filenameChromeUpdater.exe
size309760 (0x4ba00)
md500adcae56af899dd103ca66fe0c3c9c0
typePE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections9
TimeDateStamp0x55b389e5
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x30f
Magic0x10b
LinkerVersion2.22
SizeOfCode0x27000
SizeOfInitializedData0x4b600
SizeOfUninitializedData0x7400
AddressOfEntryPoint0x12a0
BaseOfCode0x1000
BaseOfData0x28000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x59000
SizeOfHeaders0x400
CheckSum0x4d583
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x26e980x27000R-X CODE IDATA
.data0x280000x1900x200RW- IDATA
.rdata0x290000x1df200x1e000R-- IDATA
.eh_fram0x470000x4380x600R-- IDATA
.bss0x480000x73280RW- UDATA
.idata0x500000x124c0x1400RW- IDATA
.CRT0x520000x180x200RW- IDATA
.tls0x530000x200x200RW- IDATA
.rsrc0x540000x448c0x4600RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x500000x124c
RESOURCE0x540000x448c
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x530000x18
LOAD_CONFIG00
Bound_IAT00
IAT0x5038c0x288
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x4530190x45301c0x44cacc0x45200400
typenamesizecp
ICON#196400
ICON#242640
ICON#311280
DIALOG#10013960
GROUP_ICONAPPICON480
MANIFEST#16560
module_namehintordfunction_name
COMCTL32.DLL94InitCommonControls
COMDLG32.DLL10GetOpenFileNameW
IMM32.DLL9ImmDisableIME
KERNEL32.dll3AddAtomA
KERNEL32.dll82CloseHandle
KERNEL32.dll128CreateDirectoryW
KERNEL32.dll129CreateEventA
KERNEL32.dll132CreateEventW
KERNEL32.dll135CreateFileA
KERNEL32.dll139CreateFileMappingW
KERNEL32.dll142CreateFileW
KERNEL32.dll154CreateMutexA
KERNEL32.dll157CreateMutexW
KERNEL32.dll166CreateProcessW
KERNEL32.dll169CreateSemaphoreA
KERNEL32.dll207DeleteCriticalSection
KERNEL32.dll212DeleteFileW
KERNEL32.dll236EnterCriticalSection
KERNEL32.dll279ExitProcess
KERNEL32.dll298FindAtomA
KERNEL32.dll352FreeLibrary
KERNEL32.dll363GetAtomNameA
KERNEL32.dll388GetCommandLineA
KERNEL32.dll389GetCommandLineW
KERNEL32.dll445GetCurrentDirectoryW
KERNEL32.dll451GetCurrentThreadId
KERNEL32.dll492GetFileSize
KERNEL32.dll510GetLastError
KERNEL32.dll528GetModuleFileNameW
KERNEL32.dll529GetModuleHandleA
KERNEL32.dll577GetProcAddress
KERNEL32.dll606GetStartupInfoA
KERNEL32.dll671GetVersionExA
KERNEL32.dll687GlobalAlloc
KERNEL32.dll698GlobalLock
KERNEL32.dll705GlobalUnlock
KERNEL32.dll734InitializeCriticalSection
KERNEL32.dll743InterlockedDecrement
KERNEL32.dll747InterlockedIncrement
KERNEL32.dll814LeaveCriticalSection
KERNEL32.dll820LoadLibraryW
KERNEL32.dll829LocalFree
KERNEL32.dll844MapViewOfFile
KERNEL32.dll893OutputDebugStringW
KERNEL32.dll947ReadFile
KERNEL32.dll974ReleaseMutex
KERNEL32.dll978ReleaseSemaphore
KERNEL32.dll995ResetEvent
KERNEL32.dll1053SetCurrentDirectoryW
KERNEL32.dll1065SetEvent
KERNEL32.dll1078SetFilePointer
KERNEL32.dll1082SetFileTime
KERNEL32.dll1091SetLastError
KERNEL32.dll1140SetUnhandledExceptionFilter
KERNEL32.dll1152Sleep
KERNEL32.dll1171TlsAlloc
KERNEL32.dll1172TlsFree
KERNEL32.dll1173TlsGetValue
KERNEL32.dll1174TlsSetValue
KERNEL32.dll1188UnmapViewOfFile
KERNEL32.dll1207VirtualAlloc
KERNEL32.dll1210VirtualFree
KERNEL32.dll1213VirtualProtect
KERNEL32.dll1215VirtualQuery
KERNEL32.dll1223WaitForSingleObject
KERNEL32.dll1267WriteFile
KERNEL32.dll1273WritePrivateProfileStringW
msvcrt.dll99_wcsdup
msvcrt.dll100_wcsicmp
msvcrt.dll109_write
msvcrt.dll55__getmainargs
msvcrt.dll65__mb_cur_max
msvcrt.dll77__p__environ
msvcrt.dll79__p__fmode
msvcrt.dll99__set_app_type
msvcrt.dll142_beginthread
msvcrt.dll143_beginthreadex
msvcrt.dll147_cexit
msvcrt.dll266_iob
msvcrt.dll268_isctype
msvcrt.dll377_memicmp
msvcrt.dll383_onexit
msvcrt.dll392_pctype
msvcrt.dll426_setmode
msvcrt.dll531_wfopen
msvcrt.dll574_wtoi
msvcrt.dll583abort
msvcrt.dll590atexit
msvcrt.dll595calloc
msvcrt.dll607fclose
msvcrt.dll620fputc
msvcrt.dll621fputs
msvcrt.dll625free
msvcrt.dll633fwrite
msvcrt.dll676malloc
msvcrt.dll680memchr
msvcrt.dll681memcmp
msvcrt.dll682memcpy
msvcrt.dll683memmove
msvcrt.dll688pow
msvcrt.dll698realloc
msvcrt.dll706signal
msvcrt.dll709sprintf
msvcrt.dll715strcmp
msvcrt.dll717strcpy
msvcrt.dll719strerror
msvcrt.dll734swprintf
msvcrt.dll748vfprintf
msvcrt.dll754wcscat
msvcrt.dll755wcschr
msvcrt.dll756wcscmp
msvcrt.dll758wcscpy
msvcrt.dll761wcslen
OLE32.dll12CoCreateInstance
OLE32.dll38CoInitializeEx
OLE32.dll69CoTaskMemFree
SHELL32.DLL2CommandLineToArgvW
SHELL32.DLL61SHBrowseForFolderW
SHELL32.DLL102SHGetPathFromIDListW
SHLWAPI.DLL37PathFileExistsW
SHLWAPI.DLL95PathRelativePathToW
SHLWAPI.DLL105PathRemoveFileSpecW
USER32.dll61CloseClipboard
USER32.dll148DialogBoxParamW
USER32.dll177EmptyClipboard
USER32.dll182EndDialog
USER32.dll213FindWindowW
USER32.dll253GetDlgItem
USER32.dll353GetWindowTextW
USER32.dll439MessageBoxW
USER32.dll455OpenClipboard
USER32.dll513SendMessageW
USER32.dll523SetClipboardData
USER32.dll534SetForegroundWindow
USER32.dll574SetWindowTextA
USER32.dll575SetWindowTextW
USER32.dll585ShowWindow
USER32.dll639wsprintfW
VERSION.dll2GetFileVersionInfoSizeW
VERSION.dll3GetFileVersionInfoW
VERSION.dll11VerQueryValueW
WININET.DLL94HttpOpenRequestA
WININET.DLL97HttpQueryInfoW
WININET.DLL98HttpSendRequestA
WININET.DLL116InternetCloseHandle
WININET.DLL122InternetConnectA
WININET.DLL124InternetCrackUrlA
WININET.DLL157InternetOpenA
WININET.DLL161InternetQueryDataAvailable
WININET.DLL165InternetReadFile
offsetsizetypecomment
0309760EXE07/25/2015 13:06:45#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x4cacc