vs_community__1597297045.1551201238.exe - vs_community.exe

info
MZ
PE
resources
strings
imports
exports
foremost
7zip
version info
signature
hexdump
disasm
log
discuss
donate

filename	vs_community__1597297045.1551201238.exe
size	1285888 (0x139f00)
md5	9bd7458087edade3176d7a7bea9bd96f

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

Rich Header

lib id	version	times used
158	40219	1
109	50727	3
206	65501	1
171	30319	46
158	30319	20
170	30319	104
203	65501	7
1	0	195
175	40219	72
155	40219	1
154	40219	1
157	40219	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	6
TimeDateStamp	0x5a05f500
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x122
Magic	0x10b
LinkerVersion	10.0
SizeOfCode	0x26400
SizeOfInitializedData	0x11e00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x17f8c
BaseOfCode	0x1000
BaseOfData	0x28000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	10.0
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0x3e000
SizeOfHeaders	0x400
CheckSum	0x1482a5
Subsystem	2
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x2000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x2625a	0x26400	R-X CODE
.data	0x28000	0x3800	0x1400	RW- IDATA
.idata	0x2c000	0xd58	0xe00	R-- IDATA
.boxld01	0x2d000	0xb8	0x200	R-- IDATA
.rsrc	0x2e000	0xce08	0xd000	R-- IDATA
.reloc	0x3b000	0x29b2	0x2a00	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x271c0	0x9a
IMPORT	0x2c000	0x50
RESOURCE	0x2e000	0xce08
EXCEPTION	0	0
SECURITY	0x136098	0x3e68
BASERELOC	0x3b000	0x1a1c
DEBUG	0x1040	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x5148	0x40
Bound_IAT	0	0
IAT	0x2c24c	0x1fc
Delay_IAT	0x26cf4	0x120
CLR_Header	0	0

show previews

type	name	size	cp
ICON	#1	5604	1252
ICON	#2	16936	1252
ICON	#3	9640	1252
ICON	#4	6760	1252
ICON	#5	4264	1252
ICON	#6	2440	1252
ICON	#7	1128	1252
DIALOG	#129	284	1252
DIALOG	#130	368	1252
STRING	#1	1410	1252
STRING	#2	552	1252
STRING	#32	78	1252
GROUP_ICON	#107	104	1252
VERSION	#1	868	1252
MANIFEST	#1	1423	1252

id	lang	string
10	1033	Preparing:
11	1033	Are you sure you want to cancel?
12	1033	An error was encountered.
13	1033	There is not enough disk space on your drive for the new files to be uncompressed and installed. Please run this application again after you have freed some space on your drive.
14	1033	Unable to create or save new files in the folder into which the files are being extracted. Please check the folder properties to ensure you have permission on the folder to write files and that the folder is not read-only.
15	1033	The application cannot find one of its required files, possibly because it was unable to create it in the folder. Please make sure that the folder in which this application was downloaded is accessible and not read-only.
16	1033	Unable to execute the embedded application to complete the installation.
17	1033	This application requires .Net Framework 4.6 or higher to be installed. Please install the latest .NET Framework from https://go.microsoft.com/fwlink/?linkid=840938, or Windows Update.
500	1033	Visual Studio Installer

module_name	hint	ord	function_name
KERNEL32.dll	615		GetModuleHandleW
KERNEL32.dll	553		GetEnvironmentVariableW
KERNEL32.dll	754		GetTickCount
KERNEL32.dll	1261		SetEnvironmentVariableW
KERNEL32.dll	592		GetLastError
KERNEL32.dll	341		ExpandEnvironmentStringsW
KERNEL32.dll	1360		Sleep
KERNEL32.dll	676		GetProcessId
KERNEL32.dll	1449		WaitForSingleObject
KERNEL32.dll	556		GetExitCodeProcess
KERNEL32.dll	127		CloseHandle
KERNEL32.dll	1270		SetFileAttributesW
KERNEL32.dll	839		InitializeCriticalSection
KERNEL32.dll	182		CreateEventW
KERNEL32.dll	232		CreateThread
KERNEL32.dll	261		DeleteCriticalSection
KERNEL32.dll	293		EnterCriticalSection
KERNEL32.dll	930		LeaveCriticalSection
KERNEL32.dll	1263		SetEvent
KERNEL32.dll	457		GetCommandLineW
KERNEL32.dll	1545		lstrlenW
KERNEL32.dll	147		CompareStringW
KERNEL32.dll	946		LocalFree
KERNEL32.dll	178		CreateDirectoryW
KERNEL32.dll	739		GetTempPathW
KERNEL32.dll	936		LoadLibraryW
KERNEL32.dll	669		GetProcAddress
KERNEL32.dll	717		GetSystemDirectoryW
KERNEL32.dll	414		FreeLibrary
KERNEL32.dll	1447		WaitForMultipleObjects
KERNEL32.dll	1185		ResetEvent
KERNEL32.dll	456		GetCommandLineA
KERNEL32.dll	823		HeapSetInformation
KERNEL32.dll	702		GetStartupInfoW
KERNEL32.dll	1345		SetUnhandledExceptionFilter
KERNEL32.dll	337		ExitProcess
KERNEL32.dll	1503		WriteFile
KERNEL32.dll	704		GetStdHandle
KERNEL32.dll	611		GetModuleFileNameW
KERNEL32.dll	610		GetModuleFileNameA
KERNEL32.dll	413		FreeEnvironmentStringsW
KERNEL32.dll	1483		WideCharToMultiByte
KERNEL32.dll	551		GetEnvironmentStringsW
KERNEL32.dll	1286		SetHandleCount
KERNEL32.dll	840		InitializeCriticalSectionAndSpinCount
KERNEL32.dll	574		GetFileType
KERNEL32.dll	1393		TlsAlloc
KERNEL32.dll	1395		TlsGetValue
KERNEL32.dll	1396		TlsSetValue
KERNEL32.dll	1394		TlsFree
KERNEL32.dll	853		InterlockedIncrement
KERNEL32.dll	1290		SetLastError
KERNEL32.dll	526		GetCurrentThreadId
KERNEL32.dll	849		InterlockedDecrement
KERNEL32.dll	817		HeapCreate
KERNEL32.dll	1069		QueryPerformanceCounter
KERNEL32.dll	522		GetCurrentProcessId
KERNEL32.dll	726		GetSystemTimeAsFileTime
KERNEL32.dll	1375		TerminateProcess
KERNEL32.dll	521		GetCurrentProcess
KERNEL32.dll	1408		UnhandledExceptionFilter
KERNEL32.dll	871		IsDebuggerPresent
KERNEL32.dll	819		HeapFree
KERNEL32.dll	435		GetCPInfo
KERNEL32.dll	420		GetACP
KERNEL32.dll	646		GetOEMCP
KERNEL32.dll	882		IsValidCodePage
KERNEL32.dll	815		HeapAlloc
KERNEL32.dll	918		LCMapStringW
KERNEL32.dll	850		InterlockedExchange
KERNEL32.dll	1196		RtlUnwind
KERNEL32.dll	1275		SetFilePointer
KERNEL32.dll	476		GetConsoleCP
KERNEL32.dll	494		GetConsoleMode
KERNEL32.dll	977		MultiByteToWideChar
KERNEL32.dll	709		GetStringTypeW
KERNEL32.dll	824		HeapSize
KERNEL32.dll	822		HeapReAlloc
KERNEL32.dll	877		IsProcessorFeaturePresent
KERNEL32.dll	1312		SetStdHandle
KERNEL32.dll	1502		WriteConsoleW
KERNEL32.dll	402		FlushFileBuffers
KERNEL32.dll	194		CreateFileW
KERNEL32.dll	942		LocalAlloc
KERNEL32.dll	933		LoadLibraryA
KERNEL32.dll	1087		RaiseException
KERNEL32.dll	186		CreateFileA
KERNEL32.dll	593		GetLocalTime
KERNEL32.dll	465		GetComputerNameW
KERNEL32.dll	1544		lstrlenA
KERNEL32.dll	410		FormatMessageW
KERNEL32.dll	724		GetSystemTime
KERNEL32.dll	761		GetTimeZoneInformation
KERNEL32.dll	1372		SystemTimeToTzSpecificLocalTime
KERNEL32.dll	674		GetProcessHeap
KERNEL32.dll	266		DeleteFileW
KERNEL32.dll	565		GetFileAttributesW
KERNEL32.dll	371		FindFirstFileW
KERNEL32.dll	383		FindNextFileW
KERNEL32.dll	360		FindClose
KERNEL32.dll	1172		RemoveDirectoryW
KERNEL32.dll	515		GetCurrentDirectoryW
KERNEL32.dll	1250		SetCurrentDirectoryW
KERNEL32.dll	791		GlobalAlloc
KERNEL32.dll	798		GlobalFree
KERNEL32.dll	1276		SetFilePointerEx
KERNEL32.dll	1103		ReadFile
KERNEL32.dll	970		MoveFileExW
KERNEL32.dll	287		DuplicateHandle
KERNEL32.dll	1257		SetEndOfFile
KERNEL32.dll	282		DosDateTimeToFileTime
KERNEL32.dll	944		LocalFileTimeToFileTime
KERNEL32.dll	1279		SetFileTime
KERNEL32.dll	772		GetVersionExA
KERNEL32.dll	612		GetModuleHandleA
KERNEL32.dll	347		FileTimeToDosDateTime
KERNEL32.dll	348		FileTimeToLocalFileTime
KERNEL32.dll	349		FileTimeToSystemTime
KERNEL32.dll	720		GetSystemInfo
KERNEL32.dll	179		CreateEventA
KERNEL32.dll	338		ExitThread
SHLWAPI.dll	141		PathRemoveExtensionW
OLEAUT32.dll		2
OLEAUT32.dll		9

ord	entry_va	function_name
1	0x2d000	?dwPlaceholder@@3PAEA
2	0xa9ec	_DecodePointerInternal@4
3	0xa9d1	_EncodePointerInternal@4

module_name	boxstub.exe
flags	0
timestamp	2017-11-10 18:50:38
version	0.0
ordinal_base	1
nFunctions	3
nNames	3
Names(3)	0x271f4
Functions(3)	0x271e8
NameOrdinals(3)	0x27200

StringTable 040904b0

CompanyName	Microsoft Corporation
FileDescription	Visual Studio Installer
FileVersion	15.9.28307.518
InternalName	vs_community.exe
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	vs_community.exe
ProductName	Microsoft Visual Studio
ProductVersion	15.9.28307.518

VS_FIXEDFILEINFO

FileVersion	15.9.28307.518
ProductVersion	15.9.28307.518
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Code Signing PCA

serial: 33000001B1DDEDBA54E965B85F0001000001B1

Certificates (4)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Signing PCA
        Validity
            Not Before: Jul 12 20:11:19 2018 GMT
            Not After : Jul 26 20:11:19 2019 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:9b:52:be:4f:2c:b4:1d:53:cb:3d:5d:23:1e:b6:
                    83:a3:9f:c0:e5:4a:e0:57:b3:c2:f8:2d:d6:8a:91:
                    5f:cc:12:ce:0c:dd:02:b7:46:78:f4:6b:9b:de:e7:
                    cb:20:21:8f:d4:3e:0e:25:94:72:3a:78:63:66:2e:
                    b5:5f:e1:db:97:fd:88:8e:a8:88:97:55:4c:1d:1e:
                    3e:a9:69:49:2d:13:63:f9:7e:c3:a5:aa:d3:bf:7f:
                    c2:07:39:21:30:66:36:95:97:6f:a7:de:ab:a5:12:
                    f6:85:e9:68:28:69:26:9b:1a:9e:b7:af:ec:53:78:
                    6f:c3:cc:31:30:87:f6:f7:36:2b:30:40:59:48:46:
                    80:51:a8:cd:0c:80:dd:e3:4a:9e:2d:74:55:ec:e6:
                    a7:44:7a:d5:13:be:f4:c2:24:7d:0c:fd:33:cd:e6:
                    23:5f:9a:cd:d4:29:6d:02:d5:32:5a:6a:27:cf:b0:
                    c9:01:8b:94:af:e5:0c:8b:7a:1f:7d:22:13:83:86:
                    f2:5a:4b:d3:84:63:57:1a:6b:49:78:3a:54:e9:8f:
                    e1:85:c6:e5:3f:96:25:e7:5e:f9:c8:cb:c7:a1:f2:
                    f2:1b:0d:22:5b:b9:2f:fc:8c:e9:db:28:c4:55:17:
                    b6:e8:f4:d7:7a:cf:fd:9c:d3:8f:ee:e9:76:2a:82:
                    8c:a1
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                Code Signing
            X509v3 Subject Key Identifier: 
                44:13:B4:02:9D:77:3E:90:55:71:F5:E4:1C:7F:AC:17:14:CF:3E:73
            X509v3 Subject Alternative Name: 
                DirName:/OU=Microsoft Operations Puerto Rico/serialNumber=229803+437950
            X509v3 Authority Key Identifier: 
                keyid:CB:11:E8:CA:D2:B4:16:58:01:C9:37:2E:33:16:16:B9:4C:9A:0A:1F

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt

    Signature Algorithm: sha1WithRSAEncryption
         83:a9:f2:a6:33:c5:a1:7b:1c:d2:5e:80:ae:ec:a4:a6:c3:e9:
         28:5d:57:25:23:8d:dd:25:09:69:70:e8:4d:69:16:2f:94:bb:
         05:d9:9b:80:ec:59:d0:68:64:1b:83:34:a8:dc:cf:63:8d:9d:
         6b:76:00:f5:7b:af:42:74:07:c5:fc:91:c0:e2:ac:45:33:96:
         5d:b1:fd:fa:8e:46:b2:49:e2:43:06:19:98:85:71:78:d3:9e:
         e9:db:95:16:41:31:34:70:2c:43:96:a2:02:77:a9:2f:3d:61:
         4a:63:59:f1:97:7d:d1:52:95:60:85:a8:bc:1b:45:07:3f:d9:
         c1:8f:f7:50:f5:b9:7e:08:89:e4:42:c4:58:8e:41:c0:95:38:
         49:1f:d7:1d:f8:30:4f:29:2f:3b:47:59:92:37:ee:97:21:ed:
         17:66:90:1c:2f:2d:6d:6b:ff:0b:75:e5:aa:12:dd:fa:af:c4:
         11:b4:e0:21:32:5a:bf:05:ce:45:f9:3f:8d:56:ae:ce:51:d6:
         cc:ae:7d:04:19:30:12:f2:bf:9f:48:26:9c:0e:00:0d:28:ad:
         a5:de:44:2d:cc:d4:87:ff:94:49:95:57:0c:4d:34:9c:23:0a:
         dd:c3:8d:32:09:f4:bd:35:28:c5:de:d0:88:3f:a9:12:13:a1:
         30:70:a0:11

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:fd:c7:f0:c9:6a:69:a1:c8:4c:00:00:00:00:00:fd
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Time-Stamp PCA
        Validity
            Not Before: Aug 23 20:20:11 2018 GMT
            Not After : Nov 23 20:20:11 2019 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft Operations Puerto Rico, OU=Thales TSS ESN:5847-F761-4F70, CN=Microsoft Time-Stamp Service
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:ba:09:81:3d:a8:c1:a7:36:34:64:75:e3:50:38:
                    82:f4:07:c0:90:85:74:1d:af:00:b6:6c:73:17:d2:
                    65:57:cb:02:89:6e:a9:f8:80:aa:42:a0:4c:66:b3:
                    c9:3f:e6:69:92:13:d9:85:88:79:1e:de:c6:81:ab:
                    6e:46:b4:02:ae:2e:e8:7d:55:aa:ef:34:eb:50:0b:
                    b0:d8:a3:31:3c:03:0c:dd:60:91:47:f1:33:0e:22:
                    5b:33:7b:33:66:e2:0d:34:fe:f1:d6:24:55:8b:0d:
                    da:fe:4e:21:86:c9:ab:83:c7:f1:03:df:58:7c:7f:
                    e3:25:94:c6:d9:dc:a1:54:a4:29:28:29:e2:3e:3d:
                    14:24:17:e7:ec:d1:eb:de:91:ac:cf:d6:da:cf:5f:
                    c6:2d:f7:1a:b9:65:0b:1d:1a:c5:e6:85:fa:2a:e2:
                    d1:45:a4:d6:d1:ad:97:9d:c1:de:0d:68:5b:e7:58:
                    ce:19:fd:05:3c:a2:72:f4:2d:c1:64:e9:c8:d6:c0:
                    52:b7:e1:7f:de:4b:46:5b:10:75:5f:55:4c:39:d9:
                    46:52:74:e9:ec:c3:e5:6b:79:57:f0:4c:a3:4c:41:
                    c5:7c:31:e8:a6:89:9a:7d:cb:95:1b:2c:19:ac:ed:
                    83:dd:b6:00:49:29:a0:59:d9:b8:cc:f0:c9:df:f3:
                    91:f3
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                2C:FB:AA:6D:80:5F:E1:33:B5:64:B8:12:10:34:43:DB:FD:E9:0E:D8
            X509v3 Authority Key Identifier: 
                keyid:23:34:F8:D9:52:46:70:0A:ED:40:FB:76:FB:B3:2B:B0:C3:35:B3:0F

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt

            X509v3 Extended Key Usage: 
                Time Stamping
    Signature Algorithm: sha1WithRSAEncryption
         4f:5a:af:5d:c1:08:4b:cd:21:d6:2b:41:a2:8f:fc:8d:82:96:
         58:56:94:19:60:1f:37:21:5f:b3:7c:50:f2:04:40:0d:4b:c1:
         8a:3a:49:03:4b:ed:16:3c:a1:39:92:69:1a:9d:ef:f1:04:51:
         e5:2f:b9:bc:29:9a:ad:db:d3:ae:45:29:e8:a4:16:70:f7:07:
         5c:a7:30:99:10:47:b7:b1:b2:7e:a7:24:df:82:19:e0:70:7d:
         fe:d3:d0:63:d3:8e:ab:6b:cd:8b:99:3b:56:4c:e7:f3:23:25:
         54:4d:76:0f:65:da:53:34:5f:75:ed:61:75:f2:20:2d:38:7c:
         2a:6b:be:89:a2:02:80:0c:3e:02:b7:ab:99:21:a1:03:65:77:
         38:e3:fa:ee:b5:70:4a:3e:d3:86:dc:5d:a2:11:b3:da:b0:d7:
         97:f8:d9:75:ac:31:c3:7a:11:6b:49:22:61:18:01:b4:d5:d2:
         26:2d:f8:a0:b5:64:6e:5a:4a:5b:3a:ca:da:c4:30:be:7a:b8:
         df:4a:8a:a7:97:cf:b8:54:4b:3c:3f:62:53:f2:86:34:ce:09:
         95:fe:fc:93:21:c0:c9:a4:04:2f:d9:3d:b0:aa:27:d6:46:2b:
         86:46:cd:6b:0c:f7:df:ad:50:ad:99:b8:e9:7c:e6:d4:cb:d0:
         24:d4:d5:8f

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:33:26:1a:00:00:00:00:00:31
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
        Validity
            Not Before: Aug 31 22:19:32 2010 GMT
            Not After : Aug 31 22:29:32 2020 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Code Signing PCA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b2:72:59:5c:19:30:64:bf:1d:9a:60:20:20:42:
                    99:76:53:6c:3e:1b:d6:6f:cc:cb:f1:ea:6b:fe:97:
                    16:10:e0:df:3a:74:83:1a:b7:2f:a0:32:ec:ff:de:
                    c2:42:4e:23:d5:72:00:db:35:57:0a:89:ca:ae:20:
                    49:f4:f0:68:ac:4d:4b:8d:a5:bd:79:4b:71:9b:47:
                    07:da:fd:25:df:9d:75:88:cf:aa:73:44:7f:d7:81:
                    db:f3:bd:f2:36:a4:c9:5c:45:dc:af:ad:3d:e0:28:
                    68:97:1a:a7:a5:72:73:56:f1:17:94:e4:fd:35:94:
                    72:a0:d6:76:5f:1e:77:45:83:85:38:16:d0:73:5b:
                    05:ba:67:52:8d:a5:b2:69:2f:da:19:0b:fe:92:74:
                    29:e2:76:2f:54:dd:14:30:59:f8:d2:8d:62:fd:cb:
                    c9:5f:46:31:50:b9:27:13:e4:40:30:cf:72:29:10:
                    28:22:c7:37:4e:3d:a0:32:3d:90:cd:a1:38:06:85:
                    5c:4e:56:82:28:2a:05:32:b7:4b:d7:4f:63:e7:d2:
                    2d:62:f1:45:3d:e7:ac:08:00:f6:46:a1:9e:d1:5b:
                    8c:26:53:e8:7a:aa:4a:f2:46:cf:37:3c:38:9e:b4:
                    77:5c:a5:17:9e:8d:cb:11:8f:56:3c:c1:ac:09:5f:
                    03:d3
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier: 
                CB:11:E8:CA:D2:B4:16:58:01:C9:37:2E:33:16:16:B9:4C:9A:0A:1F
            X509v3 Key Usage: 
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1: 
                .....
            1.3.6.1.4.1.311.21.2: 
                ....1N.&....`;.1o.<..-
            1.3.6.1.4.1.311.20.2: 
                .
.S.u.b.C.A
            X509v3 Authority Key Identifier: 
                keyid:0E:AC:82:60:40:56:27:97:E5:25:13:FC:2A:E1:0A:53:95:59:E4:A4

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt

    Signature Algorithm: sha1WithRSAEncryption
         59:39:3e:7f:26:46:af:eb:6f:40:b1:32:b5:6a:eb:0e:2f:6e:
         a8:49:f7:eb:5f:75:ed:4c:3b:2d:d7:43:ad:0b:fe:cb:e9:2d:
         31:a3:23:cc:7c:50:98:80:21:5d:ac:3d:2f:4c:ba:a2:a8:56:
         9c:e3:70:bb:b8:b4:f8:79:b5:49:72:f7:3e:ea:41:7f:ca:e1:
         0c:17:69:cb:a5:9c:20:2d:fa:0b:50:c4:56:cd:2d:e3:4a:d2:
         bc:70:e7:a8:0d:a2:03:a5:56:e0:b8:8a:4b:57:f2:95:42:9c:
         f1:f3:ef:ee:e3:86:1f:34:3c:b8:56:9a:f0:53:23:85:2a:a4:
         82:1c:93:e2:94:07:1d:f2:e2:4e:f8:8c:a1:ca:e8:13:a5:91:
         4e:c8:1b:d2:8f:72:95:2a:71:6d:9b:1a:f8:1c:f0:53:d6:67:
         cc:22:ff:5c:1d:cd:a2:8c:bd:27:b2:79:63:56:44:a2:51:cd:
         f9:e9:a3:58:56:dd:9b:02:45:44:2f:5f:f4:da:ae:d4:82:32:
         6e:fc:a4:95:13:e4:eb:69:e7:a9:a2:2c:be:c8:2b:10:0e:65:
         8e:99:db:f5:a2:fa:12:26:09:65:38:94:f1:7a:1f:4a:bb:d1:
         e1:56:e8:d0:78:96:18:5c:c9:35:16:5f:dd:93:1d:49:8e:2d:
         be:ad:34:44:1c:ee:10:15:1a:00:5d:dd:35:5b:21:ce:98:c7:
         09:ee:85:0e:8c:4f:6d:0e:13:4e:3d:7c:29:48:9c:72:d1:f3:
         6c:ca:c1:ec:70:a3:57:92:57:7d:94:8d:a0:1b:48:03:5a:f7:
         cf:a3:67:0a:74:a5:36:ed:2d:2f:17:c8:e6:72:37:12:f4:6f:
         b1:3c:67:82:f9:52:b2:8d:33:16:65:1e:0e:8a:dd:10:de:64:
         f4:6f:ce:46:d4:d3:17:e9:79:c4:04:b4:d3:fb:2c:df:1f:8a:
         9e:ac:0a:fb:13:27:40:ad:e4:f9:e1:a9:7f:46:bb:07:60:47:
         65:60:40:4e:b0:42:ec:4e:ed:b3:76:79:d8:0a:34:09:6d:1c:
         80:31:1f:e2:0e:54:dd:e5:a1:fb:e5:47:10:ad:64:98:ff:50:
         16:2e:7c:bf:05:21:7a:e2:95:41:27:69:c3:93:8f:95:c9:8d:
         d8:9b:21:ae:0d:5c:9c:f0:a2:ae:86:68:83:0c:6a:2d:bb:76:
         6b:00:1d:96:ad:f2:16:7b:f6:16:83:24:b9:88:cf:6a:a8:47:
         31:2f:9a:dc:e3:71:3d:d7:00:7e:62:47:d1:ce:88:c9:b8:18:
         fa:0e:72:8d:c1:a3:3d:af:02:40:6a:ff:69:9b:96:e2:10:a8:
         10:b4:37:50:08:d6:c3:3d

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:16:68:34:00:00:00:00:00:1c
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority
        Validity
            Not Before: Apr  3 12:53:09 2007 GMT
            Not After : Apr  3 13:03:09 2021 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Time-Stamp PCA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:9f:a1:6c:b1:df:db:48:92:2a:7c:6b:2e:19:e1:
                    bd:e2:e3:c5:99:51:23:50:ad:ce:dd:18:4e:24:0f:
                    ee:d1:a7:d1:4c:ad:74:30:20:11:eb:07:d5:54:95:
                    15:49:94:1b:42:92:ae:98:5c:30:26:da:00:6b:e8:
                    7b:bd:ec:89:07:0f:f7:0e:04:98:f0:89:cc:1f:cb:
                    33:24:87:9d:f2:f4:67:1c:2c:fc:7b:e7:88:1d:ea:
                    e7:4e:a3:a1:c1:23:53:ca:8d:fa:45:cf:09:d0:5e:
                    af:d0:b0:42:04:a2:f9:a6:6c:93:67:d7:28:dc:46:
                    53:b0:86:d0:e5:28:46:2e:27:ac:86:4f:55:52:0c:
                    e4:03:2c:fb:6a:90:90:30:6e:87:f3:59:30:9d:fa:
                    7e:d6:97:b3:e8:21:97:7e:f8:d2:13:f3:08:b7:53:
                    6d:52:b4:45:90:9f:48:00:4a:47:66:11:27:29:66:
                    a8:97:e4:d3:06:81:4a:a2:f9:84:a7:11:47:14:09:
                    82:9f:84:ed:55:78:fe:01:9a:1d:50:08:85:00:10:
                    30:46:ed:b7:de:23:46:bb:c4:2d:54:9f:af:1e:78:
                    41:31:77:cc:9b:df:3b:83:93:a1:61:02:b5:1d:0d:
                    b1:fc:f7:9b:b2:01:ce:22:4b:54:ff:f9:05:c3:c2:
                    20:0b
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier: 
                23:34:F8:D9:52:46:70:0A:ED:40:FB:76:FB:B3:2B:B0:C3:35:B3:0F
            X509v3 Key Usage: 
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1: 
                ...
            X509v3 Authority Key Identifier: 
                keyid:0E:AC:82:60:40:56:27:97:E5:25:13:FC:2A:E1:0A:53:95:59:E4:A4
                DirName:/DC=com/DC=microsoft/CN=Microsoft Root Certificate Authority
                serial:79:AD:16:A1:4A:A0:A5:AD:4C:73:58:F4:07:13:2E:65

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl

            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt

            X509v3 Extended Key Usage: 
                Time Stamping
    Signature Algorithm: sha1WithRSAEncryption
         10:97:8a:c3:5c:03:44:36:dd:e9:b4:ad:77:db:ce:79:51:4d:
         01:b1:2e:74:71:5b:6d:0c:13:ab:ce:be:7b:8f:b8:2e:d4:12:
         a2:8c:6d:62:b8:57:02:cb:4e:20:13:50:99:dd:7a:40:e2:57:
         bb:af:58:9a:1c:e1:1d:01:86:ac:bb:78:f2:8b:d0:ec:3b:01:
         ee:e2:be:8f:0a:05:c8:8d:48:e2:f0:53:15:dd:4f:ab:92:e4:
         e7:8d:6a:d5:80:c1:e6:94:f2:06:2f:85:03:e9:91:2a:24:22:
         70:fb:f6:fc:e4:78:99:2e:0d:f7:07:e2:70:bc:18:4e:9d:8e:
         6b:0a:72:95:b8:a1:39:9c:67:2d:c5:51:0e:ea:62:5c:3f:16:
         98:8b:20:3f:e2:07:1a:32:f9:cc:31:4a:76:31:3d:2b:72:0b:
         c8:ea:70:3d:ff:85:0a:13:df:c2:0a:61:8e:f0:d7:b8:17:eb:
         4e:8b:7f:c5:35:2b:5e:a3:bf:eb:bc:7d:0b:42:7b:d4:53:72:
         21:ee:30:ca:bb:78:65:5c:5b:01:17:0a:14:0e:d2:da:14:98:
         f5:3c:b9:66:58:b3:2d:2f:e7:f9:85:86:cc:51:56:e8:9d:70:
         94:6c:ac:39:4c:d4:f6:79:bf:aa:18:7a:62:29:ef:a2:9b:29:
         34:06:77:1a:62:c9:3d:1e:6d:1f:82:f0:0b:c7:2c:bb:cf:43:
         b3:e5:f9:ec:7d:b5:e3:a4:a8:74:35:b8:4e:c5:71:23:12:26:
         76:0b:3c:52:8c:71:5a:46:43:14:bc:b3:b3:b0:4d:67:c8:9f:
         42:ff:80:79:21:80:9e:15:30:66:e8:42:12:5e:1a:c8:9e:22:
         21:d0:43:e9:2b:e9:bb:f4:48:cc:2c:d4:d8:32:80:4c:26:2a:
         48:24:5f:5a:ea:56:ef:a6:de:99:9d:ca:3a:6f:bd:81:27:74:
         06:11:ee:76:21:bf:9b:82:c1:27:54:b6:b1:6a:3d:89:a1:76:
         61:b4:6e:a1:13:a6:bf:aa:47:f0:12:6f:fd:8a:32:6c:b2:fe:
         df:51:c8:8c:23:c9:66:bd:9d:1d:87:12:64:02:3d:2d:af:59:
         8f:b8:e4:21:e5:b5:b0:ca:63:b4:78:54:05:d4:41:2e:50:ac:
         94:b0:a5:78:ab:b3:a0:96:75:1a:d9:92:87:13:75:22:2f:32:
         a8:08:6e:a0:5b:8c:25:bf:a0:ef:84:ca:21:d6:eb:1e:4f:c9:
         9a:ee:49:e0:f7:01:65:6f:89:0b:7d:c8:69:c8:e6:6e:ea:a7:
         97:ce:31:29:ff:0e:c5:5b:5c:d8:4d:1b:a1:d8:fa:2f:9e:3f:
         2e:55:16:6b:c9:13:a3:fd

undefined method `first' for #

show previews

offset	size	type	comment
0	230912	EXE	11/10/2017 18:50:40	#
15c1	15	HTM		#
28f70	5604	PNG	(256 x 256)	#
38600	1054976	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 1285888 bytes (1256 KiB)


--
Type = PE
Physical Size = 1285888
CPU = x86
Characteristics = Executable 32-bit LargeAddress
Created = 2017-11-10 18:50:40
Headers Size = 1024
Checksum = 1344165
Name = vs_community.exe
Image Size = 253952
Section Alignment = 4096
File Alignment = 512
Code Size = 156672
Initialized Data Size = 73216
Uninitialized Data Size = 0
Linker Version = 10.0
OS Version = 5.1
Image Version = 10.0
Subsystem Version = 5.1
Subsystem = Windows GUI
DLL Characteristics = Relocated NX-Compatible TerminalServerAware
Stack Reserve = 1048576
Stack Commit = 8192
Heap Reserve = 1048576
Heap Commit = 4096
Image Base = 4194304
Comment = FileVersion: 15.9.28307.518
ProductVersion: 15.9.28307.518
CompanyName: Microsoft Corporation
FileDescription: Visual Studio Installer
InternalName: vs_community.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: vs_community.exe
ProductName: Microsoft Visual Studio
----
Path = [0]
Size = 1039000
Packed Size = 1039000
Virtual Size = 1039000
Offset = 230912
--
Path = [0]
Type = 7z
Offset = 164
Physical Size = 1038835
Tail Size = 1
Headers Size = 966
Method = LZMA:6m BCJ2
Solid = +
Blocks = 1

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2019-01-16 12:00:49 ....A        12867      1037869  vs_bootstrapper_d15/HelpFile/1028/help.html
2019-01-16 12:00:49 ....A        12903               vs_bootstrapper_d15/HelpFile/2052/help.html
2019-01-16 12:00:49 ....A        14276               vs_bootstrapper_d15/HelpFile/1029/help.html
2019-01-16 12:00:49 ....A        14283               vs_bootstrapper_d15/HelpFile/1036/help.html
2019-01-16 12:00:49 ....A        14336               vs_bootstrapper_d15/HelpFile/3082/help.html
2019-01-16 12:00:49 ....A        14447               vs_bootstrapper_d15/HelpFile/1040/help.html
2019-01-16 12:00:49 ....A        14709               vs_bootstrapper_d15/HelpFile/1031/help.html
2019-01-16 12:00:49 ....A        15280               vs_bootstrapper_d15/HelpFile/1033/help.html
2019-01-16 12:00:49 ....A        13935               vs_bootstrapper_d15/HelpFile/1055/help.html
2019-01-16 12:00:49 ....A        14175               vs_bootstrapper_d15/HelpFile/1046/help.html
2019-01-16 12:00:49 ....A        14242               vs_bootstrapper_d15/HelpFile/1042/help.html
2019-01-16 12:00:49 ....A        14921               vs_bootstrapper_d15/HelpFile/1045/help.html
2019-01-16 12:00:49 ....A        16460               vs_bootstrapper_d15/HelpFile/1041/help.html
2019-01-16 12:00:49 ....A        18019               vs_bootstrapper_d15/HelpFile/1049/help.html
2019-01-04 06:11:14 ....A       272496               vs_bootstrapper_d15/vs_setup_bootstrapper.exe
2019-01-04 06:11:12 ....A       159504               vs_bootstrapper_d15/Microsoft.Diagnostics.Tracing.EventSource.dll
2019-01-04 06:11:12 ....A        55440               vs_bootstrapper_d15/Microsoft.VisualStudio.RemoteControl.dll
2019-01-04 06:11:12 ....A       311864               vs_bootstrapper_d15/Microsoft.VisualStudio.Setup.Common.dll
2019-01-04 06:11:12 ....A        28928               vs_bootstrapper_d15/Microsoft.VisualStudio.Setup.Configuration.Interop.dll
2019-01-04 06:11:14 ....A       624184               vs_bootstrapper_d15/Microsoft.VisualStudio.Setup.dll
2019-01-04 06:11:14 ....A        85256               vs_bootstrapper_d15/Microsoft.VisualStudio.Setup.Download.dll
2019-01-04 06:11:14 ....A       238136               vs_bootstrapper_d15/Microsoft.VisualStudio.Setup.Engine.dll
2019-01-04 06:11:14 ....A       793720               vs_bootstrapper_d15/Microsoft.VisualStudio.Telemetry.dll
2019-01-04 06:11:14 ....A        41104               vs_bootstrapper_d15/Microsoft.VisualStudio.Utilities.Internal.dll
2019-01-04 06:11:14 ....A       526336               vs_bootstrapper_d15/Newtonsoft.Json.dll
2019-01-04 06:11:14 ....A        65592               vs_bootstrapper_d15/zh-Hans/vs_setup_bootstrapper.resources.dll
2019-01-04 06:11:14 ....A        66104               vs_bootstrapper_d15/zh-Hant/vs_setup_bootstrapper.resources.dll
2019-01-04 06:11:14 ....A        66616               vs_bootstrapper_d15/cs/vs_setup_bootstrapper.resources.dll
2019-01-04 06:11:14 ....A        66616               vs_bootstrapper_d15/pt-BR/vs_setup_bootstrapper.resources.dll
2019-01-04 06:11:14 ....A        66616               vs_bootstrapper_d15/tr/vs_setup_bootstrapper.resources.dll
2019-01-04 06:11:14 ....A        66824               vs_bootstrapper_d15/es/vs_setup_bootstrapper.resources.dll
2019-01-04 06:11:14 ....A        67128               vs_bootstrapper_d15/de/vs_setup_bootstrapper.resources.dll
2019-01-04 06:11:14 ....A        67128               vs_bootstrapper_d15/fr/vs_setup_bootstrapper.resources.dll
2019-01-04 06:11:14 ....A        67128               vs_bootstrapper_d15/it/vs_setup_bootstrapper.resources.dll
2019-01-04 06:11:14 ....A        67128               vs_bootstrapper_d15/pl/vs_setup_bootstrapper.resources.dll
2019-01-04 06:11:14 ....A        67640               vs_bootstrapper_d15/ko/vs_setup_bootstrapper.resources.dll
2019-01-04 06:11:14 ....A        68664               vs_bootstrapper_d15/ja/vs_setup_bootstrapper.resources.dll
2019-01-04 06:11:14 ....A        69176               vs_bootstrapper_d15/ru/vs_setup_bootstrapper.resources.dll
2019-03-07 05:18:14 ....A          599               vs_bootstrapper_d15/vs_setup_bootstrapper.config
2019-01-04 06:11:14 ....A         1095               vs_bootstrapper_d15/vs_setup_bootstrapper.exe.config
2019-01-04 06:11:12 ....A         8448               vs_bootstrapper_d15/detection.json
2019-03-07 05:18:14 ....A          162               vs_bootstrapper_d15/vs_setup_bootstrapper.json
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/zh-Hant
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/zh-Hans
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/tr
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/ru
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/pt-BR
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/pl
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/ko
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/ja
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/it
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/HelpFile/3082
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/HelpFile/2052
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/HelpFile/1055
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/HelpFile/1049
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/HelpFile/1046
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/HelpFile/1045
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/HelpFile/1042
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/HelpFile/1041
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/HelpFile/1040
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/HelpFile/1036
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/HelpFile/1033
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/HelpFile/1031
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/HelpFile/1029
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/HelpFile/1028
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/HelpFile
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/fr
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/es
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/de
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15/cs
2019-03-07 05:18:14 D....            0            0  vs_bootstrapper_d15
------------------- ----- ------------ ------------  ------------------------
2019-03-07 05:18:14            4224485      1037869  42 files, 29 folders

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

vs_community__1597297045.1551201238.exe- vs_community.exe - Visual Studio Installer

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904b0

VS_FIXEDFILEINFO

Signers (1)

Certificates (4)

vs_community__1597297045.1551201238.exe
- vs_community.exe - Visual Studio Installer