filenameFast Free Converter setup.exe
size1339048 (0x146ea8)
md55ed65ce340ad0453f67d55b4dc613cab
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
131307293
1473072917
10165
1704021912
154402191
157402191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x4f47e359
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion10.0
SizeOfCode0x7000
SizeOfInitializedData0x4d800
SizeOfUninitializedData0x2200
AddressOfEntryPoint0x36da
BaseOfCode0x1000
BaseOfData0x8000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion6.0
SubsystemVersion5.0
Reserved10
SizeOfImage0xfc000
SizeOfHeaders0x400
CheckSum0x153dbe
Subsystem2
DllCharacteristics0x8540
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

Nullsoft install system v2.x

Sections

namevavsizeraw sizeflags
.text0x10000x6eac0x7000R-X CODE
.rdata0x80000x1fee0x2000R-- IDATA
.data0xa0000x4961c0x200RW- IDATA
.ndata0x540000xa10000RW- UDATA
.rsrc0xf50000x57a80x5800R-- IDATA
.reloc0xfb0000xdd40xe00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x913c0xb4
RESOURCE0xf50000x57a8
EXCEPTION00
SECURITY0x1460300xe78
BASERELOC0x590000x958
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x80000x2b4
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#196400
ICON#242640
ICON#322160
ICON#413840
ICON#511280
ICON#67440
ICON#72960
DIALOG#1055140
DIALOG#1062480
DIALOG#1112380
GROUP_ICON#1031040
MANIFEST#19650
module_namehintordfunction_name
KERNEL32.dll1052SearchPathA
KERNEL32.dll608GetShortPathNameA
KERNEL32.dll504GetFullPathNameA
KERNEL32.dll862MoveFileA
KERNEL32.dll1100SetCurrentDirectoryA
KERNEL32.dll485GetFileAttributesA
KERNEL32.dll514GetLastError
KERNEL32.dll124CreateDirectoryA
KERNEL32.dll1118SetFileAttributesA
KERNEL32.dll1202Sleep
KERNEL32.dll659GetTickCount
KERNEL32.dll496GetFileSize
KERNEL32.dll531GetModuleFileNameA
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll112CopyFileA
KERNEL32.dll281ExitProcess
KERNEL32.dll686GetWindowsDirectoryA
KERNEL32.dll644GetTempPathA
KERNEL32.dll390GetCommandLineA
KERNEL32.dll1112SetErrorMode
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll96CompareFileTime
KERNEL32.dll1354lstrcpynA
KERNEL32.dll1358lstrlenW
KERNEL32.dll1355lstrcpynW
KERNEL32.dll460GetDiskFreeSpaceA
KERNEL32.dll709GlobalUnlock
KERNEL32.dll702GlobalLock
KERNEL32.dll181CreateThread
KERNEL32.dll828LoadLibraryA
KERNEL32.dll164CreateProcessA
KERNEL32.dll136CreateFileA
KERNEL32.dll642GetTempFileNameA
KERNEL32.dll1342lstrcatA
KERNEL32.dll581GetProcAddress
KERNEL32.dll896OpenProcess
KERNEL32.dll1351lstrcpyA
KERNEL32.dll675GetVersionExA
KERNEL32.dll623GetSystemDirectoryA
KERNEL32.dll674GetVersion
KERNEL32.dll1024RemoveDirectoryA
KERNEL32.dll1130SetFileTime
KERNEL32.dll82CloseHandle
KERNEL32.dll1348lstrcmpiA
KERNEL32.dll1345lstrcmpA
KERNEL32.dll284ExpandEnvironmentStringsA
KERNEL32.dll691GlobalAlloc
KERNEL32.dll1273WaitForSingleObject
KERNEL32.dll479GetExitCodeProcess
KERNEL32.dll698GlobalFree
KERNEL32.dll533GetModuleHandleA
KERNEL32.dll829LoadLibraryExA
KERNEL32.dll354FreeLibrary
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll1322WritePrivateProfileStringA
KERNEL32.dll577GetPrivateProfileStringA
KERNEL32.dll1317WriteFile
KERNEL32.dll870MulDiv
KERNEL32.dll960ReadFile
KERNEL32.dll1126SetFilePointer
KERNEL32.dll302FindClose
KERNEL32.dll323FindNextFileA
KERNEL32.dll306FindFirstFileA
KERNEL32.dll211DeleteFileA
KERNEL32.dll1357lstrlenA
USER32.dll263GetAsyncKeyState
USER32.dll462IsDlgButtonChecked
USER32.dll621ScreenToClient
USER32.dll347GetMessagePos
USER32.dll29CallWindowProcA
USER32.dll480IsWindowVisible
USER32.dll486LoadBitmapA
USER32.dll73CloseClipboard
USER32.dll646SetClipboardData
USER32.dll213EmptyClipboard
USER32.dll550OpenClipboard
USER32.dll758TrackPopupMenu
USER32.dll412GetWindowRect
USER32.dll9AppendMenuA
USER32.dll107CreatePopupMenu
USER32.dll382GetSystemMetrics
USER32.dll218EndDialog
USER32.dll214EnableMenuItem
USER32.dll381GetSystemMenu
USER32.dll643SetClassLongA
USER32.dll476IsWindowEnabled
USER32.dll710SetWindowPos
USER32.dll62CheckDlgButton
USER32.dll267GetClassInfoA
USER32.dll109CreateWindowExA
USER32.dll747SystemParametersInfoA
USER32.dll587RegisterClassA
USER32.dll655SetDlgItemTextA
USER32.dll297GetDlgItemTextA
USER32.dll529MessageBoxIndirectA
USER32.dll57CharUpperA
USER32.dll50CharPrevA
USER32.dll820wvsprintfA
USER32.dll174DispatchMessageA
USER32.dll562PeekMessageA
USER32.dll166DestroyWindow
USER32.dll98CreateDialogParamA
USER32.dll699SetTimer
USER32.dll714SetWindowTextA
USER32.dll567PostQuitMessage
USER32.dll659SetForegroundWindow
USER32.dll735ShowWindow
USER32.dll634SendMessageTimeoutA
USER32.dll248FindWindowExA
USER32.dll488LoadCursorA
USER32.dll648SetCursor
USER32.dll405GetWindowLongA
USER32.dll379GetSysColor
USER32.dll47CharNextA
USER32.dll171DialogBoxParamA
USER32.dll245ExitWindowsEx
USER32.dll475IsWindow
USER32.dll295GetDlgItem
USER32.dll707SetWindowLongA
USER32.dll494LoadImageA
USER32.dll289GetDC
USER32.dll216EnableWindow
USER32.dll446InvalidateRect
USER32.dll631SendMessageA
USER32.dll155DefWindowProcA
USER32.dll14BeginPaint
USER32.dll276GetClientRect
USER32.dll246FillRect
USER32.dll205DrawTextA
USER32.dll220EndPaint
USER32.dll818wsprintfA
GDI32.dll638SetBkColor
GDI32.dll459GetDeviceCaps
GDI32.dll230DeleteObject
GDI32.dll44CreateBrushIndirect
GDI32.dll61CreateFontIndirectA
GDI32.dll639SetBkMode
GDI32.dll678SetTextColor
GDI32.dll631SelectObject
SHELL32.dll122SHBrowseForFolderA
SHELL32.dll213SHGetPathFromIDListA
SHELL32.dll188SHGetFileInfoA
SHELL32.dll286ShellExecuteA
SHELL32.dll171SHFileOperationA
SHELL32.dll223SHGetSpecialFolderLocation
ADVAPI32.dll589RegEnumKeyA
ADVAPI32.dll608RegOpenKeyExA
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll573RegDeleteKeyA
ADVAPI32.dll583RegDeleteValueA
ADVAPI32.dll568RegCreateKeyExA
ADVAPI32.dll637RegSetValueExA
ADVAPI32.dll621RegQueryValueExA
ADVAPI32.dll593RegEnumValueA
COMCTL32.dll79ImageList_AddMasked
COMCTL32.dll84ImageList_Destroy
COMCTL32.dll17
COMCTL32.dll83ImageList_Create
ole32.dll104CoTaskMemFree
ole32.dll306OleInitialize
ole32.dll329OleUninitialize
ole32.dll16CoCreateInstance
VERSION.dll3GetFileVersionInfoSizeA
VERSION.dllGetFileVersionInfoA
VERSION.dll13VerQueryValueA

Signers (1)

issuer: /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Code Signing 2010 CA
serial: 570F3954FD8AC2184E29E83063A4482B

Certificates (2)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            57:0f:39:54:fd:8a:c2:18:4e:29:e8:30:63:a4:48:2b
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
        Validity
            Not Before: Sep 30 00:00:00 2013 GMT
            Not After : Sep 30 23:59:59 2015 GMT
        Subject: C=HK, ST=Hong Kong, L=Hong Kong, O=Denco Limited, OU=Digital ID Class 3 - Microsoft Software Validation v2, CN=Denco Limited
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:f0:fc:16:7d:0f:9d:53:59:ac:7e:1c:cf:e8:e4:
                    c5:bd:ae:7a:d0:72:57:08:b6:e4:f6:b6:c8:f6:c4:
                    61:99:ca:07:e1:71:ca:fe:23:aa:e0:ac:55:f6:08:
                    f4:19:07:67:8b:7f:e0:a0:fa:20:0c:64:12:b5:56:
                    13:df:dd:ff:23:cb:2f:f3:68:d9:84:af:d5:7a:64:
                    12:58:75:4e:0f:1b:47:95:fd:b2:31:58:49:58:c0:
                    09:5c:fd:28:65:2b:85:7c:58:ee:8d:ca:ec:ec:98:
                    4f:c5:27:f5:14:d2:a6:7a:53:30:22:5a:cc:4d:c3:
                    23:65:d1:6f:8d:e1:28:ca:29:99:f1:06:91:ed:d7:
                    3b:d5:1b:10:20:b5:89:cc:e1:2a:e7:6e:f4:2a:d7:
                    c2:d3:88:03:fa:97:6e:56:93:9d:0a:9c:9b:ec:1c:
                    8a:19:40:fd:d4:38:6a:2c:95:b9:fa:39:b6:c1:3d:
                    a8:4d:a0:72:8f:a0:37:12:c4:f2:78:77:1b:96:85:
                    3e:8f:4f:5b:c6:b3:e7:42:22:ae:81:9b:1f:c9:26:
                    a7:2f:d4:7f:14:54:fc:54:fd:09:c7:7a:52:e0:4e:
                    12:62:06:a5:6e:01:73:36:65:9e:ca:2a:6b:50:07:
                    6a:11:bf:40:73:75:cc:f1:58:b6:d2:26:af:4e:62:
                    f7:a3
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://csc3-2010-crl.verisign.com/CSC3-2010.crl

            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/rpa

            X509v3 Extended Key Usage: 
                Code Signing
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
                CA Issuers - URI:http://csc3-2010-aia.verisign.com/CSC3-2010.cer

            X509v3 Authority Key Identifier: 
                keyid:CF:99:A9:EA:7B:26:F4:4B:C9:8E:8F:D7:F0:05:26:EF:E3:D2:A7:9D

            Netscape Cert Type: 
                Object Signing
            1.3.6.1.4.1.311.2.1.27: 
                0.......
    Signature Algorithm: sha1WithRSAEncryption
         cc:63:49:ba:9e:2c:5f:ed:2d:20:4a:d1:db:a8:dc:01:1e:32:
         fc:25:b8:0b:ea:b5:86:b0:d7:61:ff:9d:83:31:9c:f3:a6:40:
         d4:bd:cc:23:4a:c8:f1:0c:0c:e2:3f:94:6d:c5:b2:62:27:84:
         f7:b3:3a:9d:e9:51:24:f3:44:87:44:c7:4c:fb:45:75:7b:12:
         00:0d:cf:86:08:e2:d6:37:ad:f2:95:68:61:50:71:a5:1a:f4:
         04:27:30:b2:bc:df:4d:e9:48:b5:d7:a8:b2:d0:e3:3d:80:5e:
         da:e8:be:cb:6d:76:c7:0a:f8:b3:f3:a3:e7:4c:75:57:03:c0:
         7e:70:32:22:b0:8a:0c:78:f4:f6:2c:3a:7e:e1:4e:93:b9:57:
         a8:ff:f9:90:5c:19:f8:0b:af:88:e7:8a:35:3c:49:ec:8c:25:
         19:9f:ee:cc:13:42:01:c9:3d:0a:fd:ae:ae:1d:17:4d:d7:6e:
         ac:3e:fd:6b:fe:2a:3e:fe:b5:1f:2d:4d:1a:a3:de:9e:35:1d:
         d0:aa:54:9b:52:60:9e:f0:f1:36:99:ed:95:8a:12:43:88:e9:
         6e:b5:4b:db:dd:83:e9:8d:f5:0e:c8:3b:71:f6:e1:e9:59:47:
         4d:7c:1e:05:3b:b8:74:57:60:fd:b7:0a:95:cf:a2:e5:c5:20:
         0b:79:3d:ed
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
        Validity
            Not Before: Feb  8 00:00:00 2010 GMT
            Not After : Feb  7 23:59:59 2020 GMT
        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:f5:23:4b:5e:a5:d7:8a:bb:32:e9:d4:57:f7:ef:
                    e4:c7:26:7e:ad:19:98:fe:a8:9d:7d:94:f6:36:6b:
                    10:d7:75:81:30:7f:04:68:7f:cb:2b:75:1e:cd:1d:
                    08:8c:df:69:94:a7:37:a3:9c:7b:80:e0:99:e1:ee:
                    37:4d:5f:ce:3b:14:ee:86:d4:d0:f5:27:35:bc:25:
                    0b:38:a7:8c:63:9d:17:a3:08:a5:ab:b0:fb:cd:6a:
                    62:82:4c:d5:21:da:1b:d9:f1:e3:84:3b:8a:2a:4f:
                    85:5b:90:01:4f:c9:a7:76:10:7f:27:03:7c:be:ae:
                    7e:7d:c1:dd:f9:05:bc:1b:48:9c:69:e7:c0:a4:3c:
                    3c:41:00:3e:df:96:e5:c5:e4:94:71:d6:55:01:c7:
                    00:26:4a:40:3c:b5:a1:26:a9:0c:a7:6d:80:8e:90:
                    25:7b:cf:bf:3f:1c:eb:2f:96:fa:e5:87:77:c6:b5:
                    56:b2:7a:3b:54:30:53:1b:df:62:34:ff:1e:d1:f4:
                    5a:93:28:85:e5:4c:17:4e:7e:5b:fd:a4:93:99:7f:
                    df:cd:ef:a4:75:ef:ef:15:f6:47:e7:f8:19:72:d8:
                    2e:34:1a:a6:b4:a7:4c:7e:bd:bb:4f:0c:3d:57:f1:
                    30:d6:a6:36:8e:d6:80:76:d7:19:2e:a5:cd:7e:34:
                    2d:89
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/cps
                  User Notice:
                    Explicit Text: https://www.verisign.com/rpa

            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            1.3.6.1.5.5.7.1.12: 
                0_.].[0Y0W0U..image/gif0!0.0...+..............k...j.H.,{..0%.#http://logo.verisign.com/vslogo.gif
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.verisign.com/pca3-g5.crl

            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com

            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, Code Signing
            X509v3 Subject Alternative Name: 
                DirName:/CN=VeriSignMPKI-2-8
            X509v3 Subject Key Identifier: 
                CF:99:A9:EA:7B:26:F4:4B:C9:8E:8F:D7:F0:05:26:EF:E3:D2:A7:9D
            X509v3 Authority Key Identifier: 
                keyid:7F:D3:65:A7:C2:DD:EC:BB:F0:30:09:F3:43:39:FA:02:AF:33:31:33

    Signature Algorithm: sha1WithRSAEncryption
         56:22:e6:34:a4:c4:61:cb:48:b9:01:ad:56:a8:64:0f:d9:8c:
         91:c4:bb:cc:0c:e5:ad:7a:a0:22:7f:df:47:38:4a:2d:6c:d1:
         7f:71:1a:7c:ec:70:a9:b1:f0:4f:e4:0f:0c:53:fa:15:5e:fe:
         74:98:49:24:85:81:26:1c:91:14:47:b0:4c:63:8c:bb:a1:34:
         d4:c6:45:e8:0d:85:26:73:03:d0:a9:8c:64:6d:dc:71:92:e6:
         45:05:60:15:59:51:39:fc:58:14:6b:fe:d4:a4:ed:79:6b:08:
         0c:41:72:e7:37:22:06:09:be:23:e9:3f:44:9a:1e:e9:61:9d:
         cc:b1:90:5c:fc:3d:d2:8d:ac:42:3d:65:36:d4:b4:3d:40:28:
         8f:9b:10:cf:23:26:cc:4b:20:cb:90:1f:5d:8c:4c:34:ca:3c:
         d8:e5:37:d6:6f:a5:20:bd:34:eb:26:d9:ae:0d:e7:c5:9a:f7:
         a1:b4:21:91:33:6f:86:e8:58:bb:25:7c:74:0e:58:fe:75:1b:
         63:3f:ce:31:7c:9b:8f:1b:96:9e:c5:53:76:84:5b:9c:ad:91:
         fa:ac:ed:93:ba:5d:c8:21:53:c2:82:53:63:af:12:0d:50:87:
         11:1b:3d:54:52:96:8a:2c:9c:3d:92:1a:08:9a:05:2e:c7:93:
         a5:48:91:d3
pkcs7-signedData
  • 1
    • SHA1: nil
    • 1.3.6.1.4.1.311.2.1.4
      • #0
        • 1.3.6.1.4.1.311.2.1.15
          • : 
            00 3c 00 3c 00 3c 00 4f  00 62 00 73 00 6f 00 6c  |.<.<.<.O.b.s.o.l|
00 65 00 74 00 65 00 3e  00 3e 00 3e              |.e.t.e.>.>.>    |
        • SHA1
          • f6 bf 38 16 30 84 66 a5  27 aa e9 d3 ed 04 e7 07  |..8.0.f.'.......|
f3 fc 40 c6                                       |..@.            |
    • Certificates
      • Certificate #0
        • 2
          • 57:0F:39:54:FD:8A:C2:18:4E:29:E8:30:63:A4:48:2B
          • RSA-SHA1: nil
          • Issuer
            • C: US
            • O: VeriSign, Inc.
            • OU: VeriSign Trust Network
            • OU: Terms of use at https://www.verisign.com/rpa (c)10
            • CN: VeriSign Class 3 Code Signing 2010 CA
          • 2013-09-30 00:00:00 UTC: 2015-09-30 23:59:59 UTC
          • Subject
            • C: HK
            • ST: Hong Kong
            • L: Hong Kong
            • O: Denco Limited
            • OU: Digital ID Class 3 - Microsoft Software Validation v2
            • CN: Denco Limited
          • #5
            • rsaEncryption: nil
            • F0:FC:16:7D:0F:9D:53:59:AC:7E:1C:CF:E8:E4:C5:BD:
              AE:7A:D0:72:57:08:B6:E4:F6:B6:C8:F6:C4:61:99:CA:
              07:E1:71:CA:FE:23:AA:E0:AC:55:F6:08:F4:19:07:67:
              8B:7F:E0:A0:FA:20:0C:64:12:B5:56:13:DF:DD:FF:23:
              CB:2F:F3:68:D9:84:AF:D5:7A:64:12:58:75:4E:0F:1B:
              47:95:FD:B2:31:58:49:58:C0:09:5C:FD:28:65:2B:85:
              7C:58:EE:8D:CA:EC:EC:98:4F:C5:27:F5:14:D2:A6:7A:
              53:30:22:5A:CC:4D:C3:23:65:D1:6F:8D:E1:28:CA:29:
              99:F1:06:91:ED:D7:3B:D5:1B:10:20:B5:89:CC:E1:2A:
              E7:6E:F4:2A:D7:C2:D3:88:03:FA:97:6E:56:93:9D:0A:
              9C:9B:EC:1C:8A:19:40:FD:D4:38:6A:2C:95:B9:FA:39:
              B6:C1:3D:A8:4D:A0:72:8F:A0:37:12:C4:F2:78:77:1B:
              96:85:3E:8F:4F:5B:C6:B3:E7:42:22:AE:81:9B:1F:C9:
              26:A7:2F:D4:7F:14:54:FC:54:FD:09:C7:7A:52:E0:4E:
              12:62:06:A5:6E:01:73:36:65:9E:CA:2A:6B:50:07:6A:
              11:BF:40:73:75:CC:F1:58:B6:D2:26:AF:4E:62:F7:A3              : 0x010001
          • X509v3 extensions
            • basicConstraints
              • nil
            • keyUsage: true, 0x80
            • crlDistributionPoints: http://csc3-2010-crl.verisign.com/CSC3-2010.crl
            • certificatePolicies
              • 2.16.840.1.113733.1.7.23.3
                • id-qt-cps: https://www.verisign.com/rpa
            • extendedKeyUsage: codeSigning
            • authorityInfoAccess
              • #0
                • OCSP: http://ocsp.verisign.com
                • caIssuers: http://csc3-2010-aia.verisign.com/CSC3-2010.cer
            • authorityKeyIdentifier: 
              cf 99 a9 ea 7b 26 f4 4b  c9 8e 8f d7 f0 05 26 ef  |....{&.K......&.|
e3 d2 a7 9d                                       |....            |
            • nsCertType: 0x10
            • 1.3.6.1.4.1.311.2.1.27
              • false: true
        • RSA-SHA1: 
          cc 63 49 ba 9e 2c 5f ed  2d 20 4a d1 db a8 dc 01  |.cI..,_.- J.....|
1e 32 fc 25 b8 0b ea b5  86 b0 d7 61 ff 9d 83 31  |.2.%.......a...1|
9c f3 a6 40 d4 bd cc 23  4a c8 f1 0c 0c e2 3f 94  |...@...#J.....?.|
6d c5 b2 62 27 84 f7 b3  3a 9d e9 51 24 f3 44 87  |m..b'...:..Q$.D.|
44 c7 4c fb 45 75 7b 12  00 0d cf 86 08 e2 d6 37  |D.L.Eu{........7|
ad f2 95 68 61 50 71 a5  1a f4 04 27 30 b2 bc df  |...haPq....'0...|
4d e9 48 b5 d7 a8 b2 d0  e3 3d 80 5e da e8 be cb  |M.H......=.^....|
6d 76 c7 0a f8 b3 f3 a3  e7 4c 75 57 03 c0 7e 70  |mv.......LuW..~p|
32 22 b0 8a 0c 78 f4 f6  2c 3a 7e e1 4e 93 b9 57  |2"...x..,:~.N..W|
a8 ff f9 90 5c 19 f8 0b  af 88 e7 8a 35 3c 49 ec  |....\.......5.k.*>...-M|
1a a3 de 9e 35 1d d0 aa  54 9b 52 60 9e f0 f1 36  |....5...T.R`...6|
99 ed 95 8a 12 43 88 e9  6e b5 4b db dd 83 e9 8d  |.....C..n.K.....|
f5 0e c8 3b 71 f6 e1 e9  59 47 4d 7c 1e 05 3b b8  |...;q...YGM|..;.|
74 57 60 fd b7 0a 95 cf  a2 e5 c5 20 0b 79 3d ed  |tW`........ .y=.|
      • Certificate #1
        • 2
          • 52:00:E5:AA:25:56:FC:1A:86:ED:96:C9:D4:4B:33:C7
          • RSA-SHA1: nil
          • Issuer
            • C: US
            • O: VeriSign, Inc.
            • OU: VeriSign Trust Network
            • OU: (c) 2006 VeriSign, Inc. - For authorized use only
            • CN: VeriSign Class 3 Public Primary Certification Authority - G5
          • 2010-02-08 00:00:00 UTC: 2020-02-07 23:59:59 UTC
          • Subject
            • C: US
            • O: VeriSign, Inc.
            • OU: VeriSign Trust Network
            • OU: Terms of use at https://www.verisign.com/rpa (c)10
            • CN: VeriSign Class 3 Code Signing 2010 CA
          • #5
            • rsaEncryption: nil
            • F5:23:4B:5E:A5:D7:8A:BB:32:E9:D4:57:F7:EF:E4:C7:
              26:7E:AD:19:98:FE:A8:9D:7D:94:F6:36:6B:10:D7:75:
              81:30:7F:04:68:7F:CB:2B:75:1E:CD:1D:08:8C:DF:69:
              94:A7:37:A3:9C:7B:80:E0:99:E1:EE:37:4D:5F:CE:3B:
              14:EE:86:D4:D0:F5:27:35:BC:25:0B:38:A7:8C:63:9D:
              17:A3:08:A5:AB:B0:FB:CD:6A:62:82:4C:D5:21:DA:1B:
              D9:F1:E3:84:3B:8A:2A:4F:85:5B:90:01:4F:C9:A7:76:
              10:7F:27:03:7C:BE:AE:7E:7D:C1:DD:F9:05:BC:1B:48:
              9C:69:E7:C0:A4:3C:3C:41:00:3E:DF:96:E5:C5:E4:94:
              71:D6:55:01:C7:00:26:4A:40:3C:B5:A1:26:A9:0C:A7:
              6D:80:8E:90:25:7B:CF:BF:3F:1C:EB:2F:96:FA:E5:87:
              77:C6:B5:56:B2:7A:3B:54:30:53:1B:DF:62:34:FF:1E:
              D1:F4:5A:93:28:85:E5:4C:17:4E:7E:5B:FD:A4:93:99:
              7F:DF:CD:EF:A4:75:EF:EF:15:F6:47:E7:F8:19:72:D8:
              2E:34:1A:A6:B4:A7:4C:7E:BD:BB:4F:0C:3D:57:F1:30:
              D6:A6:36:8E:D6:80:76:D7:19:2E:A5:CD:7E:34:2D:89              : 0x010001
          • X509v3 extensions
            • basicConstraints
              • true
              • true: 0
            • certificatePolicies
              • 2.16.840.1.113733.1.7.23.3
                • #0
                  • id-qt-cps: https://www.verisign.com/cps
                  • id-qt-unotice: https://www.verisign.com/rpa
            • keyUsage: true, 6
            • 1.3.6.1.5.5.7.1.12
              • image/gif
                • SHA1: 
                  8f e5 d3 1a 86 ac 8d 8e  6b c3 cf 80 6a d4 48 18  |........k...j.H.|
2c 7b 19 2e                                       |,{..            |
                • http://logo.verisign.com/vslogo.gif
            • crlDistributionPoints: http://crl.verisign.com/pca3-g5.crl
            • authorityInfoAccess
              • OCSP: http://ocsp.verisign.com
            • extendedKeyUsage
              • clientAuth: codeSigning
            • subjectAltName
              • CN: VeriSignMPKI-2-8
            • subjectKeyIdentifier: 
              cf 99 a9 ea 7b 26 f4 4b  c9 8e 8f d7 f0 05 26 ef  |....{&.K......&.|
e3 d2 a7 9d                                       |....            |
            • authorityKeyIdentifier: 
              7f d3 65 a7 c2 dd ec bb  f0 30 09 f3 43 39 fa 02  |..e......0..C9..|
af 33 31 33                                       |.313            |
        • RSA-SHA1: 
          56 22 e6 34 a4 c4 61 cb  48 b9 01 ad 56 a8 64 0f  |V".4..a.H...V.d.|
d9 8c 91 c4 bb cc 0c e5  ad 7a a0 22 7f df 47 38  |.........z."..G8|
4a 2d 6c d1 7f 71 1a 7c  ec 70 a9 b1 f0 4f e4 0f  |J-l..q.|.p...O..|
0c 53 fa 15 5e fe 74 98  49 24 85 81 26 1c 91 14  |.S..^.t.I$..&...|
47 b0 4c 63 8c bb a1 34  d4 c6 45 e8 0d 85 26 73  |G.Lc...4..E...&s|
03 d0 a9 8c 64 6d dc 71  92 e6 45 05 60 15 59 51  |....dm.q..E.`.YQ|
39 fc 58 14 6b fe d4 a4  ed 79 6b 08 0c 41 72 e7  |9.X.k....yk..Ar.|
37 22 06 09 be 23 e9 3f  44 9a 1e e9 61 9d cc b1  |7"...#.?D...a...|
90 5c fc 3d d2 8d ac 42  3d 65 36 d4 b4 3d 40 28  |.\.=...B=e6..=@(|
8f 9b 10 cf 23 26 cc 4b  20 cb 90 1f 5d 8c 4c 34  |....#&.K ...].L4|
ca 3c d8 e5 37 d6 6f a5  20 bd 34 eb 26 d9 ae 0d  |.<..7.o. .4.&...|
e7 c5 9a f7 a1 b4 21 91  33 6f 86 e8 58 bb 25 7c  |......!.3o..X.%||
74 0e 58 fe 75 1b 63 3f  ce 31 7c 9b 8f 1b 96 9e  |t.X.u.c?.1|.....|
c5 53 76 84 5b 9c ad 91  fa ac ed 93 ba 5d c8 21  |.Sv.[........].!|
53 c2 82 53 63 af 12 0d  50 87 11 1b 3d 54 52 96  |S..Sc...P...=TR.|
8a 2c 9c 3d 92 1a 08 9a  05 2e c7 93 a5 48 91 d3  |.,.=.........H..|
    • Signer
      • 1
      • unnamed
        • #0
          • C: US
          • O: VeriSign, Inc.
          • OU: VeriSign Trust Network
          • OU: Terms of use at https://www.verisign.com/rpa (c)10
          • CN: VeriSign Class 3 Code Signing 2010 CA
        • 57:0F:39:54:FD:8A:C2:18:4E:29:E8:30:63:A4:48:2B
      • SHA1: nil
      • #3
        • 1.3.6.1.4.1.311.2.1.12
          • nil
        • contentType: 1.3.6.1.4.1.311.2.1.4
        • 1.3.6.1.4.1.311.2.1.11: msCodeInd
        • messageDigest: 
          78 16 c0 a1 70 c1 21 2a  ea d1 90 75 63 8c e5 10  |x...p.!*...uc...|
b5 34 d8 f0                                       |.4..            |
      • rsaEncryption: 
        df 13 e6 b2 ab d7 20 25  e1 5c d0 91 eb 61 e6 26  |...... %.\...a.&|
40 b7 7a cd 70 0e 45 46  9a 50 9b f6 78 db 95 9d  |@.z.p.EF.P..x...|
4d 9b 8b 5b f3 0e 97 74  be 04 40 71 8f 09 73 fd  |M..[...t..@q..s.|
30 09 be 9a 78 6a ee 0f  ba 10 30 b5 5f 37 66 c6  |0...xj....0._7f.|
2d 43 fc b6 20 fb fe 31  82 54 26 75 ee d6 0e d1  |-C.. ..1.T&u....|
e6 0f 71 69 10 c6 6f 66  90 3d 78 4f 0e 35 bd bf  |..qi..of.=xO.5..|
22 34 ab 3b d2 bd ba 5a  4e ce 00 69 1d b2 32 08  |"4.;...ZN..i..2.|
0c 52 6b 71 5b 80 47 a2  a6 af cf 74 f4 36 5a ba  |.Rkq[.G....t.6Z.|
7e 8a d0 1b 5c ad 6c 4b  96 57 ba 82 8b 52 1d 0f  |~...\.lK.W...R..|
b7 5a ad db 9c 64 90 92  66 6e 71 3f bc a0 46 a4  |.Z...d..fnq?..F.|
df a6 88 36 7c 49 43 02  b4 7b 5e e0 bf 9c 9b 0b  |...6|IC..{^.....|
c5 29 96 04 70 d4 96 68  73 2e 23 14 16 5f c1 44  |.)..p..hs.#.._.D|
47 2d 29 62 60 7f 8d 43  a9 9e 3f e6 90 6b a5 bd  |G-)b`..C..?..k..|
90 e1 6f 3d 99 60 48 24  42 6e 52 c4 d1 6c f0 d7  |..o=.`H$BnR..l..|
f1 6b be a0 8d 64 69 f4  80 65 f7 81 53 58 f7 8f  |.k...di..e..SX..|
49 6b 95 87 6f 25 ff 67  8f ea 9f e9 3d fa 17 8a  |Ik..o%.g....=...|
offsetsizetypecomment
046592EXE02/24/2012 19:22:01#
15c115HTM#
b6001292456BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 1339048 bytes (1308 KiB)


--
Type = PE
Physical Size = 1339048
CPU = x86
Characteristics = Executable 32-bit
Created = 2012-02-24 19:22:01
Headers Size = 1024
Checksum = 1392062
Image Size = 1032192
Section Alignment = 4096
File Alignment = 512
Code Size = 28672
Initialized Data Size = 317440
Uninitialized Data Size = 8704
Linker Version = 10.0
OS Version = 5.0
Image Version = 6.0
Subsystem Version = 5.0
Subsystem = Windows GUI
DLL Characteristics = Relocated NX-Compatible NoSEH TerminalServerAware
Stack Reserve = 1048576
Stack Commit = 4096
Heap Reserve = 1048576
Heap Commit = 4096
Image Base = 4194304
----
Path = [0]
Size = 1288752
Packed Size = 1288752
Virtual Size = 1288752
Offset = 46592
--
Path = [0]
Type = Nsis
Offset = 17920
Physical Size = 1270830
Tail Size = 2
Method = Deflate
Solid = -
Headers Size = 91827
Embedded Stub Size = 0
SubType = NSIS-Park-3 log

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
                    .....                      6260  $PLUGINSDIR/System.dll
                    .....                      4307  $PLUGINSDIR/GetVersion.dll
                    .....                     13340  $PLUGINSDIR/registry.dll
                    .....                      4586  $PLUGINSDIR/nsDialogs.dll
                    .....                      1585  $PLUGINSDIR/nsProcess.dll
2013-12-06 17:08:58 .....                     62903  FastFreeConverter_x64.dll
2013-12-06 17:08:58 .....                     55651  FastFreeConverter.dll
                    .....                     20280  $PLUGINSDIR/version.dll
2013-12-05 17:08:36 .....                    254158  $PROFILE/Local Settings/Temp/sqlite3.exe
2013-12-06 17:08:58 .....         2075         2075  $_40_/extension@Fast_Free_Converter.com/FastFreeConverter.7z
                    .....                     93287  $PLUGINSDIR/nsis7z.dll
                    .....                      5430  $PLUGINSDIR/nsJSON.dll
2013-12-06 17:08:58 .....         1789         1789  $_42_/FastFreeConverter.crx.7z
                    .....                      8011  $PLUGINSDIR/InstallOptions.dll
2007-08-29 13:46:34 .....                       134  $PLUGINSDIR/ioSpecial.ini
2003-09-23 18:34:00 .....                      1886  $PLUGINSDIR/modern-wizard.bmp
                    .....                     10671  $PLUGINSDIR/inetc.dll
2013-12-05 17:08:36 .....                      6297  install.ico
                    .....                     33378  $PLUGINSDIR/SimpleSC.dll
                    .....                      3206  $PLUGINSDIR/nsExec.dll
2013-12-06 17:08:48 .....                    126833  FastFreeConverterUpdt.exe
2013-12-05 17:08:36 .....                    176041  $PROFILE/Local Settings/Temp/helper.exe
                    .....                      9588  uninstall.exe.nsis
------------------- ----- ------------ ------------  ------------------------
2013-12-06 17:08:58               3864       901696  23 files
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







[?] ignoring invalid PEdump::BITMAPINFOHEADER
[?] can't find file_offset of VA 0x59000