33b56221061be2da59e7c9bb6a3a8898x000_count1 (1).dat - sdccoinstaller.dll

info
MZ
PE
resources
imports
exports
foremost
version info
signature
hexdump
disasm
log
discuss
donate

filename	33b56221061be2da59e7c9bb6a3a8898x000_count1 (1).dat
size	183024 (0x2caf0)
md5	33b56221061be2da59e7c9bb6a3a8898

type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

Rich Header

lib id	version	times used
125	50727	8
109	50727	110
110	50727	56
123	50727	15
1	0	127
114	50727	5
122	50727	1
124	50727	1
120	50727	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	6
TimeDateStamp	0x4c088612
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x2022
Magic	0x20b
LinkerVersion	8.0
SizeOfCode	0x1dc00
SizeOfInitializedData	0xd600
SizeOfUninitializedData	0
AddressOfEntryPoint	0x9df0
BaseOfCode	0x1000
ImageBase	0x56e60000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	5.2
Reserved1	0
SizeOfImage	0x31000
SizeOfHeaders	0x400
CheckSum	0x3cadd
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1dbca	0x1dc00	R-X CODE
.rdata	0x1f000	0x8a18	0x8c00	R-- IDATA
.data	0x28000	0x3c50	0x1c00	RW- IDATA
.pdata	0x2c000	0x21a8	0x2200	R-- IDATA
.rsrc	0x2f000	0x420	0x600	R-- IDATA
.reloc	0x30000	0x55a	0x600	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x279c0	0x58
IMPORT	0x26ca8	0xa0
RESOURCE	0x2f000	0x420
EXCEPTION	0x2c000	0x21a8
SECURITY	0x2b600	0x14f0
BASERELOC	0x30000	0x270
DEBUG	0x1f470	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x1f000	0x3c8
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
VERSION	#1	808	1252
MANIFEST	#2	86	1252

module_name	hint	ord	function_name
SETUPAPI.dll	82		CM_Get_DevNode_Status
SETUPAPI.dll	427		SetupDiSetDeviceInstallParamsW
SETUPAPI.dll	359		SetupDiGetDeviceInstallParamsW
SETUPAPI.dll	361		SetupDiGetDeviceInstanceIdW
SETUPAPI.dll	290		SetupDiCallClassInstaller
SETUPAPI.dll	421		SetupDiSetClassInstallParamsW
SETUPAPI.dll	432		SetupDiSetDeviceRegistryPropertyW
SETUPAPI.dll	370		SetupDiGetDeviceRegistryPropertyW
SETUPAPI.dll	346		SetupDiGetClassInstallParamsW
KERNEL32.dll	487		GetLastError
KERNEL32.dll	1223		lstrlenA
KERNEL32.dll	793		MultiByteToWideChar
KERNEL32.dll	1070		SizeofResource
KERNEL32.dll	774		LockResource
KERNEL32.dll	757		LoadResource
KERNEL32.dll	314		FindResourceExW
KERNEL32.dll	129		CreateFileW
KERNEL32.dll	428		GetCurrentProcessId
KERNEL32.dll	1004		SetFilePointer
KERNEL32.dll	1179		WriteFile
KERNEL32.dll	68		CloseHandle
KERNEL32.dll	315		FindResourceW
KERNEL32.dll	618		GetTickCount
KERNEL32.dll	1071		Sleep
KERNEL32.dll	678		HeapFree
KERNEL32.dll	550		GetProcessHeap
KERNEL32.dll	752		LoadLibraryA
KERNEL32.dll	389		GetConsoleCP
KERNEL32.dll	407		GetConsoleMode
KERNEL32.dll	826		OutputDebugStringW
KERNEL32.dll	321		FlsSetValue
KERNEL32.dll	989		SetEnvironmentVariableA
KERNEL32.dll	86		CompareStringW
KERNEL32.dll	83		CompareStringA
KERNEL32.dll	323		FlushFileBuffers
KERNEL32.dll	122		CreateFileA
KERNEL32.dll	1178		WriteConsoleW
KERNEL32.dll	411		GetConsoleOutputCP
KERNEL32.dll	1168		WriteConsoleA
KERNEL32.dll	579		GetStringTypeW
KERNEL32.dll	576		GetStringTypeA
KERNEL32.dll	738		LCMapStringW
KERNEL32.dll	340		GetACP
KERNEL32.dll	489		GetLocaleInfoA
KERNEL32.dll	611		GetThreadLocale
KERNEL32.dll	634		GetVersionExA
KERNEL32.dll	858		RaiseException
KERNEL32.dll	219		EnterCriticalSection
KERNEL32.dll	750		LeaveCriticalSection
KERNEL32.dll	697		InitializeCriticalSection
KERNEL32.dll	192		DeleteCriticalSection
KERNEL32.dll	677		HeapDestroy
KERNEL32.dll	674		HeapAlloc
KERNEL32.dll	681		HeapReAlloc
KERNEL32.dll	683		HeapSize
KERNEL32.dll	595		GetSystemTimeAsFileTime
KERNEL32.dll	431		GetCurrentThreadId
KERNEL32.dll	736		LCMapStringA
KERNEL32.dll	369		GetCommandLineA
KERNEL32.dll	922		RtlPcToFileHeader
KERNEL32.dll	926		RtlUnwindEx
KERNEL32.dll	920		RtlLookupFunctionEntry
KERNEL32.dll	349		GetCPInfo
KERNEL32.dll	532		GetOEMCP
KERNEL32.dll	730		IsValidCodePage
KERNEL32.dll	503		GetModuleHandleA
KERNEL32.dll	546		GetProcAddress
KERNEL32.dll	320		FlsGetValue
KERNEL32.dll	1089		TlsFree
KERNEL32.dll	319		FlsFree
KERNEL32.dll	1016		SetLastError
KERNEL32.dll	1091		TlsSetValue
KERNEL32.dll	318		FlsAlloc
KERNEL32.dll	1083		TerminateProcess
KERNEL32.dll	427		GetCurrentProcess
KERNEL32.dll	1100		UnhandledExceptionFilter
KERNEL32.dll	1059		SetUnhandledExceptionFilter
KERNEL32.dll	720		IsDebuggerPresent
KERNEL32.dll	913		RtlCaptureContext
KERNEL32.dll	682		HeapSetInformation
KERNEL32.dll	676		HeapCreate
KERNEL32.dll	927		RtlVirtualUnwind
KERNEL32.dll	262		ExitProcess
KERNEL32.dll	1160		WideCharToMultiByte
KERNEL32.dll	623		GetTimeZoneInformation
KERNEL32.dll	1012		SetHandleCount
KERNEL32.dll	574		GetStdHandle
KERNEL32.dll	473		GetFileType
KERNEL32.dll	572		GetStartupInfoA
KERNEL32.dll	501		GetModuleFileNameA
KERNEL32.dll	332		FreeEnvironmentStringsA
KERNEL32.dll	449		GetEnvironmentStrings
KERNEL32.dll	333		FreeEnvironmentStringsW
KERNEL32.dll	451		GetEnvironmentStringsW
KERNEL32.dll	851		QueryPerformanceCounter
KERNEL32.dll	1034		SetStdHandle
ADVAPI32.dll	547		QueryServiceStatusEx
ADVAPI32.dll	83		CloseServiceHandle
ADVAPI32.dll	501		OpenServiceW
ADVAPI32.dll	603		RegOpenKeyExW
ADVAPI32.dll	554		RegCloseKey
ADVAPI32.dll	616		RegQueryValueExW
ADVAPI32.dll	499		OpenSCManagerW
SHELL32.dll	192		SHGetFolderPathW
ole32.dll	66		CoInitializeEx
ole32.dll	102		CoSetProxyBlanket
ole32.dll	20		CoCreateInstance
ole32.dll	111		CoUninitialize
ole32.dll	82		CoQueryProxyBlanket
OLEAUT32.dll		184
OLEAUT32.dll		185
OLEAUT32.dll		6
OLEAUT32.dll		2
USER32.dll	742		UnregisterClassA

ord	entry_va	function_name
1	0x3f30	CoDeviceInstall

module_name	sdccoinstallerx64.dll
flags	0
timestamp	2010-06-04 04:50:25
version	0.0
ordinal_base	1
nFunctions	1
nNames	1
Names(1)	0x279ec
Functions(1)	0x279e8
NameOrdinals(1)	0x279f0

StringTable 040904b0

CompanyName	Sophos Plc
FileDescription	Sophos Co-installer
FileVersion	9.5.0.9530
InternalName	sdccoinstaller.dll
LegalCopyright	© 1989-2010 Sophos Plc, www.sophos.com
OriginalFilename	sdccoinstaller.dll
ProductName	Sophos Anti-Virus
ProductVersion	9.5.0

VS_FIXEDFILEINFO

FileVersion	9.5.0.9530
ProductVersion	9.5.0.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	2
FileSubtype	0

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)04/CN=VeriSign Class 3 Code Signing 2004 CA

serial: 4235340FB5E0B7687426E38DD42C56CB

Certificates (4)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
        Validity
            Not Before: Jun 15 00:00:00 2007 GMT
            Not After : Jun 14 23:59:59 2012 GMT
        Subject: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    00:c4:b5:f2:52:15:bc:88:86:60:29:16:4a:5b:2f:
                    4b:91:6b:87:91:f3:35:54:58:35:ea:d1:36:5e:62:
                    4d:52:51:34:71:c2:7b:66:1d:89:c8:dd:2a:c4:6a:
                    0a:f6:37:d9:98:74:91:f6:92:ae:b0:b5:76:96:f1:
                    a9:4a:63:45:47:2e:6b:0b:92:4e:4b:2b:8c:ee:58:
                    4a:8b:d4:07:e4:1a:2c:f8:82:aa:58:d9:cd:42:f3:
                    2d:c0:75:de:8d:ab:c7:8e:1d:9a:6c:4c:08:95:1e:
                    de:db:ef:67:e1:72:c2:49:c2:9e:60:3c:e1:e2:be:
                    16:a3:63:78:69:14:7b:ad:2d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com

            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.verisign.com/tss-ca.crl

            X509v3 Extended Key Usage: critical
                Time Stamping
            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation
            X509v3 Subject Alternative Name: 
                DirName:/CN=TSA1-2
    Signature Algorithm: sha1WithRSAEncryption
         50:c5:4b:c8:24:80:df:e4:0d:24:c2:de:1a:b1:a1:02:a1:a6:
         82:2d:0c:83:15:81:37:0a:82:0e:2c:b0:5a:17:61:b5:d8:05:
         fe:88:db:f1:91:91:b3:56:1a:40:a6:eb:92:be:38:39:b0:75:
         36:74:3a:98:4f:e4:37:ba:99:89:ca:95:42:1d:b0:b9:c7:a0:
         8d:57:e0:fa:d5:64:04:42:35:4e:01:d1:33:a2:17:c8:4d:aa:
         27:c7:f2:e1:86:4c:02:38:4d:83:78:c6:fc:53:e0:eb:e0:06:
         87:dd:a4:96:9e:5e:0c:98:e2:a5:be:bf:82:85:c3:60:e1:df:
         ad:28:d8:c7:a5:4b:64:da:c7:1b:5b:bd:ac:39:08:d5:38:22:
         a1:33:8b:2f:8a:9a:eb:bc:07:21:3f:44:41:09:07:b5:65:1c:
         24:bc:48:d3:44:80:eb:a1:cf:c9:02:b4:14:cf:54:c7:16:a3:
         80:5c:f9:79:3e:5d:72:7d:88:17:9e:2c:43:a2:ca:53:ce:7d:
         3d:f6:2a:3a:b8:4f:94:00:a5:6d:0a:83:5d:f9:5e:53:f4:18:
         b3:57:0f:70:c3:fb:f5:ad:95:a0:0e:17:de:c4:16:80:60:c9:
         0f:2b:6e:86:04:f1:eb:f4:78:27:d1:05:c5:ee:34:5b:5e:b9:
         49:32:f2:33

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
        Validity
            Not Before: Dec  4 00:00:00 2003 GMT
            Not After : Dec  3 23:59:59 2013 GMT
        Subject: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:a9:ca:b2:a4:cc:cd:20:af:0a:7d:89:ac:87:75:
                    f0:b4:4e:f1:df:c1:0f:bf:67:61:bd:a3:64:1c:da:
                    bb:f9:ca:33:ab:84:30:89:58:7e:8c:db:6b:dd:36:
                    9e:0f:bf:d1:ec:78:f2:77:a6:7e:6f:3c:bf:93:af:
                    0d:ba:68:f4:6c:94:ca:bd:52:2d:ab:48:3d:f5:b6:
                    d5:5d:5f:1b:02:9f:fa:2f:6b:1e:a4:f7:a3:9a:a6:
                    1a:c8:02:e1:7f:4c:52:e3:0e:60:ec:40:1c:7e:b9:
                    0d:de:3f:c7:b4:df:87:bd:5f:7a:6a:31:2e:03:99:
                    81:13:a8:47:20:ce:31:73:0d:57:2d:cd:78:34:33:
                    95:12:99:12:b9:de:68:2f:aa:e6:e3:c2:8a:8c:2a:
                    c3:8b:21:87:66:bd:83:58:57:6f:75:bf:3c:aa:26:
                    87:5d:ca:10:15:3c:9f:84:ea:54:c1:0a:6e:c4:fe:
                    c5:4a:dd:b9:07:11:97:22:7c:db:3e:27:d1:1e:78:
                    ec:9f:31:c9:f1:e6:22:19:db:c4:b3:47:43:9a:1a:
                    5f:a0:1e:90:e4:5e:f5:ee:7c:f1:7d:ab:62:01:8f:
                    f5:4d:0b:de:d0:22:56:a8:95:cd:ae:88:76:ae:ee:
                    ba:0d:f3:e4:4d:d9:a0:fb:68:a0:ae:14:3b:b3:87:
                    c1:bb
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com

            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.verisign.com/ThawteTimestampingCA.crl

            X509v3 Extended Key Usage: 
                Time Stamping
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name: 
                DirName:/CN=TSA2048-1-53
    Signature Algorithm: sha1WithRSAEncryption
         4a:6b:f9:ea:58:c2:44:1c:31:89:79:99:2b:96:bf:82:ac:01:
         d6:1c:4c:cd:b0:8a:58:6e:df:08:29:a3:5e:c8:ca:93:13:e7:
         04:52:0d:ef:47:27:2f:00:38:b0:e4:c9:93:4e:9a:d4:22:62:
         15:f7:3f:37:21:4f:70:31:80:f1:8b:38:87:b3:e8:e8:97:00:
         fe:cf:55:96:4e:24:d2:a9:27:4e:7a:ae:b7:61:41:f3:2a:ce:
         e7:c9:d9:5e:dd:bb:2b:85:3e:b5:9d:b5:d9:e1:57:ff:be:b4:
         c5:7e:f5:cf:0c:9e:f0:97:fe:2b:d3:3b:52:1b:1b:38:27:f7:
         3f:4a

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
        Validity
            Not Before: Jul 16 00:00:00 2004 GMT
            Not After : Jul 15 23:59:59 2014 GMT
        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:be:bc:ee:bc:7e:ef:83:eb:e0:37:4f:fb:03:10:
                    38:be:08:d2:8c:7d:9d:fa:92:7f:19:0c:c2:6b:ee:
                    42:52:8c:de:d3:1c:48:13:25:ea:c1:63:7a:f9:51:
                    65:ee:d3:aa:3b:f5:f0:94:9c:2b:fb:f2:66:d4:24:
                    da:f7:f5:9f:6e:19:39:36:bc:d0:a3:76:08:1e:22:
                    27:24:6c:38:91:27:e2:84:49:ae:1b:8a:a1:fd:25:
                    82:2c:10:30:e8:71:ab:28:e8:77:4a:51:f1:ec:cd:
                    f8:f0:54:d4:6f:c0:e3:6d:0a:8f:d9:d8:64:8d:63:
                    b2:2d:4e:27:f6:85:0e:fe:6d:e3:29:99:e2:85:47:
                    7c:2d:86:7f:e8:57:8f:ad:67:c2:33:32:91:13:20:
                    fc:a9:23:14:9a:6d:c2:84:4b:76:68:04:d5:71:2c:
                    5d:21:fa:88:0d:26:fd:1f:2d:91:2b:e7:01:55:4d:
                    f2:6d:35:28:82:df:d9:6b:5c:b6:d6:d9:aa:81:fd:
                    5f:cd:83:ba:63:9d:d0:22:fc:a9:3b:42:69:b2:8e:
                    3a:b5:bc:b4:9e:0f:5e:c4:ea:2c:82:8b:28:fd:53:
                    08:96:dd:b5:01:20:d1:f9:a5:18:e7:c0:ee:51:70:
                    37:e1:b6:05:48:52:48:6f:38:ea:c3:e8:6c:7b:44:
                    84:bb
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/rpa

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.verisign.com/pca3.crl

            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, Code Signing
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            Netscape Cert Type: 
                Object Signing CA
            X509v3 Subject Alternative Name: 
                DirName:/CN=Class3CA2048-1-43
            X509v3 Subject Key Identifier: 
                08:F5:51:E8:FB:FE:3D:3D:64:36:7C:68:CF:5B:78:A8:DF:B9:C5:37
            X509v3 Authority Key Identifier: 
                DirName:/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
                serial:70:BA:E4:1D:10:D9:29:34:B6:38:CA:7B:03:CC:BA:BF

    Signature Algorithm: sha1WithRSAEncryption
         ae:3a:17:b8:4a:7b:55:fa:64:55:ec:40:a4:ed:49:41:90:99:
         9c:89:bc:af:2e:1d:ca:78:23:f9:1c:19:0f:7f:eb:68:bc:32:
         d9:88:38:de:dc:3f:d3:89:b4:3f:b1:82:96:f1:a4:5a:ba:ed:
         2e:26:d3:de:7c:01:6e:00:0a:00:a4:06:92:11:48:09:40:f9:
         1c:18:79:67:23:24:e0:bb:d5:e1:50:ae:1b:f5:0e:dd:e0:2e:
         81:cd:80:a3:6c:52:4f:91:75:55:8a:ba:22:f2:d2:ea:41:75:
         88:2f:63:55:7d:1e:54:5a:95:59:ca:d9:34:81:c0:5f:5e:f6:
         7a:b5

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            42:35:34:0f:b5:e0:b7:68:74:26:e3:8d:d4:2c:56:cb
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA
        Validity
            Not Before: Dec  2 00:00:00 2008 GMT
            Not After : Dec  2 23:59:59 2011 GMT
        Subject: C=GB, ST=Oxfordshire, L=Abingdon, O=Sophos Plc, OU=Digital ID Class 3 - Microsoft Software Validation v2, CN=Sophos Plc
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    00:8e:d6:b3:02:9f:41:46:89:65:8d:ce:a8:ee:8f:
                    4c:51:da:4d:53:a1:56:dd:5e:b5:13:d4:4c:c4:21:
                    31:e6:f2:ad:09:18:4d:74:cf:fe:35:ac:90:62:8f:
                    6a:2b:61:b7:0d:71:03:a0:54:33:e8:b5:ed:18:55:
                    b8:0d:d5:5d:f0:85:fd:73:30:20:12:68:71:63:6c:
                    46:0d:b0:46:16:9f:61:a4:cd:56:35:7b:33:4d:98:
                    6a:08:04:8e:8f:3e:de:57:8d:8d:56:c0:25:40:cf:
                    48:45:ea:7d:d5:b5:fe:55:b4:86:76:01:98:da:93:
                    45:c3:76:69:66:21:7d:c5:6d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://CSC3-2004-crl.verisign.com/CSC3-2004.crl

            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/rpa

            X509v3 Extended Key Usage: 
                Code Signing
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
                CA Issuers - URI:http://CSC3-2004-aia.verisign.com/CSC3-2004-aia.cer

            X509v3 Authority Key Identifier: 
                keyid:08:F5:51:E8:FB:FE:3D:3D:64:36:7C:68:CF:5B:78:A8:DF:B9:C5:37

            Netscape Cert Type: 
                Object Signing
            1.3.6.1.4.1.311.2.1.27: 
                0.......
    Signature Algorithm: sha1WithRSAEncryption
         24:6c:0a:44:77:5f:5a:b7:3a:c4:17:2b:df:51:f9:db:77:2a:
         70:e8:ee:a0:d8:ca:5e:17:12:ce:95:5c:ac:4a:98:4d:a8:1a:
         b2:b8:c7:62:2e:78:6f:49:c7:47:de:a3:79:95:91:bc:a8:9d:
         a0:ac:0b:03:a1:ef:6f:c4:18:c3:2f:55:1f:3c:26:27:ae:92:
         25:a2:40:46:0b:5e:17:7c:e4:93:83:0c:99:99:18:3f:a3:1a:
         30:eb:47:b5:83:c2:ca:df:a3:dc:ff:e0:7e:0b:2e:20:36:b7:
         54:d7:92:43:44:e3:86:8d:43:ce:a6:69:88:28:8f:b9:52:49:
         b5:83:0d:af:68:15:3e:d3:fc:fa:7f:ee:fe:e7:4e:47:a5:3d:
         ef:26:e7:ba:5b:f8:57:a9:9d:0d:ce:4d:05:d4:33:5a:3d:e0:
         49:aa:77:ec:5a:57:f5:8c:de:f7:d3:be:eb:9b:55:99:64:9f:
         bc:a7:93:fd:96:55:1b:2b:8c:10:0b:be:aa:01:a3:98:bb:75:
         c7:76:3f:ef:b8:e6:9d:25:07:b9:e9:25:23:1b:71:52:64:55:
         7b:be:df:9e:bd:6c:7e:9b:8e:4e:45:bb:7c:75:d3:3f:8c:69:
         06:99:0c:05:f4:2e:3b:3e:ca:52:b0:17:df:45:d0:a2:56:75:
         8a:11:af:1e

pkcs7-signedData

1
- SHA1: nil
- 1.3.6.1.4.1.311.2.1.4
  - #0
    - 1.3.6.1.4.1.311.2.1.15
      - :
        00 3c 00 3c 00 3c 00 4f 00 62 00 73 00 6f 00 6c |.<.<.<.O.b.s.o.l| 00 65 00 74 00 65 00 3e 00 3e 00 3e |.e.t.e.>.>.> |
    - SHA1
      - 30 89 87 53 06 8b 66 a1 c1 2a 60 bb ce fb d0 35 |0..S..f..*`....5| 1f 0f 5b 75 |..[u |
- Certificates
  - Certificate #0
    - 2
      - 38:25:D7:FA:F8:61:AF:9E:F4:90:E7:26:B5:D6:5A:D5
      - RSA-SHA1: nil
      - Issuer
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services CA
      - 2007-06-15 00:00:00 UTC: 2012-06-14 23:59:59 UTC
      - Subject
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services Signer - G2
      - #5
        rsaEncryption: nil
        C4:B5:F2:52:15:BC:88:86:60:29:16:4A:5B:2F:4B:91:
        6B:87:91:F3:35:54:58:35:EA:D1:36:5E:62:4D:52:51:
        34:71:C2:7B:66:1D:89:C8:DD:2A:C4:6A:0A:F6:37:D9:
        98:74:91:F6:92:AE:B0:B5:76:96:F1:A9:4A:63:45:47:
        2E:6B:0B:92:4E:4B:2B:8C:EE:58:4A:8B:D4:07:E4:1A:
        2C:F8:82:AA:58:D9:CD:42:F3:2D:C0:75:DE:8D:AB:C7:
        8E:1D:9A:6C:4C:08:95:1E:DE:DB:EF:67:E1:72:C2:49:
        C2:9E:60:3C:E1:E2:BE:16:A3:63:78:69:14:7B:AD:2D: 0x010001
      - X509v3 extensions
        authorityInfoAccess
        OCSP: http://ocsp.verisign.com
        basicConstraints
        true
        nil
        crlDistributionPoints: http://crl.verisign.com/tss-ca.crl
        extendedKeyUsage: true, timeStamping
        keyUsage: true, 0xc0
        subjectAltName
        CN: TSA1-2
    - RSA-SHA1:
```
50 c5 4b c8 24 80 df e4  0d 24 c2 de 1a b1 a1 02  |P.K.$....$......|
a1 a6 82 2d 0c 83 15 81  37 0a 82 0e 2c b0 5a 17  |...-....7...,.Z.|
61 b5 d8 05 fe 88 db f1  91 91 b3 56 1a 40 a6 eb  |a..........V.@..|
92 be 38 39 b0 75 36 74  3a 98 4f e4 37 ba 99 89  |..89.u6t:.O.7...|
ca 95 42 1d b0 b9 c7 a0  8d 57 e0 fa d5 64 04 42  |..B......W...d.B|
35 4e 01 d1 33 a2 17 c8  4d aa 27 c7 f2 e1 86 4c  |5N..3...M.'....L|
02 38 4d 83 78 c6 fc 53  e0 eb e0 06 87 dd a4 96  |.8M.x..S........|
9e 5e 0c 98 e2 a5 be bf  82 85 c3 60 e1 df ad 28  |.^.........`...(|
d8 c7 a5 4b 64 da c7 1b  5b bd ac 39 08 d5 38 22  |...Kd...[..9..8"|
a1 33 8b 2f 8a 9a eb bc  07 21 3f 44 41 09 07 b5  |.3./.....!?DA...|
65 1c 24 bc 48 d3 44 80  eb a1 cf c9 02 b4 14 cf  |e.$.H.D.........|
54 c7 16 a3 80 5c f9 79  3e 5d 72 7d 88 17 9e 2c  |T....\.y>]r}...,|
43 a2 ca 53 ce 7d 3d f6  2a 3a b8 4f 94 00 a5 6d  |C..S.}=.*:.O...m|
0a 83 5d f9 5e 53 f4 18  b3 57 0f 70 c3 fb f5 ad  |..].^S...W.p....|
95 a0 0e 17 de c4 16 80  60 c9 0f 2b 6e 86 04 f1  |........`..+n...|
eb f4 78 27 d1 05 c5 ee  34 5b 5e b9 49 32 f2 33  |..x'....4[^.I2.3|
```
  - Certificate #1
    - 2
      - 47:BF:19:95:DF:8D:52:46:43:F7:DB:6D:48:0D:31:A4
      - RSA-SHA1: nil
      - Issuer
        C: ZA
        ST: Western Cape
        L: Durbanville
        O: Thawte
        OU: Thawte Certification
        CN: Thawte Timestamping CA
      - 2003-12-04 00:00:00 UTC: 2013-12-03 23:59:59 UTC
      - Subject
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services CA
      - #5
        rsaEncryption: nil
        A9:CA:B2:A4:CC:CD:20:AF:0A:7D:89:AC:87:75:F0:B4:
        4E:F1:DF:C1:0F:BF:67:61:BD:A3:64:1C:DA:BB:F9:CA:
        33:AB:84:30:89:58:7E:8C:DB:6B:DD:36:9E:0F:BF:D1:
        EC:78:F2:77:A6:7E:6F:3C:BF:93:AF:0D:BA:68:F4:6C:
        94:CA:BD:52:2D:AB:48:3D:F5:B6:D5:5D:5F:1B:02:9F:
        FA:2F:6B:1E:A4:F7:A3:9A:A6:1A:C8:02:E1:7F:4C:52:
        E3:0E:60:EC:40:1C:7E:B9:0D:DE:3F:C7:B4:DF:87:BD:
        5F:7A:6A:31:2E:03:99:81:13:A8:47:20:CE:31:73:0D:
        57:2D:CD:78:34:33:95:12:99:12:B9:DE:68:2F:AA:E6:
        E3:C2:8A:8C:2A:C3:8B:21:87:66:BD:83:58:57:6F:75:
        BF:3C:AA:26:87:5D:CA:10:15:3C:9F:84:EA:54:C1:0A:
        6E:C4:FE:C5:4A:DD:B9:07:11:97:22:7C:DB:3E:27:D1:
        1E:78:EC:9F:31:C9:F1:E6:22:19:DB:C4:B3:47:43:9A:
        1A:5F:A0:1E:90:E4:5E:F5:EE:7C:F1:7D:AB:62:01:8F:
        F5:4D:0B:DE:D0:22:56:A8:95:CD:AE:88:76:AE:EE:BA:
        0D:F3:E4:4D:D9:A0:FB:68:A0:AE:14:3B:B3:87:C1:BB: 0x010001
      - X509v3 extensions
        authorityInfoAccess
        OCSP: http://ocsp.verisign.com
        basicConstraints
        true
        true: 0
        crlDistributionPoints: http://crl.verisign.com/ThawteTimestampingCA.crl
        extendedKeyUsage: timeStamping
        keyUsage: true, 6
        subjectAltName
        CN: TSA2048-1-53
    - RSA-SHA1:
```
4a 6b f9 ea 58 c2 44 1c  31 89 79 99 2b 96 bf 82  |Jk..X.D.1.y.+...|
ac 01 d6 1c 4c cd b0 8a  58 6e df 08 29 a3 5e c8  |....L...Xn..).^.|
ca 93 13 e7 04 52 0d ef  47 27 2f 00 38 b0 e4 c9  |.....R..G'/.8...|
93 4e 9a d4 22 62 15 f7  3f 37 21 4f 70 31 80 f1  |.N.."b..?7!Op1..|
8b 38 87 b3 e8 e8 97 00  fe cf 55 96 4e 24 d2 a9  |.8........U.N$..|
27 4e 7a ae b7 61 41 f3  2a ce e7 c9 d9 5e dd bb  |'Nz..aA.*....^..|
2b 85 3e b5 9d b5 d9 e1  57 ff be b4 c5 7e f5 cf  |+.>.....W....~..|
0c 9e f0 97 fe 2b d3 3b  52 1b 1b 38 27 f7 3f 4a  |.....+.;R..8'.?J|
```
  - Certificate #2
    - 2
      - 41:91:A1:5A:39:78:DF:CF:49:65:66:38:1D:4C:75:C2
      - RSA-SHA1: nil
      - Issuer
        C: US
        O: VeriSign, Inc.
        OU: Class 3 Public Primary Certification Authority
      - 2004-07-16 00:00:00 UTC: 2014-07-15 23:59:59 UTC
      - Subject
        C: US
        O: VeriSign, Inc.
        OU: VeriSign Trust Network
        OU: Terms of use at https://www.verisign.com/rpa (c)04
        CN: VeriSign Class 3 Code Signing 2004 CA
      - #5
        rsaEncryption: nil
        BE:BC:EE:BC:7E:EF:83:EB:E0:37:4F:FB:03:10:38:BE:
        08:D2:8C:7D:9D:FA:92:7F:19:0C:C2:6B:EE:42:52:8C:
        DE:D3:1C:48:13:25:EA:C1:63:7A:F9:51:65:EE:D3:AA:
        3B:F5:F0:94:9C:2B:FB:F2:66:D4:24:DA:F7:F5:9F:6E:
        19:39:36:BC:D0:A3:76:08:1E:22:27:24:6C:38:91:27:
        E2:84:49:AE:1B:8A:A1:FD:25:82:2C:10:30:E8:71:AB:
        28:E8:77:4A:51:F1:EC:CD:F8:F0:54:D4:6F:C0:E3:6D:
        0A:8F:D9:D8:64:8D:63:B2:2D:4E:27:F6:85:0E:FE:6D:
        E3:29:99:E2:85:47:7C:2D:86:7F:E8:57:8F:AD:67:C2:
        33:32:91:13:20:FC:A9:23:14:9A:6D:C2:84:4B:76:68:
        04:D5:71:2C:5D:21:FA:88:0D:26:FD:1F:2D:91:2B:E7:
        01:55:4D:F2:6D:35:28:82:DF:D9:6B:5C:B6:D6:D9:AA:
        81:FD:5F:CD:83:BA:63:9D:D0:22:FC:A9:3B:42:69:B2:
        8E:3A:B5:BC:B4:9E:0F:5E:C4:EA:2C:82:8B:28:FD:53:
        08:96:DD:B5:01:20:D1:F9:A5:18:E7:C0:EE:51:70:37:
        E1:B6:05:48:52:48:6F:38:EA:C3:E8:6C:7B:44:84:BB: 0x010001
      - X509v3 extensions
        basicConstraints
        true
        true: 0
        certificatePolicies
        2.16.840.1.113733.1.7.23.3
        id-qt-cps: https://www.verisign.com/rpa
        crlDistributionPoints: http://crl.verisign.com/pca3.crl
        extendedKeyUsage
        clientAuth: codeSigning
        keyUsage: true, 6
        nsCertType: 1
        subjectAltName
        CN: Class3CA2048-1-43
        subjectKeyIdentifier:
        08 f5 51 e8 fb fe 3d 3d 64 36 7c 68 cf 5b 78 a8 |..Q...==d6|h.[x.| df b9 c5 37 |...7 |
        authorityKeyIdentifier
        unnamed
        #0
        C: US
        O: VeriSign, Inc.
        OU: Class 3 Public Primary Certification Authority
        70 ba e4 1d 10 d9 29 34 b6 38 ca 7b 03 cc ba bf |p.....)4.8.{....|
    - RSA-SHA1:
```
ae 3a 17 b8 4a 7b 55 fa  64 55 ec 40 a4 ed 49 41  |.:..J{U.dU.@..IA|
90 99 9c 89 bc af 2e 1d  ca 78 23 f9 1c 19 0f 7f  |.........x#.....|
eb 68 bc 32 d9 88 38 de  dc 3f d3 89 b4 3f b1 82  |.h.2..8..?...?..|
96 f1 a4 5a ba ed 2e 26  d3 de 7c 01 6e 00 0a 00  |...Z...&..|.n...|
a4 06 92 11 48 09 40 f9  1c 18 79 67 23 24 e0 bb  |....H.@...yg#$..|
d5 e1 50 ae 1b f5 0e dd  e0 2e 81 cd 80 a3 6c 52  |..P...........lR|
4f 91 75 55 8a ba 22 f2  d2 ea 41 75 88 2f 63 55  |O.uU.."...Au./cU|
7d 1e 54 5a 95 59 ca d9  34 81 c0 5f 5e f6 7a b5  |}.TZ.Y..4.._^.z.|
```
  - Certificate #3
    - 2
      - 42:35:34:0F:B5:E0:B7:68:74:26:E3:8D:D4:2C:56:CB
      - RSA-SHA1: nil
      - Issuer
        C: US
        O: VeriSign, Inc.
        OU: VeriSign Trust Network
        OU: Terms of use at https://www.verisign.com/rpa (c)04
        CN: VeriSign Class 3 Code Signing 2004 CA
      - 2008-12-02 00:00:00 UTC: 2011-12-02 23:59:59 UTC
      - Subject
        C: GB
        ST: Oxfordshire
        L: Abingdon
        O: Sophos Plc
        OU: Digital ID Class 3 - Microsoft Software Validation v2
        CN: Sophos Plc
      - #5
        rsaEncryption: nil
        8E:D6:B3:02:9F:41:46:89:65:8D:CE:A8:EE:8F:4C:51:
        DA:4D:53:A1:56:DD:5E:B5:13:D4:4C:C4:21:31:E6:F2:
        AD:09:18:4D:74:CF:FE:35:AC:90:62:8F:6A:2B:61:B7:
        0D:71:03:A0:54:33:E8:B5:ED:18:55:B8:0D:D5:5D:F0:
        85:FD:73:30:20:12:68:71:63:6C:46:0D:B0:46:16:9F:
        61:A4:CD:56:35:7B:33:4D:98:6A:08:04:8E:8F:3E:DE:
        57:8D:8D:56:C0:25:40:CF:48:45:EA:7D:D5:B5:FE:55:
        B4:86:76:01:98:DA:93:45:C3:76:69:66:21:7D:C5:6D: 0x010001
      - X509v3 extensions
        basicConstraints
        nil
        keyUsage: true, 0x80
        crlDistributionPoints: http://CSC3-2004-crl.verisign.com/CSC3-2004.crl
        certificatePolicies
        2.16.840.1.113733.1.7.23.3
        id-qt-cps: https://www.verisign.com/rpa
        extendedKeyUsage: codeSigning
        authorityInfoAccess
        #0
        OCSP: http://ocsp.verisign.com
        caIssuers: http://CSC3-2004-aia.verisign.com/CSC3-2004-aia.cer
        authorityKeyIdentifier:
        08 f5 51 e8 fb fe 3d 3d 64 36 7c 68 cf 5b 78 a8 |..Q...==d6|h.[x.| df b9 c5 37 |...7 |
        nsCertType: 0x10
        1.3.6.1.4.1.311.2.1.27
        false: true
    - RSA-SHA1:
```
24 6c 0a 44 77 5f 5a b7  3a c4 17 2b df 51 f9 db  |$l.Dw_Z.:..+.Q..|
77 2a 70 e8 ee a0 d8 ca  5e 17 12 ce 95 5c ac 4a  |w*p.....^....\.J|
98 4d a8 1a b2 b8 c7 62  2e 78 6f 49 c7 47 de a3  |.M.....b.xoI.G..|
79 95 91 bc a8 9d a0 ac  0b 03 a1 ef 6f c4 18 c3  |y...........o...|
2f 55 1f 3c 26 27 ae 92  25 a2 40 46 0b 5e 17 7c  |/U.<&'..%.@F.^.||
e4 93 83 0c 99 99 18 3f  a3 1a 30 eb 47 b5 83 c2  |.......?..0.G...|
ca df a3 dc ff e0 7e 0b  2e 20 36 b7 54 d7 92 43  |......~.. 6.T..C|
44 e3 86 8d 43 ce a6 69  88 28 8f b9 52 49 b5 83  |D...C..i.(..RI..|
0d af 68 15 3e d3 fc fa  7f ee fe e7 4e 47 a5 3d  |..h.>.......NG.=|
ef 26 e7 ba 5b f8 57 a9  9d 0d ce 4d 05 d4 33 5a  |.&..[.W....M..3Z|
3d e0 49 aa 77 ec 5a 57  f5 8c de f7 d3 be eb 9b  |=.I.w.ZW........|
55 99 64 9f bc a7 93 fd  96 55 1b 2b 8c 10 0b be  |U.d......U.+....|
aa 01 a3 98 bb 75 c7 76  3f ef b8 e6 9d 25 07 b9  |.....u.v?....%..|
e9 25 23 1b 71 52 64 55  7b be df 9e bd 6c 7e 9b  |.%#.qRdU{....l~.|
8e 4e 45 bb 7c 75 d3 3f  8c 69 06 99 0c 05 f4 2e  |.NE.|u.?.i......|
3b 3e ca 52 b0 17 df 45  d0 a2 56 75 8a 11 af 1e  |;>.R...E..Vu....|
```
- Signer
  - 1
  - unnamed
    - #0
      - C: US
      - O: VeriSign, Inc.
      - OU: VeriSign Trust Network
      - OU: Terms of use at https://www.verisign.com/rpa (c)04
      - CN: VeriSign Class 3 Code Signing 2004 CA
    - 42:35:34:0F:B5:E0:B7:68:74:26:E3:8D:D4:2C:56:CB
  - SHA1: nil
  - #3
    - 1.3.6.1.4.1.311.2.1.12
      - nil
    - contentType: 1.3.6.1.4.1.311.2.1.4
    - 1.3.6.1.4.1.311.2.1.11: msCodeInd
    - messageDigest:
```
71 ad 6e b4 22 8e b8 a3  73 1c fd 16 61 2e 20 4f  |q.n."...s...a. O|
62 31 36 ba                                       |b16.            |
```
  - rsaEncryption:
```
2b 50 06 b0 ea cd f7 a8  5c 4a 29 83 47 75 b2 d0  |+P......\J).Gu..|
e3 93 5d 5f 77 c5 91 65  9f 72 2d d5 02 6c 85 fb  |..]_w..e.r-..l..|
6d 3c 8f 91 0c f0 17 56  19 eb d3 de 02 c8 fb 33  |m<.....V.......3|
cd f2 8b a6 bb 05 f8 d2  6c cb 57 63 84 11 86 8e  |........l.Wc....|
a4 f7 84 a7 26 4e 6b ea  45 88 de bb 7e 6d 4d 7d  |....&Nk.E...~mM}|
94 3b 81 33 d1 6a ef 8e  4b de 4b 2f d5 0d af 2d  |.;.3.j..K.K/...-|
9c c8 c0 e9 ff 75 aa 40  e6 ac a5 7c 9d 5c ce 86  |.....u.@...|.\..|
11 10 7c f8 24 69 49 39  ab 8a 0c 0c bf 66 1d e5  |..|.$iI9.....f..|
```
  - countersignature
    - 1
      - unnamed
        #0
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services CA
        38:25:D7:FA:F8:61:AF:9E:F4:90:E7:26:B5:D6:5A:D5
      - SHA1: nil
      - #2
        contentType: pkcs7-data
        signingTime: 2010-06-04 05:05:10 UTC
        messageDigest:
        ce b2 78 13 c3 86 4b 5f 50 84 52 1a 9e 5f d1 82 |..x...K_P.R.._..| fe 54 01 80 |.T.. |
      - rsaEncryption:
        1b c9 1c f3 c8 09 6e 93 7d e7 97 60 76 70 d7 f5 |......n.}..`vp..| 16 b5 0d 4b 26 4c 8c 69 59 58 c8 48 74 8f 72 e0 |...K&L.iYX.Ht.r.| fe 4a 46 59 58 a9 c2 66 ba fa e2 1f 65 85 3a f8 |.JFYX..f....e.:.| ba 2a 2a 3d 81 bf ad d9 24 ca 9c e8 4e c3 b6 96 |.**=....$...N...| 22 79 a3 e9 1f 87 5b fd f9 56 bc fd 68 76 ba 10 |"y....[..V..hv..| 47 92 31 f2 94 7b c1 fb 86 cd d1 de 7a 7e 97 07 |G.1..{......z~..| aa ba 0b 66 58 d1 73 59 b7 c2 0a 51 69 41 1c 24 |...fX.sY...QiA.$| a6 7a 87 a5 17 01 5d 78 14 9e 7d 0f 6d a9 c0 85 |.z....]x..}.m...|

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	177440	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

33b56221061be2da59e7c9bb6a3a8898x000_count1 (1).dat- sdccoinstaller.dll - Sophos Co-installer

MZ Header

Rich Header

DOS stub

PE Header

Sections

Data Directory

StringTable 040904b0

VS_FIXEDFILEINFO

Signers (1)

Certificates (4)

33b56221061be2da59e7c9bb6a3a8898x000_count1 (1).dat
- sdccoinstaller.dll - Sophos Co-installer