filenamehp (1).gf
size1155336 (0x11a108)
md5e3cce010a6dd36ea82db065ee92f2c2e
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd8

Rich Header

lib idversiontimes used
123507279
1030
131210221
003
148210221
145210221

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x5c9cc049
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion9.0
SizeOfCode0x10ba00
SizeOfInitializedData0xd600
SizeOfUninitializedData0
AddressOfEntryPoint0x2040
BaseOfCode0x1000
BaseOfData0x10d000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x208000
SizeOfHeaders0x400
CheckSum0x129dad
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x10b9d00x10ba00R-X CODE
.rdata0x10d0000x98b20x9a00R-- IDATA
.data0x1170000x1d700x1e00RW- IDATA
.rsrc0x1190000xeec480x1e00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x1165680x64
RESOURCE0x1190000x1c48
EXCEPTION00
SECURITY0x1194000xd08
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x10d0000x88
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#12960
ICON#213840
ICON#37440
ICON#422160
RCDATA#110500
GROUP_ICON#101620
VERSION#110320
module_namehintordfunction_name
KERNEL32.dll753LoadLibraryA
KERNEL32.dll502GetModuleHandleA
KERNEL32.dll81CompareFileTime
KERNEL32.dll128CreateHardLinkA
KERNEL32.dll321FlushFileBuffers
KERNEL32.dll544GetProcAddress
KERNEL32.dll649GlobalFindAtomW
KERNEL32.dll756LoadLibraryW
KERNEL32.dll845QueryDosDeviceA
KERNEL32.dll924SetCommBreak
KERNEL32.dll1020SetStdHandle
KERNEL32.dll454GetExitCodeThread
KERNEL32.dll1108VirtualAlloc
USER32.dll469LoadCursorW
USER32.dll47CharNextW
ADVAPI32.dll601RegOpenKeyA
SHELL32.dll188SHGetFolderPathA
SHELL32.dll6CheckEscapesW
SHELL32.dll25DoEnvironmentSubstA
SHELL32.dll291Shell_NotifyIconW
SHELL32.dll289Shell_NotifyIcon
SHELL32.dll276ShellExecuteA
SHELL32.dll217SHGetSpecialFolderPathA
SHELL32.dll207SHGetPathFromIDListA
SHELL32.dll197SHGetInstanceExplorer
SHELL32.dll175SHFreeNameMappings
SHELL32.dll42ExtractIconExA
SHELL32.dll32DragQueryFileW
SHELL32.dll31DragQueryFileAorW
SHELL32.dll30DragQueryFileA

StringTable 04090000

CommentsTool used internally by Total Commander, do not start directly!
CompanyNameGhisler Software GmbH
FileDescriptionTotal Commander 32bit->64bit helper tool
FileVersion1, 0, 0, 7
InternalNameTotalcmd-X64
LegalCopyrightCopyright © 2008-2016 Christian Ghisler
OriginalFilenametcmdx64.exe
ProductNameGhisler Software GmbH Totalcmd-X64
ProductVersion1, 0, 0, 7

VS_FIXEDFILEINFO

FileVersion1.0.0.7
ProductVersion1.0.0.7
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0

Signers (1)

issuer: /CN=KXIDPVBY
serial: 50422C8A091132B34BDF608B7866B4CD

Certificates (1)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            50:42:2c:8a:09:11:32:b3:4b:df:60:8b:78:66:b4:cd
        Signature Algorithm: sha1WithRSA
        Issuer: CN=KXIDPVBY
        Validity
            Not Before: Mar 27 12:28:55 2019 GMT
            Not After : Dec 31 23:59:59 2039 GMT
        Subject: CN=KXIDPVBY
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    00:b6:14:99:81:c5:ae:41:29:0c:83:9d:d4:6b:70:
                    4a:e9:a3:26:31:2d:12:17:81:1f:1f:36:c8:01:db:
                    a6:e2:35:1c:02:30:a3:01:dc:a3:2b:a8:9d:1f:57:
                    72:cd:4d:72:9d:df:62:73:80:6c:ed:32:0e:d9:04:
                    28:b9:d6:b8:f4:82:13:2e:a5:77:b7:b2:bd:64:b8:
                    0f:48:2c:db:de:35:df:db:23:0a:67:06:ee:d7:06:
                    7e:65:f7:cd:78:2e:4e:d0:b5:35:fa:67:da:81:f5:
                    ee:2a:07:65:a0:b4:bd:37:17:56:16:94:5b:87:a6:
                    59:9c:af:f7:5a:6a:5e:61:5d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                Code Signing
            2.5.29.1: 
                0;../-2J.FI..r<.......0.1.0...U....KXIDPVBY..PB,...2.K.`.xf..
    Signature Algorithm: sha1WithRSA
         0b:35:89:80:2f:af:dc:77:33:e6:6d:e7:01:e6:75:b8:8d:3b:
         ec:8f:94:1f:81:58:e9:df:34:77:55:04:19:26:e4:2c:0c:02:
         d7:c5:e7:5a:c9:62:44:0d:fc:10:ac:70:0a:93:6c:b8:f8:05:
         09:06:94:14:70:b6:22:5f:94:6b:b2:91:4d:92:e1:56:77:cf:
         d9:53:ce:ca:03:4f:57:df:57:fd:7b:d5:f4:97:ab:db:aa:14:
         ee:40:3b:48:2f:d2:34:23:18:47:bf:15:7f:c8:95:14:0f:88:
         f8:ed:1d:74:1b:da:e2:2e:ae:de:d1:be:81:cc:6a:22:af:b8:
         4e:9b
pkcs7-signedData
  • 1
    • SHA256: nil
    • 1.3.6.1.4.1.311.2.1.4
      • #0
        • 1.3.6.1.4.1.311.2.1.15
          • : 
            00 3c 00 3c 00 3c 00 4f  00 62 00 73 00 6f 00 6c  |.<.<.<.O.b.s.o.l|
00 65 00 74 00 65 00 3e  00 3e 00 3e              |.e.t.e.>.>.>    |
        • SHA256
          • 0f 86 21 60 6d e4 4a 61  ad eb ad 9c 1e 40 05 0c  |..!`m.Ja.....@..|
3a 9f 9e 74 43 37 66 a5  bc 79 fb 70 1f 2f c8 b8  |:..tC7f..y.p./..|
    • #2
      • 2
        • 50:42:2C:8A:09:11:32:B3:4B:DF:60:8B:78:66:B4:CD
        • RSA-SHA1-2: nil
        • CN: KXIDPVBY
        • 2019-03-27 12:28:55 UTC: 2039-12-31 23:59:59 UTC
        • CN: KXIDPVBY
        • #5
          • rsaEncryption: nil
          • B6:14:99:81:C5:AE:41:29:0C:83:9D:D4:6B:70:4A:E9:
            A3:26:31:2D:12:17:81:1F:1F:36:C8:01:DB:A6:E2:35:
            1C:02:30:A3:01:DC:A3:2B:A8:9D:1F:57:72:CD:4D:72:
            9D:DF:62:73:80:6C:ED:32:0E:D9:04:28:B9:D6:B8:F4:
            82:13:2E:A5:77:B7:B2:BD:64:B8:0F:48:2C:DB:DE:35:
            DF:DB:23:0A:67:06:EE:D7:06:7E:65:F7:CD:78:2E:4E:
            D0:B5:35:FA:67:DA:81:F5:EE:2A:07:65:A0:B4:BD:37:
            17:56:16:94:5B:87:A6:59:9C:AF:F7:5A:6A:5E:61:5D            : 0x010001
        • #6
          • extendedKeyUsage: codeSigning
          • 2.5.29.1
            • 2f 2d 32 4a a3 46 49 16  07 72 3c db 9e 90 e1 0c  |/-2J.FI..r<.....|
              • CN: KXIDPVBY
              • 50 42 2c 8a 09 11 32 b3  4b df 60 8b 78 66 b4 cd  |PB,...2.K.`.xf..|
      • RSA-SHA1-2: 
        0b 35 89 80 2f af dc 77  33 e6 6d e7 01 e6 75 b8  |.5../..w3.m...u.|
8d 3b ec 8f 94 1f 81 58  e9 df 34 77 55 04 19 26  |.;.....X..4wU..&|
e4 2c 0c 02 d7 c5 e7 5a  c9 62 44 0d fc 10 ac 70  |.,.....Z.bD....p|
0a 93 6c b8 f8 05 09 06  94 14 70 b6 22 5f 94 6b  |..l.......p."_.k|
b2 91 4d 92 e1 56 77 cf  d9 53 ce ca 03 4f 57 df  |..M..Vw..S...OW.|
57 fd 7b d5 f4 97 ab db  aa 14 ee 40 3b 48 2f d2  |W.{........@;H/.|
34 23 18 47 bf 15 7f c8  95 14 0f 88 f8 ed 1d 74  |4#.G...........t|
1b da e2 2e ae de d1 be  81 cc 6a 22 af b8 4e 9b  |..........j"..N.|
    • 1
      • #0
        • CN: KXIDPVBY
        • 50:42:2C:8A:09:11:32:B3:4B:DF:60:8B:78:66:B4:CD
      • SHA256: nil
      • #2
        • contentType: pkcs7-data
        • 1.3.6.1.4.1.311.2.1.12
          • :
        • 1.3.6.1.4.1.311.2.1.11: msCodeInd
        • signingTime: 1899-12-30 00:00:00 UTC
        • messageDigest: 
          9a 3d c0 c4 dd 5b 66 c4  4b 3c 20 10 f3 a7 80 46  |.=...[f.K< ....F|
0f be ec 43 e0 20 5b b4  05 25 4a ef d8 ad cd 7a  |...C. [..%J....z|
        • id-smime-aa-signingCertificate
          • 21 3c 40 e1 46 24 ab 7f  84 b0 14 51 8c 2a 45 3f  |!<@.F$.....Q.*E?|
31 74 a6 27                                       |1t.'            |
            • #0
              • CN: KXIDPVBY
              • 50:42:2C:8A:09:11:32:B3:4B:DF:60:8B:78:66:B4:CD
      • RSA-SHA256: 
        42 c5 8f 90 c5 49 81 c4  d9 93 bb 92 22 1a b2 01  |B....I......"...|
e2 ee e7 18 d6 07 fe 0a  02 1d 82 c8 db 2e 9c 6e  |...............n|
61 39 63 7f d8 b7 32 e5  7f c0 3e 82 69 a1 b6 15  |a9c...2...>.i...|
bc 62 9d f8 36 f4 f6 fc  49 96 9d 2a be bd 5b 23  |.b..6...I..*..[#|
af 6d f0 fc 43 c0 64 57  f4 dc b4 de 27 7b 88 42  |.m..C.dW....'{.B|
cc 1e aa 36 bf f7 02 03  df 8d 51 5b ac 11 73 eb  |...6......Q[..s.|
ec 4d ca 4f 44 74 09 d0  39 ea 35 6b 27 3f 8f 07  |.M.ODt..9.5k'?..|
ac 0f 71 a2 83 f5 09 b2  7b 33 89 96 b1 f8 ba 30  |..q.....{3.....0|
      • 1.3.6.1.4.1.311.3.3.1
        • pkcs7-signedData
          • 3
            • SHA256: nil
            • id-smime-ct-TSTInfo
              • 1
                • 1.3.6.1.4.1.6449.2.1.1
                • SHA256: 
                  ed e0 04 0e 9b 05 9e ef  47 41 58 bb 78 4a 9b e1  |........GAX.xJ..|
b4 13 22 ce 7b 2e d3 04  46 44 94 08 7b 36 7f d8  |..".{...FD..{6..|
                • 2E:8F:CB:46:91:CC:64:4E:55:B1:A9:34:23:7F:0C:8D:
                  8C:9E:BB:33
                • 2019-03-28 12:38:45 UTC
                • 6B:E9:EE:43:8E:32:9A:31
                • #5
                  • C: GB
                  • ST: Greater Manchester
                  • L: Salford
                  • O: COMODO CA Limited
                  • CN: COMODO SHA-256 Time Stamping Signer
            • Certificate #2
              • 2
                • 4E:B0:87:8F:CC:24:35:36:B2:D8:C9:F7:BF:39:55:77
                • RSA-SHA256: nil
                • Issuer
                  • C: US
                  • ST: UT
                  • L: Salt Lake City
                  • O: The USERTRUST Network
                  • OU: http://www.usertrust.com
                  • CN: UTN-USERFirst-Object
                • 2015-12-31 00:00:00 UTC: 2019-07-09 18:40:36 UTC
                • Subject
                  • C: GB
                  • ST: Greater Manchester
                  • L: Salford
                  • O: COMODO CA Limited
                  • CN: COMODO SHA-256 Time Stamping Signer
                • #5
                  • rsaEncryption: nil
                  • CE:BC:74:B7:70:80:4F:5E:F3:3F:98:AA:2E:CB:D4:12:
                    01:23:35:69:0B:22:BC:E6:FD:09:6C:28:E4:13:12:AC:
                    BB:BA:2D:E5:D5:DD:22:EE:73:B6:2C:F8:D2:A4:71:E7:
                    49:25:78:AB:25:B7:90:10:A0:9B:8B:77:26:DD:40:EA:
                    41:A3:FD:88:CD:72:A6:89:3B:50:57:1C:7A:25:24:22:
                    02:51:40:35:67:8A:31:69:0D:E5:39:73:49:39:9B:95:
                    01:85:52:F2:2B:14:89:9A:4E:04:A4:BC:40:AE:39:A6:
                    DD:40:02:E0:3A:75:FE:3D:7D:55:94:5B:F1:4E:24:7C:
                    C8:B8:58:19:CA:C0:DA:BE:58:13:9A:E6:1C:E7:D1:C1:
                    3B:F0:5D:8F:49:08:21:9E:D0:F3:BE:D6:D4:66:4F:5C:
                    72:36:7B:C3:82:D3:98:08:94:AF:AB:44:4F:18:C7:14:
                    DA:16:B1:1E:32:0E:12:38:C0:B5:3C:76:EC:75:50:00:
                    20:04:11:19:ED:C6:FF:DF:4E:FE:08:81:27:31:4F:71:
                    74:6E:03:0C:70:27:81:55:6A:9A:43:92:A4:7F:DB:FD:
                    3F:C5:17:1E:41:BB:CE:E8:A7:7F:8C:95:F9:FD:7F:F8:
                    61:88:89:00:3E:FF:0B:01:DB:FD:D5:B5:A4:E4:91:11                    : 0x010001
                • #6
                  • authorityKeyIdentifier: 
                    da ed 64 74 14 9c 14 3c  ab dd 99 a9 bd 5b 28 4d  |..dt...<.....[(M|
8b 3c c9 d8                                       |.<..            |
                  • subjectKeyIdentifier: 
                    7d bf 91 d7 a7 6c 5a 47  66 44 7b 90 d4 8e 90 72  |}....lZGfD{....r|
41 8f 17 c2                                       |A...            |
                  • keyUsage: true, 0xc0
                  • basicConstraints
                    • true
                    • nil
                  • extendedKeyUsage: true, timeStamping
                  • crlDistributionPoints: http://crl.usertrust.com/UTN-USERFirst-Object.crl
                  • authorityInfoAccess
                    • OCSP: http://ocsp.usertrust.com
              • RSA-SHA256: 
                50 b0 f5 df 5f ad 33 dc  c3 53 58 58 bc c2 13 75  |P..._.3..SXX...u|
7b 20 1d 54 ca ba 3f 50  3f ba 8a f4 6b 09 63 c0  |{ .T..?P?...k.c.|
5b 5d 8b d6 75 1a 73 bd  8b ff 47 f1 15 dc 51 16  |[]..u.s...G...Q.|
23 19 32 e6 6e 92 4d d1  c6 2e 5a 1e 88 42 14 c9  |#.2.n.M...Z..B..|
72 e5 d7 08 50 8a 6a f5  64 40 56 ae 24 e3 61 97  |r...P.j.d@V.$.a.|
15 42 f0 2c 48 ae 83 e6  35 3c 8b 5b c2 8f ae 8e  |.B.,H...5<.[....|
cc 34 52 34 e0 fb fe ca  fd b1 24 68 d1 a4 11 23  |.4R4......$h...#|
10 06 fd b2 c2 24 27 c7  d7 e9 4a 1c 8f 3f 3e cf  |.....$'...J..?>.|
ed eb 75 79 6c 8e 5f f7  21 b6 50 e6 25 a1 cd 66  |..uyl._.!.P.%..f|
94 12 6c bf db b3 ae 87  d8 68 03 72 20 02 c2 7e  |..l......h.r ..~|
da 94 f3 72 07 3c 57 e8  55 24 e7 05 a0 1d c4 81  |...r........._.[|
bb 87 76 c6 9e 4c 54 61  d0 67 db 93 84 da 31 87  |..v..LTa.g....1.|
03 92 e7 9f e3 e9 cf 5a  56 c8 68 e0 52 49 94 5c  |.......ZV.h.RI.\|
            • 1
              • unnamed
                • #0
                  • C: US
                  • ST: UT
                  • L: Salt Lake City
                  • O: The USERTRUST Network
                  • OU: http://www.usertrust.com
                  • CN: UTN-USERFirst-Object
                • 4E:B0:87:8F:CC:24:35:36:B2:D8:C9:F7:BF:39:55:77
              • SHA256: nil
              • #2
                • contentType: id-smime-ct-TSTInfo
                • signingTime: 2019-03-28 12:38:45 UTC
                • id-smime-aa-signingCertificate: 
                  36 52 7d 4f a2 6a 68 f9  eb 45 96 f1 d9 9a bb 2c  |6R}O.jh..E.....,|
0e a7 6d fa                                       |..m.            |
                • messageDigest: 
                  d9 5f 78 b1 61 3a 73 c7  0c db f4 24 eb 40 05 41  |._x.a:s....$.@.A|
da 39 b5 b8 3e b4 b5 d7  68 0f 26 71 f6 40 9b 85  |.9..>...h.&q.@..|
              • rsaEncryption: 
                b4 68 5a 28 d3 a1 53 84  25 df 8a e9 27 53 20 4b  |.hZ(..S.%...'S K|
92 bf 0c 82 72 3c c1 c7  dc 53 74 23 eb fd d1 23  |....r<...St#...#|
d2 5b 02 14 68 3f 44 db  cc 13 08 06 c8 01 72 d8  |.[..h?D.......r.|
57 73 9c 87 ae 7b 30 3a  67 bc 14 fc 38 02 dd a9  |Ws...{0:g...8...|
a5 74 2f 47 f7 71 ba f6  29 a8 d5 f9 10 f1 ba 08  |.t/G.q..).......|
cf 6b 35 48 48 ed 19 e3  c2 3b 76 60 60 8c 32 50  |.k5HH....;v``.2P|
d4 25 fb a8 0c 05 2d 82  8d a9 06 9d 54 0d 70 ea  |.%....-.....T.p.|
ab 8e 1d 8d 9f ce 63 28  bd 12 40 aa 41 d1 18 16  |......c(..@.A...|
2a 16 e9 ef 97 37 9e b7  1d 06 a2 a9 ae 4d 68 83  |*....7.......Mh.|
4b 43 77 0e 38 31 d2 00  92 aa e0 89 38 28 5e 65  |KCw.81......8(^e|
b8 b6 0b 99 6e cc 0a 4c  26 08 27 f0 80 53 e2 07  |....n..L&.'..S..|
db 1b 61 68 2b 4c 49 60  88 80 93 43 6e cd 8f 7f  |..ah+LI`...Cn...|
60 f7 e7 71 bf 05 90 12  46 ca 16 10 8f a7 56 0b  |`..q....F.....V.|
4a 1e cc 72 cc 54 fa ae  03 5a a6 5e 1b bd 58 f7  |J..r.T...Z.^..X.|
38 5f ff 34 39 37 f8 6a  0f ad fb 7e 00 4d a8 70  |8_.497.j...~.M.p|
3b bd 90 89 7f ff c8 fe  30 d6 40 69 21 92 2d 3e  |;.......0.@i!.->|
offsetsizetypecomment
01152000EXE03/28/2019 12:38:33#
15c115HTM#
1194003336PKCS7Authenticode Signature#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK