c5:a2:3a:2f:cc:0b:c3:98:
                    5b:bd
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://csc3-2010-crl.verisign.com/CSC3-2010.crl
            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/rpa
            X509v3 Extended Key Usage: 
                Code Signing
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
                CA Issuers - URI:http://csc3-2010-aia.verisign.com/CSC3-2010.cer
            X509v3 Authority Key Identifier: 
                CF:99:A9:EA:7B:26:F4:4B:C9:8E:8F:D7:F0:05:26:EF:E3:D2:A7:9D
            Netscape Cert Type: 
                Object Signing
            1.3.6.1.4.1.311.2.1.27: 
                0.......
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        c2:aa:9d:45:c1:55:1f:8c:6d:df:f5:fa:b8:59:81:0a:ef:58:
        1f:87:35:77:c3:e6:10:fd:b5:0a:04:0e:c3:b8:2c:b3:fb:75:
        23:09:cf:cf:b5:a0:1b:f9:ae:d0:57:8b:86:12:8f:52:56:fc:
        cf:4e:1d:5a:f1:bb:a4:b1:07:18:6e:60:ad:62:50:10:3c:ef:
        4a:d0:6a:bb:e5:ca:c0:99:6b:0a:20:1f:15:33:c7:db:b6:79:
        38:40:6b:ae:a7:c1:99:32:e3:14:30:a8:78:55:e6:d6:4e:81:
        c7:fc:ec:ee:ab:05:13:da:da:ec:fc:9c:9a:02:c1:47:72:19:
        45:eb:ee:7c:64:e3:a1:33:b5:74:12:aa:66:ca:11:d9:4f:5e:
        1f:4d:66:4c:e7:1d:5e:1d:58:3e:96:96:b0:b0:91:b7:fd:77:
        9c:b8:de:b2:56:bb:b8:8f:1b:37:45:4f:bc:f3:72:fc:29:c5:
        ad:51:a1:e2:32:24:1e:79:d1:d1:2b:89:57:73:ec:47:e1:9a:
        67:d5:fe:0b:d4:2a:15:11:30:9f:84:f8:97:85:95:1c:c7:50:
        4d:63:35:44:6e:07:f7:98:10:b2:15:b5:f0:96:39:fb:b3:c0:
        18:67:bf:f4:a3:03:18:3f:5e:42:58:ad:80:26:e1:bc:23:50:
        7d:a3:15:7a

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:19:93:e4:00:00:00:00:00:1c
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Verification Root
        Validity
            Not Before: Feb 22 19:25:17 2011 GMT
            Not After : Feb 22 19:35:17 2021 GMT
        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:af:24:08:08:29:7a:35:9e:60:0c:aa:e7:4b:3b:
                    4e:dc:7c:bc:3c:45:1c:bb:2b:e0:fe:29:02:f9:57:
                    08:a3:64:85:15:27:f5:f1:ad:c8:31:89:5d:22:e8:
                    2a:aa:a6:42:b3:8f:f8:b9:55:b7:b1:b7:4b:b3:fe:
                    8f:7e:07:57:ec:ef:43:db:66:62:15:61:cf:60:0d:
                    a4:d8:de:f8:e0:c3:62:08:3d:54:13:eb:49:ca:59:
                    54:85:26:e5:2b:8f:1b:9f:eb:f5:a1:91:c2:33:49:
                    d8:43:63:6a:52:4b:d2:8f:e8:70:51:4d:d1:89:69:
                    7b:c7:70:f6:b3:dc:12:74:db:7b:5d:4b:56:d3:96:
                    bf:15:77:a1:b0:f4:a2:25:f2:af:1c:92:67:18:e5:
                    f4:06:04:ef:90:b9:e4:00:e4:dd:3a:b5:19:ff:02:
                    ba:f4:3c:ee:e0:8b:eb:37:8b:ec:f4:d7:ac:f2:f6:
                    f0:3d:af:dd:75:91:33:19:1d:1c:40:cb:74:24:19:
                    21:93:d9:14:fe:ac:2a:52:c7:8f:d5:04:49:e4:8d:
                    63:47:88:3c:69:83:cb:fe:47:bd:2b:7e:4f:c5:95:
                    ae:0e:9d:d4:d1:43:c0:67:73:e3:14:08:7e:e5:3f:
                    9f:73:b8:33:0a:cf:5d:3f:34:87:96:8a:ee:53:e8:
                    25:15
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Certificate Policies: 
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: 
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier: 
                7F:D3:65:A7:C2:DD:EC:BB:F0:30:09:F3:43:39:FA:02:AF:33:31:33
            X509v3 Authority Key Identifier: 
                62:FB:0A:21:5B:7F:43:6E:11:DA:09:54:50:6B:F5:D2:96:71:F1:9E
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        81:2a:82:16:8c:34:67:2b:e5:03:eb:34:7b:8c:a2:a3:50:8a:
        f4:55:86:f1:1e:8c:8e:ae:7d:ee:03:19:ce:72:95:18:48:ad:
        62:11:fd:20:fd:3f:47:06:01:5a:e2:e0:6f:8c:15:2c:4e:3c:
        6a:50:6c:0b:36:a3:cf:7a:0d:9c:42:bc:5c:f8:19:d5:60:e3:
        69:e6:e2:23:41:67:8c:68:83:76:2b:8f:93:a3:2a:b5:7f:be:
        59:fb:a9:c9:b2:26:8f:ca:a2:f3:82:1b:98:3e:91:95:27:97:
        86:61:ee:5b:5d:07:6b:cd:86:a8:e2:65:80:a8:e2:15:e2:b2:
        be:23:05:6a:ba:0c:f3:47:93:4d:ac:a4:8c:07:79:39:c0:61:
        12:3a:05:0d:89:a3:ec:9f:57:89:84:fb:ec:ca:7c:47:66:14:
        91:d8:b6:0f:19:5d:e6:b8:4a:ac:bc:47:c8:71:43:96:e6:32:
        20:a5:dc:77:86:fd:3c:e3:8b:71:db:7b:9b:03:fc:b7:1d:32:
        64:eb:16:52:a0:43:a3:fa:2e:ad:59:92:4e:7c:c7:f2:33:42:
        48:38:51:3a:7c:38:c7:1b:24:22:28:40:1e:1a:46:1f:17:db:
        18:f7:f0:27:35:6c:b8:63:d9:cd:b9:64:5d:2b:a5:5e:ef:c6:
        29:b4:f2:c7:f8:21:cc:04:ba:57:fd:01:b6:ab:c6:67:f9:e7:
        d3:99:7f:f4:f5:22:fa:72:f5:fd:ff:3a:1c:42:3a:a1:f9:80:
        18:a5:ee:8d:1c:d4:66:9e:45:01:fe:aa:ee:ff:fb:17:8f:30:
        f7:f1:cd:29:c5:9d:ec:b5:d5:49:00:3d:85:b8:cb:bb:93:3a:
        27:6a:49:c0:30:ae:66:c9:f7:23:28:32:76:f9:a4:83:56:c8:
        48:ce:5a:96:aa:a0:cc:0c:c4:7f:b4:8e:97:af:6d:e3:54:27:
        c3:9f:86:c0:d6:e4:73:08:97:05:db:d0:54:62:5e:03:48:c2:
        d5:9f:7f:a7:66:8c:d0:9d:b0:4f:d4:d3:98:5f:4b:7a:c9:7f:
        b2:29:52:d0:12:80:c7:0f:54:b6:1e:67:cd:c6:a0:6c:11:03:
        84:d3:48:75:e7:2a:fe:b0:3b:6e:0a:3a:a6:6b:76:99:05:a3:
        f1:77:68:61:33:14:47:06:fc:53:7f:52:bd:92:14:5c:4a:24:
        6a:67:8c:af:8d:90:aa:d0:f6:79:21:1b:93:26:7c:c3:ce:1e:
        bd:88:38:92:ae:45:c6:19:6a:49:50:b3:05:f8:ae:59:37:8a:
        6a:25:03:94:b1:59:81:50:e8:ba:83:80:b7:23:35:f4:76:b9:
        67:1d:59:18:ad:20:8d:94

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
        Validity
            Not Before: Feb  8 00:00:00 2010 GMT
            Not After : Feb  7 23:59:59 2020 GMT
        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https:\/\/www.verisign.com\/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:f5:23:4b:5e:a5:d7:8a:bb:32:e9:d4:57:f7:ef:
                    e4:c7:26:7e:ad:19:98:fe:a8:9d:7d:94:f6:36:6b:
                    10:d7:75:81:30:7f:04:68:7f:cb:2b:75:1e:cd:1d:
                    08:8c:df:69:94:a7:37:a3:9c:7b:80:e0:99:e1:ee:
                    37:4d:5f:ce:3b:14:ee:86:d4:d0:f5:27:35:bc:25:
                    0b:38:a7:8c:63:9d:17:a3:08:a5:ab:b0:fb:cd:6a:
                    62:82:4c:d5:21:da:1b:d9:f1:e3:84:3b:8a:2a:4f:
                    85:5b:90:01:4f:c9:a7:76:10:7f:27:03:7c:be:ae:
                    7e:7d:c1:dd:f9:05:bc:1b:48:9c:69:e7:c0:a4:3c:
                    3c:41:00:3e:df:96:e5:c5:e4:94:71:d6:55:01:c7:
                    00:26:4a:40:3c:b5:a1:26:a9:0c:a7:6d:80:8e:90:
                    25:7b:cf:bf:3f:1c:eb:2f:96:fa:e5:87:77:c6:b5:
                    56:b2:7a:3b:54:30:53:1b:df:62:34:ff:1e:d1:f4:
                    5a:93:28:85:e5:4c:17:4e:7e:5b:fd:a4:93:99:7f:
                    df:cd:ef:a4:75:ef:ef:15:f6:47:e7:f8:19:72:d8:
                    2e:34:1a:a6:b4:a7:4c:7e:bd:bb:4f:0c:3d:57:f1:
                    30:d6:a6:36:8e:d6:80:76:d7:19:2e:a5:cd:7e:34:
                    2d:89
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/cps
                  User Notice:
                    Explicit Text: https://www.verisign.com/rpa
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            1.3.6.1.5.5.7.1.12: 
                0_.].[0Y0W0U..image/gif0!0.0...+..............k...j.H.,{..0%.#http://logo.verisign.com/vslogo.gif
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.verisign.com/pca3-g5.crl
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, Code Signing
            X509v3 Subject Alternative Name: 
                DirName:/CN=VeriSignMPKI-2-8
            X509v3 Subject Key Identifier: 
                CF:99:A9:EA:7B:26:F4:4B:C9:8E:8F:D7:F0:05:26:EF:E3:D2:A7:9D
            X509v3 Authority Key Identifier: 
                7F:D3:65:A7:C2:DD:EC:BB:F0:30:09:F3:43:39:FA:02:AF:33:31:33
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        56:22:e6:34:a4:c4:61:cb:48:b9:01:ad:56:a8:64:0f:d9:8c:
        91:c4:bb:cc:0c:e5:ad:7a:a0:22:7f:df:47:38:4a:2d:6c:d1:
        7f:71:1a:7c:ec:70:a9:b1:f0:4f:e4:0f:0c:53:fa:15:5e:fe:
        74:98:49:24:85:81:26:1c:91:14:47:b0:4c:63:8c:bb:a1:34:
        d4:c6:45:e8:0d:85:26:73:03:d0:a9:8c:64:6d:dc:71:92:e6:
        45:05:60:15:59:51:39:fc:58:14:6b:fe:d4:a4:ed:79:6b:08:
        0c:41:72:e7:37:22:06:09:be:23:e9:3f:44:9a:1e:e9:61:9d:
        cc:b1:90:5c:fc:3d:d2:8d:ac:42:3d:65:36:d4:b4:3d:40:28:
        8f:9b:10:cf:23:26:cc:4b:20:cb:90:1f:5d:8c:4c:34:ca:3c:
        d8:e5:37:d6:6f:a5:20:bd:34:eb:26:d9:ae:0d:e7:c5:9a:f7:
        a1:b4:21:91:33:6f:86:e8:58:bb:25:7c:74:0e:58:fe:75:1b:
        63:3f:ce:31:7c:9b:8f:1b:96:9e:c5:53:76:84:5b:9c:ad:91:
        fa:ac:ed:93:ba:5d:c8:21:53:c2:82:53:63:af:12:0d:50:87:
        11:1b:3d:54:52:96:8a:2c:9c:3d:92:1a:08:9a:05:2e:c7:93:
        a5:48:91:d3
pkcs7-signedData
  • 1
    • SHA1: nil
    • 1.3.6.1.4.1.311.2.1.4
      • #0
        • 1.3.6.1.4.1.311.2.1.15
          • : 
            00 3c 00 3c 00 3c 00 4f  00 62 00 73 00 6f 00 6c  |.<.<.<.O.b.s.o.l|
00 65 00 74 00 65 00 3e  00 3e 00 3e              |.e.t.e.>.>.>    |
        • SHA1
          • 0a b4 10 ea 17 ea 41 dc  fe e1 00 32 30 0f e3 00  |......A....20...|
de 82 ca 91                                       |....            |
    • Certificates
      • Certificate #0
        • 2
          • 7E:93:EB:FB:7C:C6:4E:59:EA:4B:9A:77:D4:06:FC:3B
          • RSA-SHA1: nil
          • Issuer
            • C: ZA
            • ST: Western Cape
            • L: Durbanville
            • O: Thawte
            • OU: Thawte Certification
            • CN: Thawte Timestamping CA
          • 2012-12-21 00:00:00 UTC: 2020-12-30 23:59:59 UTC
          • Subject
            • C: US
            • O: Symantec Corporation
            • CN: Symantec Time Stamping Services CA - G2
          • #5
            • rsaEncryption: nil
            • B1:AC:B3:49:54:4B:97:1C:12:0A:D8:25:79:91:22:57:
              2A:6F:DC:B8:26:C4:43:73:6B:C2:BF:2E:50:5A:FB:14:
              C2:76:8E:43:01:25:43:B4:A1:E2:45:F4:E8:B7:7B:C3:
              74:CC:22:D7:B4:94:00:02:F7:4D:ED:BF:B4:B7:44:24:
              6B:CD:5F:45:3B:D1:44:CE:43:12:73:17:82:8B:69:B4:
              2B:CB:99:1E:AC:72:1B:26:4D:71:1F:B1:31:DD:FB:51:
              61:02:53:A6:AA:F5:49:2C:05:78:45:A5:2F:89:CE:E7:
              99:E7:FE:8C:E2:57:3F:3D:C6:92:DC:4A:F8:7B:33:E4:
              79:0A:FB:F0:75:88:41:9C:FF:C5:03:51:99:AA:D7:6C:
              9F:93:69:87:65:29:83:85:C2:60:14:C4:C8:C9:3B:14:
              DA:C0:81:F0:1F:0D:74:DE:92:22:AB:CA:F7:FB:74:7C:
              27:E6:F7:4A:1B:7F:A7:C3:9E:2D:AE:8A:EA:A6:E6:AA:
              27:16:7D:61:F7:98:71:11:BC:E2:50:A1:4B:E5:5D:FA:
              E5:0E:A7:2C:9F:AA:65:20:D3:D8:96:E8:C8:7C:A5:4E:
              48:44:FF:19:E2:44:07:92:0B:D7:68:84:80:5D:6A:78:
              64:45:CD:60:46:7E:54:C1:13:7C:C5:79:F1:C9:C1:71              : 0x010001
          • #6
            • subjectKeyIdentifier: 
              5f 9a f5 6e 5c cc cc 74  9a d4 dd 7d ef 3f db ec  |_..n\..t...}.?..|
4c 80 2e dd                                       |L...            |
            • authorityInfoAccess
              • OCSP: http://ocsp.thawte.com
            • basicConstraints
              • true
              • true: 0
            • crlDistributionPoints: http://crl.thawte.com/ThawteTimestampingCA.crl
            • extendedKeyUsage: timeStamping
            • keyUsage: true, 6
            • subjectAltName
              • CN: TimeStamp-2048-1
        • RSA-SHA1: 
          03 09 9b 8f 79 ef 7f 59  30 aa ef 68 b5 fa e3 09  |....y..Y0..h....|
1d bb 4f 82 06 5d 37 5f  a6 52 9f 16 8d ea 1c 92  |..O..]7_.R......|
09 44 6e f5 6d eb 58 7c  30 e8 f9 69 8d 23 73 0b  |.Dn.m.X|0..i.#s.|
12 6f 47 a9 ae 39 11 f8  2a b1 9b b0 1a c3 8e eb  |.oG..9..*.......|
59 96 00 ad ce 0c 4d b2  d0 31 a6 08 5c 2a 7a fc  |Y.....M..1..\*z.|
e2 7a 1d 57 4c a8 65 18  e9 79 40 62 25 96 6e c7  |.z.WL.e..y@b%.n.|
c7 37 6a 83 21 08 8e 41  ea dd d9 57 3f 1d 77 49  |.7j.!..A...W?.wI|
87 2a 16 06 5e a6 38 6a  22 12 a3 51 19 83 7e b6  |.*..^.8j"..Q..~.|
      • Certificate #1
        • 2
          • 0E:CF:F4:38:C8:FE:BF:35:6E:04:D8:6A:98:1B:1A:50
          • RSA-SHA1: nil
          • Issuer
            • C: US
            • O: Symantec Corporation
            • CN: Symantec Time Stamping Services CA - G2
          • 2012-10-18 00:00:00 UTC: 2020-12-29 23:59:59 UTC
          • Subject
            • C: US
            • O: Symantec Corporation
            • CN: Symantec Time Stamping Services Signer - G4
          • #5
            • rsaEncryption: nil
            • A2:63:0B:39:44:B8:BB:23:A7:44:49:BB:0E:FF:A1:F0:
              61:0A:53:93:B0:98:DB:AD:2C:0F:4A:C5:6E:FF:86:3C:
              53:55:0F:15:CE:04:3F:2B:FD:A9:96:96:D9:BE:61:79:
              0B:5B:C9:4C:86:76:E5:E0:43:4B:22:95:EE:C2:2B:43:
              C1:9F:D8:68:B4:8E:40:4F:EE:85:38:B9:11:C5:23:F2:
              64:58:F0:15:32:6F:4E:57:A1:AE:88:A4:02:D7:2A:1E:
              CD:4B:E1:DD:63:D5:17:89:32:5B:B0:5E:99:5A:A8:9D:
              28:50:0E:17:EE:96:DB:61:3B:45:51:1D:CF:12:56:0B:
              92:47:FC:AB:AE:F6:66:3D:47:AC:70:72:E7:92:E7:5F:
              CD:10:B9:C4:83:64:94:19:BD:25:80:E1:E8:D2:22:A5:
              D0:BA:02:7A:A1:77:93:5B:65:C3:EE:17:74:BC:41:86:
              2A:DC:08:4C:8C:92:8C:91:2D:9E:77:44:1F:68:D6:A8:
              74:77:DB:0E:5B:32:8B:56:8B:33:BD:D9:63:C8:49:9D:
              3A:C5:C5:EA:33:0B:D2:F1:A3:1B:F4:8B:BE:D9:B3:57:
              8B:3B:DE:04:A7:7A:22:B2:24:AE:2E:C7:70:C5:BE:4E:
              83:26:08:FB:0B:BD:A9:4F:99:08:E1:10:28:72:AA:CD              : 0x010001
          • X509v3 extensions
            • basicConstraints
              • true
              • nil
            • extendedKeyUsage: true, timeStamping
            • keyUsage: true, 0x80
            • authorityInfoAccess
              • #0
                • OCSP: http://ts-ocsp.ws.symantec.com
                • caIssuers: http://ts-aia.ws.symantec.com/tss-ca-g2.cer
            • crlDistributionPoints: http://ts-crl.ws.symantec.com/tss-ca-g2.crl
            • subjectAltName
              • CN: TimeStamp-2048-2
            • subjectKeyIdentifier: 
              46 c6 69 a3 0e 4a 14 1e  d5 4c da 52 63 17 3f 5e  |F.i..J...L.Rc.?^|
36 bc 0d e6                                       |6...            |
            • authorityKeyIdentifier: 
              5f 9a f5 6e 5c cc cc 74  9a d4 dd 7d ef 3f db ec  |_..n\..t...}.?..|
4c 80 2e dd                                       |L...            |
        • RSA-SHA1: 
          78 3b b4 91 2a 00 4c f0  8f 62 30 37 78 a3 84 27  |x;..*.L..b07x..'|
07 6f 18 b2 de 25 dc a0  d4 94 03 aa 86 4e 25 9f  |.o...%.......N%.|
9a 40 03 1c dd ce e3 79  cb 21 68 06 da b6 32 b4  |.@.....y.!h...2.|
6d bf f4 2c 26 63 33 e4  49 64 6d 0d e6 c3 67 0e  |m..,&c3.Idm...g.|
f7 05 a4 35 6c 7c 89 16  c6 e9 b2 df b2 e9 dd 20  |...5l|......... |
c6 71 0f cd 95 74 dc b6  5c de bd 37 1f 43 78 e6  |.q...t..\..7.Cx.|
78 b5 cd 28 04 20 a3 aa  f1 4b c4 88 29 91 0e 80  |x..(. ...K..)...|
d1 11 fc dd 5c 76 6e 4f  5e 0e 45 46 41 6e 0d b0  |....\vnO^.EFAn..|
ea 38 9a b1 3a da 09 71  10 fc 1c 79 b4 80 7b ac  |.8..:..q...y..{.|
69 f4 fd 9c b6 0c 16 2b  f1 7f 5b 09 3d 9b 5b e2  |i......+..[.=.[.|
16 ca 13 81 6d 00 2e 38  0d a8 29 8f 2c e1 b2 f4  |....m..8..).,...|
5a a9 01 af 15 9c 2c 2f  49 1b db 22 bb c3 fe 78  |Z.....,/I.."...x|
94 51 c3 86 b1 82 88 5d  f0 3d b4 51 a1 79 33 2b  |.Q.....].=.Q.y3+|
2e 7b b9 dc 20 09 13 71  eb 6a 19 5b cf e8 a5 30  |.{.. ..q.j.[...0|
57 2c 89 49 3f b9 cf 7f  c9 bf 3e 22 68 63 53 9a  |W,.I?.....>"hcS.|
bd 69 74 ac c5 1d 3c 7f  92 e0 c3 bc 1c d8 04 75  |.it...<........u|
      • Certificate #2
        • 2
          • 6F:36:C4:B7:4B:4F:8A:B0:01:F0:39:D6:92:A7:5B:49
          • RSA-SHA1: nil
          • Issuer
            • C: US
            • O: VeriSign, Inc.
            • OU: VeriSign Trust Network
            • OU: Terms of use at https://www.verisign.com/rpa (c)10
            • CN: VeriSign Class 3 Code Signing 2010 CA
          • 2013-04-30 00:00:00 UTC: 2016-06-19 23:59:59 UTC
          • Subject
            • C: US
            • ST: California
            • L: San Jose
            • O: Malwarebytes Corporation
            • OU: Digital ID Class 3 - Microsoft Software Validation v2
            • CN: Malwarebytes Corporation
          • #5
            • rsaEncryption: nil
            • B8:52:BD:06:AA:AE:86:8B:C3:B8:60:2A:6A:87:69:AD:
              A0:67:EF:3E:4D:27:DD:B0:EA:10:62:6B:EB:AD:40:FA:
              9F:86:F3:24:78:C0:2F:A8:29:22:76:78:C1:B1:EB:EF:
              CB:99:5C:0A:B8:E1:80:DE:D8:13:BB:5E:EC:8A:AB:01:
              FE:A1:FA:8C:D1:AB:94:C8:D1:20:60:E7:FA:C6:46:7B:
              EC:4B:26:1F:9C:5F:F4:BA:AA:E7:31:98:5C:87:8A:CE:
              DC:B7:96:B8:16:EB:9D:92:27:FF:A6:3E:4A:99:A6:54:
              CB:F3:BC:33:4B:32:8B:1F:0E:8E:C0:5D:0E:F4:30:B4:
              9C:2C:EA:63:95:09:97:D5:21:EB:91:1B:C7:FE:88:2A:
              0E:00:AB:D3:AA:04:97:A1:47:C4:E1:F9:61:E7:A3:69:
              55:1A:C1:74:67:F2:A7:32:6E:FB:1E:0C:10:AA:61:E1:
              35:CF:50:94:32:22:C7:25:AC:62:B6:FE:61:A5:8A:4F:
              60:D1:00:27:BD:6F:00:E2:9A:87:A8:F5:0A:68:43:B1:
              F7:36:A7:29:47:12:A0:87:85:0F:FB:64:41:CE:47:F1:
              9C:55:73:F1:C8:89:25:9A:1B:AD:AF:5D:9E:FD:30:F9:
              58:27:27:19:8A:3C:C5:A2:3A:2F:CC:0B:C3:98:5B:BD              : 0x010001
          • X509v3 extensions
            • basicConstraints
              • nil
            • keyUsage: true, 0x80
            • crlDistributionPoints: http://csc3-2010-crl.verisign.com/CSC3-2010.crl
            • certificatePolicies
              • 2.16.840.1.113733.1.7.23.3
                • id-qt-cps: https://www.verisign.com/rpa
            • extendedKeyUsage: codeSigning
            • authorityInfoAccess
              • #0
                • OCSP: http://ocsp.verisign.com
                • caIssuers: http://csc3-2010-aia.verisign.com/CSC3-2010.cer
            • authorityKeyIdentifier: 
              cf 99 a9 ea 7b 26 f4 4b  c9 8e 8f d7 f0 05 26 ef  |....{&.K......&.|
e3 d2 a7 9d                                       |....            |
            • nsCertType: 0x10
            • 1.3.6.1.4.1.311.2.1.27
              • false: true
        • RSA-SHA1: 
          c2 aa 9d 45 c1 55 1f 8c  6d df f5 fa b8 59 81 0a  |...E.U..m....Y..|
ef 58 1f 87 35 77 c3 e6  10 fd b5 0a 04 0e c3 b8  |.X..5w..........|
2c b3 fb 75 23 09 cf cf  b5 a0 1b f9 ae d0 57 8b  |,..u#.........W.|
86 12 8f 52 56 fc cf 4e  1d 5a f1 bb a4 b1 07 18  |...RV..N.Z......|
6e 60 ad 62 50 10 3c ef  4a d0 6a bb e5 ca c0 99  |n`.bP.<.J.j.....|
6b 0a 20 1f 15 33 c7 db  b6 79 38 40 6b ae a7 c1  |k. ..3...y8@k...|
99 32 e3 14 30 a8 78 55  e6 d6 4e 81 c7 fc ec ee  |.2..0.xU..N.....|
ab 05 13 da da ec fc 9c  9a 02 c1 47 72 19 45 eb  |...........Gr.E.|
ee 7c 64 e3 a1 33 b5 74  12 aa 66 ca 11 d9 4f 5e  |.|d..3.t..f...O^|
1f 4d 66 4c e7 1d 5e 1d  58 3e 96 96 b0 b0 91 b7  |.MfL..^.X>......|
fd 77 9c b8 de b2 56 bb  b8 8f 1b 37 45 4f bc f3  |.w....V....7EO..|
72 fc 29 c5 ad 51 a1 e2  32 24 1e 79 d1 d1 2b 89  |r.)..Q..2$.y..+.|
57 73 ec 47 e1 9a 67 d5  fe 0b d4 2a 15 11 30 9f  |Ws.G..g....*..0.|
84 f8 97 85 95 1c c7 50  4d 63 35 44 6e 07 f7 98  |.......PMc5Dn...|
10 b2 15 b5 f0 96 39 fb  b3 c0 18 67 bf f4 a3 03  |......9....g....|
18 3f 5e 42 58 ad 80 26  e1 bc 23 50 7d a3 15 7a  |.?^BX..&..#P}..z|
      • Certificate #3
        • 2
          • 61:19:93:E4:00:00:00:00:00:1C
          • RSA-SHA1: nil
          • Issuer
            • C: US
            • ST: Washington
            • L: Redmond
            • O: Microsoft Corporation
            • CN: Microsoft Code Verification Root
          • 2011-02-22 19:25:17 UTC: 2021-02-22 19:35:17 UTC
          • Subject
            • C: US
            • O: VeriSign, Inc.
            • OU: VeriSign Trust Network
            • OU: (c) 2006 VeriSign, Inc. - For authorized use only
            • CN: VeriSign Class 3 Public Primary Certification Authority - G5
          • #5
            • rsaEncryption: nil
            • AF:24:08:08:29:7A:35:9E:60:0C:AA:E7:4B:3B:4E:DC:
              7C:BC:3C:45:1C:BB:2B:E0:FE:29:02:F9:57:08:A3:64:
              85:15:27:F5:F1:AD:C8:31:89:5D:22:E8:2A:AA:A6:42:
              B3:8F:F8:B9:55:B7:B1:B7:4B:B3:FE:8F:7E:07:57:EC:
              EF:43:DB:66:62:15:61:CF:60:0D:A4:D8:DE:F8:E0:C3:
              62:08:3D:54:13:EB:49:CA:59:54:85:26:E5:2B:8F:1B:
              9F:EB:F5:A1:91:C2:33:49:D8:43:63:6A:52:4B:D2:8F:
              E8:70:51:4D:D1:89:69:7B:C7:70:F6:B3:DC:12:74:DB:
              7B:5D:4B:56:D3:96:BF:15:77:A1:B0:F4:A2:25:F2:AF:
              1C:92:67:18:E5:F4:06:04:EF:90:B9:E4:00:E4:DD:3A:
              B5:19:FF:02:BA:F4:3C:EE:E0:8B:EB:37:8B:EC:F4:D7:
              AC:F2:F6:F0:3D:AF:DD:75:91:33:19:1D:1C:40:CB:74:
              24:19:21:93:D9:14:FE:AC:2A:52:C7:8F:D5:04:49:E4:
              8D:63:47:88:3C:69:83:CB:FE:47:BD:2B:7E:4F:C5:95:
              AE:0E:9D:D4:D1:43:C0:67:73:E3:14:08:7E:E5:3F:9F:
              73:B8:33:0A:CF:5D:3F:34:87:96:8A:EE:53:E8:25:15              : 0x010001
          • #6
            • certificatePolicies: anyPolicy
            • basicConstraints: true, true
            • keyUsage: 0x86
            • subjectKeyIdentifier: 
              7f d3 65 a7 c2 dd ec bb  f0 30 09 f3 43 39 fa 02  |..e......0..C9..|
af 33 31 33                                       |.313            |
            • authorityKeyIdentifier: 
              62 fb 0a 21 5b 7f 43 6e  11 da 09 54 50 6b f5 d2  |b..![.Cn...TPk..|
96 71 f1 9e                                       |.q..            |
            • crlDistributionPoints: http://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl
        • RSA-SHA1: 
          81 2a 82 16 8c 34 67 2b  e5 03 eb 34 7b 8c a2 a3  |.*...4g+...4{...|
50 8a f4 55 86 f1 1e 8c  8e ae 7d ee 03 19 ce 72  |P..U......}....r|
95 18 48 ad 62 11 fd 20  fd 3f 47 06 01 5a e2 e0  |..H.b.. .?G..Z..|
6f 8c 15 2c 4e 3c 6a 50  6c 0b 36 a3 cf 7a 0d 9c  |o..,N..'..a.[|
5d 07 6b cd 86 a8 e2 65  80 a8 e2 15 e2 b2 be 23  |].k....e.......#|
05 6a ba 0c f3 47 93 4d  ac a4 8c 07 79 39 c0 61  |.j...G.M....y9.a|
12 3a 05 0d 89 a3 ec 9f  57 89 84 fb ec ca 7c 47  |.:......W.....|G|
66 14 91 d8 b6 0f 19 5d  e6 b8 4a ac bc 47 c8 71  |f......]..J..G.q|
43 96 e6 32 20 a5 dc 77  86 fd 3c e3 8b 71 db 7b  |C..2 ..w..<..q.{|
9b 03 fc b7 1d 32 64 eb  16 52 a0 43 a3 fa 2e ad  |.....2d..R.C....|
59 92 4e 7c c7 f2 33 42  48 38 51 3a 7c 38 c7 1b  |Y.N|..3BH8Q:|8..|
24 22 28 40 1e 1a 46 1f  17 db 18 f7 f0 27 35 6c  |$"(@..F......'5l|
b8 63 d9 cd b9 64 5d 2b  a5 5e ef c6 29 b4 f2 c7  |.c...d]+.^..)...|
f8 21 cc 04 ba 57 fd 01  b6 ab c6 67 f9 e7 d3 99  |.!...W.....g....|
7f f4 f5 22 fa 72 f5 fd  ff 3a 1c 42 3a a1 f9 80  |...".r...:.B:...|
18 a5 ee 8d 1c d4 66 9e  45 01 fe aa ee ff fb 17  |......f.E.......|
8f 30 f7 f1 cd 29 c5 9d  ec b5 d5 49 00 3d 85 b8  |.0...).....I.=..|
cb bb 93 3a 27 6a 49 c0  30 ae 66 c9 f7 23 28 32  |...:'jI.0.f..#(2|
76 f9 a4 83 56 c8 48 ce  5a 96 aa a0 cc 0c c4 7f  |v...V.H.Z.......|
b4 8e 97 af 6d e3 54 27  c3 9f 86 c0 d6 e4 73 08  |....m.T'......s.|
97 05 db d0 54 62 5e 03  48 c2 d5 9f 7f a7 66 8c  |....Tb^.H.....f.|
d0 9d b0 4f d4 d3 98 5f  4b 7a c9 7f b2 29 52 d0  |...O..._Kz...)R.|
12 80 c7 0f 54 b6 1e 67  cd c6 a0 6c 11 03 84 d3  |....T..g...l....|
48 75 e7 2a fe b0 3b 6e  0a 3a a6 6b 76 99 05 a3  |Hu.*..;n.:.kv...|
f1 77 68 61 33 14 47 06  fc 53 7f 52 bd 92 14 5c  |.wha3.G..S.R...\|
4a 24 6a 67 8c af 8d 90  aa d0 f6 79 21 1b 93 26  |J$jg.......y!..&|
7c c3 ce 1e bd 88 38 92  ae 45 c6 19 6a 49 50 b3  ||.....8..E..jIP.|
05 f8 ae 59 37 8a 6a 25  03 94 b1 59 81 50 e8 ba  |...Y7.j%...Y.P..|
83 80 b7 23 35 f4 76 b9  67 1d 59 18 ad 20 8d 94  |...#5.v.g.Y.. ..|
      • Certificate #4
        • 2
          • 52:00:E5:AA:25:56:FC:1A:86:ED:96:C9:D4:4B:33:C7
          • RSA-SHA1: nil
          • Issuer
            • C: US
            • O: VeriSign, Inc.
            • OU: VeriSign Trust Network
            • OU: (c) 2006 VeriSign, Inc. - For authorized use only
            • CN: VeriSign Class 3 Public Primary Certification Authority - G5
          • 2010-02-08 00:00:00 UTC: 2020-02-07 23:59:59 UTC
          • Subject
            • C: US
            • O: VeriSign, Inc.
            • OU: VeriSign Trust Network
            • OU: Terms of use at https://www.verisign.com/rpa (c)10
            • CN: VeriSign Class 3 Code Signing 2010 CA
          • #5
            • rsaEncryption: nil
            • F5:23:4B:5E:A5:D7:8A:BB:32:E9:D4:57:F7:EF:E4:C7:
              26:7E:AD:19:98:FE:A8:9D:7D:94:F6:36:6B:10:D7:75:
              81:30:7F:04:68:7F:CB:2B:75:1E:CD:1D:08:8C:DF:69:
              94:A7:37:A3:9C:7B:80:E0:99:E1:EE:37:4D:5F:CE:3B:
              14:EE:86:D4:D0:F5:27:35:BC:25:0B:38:A7:8C:63:9D:
              17:A3:08:A5:AB:B0:FB:CD:6A:62:82:4C:D5:21:DA:1B:
              D9:F1:E3:84:3B:8A:2A:4F:85:5B:90:01:4F:C9:A7:76:
              10:7F:27:03:7C:BE:AE:7E:7D:C1:DD:F9:05:BC:1B:48:
              9C:69:E7:C0:A4:3C:3C:41:00:3E:DF:96:E5:C5:E4:94:
              71:D6:55:01:C7:00:26:4A:40:3C:B5:A1:26:A9:0C:A7:
              6D:80:8E:90:25:7B:CF:BF:3F:1C:EB:2F:96:FA:E5:87:
              77:C6:B5:56:B2:7A:3B:54:30:53:1B:DF:62:34:FF:1E:
              D1:F4:5A:93:28:85:E5:4C:17:4E:7E:5B:FD:A4:93:99:
              7F:DF:CD:EF:A4:75:EF:EF:15:F6:47:E7:F8:19:72:D8:
              2E:34:1A:A6:B4:A7:4C:7E:BD:BB:4F:0C:3D:57:F1:30:
              D6:A6:36:8E:D6:80:76:D7:19:2E:A5:CD:7E:34:2D:89              : 0x010001
          • X509v3 extensions
            • basicConstraints
              • true
              • true: 0
            • certificatePolicies
              • 2.16.840.1.113733.1.7.23.3
                • #0
                  • id-qt-cps: https://www.verisign.com/cps
                  • id-qt-unotice: https://www.verisign.com/rpa
            • keyUsage: true, 6
            • 1.3.6.1.5.5.7.1.12
              • image/gif
                • SHA1: 
                  8f e5 d3 1a 86 ac 8d 8e  6b c3 cf 80 6a d4 48 18  |........k...j.H.|
2c 7b 19 2e                                       |,{..            |
                • http://logo.verisign.com/vslogo.gif
            • crlDistributionPoints: http://crl.verisign.com/pca3-g5.crl
            • authorityInfoAccess
              • OCSP: http://ocsp.verisign.com
            • extendedKeyUsage
              • clientAuth: codeSigning
            • subjectAltName
              • CN: VeriSignMPKI-2-8
            • subjectKeyIdentifier: 
              cf 99 a9 ea 7b 26 f4 4b  c9 8e 8f d7 f0 05 26 ef  |....{&.K......&.|
e3 d2 a7 9d                                       |....            |
            • authorityKeyIdentifier: 
              7f d3 65 a7 c2 dd ec bb  f0 30 09 f3 43 39 fa 02  |..e......0..C9..|
af 33 31 33                                       |.313            |
        • RSA-SHA1: 
          56 22 e6 34 a4 c4 61 cb  48 b9 01 ad 56 a8 64 0f  |V".4..a.H...V.d.|
d9 8c 91 c4 bb cc 0c e5  ad 7a a0 22 7f df 47 38  |.........z."..G8|
4a 2d 6c d1 7f 71 1a 7c  ec 70 a9 b1 f0 4f e4 0f  |J-l..q.|.p...O..|
0c 53 fa 15 5e fe 74 98  49 24 85 81 26 1c 91 14  |.S..^.t.I$..&...|
47 b0 4c 63 8c bb a1 34  d4 c6 45 e8 0d 85 26 73  |G.Lc...4..E...&s|
03 d0 a9 8c 64 6d dc 71  92 e6 45 05 60 15 59 51  |....dm.q..E.`.YQ|
39 fc 58 14 6b fe d4 a4  ed 79 6b 08 0c 41 72 e7  |9.X.k....yk..Ar.|
37 22 06 09 be 23 e9 3f  44 9a 1e e9 61 9d cc b1  |7"...#.?D...a...|
90 5c fc 3d d2 8d ac 42  3d 65 36 d4 b4 3d 40 28  |.\.=...B=e6..=@(|
8f 9b 10 cf 23 26 cc 4b  20 cb 90 1f 5d 8c 4c 34  |....#&.K ...].L4|
ca 3c d8 e5 37 d6 6f a5  20 bd 34 eb 26 d9 ae 0d  |.<..7.o. .4.&...|
e7 c5 9a f7 a1 b4 21 91  33 6f 86 e8 58 bb 25 7c  |......!.3o..X.%||
74 0e 58 fe 75 1b 63 3f  ce 31 7c 9b 8f 1b 96 9e  |t.X.u.c?.1|.....|
c5 53 76 84 5b 9c ad 91  fa ac ed 93 ba 5d c8 21  |.Sv.[........].!|
53 c2 82 53 63 af 12 0d  50 87 11 1b 3d 54 52 96  |S..Sc...P...=TR.|
8a 2c 9c 3d 92 1a 08 9a  05 2e c7 93 a5 48 91 d3  |.,.=.........H..|
    • Signer
      • 1
      • unnamed
        • #0
          • C: US
          • O: VeriSign, Inc.
          • OU: VeriSign Trust Network
          • OU: Terms of use at https://www.verisign.com/rpa (c)10
          • CN: VeriSign Class 3 Code Signing 2010 CA
        • 6F:36:C4:B7:4B:4F:8A:B0:01:F0:39:D6:92:A7:5B:49
      • SHA1: nil
      • #3
        • 1.3.6.1.4.1.311.2.1.12
          • nil
        • contentType: 1.3.6.1.4.1.311.2.1.4
        • 1.3.6.1.4.1.311.2.1.11: msCodeInd
        • messageDigest: 
          15 1a 68 00 01 b9 12 be  71 e8 38 08 ce 9b 91 fe  |..h.....q.8.....|
c0 be 48 97                                       |..H.            |
      • rsaEncryption: 
        81 6e 2b fe f7 b8 f8 f2  69 16 98 a4 2e a5 b6 91  |.n+.....i.......|
d0 f2 5f 49 77 6c 7c 14  d9 1b 5a 25 bc 70 68 e4  |.._Iwl|...Z%.ph.|
87 26 14 dd 81 56 35 21  61 f1 f8 ff 55 3c dc 2e  |.&...V5!a...U<..|
f4 c7 18 ea 16 97 c6 d3  67 48 66 2b eb d6 6c 85  |........gHf+..l.|
89 04 f8 78 9b 52 2e da  b1 46 ce 20 f8 97 cd 51  |...x.R...F. ...Q|
0b 89 b1 9c e2 46 e0 c4  04 24 d3 6e c9 bb c0 87  |.....F...$.n....|
8e 7b b2 d5 8f 5c 9c 0e  00 18 f3 99 56 d1 9b 4c  |.{...\......V..L|
a2 96 eb 63 4c 9c 1b af  b5 ba b0 f0 a3 a7 d3 29  |...cL..........)|
ea d0 85 8e e2 d8 88 46  1d 80 3b 01 f1 72 d9 1e  |.......F..;..r..|
88 3c 94 7e 6e 2c 64 55  c0 cc d0 b6 e9 c8 8a d6  |.<.~n,dU........|
c1 25 b6 c4 64 34 87 ca  71 8a 7d 70 5b 78 db 54  |.%..d4..q.}p[x.T|
a0 28 56 d2 ce 3f ea 89  31 e8 b4 eb b4 fe 08 dd  |.(V..?..1.......|
69 a4 75 dd 65 36 39 a2  12 6c 11 c5 fd 8b ac c2  |i.u.e69..l......|
71 c2 4d ee f1 db a3 f0  7f 8b ed a9 2a 5f fb 8d  |q.M.........*_..|
c9 96 cb fb 75 8c a7 f4  ef e8 5a 48 67 e3 03 64  |....u.....ZHg..d|
34 fe fb 20 f1 2a 8f 94  eb 1f 29 6c 6b db 0c 22  |4.. .*....)lk.."|
      • countersignature
        • 1
          • unnamed
            • #0
              • C: US
              • O: Symantec Corporation
              • CN: Symantec Time Stamping Services CA - G2
            • 0E:CF:F4:38:C8:FE:BF:35:6E:04:D8:6A:98:1B:1A:50
          • SHA1: nil
          • #2
            • contentType: pkcs7-data
            • signingTime: 2016-01-20 21:05:26 UTC
            • messageDigest: 
              01 2e 97 76 f4 37 83 8c  f4 05 96 aa 97 8c c1 f5  |...v.7..........|
70 2b 76 0a                                       |p+v.            |
          • rsaEncryption: 
            3f c8 7a 48 c2 45 8e ba  03 45 d8 b1 cc 72 42 b4  |?.zH.E...E...rB.|
42 03 75 67 c9 08 a7 28  58 c1 3b 01 ed ad 12 88  |B.ug...(X.;.....|
bb 28 80 6f b8 5e 12 9b  aa 05 37 9f 2c 4b 86 87  |.(.o.^....7.,K..|
3c d9 28 ee 7b 9a df ac  ef ab 07 51 a3 60 9b 26  |<.(.{......Q.`.&|
83 1d 3f 29 62 8a 78 28  4f fe d6 3b e2 a3 de f9  |..?)b.x(O..;....|
3b 00 18 c7 5e dc 9f a6  c8 2a ee ac 18 02 3f ce  |;...^....*....?.|
68 7b c4 ce 25 61 8d f3  5b af 6c 69 19 33 c7 6e  |h{..%a..[.li.3.n|
a3 80 f1 a7 eb 89 9f 1e  93 bd 02 b2 2b 45 22 bc  |............+E".|
01 44 9b e0 c2 26 68 8b  0f 54 92 da 28 81 7b 4b  |.D...&h..T..(.{K|
57 7a 21 37 1c f6 5e ad  71 04 6f 61 79 16 52 8b  |Wz!7..^.q.oay.R.|
72 a3 2c 05 a4 16 c8 c5  b8 07 c7 80 38 d1 8c e8  |r.,.........8...|
4a 92 c2 65 c7 7f 30 a3  59 0a 3e da 7c f5 bc bc  |J..e..0.Y.>.|...|
e3 0a 44 58 07 0d 99 12  36 db eb a2 1a 5a 54 bd  |..DX....6....ZT.|
02 69 28 25 2c 5f 1b 27  ec 50 7f 8f 6f 14 b3 a5  |.i(%,_.'.P..o...|
6d 68 a1 ae f4 c2 4e 23  31 b9 77 ac 21 fd ee 2a  |mh....N#1.w.!..*|
46 39 fc 96 37 ef e0 ad  37 20 55 5e f2 09 91 23  |F9..7...7 U^...#|
offsetsizetypecomment
15c115HTM#
15d047880BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK