services.exe - Services and Controller app

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	services.exe
size	328704 (0x50400)
md5	014a9cb92514e27c0107614df764bc06

type	PE32+ executable (GUI) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	Trojan.Sirefef-427 FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe8

Rich Header

lib id	version	times used
132	30729	1
149	30729	1
1	0	315
147	30729	47
131	30729	17
138	30729	41
148	30729	1
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	6
TimeDateStamp	0x4a5bc10e
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	9.0
SizeOfCode	0x3cc00
SizeOfInitializedData	0x13000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x13310
BaseOfCode	0x1000
ImageBase	0x100000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.1
ImageVersion	6.1
SubsystemVersion	6.1
Reserved1	0
SizeOfImage	0x53000
SizeOfHeaders	0x800
CheckSum	0x54321
Subsystem	2
DllCharacteristics	0x8100
SizeOfStackReserve	0x80000
SizeOfStackCommit	0x8000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x3cabd	0x3cc00	R-X CODE
.rdata	0x3e000	0x9a10	0x9c00	R-- IDATA
.data	0x48000	0x1758	0x1800	RW- IDATA
.pdata	0x4a000	0x2b8c	0x2c00	R-- IDATA
.rsrc	0x4d000	0x4aa8	0x4c00	R-- IDATA
.reloc	0x52000	0x220	0x400	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x43ac4	0x1e0
RESOURCE	0x4d000	0x4aa8
EXCEPTION	0x4a000	0x2b8c
SECURITY	0	0
BASERELOC	0x52000	0x220
DEBUG	0x3da5c	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0x2e0	0x3a4
IAT	0x3e000	0xa00
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
MUI	#1	240
WEVT_TEMPLATE	#1	16874
VERSION	#1	932
MANIFEST	#1	698

module_name	hint	ord	function_name
msvcrt.dll	179		_cexit
msvcrt.dll	255		_exit
msvcrt.dll	82		_XcptFilter
msvcrt.dll	83		__C_specific_handler
msvcrt.dll	364		_initterm
msvcrt.dll	160		_amsg_exit
msvcrt.dll	130		__setusermatherr
msvcrt.dll	1056		exit
msvcrt.dll	280		_fmode
msvcrt.dll	128		__set_app_type
msvcrt.dll	48		void __cdecl terminate(void) ?terminate@@YAXXZ
msvcrt.dll	196		_commode
msvcrt.dll	1156		memset
msvcrt.dll	1152		memcpy
msvcrt.dll	481		_ltow
msvcrt.dll	1268		wcscspn
msvcrt.dll	113		__getmainargs
msvcrt.dll	482		_ltow_s
msvcrt.dll	1263		wcschr
msvcrt.dll	893		_wcslwr
msvcrt.dll	810		_ultow_s
msvcrt.dll	1234		time
msvcrt.dll	1278		wcsrchr
msvcrt.dll	856		_vsnwprintf
msvcrt.dll	899		_wcsnicmp
msvcrt.dll	1289		wcstoul
msvcrt.dll	1282		wcsstr
msvcrt.dll	889		_wcsicmp
msvcrt.dll	1015		_wtol
msvcrt.dll	1273		wcsncmp
msvcrt.dll	809		_ultow
RPCRT4.dll	515		UuidCreate
RPCRT4.dll	516		UuidCreateNil
RPCRT4.dll	518		UuidEqual
RPCRT4.dll	460		RpcServerUnsubscribeForNotification
RPCRT4.dll	456		RpcServerSubscribeForNotification
RPCRT4.dll	381		RpcBindingVectorFree
RPCRT4.dll	452		RpcServerRegisterAuthInfoW
RPCRT4.dll	448		RpcServerInqDefaultPrincNameW
RPCRT4.dll	390		RpcEpRegisterW
RPCRT4.dll	506		RpcStringFreeW
RPCRT4.dll	504		RpcStringBindingParseW
RPCRT4.dll	379		RpcBindingToStringBindingW
RPCRT4.dll	444		RpcServerInqBindings
RPCRT4.dll	476		RpcServerUseProtseqW
RPCRT4.dll	469		RpcServerUseProtseqEpW
RPCRT4.dll	61		I_RpcMapWin32Status
RPCRT4.dll	446		RpcServerInqCallAttributesW
RPCRT4.dll	349		RpcAsyncCompleteCall
RPCRT4.dll	440		RpcRevertToSelf
RPCRT4.dll	407		RpcImpersonateClient
RPCRT4.dll	443		RpcServerInqBindingHandle
RPCRT4.dll	30		I_RpcBindingInqLocalClientPID
RPCRT4.dll	99		I_RpcSessionStrictContextHandle
RPCRT4.dll	36		I_RpcBindingIsClientLocal
RPCRT4.dll	291		NdrServerCall2
RPCRT4.dll	141		NdrAsyncServerCall
RPCRT4.dll	520		UuidFromStringW
RPCRT4.dll	357		RpcBindingFree
RPCRT4.dll	445		RpcServerInqCallAttributesA
RPCRT4.dll	455		RpcServerRegisterIfEx
RPCRT4.dll	347		RpcAsyncAbortCall
SspiCli.dll	33		LogonUserExExW
ntdll.dll	1005		RtlLengthSid
ntdll.dll	79		EtwTraceMessage
ntdll.dll	540		NtTraceControl
ntdll.dll	1161		RtlSetLastWin32Error
ntdll.dll	67		EtwGetTraceLoggerHandle
ntdll.dll	937		RtlInitializeCriticalSection
ntdll.dll	635		RtlCaptureContext
ntdll.dll	1025		RtlLookupFunctionEntry
ntdll.dll	1264		RtlVirtualUnwind
ntdll.dll	363		NtOpenThread
ntdll.dll	434		NtQueueApcThread
ntdll.dll	1092		RtlQueueApcWow64Thread
ntdll.dll	87		EvtIntReportEventAndSourceAsync
ntdll.dll	57		EtwEventWrite
ntdll.dll	55		EtwEventRegister
ntdll.dll	1219		RtlUnhandledExceptionFilter
ntdll.dll	842		RtlFreeHeap
ntdll.dll	488		NtSetEvent
ntdll.dll	498		NtSetInformationProcess
ntdll.dll	356		NtOpenProcessToken
ntdll.dll	1166		RtlSetProcessIsCritical
ntdll.dll	396		NtQueryInformationFile
ntdll.dll	494		NtSetInformationFile
ntdll.dll	622		RtlAppendUnicodeStringToString
ntdll.dll	623		RtlAppendUnicodeToString
ntdll.dll	556		NtWaitForSingleObject
ntdll.dll	388		NtQueryDirectoryFile
ntdll.dll	266		NtDeleteFile
ntdll.dll	682		RtlCopyUnicodeString
ntdll.dll	285		NtFilterToken
ntdll.dll	402		NtQueryInformationToken
ntdll.dll	500		NtSetInformationThread
ntdll.dll	176		NtAdjustPrivilegesToken
ntdll.dll	276		NtDuplicateToken
ntdll.dll	166		NtAccessCheckAndAuditAlarm
ntdll.dll	165		NtAccessCheck
ntdll.dll	376		NtPrivilegeObjectAuditAlarm
ntdll.dll	375		NtPrivilegeCheck
ntdll.dll	1028		RtlMapGenericMask
ntdll.dll	1170		RtlSetSecurityObject
ntdll.dll	364		NtOpenThreadToken
ntdll.dll	1257		RtlValidRelativeSecurityDescriptor
ntdll.dll	1087		RtlQuerySecurityObject
ntdll.dll	1195		RtlSubAuthoritySid
ntdll.dll	1386		WinSqmAddToStream
ntdll.dll	1146		RtlSetControlSecurityDescriptor
ntdll.dll	267		NtDeleteKey
ntdll.dll	280		NtEnumerateKey
ntdll.dll	270		NtDeleteValueKey
ntdll.dll	523		NtSetValueKey
ntdll.dll	431		NtQueryValueKey
ntdll.dll	347		NtOpenKey
ntdll.dll	234		NtCreateKey
ntdll.dll	1004		RtlLengthSecurityDescriptor
ntdll.dll	1258		RtlValidSecurityDescriptor
ntdll.dll	1155		RtlSetEnvironmentVariable
ntdll.dll	664		RtlConvertExclusiveToShared
ntdll.dll	666		RtlConvertSharedToExclusive
ntdll.dll	701		RtlCreateServiceSid
ntdll.dll	1106		RtlRegisterWait
ntdll.dll	799		RtlEqualUnicodeString
ntdll.dll	887		RtlGetNtProductType
ntdll.dll	679		RtlCopySid
ntdll.dll	544		NtUnloadDriver
ntdll.dll	654		RtlCompareUnicodeString
ntdll.dll	389		NtQueryDirectoryObject
ntdll.dll	340		NtOpenDirectoryObject
ntdll.dll	320		NtLoadDriver
ntdll.dll	33		DbgPrintEx
ntdll.dll	609		RtlAdjustPrivilege
ntdll.dll	809		RtlExpandEnvironmentStrings_U
ntdll.dll	948		RtlInitializeSRWLock
ntdll.dll	344		NtOpenFile
ntdll.dll	423		NtQuerySymbolicLinkObject
ntdll.dll	362		NtOpenSymbolicLinkObject
ntdll.dll	847		RtlFreeUnicodeString
ntdll.dll	767		RtlDosPathNameToNtPathName_U
ntdll.dll	1114		RtlReleaseSRWLockShared
ntdll.dll	268		NtDeleteObjectAuditAlarm
ntdll.dll	582		RtlAcquireSRWLockShared
ntdll.dll	290		NtFlushKey
ntdll.dll	627		RtlAreAllAccessesGranted
ntdll.dll	215		NtCloseObjectAuditAlarm
ntdll.dll	1113		RtlReleaseSRWLockExclusive
ntdll.dll	581		RtlAcquireSRWLockExclusive
ntdll.dll	750		RtlDeregisterWait
ntdll.dll	580		RtlAcquireResourceShared
ntdll.dll	946		RtlInitializeResource
ntdll.dll	1093		RtlQueueWorkItem
ntdll.dll	742		RtlDeleteSecurityObject
ntdll.dll	1112		RtlReleaseResource
ntdll.dll	579		RtlAcquireResourceExclusive
ntdll.dll	671		RtlCopyLuid
ntdll.dll	409		NtQueryKey
ntdll.dll	525		NtShutdownSystem
ntdll.dll	314		NtInitializeRegistry
ntdll.dll	513		NtSetSystemEnvironmentValue
ntdll.dll	930		RtlInitUnicodeString
ntdll.dll	214		NtClose
ntdll.dll	1044		RtlNtStatusToDosError
ntdll.dll	426		NtQuerySystemInformation
ntdll.dll	1045		RtlNtStatusToDosErrorNoTeb
ntdll.dll	1003		RtlLengthRequiredSid
ntdll.dll	592		RtlAddAce
ntdll.dll	683		RtlCreateAcl
ntdll.dll	1151		RtlSetDaclSecurityDescriptor
ntdll.dll	1038		RtlNewSecurityObject
ntdll.dll	1157		RtlSetGroupSecurityDescriptor
ntdll.dll	1168		RtlSetSaclSecurityDescriptor
ntdll.dll	613		RtlAllocateHeap
ntdll.dll	949		RtlInitializeSid
ntdll.dll	1194		RtlSubAuthorityCountSid
ntdll.dll	700		RtlCreateSecurityDescriptor
ntdll.dll	1164		RtlSetOwnerSecurityDescriptor
ntdll.dll	618		RtlAnsiStringToUnicodeString
ntdll.dll	921		RtlInitAnsiString
ntdll.dll	1222		RtlUnicodeStringToAnsiString
ntdll.dll	66		EtwGetTraceEnableLevel
ntdll.dll	65		EtwGetTraceEnableFlags
ntdll.dll	74		EtwRegisterTraceGuidsW
ntdll.dll	1224		RtlUnicodeStringToInteger
profapi.dll		101
profapi.dll		102
profapi.dll		105
profapi.dll		106
API-MS-Win-Security-LSALookup-L1-1-0.dll	10		LsaLookupTranslateSids
API-MS-Win-Security-LSALookup-L1-1-0.dll	5		LsaLookupFreeMemory
API-MS-Win-Security-LSALookup-L1-1-0.dll	4		LsaLookupClose
API-MS-Win-Security-LSALookup-L1-1-0.dll	7		LsaLookupManageSidNameMapping
API-MS-Win-Security-LSALookup-L1-1-0.dll	6		LsaLookupGetDomainInfo
API-MS-Win-Security-LSALookup-L1-1-0.dll	9		LsaLookupTranslateNames
API-MS-Win-Security-LSALookup-L1-1-0.dll	8		LsaLookupOpenLocalPolicy
API-MS-Win-Security-SDDL-L1-1-0.dll	2		ConvertStringSecurityDescriptorToSecurityDescriptorW
API-MS-Win-Security-SDDL-L1-1-0.dll			ConvertSecurityDescriptorToStringSecurityDescriptorW
API-MS-Win-Security-SDDL-L1-1-0.dll	1		ConvertSidToStringSidW
CRYPTBASE.dll	6		SystemFunction029
CRYPTBASE.dll	4		SystemFunction005
API-MS-Win-Core-ErrorHandling-L1-1-0.dll	1		GetLastError
API-MS-Win-Core-ErrorHandling-L1-1-0.dll	4		SetLastError
API-MS-Win-Core-ErrorHandling-L1-1-0.dll	5		SetUnhandledExceptionFilter
API-MS-Win-Core-ErrorHandling-L1-1-0.dll	3		SetErrorMode
API-MS-Win-Core-ErrorHandling-L1-1-0.dll	6		UnhandledExceptionFilter
API-MS-Win-Core-File-L1-1-0.dll	66		SetFileInformationByHandle
API-MS-Win-Core-File-L1-1-0.dll	2		CreateDirectoryW
API-MS-Win-Core-File-L1-1-0.dll	18		FindFirstFileW
API-MS-Win-Core-File-L1-1-0.dll	4		CreateFileW
API-MS-Win-Core-File-L1-1-0.dll	11		FindClose
API-MS-Win-Core-File-L1-1-0.dll	22		FindNextFileW
API-MS-Win-Core-Handle-L1-1-0.dll	1		DuplicateHandle
API-MS-Win-Core-Handle-L1-1-0.dll			CloseHandle
API-MS-Win-Core-Heap-L1-1-0.dll	2		HeapAlloc
API-MS-Win-Core-Heap-L1-1-0.dll	6		HeapFree
API-MS-Win-Core-Heap-L1-1-0.dll	4		HeapCreate
API-MS-Win-Core-Heap-L1-1-0.dll	10		HeapSetInformation
API-MS-Win-Core-IO-L1-1-0.dll	2		DeviceIoControl
API-MS-Win-Core-LibraryLoader-L1-1-0.dll	11		GetModuleHandleW
API-MS-Win-Core-LibraryLoader-L1-1-0.dll	12		GetProcAddress
API-MS-Win-Core-LibraryLoader-L1-1-0.dll	14		LoadLibraryExW
API-MS-Win-Core-LibraryLoader-L1-1-0.dll	3		FreeLibrary
API-MS-Win-Core-LibraryLoader-L1-1-0.dll	17		LoadStringW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	25		RegOpenKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	30		RegQueryValueExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll			RegCloseKey
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	22		RegNotifyChangeKeyValue
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	35		RegSetKeySecurity
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	15		RegGetKeySecurity
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	21		RegLoadMUIStringW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	2		RegCreateKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	37		RegSetValueExW
API-MS-Win-Core-Misc-L1-1-0.dll	10		LocalAlloc
API-MS-Win-Core-Misc-L1-1-0.dll	11		LocalFree
API-MS-Win-Core-Misc-L1-1-0.dll	19		Sleep
API-MS-Win-Core-Misc-L1-1-0.dll	8		IsWow64Process
API-MS-Win-Core-Misc-L1-1-0.dll	33		lstrlenW
API-MS-Win-Core-ProcessEnvironment-L1-1-0.dll	12		GetEnvironmentVariableW
API-MS-Win-Core-ProcessEnvironment-L1-1-0.dll	1		ExpandEnvironmentStringsW
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	5		CreateThread
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	2		CreateProcessW
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	42		TerminateProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	13		GetCurrentThreadId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	17		GetProcessId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	28		OpenThreadToken
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	12		GetCurrentThread
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	10		GetCurrentProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	25		InitializeProcThreadAttributeList
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	48		UpdateProcThreadAttribute
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	6		DeleteProcThreadAttributeList
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	1		CreateProcessAsUserW
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	32		ResumeThread
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	26		OpenProcessToken
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	11		GetCurrentProcessId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	35		SetProcessShutdownParameters
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	8		ExitThread
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	36		SetThreadPriority
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	19		GetProcessTimes
API-MS-Win-Core-Profile-L1-1-0.dll			QueryPerformanceCounter
API-MS-Win-Core-String-L1-1-0.dll	2		CompareStringW
API-MS-Win-Core-Synch-L1-1-0.dll	15		InitializeCriticalSection
API-MS-Win-Core-Synch-L1-1-0.dll	14		EnterCriticalSection
API-MS-Win-Core-Synch-L1-1-0.dll	19		LeaveCriticalSection
API-MS-Win-Core-Synch-L1-1-0.dll	40		WaitForSingleObject
API-MS-Win-Core-Synch-L1-1-0.dll	32		SetEvent
API-MS-Win-Core-Synch-L1-1-0.dll	6		CreateEventW
API-MS-Win-Core-Synch-L1-1-0.dll	39		WaitForMultipleObjectsEx
API-MS-Win-Core-Synch-L1-1-0.dll	30		ResetEvent
API-MS-Win-Core-Synch-L1-1-0.dll	21		OpenEventW
API-MS-Win-Core-Synch-L1-1-0.dll	23		OpenProcess
API-MS-Win-Core-SysInfo-L1-1-0.dll	14		GetTickCount
API-MS-Win-Core-SysInfo-L1-1-0.dll	11		GetSystemTimeAsFileTime
API-MS-Win-Core-SysInfo-L1-1-0.dll	7		GetSystemDirectoryW
API-MS-Win-Core-SysInfo-L1-1-0.dll	1		GetComputerNameExW
API-MS-Win-Core-SysInfo-L1-1-0.dll	20		GetVersionExW
API-MS-Win-Core-SysInfo-L1-1-0.dll	9		GetSystemTime
API-MS-Win-Security-Base-L1-1-0.dll	48		GetSecurityDescriptorDacl
API-MS-Win-Security-Base-L1-1-0.dll	93		SetSecurityDescriptorOwner
API-MS-Win-Security-Base-L1-1-0.dll	64		InitializeSecurityDescriptor
API-MS-Win-Security-Base-L1-1-0.dll	38		EqualSid
API-MS-Win-Security-Base-L1-1-0.dll	19		AdjustTokenPrivileges
API-MS-Win-Security-Base-L1-1-0.dll	83		RevertToSelf
API-MS-Win-Security-Base-L1-1-0.dll	61		ImpersonateLoggedOnUser
API-MS-Win-Security-Base-L1-1-0.dll	26		CopySid
API-MS-Win-Security-Base-L1-1-0.dll	45		GetLengthSid
API-MS-Win-Security-Base-L1-1-0.dll	24		CheckTokenMembership
API-MS-Win-Security-Base-L1-1-0.dll	58		GetTokenInformation
API-MS-Win-Security-Base-L1-1-0.dll	63		InitializeAcl
API-MS-Win-Security-Base-L1-1-0.dll	13		AddAce
API-MS-Win-Security-Base-L1-1-0.dll	91		SetSecurityDescriptorDacl
API-MS-Win-Security-Base-L1-1-0.dll	21		AllocateLocallyUniqueId
API-MS-Win-Security-Base-L1-1-0.dll	20		AllocateAndInitializeSid
API-MS-Win-Security-Base-L1-1-0.dll	40		FreeSid
API-MS-Win-Security-Base-L1-1-0.dll	44		GetKernelObjectSecurity
API-MS-Win-Security-Base-L1-1-0.dll	86		SetKernelObjectSecurity
API-MS-Win-Security-Base-L1-1-0.dll	7		AddAccessAllowedAce
API-MS-Win-Security-Base-L1-1-0.dll	96		SetTokenInformation

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Services and Controller app
FileVersion	6.1.7600.16385 (win7_rtm.090713-1255)
InternalName	services.exe
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	services.exe
ProductName	Microsoft® Windows® Operating System
ProductVersion	6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion	6.1.7600.16385
ProductVersion	6.1.7600.16385
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	323120	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x2e0

services.exe- -

MZ Header

Rich Header

DOS stub

PE Header

Sections

Data Directory

StringTable 040904B0

VS_FIXEDFILEINFO

services.exe
-
-