earth.exe - Earth 3D Screensaver Setup

info
MZ
PE
resources
imports
foremost
version info
signature
hexdump
disasm
log
discuss
donate

filename	earth.exe
size	13689048 (0xd0e0d8)
md5	0d6ca6e2d1816fe2c90e38be352e8f1e

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe8

Rich Header

lib id	version	times used
15	3077	18
95	3077	66
93	2067	2
93	2179	7
1	0	94
96	3077	8
94	3052	1
90	3077	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x4140d4d1
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	7.10
SizeOfCode	0x7000
SizeOfInitializedData	0x5000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x3097
BaseOfCode	0x1000
BaseOfData	0x8000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	54255.208
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0xe000
SizeOfHeaders	0x1000
CheckSum	0xd0fadf
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v7.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x6f08	0x7000	R-X CODE
.rdata	0x8000	0x18ce	0x2000	R-- IDATA
.data	0xa000	0x1c84	0x1000	RW- IDATA
.rsrc	0xc000	0x1794	0x2000	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x9098	0x64
RESOURCE	0xc000	0x1794
EXCEPTION	0	0
SECURITY	0xd0d3f0	0xce8
BASERELOC	0	0
DEBUG	0x8180	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x8fa8	0x48
Bound_IAT	0	0
IAT	0x8000	0x180
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
ICON	#1	296	1252
ICON	#2	1384	1252
ICON	#3	744	1252
ICON	#4	2216	1252
GROUP_ICON	MAINICON	62	1252
VERSION	#1	936	1252

module_name	hint	function_name
WININET.dll	159	InternetSetCookieA
KERNEL32.dll	51	CompareFileTime
KERNEL32.dll	239	FreeLibrary
KERNEL32.dll	361	GetLastError
KERNEL32.dll	46	CloseHandle
KERNEL32.dll	338	GetExitCodeProcess
KERNEL32.dll	839	Sleep
KERNEL32.dll	634	OpenProcess
KERNEL32.dll	795	SetLastError
KERNEL32.dll	408	GetProcAddress
KERNEL32.dll	584	LoadLibraryA
KERNEL32.dll	478	GetVersion
KERNEL32.dll	342	GetFileAttributesA
KERNEL32.dll	201	FindFirstFileA
KERNEL32.dll	939	_lwrite
KERNEL32.dll	938	_lread
KERNEL32.dll	96	CreateProcessA
KERNEL32.dll	956	lstrlenA
KERNEL32.dll	941	lstrcatA
KERNEL32.dll	524	HeapFree
KERNEL32.dll	366	GetLogicalDriveStringsA
KERNEL32.dll	331	GetDriveTypeA
KERNEL32.dll	325	GetDiskFreeSpaceA
KERNEL32.dll	696	RemoveDirectoryA
KERNEL32.dll	934	_lclose
KERNEL32.dll	935	_lcreat
KERNEL32.dll	69	CreateDirectoryA
KERNEL32.dll	124	DeleteFileA
KERNEL32.dll	457	GetTempFileNameA
KERNEL32.dll	459	GetTempPathA
KERNEL32.dll	936	_llseek
KERNEL32.dll	937	_lopen
KERNEL32.dll	373	GetModuleFileNameA
KERNEL32.dll	810	SetStdHandle
KERNEL32.dll	443	GetSystemInfo
KERNEL32.dll	889	VirtualProtect
KERNEL32.dll	364	GetLocaleInfoA
KERNEL32.dll	891	VirtualQuery
KERNEL32.dll	411	GetProcessHeap
KERNEL32.dll	518	HeapAlloc
KERNEL32.dll	528	HeapReAlloc
KERNEL32.dll	229	FlushFileBuffers
KERNEL32.dll	234	FormatMessageA
KERNEL32.dll	530	HeapSize
KERNEL32.dll	950	lstrcpyA
KERNEL32.dll	175	ExitProcess
KERNEL32.dll	375	GetModuleHandleA
KERNEL32.dll	431	GetStartupInfoA
KERNEL32.dll	264	GetCommandLineA
KERNEL32.dll	479	GetVersionExA
KERNEL32.dll	245	GetACP
KERNEL32.dll	395	GetOEMCP
KERNEL32.dll	252	GetCPInfo
KERNEL32.dll	522	HeapDestroy
KERNEL32.dll	520	HeapCreate
KERNEL32.dll	886	VirtualFree
KERNEL32.dll	883	VirtualAlloc
KERNEL32.dll	663	QueryPerformanceCounter
KERNEL32.dll	469	GetTickCount
KERNEL32.dll	318	GetCurrentThreadId
KERNEL32.dll	315	GetCurrentProcessId
KERNEL32.dll	448	GetSystemTimeAsFileTime
KERNEL32.dll	847	TerminateProcess
KERNEL32.dll	314	GetCurrentProcess
KERNEL32.dll	916	WriteFile
KERNEL32.dll	433	GetStdHandle
KERNEL32.dll	864	UnhandledExceptionFilter
KERNEL32.dll	237	FreeEnvironmentStringsA
KERNEL32.dll	333	GetEnvironmentStrings
KERNEL32.dll	238	FreeEnvironmentStringsW
KERNEL32.dll	903	WideCharToMultiByte
KERNEL32.dll	335	GetEnvironmentStringsW
KERNEL32.dll	791	SetHandleCount
KERNEL32.dll	350	GetFileType
KERNEL32.dll	570	LCMapStringA
KERNEL32.dll	619	MultiByteToWideChar
KERNEL32.dll	571	LCMapStringW
KERNEL32.dll	434	GetStringTypeA
KERNEL32.dll	437	GetStringTypeW
KERNEL32.dll	782	SetFilePointer
KERNEL32.dll	714	RtlUnwind
KERNEL32.dll	543	InterlockedExchange
USER32.dll	511	PeekMessageA
USER32.dll	682	TranslateMessage
USER32.dll	161	DispatchMessageA
USER32.dll	478	MessageBoxA
ADVAPI32.dll	482	RegOpenKeyExA
ADVAPI32.dll	461	RegCreateKeyExA
ADVAPI32.dll	505	RegSetValueExA
ADVAPI32.dll	492	RegQueryValueExA
ADVAPI32.dll	470	RegEnumKeyExA
ADVAPI32.dll	457	RegCloseKey

StringTable 040904e4

Comments	This installation was built with Inno Setup: http://www.innosetup.com
CompanyName	3Planesoft
FileDescription	Earth 3D Screensaver Setup
FileVersion
InternalName
OriginalFilename
ProductName
ProductVersion

VS_FIXEDFILEINFO

FileVersion	0.0.0.0
ProductVersion	0.0.0.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=ZA/O=Thawte Consulting (Pty) Ltd./CN=Thawte Code Signing CA

serial: 21B063

Certificates (3)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
        Signature Algorithm: md5WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
        Validity
            Not Before: Aug  1 00:00:00 1996 GMT
            Not After : Dec 31 23:59:59 2020 GMT
        Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:d2:36:36:6a:8b:d7:c2:5b:9e:da:81:41:62:8f:
                    38:ee:49:04:55:d6:d0:ef:1c:1b:95:16:47:ef:18:
                    48:35:3a:52:f4:2b:6a:06:8f:3b:2f:ea:56:e3:af:
                    86:8d:9e:17:f7:9e:b4:65:75:02:4d:ef:cb:09:a2:
                    21:51:d8:9b:d0:67:d0:ba:0d:92:06:14:73:d4:93:
                    cb:97:2a:00:9c:5c:4e:0c:bc:fa:15:52:fc:f2:44:
                    6e:da:11:4a:6e:08:9f:2f:2d:e3:f9:aa:3a:86:73:
                    b6:46:53:58:c8:89:05:bd:83:11:b8:73:3f:aa:07:
                    8d:f4:42:4d:e7:40:9d:1c:37
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: md5WithRSAEncryption
    Signature Value:
        26:48:2c:16:c2:58:fa:e8:16:74:0c:aa:aa:5f:54:3f:f2:d7:
        c9:78:60:5e:5e:6e:37:63:22:77:36:7e:b2:17:c4:34:b9:f5:
        08:85:fc:c9:01:38:ff:4d:be:f2:16:42:43:e7:bb:5a:46:fb:
        c1:c6:11:1f:f1:4a:b0:28:46:c9:c3:c4:42:7d:bc:fa:ab:59:
        6e:d5:b7:51:88:11:e3:a4:85:19:6b:82:4c:a4:0c:12:ad:e9:
        a4:ae:3f:f1:c3:49:65:9a:8c:c5:c8:3e:25:b7:94:99:bb:92:
        32:71:07:f0:86:5e:ed:50:27:a6:0d:a6:23:f9:bb:cb:a6:07:
        14:42

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 10 (0xa)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
        Validity
            Not Before: Aug  6 00:00:00 2003 GMT
            Not After : Aug  5 23:59:59 2013 GMT
        Subject: C=ZA, O=Thawte Consulting (Pty) Ltd., CN=Thawte Code Signing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:c6:b8:b9:27:60:af:0b:e3:91:69:65:db:7e:8d:
                    ed:91:e6:aa:f1:be:d5:ed:fe:6d:d4:2c:7f:d1:70:
                    77:fb:26:99:57:b4:dd:3f:30:b8:dc:21:ea:68:8d:
                    81:92:fc:2e:4b:91:35:84:20:f2:da:4a:ba:b4:fc:
                    e6:da:88:f2:20:c5:21:92:09:47:95:a0:09:1c:a6:
                    79:be:b1:4c:1d:fc:f1:8a:6e:54:d2:69:a1:f1:4c:
                    93:3a:41:fe:7d:d4:64:7b:63:45:f7:60:60:1d:31:
                    1d:a4:e9:d3:0f:8b:fb:6e:26:24:b3:a8:ff:e5:e5:
                    90:d4:b4:c2:dc:50:60:ae:59
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.thawte.com/ThawtePremiumServerCA.crl
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, Code Signing
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name: 
                DirName:/CN=PrivateLabel2-144
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        76:b2:9c:ee:13:9f:1b:f6:2d:34:92:94:45:73:34:dc:8e:6b:
        2e:5c:fc:4c:7d:89:eb:c3:68:f1:d7:99:0f:2e:1d:17:c8:b5:
        16:8b:be:cd:8a:05:06:f2:19:49:3a:03:5b:05:c9:20:8e:6d:
        52:e1:76:81:a0:c3:65:8a:22:67:e4:1c:53:53:37:46:bf:bc:
        d7:2f:eb:7b:9e:d0:14:45:6c:40:21:08:e2:5d:75:76:66:30:
        1e:f4:df:82:8a:2f:bd:f3:a2:0c:bf:1d:db:9f:14:a2:9a:72:
        37:4d:b0:77:48:e8:4a:3f:09:ce:55:19:2c:ef:e6:07:24:e1:
        af:ec

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2207843 (0x21b063)
        Signature Algorithm: md5WithRSAEncryption
        Issuer: C=ZA, O=Thawte Consulting (Pty) Ltd., CN=Thawte Code Signing CA
        Validity
            Not Before: Aug 23 18:48:35 2005 GMT
            Not After : Sep  7 19:58:46 2007 GMT
        Subject: C=US, ST=Nebraska, L=Lincoln, O=eSellerate, OU=Secure Application Development, CN=eSellerate
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:b7:dd:c6:62:a9:94:e6:f3:7f:d1:4f:db:7a:2c:
                    13:37:9d:5d:89:7c:64:3f:34:17:d4:81:df:24:cf:
                    4e:14:48:bd:39:1a:9b:be:97:d0:96:99:7a:e6:46:
                    9c:85:73:4d:71:cd:7b:e2:1c:f4:0b:df:ff:b7:18:
                    a0:0e:b1:2e:71:de:84:7b:80:d9:5d:e0:59:0d:80:
                    5e:e9:bc:e3:82:1b:c7:f4:02:62:64:c2:8e:85:42:
                    cd:98:8d:ba:2d:f9:43:90:eb:6e:b0:77:44:7e:b4:
                    4c:40:ff:66:b6:85:8b:75:8c:51:2a:54:01:0c:fa:
                    7a:b8:b6:2e:90:7b:1e:88:28:48:77:f6:15:8c:eb:
                    74:93:eb:67:16:f2:f5:ad:e9:b1:ed:8b:32:7f:19:
                    5e:74:a6:3d:e8:c0:45:a5:33:8d:f7:e1:ca:69:7c:
                    2f:9b:20:18:1c:63:be:2e:38:e2:f8:0b:b7:e7:11:
                    c3:0b:79:75:55:92:9c:f5:e0:33:66:e6:c2:eb:e8:
                    c1:4d:c4:32:60:e2:c0:45:ec:e9:47:e3:69:74:1f:
                    72:d8:33:d5:0e:24:e3:9b:b4:3f:1e:68:18:8a:30:
                    79:22:ec:63:c0:6c:c0:ce:28:c5:ac:c6:e0:4f:d5:
                    8e:af:48:41:fc:8f:7e:63:1d:47:77:db:ad:9e:49:
                    5b:5f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                Code Signing, Microsoft Commercial Code Signing
            Netscape Cert Type: 
                Object Signing
            2.5.29.4: 
                0.0.0..
+.....7.......
            X509v3 Subject Alternative Name: 
                DNS:www.esellerate.net
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.thawte.com/ThawteCodeSigningCA.crl
            Authority Information Access: 
                OCSP - URI:http://ocsp.thawte.com
            X509v3 Basic Constraints: critical
                CA:FALSE
    Signature Algorithm: md5WithRSAEncryption
    Signature Value:
        51:7b:11:c8:14:4d:28:40:99:dc:9d:2a:29:fa:9d:bf:fa:ff:
        9b:03:91:db:06:77:bb:89:a8:0f:60:1e:c7:23:50:9b:3a:7b:
        a9:05:75:f5:b9:4e:3a:3e:35:99:d6:f2:2e:fa:5c:e9:1c:68:
        1e:f4:9a:39:b6:86:df:84:b5:de:25:de:1d:d3:84:f4:4c:0a:
        1d:9f:f1:2d:43:61:3e:74:12:d2:fb:41:a6:ee:75:96:0a:fe:
        1d:3c:31:1b:d6:bf:8b:fa:d9:83:27:0c:e9:bd:9f:ff:b0:2e:
        c5:b3:2b:10:a2:17:e9:5f:00:33:49:99:f2:ca:e7:3c:71:10:
        51:5d

pkcs7-signedData

1
- SHA1: nil
- 1.3.6.1.4.1.311.2.1.4
  - #0
    - 1.3.6.1.4.1.311.2.1.15
      - :
        00 3c 00 3c 00 3c 00 4f 00 62 00 73 00 6f 00 6c |.<.<.<.O.b.s.o.l| 00 65 00 74 00 65 00 3e 00 3e 00 3e |.e.t.e.>.>.> |
    - SHA1
      - 04 cc 90 ae a1 12 40 5b c2 8d d5 87 50 b7 fa d1 |......@[....P...| 34 0f 37 1d |4.7. |
- Certificates
  - Certificate #0
    - 2
      - 1
      - RSA-MD5: nil
      - Issuer
        C: ZA
        ST: Western Cape
        L: Cape Town
        O: Thawte Consulting cc
        OU: Certification Services Division
        CN: Thawte Premium Server CA
        emailAddress: premium-server@thawte.com
      - 1996-08-01 00:00:00 UTC: 2020-12-31 23:59:59 UTC
      - Subject
        C: ZA
        ST: Western Cape
        L: Cape Town
        O: Thawte Consulting cc
        OU: Certification Services Division
        CN: Thawte Premium Server CA
        emailAddress: premium-server@thawte.com
      - #5
        rsaEncryption: nil
        D2:36:36:6A:8B:D7:C2:5B:9E:DA:81:41:62:8F:38:EE:
        49:04:55:D6:D0:EF:1C:1B:95:16:47:EF:18:48:35:3A:
        52:F4:2B:6A:06:8F:3B:2F:EA:56:E3:AF:86:8D:9E:17:
        F7:9E:B4:65:75:02:4D:EF:CB:09:A2:21:51:D8:9B:D0:
        67:D0:BA:0D:92:06:14:73:D4:93:CB:97:2A:00:9C:5C:
        4E:0C:BC:FA:15:52:FC:F2:44:6E:DA:11:4A:6E:08:9F:
        2F:2D:E3:F9:AA:3A:86:73:B6:46:53:58:C8:89:05:BD:
        83:11:B8:73:3F:AA:07:8D:F4:42:4D:E7:40:9D:1C:37: 0x010001
      - basicConstraints: true, true
    - RSA-MD5:
```
26 48 2c 16 c2 58 fa e8  16 74 0c aa aa 5f 54 3f  |&H,..X...t..._T?|
f2 d7 c9 78 60 5e 5e 6e  37 63 22 77 36 7e b2 17  |...x`^^n7c"w6~..|
c4 34 b9 f5 08 85 fc c9  01 38 ff 4d be f2 16 42  |.4.......8.M...B|
43 e7 bb 5a 46 fb c1 c6  11 1f f1 4a b0 28 46 c9  |C..ZF......J.(F.|
c3 c4 42 7d bc fa ab 59  6e d5 b7 51 88 11 e3 a4  |..B}...Yn..Q....|
85 19 6b 82 4c a4 0c 12  ad e9 a4 ae 3f f1 c3 49  |..k.L.......?..I|
65 9a 8c c5 c8 3e 25 b7  94 99 bb 92 32 71 07 f0  |e....>%.....2q..|
86 5e ed 50 27 a6 0d a6  23 f9 bb cb a6 07 14 42  |.^.P'...#......B|
```
  - Certificate #1
    - 2
      - 0x0A
      - RSA-SHA1: nil
      - Issuer
        C: ZA
        ST: Western Cape
        L: Cape Town
        O: Thawte Consulting cc
        OU: Certification Services Division
        CN: Thawte Premium Server CA
        emailAddress: premium-server@thawte.com
      - 2003-08-06 00:00:00 UTC: 2013-08-05 23:59:59 UTC
      - Subject
        C: ZA
        O: Thawte Consulting (Pty) Ltd.
        CN: Thawte Code Signing CA
      - #5
        rsaEncryption: nil
        C6:B8:B9:27:60:AF:0B:E3:91:69:65:DB:7E:8D:ED:91:
        E6:AA:F1:BE:D5:ED:FE:6D:D4:2C:7F:D1:70:77:FB:26:
        99:57:B4:DD:3F:30:B8:DC:21:EA:68:8D:81:92:FC:2E:
        4B:91:35:84:20:F2:DA:4A:BA:B4:FC:E6:DA:88:F2:20:
        C5:21:92:09:47:95:A0:09:1C:A6:79:BE:B1:4C:1D:FC:
        F1:8A:6E:54:D2:69:A1:F1:4C:93:3A:41:FE:7D:D4:64:
        7B:63:45:F7:60:60:1D:31:1D:A4:E9:D3:0F:8B:FB:6E:
        26:24:B3:A8:FF:E5:E5:90:D4:B4:C2:DC:50:60:AE:59: 0x010001
      - X509v3 extensions
        basicConstraints
        true
        true: 0
        crlDistributionPoints: http://crl.thawte.com/ThawtePremiumServerCA.crl
        extendedKeyUsage
        clientAuth: codeSigning
        keyUsage: true, 6
        subjectAltName
        CN: PrivateLabel2-144
    - RSA-SHA1:
```
76 b2 9c ee 13 9f 1b f6  2d 34 92 94 45 73 34 dc  |v.......-4..Es4.|
8e 6b 2e 5c fc 4c 7d 89  eb c3 68 f1 d7 99 0f 2e  |.k.\.L}...h.....|
1d 17 c8 b5 16 8b be cd  8a 05 06 f2 19 49 3a 03  |.............I:.|
5b 05 c9 20 8e 6d 52 e1  76 81 a0 c3 65 8a 22 67  |[.. .mR.v...e."g|
e4 1c 53 53 37 46 bf bc  d7 2f eb 7b 9e d0 14 45  |..SS7F.../.{...E|
6c 40 21 08 e2 5d 75 76  66 30 1e f4 df 82 8a 2f  |l@!..]uvf0...../|
bd f3 a2 0c bf 1d db 9f  14 a2 9a 72 37 4d b0 77  |...........r7M.w|
48 e8 4a 3f 09 ce 55 19  2c ef e6 07 24 e1 af ec  |H.J?..U.,...$...|
```
  - Certificate #2
    - 2
      - 0x21B063
      - RSA-MD5: nil
      - Issuer
        C: ZA
        O: Thawte Consulting (Pty) Ltd.
        CN: Thawte Code Signing CA
      - 2005-08-23 18:48:35 UTC: 2007-09-07 19:58:46 UTC
      - Subject
        C: US
        ST: Nebraska
        L: Lincoln
        O: eSellerate
        OU: Secure Application Development
        CN: eSellerate
      - #5
        rsaEncryption: nil
        B7:DD:C6:62:A9:94:E6:F3:7F:D1:4F:DB:7A:2C:13:37:
        9D:5D:89:7C:64:3F:34:17:D4:81:DF:24:CF:4E:14:48:
        BD:39:1A:9B:BE:97:D0:96:99:7A:E6:46:9C:85:73:4D:
        71:CD:7B:E2:1C:F4:0B:DF:FF:B7:18:A0:0E:B1:2E:71:
        DE:84:7B:80:D9:5D:E0:59:0D:80:5E:E9:BC:E3:82:1B:
        C7:F4:02:62:64:C2:8E:85:42:CD:98:8D:BA:2D:F9:43:
        90:EB:6E:B0:77:44:7E:B4:4C:40:FF:66:B6:85:8B:75:
        8C:51:2A:54:01:0C:FA:7A:B8:B6:2E:90:7B:1E:88:28:
        48:77:F6:15:8C:EB:74:93:EB:67:16:F2:F5:AD:E9:B1:
        ED:8B:32:7F:19:5E:74:A6:3D:E8:C0:45:A5:33:8D:F7:
        E1:CA:69:7C:2F:9B:20:18:1C:63:BE:2E:38:E2:F8:0B:
        B7:E7:11:C3:0B:79:75:55:92:9C:F5:E0:33:66:E6:C2:
        EB:E8:C1:4D:C4:32:60:E2:C0:45:EC:E9:47:E3:69:74:
        1F:72:D8:33:D5:0E:24:E3:9B:B4:3F:1E:68:18:8A:30:
        79:22:EC:63:C0:6C:C0:CE:28:C5:AC:C6:E0:4F:D5:8E:
        AF:48:41:FC:8F:7E:63:1D:47:77:DB:AD:9E:49:5B:5F: 0x010001
      - #6
        extendedKeyUsage
        codeSigning: msCodeCom
        nsCertType: 0x10
        2.5.29.4
        msCodeCom: 0x80
        subjectAltName: www.esellerate.net
        crlDistributionPoints: http://crl.thawte.com/ThawteCodeSigningCA.crl
        authorityInfoAccess
        OCSP: http://ocsp.thawte.com
        basicConstraints
        true
        nil
    - RSA-MD5:
```
51 7b 11 c8 14 4d 28 40  99 dc 9d 2a 29 fa 9d bf  |Q{...M(@...*)...|
fa ff 9b 03 91 db 06 77  bb 89 a8 0f 60 1e c7 23  |.......w....`..#|
50 9b 3a 7b a9 05 75 f5  b9 4e 3a 3e 35 99 d6 f2  |P.:{..u..N:>5...|
2e fa 5c e9 1c 68 1e f4  9a 39 b6 86 df 84 b5 de  |..\..h...9......|
25 de 1d d3 84 f4 4c 0a  1d 9f f1 2d 43 61 3e 74  |%.....L....-Ca>t|
12 d2 fb 41 a6 ee 75 96  0a fe 1d 3c 31 1b d6 bf  |...A..u....<1...|
8b fa d9 83 27 0c e9 bd  9f ff b0 2e c5 b3 2b 10  |....'.........+.|
a2 17 e9 5f 00 33 49 99  f2 ca e7 3c 71 10 51 5d  |..._.3I....
```
- 1
  - unnamed
    - #0
      - C: ZA
      - O: Thawte Consulting (Pty) Ltd.
      - CN: Thawte Code Signing CA
    - 0x21B063
  - SHA1: nil
  - #2
    - 1.3.6.1.4.1.311.2.1.12
      - nil
    - contentType: 1.3.6.1.4.1.311.2.1.4
    - 1.3.6.1.4.1.311.2.1.11: msCodeCom
    - messageDigest:
```
da 6d 95 58 a3 b2 5d 18  98 a8 bb 95 84 e0 c7 fd  |.m.X..].........|
e9 57 d0 12                                       |.W..            |
```
  - rsaEncryption:
```
56 f7 85 7e b7 28 22 08  8a 9c d6 13 02 ba 3e 04  |V..~.(".......>.|
e0 44 fc 86 34 96 f5 aa  93 03 48 92 2b 52 50 35  |.D..4.....H.+RP5|
52 82 26 45 8c e2 d1 11  5e a3 0b 9a 81 c6 89 1d  |R.&E....^.......|
11 43 02 73 87 6f 8c f9  7c ff 8d 25 ad 5b 7c c8  |.C.s.o..|..%.[|.|
7b 86 df 75 ea 83 f1 a8  b4 4e 37 5f 44 47 75 c8  |{..u.....N7_DGu.|
30 54 39 38 24 97 08 ff  e9 74 68 b1 b8 6b 78 40  |0T98$....th..kx@|
37 20 e4 24 fe 75 da 2c  8f 0e da 49 0d c3 5e 26  |7 .$.u.,...I..^&|
88 84 90 da 65 d3 7e 74  4c 36 fe 0b 57 2f c6 ab  |....e.~tL6..W/..|
6b 9c 2d 5a 34 45 7c 9f  a0 e5 d2 27 2d 14 1e 69  |k.-Z4E|....'-..i|
8c da 48 fc 24 95 10 e7  6d 28 81 73 ba c0 94 fd  |..H.$...m(.s....|
8e fc f1 54 a5 a6 83 89  0f 32 30 37 22 4d 97 6c  |...T.....207"M.l|
3f cf eb 29 94 72 a5 59  12 43 92 f6 70 21 8c a3  |?..).r.Y.C..p!..|
a0 67 54 61 8e dc f4 4f  ce 9b 25 4a 68 f3 82 80  |.gTa...O..%Jh...|
ae 5f 41 ad b9 79 59 26  94 8a b8 e3 c1 4c e7 52  |._A..yY&.....L.R|
b2 21 a3 5c 0c f5 65 36  c9 fa cf 36 ac 87 0d c0  |.!.\..e6...6....|
5a 12 72 ed 0d 8f e4 dd  1d 20 5d 2b f9 91 83 37  |Z.r...... ]+...7|
```

show previews

offset	size	type	comment
0	53248	EXE	09/09/2004 22:10:25	#
15c1	15	HTM		#
d014	50688	EXE	06/19/1992 22:22:17	#
19614	13585092	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

earth.exe-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904e4

VS_FIXEDFILEINFO

Signers (1)

Certificates (3)

earth.exe
-