Installer.exe - Updater.exe - Blizzard Installer

info
MZ
PE
resources
imports
foremost
version info
signature
hexdump
disasm
log
discuss
donate

filename	Installer.exe
size	2505256 (0x263a28)
md5	a9caefd3a5dd49b5c3dbeb7dbc25651a

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd8

Rich Header

lib id	version	times used
93	4035	5
1	0	114
125	50727	17
110	50727	36
109	50727	114
124	50727	1
120	50727	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x4bd70c53
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x103
Magic	0x10b
LinkerVersion	8.0
SizeOfCode	0xf000
SizeOfInitializedData	0x78000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x720f
BaseOfCode	0x1000
BaseOfData	0x10000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x8a000
SizeOfHeaders	0x1000
CheckSum	0x26770d
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xe134	0xf000	R-X CODE
.rdata	0x10000	0x6312	0x7000	R-- IDATA
.data	0x17000	0x2ea4	0x1000	RW- IDATA
.rsrc	0x1a000	0x6f960	0x70000	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x15a54	0x3c
RESOURCE	0x1a000	0x6f960
EXCEPTION	0	0
SECURITY	0x262790	0x1298
BASERELOC	0	0
DEBUG	0x101e0	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x155d0	0x40
Bound_IAT	0	0
IAT	0x10000	0x194
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
ICON	#1	74792	1252
ICON	#2	19496	1252
ICON	#3	3752	1252
ICON	#4	2216	1252
ICON	#5	1384	1252
ICON	#6	270376	1252
ICON	#7	67624	1252
ICON	#8	9640	1252
ICON	#9	4264	1252
ICON	#10	1128	1252
GROUP_ICON	#131	146	1252
VERSION	#1	740	1252
MANIFEST	#1	758	1252

module_name	hint	function_name
KERNEL32.dll	784	SetEndOfFile
KERNEL32.dll	795	SetFilePointer
KERNEL32.dll	355	GetFileSize
KERNEL32.dll	693	ReadFile
KERNEL32.dll	932	WriteFile
KERNEL32.dll	52	CloseHandle
KERNEL32.dll	881	UnmapViewOfFile
KERNEL32.dll	616	MapViewOfFile
KERNEL32.dll	85	CreateFileMappingW
KERNEL32.dll	86	CreateFileW
KERNEL32.dll	958	lstrcatW
KERNEL32.dll	500	GetWindowsDirectoryW
KERNEL32.dll	624	MoveFileExW
KERNEL32.dll	438	GetShortPathNameW
KERNEL32.dll	132	DeleteFileW
KERNEL32.dll	794	SetFileAttributesW
KERNEL32.dll	709	RemoveDirectoryW
KERNEL32.dll	206	FindClose
KERNEL32.dll	221	FindNextFileW
KERNEL32.dll	213	FindFirstFileW
KERNEL32.dll	490	GetVersionExW
KERNEL32.dll	78	CreateDirectoryW
KERNEL32.dll	479	GetTickCount
KERNEL32.dll	470	GetTempPathW
KERNEL32.dll	369	GetLastError
KERNEL32.dll	80	CreateEventW
KERNEL32.dll	382	GetModuleFileNameW
KERNEL32.dll	386	GetModuleHandleW
KERNEL32.dll	105	CreateProcessW
KERNEL32.dll	854	Sleep
KERNEL32.dll	528	HeapAlloc
KERNEL32.dll	534	HeapFree
KERNEL32.dll	489	GetVersionExA
KERNEL32.dll	419	GetProcessHeap
KERNEL32.dll	440	GetStartupInfoW
KERNEL32.dll	129	DeleteCriticalSection
KERNEL32.dll	593	LeaveCriticalSection
KERNEL32.dll	152	EnterCriticalSection
KERNEL32.dll	899	VirtualFree
KERNEL32.dll	897	VirtualAlloc
KERNEL32.dll	538	HeapReAlloc
KERNEL32.dll	532	HeapDestroy
KERNEL32.dll	530	HeapCreate
KERNEL32.dll	416	GetProcAddress
KERNEL32.dll	383	GetModuleHandleA
KERNEL32.dll	185	ExitProcess
KERNEL32.dll	441	GetStdHandle
KERNEL32.dll	381	GetModuleFileNameA
KERNEL32.dll	862	TerminateProcess
KERNEL32.dll	322	GetCurrentProcess
KERNEL32.dll	878	UnhandledExceptionFilter
KERNEL32.dll	842	SetUnhandledExceptionFilter
KERNEL32.dll	569	IsDebuggerPresent
KERNEL32.dll	869	TlsGetValue
KERNEL32.dll	867	TlsAlloc
KERNEL32.dll	870	TlsSetValue
KERNEL32.dll	868	TlsFree
KERNEL32.dll	556	InterlockedIncrement
KERNEL32.dll	808	SetLastError
KERNEL32.dll	326	GetCurrentThreadId
KERNEL32.dll	552	InterlockedDecrement
KERNEL32.dll	540	HeapSize
KERNEL32.dll	260	GetCPInfo
KERNEL32.dll	253	GetACP
KERNEL32.dll	403	GetOEMCP
KERNEL32.dll	575	IsValidCodePage
KERNEL32.dll	246	FreeEnvironmentStringsA
KERNEL32.dll	629	MultiByteToWideChar
KERNEL32.dll	341	GetEnvironmentStrings
KERNEL32.dll	247	FreeEnvironmentStringsW
KERNEL32.dll	343	GetEnvironmentStringsW
KERNEL32.dll	272	GetCommandLineA
KERNEL32.dll	273	GetCommandLineW
KERNEL32.dll	804	SetHandleCount
KERNEL32.dll	358	GetFileType
KERNEL32.dll	439	GetStartupInfoA
KERNEL32.dll	675	QueryPerformanceCounter
KERNEL32.dll	323	GetCurrentProcessId
KERNEL32.dll	458	GetSystemTimeAsFileTime
KERNEL32.dll	547	InitializeCriticalSection
KERNEL32.dll	727	RtlUnwind
KERNEL32.dll	594	LoadLibraryA
KERNEL32.dll	916	WideCharToMultiByte
KERNEL32.dll	290	GetConsoleCP
KERNEL32.dll	307	GetConsoleMode
KERNEL32.dll	580	LCMapStringA
KERNEL32.dll	581	LCMapStringW
KERNEL32.dll	442	GetStringTypeA
KERNEL32.dll	445	GetStringTypeW
KERNEL32.dll	372	GetLocaleInfoA
KERNEL32.dll	823	SetStdHandle
KERNEL32.dll	921	WriteConsoleA
KERNEL32.dll	309	GetConsoleOutputCP
KERNEL32.dll	931	WriteConsoleW
KERNEL32.dll	83	CreateFileA
KERNEL32.dll	238	FlushFileBuffers
USER32.dll	728	wsprintfW
USER32.dll	486	MessageBoxW
USER32.dll	727	wsprintfA

StringTable 040904b0

FileDescription	Blizzard Installer
FileVersion	4.1.1.4219
InternalName	Updater
LegalCopyright	Copyright (C) 2004-2010 Blizzard Entertainment
OriginalFilename	Updater.exe
ProductName	Updater
ProductVersion	4.1.1.4219

VS_FIXEDFILEINFO

FileVersion	4.1.1.4219
ProductVersion	4.1.1.4219
StrucVersion	0x10000
FileFlagsMask	0x17
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=ZA/O=Thawte Consulting (Pty) Ltd./CN=Thawte Code Signing CA

serial: 7B715B3347BC57B25C66B34202F4A1A0

Certificates (4)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 10 (0xa)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
        Validity
            Not Before: Aug  6 00:00:00 2003 GMT
            Not After : Aug  5 23:59:59 2013 GMT
        Subject: C=ZA, O=Thawte Consulting (Pty) Ltd., CN=Thawte Code Signing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    00:c6:b8:b9:27:60:af:0b:e3:91:69:65:db:7e:8d:
                    ed:91:e6:aa:f1:be:d5:ed:fe:6d:d4:2c:7f:d1:70:
                    77:fb:26:99:57:b4:dd:3f:30:b8:dc:21:ea:68:8d:
                    81:92:fc:2e:4b:91:35:84:20:f2:da:4a:ba:b4:fc:
                    e6:da:88:f2:20:c5:21:92:09:47:95:a0:09:1c:a6:
                    79:be:b1:4c:1d:fc:f1:8a:6e:54:d2:69:a1:f1:4c:
                    93:3a:41:fe:7d:d4:64:7b:63:45:f7:60:60:1d:31:
                    1d:a4:e9:d3:0f:8b:fb:6e:26:24:b3:a8:ff:e5:e5:
                    90:d4:b4:c2:dc:50:60:ae:59
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.thawte.com/ThawtePremiumServerCA.crl

            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, Code Signing
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name: 
                DirName:/CN=PrivateLabel2-144
    Signature Algorithm: sha1WithRSAEncryption
         76:b2:9c:ee:13:9f:1b:f6:2d:34:92:94:45:73:34:dc:8e:6b:
         2e:5c:fc:4c:7d:89:eb:c3:68:f1:d7:99:0f:2e:1d:17:c8:b5:
         16:8b:be:cd:8a:05:06:f2:19:49:3a:03:5b:05:c9:20:8e:6d:
         52:e1:76:81:a0:c3:65:8a:22:67:e4:1c:53:53:37:46:bf:bc:
         d7:2f:eb:7b:9e:d0:14:45:6c:40:21:08:e2:5d:75:76:66:30:
         1e:f4:df:82:8a:2f:bd:f3:a2:0c:bf:1d:db:9f:14:a2:9a:72:
         37:4d:b0:77:48:e8:4a:3f:09:ce:55:19:2c:ef:e6:07:24:e1:
         af:ec

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
        Validity
            Not Before: Jun 15 00:00:00 2007 GMT
            Not After : Jun 14 23:59:59 2012 GMT
        Subject: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    00:c4:b5:f2:52:15:bc:88:86:60:29:16:4a:5b:2f:
                    4b:91:6b:87:91:f3:35:54:58:35:ea:d1:36:5e:62:
                    4d:52:51:34:71:c2:7b:66:1d:89:c8:dd:2a:c4:6a:
                    0a:f6:37:d9:98:74:91:f6:92:ae:b0:b5:76:96:f1:
                    a9:4a:63:45:47:2e:6b:0b:92:4e:4b:2b:8c:ee:58:
                    4a:8b:d4:07:e4:1a:2c:f8:82:aa:58:d9:cd:42:f3:
                    2d:c0:75:de:8d:ab:c7:8e:1d:9a:6c:4c:08:95:1e:
                    de:db:ef:67:e1:72:c2:49:c2:9e:60:3c:e1:e2:be:
                    16:a3:63:78:69:14:7b:ad:2d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com

            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.verisign.com/tss-ca.crl

            X509v3 Extended Key Usage: critical
                Time Stamping
            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation
            X509v3 Subject Alternative Name: 
                DirName:/CN=TSA1-2
    Signature Algorithm: sha1WithRSAEncryption
         50:c5:4b:c8:24:80:df:e4:0d:24:c2:de:1a:b1:a1:02:a1:a6:
         82:2d:0c:83:15:81:37:0a:82:0e:2c:b0:5a:17:61:b5:d8:05:
         fe:88:db:f1:91:91:b3:56:1a:40:a6:eb:92:be:38:39:b0:75:
         36:74:3a:98:4f:e4:37:ba:99:89:ca:95:42:1d:b0:b9:c7:a0:
         8d:57:e0:fa:d5:64:04:42:35:4e:01:d1:33:a2:17:c8:4d:aa:
         27:c7:f2:e1:86:4c:02:38:4d:83:78:c6:fc:53:e0:eb:e0:06:
         87:dd:a4:96:9e:5e:0c:98:e2:a5:be:bf:82:85:c3:60:e1:df:
         ad:28:d8:c7:a5:4b:64:da:c7:1b:5b:bd:ac:39:08:d5:38:22:
         a1:33:8b:2f:8a:9a:eb:bc:07:21:3f:44:41:09:07:b5:65:1c:
         24:bc:48:d3:44:80:eb:a1:cf:c9:02:b4:14:cf:54:c7:16:a3:
         80:5c:f9:79:3e:5d:72:7d:88:17:9e:2c:43:a2:ca:53:ce:7d:
         3d:f6:2a:3a:b8:4f:94:00:a5:6d:0a:83:5d:f9:5e:53:f4:18:
         b3:57:0f:70:c3:fb:f5:ad:95:a0:0e:17:de:c4:16:80:60:c9:
         0f:2b:6e:86:04:f1:eb:f4:78:27:d1:05:c5:ee:34:5b:5e:b9:
         49:32:f2:33

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
        Validity
            Not Before: Dec  4 00:00:00 2003 GMT
            Not After : Dec  3 23:59:59 2013 GMT
        Subject: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:a9:ca:b2:a4:cc:cd:20:af:0a:7d:89:ac:87:75:
                    f0:b4:4e:f1:df:c1:0f:bf:67:61:bd:a3:64:1c:da:
                    bb:f9:ca:33:ab:84:30:89:58:7e:8c:db:6b:dd:36:
                    9e:0f:bf:d1:ec:78:f2:77:a6:7e:6f:3c:bf:93:af:
                    0d:ba:68:f4:6c:94:ca:bd:52:2d:ab:48:3d:f5:b6:
                    d5:5d:5f:1b:02:9f:fa:2f:6b:1e:a4:f7:a3:9a:a6:
                    1a:c8:02:e1:7f:4c:52:e3:0e:60:ec:40:1c:7e:b9:
                    0d:de:3f:c7:b4:df:87:bd:5f:7a:6a:31:2e:03:99:
                    81:13:a8:47:20:ce:31:73:0d:57:2d:cd:78:34:33:
                    95:12:99:12:b9:de:68:2f:aa:e6:e3:c2:8a:8c:2a:
                    c3:8b:21:87:66:bd:83:58:57:6f:75:bf:3c:aa:26:
                    87:5d:ca:10:15:3c:9f:84:ea:54:c1:0a:6e:c4:fe:
                    c5:4a:dd:b9:07:11:97:22:7c:db:3e:27:d1:1e:78:
                    ec:9f:31:c9:f1:e6:22:19:db:c4:b3:47:43:9a:1a:
                    5f:a0:1e:90:e4:5e:f5:ee:7c:f1:7d:ab:62:01:8f:
                    f5:4d:0b:de:d0:22:56:a8:95:cd:ae:88:76:ae:ee:
                    ba:0d:f3:e4:4d:d9:a0:fb:68:a0:ae:14:3b:b3:87:
                    c1:bb
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com

            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.verisign.com/ThawteTimestampingCA.crl

            X509v3 Extended Key Usage: 
                Time Stamping
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name: 
                DirName:/CN=TSA2048-1-53
    Signature Algorithm: sha1WithRSAEncryption
         4a:6b:f9:ea:58:c2:44:1c:31:89:79:99:2b:96:bf:82:ac:01:
         d6:1c:4c:cd:b0:8a:58:6e:df:08:29:a3:5e:c8:ca:93:13:e7:
         04:52:0d:ef:47:27:2f:00:38:b0:e4:c9:93:4e:9a:d4:22:62:
         15:f7:3f:37:21:4f:70:31:80:f1:8b:38:87:b3:e8:e8:97:00:
         fe:cf:55:96:4e:24:d2:a9:27:4e:7a:ae:b7:61:41:f3:2a:ce:
         e7:c9:d9:5e:dd:bb:2b:85:3e:b5:9d:b5:d9:e1:57:ff:be:b4:
         c5:7e:f5:cf:0c:9e:f0:97:fe:2b:d3:3b:52:1b:1b:38:27:f7:
         3f:4a

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:71:5b:33:47:bc:57:b2:5c:66:b3:42:02:f4:a1:a0
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, O=Thawte Consulting (Pty) Ltd., CN=Thawte Code Signing CA
        Validity
            Not Before: Jan  8 00:00:00 2010 GMT
            Not After : Dec  5 23:59:59 2011 GMT
        Subject: C=US, ST=California, L=Irvine, O=Blizzard Entertainment, Inc., OU=TECHNICAL SUPPORT, CN=Blizzard Entertainment, Inc.
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:c9:34:de:a5:7c:54:2a:cc:7d:38:a9:c6:69:f6:
                    8c:46:3b:44:78:45:79:57:8b:14:88:05:db:3d:54:
                    81:9b:63:4b:84:5f:92:2b:62:23:0f:dc:a3:8e:4b:
                    42:f7:8b:94:4b:80:ec:9e:0b:f5:e4:fe:a8:3b:d7:
                    60:11:14:6b:f9:25:4b:26:be:f9:a6:f6:2a:dd:9e:
                    9b:d4:56:84:f0:67:37:87:02:08:17:d0:97:a2:db:
                    39:b4:05:ae:6e:8f:5f:0a:75:62:94:80:fb:58:a9:
                    ee:76:bd:e7:e1:37:d4:38:0d:7f:0d:67:ea:5b:0f:
                    09:de:22:c7:34:fc:7f:68:f1:32:02:9f:92:bb:e0:
                    45:3f:48:f3:c0:1b:4e:b8:56:49:e5:0c:20:da:62:
                    cc:8a:8a:88:a8:b6:f2:97:2d:75:a3:1e:55:2a:da:
                    04:d1:45:a5:26:55:e9:55:c3:ef:a5:ca:39:1e:73:
                    27:3d:7a:a0:8a:67:3d:42:45:0e:27:1a:1b:65:15:
                    67:a9:2e:23:3b:ab:fe:5f:3c:63:3c:f1:6d:1c:ec:
                    c1:ed:21:2a:1b:27:90:45:87:e0:45:f1:38:cf:20:
                    15:8b:88:66:b2:f8:32:9c:ec:0e:f0:54:a9:e6:ec:
                    c5:c6:bc:d2:3d:6c:27:94:aa:49:cc:3c:c7:52:0e:
                    0b:d1
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.thawte.com/ThawteCodeSigningCA.crl

            X509v3 Extended Key Usage: 
                Code Signing, Microsoft Commercial Code Signing
            2.5.29.4: 
                0.0.0..
+.....7.......
            Authority Information Access: 
                OCSP - URI:http://ocsp.thawte.com

            Netscape Cert Type: 
                Object Signing
    Signature Algorithm: sha1WithRSAEncryption
         02:79:fa:2d:9b:df:9b:e9:cc:ee:d0:9d:47:6d:bb:0b:f0:39:
         69:26:18:37:be:fc:8a:56:7a:61:66:85:58:82:b3:12:25:3e:
         b6:e1:73:1f:e6:80:46:61:4f:08:c6:71:58:c4:ed:3a:a1:66:
         bc:b4:7b:bd:65:b3:b2:d0:fb:36:19:75:08:53:3b:7b:10:5a:
         70:fa:2e:4c:db:39:9e:36:ca:0f:11:fa:bc:57:55:c5:6e:89:
         87:2f:58:c5:e1:d9:0e:f6:2a:1f:34:61:96:1f:b6:48:10:94:
         95:17:05:3d:e5:09:bc:0d:3f:ed:ca:87:ac:e6:5c:fe:68:31:
         18:06

pkcs7-signedData

1
- SHA1: nil
- 1.3.6.1.4.1.311.2.1.4
  - #0
    - 1.3.6.1.4.1.311.2.1.15
      - :
        00 3c 00 3c 00 3c 00 4f 00 62 00 73 00 6f 00 6c |.<.<.<.O.b.s.o.l| 00 65 00 74 00 65 00 3e 00 3e 00 3e |.e.t.e.>.>.> |
    - SHA1
      - 4d d9 d3 a7 98 4c ab 2a cf c5 a1 17 f0 66 3e 8c |M....L.*.....f>.| 3c 5a ce 4a |
- Certificates
  - Certificate #0
    - 2
      - 0x0A
      - RSA-SHA1: nil
      - Issuer
        C: ZA
        ST: Western Cape
        L: Cape Town
        O: Thawte Consulting cc
        OU: Certification Services Division
        CN: Thawte Premium Server CA
        emailAddress: premium-server@thawte.com
      - 2003-08-06 00:00:00 UTC: 2013-08-05 23:59:59 UTC
      - Subject
        C: ZA
        O: Thawte Consulting (Pty) Ltd.
        CN: Thawte Code Signing CA
      - #5
        rsaEncryption: nil
        C6:B8:B9:27:60:AF:0B:E3:91:69:65:DB:7E:8D:ED:91:
        E6:AA:F1:BE:D5:ED:FE:6D:D4:2C:7F:D1:70:77:FB:26:
        99:57:B4:DD:3F:30:B8:DC:21:EA:68:8D:81:92:FC:2E:
        4B:91:35:84:20:F2:DA:4A:BA:B4:FC:E6:DA:88:F2:20:
        C5:21:92:09:47:95:A0:09:1C:A6:79:BE:B1:4C:1D:FC:
        F1:8A:6E:54:D2:69:A1:F1:4C:93:3A:41:FE:7D:D4:64:
        7B:63:45:F7:60:60:1D:31:1D:A4:E9:D3:0F:8B:FB:6E:
        26:24:B3:A8:FF:E5:E5:90:D4:B4:C2:DC:50:60:AE:59: 0x010001
      - X509v3 extensions
        basicConstraints
        true
        true: 0
        crlDistributionPoints: http://crl.thawte.com/ThawtePremiumServerCA.crl
        extendedKeyUsage
        clientAuth: codeSigning
        keyUsage: true, 6
        subjectAltName
        CN: PrivateLabel2-144
    - RSA-SHA1:
```
76 b2 9c ee 13 9f 1b f6  2d 34 92 94 45 73 34 dc  |v.......-4..Es4.|
8e 6b 2e 5c fc 4c 7d 89  eb c3 68 f1 d7 99 0f 2e  |.k.\.L}...h.....|
1d 17 c8 b5 16 8b be cd  8a 05 06 f2 19 49 3a 03  |.............I:.|
5b 05 c9 20 8e 6d 52 e1  76 81 a0 c3 65 8a 22 67  |[.. .mR.v...e."g|
e4 1c 53 53 37 46 bf bc  d7 2f eb 7b 9e d0 14 45  |..SS7F.../.{...E|
6c 40 21 08 e2 5d 75 76  66 30 1e f4 df 82 8a 2f  |l@!..]uvf0...../|
bd f3 a2 0c bf 1d db 9f  14 a2 9a 72 37 4d b0 77  |...........r7M.w|
48 e8 4a 3f 09 ce 55 19  2c ef e6 07 24 e1 af ec  |H.J?..U.,...$...|
```
  - Certificate #1
    - 2
      - 38:25:D7:FA:F8:61:AF:9E:F4:90:E7:26:B5:D6:5A:D5
      - RSA-SHA1: nil
      - Issuer
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services CA
      - 2007-06-15 00:00:00 UTC: 2012-06-14 23:59:59 UTC
      - Subject
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services Signer - G2
      - #5
        rsaEncryption: nil
        C4:B5:F2:52:15:BC:88:86:60:29:16:4A:5B:2F:4B:91:
        6B:87:91:F3:35:54:58:35:EA:D1:36:5E:62:4D:52:51:
        34:71:C2:7B:66:1D:89:C8:DD:2A:C4:6A:0A:F6:37:D9:
        98:74:91:F6:92:AE:B0:B5:76:96:F1:A9:4A:63:45:47:
        2E:6B:0B:92:4E:4B:2B:8C:EE:58:4A:8B:D4:07:E4:1A:
        2C:F8:82:AA:58:D9:CD:42:F3:2D:C0:75:DE:8D:AB:C7:
        8E:1D:9A:6C:4C:08:95:1E:DE:DB:EF:67:E1:72:C2:49:
        C2:9E:60:3C:E1:E2:BE:16:A3:63:78:69:14:7B:AD:2D: 0x010001
      - X509v3 extensions
        authorityInfoAccess
        OCSP: http://ocsp.verisign.com
        basicConstraints
        true
        nil
        crlDistributionPoints: http://crl.verisign.com/tss-ca.crl
        extendedKeyUsage: true, timeStamping
        keyUsage: true, 0xc0
        subjectAltName
        CN: TSA1-2
    - RSA-SHA1:
```
50 c5 4b c8 24 80 df e4  0d 24 c2 de 1a b1 a1 02  |P.K.$....$......|
a1 a6 82 2d 0c 83 15 81  37 0a 82 0e 2c b0 5a 17  |...-....7...,.Z.|
61 b5 d8 05 fe 88 db f1  91 91 b3 56 1a 40 a6 eb  |a..........V.@..|
92 be 38 39 b0 75 36 74  3a 98 4f e4 37 ba 99 89  |..89.u6t:.O.7...|
ca 95 42 1d b0 b9 c7 a0  8d 57 e0 fa d5 64 04 42  |..B......W...d.B|
35 4e 01 d1 33 a2 17 c8  4d aa 27 c7 f2 e1 86 4c  |5N..3...M.'....L|
02 38 4d 83 78 c6 fc 53  e0 eb e0 06 87 dd a4 96  |.8M.x..S........|
9e 5e 0c 98 e2 a5 be bf  82 85 c3 60 e1 df ad 28  |.^.........`...(|
d8 c7 a5 4b 64 da c7 1b  5b bd ac 39 08 d5 38 22  |...Kd...[..9..8"|
a1 33 8b 2f 8a 9a eb bc  07 21 3f 44 41 09 07 b5  |.3./.....!?DA...|
65 1c 24 bc 48 d3 44 80  eb a1 cf c9 02 b4 14 cf  |e.$.H.D.........|
54 c7 16 a3 80 5c f9 79  3e 5d 72 7d 88 17 9e 2c  |T....\.y>]r}...,|
43 a2 ca 53 ce 7d 3d f6  2a 3a b8 4f 94 00 a5 6d  |C..S.}=.*:.O...m|
0a 83 5d f9 5e 53 f4 18  b3 57 0f 70 c3 fb f5 ad  |..].^S...W.p....|
95 a0 0e 17 de c4 16 80  60 c9 0f 2b 6e 86 04 f1  |........`..+n...|
eb f4 78 27 d1 05 c5 ee  34 5b 5e b9 49 32 f2 33  |..x'....4[^.I2.3|
```
  - Certificate #2
    - 2
      - 47:BF:19:95:DF:8D:52:46:43:F7:DB:6D:48:0D:31:A4
      - RSA-SHA1: nil
      - Issuer
        C: ZA
        ST: Western Cape
        L: Durbanville
        O: Thawte
        OU: Thawte Certification
        CN: Thawte Timestamping CA
      - 2003-12-04 00:00:00 UTC: 2013-12-03 23:59:59 UTC
      - Subject
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services CA
      - #5
        rsaEncryption: nil
        A9:CA:B2:A4:CC:CD:20:AF:0A:7D:89:AC:87:75:F0:B4:
        4E:F1:DF:C1:0F:BF:67:61:BD:A3:64:1C:DA:BB:F9:CA:
        33:AB:84:30:89:58:7E:8C:DB:6B:DD:36:9E:0F:BF:D1:
        EC:78:F2:77:A6:7E:6F:3C:BF:93:AF:0D:BA:68:F4:6C:
        94:CA:BD:52:2D:AB:48:3D:F5:B6:D5:5D:5F:1B:02:9F:
        FA:2F:6B:1E:A4:F7:A3:9A:A6:1A:C8:02:E1:7F:4C:52:
        E3:0E:60:EC:40:1C:7E:B9:0D:DE:3F:C7:B4:DF:87:BD:
        5F:7A:6A:31:2E:03:99:81:13:A8:47:20:CE:31:73:0D:
        57:2D:CD:78:34:33:95:12:99:12:B9:DE:68:2F:AA:E6:
        E3:C2:8A:8C:2A:C3:8B:21:87:66:BD:83:58:57:6F:75:
        BF:3C:AA:26:87:5D:CA:10:15:3C:9F:84:EA:54:C1:0A:
        6E:C4:FE:C5:4A:DD:B9:07:11:97:22:7C:DB:3E:27:D1:
        1E:78:EC:9F:31:C9:F1:E6:22:19:DB:C4:B3:47:43:9A:
        1A:5F:A0:1E:90:E4:5E:F5:EE:7C:F1:7D:AB:62:01:8F:
        F5:4D:0B:DE:D0:22:56:A8:95:CD:AE:88:76:AE:EE:BA:
        0D:F3:E4:4D:D9:A0:FB:68:A0:AE:14:3B:B3:87:C1:BB: 0x010001
      - X509v3 extensions
        authorityInfoAccess
        OCSP: http://ocsp.verisign.com
        basicConstraints
        true
        true: 0
        crlDistributionPoints: http://crl.verisign.com/ThawteTimestampingCA.crl
        extendedKeyUsage: timeStamping
        keyUsage: true, 6
        subjectAltName
        CN: TSA2048-1-53
    - RSA-SHA1:
```
4a 6b f9 ea 58 c2 44 1c  31 89 79 99 2b 96 bf 82  |Jk..X.D.1.y.+...|
ac 01 d6 1c 4c cd b0 8a  58 6e df 08 29 a3 5e c8  |....L...Xn..).^.|
ca 93 13 e7 04 52 0d ef  47 27 2f 00 38 b0 e4 c9  |.....R..G'/.8...|
93 4e 9a d4 22 62 15 f7  3f 37 21 4f 70 31 80 f1  |.N.."b..?7!Op1..|
8b 38 87 b3 e8 e8 97 00  fe cf 55 96 4e 24 d2 a9  |.8........U.N$..|
27 4e 7a ae b7 61 41 f3  2a ce e7 c9 d9 5e dd bb  |'Nz..aA.*....^..|
2b 85 3e b5 9d b5 d9 e1  57 ff be b4 c5 7e f5 cf  |+.>.....W....~..|
0c 9e f0 97 fe 2b d3 3b  52 1b 1b 38 27 f7 3f 4a  |.....+.;R..8'.?J|
```
  - Certificate #3
    - 2
      - 7B:71:5B:33:47:BC:57:B2:5C:66:B3:42:02:F4:A1:A0
      - RSA-SHA1: nil
      - Issuer
        C: ZA
        O: Thawte Consulting (Pty) Ltd.
        CN: Thawte Code Signing CA
      - 2010-01-08 00:00:00 UTC: 2011-12-05 23:59:59 UTC
      - Subject
        C: US
        ST: California
        L: Irvine
        O: Blizzard Entertainment, Inc.
        OU: TECHNICAL SUPPORT
        CN: Blizzard Entertainment, Inc.
      - #5
        rsaEncryption: nil
        C9:34:DE:A5:7C:54:2A:CC:7D:38:A9:C6:69:F6:8C:46:
        3B:44:78:45:79:57:8B:14:88:05:DB:3D:54:81:9B:63:
        4B:84:5F:92:2B:62:23:0F:DC:A3:8E:4B:42:F7:8B:94:
        4B:80:EC:9E:0B:F5:E4:FE:A8:3B:D7:60:11:14:6B:F9:
        25:4B:26:BE:F9:A6:F6:2A:DD:9E:9B:D4:56:84:F0:67:
        37:87:02:08:17:D0:97:A2:DB:39:B4:05:AE:6E:8F:5F:
        0A:75:62:94:80:FB:58:A9:EE:76:BD:E7:E1:37:D4:38:
        0D:7F:0D:67:EA:5B:0F:09:DE:22:C7:34:FC:7F:68:F1:
        32:02:9F:92:BB:E0:45:3F:48:F3:C0:1B:4E:B8:56:49:
        E5:0C:20:DA:62:CC:8A:8A:88:A8:B6:F2:97:2D:75:A3:
        1E:55:2A:DA:04:D1:45:A5:26:55:E9:55:C3:EF:A5:CA:
        39:1E:73:27:3D:7A:A0:8A:67:3D:42:45:0E:27:1A:1B:
        65:15:67:A9:2E:23:3B:AB:FE:5F:3C:63:3C:F1:6D:1C:
        EC:C1:ED:21:2A:1B:27:90:45:87:E0:45:F1:38:CF:20:
        15:8B:88:66:B2:F8:32:9C:EC:0E:F0:54:A9:E6:EC:C5:
        C6:BC:D2:3D:6C:27:94:AA:49:CC:3C:C7:52:0E:0B:D1: 0x010001
      - X509v3 extensions
        basicConstraints
        true
        nil
        crlDistributionPoints: http://crl.thawte.com/ThawteCodeSigningCA.crl
        extendedKeyUsage
        codeSigning: msCodeCom
        2.5.29.4
        msCodeCom: 0x80
        authorityInfoAccess
        OCSP: http://ocsp.thawte.com
        nsCertType: 0x10
    - RSA-SHA1:
```
02 79 fa 2d 9b df 9b e9  cc ee d0 9d 47 6d bb 0b  |.y.-........Gm..|
f0 39 69 26 18 37 be fc  8a 56 7a 61 66 85 58 82  |.9i&.7...Vzaf.X.|
b3 12 25 3e b6 e1 73 1f  e6 80 46 61 4f 08 c6 71  |..%>..s...FaO..q|
58 c4 ed 3a a1 66 bc b4  7b bd 65 b3 b2 d0 fb 36  |X..:.f..{.e....6|
19 75 08 53 3b 7b 10 5a  70 fa 2e 4c db 39 9e 36  |.u.S;{.Zp..L.9.6|
ca 0f 11 fa bc 57 55 c5  6e 89 87 2f 58 c5 e1 d9  |.....WU.n../X...|
0e f6 2a 1f 34 61 96 1f  b6 48 10 94 95 17 05 3d  |..*.4a...H.....=|
e5 09 bc 0d 3f ed ca 87  ac e6 5c fe 68 31 18 06  |....?.....\.h1..|
```
- 1
  - unnamed
    - #0
      - C: ZA
      - O: Thawte Consulting (Pty) Ltd.
      - CN: Thawte Code Signing CA
    - 7B:71:5B:33:47:BC:57:B2:5C:66:B3:42:02:F4:A1:A0
  - SHA1: nil
  - #2
    - 1.3.6.1.4.1.311.2.1.12
      - nil
    - contentType: 1.3.6.1.4.1.311.2.1.4
    - 1.3.6.1.4.1.311.2.1.11: msCodeCom
    - messageDigest:
```
d8 ae d8 0f 41 c6 90 e2  6a c1 08 0c ac 6d f6 61  |....A...j....m.a|
89 c4 92 b4                                       |....            |
```
  - rsaEncryption:
```
2a 0c 3f 8c 37 82 f7 e8  7d 5c 5c 7e d2 e7 9f 5d  |*.?.7...}\\~...]|
c0 6e 0c 6b ec 54 af a3  e5 23 d0 12 6a f2 df 6d  |.n.k.T...#..j..m|
72 45 cf 73 a7 62 f3 f6  c5 af c4 f9 3d 81 20 f4  |rE.s.b......=. .|
c6 62 c7 50 ff be f3 53  6c 5e 02 6b f7 c2 f2 f9  |.b.P...Sl^.k....|
3c 36 df a1 ae f1 98 ef  a9 1e 67 97 a4 b8 3e 0c  |<6........g...>.|
74 89 fb 8d 57 a3 12 51  73 8d 97 3a aa cb 32 ed  |t...W..Qs..:..2.|
5c b9 30 c1 1b d2 cc db  a0 9e bb 98 de 8c e8 83  |\.0.............|
6b bf ed a6 37 12 b2 e2  ed 98 5c 6c 60 8d 62 9e  |k...7.....\l`.b.|
41 62 b5 3e bd 7a 07 a3  2a 30 c3 36 bf 63 b3 4e  |Ab.>.z..*0.6.c.N|
46 7b 28 b8 6c 22 c2 d3  43 fb c4 73 04 79 db 66  |F{(.l"..C..s.y.f|
f5 a6 73 ca 93 cd 83 9d  f1 a8 3a 2e 7a e6 a1 bb  |..s.......:.z...|
75 ab 32 7f b1 69 70 4e  95 cc a0 c6 32 cb 34 84  |u.2..ipN....2.4.|
38 19 7a 66 8d 98 d1 95  58 6e 68 50 f2 e1 6e f3  |8.zf....XnhP..n.|
33 28 05 bb ba d7 e4 ed  54 85 31 b8 51 d5 86 38  |3(......T.1.Q..8|
b9 ff 7e 6c 9c 98 97 ed  e4 90 13 27 8f 24 4f f4  |..~l.......'.$O.|
1b e1 53 b5 e8 41 62 3c  a6 91 86 48 d4 c2 72 76  |..S..Ab<...H..rv|
```
  - countersignature
    - 1
      - unnamed
        #0
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services CA
        38:25:D7:FA:F8:61:AF:9E:F4:90:E7:26:B5:D6:5A:D5
      - SHA1: nil
      - #2
        contentType: pkcs7-data
        signingTime: 2010-05-20 18:10:34 UTC
        messageDigest:
        a0 99 86 90 50 f9 47 12 8a 1d 99 5e a8 59 08 c2 |....P.G....^.Y..| 2f 16 e4 c5 |/... |
      - rsaEncryption:
        67 7e 50 90 f7 ac 39 02 24 64 fd 1a e7 8c a0 d7 |g~P...9.$d......| b9 33 fb dd 56 07 2f b8 68 5a b2 17 15 be 71 24 |.3..V./.hZ....q$| bf 38 40 6f c5 ae a0 c2 8e f3 f8 50 10 1e 01 e6 |.8@o.......P....| 55 ea 44 73 00 8b 57 c4 84 6f 8d e7 f9 64 4d 19 |U.Ds..W..o...dM.| 48 0e cc 46 18 c5 fe 6e 79 77 65 7f 82 0e 3d 1f |H..F...nywe...=.| 01 f9 bb 67 12 ed c2 c0 fe f6 9f 67 b3 f8 80 8a |...g.......g....| b6 4c c9 35 1d 6d d8 a0 71 c8 5d 46 1a f6 4d a2 |.L.5.m..q.]F..M.| 02 d3 c7 02 dd 1f b8 57 f7 47 c2 e0 59 ff de 3d |.......W.G..Y..=|

show previews

offset	size	type	comment
0	557056	EXE	04/27/2010 16:09:55	#
15c1	15	HTM		#
88000	1948200	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

Installer.exe- Updater.exe - Blizzard Installer

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904b0

VS_FIXEDFILEINFO

Signers (1)

Certificates (4)

Installer.exe
- Updater.exe - Blizzard Installer