filenameW10DigitalActivation.unpacked.exe_1826159_1286656.exe
size1286656 (0x13a200)
md5071d161803dfe00513c42fab91a0db21
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
259243252
260243251
2602571123
10140
257257119
261257112
2652571127
2592571111
255257111
258257111

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x54ceb13c
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion14.12
SizeOfCode0x133400
SizeOfInitializedData0x6e00
SizeOfUninitializedData0
AddressOfEntryPoint0xd33e0
BaseOfCode0x1000
BaseOfData0x135000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion10.0
ImageVersion21315.20512
SubsystemVersion6.0
Reserved10
SizeOfImage0x13f000
SizeOfHeaders0x400
CheckSum0x14c0c9
Subsystem2
DllCharacteristics0xc140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x1332bc0x133400R-X CODE
.data0x1350000x7080x400RW- IDATA
.idata0x1360000xa060xc00R-- IDATA
.didat0x1370000x900x200RW- IDATA
.rsrc0x1380000x4280x600R-- IDATA
.reloc0x1390000x50400x5200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x1361900x64
RESOURCE0x1380000x428
EXCEPTION00
SECURITY0x13a2000x8838
BASERELOC0x1390000x5040
DEBUG0x68f100x54
ARCHITECTURE00
GLOBALPTR00
TLS0x8dc80x18
LOAD_CONFIG0x8d280x40
Bound_IAT00
IAT0x1360000x18c
Delay_IAT0x133ebc0xc0
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x533e100x533e180x5356140x408e1400x300000
typenamesizecp
VERSION#19680
module_namehintordfunction_name
msvcrt.dll1289memcpy
msvcrt.dll1288memcmp
msvcrt.dll311_controlfp
msvcrt.dll53void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll362_except_handler4_common
msvcrt.dll777_onexit
msvcrt.dll157__dllonexit
msvcrt.dll964_unlock
msvcrt.dll608_lock
msvcrt.dll488_initterm
msvcrt.dll228__setusermatherr
msvcrt.dll206__p__fmode
msvcrt.dll1287memchr
msvcrt.dll1392wcschr
msvcrt.dll1047_wcsnicmp
msvcrt.dll1290memcpy_s
msvcrt.dll292_cexit
msvcrt.dll371_exit
msvcrt.dll1198exit
msvcrt.dll226__set_app_type
msvcrt.dll241__wgetmainargs
msvcrt.dll273_amsg_exit
msvcrt.dll201__p__commode
msvcrt.dll111_XcptFilter
msvcrt.dll794_purecall
msvcrt.dll1277malloc
msvcrt.dll1221free
msvcrt.dll1411wcsstr
msvcrt.dll1037_wcsicmp
msvcrt.dll1291memmove
msvcrt.dll1004_vsnwprintf
msvcrt.dll1423wprintf
msvcrt.dll1293memset
ntdll.dll746RtlCaptureContext
KERNEL32.dll732GetSystemDirectoryW
KERNEL32.dll425FreeLibrary
KERNEL32.dll283DeviceIoControl
KERNEL32.dll1000MultiByteToWideChar
KERNEL32.dll790GetVersionExA
KERNEL32.dll908IsWow64Process
KERNEL32.dll940LCMapStringW
KERNEL32.dll730GetSystemDefaultUILanguage
KERNEL32.dll822GlobalMemoryStatusEx
KERNEL32.dll952LeaveCriticalSection
KERNEL32.dll267DelayLoadFailureHook
KERNEL32.dll837HeapFree
KERNEL32.dll1546WriteFile
KERNEL32.dll627GetModuleHandleExW
KERNEL32.dll352ExpandEnvironmentStringsW
KERNEL32.dll624GetModuleFileNameW
KERNEL32.dll1293SetErrorMode
KERNEL32.dll965LocalAlloc
KERNEL32.dll202CreateFileW
KERNEL32.dll577GetFileAttributesW
KERNEL32.dll791GetVersionExW
KERNEL32.dll605GetLastError
KERNEL32.dll360FileTimeToSystemTime
KERNEL32.dll134CloseHandle
KERNEL32.dll833HeapAlloc
KERNEL32.dll682GetProcAddress
KERNEL32.dll969LocalFree
KERNEL32.dll688GetProcessHeap
KERNEL32.dll1526WideCharToMultiByte
KERNEL32.dll741GetSystemTimeAsFileTime
KERNEL32.dll739GetSystemTime
KERNEL32.dll1476VirtualProtect
KERNEL32.dll1322SetLastError
KERNEL32.dll303EnterCriticalSection
KERNEL32.dll1473VirtualFree
KERNEL32.dll533GetCurrentProcess
KERNEL32.dll1470VirtualAlloc
KERNEL32.dll1412TerminateProcess
KERNEL32.dll771GetTickCount
KERNEL32.dll857InitializeCriticalSection
KERNEL32.dll537GetCurrentThread
KERNEL32.dll270DeleteCriticalSection
KERNEL32.dll1445UnhandledExceptionFilter
KERNEL32.dll628GetModuleHandleW
KERNEL32.dll958LoadLibraryExW
KERNEL32.dll1381SetUnhandledExceptionFilter
KERNEL32.dll1397Sleep
KERNEL32.dll1094QueryPerformanceCounter
KERNEL32.dll534GetCurrentProcessId
KERNEL32.dll538GetCurrentThreadId
KERNEL32.dll957LoadLibraryExA
ADVAPI32.dll220CryptReleaseContext
ADVAPI32.dll199CryptDestroyHash
ADVAPI32.dll217CryptHashData
ADVAPI32.dll196CryptCreateHash
ADVAPI32.dll194CryptAcquireContextW
ADVAPI32.dll316GetCurrentHwProfileW
ADVAPI32.dll603RegCloseKey
ADVAPI32.dll665RegQueryValueExW
ADVAPI32.dll652RegOpenKeyExW
ADVAPI32.dll213CryptGetHashParam

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionGather Downlevel OS Activation State
FileVersion10.0.17134.1 (WinBuild.160101.0800)
InternalNameGatherOsState
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameGatherOsState.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion10.0.17134.1

VS_FIXEDFILEINFO

FileVersion10.0.17134.1
ProductVersion10.0.17134.1
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
01286656EXE02/01/2015 23:05:32#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x135614