hafmal (11) - sfxhead.exe - Total Commander Auto-Installer

info
MZ
PE
resources
imports
foremost
7zip
version info
signature
hexdump
disasm
log
discuss
donate

filename	hafmal (11)
size	4329488 (0x421010)
md5	0b644ebe34259c653f7ca3c340af4da9

type	PE32+ executable (GUI) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	6
TimeDateStamp	0
PointerToSymbolTable	0x44810
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x2f
Magic	0x20b
LinkerVersion	2.44
SizeOfCode	0x38800
SizeOfInitializedData	0x8698
SizeOfUninitializedData	0x5220
AddressOfEntryPoint	0x12df0
BaseOfCode	0x1000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	1.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x4e000
SizeOfHeaders	0x400
CheckSum	0x421ba6
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x1000000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x38800	0x38800	R-X CODE
.data	0x3a000	0x8698	0x8698	RW- IDATA
.bss	0x43000	0x5220	0	RW- UDATA
.idata	0x49000	0x15b4	0x15b4	RW- IDATA
.rsrc	0x4b000	0x1d70	0x1d70	RW- IDATA
/4	0x4d000	0x10	0x10	--- DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x49000	0x15b4
RESOURCE	0x4b000	0x1d70
EXCEPTION	0	0
SECURITY	0x41f9b0	0x1660
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
ICON	#1	296
ICON	#2	1384
ICON	#3	744
ICON	#4	2216
DIALOG	DLG2FILEACTIONMIN	230
GROUP_ICON	MAINICON	62
VERSION	#1	724
MANIFEST	#1	1299

module_name	hint	ord	function_name
gdi32.dll			CreateSolidBrush
gdi32.dll			DeleteObject
gdi32.dll			IntersectClipRect
gdi32.dll			SetBkColor
gdi32.dll			SetBkMode
gdi32.dll			SetTextColor
kernel32.dll			AddVectoredExceptionHandler
kernel32.dll			CloseHandle
kernel32.dll			CompareStringA
kernel32.dll			CompareStringW
kernel32.dll			CreateDirectoryA
kernel32.dll			CreateEventA
kernel32.dll			CreateFileA
kernel32.dll			CreateProcessA
kernel32.dll			CreateThread
kernel32.dll			DeleteCriticalSection
kernel32.dll			DeleteFileA
kernel32.dll			DuplicateHandle
kernel32.dll			EnterCriticalSection
kernel32.dll			EnumCalendarInfoA
kernel32.dll			EnumResourceLanguagesA
kernel32.dll			EnumResourceNamesA
kernel32.dll			EnumResourceTypesA
kernel32.dll			ExitProcess
kernel32.dll			ExitThread
kernel32.dll			FileTimeToLocalFileTime
kernel32.dll			FileTimeToSystemTime
kernel32.dll			FindClose
kernel32.dll			FindFirstFileA
kernel32.dll			FindNextFileA
kernel32.dll			FindResourceA
kernel32.dll			FindResourceExA
kernel32.dll			FormatMessageA
kernel32.dll			FreeLibrary
kernel32.dll			FreeResource
kernel32.dll			GetCommandLineA
kernel32.dll			GetConsoleMode
kernel32.dll			GetConsoleOutputCP
kernel32.dll			GetCurrentProcess
kernel32.dll			GetCurrentProcessId
kernel32.dll			GetCurrentThreadId
kernel32.dll			GetDateFormatA
kernel32.dll			GetDriveTypeA
kernel32.dll			GetEnvironmentVariableA
kernel32.dll			GetFileTime
kernel32.dll			GetFileType
kernel32.dll			GetLastError
kernel32.dll			GetLocalTime
kernel32.dll			GetLocaleInfoA
kernel32.dll			GetModuleFileNameA
kernel32.dll			GetModuleHandleA
kernel32.dll			GetProcAddress
kernel32.dll			GetProcessHeap
kernel32.dll			GetStartupInfoA
kernel32.dll			GetStdHandle
kernel32.dll			GetThreadLocale
kernel32.dll			GetThreadPriority
kernel32.dll			GetTickCount
kernel32.dll			GetVersionExA
kernel32.dll			GetWindowsDirectoryA
kernel32.dll			HeapAlloc
kernel32.dll			HeapFree
kernel32.dll			InitializeCriticalSection
kernel32.dll			LeaveCriticalSection
kernel32.dll			LoadLibraryA
kernel32.dll			LoadResource
kernel32.dll			LocalAlloc
kernel32.dll			LocalFileTimeToFileTime
kernel32.dll			LocalFree
kernel32.dll			LockResource
kernel32.dll			MultiByteToWideChar
kernel32.dll			ReadFile
kernel32.dll			ReadProcessMemory
kernel32.dll			RemoveDirectoryA
kernel32.dll			ResetEvent
kernel32.dll			ResumeThread
kernel32.dll			SetCurrentDirectoryA
kernel32.dll			SetErrorMode
kernel32.dll			SetEvent
kernel32.dll			SetFileAttributesA
kernel32.dll			SetFilePointer
kernel32.dll			SetFileTime
kernel32.dll			SetLastError
kernel32.dll			SetThreadPriority
kernel32.dll			SizeofResource
kernel32.dll			Sleep
kernel32.dll			SuspendThread
kernel32.dll			SystemTimeToFileTime
kernel32.dll			TerminateThread
kernel32.dll			TlsAlloc
kernel32.dll			TlsGetValue
kernel32.dll			TlsSetValue
kernel32.dll			TryEnterCriticalSection
kernel32.dll			VirtualQuery
kernel32.dll			WaitForSingleObject
kernel32.dll			WideCharToMultiByte
kernel32.dll			WriteFile
oleaut32.dll			SafeArrayAccessData
oleaut32.dll			SafeArrayCreate
oleaut32.dll			SafeArrayGetElement
oleaut32.dll			SafeArrayGetLBound
oleaut32.dll			SafeArrayGetUBound
oleaut32.dll			SafeArrayPtrOfIndex
oleaut32.dll			SafeArrayPutElement
oleaut32.dll			SafeArrayRedim
oleaut32.dll			SafeArrayUnaccessData
oleaut32.dll			SysAllocStringLen
oleaut32.dll			SysFreeString
oleaut32.dll			SysReAllocStringLen
oleaut32.dll			VariantChangeTypeEx
oleaut32.dll			VariantClear
oleaut32.dll			VariantCopy
oleaut32.dll			VariantInit
shell32.dll			FindExecutableA
user32.dll			CharLowerA
user32.dll			CharLowerBuffA
user32.dll			CharLowerBuffW
user32.dll			CharNextA
user32.dll			CharPrevA
user32.dll			CharUpperA
user32.dll			CharUpperBuffA
user32.dll			CharUpperBuffW
user32.dll			CreateDialogParamA
user32.dll			DeleteMenu
user32.dll			DestroyWindow
user32.dll			DispatchMessageA
user32.dll			DrawTextA
user32.dll			FillRect
user32.dll			GetActiveWindow
user32.dll			GetAsyncKeyState
user32.dll			GetClientRect
user32.dll			GetDC
user32.dll			GetDesktopWindow
user32.dll			GetDlgItem
user32.dll			GetParent
user32.dll			GetSysColor
user32.dll			GetSystemMenu
user32.dll			GetSystemMetrics
user32.dll			GetWindowRect
user32.dll			IsDialogMessageA
user32.dll			IsIconic
user32.dll			IsWindow
user32.dll			MessageBeep
user32.dll			MessageBoxA
user32.dll			MoveWindow
user32.dll			OemToCharA
user32.dll			PeekMessageA
user32.dll			ReleaseDC
user32.dll			SendMessageA
user32.dll			ShowWindow
user32.dll			TranslateMessage

StringTable 040904E4

CompanyName	Ghisler Software GmbH
FileDescription	Total Commander Auto-Installer
FileVersion	8.0
InternalName	Total Commander Installer
LegalCopyright	Copyright © Ghisler Software GmbH 1993-2011
OriginalFilename	sfxhead.exe

VS_FIXEDFILEINFO

FileVersion	8.0.0.0
ProductVersion	8.0.0.0
StrucVersion	0x10000
FileFlagsMask	0
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https:\/\/www.verisign.com\/rpa (c)10/CN=VeriSign Class 3 Code Signing 2010 CA

serial: 1CD8517B2373647496D551377199DEB5

Certificates (4)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
        Validity
            Not Before: May  1 00:00:00 2012 GMT
            Not After : Dec 31 23:59:59 2012 GMT
        Subject: C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:a9:59:66:74:da:3d:8a:7d:7a:d8:fc:f5:80:44:
                    7b:fe:47:6a:14:55:4e:50:47:0b:ec:d3:ed:ce:f6:
                    38:f7:4f:69:b9:b1:f0:b6:78:82:0a:8c:76:16:67:
                    e2:02:ad:b7:0d:a5:8a:f6:03:fc:66:d3:fc:08:2d:
                    cc:b5:73:59:7b:89:dc:33:6e:66:5a:5e:52:37:b4:
                    62:d1:92:59:35:14:8b:45:ac:59:b2:4d:24:a2:98:
                    94:68:42:72:9f:3a:68:e2:6b:8b:9e:22:2d:f4:98:
                    4e:9a:c6:af:b3:e4:a0:ab:3c:28:bf:23:e1:d7:72:
                    a4:f2:10:53:67:ae:77:af:51
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.verisign.com/tss-ca.crl
            X509v3 Extended Key Usage: critical
                Time Stamping
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Subject Alternative Name: 
                DirName:/CN=TSA1-3
            X509v3 Subject Key Identifier: 
                B4:B7:F1:89:49:26:60:E7:65:EA:73:AE:DC:D3:38:CD:BF:57:92:6F
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        1e:98:aa:27:b7:78:b5:08:b5:c9:72:6d:b7:df:c0:0e:98:a6:
        35:c4:88:c9:d2:f6:6d:f1:4b:1a:fb:d5:f9:2d:99:00:9e:d1:
        e7:9b:8b:e1:3f:bd:39:80:0c:66:cd:07:bc:5c:98:54:a6:94:
        ba:10:d1:4e:8b:ab:f5:6f:65:cc:67:09:a2:80:7c:52:e8:0e:
        03:d6:6b:7a:c6:05:18:ec:c8:ac:42:7c:07:2c:a7:3d:08:66:
        dc:00:ed:fd:94:1d:73:f2:72:98:93:b1:11:d6:8f:ef:8e:ea:
        ac:f4:96:51:0c:d0:8d:df:31:52:4f:5e:af:7d:a7:4a:75:e6:
        4e:ce:2b:9f:29:2b:e7:cf:5d:9f:03:7e:6e:27:7b:23:ad:62:
        29:66:af:92:e8:2c:ce:bd:9c:7f:dc:cd:17:3c:43:c2:09:3f:
        75:45:c7:9e:e4:d7:60:7f:97:c6:e4:aa:c7:69:f5:fc:cd:74:
        ac:2c:b0:48:c1:50:4e:70:56:1e:b5:35:d3:8e:be:b1:ed:ac:
        bd:fe:0c:ec:85:7d:d5:bb:85:66:44:19:5d:9f:93:eb:82:ba:
        63:9e:d3:7c:61:ff:c8:1b:d9:23:58:7f:30:a3:66:a1:39:26:
        5e:92:c3:3c:cb:37:32:fa:f5:a3:8d:dc:d5:b0:a3:e9:25:36:
        55:d7:81:fa

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
        Validity
            Not Before: Dec  4 00:00:00 2003 GMT
            Not After : Dec  3 23:59:59 2013 GMT
        Subject: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:a9:ca:b2:a4:cc:cd:20:af:0a:7d:89:ac:87:75:
                    f0:b4:4e:f1:df:c1:0f:bf:67:61:bd:a3:64:1c:da:
                    bb:f9:ca:33:ab:84:30:89:58:7e:8c:db:6b:dd:36:
                    9e:0f:bf:d1:ec:78:f2:77:a6:7e:6f:3c:bf:93:af:
                    0d:ba:68:f4:6c:94:ca:bd:52:2d:ab:48:3d:f5:b6:
                    d5:5d:5f:1b:02:9f:fa:2f:6b:1e:a4:f7:a3:9a:a6:
                    1a:c8:02:e1:7f:4c:52:e3:0e:60:ec:40:1c:7e:b9:
                    0d:de:3f:c7:b4:df:87:bd:5f:7a:6a:31:2e:03:99:
                    81:13:a8:47:20:ce:31:73:0d:57:2d:cd:78:34:33:
                    95:12:99:12:b9:de:68:2f:aa:e6:e3:c2:8a:8c:2a:
                    c3:8b:21:87:66:bd:83:58:57:6f:75:bf:3c:aa:26:
                    87:5d:ca:10:15:3c:9f:84:ea:54:c1:0a:6e:c4:fe:
                    c5:4a:dd:b9:07:11:97:22:7c:db:3e:27:d1:1e:78:
                    ec:9f:31:c9:f1:e6:22:19:db:c4:b3:47:43:9a:1a:
                    5f:a0:1e:90:e4:5e:f5:ee:7c:f1:7d:ab:62:01:8f:
                    f5:4d:0b:de:d0:22:56:a8:95:cd:ae:88:76:ae:ee:
                    ba:0d:f3:e4:4d:d9:a0:fb:68:a0:ae:14:3b:b3:87:
                    c1:bb
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.verisign.com/ThawteTimestampingCA.crl
            X509v3 Extended Key Usage: 
                Time Stamping
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name: 
                DirName:/CN=TSA2048-1-53
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        4a:6b:f9:ea:58:c2:44:1c:31:89:79:99:2b:96:bf:82:ac:01:
        d6:1c:4c:cd:b0:8a:58:6e:df:08:29:a3:5e:c8:ca:93:13:e7:
        04:52:0d:ef:47:27:2f:00:38:b0:e4:c9:93:4e:9a:d4:22:62:
        15:f7:3f:37:21:4f:70:31:80:f1:8b:38:87:b3:e8:e8:97:00:
        fe:cf:55:96:4e:24:d2:a9:27:4e:7a:ae:b7:61:41:f3:2a:ce:
        e7:c9:d9:5e:dd:bb:2b:85:3e:b5:9d:b5:d9:e1:57:ff:be:b4:
        c5:7e:f5:cf:0c:9e:f0:97:fe:2b:d3:3b:52:1b:1b:38:27:f7:
        3f:4a

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
        Validity
            Not Before: Sep 30 00:00:00 2010 GMT
            Not After : Jan  1 23:59:59 2014 GMT
        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https:\/\/www.verisign.com\/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:f5:23:4b:5e:a5:d7:8a:bb:32:e9:d4:57:f7:ef:
                    e4:c7:26:7e:ad:19:98:fe:a8:9d:7d:94:f6:36:6b:
                    10:d7:75:81:30:7f:04:68:7f:cb:2b:75:1e:cd:1d:
                    08:8c:df:69:94:a7:37:a3:9c:7b:80:e0:99:e1:ee:
                    37:4d:5f:ce:3b:14:ee:86:d4:d0:f5:27:35:bc:25:
                    0b:38:a7:8c:63:9d:17:a3:08:a5:ab:b0:fb:cd:6a:
                    62:82:4c:d5:21:da:1b:d9:f1:e3:84:3b:8a:2a:4f:
                    85:5b:90:01:4f:c9:a7:76:10:7f:27:03:7c:be:ae:
                    7e:7d:c1:dd:f9:05:bc:1b:48:9c:69:e7:c0:a4:3c:
                    3c:41:00:3e:df:96:e5:c5:e4:94:71:d6:55:01:c7:
                    00:26:4a:40:3c:b5:a1:26:a9:0c:a7:6d:80:8e:90:
                    25:7b:cf:bf:3f:1c:eb:2f:96:fa:e5:87:77:c6:b5:
                    56:b2:7a:3b:54:30:53:1b:df:62:34:ff:1e:d1:f4:
                    5a:93:28:85:e5:4c:17:4e:7e:5b:fd:a4:93:99:7f:
                    df:cd:ef:a4:75:ef:ef:15:f6:47:e7:f8:19:72:d8:
                    2e:34:1a:a6:b4:a7:4c:7e:bd:bb:4f:0c:3d:57:f1:
                    30:d6:a6:36:8e:d6:80:76:d7:19:2e:a5:cd:7e:34:
                    2d:89
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/cps
                  User Notice:
                    Explicit Text: https://www.verisign.com/rpa
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            1.3.6.1.5.5.7.1.12: 
                0_.].[0Y0W0U..image/gif0!0.0...+..............k...j.H.,{..0%.#http://logo.verisign.com/vslogo.gif
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, Code Signing
            X509v3 Subject Alternative Name: 
                DirName:/CN=VeriSignMPKI-2-8
            X509v3 Subject Key Identifier: 
                CF:99:A9:EA:7B:26:F4:4B:C9:8E:8F:D7:F0:05:26:EF:E3:D2:A7:9D
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.verisign.com/pca3.crl
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        ae:dd:21:1d:5f:8f:80:7a:d2:52:09:ea:db:6e:d2:5d:8b:e8:
        c2:1b:69:04:be:51:a5:01:0e:59:fa:37:d1:74:a3:ee:dc:ed:
        89:74:2b:62:d5:a6:bf:4f:ad:36:17:54:f0:13:e0:a3:45:d2:
        4c:26:cb:e2:6d:a2:1f:d0:1e:7a:07:0f:b6:b3:7b:6f:50:68:
        a2:e9:31:b3:b7:99:7d:80:70:a0:a7:de:0b:1e:a4:ff:f3:4d:
        81:1b:dd:20:c9:1c:c4:af:cf:f1:8f:fa:d9:da:95:f0:ec:dc:
        5c:bf:e8:8c:5a:3e:7a:b0:a3:eb:59:43:74:11:e0:9b:1a:6a:
        f3:6f

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1c:d8:51:7b:23:73:64:74:96:d5:51:37:71:99:de:b5
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https:\/\/www.verisign.com\/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
        Validity
            Not Before: Aug 26 00:00:00 2011 GMT
            Not After : Aug 25 23:59:59 2012 GMT
        Subject: C=CH, ST=Bern, L=Bolligen, O=Ghisler Software GmbH, OU=Digital ID Class 3 - Microsoft Software Validation v2, OU=Development, CN=Ghisler Software GmbH
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:d3:08:0e:ee:01:39:7c:65:76:13:c3:58:c4:25:
                    da:76:7d:ec:8f:8c:b0:9d:e7:65:64:ee:f2:d1:67:
                    9a:1a:64:3b:e4:78:df:cc:d2:d8:c9:27:b5:72:7d:
                    97:2a:6c:3c:71:42:b5:44:fe:97:1e:34:85:93:77:
                    fb:08:cc:5a:2c:66:9f:31:f7:5f:86:b3:b5:56:d7:
                    d3:6d:29:96:71:56:94:95:0b:6d:10:45:8f:be:23:
                    ce:c1:64:b2:d3:17:d4:6d:14:94:3f:68:3e:21:cb:
                    03:41:2f:de:b7:62:3f:fc:c3:c9:cf:a0:91:f6:49:
                    15:b8:12:1d:ca:7e:5d:24:97:a3:ee:27:03:dd:02:
                    03:6c:28:8e:b0:f7:3d:19:5f:19:44:99:fd:6a:21:
                    fc:f0:cc:a0:08:63:ec:49:14:b9:c4:cf:b1:78:c3:
                    95:6b:58:a7:93:47:25:12:0c:44:b8:d9:b4:6d:9d:
                    a5:7a:f6:6c:6c:1e:5b:63:19:7c:aa:66:da:7a:63:
                    9f:6c:39:4e:67:64:ed:5c:70:6a:dc:8c:3b:fd:b9:
                    63:43:26:cb:14:ed:1f:a7:7a:cf:54:63:4b:f7:6e:
                    d4:74:75:1b:e6:8c:ce:15:0e:0b:f6:ea:2f:96:db:
                    97:fa:8c:8c:85:96:90:09:1b:ff:ee:dd:f2:ad:8b:
                    14:8d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://csc3-2010-crl.verisign.com/CSC3-2010.crl
            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/rpa
            X509v3 Extended Key Usage: 
                Code Signing
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
                CA Issuers - URI:http://csc3-2010-aia.verisign.com/CSC3-2010.cer
            X509v3 Authority Key Identifier: 
                CF:99:A9:EA:7B:26:F4:4B:C9:8E:8F:D7:F0:05:26:EF:E3:D2:A7:9D
            Netscape Cert Type: 
                Object Signing
            1.3.6.1.4.1.311.2.1.27: 
                0.......
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        da:a7:ee:a8:27:f6:4c:40:b7:ef:a1:db:09:d9:73:12:1c:56:
        69:7b:c7:48:ff:a2:ec:de:b8:fd:05:93:ca:f7:21:d1:0f:71:
        38:6f:5d:41:32:02:8d:6d:ae:1f:5f:f9:1d:10:bd:08:4a:56:
        cb:74:0b:69:18:1c:c5:9b:bc:a6:c3:b5:1b:6a:1a:d9:12:ee:
        d4:de:6b:46:3b:a9:3f:5b:9e:c8:c4:39:dc:09:db:aa:15:cd:
        c5:da:86:44:ed:d4:c6:c2:b1:e9:19:5f:51:34:81:b3:87:43:
        42:8c:5e:7d:dd:54:fb:17:0f:71:dc:12:ca:98:ef:1f:a4:dd:
        ca:6b:a5:b5:95:6d:55:d3:d7:1c:99:d4:39:5a:0e:7a:b7:77:
        b9:b9:35:6d:12:78:97:93:75:cc:13:68:03:2b:42:76:e4:06:
        93:89:0b:59:81:73:a1:f6:4e:40:08:fe:79:3d:10:fe:ee:d7:
        44:aa:c1:b0:0a:79:d4:46:a7:d6:c6:85:e6:6a:f1:95:81:a5:
        4d:01:e5:7b:c6:70:f6:60:3c:53:db:91:1d:94:b4:93:d3:42:
        70:69:02:44:e6:b8:41:19:6d:7f:fc:bd:f2:b8:c5:d1:b6:2a:
        be:e3:8b:77:a7:8f:a4:7c:fe:c1:a8:7d:00:14:c5:5f:20:e8:
        e1:6d:62:2a

pkcs7-signedData

1
- SHA1: nil
- 1.3.6.1.4.1.311.2.1.4
  - #0
    - 1.3.6.1.4.1.311.2.1.15
      - :
        00 3c 00 3c 00 3c 00 4f 00 62 00 73 00 6f 00 6c |.<.<.<.O.b.s.o.l| 00 65 00 74 00 65 00 3e 00 3e 00 3e |.e.t.e.>.>.> |
    - SHA1
      - 10 68 41 ff a5 14 cf 2d 11 e7 65 60 a1 a9 52 a3 |.hA....-..e`..R.| 84 2f b5 ee |./.. |
- Certificates
  - Certificate #0
    - 2
      - 79:A2:A5:85:F9:D1:15:42:13:D9:B8:3E:F6:B6:8D:ED
      - RSA-SHA1: nil
      - Issuer
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services CA
      - 2012-05-01 00:00:00 UTC: 2012-12-31 23:59:59 UTC
      - Subject
        C: US
        O: Symantec Corporation
        CN: Symantec Time Stamping Services Signer - G3
      - #5
        rsaEncryption: nil
        A9:59:66:74:DA:3D:8A:7D:7A:D8:FC:F5:80:44:7B:FE:
        47:6A:14:55:4E:50:47:0B:EC:D3:ED:CE:F6:38:F7:4F:
        69:B9:B1:F0:B6:78:82:0A:8C:76:16:67:E2:02:AD:B7:
        0D:A5:8A:F6:03:FC:66:D3:FC:08:2D:CC:B5:73:59:7B:
        89:DC:33:6E:66:5A:5E:52:37:B4:62:D1:92:59:35:14:
        8B:45:AC:59:B2:4D:24:A2:98:94:68:42:72:9F:3A:68:
        E2:6B:8B:9E:22:2D:F4:98:4E:9A:C6:AF:B3:E4:A0:AB:
        3C:28:BF:23:E1:D7:72:A4:F2:10:53:67:AE:77:AF:51: 0x010001
      - X509v3 extensions
        basicConstraints
        true
        nil
        crlDistributionPoints: http://crl.verisign.com/tss-ca.crl
        extendedKeyUsage: true, timeStamping
        authorityInfoAccess
        OCSP: http://ocsp.verisign.com
        keyUsage: true, 0x80
        subjectAltName
        CN: TSA1-3
        subjectKeyIdentifier:
        b4 b7 f1 89 49 26 60 e7 65 ea 73 ae dc d3 38 cd |....I&`.e.s...8.| bf 57 92 6f |.W.o |
    - RSA-SHA1:
```
1e 98 aa 27 b7 78 b5 08  b5 c9 72 6d b7 df c0 0e  |...'.x....rm....|
98 a6 35 c4 88 c9 d2 f6  6d f1 4b 1a fb d5 f9 2d  |..5.....m.K....-|
99 00 9e d1 e7 9b 8b e1  3f bd 39 80 0c 66 cd 07  |........?.9..f..|
bc 5c 98 54 a6 94 ba 10  d1 4e 8b ab f5 6f 65 cc  |.\.T.....N...oe.|
67 09 a2 80 7c 52 e8 0e  03 d6 6b 7a c6 05 18 ec  |g...|R....kz....|
c8 ac 42 7c 07 2c a7 3d  08 66 dc 00 ed fd 94 1d  |..B|.,.=.f......|
73 f2 72 98 93 b1 11 d6  8f ef 8e ea ac f4 96 51  |s.r............Q|
0c d0 8d df 31 52 4f 5e  af 7d a7 4a 75 e6 4e ce  |....1RO^.}.Ju.N.|
2b 9f 29 2b e7 cf 5d 9f  03 7e 6e 27 7b 23 ad 62  |+.)+..]..~n'{#.b|
29 66 af 92 e8 2c ce bd  9c 7f dc cd 17 3c 43 c2  |)f...,.......
```
  - Certificate #1
    - 2
      - 47:BF:19:95:DF:8D:52:46:43:F7:DB:6D:48:0D:31:A4
      - RSA-SHA1: nil
      - Issuer
        C: ZA
        ST: Western Cape
        L: Durbanville
        O: Thawte
        OU: Thawte Certification
        CN: Thawte Timestamping CA
      - 2003-12-04 00:00:00 UTC: 2013-12-03 23:59:59 UTC
      - Subject
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services CA
      - #5
        rsaEncryption: nil
        A9:CA:B2:A4:CC:CD:20:AF:0A:7D:89:AC:87:75:F0:B4:
        4E:F1:DF:C1:0F:BF:67:61:BD:A3:64:1C:DA:BB:F9:CA:
        33:AB:84:30:89:58:7E:8C:DB:6B:DD:36:9E:0F:BF:D1:
        EC:78:F2:77:A6:7E:6F:3C:BF:93:AF:0D:BA:68:F4:6C:
        94:CA:BD:52:2D:AB:48:3D:F5:B6:D5:5D:5F:1B:02:9F:
        FA:2F:6B:1E:A4:F7:A3:9A:A6:1A:C8:02:E1:7F:4C:52:
        E3:0E:60:EC:40:1C:7E:B9:0D:DE:3F:C7:B4:DF:87:BD:
        5F:7A:6A:31:2E:03:99:81:13:A8:47:20:CE:31:73:0D:
        57:2D:CD:78:34:33:95:12:99:12:B9:DE:68:2F:AA:E6:
        E3:C2:8A:8C:2A:C3:8B:21:87:66:BD:83:58:57:6F:75:
        BF:3C:AA:26:87:5D:CA:10:15:3C:9F:84:EA:54:C1:0A:
        6E:C4:FE:C5:4A:DD:B9:07:11:97:22:7C:DB:3E:27:D1:
        1E:78:EC:9F:31:C9:F1:E6:22:19:DB:C4:B3:47:43:9A:
        1A:5F:A0:1E:90:E4:5E:F5:EE:7C:F1:7D:AB:62:01:8F:
        F5:4D:0B:DE:D0:22:56:A8:95:CD:AE:88:76:AE:EE:BA:
        0D:F3:E4:4D:D9:A0:FB:68:A0:AE:14:3B:B3:87:C1:BB: 0x010001
      - X509v3 extensions
        authorityInfoAccess
        OCSP: http://ocsp.verisign.com
        basicConstraints
        true
        true: 0
        crlDistributionPoints: http://crl.verisign.com/ThawteTimestampingCA.crl
        extendedKeyUsage: timeStamping
        keyUsage: true, 6
        subjectAltName
        CN: TSA2048-1-53
    - RSA-SHA1:
```
4a 6b f9 ea 58 c2 44 1c  31 89 79 99 2b 96 bf 82  |Jk..X.D.1.y.+...|
ac 01 d6 1c 4c cd b0 8a  58 6e df 08 29 a3 5e c8  |....L...Xn..).^.|
ca 93 13 e7 04 52 0d ef  47 27 2f 00 38 b0 e4 c9  |.....R..G'/.8...|
93 4e 9a d4 22 62 15 f7  3f 37 21 4f 70 31 80 f1  |.N.."b..?7!Op1..|
8b 38 87 b3 e8 e8 97 00  fe cf 55 96 4e 24 d2 a9  |.8........U.N$..|
27 4e 7a ae b7 61 41 f3  2a ce e7 c9 d9 5e dd bb  |'Nz..aA.*....^..|
2b 85 3e b5 9d b5 d9 e1  57 ff be b4 c5 7e f5 cf  |+.>.....W....~..|
0c 9e f0 97 fe 2b d3 3b  52 1b 1b 38 27 f7 3f 4a  |.....+.;R..8'.?J|
```
  - Certificate #2
    - 2
      - 4D:62:90:E5:8C:54:F0:F1:EB:17:34:1A:13:10:E6:A4
      - RSA-SHA1: nil
      - Issuer
        C: US
        O: VeriSign, Inc.
        OU: Class 3 Public Primary Certification Authority
      - 2010-09-30 00:00:00 UTC: 2014-01-01 23:59:59 UTC
      - Subject
        C: US
        O: VeriSign, Inc.
        OU: VeriSign Trust Network
        OU: Terms of use at https://www.verisign.com/rpa (c)10
        CN: VeriSign Class 3 Code Signing 2010 CA
      - #5
        rsaEncryption: nil
        F5:23:4B:5E:A5:D7:8A:BB:32:E9:D4:57:F7:EF:E4:C7:
        26:7E:AD:19:98:FE:A8:9D:7D:94:F6:36:6B:10:D7:75:
        81:30:7F:04:68:7F:CB:2B:75:1E:CD:1D:08:8C:DF:69:
        94:A7:37:A3:9C:7B:80:E0:99:E1:EE:37:4D:5F:CE:3B:
        14:EE:86:D4:D0:F5:27:35:BC:25:0B:38:A7:8C:63:9D:
        17:A3:08:A5:AB:B0:FB:CD:6A:62:82:4C:D5:21:DA:1B:
        D9:F1:E3:84:3B:8A:2A:4F:85:5B:90:01:4F:C9:A7:76:
        10:7F:27:03:7C:BE:AE:7E:7D:C1:DD:F9:05:BC:1B:48:
        9C:69:E7:C0:A4:3C:3C:41:00:3E:DF:96:E5:C5:E4:94:
        71:D6:55:01:C7:00:26:4A:40:3C:B5:A1:26:A9:0C:A7:
        6D:80:8E:90:25:7B:CF:BF:3F:1C:EB:2F:96:FA:E5:87:
        77:C6:B5:56:B2:7A:3B:54:30:53:1B:DF:62:34:FF:1E:
        D1:F4:5A:93:28:85:E5:4C:17:4E:7E:5B:FD:A4:93:99:
        7F:DF:CD:EF:A4:75:EF:EF:15:F6:47:E7:F8:19:72:D8:
        2E:34:1A:A6:B4:A7:4C:7E:BD:BB:4F:0C:3D:57:F1:30:
        D6:A6:36:8E:D6:80:76:D7:19:2E:A5:CD:7E:34:2D:89: 0x010001
      - X509v3 extensions
        basicConstraints
        true
        true: 0
        certificatePolicies
        2.16.840.1.113733.1.7.23.3
        #0
        id-qt-cps: https://www.verisign.com/cps
        id-qt-unotice: https://www.verisign.com/rpa
        keyUsage: true, 6
        1.3.6.1.5.5.7.1.12
        image/gif
        SHA1:
        8f e5 d3 1a 86 ac 8d 8e 6b c3 cf 80 6a d4 48 18 |........k...j.H.| 2c 7b 19 2e |,{.. |
        http://logo.verisign.com/vslogo.gif
        extendedKeyUsage
        clientAuth: codeSigning
        subjectAltName
        CN: VeriSignMPKI-2-8
        subjectKeyIdentifier:
        cf 99 a9 ea 7b 26 f4 4b c9 8e 8f d7 f0 05 26 ef |....{&.K......&.| e3 d2 a7 9d |.... |
        crlDistributionPoints: http://crl.verisign.com/pca3.crl
    - RSA-SHA1:
```
ae dd 21 1d 5f 8f 80 7a  d2 52 09 ea db 6e d2 5d  |..!._..z.R...n.]|
8b e8 c2 1b 69 04 be 51  a5 01 0e 59 fa 37 d1 74  |....i..Q...Y.7.t|
a3 ee dc ed 89 74 2b 62  d5 a6 bf 4f ad 36 17 54  |.....t+b...O.6.T|
f0 13 e0 a3 45 d2 4c 26  cb e2 6d a2 1f d0 1e 7a  |....E.L&..m....z|
07 0f b6 b3 7b 6f 50 68  a2 e9 31 b3 b7 99 7d 80  |....{oPh..1...}.|
70 a0 a7 de 0b 1e a4 ff  f3 4d 81 1b dd 20 c9 1c  |p........M... ..|
c4 af cf f1 8f fa d9 da  95 f0 ec dc 5c bf e8 8c  |............\...|
5a 3e 7a b0 a3 eb 59 43  74 11 e0 9b 1a 6a f3 6f  |Z>z...YCt....j.o|
```
  - Certificate #3
    - 2
      - 1C:D8:51:7B:23:73:64:74:96:D5:51:37:71:99:DE:B5
      - RSA-SHA1: nil
      - Issuer
        C: US
        O: VeriSign, Inc.
        OU: VeriSign Trust Network
        OU: Terms of use at https://www.verisign.com/rpa (c)10
        CN: VeriSign Class 3 Code Signing 2010 CA
      - 2011-08-26 00:00:00 UTC: 2012-08-25 23:59:59 UTC
      - Subject
        C: CH
        ST: Bern
        L: Bolligen
        O: Ghisler Software GmbH
        OU: Digital ID Class 3 - Microsoft Software Validation v2
        OU: Development
        CN: Ghisler Software GmbH
      - #5
        rsaEncryption: nil
        D3:08:0E:EE:01:39:7C:65:76:13:C3:58:C4:25:DA:76:
        7D:EC:8F:8C:B0:9D:E7:65:64:EE:F2:D1:67:9A:1A:64:
        3B:E4:78:DF:CC:D2:D8:C9:27:B5:72:7D:97:2A:6C:3C:
        71:42:B5:44:FE:97:1E:34:85:93:77:FB:08:CC:5A:2C:
        66:9F:31:F7:5F:86:B3:B5:56:D7:D3:6D:29:96:71:56:
        94:95:0B:6D:10:45:8F:BE:23:CE:C1:64:B2:D3:17:D4:
        6D:14:94:3F:68:3E:21:CB:03:41:2F:DE:B7:62:3F:FC:
        C3:C9:CF:A0:91:F6:49:15:B8:12:1D:CA:7E:5D:24:97:
        A3:EE:27:03:DD:02:03:6C:28:8E:B0:F7:3D:19:5F:19:
        44:99:FD:6A:21:FC:F0:CC:A0:08:63:EC:49:14:B9:C4:
        CF:B1:78:C3:95:6B:58:A7:93:47:25:12:0C:44:B8:D9:
        B4:6D:9D:A5:7A:F6:6C:6C:1E:5B:63:19:7C:AA:66:DA:
        7A:63:9F:6C:39:4E:67:64:ED:5C:70:6A:DC:8C:3B:FD:
        B9:63:43:26:CB:14:ED:1F:A7:7A:CF:54:63:4B:F7:6E:
        D4:74:75:1B:E6:8C:CE:15:0E:0B:F6:EA:2F:96:DB:97:
        FA:8C:8C:85:96:90:09:1B:FF:EE:DD:F2:AD:8B:14:8D: 0x010001
      - X509v3 extensions
        basicConstraints
        nil
        keyUsage: true, 0x80
        crlDistributionPoints: http://csc3-2010-crl.verisign.com/CSC3-2010.crl
        certificatePolicies
        2.16.840.1.113733.1.7.23.3
        id-qt-cps: https://www.verisign.com/rpa
        extendedKeyUsage: codeSigning
        authorityInfoAccess
        #0
        OCSP: http://ocsp.verisign.com
        caIssuers: http://csc3-2010-aia.verisign.com/CSC3-2010.cer
        authorityKeyIdentifier:
        cf 99 a9 ea 7b 26 f4 4b c9 8e 8f d7 f0 05 26 ef |....{&.K......&.| e3 d2 a7 9d |.... |
        nsCertType: 0x10
        1.3.6.1.4.1.311.2.1.27
        false: true
    - RSA-SHA1:
```
da a7 ee a8 27 f6 4c 40  b7 ef a1 db 09 d9 73 12  |....'.L@......s.|
1c 56 69 7b c7 48 ff a2  ec de b8 fd 05 93 ca f7  |.Vi{.H..........|
21 d1 0f 71 38 6f 5d 41  32 02 8d 6d ae 1f 5f f9  |!..q8o]A2..m.._.|
1d 10 bd 08 4a 56 cb 74  0b 69 18 1c c5 9b bc a6  |....JV.t.i......|
c3 b5 1b 6a 1a d9 12 ee  d4 de 6b 46 3b a9 3f 5b  |...j......kF;.?[|
9e c8 c4 39 dc 09 db aa  15 cd c5 da 86 44 ed d4  |...9.........D..|
c6 c2 b1 e9 19 5f 51 34  81 b3 87 43 42 8c 5e 7d  |....._Q4...CB.^}|
dd 54 fb 17 0f 71 dc 12  ca 98 ef 1f a4 dd ca 6b  |.T...q.........k|
a5 b5 95 6d 55 d3 d7 1c  99 d4 39 5a 0e 7a b7 77  |...mU.....9Z.z.w|
b9 b9 35 6d 12 78 97 93  75 cc 13 68 03 2b 42 76  |..5m.x..u..h.+Bv|
e4 06 93 89 0b 59 81 73  a1 f6 4e 40 08 fe 79 3d  |.....Y.s..N@..y=|
10 fe ee d7 44 aa c1 b0  0a 79 d4 46 a7 d6 c6 85  |....D....y.F....|
e6 6a f1 95 81 a5 4d 01  e5 7b c6 70 f6 60 3c 53  |.j....M..{.p.`
```
- Signer
  - 1
  - unnamed
    - #0
      - C: US
      - O: VeriSign, Inc.
      - OU: VeriSign Trust Network
      - OU: Terms of use at https://www.verisign.com/rpa (c)10
      - CN: VeriSign Class 3 Code Signing 2010 CA
    - 1C:D8:51:7B:23:73:64:74:96:D5:51:37:71:99:DE:B5
  - SHA1: nil
  - #3
    - contentType: 1.3.6.1.4.1.311.2.1.4
    - 1.3.6.1.4.1.311.2.1.11: msCodeInd
    - messageDigest:
```
96 41 7a 1b 03 87 f4 4c  40 29 f9 17 32 5f 36 0e  |.Az....L@)..2_6.|
c3 be 79 b8                                       |..y.            |
```
    - 1.3.6.1.4.1.311.2.1.12: http://www.ghisler.com
  - rsaEncryption:
```
ad 63 16 db ab 99 a0 16  2c 9e 7b 43 ba 73 49 e8  |.c......,.{C.sI.|
35 68 7e f7 89 65 a7 c6  1e 4d 34 ba 1d 1c b6 62  |5h~..e...M4....b|
fc 0c 12 5c 15 6c 41 fe  bd c5 83 31 93 30 8a 40  |...\.lA....1.0.@|
d7 af 67 b5 8c 42 e5 dd  97 8d 34 95 24 f9 f3 85  |..g..B....4.$...|
df 3c 79 b7 32 24 70 3f  2e 89 a3 27 f7 df a4 a9  |.. |
1c 48 2d fb 21 3e fe 64  86 47 e9 26 34 27 3f 08  |.H-.!>.d.G.&4'?.|
f0 31 88 72 59 b5 0a 1a  20 cf 83 ba 0c f3 1d 85  |.1.rY... .......|
c9 71 e0 da dd f5 2e 94  27 31 36 5d 4b b6 8f 09  |.q......'16]K...|
```
  - countersignature
    - 1
      - unnamed
        #0
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services CA
        79:A2:A5:85:F9:D1:15:42:13:D9:B8:3E:F6:B6:8D:ED
      - SHA1: nil
      - #2
        contentType: pkcs7-data
        signingTime: 2012-08-03 10:29:14 UTC
        messageDigest:
        a2 8e 18 f8 47 bf 5c b7 a2 8f 09 7c 4b 90 1a b6 |....G.\....|K...| 02 26 91 5e |.&.^ |
      - rsaEncryption:
        7c a9 50 78 6d cc 39 b7 11 c8 c5 ec 7c f3 15 46 ||.Pxm.9.....|..F| 51 03 95 bf f8 9c 3c fc 0f 89 31 77 a3 d8 1b 4a |Q.....<...1w...J| 30 f8 d2 8e dc e2 b9 52 18 a2 10 85 2e 59 d2 b9 |0......R.....Y..| 7e 74 2c 49 71 cc 7b a6 cf 22 5c cf 6e e4 4e dc |~t,Iq.{.."\.n.N.| 80 27 33 fc 30 76 07 96 94 63 67 56 a2 30 77 be |.'3.0v...cgV.0w.| 96 54 80 93 ac a5 8d 36 3c 21 fb bd 4d 28 41 50 |.T.....6

show previews

offset	size	type	comment
0	13359	EXE	01/01/1970 00:00:00	#
15c1	15	HTM		#
39c58	4087121	ZIP		#
41f9a9	5735	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 4329488 bytes (4229 KiB)


--
Type = PE
Physical Size = 4329488
CPU = x64
64-bit = +
Characteristics = Executable LargeAddress NoRelocs NoLineNums NoLocalSyms
Headers Size = 1024
Checksum = 4332454
Name = sfxhead.exe
Image Size = 319488
Section Alignment = 4096
File Alignment = 512
Code Size = 231424
Initialized Data Size = 34456
Uninitialized Data Size = 21024
Linker Version = 2.44
OS Version = 4.0
Image Version = 1.0
Subsystem Version = 4.0
Subsystem = Windows GUI
Stack Reserve = 16777216
Stack Commit = 4096
Heap Reserve = 1048576
Heap Commit = 4096
Image Base = 4194304
Comment = FileVersion: 8.0.0.0
FileVersion: 8.0
ProductVersion: 8.0.0.0
CompanyName: Ghisler Software GmbH
FileDescription: Total Commander Auto-Installer
InternalName: Total Commander Installer
LegalCopyright: Copyright © Ghisler Software GmbH 1993-2011
OriginalFilename: sfxhead.exe
----
Path = [3]
Size = 4043168
Packed Size = 4043168
Virtual Size = 4043168
Offset = 280592
--
Path = [3]
Type = zip
Offset = -280592
Physical Size = 4323753
Tail Size = 7
Embedded Stub Size = 280611

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2012-08-03 08:01:00 ....A          880          493  FILE_ID.DIZ
2012-08-03 08:01:00 ....A      3944656      3943088  INSTALL.CAB
2012-08-03 08:01:00 ....A       146528        72377  INSTALL.EXE
2012-08-03 08:01:00 ....A         4529         1452  INSTALL.INF
2012-08-03 08:01:00 ....A        53988        21623  INSTALL.LNG
2012-08-03 08:01:00 ....A         3486         1702  LIESMICH.TXT
2012-08-03 08:01:00 ....A         3475         1699  README.TXT
------------------- ----- ------------ ------------  ------------------------
2012-08-03 08:01:00            4157542      4042434  7 files

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

hafmal (11)-

MZ Header

DOS stub

PE Header

Sections

Data Directory

StringTable 040904E4

VS_FIXEDFILEINFO

Signers (1)

Certificates (4)

hafmal (11)
-