uTorrent.exe - µTorrent

info
MZ
PE
resources
imports
foremost
version info
signature
hexdump
disasm
log
discuss
donate

filename	uTorrent.exe
size	740216 (0xb4b78)
md5	bb6da792792a5ac450174f10756eec15

type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x118

Rich Header

lib id	version	times used
19	8022	15
123	50727	2
93	2179	2
0	0	29
19	8034	20
1	0	597
4	8047	3
12	7291	1
14	7299	2
10	8047	11
149	21022	13
132	30729	222
131	30729	38
148	30729	1
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x4f457844
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x103
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0x98000
SizeOfInitializedData	0x1c000
SizeOfUninitializedData	0x46d000
AddressOfEntryPoint	0x505340
BaseOfCode	0x46e000
BaseOfData	0x506000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0x522000
SizeOfHeaders	0x1000
CheckSum	0xbad6f
Subsystem	2
DllCharacteristics	0x8140
SizeOfStackReserve	0x2dc6c0
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

UPX v3.0 (EXE_LZMA) (Markus Oberhumer & Laszlo Molnar & John Reiser)

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
UPX0	0x1000	0x46d000	0	RWX UDATA
UPX1	0x46e000	0x98000	0x98000	RWX IDATA
.rsrc	0x506000	0x1c000	0x1b200	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x520d1c	0x330
RESOURCE	0x506000	0x1ad1c
EXCEPTION	0	0
SECURITY	0xb3600	0x1578
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
BITMAP	#11	16936
BITMAP	#267	2090
ICON	#1	4264
ICON	#2	2216
ICON	#3	9640
ICON	#4	9640
ICON	#5	9640
ICON	#6	9640
ICON	#7	9640
ICON	#8	9640
ICON	#9	9640
ICON	#10	9640
ICON	#11	4264
ICON	#12	18280
ICON	#13	1128
ICON	#14	4264
ICON	#15	9640
ICON	#16	18280
ICON	#17	2216
ICON	#18	2216
ICON	#19	2216
ICON	#20	1512
ICON	#21	36200
ICON	#22	9640
ICON	#23	9640
ICON	#24	3240
ICON	#25	3240
ICON	#26	3240
ICON	#27	8136
ICON	#28	1128
ICON	#29	4264
ICON	#30	9640
ICON	#31	16936
ICON	#32	67624
ICON	#33	2216
ICON	#34	1384
ICON	#35	296
ICON	#36	2216
ICON	#37	2216
ICON	#38	1128
ICON	#39	1128
ICON	#40	1128
DIALOG	#3	188
DIALOG	#10	114
DIALOG	#11	120
DIALOG	#12	120
DIALOG	#13	120
DIALOG	#14	226
DIALOG	#15	120
DIALOG	#16	120
DIALOG	#18	64
DIALOG	#19	252
DIALOG	#20	860
DIALOG	#21	864
DIALOG	#22	896
DIALOG	#24	576
DIALOG	#25	356
DIALOG	#26	704
DIALOG	#27	344
DIALOG	#29	384
DIALOG	#30	128
DIALOG	#31	800
DIALOG	#32	256
DIALOG	#34	192
DIALOG	#35	96
DIALOG	#37	188
DIALOG	#41	864
DIALOG	#42	768
DIALOG	#43	320
DIALOG	#44	800
DIALOG	#45	608
DIALOG	#46	1648
DIALOG	#47	544
DIALOG	#48	128
DIALOG	#49	326
DIALOG	#50	96
DIALOG	#51	396
DIALOG	#52	320
DIALOG	#231	152
DIALOG	#232	952
DIALOG	#233	416
DIALOG	#234	704
DIALOG	#235	544
DIALOG	#236	372
DIALOG	#237	96
DIALOG	#238	288
DIALOG	#240	160
DIALOG	#242	352
DIALOG	#243	736
DIALOG	#244	500
DIALOG	#245	688
DIALOG	#246	320
DIALOG	#248	1320
DIALOG	#249	224
DIALOG	#252	192
DIALOG	#253	580
DIALOG	#254	224
DIALOG	#255	224
DIALOG	#257	160
DIALOG	#259	592
DIALOG	#269	224
DIALOG	#270	352
DIALOG	#272	288
DIALOG	#273	184
DIALOG	#274	184
DIALOG	#277	96
DIALOG	#278	128
DIALOG	#279	64
DIALOG	#280	376
DIALOG	#288	160
DIALOG	#289	556
DIALOG	#290	224
DIALOG	#291	984
DIALOG	#308	64
DIALOG	#309	184
DIALOG	#310	204
DIALOG	#311	96
DIALOG	#313	64
DIALOG	#316	352
DIALOG	#329	192
DIALOG	#1048	64
DIALOG	#1175	96
DIALOG	#1496	64
DIALOG	#1512	340
DIALOG	#1516	288
DIALOG	#1517	344
DIALOG	#1574	96
DIALOG	#1575	64
DIALOG	#1630	256
DIALOG	#1649	204
GROUP_ICON	#2	76
GROUP_ICON	#5	20
GROUP_ICON	#244	20
GROUP_ICON	#248	20
GROUP_ICON	#249	20
GROUP_ICON	#250	20
GROUP_ICON	#252	20
GROUP_ICON	#253	20
GROUP_ICON	#256	20
GROUP_ICON	#276	20
GROUP_ICON	#300	20
GROUP_ICON	#301	20
GROUP_ICON	#302	20
GROUP_ICON	#303	20
GROUP_ICON	#304	20
GROUP_ICON	#305	20
GROUP_ICON	#306	20
GROUP_ICON	#307	20
GROUP_ICON	#310	20
GROUP_ICON	#311	20
GROUP_ICON	#312	48
GROUP_ICON	#314	20
GROUP_ICON	#317	20
GROUP_ICON	#320	20
GROUP_ICON	#321	20
GROUP_ICON	#322	20
GROUP_ICON	#323	20
GROUP_ICON	#325	20
GROUP_ICON	#328	20
GROUP_ICON	#330	20
GROUP_ICON	#331	20
GROUP_ICON	#332	20
GROUP_ICON	#333	20
GROUP_ICON	#1619	20
VERSION	#1	768
MANIFEST	#1	1254

module_name	ord	function_name
KERNEL32.DLL		LoadLibraryA
KERNEL32.DLL		GetProcAddress
KERNEL32.DLL		VirtualProtect
KERNEL32.DLL		VirtualAlloc
KERNEL32.DLL		VirtualFree
KERNEL32.DLL		ExitProcess
ADVAPI32.dll		FreeSid
COMCTL32.dll	17
comdlg32.dll		GetSaveFileNameW
GDI32.dll		SaveDC
MSIMG32.dll		GradientFill
MSVCRT.dll		atoi
ole32.dll		OleCreate
OLEAUT32.dll	2
PSAPI.DLL		GetProcessMemoryInfo
SETUPAPI.dll		SetupDiGetClassDevsW
SHELL32.dll		DragFinish
USER32.dll		GetDC
WS2_32.dll	56

StringTable 040904E4

CompanyName	BitTorrent, Inc.
FileDescription	µTorrent
FileVersion	3.1.2.26773
InternalName	uTorrent.exe
OriginalFilename	uTorrent.exe
LegalCopyright	©2012 BitTorrent, Inc. All Rights Reserved.
ProductName	µTorrent
ProductVersion	3.1.2.26773

VS_FIXEDFILEINFO

FileVersion	3.1.2.26773
ProductVersion	3.1.2.26773
StrucVersion	0x10000
FileFlagsMask	0
FileFlags	0
FileOS	0
FileType	0
FileSubtype	0

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https:\/\/www.verisign.com\/rpa (c)09/CN=VeriSign Class 3 Code Signing 2009-2 CA

serial: 36BC30562A650AFAA5AD101ECD643AB4

Certificates (4)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
        Validity
            Not Before: Jun 15 00:00:00 2007 GMT
            Not After : Jun 14 23:59:59 2012 GMT
        Subject: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:c4:b5:f2:52:15:bc:88:86:60:29:16:4a:5b:2f:
                    4b:91:6b:87:91:f3:35:54:58:35:ea:d1:36:5e:62:
                    4d:52:51:34:71:c2:7b:66:1d:89:c8:dd:2a:c4:6a:
                    0a:f6:37:d9:98:74:91:f6:92:ae:b0:b5:76:96:f1:
                    a9:4a:63:45:47:2e:6b:0b:92:4e:4b:2b:8c:ee:58:
                    4a:8b:d4:07:e4:1a:2c:f8:82:aa:58:d9:cd:42:f3:
                    2d:c0:75:de:8d:ab:c7:8e:1d:9a:6c:4c:08:95:1e:
                    de:db:ef:67:e1:72:c2:49:c2:9e:60:3c:e1:e2:be:
                    16:a3:63:78:69:14:7b:ad:2d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.verisign.com/tss-ca.crl
            X509v3 Extended Key Usage: critical
                Time Stamping
            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation
            X509v3 Subject Alternative Name: 
                DirName:/CN=TSA1-2
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        50:c5:4b:c8:24:80:df:e4:0d:24:c2:de:1a:b1:a1:02:a1:a6:
        82:2d:0c:83:15:81:37:0a:82:0e:2c:b0:5a:17:61:b5:d8:05:
        fe:88:db:f1:91:91:b3:56:1a:40:a6:eb:92:be:38:39:b0:75:
        36:74:3a:98:4f:e4:37:ba:99:89:ca:95:42:1d:b0:b9:c7:a0:
        8d:57:e0:fa:d5:64:04:42:35:4e:01:d1:33:a2:17:c8:4d:aa:
        27:c7:f2:e1:86:4c:02:38:4d:83:78:c6:fc:53:e0:eb:e0:06:
        87:dd:a4:96:9e:5e:0c:98:e2:a5:be:bf:82:85:c3:60:e1:df:
        ad:28:d8:c7:a5:4b:64:da:c7:1b:5b:bd:ac:39:08:d5:38:22:
        a1:33:8b:2f:8a:9a:eb:bc:07:21:3f:44:41:09:07:b5:65:1c:
        24:bc:48:d3:44:80:eb:a1:cf:c9:02:b4:14:cf:54:c7:16:a3:
        80:5c:f9:79:3e:5d:72:7d:88:17:9e:2c:43:a2:ca:53:ce:7d:
        3d:f6:2a:3a:b8:4f:94:00:a5:6d:0a:83:5d:f9:5e:53:f4:18:
        b3:57:0f:70:c3:fb:f5:ad:95:a0:0e:17:de:c4:16:80:60:c9:
        0f:2b:6e:86:04:f1:eb:f4:78:27:d1:05:c5:ee:34:5b:5e:b9:
        49:32:f2:33

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
        Validity
            Not Before: Dec  4 00:00:00 2003 GMT
            Not After : Dec  3 23:59:59 2013 GMT
        Subject: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:a9:ca:b2:a4:cc:cd:20:af:0a:7d:89:ac:87:75:
                    f0:b4:4e:f1:df:c1:0f:bf:67:61:bd:a3:64:1c:da:
                    bb:f9:ca:33:ab:84:30:89:58:7e:8c:db:6b:dd:36:
                    9e:0f:bf:d1:ec:78:f2:77:a6:7e:6f:3c:bf:93:af:
                    0d:ba:68:f4:6c:94:ca:bd:52:2d:ab:48:3d:f5:b6:
                    d5:5d:5f:1b:02:9f:fa:2f:6b:1e:a4:f7:a3:9a:a6:
                    1a:c8:02:e1:7f:4c:52:e3:0e:60:ec:40:1c:7e:b9:
                    0d:de:3f:c7:b4:df:87:bd:5f:7a:6a:31:2e:03:99:
                    81:13:a8:47:20:ce:31:73:0d:57:2d:cd:78:34:33:
                    95:12:99:12:b9:de:68:2f:aa:e6:e3:c2:8a:8c:2a:
                    c3:8b:21:87:66:bd:83:58:57:6f:75:bf:3c:aa:26:
                    87:5d:ca:10:15:3c:9f:84:ea:54:c1:0a:6e:c4:fe:
                    c5:4a:dd:b9:07:11:97:22:7c:db:3e:27:d1:1e:78:
                    ec:9f:31:c9:f1:e6:22:19:db:c4:b3:47:43:9a:1a:
                    5f:a0:1e:90:e4:5e:f5:ee:7c:f1:7d:ab:62:01:8f:
                    f5:4d:0b:de:d0:22:56:a8:95:cd:ae:88:76:ae:ee:
                    ba:0d:f3:e4:4d:d9:a0:fb:68:a0:ae:14:3b:b3:87:
                    c1:bb
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.verisign.com/ThawteTimestampingCA.crl
            X509v3 Extended Key Usage: 
                Time Stamping
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name: 
                DirName:/CN=TSA2048-1-53
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        4a:6b:f9:ea:58:c2:44:1c:31:89:79:99:2b:96:bf:82:ac:01:
        d6:1c:4c:cd:b0:8a:58:6e:df:08:29:a3:5e:c8:ca:93:13:e7:
        04:52:0d:ef:47:27:2f:00:38:b0:e4:c9:93:4e:9a:d4:22:62:
        15:f7:3f:37:21:4f:70:31:80:f1:8b:38:87:b3:e8:e8:97:00:
        fe:cf:55:96:4e:24:d2:a9:27:4e:7a:ae:b7:61:41:f3:2a:ce:
        e7:c9:d9:5e:dd:bb:2b:85:3e:b5:9d:b5:d9:e1:57:ff:be:b4:
        c5:7e:f5:cf:0c:9e:f0:97:fe:2b:d3:3b:52:1b:1b:38:27:f7:
        3f:4a

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            36:bc:30:56:2a:65:0a:fa:a5:ad:10:1e:cd:64:3a:b4
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https:\/\/www.verisign.com\/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009-2 CA
        Validity
            Not Before: Jun 21 00:00:00 2010 GMT
            Not After : Jul 26 23:59:59 2013 GMT
        Subject: C=US, ST=California, L=San Francisco, O=BitTorrent Inc, OU=Digital ID Class 3 - Microsoft Software Validation v2, CN=BitTorrent Inc
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:b5:77:f6:92:eb:f1:4f:6f:d7:ae:a3:0b:5f:8e:
                    4b:ac:23:e8:4e:65:b1:7f:4d:17:74:b2:63:05:42:
                    47:03:8a:ce:c5:de:11:35:07:aa:1b:cd:32:5b:11:
                    d3:22:d7:e5:99:df:3f:5b:ad:37:8c:17:68:c2:45:
                    82:b0:ed:f2:41:94:57:2a:fa:3b:d7:8d:b9:8c:49:
                    29:07:93:f8:30:73:01:62:04:38:c5:81:d7:af:79:
                    75:13:08:ef:4b:b6:b2:90:38:4d:b9:74:7e:34:4f:
                    99:a5:a5:4a:9b:71:eb:a7:f2:de:c0:55:99:c5:87:
                    7f:fe:47:8c:57:1a:92:d5:ed
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://csc3-2009-2-crl.verisign.com/CSC3-2009-2.crl
            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/rpa
            X509v3 Extended Key Usage: 
                Code Signing
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
                CA Issuers - URI:http://csc3-2009-2-aia.verisign.com/CSC3-2009-2.cer
            X509v3 Authority Key Identifier: 
                97:D0:6B:A8:26:70:C8:A1:3F:94:1F:08:2D:C4:35:9B:A4:A1:1E:F2
            Netscape Cert Type: 
                Object Signing
            1.3.6.1.4.1.311.2.1.27: 
                0.......
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        46:6f:c3:87:7f:56:7b:e8:d5:8c:cb:04:74:8a:3b:6e:04:58:
        e6:79:9a:47:7b:68:bb:22:b9:76:34:6e:cb:ce:d0:45:b1:51:
        da:50:6d:53:7a:aa:c0:29:7c:62:3a:fb:68:54:40:22:5b:19:
        64:40:26:2a:3f:12:53:31:00:11:99:d1:90:14:b4:90:3a:86:
        63:6f:ce:d1:56:bb:98:98:90:3b:5b:a0:a6:b7:a1:2a:11:bb:
        c8:b4:0a:d5:e1:f2:df:0c:af:25:d9:49:87:b0:84:d2:62:93:
        e3:df:1e:98:12:19:c4:ab:05:3d:a8:63:8f:53:90:9b:21:93:
        d0:b1:9a:62:a5:82:88:b8:e3:2a:3e:bc:22:d1:d5:01:6b:df:
        d1:c9:74:86:5e:3c:24:01:a2:cc:69:f1:d6:79:58:9a:0c:24:
        1e:96:c7:6a:0c:4d:a6:3c:4c:fd:7c:30:86:51:68:17:f2:a6:
        0d:ef:20:ed:cb:c4:76:93:81:1f:ca:f9:15:fc:a3:68:1a:7e:
        72:6e:12:88:b9:62:c4:ee:69:77:cf:fd:ad:48:b4:fb:5f:87:
        83:0d:1f:35:b5:86:16:8a:90:20:e9:47:5c:24:fc:13:76:dd:
        3a:7c:d0:0d:27:bf:53:0f:c3:15:ee:17:8b:dd:e5:19:2f:10:
        21:97:d0:0c

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
        Validity
            Not Before: May 21 00:00:00 2009 GMT
            Not After : May 20 23:59:59 2019 GMT
        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https:\/\/www.verisign.com\/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009-2 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:be:67:1d:b4:60:aa:10:49:6f:56:17:7c:66:c9:
                    5e:86:0d:d5:f1:ac:a7:71:83:8e:8b:89:f8:88:04:
                    89:15:06:ba:2d:84:21:95:e4:d1:9c:50:4c:fb:d2:
                    22:bd:da:f2:b2:35:3b:1e:8f:c3:09:fb:fc:13:2e:
                    5a:bf:89:7c:3d:3b:25:1e:f6:f3:58:7b:9c:f4:01:
                    b5:c6:0a:b8:80:ce:be:27:74:61:67:27:4d:6a:e5:
                    ec:81:61:58:79:a3:e0:17:10:12:15:27:b0:e1:4d:
                    34:7f:2b:47:20:44:b9:de:66:24:66:8a:cd:4f:ba:
                    1f:c5:38:c8:54:90:e1:72:f6:19:66:75:6a:b9:49:
                    68:cf:38:79:0d:aa:30:a8:db:2c:60:48:9e:d7:aa:
                    14:01:a9:83:d7:38:91:30:39:13:96:03:3a:7c:40:
                    54:b6:ad:e0:2f:1b:83:dc:a8:11:52:3e:02:b3:d7:
                    2b:fd:21:b6:a7:5c:a3:0f:0b:a9:a6:10:50:0e:34:
                    2e:4d:a7:ce:c9:5e:25:d4:8c:bc:f3:6e:7c:29:bc:
                    01:5d:fc:31:87:5a:d5:8c:85:67:58:88:19:a0:bf:
                    35:f0:ea:2b:a3:21:e7:90:f6:83:e5:a8:ed:60:78:
                    5e:7b:60:83:fd:57:0b:5d:41:0d:63:54:60:d6:43:
                    21:ef
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/cps
                  User Notice:
                    Explicit Text: https://www.verisign.com/rpa
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            1.3.6.1.5.5.7.1.12: 
                0_.].[0Y0W0U..image/gif0!0.0...+..............k...j.H.,{..0%.#http://logo.verisign.com/vslogo.gif
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, Code Signing
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.verisign.com/pca3.crl
            X509v3 Subject Alternative Name: 
                DirName:/CN=Class3CA2048-1-55
            X509v3 Subject Key Identifier: 
                97:D0:6B:A8:26:70:C8:A1:3F:94:1F:08:2D:C4:35:9B:A4:A1:1E:F2
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        8b:03:c0:dd:94:d8:41:a2:61:69:b0:15:a8:78:c7:30:c6:90:
        3c:7e:42:f7:24:b6:e4:83:73:17:04:7f:04:10:9c:a1:e2:fa:
        81:2f:eb:c0:ca:44:e7:72:e0:50:b6:55:10:20:83:6e:96:92:
        e4:9a:51:6a:b4:37:31:dc:a5:2d:eb:8c:00:c7:1d:4f:e7:4d:
        32:ba:85:f8:4e:be:fa:67:55:65:f0:6a:be:7a:ca:64:38:1a:
        10:10:78:45:76:31:f3:86:7a:03:0f:60:c2:b3:5d:9d:f6:8b:
        66:76:82:1b:59:e1:83:e5:bd:49:a5:38:56:e5:de:41:77:0e:
        58:0f

pkcs7-signedData

1
- SHA1: nil
- 1.3.6.1.4.1.311.2.1.4
  - #0
    - 1.3.6.1.4.1.311.2.1.15
      - :
        00 3c 00 3c 00 3c 00 4f 00 62 00 73 00 6f 00 6c |.<.<.<.O.b.s.o.l| 00 65 00 74 00 65 00 3e 00 3e 00 3e |.e.t.e.>.>.> |
    - SHA1
      - 38 4b 76 37 53 a7 db 7c 46 96 bf c4 e0 d1 c6 e8 |8Kv7S..|F.......| 07 94 98 6f |...o |
- Certificates
  - Certificate #0
    - 2
      - 38:25:D7:FA:F8:61:AF:9E:F4:90:E7:26:B5:D6:5A:D5
      - RSA-SHA1: nil
      - Issuer
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services CA
      - 2007-06-15 00:00:00 UTC: 2012-06-14 23:59:59 UTC
      - Subject
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services Signer - G2
      - #5
        rsaEncryption: nil
        C4:B5:F2:52:15:BC:88:86:60:29:16:4A:5B:2F:4B:91:
        6B:87:91:F3:35:54:58:35:EA:D1:36:5E:62:4D:52:51:
        34:71:C2:7B:66:1D:89:C8:DD:2A:C4:6A:0A:F6:37:D9:
        98:74:91:F6:92:AE:B0:B5:76:96:F1:A9:4A:63:45:47:
        2E:6B:0B:92:4E:4B:2B:8C:EE:58:4A:8B:D4:07:E4:1A:
        2C:F8:82:AA:58:D9:CD:42:F3:2D:C0:75:DE:8D:AB:C7:
        8E:1D:9A:6C:4C:08:95:1E:DE:DB:EF:67:E1:72:C2:49:
        C2:9E:60:3C:E1:E2:BE:16:A3:63:78:69:14:7B:AD:2D: 0x010001
      - X509v3 extensions
        authorityInfoAccess
        OCSP: http://ocsp.verisign.com
        basicConstraints
        true
        nil
        crlDistributionPoints: http://crl.verisign.com/tss-ca.crl
        extendedKeyUsage: true, timeStamping
        keyUsage: true, 0xc0
        subjectAltName
        CN: TSA1-2
    - RSA-SHA1:
```
50 c5 4b c8 24 80 df e4  0d 24 c2 de 1a b1 a1 02  |P.K.$....$......|
a1 a6 82 2d 0c 83 15 81  37 0a 82 0e 2c b0 5a 17  |...-....7...,.Z.|
61 b5 d8 05 fe 88 db f1  91 91 b3 56 1a 40 a6 eb  |a..........V.@..|
92 be 38 39 b0 75 36 74  3a 98 4f e4 37 ba 99 89  |..89.u6t:.O.7...|
ca 95 42 1d b0 b9 c7 a0  8d 57 e0 fa d5 64 04 42  |..B......W...d.B|
35 4e 01 d1 33 a2 17 c8  4d aa 27 c7 f2 e1 86 4c  |5N..3...M.'....L|
02 38 4d 83 78 c6 fc 53  e0 eb e0 06 87 dd a4 96  |.8M.x..S........|
9e 5e 0c 98 e2 a5 be bf  82 85 c3 60 e1 df ad 28  |.^.........`...(|
d8 c7 a5 4b 64 da c7 1b  5b bd ac 39 08 d5 38 22  |...Kd...[..9..8"|
a1 33 8b 2f 8a 9a eb bc  07 21 3f 44 41 09 07 b5  |.3./.....!?DA...|
65 1c 24 bc 48 d3 44 80  eb a1 cf c9 02 b4 14 cf  |e.$.H.D.........|
54 c7 16 a3 80 5c f9 79  3e 5d 72 7d 88 17 9e 2c  |T....\.y>]r}...,|
43 a2 ca 53 ce 7d 3d f6  2a 3a b8 4f 94 00 a5 6d  |C..S.}=.*:.O...m|
0a 83 5d f9 5e 53 f4 18  b3 57 0f 70 c3 fb f5 ad  |..].^S...W.p....|
95 a0 0e 17 de c4 16 80  60 c9 0f 2b 6e 86 04 f1  |........`..+n...|
eb f4 78 27 d1 05 c5 ee  34 5b 5e b9 49 32 f2 33  |..x'....4[^.I2.3|
```
  - Certificate #1
    - 2
      - 47:BF:19:95:DF:8D:52:46:43:F7:DB:6D:48:0D:31:A4
      - RSA-SHA1: nil
      - Issuer
        C: ZA
        ST: Western Cape
        L: Durbanville
        O: Thawte
        OU: Thawte Certification
        CN: Thawte Timestamping CA
      - 2003-12-04 00:00:00 UTC: 2013-12-03 23:59:59 UTC
      - Subject
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services CA
      - #5
        rsaEncryption: nil
        A9:CA:B2:A4:CC:CD:20:AF:0A:7D:89:AC:87:75:F0:B4:
        4E:F1:DF:C1:0F:BF:67:61:BD:A3:64:1C:DA:BB:F9:CA:
        33:AB:84:30:89:58:7E:8C:DB:6B:DD:36:9E:0F:BF:D1:
        EC:78:F2:77:A6:7E:6F:3C:BF:93:AF:0D:BA:68:F4:6C:
        94:CA:BD:52:2D:AB:48:3D:F5:B6:D5:5D:5F:1B:02:9F:
        FA:2F:6B:1E:A4:F7:A3:9A:A6:1A:C8:02:E1:7F:4C:52:
        E3:0E:60:EC:40:1C:7E:B9:0D:DE:3F:C7:B4:DF:87:BD:
        5F:7A:6A:31:2E:03:99:81:13:A8:47:20:CE:31:73:0D:
        57:2D:CD:78:34:33:95:12:99:12:B9:DE:68:2F:AA:E6:
        E3:C2:8A:8C:2A:C3:8B:21:87:66:BD:83:58:57:6F:75:
        BF:3C:AA:26:87:5D:CA:10:15:3C:9F:84:EA:54:C1:0A:
        6E:C4:FE:C5:4A:DD:B9:07:11:97:22:7C:DB:3E:27:D1:
        1E:78:EC:9F:31:C9:F1:E6:22:19:DB:C4:B3:47:43:9A:
        1A:5F:A0:1E:90:E4:5E:F5:EE:7C:F1:7D:AB:62:01:8F:
        F5:4D:0B:DE:D0:22:56:A8:95:CD:AE:88:76:AE:EE:BA:
        0D:F3:E4:4D:D9:A0:FB:68:A0:AE:14:3B:B3:87:C1:BB: 0x010001
      - X509v3 extensions
        authorityInfoAccess
        OCSP: http://ocsp.verisign.com
        basicConstraints
        true
        true: 0
        crlDistributionPoints: http://crl.verisign.com/ThawteTimestampingCA.crl
        extendedKeyUsage: timeStamping
        keyUsage: true, 6
        subjectAltName
        CN: TSA2048-1-53
    - RSA-SHA1:
```
4a 6b f9 ea 58 c2 44 1c  31 89 79 99 2b 96 bf 82  |Jk..X.D.1.y.+...|
ac 01 d6 1c 4c cd b0 8a  58 6e df 08 29 a3 5e c8  |....L...Xn..).^.|
ca 93 13 e7 04 52 0d ef  47 27 2f 00 38 b0 e4 c9  |.....R..G'/.8...|
93 4e 9a d4 22 62 15 f7  3f 37 21 4f 70 31 80 f1  |.N.."b..?7!Op1..|
8b 38 87 b3 e8 e8 97 00  fe cf 55 96 4e 24 d2 a9  |.8........U.N$..|
27 4e 7a ae b7 61 41 f3  2a ce e7 c9 d9 5e dd bb  |'Nz..aA.*....^..|
2b 85 3e b5 9d b5 d9 e1  57 ff be b4 c5 7e f5 cf  |+.>.....W....~..|
0c 9e f0 97 fe 2b d3 3b  52 1b 1b 38 27 f7 3f 4a  |.....+.;R..8'.?J|
```
  - Certificate #2
    - 2
      - 36:BC:30:56:2A:65:0A:FA:A5:AD:10:1E:CD:64:3A:B4
      - RSA-SHA1: nil
      - Issuer
        C: US
        O: VeriSign, Inc.
        OU: VeriSign Trust Network
        OU: Terms of use at https://www.verisign.com/rpa (c)09
        CN: VeriSign Class 3 Code Signing 2009-2 CA
      - 2010-06-21 00:00:00 UTC: 2013-07-26 23:59:59 UTC
      - Subject
        C: US
        ST: California
        L: San Francisco
        O: BitTorrent Inc
        OU: Digital ID Class 3 - Microsoft Software Validation v2
        CN: BitTorrent Inc
      - #5
        rsaEncryption: nil
        B5:77:F6:92:EB:F1:4F:6F:D7:AE:A3:0B:5F:8E:4B:AC:
        23:E8:4E:65:B1:7F:4D:17:74:B2:63:05:42:47:03:8A:
        CE:C5:DE:11:35:07:AA:1B:CD:32:5B:11:D3:22:D7:E5:
        99:DF:3F:5B:AD:37:8C:17:68:C2:45:82:B0:ED:F2:41:
        94:57:2A:FA:3B:D7:8D:B9:8C:49:29:07:93:F8:30:73:
        01:62:04:38:C5:81:D7:AF:79:75:13:08:EF:4B:B6:B2:
        90:38:4D:B9:74:7E:34:4F:99:A5:A5:4A:9B:71:EB:A7:
        F2:DE:C0:55:99:C5:87:7F:FE:47:8C:57:1A:92:D5:ED: 0x010001
      - X509v3 extensions
        basicConstraints
        nil
        keyUsage: true, 0x80
        crlDistributionPoints: http://csc3-2009-2-crl.verisign.com/CSC3-2009-2.crl
        certificatePolicies
        2.16.840.1.113733.1.7.23.3
        id-qt-cps: https://www.verisign.com/rpa
        extendedKeyUsage: codeSigning
        authorityInfoAccess
        #0
        OCSP: http://ocsp.verisign.com
        caIssuers: http://csc3-2009-2-aia.verisign.com/CSC3-2009-2.cer
        authorityKeyIdentifier:
        97 d0 6b a8 26 70 c8 a1 3f 94 1f 08 2d c4 35 9b |..k.&p..?...-.5.| a4 a1 1e f2 |.... |
        nsCertType: 0x10
        1.3.6.1.4.1.311.2.1.27
        false: true
    - RSA-SHA1:
```
46 6f c3 87 7f 56 7b e8  d5 8c cb 04 74 8a 3b 6e  |Fo...V{.....t.;n|
04 58 e6 79 9a 47 7b 68  bb 22 b9 76 34 6e cb ce  |.X.y.G{h.".v4n..|
d0 45 b1 51 da 50 6d 53  7a aa c0 29 7c 62 3a fb  |.E.Q.PmSz..)|b:.|
68 54 40 22 5b 19 64 40  26 2a 3f 12 53 31 00 11  |hT@"[.d@&*?.S1..|
99 d1 90 14 b4 90 3a 86  63 6f ce d1 56 bb 98 98  |......:.co..V...|
90 3b 5b a0 a6 b7 a1 2a  11 bb c8 b4 0a d5 e1 f2  |.;[....*........|
df 0c af 25 d9 49 87 b0  84 d2 62 93 e3 df 1e 98  |...%.I....b.....|
12 19 c4 ab 05 3d a8 63  8f 53 90 9b 21 93 d0 b1  |.....=.c.S..!...|
9a 62 a5 82 88 b8 e3 2a  3e bc 22 d1 d5 01 6b df  |.b.....*>."...k.|
d1 c9 74 86 5e 3c 24 01  a2 cc 69 f1 d6 79 58 9a  |..t.^<$...i..yX.|
0c 24 1e 96 c7 6a 0c 4d  a6 3c 4c fd 7c 30 86 51  |.$...j.M.
```
  - Certificate #3
    - 2
      - 65:52:26:E1:B2:2E:18:E1:59:0F:29:85:AC:22:E7:5C
      - RSA-SHA1: nil
      - Issuer
        C: US
        O: VeriSign, Inc.
        OU: Class 3 Public Primary Certification Authority
      - 2009-05-21 00:00:00 UTC: 2019-05-20 23:59:59 UTC
      - Subject
        C: US
        O: VeriSign, Inc.
        OU: VeriSign Trust Network
        OU: Terms of use at https://www.verisign.com/rpa (c)09
        CN: VeriSign Class 3 Code Signing 2009-2 CA
      - #5
        rsaEncryption: nil
        BE:67:1D:B4:60:AA:10:49:6F:56:17:7C:66:C9:5E:86:
        0D:D5:F1:AC:A7:71:83:8E:8B:89:F8:88:04:89:15:06:
        BA:2D:84:21:95:E4:D1:9C:50:4C:FB:D2:22:BD:DA:F2:
        B2:35:3B:1E:8F:C3:09:FB:FC:13:2E:5A:BF:89:7C:3D:
        3B:25:1E:F6:F3:58:7B:9C:F4:01:B5:C6:0A:B8:80:CE:
        BE:27:74:61:67:27:4D:6A:E5:EC:81:61:58:79:A3:E0:
        17:10:12:15:27:B0:E1:4D:34:7F:2B:47:20:44:B9:DE:
        66:24:66:8A:CD:4F:BA:1F:C5:38:C8:54:90:E1:72:F6:
        19:66:75:6A:B9:49:68:CF:38:79:0D:AA:30:A8:DB:2C:
        60:48:9E:D7:AA:14:01:A9:83:D7:38:91:30:39:13:96:
        03:3A:7C:40:54:B6:AD:E0:2F:1B:83:DC:A8:11:52:3E:
        02:B3:D7:2B:FD:21:B6:A7:5C:A3:0F:0B:A9:A6:10:50:
        0E:34:2E:4D:A7:CE:C9:5E:25:D4:8C:BC:F3:6E:7C:29:
        BC:01:5D:FC:31:87:5A:D5:8C:85:67:58:88:19:A0:BF:
        35:F0:EA:2B:A3:21:E7:90:F6:83:E5:A8:ED:60:78:5E:
        7B:60:83:FD:57:0B:5D:41:0D:63:54:60:D6:43:21:EF: 0x010001
      - X509v3 extensions
        basicConstraints
        true
        true: 0
        certificatePolicies
        2.16.840.1.113733.1.7.23.3
        #0
        id-qt-cps: https://www.verisign.com/cps
        id-qt-unotice: https://www.verisign.com/rpa
        keyUsage: true, 6
        1.3.6.1.5.5.7.1.12
        image/gif
        SHA1:
        8f e5 d3 1a 86 ac 8d 8e 6b c3 cf 80 6a d4 48 18 |........k...j.H.| 2c 7b 19 2e |,{.. |
        http://logo.verisign.com/vslogo.gif
        extendedKeyUsage
        clientAuth: codeSigning
        authorityInfoAccess
        OCSP: http://ocsp.verisign.com
        crlDistributionPoints: http://crl.verisign.com/pca3.crl
        subjectAltName
        CN: Class3CA2048-1-55
        subjectKeyIdentifier:
        97 d0 6b a8 26 70 c8 a1 3f 94 1f 08 2d c4 35 9b |..k.&p..?...-.5.| a4 a1 1e f2 |.... |
    - RSA-SHA1:
```
8b 03 c0 dd 94 d8 41 a2  61 69 b0 15 a8 78 c7 30  |......A.ai...x.0|
c6 90 3c 7e 42 f7 24 b6  e4 83 73 17 04 7f 04 10  |..<~B.$...s.....|
9c a1 e2 fa 81 2f eb c0  ca 44 e7 72 e0 50 b6 55  |...../...D.r.P.U|
10 20 83 6e 96 92 e4 9a  51 6a b4 37 31 dc a5 2d  |. .n....Qj.71..-|
eb 8c 00 c7 1d 4f e7 4d  32 ba 85 f8 4e be fa 67  |.....O.M2...N..g|
55 65 f0 6a be 7a ca 64  38 1a 10 10 78 45 76 31  |Ue.j.z.d8...xEv1|
f3 86 7a 03 0f 60 c2 b3  5d 9d f6 8b 66 76 82 1b  |..z..`..]...fv..|
59 e1 83 e5 bd 49 a5 38  56 e5 de 41 77 0e 58 0f  |Y....I.8V..Aw.X.|
```
- Signer
  - 1
  - unnamed
    - #0
      - C: US
      - O: VeriSign, Inc.
      - OU: VeriSign Trust Network
      - OU: Terms of use at https://www.verisign.com/rpa (c)09
      - CN: VeriSign Class 3 Code Signing 2009-2 CA
    - 36:BC:30:56:2A:65:0A:FA:A5:AD:10:1E:CD:64:3A:B4
  - SHA1: nil
  - #3
    - contentType: 1.3.6.1.4.1.311.2.1.4
    - 1.3.6.1.4.1.311.2.1.11: msCodeInd
    - messageDigest:
```
d2 be cf e6 e8 8e f8 fd  6a 79 4e d3 2b 4a 66 9d  |........jyN.+Jf.|
ad 58 71 01                                       |.Xq.            |
```
    - 1.3.6.1.4.1.311.2.1.12
      - 00 75 00 54 00 6f 00 72 00 72 00 65 00 6e 00 74 |.u.T.o.r.r.e.n.t|
        : http://www.utorrent.com
  - rsaEncryption:
```
ac 60 71 f6 89 a3 d8 81  78 69 75 7c d2 5e 1f dc  |.`q.....xiu|.^..|
59 9e 8f c3 50 98 54 f9  63 b6 4f 30 14 71 81 78  |Y...P.T.c.O0.q.x|
f9 77 78 77 f3 0f 69 dc  96 a1 92 31 1a 36 0e fd  |.wxw..i....1.6..|
66 f9 7d d9 52 69 c0 9f  d1 af 54 5b 49 0d 15 be  |f.}.Ri....T[I...|
9e 92 d2 3f 08 66 09 bd  f4 ec 9c 43 8a 96 58 e8  |...?.f.....C..X.|
8a 6b 48 c8 d7 29 ac 29  eb a6 a5 45 f2 d1 1b f5  |.kH..).)...E....|
1f 92 45 13 be 89 4d f8  ba 72 3f 3e 48 c6 5b 3e  |..E...M..r?>H.[>|
cd 9d e7 4d 80 cb 68 28  e2 5a b1 b4 1a 4e 8a 47  |...M..h(.Z...N.G|
```
  - countersignature
    - 1
      - unnamed
        #0
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services CA
        38:25:D7:FA:F8:61:AF:9E:F4:90:E7:26:B5:D6:5A:D5
      - SHA1: nil
      - #2
        contentType: pkcs7-data
        signingTime: 2012-02-22 23:25:17 UTC
        messageDigest:
        91 43 79 d3 f9 ec dc 21 d3 61 4a f5 65 4e e0 da |.Cy....!.aJ.eN..| 44 58 1f 74 |DX.t |
      - rsaEncryption:
        9d 03 bc 92 4e 63 5c 57 4d d1 b0 3a 63 b7 fa b1 |....Nc\WM..:c...| 52 d5 21 5c 4c ad 03 93 d3 26 2a c0 d2 80 58 de |R.!\L....&*...X.| b8 88 4f 3b 8b 69 f1 76 b6 3d b3 44 92 d3 18 63 |..O;.i.v.=.D...c| d3 f3 a8 93 ee 91 05 33 48 8f c6 5f 38 15 6f c2 |.......3H.._8.o.| c8 7a 30 53 c3 f8 76 7e 01 f0 a0 bc bf 8f 4e dd |.z0S..v~......N.| 90 c5 31 88 aa 50 6d 6a 4d a1 14 39 7c 65 12 e4 |..1..PmjM..9|e..| 66 d5 d5 70 82 3f d3 a0 51 9a 68 34 1d fb f4 ab |f..p.?..Q.h4....| 7d 62 be c4 ba 5a 56 66 5d 25 e1 85 3d 38 1a 3a |}b...ZVf]%..=8.:|

show previews

offset	size	type	comment
0	734720	EXE	02/22/2012 23:20:36	#
15c1	15	HTM		#
b3600	5496	PKCS7	Authenticode Signature	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[!] refusing to read ICODIRENTRY beyond resource size

uTorrent.exe-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904E4

VS_FIXEDFILEINFO

Signers (1)

Certificates (4)

uTorrent.exe
-