filenamesf2.exe
size8768552 (0x85cc28)
md53c67a8452399c41cb570070e0a964404
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x138

Rich Header

lib idversiontimes used
1704021914
150204134
1493072913
138307294
9630771
13130729186
1235072712
110507271
9340352
9540352
1473072953
10690
95307710
109507277
13230729442
146307291
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x5d517189
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x122
Magic0x10b
LinkerVersion9.0
SizeOfCode0xf64a00
SizeOfInitializedData0xa34000
SizeOfUninitializedData0
AddressOfEntryPoint0x2254000
BaseOfCode0x1000
BaseOfData0xf66000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x2255000
SizeOfHeaders0x400
CheckSum0x8606d8
Subsystem2
DllCharacteristics0x8100
SizeOfStackReserve0x4c4b40
SizeOfStackCommit0x4c4b40
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
0x10000x17dc0000x679600RWX IDATA
.rsrc0x17dd0000x1b5d00x19200RW- IDATA
.idata0x17f90000x10000x200RW- IDATA
0x17fa0000x8920000x200RWX IDATA
dmvejbem0x208c0000x1c80000x1c7400RWX IDATA
tbtpfbmy0x22540000x10000x200RWX IDATA

Data Directory

typevasize
EXPORT0x22399bc0x8a7
IMPORT0x17f906d0x95
RESOURCE0x17dd0000x1b5d0
EXCEPTION00
SECURITY0x85b2000x1a28
BASERELOC0x17f91f88
DEBUG0x22533c40x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT0x129287c0x80
CLR_Header00
typenamesizecp
CURSOR#123080
CURSOR#133080
CURSOR#143080
CURSOR#153080
CURSOR#163080
ICON#17440
ICON#22960
ICON#337520
ICON#422160
ICON#513840
ICON#6191650
ICON#796400
ICON#842640
ICON#911280
ICON#1042640
ICON#11534630
DIALOG#1013000
DIALOG#1023440
RCDATA#101053970
MESSAGETABLE#1960
GROUP_CURSORWXCURSOR_CROSS200
GROUP_CURSOR#104200
GROUP_CURSOR#105200
GROUP_CURSOR#106200
GROUP_CURSOR#2001200
GROUP_ICON#201340
GROUP_ICON#2021320
VERSION#17960
MANIFEST#112950
module_namehintordfunction_name
kernel32.dlllstrcpy
comctl32.dllInitCommonControls
ordentry_vafunction_name
10xa59c0??0System@Scaleform@@QAE@ABUHeapDesc@MemoryHeap@1@PAVSysAllocBase@1@@Z
20xa6f40??0System@Scaleform@@QAE@PAVSysAllocBase@1@@Z
30xa5890??1AcquireInterface@Scaleform@@UAE@XZ
40xa5890??1DefaultAcquireInterface@Scaleform@@UAE@XZ
50xa59e0??1System@Scaleform@@QAE@XZ
60xa5910??_FEvent@Scaleform@@QAEXXZ
70xa5900??_FMutex@Scaleform@@QAEXXZ
80xa5920??_FSemaphore@Scaleform@@QAEXXZ
90xa5870??_FSysAllocStatic@Scaleform@@QAEXXZ
100xa9ca0??_FSystem@Scaleform@@QAEXXZ
110xa5930??_FThread@Scaleform@@QAEXXZ
120x12dd688GDebugger
130x861c0GetOutermost
140x7dae80GetStackOwnerClass
150xa79b0?GetXScale@?$Matrix2x4@M@Render@Scaleform@@QBEMXZ
160xa79c0?GetYScale@?$Matrix2x4@M@Render@Scaleform@@QBEMXZ
170xa5a40?Init@System@GFx@Scaleform@@SAXPAVSysAllocBase@3@@Z
180xa59f0?Init@System@Scaleform@@SAXPAVSysAllocBase@2@@Z
190x8962f0?Prepend@?$Matrix2x4@M@Render@Scaleform@@QAEAAV123@ABV123@@Z
200xa6be0?SetIdentity@?$Matrix2x4@M@Render@Scaleform@@QAEXXZ
210xa79e0?SetIdentity@?$Matrix3x4@M@Render@Scaleform@@QAEXXZ
220xa7a10?SetIdentity@?$Matrix4x4@M@Render@Scaleform@@QAEXXZ
230xa84e40?TootleCleanup@@YAXXZ
240xa83280?TootleClusterMesh@@YA?AW4TootleResult@@PBXPBIIIIIPAI22@Z
250xa85150?TootleFastOptimize@@YA?AW4TootleResult@@PBXPBIIIIIW4TootleFaceWinding@@PAI3M@Z
260xa837f0?TootleFastOptimizeVCacheAndClusterMesh@@YA?AW4TootleResult@@PBIIIIPAI11M@Z
270xa82840?TootleInit@@YA?AW4TootleResult@@XZ
280xa85600?TootleMeasureCacheEfficiency@@YA?AW4TootleResult@@PBIIIPAM@Z
290xa85860?TootleMeasureOverdraw@@YA?AW4TootleResult@@PBXPBIIIIPBMIW4TootleFaceWinding@@PAM4W4TootleOverdrawOptimizer@@@Z
300xa84e60?TootleOptimize@@YA?AW4TootleResult@@PBXPBIIIIIPBMIW4TootleFaceWinding@@PAI4W4TootleVCacheOptimizer@@W4TootleOverdrawOptimizer@@@Z
310xa83ad0?TootleOptimizeOverdraw@@YA?AW4TootleResult@@PBXPBIIIIPBMIW4TootleFaceWinding@@1PAI4W4TootleOverdrawOptimizer@@@Z
320xa82860?TootleOptimizeVCache@@YA?AW4TootleResult@@PBIIIIPAI1W4TootleVCacheOptimizer@@@Z
330xa86510?TootleOptimizeVertexMemory@@YA?AW4TootleResult@@PBXPBIIIIPAXPAI3@Z
340xa853c0?TootleVCacheClusters@@YA?AW4TootleResult@@PBIIII0PAI1W4TootleVCacheOptimizer@@@Z
350x1298208nFringePFO
module_nameShippingPC-SFGame.exe
flags0
timestamp2019-08-12 14:02:40
version0.0
ordinal_base1
nFunctions35
nNames35
Names(35)0x2239a70
Functions(35)0x22399e4
NameOrdinals(35)0x2239afc

VS_FIXEDFILEINFO

dwSignature0xfeef
FileVersion0.1.0.490
ProductVersion0.1.23.490
StrucVersion1
FileFlagsMask0
FileFlags0x40000
FileOS0x20000
FileType0
FileSubtype0

Signers (1)

issuer: /C=US/O=thawte, Inc./CN=thawte SHA256 Code Signing CA
serial: 6E1302C561B696BA73053F446676E58B

Certificates (2)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA
        Validity
            Not Before: Dec 10 00:00:00 2013 GMT
            Not After : Dec  9 23:59:59 2023 GMT
        Subject: C=US, O=thawte, Inc., CN=thawte SHA256 Code Signing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:9b:55:02:4c:17:05:e9:d0:66:c3:fc:28:ad:d3:
                    c0:fe:ef:e0:e9:7e:d4:1e:f6:aa:1b:91:46:fd:f5:
                    16:ed:98:07:53:fa:ba:87:1b:7d:9e:1f:01:27:ab:
                    b9:d2:67:ca:b7:10:25:53:f4:e3:be:9b:90:b8:ed:
                    23:5c:42:ef:64:25:58:e5:88:22:1a:be:f5:c7:ae:
                    f5:be:8a:b1:11:11:93:1a:22:a9:74:69:c1:74:b6:
                    68:87:a7:83:30:f9:64:f1:b1:e3:38:3e:f4:d6:c1:
                    fc:12:fe:73:57:17:35:57:8a:dd:50:8d:03:f8:66:
                    cd:ca:76:83:13:c8:d7:0e:71:1d:e4:63:c9:ba:17:
                    f8:d1:b9:e4:88:d2:2c:28:c8:21:20:0d:41:b7:0b:
                    e2:2f:c2:80:e6:88:7b:53:6c:c3:44:63:81:7f:68:
                    47:8c:2b:2a:cf:5b:f4:8c:49:61:ba:69:85:fd:6b:
                    00:78:05:26:69:13:30:80:38:4e:f1:5a:55:c9:c5:
                    50:d6:aa:38:89:47:43:5c:fe:4d:73:a5:49:c5:93:
                    69:fe:77:96:9a:af:f3:8c:0e:57:ba:33:d9:0e:c6:
                    42:d3:03:77:c4:bb:39:ad:91:f9:f3:f7:96:5c:3a:
                    64:a6:ed:27:57:c1:e8:40:f3:53:f2:be:29:34:fe:
                    5f:f9
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access: 
                OCSP - URI:http://t2.symcb.com

            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://t1.symcb.com/ThawtePCA.crl

            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, Code Signing
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name: 
                DirName:/CN=SymantecPKI-1-568
            X509v3 Subject Key Identifier: 
                57:86:9B:54:B8:BE:A6:29:8A:E4:F6:C2:E2:13:18:89:85:CD:DC:B7
            X509v3 Authority Key Identifier: 
                keyid:7B:5B:45:CF:AF:CE:CB:7A:FD:31:92:1A:6A:B6:F3:46:EB:57:48:50

    Signature Algorithm: sha256WithRSAEncryption
         24:3b:f5:d7:a0:36:13:c7:43:fe:f0:09:87:68:d1:98:31:6e:
         12:e4:3f:1e:1f:96:7b:6b:4c:1e:87:9e:8b:c5:6c:a3:b1:0c:
         7b:50:92:d5:81:9c:b1:8f:2c:29:b7:ee:f9:91:05:b9:8e:41:
         f1:2c:f6:d0:59:2d:98:e0:b9:ea:80:01:47:40:95:b8:3d:9d:
         03:bd:79:bb:35:b6:ad:9c:4c:27:f6:67:45:10:c9:c5:bc:87:
         4e:55:7b:d2:87:bb:dd:dc:30:ef:c6:d4:6c:cc:99:35:6d:1c:
         e0:60:d3:cd:68:8f:29:59:4b:89:96:08:46:c9:8e:fc:75:4f:
         c5:dc:09:cc:4e:27:8b:44:cd:07:bc:ac:04:e0:b5:33:a5:87:
         9f:f4:dd:73:0c:91:ea:12:81:6f:e3:75:f0:1e:b5:93:6c:44:
         17:d5:3e:97:c9:bd:07:2c:56:77:1f:85:dd:46:e8:bf:de:2c:
         81:94:a3:f7:e5:b7:a7:c1:37:9f:75:ca:55:77:4d:5e:36:29:
         ca:85:d8:45:41:72:57:75:c0:79:5b:fa:34:10:06:6d:64:20:
         42:b7:3a:c8:1f:1d:46:64:02:5f:c6:47:be:f0:c4:3a:28:54:
         da:f6:1e:4f:9a:a2:19:43:a4:6f:49:f8:fc:5e:42:20:28:84:
         8b:47:20:6e
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6e:13:02:c5:61:b6:96:ba:73:05:3f:44:66:76:e5:8b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, O=thawte, Inc., CN=thawte SHA256 Code Signing CA
        Validity
            Not Before: Oct 18 00:00:00 2018 GMT
            Not After : Nov 17 23:59:59 2019 GMT
        Subject: C=KR, ST=Seoul, L=Seocho-gu, O=DRAGONFLY GF CO., LTD., CN=DRAGONFLY GF CO., LTD.
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:96:8f:39:67:ba:0d:f1:07:54:46:fc:a5:1b:7d:
                    54:a8:d1:02:c9:73:fe:86:b8:f1:49:01:eb:18:54:
                    70:c0:aa:6e:90:e8:a5:7f:dd:5e:4a:2c:1d:bd:d8:
                    06:6b:80:84:7b:f3:4a:4b:9d:cf:81:8c:6d:33:0e:
                    39:bb:67:5a:59:ed:68:36:6e:d3:70:4a:22:11:a1:
                    62:71:32:79:8d:e0:28:9b:c3:be:24:99:f0:dc:5f:
                    79:1a:e3:8e:cc:10:00:77:47:70:1f:b7:86:dd:f3:
                    71:ab:23:bf:68:2e:7c:43:2b:3b:38:3d:e9:42:ea:
                    d7:4b:49:46:8f:d5:84:af:67:60:e1:d8:c7:9f:3c:
                    47:c9:7b:40:5e:91:dd:23:ee:43:a7:a3:c5:48:c4:
                    9d:52:10:00:11:58:cd:77:92:94:1a:ec:1f:38:6e:
                    88:48:2a:47:79:9c:b7:92:21:31:70:7a:02:95:c5:
                    92:d1:63:65:a3:3b:79:5f:fd:c6:f1:13:49:1e:c6:
                    3e:8a:cd:61:82:8e:3f:00:5c:9d:1a:b5:f1:af:22:
                    d3:e0:c5:88:3d:0e:7a:17:37:10:86:97:1f:d1:81:
                    26:31:82:31:8d:ed:e5:07:d5:b5:1d:e7:34:a5:ea:
                    d5:05:91:b0:88:ba:26:90:8b:b8:b7:33:b8:a0:52:
                    6a:a7
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Authority Key Identifier: 
                keyid:57:86:9B:54:B8:BE:A6:29:8A:E4:F6:C2:E2:13:18:89:85:CD:DC:B7

            X509v3 Subject Key Identifier: 
                43:A6:7D:09:8B:4C:CF:CF:E4:94:5B:7E:6B:96:11:D8:2F:58:44:B2
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://tl.symcb.com/tl.crl

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Extended Key Usage: 
                Code Signing
            X509v3 Certificate Policies: 
                Policy: 2.23.140.1.4.1
                  CPS: https://www.thawte.com/cps
                  User Notice:
                    Explicit Text: https://www.thawte.com/repository

            Authority Information Access: 
                OCSP - URI:http://tl.symcd.com
                CA Issuers - URI:http://tl.symcb.com/tl.crt

    Signature Algorithm: sha256WithRSAEncryption
         27:85:99:b2:40:57:30:38:25:9c:51:2c:80:7e:36:32:2c:a4:
         f6:59:6a:e4:38:23:d8:5d:92:6a:29:d1:ff:54:39:b6:8e:48:
         8c:55:bc:58:a5:c4:3b:77:9e:25:71:56:e1:c7:95:e4:fb:90:
         1e:c7:8c:c7:ad:05:5b:73:95:f0:1f:7c:33:34:67:60:8a:ae:
         c3:a8:ea:dd:bb:51:51:58:29:77:78:d6:84:51:ee:42:18:6e:
         86:e4:d0:f0:3c:6e:7e:f9:3b:7b:06:02:d3:11:5f:65:4b:87:
         82:21:e5:3b:4c:46:69:4c:6c:0d:06:77:ea:a7:7a:1f:e8:21:
         5f:02:de:4a:a6:e0:30:db:c5:0e:2d:e8:82:25:46:a0:ac:6a:
         2f:c8:69:61:db:60:f9:4f:27:6b:f0:72:04:1f:90:c2:ad:87:
         42:b2:19:09:1d:13:88:ac:73:0d:c9:3b:65:b8:ff:cb:e7:05:
         c1:fb:f1:4e:92:93:76:a5:cd:62:82:96:8b:1a:d6:f2:1d:50:
         2f:b8:d5:64:7f:90:68:ab:64:ef:8e:a6:16:83:15:21:57:3f:
         78:3d:76:33:99:e2:56:a8:f4:85:93:2a:f2:97:4b:6a:fb:b6:
         04:fd:f4:a8:45:53:b3:3b:90:40:ec:1c:65:cc:b4:70:8e:cf:
         1d:55:ba:8f
pkcs7-signedData
  • 1
    • SHA256: nil
    • 1.3.6.1.4.1.311.2.1.4
      • #0
        • 1.3.6.1.4.1.311.2.1.15
          • :
        • SHA256
          • f6 f1 02 97 88 fd 8a 2c  25 c4 a1 53 7a 78 9b e2  |.......,%..Szx..|
9f c4 49 53 f4 ed 22 de  9e 99 99 41 80 5e b1 7f  |..IS.."....A.^..|
    • Certificates
      • Certificate #0
        • 2
          • 71:A0:B7:36:95:DD:B1:AF:C2:3B:2B:9A:18:EE:54:CB
          • RSA-SHA256: nil
          • Issuer
            • C: US
            • O: thawte, Inc.
            • OU: Certification Services Division
            • OU: (c) 2006 thawte, Inc. - For authorized use only
            • CN: thawte Primary Root CA
          • 2013-12-10 00:00:00 UTC: 2023-12-09 23:59:59 UTC
          • Subject
            • C: US
            • O: thawte, Inc.
            • CN: thawte SHA256 Code Signing CA
          • #5
            • rsaEncryption: nil
            • 9B:55:02:4C:17:05:E9:D0:66:C3:FC:28:AD:D3:C0:FE:
              EF:E0:E9:7E:D4:1E:F6:AA:1B:91:46:FD:F5:16:ED:98:
              07:53:FA:BA:87:1B:7D:9E:1F:01:27:AB:B9:D2:67:CA:
              B7:10:25:53:F4:E3:BE:9B:90:B8:ED:23:5C:42:EF:64:
              25:58:E5:88:22:1A:BE:F5:C7:AE:F5:BE:8A:B1:11:11:
              93:1A:22:A9:74:69:C1:74:B6:68:87:A7:83:30:F9:64:
              F1:B1:E3:38:3E:F4:D6:C1:FC:12:FE:73:57:17:35:57:
              8A:DD:50:8D:03:F8:66:CD:CA:76:83:13:C8:D7:0E:71:
              1D:E4:63:C9:BA:17:F8:D1:B9:E4:88:D2:2C:28:C8:21:
              20:0D:41:B7:0B:E2:2F:C2:80:E6:88:7B:53:6C:C3:44:
              63:81:7F:68:47:8C:2B:2A:CF:5B:F4:8C:49:61:BA:69:
              85:FD:6B:00:78:05:26:69:13:30:80:38:4E:F1:5A:55:
              C9:C5:50:D6:AA:38:89:47:43:5C:FE:4D:73:A5:49:C5:
              93:69:FE:77:96:9A:AF:F3:8C:0E:57:BA:33:D9:0E:C6:
              42:D3:03:77:C4:BB:39:AD:91:F9:F3:F7:96:5C:3A:64:
              A6:ED:27:57:C1:E8:40:F3:53:F2:BE:29:34:FE:5F:F9              : 0x010001
          • X509v3 extensions
            • authorityInfoAccess
              • OCSP: http://t2.symcb.com
            • basicConstraints
              • true
              • true: 0
            • crlDistributionPoints: http://t1.symcb.com/ThawtePCA.crl
            • extendedKeyUsage
              • clientAuth: codeSigning
            • keyUsage: true, 6
            • subjectAltName
              • CN: SymantecPKI-1-568
            • subjectKeyIdentifier: 
              57 86 9b 54 b8 be a6 29  8a e4 f6 c2 e2 13 18 89  |W..T...)........|
85 cd dc b7                                       |....            |
            • authorityKeyIdentifier: 
              7b 5b 45 cf af ce cb 7a  fd 31 92 1a 6a b6 f3 46  |{[E....z.1..j..F|
eb 57 48 50                                       |.WHP            |
        • RSA-SHA256: 
          24 3b f5 d7 a0 36 13 c7  43 fe f0 09 87 68 d1 98  |$;...6..C....h..|
31 6e 12 e4 3f 1e 1f 96  7b 6b 4c 1e 87 9e 8b c5  |1n..?...{kL.....|
6c a3 b1 0c 7b 50 92 d5  81 9c b1 8f 2c 29 b7 ee  |l...{P......,)..|
f9 91 05 b9 8e 41 f1 2c  f6 d0 59 2d 98 e0 b9 ea  |.....A.,..Y-....|
80 01 47 40 95 b8 3d 9d  03 bd 79 bb 35 b6 ad 9c  |..G@..=...y.5...|
4c 27 f6 67 45 10 c9 c5  bc 87 4e 55 7b d2 87 bb  |L'.gE.....NU{...|
dd dc 30 ef c6 d4 6c cc  99 35 6d 1c e0 60 d3 cd  |..0...l..5m..`..|
68 8f 29 59 4b 89 96 08  46 c9 8e fc 75 4f c5 dc  |h.)YK...F...uO..|
09 cc 4e 27 8b 44 cd 07  bc ac 04 e0 b5 33 a5 87  |..N'.D.......3..|
9f f4 dd 73 0c 91 ea 12  81 6f e3 75 f0 1e b5 93  |...s.....o.u....|
6c 44 17 d5 3e 97 c9 bd  07 2c 56 77 1f 85 dd 46  |lD..>....,Vw...F|
e8 bf de 2c 81 94 a3 f7  e5 b7 a7 c1 37 9f 75 ca  |...,........7.u.|
55 77 4d 5e 36 29 ca 85  d8 45 41 72 57 75 c0 79  |UwM^6)...EArWu.y|
5b fa 34 10 06 6d 64 20  42 b7 3a c8 1f 1d 46 64  |[.4..md B.:...Fd|
02 5f c6 47 be f0 c4 3a  28 54 da f6 1e 4f 9a a2  |._.G...:(T...O..|
19 43 a4 6f 49 f8 fc 5e  42 20 28 84 8b 47 20 6e  |.C.oI..^B (..G n|
      • Certificate #1
        • 2
          • 6E:13:02:C5:61:B6:96:BA:73:05:3F:44:66:76:E5:8B
          • RSA-SHA256: nil
          • Issuer
            • C: US
            • O: thawte, Inc.
            • CN: thawte SHA256 Code Signing CA
          • 2018-10-18 00:00:00 UTC: 2019-11-17 23:59:59 UTC
          • Subject
            • C: KR
            • ST: Seoul
            • L: Seocho-gu
            • O: DRAGONFLY GF CO., LTD.
            • CN: DRAGONFLY GF CO., LTD.
          • #5
            • rsaEncryption: nil
            • 96:8F:39:67:BA:0D:F1:07:54:46:FC:A5:1B:7D:54:A8:
              D1:02:C9:73:FE:86:B8:F1:49:01:EB:18:54:70:C0:AA:
              6E:90:E8:A5:7F:DD:5E:4A:2C:1D:BD:D8:06:6B:80:84:
              7B:F3:4A:4B:9D:CF:81:8C:6D:33:0E:39:BB:67:5A:59:
              ED:68:36:6E:D3:70:4A:22:11:A1:62:71:32:79:8D:E0:
              28:9B:C3:BE:24:99:F0:DC:5F:79:1A:E3:8E:CC:10:00:
              77:47:70:1F:B7:86:DD:F3:71:AB:23:BF:68:2E:7C:43:
              2B:3B:38:3D:E9:42:EA:D7:4B:49:46:8F:D5:84:AF:67:
              60:E1:D8:C7:9F:3C:47:C9:7B:40:5E:91:DD:23:EE:43:
              A7:A3:C5:48:C4:9D:52:10:00:11:58:CD:77:92:94:1A:
              EC:1F:38:6E:88:48:2A:47:79:9C:B7:92:21:31:70:7A:
              02:95:C5:92:D1:63:65:A3:3B:79:5F:FD:C6:F1:13:49:
              1E:C6:3E:8A:CD:61:82:8E:3F:00:5C:9D:1A:B5:F1:AF:
              22:D3:E0:C5:88:3D:0E:7A:17:37:10:86:97:1F:D1:81:
              26:31:82:31:8D:ED:E5:07:D5:B5:1D:E7:34:A5:EA:D5:
              05:91:B0:88:BA:26:90:8B:B8:B7:33:B8:A0:52:6A:A7              : 0x010001
          • X509v3 extensions
            • basicConstraints
              • nil
            • authorityKeyIdentifier: 
              57 86 9b 54 b8 be a6 29  8a e4 f6 c2 e2 13 18 89  |W..T...)........|
85 cd dc b7                                       |....            |
            • subjectKeyIdentifier: 
              43 a6 7d 09 8b 4c cf cf  e4 94 5b 7e 6b 96 11 d8  |C.}..L....[~k...|
2f 58 44 b2                                       |/XD.            |
            • crlDistributionPoints: http://tl.symcb.com/tl.crl
            • keyUsage: true, 0x80
            • extendedKeyUsage: codeSigning
            • certificatePolicies
              • 2.23.140.1.4.1
                • #0
                  • id-qt-cps: https://www.thawte.com/cps
                  • id-qt-unotice: https://www.thawte.com/repository
            • authorityInfoAccess
              • #0
                • OCSP: http://tl.symcd.com
                • caIssuers: http://tl.symcb.com/tl.crt
        • RSA-SHA256: 
          27 85 99 b2 40 57 30 38  25 9c 51 2c 80 7e 36 32  |'...@W08%.Q,.~62|
2c a4 f6 59 6a e4 38 23  d8 5d 92 6a 29 d1 ff 54  |,..Yj.8#.].j)..T|
39 b6 8e 48 8c 55 bc 58  a5 c4 3b 77 9e 25 71 56  |9..H.U.X..;w.%qV|
e1 c7 95 e4 fb 90 1e c7  8c c7 ad 05 5b 73 95 f0  |............[s..|
1f 7c 33 34 67 60 8a ae  c3 a8 ea dd bb 51 51 58  |.|34g`.......QQX|
29 77 78 d6 84 51 ee 42  18 6e 86 e4 d0 f0 3c 6e  |)wx..Q.B.n....
    • Signer
      • 1
      • unnamed
        • #0
          • C: US
          • O: thawte, Inc.
          • CN: thawte SHA256 Code Signing CA
        • 6E:13:02:C5:61:B6:96:BA:73:05:3F:44:66:76:E5:8B
      • SHA256: nil
      • #3
        • 1.3.6.1.4.1.311.2.1.12
          • nil
        • contentType: 1.3.6.1.4.1.311.2.1.4
        • 1.3.6.1.4.1.311.2.1.11: msCodeInd
        • messageDigest: 
          1e d8 a4 08 31 55 dd f1  13 cb 3d b9 78 c0 10 f9  |....1U....=.x...|
c5 b2 f5 f5 41 57 34 e5  83 03 a9 45 54 e8 aa 72  |....AW4....ET..r|
      • rsaEncryption: 
        4d ec 07 0a 42 15 7c 18  30 ff be d7 ea c8 83 e6  |M...B.|.0.......|
f3 6a 54 17 09 b2 05 8d  94 ff e1 db b4 d6 02 39  |.jT............9|
c8 d3 c5 7e 29 01 f2 f9  00 e9 c2 0d 11 0f cb 67  |...~)..........g|
ea 22 45 9f df e9 6e 79  39 89 1a 3a 44 f6 72 93  |."E...ny9..:D.r.|
5b a8 d8 b1 f1 23 2b d6  be f4 54 13 f1 b5 7c ec  |[....#+...T...|.|
64 15 3b da a9 9f c2 c0  94 38 fa 44 f2 11 d0 74  |d.;......8.D...t|
cb c1 b3 95 ef 90 47 33  3b 52 a0 a0 f8 56 04 80  |......G3;R...V..|
d4 8c c9 e5 48 e7 c8 1b  13 42 3f 94 89 15 58 ed  |....H....B?...X.|
0a 56 1e aa 50 02 36 73  71 81 33 13 36 5f fa 84  |.V..P.6sq.3.6_..|
40 a4 af 08 5a 42 1f c7  a9 83 37 a3 7d d6 18 ce  |@...ZB....7.}...|
ec f1 05 52 1d 4c e2 40  59 5d 03 53 07 7c cb 88  |...R.L.@Y].S.|..|
11 12 52 1d c2 e6 93 08  3a 72 16 ae 6b ed ff 6f  |..R.....:r..k..o|
35 12 5c aa f5 ba c2 e0  87 bb e1 6c 7b 31 65 59  |5.\........l{1eY|
6d 16 40 ff ca 5a 3d 8b  4f aa 11 7e 21 c1 d5 e0  |m.@..Z=.O..~!...|
f2 02 89 94 d8 c8 d3 dc  03 13 25 9e a2 d8 74 f2  |..........%...t.|
0b 9d 94 cb 91 a2 f5 ff  07 91 0e bf a1 c1 d9 c1  |................|
      • 1.3.6.1.4.1.311.3.3.1
        • pkcs7-signedData
          • 3
            • SHA256
            • id-smime-ct-TSTInfo
              • 1
                • 2.16.840.1.113733.1.7.23.3
                • SHA1
                  • 40 f4 e3 f4 a9 28 c8 f5  97 59 17 1f e2 06 22 31  |@....(...Y...."1|
4c 17 c8 f5                                       |L...            |
                • 63:E9:E7:BE:94:19:17:F5:94:FE:50:EA:4A:1B:5D:CC:
                  7F:A2:16:53
                • 2019-08-12 14:59:36 UTC
                • 0x1E
                • #5
                  • C: US
                  • O: Symantec Corporation
                  • OU: Symantec Trust Network
                  • CN: Symantec SHA256 TimeStamping Signer - G3
            • Certificates
              • Certificate #0
                • 2
                  • 7B:05:B1:D4:49:68:51:44:F7:C9:89:D2:9C:19:9D:12
                  • RSA-SHA256: nil
                  • Issuer
                    • C: US
                    • O: VeriSign, Inc.
                    • OU: VeriSign Trust Network
                    • OU: (c) 2008 VeriSign, Inc. - For authorized use only
                    • CN: VeriSign Universal Root Certification Authority
                  • 2016-01-12 00:00:00 UTC: 2031-01-11 23:59:59 UTC
                  • Subject
                    • C: US
                    • O: Symantec Corporation
                    • OU: Symantec Trust Network
                    • CN: Symantec SHA256 TimeStamping CA
                  • #5
                    • rsaEncryption: nil
                    • BB:59:9D:59:55:4F:9D:8C:72:5D:1A:81:A2:EB:55:F3:
                      B0:01:AD:3C:71:AC:32:8F:05:6B:86:9A:27:00:32:97:
                      6A:4D:C9:64:14:4B:29:BB:C2:D9:29:B9:2E:EC:63:B3:
                      E1:CF:3F:0B:56:90:F8:62:1B:7E:EB:A6:07:E2:DE:7F:
                      5E:6D:40:38:D4:91:06:E7:41:7C:79:1C:CB:CB:AD:1B:
                      BF:D8:95:91:F3:F0:EE:6C:F8:AD:96:39:2E:7F:C1:27:
                      B8:78:39:C5:84:A5:ED:ED:AF:87:8E:CE:8D:C7:6D:EA:
                      D2:98:B5:3A:1F:1E:39:9D:C3:F4:9A:A8:F4:84:E1:C4:
                      D1:7C:71:C6:06:29:B4:3F:E4:83:0D:26:C3:7B:08:3E:
                      4D:F9:0A:B7:33:49:FF:CA:3B:D4:F5:B2:9B:4B:E1:88:
                      99:1A:F5:C0:E9:33:14:D6:DF:C7:80:DB:91:EE:FE:BC:
                      92:57:72:77:F4:CD:A8:CC:FE:09:F5:93:37:BE:95:88:
                      6A:C5:DC:F4:B1:4B:D4:CE:E8:09:91:5F:B5:84:79:35:
                      8A:78:AC:19:32:8F:23:C1:32:41:1B:59:0E:A9:3E:B1:
                      CC:F9:D6:2B:EF:B7:D8:E4:D5:1D:6D:11:3A:92:F6:93:
                      C9:9C:E3:48:EE:BB:53:0E:D4:36:97:86:78:C5:A1:37                      : 0x010001
                  • #6
                    • keyUsage: true, 6
                    • basicConstraints
                      • true
                      • true: 0
                    • certificatePolicies
                      • 2.16.840.1.113733.1.7.23.3
                        • #0
                          • id-qt-cps: https://d.symcb.com/cps
                          • id-qt-unotice: https://d.symcb.com/rpa
                    • authorityInfoAccess
                      • OCSP: http://s.symcd.com
                    • crlDistributionPoints: http://s.symcb.com/universal-root.crl
                    • extendedKeyUsage: timeStamping
                    • subjectAltName
                      • CN: TimeStamp-2048-3
                    • subjectKeyIdentifier: 
                      af 63 d6 ca a3 4e 85 72  e0 a7 bc 41 f3 29 a2 38  |.c...N.r...A.).8|
7f 80 75 62                                       |..ub            |
                    • authorityKeyIdentifier: 
                      b6 77 fa 69 48 47 9f 53  12 d5 c2 ea 07 32 76 07  |.w.iHG.S.....2v.|
d1 97 07 19                                       |....            |
                • RSA-SHA256: 
                  75 ea b0 2d d5 34 19 5c  32 45 fe 0e e1 d4 4f a6  |u..-.4.\2E....O.|
78 c1 6f d7 ea dd dc 4f  f3 a1 c8 81 88 f7 a7 8f  |x.o....O........|
15 e6 40 29 ad e6 5d f4  a2 d9 56 64 84 71 30 2a  |..@)..]...Vd.q0*|
dd 1e 61 17 66 20 56 06  98 19 8d 5d 71 f2 f8 97  |..a.f V....]q...|
bc 09 fd 1c 91 47 c9 e2  e8 8d 03 fb cc 90 2f d6  |.....G......../.|
0a 6c 4e 33 ec d6 b4 93  c8 4c 90 63 48 39 40 21  |.lN3.....L.cH9@!|
c4 dd d6 6e 89 98 3c b5  98 97 e8 a9 06 b7 09 c9  |...n..<.........|
8f 53 57 41 90 2f e1 1e  4d 4e dc ca 10 78 6c 42  |.SWA./..MN...xlB|
6e f0 b6 c5 f8 61 5c 52  f5 4e f6 6b 8d f7 4a 7a  |n....a\R.N.k..Jz|
be f3 cd fd 03 d7 d9 f6  03 a8 0f e3 53 f7 0a 75  |............S..u|
ec c6 75 2e aa 66 85 04  99 b7 f8 06 57 e1 c6 0e  |..u..f......W...|
f6 e8 af da ec 9b 18 1f  aa b9 e3 3a 00 bf ce 8a  |...........:....|
94 cb 01 db 9e c7 38 bb  0f 52 ab d1 e3 94 03 60  |......8..R.....`|
0a 4d a0 fe 27 6d 14 32  fc 3f 97 40 e1 bf 99 89  |.M..'m.2.?.@....|
db e4 39 14 bd da e4 d3  c3 ea 2b 5a b3 95 58 55  |..9.......+Z..XU|
04 7d c7 9a ec 23 03 8d  85 2a d2 ff ae a9 61 81  |.}...#...*....a.|
              • Certificate #1
                • 2
                  • 7B:D4:E5:AF:BA:CC:07:3F:A1:01:23:04:22:41:4D:12
                  • RSA-SHA256: nil
                  • Issuer
                    • C: US
                    • O: Symantec Corporation
                    • OU: Symantec Trust Network
                    • CN: Symantec SHA256 TimeStamping CA
                  • 2017-12-23 00:00:00 UTC: 2029-03-22 23:59:59 UTC
                  • Subject
                    • C: US
                    • O: Symantec Corporation
                    • OU: Symantec Trust Network
                    • CN: Symantec SHA256 TimeStamping Signer - G3
                  • #5
                    • rsaEncryption: nil
                    • AF:0E:8A:AA:F8:DC:BF:69:7B:54:17:71:47:09:BD:8D:
                      3C:81:F8:74:15:77:67:90:9C:FD:DE:4E:02:9E:4B:76:
                      F6:E5:36:3E:65:D5:24:20:6D:30:F9:DD:1D:83:E9:3F:
                      27:4A:33:4E:6D:16:8A:E4:8D:40:8D:22:AA:BE:A7:0B:
                      1B:D2:07:B6:3C:B5:1A:24:28:F8:1B:72:51:3D:C8:09:
                      88:26:08:3A:F9:FA:43:23:75:47:70:0C:B3:5F:5B:8F:
                      08:1D:72:48:57:65:4D:AF:02:3C:40:F7:F4:DD:32:38:
                      93:3F:E5:2C:A6:F3:59:23:CB:80:DE:13:4D:F9:10:C9:
                      AA:0A:18:6C:55:61:57:D1:F1:02:2C:C4:B5:AB:F2:6C:
                      23:D2:9F:0D:0F:19:6C:AD:85:62:69:FD:4E:85:C1:8A:
                      52:31:AB:5B:D8:C9:74:52:E3:57:6C:22:BF:55:7F:6F:
                      CA:06:AB:3F:4A:B7:22:76:65:EC:EC:36:F2:96:95:81:
                      26:2C:FD:BB:98:AA:01:38:D3:AF:25:40:9B:09:53:F0:
                      29:57:85:58:5E:EA:85:48:41:21:87:E5:DE:B4:D3:26:
                      B2:7B:40:53:58:79:8E:52:31:06:4D:94:03:45:C4:CE:
                      3C:03:EC:B7:00:F2:3A:22:C5:B4:6F:E5:EF:B0:8A:9B                      : 0x010001
                  • X509v3 extensions
                    • basicConstraints
                      • true
                      • nil
                    • certificatePolicies
                      • 2.16.840.1.113733.1.7.23.3
                        • #0
                          • id-qt-cps: https://d.symcb.com/cps
                          • id-qt-unotice: https://d.symcb.com/rpa
                    • crlDistributionPoints: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl
                    • extendedKeyUsage: true, timeStamping
                    • keyUsage: true, 0x80
                    • authorityInfoAccess
                      • #0
                        • OCSP: http://ts-ocsp.ws.symantec.com
                        • caIssuers: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer
                    • subjectAltName
                      • CN: TimeStamp-2048-6
                    • subjectKeyIdentifier: 
                      a5 13 01 a9 9f 85 cc 1b  6e 16 1e 5f 3b 31 aa 79  |........n.._;1.y|
36 00 7b 1d                                       |6.{.            |
                    • authorityKeyIdentifier: 
                      af 63 d6 ca a3 4e 85 72  e0 a7 bc 41 f3 29 a2 38  |.c...N.r...A.).8|
7f 80 75 62                                       |..ub            |
                • RSA-SHA256: 
                  46 9e af f0 b8 a2 5f a2  99 48 cf a8 27 4b 21 cd  |F....._..H..'K!.|
b2 b9 a6 72 70 63 2f e3  55 29 7b 39 46 4e e7 7e  |...rpc/.U){9FN.~|
65 06 58 8b bc 57 8a 92  0d 08 d8 10 ba 36 24 fa  |e.X..W.......6$.|
0a 7b fb 3b d3 62 bf 4a  94 15 e6 82 db 8a 54 6d  |.{.;.b.J......Tm|
ff 28 fe 67 cf 71 3f e6  33 09 d9 a2 59 10 f4 1e  |.(.g.q?.3...Y...|
4a fe 65 cc de d4 6b e3  52 29 75 00 4a 2b a5 cc  |J.e...k.R)u.J+..|
cb 9b e8 a9 4d f7 b4 17  59 92 41 c3 b7 3f 86 e6  |....M...Y.A..?..|
f6 c0 7f 44 3c 46 5c 17  5a e3 a4 3b d5 69 26 d5  |...D.z.".t..G....|
91 25 b2 1b 96 e9 85 08  e8 dd ea 74 60 6e 60 a5  |.%.........t`n`.|
56 7a 0d c8 44 58 dc e6  f9 48 14 9e e5 bf de 00  |Vz..DX...H......|
bd 77 b1 98 14 72 14 24  df c7 11 2c 1f 00 3f c3  |.w...r.$...,..?.|
4b 14 c6 67 1c cc 1e 06  a3 90 5f 5c 54 8b 3e e3  |K..g......_\T.>.|
33 5b 82 0f c5 b7 86 02  4e 71 9f e9 66 45 3f 76  |3[......Nq..fE?v|
            • 1
              • unnamed
                • #0
                  • C: US
                  • O: Symantec Corporation
                  • OU: Symantec Trust Network
                  • CN: Symantec SHA256 TimeStamping CA
                • 7B:D4:E5:AF:BA:CC:07:3F:A1:01:23:04:22:41:4D:12
              • SHA256
              • #2
                • contentType: id-smime-ct-TSTInfo
                • signingTime: 2019-08-12 14:59:36 UTC
                • messageDigest: 
                  66 a8 28 07 bf e6 6c 0c  9a 8a 4e 0b a5 06 5f 91  |f.(...l...N..._.|
f4 70 69 52 ea 28 8c f3  bf c0 d7 6d 97 7b fb 74  |.piR.(.....m.{.t|
                • id-smime-aa-signingCertificateV2: 
                  c4 74 ce 76 00 7d 02 39  4e 0d a5 e4 de 7c 14 c6  |.t.v.}.9N....|..|
80 f9 e2 82 01 3c fe f6  53 ef 5d b7 1f df 61 f8  |.....<..S.]...a.|
              • rsaEncryption
              • 4c cd 28 ee 31 06 1d 0f  2f 5d b5 8c 24 e3 00 ff  |L.(.1.../]..$...|
57 9d 8f e2 40 29 88 ab  20 b7 63 4f b7 31 54 b4  |W...@).. .cO.1T.|
69 ed 09 8b dd 56 04 a7  d3 75 3b e9 14 ce 2b 0c  |i....V...u;...+.|
79 a7 5b 63 71 7e 94 ed  32 21 e9 c5 a0 84 83 7b  |y.[cq~..2!.....{|
5c a2 fc 41 bc 44 db 90  a1 41 88 71 f8 b9 19 e0  |\..A.D...A.q....|
e8 7e 36 6f 66 c1 52 ed  a0 b2 20 bf a3 37 8d a7  |.~6of.R... ..7..|
f2 a8 36 5d 76 d9 51 33  db 53 33 bd fc 4a 06 39  |..6]v.Q3.S3..J.9|
84 98 51 1b 61 30 f7 cf  f6 6e fe 08 27 5c 0b f9  |..Q.a0...n..'\..|
53 4f 6e f0 a4 40 da 67  dd bc 44 14 f6 b4 23 e8  |SOn..@.g..D...#.|
8a 27 c8 11 21 fc b6 bb  51 ec 66 a7 1a 38 63 50  |.'..!...Q.f..8cP|
ed ab 28 96 f3 99 05 40  ee 6e 83 bf c6 08 fc 93  |..(....@.n......|
7b 1e 0f 35 22 4b e7 58  a0 aa 18 f2 aa 8d 91 6b  |{..5"K.X.......k|
91 fa 2a 56 fc 92 ce cd  99 f8 cc 8e fb 11 4c 2d  |..*V..........L-|
04 1c fd 68 d7 08 f4 2d  a2 10 4d af 11 19 24 7a  |...h...-..M...$z|
89 3c a8 7d 29 28 0e 8d  6d 4b 4a d3 df d1 18 44  |.<.})(..mKJ....D|
e2 54 be d4 fc e1 c9 57  f4 c5 1a 64 35 02 32 a6  |.T.....W...d5.2.|
offsetsizetypecomment
15c115HTM#
843f2c19165PNG(256 x 256)#
84d56953463PNG(256 x 256)#
85a6409704BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







[?] can't find file_offset of VA 0x17f6a28
[?] can't find file_offset of VA 0x17f6b78
[?] can't find file_offset of VA 0x17f6cc8
[?] can't find file_offset of VA 0x17f6e18
[?] can't find file_offset of VA 0x17f6f68
[?] ignoring invalid PEdump::BITMAPINFOHEADER
[?] can't find file_offset of VA 0x17f70b8
[?] can't find file_offset of VA 0x17f70a0
[?] can't find file_offset of VA 0x17f6cb0
[?] can't find file_offset of VA 0x17f6e00
[?] can't find file_offset of VA 0x17f6b60
[?] can't find file_offset of VA 0x17f6f50
[?] invalid VS_VERSIONINFO child type "t\x00r\x00i\x00"
[?] can't find file_offset of VA 0x129287c