CradleOfRome.exe

info
MZ
PE
resources
imports
foremost
signature
hexdump
disasm
log
discuss
donate

filename	CradleOfRome.exe
size	1743240 (0x1a9988)
md5	f56c4041b11a6ad92a3dcfd4b0803613

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf8

Rich Header

lib id	version	times used
132	21022	4
149	30729	24
131	30729	180
147	30729	21
1	0	279
131	21022	2
138	30729	19
132	30729	81
146	30729	1
148	21022	1
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	7
TimeDateStamp	0x4f2254e9
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x103
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0x26e00
SizeOfInitializedData	0x2d7600
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1000
BaseOfCode	0x1000
BaseOfData	0x28000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0x32b000
SizeOfHeaders	0x400
CheckSum	0x1acaf0
Subsystem	2
DllCharacteristics	0x8000
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

ASProtect 1.33 - 2.1 Registered (Alexey Solodovnikov)

Sections

name	va	vsize	raw size	flags
	0x1000	0x27000	0x13000	RWX IDATA
	0x28000	0xc000	0x6400	RWX IDATA
	0x34000	0x5000	0xc00	RWX IDATA
.rsrc	0x39000	0x2c9000	0x167800	RWX IDATA
	0x302000	0x1000	0x200	RWX IDATA
.data	0x303000	0x27000	0x26400	RWX IDATA
.adata	0x32a000	0x1000	0	RWX IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x303a5c	0x21c
RESOURCE	0x39000	0x2c8f70
EXCEPTION	0	0
SECURITY	0x1a8200	0x1788
BASERELOC	0x3039e8	8
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0
	0	0x100000

show previews

type	name	size	cp
RT_RCDATA	PACKINFO	4096	1252
RT_RCDATA	SMSKEY	1024	1252
BITMAP	SKINBITMAP______________________	88	1252
ICON	#1	3752	1252
DIALOG	#103	64	1252
DIALOG	#1000	64	1252
GROUP_ICON	IDI_APPICON	20	1252
HTML	ARR_DOWN.GIF	316	1252
HTML	BACKGROUND.GIF	51711	1252
HTML	BACKGROUND_01.GIF	2539	1252
HTML	BACKGROUND_02.GIF	61643	1252
HTML	BACK_01.GIF	14020	1252
HTML	BACK_GAME.GIF	823	1252
HTML	BANNER.HTML	86	1252
HTML	BBL_BG.GIF	66	1252
HTML	BBL_BOTTOM.GIF	360	1252
HTML	BBL_SPACER.GIF	107	1252
HTML	BBL_TOP.GIF	360	1252
HTML	BECOME_AN_AFFILIATE_BUTTON.JPG	34850	1252
HTML	BG_INPUT.GIF	49	1252
HTML	BILLING.XML	6879	1252
HTML	BORDER_BLUE_01.GIF	1548	1252
HTML	BORDER_BLUE_02.GIF	48294	1252
HTML	BOT_01.GIF	168	1252
HTML	BOT_02.GIF	169	1252
HTML	BUTTON.PNG	2898	1252
HTML	BUTTONS_BUYDEMOLONG_01.GIF	4698	1252
HTML	BUTTONS_BUYDEMOLONG_02.GIF	4563	1252
HTML	BUTTONS_BUYDEMOLONG_03.GIF	4443	1252
HTML	BUTTONS_BUYDEMO_01.GIF	2766	1252
HTML	BUTTONS_BUYDEMO_02.GIF	2796	1252
HTML	BUTTONS_BUYDEMO_03.GIF	2868	1252
HTML	BUTTONS_BUYOTHER_01.GIF	7094	1252
HTML	BUTTONS_BUYOTHER_02.GIF	6821	1252
HTML	BUTTONS_BUYOTHER_03.GIF	6859	1252
HTML	BUTTONS_CONTINUE_01.GIF	5868	1252
HTML	BUTTONS_CONTINUE_02.GIF	5846	1252
HTML	BUTTONS_CONTINUE_03.GIF	5906	1252
HTML	BUTTONS_EXITLONG_01.GIF	3242	1252
HTML	BUTTONS_EXITLONG_02.GIF	3271	1252
HTML	BUTTONS_EXITLONG_03.GIF	3189	1252
HTML	BUTTONS_KEY_01.GIF	5810	1252
HTML	BUTTONS_KEY_02.GIF	5909	1252
HTML	BUTTONS_KEY_03.GIF	5927	1252
HTML	BUTTONS_PAY_01.GIF	6098	1252
HTML	BUTTONS_PAY_02.GIF	5986	1252
HTML	BUTTONS_PAY_03.GIF	6118	1252
HTML	BUTTONS_PLAYDEMOLONG_01.GIF	3377	1252
HTML	BUTTONS_PLAYDEMOLONG_02.GIF	3433	1252
HTML	BUTTONS_PLAYDEMOLONG_03.GIF	3437	1252
HTML	BUTTONS_PLAYDEMOLONG_04.GIF	5322	1252
HTML	BUTTONS_PLAYDEMO_01.GIF	1871	1252
HTML	BUTTONS_PLAYDEMO_02.GIF	2339	1252
HTML	BUTTONS_PLAYDEMO_03.GIF	1911	1252
HTML	BUTTONS_PLAYDEMO_GREY.GIF	2266	1252
HTML	BUTTONS_PLAYDEMO_YELLOW.GIF	1871	1252
HTML	BUTTONS_REGISTER_01.GIF	4305	1252
HTML	BUTTONS_REGISTER_02.GIF	4394	1252
HTML	BUTTONS_REGISTER_03.GIF	4455	1252
HTML	BUTTON_DOWNLOAD_01.GIF	1243	1252
HTML	BUTTON_DOWNLOAD_02.GIF	1181	1252
HTML	BUTTON_DOWNLOAD_DE_01.GIF	1365	1252
HTML	BUTTON_DOWNLOAD_DE_02.GIF	1288	1252
HTML	BUTTON_GAME_01.GIF	1852	1252
HTML	BUTTON_GAME_02.GIF	1886	1252
HTML	BUTTON_GAME_03.GIF	1874	1252
HTML	BUTTON_OTHER_01.GIF	1691	1252
HTML	BUTTON_OTHER_02.GIF	1718	1252
HTML	BUTTON_OTHER_03.GIF	1703	1252
HTML	BUTTON_WEBMONEY_01.GIF	7658	1252
HTML	BUTTON_WEBMONEY_02.GIF	7297	1252
HTML	BUTTON_WEBMONEY_03.GIF	7592	1252
HTML	BUT_EXIT_01.GIF	1533	1252
HTML	BUT_EXIT_02.GIF	1541	1252
HTML	BUT_GAME_01.GIF	1759	1252
HTML	BUT_GAME_02.GIF	1770	1252
HTML	BUT_GAME_NOW_01.GIF	4223	1252
HTML	BUT_GAME_NOW_02.GIF	4215	1252
HTML	BUT_PREV_01.GIF	1689	1252
HTML	BUT_PREV_02.GIF	1699	1252
HTML	B_COUNTRY_01.GIF	3952	1252
HTML	B_COUNTRY_02.GIF	4012	1252
HTML	B_COUNTRY_03.GIF	3930	1252
HTML	B_EXIT_ACTIVE.GIF	703	1252
HTML	B_EXIT_DEF.GIF	1112	1252
HTML	B_EXIT_UP.GIF	1109	1252
HTML	B_LOGO_GAME.JPG	101085	1252
HTML	B_MENU_BACK.GIF	17411	1252
HTML	B_MINIMIZE_ACTIVE.GIF	685	1252
HTML	B_MINIMIZE_DEF.GIF	667	1252
HTML	B_MINIMIZE_UP.GIF	701	1252
HTML	B_MINI_GAME.GIF	1916	1252
HTML	CARDS_LOGO.GIF	1277	1252
HTML	COPYKEY.GIF	13555	1252
HTML	ENT_KEY.GIF	2166	1252
HTML	ENT_KEY_HOVER.GIF	2144	1252
HTML	FILENAME_MAP.XML	2494	1252
HTML	FON_01.GIF	2168	1252
HTML	FRAME.HTML	2887	1252
HTML	GAMES.HTML	23395	1252
HTML	GRAYCENTER.GIF	818	1252
HTML	GRAYLEFT.GIF	941	1252
HTML	GRAYRIGHT.GIF	940	1252
HTML	HELP_01.GIF	10948	1252
HTML	ICO_01.GIF	628	1252
HTML	ICO_ALAWAR.GIF	804	1252
HTML	ICO_ALAWAR_18.PNG	1202	1252
HTML	ICO_ALAWAR_26.PNG	2053	1252
HTML	ICO_ARROW_01.GIF	212	1252
HTML	ICO_ARROW_02.GIF	323	1252
HTML	ICO_ARROW_02_BLUE.GIF	323	1252
HTML	ICO_HIT.GIF	734	1252
HTML	ICO_NEW.GIF	728	1252
HTML	ICO_ONE.GIF	763	1252
HTML	ICO_STAR.GIF	891	1252
HTML	ICO_THREE.GIF	361	1252
HTML	ICO_TWO.GIF	365	1252
HTML	IEFRAME_TAB0.HTML	968	1252
HTML	IEFRAME_TAB1.HTML	986	1252
HTML	IEFRAME_TAB2.HTML	982	1252
HTML	IEFRAME_TAB3.HTML	970	1252
HTML	IMAGE_0.HTML	4916	1252
HTML	IMAGE_1.HTML	2227	1252
HTML	IMAGE_10.JPG	10984	1252
HTML	IMAGE_11.JPG	17153	1252
HTML	IMAGE_12.GIF	3378	1252
HTML	IMAGE_13.GIF	8772	1252
HTML	IMAGE_14.GIF	10205	1252
HTML	IMAGE_15.GIF	3590	1252
HTML	IMAGE_16.GIF	9172	1252
HTML	IMAGE_17.GIF	10531	1252
HTML	IMAGE_18.GIF	3455	1252
HTML	IMAGE_19.GIF	7936	1252
HTML	IMAGE_2.HTML	33992	1252
HTML	IMAGE_20.GIF	8525	1252
HTML	IMAGE_21.GIF	1507	1252
HTML	IMAGE_22.GIF	3831	1252
HTML	IMAGE_23.GIF	2204	1252
HTML	IMAGE_24.GIF	2052	1252
HTML	IMAGE_25.GIF	2602	1252
HTML	IMAGE_26.GIF	2195	1252
HTML	IMAGE_27.GIF	1764	1252
HTML	IMAGE_28.GIF	1848	1252
HTML	IMAGE_29.GIF	2366	1252
HTML	IMAGE_3.JPG	17162	1252
HTML	IMAGE_4.GIF	7905	1252
HTML	IMAGE_5.JPG	33366	1252
HTML	IMAGE_6.GIF	2139	1252
HTML	IMAGE_7.GIF	4616	1252
HTML	IMAGE_8.JPG	30942	1252
HTML	IMAGE_9.JPG	2895	1252
HTML	IM_INDICATOR.GIF	817	1252
HTML	IN_01.GIF	320	1252
HTML	IN_02.GIF	113	1252
HTML	IN_03.GIF	320	1252
HTML	LINE.GIF	946	1252
HTML	LOGO_ALAWAR.GIF	6093	1252
HTML	LOGO_ALL.GIF	9490	1252
HTML	MASYANAS-IN-AFRICA-ICON.GIF	2610	1252
HTML	MASYANAS-IN-AFRICA-PIC.GIF	6908	1252
HTML	MASYANAS-IN-AFRICA-PICBG.GIF	7769	1252
HTML	MASYANYA-EUROTOUR-ICON.GIF	3277	1252
HTML	MASYANYA-EUROTOUR-PIC.GIF	6470	1252
HTML	MASYANYA-EUROTOUR-PICBG.GIF	6796	1252
HTML	MONEY_LOGO.GIF	1169	1252
HTML	MOVING_CUBE.GIF	3427	1252
HTML	NO.GIF	226	1252
HTML	NOVOTELECOM_LOGO.GIF	888	1252
HTML	NO_CONNECT.HTML	1314	1252
HTML	NY_GAMELOGO_ANIMATION.GIF	6767	1252
HTML	OK.GIF	333	1252
HTML	PAPAS-DAUGHTERS-2-ICON.GIF	3304	1252
HTML	PAPAS-DAUGHTERS-2-PIC.GIF	7344	1252
HTML	PAPAS-DAUGHTERS-2-PICBG.GIF	7949	1252
HTML	PAPAS-DAUGHTERS-ICON.GIF	2547	1252
HTML	PAPAS-DAUGHTERS-PIC.GIF	7533	1252
HTML	PAPAS-DAUGHTERS-PICBG.GIF	8894	1252
HTML	PASTEKEY.GIF	16164	1252
HTML	PAY.GIF	1667	1252
HTML	PAYMENTS_ALIPAY.HTML	5157	1252
HTML	PAYMENTS_AVANGATE.HTML	5238	1252
HTML	PAYMENTS_AW_SUBSCRIPTION.HTML	9451	1252
HTML	PAYMENTS_BG.GIF	1747	1252
HTML	PAYMENTS_BOACOMPRA.HTML	5843	1252
HTML	PAYMENTS_BOACOMPRA_SMS.HTML	5832	1252
HTML	PAYMENTS_BOLETO.HTML	5181	1252
HTML	PAYMENTS_CARDS.HTML	6286	1252
HTML	PAYMENTS_CARDS_INFO.HTML	7438	1252
HTML	PAYMENTS_DIRECT_DEBET.HTML	4998	1252
HTML	PAYMENTS_DJUICE.HTML	5206	1252
HTML	PAYMENTS_ENTER_KEY.HTML	4972	1252
HTML	PAYMENTS_IGAME.HTML	5106	1252
HTML	PAYMENTS_IPKO.HTML	5049	1252
HTML	PAYMENTS_KWEDIT.HTML	5306	1252
HTML	PAYMENTS_LOTUS.HTML	5155	1252
HTML	PAYMENTS_MENU_711.GIF	3105	1252
HTML	PAYMENTS_MENU_711_ACTIVE.GIF	1791	1252
HTML	PAYMENTS_MENU_ALIPAY.GIF	4204	1252
HTML	PAYMENTS_MENU_ALIPAY_ACTIVE.GIF	2400	1252
HTML	PAYMENTS_MENU_AWONLINE.GIF	3326	1252
HTML	PAYMENTS_MENU_BOLETO.GIF	5698	1252
HTML	PAYMENTS_MENU_BOLETO_ACTIVE.GIF	4638	1252
HTML	PAYMENTS_MENU_CARDS.GIF	4477	1252
HTML	PAYMENTS_MENU_CARDS_ACTIVE.GIF	2749	1252
HTML	PAYMENTS_MENU_CARDS_IL.GIF	5541	1252
HTML	PAYMENTS_MENU_DIRECT_DEBIT.GIF	3981	1252
HTML	PAYMENTS_MENU_DJUICE.GIF	3132	1252
HTML	PAYMENTS_MENU_DJUICE_ACTIVE.GIF	1798	1252
HTML	PAYMENTS_MENU_E_CASH.GIF	3773	1252
HTML	PAYMENTS_MENU_E_CASH_ACTIVE.GIF	1485	1252
HTML	PAYMENTS_MENU_IGAME.GIF	4264	1252
HTML	PAYMENTS_MENU_IGAME_ACTIVE.GIF	1954	1252
HTML	PAYMENTS_MENU_KPO.GIF	3106	1252
HTML	PAYMENTS_MENU_KPO_ACTIVE.GIF	1573	1252
HTML	PAYMENTS_MENU_KWEDIT.GIF	3498	1252
HTML	PAYMENTS_MENU_KWEDIT_ACTIVE.GIF	2137	1252
HTML	PAYMENTS_MENU_LOTUS.GIF	3800	1252
HTML	PAYMENTS_MENU_LOTUS_ACTIVE.GIF	1909	1252
HTML	PAYMENTS_MENU_MORE.GIF	4259	1252
HTML	PAYMENTS_MENU_MORE_ACTIVE.GIF	2703	1252
HTML	PAYMENTS_MENU_MTRANSFER.GIF	3328	1252
HTML	PAYMENTS_MENU_NOVOTELECOM.GIF	4308	1252
HTML	PAYMENTS_MENU_PAL.GIF	3735	1252
HTML	PAYMENTS_MENU_PAL_ACTIVE.GIF	1405	1252
HTML	PAYMENTS_MENU_PAL_ACTIVE_IL.GIF	2460	1252
HTML	PAYMENTS_MENU_PAL_IL.GIF	4806	1252
HTML	PAYMENTS_MENU_PAYNET.GIF	3641	1252
HTML	PAYMENTS_MENU_PAYNET_ACTIVE.GIF	2516	1252
HTML	PAYMENTS_MENU_SMS.GIF	4076	1252
HTML	PAYMENTS_MENU_SMS_ACTIVE.GIF	2672	1252
HTML	PAYMENTS_MENU_SMS_ACTIVE_IL.GIF	3700	1252
HTML	PAYMENTS_MENU_SMS_IL.GIF	5134	1252
HTML	PAYMENTS_MENU_SUBSCR.GIF	4183	1252
HTML	PAYMENTS_MENU_SUBSCR_ACTIVE.GIF	2635	1252
HTML	PAYMENTS_MENU_TERMINAL.GIF	3717	1252
HTML	PAYMENTS_MENU_TRIALPAY.GIF	3398	1252
HTML	PAYMENTS_MENU_VIO.GIF	4253	1252
HTML	PAYMENTS_MENU_VIO_ACTIVE.GIF	2970	1252
HTML	PAYMENTS_MENU_WAVE_POINT.GIF	2699	1252
HTML	PAYMENTS_MENU_WMYANDEX.GIF	4021	1252
HTML	PAYMENTS_MORE.HTML	5405	1252
HTML	PAYMENTS_MORE_INFO.HTML	2857	1252
HTML	PAYMENTS_MTRANSFER.HTML	5047	1252
HTML	PAYMENTS_NOVOTELECOM.HTML	5306	1252
HTML	PAYMENTS_PAYNET.HTML	6729	1252
HTML	PAYMENTS_PAYPAL.HTML	5199	1252
HTML	PAYMENTS_SAFE_CART.HTML	5104	1252
HTML	PAYMENTS_SEVEN_ELEVEN.HTML	5240	1252
HTML	PAYMENTS_SMS.GIF	2804	1252
HTML	PAYMENTS_SMS.HTML	61845	1252
HTML	PAYMENTS_SMS_DJUICE.HTML	5573	1252
HTML	PAYMENTS_SMS_PPC.HTML	8652	1252
HTML	PAYMENTS_SMS_PTTERMS.HTML	11904	1252
HTML	PAYMENTS_TERMINAL.HTML	6495	1252
HTML	PAYMENTS_TRIALPAY.HTML	5081	1252
HTML	PAYMENTS_VIO.HTML	6431	1252
HTML	PAYMENTS_WAVEPOINT.HTML	5075	1252
HTML	PAYMENTS_WM.HTML	4591	1252
HTML	PAYMENTS_WMYANDEX.HTML	4647	1252
HTML	PAYMENTS_YANDEX.HTML	4578	1252
HTML	PAYMENT_METHODS.HTML	11691	1252
HTML	PAYPAL.GIF	2148	1252
HTML	PAY_HOVER.GIF	1699	1252
HTML	PENGUINS-MANIA-ICON.GIF	1698	1252
HTML	PENGUINS-MANIA-PIC.GIF	3574	1252
HTML	PENGUINS-MANIA-PICBG.JPG	22387	1252
HTML	PLAY_MORE.GIF	1695	1252
HTML	PLAY_MORE_DISABLED.GIF	1264	1252
HTML	PLAY_MORE_HOVER.GIF	1696	1252
HTML	PREV_SUPPORT_01.GIF	2491	1252
HTML	PREV_SUPPORT_02.GIF	2498	1252
HTML	PROCESSING.GIF	1456	1252
HTML	QIWI001.GIF	7972	1252
HTML	QIWI003.JPG	32808	1252
HTML	QIWI004.GIF	31258	1252
HTML	QIWI007.JPG	25182	1252
HTML	QIWI010.JPG	79242	1252
HTML	QIWI013.JPG	29145	1252
HTML	QIWI015.JPG	67584	1252
HTML	QIWI_LOGO.GIF	1270	1252
HTML	QUESTION.GIF	488	1252
HTML	REGISTER.HTML	61964	1252
HTML	REGISTER_IE.HTML	1049	1252
HTML	REGISTER_OK.HTML	950	1252
HTML	REGISTER_WR.HTML	1485	1252
HTML	RENTSOFT_ERROR.HTML	1802	1252
HTML	SELECTKEY.GIF	12838	1252
HTML	SEND_SUPPORT_01.GIF	1377	1252
HTML	SEND_SUPPORT_02.GIF	1358	1252
HTML	SPACER.GIF	43	1252
HTML	SPLASH.HTML	543	1252
HTML	START_REGISTERED.HTML	6375	1252
HTML	START_UNREGISTERED.HTML	7425	1252
HTML	START_UNREG_TIMEEND.HTML	1570	1252
HTML	STRINGS.XML.AR	35630	1252
HTML	STRINGS.XML.AZ	23563	1252
HTML	STRINGS.XML.BG	20752	1252
HTML	STRINGS.XML.CS	23956	1252
HTML	STRINGS.XML.DE	24629	1252
HTML	STRINGS.XML.EL	47312	1252
HTML	STRINGS.XML.EN	31617	1252
HTML	STRINGS.XML.ES	24497	1252
HTML	STRINGS.XML.ET	21919	1252
HTML	STRINGS.XML.FI	18332	1252
HTML	STRINGS.XML.FR	24431	1252
HTML	STRINGS.XML.HR	23368	1252
HTML	STRINGS.XML.HU	23751	1252
HTML	STRINGS.XML.HU_CD	10748	1252
HTML	STRINGS.XML.ID	26622	1252
HTML	STRINGS.XML.IL	20233	1252
HTML	STRINGS.XML.IT	24725	1252
HTML	STRINGS.XML.JA	26192	1252
HTML	STRINGS.XML.KA	29495	1252
HTML	STRINGS.XML.KO	24587	1252
HTML	STRINGS.XML.LT	18535	1252
HTML	STRINGS.XML.LV	18417	1252
HTML	STRINGS.XML.MN	29776	1252
HTML	STRINGS.XML.NL	23890	1252
HTML	STRINGS.XML.PL	24304	1252
HTML	STRINGS.XML.PT	24132	1252
HTML	STRINGS.XML.RO	24428	1252
HTML	STRINGS.XML.RU	42528	1252
HTML	STRINGS.XML.SL	23453	1252
HTML	STRINGS.XML.SR	23279	1252
HTML	STRINGS.XML.SV	23660	1252
HTML	STRINGS.XML.TR	24130	1252
HTML	STRINGS.XML.UK	36097	1252
HTML	STRINGS.XML.VI	20128	1252
HTML	STRINGS.XML.ZH	25368	1252
HTML	STRL.GIF	115	1252
HTML	SUPERCOW-ICON.GIF	2432	1252
HTML	SUPERCOW-PIC.GIF	6407	1252
HTML	SUPERCOW-PICBG.GIF	8614	1252
HTML	SUPPORT_FORM.HTML	24418	1252
HTML	SUPPORT_FORM_OK.HTML	2126	1252
HTML	TEST.XML	1567	1252
HTML	TOP_MENU_BUTTON_01.GIF	1724	1252
HTML	TOP_MENU_BUTTON_02.GIF	2170	1252
HTML	TOP_MENU_BUTTON_03.GIF	2157	1252
HTML	WAITING2.GIF	3951	1252
HTML	WEBMONEY_LOGO.GIF	1211	1252
HTML	WM_LOGO.GIF	2553	1252
HTML	WRAPPER.CSS	30136	1252
HTML	WRAPPER.CSS.AR	2478	1252
HTML	WRAPPER.CSS.AZ	595	1252
HTML	WRAPPER.CSS.BG	1249	1252
HTML	WRAPPER.CSS.CS	2006	1252
HTML	WRAPPER.CSS.DE	762	1252
HTML	WRAPPER.CSS.EL	1643	1252
HTML	WRAPPER.CSS.EN	1176	1252
HTML	WRAPPER.CSS.ES	572	1252
HTML	WRAPPER.CSS.ET	583	1252
HTML	WRAPPER.CSS.FI	437	1252
HTML	WRAPPER.CSS.FR	347	1252
HTML	WRAPPER.CSS.HR	1495	1252
HTML	WRAPPER.CSS.HU	643	1252
HTML	WRAPPER.CSS.HU_CD	412	1252
HTML	WRAPPER.CSS.ID	1560	1252
HTML	WRAPPER.CSS.IL	2452	1252
HTML	WRAPPER.CSS.IT	662	1252
MANIFEST	#1	346	1252

module_name	ord	function_name
kernel32.dll		GetProcAddress
kernel32.dll		GetModuleHandleA
kernel32.dll		LoadLibraryA
user32.dll		CharNextW
gdi32.dll		GetObjectW
advapi32.dll		CryptGenRandom
shell32.dll		ShellExecuteW
ole32.dll		CoTaskMemAlloc
oleaut32.dll	200
wrapper.dll		char * __cdecl DllSetRegKey(void) ?DllSetRegKey@@YAPADXZ
oleaut32.dll		VariantChangeTypeEx
kernel32.dll		RaiseException

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Code Signing 2010 CA

serial: 650A27A04DBAA9DF0C06DEBBA3983054

Certificates (4)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
        Validity
            Not Before: Jun 15 00:00:00 2007 GMT
            Not After : Jun 14 23:59:59 2012 GMT
        Subject: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    00:c4:b5:f2:52:15:bc:88:86:60:29:16:4a:5b:2f:
                    4b:91:6b:87:91:f3:35:54:58:35:ea:d1:36:5e:62:
                    4d:52:51:34:71:c2:7b:66:1d:89:c8:dd:2a:c4:6a:
                    0a:f6:37:d9:98:74:91:f6:92:ae:b0:b5:76:96:f1:
                    a9:4a:63:45:47:2e:6b:0b:92:4e:4b:2b:8c:ee:58:
                    4a:8b:d4:07:e4:1a:2c:f8:82:aa:58:d9:cd:42:f3:
                    2d:c0:75:de:8d:ab:c7:8e:1d:9a:6c:4c:08:95:1e:
                    de:db:ef:67:e1:72:c2:49:c2:9e:60:3c:e1:e2:be:
                    16:a3:63:78:69:14:7b:ad:2d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com

            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.verisign.com/tss-ca.crl

            X509v3 Extended Key Usage: critical
                Time Stamping
            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation
            X509v3 Subject Alternative Name: 
                DirName:/CN=TSA1-2
    Signature Algorithm: sha1WithRSAEncryption
         50:c5:4b:c8:24:80:df:e4:0d:24:c2:de:1a:b1:a1:02:a1:a6:
         82:2d:0c:83:15:81:37:0a:82:0e:2c:b0:5a:17:61:b5:d8:05:
         fe:88:db:f1:91:91:b3:56:1a:40:a6:eb:92:be:38:39:b0:75:
         36:74:3a:98:4f:e4:37:ba:99:89:ca:95:42:1d:b0:b9:c7:a0:
         8d:57:e0:fa:d5:64:04:42:35:4e:01:d1:33:a2:17:c8:4d:aa:
         27:c7:f2:e1:86:4c:02:38:4d:83:78:c6:fc:53:e0:eb:e0:06:
         87:dd:a4:96:9e:5e:0c:98:e2:a5:be:bf:82:85:c3:60:e1:df:
         ad:28:d8:c7:a5:4b:64:da:c7:1b:5b:bd:ac:39:08:d5:38:22:
         a1:33:8b:2f:8a:9a:eb:bc:07:21:3f:44:41:09:07:b5:65:1c:
         24:bc:48:d3:44:80:eb:a1:cf:c9:02:b4:14:cf:54:c7:16:a3:
         80:5c:f9:79:3e:5d:72:7d:88:17:9e:2c:43:a2:ca:53:ce:7d:
         3d:f6:2a:3a:b8:4f:94:00:a5:6d:0a:83:5d:f9:5e:53:f4:18:
         b3:57:0f:70:c3:fb:f5:ad:95:a0:0e:17:de:c4:16:80:60:c9:
         0f:2b:6e:86:04:f1:eb:f4:78:27:d1:05:c5:ee:34:5b:5e:b9:
         49:32:f2:33

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
        Validity
            Not Before: Dec  4 00:00:00 2003 GMT
            Not After : Dec  3 23:59:59 2013 GMT
        Subject: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:a9:ca:b2:a4:cc:cd:20:af:0a:7d:89:ac:87:75:
                    f0:b4:4e:f1:df:c1:0f:bf:67:61:bd:a3:64:1c:da:
                    bb:f9:ca:33:ab:84:30:89:58:7e:8c:db:6b:dd:36:
                    9e:0f:bf:d1:ec:78:f2:77:a6:7e:6f:3c:bf:93:af:
                    0d:ba:68:f4:6c:94:ca:bd:52:2d:ab:48:3d:f5:b6:
                    d5:5d:5f:1b:02:9f:fa:2f:6b:1e:a4:f7:a3:9a:a6:
                    1a:c8:02:e1:7f:4c:52:e3:0e:60:ec:40:1c:7e:b9:
                    0d:de:3f:c7:b4:df:87:bd:5f:7a:6a:31:2e:03:99:
                    81:13:a8:47:20:ce:31:73:0d:57:2d:cd:78:34:33:
                    95:12:99:12:b9:de:68:2f:aa:e6:e3:c2:8a:8c:2a:
                    c3:8b:21:87:66:bd:83:58:57:6f:75:bf:3c:aa:26:
                    87:5d:ca:10:15:3c:9f:84:ea:54:c1:0a:6e:c4:fe:
                    c5:4a:dd:b9:07:11:97:22:7c:db:3e:27:d1:1e:78:
                    ec:9f:31:c9:f1:e6:22:19:db:c4:b3:47:43:9a:1a:
                    5f:a0:1e:90:e4:5e:f5:ee:7c:f1:7d:ab:62:01:8f:
                    f5:4d:0b:de:d0:22:56:a8:95:cd:ae:88:76:ae:ee:
                    ba:0d:f3:e4:4d:d9:a0:fb:68:a0:ae:14:3b:b3:87:
                    c1:bb
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com

            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.verisign.com/ThawteTimestampingCA.crl

            X509v3 Extended Key Usage: 
                Time Stamping
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name: 
                DirName:/CN=TSA2048-1-53
    Signature Algorithm: sha1WithRSAEncryption
         4a:6b:f9:ea:58:c2:44:1c:31:89:79:99:2b:96:bf:82:ac:01:
         d6:1c:4c:cd:b0:8a:58:6e:df:08:29:a3:5e:c8:ca:93:13:e7:
         04:52:0d:ef:47:27:2f:00:38:b0:e4:c9:93:4e:9a:d4:22:62:
         15:f7:3f:37:21:4f:70:31:80:f1:8b:38:87:b3:e8:e8:97:00:
         fe:cf:55:96:4e:24:d2:a9:27:4e:7a:ae:b7:61:41:f3:2a:ce:
         e7:c9:d9:5e:dd:bb:2b:85:3e:b5:9d:b5:d9:e1:57:ff:be:b4:
         c5:7e:f5:cf:0c:9e:f0:97:fe:2b:d3:3b:52:1b:1b:38:27:f7:
         3f:4a

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            65:0a:27:a0:4d:ba:a9:df:0c:06:de:bb:a3:98:30:54
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
        Validity
            Not Before: Dec 19 00:00:00 2011 GMT
            Not After : Dec 31 23:59:59 2014 GMT
        Subject: C=US, ST=Virginia, L=Alexandria, O=Alawar Entertainment Inc, OU=Digital ID Class 3 - Microsoft Software Validation v2, OU=-, CN=Alawar Entertainment Inc
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:8e:9c:98:ca:d4:1b:c1:26:31:99:f8:36:82:21:
                    d1:6c:7c:61:6a:4c:a4:99:75:d2:17:45:b6:96:37:
                    e1:eb:ec:a0:b6:54:6f:f1:00:b8:c0:d1:a1:d1:ac:
                    98:47:2a:a6:ab:59:5b:c1:d4:84:1b:3c:a8:88:75:
                    e3:68:dc:47:e9:1a:9f:6a:fa:f6:6b:d5:ed:c2:a9:
                    e5:41:8b:86:4f:bd:13:73:1c:fc:e6:eb:0f:92:80:
                    1c:af:ec:6e:84:69:1c:c4:b2:59:76:52:b4:13:6f:
                    71:ad:a3:44:f1:86:4c:dc:fa:e6:08:8d:e9:f9:bc:
                    cd:b6:34:b0:b5:8a:1d:4f:a4:73:a4:ec:cf:a8:70:
                    3c:92:04:ce:8a:db:7a:6a:8e:d8:15:ca:87:c2:dd:
                    bf:11:d6:b2:9a:5c:32:a1:5d:c5:de:2e:25:d6:bb:
                    eb:f2:1d:da:f6:6e:16:f2:32:6f:7c:34:de:fb:80:
                    c9:c0:2f:86:26:0a:b4:db:7d:1d:26:f6:3b:0e:16:
                    55:45:3c:60:c4:98:ba:82:48:ac:ea:68:9d:7a:a8:
                    2b:df:ef:14:9b:6d:57:ed:c1:4c:fc:b4:0f:9e:1c:
                    bb:55:3f:83:00:45:c0:11:c2:49:34:1b:ad:13:69:
                    2a:98:e1:e7:b7:74:5d:85:60:7c:a6:df:ae:45:19:
                    3c:4f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://csc3-2010-crl.verisign.com/CSC3-2010.crl

            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/rpa

            X509v3 Extended Key Usage: 
                Code Signing
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
                CA Issuers - URI:http://csc3-2010-aia.verisign.com/CSC3-2010.cer

            X509v3 Authority Key Identifier: 
                keyid:CF:99:A9:EA:7B:26:F4:4B:C9:8E:8F:D7:F0:05:26:EF:E3:D2:A7:9D

            Netscape Cert Type: 
                Object Signing
            1.3.6.1.4.1.311.2.1.27: 
                0.......
    Signature Algorithm: sha1WithRSAEncryption
         2e:ae:99:82:1d:05:7a:b8:d4:09:61:a4:12:4e:2d:42:b1:ab:
         24:aa:67:36:b0:68:87:74:37:19:97:31:13:11:e4:69:ac:42:
         f8:b7:5b:95:ec:16:bf:fd:c6:37:5b:92:6f:6f:9e:f0:bb:a4:
         89:b1:74:e3:81:71:c0:05:60:fe:0d:86:4a:6c:a2:03:86:f7:
         71:24:82:91:6f:61:98:12:58:26:90:d4:58:cc:52:49:e8:37:
         d4:cb:46:11:40:52:44:7b:c4:f9:b0:d2:ae:a9:12:1b:3c:98:
         80:92:a1:77:94:58:74:25:b9:5f:82:4b:0d:66:60:aa:bd:a6:
         7f:f1:4a:7f:98:bf:e2:48:a2:8e:86:c2:44:9f:1b:b7:3d:af:
         dd:6f:60:0b:e9:bc:d2:e0:9a:72:9e:3b:59:b4:5c:30:91:ab:
         ec:be:45:08:71:06:71:fa:31:87:f6:cc:08:58:29:34:c5:85:
         1c:17:64:60:64:1f:f8:90:b3:5e:3a:16:e2:89:c9:0e:fd:ba:
         e5:63:d5:b1:a8:a1:64:b0:47:62:ce:38:15:84:b5:eb:fb:b8:
         a3:cf:f7:2e:9d:99:6f:ef:f6:5c:dd:59:94:47:27:50:ae:19:
         70:1c:01:65:32:a2:75:23:0a:2d:21:a0:5c:54:9a:32:d3:3f:
         ba:dc:e6:e1

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
        Validity
            Not Before: Feb  8 00:00:00 2010 GMT
            Not After : Feb  7 23:59:59 2020 GMT
        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:f5:23:4b:5e:a5:d7:8a:bb:32:e9:d4:57:f7:ef:
                    e4:c7:26:7e:ad:19:98:fe:a8:9d:7d:94:f6:36:6b:
                    10:d7:75:81:30:7f:04:68:7f:cb:2b:75:1e:cd:1d:
                    08:8c:df:69:94:a7:37:a3:9c:7b:80:e0:99:e1:ee:
                    37:4d:5f:ce:3b:14:ee:86:d4:d0:f5:27:35:bc:25:
                    0b:38:a7:8c:63:9d:17:a3:08:a5:ab:b0:fb:cd:6a:
                    62:82:4c:d5:21:da:1b:d9:f1:e3:84:3b:8a:2a:4f:
                    85:5b:90:01:4f:c9:a7:76:10:7f:27:03:7c:be:ae:
                    7e:7d:c1:dd:f9:05:bc:1b:48:9c:69:e7:c0:a4:3c:
                    3c:41:00:3e:df:96:e5:c5:e4:94:71:d6:55:01:c7:
                    00:26:4a:40:3c:b5:a1:26:a9:0c:a7:6d:80:8e:90:
                    25:7b:cf:bf:3f:1c:eb:2f:96:fa:e5:87:77:c6:b5:
                    56:b2:7a:3b:54:30:53:1b:df:62:34:ff:1e:d1:f4:
                    5a:93:28:85:e5:4c:17:4e:7e:5b:fd:a4:93:99:7f:
                    df:cd:ef:a4:75:ef:ef:15:f6:47:e7:f8:19:72:d8:
                    2e:34:1a:a6:b4:a7:4c:7e:bd:bb:4f:0c:3d:57:f1:
                    30:d6:a6:36:8e:d6:80:76:d7:19:2e:a5:cd:7e:34:
                    2d:89
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/cps
                  User Notice:
                    Explicit Text: https://www.verisign.com/rpa

            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            1.3.6.1.5.5.7.1.12: 
                0_.].[0Y0W0U..image/gif0!0.0...+..............k...j.H.,{..0%.#http://logo.verisign.com/vslogo.gif
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.verisign.com/pca3-g5.crl

            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com

            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, Code Signing
            X509v3 Subject Alternative Name: 
                DirName:/CN=VeriSignMPKI-2-8
            X509v3 Subject Key Identifier: 
                CF:99:A9:EA:7B:26:F4:4B:C9:8E:8F:D7:F0:05:26:EF:E3:D2:A7:9D
            X509v3 Authority Key Identifier: 
                keyid:7F:D3:65:A7:C2:DD:EC:BB:F0:30:09:F3:43:39:FA:02:AF:33:31:33

    Signature Algorithm: sha1WithRSAEncryption
         56:22:e6:34:a4:c4:61:cb:48:b9:01:ad:56:a8:64:0f:d9:8c:
         91:c4:bb:cc:0c:e5:ad:7a:a0:22:7f:df:47:38:4a:2d:6c:d1:
         7f:71:1a:7c:ec:70:a9:b1:f0:4f:e4:0f:0c:53:fa:15:5e:fe:
         74:98:49:24:85:81:26:1c:91:14:47:b0:4c:63:8c:bb:a1:34:
         d4:c6:45:e8:0d:85:26:73:03:d0:a9:8c:64:6d:dc:71:92:e6:
         45:05:60:15:59:51:39:fc:58:14:6b:fe:d4:a4:ed:79:6b:08:
         0c:41:72:e7:37:22:06:09:be:23:e9:3f:44:9a:1e:e9:61:9d:
         cc:b1:90:5c:fc:3d:d2:8d:ac:42:3d:65:36:d4:b4:3d:40:28:
         8f:9b:10:cf:23:26:cc:4b:20:cb:90:1f:5d:8c:4c:34:ca:3c:
         d8:e5:37:d6:6f:a5:20:bd:34:eb:26:d9:ae:0d:e7:c5:9a:f7:
         a1:b4:21:91:33:6f:86:e8:58:bb:25:7c:74:0e:58:fe:75:1b:
         63:3f:ce:31:7c:9b:8f:1b:96:9e:c5:53:76:84:5b:9c:ad:91:
         fa:ac:ed:93:ba:5d:c8:21:53:c2:82:53:63:af:12:0d:50:87:
         11:1b:3d:54:52:96:8a:2c:9c:3d:92:1a:08:9a:05:2e:c7:93:
         a5:48:91:d3

pkcs7-signedData

SHA1: nil

1.3.6.1.4.1.311.2.1.4

1.3.6.1.4.1.311.2.1.15

00 3c 00 3c 00 3c 00 4f  00 62 00 73 00 6f 00 6c  |.<.<.<.O.b.s.o.l|
00 65 00 74 00 65 00 3e  00 3e 00 3e              |.e.t.e.>.>.>    |

SHA1

43 27 55 2e 2b b8 57 58 00 36 61 10 19 5f 6b c2 |C'U.+.WX.6a.._k.| bf 35 77 39 |.5w9 |

Certificates
- Certificate #0
  - 2
    - 38:25:D7:FA:F8:61:AF:9E:F4:90:E7:26:B5:D6:5A:D5
    - RSA-SHA1: nil
    - Issuer
      - C: US
      - O: VeriSign, Inc.
      - CN: VeriSign Time Stamping Services CA
    - 2007-06-15 00:00:00 UTC: 2012-06-14 23:59:59 UTC
    - Subject
      - C: US
      - O: VeriSign, Inc.
      - CN: VeriSign Time Stamping Services Signer - G2
    - #5
      - rsaEncryption: nil
      - C4:B5:F2:52:15:BC:88:86:60:29:16:4A:5B:2F:4B:91:
        6B:87:91:F3:35:54:58:35:EA:D1:36:5E:62:4D:52:51:
        34:71:C2:7B:66:1D:89:C8:DD:2A:C4:6A:0A:F6:37:D9:
        98:74:91:F6:92:AE:B0:B5:76:96:F1:A9:4A:63:45:47:
        2E:6B:0B:92:4E:4B:2B:8C:EE:58:4A:8B:D4:07:E4:1A:
        2C:F8:82:AA:58:D9:CD:42:F3:2D:C0:75:DE:8D:AB:C7:
        8E:1D:9A:6C:4C:08:95:1E:DE:DB:EF:67:E1:72:C2:49:
        C2:9E:60:3C:E1:E2:BE:16:A3:63:78:69:14:7B:AD:2D: 0x010001
    - X509v3 extensions
      - authorityInfoAccess
        OCSP: http://ocsp.verisign.com
      - basicConstraints
        true
        nil
      - crlDistributionPoints: http://crl.verisign.com/tss-ca.crl
      - extendedKeyUsage: true, timeStamping
      - keyUsage: true, 0xc0
      - subjectAltName
        CN: TSA1-2
  - RSA-SHA1:
```
50 c5 4b c8 24 80 df e4  0d 24 c2 de 1a b1 a1 02  |P.K.$....$......|
a1 a6 82 2d 0c 83 15 81  37 0a 82 0e 2c b0 5a 17  |...-....7...,.Z.|
61 b5 d8 05 fe 88 db f1  91 91 b3 56 1a 40 a6 eb  |a..........V.@..|
92 be 38 39 b0 75 36 74  3a 98 4f e4 37 ba 99 89  |..89.u6t:.O.7...|
ca 95 42 1d b0 b9 c7 a0  8d 57 e0 fa d5 64 04 42  |..B......W...d.B|
35 4e 01 d1 33 a2 17 c8  4d aa 27 c7 f2 e1 86 4c  |5N..3...M.'....L|
02 38 4d 83 78 c6 fc 53  e0 eb e0 06 87 dd a4 96  |.8M.x..S........|
9e 5e 0c 98 e2 a5 be bf  82 85 c3 60 e1 df ad 28  |.^.........`...(|
d8 c7 a5 4b 64 da c7 1b  5b bd ac 39 08 d5 38 22  |...Kd...[..9..8"|
a1 33 8b 2f 8a 9a eb bc  07 21 3f 44 41 09 07 b5  |.3./.....!?DA...|
65 1c 24 bc 48 d3 44 80  eb a1 cf c9 02 b4 14 cf  |e.$.H.D.........|
54 c7 16 a3 80 5c f9 79  3e 5d 72 7d 88 17 9e 2c  |T....\.y>]r}...,|
43 a2 ca 53 ce 7d 3d f6  2a 3a b8 4f 94 00 a5 6d  |C..S.}=.*:.O...m|
0a 83 5d f9 5e 53 f4 18  b3 57 0f 70 c3 fb f5 ad  |..].^S...W.p....|
95 a0 0e 17 de c4 16 80  60 c9 0f 2b 6e 86 04 f1  |........`..+n...|
eb f4 78 27 d1 05 c5 ee  34 5b 5e b9 49 32 f2 33  |..x'....4[^.I2.3|
```
- Certificate #1
  - 2
    - 47:BF:19:95:DF:8D:52:46:43:F7:DB:6D:48:0D:31:A4
    - RSA-SHA1: nil
    - Issuer
      - C: ZA
      - ST: Western Cape
      - L: Durbanville
      - O: Thawte
      - OU: Thawte Certification
      - CN: Thawte Timestamping CA
    - 2003-12-04 00:00:00 UTC: 2013-12-03 23:59:59 UTC
    - Subject
      - C: US
      - O: VeriSign, Inc.
      - CN: VeriSign Time Stamping Services CA
    - #5
      - rsaEncryption: nil
      - A9:CA:B2:A4:CC:CD:20:AF:0A:7D:89:AC:87:75:F0:B4:
        4E:F1:DF:C1:0F:BF:67:61:BD:A3:64:1C:DA:BB:F9:CA:
        33:AB:84:30:89:58:7E:8C:DB:6B:DD:36:9E:0F:BF:D1:
        EC:78:F2:77:A6:7E:6F:3C:BF:93:AF:0D:BA:68:F4:6C:
        94:CA:BD:52:2D:AB:48:3D:F5:B6:D5:5D:5F:1B:02:9F:
        FA:2F:6B:1E:A4:F7:A3:9A:A6:1A:C8:02:E1:7F:4C:52:
        E3:0E:60:EC:40:1C:7E:B9:0D:DE:3F:C7:B4:DF:87:BD:
        5F:7A:6A:31:2E:03:99:81:13:A8:47:20:CE:31:73:0D:
        57:2D:CD:78:34:33:95:12:99:12:B9:DE:68:2F:AA:E6:
        E3:C2:8A:8C:2A:C3:8B:21:87:66:BD:83:58:57:6F:75:
        BF:3C:AA:26:87:5D:CA:10:15:3C:9F:84:EA:54:C1:0A:
        6E:C4:FE:C5:4A:DD:B9:07:11:97:22:7C:DB:3E:27:D1:
        1E:78:EC:9F:31:C9:F1:E6:22:19:DB:C4:B3:47:43:9A:
        1A:5F:A0:1E:90:E4:5E:F5:EE:7C:F1:7D:AB:62:01:8F:
        F5:4D:0B:DE:D0:22:56:A8:95:CD:AE:88:76:AE:EE:BA:
        0D:F3:E4:4D:D9:A0:FB:68:A0:AE:14:3B:B3:87:C1:BB: 0x010001
    - X509v3 extensions
      - authorityInfoAccess
        OCSP: http://ocsp.verisign.com
      - basicConstraints
        true
        true: 0
      - crlDistributionPoints: http://crl.verisign.com/ThawteTimestampingCA.crl
      - extendedKeyUsage: timeStamping
      - keyUsage: true, 6
      - subjectAltName
        CN: TSA2048-1-53
  - RSA-SHA1:
```
4a 6b f9 ea 58 c2 44 1c  31 89 79 99 2b 96 bf 82  |Jk..X.D.1.y.+...|
ac 01 d6 1c 4c cd b0 8a  58 6e df 08 29 a3 5e c8  |....L...Xn..).^.|
ca 93 13 e7 04 52 0d ef  47 27 2f 00 38 b0 e4 c9  |.....R..G'/.8...|
93 4e 9a d4 22 62 15 f7  3f 37 21 4f 70 31 80 f1  |.N.."b..?7!Op1..|
8b 38 87 b3 e8 e8 97 00  fe cf 55 96 4e 24 d2 a9  |.8........U.N$..|
27 4e 7a ae b7 61 41 f3  2a ce e7 c9 d9 5e dd bb  |'Nz..aA.*....^..|
2b 85 3e b5 9d b5 d9 e1  57 ff be b4 c5 7e f5 cf  |+.>.....W....~..|
0c 9e f0 97 fe 2b d3 3b  52 1b 1b 38 27 f7 3f 4a  |.....+.;R..8'.?J|
```
- Certificate #2
  - 2
    - 65:0A:27:A0:4D:BA:A9:DF:0C:06:DE:BB:A3:98:30:54
    - RSA-SHA1: nil
    - Issuer
      - C: US
      - O: VeriSign, Inc.
      - OU: VeriSign Trust Network
      - OU: Terms of use at https://www.verisign.com/rpa (c)10
      - CN: VeriSign Class 3 Code Signing 2010 CA
    - 2011-12-19 00:00:00 UTC: 2014-12-31 23:59:59 UTC
    - Subject
      - C: US
      - ST: Virginia
      - L: Alexandria
      - O: Alawar Entertainment Inc
      - OU: Digital ID Class 3 - Microsoft Software Validation v2
      - OU: -
      - CN: Alawar Entertainment Inc
    - #5
      - rsaEncryption: nil
      - 8E:9C:98:CA:D4:1B:C1:26:31:99:F8:36:82:21:D1:6C:
        7C:61:6A:4C:A4:99:75:D2:17:45:B6:96:37:E1:EB:EC:
        A0:B6:54:6F:F1:00:B8:C0:D1:A1:D1:AC:98:47:2A:A6:
        AB:59:5B:C1:D4:84:1B:3C:A8:88:75:E3:68:DC:47:E9:
        1A:9F:6A:FA:F6:6B:D5:ED:C2:A9:E5:41:8B:86:4F:BD:
        13:73:1C:FC:E6:EB:0F:92:80:1C:AF:EC:6E:84:69:1C:
        C4:B2:59:76:52:B4:13:6F:71:AD:A3:44:F1:86:4C:DC:
        FA:E6:08:8D:E9:F9:BC:CD:B6:34:B0:B5:8A:1D:4F:A4:
        73:A4:EC:CF:A8:70:3C:92:04:CE:8A:DB:7A:6A:8E:D8:
        15:CA:87:C2:DD:BF:11:D6:B2:9A:5C:32:A1:5D:C5:DE:
        2E:25:D6:BB:EB:F2:1D:DA:F6:6E:16:F2:32:6F:7C:34:
        DE:FB:80:C9:C0:2F:86:26:0A:B4:DB:7D:1D:26:F6:3B:
        0E:16:55:45:3C:60:C4:98:BA:82:48:AC:EA:68:9D:7A:
        A8:2B:DF:EF:14:9B:6D:57:ED:C1:4C:FC:B4:0F:9E:1C:
        BB:55:3F:83:00:45:C0:11:C2:49:34:1B:AD:13:69:2A:
        98:E1:E7:B7:74:5D:85:60:7C:A6:DF:AE:45:19:3C:4F: 0x010001
    - X509v3 extensions
      - basicConstraints
        nil
      - keyUsage: true, 0x80
      - crlDistributionPoints: http://csc3-2010-crl.verisign.com/CSC3-2010.crl
      - certificatePolicies
        2.16.840.1.113733.1.7.23.3
        id-qt-cps: https://www.verisign.com/rpa
      - extendedKeyUsage: codeSigning
      - authorityInfoAccess
        #0
        OCSP: http://ocsp.verisign.com
        caIssuers: http://csc3-2010-aia.verisign.com/CSC3-2010.cer
      - authorityKeyIdentifier:
        cf 99 a9 ea 7b 26 f4 4b c9 8e 8f d7 f0 05 26 ef |....{&.K......&.| e3 d2 a7 9d |.... |
      - nsCertType: 0x10
      - 1.3.6.1.4.1.311.2.1.27
        false: true
  - RSA-SHA1:
```
2e ae 99 82 1d 05 7a b8  d4 09 61 a4 12 4e 2d 42  |......z...a..N-B|
b1 ab 24 aa 67 36 b0 68  87 74 37 19 97 31 13 11  |..$.g6.h.t7..1..|
e4 69 ac 42 f8 b7 5b 95  ec 16 bf fd c6 37 5b 92  |.i.B..[......7[.|
6f 6f 9e f0 bb a4 89 b1  74 e3 81 71 c0 05 60 fe  |oo......t..q..`.|
0d 86 4a 6c a2 03 86 f7  71 24 82 91 6f 61 98 12  |..Jl....q$..oa..|
58 26 90 d4 58 cc 52 49  e8 37 d4 cb 46 11 40 52  |X&..X.RI.7..F.@R|
44 7b c4 f9 b0 d2 ae a9  12 1b 3c 98 80 92 a1 77  |D{........<....w|
94 58 74 25 b9 5f 82 4b  0d 66 60 aa bd a6 7f f1  |.Xt%._.K.f`.....|
4a 7f 98 bf e2 48 a2 8e  86 c2 44 9f 1b b7 3d af  |J....H....D...=.|
dd 6f 60 0b e9 bc d2 e0  9a 72 9e 3b 59 b4 5c 30  |.o`......r.;Y.\0|
91 ab ec be 45 08 71 06  71 fa 31 87 f6 cc 08 58  |....E.q.q.1....X|
29 34 c5 85 1c 17 64 60  64 1f f8 90 b3 5e 3a 16  |)4....d`d....^:.|
e2 89 c9 0e fd ba e5 63  d5 b1 a8 a1 64 b0 47 62  |.......c....d.Gb|
ce 38 15 84 b5 eb fb b8  a3 cf f7 2e 9d 99 6f ef  |.8............o.|
f6 5c dd 59 94 47 27 50  ae 19 70 1c 01 65 32 a2  |.\.Y.G'P..p..e2.|
75 23 0a 2d 21 a0 5c 54  9a 32 d3 3f ba dc e6 e1  |u#.-!.\T.2.?....|
```
- Certificate #3
  - 2
    - 52:00:E5:AA:25:56:FC:1A:86:ED:96:C9:D4:4B:33:C7
    - RSA-SHA1: nil
    - Issuer
      - C: US
      - O: VeriSign, Inc.
      - OU: VeriSign Trust Network
      - OU: (c) 2006 VeriSign, Inc. - For authorized use only
      - CN: VeriSign Class 3 Public Primary Certification Authority - G5
    - 2010-02-08 00:00:00 UTC: 2020-02-07 23:59:59 UTC
    - Subject
      - C: US
      - O: VeriSign, Inc.
      - OU: VeriSign Trust Network
      - OU: Terms of use at https://www.verisign.com/rpa (c)10
      - CN: VeriSign Class 3 Code Signing 2010 CA
    - #5
      - rsaEncryption: nil
      - F5:23:4B:5E:A5:D7:8A:BB:32:E9:D4:57:F7:EF:E4:C7:
        26:7E:AD:19:98:FE:A8:9D:7D:94:F6:36:6B:10:D7:75:
        81:30:7F:04:68:7F:CB:2B:75:1E:CD:1D:08:8C:DF:69:
        94:A7:37:A3:9C:7B:80:E0:99:E1:EE:37:4D:5F:CE:3B:
        14:EE:86:D4:D0:F5:27:35:BC:25:0B:38:A7:8C:63:9D:
        17:A3:08:A5:AB:B0:FB:CD:6A:62:82:4C:D5:21:DA:1B:
        D9:F1:E3:84:3B:8A:2A:4F:85:5B:90:01:4F:C9:A7:76:
        10:7F:27:03:7C:BE:AE:7E:7D:C1:DD:F9:05:BC:1B:48:
        9C:69:E7:C0:A4:3C:3C:41:00:3E:DF:96:E5:C5:E4:94:
        71:D6:55:01:C7:00:26:4A:40:3C:B5:A1:26:A9:0C:A7:
        6D:80:8E:90:25:7B:CF:BF:3F:1C:EB:2F:96:FA:E5:87:
        77:C6:B5:56:B2:7A:3B:54:30:53:1B:DF:62:34:FF:1E:
        D1:F4:5A:93:28:85:E5:4C:17:4E:7E:5B:FD:A4:93:99:
        7F:DF:CD:EF:A4:75:EF:EF:15:F6:47:E7:F8:19:72:D8:
        2E:34:1A:A6:B4:A7:4C:7E:BD:BB:4F:0C:3D:57:F1:30:
        D6:A6:36:8E:D6:80:76:D7:19:2E:A5:CD:7E:34:2D:89: 0x010001
    - X509v3 extensions
      - basicConstraints
        true
        true: 0
      - certificatePolicies
        2.16.840.1.113733.1.7.23.3
        #0
        id-qt-cps: https://www.verisign.com/cps
        id-qt-unotice: https://www.verisign.com/rpa
      - keyUsage: true, 6
      - 1.3.6.1.5.5.7.1.12
        image/gif
        SHA1:
        8f e5 d3 1a 86 ac 8d 8e 6b c3 cf 80 6a d4 48 18 |........k...j.H.| 2c 7b 19 2e |,{.. |
        http://logo.verisign.com/vslogo.gif
      - crlDistributionPoints: http://crl.verisign.com/pca3-g5.crl
      - authorityInfoAccess
        OCSP: http://ocsp.verisign.com
      - extendedKeyUsage
        clientAuth: codeSigning
      - subjectAltName
        CN: VeriSignMPKI-2-8
      - subjectKeyIdentifier:
        cf 99 a9 ea 7b 26 f4 4b c9 8e 8f d7 f0 05 26 ef |....{&.K......&.| e3 d2 a7 9d |.... |
      - authorityKeyIdentifier:
        7f d3 65 a7 c2 dd ec bb f0 30 09 f3 43 39 fa 02 |..e......0..C9..| af 33 31 33 |.313 |
  - RSA-SHA1:
```
56 22 e6 34 a4 c4 61 cb  48 b9 01 ad 56 a8 64 0f  |V".4..a.H...V.d.|
d9 8c 91 c4 bb cc 0c e5  ad 7a a0 22 7f df 47 38  |.........z."..G8|
4a 2d 6c d1 7f 71 1a 7c  ec 70 a9 b1 f0 4f e4 0f  |J-l..q.|.p...O..|
0c 53 fa 15 5e fe 74 98  49 24 85 81 26 1c 91 14  |.S..^.t.I$..&...|
47 b0 4c 63 8c bb a1 34  d4 c6 45 e8 0d 85 26 73  |G.Lc...4..E...&s|
03 d0 a9 8c 64 6d dc 71  92 e6 45 05 60 15 59 51  |....dm.q..E.`.YQ|
39 fc 58 14 6b fe d4 a4  ed 79 6b 08 0c 41 72 e7  |9.X.k....yk..Ar.|
37 22 06 09 be 23 e9 3f  44 9a 1e e9 61 9d cc b1  |7"...#.?D...a...|
90 5c fc 3d d2 8d ac 42  3d 65 36 d4 b4 3d 40 28  |.\.=...B=e6..=@(|
8f 9b 10 cf 23 26 cc 4b  20 cb 90 1f 5d 8c 4c 34  |....#&.K ...].L4|
ca 3c d8 e5 37 d6 6f a5  20 bd 34 eb 26 d9 ae 0d  |.<..7.o. .4.&...|
e7 c5 9a f7 a1 b4 21 91  33 6f 86 e8 58 bb 25 7c  |......!.3o..X.%||
74 0e 58 fe 75 1b 63 3f  ce 31 7c 9b 8f 1b 96 9e  |t.X.u.c?.1|.....|
c5 53 76 84 5b 9c ad 91  fa ac ed 93 ba 5d c8 21  |.Sv.[........].!|
53 c2 82 53 63 af 12 0d  50 87 11 1b 3d 54 52 96  |S..Sc...P...=TR.|
8a 2c 9c 3d 92 1a 08 9a  05 2e c7 93 a5 48 91 d3  |.,.=.........H..|
```

Signer

1
unnamed
- #0
  - C: US
  - O: VeriSign, Inc.
  - OU: VeriSign Trust Network
  - OU: Terms of use at https://www.verisign.com/rpa (c)10
  - CN: VeriSign Class 3 Code Signing 2010 CA
- 65:0A:27:A0:4D:BA:A9:DF:0C:06:DE:BB:A3:98:30:54
SHA1: nil

contentType: 1.3.6.1.4.1.311.2.1.4
1.3.6.1.4.1.311.2.1.11: msCodeInd

messageDigest:

31 1f ac 45 f8 44 e8 ad  21 76 da f8 d1 4b 89 4d  |1..E.D..!v...K.M|
a5 50 dd 69                                       |.P.i            |

1.3.6.1.4.1.311.2.1.12:

04 1a 04 3e 04 3b 04 4b  04 31 04 35 04 3b 04 4c  |...>.;.K.1.5.;.L|
00 20 04 20 04 38 04 3c  04 30                    |. . .8.<.0      |

rsaEncryption:

16 60 eb 19 19 06 1f ae  b3 8f 4f 6d bc 1f 5e a8  |.`........Om..^.|
3a 25 ee 93 76 5f 6e a9  ce 8d fc f0 14 c3 8d 7c  |:%..v_n........||
c7 f0 28 03 32 7e 77 13  5a 67 5f 13 0f 86 18 e0  |..(.2~w.Zg_.....|
ca 6b 39 c6 cd a6 0d fb  33 47 7b a7 65 16 df 97  |.k9.....3G{.e...|
d1 91 d9 f5 bb 78 d9 97  15 a3 48 0a 25 14 c7 bf  |.....x....H.%...|
10 b0 6c b2 c4 0c e1 c0  62 f0 44 4e 32 fd 01 0a  |..l.....b.DN2...|
a8 e8 be f6 2d de a4 05  b2 4a a4 1b 0a da 8d 2d  |....-....J.....-|
6c 16 12 e6 6f 40 99 e3  7b ba 0e bc a6 61 04 c8  |l...o@..{....a..|
01 7d aa fe da 38 11 3f  4c 2c ae 15 2c 58 fe b7  |.}...8.?L,..,X..|
4d 9d 5c 4a 60 aa 34 13  f8 6c 6b c4 fc dc 58 c5  |M.\J`.4..lk...X.|
46 19 c5 30 75 46 4a c2  d2 67 d1 af cf 6b c9 64  |F..0uFJ..g...k.d|
4e a2 b3 8a 3b 2a 97 41  80 a5 03 f8 07 c9 6c a3  |N...;*.A......l.|
dc 32 aa c7 41 c0 85 46  99 6b 6d 6f bf 5f ae 03  |.2..A..F.kmo._..|
73 54 eb a9 67 9e d6 3b  2e 98 0f 38 bf c7 48 ae  |sT..g..;...8..H.|
67 48 f5 03 14 b2 11 59  04 5c 00 a0 e4 7e a7 f9  |gH.....Y.\...~..|
a4 b2 34 67 81 dc b6 06  18 8d 24 f5 da 76 fc 02  |..4g......$..v..|

countersignature

unnamed
- #0
  - C: US
  - O: VeriSign, Inc.
  - CN: VeriSign Time Stamping Services CA
- 38:25:D7:FA:F8:61:AF:9E:F4:90:E7:26:B5:D6:5A:D5
SHA1: nil

contentType: pkcs7-data
signingTime: 2012-02-03 04:05:35 UTC

messageDigest:

06 20 db d8 f3 9a e4 38  b1 42 9e 2c 39 33 6a ce  |. .....8.B.,93j.|
95 9b a0 2c                                       |...,            |

rsaEncryption:

67 1f 16 89 fe ba 78 08  d3 fb 02 97 d2 1f a4 91  |g.....x.........|
df c2 96 65 34 02 c2 ce  82 9c 92 19 ba 5f 2e 40  |...e4........_.@|
68 f5 62 7a 16 cc a3 79  8a 36 61 2a d7 b5 21 33  |h.bz...y.6a*..!3|
55 2d b8 cc 7c 26 16 ca  20 3d fd c6 04 94 d2 f9  |U-..|&.. =......|
e3 e9 90 c7 7a b7 98 87  68 86 55 8c cc 99 17 e8  |....z...h.U.....|
8c c2 7c b9 a4 04 ae 93  df 97 a4 fa c3 be 53 89  |..|...........S.|
ee 8a 75 ec 17 9e f2 c8  b2 3c 43 e1 58 d9 34 5a  |..u......

show previews

offset	size	type	comment
0	1737216	EXE	01/27/2012 07:40:25	#
15c1	15	HTM		#
1a8200	6024	PKCS7	Authenticode Signature	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x1a1384

[?] can't find file_offset of VA 0x1a4130

[?] can't find file_offset of VA 0x1a4994

[?] can't find file_offset of VA 0x1a5038

[?] can't find file_offset of VA 0x1a56dc

[?] can't find file_offset of VA 0x1a64d4

[?] can't find file_offset of VA 0x1abc48

[?] can't find file_offset of VA 0x1ac2e8

[?] can't find file_offset of VA 0x1ac7d8

[?] can't find file_offset of VA 0x1ace78

[?] can't find file_offset of VA 0x1ad834

[?] can't find file_offset of VA 0x1ae1f8

[?] can't find file_offset of VA 0x1ae7a8

[?] can't find file_offset of VA 0x1b06cc

[?] can't find file_offset of VA 0x1b86f4

[?] can't find file_offset of VA 0x1c0110

[?] can't find file_offset of VA 0x1c6370

[?] can't find file_offset of VA 0x1d98fc

[?] can't find file_offset of VA 0x1e0ad8

[?] can't find file_offset of VA 0x1f12d8

[?] can't find file_offset of VA 0x1f17d0

[?] can't find file_offset of VA 0x1f19b8

[?] can't find file_offset of VA 0x200bc4

[?] can't find file_offset of VA 0x200fe0

[?] can't find file_offset of VA 0x201398

[?] can't find file_offset of VA 0x201968

[?] can't find file_offset of VA 0x202074

[?] can't find file_offset of VA 0x20529c

[?] can't find file_offset of VA 0x205800

[?] can't find file_offset of VA 0x205d50

[?] can't find file_offset of VA 0x205d7c

[?] can't find file_offset of VA 0x205f9c

[?] can't find file_offset of VA 0x207884

[?] can't find file_offset of VA 0x209588

[?] can't find file_offset of VA 0x209bac

[?] can't find file_offset of VA 0x2126dc

[?] can't find file_offset of VA 0x2182e8

[?] can't find file_offset of VA 0x21d3f8

[?] can't find file_offset of VA 0x22318c

[?] can't find file_offset of VA 0x2291c4

[?] can't find file_offset of VA 0x234a94

[?] can't find file_offset of VA 0x23c618

[?] can't find file_offset of VA 0x2425cc

[?] can't find file_offset of VA 0x247b6c

[?] can't find file_offset of VA 0x24c308

[?] can't find file_offset of VA 0x252278

[?] can't find file_offset of VA 0x257dc0

[?] can't find file_offset of VA 0x25da88

[?] can't find file_offset of VA 0x260484

[?] can't find file_offset of VA 0x266c84

[?] can't find file_offset of VA 0x26bb90

[?] can't find file_offset of VA 0x271c28

[?] can't find file_offset of VA 0x278278

[?] can't find file_offset of VA 0x27f5b0

[?] can't find file_offset of VA 0x2855bc

[?] can't find file_offset of VA 0x289e24

[?] can't find file_offset of VA 0x28e618

[?] can't find file_offset of VA 0x295a68

[?] can't find file_offset of VA 0x29b7bc

[?] can't find file_offset of VA 0x2a16ac

[?] can't find file_offset of VA 0x2a74f0

[?] can't find file_offset of VA 0x2ad45c

[?] can't find file_offset of VA 0x2b7a7c

[?] can't find file_offset of VA 0x2bd61c

[?] can't find file_offset of VA 0x2c310c

[?] can't find file_offset of VA 0x2c8d78

[?] can't find file_offset of VA 0x2cebbc

[?] can't find file_offset of VA 0x2d78c0

[?] can't find file_offset of VA 0x2dc760

[?] can't find file_offset of VA 0x2e2a78

[?] can't find file_offset of VA 0x2e2aec

[?] can't find file_offset of VA 0x2e346c

[?] can't find file_offset of VA 0x2e4d74

[?] can't find file_offset of VA 0x2e6f1c

[?] can't find file_offset of VA 0x2ece80

[?] can't find file_offset of VA 0x2ed6d0

[?] can't find file_offset of VA 0x2edcf0

[?] can't find file_offset of VA 0x2ee3ac

[?] can't find file_offset of VA 0x2eec28

[?] can't find file_offset of VA 0x2ef498

[?] can't find file_offset of VA 0x2f0408

[?] can't find file_offset of VA 0x2f08c4

[?] can't find file_offset of VA 0x2f12c0

[?] can't find file_offset of VA 0x2f8878

[?] can't find file_offset of VA 0x2f9228

[?] can't find file_offset of VA 0x2f947c

[?] can't find file_offset of VA 0x2f9960

[?] can't find file_offset of VA 0x2fa138

[?] can't find file_offset of VA 0x2fa434

[?] can't find file_offset of VA 0x2faaa0

[?] can't find file_offset of VA 0x2faf38

[?] can't find file_offset of VA 0x2fb174

[?] can't find file_offset of VA 0x2fb3bc

[?] can't find file_offset of VA 0x2fb574

[?] can't find file_offset of VA 0x2fb6d0

[?] can't find file_offset of VA 0x2fbca8

[?] can't find file_offset of VA 0x2fbf2c

[?] can't find file_offset of VA 0x2fc0c8

[?] can't find file_offset of VA 0x2fc6e0

[?] can't find file_offset of VA 0x2fd074

[?] can't find file_offset of VA 0x2fd30c

[?] too many errors getting resource data, stopped on 0 of 1

[?] can't find file_offset of VA 0x0