d04aaed0223e197af9d030b48267e185

info
MZ
PE
resources
imports
foremost
7zip
signature
hexdump
disasm
log
discuss
donate

filename	d04aaed0223e197af9d030b48267e185
size	227072 (0x37700)
md5	d04aaed0223e197af9d030b48267e185

type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
mimetype	application/x-dosexec

clamav	Win.Adware.Somoto FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	7
TimeDateStamp	0x4d0b29e4
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x30f
Magic	0x10b
LinkerVersion	2.56
SizeOfCode	0x7200
SizeOfInitializedData	0x3a00
SizeOfUninitializedData	0x1b000
AddressOfEntryPoint	0x39ac
BaseOfCode	0x1000
BaseOfData	0x9000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	6.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x36000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0x8000
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x70bc	0x7200	R-X CODE
.data	0x9000	0x8c	0x200	RW- IDATA
.rdata	0xa000	0xc7c	0xe00	R-- IDATA
.bss	0xb000	0x1ae08	0	RW- UDATA
.idata	0x26000	0x1344	0x1400	RW- IDATA
.ndata	0x28000	0x9000	0x400	RW- IDATA
.rsrc	0x31000	0x4338	0x4400	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x26000	0x1344
RESOURCE	0x31000	0x4338
EXCEPTION	0	0
SECURITY	0x35cd8	0x1a28
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
ICON	#1	9640
ICON	#2	4264
ICON	#3	1128
DIALOG	#105	280
DIALOG	#106	296
DIALOG	#111	96
GROUP_ICON	#103	48
MANIFEST	#1	958

module_name	hint	function_name
ADVAPI32.DLL	386	RegCloseKey
ADVAPI32.DLL	390	RegCreateKeyExA
ADVAPI32.DLL	393	RegDeleteKeyA
ADVAPI32.DLL	397	RegDeleteValueA
ADVAPI32.DLL	400	RegEnumKeyA
ADVAPI32.DLL	404	RegEnumValueA
ADVAPI32.DLL	413	RegOpenKeyExA
ADVAPI32.DLL	423	RegQueryValueExA
ADVAPI32.DLL	434	RegSetValueExA
COMCTL32.DLL	56	ImageList_AddMasked
COMCTL32.DLL	59	ImageList_Create
COMCTL32.DLL	60	ImageList_Destroy
COMCTL32.DLL	91	InitCommonControls
GDI32.dll	30	CreateBrushIndirect
GDI32.dll	47	CreateFontIndirectA
GDI32.dll	73	DeleteObject
GDI32.dll	146	GetDeviceCaps
GDI32.dll	279	SelectObject
GDI32.dll	285	SetBkColor
GDI32.dll	286	SetBkMode
GDI32.dll	321	SetTextColor
KERNEL32.dll	38	CloseHandle
KERNEL32.dll	43	CompareFileTime
KERNEL32.dll	53	CopyFileA
KERNEL32.dll	60	CreateDirectoryA
KERNEL32.dll	68	CreateFileA
KERNEL32.dll	85	CreateProcessA
KERNEL32.dll	91	CreateThread
KERNEL32.dll	109	DeleteFileA
KERNEL32.dll	156	ExitProcess
KERNEL32.dll	159	ExpandEnvironmentStringsA
KERNEL32.dll	178	FindClose
KERNEL32.dll	182	FindFirstFileA
KERNEL32.dll	191	FindNextFileA
KERNEL32.dll	214	FreeLibrary
KERNEL32.dll	237	GetCommandLineA
KERNEL32.dll	283	GetCurrentProcess
KERNEL32.dll	292	GetDiskFreeSpaceA
KERNEL32.dll	306	GetExitCodeProcess
KERNEL32.dll	308	GetFileAttributesA
KERNEL32.dll	313	GetFileSize
KERNEL32.dll	319	GetFullPathNameA
KERNEL32.dll	325	GetLastError
KERNEL32.dll	335	GetModuleFileNameA
KERNEL32.dll	337	GetModuleHandleA
KERNEL32.dll	360	GetPrivateProfileStringA
KERNEL32.dll	364	GetProcAddress
KERNEL32.dll	384	GetShortPathNameA
KERNEL32.dll	396	GetSystemDirectoryA
KERNEL32.dll	412	GetTempFileNameA
KERNEL32.dll	414	GetTempPathA
KERNEL32.dll	423	GetTickCount
KERNEL32.dll	432	GetVersion
KERNEL32.dll	443	GetWindowsDirectoryA
KERNEL32.dll	448	GlobalAlloc
KERNEL32.dll	455	GlobalFree
KERNEL32.dll	459	GlobalLock
KERNEL32.dll	467	GlobalUnlock
KERNEL32.dll	524	LoadLibraryA
KERNEL32.dll	525	LoadLibraryExA
KERNEL32.dll	553	MoveFileA
KERNEL32.dll	559	MulDiv
KERNEL32.dll	560	MultiByteToWideChar
KERNEL32.dll	616	ReadFile
KERNEL32.dll	631	RemoveDirectoryA
KERNEL32.dll	648	SearchPathA
KERNEL32.dll	688	SetCurrentDirectoryA
KERNEL32.dll	697	SetErrorMode
KERNEL32.dll	701	SetFileAttributesA
KERNEL32.dll	703	SetFilePointer
KERNEL32.dll	707	SetFileTime
KERNEL32.dll	751	Sleep
KERNEL32.dll	810	WaitForSingleObject
KERNEL32.dll	827	WriteFile
KERNEL32.dll	833	WritePrivateProfileStringA
KERNEL32.dll	854	lstrcatA
KERNEL32.dll	857	lstrcmpA
KERNEL32.dll	860	lstrcmpiA
KERNEL32.dll	866	lstrcpynA
KERNEL32.dll	869	lstrlenA
OLE32.dll	12	CoCreateInstance
OLE32.dll	69	CoTaskMemFree
OLE32.dll	180	OleInitialize
OLE32.dll	203	OleUninitialize
SHELL32.DLL	60	SHBrowseForFolderA
SHELL32.DLL	74	SHFileOperationA
SHELL32.DLL	85	SHGetFileInfoA
SHELL32.DLL	100	SHGetPathFromIDListA
SHELL32.DLL	104	SHGetSpecialFolderLocation
SHELL32.DLL	143	ShellExecuteA
USER32.dll	6	AppendMenuA
USER32.dll	11	BeginPaint
USER32.dll	24	CallWindowProcA
USER32.dll	39	CharNextA
USER32.dll	42	CharPrevA
USER32.dll	53	CheckDlgButton
USER32.dll	61	CloseClipboard
USER32.dll	79	CreateDialogParamA
USER32.dll	88	CreatePopupMenu
USER32.dll	89	CreateWindowExA
USER32.dll	133	DefWindowProcA
USER32.dll	143	DestroyWindow
USER32.dll	146	DialogBoxParamA
USER32.dll	148	DispatchMessageA
USER32.dll	171	DrawTextA
USER32.dll	176	EmptyClipboard
USER32.dll	177	EnableMenuItem
USER32.dll	179	EnableWindow
USER32.dll	181	EndDialog
USER32.dll	183	EndPaint
USER32.dll	207	ExitWindowsEx
USER32.dll	208	FillRect
USER32.dll	210	FindWindowExA
USER32.dll	226	GetClassInfoA
USER32.dll	235	GetClientRect
USER32.dll	247	GetDC
USER32.dll	252	GetDlgItem
USER32.dll	254	GetDlgItemTextA
USER32.dll	294	GetMessagePos
USER32.dll	322	GetSysColor
USER32.dll	324	GetSystemMenu
USER32.dll	325	GetSystemMetrics
USER32.dll	340	GetWindowLongA
USER32.dll	346	GetWindowRect
USER32.dll	368	InvalidateRect
USER32.dll	391	IsWindow
USER32.dll	392	IsWindowEnabled
USER32.dll	394	IsWindowVisible
USER32.dll	400	LoadBitmapA
USER32.dll	402	LoadCursorA
USER32.dll	408	LoadImageA
USER32.dll	434	MessageBoxIndirectA
USER32.dll	452	OpenClipboard
USER32.dll	461	PeekMessageA
USER32.dll	465	PostQuitMessage
USER32.dll	476	RegisterClassA
USER32.dll	496	ScreenToClient
USER32.dll	504	SendMessageA
USER32.dll	507	SendMessageTimeoutA
USER32.dll	516	SetClassLongA
USER32.dll	519	SetClipboardData
USER32.dll	521	SetCursor
USER32.dll	526	SetDlgItemTextA
USER32.dll	530	SetForegroundWindow
USER32.dll	559	SetTimer
USER32.dll	565	SetWindowLongA
USER32.dll	568	SetWindowPos
USER32.dll	570	SetWindowTextA
USER32.dll	581	ShowWindow
USER32.dll	587	SystemParametersInfoA
USER32.dll	598	TrackPopupMenu
USER32.dll	633	wsprintfA
VERSION.dll		GetFileVersionInfoA
VERSION.dll	1	GetFileVersionInfoSizeA
VERSION.dll	10	VerQueryValueA

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=US/O=Thawte, Inc./CN=Thawte Code Signing CA - G2

serial: 3EE11B140A803DE260823157A875B8C5

Certificates (5)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3e:e1:1b:14:0a:80:3d:e2:60:82:31:57:a8:75:b8:c5
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=Thawte, Inc., CN=Thawte Code Signing CA - G2
        Validity
            Not Before: Jun 28 00:00:00 2013 GMT
            Not After : Jun 28 23:59:59 2015 GMT
        Subject: C=IL, ST=NA, L=Tel Aviv, O=SITE ON SPOT Ltd., CN=SITE ON SPOT Ltd.
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:cd:90:6b:59:de:2b:a7:0e:d4:29:4c:1e:bb:82:
                    bf:29:f5:8a:67:a0:99:2b:a2:89:7d:09:a6:56:7f:
                    3c:db:dd:c3:84:b6:af:f5:69:2a:e3:6a:1a:6a:25:
                    44:85:da:ae:81:3b:46:7c:26:bc:bd:3c:21:f1:6c:
                    78:2b:bd:0b:42:43:d9:51:a1:b8:66:8b:d7:d8:eb:
                    7e:81:d1:d7:33:ea:24:31:01:e5:7d:dd:97:af:de:
                    01:ea:a7:ad:f2:99:29:e3:ad:fd:ea:44:18:56:73:
                    1b:aa:90:8c:fa:b3:0c:85:dd:70:2d:62:a7:32:52:
                    ef:a6:4f:58:36:c0:c7:6a:f1:83:4a:65:3e:a7:36:
                    39:73:d5:32:25:9c:88:19:8c:e1:1b:56:2e:e5:51:
                    a8:dd:82:7b:ab:7d:ce:99:8c:72:67:c6:4e:fe:f2:
                    66:27:f8:9d:fb:fd:a0:7e:b7:23:9c:f1:94:eb:25:
                    8a:ea:3d:f9:d7:33:bb:fc:0f:ba:76:cd:97:3f:ae:
                    6c:a7:58:dd:89:cf:80:5e:4d:1a:75:16:f1:4b:35:
                    8e:8d:a1:6d:37:22:13:58:31:9b:74:19:d7:ff:5f:
                    09:d9:f1:28:a0:73:5f:de:af:70:bc:47:32:43:3a:
                    1e:5c:80:9a:4c:84:12:9e:6e:79:2f:68:2e:80:d1:
                    06:89
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://cs-g2-crl.thawte.com/ThawteCSG2.crl

            X509v3 Extended Key Usage: 
                Code Signing, Microsoft Commercial Code Signing
            2.5.29.4: 
                0.0.0..
+.....7.......
            Authority Information Access: 
                OCSP - URI:http://ocsp.thawte.com

            Netscape Cert Type: 
                Object Signing
    Signature Algorithm: sha1WithRSAEncryption
         7d:f1:28:cc:5e:31:8a:ca:0a:bb:48:b6:37:43:de:d2:9f:e1:
         7e:b8:23:66:e9:53:54:b2:e1:b4:0a:d8:65:e6:5a:7a:fd:50:
         39:ab:73:3c:59:65:c7:cb:45:92:16:d9:8a:c8:09:c3:05:f9:
         9c:d2:e7:62:a8:03:cd:64:56:10:c6:6f:55:1b:23:34:ad:70:
         38:c1:ff:60:91:b7:39:ee:01:ae:f8:b0:37:a3:0a:2c:f7:bb:
         a4:81:43:cd:66:30:57:29:6c:27:4b:e8:e9:6c:58:f6:54:e3:
         4e:e6:60:49:ed:78:af:20:9e:f4:bb:d9:d4:dd:fa:76:02:89:
         de:d4:2d:60:4a:09:7a:1d:5f:16:28:0b:c5:f8:81:21:0d:71:
         ae:af:49:7c:ec:8f:3b:1d:0c:01:c9:95:26:cd:91:1d:56:2f:
         08:a1:eb:6f:9e:91:1f:76:23:2f:3c:b0:f4:c3:c7:c8:29:8f:
         ce:0b:1f:79:13:f8:1b:d6:99:75:76:a8:f3:59:d4:c9:85:e3:
         93:0e:89:36:ec:fd:7f:49:a0:24:7c:29:88:db:f8:a7:60:81:
         19:af:7c:a9:64:dc:19:91:eb:1b:d0:c6:ac:0b:59:f8:97:11:
         18:56:a5:57:56:27:8c:e9:a7:dd:7e:84:49:f6:13:7c:39:b7:
         a5:b8:1a:2f

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA
        Validity
            Not Before: Feb  8 00:00:00 2010 GMT
            Not After : Feb  7 23:59:59 2020 GMT
        Subject: C=US, O=Thawte, Inc., CN=Thawte Code Signing CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b7:8b:cf:75:5b:9f:25:da:7e:39:b0:93:db:38:
                    d3:a9:23:d0:82:fa:e9:24:7e:5c:0b:8e:83:f8:e6:
                    7a:59:e6:a3:c5:98:a7:99:d2:44:ff:00:a6:a5:39:
                    04:8a:da:29:88:ea:db:a2:f3:1c:99:15:26:c2:b1:
                    f4:fc:e1:0c:47:a9:09:11:06:0a:20:92:b9:c7:a0:
                    04:8c:5c:94:19:ab:5b:25:2c:1d:62:7e:70:0d:ce:
                    61:6c:dd:2b:82:c9:ce:5d:48:5f:f7:c2:be:bc:41:
                    23:1e:4f:29:5d:d7:4f:bc:f4:c5:2a:fc:63:e6:7c:
                    26:4e:99:a7:79:41:9e:10:4a:7a:79:c9:c6:86:f7:
                    86:95:d2:26:ce:3c:18:2a:d6:7c:ce:af:cd:ad:bb:
                    f7:82:2c:70:26:37:45:e5:0f:47:22:c6:01:28:bd:
                    2e:83:5c:6a:a4:47:c1:e7:d0:d8:6b:81:46:3f:21:
                    17:f5:07:c5:43:5a:a6:67:2c:b8:7b:60:11:b5:83:
                    ee:f5:74:0a:72:71:44:3d:58:fe:e8:1a:ab:38:c3:
                    59:db:7f:6e:38:7d:76:c7:72:69:98:36:96:57:d3:
                    66:1c:d2:54:91:04:2e:54:19:b0:dc:3d:b5:22:5e:
                    86:d5:2a:7e:20:df:5d:e6:7a:b1:65:fe:c5:02:4e:
                    31:2d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.thawte.com/ThawtePCA.crl

            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            Authority Information Access: 
                OCSP - URI:http://ocsp.thawte.com

            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, Code Signing
            X509v3 Subject Alternative Name: 
                DirName:/CN=VeriSignMPKI-2-10
            X509v3 Subject Key Identifier: 
                D4:0D:65:3F:7A:BD:34:C6:FE:47:E7:4C:0D:C0:BD:F2:DE:15:AB:71
            X509v3 Authority Key Identifier: 
                keyid:7B:5B:45:CF:AF:CE:CB:7A:FD:31:92:1A:6A:B6:F3:46:EB:57:48:50

    Signature Algorithm: sha1WithRSAEncryption
         56:fe:53:5c:e1:c7:9e:bc:a7:ed:7e:53:6d:6a:14:4b:51:8c:
         40:5e:80:5f:aa:a4:e8:2f:ef:38:c8:04:c9:ca:3e:cf:df:3a:
         58:4e:b0:d4:b6:63:c5:29:57:fa:02:05:9a:45:4d:68:db:2a:
         1b:d4:34:3d:9f:00:c3:5a:cb:95:49:a5:6e:e1:b0:c5:fc:41:
         4d:41:4a:6f:d3:77:c8:d7:38:8d:e4:19:de:18:f3:1f:15:65:
         83:6d:45:0c:53:f9:0a:9a:2e:a5:5d:bf:6f:32:81:18:92:19:
         6a:55:00:ad:63:1c:52:06:7e:55:d9:29:68:ae:4a:7c:18:9a:
         79:88:6b:23:23:d8:27:38:2a:29:87:76:ca:fb:c7:b6:62:23:
         1f:ed:7a:56:4c:dd:9c:32:5b:f5:3d:0c:46:18:95:3b:2a:23:
         68:83:64:41:d9:00:6d:0f:19:24:15:68:72:bd:c5:71:67:6e:
         ac:4c:db:90:eb:51:a5:1a:62:07:d0:be:6a:00:47:3c:72:2f:
         ec:4f:61:3e:73:85:ce:5a:0a:b7:ba:c0:1c:13:75:e3:22:39:
         28:dd:6d:1d:09:46:9d:4f:ba:e8:40:81:91:c6:a4:ce:94:72:
         1b:01:cf:2a:6e:15:67:95:89:ae:7d:b7:b7:cd:f9:0a:3d:75:
         b6:6b:3c:25

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA
        Validity
            Not Before: Nov 17 00:00:00 2006 GMT
            Not After : Jul 16 23:59:59 2036 GMT
        Subject: C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:ac:a0:f0:fb:80:59:d4:9c:c7:a4:cf:9d:a1:59:
                    73:09:10:45:0c:0d:2c:6e:68:f1:6c:5b:48:68:49:
                    59:37:fc:0b:33:19:c2:77:7f:cc:10:2d:95:34:1c:
                    e6:eb:4d:09:a7:1c:d2:b8:c9:97:36:02:b7:89:d4:
                    24:5f:06:c0:cc:44:94:94:8d:02:62:6f:eb:5a:dd:
                    11:8d:28:9a:5c:84:90:10:7a:0d:bd:74:66:2f:6a:
                    38:a0:e2:d5:54:44:eb:1d:07:9f:07:ba:6f:ee:e9:
                    fd:4e:0b:29:f5:3e:84:a0:01:f1:9c:ab:f8:1c:7e:
                    89:a4:e8:a1:d8:71:65:0d:a3:51:7b:ee:bc:d2:22:
                    60:0d:b9:5b:9d:df:ba:fc:51:5b:0b:af:98:b2:e9:
                    2e:e9:04:e8:62:87:de:2b:c8:d7:4e:c1:4c:64:1e:
                    dd:cf:87:58:ba:4a:4f:ca:68:07:1d:1c:9d:4a:c6:
                    d5:2f:91:cc:7c:71:72:1c:c5:c0:67:eb:32:fd:c9:
                    92:5c:94:da:85:c0:9b:bf:53:7d:2b:09:f4:8c:9d:
                    91:1f:97:6a:52:cb:de:09:36:a4:77:d8:7b:87:50:
                    44:d5:3e:6e:29:69:fb:39:49:26:1e:09:a5:80:7b:
                    40:2d:eb:e8:27:85:c9:fe:61:fd:7e:e6:7c:97:1d:
                    d5:9d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier: 
                7B:5B:45:CF:AF:CE:CB:7A:FD:31:92:1A:6A:B6:F3:46:EB:57:48:50
    Signature Algorithm: sha1WithRSAEncryption
         79:11:c0:4b:b3:91:b6:fc:f0:e9:67:d4:0d:6e:45:be:55:e8:
         93:d2:ce:03:3f:ed:da:25:b0:1d:57:cb:1e:3a:76:a0:4c:ec:
         50:76:e8:64:72:0c:a4:a9:f1:b8:8b:d6:d6:87:84:bb:32:e5:
         41:11:c0:77:d9:b3:60:9d:eb:1b:d5:d1:6e:44:44:a9:a6:01:
         ec:55:62:1d:77:b8:5c:8e:48:49:7c:9c:3b:57:11:ac:ad:73:
         37:8e:2f:78:5c:90:68:47:d9:60:60:e6:fc:07:3d:22:20:17:
         c4:f7:16:e9:c4:d8:72:f9:c8:73:7c:df:16:2f:15:a9:3e:fd:
         6a:27:b6:a1:eb:5a:ba:98:1f:d5:e3:4d:64:0a:9d:13:c8:61:
         ba:f5:39:1c:87:ba:b8:bd:7b:22:7f:f6:fe:ac:40:79:e5:ac:
         10:6f:3d:8f:1b:79:76:8b:c4:37:b3:21:18:84:e5:36:00:eb:
         63:20:99:b9:e9:fe:33:04:bb:41:c8:c1:02:f9:44:63:20:9e:
         81:ce:42:d3:d6:3f:2c:76:d3:63:9c:59:dd:8f:a6:e1:0e:a0:
         2e:41:f7:2e:95:47:cf:bc:fd:33:f3:f6:0b:61:7e:7e:91:2b:
         81:47:c2:27:30:ee:a7:10:5d:37:8f:5c:39:2b:e4:04:f0:7b:
         8d:56:8c:68

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA - G2
        Validity
            Not Before: Oct 18 00:00:00 2012 GMT
            Not After : Dec 29 23:59:59 2020 GMT
        Subject: C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer - G4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:a2:63:0b:39:44:b8:bb:23:a7:44:49:bb:0e:ff:
                    a1:f0:61:0a:53:93:b0:98:db:ad:2c:0f:4a:c5:6e:
                    ff:86:3c:53:55:0f:15:ce:04:3f:2b:fd:a9:96:96:
                    d9:be:61:79:0b:5b:c9:4c:86:76:e5:e0:43:4b:22:
                    95:ee:c2:2b:43:c1:9f:d8:68:b4:8e:40:4f:ee:85:
                    38:b9:11:c5:23:f2:64:58:f0:15:32:6f:4e:57:a1:
                    ae:88:a4:02:d7:2a:1e:cd:4b:e1:dd:63:d5:17:89:
                    32:5b:b0:5e:99:5a:a8:9d:28:50:0e:17:ee:96:db:
                    61:3b:45:51:1d:cf:12:56:0b:92:47:fc:ab:ae:f6:
                    66:3d:47:ac:70:72:e7:92:e7:5f:cd:10:b9:c4:83:
                    64:94:19:bd:25:80:e1:e8:d2:22:a5:d0:ba:02:7a:
                    a1:77:93:5b:65:c3:ee:17:74:bc:41:86:2a:dc:08:
                    4c:8c:92:8c:91:2d:9e:77:44:1f:68:d6:a8:74:77:
                    db:0e:5b:32:8b:56:8b:33:bd:d9:63:c8:49:9d:3a:
                    c5:c5:ea:33:0b:d2:f1:a3:1b:f4:8b:be:d9:b3:57:
                    8b:3b:de:04:a7:7a:22:b2:24:ae:2e:c7:70:c5:be:
                    4e:83:26:08:fb:0b:bd:a9:4f:99:08:e1:10:28:72:
                    aa:cd
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Extended Key Usage: critical
                Time Stamping
            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access: 
                OCSP - URI:http://ts-ocsp.ws.symantec.com
                CA Issuers - URI:http://ts-aia.ws.symantec.com/tss-ca-g2.cer

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://ts-crl.ws.symantec.com/tss-ca-g2.crl

            X509v3 Subject Alternative Name: 
                DirName:/CN=TimeStamp-2048-2
            X509v3 Subject Key Identifier: 
                46:C6:69:A3:0E:4A:14:1E:D5:4C:DA:52:63:17:3F:5E:36:BC:0D:E6
            X509v3 Authority Key Identifier: 
                keyid:5F:9A:F5:6E:5C:CC:CC:74:9A:D4:DD:7D:EF:3F:DB:EC:4C:80:2E:DD

    Signature Algorithm: sha1WithRSAEncryption
         78:3b:b4:91:2a:00:4c:f0:8f:62:30:37:78:a3:84:27:07:6f:
         18:b2:de:25:dc:a0:d4:94:03:aa:86:4e:25:9f:9a:40:03:1c:
         dd:ce:e3:79:cb:21:68:06:da:b6:32:b4:6d:bf:f4:2c:26:63:
         33:e4:49:64:6d:0d:e6:c3:67:0e:f7:05:a4:35:6c:7c:89:16:
         c6:e9:b2:df:b2:e9:dd:20:c6:71:0f:cd:95:74:dc:b6:5c:de:
         bd:37:1f:43:78:e6:78:b5:cd:28:04:20:a3:aa:f1:4b:c4:88:
         29:91:0e:80:d1:11:fc:dd:5c:76:6e:4f:5e:0e:45:46:41:6e:
         0d:b0:ea:38:9a:b1:3a:da:09:71:10:fc:1c:79:b4:80:7b:ac:
         69:f4:fd:9c:b6:0c:16:2b:f1:7f:5b:09:3d:9b:5b:e2:16:ca:
         13:81:6d:00:2e:38:0d:a8:29:8f:2c:e1:b2:f4:5a:a9:01:af:
         15:9c:2c:2f:49:1b:db:22:bb:c3:fe:78:94:51:c3:86:b1:82:
         88:5d:f0:3d:b4:51:a1:79:33:2b:2e:7b:b9:dc:20:09:13:71:
         eb:6a:19:5b:cf:e8:a5:30:57:2c:89:49:3f:b9:cf:7f:c9:bf:
         3e:22:68:63:53:9a:bd:69:74:ac:c5:1d:3c:7f:92:e0:c3:bc:
         1c:d8:04:75

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
        Validity
            Not Before: Dec 21 00:00:00 2012 GMT
            Not After : Dec 30 23:59:59 2020 GMT
        Subject: C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b1:ac:b3:49:54:4b:97:1c:12:0a:d8:25:79:91:
                    22:57:2a:6f:dc:b8:26:c4:43:73:6b:c2:bf:2e:50:
                    5a:fb:14:c2:76:8e:43:01:25:43:b4:a1:e2:45:f4:
                    e8:b7:7b:c3:74:cc:22:d7:b4:94:00:02:f7:4d:ed:
                    bf:b4:b7:44:24:6b:cd:5f:45:3b:d1:44:ce:43:12:
                    73:17:82:8b:69:b4:2b:cb:99:1e:ac:72:1b:26:4d:
                    71:1f:b1:31:dd:fb:51:61:02:53:a6:aa:f5:49:2c:
                    05:78:45:a5:2f:89:ce:e7:99:e7:fe:8c:e2:57:3f:
                    3d:c6:92:dc:4a:f8:7b:33:e4:79:0a:fb:f0:75:88:
                    41:9c:ff:c5:03:51:99:aa:d7:6c:9f:93:69:87:65:
                    29:83:85:c2:60:14:c4:c8:c9:3b:14:da:c0:81:f0:
                    1f:0d:74:de:92:22:ab:ca:f7:fb:74:7c:27:e6:f7:
                    4a:1b:7f:a7:c3:9e:2d:ae:8a:ea:a6:e6:aa:27:16:
                    7d:61:f7:98:71:11:bc:e2:50:a1:4b:e5:5d:fa:e5:
                    0e:a7:2c:9f:aa:65:20:d3:d8:96:e8:c8:7c:a5:4e:
                    48:44:ff:19:e2:44:07:92:0b:d7:68:84:80:5d:6a:
                    78:64:45:cd:60:46:7e:54:c1:13:7c:c5:79:f1:c9:
                    c1:71
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                5F:9A:F5:6E:5C:CC:CC:74:9A:D4:DD:7D:EF:3F:DB:EC:4C:80:2E:DD
            Authority Information Access: 
                OCSP - URI:http://ocsp.thawte.com

            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.thawte.com/ThawteTimestampingCA.crl

            X509v3 Extended Key Usage: 
                Time Stamping
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name: 
                DirName:/CN=TimeStamp-2048-1
    Signature Algorithm: sha1WithRSAEncryption
         03:09:9b:8f:79:ef:7f:59:30:aa:ef:68:b5:fa:e3:09:1d:bb:
         4f:82:06:5d:37:5f:a6:52:9f:16:8d:ea:1c:92:09:44:6e:f5:
         6d:eb:58:7c:30:e8:f9:69:8d:23:73:0b:12:6f:47:a9:ae:39:
         11:f8:2a:b1:9b:b0:1a:c3:8e:eb:59:96:00:ad:ce:0c:4d:b2:
         d0:31:a6:08:5c:2a:7a:fc:e2:7a:1d:57:4c:a8:65:18:e9:79:
         40:62:25:96:6e:c7:c7:37:6a:83:21:08:8e:41:ea:dd:d9:57:
         3f:1d:77:49:87:2a:16:06:5e:a6:38:6a:22:12:a3:51:19:83:
         7e:b6

pkcs7-signedData

1
- SHA1: nil
- 1.3.6.1.4.1.311.2.1.4
  - #0
    - 1.3.6.1.4.1.311.2.1.15
      - :
        00 3c 00 3c 00 3c 00 4f 00 62 00 73 00 6f 00 6c |.<.<.<.O.b.s.o.l| 00 65 00 74 00 65 00 3e 00 3e 00 3e |.e.t.e.>.>.> |
    - SHA1
      - 8c ed 25 08 0d 22 ae 32 01 c2 de 9f 9e 78 63 b4 |..%..".2.....xc.| b1 1a bb 4d |...M |
- Certificates
  - Certificate #0
    - 2
      - 3E:E1:1B:14:0A:80:3D:E2:60:82:31:57:A8:75:B8:C5
      - RSA-SHA1: nil
      - Issuer
        C: US
        O: Thawte, Inc.
        CN: Thawte Code Signing CA - G2
      - 2013-06-28 00:00:00 UTC: 2015-06-28 23:59:59 UTC
      - Subject
        C: IL
        ST: NA
        L: Tel Aviv
        O: SITE ON SPOT Ltd.
        CN: SITE ON SPOT Ltd.
      - #5
        rsaEncryption: nil
        CD:90:6B:59:DE:2B:A7:0E:D4:29:4C:1E:BB:82:BF:29:
        F5:8A:67:A0:99:2B:A2:89:7D:09:A6:56:7F:3C:DB:DD:
        C3:84:B6:AF:F5:69:2A:E3:6A:1A:6A:25:44:85:DA:AE:
        81:3B:46:7C:26:BC:BD:3C:21:F1:6C:78:2B:BD:0B:42:
        43:D9:51:A1:B8:66:8B:D7:D8:EB:7E:81:D1:D7:33:EA:
        24:31:01:E5:7D:DD:97:AF:DE:01:EA:A7:AD:F2:99:29:
        E3:AD:FD:EA:44:18:56:73:1B:AA:90:8C:FA:B3:0C:85:
        DD:70:2D:62:A7:32:52:EF:A6:4F:58:36:C0:C7:6A:F1:
        83:4A:65:3E:A7:36:39:73:D5:32:25:9C:88:19:8C:E1:
        1B:56:2E:E5:51:A8:DD:82:7B:AB:7D:CE:99:8C:72:67:
        C6:4E:FE:F2:66:27:F8:9D:FB:FD:A0:7E:B7:23:9C:F1:
        94:EB:25:8A:EA:3D:F9:D7:33:BB:FC:0F:BA:76:CD:97:
        3F:AE:6C:A7:58:DD:89:CF:80:5E:4D:1A:75:16:F1:4B:
        35:8E:8D:A1:6D:37:22:13:58:31:9B:74:19:D7:FF:5F:
        09:D9:F1:28:A0:73:5F:DE:AF:70:BC:47:32:43:3A:1E:
        5C:80:9A:4C:84:12:9E:6E:79:2F:68:2E:80:D1:06:89: 0x010001
      - X509v3 extensions
        basicConstraints
        true
        nil
        crlDistributionPoints: http://cs-g2-crl.thawte.com/ThawteCSG2.crl
        extendedKeyUsage
        codeSigning: msCodeCom
        2.5.29.4
        msCodeCom: 0x80
        authorityInfoAccess
        OCSP: http://ocsp.thawte.com
        nsCertType: 0x10
    - RSA-SHA1:
```
7d f1 28 cc 5e 31 8a ca  0a bb 48 b6 37 43 de d2  |}.(.^1....H.7C..|
9f e1 7e b8 23 66 e9 53  54 b2 e1 b4 0a d8 65 e6  |..~.#f.ST.....e.|
5a 7a fd 50 39 ab 73 3c  59 65 c7 cb 45 92 16 d9  |Zz.P9.s
```
  - Certificate #1
    - 2
      - 47:97:4D:78:73:A5:BC:AB:0D:2F:B3:70:19:2F:CE:5E
      - RSA-SHA1: nil
      - Issuer
        C: US
        O: thawte, Inc.
        OU: Certification Services Division
        OU: (c) 2006 thawte, Inc. - For authorized use only
        CN: thawte Primary Root CA
      - 2010-02-08 00:00:00 UTC: 2020-02-07 23:59:59 UTC
      - Subject
        C: US
        O: Thawte, Inc.
        CN: Thawte Code Signing CA - G2
      - #5
        rsaEncryption: nil
        B7:8B:CF:75:5B:9F:25:DA:7E:39:B0:93:DB:38:D3:A9:
        23:D0:82:FA:E9:24:7E:5C:0B:8E:83:F8:E6:7A:59:E6:
        A3:C5:98:A7:99:D2:44:FF:00:A6:A5:39:04:8A:DA:29:
        88:EA:DB:A2:F3:1C:99:15:26:C2:B1:F4:FC:E1:0C:47:
        A9:09:11:06:0A:20:92:B9:C7:A0:04:8C:5C:94:19:AB:
        5B:25:2C:1D:62:7E:70:0D:CE:61:6C:DD:2B:82:C9:CE:
        5D:48:5F:F7:C2:BE:BC:41:23:1E:4F:29:5D:D7:4F:BC:
        F4:C5:2A:FC:63:E6:7C:26:4E:99:A7:79:41:9E:10:4A:
        7A:79:C9:C6:86:F7:86:95:D2:26:CE:3C:18:2A:D6:7C:
        CE:AF:CD:AD:BB:F7:82:2C:70:26:37:45:E5:0F:47:22:
        C6:01:28:BD:2E:83:5C:6A:A4:47:C1:E7:D0:D8:6B:81:
        46:3F:21:17:F5:07:C5:43:5A:A6:67:2C:B8:7B:60:11:
        B5:83:EE:F5:74:0A:72:71:44:3D:58:FE:E8:1A:AB:38:
        C3:59:DB:7F:6E:38:7D:76:C7:72:69:98:36:96:57:D3:
        66:1C:D2:54:91:04:2E:54:19:B0:DC:3D:B5:22:5E:86:
        D5:2A:7E:20:DF:5D:E6:7A:B1:65:FE:C5:02:4E:31:2D: 0x010001
      - X509v3 extensions
        basicConstraints
        true
        true: 0
        crlDistributionPoints: http://crl.thawte.com/ThawtePCA.crl
        keyUsage: true, 6
        authorityInfoAccess
        OCSP: http://ocsp.thawte.com
        extendedKeyUsage
        clientAuth: codeSigning
        subjectAltName
        CN: VeriSignMPKI-2-10
        subjectKeyIdentifier:
        d4 0d 65 3f 7a bd 34 c6 fe 47 e7 4c 0d c0 bd f2 |..e?z.4..G.L....| de 15 ab 71 |...q |
        authorityKeyIdentifier:
        7b 5b 45 cf af ce cb 7a fd 31 92 1a 6a b6 f3 46 |{[E....z.1..j..F| eb 57 48 50 |.WHP |
    - RSA-SHA1:
```
56 fe 53 5c e1 c7 9e bc  a7 ed 7e 53 6d 6a 14 4b  |V.S\......~Smj.K|
51 8c 40 5e 80 5f aa a4  e8 2f ef 38 c8 04 c9 ca  |Q.@^._.../.8....|
3e cf df 3a 58 4e b0 d4  b6 63 c5 29 57 fa 02 05  |>..:XN...c.)W...|
9a 45 4d 68 db 2a 1b d4  34 3d 9f 00 c3 5a cb 95  |.EMh.*..4=...Z..|
49 a5 6e e1 b0 c5 fc 41  4d 41 4a 6f d3 77 c8 d7  |I.n....AMAJo.w..|
38 8d e4 19 de 18 f3 1f  15 65 83 6d 45 0c 53 f9  |8........e.mE.S.|
0a 9a 2e a5 5d bf 6f 32  81 18 92 19 6a 55 00 ad  |....].o2....jU..|
63 1c 52 06 7e 55 d9 29  68 ae 4a 7c 18 9a 79 88  |c.R.~U.)h.J|..y.|
6b 23 23 d8 27 38 2a 29  87 76 ca fb c7 b6 62 23  |k##.'8*).v....b#|
1f ed 7a 56 4c dd 9c 32  5b f5 3d 0c 46 18 95 3b  |..zVL..2[.=.F..;|
2a 23 68 83 64 41 d9 00  6d 0f 19 24 15 68 72 bd  |*#h.dA..m..$.hr.|
c5 71 67 6e ac 4c db 90  eb 51 a5 1a 62 07 d0 be  |.qgn.L...Q..b...|
6a 00 47 3c 72 2f ec 4f  61 3e 73 85 ce 5a 0a b7  |j.Gs..Z..|
ba c0 1c 13 75 e3 22 39  28 dd 6d 1d 09 46 9d 4f  |....u."9(.m..F.O|
ba e8 40 81 91 c6 a4 ce  94 72 1b 01 cf 2a 6e 15  |..@......r...*n.|
67 95 89 ae 7d b7 b7 cd  f9 0a 3d 75 b6 6b 3c 25  |g...}.....=u.k<%|
```
  - Certificate #2
    - 2
      - 34:4E:D5:57:20:D5:ED:EC:49:F4:2F:CE:37:DB:2B:6D
      - RSA-SHA1: nil
      - Issuer
        C: US
        O: thawte, Inc.
        OU: Certification Services Division
        OU: (c) 2006 thawte, Inc. - For authorized use only
        CN: thawte Primary Root CA
      - 2006-11-17 00:00:00 UTC: 2036-07-16 23:59:59 UTC
      - Subject
        C: US
        O: thawte, Inc.
        OU: Certification Services Division
        OU: (c) 2006 thawte, Inc. - For authorized use only
        CN: thawte Primary Root CA
      - #5
        rsaEncryption: nil
        AC:A0:F0:FB:80:59:D4:9C:C7:A4:CF:9D:A1:59:73:09:
        10:45:0C:0D:2C:6E:68:F1:6C:5B:48:68:49:59:37:FC:
        0B:33:19:C2:77:7F:CC:10:2D:95:34:1C:E6:EB:4D:09:
        A7:1C:D2:B8:C9:97:36:02:B7:89:D4:24:5F:06:C0:CC:
        44:94:94:8D:02:62:6F:EB:5A:DD:11:8D:28:9A:5C:84:
        90:10:7A:0D:BD:74:66:2F:6A:38:A0:E2:D5:54:44:EB:
        1D:07:9F:07:BA:6F:EE:E9:FD:4E:0B:29:F5:3E:84:A0:
        01:F1:9C:AB:F8:1C:7E:89:A4:E8:A1:D8:71:65:0D:A3:
        51:7B:EE:BC:D2:22:60:0D:B9:5B:9D:DF:BA:FC:51:5B:
        0B:AF:98:B2:E9:2E:E9:04:E8:62:87:DE:2B:C8:D7:4E:
        C1:4C:64:1E:DD:CF:87:58:BA:4A:4F:CA:68:07:1D:1C:
        9D:4A:C6:D5:2F:91:CC:7C:71:72:1C:C5:C0:67:EB:32:
        FD:C9:92:5C:94:DA:85:C0:9B:BF:53:7D:2B:09:F4:8C:
        9D:91:1F:97:6A:52:CB:DE:09:36:A4:77:D8:7B:87:50:
        44:D5:3E:6E:29:69:FB:39:49:26:1E:09:A5:80:7B:40:
        2D:EB:E8:27:85:C9:FE:61:FD:7E:E6:7C:97:1D:D5:9D: 0x010001
      - X509v3 extensions
        basicConstraints: true, true
        keyUsage: true, 6
        subjectKeyIdentifier:
        7b 5b 45 cf af ce cb 7a fd 31 92 1a 6a b6 f3 46 |{[E....z.1..j..F| eb 57 48 50 |.WHP |
    - RSA-SHA1:
```
79 11 c0 4b b3 91 b6 fc  f0 e9 67 d4 0d 6e 45 be  |y..K......g..nE.|
55 e8 93 d2 ce 03 3f ed  da 25 b0 1d 57 cb 1e 3a  |U.....?..%..W..:|
76 a0 4c ec 50 76 e8 64  72 0c a4 a9 f1 b8 8b d6  |v.L.Pv.dr.......|
d6 87 84 bb 32 e5 41 11  c0 77 d9 b3 60 9d eb 1b  |....2.A..w..`...|
d5 d1 6e 44 44 a9 a6 01  ec 55 62 1d 77 b8 5c 8e  |..nDD....Ub.w.\.|
48 49 7c 9c 3b 57 11 ac  ad 73 37 8e 2f 78 5c 90  |HI|.;W...s7./x\.|
68 47 d9 60 60 e6 fc 07  3d 22 20 17 c4 f7 16 e9  |hG.``...=" .....|
c4 d8 72 f9 c8 73 7c df  16 2f 15 a9 3e fd 6a 27  |..r..s|../..>.j'|
b6 a1 eb 5a ba 98 1f d5  e3 4d 64 0a 9d 13 c8 61  |...Z.....Md....a|
ba f5 39 1c 87 ba b8 bd  7b 22 7f f6 fe ac 40 79  |..9.....{"....@y|
e5 ac 10 6f 3d 8f 1b 79  76 8b c4 37 b3 21 18 84  |...o=..yv..7.!..|
e5 36 00 eb 63 20 99 b9  e9 fe 33 04 bb 41 c8 c1  |.6..c ....3..A..|
02 f9 44 63 20 9e 81 ce  42 d3 d6 3f 2c 76 d3 63  |..Dc ...B..?,v.c|
9c 59 dd 8f a6 e1 0e a0  2e 41 f7 2e 95 47 cf bc  |.Y.......A...G..|
fd 33 f3 f6 0b 61 7e 7e  91 2b 81 47 c2 27 30 ee  |.3...a~~.+.G.'0.|
a7 10 5d 37 8f 5c 39 2b  e4 04 f0 7b 8d 56 8c 68  |..]7.\9+...{.V.h|
```
  - Certificate #3
    - 2
      - 0E:CF:F4:38:C8:FE:BF:35:6E:04:D8:6A:98:1B:1A:50
      - RSA-SHA1: nil
      - Issuer
        C: US
        O: Symantec Corporation
        CN: Symantec Time Stamping Services CA - G2
      - 2012-10-18 00:00:00 UTC: 2020-12-29 23:59:59 UTC
      - Subject
        C: US
        O: Symantec Corporation
        CN: Symantec Time Stamping Services Signer - G4
      - #5
        rsaEncryption: nil
        A2:63:0B:39:44:B8:BB:23:A7:44:49:BB:0E:FF:A1:F0:
        61:0A:53:93:B0:98:DB:AD:2C:0F:4A:C5:6E:FF:86:3C:
        53:55:0F:15:CE:04:3F:2B:FD:A9:96:96:D9:BE:61:79:
        0B:5B:C9:4C:86:76:E5:E0:43:4B:22:95:EE:C2:2B:43:
        C1:9F:D8:68:B4:8E:40:4F:EE:85:38:B9:11:C5:23:F2:
        64:58:F0:15:32:6F:4E:57:A1:AE:88:A4:02:D7:2A:1E:
        CD:4B:E1:DD:63:D5:17:89:32:5B:B0:5E:99:5A:A8:9D:
        28:50:0E:17:EE:96:DB:61:3B:45:51:1D:CF:12:56:0B:
        92:47:FC:AB:AE:F6:66:3D:47:AC:70:72:E7:92:E7:5F:
        CD:10:B9:C4:83:64:94:19:BD:25:80:E1:E8:D2:22:A5:
        D0:BA:02:7A:A1:77:93:5B:65:C3:EE:17:74:BC:41:86:
        2A:DC:08:4C:8C:92:8C:91:2D:9E:77:44:1F:68:D6:A8:
        74:77:DB:0E:5B:32:8B:56:8B:33:BD:D9:63:C8:49:9D:
        3A:C5:C5:EA:33:0B:D2:F1:A3:1B:F4:8B:BE:D9:B3:57:
        8B:3B:DE:04:A7:7A:22:B2:24:AE:2E:C7:70:C5:BE:4E:
        83:26:08:FB:0B:BD:A9:4F:99:08:E1:10:28:72:AA:CD: 0x010001
      - X509v3 extensions
        basicConstraints
        true
        nil
        extendedKeyUsage: true, timeStamping
        keyUsage: true, 0x80
        authorityInfoAccess
        #0
        OCSP: http://ts-ocsp.ws.symantec.com
        caIssuers: http://ts-aia.ws.symantec.com/tss-ca-g2.cer
        crlDistributionPoints: http://ts-crl.ws.symantec.com/tss-ca-g2.crl
        subjectAltName
        CN: TimeStamp-2048-2
        subjectKeyIdentifier:
        46 c6 69 a3 0e 4a 14 1e d5 4c da 52 63 17 3f 5e |F.i..J...L.Rc.?^| 36 bc 0d e6 |6... |
        authorityKeyIdentifier:
        5f 9a f5 6e 5c cc cc 74 9a d4 dd 7d ef 3f db ec |_..n\..t...}.?..| 4c 80 2e dd |L... |
    - RSA-SHA1:
```
78 3b b4 91 2a 00 4c f0  8f 62 30 37 78 a3 84 27  |x;..*.L..b07x..'|
07 6f 18 b2 de 25 dc a0  d4 94 03 aa 86 4e 25 9f  |.o...%.......N%.|
9a 40 03 1c dd ce e3 79  cb 21 68 06 da b6 32 b4  |.@.....y.!h...2.|
6d bf f4 2c 26 63 33 e4  49 64 6d 0d e6 c3 67 0e  |m..,&c3.Idm...g.|
f7 05 a4 35 6c 7c 89 16  c6 e9 b2 df b2 e9 dd 20  |...5l|......... |
c6 71 0f cd 95 74 dc b6  5c de bd 37 1f 43 78 e6  |.q...t..\..7.Cx.|
78 b5 cd 28 04 20 a3 aa  f1 4b c4 88 29 91 0e 80  |x..(. ...K..)...|
d1 11 fc dd 5c 76 6e 4f  5e 0e 45 46 41 6e 0d b0  |....\vnO^.EFAn..|
ea 38 9a b1 3a da 09 71  10 fc 1c 79 b4 80 7b ac  |.8..:..q...y..{.|
69 f4 fd 9c b6 0c 16 2b  f1 7f 5b 09 3d 9b 5b e2  |i......+..[.=.[.|
16 ca 13 81 6d 00 2e 38  0d a8 29 8f 2c e1 b2 f4  |....m..8..).,...|
5a a9 01 af 15 9c 2c 2f  49 1b db 22 bb c3 fe 78  |Z.....,/I.."...x|
94 51 c3 86 b1 82 88 5d  f0 3d b4 51 a1 79 33 2b  |.Q.....].=.Q.y3+|
2e 7b b9 dc 20 09 13 71  eb 6a 19 5b cf e8 a5 30  |.{.. ..q.j.[...0|
57 2c 89 49 3f b9 cf 7f  c9 bf 3e 22 68 63 53 9a  |W,.I?.....>"hcS.|
bd 69 74 ac c5 1d 3c 7f  92 e0 c3 bc 1c d8 04 75  |.it...<........u|
```
  - Certificate #4
    - 2
      - 7E:93:EB:FB:7C:C6:4E:59:EA:4B:9A:77:D4:06:FC:3B
      - RSA-SHA1: nil
      - Issuer
        C: ZA
        ST: Western Cape
        L: Durbanville
        O: Thawte
        OU: Thawte Certification
        CN: Thawte Timestamping CA
      - 2012-12-21 00:00:00 UTC: 2020-12-30 23:59:59 UTC
      - Subject
        C: US
        O: Symantec Corporation
        CN: Symantec Time Stamping Services CA - G2
      - #5
        rsaEncryption: nil
        B1:AC:B3:49:54:4B:97:1C:12:0A:D8:25:79:91:22:57:
        2A:6F:DC:B8:26:C4:43:73:6B:C2:BF:2E:50:5A:FB:14:
        C2:76:8E:43:01:25:43:B4:A1:E2:45:F4:E8:B7:7B:C3:
        74:CC:22:D7:B4:94:00:02:F7:4D:ED:BF:B4:B7:44:24:
        6B:CD:5F:45:3B:D1:44:CE:43:12:73:17:82:8B:69:B4:
        2B:CB:99:1E:AC:72:1B:26:4D:71:1F:B1:31:DD:FB:51:
        61:02:53:A6:AA:F5:49:2C:05:78:45:A5:2F:89:CE:E7:
        99:E7:FE:8C:E2:57:3F:3D:C6:92:DC:4A:F8:7B:33:E4:
        79:0A:FB:F0:75:88:41:9C:FF:C5:03:51:99:AA:D7:6C:
        9F:93:69:87:65:29:83:85:C2:60:14:C4:C8:C9:3B:14:
        DA:C0:81:F0:1F:0D:74:DE:92:22:AB:CA:F7:FB:74:7C:
        27:E6:F7:4A:1B:7F:A7:C3:9E:2D:AE:8A:EA:A6:E6:AA:
        27:16:7D:61:F7:98:71:11:BC:E2:50:A1:4B:E5:5D:FA:
        E5:0E:A7:2C:9F:AA:65:20:D3:D8:96:E8:C8:7C:A5:4E:
        48:44:FF:19:E2:44:07:92:0B:D7:68:84:80:5D:6A:78:
        64:45:CD:60:46:7E:54:C1:13:7C:C5:79:F1:C9:C1:71: 0x010001
      - #6
        subjectKeyIdentifier:
        5f 9a f5 6e 5c cc cc 74 9a d4 dd 7d ef 3f db ec |_..n\..t...}.?..| 4c 80 2e dd |L... |
        authorityInfoAccess
        OCSP: http://ocsp.thawte.com
        basicConstraints
        true
        true: 0
        crlDistributionPoints: http://crl.thawte.com/ThawteTimestampingCA.crl
        extendedKeyUsage: timeStamping
        keyUsage: true, 6
        subjectAltName
        CN: TimeStamp-2048-1
    - RSA-SHA1:
```
03 09 9b 8f 79 ef 7f 59  30 aa ef 68 b5 fa e3 09  |....y..Y0..h....|
1d bb 4f 82 06 5d 37 5f  a6 52 9f 16 8d ea 1c 92  |..O..]7_.R......|
09 44 6e f5 6d eb 58 7c  30 e8 f9 69 8d 23 73 0b  |.Dn.m.X|0..i.#s.|
12 6f 47 a9 ae 39 11 f8  2a b1 9b b0 1a c3 8e eb  |.oG..9..*.......|
59 96 00 ad ce 0c 4d b2  d0 31 a6 08 5c 2a 7a fc  |Y.....M..1..\*z.|
e2 7a 1d 57 4c a8 65 18  e9 79 40 62 25 96 6e c7  |.z.WL.e..y@b%.n.|
c7 37 6a 83 21 08 8e 41  ea dd d9 57 3f 1d 77 49  |.7j.!..A...W?.wI|
87 2a 16 06 5e a6 38 6a  22 12 a3 51 19 83 7e b6  |.*..^.8j"..Q..~.|
```
- Signer
  - 1
  - unnamed
    - #0
      - C: US
      - O: Thawte, Inc.
      - CN: Thawte Code Signing CA - G2
    - 3E:E1:1B:14:0A:80:3D:E2:60:82:31:57:A8:75:B8:C5
  - SHA1: nil
  - #3
    - contentType: 1.3.6.1.4.1.311.2.1.4
    - signingTime: 2014-06-20 19:02:40 UTC
    - 1.3.6.1.4.1.311.2.1.11: msCodeInd
    - messageDigest:
```
64 73 9a 2a a4 1a af 9a  38 ab 52 f6 cc 89 cc 8f  |ds.*....8.R.....|
bf 0e 2e 4b                                       |...K            |
```
  - rsaEncryption:
```
4a 4e 2a 6d a6 9f c8 1c  cb c5 45 a1 26 c3 a4 24  |JN*m......E.&..$|
87 f9 5c b6 9a 72 ab 3f  e8 21 76 b8 17 fb 9d ba  |..\..r.?.!v.....|
58 1d c6 c8 d0 75 a9 7c  a6 a6 50 55 39 d8 c3 21  |X....u.|..PU9..!|
73 c1 9c 7d 9d 17 86 13  26 0c 92 55 01 65 00 71  |s..}....&..U.e.q|
62 00 b8 58 d1 a6 5f 53  d0 e3 32 e6 ac 09 00 5c  |b..X.._S..2....\|
63 6a 0e a0 d4 56 5a 04  28 9e bd 59 a3 29 50 72  |cj...VZ.(..Y.)Pr|
8c 01 f0 c0 03 94 ef 7d  37 ad 7d 31 26 5c fb be  |.......}7.}1&\..|
d0 52 97 56 cc 4b d0 82  05 86 b8 51 01 28 ce dd  |.R.V.K.....Q.(..|
e3 e9 73 98 91 59 e1 f8  4e 9b 87 08 fc b8 eb 60  |..s..Y..N......`|
9e f2 aa 85 09 c7 42 26  12 7a d1 e5 21 ee 4a 52  |......B&.z..!.JR|
f4 cf e9 71 ec 15 43 19  68 2e f8 30 f2 68 9c d9  |...q..C.h..0.h..|
34 63 94 34 c3 b4 c9 f7  b4 8e 55 70 1e 1d b7 b0  |4c.4......Up....|
cf 79 0b dd 28 45 a2 1f  4f e7 e0 e7 94 86 e7 f8  |.y..(E..O.......|
c2 57 9c 2a 3e a8 ce 75  4c 8a db 1e 54 6b 72 ab  |.W.*>..uL...Tkr.|
ff c0 38 57 f1 7f e3 9e  8c 8a 5c 12 18 dd 6c 1a  |..8W......\...l.|
0d 28 c1 35 73 43 9d 61  09 9f 79 4f 72 76 e4 98  |.(.5sC.a..yOrv..|
```
  - countersignature
    - 1
      - unnamed
        #0
        C: US
        O: Symantec Corporation
        CN: Symantec Time Stamping Services CA - G2
        0E:CF:F4:38:C8:FE:BF:35:6E:04:D8:6A:98:1B:1A:50
      - SHA1: nil
      - #2
        contentType: pkcs7-data
        signingTime: 2014-06-20 19:02:37 UTC
        messageDigest:
        8c f2 ed d2 c9 d5 0d 3f a5 b7 07 13 ae b4 b7 fe |.......?........| b1 e7 9c a8 |.... |
      - rsaEncryption:
        68 69 d2 c0 4c e7 c3 e8 d2 bc 2c 4b 8b e3 b1 94 |hi..L.....,K....| 75 47 72 ea ad e2 44 f2 39 f2 4f 07 ed 62 49 49 |uGr...D.9.O..bII| 5c 76 2e 92 51 89 5e 4d d8 73 a6 81 32 35 c2 96 |\v..Q.^M.s..25..| 1e eb 9c b8 47 f9 40 89 bd 14 79 f8 7d 0e a6 68 |....G.@...y.}..h| 7b 72 86 0c e1 bc b0 af d2 15 3c 73 79 1b aa 7f |{r........

show previews

offset	size	type	comment
0	57856	EXE	12/17/2010 09:14:12	#
15c1	15	HTM		#
e200	169216	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 227072 bytes (222 KiB)


--
Type = PE
Physical Size = 227072
CPU = x86
Characteristics = Executable 32-bit NoRelocs NoLineNums NoLocalSyms NoDebugInfo
Created = 2010-12-17 09:14:12
Headers Size = 1024
Checksum = 0
Image Size = 221184
Section Alignment = 4096
File Alignment = 512
Code Size = 29184
Initialized Data Size = 14848
Uninitialized Data Size = 110592
Linker Version = 2.56
OS Version = 4.0
Image Version = 6.0
Subsystem Version = 4.0
Subsystem = Windows GUI
DLL Characteristics = TerminalServerAware
Stack Reserve = 2097152
Stack Commit = 4096
Heap Reserve = 1048576
Heap Commit = 4096
Image Base = 4194304
----
Path = [0]
Size = 162520
Packed Size = 162520
Virtual Size = 162520
Offset = 57856
--
Path = [0]
Type = Nsis
Physical Size = 162514
Tail Size = 6
Method = LZMA:23
Solid = +
Headers Size = 14967
Embedded Stub Size = 0
SubType = NSIS-2

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2014-06-20 19:02:40 .....       238536       162510  $PLUGINSDIR/Fri6669.exe
                    .....                            $PLUGINSDIR/nsExec.dll
------------------- ----- ------------ ------------  ------------------------
2014-06-20 19:02:40             238536       162510  2 files

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

d04aaed0223e197af9d030b48267e185- Win.Adware.Somoto

MZ Header

DOS stub

PE Header

Sections

Data Directory

Signers (1)

Certificates (5)

d04aaed0223e197af9d030b48267e185
- Win.Adware.Somoto