filenameoi_gears300zip.exe
size342848 (0x53b40)
md589cd73a9c5e90cf619564c3b6641f1ed
typePE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x118

Rich Header

lib idversiontimes used
10520673
15307728
953077145
96307735
95217911
2891781
9320672
2592104
93217917
10359
100307731
9430521
9030771

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x4fa3eb50
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.10
SizeOfCode0x40000
SizeOfInitializedData0x12000
SizeOfUninitializedData0x9f000
AddressOfEntryPoint0xdfa80
BaseOfCode0xa0000
BaseOfData0xe0000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xf2000
SizeOfHeaders0x1000
CheckSum0x61a5c
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

UPX Modified >> *$igBy Ahmed18

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

namevavsizeraw sizeflags
UPX00x10000x9f0000RWX UDATA
UPX10xa00000x400000x3fe00RWX IDATA
.rsrc0xe00000x120000x12000RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0xf1bec0x290
RESOURCE0xe00000x11bec
EXCEPTION00
SECURITY0x522000x1940
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0xdfc340x48
Bound_IAT00
IAT00
Delay_IAT0x8a8400x100
CLR_Header00
typenamesizecp
JSONDATA#14110
JSONDATA#1428010
SCRIPT#140195730
BITMAP#1432109100
ICON#156720
ICON#237520
ICON#322160
ICON#413840
ICON#5128400
ICON#673360
ICON#732400
ICON#88720
ICON#9169360
ICON#1096400
ICON#1142640
ICON#1211280
GROUP_ICON#1071740
VERSION#18320
MANIFEST#112050
module_namehintordfunction_name
KERNEL32.DLLLoadLibraryA
KERNEL32.DLLGetProcAddress
KERNEL32.DLLVirtualProtect
KERNEL32.DLLVirtualAlloc
KERNEL32.DLLVirtualFree
KERNEL32.DLLExitProcess
COMCTL32.dll17
comdlg32.dllGetOpenFileNameA
GDI32.dllBitBlt
msi.dll112
ole32.dllCoCreateGuid
OLEAUT32.dll29
SHLWAPI.dllPathAppendA
USER32.dllGetDC
VERSION.dllVerQueryValueA
WININET.dllInternetOpenA

StringTable 040904b0

Comments
CompanyNameOpenInstall
FileDescriptionInstaller
FileVersion1,18,0,2464
InternalNameInstaller
LegalCopyrightCopyright © 2012
OriginalFilenameInstaller.exe
ProductNameInstaller
ProductVersion1,18,0,2464

VS_FIXEDFILEINFO

FileVersion1.18.0.2464
ProductVersion1.18.0.2464
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0

Signers (1)

issuer: /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https:\/\/www.verisign.com\/rpa (c)10/CN=VeriSign Class 3 Code Signing 2010 CA
serial: 4984489DEC6200DECEAD93D4732CABCA

Certificates (4)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
        Validity
            Not Before: May  1 00:00:00 2012 GMT
            Not After : Dec 31 23:59:59 2012 GMT
        Subject: C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:a9:59:66:74:da:3d:8a:7d:7a:d8:fc:f5:80:44:
                    7b:fe:47:6a:14:55:4e:50:47:0b:ec:d3:ed:ce:f6:
                    38:f7:4f:69:b9:b1:f0:b6:78:82:0a:8c:76:16:67:
                    e2:02:ad:b7:0d:a5:8a:f6:03:fc:66:d3:fc:08:2d:
                    cc:b5:73:59:7b:89:dc:33:6e:66:5a:5e:52:37:b4:
                    62:d1:92:59:35:14:8b:45:ac:59:b2:4d:24:a2:98:
                    94:68:42:72:9f:3a:68:e2:6b:8b:9e:22:2d:f4:98:
                    4e:9a:c6:af:b3:e4:a0:ab:3c:28:bf:23:e1:d7:72:
                    a4:f2:10:53:67:ae:77:af:51
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.verisign.com/tss-ca.crl
            X509v3 Extended Key Usage: critical
                Time Stamping
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Subject Alternative Name: 
                DirName:/CN=TSA1-3
            X509v3 Subject Key Identifier: 
                B4:B7:F1:89:49:26:60:E7:65:EA:73:AE:DC:D3:38:CD:BF:57:92:6F
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        1e:98:aa:27:b7:78:b5:08:b5:c9:72:6d:b7:df:c0:0e:98:a6:
        35:c4:88:c9:d2:f6:6d:f1:4b:1a:fb:d5:f9:2d:99:00:9e:d1:
        e7:9b:8b:e1:3f:bd:39:80:0c:66:cd:07:bc:5c:98:54:a6:94:
        ba:10:d1:4e:8b:ab:f5:6f:65:cc:67:09:a2:80:7c:52:e8:0e:
        03:d6:6b:7a:c6:05:18:ec:c8:ac:42:7c:07:2c:a7:3d:08:66:
        dc:00:ed:fd:94:1d:73:f2:72:98:93:b1:11:d6:8f:ef:8e:ea:
        ac:f4:96:51:0c:d0:8d:df:31:52:4f:5e:af:7d:a7:4a:75:e6:
        4e:ce:2b:9f:29:2b:e7:cf:5d:9f:03:7e:6e:27:7b:23:ad:62:
        29:66:af:92:e8:2c:ce:bd:9c:7f:dc:cd:17:3c:43:c2:09:3f:
        75:45:c7:9e:e4:d7:60:7f:97:c6:e4:aa:c7:69:f5:fc:cd:74:
        ac:2c:b0:48:c1:50:4e:70:56:1e:b5:35:d3:8e:be:b1:ed:ac:
        bd:fe:0c:ec:85:7d:d5:bb:85:66:44:19:5d:9f:93:eb:82:ba:
        63:9e:d3:7c:61:ff:c8:1b:d9:23:58:7f:30:a3:66:a1:39:26:
        5e:92:c3:3c:cb:37:32:fa:f5:a3:8d:dc:d5:b0:a3:e9:25:36:
        55:d7:81:fa

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
        Validity
            Not Before: Dec  4 00:00:00 2003 GMT
            Not After : Dec  3 23:59:59 2013 GMT
        Subject: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:a9:ca:b2:a4:cc:cd:20:af:0a:7d:89:ac:87:75:
                    f0:b4:4e:f1:df:c1:0f:bf:67:61:bd:a3:64:1c:da:
                    bb:f9:ca:33:ab:84:30:89:58:7e:8c:db:6b:dd:36:
                    9e:0f:bf:d1:ec:78:f2:77:a6:7e:6f:3c:bf:93:af:
                    0d:ba:68:f4:6c:94:ca:bd:52:2d:ab:48:3d:f5:b6:
                    d5:5d:5f:1b:02:9f:fa:2f:6b:1e:a4:f7:a3:9a:a6:
                    1a:c8:02:e1:7f:4c:52:e3:0e:60:ec:40:1c:7e:b9:
                    0d:de:3f:c7:b4:df:87:bd:5f:7a:6a:31:2e:03:99:
                    81:13:a8:47:20:ce:31:73:0d:57:2d:cd:78:34:33:
                    95:12:99:12:b9:de:68:2f:aa:e6:e3:c2:8a:8c:2a:
                    c3:8b:21:87:66:bd:83:58:57:6f:75:bf:3c:aa:26:
                    87:5d:ca:10:15:3c:9f:84:ea:54:c1:0a:6e:c4:fe:
                    c5:4a:dd:b9:07:11:97:22:7c:db:3e:27:d1:1e:78:
                    ec:9f:31:c9:f1:e6:22:19:db:c4:b3:47:43:9a:1a:
                    5f:a0:1e:90:e4:5e:f5:ee:7c:f1:7d:ab:62:01:8f:
                    f5:4d:0b:de:d0:22:56:a8:95:cd:ae:88:76:ae:ee:
                    ba:0d:f3:e4:4d:d9:a0:fb:68:a0:ae:14:3b:b3:87:
                    c1:bb
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.verisign.com/ThawteTimestampingCA.crl
            X509v3 Extended Key Usage: 
                Time Stamping
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name: 
                DirName:/CN=TSA2048-1-53
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        4a:6b:f9:ea:58:c2:44:1c:31:89:79:99:2b:96:bf:82:ac:01:
        d6:1c:4c:cd:b0:8a:58:6e:df:08:29:a3:5e:c8:ca:93:13:e7:
        04:52:0d:ef:47:27:2f:00:38:b0:e4:c9:93:4e:9a:d4:22:62:
        15:f7:3f:37:21:4f:70:31:80:f1:8b:38:87:b3:e8:e8:97:00:
        fe:cf:55:96:4e:24:d2:a9:27:4e:7a:ae:b7:61:41:f3:2a:ce:
        e7:c9:d9:5e:dd:bb:2b:85:3e:b5:9d:b5:d9:e1:57:ff:be:b4:
        c5:7e:f5:cf:0c:9e:f0:97:fe:2b:d3:3b:52:1b:1b:38:27:f7:
        3f:4a

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            49:84:48:9d:ec:62:00:de:ce:ad:93:d4:73:2c:ab:ca
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https:\/\/www.verisign.com\/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
        Validity
            Not Before: Jan  6 00:00:00 2012 GMT
            Not After : Jan  5 23:59:59 2015 GMT
        Subject: C=CZ, ST=Jihomoravsky kraj, L=Brno, O=AVG Technologies CZ, s.r.o., OU=Digital ID Class 3 - Microsoft Software Validation v2, CN=AVG Technologies CZ, s.r.o.
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:e2:14:e3:e1:0b:33:09:13:13:1a:14:20:69:8f:
                    87:d2:ea:d7:37:74:70:09:c1:bc:e2:05:20:b7:c4:
                    95:7d:1d:34:f1:61:6f:e8:f0:26:7e:db:12:84:95:
                    3a:8e:62:fa:aa:94:ca:47:2f:18:16:d2:22:9c:3e:
                    8b:cb:4d:39:22:2d:f9:36:35:59:80:e6:63:d6:2e:
                    32:44:6a:c5:53:b5:61:86:9a:02:3f:f5:12:37:18:
                    09:1f:1a:47:35:bd:09:66:56:74:5f:8b:9b:cb:5d:
                    d7:66:58:e8:27:f1:8b:fe:92:28:4a:92:b1:1d:9d:
                    8f:a5:de:04:41:51:a8:61:43:4f:7f:95:b0:34:15:
                    5a:2d:a0:a9:26:20:f7:8d:13:de:65:5c:d2:6a:f0:
                    a3:c2:ca:e5:a0:ed:0a:c5:2f:69:20:96:39:0f:d9:
                    5d:83:c6:e4:bb:a4:57:94:ff:ae:b2:20:74:c8:21:
                    88:60:6d:db:b6:80:bd:fd:eb:53:47:2f:fd:17:a9:
                    45:c1:41:8e:96:33:41:28:41:99:38:fb:18:80:44:
                    94:ae:23:58:56:66:da:b6:c0:ff:9b:3e:16:fb:f6:
                    d2:63:ee:5b:34:d3:a3:95:a9:ff:76:63:51:0f:f2:
                    4c:cb:34:9c:c5:69:fb:bc:c4:5c:be:88:60:fd:ba:
                    41:b3
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://csc3-2010-crl.verisign.com/CSC3-2010.crl
            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/rpa
            X509v3 Extended Key Usage: 
                Code Signing
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
                CA Issuers - URI:http://csc3-2010-aia.verisign.com/CSC3-2010.cer
            X509v3 Authority Key Identifier: 
                CF:99:A9:EA:7B:26:F4:4B:C9:8E:8F:D7:F0:05:26:EF:E3:D2:A7:9D
            Netscape Cert Type: 
                Object Signing
            1.3.6.1.4.1.311.2.1.27: 
                0.......
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        9d:d0:21:8e:93:23:23:29:96:8a:ca:7d:1e:d0:e3:21:fe:67:
        3f:0e:ac:dd:0b:c6:90:45:fb:85:5d:61:09:3d:bc:2e:94:d8:
        f3:21:e0:a1:45:19:eb:c6:87:09:72:94:bb:9e:8d:c8:84:94:
        65:21:ed:22:35:70:85:e2:d8:66:ac:c3:41:3c:0f:6d:08:cd:
        f2:87:28:0a:e3:56:22:94:da:d5:47:f9:40:2c:cb:d2:05:93:
        5e:55:6b:ea:38:e9:4b:ca:20:75:40:db:ec:59:49:6e:bb:8c:
        0e:1c:d4:81:0e:31:de:85:70:bd:20:c1:63:4c:08:2d:94:6b:
        f8:4e:31:2b:0d:c3:96:9b:5f:b2:04:4d:02:d0:3b:9e:b8:a5:
        46:dc:b3:d1:a2:8b:2d:98:2f:ce:18:a5:74:6b:1f:39:b0:65:
        b5:63:77:c6:73:d3:d7:77:25:30:8f:78:53:04:9a:8a:05:e6:
        6f:2c:a2:6f:2f:b8:43:d7:37:48:f5:24:c2:19:b4:ec:49:69:
        61:ee:6c:72:fa:dc:59:83:4f:e8:ac:85:b5:12:48:c6:ab:ee:
        b6:46:1b:2b:66:87:b2:e7:9f:f3:2c:aa:c8:1f:e0:82:50:ba:
        86:e3:8e:5f:94:ea:76:87:56:6f:58:0e:fb:16:e4:5e:0c:72:
        91:94:ca:1b

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
        Validity
            Not Before: Feb  8 00:00:00 2010 GMT
            Not After : Feb  7 23:59:59 2020 GMT
        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https:\/\/www.verisign.com\/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:f5:23:4b:5e:a5:d7:8a:bb:32:e9:d4:57:f7:ef:
                    e4:c7:26:7e:ad:19:98:fe:a8:9d:7d:94:f6:36:6b:
                    10:d7:75:81:30:7f:04:68:7f:cb:2b:75:1e:cd:1d:
                    08:8c:df:69:94:a7:37:a3:9c:7b:80:e0:99:e1:ee:
                    37:4d:5f:ce:3b:14:ee:86:d4:d0:f5:27:35:bc:25:
                    0b:38:a7:8c:63:9d:17:a3:08:a5:ab:b0:fb:cd:6a:
                    62:82:4c:d5:21:da:1b:d9:f1:e3:84:3b:8a:2a:4f:
                    85:5b:90:01:4f:c9:a7:76:10:7f:27:03:7c:be:ae:
                    7e:7d:c1:dd:f9:05:bc:1b:48:9c:69:e7:c0:a4:3c:
                    3c:41:00:3e:df:96:e5:c5:e4:94:71:d6:55:01:c7:
                    00:26:4a:40:3c:b5:a1:26:a9:0c:a7:6d:80:8e:90:
                    25:7b:cf:bf:3f:1c:eb:2f:96:fa:e5:87:77:c6:b5:
                    56:b2:7a:3b:54:30:53:1b:df:62:34:ff:1e:d1:f4:
                    5a:93:28:85:e5:4c:17:4e:7e:5b:fd:a4:93:99:7f:
                    df:cd:ef:a4:75:ef:ef:15:f6:47:e7:f8:19:72:d8:
                    2e:34:1a:a6:b4:a7:4c:7e:bd:bb:4f:0c:3d:57:f1:
                    30:d6:a6:36:8e:d6:80:76:d7:19:2e:a5:cd:7e:34:
                    2d:89
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/cps
                  User Notice:
                    Explicit Text: https://www.verisign.com/rpa
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            1.3.6.1.5.5.7.1.12: 
                0_.].[0Y0W0U..image/gif0!0.0...+..............k...j.H.,{..0%.#http://logo.verisign.com/vslogo.gif
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.verisign.com/pca3-g5.crl
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, Code Signing
            X509v3 Subject Alternative Name: 
                DirName:/CN=VeriSignMPKI-2-8
            X509v3 Subject Key Identifier: 
                CF:99:A9:EA:7B:26:F4:4B:C9:8E:8F:D7:F0:05:26:EF:E3:D2:A7:9D
            X509v3 Authority Key Identifier: 
                7F:D3:65:A7:C2:DD:EC:BB:F0:30:09:F3:43:39:FA:02:AF:33:31:33
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        56:22:e6:34:a4:c4:61:cb:48:b9:01:ad:56:a8:64:0f:d9:8c:
        91:c4:bb:cc:0c:e5:ad:7a:a0:22:7f:df:47:38:4a:2d:6c:d1:
        7f:71:1a:7c:ec:70:a9:b1:f0:4f:e4:0f:0c:53:fa:15:5e:fe:
        74:98:49:24:85:81:26:1c:91:14:47:b0:4c:63:8c:bb:a1:34:
        d4:c6:45:e8:0d:85:26:73:03:d0:a9:8c:64:6d:dc:71:92:e6:
        45:05:60:15:59:51:39:fc:58:14:6b:fe:d4:a4:ed:79:6b:08:
        0c:41:72:e7:37:22:06:09:be:23:e9:3f:44:9a:1e:e9:61:9d:
        cc:b1:90:5c:fc:3d:d2:8d:ac:42:3d:65:36:d4:b4:3d:40:28:
        8f:9b:10:cf:23:26:cc:4b:20:cb:90:1f:5d:8c:4c:34:ca:3c:
        d8:e5:37:d6:6f:a5:20:bd:34:eb:26:d9:ae:0d:e7:c5:9a:f7:
        a1:b4:21:91:33:6f:86:e8:58:bb:25:7c:74:0e:58:fe:75:1b:
        63:3f:ce:31:7c:9b:8f:1b:96:9e:c5:53:76:84:5b:9c:ad:91:
        fa:ac:ed:93:ba:5d:c8:21:53:c2:82:53:63:af:12:0d:50:87:
        11:1b:3d:54:52:96:8a:2c:9c:3d:92:1a:08:9a:05:2e:c7:93:
        a5:48:91:d3
pkcs7-signedData
  • 1
    • SHA1: nil
    • 1.3.6.1.4.1.311.2.1.4
      • #0
        • 1.3.6.1.4.1.311.2.1.15
          • : 
            00 3c 00 3c 00 3c 00 4f  00 62 00 73 00 6f 00 6c  |.<.<.<.O.b.s.o.l|
00 65 00 74 00 65 00 3e  00 3e 00 3e              |.e.t.e.>.>.>    |
        • SHA1
          • 1e 96 34 a8 d5 38 d0 26  c2 bf 91 2f 2b 00 72 15  |..4..8.&.../+.r.|
1c b9 63 f9                                       |..c.            |
    • Certificates
      • Certificate #0
        • 2
          • 79:A2:A5:85:F9:D1:15:42:13:D9:B8:3E:F6:B6:8D:ED
          • RSA-SHA1: nil
          • Issuer
            • C: US
            • O: VeriSign, Inc.
            • CN: VeriSign Time Stamping Services CA
          • 2012-05-01 00:00:00 UTC: 2012-12-31 23:59:59 UTC
          • Subject
            • C: US
            • O: Symantec Corporation
            • CN: Symantec Time Stamping Services Signer - G3
          • #5
            • rsaEncryption: nil
            • A9:59:66:74:DA:3D:8A:7D:7A:D8:FC:F5:80:44:7B:FE:
              47:6A:14:55:4E:50:47:0B:EC:D3:ED:CE:F6:38:F7:4F:
              69:B9:B1:F0:B6:78:82:0A:8C:76:16:67:E2:02:AD:B7:
              0D:A5:8A:F6:03:FC:66:D3:FC:08:2D:CC:B5:73:59:7B:
              89:DC:33:6E:66:5A:5E:52:37:B4:62:D1:92:59:35:14:
              8B:45:AC:59:B2:4D:24:A2:98:94:68:42:72:9F:3A:68:
              E2:6B:8B:9E:22:2D:F4:98:4E:9A:C6:AF:B3:E4:A0:AB:
              3C:28:BF:23:E1:D7:72:A4:F2:10:53:67:AE:77:AF:51              : 0x010001
          • X509v3 extensions
            • basicConstraints
              • true
              • nil
            • crlDistributionPoints: http://crl.verisign.com/tss-ca.crl
            • extendedKeyUsage: true, timeStamping
            • authorityInfoAccess
              • OCSP: http://ocsp.verisign.com
            • keyUsage: true, 0x80
            • subjectAltName
              • CN: TSA1-3
            • subjectKeyIdentifier: 
              b4 b7 f1 89 49 26 60 e7  65 ea 73 ae dc d3 38 cd  |....I&`.e.s...8.|
bf 57 92 6f                                       |.W.o            |
        • RSA-SHA1: 
          1e 98 aa 27 b7 78 b5 08  b5 c9 72 6d b7 df c0 0e  |...'.x....rm....|
98 a6 35 c4 88 c9 d2 f6  6d f1 4b 1a fb d5 f9 2d  |..5.....m.K....-|
99 00 9e d1 e7 9b 8b e1  3f bd 39 80 0c 66 cd 07  |........?.9..f..|
bc 5c 98 54 a6 94 ba 10  d1 4e 8b ab f5 6f 65 cc  |.\.T.....N...oe.|
67 09 a2 80 7c 52 e8 0e  03 d6 6b 7a c6 05 18 ec  |g...|R....kz....|
c8 ac 42 7c 07 2c a7 3d  08 66 dc 00 ed fd 94 1d  |..B|.,.=.f......|
73 f2 72 98 93 b1 11 d6  8f ef 8e ea ac f4 96 51  |s.r............Q|
0c d0 8d df 31 52 4f 5e  af 7d a7 4a 75 e6 4e ce  |....1RO^.}.Ju.N.|
2b 9f 29 2b e7 cf 5d 9f  03 7e 6e 27 7b 23 ad 62  |+.)+..]..~n'{#.b|
29 66 af 92 e8 2c ce bd  9c 7f dc cd 17 3c 43 c2  |)f...,.......
      • Certificate #1
        • 2
          • 47:BF:19:95:DF:8D:52:46:43:F7:DB:6D:48:0D:31:A4
          • RSA-SHA1: nil
          • Issuer
            • C: ZA
            • ST: Western Cape
            • L: Durbanville
            • O: Thawte
            • OU: Thawte Certification
            • CN: Thawte Timestamping CA
          • 2003-12-04 00:00:00 UTC: 2013-12-03 23:59:59 UTC
          • Subject
            • C: US
            • O: VeriSign, Inc.
            • CN: VeriSign Time Stamping Services CA
          • #5
            • rsaEncryption: nil
            • A9:CA:B2:A4:CC:CD:20:AF:0A:7D:89:AC:87:75:F0:B4:
              4E:F1:DF:C1:0F:BF:67:61:BD:A3:64:1C:DA:BB:F9:CA:
              33:AB:84:30:89:58:7E:8C:DB:6B:DD:36:9E:0F:BF:D1:
              EC:78:F2:77:A6:7E:6F:3C:BF:93:AF:0D:BA:68:F4:6C:
              94:CA:BD:52:2D:AB:48:3D:F5:B6:D5:5D:5F:1B:02:9F:
              FA:2F:6B:1E:A4:F7:A3:9A:A6:1A:C8:02:E1:7F:4C:52:
              E3:0E:60:EC:40:1C:7E:B9:0D:DE:3F:C7:B4:DF:87:BD:
              5F:7A:6A:31:2E:03:99:81:13:A8:47:20:CE:31:73:0D:
              57:2D:CD:78:34:33:95:12:99:12:B9:DE:68:2F:AA:E6:
              E3:C2:8A:8C:2A:C3:8B:21:87:66:BD:83:58:57:6F:75:
              BF:3C:AA:26:87:5D:CA:10:15:3C:9F:84:EA:54:C1:0A:
              6E:C4:FE:C5:4A:DD:B9:07:11:97:22:7C:DB:3E:27:D1:
              1E:78:EC:9F:31:C9:F1:E6:22:19:DB:C4:B3:47:43:9A:
              1A:5F:A0:1E:90:E4:5E:F5:EE:7C:F1:7D:AB:62:01:8F:
              F5:4D:0B:DE:D0:22:56:A8:95:CD:AE:88:76:AE:EE:BA:
              0D:F3:E4:4D:D9:A0:FB:68:A0:AE:14:3B:B3:87:C1:BB              : 0x010001
          • X509v3 extensions
            • authorityInfoAccess
              • OCSP: http://ocsp.verisign.com
            • basicConstraints
              • true
              • true: 0
            • crlDistributionPoints: http://crl.verisign.com/ThawteTimestampingCA.crl
            • extendedKeyUsage: timeStamping
            • keyUsage: true, 6
            • subjectAltName
              • CN: TSA2048-1-53
        • RSA-SHA1: 
          4a 6b f9 ea 58 c2 44 1c  31 89 79 99 2b 96 bf 82  |Jk..X.D.1.y.+...|
ac 01 d6 1c 4c cd b0 8a  58 6e df 08 29 a3 5e c8  |....L...Xn..).^.|
ca 93 13 e7 04 52 0d ef  47 27 2f 00 38 b0 e4 c9  |.....R..G'/.8...|
93 4e 9a d4 22 62 15 f7  3f 37 21 4f 70 31 80 f1  |.N.."b..?7!Op1..|
8b 38 87 b3 e8 e8 97 00  fe cf 55 96 4e 24 d2 a9  |.8........U.N$..|
27 4e 7a ae b7 61 41 f3  2a ce e7 c9 d9 5e dd bb  |'Nz..aA.*....^..|
2b 85 3e b5 9d b5 d9 e1  57 ff be b4 c5 7e f5 cf  |+.>.....W....~..|
0c 9e f0 97 fe 2b d3 3b  52 1b 1b 38 27 f7 3f 4a  |.....+.;R..8'.?J|
      • Certificate #2
        • 2
          • 49:84:48:9D:EC:62:00:DE:CE:AD:93:D4:73:2C:AB:CA
          • RSA-SHA1: nil
          • Issuer
            • C: US
            • O: VeriSign, Inc.
            • OU: VeriSign Trust Network
            • OU: Terms of use at https://www.verisign.com/rpa (c)10
            • CN: VeriSign Class 3 Code Signing 2010 CA
          • 2012-01-06 00:00:00 UTC: 2015-01-05 23:59:59 UTC
          • Subject
            • C: CZ
            • ST: Jihomoravsky kraj
            • L: Brno
            • O: AVG Technologies CZ, s.r.o.
            • OU: Digital ID Class 3 - Microsoft Software Validation v2
            • CN: AVG Technologies CZ, s.r.o.
          • #5
            • rsaEncryption: nil
            • E2:14:E3:E1:0B:33:09:13:13:1A:14:20:69:8F:87:D2:
              EA:D7:37:74:70:09:C1:BC:E2:05:20:B7:C4:95:7D:1D:
              34:F1:61:6F:E8:F0:26:7E:DB:12:84:95:3A:8E:62:FA:
              AA:94:CA:47:2F:18:16:D2:22:9C:3E:8B:CB:4D:39:22:
              2D:F9:36:35:59:80:E6:63:D6:2E:32:44:6A:C5:53:B5:
              61:86:9A:02:3F:F5:12:37:18:09:1F:1A:47:35:BD:09:
              66:56:74:5F:8B:9B:CB:5D:D7:66:58:E8:27:F1:8B:FE:
              92:28:4A:92:B1:1D:9D:8F:A5:DE:04:41:51:A8:61:43:
              4F:7F:95:B0:34:15:5A:2D:A0:A9:26:20:F7:8D:13:DE:
              65:5C:D2:6A:F0:A3:C2:CA:E5:A0:ED:0A:C5:2F:69:20:
              96:39:0F:D9:5D:83:C6:E4:BB:A4:57:94:FF:AE:B2:20:
              74:C8:21:88:60:6D:DB:B6:80:BD:FD:EB:53:47:2F:FD:
              17:A9:45:C1:41:8E:96:33:41:28:41:99:38:FB:18:80:
              44:94:AE:23:58:56:66:DA:B6:C0:FF:9B:3E:16:FB:F6:
              D2:63:EE:5B:34:D3:A3:95:A9:FF:76:63:51:0F:F2:4C:
              CB:34:9C:C5:69:FB:BC:C4:5C:BE:88:60:FD:BA:41:B3              : 0x010001
          • X509v3 extensions
            • basicConstraints
              • nil
            • keyUsage: true, 0x80
            • crlDistributionPoints: http://csc3-2010-crl.verisign.com/CSC3-2010.crl
            • certificatePolicies
              • 2.16.840.1.113733.1.7.23.3
                • id-qt-cps: https://www.verisign.com/rpa
            • extendedKeyUsage: codeSigning
            • authorityInfoAccess
              • #0
                • OCSP: http://ocsp.verisign.com
                • caIssuers: http://csc3-2010-aia.verisign.com/CSC3-2010.cer
            • authorityKeyIdentifier: 
              cf 99 a9 ea 7b 26 f4 4b  c9 8e 8f d7 f0 05 26 ef  |....{&.K......&.|
e3 d2 a7 9d                                       |....            |
            • nsCertType: 0x10
            • 1.3.6.1.4.1.311.2.1.27
              • false: true
        • RSA-SHA1: 
          9d d0 21 8e 93 23 23 29  96 8a ca 7d 1e d0 e3 21  |..!..##)...}...!|
fe 67 3f 0e ac dd 0b c6  90 45 fb 85 5d 61 09 3d  |.g?......E..]a.=|
bc 2e 94 d8 f3 21 e0 a1  45 19 eb c6 87 09 72 94  |.....!..E.....r.|
bb 9e 8d c8 84 94 65 21  ed 22 35 70 85 e2 d8 66  |......e!."5p...f|
ac c3 41 3c 0f 6d 08 cd  f2 87 28 0a e3 56 22 94  |..A<.m....(..V".|
da d5 47 f9 40 2c cb d2  05 93 5e 55 6b ea 38 e9  |..G.@,....^Uk.8.|
4b ca 20 75 40 db ec 59  49 6e bb 8c 0e 1c d4 81  |K. u@..YIn......|
0e 31 de 85 70 bd 20 c1  63 4c 08 2d 94 6b f8 4e  |.1..p. .cL.-.k.N|
31 2b 0d c3 96 9b 5f b2  04 4d 02 d0 3b 9e b8 a5  |1+...._..M..;...|
46 dc b3 d1 a2 8b 2d 98  2f ce 18 a5 74 6b 1f 39  |F.....-./...tk.9|
b0 65 b5 63 77 c6 73 d3  d7 77 25 30 8f 78 53 04  |.e.cw.s..w%0.xS.|
9a 8a 05 e6 6f 2c a2 6f  2f b8 43 d7 37 48 f5 24  |....o,.o/.C.7H.$|
c2 19 b4 ec 49 69 61 ee  6c 72 fa dc 59 83 4f e8  |....Iia.lr..Y.O.|
ac 85 b5 12 48 c6 ab ee  b6 46 1b 2b 66 87 b2 e7  |....H....F.+f...|
9f f3 2c aa c8 1f e0 82  50 ba 86 e3 8e 5f 94 ea  |..,.....P...._..|
76 87 56 6f 58 0e fb 16  e4 5e 0c 72 91 94 ca 1b  |v.VoX....^.r....|
      • Certificate #3
        • 2
          • 52:00:E5:AA:25:56:FC:1A:86:ED:96:C9:D4:4B:33:C7
          • RSA-SHA1: nil
          • Issuer
            • C: US
            • O: VeriSign, Inc.
            • OU: VeriSign Trust Network
            • OU: (c) 2006 VeriSign, Inc. - For authorized use only
            • CN: VeriSign Class 3 Public Primary Certification Authority - G5
          • 2010-02-08 00:00:00 UTC: 2020-02-07 23:59:59 UTC
          • Subject
            • C: US
            • O: VeriSign, Inc.
            • OU: VeriSign Trust Network
            • OU: Terms of use at https://www.verisign.com/rpa (c)10
            • CN: VeriSign Class 3 Code Signing 2010 CA
          • #5
            • rsaEncryption: nil
            • F5:23:4B:5E:A5:D7:8A:BB:32:E9:D4:57:F7:EF:E4:C7:
              26:7E:AD:19:98:FE:A8:9D:7D:94:F6:36:6B:10:D7:75:
              81:30:7F:04:68:7F:CB:2B:75:1E:CD:1D:08:8C:DF:69:
              94:A7:37:A3:9C:7B:80:E0:99:E1:EE:37:4D:5F:CE:3B:
              14:EE:86:D4:D0:F5:27:35:BC:25:0B:38:A7:8C:63:9D:
              17:A3:08:A5:AB:B0:FB:CD:6A:62:82:4C:D5:21:DA:1B:
              D9:F1:E3:84:3B:8A:2A:4F:85:5B:90:01:4F:C9:A7:76:
              10:7F:27:03:7C:BE:AE:7E:7D:C1:DD:F9:05:BC:1B:48:
              9C:69:E7:C0:A4:3C:3C:41:00:3E:DF:96:E5:C5:E4:94:
              71:D6:55:01:C7:00:26:4A:40:3C:B5:A1:26:A9:0C:A7:
              6D:80:8E:90:25:7B:CF:BF:3F:1C:EB:2F:96:FA:E5:87:
              77:C6:B5:56:B2:7A:3B:54:30:53:1B:DF:62:34:FF:1E:
              D1:F4:5A:93:28:85:E5:4C:17:4E:7E:5B:FD:A4:93:99:
              7F:DF:CD:EF:A4:75:EF:EF:15:F6:47:E7:F8:19:72:D8:
              2E:34:1A:A6:B4:A7:4C:7E:BD:BB:4F:0C:3D:57:F1:30:
              D6:A6:36:8E:D6:80:76:D7:19:2E:A5:CD:7E:34:2D:89              : 0x010001
          • X509v3 extensions
            • basicConstraints
              • true
              • true: 0
            • certificatePolicies
              • 2.16.840.1.113733.1.7.23.3
                • #0
                  • id-qt-cps: https://www.verisign.com/cps
                  • id-qt-unotice: https://www.verisign.com/rpa
            • keyUsage: true, 6
            • 1.3.6.1.5.5.7.1.12
              • image/gif
                • SHA1: 
                  8f e5 d3 1a 86 ac 8d 8e  6b c3 cf 80 6a d4 48 18  |........k...j.H.|
2c 7b 19 2e                                       |,{..            |
                • http://logo.verisign.com/vslogo.gif
            • crlDistributionPoints: http://crl.verisign.com/pca3-g5.crl
            • authorityInfoAccess
              • OCSP: http://ocsp.verisign.com
            • extendedKeyUsage
              • clientAuth: codeSigning
            • subjectAltName
              • CN: VeriSignMPKI-2-8
            • subjectKeyIdentifier: 
              cf 99 a9 ea 7b 26 f4 4b  c9 8e 8f d7 f0 05 26 ef  |....{&.K......&.|
e3 d2 a7 9d                                       |....            |
            • authorityKeyIdentifier: 
              7f d3 65 a7 c2 dd ec bb  f0 30 09 f3 43 39 fa 02  |..e......0..C9..|
af 33 31 33                                       |.313            |
        • RSA-SHA1: 
          56 22 e6 34 a4 c4 61 cb  48 b9 01 ad 56 a8 64 0f  |V".4..a.H...V.d.|
d9 8c 91 c4 bb cc 0c e5  ad 7a a0 22 7f df 47 38  |.........z."..G8|
4a 2d 6c d1 7f 71 1a 7c  ec 70 a9 b1 f0 4f e4 0f  |J-l..q.|.p...O..|
0c 53 fa 15 5e fe 74 98  49 24 85 81 26 1c 91 14  |.S..^.t.I$..&...|
47 b0 4c 63 8c bb a1 34  d4 c6 45 e8 0d 85 26 73  |G.Lc...4..E...&s|
03 d0 a9 8c 64 6d dc 71  92 e6 45 05 60 15 59 51  |....dm.q..E.`.YQ|
39 fc 58 14 6b fe d4 a4  ed 79 6b 08 0c 41 72 e7  |9.X.k....yk..Ar.|
37 22 06 09 be 23 e9 3f  44 9a 1e e9 61 9d cc b1  |7"...#.?D...a...|
90 5c fc 3d d2 8d ac 42  3d 65 36 d4 b4 3d 40 28  |.\.=...B=e6..=@(|
8f 9b 10 cf 23 26 cc 4b  20 cb 90 1f 5d 8c 4c 34  |....#&.K ...].L4|
ca 3c d8 e5 37 d6 6f a5  20 bd 34 eb 26 d9 ae 0d  |.<..7.o. .4.&...|
e7 c5 9a f7 a1 b4 21 91  33 6f 86 e8 58 bb 25 7c  |......!.3o..X.%||
74 0e 58 fe 75 1b 63 3f  ce 31 7c 9b 8f 1b 96 9e  |t.X.u.c?.1|.....|
c5 53 76 84 5b 9c ad 91  fa ac ed 93 ba 5d c8 21  |.Sv.[........].!|
53 c2 82 53 63 af 12 0d  50 87 11 1b 3d 54 52 96  |S..Sc...P...=TR.|
8a 2c 9c 3d 92 1a 08 9a  05 2e c7 93 a5 48 91 d3  |.,.=.........H..|
    • Signer
      • 1
      • unnamed
        • #0
          • C: US
          • O: VeriSign, Inc.
          • OU: VeriSign Trust Network
          • OU: Terms of use at https://www.verisign.com/rpa (c)10
          • CN: VeriSign Class 3 Code Signing 2010 CA
        • 49:84:48:9D:EC:62:00:DE:CE:AD:93:D4:73:2C:AB:CA
      • SHA1: nil
      • #3
        • contentType: 1.3.6.1.4.1.311.2.1.4
        • 1.3.6.1.4.1.311.2.1.11: msCodeInd
        • messageDigest: 
          77 a5 69 cb a2 f9 ac f0  0d bd e0 51 1c 24 8f 64  |w.i........Q.$.d|
4c fc 71 8c                                       |L.q.            |
        • 1.3.6.1.4.1.311.2.1.12: http://www.avg.com
      • rsaEncryption: 
        c7 0f 14 dd e4 da 13 dd  5e 25 27 9e 18 41 44 61  |........^%'..ADa|
02 21 3e 7c 25 a6 74 49  14 18 92 23 76 fd c7 74  |.!>|%.tI...#v..t|
23 5b 6c de 05 96 05 75  1f 3a 66 53 fd 56 5c 62  |#[l....u.:fS.V\b|
fc 57 96 d8 19 c0 fb 8e  13 2a df 97 d2 33 55 d6  |.W.......*...3U.|
04 c9 22 d3 48 fb f6 a7  b9 d3 2e 0a a0 39 f7 9d  |..".H........9..|
ff 5b ba 02 ec 69 28 c0  82 63 8d 6c e8 5e 34 77  |.[...i(..c.l.^4w|
a5 c8 29 5f cb de 4e 1b  8b 96 22 12 8d 3e ac 7d  |..)_..N..."..>.}|
2e 54 ff d6 e9 7d 40 e6  7b db fd 64 1d 8b 9c 2e  |.T...}@.{..d....|
ae ce f6 13 6b a0 48 21  1f 8f 68 59 3a dd 4d 9f  |....k.H!..hY:.M.|
84 cb 50 68 60 4e e8 d6  7b 75 8c cc c9 56 8d 4b  |..Ph`N..{u...V.K|
d0 1a dd 75 52 49 25 4f  16 ee 50 a6 43 26 d3 b3  |...uRI%O..P.C&..|
8a 43 78 83 c1 f6 c8 9f  82 ef 30 cf bb dc 3d 9b  |.Cx.......0...=.|
fa 95 79 d8 43 d1 6b ad  d5 07 44 c6 e7 b6 90 bc  |..y.C.k...D.....|
b7 63 f8 17 bb 3d 04 3e  bf 76 ec 15 7d f7 d1 4f  |.c...=.>.v..}..O|
3e b2 ac 8e cb e9 34 f1  1c dc 55 4c 69 d7 e5 d8  |>.....4...ULi...|
6c ae 08 f2 db 6f ff 99  c3 ea 15 23 5c 95 72 63  |l....o.....#\.rc|
      • countersignature
        • 1
          • unnamed
            • #0
              • C: US
              • O: VeriSign, Inc.
              • CN: VeriSign Time Stamping Services CA
            • 79:A2:A5:85:F9:D1:15:42:13:D9:B8:3E:F6:B6:8D:ED
          • SHA1: nil
          • #2
            • contentType: pkcs7-data
            • signingTime: 2012-05-24 00:47:37 UTC
            • messageDigest: 
              2f f9 ce 1b e5 65 c3 d8  16 2e 51 d4 1d 8c 64 b1  |/....e....Q...d.|
1c 1f da 80                                       |....            |
          • rsaEncryption: 
            7e 84 59 a6 17 48 28 cf  59 5c e5 55 a1 c0 2a a9  |~.Y..H(.Y\.U..*.|
0c 0e 26 68 bf d6 ee 02  9d 83 f4 d9 aa b4 63 34  |..&h..........c4|
2d ba 0a ba 07 de 6a 52  da 79 7f 0b 1e 12 13 10  |-.....jR.y......|
e8 67 89 de 50 eb f8 bf  d4 ff e3 0b 4a 5d 19 82  |.g..P.......J]..|
e6 81 03 4e f4 18 4c 58  84 bb 6d ca 5b 15 4f c1  |...N..LX..m.[.O.|
e8 84 33 3d 95 df a5 16  88 86 7e 93 20 41 76 71  |..3=......~. Avq|
ca 1d a2 1c f4 6b e3 36  fe 25 ed 79 fb d1 c2 5e  |.....k.6.%.y...^|
36 a0 00 bc bc 86 42 57  22 bd 5d ee 10 f1 6e de  |6.....BW".]...n.|
offsetsizetypecomment
0336384EXE05/04/2012 14:44:32#
15c115HTM#
522006464PKCS7Authenticode Signature#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x92468
[?] can't find file_offset of VA 0x9246c
[?] can't find file_offset of VA 0x92790
[?] can't find file_offset of VA 0x97408
[?] can't find file_offset of VA 0x8a840