ESET_VC52_GetID.exe - imimimi.blog.163.com

info
MZ
PE
resources
strings
imports
foremost
version info
signature
hexdump
disasm
log
discuss
donate

filename	ESET_VC52_GetID.exe
size	389936 (0x5f330)
md5	db6adb9463830d6f56ccdc698686269f

type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x108

Rich Header

lib id	version	times used
152	20115	2
170	40219	183
171	40219	53
131	30729	9
147	30729	33
1	0	535
180	40219	74
158	40219	55
154	40219	1
151	0	1
157	40219	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x4f837aa9
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x123
Magic	0x10b
LinkerVersion	10.0
SizeOfCode	0x4c000
SizeOfInitializedData	0x9000
SizeOfUninitializedData	0x7e000
AddressOfEntryPoint	0xc9e60
BaseOfCode	0x7f000
BaseOfData	0xcb000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0xd4000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0x8000
SizeOfStackReserve	0x400000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x400000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

UPX v0.89.6 - v1.02 / v1.05 - v1.22

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
UPX0	0x1000	0x7e000	0	RWX UDATA
UPX1	0x7f000	0x4c000	0x4b200	RWX IDATA
.rsrc	0xcb000	0x9000	0x8a00	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xd3508	0x3b0
RESOURCE	0xcb000	0x8508
EXCEPTION	0	0
SECURITY	0x5e1c8	0x1168
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
ICON	#1	296	1252
ICON	#2	296	1252
ICON	#3	296	1252
ICON	#4	4264	1252
ICON	#5	9640	1252
ICON	#6	16936	1252
MENU	#166	78	1252
DIALOG	#1000	240	1252
STRING	#7	542	1252
STRING	#8	720	1252
STRING	#9	542	1252
STRING	#10	760	1252
STRING	#11	764	1252
STRING	#12	492	1252
STRING	#313	132	1252
GROUP_ICON	#99	48	1252
GROUP_ICON	#162	20	1252
GROUP_ICON	#164	20	1252
GROUP_ICON	#169	20	1252
VERSION	#1	496	1252
MANIFEST	#1	481	1252

id	lang	string
96	2057	df 37 da a8 2e ea 59 18 06 50 e6 c6 6f ae 9c fc \|.7....Y..P..o...\| 1d 5b eb 08 70 26 07 d8 94 d4 68 34 8c 4d 7e 73 \|.[..p&....h4.M~s\| e5 e4 ee f8 41 07 ac 00 e2 45 d6 70 c5 6c 00 e4 \|....A....E.p.l..\| 37 7f 41 2f 9c 2b ef a4 6f 15 9a 24 ef 4e fe f6 \|7.A/.+..o..$.N..\| e5 c0 68 17 fc be 5c be eb ff 2a d4 4b 08 7f 93 \|..h...\...*.K...\| ff 57 c4 c5 08 f4 3f 2d 99 3f 16 bb c5 42 2f 50 \|.W....?-.?...B/P\| 38 15 df 56 80 37 94 28 6c c0 d0 40 bf 2f a0 f3 \|8..V.7.(l..@./..\| b7 fd cd 70 21 75 c7 e5 d1 40 e3 4a bf 2f 40 70 \|...p!u...@.J./@p\| 2d 6e 2f 20 01 40 12 ec f9 31 bf 09 72 f2 37 57 \|-n/ .@...1..r.7W\| a4 38 39 a1 e5 7f d4 f1 b4 35 09 95 93 bf b9 3c \|.89......5.....<\| cb 44 f7 b6 13 c6 80 d7 37 09 68 ae 9c fc cd 29 \|.D......7.h....)\| 50 08 52 60 44 ca 4f 47 09 80 54 5b 73 e5 e4 6f \|P.R`D.OG..T[s..o\| 39 25 cf 00 8d 9a 4b 0a d0 4d 66 9b 2b 27 7f 19 \|9%....K..Mf.+'..\| b3 e3 94 2f e0 3c 0a 94 16 71 bc c3 7e f3 37 f9 \|.../.<...q..~.7.\| 92 1d de ed 3f 5f 04 b0 7b 34 e6 8b d6 32 47 e4 \|....?_..{4...2G.\| 6f 5f 4e c0 4c 1b 86 be c3 82 a9 fe e1 7c 2f e3 \|o_N.L........\|/.\| f8 e6 ee 0b 2f 8c 59 90 df fb c0 73 f1 7f e5 e4 \|..../.Y....s....\| 37 7f 2f e0 6b 9a d9 f0 c3 92 d2 61 80 57 4e fe \|7./.k......a.WN.\| f6 58 53 a4 be 78 28 33 fd 9b 75 38 0b fc 10 ae \|.XS..x(3..u8....\| b9 72 f2 37 76 c1 4f 2c 69 62 19 0c c8 a5 b7 cd \|.r.7v.O,ib......\| 95 93 bf 1b fe 26 4c cd 92 43 0c b8 12 c1 99 6f \|.....&L..C.....o\| ae 9c fc d1 7d 18 e3 fb 4c 0c c0 58 ca 4c 6f a2 \|....}...L..X.Lo.\| 88 fc c5 d9 e4 8c b7 13 2f 78 d3 8e d4 1b cf a0 \|......../x......\| 99 fc e6 ee 42 3f 0d 2f a0 73 dc 36 46 49 44 1b \|....B?./.s.6FID.\| 3f 90 df be 9c 40 38 4a e5 be 8c 99 ab be 67 73 \|?....@8J......gs\| 27 7f 73 65 0d 64 fd ed 11 15 98 a0 79 10 15 0d \|'.se.d......y...\| 38 f9 9b 2b e8 8d f6 3e 9f 26 bb 30 39 43 0e b9 \|8..+...>.&.09C..\| eb 6f 7e cf fc fe 04 0a 94 fb 3c c5 41 3f 0e f9 \|.o~.......<.A?..\| 9b fc 7f 4a 07 f5 3f 10 49 8f 16 56 09 43 2f 60 \|...J..?.I..V.C/`\| 77 0f 7f e1 aa ba bb 84 5e 68 a5 ff 2f f8 84 17 \|w.......^h../...\| e6 ee f6 37 87 23 b9 cd 25 aa 40 bf 0f 2f 9c 73 \|...7.#..%.@../.s\| 1f 6f ae dc fe 03 00 96 4d fb 1e 4b bf 0f 00 44 \|.o......M..K...D\| 27 ce ae b9 51 7f 73 e5 e4 e5 d4 2d 0f c4 f6 2e \|'...Q.s....-....\| 39 0b 21 b4 a8 ee 47 f9 9b 2b 27 0f 94 8c \|9.!...G..+'... \|
112	2057	2e a4 c9 cf e9 31 91 bf b9 3b 10 2f 08 06 3e 2e \|.....1...;./..>.\| 31 07 91 4e 63 42 77 f2 db 97 20 c0 63 45 5e 15 \|1..NcBw... .cE^.\| e2 73 c7 94 87 40 2f 2f 23 7f f3 4c a6 4c 02 87 \|.s...@//#..L.L..\| 6e e8 48 7f 4e 60 48 ce 7d 19 f9 9b 53 a9 57 13 \|n.H.N`H.}...S.W.\| 98 ec 08 24 80 38 dc 5a cd 97 91 bf ee 0a c8 82 \|...$.8.Z........\| a7 71 ab 3b a0 ac d0 61 4e 6f be 8c fc 1d f6 2f \|.q.;...aNo...../\| 85 5b 37 c0 28 ac 68 16 89 3d a4 7f f3 65 e4 1c \|.[7.(.h..=...e..\| 6d 43 e0 30 6f 6f 91 48 10 37 35 1f 4d f2 b7 97 \|mC.0oo.H.75.M...\| 23 00 11 1a 76 2e 50 b7 c6 2e 14 a2 23 4e 7e fb \|#...v.P.....#N~.\| 32 20 e4 ad 7c be 9a 47 e7 0f a5 db 40 65 e4 6f \|2 ..\|..G....@e.o\| fe 2f 80 2a 83 ed 23 34 84 bb 32 49 60 23 23 7f \|./.*..#4..2I`##.\| f3 94 90 89 6f 1b 8f d5 e4 6f 4a 80 e0 f0 e5 e4 \|....o....oJ.....\| b7 8f be f0 f7 db 2d a9 84 a0 e8 1a 96 e6 ca c9 \|......-.........\| 5f 7e d4 68 a3 94 25 0c 46 11 04 40 9c 37 57 4e \|_~.h..%.F..@.7WN\| fe 1e 52 ab 78 5e 7f 44 11 50 50 a2 86 16 c6 fe \|..R.x^.D.PP.....\| b9 72 f2 00 73 8a 40 12 34 4c a8 8f 5f 21 0a be \|.r..s.@.4L.._!..\| f2 37 7f 41 2f 10 34 ae ac e4 83 3a 23 8e 47 91 \|.7.A/.4....:#.G.\| bf f9 32 40 4c 08 b4 71 67 8e 3a 26 08 4a 8c fc \|..2@L..qg.:&.J..\| cd 97 60 48 c9 b9 35 4c 24 2e d7 c0 34 80 65 e4 \|..`H..5L$...4.e.\| 6f be 5c 77 bf 0b 21 bd 31 04 94 43 a0 2f 23 7f \|o.\w..!.1..C./#.\| f3 e8 12 c5 0c c1 c1 e8 b9 5b 3c c0 44 9c 7c b9 \|.........[<.D.\|.\| fc 9b ca ae ba 3c d5 7f a5 fa 3d e0 c4 13 d0 57 \|.....<....=....W\| 1e 96 df 86 ee 0a 7e bd da fe 13 bc 79 d5 b9 72 \|......~.....y..r\| f2 37 ab fc 87 e4 fe a9 42 13 84 ce da cd 95 93 \|.7......B.......\| bf b5 7e 2e c0 f1 df 34 13 68 12 e0 e2 6f ae 9c \|..~....4.h...o..\| fc fa 75 9a 7c df 38 13 b8 45 e5 41 1d 38 79 7f \|..u.\|.8..E.A.8y.\| 73 e5 e4 4c 1a 3b 13 c0 68 ea c0 ac 34 31 fd bb \|s..L.;..h...41..\| 43 f2 9b 2b 27 13 cc 7b ef 2d f9 83 d3 2b 6f 91 \|C..+'..{.-...+o.\| bf f9 0b 2f 24 7f f4 78 94 93 f8 12 04 4f 8e fc \|.../$..x.....O..\| cd 97 e0 14 73 f9 cb d5 9d 6d 85 54 32 00 14 32 \|....s....m.T2..2\| f2 37 57 dc 57 fe 87 de f0 04 85 3d 1a 20 be 8c \|.7W.W......=. ..\| fc ff c0 2d 03 f6 3f c3 ae de 5c 1f b3 3d 40 08 \|...-..?...\..=@.\| f5 07 f3 77 c3 6f 05 cb fd ca 5c 3d 0f 60 2f f0 \|...w.o....\=.`/.\| ad 0c 9b bf 05 7f 1c 07 6a 5c 26 22 0f 7f 2f b8 \|........j\&"../.\| 58 11 be 0c df 7c 19 f9 f9 31 d2 44 3e a0 a0 f5 \|X....\|...1.D>...\| 15 f5 23 4f 23 60 fe e6 cb c8 c6 49 c0 e8 84 1a \|..#O#`.....I....\| 99 7d 8c 83 d7 1d 30 f2 37 5f 46 e0 c4 06 1f af \|.}....0.7_F.....\| 82 b7 46 5c 49 45 c8 df 5c 39 00 15 74 7b 23 ff \|..F\IE..\9..t{#.\| a5 d7 af 04 2c 42 46 fe e6 cb 20 30 e3 27 89 45 \|....,BF... 0.'.E\| 95 20 5d 81 24 40 32 f2 37 5f 2c 3e 2c 92 ec de \|. ].$@2.7_,>,...\| 86 3f 15 35 60 5f 4e 7e fb a0 8c 30 be bb af 69 \|.?.5`_N~...0...i\| 49 71 0f 80 c4 ce 34 ae 9c fc 05 7e e6 68 61 f3 \|Iq....4....~.ha.\| bb ad 3b 15 c8 04 39 73 e5 e4 6f f9 8d 41 90 8c \|..;...9s..o..A..\| cd 44 15 e4 2e 3d cd 95 91 7f cc a4 4b 46 ff 77 \|.D...=......KF.w\| fc 3d 15 44 4d 41 cd 37 57 46 fe fa 04 1d f7 98 \|.=.DMA.7WF......\|
128	2057	e2 3d 16 18 60 45 61 70 91 bf b9 72 f2 49 30 ae \|.=..`Eap...r.I0.\| 48 16 98 67 49 a4 99 3a 9d d8 c3 fc cd 95 93 2d \|H..gI..:.......-\| 16 ec 63 4d a5 f2 25 15 51 12 0e c8 6f ae 9c 16 \|..cM..%.Q...o...\| 40 55 51 4c 79 35 da 9a 6f 46 fe e6 2f 2f c8 3b \|@UQLy5..oF..//.;\| 55 76 da 67 a0 30 8f 2f a0 32 f2 37 5f a8 17 59 \|Uv.g.0./.2.7_..Y\| 6a 76 de 0c 55 8e 47 c0 97 91 bf f9 10 e9 5c d0 \|jv..U.G.......\.\| e7 d2 e3 ff 79 4b e0 2c 95 91 7f c1 b0 60 7e 41 \|....yK.,.....`~A\| 25 4d 79 81 da 1c 3e 17 1c fc 05 f9 cd 6d 64 f0 \|%My...>......md.\| fb ee a5 9e fe 2f 10 20 68 e6 cb c8 df c1 70 cd \|...../. h.....p.\| 1f d3 f4 4d 40 30 c9 6b 37 5f 46 fe 6b ee 0e 1c \|...M@0.k7_F.k...\| 91 7d 3c 60 9c 68 6f 9d b5 94 bf f9 32 f2 b8 66 \|.}<`.ho.....2..f\| 37 4f 80 80 fe 72 98 9b f8 02 7d fc b8 65 2d 27 \|7O...r....}..e-'\| a0 da f3 17 e4 77 7e 2b 85 f5 0d 69 96 2f 40 0e \|.....w~+...i./@.\| 7a 9b 2f 23 7f eb 62 f1 42 27 3d 3e e0 60 88 7d \|z./#..b.B'=>.`.}\| 5a 08 6f ae 1c f9 c9 e4 cd e4 4d 00 18 88 f9 80 \|Z.o.......M.....\| 31 ae f0 89 ff e6 cb c9 98 93 20 dc 61 84 52 e2 \|1......... .a.R.\| 7e 15 8d d7 e4 3d e4 6f 5f 2e 40 74 c1 87 8e 51 \|~....=.o_.@t...Q\| 4e 54 09 aa ec 42 23 7f f3 65 60 78 18 8b d6 57 \|NT...B#..e`x...W\| 33 04 63 e9 4c 80 19 f9 9b 2f 0c 67 8e e5 2b 28 \|3.c.L..../.g..+(\| 9e 8a a2 f6 a0 6f f2 17 7c 44 ad 91 7e 71 8d c8 \|.....o..\|D..~q..\| c2 4a bc 4b 2f 5f 46 fe e6 4c eb 94 c8 18 1d 00 \|.J.K/_F..L......\| 3b 2c 2a e0 38 21 98 5c 39 f2 37 df f8 8c 94 82 \|;,*.8!.\9.7.....\| ea 44 00 19 2c 4f 9b ed cb c8 df cb 20 f5 be ab \|.D..,O...... ...\| fd 45 20 44 75 9e 5e ef bf f9 3b f9 96 f2 69 6e \|.E Du.^...;...in\| 5d 40 2f 9c 93 a1 25 94 8e 93 c1 33 fc cd 97 91 \|]@/...%....3....\| 46 60 50 aa a4 5e 8e bc 46 22 56 4d e4 6f be 8c \|F`P..^..F"VM.o..\| 80 80 b9 a7 85 7d 9b 33 30 7d 2d 23 7f f3 65 a0 \|.....}.30}-#..e.\| 40 c1 aa 87 7e 46 09 79 90 3b c0 19 f9 9b 2f b0 \|@...~F.y.;..../.\| c1 ad 6c 09 1e 52 1f 02 28 e0 19 f9 17 7d e8 ba \|..l..R..(....}..\| b0 fe fa a8 5c d0 37 60 08 3e 1a ca c9 df 5c 00 \|....\.7`.>....\.\| ad b3 89 64 67 b4 99 f7 3b 1a 57 4e fe e6 14 98 \|...dg...;.WN....\| b6 e1 3b 53 76 b0 40 45 1a 3c 7c b9 b9 72 f2 37 \|..;Sv.@E.<\|..r.7\| 98 ea c8 1f f7 84 4d 1a 94 59 bc cd 95 93 bf 7c \|......M..Y.....\|\| 7d 97 11 3b bf 32 1a 2c 30 bf a6 6f ae 9c \|}..;.2.,0..o.. \|
144	2057	76 0c fb e2 47 1a 24 00 c2 cc af 81 2f 7f 73 e5 \|v...G.$...../.s.\| e4 70 c3 22 1a 8c c9 c4 93 fb ff 5c 28 1c 30 f9 \|.p.".......\(.0.\| 9b 2b 27 1a 7c 8c c7 5b 73 24 ab 8c f5 46 c9 df \|.+'.\|..[s$...F..\| 5c 39 1b 10 49 ca ab 64 87 d3 94 56 19 4e fe e6 \|\9..I..d...V.N..\| ca 1b 54 ff cc ba ad a4 30 29 4c 4b 1b 72 f2 37 \|..T.....0)LK.r.7\| 57 68 af cf f7 29 8f 35 47 c8 35 1b 95 93 bf b9 \|Wh...).5G.5.....\| 58 59 d2 8a 7c da 1a ca 7a 4a 1b 40 ae 9c fc cd \|XY..\|...zJ.@....\| fd d4 57 b5 de be 9b 4c 3f 1b 30 9b d7 73 e5 e4 \|..W....L?.0..s..\| 6f 8d da f9 e9 9d 36 3a 1b 3c 33 da 9b 2b 27 7f \|o.....6:.<3..+'.\| a0 88 51 92 b7 bc 42 1b 78 c5 dc 37 6f df dc 0d \|..Q...B.x..7o...\| f2 ac e5 2f ab 1c 2f fc 51 df a7 4b 63 da 5a fc \|.../../.Q..Kc.Z.\| ed cb c8 a8 30 20 d4 d8 e1 5e fb 7a 2d 97 41 01 \|....0 ...^.z-.A.\| 35 e4 6f be 8c 40 14 5a e4 22 42 05 f1 44 63 49 \|5.o..@.Z."B..DcI\| 46 fe 76 64 60 d5 e6 8e d7 1e de 60 49 9a 2e 80 \|F.vd`......`I...\| 32 f2 37 5f 20 4c e9 4c 1f f4 02 64 e9 25 a0 65 \|2.7_ L.L...d.%.e\| 82 ff f9 0c bd eb d7 6c 22 77 20 f4 3d 7f 1c 2b \|.......l"w .=..+\| 27 7f 73 a8 28 ee 1a b0 3f d7 1c f2 21 1c 04 8f \|'.s.(...?...!...\| 5c 39 f9 9b f0 8f 85 6a 5e ff 1a 4a 1d 38 f0 f2 \|\9.....j^..J.8..\| cd 5f 90 df 00 cf 9e 48 fa 85 2f 4c 4c f5 9a df \|._.....H../LL...\| be 8c fc 82 a7 25 87 7f 43 40 54 a3 f7 8e a1 1f \|.....%..C@T.....\| c3 4a cf fc e6 cb c8 2b 4e 60 64 f5 f9 3b 1c 6c \|.J.....+N`d..;.l\| f6 3e fd c8 df fc 9d 80 2f 84 42 fc a8 5e 7b 76 \|.>....../.B..^{v\| 7f 95 40 46 fe e6 cb a0 c8 8a fe fa 40 59 cb 95 \|..@F........@Y..\| 7f 42 c0 38 7e a7 5e 40 ce 0e 54 87 6c b2 8b 90 \|.B.8~.^@..T.l...\| 7f 17 fd cd 5f 2f f8 0c 03 77 1e 34 6e 19 03 34 \|...._/...w.4n..4\| ff 1e bf 20 ff 2f 47 05 f7 3f 96 6f 4e 9a 3d 9c \|... ./G..?.oN.=.\| 2f 68 7c f9 32 f2 b7 07 5e fe 4c d2 7b 1f ad 2f \|/h\|.2...^.L.{../\| 40 3c ad 09 cd 97 91 bf 42 13 8b 6e 1e 75 35 60 \|@<......B..n.u5`\| 8c d9 0b fd 6f be 8c fc b2 d4 60 86 2c 2b 80 64 \|....o.....`.,+.d\| 01 0e 9a b4 e5 0b fc cd df c9 05 c6 a0 2f d4 24 \|............./.$\| 10 6c 01 b1 d6 19 20 20 e4 6f be 8c c0 e4 43 12 \|.l.... .o....C.\| 7e 7f 2b 5e 97 88 4d 23 7f f3 65 e0 ac 5e 14 d1 \|~.+^..M#..e..^..\| 50 4b c0 51 44 00 00 8c fc cd 95 1f 2c 75 16 5e \|PK.QD.......,u.^\| 7b e8 0f 23 74 46 20 bf 93 df be 7c 87 18 be e3 \|{..#tF ....\|....\| 5e 34 4b d1 cb 40 2f a0 95 7c 19 f9 9b 1a 85 ee \|^4K..@/..\|......\| 34 a2 4f 0a 3e 60 a8 9f 1c e6 cb c8 df 58 45 da \|4.O.>`.......XE.\| 93 a5 20 4a 80 a4 a5 1e 37 5f 46 fe 28 c7 67 d4 \|.. J....7_F.(.g.\| b9 d1 2c a0 98 a7 20 34 33 2d 7f 3b 32 f2 73 0f \|..,... 43-.;2.s.\| 70 46 c0 a5 22 be 50 60 45 35 a7 2b 2a fc 05 27 \|pF..".P`E5.+*..'\| 23 e0 24 7e 3d 98 51 0b 51 cb 44 1f c4 02 9e 20 \|#.$~=.Q.Q.D.... \| 40 0f 91 3c 20 89 0e 81 ff 43 6f 6d 70 6c 65 74 \|@..< ....Complet\| 65 20 d5 78 ff bb 1f 00 5c 6f 72 27 5b 43 6c 61 \|e .x....\or'[Cla\| 73 73 20 48 69 65 72 b7 ff 47 1b 3a 79 20 44 65 \|ss Hier..G.:y De\| 73 63 72 69 70 3d 00 89 6d 6f cd 20 42 65 49 41 \|scrip=..mo. BeIA\| 72 46 79 27 27 de 21 b4 69 5d 20 a4 20 aa 54 79 \|rFy''.!.i] . .Ty\| 70 65 8f c0 ef c5 89 60 6c de 6c 20 73 ec 63 d6 \|pe.....`l.l s.c.\| 56 00 fa 20 74 68 72 65 68 67 75 de 64 3a 1b 34 \|V.. threhgu.d:.4\| 23 f0 60 6d 61 6e 86 1e \|#.`man.. \|
160	2057	76 30 88 0d 7e db fb 63 6f 70 79 08 6e 58 72 75 \|v0..~..copy.nXru\| 21 69 74 32 1b b4 7b 9b 91 60 47 76 62 fe 53 57 \|!it2..{..`Gvb.SW\| 36 68 a7 da 9f 64 79 f6 6d 24 1e da dd b1 db 65 \|6h...dy.m$.....e\| 78 2e 20 64 65 4b 66 06 42 47 7e ec 82 f6 69 6e \|x. deKf.BG~...in\| 42 69 8a 69 7a 65 3b 60 65 68 20 2a 78 21 08 25 \|Bi.ize;`eh x!.%\| 57 25 6a 83 d1 90 1f 26 4d 15 23 96 da 4f 9f f0 \|W%j....&M.#..O..\| 61 87 c1 66 1b 82 65 6e bd 07 76 8a 15 b6 5b 5d \|a..f..en..v...[]\| 56 1e 73 75 08 3c 3f 13 38 ae ad 3b 60 6c e8 1e \|V.su.\| 3e 74 cf f3 5e 25 16 2f 06 2d 2b 2a 47 7c 34 df \|>t..^%./.-+G\|4.\| 73 f7 26 0e 67 06 7e 0e 28 29 2c 66 ae 05 ee 64 \|s.&.g.~.(),f...d\| 31 3c 87 04 7e 53 9e 7d 9e 00 00 3e 2a 66 16 2b \|1<..~S.}...>f.+\| 07 70 d8 3b af 2d 9e 2b 37 06 8a 39 68 74 66 97 \|.p.;.-.+7..9htf.\| 00 4f 21 16 3d 68 44 a7 f2 21 00 00 9f bc 76 f5 \|.O!.=hD..!....v.\| ee 97 4f 5f 5f 75 6e c2 67 1c 64 16 72 78 5b 67 \|..O__un.g.d.rx[g\| 3a 35 69 2f 70 12 36 34 0e 65 9e 41 83 2b b4 69 \|:5i/p.64.e.A.+.i\| 1f d0 72 f5 67 41 fe 9e 29 0c 4e 19 16 74 68 69 \|..r.gA..).N..thi\| 73 42 e6 1e 6b 2a 64 47 70 61 2d c7 bb 1d ce 84 \|sB..kdGpa-.....\| 54 7c 0e ff 64 28 27 24 55 cd e7 79 4d 1a 1c 06 \|T\|..d('$U..yM...\| 10 04 f8 54 ec 3c cf f3 36 00 e0 0e d8 d0 c4 b8 \|...T.<..6.......\| 69 bc a7 f9 32 58 b0 a8 06 10 79 9e f7 ba 56 a4 \|i...2X....y...V.\| 0e a0 06 9c 98 94 e7 79 9e e7 90 84 80 7c 78 9e \|.......y.....\|x.\| e7 79 9e 74 70 6c 68 64 60 79 9e e7 79 5c 58 54 \|.y.tplhd`y..y\XT\| 50 4c e7 79 9e e7 48 44 40 3c 38 9e e7 79 9e 34 \|PL.y..HD@<8..y.4\| 30 2c 28 24 20 79 9e e7 79 1c 18 14 10 0c f3 3c \|0,($ y..y......<\| cd e7 08 fc 53 f0 e8 dc cf f3 3c cf c4 b8 a4 84 \|....S.....<.....\| 64 44 f3 ce e7 79 46 24 04 e0 52 06 a0 cf f3 3c \|dD...yF$..R....<\| cf 80 58 3c 2c 28 20 9e a7 f9 3c 10 ec 51 e4 d8 \|..X<,( ...<..Q..\| c8 79 9e e7 79 ac 8c 64 3c 14 f3 3c 4f f3 e8 50 \|.y..y..d<..
176	2057	52 37 48 1e 26 50 bf 54 1a 08 ee a6 dd 58 0a 2f \|R7H.&P.T.....X./\| 46 8e 66 8f 3b d8 6d ef 55 6e 43 1f ea e7 49 87 \|F.f.;.m.UnC...I.\| 6b 21 f6 da 00 57 f7 3b 00 4e 8a 1c 5e 77 f0 4d \|k!...W.;.N..^w.M\| 00 42 13 01 43 c3 36 78 47 e1 1e a7 41 52 56 4f \|.B..C.6xG...ARVO\| 01 0d 45 3b 63 01 22 6b 40 17 0b 1f 47 17 1b a7 \|..E;c."k@...G...\| b1 8d 66 4a 36 96 42 6b 03 33 6e e3 f2 56 d6 ab \|..fJ6.Bk.3n..V..\| f8 02 3e 41 6c 78 9c f7 37 4f 4a 54 57 da 7b 1f \|..>Alx..7OJTW.{.\| ae 0e 4d 0f 58 06 43 3f 0e 3c 0f 56 6c f7 03 00 \|..M.X.C?.<.Vl...\| 3b 53 f3 57 b2 31 c0 6a 2f 9e c1 ed bd 69 ab 53 \|;S.W.1.j/....i.S\| e6 64 b6 75 f7 2f 3b a0 f6 6e 07 33 33 70 0b 86 \|.d.u./;..n.33p..\| 65 bd b6 da 05 e7 4f a2 78 3a 63 b5 47 1b f7 27 \|e.....O.x:c.G..'\| 65 d6 76 65 4f 3e 7c ef 1d 53 12 72 56 70 fb 54 \|e.veO>\|..S.rVp.T\| 3f 6b df b1 8d f7 c6 61 2a 43 6f 4f 64 57 70 03 \|?k.....aCoOdWp.\| 79 92 00 00 8b 20 36 6e 62 1b 2b 6f 9e 8e be 77 \|y.... 6nb.+o...w\| 95 8b 6d 76 6d 43 79 db 37 60 13 de 00 75 78 74 \|..mvmCy.7`...uxt\| 68 b6 2e 64 52 49 73 54 8f ef 59 70 17 c7 36 59 \|h..dRIsT..Yp..6Y\| 19 c3 f0 e0 9c 4e 65 8b d2 03 50 77 73 01 7a 43 \|.....Ne...Pws.zC\| 76 d7 67 06 00 69 e3 1c 7c 4f 42 5e 63 c1 f9 5b \|v.g..i..\|OB^c..[\| ed 3a 4b 47 49 00 6e 93 2b f6 de 33 73 51 5a 6f \|.:KGI.n.+..3sQZo\| b6 61 af 29 d8 de ab 41 93 69 26 6e 4b 86 61 e0 \|.a.)...A.i&nK.a.\| 80 bd 77 54 76 6b 42 6e 7b 77 b8 37 d0 f7 ef 73 \|..wTvkBn{w.7...s\| bb 30 68 2a 66 16 92 a1 7d db eb 3f 5c 55 ef b5 \|.0hf...}..?\U..\| 3b 43 ba d2 62 0a 42 06 78 d7 54 07 c3 de 69 63 \|;C..b.B.x.T...ic\| 23 7c 47 9b d8 75 77 d7 4c 03 5f 0e 93 56 56 0e \|#\|G..uw.L._..VV.\| 7a 30 38 23 b5 a2 62 2f 69 78 f7 56 00 1f 2f e6 \|z08#..b/ix.V../.\| ff 8b 5d dc 37 6e 23 73 e2 77 4f 40 3b 8d b6 6c \|..].7n#s.wO@;..l\| ef 7f 57 c6 47 f7 7e 7d 2d 3b af e3 4c 12 41 36 \|..W.G.~}-;..L.A6\| 0d 76 d2 00 2b 43 53 17 b0 4f 17 a0 3e 4e af 47 \|.v..+CS..O..>N.G\| 6b 50 4f 97 d2 36 60 37 8b 80 7c 03 3c 0f 0f e7 \|kPO..6`7..\|.<...\| 66 47 4e c0 02 dc 03 d7 41 0e 4f 6b ef 0b 2b ab \|fGN.....A.Ok..+.\| 3e 73 06 75 17 e6 85 c0 80 64 47 1f \|>s.u.....dG. \|
4992	1033	1b 76 7b 80 b6 0e 43 77 56 97 5b 23 2d ef f0 2e \|.v{...CwV.[#-...\| 48 d3 ae 3e 3d b6 15 bc 81 23 3a 67 9f 47 6b 18 \|H..>=....#:g.Gk.\| fb d6 23 97 54 5b 17 74 69 db 05 cb 3d ef 33 4f \|..#.T[.ti...=.3O\| 41 70 03 12 5c 93 1f 47 5d d8 d5 b6 45 1f f7 d3 \|Ap..\..G]...E...\| 00 17 61 3a 00 ba 68 f3 62 cd 5d 8a 70 d3 3f af \|..a:..h.b.].p.?.\| 14 98 45 a1 ae 25 ae 6b 26 3a 06 3b b2 55 12 d7 \|..E..%.k&:.;.U..\| c7 c7 01 67 17 53 93 ef 15 7c c4 b0 33 9e 0e 29 \|...g.S...\|..3..)\| 66 18 06 c0 77 1b f9 9a a0 06 16 e9 a0 c5 0f 18 \|f...w...........\| 46 d8 e7 bd \|F... \|

module_name	ord	function_name
KERNEL32.DLL		LoadLibraryA
KERNEL32.DLL		GetProcAddress
KERNEL32.DLL		VirtualProtect
KERNEL32.DLL		VirtualAlloc
KERNEL32.DLL		VirtualFree
KERNEL32.DLL		ExitProcess
ADVAPI32.dll		GetAce
COMCTL32.dll		ImageList_Remove
COMDLG32.dll		GetSaveFileNameW
GDI32.dll		LineTo
MPR.dll		WNetUseConnectionW
ole32.dll		CoGetObject
OLEAUT32.dll	10
PSAPI.DLL		EnumProcesses
SHELL32.dll		DragFinish
USER32.dll		GetDC
USERENV.dll		LoadUserProfileW
VERSION.dll		VerQueryValueW
WININET.dll		FtpOpenFileW
WINMM.dll		timeGetTime
WSOCK32.dll	16

StringTable 080404b0

FileVersion	2.0.0.9
FileDescription	imimimi.blog.163.com - ESET_VC52_GetID
LegalCopyright	lss33333
ProductVersion	3.3.9.4

VS_FIXEDFILEINFO

FileVersion	2.0.0.9
ProductVersion	3.3.9.4
StrucVersion	0x10000
FileFlagsMask	0
FileFlags	0
FileOS	4
FileType	0
FileSubtype	0

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=ZA/O=Thawte Consulting (Pty) Ltd./CN=Thawte Code Signing CA

serial: 3A15A1539CB9167CD5E01C41A0FC9DCA

Certificates (4)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3a:15:a1:53:9c:b9:16:7c:d5:e0:1c:41:a0:fc:9d:ca
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, O=Thawte Consulting (Pty) Ltd., CN=Thawte Code Signing CA
        Validity
            Not Before: Apr 28 00:00:00 2009 GMT
            Not After : Apr 28 23:59:59 2011 GMT
        Subject: C=CN, ST=Hong Kong, L=Hong Kong , O=Version 2 Limited, CN=Version 2 Limited
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    00:c0:6f:b0:f5:91:11:70:3b:bf:e9:a1:a1:7d:75:
                    11:2f:ff:09:6e:1d:cf:59:18:c8:77:45:b8:45:56:
                    e4:f0:c3:90:98:5e:d9:23:bb:15:c9:b6:fa:23:40:
                    47:1a:54:fc:a4:c8:f6:35:b0:75:35:cb:c6:af:8c:
                    81:55:13:3e:20:29:37:71:aa:d7:b5:3b:b3:44:23:
                    19:7a:4b:4f:09:7f:ad:a0:14:95:f2:17:11:ad:90:
                    2e:39:88:69:84:f4:23:5e:97:ce:dc:d6:88:a4:45:
                    42:06:11:b2:d1:61:9b:79:82:a4:1b:41:f0:e1:f0:
                    c1:2e:1f:3d:37:e1:cd:2e:f9
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.thawte.com/ThawteCodeSigningCA.crl

            X509v3 Extended Key Usage: 
                Code Signing, Microsoft Commercial Code Signing
            2.5.29.4: 
                0.0.0..
+.....7.......
            Authority Information Access: 
                OCSP - URI:http://ocsp.thawte.com

            Netscape Cert Type: 
                Object Signing
    Signature Algorithm: sha1WithRSAEncryption
         9f:d6:2e:b9:00:70:b3:94:6e:5b:73:61:5d:54:85:b2:b5:bd:
         cc:4b:b2:30:90:13:51:87:ed:31:1a:a6:84:bf:48:61:9f:ec:
         8b:7f:15:96:d3:dd:07:65:e7:d7:8b:8e:a6:bc:ca:e8:e6:7f:
         36:90:7c:5c:15:77:5c:37:76:99:22:36:fd:96:9b:7a:24:94:
         24:dd:9f:48:97:99:bc:4d:2c:e8:12:e4:2b:e7:eb:04:ad:b8:
         7b:bc:90:b2:03:d2:f5:4d:50:63:5b:cb:4d:ef:80:2c:4d:a8:
         92:75:30:13:47:9b:4f:c7:4c:e5:a4:26:94:1a:34:f8:ef:56:
         43:9a

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 10 (0xa)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
        Validity
            Not Before: Aug  6 00:00:00 2003 GMT
            Not After : Aug  5 23:59:59 2013 GMT
        Subject: C=ZA, O=Thawte Consulting (Pty) Ltd., CN=Thawte Code Signing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    00:c6:b8:b9:27:60:af:0b:e3:91:69:65:db:7e:8d:
                    ed:91:e6:aa:f1:be:d5:ed:fe:6d:d4:2c:7f:d1:70:
                    77:fb:26:99:57:b4:dd:3f:30:b8:dc:21:ea:68:8d:
                    81:92:fc:2e:4b:91:35:84:20:f2:da:4a:ba:b4:fc:
                    e6:da:88:f2:20:c5:21:92:09:47:95:a0:09:1c:a6:
                    79:be:b1:4c:1d:fc:f1:8a:6e:54:d2:69:a1:f1:4c:
                    93:3a:41:fe:7d:d4:64:7b:63:45:f7:60:60:1d:31:
                    1d:a4:e9:d3:0f:8b:fb:6e:26:24:b3:a8:ff:e5:e5:
                    90:d4:b4:c2:dc:50:60:ae:59
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.thawte.com/ThawtePremiumServerCA.crl

            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, Code Signing
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name: 
                DirName:/CN=PrivateLabel2-144
    Signature Algorithm: sha1WithRSAEncryption
         76:b2:9c:ee:13:9f:1b:f6:2d:34:92:94:45:73:34:dc:8e:6b:
         2e:5c:fc:4c:7d:89:eb:c3:68:f1:d7:99:0f:2e:1d:17:c8:b5:
         16:8b:be:cd:8a:05:06:f2:19:49:3a:03:5b:05:c9:20:8e:6d:
         52:e1:76:81:a0:c3:65:8a:22:67:e4:1c:53:53:37:46:bf:bc:
         d7:2f:eb:7b:9e:d0:14:45:6c:40:21:08:e2:5d:75:76:66:30:
         1e:f4:df:82:8a:2f:bd:f3:a2:0c:bf:1d:db:9f:14:a2:9a:72:
         37:4d:b0:77:48:e8:4a:3f:09:ce:55:19:2c:ef:e6:07:24:e1:
         af:ec

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
        Validity
            Not Before: Jun 15 00:00:00 2007 GMT
            Not After : Jun 14 23:59:59 2012 GMT
        Subject: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    00:c4:b5:f2:52:15:bc:88:86:60:29:16:4a:5b:2f:
                    4b:91:6b:87:91:f3:35:54:58:35:ea:d1:36:5e:62:
                    4d:52:51:34:71:c2:7b:66:1d:89:c8:dd:2a:c4:6a:
                    0a:f6:37:d9:98:74:91:f6:92:ae:b0:b5:76:96:f1:
                    a9:4a:63:45:47:2e:6b:0b:92:4e:4b:2b:8c:ee:58:
                    4a:8b:d4:07:e4:1a:2c:f8:82:aa:58:d9:cd:42:f3:
                    2d:c0:75:de:8d:ab:c7:8e:1d:9a:6c:4c:08:95:1e:
                    de:db:ef:67:e1:72:c2:49:c2:9e:60:3c:e1:e2:be:
                    16:a3:63:78:69:14:7b:ad:2d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com

            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.verisign.com/tss-ca.crl

            X509v3 Extended Key Usage: critical
                Time Stamping
            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation
            X509v3 Subject Alternative Name: 
                DirName:/CN=TSA1-2
    Signature Algorithm: sha1WithRSAEncryption
         50:c5:4b:c8:24:80:df:e4:0d:24:c2:de:1a:b1:a1:02:a1:a6:
         82:2d:0c:83:15:81:37:0a:82:0e:2c:b0:5a:17:61:b5:d8:05:
         fe:88:db:f1:91:91:b3:56:1a:40:a6:eb:92:be:38:39:b0:75:
         36:74:3a:98:4f:e4:37:ba:99:89:ca:95:42:1d:b0:b9:c7:a0:
         8d:57:e0:fa:d5:64:04:42:35:4e:01:d1:33:a2:17:c8:4d:aa:
         27:c7:f2:e1:86:4c:02:38:4d:83:78:c6:fc:53:e0:eb:e0:06:
         87:dd:a4:96:9e:5e:0c:98:e2:a5:be:bf:82:85:c3:60:e1:df:
         ad:28:d8:c7:a5:4b:64:da:c7:1b:5b:bd:ac:39:08:d5:38:22:
         a1:33:8b:2f:8a:9a:eb:bc:07:21:3f:44:41:09:07:b5:65:1c:
         24:bc:48:d3:44:80:eb:a1:cf:c9:02:b4:14:cf:54:c7:16:a3:
         80:5c:f9:79:3e:5d:72:7d:88:17:9e:2c:43:a2:ca:53:ce:7d:
         3d:f6:2a:3a:b8:4f:94:00:a5:6d:0a:83:5d:f9:5e:53:f4:18:
         b3:57:0f:70:c3:fb:f5:ad:95:a0:0e:17:de:c4:16:80:60:c9:
         0f:2b:6e:86:04:f1:eb:f4:78:27:d1:05:c5:ee:34:5b:5e:b9:
         49:32:f2:33

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
        Validity
            Not Before: Dec  4 00:00:00 2003 GMT
            Not After : Dec  3 23:59:59 2013 GMT
        Subject: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:a9:ca:b2:a4:cc:cd:20:af:0a:7d:89:ac:87:75:
                    f0:b4:4e:f1:df:c1:0f:bf:67:61:bd:a3:64:1c:da:
                    bb:f9:ca:33:ab:84:30:89:58:7e:8c:db:6b:dd:36:
                    9e:0f:bf:d1:ec:78:f2:77:a6:7e:6f:3c:bf:93:af:
                    0d:ba:68:f4:6c:94:ca:bd:52:2d:ab:48:3d:f5:b6:
                    d5:5d:5f:1b:02:9f:fa:2f:6b:1e:a4:f7:a3:9a:a6:
                    1a:c8:02:e1:7f:4c:52:e3:0e:60:ec:40:1c:7e:b9:
                    0d:de:3f:c7:b4:df:87:bd:5f:7a:6a:31:2e:03:99:
                    81:13:a8:47:20:ce:31:73:0d:57:2d:cd:78:34:33:
                    95:12:99:12:b9:de:68:2f:aa:e6:e3:c2:8a:8c:2a:
                    c3:8b:21:87:66:bd:83:58:57:6f:75:bf:3c:aa:26:
                    87:5d:ca:10:15:3c:9f:84:ea:54:c1:0a:6e:c4:fe:
                    c5:4a:dd:b9:07:11:97:22:7c:db:3e:27:d1:1e:78:
                    ec:9f:31:c9:f1:e6:22:19:db:c4:b3:47:43:9a:1a:
                    5f:a0:1e:90:e4:5e:f5:ee:7c:f1:7d:ab:62:01:8f:
                    f5:4d:0b:de:d0:22:56:a8:95:cd:ae:88:76:ae:ee:
                    ba:0d:f3:e4:4d:d9:a0:fb:68:a0:ae:14:3b:b3:87:
                    c1:bb
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com

            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.verisign.com/ThawteTimestampingCA.crl

            X509v3 Extended Key Usage: 
                Time Stamping
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name: 
                DirName:/CN=TSA2048-1-53
    Signature Algorithm: sha1WithRSAEncryption
         4a:6b:f9:ea:58:c2:44:1c:31:89:79:99:2b:96:bf:82:ac:01:
         d6:1c:4c:cd:b0:8a:58:6e:df:08:29:a3:5e:c8:ca:93:13:e7:
         04:52:0d:ef:47:27:2f:00:38:b0:e4:c9:93:4e:9a:d4:22:62:
         15:f7:3f:37:21:4f:70:31:80:f1:8b:38:87:b3:e8:e8:97:00:
         fe:cf:55:96:4e:24:d2:a9:27:4e:7a:ae:b7:61:41:f3:2a:ce:
         e7:c9:d9:5e:dd:bb:2b:85:3e:b5:9d:b5:d9:e1:57:ff:be:b4:
         c5:7e:f5:cf:0c:9e:f0:97:fe:2b:d3:3b:52:1b:1b:38:27:f7:
         3f:4a

pkcs7-signedData

1
- MD5: nil
- 1.3.6.1.4.1.311.2.1.4
  - #0
    - 1.3.6.1.4.1.311.2.1.15
      - :
        00 3c 00 3c 00 3c 00 4f 00 62 00 73 00 6f 00 6c |.<.<.<.O.b.s.o.l| 00 65 00 74 00 65 00 3e 00 3e 00 3e |.e.t.e.>.>.> |
    - MD5
      - 0d 1a 90 9b cd 95 6f ae ef c5 0f ea 75 d3 7f 76 |......o.....u..v|
- Certificates
  - Certificate #0
    - 2
      - 3A:15:A1:53:9C:B9:16:7C:D5:E0:1C:41:A0:FC:9D:CA
      - RSA-SHA1: nil
      - Issuer
        C: ZA
        O: Thawte Consulting (Pty) Ltd.
        CN: Thawte Code Signing CA
      - 2009-04-28 00:00:00 UTC: 2011-04-28 23:59:59 UTC
      - Subject
        C: CN
        ST: Hong Kong
        L: Hong Kong
        O: Version 2 Limited
        CN: Version 2 Limited
      - #5
        rsaEncryption: nil
        C0:6F:B0:F5:91:11:70:3B:BF:E9:A1:A1:7D:75:11:2F:
        FF:09:6E:1D:CF:59:18:C8:77:45:B8:45:56:E4:F0:C3:
        90:98:5E:D9:23:BB:15:C9:B6:FA:23:40:47:1A:54:FC:
        A4:C8:F6:35:B0:75:35:CB:C6:AF:8C:81:55:13:3E:20:
        29:37:71:AA:D7:B5:3B:B3:44:23:19:7A:4B:4F:09:7F:
        AD:A0:14:95:F2:17:11:AD:90:2E:39:88:69:84:F4:23:
        5E:97:CE:DC:D6:88:A4:45:42:06:11:B2:D1:61:9B:79:
        82:A4:1B:41:F0:E1:F0:C1:2E:1F:3D:37:E1:CD:2E:F9: 0x010001
      - X509v3 extensions
        basicConstraints
        true
        nil
        crlDistributionPoints: http://crl.thawte.com/ThawteCodeSigningCA.crl
        extendedKeyUsage
        codeSigning: msCodeCom
        2.5.29.4
        msCodeCom: 0x80
        authorityInfoAccess
        OCSP: http://ocsp.thawte.com
        nsCertType: 0x10
    - RSA-SHA1:
```
9f d6 2e b9 00 70 b3 94  6e 5b 73 61 5d 54 85 b2  |.....p..n[sa]T..|
b5 bd cc 4b b2 30 90 13  51 87 ed 31 1a a6 84 bf  |...K.0..Q..1....|
48 61 9f ec 8b 7f 15 96  d3 dd 07 65 e7 d7 8b 8e  |Ha.........e....|
a6 bc ca e8 e6 7f 36 90  7c 5c 15 77 5c 37 76 99  |......6.|\.w\7v.|
22 36 fd 96 9b 7a 24 94  24 dd 9f 48 97 99 bc 4d  |"6...z$.$..H...M|
2c e8 12 e4 2b e7 eb 04  ad b8 7b bc 90 b2 03 d2  |,...+.....{.....|
f5 4d 50 63 5b cb 4d ef  80 2c 4d a8 92 75 30 13  |.MPc[.M..,M..u0.|
47 9b 4f c7 4c e5 a4 26  94 1a 34 f8 ef 56 43 9a  |G.O.L..&..4..VC.|
```
  - Certificate #1
    - 2
      - 0x0A
      - RSA-SHA1: nil
      - Issuer
        C: ZA
        ST: Western Cape
        L: Cape Town
        O: Thawte Consulting cc
        OU: Certification Services Division
        CN: Thawte Premium Server CA
        emailAddress: premium-server@thawte.com
      - 2003-08-06 00:00:00 UTC: 2013-08-05 23:59:59 UTC
      - Subject
        C: ZA
        O: Thawte Consulting (Pty) Ltd.
        CN: Thawte Code Signing CA
      - #5
        rsaEncryption: nil
        C6:B8:B9:27:60:AF:0B:E3:91:69:65:DB:7E:8D:ED:91:
        E6:AA:F1:BE:D5:ED:FE:6D:D4:2C:7F:D1:70:77:FB:26:
        99:57:B4:DD:3F:30:B8:DC:21:EA:68:8D:81:92:FC:2E:
        4B:91:35:84:20:F2:DA:4A:BA:B4:FC:E6:DA:88:F2:20:
        C5:21:92:09:47:95:A0:09:1C:A6:79:BE:B1:4C:1D:FC:
        F1:8A:6E:54:D2:69:A1:F1:4C:93:3A:41:FE:7D:D4:64:
        7B:63:45:F7:60:60:1D:31:1D:A4:E9:D3:0F:8B:FB:6E:
        26:24:B3:A8:FF:E5:E5:90:D4:B4:C2:DC:50:60:AE:59: 0x010001
      - X509v3 extensions
        basicConstraints
        true
        true: 0
        crlDistributionPoints: http://crl.thawte.com/ThawtePremiumServerCA.crl
        extendedKeyUsage
        clientAuth: codeSigning
        keyUsage: true, 6
        subjectAltName
        CN: PrivateLabel2-144
    - RSA-SHA1:
```
76 b2 9c ee 13 9f 1b f6  2d 34 92 94 45 73 34 dc  |v.......-4..Es4.|
8e 6b 2e 5c fc 4c 7d 89  eb c3 68 f1 d7 99 0f 2e  |.k.\.L}...h.....|
1d 17 c8 b5 16 8b be cd  8a 05 06 f2 19 49 3a 03  |.............I:.|
5b 05 c9 20 8e 6d 52 e1  76 81 a0 c3 65 8a 22 67  |[.. .mR.v...e."g|
e4 1c 53 53 37 46 bf bc  d7 2f eb 7b 9e d0 14 45  |..SS7F.../.{...E|
6c 40 21 08 e2 5d 75 76  66 30 1e f4 df 82 8a 2f  |l@!..]uvf0...../|
bd f3 a2 0c bf 1d db 9f  14 a2 9a 72 37 4d b0 77  |...........r7M.w|
48 e8 4a 3f 09 ce 55 19  2c ef e6 07 24 e1 af ec  |H.J?..U.,...$...|
```
  - Certificate #2
    - 2
      - 38:25:D7:FA:F8:61:AF:9E:F4:90:E7:26:B5:D6:5A:D5
      - RSA-SHA1: nil
      - Issuer
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services CA
      - 2007-06-15 00:00:00 UTC: 2012-06-14 23:59:59 UTC
      - Subject
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services Signer - G2
      - #5
        rsaEncryption: nil
        C4:B5:F2:52:15:BC:88:86:60:29:16:4A:5B:2F:4B:91:
        6B:87:91:F3:35:54:58:35:EA:D1:36:5E:62:4D:52:51:
        34:71:C2:7B:66:1D:89:C8:DD:2A:C4:6A:0A:F6:37:D9:
        98:74:91:F6:92:AE:B0:B5:76:96:F1:A9:4A:63:45:47:
        2E:6B:0B:92:4E:4B:2B:8C:EE:58:4A:8B:D4:07:E4:1A:
        2C:F8:82:AA:58:D9:CD:42:F3:2D:C0:75:DE:8D:AB:C7:
        8E:1D:9A:6C:4C:08:95:1E:DE:DB:EF:67:E1:72:C2:49:
        C2:9E:60:3C:E1:E2:BE:16:A3:63:78:69:14:7B:AD:2D: 0x010001
      - X509v3 extensions
        authorityInfoAccess
        OCSP: http://ocsp.verisign.com
        basicConstraints
        true
        nil
        crlDistributionPoints: http://crl.verisign.com/tss-ca.crl
        extendedKeyUsage: true, timeStamping
        keyUsage: true, 0xc0
        subjectAltName
        CN: TSA1-2
    - RSA-SHA1:
```
50 c5 4b c8 24 80 df e4  0d 24 c2 de 1a b1 a1 02  |P.K.$....$......|
a1 a6 82 2d 0c 83 15 81  37 0a 82 0e 2c b0 5a 17  |...-....7...,.Z.|
61 b5 d8 05 fe 88 db f1  91 91 b3 56 1a 40 a6 eb  |a..........V.@..|
92 be 38 39 b0 75 36 74  3a 98 4f e4 37 ba 99 89  |..89.u6t:.O.7...|
ca 95 42 1d b0 b9 c7 a0  8d 57 e0 fa d5 64 04 42  |..B......W...d.B|
35 4e 01 d1 33 a2 17 c8  4d aa 27 c7 f2 e1 86 4c  |5N..3...M.'....L|
02 38 4d 83 78 c6 fc 53  e0 eb e0 06 87 dd a4 96  |.8M.x..S........|
9e 5e 0c 98 e2 a5 be bf  82 85 c3 60 e1 df ad 28  |.^.........`...(|
d8 c7 a5 4b 64 da c7 1b  5b bd ac 39 08 d5 38 22  |...Kd...[..9..8"|
a1 33 8b 2f 8a 9a eb bc  07 21 3f 44 41 09 07 b5  |.3./.....!?DA...|
65 1c 24 bc 48 d3 44 80  eb a1 cf c9 02 b4 14 cf  |e.$.H.D.........|
54 c7 16 a3 80 5c f9 79  3e 5d 72 7d 88 17 9e 2c  |T....\.y>]r}...,|
43 a2 ca 53 ce 7d 3d f6  2a 3a b8 4f 94 00 a5 6d  |C..S.}=.*:.O...m|
0a 83 5d f9 5e 53 f4 18  b3 57 0f 70 c3 fb f5 ad  |..].^S...W.p....|
95 a0 0e 17 de c4 16 80  60 c9 0f 2b 6e 86 04 f1  |........`..+n...|
eb f4 78 27 d1 05 c5 ee  34 5b 5e b9 49 32 f2 33  |..x'....4[^.I2.3|
```
  - Certificate #3
    - 2
      - 47:BF:19:95:DF:8D:52:46:43:F7:DB:6D:48:0D:31:A4
      - RSA-SHA1: nil
      - Issuer
        C: ZA
        ST: Western Cape
        L: Durbanville
        O: Thawte
        OU: Thawte Certification
        CN: Thawte Timestamping CA
      - 2003-12-04 00:00:00 UTC: 2013-12-03 23:59:59 UTC
      - Subject
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services CA
      - #5
        rsaEncryption: nil
        A9:CA:B2:A4:CC:CD:20:AF:0A:7D:89:AC:87:75:F0:B4:
        4E:F1:DF:C1:0F:BF:67:61:BD:A3:64:1C:DA:BB:F9:CA:
        33:AB:84:30:89:58:7E:8C:DB:6B:DD:36:9E:0F:BF:D1:
        EC:78:F2:77:A6:7E:6F:3C:BF:93:AF:0D:BA:68:F4:6C:
        94:CA:BD:52:2D:AB:48:3D:F5:B6:D5:5D:5F:1B:02:9F:
        FA:2F:6B:1E:A4:F7:A3:9A:A6:1A:C8:02:E1:7F:4C:52:
        E3:0E:60:EC:40:1C:7E:B9:0D:DE:3F:C7:B4:DF:87:BD:
        5F:7A:6A:31:2E:03:99:81:13:A8:47:20:CE:31:73:0D:
        57:2D:CD:78:34:33:95:12:99:12:B9:DE:68:2F:AA:E6:
        E3:C2:8A:8C:2A:C3:8B:21:87:66:BD:83:58:57:6F:75:
        BF:3C:AA:26:87:5D:CA:10:15:3C:9F:84:EA:54:C1:0A:
        6E:C4:FE:C5:4A:DD:B9:07:11:97:22:7C:DB:3E:27:D1:
        1E:78:EC:9F:31:C9:F1:E6:22:19:DB:C4:B3:47:43:9A:
        1A:5F:A0:1E:90:E4:5E:F5:EE:7C:F1:7D:AB:62:01:8F:
        F5:4D:0B:DE:D0:22:56:A8:95:CD:AE:88:76:AE:EE:BA:
        0D:F3:E4:4D:D9:A0:FB:68:A0:AE:14:3B:B3:87:C1:BB: 0x010001
      - X509v3 extensions
        authorityInfoAccess
        OCSP: http://ocsp.verisign.com
        basicConstraints
        true
        true: 0
        crlDistributionPoints: http://crl.verisign.com/ThawteTimestampingCA.crl
        extendedKeyUsage: timeStamping
        keyUsage: true, 6
        subjectAltName
        CN: TSA2048-1-53
    - RSA-SHA1:
```
4a 6b f9 ea 58 c2 44 1c  31 89 79 99 2b 96 bf 82  |Jk..X.D.1.y.+...|
ac 01 d6 1c 4c cd b0 8a  58 6e df 08 29 a3 5e c8  |....L...Xn..).^.|
ca 93 13 e7 04 52 0d ef  47 27 2f 00 38 b0 e4 c9  |.....R..G'/.8...|
93 4e 9a d4 22 62 15 f7  3f 37 21 4f 70 31 80 f1  |.N.."b..?7!Op1..|
8b 38 87 b3 e8 e8 97 00  fe cf 55 96 4e 24 d2 a9  |.8........U.N$..|
27 4e 7a ae b7 61 41 f3  2a ce e7 c9 d9 5e dd bb  |'Nz..aA.*....^..|
2b 85 3e b5 9d b5 d9 e1  57 ff be b4 c5 7e f5 cf  |+.>.....W....~..|
0c 9e f0 97 fe 2b d3 3b  52 1b 1b 38 27 f7 3f 4a  |.....+.;R..8'.?J|
```
- 1
  - unnamed
    - #0
      - C: ZA
      - O: Thawte Consulting (Pty) Ltd.
      - CN: Thawte Code Signing CA
    - 3A:15:A1:53:9C:B9:16:7C:D5:E0:1C:41:A0:FC:9D:CA
  - MD5: nil
  - #2
    - 1.3.6.1.4.1.311.2.1.12
      - nil
    - contentType: 1.3.6.1.4.1.311.2.1.4
    - 1.3.6.1.4.1.311.2.1.11: msCodeCom
    - messageDigest:
```
cd fd 5b 34 e7 72 2b 39  e1 87 9b 8f 34 ce 7a 26  |..[4.r+9....4.z&|
```
  - rsaEncryption:
```
5e 42 c5 af 71 d5 07 62  7f 09 3d 32 28 5f d6 59  |^B..q..b..=2(_.Y|
c3 75 a9 73 d8 77 37 ff  32 b0 4b 62 1f e1 19 26  |.u.s.w7.2.Kb...&|
fb 03 50 23 81 11 09 c3  aa b8 04 93 fe ec 81 08  |..P#............|
3a 78 08 56 b0 6b f8 0b  8d a2 29 b6 d6 40 c3 4c  |:x.V.k....)..@.L|
2d dd d6 15 af f3 42 89  c4 30 c4 8c 38 3d b0 9b  |-.....B..0..8=..|
28 55 e7 8b 41 6b 6a 65  c1 65 c5 96 3e f2 79 49  |(U..Akje.e..>.yI|
64 c1 d0 43 06 f6 32 3f  b1 92 77 0e 60 5a 34 7b  |d..C..2?..w.`Z4{|
f3 cf 41 c5 97 41 2d 5e  e6 d8 c9 d3 7c 80 cf 46  |..A..A-^....|..F|
```
  - countersignature
    - 1
      - unnamed
        #0
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services CA
        38:25:D7:FA:F8:61:AF:9E:F4:90:E7:26:B5:D6:5A:D5
      - SHA1: nil
      - #2
        contentType: pkcs7-data
        signingTime: 2009-08-26 07:51:18 UTC
        messageDigest:
        3f c3 26 c2 c4 8a 57 c2 a7 b0 0b de fa 55 01 25 |?.&...W......U.%| 43 56 ce de |CV.. |
      - rsaEncryption:
        01 e9 ee 31 38 2b b0 26 18 f9 86 37 a9 a0 6c 11 |...18+.&...7..l.| 01 55 86 cd 49 d5 30 84 10 1b 2c 17 7d 0d 77 88 |.U..I.0...,.}.w.| d9 ca ba 8c c8 58 eb d2 67 e9 6e e2 ea 3a a5 a6 |.....X..g.n..:..| fe ba 6d 50 50 bf 62 48 09 e9 4e a8 90 ed 30 6c |..mPP.bH..N...0l| e5 d4 59 a1 75 82 51 35 60 c2 54 f5 73 9e e2 51 |..Y.u.Q5`.T.s..Q| 98 34 71 4c 9f a1 82 a7 07 c2 21 65 75 ad ed 38 |.4qL......!eu..8| 95 cb df 54 74 ee cd dc bc 65 32 63 f8 28 a4 65 |...Tt....e2c.(.e| 1d 56 8e aa 33 4c 92 32 7d 98 ab 1b 6f b4 87 6b |.V..3L.2}...o..k|

show previews

offset	size	type	comment
0	344064	EXE	04/10/2012 00:11:21	#
15c1	15	HTM		#
54000	45872	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[!] string size(28606) > stringtable size(542). truncated to 540

[!] cannot convert "\xDA\xA8.\xEAY\x18\x06P\xE6\xC6o\xAE\x9C\xFC\x1D["... to UTF-16

[!] string size(84060) > stringtable size(720). truncated to 718

[!] cannot convert "\xC9\xCF\xE91\x91\xBF\xB9;\x10/\b\x06>.1\a"... to UTF-16

[!] string size(31684) > stringtable size(542). truncated to 540

[!] cannot convert "\x16\x18`Eap\x91\xBF\xB9r\xF2I0\xAEH\x16"... to UTF-16

[!] string size(6380) > stringtable size(760). truncated to 758

[!] cannot convert "\xFB\xE2G\x1A$\x00\xC2\xCC\xAF\x81/\x7Fs\xE5\xE4p"... to UTF-16

[!] string size(24812) > stringtable size(764). truncated to 762

[!] cannot convert "\x88\r~\xDB\xFBcopy\bnXru!i"... to UTF-16

[!] string size(28324) > stringtable size(492). truncated to 490

[!] cannot convert "H\x1E&P\xBFT\x1A\b\xEE\xA6\xDDX\n/F\x8E"... to UTF-16

[!] string size(60470) > stringtable size(132). truncated to 130

[!] cannot convert "{\x80\xB6\x0ECwV\x97[#-\xEF\xF0.H\xD3"... to UTF-16

ESET_VC52_GetID.exe- imimimi.blog.163.com - ESET_VC52_GetID