mp3tag.exe - mp3Tag

info
MZ
PE
resources
imports
foremost
version info
signature
hexdump
disasm
log
discuss
donate

filename	mp3tag.exe
size	1568928 (0x17f0a0)
md5	ad2e754cd6927103700c420612b1819c

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x50
blocks_in_file	2
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0xf
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0x1a
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x120

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0: b6 a0 ec 2b 72 74 c9 12  aa 7c b0 6a dc 6d 53 46  |...+rt...|.j.mSF|
000000d0: 92 2d 47 e4 fa e2 2f b5  03 c8 65 88 0d ef 43 af  |.-G.../...e...C.|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	0xc
TimeDateStamp	0x2a425e19
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x818f
Magic	0x10b
LinkerVersion	2.25
SizeOfCode	0x206000
SizeOfInitializedData	0xb9e00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x50bac1
BaseOfCode	0x397000
BaseOfData	0x207000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x50d000
SizeOfHeaders	0x1000
CheckSum	0x182541
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x4000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

EXECryptor v2.2x - v2.4x (StrongBit Technology >> $ignBy.fly)

Sections

name	va	vsize	raw size	flags
CODE	0x1000	0x206000	0	RWX CODE
DATA	0x207000	0x15000	0	RW- IDATA
BSS	0x21c000	0x5b000	0	RW-
uj93yeqm	0x277000	0x4000	0	RWX CODE IDATA
s2.0s55b	0x27b000	0x1000	0	RWX CODE IDATA
.tls	0x27c000	0x1000	0	RW-
.rdata	0x27d000	0x1000	0	RW- IDATA
dg0hmd5a	0x27e000	0x1d000	0	RWX CODE IDATA
.rsrc	0x29b000	0x85000	0x9000	RW- IDATA
cn3nn74c	0x320000	0x77000	0	RWX CODE
8qs02k82	0x397000	0x175000	0x174ae5	RWX CODE IDATA
fexptzfq	0x50c000	0x1000	0x200	R-- UDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x397000	0x110
RESOURCE	0x29b000	0x84800
EXCEPTION	0	0
SECURITY	0x17e200	0xea0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0x27d018	0x36
GLOBALPTR	0	0
TLS	0x397110	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x797128	0x79714c	0x79714c	0x797150	0	0

show previews

type	name	size
CURSOR	#1	308
CURSOR	#2	308
CURSOR	#3	308
CURSOR	#4	308
CURSOR	#5	308
CURSOR	#6	308
CURSOR	#7	308
CURSOR	#8	748
CURSOR	#9	748
CURSOR	#10	748
CURSOR	#11	748
CURSOR	#12	308
CURSOR	#13	308
CURSOR	#14	308
CURSOR	#15	308
CURSOR	#16	748
CURSOR	#17	748
CURSOR	#18	748
CURSOR	#19	748
CURSOR	#20	748
CURSOR	#21	748
CURSOR	#22	308
BITMAP	BBABORT	464
BITMAP	BBALL	484
BITMAP	BBCANCEL	464
BITMAP	BBCLOSE	464
BITMAP	BBHELP	464
BITMAP	BBIGNORE	464
BITMAP	BBNO	464
BITMAP	BBOK	464
BITMAP	BBRETRY	464
BITMAP	BBYES	464
BITMAP	CDROM	192
BITMAP	CHECK_IMAGES	1976
BITMAP	CLOSEDFOLDER	224
BITMAP	CURRENTFOLDER	224
BITMAP	DEDITBMP	296
BITMAP	DEVICE_FNT	248
BITMAP	EXECUTABLE	224
BITMAP	FEDITBMP	200
BITMAP	FLATDOWN	124
BITMAP	FLATUP	124
BITMAP	FLOPPY	192
BITMAP	HARD	192
BITMAP	KNOWNFILE	224
BITMAP	NETWORK	192
BITMAP	NEXT1	72
BITMAP	NEXT2	72
BITMAP	OPENFOLDER	224
BITMAP	PREV1	72
BITMAP	PREV2	72
BITMAP	PREVIEWGLYPH	232
BITMAP	RAM	192
BITMAP	SEDITBMP	200
BITMAP	TAAC	1640
BITMAP	TAPE	1640
BITMAP	TFLACTAG	1640
BITMAP	TMP3INFO	1640
BITMAP	TMP3TAG	1640
BITMAP	TMP3TAG2	1640
BITMAP	TMP4TAG	392
BITMAP	TMPCTAG	1640
BITMAP	TOGG	1640
BITMAP	TRUETYPE_FNT	248
BITMAP	TWAVPACK	1640
BITMAP	TWMATAG	1640
BITMAP	UNKNOWNFILE	224
BITMAP	VT_CHECK_DARK	3304
BITMAP	VT_CHECK_LIGHT	3304
BITMAP	VT_FLAT	3304
BITMAP	VT_MOVEALL	616
BITMAP	VT_MOVEEW	616
BITMAP	VT_MOVENS	616
BITMAP	VT_TICK_DARK	3304
BITMAP	VT_TICK_LIGHT	3304
BITMAP	VT_UTILITIES	3368
BITMAP	VT_XP	19242
BITMAP	VT_XPBUTTONMINUS	294
BITMAP	VT_XPBUTTONPLUS	294
ICON	#1	1640
ICON	#2	744
ICON	#3	296
ICON	#4	3752
ICON	#5	2216
ICON	#6	1384
ICON	#7	9640
ICON	#8	4264
ICON	#9	1128
DIALOG	DLGTEMPLATE	82
STRING	#3819	548
STRING	#3829	472
STRING	#3830	44
STRING	#4068	1376
STRING	#4069	1484
STRING	#4070	872
STRING	#4071	1032
STRING	#4072	988
STRING	#4073	804
STRING	#4074	796
STRING	#4075	980
STRING	#4076	1208
STRING	#4077	536
STRING	#4078	456
STRING	#4079	232
STRING	#4080	808
STRING	#4081	776
STRING	#4082	192
STRING	#4083	252
STRING	#4084	420
STRING	#4085	968
STRING	#4086	1052
GROUP_ICON	MAINICON	132
VERSION	#1	916

module_name	hint	ord	function_name
kernel32.dll			GetModuleHandleA
kernel32.dll			LoadLibraryA
kernel32.dll			GetProcAddress
kernel32.dll			ExitProcess
kernel32.dll			VirtualAlloc
kernel32.dll			VirtualFree
user32.dll			MessageBoxA

StringTable 040904E4

CompanyName	ManiacTools
FileDescription	mp3Tag
FileVersion	5.9.1.426
InternalName	mp3Tag
LegalCopyright	(c) ManiacTools, 2000-2006
LegalTrademarks	(c) ManiacTools, 2000-2006
OriginalFilename	mp3Tag
ProductName	mp3Tag
ProductVersion	5.0
Comments	Gain full control over your tags in MP3 and Ogg Vorbis-files!

VS_FIXEDFILEINFO

FileVersion	5.9.1.426
ProductVersion	5.9.1.426
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=US/ST=UT/L=Salt Lake City/O=The USERTRUST Network/OU=http://www.usertrust.com/CN=UTN-USERFirst-Object

serial: ECB8EBB32DAC9EE06988005541055C9F

Certificates (2)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Object
        Validity
            Not Before: May 17 00:00:00 2005 GMT
            Not After : May 16 23:59:59 2010 GMT
        Subject: C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=Comodo Time Stamping Signer
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:bc:35:a0:36:70:22:81:11:c3:b2:83:b9:d3:28:
                    c6:36:cd:25:6b:a9:7b:b2:1c:f6:9b:51:9c:ef:35:
                    f4:ed:08:8e:5e:38:08:f8:77:3c:0a:42:e0:f3:70:
                    dc:a3:d7:ca:f5:4c:0b:cf:ff:22:9c:0a:7e:68:d6:
                    09:a2:2a:84:7b:a6:9d:b4:a9:c1:33:e2:ef:1f:17:
                    48:ca:3a:cd:46:e6:c5:aa:77:bd:e3:77:9a:fa:47:
                    53:40:28:59:43:93:f1:a4:81:ea:ef:80:b5:4f:a7:
                    08:ce:ba:6e:bc:ca:76:0c:97:64:59:86:24:bb:3d:
                    82:90:a8:55:b1:92:d3:a0:a7:05:ac:9f:53:25:08:
                    10:47:99:cd:98:de:68:e5:b4:50:78:a3:af:01:cc:
                    59:43:58:e4:76:6e:7e:ac:c7:e2:9e:1f:4f:b0:47:
                    2d:c8:0c:a3:49:27:80:75:8c:bb:06:91:65:0f:90:
                    9b:f4:ba:d1:81:c8:5c:6a:ec:14:e9:25:09:bf:23:
                    16:f4:95:46:40:40:21:bb:83:96:fd:86:1f:7a:c8:
                    0d:10:8e:a2:f8:19:07:58:7f:9f:bd:37:02:60:f2:
                    a4:e9:9d:44:3f:30:05:e4:a7:70:99:51:9a:e8:17:
                    f1:55:ca:b2:61:89:65:46:a7:6a:f2:58:46:7e:aa:
                    a0:07
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier: 
                keyid:DA:ED:64:74:14:9C:14:3C:AB:DD:99:A9:BD:5B:28:4D:8B:3C:C9:D8

            X509v3 Subject Key Identifier: 
                2E:2D:B0:0A:44:4A:D3:87:C0:02:07:CE:97:7D:50:62:20:FD:0F:83
            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Extended Key Usage: critical
                Time Stamping
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.usertrust.com/UTN-USERFirst-Object.crl

    Signature Algorithm: sha1WithRSAEncryption
         4a:8f:fc:1e:30:a8:3c:75:e8:47:e7:73:ae:b0:69:7a:b2:4d:
         bc:50:d6:9a:8f:81:b6:60:2a:f7:02:a5:48:3a:1e:15:c7:18:
         6b:1c:18:a4:c9:df:fd:f1:ce:f7:b8:2a:d6:6d:a7:cd:e5:7d:
         21:3d:1e:3f:74:c8:a2:b8:79:96:28:ae:e1:fa:73:43:f2:7a:
         be:80:2e:67:04:da:17:fa:9e:5a:96:f5:9c:6d:7e:7e:8c:6c:
         81:27:50:7f:68:d8:89:fa:7d:04:59:67:0f:2d:74:e4:99:87:
         d7:c1:e1:5d:11:4a:26:f7:26:10:80:67:c2:c3:f7:cf:34:1b:
         c4:79:21:cc:60:35:bf:a9:60:77:9e:cb:bc:52:32:22:6c:ad:
         da:df:6d:dd:f3:2e:36:cd:c5:a7:54:e0:f4:a4:cc:e3:f5:d4:
         62:4f:99:06:0c:e5:6f:59:6f:11:c7:cf:58:24:bf:af:25:1d:
         45:11:77:99:65:ae:31:d4:5d:48:9d:8c:c3:72:72:29:99:e5:
         0a:f1:b9:cc:5a:3c:48:d3:ff:40:ce:cd:10:03:3d:bf:33:9c:
         08:f3:10:22:2a:47:b0:77:2b:ee:5b:4e:65:e0:d3:23:3c:03:
         c4:cf:2e:45:62:69:0e:1b:d2:0b:f9:f3:20:0f:53:1a:d0:7c:
         71:f1:38:d0

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ec:b8:eb:b3:2d:ac:9e:e0:69:88:00:55:41:05:5c:9f
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Object
        Validity
            Not Before: Sep 17 00:00:00 2009 GMT
            Not After : Sep 16 23:59:59 2012 GMT
        Subject: C=UA/postalCode=03150, ST=Kyiv, L=Kyiv/street=34-B Predslavinskaya, O=Soft Integrator Ltd., CN=Soft Integrator Ltd.
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:e6:66:06:36:61:43:71:a4:d8:81:08:6a:47:6f:
                    43:c9:55:89:13:11:5a:15:69:cf:2a:28:d9:ed:02:
                    40:99:50:7a:e0:ea:5f:d3:e1:ce:d0:b7:eb:65:22:
                    c5:19:48:6c:27:b1:df:bf:c3:82:33:fb:04:bc:96:
                    36:d4:12:b9:bb:76:25:90:95:4e:b5:d8:26:19:db:
                    84:33:65:32:ac:ac:91:5c:89:dc:1c:b2:74:5e:37:
                    2c:9d:68:67:69:fa:ad:c6:56:74:de:0a:a4:fa:1e:
                    3f:f3:3d:e8:57:9a:c3:27:a4:d3:f7:85:d1:b1:7f:
                    95:54:ec:51:af:f3:f2:c7:5c:e7:cd:48:f9:c3:0f:
                    de:a6:e2:c5:ec:78:87:01:d3:f1:56:03:1f:2b:47:
                    bd:a3:2f:78:98:b1:40:f6:cf:48:87:7e:92:a7:08:
                    7e:e5:63:df:c0:bc:5c:94:25:fd:50:07:7c:0f:2d:
                    45:26:b2:e5:33:b4:eb:65:bc:20:53:37:96:31:37:
                    13:47:c9:69:d1:bd:b4:e1:99:d4:4e:50:37:91:38:
                    62:75:2e:f0:1e:a0:c2:d2:0b:a9:8e:fb:49:cd:22:
                    b6:56:19:04:d4:22:c3:4c:8d:14:10:c2:f6:4f:89:
                    19:fe:15:bf:ff:d7:56:88:17:f3:ea:f2:cf:46:6d:
                    88:81
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier: 
                keyid:DA:ED:64:74:14:9C:14:3C:AB:DD:99:A9:BD:5B:28:4D:8B:3C:C9:D8

            X509v3 Subject Key Identifier: 
                B6:F2:CE:CA:4F:F2:C2:06:41:8B:61:65:3B:17:88:1A:81:3F:6A:82
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Extended Key Usage: 
                Code Signing
            Netscape Cert Type: 
                Object Signing
            X509v3 Certificate Policies: 
                Policy: 1.3.6.1.4.1.6449.1.2.1.3.2
                  CPS: https://secure.comodo.net/CPS

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.usertrust.com/UTN-USERFirst-Object.crl

            Authority Information Access: 
                OCSP - URI:http://ocsp.comodoca.com

    Signature Algorithm: sha1WithRSAEncryption
         33:cb:be:8b:8d:5a:85:5b:b9:16:b7:69:cb:6e:2b:01:71:55:
         f8:53:7d:a4:b8:b4:7c:ce:25:b4:f6:97:bc:d6:c7:f1:8f:c6:
         66:75:49:ff:5f:9e:21:98:0b:ca:c8:90:05:b3:a9:07:cc:2d:
         87:c0:38:b0:4b:0f:2a:47:3a:d6:81:da:b1:f8:78:70:ca:00:
         29:e1:71:32:37:6a:85:63:94:a9:bf:c0:a6:ab:79:19:47:be:
         53:46:b7:7b:18:24:19:3e:c6:11:72:f6:b7:cb:b0:30:c6:a8:
         57:eb:d5:59:da:3b:df:f5:74:6d:44:a5:d1:07:ae:a3:82:d5:
         9e:75:a2:fe:2d:08:e2:b2:4b:c3:bd:6c:b1:cc:1c:2b:62:f8:
         a2:b8:1a:ca:bf:d2:cc:2d:ca:40:8f:ff:4e:0e:5a:fa:62:98:
         47:45:37:1e:40:43:9a:0f:d2:67:d0:0b:5f:e0:a7:ae:05:87:
         18:a9:ca:4a:44:d7:d9:50:bc:45:f3:87:ad:aa:ce:a8:7b:45:
         f9:6a:66:79:15:0b:a7:6f:f0:54:02:f2:c2:50:af:d3:4e:61:
         c4:4c:5e:2f:a0:49:fd:97:da:4a:50:e8:91:e4:81:f8:af:b0:
         bf:d0:6e:c0:d5:fd:e8:ab:83:63:15:4c:f0:2e:4a:cc:d3:a4:
         c0:60:5d:8f

pkcs7-signedData

SHA1: nil

1.3.6.1.4.1.311.2.1.4

1.3.6.1.4.1.311.2.1.15

00 3c 00 3c 00 3c 00 4f  00 62 00 73 00 6f 00 6c  |.<.<.<.O.b.s.o.l|
00 65 00 74 00 65 00 3e  00 3e 00 3e              |.e.t.e.>.>.>    |

SHA1

14 9c 2c d9 90 67 76 f3 22 01 70 c7 20 f2 b3 8e |..,..gv.".p. ...| 2e 52 26 31 |.R&1 |

Certificates
- Certificate #0
  - 2
    - 4F:63:D0:30:F8:15:A3:A5:B3:44:69:40:06:3D:16:89
    - RSA-SHA1: nil
    - Issuer
      - C: US
      - ST: UT
      - L: Salt Lake City
      - O: The USERTRUST Network
      - OU: http://www.usertrust.com
      - CN: UTN-USERFirst-Object
    - 2005-05-17 00:00:00 UTC: 2010-05-16 23:59:59 UTC
    - Subject
      - C: GB
      - ST: Greater Manchester
      - L: Salford
      - O: Comodo CA Limited
      - CN: Comodo Time Stamping Signer
    - #5
      - rsaEncryption: nil
      - BC:35:A0:36:70:22:81:11:C3:B2:83:B9:D3:28:C6:36:
        CD:25:6B:A9:7B:B2:1C:F6:9B:51:9C:EF:35:F4:ED:08:
        8E:5E:38:08:F8:77:3C:0A:42:E0:F3:70:DC:A3:D7:CA:
        F5:4C:0B:CF:FF:22:9C:0A:7E:68:D6:09:A2:2A:84:7B:
        A6:9D:B4:A9:C1:33:E2:EF:1F:17:48:CA:3A:CD:46:E6:
        C5:AA:77:BD:E3:77:9A:FA:47:53:40:28:59:43:93:F1:
        A4:81:EA:EF:80:B5:4F:A7:08:CE:BA:6E:BC:CA:76:0C:
        97:64:59:86:24:BB:3D:82:90:A8:55:B1:92:D3:A0:A7:
        05:AC:9F:53:25:08:10:47:99:CD:98:DE:68:E5:B4:50:
        78:A3:AF:01:CC:59:43:58:E4:76:6E:7E:AC:C7:E2:9E:
        1F:4F:B0:47:2D:C8:0C:A3:49:27:80:75:8C:BB:06:91:
        65:0F:90:9B:F4:BA:D1:81:C8:5C:6A:EC:14:E9:25:09:
        BF:23:16:F4:95:46:40:40:21:BB:83:96:FD:86:1F:7A:
        C8:0D:10:8E:A2:F8:19:07:58:7F:9F:BD:37:02:60:F2:
        A4:E9:9D:44:3F:30:05:E4:A7:70:99:51:9A:E8:17:F1:
        55:CA:B2:61:89:65:46:A7:6A:F2:58:46:7E:AA:A0:07: 0x010001
    - #6
      - authorityKeyIdentifier:
        da ed 64 74 14 9c 14 3c ab dd 99 a9 bd 5b 28 4d |..dt...<.....[(M| 8b 3c c9 d8 |.<.. |
      - subjectKeyIdentifier:
        2e 2d b0 0a 44 4a d3 87 c0 02 07 ce 97 7d 50 62 |.-..DJ.......}Pb| 20 fd 0f 83 | ... |
      - keyUsage: true, 0xc0
      - basicConstraints
        true
        nil
      - extendedKeyUsage: true, timeStamping
      - crlDistributionPoints: http://crl.usertrust.com/UTN-USERFirst-Object.crl
  - RSA-SHA1:
```
4a 8f fc 1e 30 a8 3c 75  e8 47 e7 73 ae b0 69 7a  |J...0.
```
- Certificate #1
  - 2
    - EC:B8:EB:B3:2D:AC:9E:E0:69:88:00:55:41:05:5C:9F
    - RSA-SHA1: nil
    - Issuer
      - C: US
      - ST: UT
      - L: Salt Lake City
      - O: The USERTRUST Network
      - OU: http://www.usertrust.com
      - CN: UTN-USERFirst-Object
    - 2009-09-17 00:00:00 UTC: 2012-09-16 23:59:59 UTC
    - Subject
      - C: UA
      - postalCode: 03150
      - ST: Kyiv
      - L: Kyiv
      - street: 34-B Predslavinskaya
      - O: Soft Integrator Ltd.
      - CN: Soft Integrator Ltd.
    - #5
      - rsaEncryption: nil
      - E6:66:06:36:61:43:71:A4:D8:81:08:6A:47:6F:43:C9:
        55:89:13:11:5A:15:69:CF:2A:28:D9:ED:02:40:99:50:
        7A:E0:EA:5F:D3:E1:CE:D0:B7:EB:65:22:C5:19:48:6C:
        27:B1:DF:BF:C3:82:33:FB:04:BC:96:36:D4:12:B9:BB:
        76:25:90:95:4E:B5:D8:26:19:DB:84:33:65:32:AC:AC:
        91:5C:89:DC:1C:B2:74:5E:37:2C:9D:68:67:69:FA:AD:
        C6:56:74:DE:0A:A4:FA:1E:3F:F3:3D:E8:57:9A:C3:27:
        A4:D3:F7:85:D1:B1:7F:95:54:EC:51:AF:F3:F2:C7:5C:
        E7:CD:48:F9:C3:0F:DE:A6:E2:C5:EC:78:87:01:D3:F1:
        56:03:1F:2B:47:BD:A3:2F:78:98:B1:40:F6:CF:48:87:
        7E:92:A7:08:7E:E5:63:DF:C0:BC:5C:94:25:FD:50:07:
        7C:0F:2D:45:26:B2:E5:33:B4:EB:65:BC:20:53:37:96:
        31:37:13:47:C9:69:D1:BD:B4:E1:99:D4:4E:50:37:91:
        38:62:75:2E:F0:1E:A0:C2:D2:0B:A9:8E:FB:49:CD:22:
        B6:56:19:04:D4:22:C3:4C:8D:14:10:C2:F6:4F:89:19:
        FE:15:BF:FF:D7:56:88:17:F3:EA:F2:CF:46:6D:88:81: 0x010001
    - #6
      - authorityKeyIdentifier:
        da ed 64 74 14 9c 14 3c ab dd 99 a9 bd 5b 28 4d |..dt...<.....[(M| 8b 3c c9 d8 |.<.. |
      - subjectKeyIdentifier:
        b6 f2 ce ca 4f f2 c2 06 41 8b 61 65 3b 17 88 1a |....O...A.ae;...| 81 3f 6a 82 |.?j. |
      - keyUsage: true, 0x80
      - basicConstraints
        true
        nil
      - extendedKeyUsage: codeSigning
      - nsCertType: 0x10
      - certificatePolicies
        1.3.6.1.4.1.6449.1.2.1.3.2
        id-qt-cps: https://secure.comodo.net/CPS
      - crlDistributionPoints: http://crl.usertrust.com/UTN-USERFirst-Object.crl
      - authorityInfoAccess
        OCSP: http://ocsp.comodoca.com
  - RSA-SHA1:
```
33 cb be 8b 8d 5a 85 5b  b9 16 b7 69 cb 6e 2b 01  |3....Z.[...i.n+.|
71 55 f8 53 7d a4 b8 b4  7c ce 25 b4 f6 97 bc d6  |qU.S}...|.%.....|
c7 f1 8f c6 66 75 49 ff  5f 9e 21 98 0b ca c8 90  |....fuI._.!.....|
05 b3 a9 07 cc 2d 87 c0  38 b0 4b 0f 2a 47 3a d6  |.....-..8.K.*G:.|
81 da b1 f8 78 70 ca 00  29 e1 71 32 37 6a 85 63  |....xp..).q27j.c|
94 a9 bf c0 a6 ab 79 19  47 be 53 46 b7 7b 18 24  |......y.G.SF.{.$|
19 3e c6 11 72 f6 b7 cb  b0 30 c6 a8 57 eb d5 59  |.>..r....0..W..Y|
da 3b df f5 74 6d 44 a5  d1 07 ae a3 82 d5 9e 75  |.;..tmD........u|
a2 fe 2d 08 e2 b2 4b c3  bd 6c b1 cc 1c 2b 62 f8  |..-...K..l...+b.|
a2 b8 1a ca bf d2 cc 2d  ca 40 8f ff 4e 0e 5a fa  |.......-.@..N.Z.|
62 98 47 45 37 1e 40 43  9a 0f d2 67 d0 0b 5f e0  |b.GE7.@C...g.._.|
a7 ae 05 87 18 a9 ca 4a  44 d7 d9 50 bc 45 f3 87  |.......JD..P.E..|
ad aa ce a8 7b 45 f9 6a  66 79 15 0b a7 6f f0 54  |....{E.jfy...o.T|
02 f2 c2 50 af d3 4e 61  c4 4c 5e 2f a0 49 fd 97  |...P..Na.L^/.I..|
da 4a 50 e8 91 e4 81 f8  af b0 bf d0 6e c0 d5 fd  |.JP.........n...|
e8 ab 83 63 15 4c f0 2e  4a cc d3 a4 c0 60 5d 8f  |...c.L..J....`].|
```

Signer

1
unnamed
- #0
  - C: US
  - ST: UT
  - L: Salt Lake City
  - O: The USERTRUST Network
  - OU: http://www.usertrust.com
  - CN: UTN-USERFirst-Object
- EC:B8:EB:B3:2D:AC:9E:E0:69:88:00:55:41:05:5C:9F
SHA1: nil

1.3.6.1.4.1.311.2.1.12
- nil
contentType: 1.3.6.1.4.1.311.2.1.4
1.3.6.1.4.1.311.2.1.11: msCodeInd

messageDigest:

b1 09 f7 ad 01 b9 63 bc  7e 41 0c f5 02 e6 4d 8c  |......c.~A....M.|
e2 ef 10 bb                                       |....            |

rsaEncryption:

82 6f e9 6e 9f ea cd b5  53 09 44 ca 87 65 a8 5d  |.o.n....S.D..e.]|
62 f0 ff 01 60 65 1e 8d  45 b4 b7 2a 73 35 b7 16  |b...`e..E..*s5..|
01 a2 5c b3 7a e4 96 df  5c ba 03 13 a4 f8 1e 66  |..\.z...\......f|
fd 59 33 97 dc 46 85 b8  72 d0 03 76 3b 9d e3 10  |.Y3..F..r..v;...|
aa 58 1a fe ee ba 8e 75  6c fe 9f 44 b3 87 cb 50  |.X.....ul..D...P|
e0 14 bd 3b c3 99 4f ef  ee 5d c2 bf 3b e8 2c a8  |...;..O..]..;.,.|
de 4c d8 4e 19 53 e6 d8  70 95 3d 82 52 bb 76 4a  |.L.N.S..p.=.R.vJ|
f3 71 06 76 4c 8f 64 e7  88 ab 12 db ca 8a e2 ba  |.q.vL.d.........|
88 9f 69 f2 bd dc 07 b5  43 49 1d df 92 8a 7b 31  |..i.....CI....{1|
5e 45 4e 90 5f 48 44 ab  27 ad 3c 44 7b 3f a9 aa  |^EN._HD.'.countersignature1unnamed#0C: US
ST: UT
L: Salt Lake City
O: The USERTRUST Network
OU: http://www.usertrust.com
CN: UTN-USERFirst-Object
4F:63:D0:30:F8:15:A3:A5:B3:44:69:40:06:3D:16:89
SHA1: nil
#2contentType: pkcs7-data
signingTime: 2010-01-28 20:19:12 UTC
messageDigest: 6a d1 a3 32 93 d7 3a 3d  61 81 49 81 a3 4d 14 06  |j..2..:=a.I..M..|
b1 f5 af c2                                       |....            |
rsaEncryption: 5b 07 13 bf 5a a9 1b 98  0d 38 d9 70 a6 7a 38 fe  |[...Z....8.p.z8.|
c5 d2 48 35 df a1 42 e5  9c 8a be 26 94 1c a3 8c  |..H5..B....&....|
6a 10 e6 8d 26 e1 37 4b  d0 af 16 88 05 65 73 04  |j...&.7K.....es.|
7a 54 83 9b 57 27 be b7  41 02 38 7c 1d f2 05 cb  |zT..W'..A.8|....|
18 46 2e 21 3c a0 2b d9  8d 5c fb c7 6e 95 e0 32  |.F.!<.+..\..n..2|
46 f4 d7 0e 05 52 c3 f0  fc d0 ac ea c7 96 00 cc  |F....R..........|
1e 77 46 53 36 0e cf df  f0 b3 6c 73 f7 75 c7 82  |.wFS6.....ls.u..|
49 3c 45 ba 5a 1f ed a4  2e 25 d1 e4 d7 c8 4b 7b  |I

show previews

offset	size	type	comment
0	1565184	EXE	06/19/1992 22:22:17	#
15c1	15	HTM		#
17e200	3744	PKCS7	Authenticode Signature	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x2a40c4

[?] can't find file_offset of VA 0x2a41f8

[?] can't find file_offset of VA 0x2a432c

[?] can't find file_offset of VA 0x2a4460

[?] can't find file_offset of VA 0x2a4594

[?] can't find file_offset of VA 0x2a46c8

[?] can't find file_offset of VA 0x2a49b4

[?] can't find file_offset of VA 0x2a4ca0

[?] can't find file_offset of VA 0x2a4f8c

[?] can't find file_offset of VA 0x2a5278

[?] can't find file_offset of VA 0x2a53ac

[?] can't find file_offset of VA 0x2a54e0

[?] can't find file_offset of VA 0x2a5614

[?] can't find file_offset of VA 0x2a5748

[?] can't find file_offset of VA 0x2a5a34

[?] can't find file_offset of VA 0x2a5d20

[?] can't find file_offset of VA 0x2a600c

[?] can't find file_offset of VA 0x2a62f8

[?] can't find file_offset of VA 0x2a65e4

[?] can't find file_offset of VA 0x2a68d0

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x2a6a04

[?] can't find file_offset of VA 0x2a6bd4

[?] can't find file_offset of VA 0x2a6db8

[?] can't find file_offset of VA 0x2a6f88

[?] can't find file_offset of VA 0x2a7158

[?] can't find file_offset of VA 0x2a7328

[?] can't find file_offset of VA 0x2a74f8

[?] can't find file_offset of VA 0x2a76c8

[?] can't find file_offset of VA 0x2a7898

[?] can't find file_offset of VA 0x2a7a68

[?] can't find file_offset of VA 0x2a7c38

[?] can't find file_offset of VA 0x2a7cf8

[?] can't find file_offset of VA 0x2a84b0

[?] can't find file_offset of VA 0x2a8590

[?] can't find file_offset of VA 0x2a8670

[?] can't find file_offset of VA 0x2a8798

[?] can't find file_offset of VA 0x2a8890

[?] can't find file_offset of VA 0x2a8970

[?] can't find file_offset of VA 0x2a8a38

[?] can't find file_offset of VA 0x2a8ab4

[?] can't find file_offset of VA 0x2a8b30

[?] can't find file_offset of VA 0x2a8bf0

[?] can't find file_offset of VA 0x2a8cb0

[?] can't find file_offset of VA 0x2a8d90

[?] can't find file_offset of VA 0x2a8e50

[?] can't find file_offset of VA 0x2a8e98

[?] can't find file_offset of VA 0x2a8ee0

[?] can't find file_offset of VA 0x2a8fc0

[?] can't find file_offset of VA 0x2a9008

[?] can't find file_offset of VA 0x2a9050

[?] can't find file_offset of VA 0x2a9138

[?] can't find file_offset of VA 0x2a91f8

[?] can't find file_offset of VA 0x2a92c0

[?] can't find file_offset of VA 0x2a9928

[?] can't find file_offset of VA 0x2a9f90

[?] can't find file_offset of VA 0x2aa5f8

[?] can't find file_offset of VA 0x2aac60

[?] can't find file_offset of VA 0x2ab2c8

[?] can't find file_offset of VA 0x2ab930

[?] can't find file_offset of VA 0x2abab8

[?] can't find file_offset of VA 0x2ac120

[?] can't find file_offset of VA 0x2ac788

[?] can't find file_offset of VA 0x2ac880

[?] can't find file_offset of VA 0x2acee8

[?] can't find file_offset of VA 0x2ad550

[?] can't find file_offset of VA 0x2ad630

[?] can't find file_offset of VA 0x2ae318

[?] can't find file_offset of VA 0x2af000

[?] can't find file_offset of VA 0x2afce8

[?] can't find file_offset of VA 0x2aff50

[?] can't find file_offset of VA 0x2b01b8

[?] can't find file_offset of VA 0x2b0420

[?] can't find file_offset of VA 0x2b1108

[?] can't find file_offset of VA 0x2b1df0

[?] can't find file_offset of VA 0x2b2b18

[?] can't find file_offset of VA 0x2b7644

[?] can't find file_offset of VA 0x2b776c

[?] can't find file_offset of VA 0x2b7894

[?] can't find file_offset of VA 0x2b78e8

[?] can't find file_offset of VA 0x2b7b0c

[?] can't find file_offset of VA 0x2b7ce4

[?] can't find file_offset of VA 0x2b7d10

[?] can't find file_offset of VA 0x2b8270

[?] can't find file_offset of VA 0x2b883c

[?] can't find file_offset of VA 0x2b8ba4

[?] can't find file_offset of VA 0x2b8fac

[?] can't find file_offset of VA 0x2b9388

[?] can't find file_offset of VA 0x2b96ac

[?] can't find file_offset of VA 0x2b99c8

[?] can't find file_offset of VA 0x2b9d9c

[?] can't find file_offset of VA 0x2ba254

[?] can't find file_offset of VA 0x2ba46c

[?] can't find file_offset of VA 0x2ba634

[?] can't find file_offset of VA 0x2ba71c

[?] can't find file_offset of VA 0x2baa44

[?] can't find file_offset of VA 0x2bad4c

[?] can't find file_offset of VA 0x2bae0c

[?] can't find file_offset of VA 0x2baf08

[?] can't find file_offset of VA 0x2bb0ac

[?] can't find file_offset of VA 0x2bb474

[?] can't find file_offset of VA 0x2bb890

[?] too many errors getting resource data, stopped on 0 of 1

[?] can't find file_offset of VA 0x27d018

mp3tag.exe- mp3Tag - mp3Tag