agentran_64.exe - Agent Ransack (64-bit) Setup

info
MZ
PE
resources
strings
imports
foremost
version info
signature
hexdump
disasm
log
discuss
donate

filename	agentran_64.exe
size	3867176 (0x3b0228)
md5	f256658874eb90226f21aec57fc9cd76

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x50
blocks_in_file	2
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0xf
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0x1a
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	9
TimeDateStamp	0x4b7d4605
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x818f
Magic	0x10b
LinkerVersion	2.25
SizeOfCode	0x15400
SizeOfInitializedData	0xec00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x163c4
BaseOfCode	0x1000
BaseOfData	0x17000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	6.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0x2f000
SizeOfHeaders	0x400
CheckSum	0x3b2d40
Subsystem	2
DllCharacteristics	0x8000
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x4000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

Borland Delphi v6.0 - v7.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x14620	0x14800	R-X CODE
.itext	0x16000	0xb34	0xc00	R-X CODE
.data	0x17000	0xd9c	0xe00	RW- IDATA
.bss	0x18000	0x5710	0	RW-
.idata	0x1e000	0xf9e	0x1000	RW- IDATA
.tls	0x1f000	8	0	RW-
.rdata	0x20000	0x18	0x200	R-- IDATA
.reloc	0x21000	0x1944	0	R-- IDATA DISCARDABLE
.rsrc	0x23000	0xb200	0xb200	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x1e000	0xf9e
RESOURCE	0x23000	0xb200
EXCEPTION	0	0
SECURITY	0x3af080	0x11a8
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x20000	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x1e350	0x24c
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x41f000	0x41f008	0x4177b4	0x420010	0	0

show previews

type	name	size
ICON	#1	296
ICON	#2	1384
ICON	#3	744
ICON	#4	2216
STRING	#4091	196
STRING	#4092	204
STRING	#4093	372
STRING	#4094	924
STRING	#4095	844
STRING	#4096	660
RCDATA	CHARTABLE	33512
RCDATA	DVCLAL	16
RCDATA	PACKAGEINFO	384
RCDATA	#11111	44
GROUP_ICON	MAINICON	62
VERSION	#1	1208
MANIFEST	#1	1376

id	lang	string
65440	0	Thu
65441	0	Fri
65442	0	Sat
65443	0	Sunday
65444	0	Monday
65445	0	Tuesday
65446	0	Wednesday
65447	0	Thursday
65448	0	Friday
65449	0	Saturday
65450	0	Invalid file name - %s
65456	0	January
65457	0	February
65458	0	March
65459	0	April
65460	0	May
65461	0	June
65462	0	July
65463	0	August
65464	0	September
65465	0	October
65466	0	November
65467	0	December
65468	0	Sun
65469	0	Mon
65470	0	Tue
65471	0	Wed
65472	0	Monitor support function not initialized
65473	0	%s (%s, line %d)
65474	0	Abstract Error
65475	0	Access violation at address %p in module '%s'. %s of address %p
65476	0	Jan
65477	0	Feb
65478	0	Mar
65479	0	Apr
65480	0	May
65481	0	Jun
65482	0	Jul
65483	0	Aug
65484	0	Sep
65485	0	Oct
65486	0	Nov
65487	0	Dec
65488	0	Variant or safe array is locked
65489	0	Invalid variant type conversion
65490	0	Invalid variant operation
65491	0	Invalid variant operation (%s%.8x) %s
65492	0	Could not convert variant of type (%s) into type (%s)
65493	0	Overflow while converting variant of type (%s) into type (%s)
65494	0	Variant overflow
65495	0	Invalid argument
65496	0	Invalid variant type
65497	0	Operation not supported
65498	0	Unexpected variant error
65499	0	External exception %x
65500	0	Assertion failed
65501	0	Interface not supported
65502	0	Exception in safecall method
65503	0	Object lock not owned
65504	0	Invalid class typecast
65505	0	Access violation at address %p. %s of address %p
65506	0	Access violation
65507	0	Stack overflow
65508	0	Control-C hit
65509	0	Privileged instruction
65510	0	Operation aborted
65511	0	Exception %s in module %s at %p. %s%s
65512	0	Application Error
65513	0	Format '%s' invalid or incompatible with argument
65514	0	No argument for format '%s'
65515	0	Variant method calls not supported
65516	0	Read
65517	0	Write
65518	0	Error creating variant or safe array
65519	0	Variant or safe array index out of bounds
65520	0	Out of memory
65521	0	I/O error %d
65522	0	File not found
65523	0	Too many open files
65524	0	File access denied
65525	0	Read beyond end of file
65526	0	Disk full
65527	0	Invalid numeric input
65528	0	Division by zero
65529	0	Range check error
65530	0	Integer overflow
65531	0	Invalid floating point operation
65532	0	Floating point division by zero
65533	0	Floating point overflow
65534	0	Floating point underflow
65535	0	Invalid pointer operation

module_name	hint	ord	function_name
oleaut32.dll			SysFreeString
oleaut32.dll			SysReAllocStringLen
oleaut32.dll			SysAllocStringLen
advapi32.dll			RegQueryValueExW
advapi32.dll			RegOpenKeyExW
advapi32.dll			RegCloseKey
user32.dll			GetKeyboardType
user32.dll			LoadStringW
user32.dll			MessageBoxA
user32.dll			CharNextW
kernel32.dll			GetACP
kernel32.dll			Sleep
kernel32.dll			VirtualFree
kernel32.dll			VirtualAlloc
kernel32.dll			GetSystemInfo
kernel32.dll			GetTickCount
kernel32.dll			QueryPerformanceCounter
kernel32.dll			GetVersion
kernel32.dll			GetCurrentThreadId
kernel32.dll			VirtualQuery
kernel32.dll			WideCharToMultiByte
kernel32.dll			MultiByteToWideChar
kernel32.dll			lstrlenW
kernel32.dll			lstrcpynW
kernel32.dll			LoadLibraryExW
kernel32.dll			GetThreadLocale
kernel32.dll			GetStartupInfoA
kernel32.dll			GetProcAddress
kernel32.dll			GetModuleHandleW
kernel32.dll			GetModuleFileNameW
kernel32.dll			GetLocaleInfoW
kernel32.dll			GetCommandLineW
kernel32.dll			FreeLibrary
kernel32.dll			FindFirstFileW
kernel32.dll			FindClose
kernel32.dll			ExitProcess
kernel32.dll			WriteFile
kernel32.dll			UnhandledExceptionFilter
kernel32.dll			RtlUnwind
kernel32.dll			RaiseException
kernel32.dll			GetStdHandle
kernel32.dll			CloseHandle
kernel32.dll			TlsSetValue
kernel32.dll			TlsGetValue
kernel32.dll			LocalAlloc
kernel32.dll			GetModuleHandleW
user32.dll			CreateWindowExW
user32.dll			TranslateMessage
user32.dll			SetWindowLongW
user32.dll			PeekMessageW
user32.dll			MsgWaitForMultipleObjects
user32.dll			MessageBoxW
user32.dll			LoadStringW
user32.dll			GetSystemMetrics
user32.dll			ExitWindowsEx
user32.dll			DispatchMessageW
user32.dll			DestroyWindow
user32.dll			CharUpperBuffW
user32.dll			CallWindowProcW
kernel32.dll			WriteFile
kernel32.dll			WideCharToMultiByte
kernel32.dll			WaitForSingleObject
kernel32.dll			VirtualQuery
kernel32.dll			VirtualProtect
kernel32.dll			VirtualFree
kernel32.dll			VirtualAlloc
kernel32.dll			SizeofResource
kernel32.dll			SignalObjectAndWait
kernel32.dll			SetLastError
kernel32.dll			SetFilePointer
kernel32.dll			SetEvent
kernel32.dll			SetErrorMode
kernel32.dll			SetEndOfFile
kernel32.dll			ResetEvent
kernel32.dll			RemoveDirectoryW
kernel32.dll			ReadFile
kernel32.dll			MultiByteToWideChar
kernel32.dll			LockResource
kernel32.dll			LoadResource
kernel32.dll			LoadLibraryW
kernel32.dll			LeaveCriticalSection
kernel32.dll			InitializeCriticalSection
kernel32.dll			GetWindowsDirectoryW
kernel32.dll			GetVersionExW
kernel32.dll			GetUserDefaultLangID
kernel32.dll			GetThreadLocale
kernel32.dll			GetSystemInfo
kernel32.dll			GetStdHandle
kernel32.dll			GetProcAddress
kernel32.dll			GetModuleHandleW
kernel32.dll			GetModuleFileNameW
kernel32.dll			GetLocaleInfoW
kernel32.dll			GetLocalTime
kernel32.dll			GetLastError
kernel32.dll			GetFullPathNameW
kernel32.dll			GetFileSize
kernel32.dll			GetFileAttributesW
kernel32.dll			GetExitCodeProcess
kernel32.dll			GetEnvironmentVariableW
kernel32.dll			GetDiskFreeSpaceW
kernel32.dll			GetDateFormatW
kernel32.dll			GetCurrentProcess
kernel32.dll			GetCommandLineW
kernel32.dll			GetCPInfo
kernel32.dll			InterlockedExchange
kernel32.dll			InterlockedCompareExchange
kernel32.dll			FreeLibrary
kernel32.dll			FormatMessageW
kernel32.dll			FindResourceW
kernel32.dll			EnumCalendarInfoW
kernel32.dll			EnterCriticalSection
kernel32.dll			DeleteFileW
kernel32.dll			DeleteCriticalSection
kernel32.dll			CreateProcessW
kernel32.dll			CreateFileW
kernel32.dll			CreateEventW
kernel32.dll			CreateDirectoryW
kernel32.dll			CompareStringW
kernel32.dll			CloseHandle
advapi32.dll			RegQueryValueExW
advapi32.dll			RegOpenKeyExW
advapi32.dll			RegCloseKey
advapi32.dll			OpenProcessToken
advapi32.dll			LookupPrivilegeValueW
comctl32.dll			InitCommonControls
kernel32.dll			Sleep
advapi32.dll			AdjustTokenPrivileges
oleaut32.dll			SafeArrayPtrOfIndex
oleaut32.dll			SafeArrayGetUBound
oleaut32.dll			SafeArrayGetLBound
oleaut32.dll			SafeArrayCreate
oleaut32.dll			VariantChangeType
oleaut32.dll			VariantCopy
oleaut32.dll			VariantClear
oleaut32.dll			VariantInit

StringTable 000004b0

Comments	This installation was built with Inno Setup.
CompanyName
FileDescription	Agent Ransack (64-bit) Setup
FileVersion
LegalCopyright
ProductName	Agent Ransack (64-bit)
ProductVersion

VS_FIXEDFILEINFO

FileVersion	0.0.0.0
ProductVersion	0.0.0.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=ZA/O=Thawte Consulting (Pty) Ltd./CN=Thawte Code Signing CA

serial: 034F92B904BA3C48F65BE12DEA888C70

Certificates (4)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            03:4f:92:b9:04:ba:3c:48:f6:5b:e1:2d:ea:88:8c:70
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, O=Thawte Consulting (Pty) Ltd., CN=Thawte Code Signing CA
        Validity
            Not Before: Oct 24 00:00:00 2008 GMT
            Not After : Oct 24 23:59:59 2010 GMT
        Subject: C=GB, ST=Oxfordshire, L=Oxford, O=Mythicsoft Ltd, OU=Secure Application Development, CN=Mythicsoft Ltd
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    00:a7:67:15:41:8f:4a:93:11:81:c1:57:d1:22:1c:
                    82:e4:f6:a1:cf:f9:07:07:2e:e6:78:50:5f:0c:83:
                    af:9d:ad:c6:4c:8a:4a:5a:4c:ce:82:83:cb:03:3e:
                    64:d7:34:06:29:8f:b0:1b:34:da:1e:1b:eb:bc:3e:
                    69:8c:17:c1:17:03:e1:51:25:1e:20:b2:83:17:f2:
                    17:26:9d:6f:4e:da:9e:e8:31:1c:b2:97:61:33:b4:
                    87:da:5a:77:db:c1:50:0c:95:04:91:c7:48:14:75:
                    d4:c9:1e:79:46:33:7f:e7:2c:5b:d6:90:0c:23:7b:
                    6d:51:56:da:58:10:03:d0:e7
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.thawte.com/ThawteCodeSigningCA.crl

            X509v3 Extended Key Usage: 
                Code Signing, Microsoft Commercial Code Signing
            2.5.29.4: 
                0.0.0..
+.....7.......
            Authority Information Access: 
                OCSP - URI:http://ocsp.thawte.com

            Netscape Cert Type: 
                Object Signing
    Signature Algorithm: sha1WithRSAEncryption
         20:fe:f0:4e:5b:d3:9e:e2:71:fe:a5:72:8f:28:3e:5a:b9:0f:
         f9:53:05:3e:f1:57:e0:15:f8:6b:6f:e6:bf:26:f8:0f:3f:3a:
         92:94:81:99:ad:87:60:11:20:b6:df:3b:90:45:f7:a6:ab:0c:
         55:d2:dc:b3:68:a7:f9:44:d5:51:ad:1b:db:90:2d:e7:b9:32:
         68:be:6a:ed:e7:30:3b:c0:51:bd:77:69:d8:b4:94:6f:6b:08:
         1c:56:48:30:84:bc:4d:5d:93:ab:b5:b9:d9:b2:ce:71:fc:15:
         e9:55:49:1f:56:96:51:1c:43:30:df:bc:67:be:f2:db:2f:2b:
         de:19

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 10 (0xa)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
        Validity
            Not Before: Aug  6 00:00:00 2003 GMT
            Not After : Aug  5 23:59:59 2013 GMT
        Subject: C=ZA, O=Thawte Consulting (Pty) Ltd., CN=Thawte Code Signing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    00:c6:b8:b9:27:60:af:0b:e3:91:69:65:db:7e:8d:
                    ed:91:e6:aa:f1:be:d5:ed:fe:6d:d4:2c:7f:d1:70:
                    77:fb:26:99:57:b4:dd:3f:30:b8:dc:21:ea:68:8d:
                    81:92:fc:2e:4b:91:35:84:20:f2:da:4a:ba:b4:fc:
                    e6:da:88:f2:20:c5:21:92:09:47:95:a0:09:1c:a6:
                    79:be:b1:4c:1d:fc:f1:8a:6e:54:d2:69:a1:f1:4c:
                    93:3a:41:fe:7d:d4:64:7b:63:45:f7:60:60:1d:31:
                    1d:a4:e9:d3:0f:8b:fb:6e:26:24:b3:a8:ff:e5:e5:
                    90:d4:b4:c2:dc:50:60:ae:59
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.thawte.com/ThawtePremiumServerCA.crl

            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, Code Signing
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name: 
                DirName:/CN=PrivateLabel2-144
    Signature Algorithm: sha1WithRSAEncryption
         76:b2:9c:ee:13:9f:1b:f6:2d:34:92:94:45:73:34:dc:8e:6b:
         2e:5c:fc:4c:7d:89:eb:c3:68:f1:d7:99:0f:2e:1d:17:c8:b5:
         16:8b:be:cd:8a:05:06:f2:19:49:3a:03:5b:05:c9:20:8e:6d:
         52:e1:76:81:a0:c3:65:8a:22:67:e4:1c:53:53:37:46:bf:bc:
         d7:2f:eb:7b:9e:d0:14:45:6c:40:21:08:e2:5d:75:76:66:30:
         1e:f4:df:82:8a:2f:bd:f3:a2:0c:bf:1d:db:9f:14:a2:9a:72:
         37:4d:b0:77:48:e8:4a:3f:09:ce:55:19:2c:ef:e6:07:24:e1:
         af:ec

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
        Validity
            Not Before: Jun 15 00:00:00 2007 GMT
            Not After : Jun 14 23:59:59 2012 GMT
        Subject: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    00:c4:b5:f2:52:15:bc:88:86:60:29:16:4a:5b:2f:
                    4b:91:6b:87:91:f3:35:54:58:35:ea:d1:36:5e:62:
                    4d:52:51:34:71:c2:7b:66:1d:89:c8:dd:2a:c4:6a:
                    0a:f6:37:d9:98:74:91:f6:92:ae:b0:b5:76:96:f1:
                    a9:4a:63:45:47:2e:6b:0b:92:4e:4b:2b:8c:ee:58:
                    4a:8b:d4:07:e4:1a:2c:f8:82:aa:58:d9:cd:42:f3:
                    2d:c0:75:de:8d:ab:c7:8e:1d:9a:6c:4c:08:95:1e:
                    de:db:ef:67:e1:72:c2:49:c2:9e:60:3c:e1:e2:be:
                    16:a3:63:78:69:14:7b:ad:2d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com

            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.verisign.com/tss-ca.crl

            X509v3 Extended Key Usage: critical
                Time Stamping
            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation
            X509v3 Subject Alternative Name: 
                DirName:/CN=TSA1-2
    Signature Algorithm: sha1WithRSAEncryption
         50:c5:4b:c8:24:80:df:e4:0d:24:c2:de:1a:b1:a1:02:a1:a6:
         82:2d:0c:83:15:81:37:0a:82:0e:2c:b0:5a:17:61:b5:d8:05:
         fe:88:db:f1:91:91:b3:56:1a:40:a6:eb:92:be:38:39:b0:75:
         36:74:3a:98:4f:e4:37:ba:99:89:ca:95:42:1d:b0:b9:c7:a0:
         8d:57:e0:fa:d5:64:04:42:35:4e:01:d1:33:a2:17:c8:4d:aa:
         27:c7:f2:e1:86:4c:02:38:4d:83:78:c6:fc:53:e0:eb:e0:06:
         87:dd:a4:96:9e:5e:0c:98:e2:a5:be:bf:82:85:c3:60:e1:df:
         ad:28:d8:c7:a5:4b:64:da:c7:1b:5b:bd:ac:39:08:d5:38:22:
         a1:33:8b:2f:8a:9a:eb:bc:07:21:3f:44:41:09:07:b5:65:1c:
         24:bc:48:d3:44:80:eb:a1:cf:c9:02:b4:14:cf:54:c7:16:a3:
         80:5c:f9:79:3e:5d:72:7d:88:17:9e:2c:43:a2:ca:53:ce:7d:
         3d:f6:2a:3a:b8:4f:94:00:a5:6d:0a:83:5d:f9:5e:53:f4:18:
         b3:57:0f:70:c3:fb:f5:ad:95:a0:0e:17:de:c4:16:80:60:c9:
         0f:2b:6e:86:04:f1:eb:f4:78:27:d1:05:c5:ee:34:5b:5e:b9:
         49:32:f2:33

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
        Validity
            Not Before: Dec  4 00:00:00 2003 GMT
            Not After : Dec  3 23:59:59 2013 GMT
        Subject: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:a9:ca:b2:a4:cc:cd:20:af:0a:7d:89:ac:87:75:
                    f0:b4:4e:f1:df:c1:0f:bf:67:61:bd:a3:64:1c:da:
                    bb:f9:ca:33:ab:84:30:89:58:7e:8c:db:6b:dd:36:
                    9e:0f:bf:d1:ec:78:f2:77:a6:7e:6f:3c:bf:93:af:
                    0d:ba:68:f4:6c:94:ca:bd:52:2d:ab:48:3d:f5:b6:
                    d5:5d:5f:1b:02:9f:fa:2f:6b:1e:a4:f7:a3:9a:a6:
                    1a:c8:02:e1:7f:4c:52:e3:0e:60:ec:40:1c:7e:b9:
                    0d:de:3f:c7:b4:df:87:bd:5f:7a:6a:31:2e:03:99:
                    81:13:a8:47:20:ce:31:73:0d:57:2d:cd:78:34:33:
                    95:12:99:12:b9:de:68:2f:aa:e6:e3:c2:8a:8c:2a:
                    c3:8b:21:87:66:bd:83:58:57:6f:75:bf:3c:aa:26:
                    87:5d:ca:10:15:3c:9f:84:ea:54:c1:0a:6e:c4:fe:
                    c5:4a:dd:b9:07:11:97:22:7c:db:3e:27:d1:1e:78:
                    ec:9f:31:c9:f1:e6:22:19:db:c4:b3:47:43:9a:1a:
                    5f:a0:1e:90:e4:5e:f5:ee:7c:f1:7d:ab:62:01:8f:
                    f5:4d:0b:de:d0:22:56:a8:95:cd:ae:88:76:ae:ee:
                    ba:0d:f3:e4:4d:d9:a0:fb:68:a0:ae:14:3b:b3:87:
                    c1:bb
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com

            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.verisign.com/ThawteTimestampingCA.crl

            X509v3 Extended Key Usage: 
                Time Stamping
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name: 
                DirName:/CN=TSA2048-1-53
    Signature Algorithm: sha1WithRSAEncryption
         4a:6b:f9:ea:58:c2:44:1c:31:89:79:99:2b:96:bf:82:ac:01:
         d6:1c:4c:cd:b0:8a:58:6e:df:08:29:a3:5e:c8:ca:93:13:e7:
         04:52:0d:ef:47:27:2f:00:38:b0:e4:c9:93:4e:9a:d4:22:62:
         15:f7:3f:37:21:4f:70:31:80:f1:8b:38:87:b3:e8:e8:97:00:
         fe:cf:55:96:4e:24:d2:a9:27:4e:7a:ae:b7:61:41:f3:2a:ce:
         e7:c9:d9:5e:dd:bb:2b:85:3e:b5:9d:b5:d9:e1:57:ff:be:b4:
         c5:7e:f5:cf:0c:9e:f0:97:fe:2b:d3:3b:52:1b:1b:38:27:f7:
         3f:4a

pkcs7-signedData

1
- MD5: nil
- 1.3.6.1.4.1.311.2.1.4
  - #0
    - 1.3.6.1.4.1.311.2.1.15
      - :
        00 3c 00 3c 00 3c 00 4f 00 62 00 73 00 6f 00 6c |.<.<.<.O.b.s.o.l| 00 65 00 74 00 65 00 3e 00 3e 00 3e |.e.t.e.>.>.> |
    - MD5
      - 39 65 e5 5e e9 c4 7e 71 38 14 0f 3c 91 fd ee 70 |9e.^..~q8..<...p|
- Certificates
  - Certificate #0
    - 2
      - 03:4F:92:B9:04:BA:3C:48:F6:5B:E1:2D:EA:88:8C:70
      - RSA-SHA1: nil
      - Issuer
        C: ZA
        O: Thawte Consulting (Pty) Ltd.
        CN: Thawte Code Signing CA
      - 2008-10-24 00:00:00 UTC: 2010-10-24 23:59:59 UTC
      - Subject
        C: GB
        ST: Oxfordshire
        L: Oxford
        O: Mythicsoft Ltd
        OU: Secure Application Development
        CN: Mythicsoft Ltd
      - #5
        rsaEncryption: nil
        A7:67:15:41:8F:4A:93:11:81:C1:57:D1:22:1C:82:E4:
        F6:A1:CF:F9:07:07:2E:E6:78:50:5F:0C:83:AF:9D:AD:
        C6:4C:8A:4A:5A:4C:CE:82:83:CB:03:3E:64:D7:34:06:
        29:8F:B0:1B:34:DA:1E:1B:EB:BC:3E:69:8C:17:C1:17:
        03:E1:51:25:1E:20:B2:83:17:F2:17:26:9D:6F:4E:DA:
        9E:E8:31:1C:B2:97:61:33:B4:87:DA:5A:77:DB:C1:50:
        0C:95:04:91:C7:48:14:75:D4:C9:1E:79:46:33:7F:E7:
        2C:5B:D6:90:0C:23:7B:6D:51:56:DA:58:10:03:D0:E7: 0x010001
      - X509v3 extensions
        basicConstraints
        true
        nil
        crlDistributionPoints: http://crl.thawte.com/ThawteCodeSigningCA.crl
        extendedKeyUsage
        codeSigning: msCodeCom
        2.5.29.4
        msCodeCom: 0x80
        authorityInfoAccess
        OCSP: http://ocsp.thawte.com
        nsCertType: 0x10
    - RSA-SHA1:
```
20 fe f0 4e 5b d3 9e e2  71 fe a5 72 8f 28 3e 5a  | ..N[...q..r.(>Z|
b9 0f f9 53 05 3e f1 57  e0 15 f8 6b 6f e6 bf 26  |...S.>.W...ko..&|
f8 0f 3f 3a 92 94 81 99  ad 87 60 11 20 b6 df 3b  |..?:......`. ..;|
90 45 f7 a6 ab 0c 55 d2  dc b3 68 a7 f9 44 d5 51  |.E....U...h..D.Q|
ad 1b db 90 2d e7 b9 32  68 be 6a ed e7 30 3b c0  |....-..2h.j..0;.|
51 bd 77 69 d8 b4 94 6f  6b 08 1c 56 48 30 84 bc  |Q.wi...ok..VH0..|
4d 5d 93 ab b5 b9 d9 b2  ce 71 fc 15 e9 55 49 1f  |M].......q...UI.|
56 96 51 1c 43 30 df bc  67 be f2 db 2f 2b de 19  |V.Q.C0..g.../+..|
```
  - Certificate #1
    - 2
      - 0x0A
      - RSA-SHA1: nil
      - Issuer
        C: ZA
        ST: Western Cape
        L: Cape Town
        O: Thawte Consulting cc
        OU: Certification Services Division
        CN: Thawte Premium Server CA
        emailAddress: premium-server@thawte.com
      - 2003-08-06 00:00:00 UTC: 2013-08-05 23:59:59 UTC
      - Subject
        C: ZA
        O: Thawte Consulting (Pty) Ltd.
        CN: Thawte Code Signing CA
      - #5
        rsaEncryption: nil
        C6:B8:B9:27:60:AF:0B:E3:91:69:65:DB:7E:8D:ED:91:
        E6:AA:F1:BE:D5:ED:FE:6D:D4:2C:7F:D1:70:77:FB:26:
        99:57:B4:DD:3F:30:B8:DC:21:EA:68:8D:81:92:FC:2E:
        4B:91:35:84:20:F2:DA:4A:BA:B4:FC:E6:DA:88:F2:20:
        C5:21:92:09:47:95:A0:09:1C:A6:79:BE:B1:4C:1D:FC:
        F1:8A:6E:54:D2:69:A1:F1:4C:93:3A:41:FE:7D:D4:64:
        7B:63:45:F7:60:60:1D:31:1D:A4:E9:D3:0F:8B:FB:6E:
        26:24:B3:A8:FF:E5:E5:90:D4:B4:C2:DC:50:60:AE:59: 0x010001
      - X509v3 extensions
        basicConstraints
        true
        true: 0
        crlDistributionPoints: http://crl.thawte.com/ThawtePremiumServerCA.crl
        extendedKeyUsage
        clientAuth: codeSigning
        keyUsage: true, 6
        subjectAltName
        CN: PrivateLabel2-144
    - RSA-SHA1:
```
76 b2 9c ee 13 9f 1b f6  2d 34 92 94 45 73 34 dc  |v.......-4..Es4.|
8e 6b 2e 5c fc 4c 7d 89  eb c3 68 f1 d7 99 0f 2e  |.k.\.L}...h.....|
1d 17 c8 b5 16 8b be cd  8a 05 06 f2 19 49 3a 03  |.............I:.|
5b 05 c9 20 8e 6d 52 e1  76 81 a0 c3 65 8a 22 67  |[.. .mR.v...e."g|
e4 1c 53 53 37 46 bf bc  d7 2f eb 7b 9e d0 14 45  |..SS7F.../.{...E|
6c 40 21 08 e2 5d 75 76  66 30 1e f4 df 82 8a 2f  |l@!..]uvf0...../|
bd f3 a2 0c bf 1d db 9f  14 a2 9a 72 37 4d b0 77  |...........r7M.w|
48 e8 4a 3f 09 ce 55 19  2c ef e6 07 24 e1 af ec  |H.J?..U.,...$...|
```
  - Certificate #2
    - 2
      - 38:25:D7:FA:F8:61:AF:9E:F4:90:E7:26:B5:D6:5A:D5
      - RSA-SHA1: nil
      - Issuer
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services CA
      - 2007-06-15 00:00:00 UTC: 2012-06-14 23:59:59 UTC
      - Subject
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services Signer - G2
      - #5
        rsaEncryption: nil
        C4:B5:F2:52:15:BC:88:86:60:29:16:4A:5B:2F:4B:91:
        6B:87:91:F3:35:54:58:35:EA:D1:36:5E:62:4D:52:51:
        34:71:C2:7B:66:1D:89:C8:DD:2A:C4:6A:0A:F6:37:D9:
        98:74:91:F6:92:AE:B0:B5:76:96:F1:A9:4A:63:45:47:
        2E:6B:0B:92:4E:4B:2B:8C:EE:58:4A:8B:D4:07:E4:1A:
        2C:F8:82:AA:58:D9:CD:42:F3:2D:C0:75:DE:8D:AB:C7:
        8E:1D:9A:6C:4C:08:95:1E:DE:DB:EF:67:E1:72:C2:49:
        C2:9E:60:3C:E1:E2:BE:16:A3:63:78:69:14:7B:AD:2D: 0x010001
      - X509v3 extensions
        authorityInfoAccess
        OCSP: http://ocsp.verisign.com
        basicConstraints
        true
        nil
        crlDistributionPoints: http://crl.verisign.com/tss-ca.crl
        extendedKeyUsage: true, timeStamping
        keyUsage: true, 0xc0
        subjectAltName
        CN: TSA1-2
    - RSA-SHA1:
```
50 c5 4b c8 24 80 df e4  0d 24 c2 de 1a b1 a1 02  |P.K.$....$......|
a1 a6 82 2d 0c 83 15 81  37 0a 82 0e 2c b0 5a 17  |...-....7...,.Z.|
61 b5 d8 05 fe 88 db f1  91 91 b3 56 1a 40 a6 eb  |a..........V.@..|
92 be 38 39 b0 75 36 74  3a 98 4f e4 37 ba 99 89  |..89.u6t:.O.7...|
ca 95 42 1d b0 b9 c7 a0  8d 57 e0 fa d5 64 04 42  |..B......W...d.B|
35 4e 01 d1 33 a2 17 c8  4d aa 27 c7 f2 e1 86 4c  |5N..3...M.'....L|
02 38 4d 83 78 c6 fc 53  e0 eb e0 06 87 dd a4 96  |.8M.x..S........|
9e 5e 0c 98 e2 a5 be bf  82 85 c3 60 e1 df ad 28  |.^.........`...(|
d8 c7 a5 4b 64 da c7 1b  5b bd ac 39 08 d5 38 22  |...Kd...[..9..8"|
a1 33 8b 2f 8a 9a eb bc  07 21 3f 44 41 09 07 b5  |.3./.....!?DA...|
65 1c 24 bc 48 d3 44 80  eb a1 cf c9 02 b4 14 cf  |e.$.H.D.........|
54 c7 16 a3 80 5c f9 79  3e 5d 72 7d 88 17 9e 2c  |T....\.y>]r}...,|
43 a2 ca 53 ce 7d 3d f6  2a 3a b8 4f 94 00 a5 6d  |C..S.}=.*:.O...m|
0a 83 5d f9 5e 53 f4 18  b3 57 0f 70 c3 fb f5 ad  |..].^S...W.p....|
95 a0 0e 17 de c4 16 80  60 c9 0f 2b 6e 86 04 f1  |........`..+n...|
eb f4 78 27 d1 05 c5 ee  34 5b 5e b9 49 32 f2 33  |..x'....4[^.I2.3|
```
  - Certificate #3
    - 2
      - 47:BF:19:95:DF:8D:52:46:43:F7:DB:6D:48:0D:31:A4
      - RSA-SHA1: nil
      - Issuer
        C: ZA
        ST: Western Cape
        L: Durbanville
        O: Thawte
        OU: Thawte Certification
        CN: Thawte Timestamping CA
      - 2003-12-04 00:00:00 UTC: 2013-12-03 23:59:59 UTC
      - Subject
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services CA
      - #5
        rsaEncryption: nil
        A9:CA:B2:A4:CC:CD:20:AF:0A:7D:89:AC:87:75:F0:B4:
        4E:F1:DF:C1:0F:BF:67:61:BD:A3:64:1C:DA:BB:F9:CA:
        33:AB:84:30:89:58:7E:8C:DB:6B:DD:36:9E:0F:BF:D1:
        EC:78:F2:77:A6:7E:6F:3C:BF:93:AF:0D:BA:68:F4:6C:
        94:CA:BD:52:2D:AB:48:3D:F5:B6:D5:5D:5F:1B:02:9F:
        FA:2F:6B:1E:A4:F7:A3:9A:A6:1A:C8:02:E1:7F:4C:52:
        E3:0E:60:EC:40:1C:7E:B9:0D:DE:3F:C7:B4:DF:87:BD:
        5F:7A:6A:31:2E:03:99:81:13:A8:47:20:CE:31:73:0D:
        57:2D:CD:78:34:33:95:12:99:12:B9:DE:68:2F:AA:E6:
        E3:C2:8A:8C:2A:C3:8B:21:87:66:BD:83:58:57:6F:75:
        BF:3C:AA:26:87:5D:CA:10:15:3C:9F:84:EA:54:C1:0A:
        6E:C4:FE:C5:4A:DD:B9:07:11:97:22:7C:DB:3E:27:D1:
        1E:78:EC:9F:31:C9:F1:E6:22:19:DB:C4:B3:47:43:9A:
        1A:5F:A0:1E:90:E4:5E:F5:EE:7C:F1:7D:AB:62:01:8F:
        F5:4D:0B:DE:D0:22:56:A8:95:CD:AE:88:76:AE:EE:BA:
        0D:F3:E4:4D:D9:A0:FB:68:A0:AE:14:3B:B3:87:C1:BB: 0x010001
      - X509v3 extensions
        authorityInfoAccess
        OCSP: http://ocsp.verisign.com
        basicConstraints
        true
        true: 0
        crlDistributionPoints: http://crl.verisign.com/ThawteTimestampingCA.crl
        extendedKeyUsage: timeStamping
        keyUsage: true, 6
        subjectAltName
        CN: TSA2048-1-53
    - RSA-SHA1:
```
4a 6b f9 ea 58 c2 44 1c  31 89 79 99 2b 96 bf 82  |Jk..X.D.1.y.+...|
ac 01 d6 1c 4c cd b0 8a  58 6e df 08 29 a3 5e c8  |....L...Xn..).^.|
ca 93 13 e7 04 52 0d ef  47 27 2f 00 38 b0 e4 c9  |.....R..G'/.8...|
93 4e 9a d4 22 62 15 f7  3f 37 21 4f 70 31 80 f1  |.N.."b..?7!Op1..|
8b 38 87 b3 e8 e8 97 00  fe cf 55 96 4e 24 d2 a9  |.8........U.N$..|
27 4e 7a ae b7 61 41 f3  2a ce e7 c9 d9 5e dd bb  |'Nz..aA.*....^..|
2b 85 3e b5 9d b5 d9 e1  57 ff be b4 c5 7e f5 cf  |+.>.....W....~..|
0c 9e f0 97 fe 2b d3 3b  52 1b 1b 38 27 f7 3f 4a  |.....+.;R..8'.?J|
```
- 1
  - unnamed
    - #0
      - C: ZA
      - O: Thawte Consulting (Pty) Ltd.
      - CN: Thawte Code Signing CA
    - 03:4F:92:B9:04:BA:3C:48:F6:5B:E1:2D:EA:88:8C:70
  - MD5: nil
  - #2
    - contentType: 1.3.6.1.4.1.311.2.1.4
    - 1.3.6.1.4.1.311.2.1.11: msCodeCom
    - messageDigest:
```
8f c5 04 7c 52 3e 4e 91  1e f7 bc 6a 32 60 ee 84  |...|R>N....j2`..|
```
    - 1.3.6.1.4.1.311.2.1.12: http://www.mythicsoft.com
  - rsaEncryption:
```
86 fc 3d 40 b0 26 a5 8e  88 de f7 58 58 ae 43 4b  |..=@.&.....XX.CK|
8c b8 fe 6f d3 7b 5f 34  fb a0 90 be f8 52 87 96  |...o.{_4.....R..|
bc 50 01 e4 f0 29 39 c8  44 47 01 b5 e8 6a 18 25  |.P...)9.DG...j.%|
4a 32 76 5d b8 16 d3 80  91 0e 6a 4c 42 59 5f 26  |J2v]......jLBY_&|
14 0f 5d b6 6c 68 d5 2b  3d 5b 35 50 37 42 f3 5e  |..].lh.+=[5P7B.^|
fb 53 8f c3 d6 80 4e fa  91 73 51 6e 28 ab dd 9f  |.S....N..sQn(...|
46 a6 25 dc ac a9 b7 a5  08 50 f6 3c a5 ff 0e ef  |F.%......P.<....|
a9 2b 79 6d ff 5b b3 48  14 ba d9 47 5a 53 25 23  |.+ym.[.H...GZS%#|
```
  - countersignature
    - 1
      - unnamed
        #0
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services CA
        38:25:D7:FA:F8:61:AF:9E:F4:90:E7:26:B5:D6:5A:D5
      - SHA1: nil
      - #2
        contentType: pkcs7-data
        signingTime: 2010-03-29 11:38:48 UTC
        messageDigest:
        c5 ae 9c a3 5b 1a 06 cb 9c 34 9b f4 48 c7 a1 08 |....[....4..H...| 1a eb 7d 5c |..}\ |
      - rsaEncryption:
        0a f1 6b c1 d0 9e 71 dd 0a 6a 14 21 d3 40 9c c1 |..k...q..j.!.@..| de d5 f5 fe 8e 9e 07 8c cd ce 31 e0 23 e1 be 6f |..........1.#..o| 2d 23 df 7f e3 9f 03 17 74 d2 a7 c2 95 e0 20 33 |-#......t..... 3| 72 3a a6 dd c6 4e b2 e9 0f 52 35 cc 8e 55 41 45 |r:...N...R5..UAE| 18 7d a7 d6 de 33 47 ef 01 16 7a ae 8f c7 5f cf |.}...3G...z..._.| ac f8 10 db 4c ca fb 17 a8 56 97 0f 28 cc ed 06 |....L....V..(...| b9 5a 38 1e 8f e1 16 30 64 b7 d3 e2 69 0e f9 d3 |.Z8....0d...i...| 9e 8a 25 f8 12 f8 eb cc 99 70 77 99 d2 0e a9 1f |..%......pw.....|

show previews

offset	size	type	comment
0	141824	EXE	02/18/2010 13:52:05	#
15c1	15	HTM		#
22a00	3725352	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

agentran_64.exe- Agent Ransack (64-bit) Setup

MZ Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

TLS

StringTable 000004b0

VS_FIXEDFILEINFO

Signers (1)

Certificates (4)

agentran_64.exe
- Agent Ransack (64-bit) Setup