filenamePE.Explorer_setup.exe
size3828712 (0x3a6be8)
md5efc2e46440a5f3e142c11353386db65d
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x50
blocks_in_file2
num_relocs0
header_paragraphs4
min_extra_paragraphs0xf
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0x1a
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

SignaturePE
Machine0x14c
NumberOfSections8
TimeDateStamp0x4ad5af30
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x818f
Magic0x10b
LinkerVersion2.25
SizeOfCode0x9400
SizeOfInitializedData0x8600
SizeOfUninitializedData0
AddressOfEntryPoint0x9b24
BaseOfCode0x1000
BaseOfData0xb000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion1.0
ImageVersion6.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x19000
SizeOfHeaders0x400
CheckSum0x3b4bb7
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x100000
SizeOfStackCommit0x4000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

Inno Setup v5.x - Installer Maker

Sections

namevavsizeraw sizeflags
CODE0x10000x92440x9400R-X CODE
DATA0xb0000x24c0x400RW- IDATA
BSS0xc0000xe480RW-
.idata0xd0000x9500xa00RW- IDATA
.tls0xe00080RW-
.rdata0xf0000x180x200R-- IDATA SHARED
.reloc0x100000x8b40R-- IDATA SHARED
.rsrc0x110000x74400x7600R-- IDATA SHARED

Data Directory

typevasize
EXPORT00
IMPORT0xd0000x950
RESOURCE0x110000x7440
EXCEPTION00
SECURITY0x3a5b280x10c0
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0xf0000x18
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x40e0000x40e0080x40c3d00x40f01000
typenamesizecp
ICON#17440
ICON#22960
ICON#337521200
ICON#422160
ICON#513840
ICON#696401200
ICON#742641200
ICON#811281200
STRING#40897540
STRING#40907800
STRING#40917180
STRING#40931040
STRING#40941800
STRING#40951740
RCDATA#11111440
GROUP_ICONMAINICON1180
VERSION#19840
MANIFEST#114030
idlangstring
654080'%s' is not a valid integer value
654090'%s' is not a valid floating point value
654100'%s' is not a valid date
654110'%s' is not a valid time
654120'%s' is not a valid date and time
654130Invalid argument to time encode
654140Invalid argument to date encode
654150Out of memory
654160I/O error %d
654170File not found
654180Invalid filename
654190Too many open files
654200File access denied
654210Read beyond end of file
654220Disk full
654230Invalid numeric input
654240Division by zero
654250Range check error
654260Integer overflow
654270Invalid floating point operation
654280Floating point division by zero
654290Floating point overflow
654300Floating point underflow
654310Invalid pointer operation
654320Invalid class typecast
654330Access violation at address %p. %s of address %p
654340Stack overflow
654350Control-C hit
654360Privileged instruction
654370Operation aborted
654380Exception %s in module %s at %p. %s%s
654390Application Error
654400Format '%s' invalid or incompatible with argument
654410No argument for format '%s'
654420Invalid variant type conversion
654430Invalid variant operation
654440Variant method calls not supported
654450Read
654460Write
654470Format result longer than 4096 characters
654480Format string too long
654490Error creating variant array
654500Variant is not an array
654510Variant array index out of bounds
654520External exception %x
654720Jan
654730Feb
654740Mar
654750Apr
654760May
654770Jun
654780Jul
654790Aug
654800Sep
654810Oct
654820Nov
654830Dec
654880January
654890February
654900March
654910April
654920May
654930June
654940July
654950August
654960September
654970October
654980November
654990December
655040Sun
655050Mon
655060Tue
655070Wed
655080Thu
655090Fri
655100Sat
655110Sunday
655120Monday
655130Tuesday
655140Wednesday
655150Thursday
655160Friday
655170Saturday
module_namehintordfunction_name
kernel32.dllDeleteCriticalSection
kernel32.dllLeaveCriticalSection
kernel32.dllEnterCriticalSection
kernel32.dllInitializeCriticalSection
kernel32.dllVirtualFree
kernel32.dllVirtualAlloc
kernel32.dllLocalFree
kernel32.dllLocalAlloc
kernel32.dllWideCharToMultiByte
kernel32.dllTlsSetValue
kernel32.dllTlsGetValue
kernel32.dllMultiByteToWideChar
kernel32.dllGetModuleHandleA
kernel32.dllGetLastError
kernel32.dllGetCommandLineA
kernel32.dllWriteFile
kernel32.dllSetFilePointer
kernel32.dllSetEndOfFile
kernel32.dllRtlUnwind
kernel32.dllReadFile
kernel32.dllRaiseException
kernel32.dllGetStdHandle
kernel32.dllGetFileSize
kernel32.dllGetSystemTime
kernel32.dllGetFileType
kernel32.dllExitProcess
kernel32.dllCreateFileA
kernel32.dllCloseHandle
user32.dllMessageBoxA
oleaut32.dllVariantChangeTypeEx
oleaut32.dllVariantCopyInd
oleaut32.dllVariantClear
oleaut32.dllSysStringLen
oleaut32.dllSysAllocStringLen
advapi32.dllRegQueryValueExA
advapi32.dllRegOpenKeyExA
advapi32.dllRegCloseKey
advapi32.dllOpenProcessToken
advapi32.dllLookupPrivilegeValueA
kernel32.dllWriteFile
kernel32.dllVirtualQuery
kernel32.dllVirtualProtect
kernel32.dllVirtualFree
kernel32.dllVirtualAlloc
kernel32.dllSleep
kernel32.dllSizeofResource
kernel32.dllSetLastError
kernel32.dllSetFilePointer
kernel32.dllSetErrorMode
kernel32.dllSetEndOfFile
kernel32.dllRemoveDirectoryA
kernel32.dllReadFile
kernel32.dllLockResource
kernel32.dllLoadResource
kernel32.dllLoadLibraryA
kernel32.dllIsDBCSLeadByte
kernel32.dllGetWindowsDirectoryA
kernel32.dllGetVersionExA
kernel32.dllGetUserDefaultLangID
kernel32.dllGetSystemInfo
kernel32.dllGetSystemDefaultLCID
kernel32.dllGetProcAddress
kernel32.dllGetModuleHandleA
kernel32.dllGetModuleFileNameA
kernel32.dllGetLocaleInfoA
kernel32.dllGetLastError
kernel32.dllGetFullPathNameA
kernel32.dllGetFileSize
kernel32.dllGetFileAttributesA
kernel32.dllGetExitCodeProcess
kernel32.dllGetEnvironmentVariableA
kernel32.dllGetCurrentProcess
kernel32.dllGetCommandLineA
kernel32.dllGetACP
kernel32.dllInterlockedExchange
kernel32.dllFormatMessageA
kernel32.dllFindResourceA
kernel32.dllDeleteFileA
kernel32.dllCreateProcessA
kernel32.dllCreateFileA
kernel32.dllCreateDirectoryA
kernel32.dllCloseHandle
user32.dllTranslateMessage
user32.dllSetWindowLongA
user32.dllPeekMessageA
user32.dllMsgWaitForMultipleObjects
user32.dllMessageBoxA
user32.dllLoadStringA
user32.dllExitWindowsEx
user32.dllDispatchMessageA
user32.dllDestroyWindow
user32.dllCreateWindowExA
user32.dllCallWindowProcA
user32.dllCharPrevA
comctl32.dllInitCommonControls
advapi32.dllAdjustTokenPrivileges

StringTable 000004E3

Comments
CompanyNameHeaventools Software
FileDescriptionPE Explorer Setup
FileVersion1.99.6.1400
LegalCopyrightCopyright © 2000-2008 Heaventools Software
ProductNamePE Explorer
ProductVersion1.0.0.0
LegalTrademarksPE Explorer is a trademark of Heaventools Software
InternalNamePE Explorer Setup
OriginalFilenamePE.Explorer_setup.exe

VS_FIXEDFILEINFO

FileVersion1.99.6.1400
ProductVersion1.0.0.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS4
FileType1
FileSubtype0

Signers (1)

issuer: /C=US/ST=UT/L=Salt Lake City/O=The USERTRUST Network/OU=http:\/\/www.usertrust.com/CN=UTN-USERFirst-Object
serial: 9F1730A374EFEA42ED0D1B504DA8F981

Certificates (3)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
        Validity
            Not Before: Jun 15 00:00:00 2007 GMT
            Not After : Jun 14 23:59:59 2012 GMT
        Subject: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:c4:b5:f2:52:15:bc:88:86:60:29:16:4a:5b:2f:
                    4b:91:6b:87:91:f3:35:54:58:35:ea:d1:36:5e:62:
                    4d:52:51:34:71:c2:7b:66:1d:89:c8:dd:2a:c4:6a:
                    0a:f6:37:d9:98:74:91:f6:92:ae:b0:b5:76:96:f1:
                    a9:4a:63:45:47:2e:6b:0b:92:4e:4b:2b:8c:ee:58:
                    4a:8b:d4:07:e4:1a:2c:f8:82:aa:58:d9:cd:42:f3:
                    2d:c0:75:de:8d:ab:c7:8e:1d:9a:6c:4c:08:95:1e:
                    de:db:ef:67:e1:72:c2:49:c2:9e:60:3c:e1:e2:be:
                    16:a3:63:78:69:14:7b:ad:2d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.verisign.com/tss-ca.crl
            X509v3 Extended Key Usage: critical
                Time Stamping
            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation
            X509v3 Subject Alternative Name: 
                DirName:/CN=TSA1-2
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        50:c5:4b:c8:24:80:df:e4:0d:24:c2:de:1a:b1:a1:02:a1:a6:
        82:2d:0c:83:15:81:37:0a:82:0e:2c:b0:5a:17:61:b5:d8:05:
        fe:88:db:f1:91:91:b3:56:1a:40:a6:eb:92:be:38:39:b0:75:
        36:74:3a:98:4f:e4:37:ba:99:89:ca:95:42:1d:b0:b9:c7:a0:
        8d:57:e0:fa:d5:64:04:42:35:4e:01:d1:33:a2:17:c8:4d:aa:
        27:c7:f2:e1:86:4c:02:38:4d:83:78:c6:fc:53:e0:eb:e0:06:
        87:dd:a4:96:9e:5e:0c:98:e2:a5:be:bf:82:85:c3:60:e1:df:
        ad:28:d8:c7:a5:4b:64:da:c7:1b:5b:bd:ac:39:08:d5:38:22:
        a1:33:8b:2f:8a:9a:eb:bc:07:21:3f:44:41:09:07:b5:65:1c:
        24:bc:48:d3:44:80:eb:a1:cf:c9:02:b4:14:cf:54:c7:16:a3:
        80:5c:f9:79:3e:5d:72:7d:88:17:9e:2c:43:a2:ca:53:ce:7d:
        3d:f6:2a:3a:b8:4f:94:00:a5:6d:0a:83:5d:f9:5e:53:f4:18:
        b3:57:0f:70:c3:fb:f5:ad:95:a0:0e:17:de:c4:16:80:60:c9:
        0f:2b:6e:86:04:f1:eb:f4:78:27:d1:05:c5:ee:34:5b:5e:b9:
        49:32:f2:33

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
        Validity
            Not Before: Dec  4 00:00:00 2003 GMT
            Not After : Dec  3 23:59:59 2013 GMT
        Subject: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:a9:ca:b2:a4:cc:cd:20:af:0a:7d:89:ac:87:75:
                    f0:b4:4e:f1:df:c1:0f:bf:67:61:bd:a3:64:1c:da:
                    bb:f9:ca:33:ab:84:30:89:58:7e:8c:db:6b:dd:36:
                    9e:0f:bf:d1:ec:78:f2:77:a6:7e:6f:3c:bf:93:af:
                    0d:ba:68:f4:6c:94:ca:bd:52:2d:ab:48:3d:f5:b6:
                    d5:5d:5f:1b:02:9f:fa:2f:6b:1e:a4:f7:a3:9a:a6:
                    1a:c8:02:e1:7f:4c:52:e3:0e:60:ec:40:1c:7e:b9:
                    0d:de:3f:c7:b4:df:87:bd:5f:7a:6a:31:2e:03:99:
                    81:13:a8:47:20:ce:31:73:0d:57:2d:cd:78:34:33:
                    95:12:99:12:b9:de:68:2f:aa:e6:e3:c2:8a:8c:2a:
                    c3:8b:21:87:66:bd:83:58:57:6f:75:bf:3c:aa:26:
                    87:5d:ca:10:15:3c:9f:84:ea:54:c1:0a:6e:c4:fe:
                    c5:4a:dd:b9:07:11:97:22:7c:db:3e:27:d1:1e:78:
                    ec:9f:31:c9:f1:e6:22:19:db:c4:b3:47:43:9a:1a:
                    5f:a0:1e:90:e4:5e:f5:ee:7c:f1:7d:ab:62:01:8f:
                    f5:4d:0b:de:d0:22:56:a8:95:cd:ae:88:76:ae:ee:
                    ba:0d:f3:e4:4d:d9:a0:fb:68:a0:ae:14:3b:b3:87:
                    c1:bb
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.verisign.com/ThawteTimestampingCA.crl
            X509v3 Extended Key Usage: 
                Time Stamping
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name: 
                DirName:/CN=TSA2048-1-53
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        4a:6b:f9:ea:58:c2:44:1c:31:89:79:99:2b:96:bf:82:ac:01:
        d6:1c:4c:cd:b0:8a:58:6e:df:08:29:a3:5e:c8:ca:93:13:e7:
        04:52:0d:ef:47:27:2f:00:38:b0:e4:c9:93:4e:9a:d4:22:62:
        15:f7:3f:37:21:4f:70:31:80:f1:8b:38:87:b3:e8:e8:97:00:
        fe:cf:55:96:4e:24:d2:a9:27:4e:7a:ae:b7:61:41:f3:2a:ce:
        e7:c9:d9:5e:dd:bb:2b:85:3e:b5:9d:b5:d9:e1:57:ff:be:b4:
        c5:7e:f5:cf:0c:9e:f0:97:fe:2b:d3:3b:52:1b:1b:38:27:f7:
        3f:4a

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            9f:17:30:a3:74:ef:ea:42:ed:0d:1b:50:4d:a8:f9:81
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http:\/\/www.usertrust.com, CN=UTN-USERFirst-Object
        Validity
            Not Before: Oct 25 00:00:00 2007 GMT
            Not After : Oct 24 23:59:59 2009 GMT
        Subject: C=CA/postalCode=V6H4E4, ST=BC, L=Vancouver/street=101-1001 West Broadway Dept. 381, O=Heaventools Software, CN=Heaventools Software
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:af:8a:19:df:c2:14:ba:a7:3f:53:19:b6:e8:3a:
                    f8:c1:ea:6e:30:e6:32:d4:9b:30:f6:36:a9:60:f7:
                    40:5b:98:d4:5b:74:c4:14:eb:3a:bd:96:ad:76:60:
                    39:32:ed:03:1a:51:80:a9:0d:27:3f:5c:67:c4:6c:
                    79:5c:3f:4e:0a:c3:4a:e8:c8:dc:90:21:89:3f:80:
                    bb:d4:44:43:8c:3f:ed:db:8d:dd:04:fd:ed:3b:d3:
                    7b:c8:4b:04:3a:9d:74:96:34:fa:eb:ff:ed:22:b8:
                    c8:2f:13:84:08:c0:30:56:56:37:cd:3e:ae:0f:41:
                    67:18:8e:b2:a1:c1:6b:74:2c:32:38:00:f5:d0:24:
                    69:f6:cb:4b:bc:34:04:fb:c4:21:f8:3f:99:be:59:
                    21:c5:b6:60:36:6d:32:32:c0:43:f7:5d:d7:88:f4:
                    57:b1:d8:a9:bd:09:b8:06:d6:1a:e5:2d:9f:21:17:
                    27:b0:e0:d6:66:82:f8:f6:c5:25:64:05:6c:3e:eb:
                    54:f3:44:78:94:80:2c:98:69:9c:e5:bc:81:8c:45:
                    71:d3:09:c8:90:24:5a:15:85:7c:0c:85:f8:70:b4:
                    69:70:b5:52:54:13:fe:ed:a0:25:a1:b1:d6:dc:d6:
                    52:57:7c:73:b7:c2:48:5c:86:13:75:93:0b:35:ea:
                    90:11
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier: 
                DA:ED:64:74:14:9C:14:3C:AB:DD:99:A9:BD:5B:28:4D:8B:3C:C9:D8
            X509v3 Subject Key Identifier: 
                28:A0:D8:9C:16:56:AF:04:5D:D7:6B:D6:9D:DE:B9:10:45:FA:41:E3
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Extended Key Usage: 
                Code Signing
            Netscape Cert Type: 
                Object Signing
            X509v3 Certificate Policies: 
                Policy: 1.3.6.1.4.1.6449.1.2.1.3.2
                  CPS: https://secure.comodo.net/CPS
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.usertrust.com/UTN-USERFirst-Object.crl
            X509v3 Subject Alternative Name: 
                email:support@heaventools.com
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        92:74:6a:92:1f:ed:64:96:ac:4a:ae:82:1f:44:5d:ed:48:6a:
        8b:67:3d:6d:10:1c:55:6b:d0:6c:ae:17:64:9e:a8:72:af:13:
        5d:d4:a0:dd:41:63:fd:13:6d:c7:a9:58:c8:34:63:64:03:44:
        51:89:db:a1:1b:c8:4f:c2:a6:3e:b8:14:89:ba:f7:fd:80:94:
        d6:a6:4f:fb:6e:19:30:ae:b4:9a:a6:35:45:ef:0a:02:86:3e:
        6a:8d:62:51:e5:90:02:b6:e2:87:9f:72:45:ba:c2:54:81:d1:
        25:47:3e:a7:f8:37:ff:ea:ac:e4:cb:90:cf:c9:20:5e:be:4f:
        f9:ab:25:d1:46:4c:e7:bd:49:dd:4e:31:2f:a8:8c:55:43:bb:
        63:f8:6b:ad:fa:ab:ef:be:22:1b:7b:ed:a3:98:4c:be:f0:5d:
        50:11:78:c7:b3:74:3d:9f:2c:b1:cd:2d:18:86:6e:c8:0d:74:
        44:15:66:c4:9e:a3:41:de:c2:fa:8c:4d:92:a5:5a:4a:43:e3:
        50:8e:a8:cb:e7:f3:5a:17:70:20:22:3c:40:3f:3a:ac:bc:fc:
        53:05:a3:d2:8e:3b:a0:f4:4b:2a:a6:79:f5:e0:4e:9f:3e:8d:
        02:7d:72:24:b6:59:77:10:9e:45:2c:7c:48:da:96:fe:16:b7:
        77:70:a6:6c
pkcs7-signedData
  • 1
    • SHA1: nil
    • 1.3.6.1.4.1.311.2.1.4
      • #0
        • 1.3.6.1.4.1.311.2.1.15
          • : 
            00 3c 00 3c 00 3c 00 4f  00 62 00 73 00 6f 00 6c  |.<.<.<.O.b.s.o.l|
00 65 00 74 00 65 00 3e  00 3e 00 3e              |.e.t.e.>.>.>    |
        • SHA1
          • d5 32 74 5a fc 12 8d 15  aa 46 b5 16 53 52 c5 df  |.2tZ.....F..SR..|
ed 6b 9f cc                                       |.k..            |
    • Certificates
      • Certificate #0
        • 2
          • 38:25:D7:FA:F8:61:AF:9E:F4:90:E7:26:B5:D6:5A:D5
          • RSA-SHA1: nil
          • Issuer
            • C: US
            • O: VeriSign, Inc.
            • CN: VeriSign Time Stamping Services CA
          • 2007-06-15 00:00:00 UTC: 2012-06-14 23:59:59 UTC
          • Subject
            • C: US
            • O: VeriSign, Inc.
            • CN: VeriSign Time Stamping Services Signer - G2
          • #5
            • rsaEncryption: nil
            • C4:B5:F2:52:15:BC:88:86:60:29:16:4A:5B:2F:4B:91:
              6B:87:91:F3:35:54:58:35:EA:D1:36:5E:62:4D:52:51:
              34:71:C2:7B:66:1D:89:C8:DD:2A:C4:6A:0A:F6:37:D9:
              98:74:91:F6:92:AE:B0:B5:76:96:F1:A9:4A:63:45:47:
              2E:6B:0B:92:4E:4B:2B:8C:EE:58:4A:8B:D4:07:E4:1A:
              2C:F8:82:AA:58:D9:CD:42:F3:2D:C0:75:DE:8D:AB:C7:
              8E:1D:9A:6C:4C:08:95:1E:DE:DB:EF:67:E1:72:C2:49:
              C2:9E:60:3C:E1:E2:BE:16:A3:63:78:69:14:7B:AD:2D              : 0x010001
          • X509v3 extensions
            • authorityInfoAccess
              • OCSP: http://ocsp.verisign.com
            • basicConstraints
              • true
              • nil
            • crlDistributionPoints: http://crl.verisign.com/tss-ca.crl
            • extendedKeyUsage: true, timeStamping
            • keyUsage: true, 0xc0
            • subjectAltName
              • CN: TSA1-2
        • RSA-SHA1: 
          50 c5 4b c8 24 80 df e4  0d 24 c2 de 1a b1 a1 02  |P.K.$....$......|
a1 a6 82 2d 0c 83 15 81  37 0a 82 0e 2c b0 5a 17  |...-....7...,.Z.|
61 b5 d8 05 fe 88 db f1  91 91 b3 56 1a 40 a6 eb  |a..........V.@..|
92 be 38 39 b0 75 36 74  3a 98 4f e4 37 ba 99 89  |..89.u6t:.O.7...|
ca 95 42 1d b0 b9 c7 a0  8d 57 e0 fa d5 64 04 42  |..B......W...d.B|
35 4e 01 d1 33 a2 17 c8  4d aa 27 c7 f2 e1 86 4c  |5N..3...M.'....L|
02 38 4d 83 78 c6 fc 53  e0 eb e0 06 87 dd a4 96  |.8M.x..S........|
9e 5e 0c 98 e2 a5 be bf  82 85 c3 60 e1 df ad 28  |.^.........`...(|
d8 c7 a5 4b 64 da c7 1b  5b bd ac 39 08 d5 38 22  |...Kd...[..9..8"|
a1 33 8b 2f 8a 9a eb bc  07 21 3f 44 41 09 07 b5  |.3./.....!?DA...|
65 1c 24 bc 48 d3 44 80  eb a1 cf c9 02 b4 14 cf  |e.$.H.D.........|
54 c7 16 a3 80 5c f9 79  3e 5d 72 7d 88 17 9e 2c  |T....\.y>]r}...,|
43 a2 ca 53 ce 7d 3d f6  2a 3a b8 4f 94 00 a5 6d  |C..S.}=.*:.O...m|
0a 83 5d f9 5e 53 f4 18  b3 57 0f 70 c3 fb f5 ad  |..].^S...W.p....|
95 a0 0e 17 de c4 16 80  60 c9 0f 2b 6e 86 04 f1  |........`..+n...|
eb f4 78 27 d1 05 c5 ee  34 5b 5e b9 49 32 f2 33  |..x'....4[^.I2.3|
      • Certificate #1
        • 2
          • 47:BF:19:95:DF:8D:52:46:43:F7:DB:6D:48:0D:31:A4
          • RSA-SHA1: nil
          • Issuer
            • C: ZA
            • ST: Western Cape
            • L: Durbanville
            • O: Thawte
            • OU: Thawte Certification
            • CN: Thawte Timestamping CA
          • 2003-12-04 00:00:00 UTC: 2013-12-03 23:59:59 UTC
          • Subject
            • C: US
            • O: VeriSign, Inc.
            • CN: VeriSign Time Stamping Services CA
          • #5
            • rsaEncryption: nil
            • A9:CA:B2:A4:CC:CD:20:AF:0A:7D:89:AC:87:75:F0:B4:
              4E:F1:DF:C1:0F:BF:67:61:BD:A3:64:1C:DA:BB:F9:CA:
              33:AB:84:30:89:58:7E:8C:DB:6B:DD:36:9E:0F:BF:D1:
              EC:78:F2:77:A6:7E:6F:3C:BF:93:AF:0D:BA:68:F4:6C:
              94:CA:BD:52:2D:AB:48:3D:F5:B6:D5:5D:5F:1B:02:9F:
              FA:2F:6B:1E:A4:F7:A3:9A:A6:1A:C8:02:E1:7F:4C:52:
              E3:0E:60:EC:40:1C:7E:B9:0D:DE:3F:C7:B4:DF:87:BD:
              5F:7A:6A:31:2E:03:99:81:13:A8:47:20:CE:31:73:0D:
              57:2D:CD:78:34:33:95:12:99:12:B9:DE:68:2F:AA:E6:
              E3:C2:8A:8C:2A:C3:8B:21:87:66:BD:83:58:57:6F:75:
              BF:3C:AA:26:87:5D:CA:10:15:3C:9F:84:EA:54:C1:0A:
              6E:C4:FE:C5:4A:DD:B9:07:11:97:22:7C:DB:3E:27:D1:
              1E:78:EC:9F:31:C9:F1:E6:22:19:DB:C4:B3:47:43:9A:
              1A:5F:A0:1E:90:E4:5E:F5:EE:7C:F1:7D:AB:62:01:8F:
              F5:4D:0B:DE:D0:22:56:A8:95:CD:AE:88:76:AE:EE:BA:
              0D:F3:E4:4D:D9:A0:FB:68:A0:AE:14:3B:B3:87:C1:BB              : 0x010001
          • X509v3 extensions
            • authorityInfoAccess
              • OCSP: http://ocsp.verisign.com
            • basicConstraints
              • true
              • true: 0
            • crlDistributionPoints: http://crl.verisign.com/ThawteTimestampingCA.crl
            • extendedKeyUsage: timeStamping
            • keyUsage: true, 6
            • subjectAltName
              • CN: TSA2048-1-53
        • RSA-SHA1: 
          4a 6b f9 ea 58 c2 44 1c  31 89 79 99 2b 96 bf 82  |Jk..X.D.1.y.+...|
ac 01 d6 1c 4c cd b0 8a  58 6e df 08 29 a3 5e c8  |....L...Xn..).^.|
ca 93 13 e7 04 52 0d ef  47 27 2f 00 38 b0 e4 c9  |.....R..G'/.8...|
93 4e 9a d4 22 62 15 f7  3f 37 21 4f 70 31 80 f1  |.N.."b..?7!Op1..|
8b 38 87 b3 e8 e8 97 00  fe cf 55 96 4e 24 d2 a9  |.8........U.N$..|
27 4e 7a ae b7 61 41 f3  2a ce e7 c9 d9 5e dd bb  |'Nz..aA.*....^..|
2b 85 3e b5 9d b5 d9 e1  57 ff be b4 c5 7e f5 cf  |+.>.....W....~..|
0c 9e f0 97 fe 2b d3 3b  52 1b 1b 38 27 f7 3f 4a  |.....+.;R..8'.?J|
      • Certificate #2
        • 2
          • 9F:17:30:A3:74:EF:EA:42:ED:0D:1B:50:4D:A8:F9:81
          • RSA-SHA1: nil
          • Issuer
            • C: US
            • ST: UT
            • L: Salt Lake City
            • O: The USERTRUST Network
            • OU: http://www.usertrust.com
            • CN: UTN-USERFirst-Object
          • 2007-10-25 00:00:00 UTC: 2009-10-24 23:59:59 UTC
          • Subject
            • C: CA
            • postalCode: V6H4E4
            • ST: BC
            • L: Vancouver
            • street: 101-1001 West Broadway Dept. 381
            • O: Heaventools Software
            • CN: Heaventools Software
          • #5
            • rsaEncryption: nil
            • AF:8A:19:DF:C2:14:BA:A7:3F:53:19:B6:E8:3A:F8:C1:
              EA:6E:30:E6:32:D4:9B:30:F6:36:A9:60:F7:40:5B:98:
              D4:5B:74:C4:14:EB:3A:BD:96:AD:76:60:39:32:ED:03:
              1A:51:80:A9:0D:27:3F:5C:67:C4:6C:79:5C:3F:4E:0A:
              C3:4A:E8:C8:DC:90:21:89:3F:80:BB:D4:44:43:8C:3F:
              ED:DB:8D:DD:04:FD:ED:3B:D3:7B:C8:4B:04:3A:9D:74:
              96:34:FA:EB:FF:ED:22:B8:C8:2F:13:84:08:C0:30:56:
              56:37:CD:3E:AE:0F:41:67:18:8E:B2:A1:C1:6B:74:2C:
              32:38:00:F5:D0:24:69:F6:CB:4B:BC:34:04:FB:C4:21:
              F8:3F:99:BE:59:21:C5:B6:60:36:6D:32:32:C0:43:F7:
              5D:D7:88:F4:57:B1:D8:A9:BD:09:B8:06:D6:1A:E5:2D:
              9F:21:17:27:B0:E0:D6:66:82:F8:F6:C5:25:64:05:6C:
              3E:EB:54:F3:44:78:94:80:2C:98:69:9C:E5:BC:81:8C:
              45:71:D3:09:C8:90:24:5A:15:85:7C:0C:85:F8:70:B4:
              69:70:B5:52:54:13:FE:ED:A0:25:A1:B1:D6:DC:D6:52:
              57:7C:73:B7:C2:48:5C:86:13:75:93:0B:35:EA:90:11              : 0x010001
          • #6
            • authorityKeyIdentifier: 
              da ed 64 74 14 9c 14 3c  ab dd 99 a9 bd 5b 28 4d  |..dt...<.....[(M|
8b 3c c9 d8                                       |.<..            |
            • subjectKeyIdentifier: 
              28 a0 d8 9c 16 56 af 04  5d d7 6b d6 9d de b9 10  |(....V..].k.....|
45 fa 41 e3                                       |E.A.            |
            • keyUsage: true, 0x80
            • basicConstraints
              • true
              • nil
            • extendedKeyUsage: codeSigning
            • nsCertType: 0x10
            • certificatePolicies
              • 1.3.6.1.4.1.6449.1.2.1.3.2
                • id-qt-cps: https://secure.comodo.net/CPS
            • crlDistributionPoints: http://crl.usertrust.com/UTN-USERFirst-Object.crl
            • subjectAltName: support@heaventools.com
        • RSA-SHA1: 
          92 74 6a 92 1f ed 64 96  ac 4a ae 82 1f 44 5d ed  |.tj...d..J...D].|
48 6a 8b 67 3d 6d 10 1c  55 6b d0 6c ae 17 64 9e  |Hj.g=m..Uk.l..d.|
a8 72 af 13 5d d4 a0 dd  41 63 fd 13 6d c7 a9 58  |.r..]...Ac..m..X|
c8 34 63 64 03 44 51 89  db a1 1b c8 4f c2 a6 3e  |.4cd.DQ.....O..>|
b8 14 89 ba f7 fd 80 94  d6 a6 4f fb 6e 19 30 ae  |..........O.n.0.|
b4 9a a6 35 45 ef 0a 02  86 3e 6a 8d 62 51 e5 90  |...5E....>j.bQ..|
02 b6 e2 87 9f 72 45 ba  c2 54 81 d1 25 47 3e a7  |.....rE..T..%G>.|
f8 37 ff ea ac e4 cb 90  cf c9 20 5e be 4f f9 ab  |.7........ ^.O..|
25 d1 46 4c e7 bd 49 dd  4e 31 2f a8 8c 55 43 bb  |%.FL..I.N1/..UC.|
63 f8 6b ad fa ab ef be  22 1b 7b ed a3 98 4c be  |c.k.....".{...L.|
f0 5d 50 11 78 c7 b3 74  3d 9f 2c b1 cd 2d 18 86  |.]P.x..t=.,..-..|
6e c8 0d 74 44 15 66 c4  9e a3 41 de c2 fa 8c 4d  |n..tD.f...A....M|
92 a5 5a 4a 43 e3 50 8e  a8 cb e7 f3 5a 17 70 20  |..ZJC.P.....Z.p |
22 3c 40 3f 3a ac bc fc  53 05 a3 d2 8e 3b a0 f4  |"<@?:...S....;..|
4b 2a a6 79 f5 e0 4e 9f  3e 8d 02 7d 72 24 b6 59  |K*.y..N.>..}r$.Y|
77 10 9e 45 2c 7c 48 da  96 fe 16 b7 77 70 a6 6c  |w..E,|H.....wp.l|
    • Signer
      • 1
      • unnamed
        • #0
          • C: US
          • ST: UT
          • L: Salt Lake City
          • O: The USERTRUST Network
          • OU: http://www.usertrust.com
          • CN: UTN-USERFirst-Object
        • 9F:17:30:A3:74:EF:EA:42:ED:0D:1B:50:4D:A8:F9:81
      • SHA1: nil
      • #3
        • 1.3.6.1.4.1.311.2.1.12
          • nil
        • contentType: 1.3.6.1.4.1.311.2.1.4
        • 1.3.6.1.4.1.311.2.1.11: msCodeInd
        • messageDigest: 
          b9 1a 1d b5 2c 2e d5 7f  73 1b 56 98 fe 20 ee 0d  |....,...s.V.. ..|
ec ce 4d f4                                       |..M.            |
      • rsaEncryption: 
        7a ac f7 37 80 d6 ff 16  af b8 00 3f 93 78 cf 86  |z..7.......?.x..|
e7 21 24 72 7c 7c 84 43  d2 78 a8 06 5f ea d5 40  |.!$r||.C.x.._..@|
2c d0 48 e0 74 6e a3 56  83 e2 f5 a0 fa c6 fb 9f  |,.H.tn.V........|
f1 42 f3 a7 11 e0 dc aa  62 91 a4 66 21 68 97 96  |.B......b..f!h..|
d4 31 3c f3 5b 19 a4 c4  0d ab 78 8f 2d 49 3c 66  |.1<.[.....x.-I.|
f2 91 98 bc c1 ad 39 b8  4d 8f d7 9a 2d 41 d7 2e  |......9.M...-A..|
2d 2d 49 b6 07 fc 39 c9  81 94 86 c2 9c 5f 9c 76  |--I...9......_.v|
8c 78 9d b5 9d 1d 13 69  11 95 33 87 95 89 8e 72  |.x.....i..3....r|
98 6f 25 49 b7 e8 09 e7  ff 76 7c 91 a3 0a 11 84  |.o%I.....v|.....|
4d 20 da 42 ca 24 02 7b  86 7c 8b e7 b8 9b 9e 4a  |M .B.$.{.|.....J|
      • countersignature
        • 1
          • unnamed
            • #0
              • C: US
              • O: VeriSign, Inc.
              • CN: VeriSign Time Stamping Services CA
            • 38:25:D7:FA:F8:61:AF:9E:F4:90:E7:26:B5:D6:5A:D5
          • SHA1: nil
          • #2
            • contentType: pkcs7-data
            • signingTime: 2009-10-14 15:11:12 UTC
            • messageDigest: 
              94 01 f1 4b 95 ae d2 09  ff e8 b5 2f c7 1d af e9  |...K......./....|
16 74 ff 07                                       |.t..            |
          • rsaEncryption: 
            70 61 96 da 79 79 e7 06  79 4d 4f cb 5f b6 e9 67  |pa..yy..yMO._..g|
50 9d e2 d3 9a 36 54 28  62 9c a8 9f da 14 8f 10  |P....6T(b.......|
6a 1f d3 76 01 bb 64 b1  47 ab 77 31 83 2e 02 0c  |j..v..d.G.w1....|
a2 6f ec 2f 00 42 6b 93  69 fe 4a 38 56 de c2 21  |.o./.Bk.i.J8V..!|
e9 9f f9 6f d1 41 9f b0  52 b9 3d bd 83 1d 64 b8  |...o.A..R.=...d.|
af e2 c1 81 93 f7 07 d4  7d 92 fe 54 85 3b ca c0  |........}..T.;..|
3e 08 c6 3f 20 23 53 5e  59 77 a1 bd 58 7e 5a 1d  |>..? #S^Yw..X~Z.|
b6 44 c9 a1 de 62 11 c3  45 36 7d fe 60 17 65 e7  |.D...b..E6}.`.e.|
offsetsizetypecomment
073216EXE10/14/2009 11:00:00#
15c115HTM#
11e003755496BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0xc3d0