filenamerms.exe
size7613174 (0x742af6)
md50c821d96057a59ac9b85103f56abc9ae
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x60
blocks_in_file1
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x60

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 52 65  |........!..L.!Re|
00000010: 71 75 69 72 65 20 57 69  6e 64 6f 77 73 0d 0a 24  |quire Windows..$|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4db951ac
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion8.0
SizeOfCode0x11800
SizeOfInitializedData0x12200
SizeOfUninitializedData0
AddressOfEntryPoint0x121cf
BaseOfCode0x1000
BaseOfData0x13000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x29000
SizeOfHeaders0x200
CheckSum0x29174
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x117130x11800R-X CODE
.rdata0x130000x30ee0x3200R-- IDATA
.data0x170000x292c0x800RW- IDATA
.rsrc0x1a0000xf0000xe800R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x150b40xb4
RESOURCE0x1a0000xe800
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x130000x314
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#137520
ICON#222160
ICON#313840
ICON#42961252
ICON#5343830
ICON#696400
ICON#742640
ICON#811280
GROUP_ICON#1011040
VERSION#17321252
MANIFEST#18491252
module_namehintordfunction_name
COMCTL32.dll17
SHELL32.dll225SHGetSpecialFolderPathW
SHELL32.dll289ShellExecuteExW
SHELL32.dll207SHGetMalloc
SHELL32.dll215SHGetPathFromIDListW
SHELL32.dll123SHBrowseForFolderW
SHELL32.dll189SHGetFileInfoW
SHELL32.dll290ShellExecuteW
GDI32.dll64CreateFontIndirectW
GDI32.dll230DeleteObject
GDI32.dll459GetDeviceCaps
GDI32.dll509GetObjectW
GDI32.dll48CreateCompatibleDC
GDI32.dll631SelectObject
GDI32.dll47CreateCompatibleBitmap
GDI32.dll674SetStretchBltMode
GDI32.dll227DeleteDC
GDI32.dll452GetCurrentObject
GDI32.dll691StretchBlt
USER32.dll412GetWindowRect
USER32.dll621ScreenToClient
USER32.dll110CreateWindowExW
USER32.dll419GetWindowTextW
USER32.dll349GetMessageW
USER32.dll356GetParent
USER32.dll483KillTimer
USER32.dll166DestroyWindow
USER32.dll60CharUpperW
USER32.dll218EndDialog
USER32.dll636SendMessageW
USER32.dll819wsprintfW
USER32.dll84CopyImage
USER32.dll613ReleaseDC
USER32.dll402GetWindowDC
USER32.dll710SetWindowPos
USER32.dll331GetMenu
USER32.dll406GetWindowLongW
USER32.dll175DispatchMessageW
USER32.dll418GetWindowTextLengthW
USER32.dll379GetSysColor
USER32.dll715SetWindowTextW
USER32.dll526MessageBoxA
USER32.dll818wsprintfA
USER32.dll317GetKeyState
USER32.dll295GetDlgItem
USER32.dll276GetClientRect
USER32.dll382GetSystemMetrics
USER32.dll708SetWindowLongW
USER32.dll658SetFocus
USER32.dll748SystemParametersInfoW
USER32.dll735ShowWindow
USER32.dll208DrawTextW
USER32.dll289GetDC
USER32.dll71ClientToScreen
USER32.dll398GetWindow
USER32.dll170DialogBoxIndirectParamW
USER32.dll200DrawIconEx
USER32.dll30CallWindowProcW
USER32.dll156DefWindowProcW
USER32.dll475IsWindow
USER32.dll821wvsprintfW
USER32.dll495LoadImageW
USER32.dll493LoadIconW
USER32.dll525MessageBeep
USER32.dll216EnableWindow
USER32.dll214EnableMenuItem
USER32.dll381GetSystemMenu
USER32.dll273GetClassNameA
USER32.dll699SetTimer
ole32.dll134CreateStreamOnHGlobal
ole32.dll16CoCreateInstance
ole32.dll62CoInitialize
OLEAUT32.dll2
OLEAUT32.dll9
OLEAUT32.dll418
KERNEL32.dll1107SetEndOfFile
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll1271WaitForMultipleObjects
KERNEL32.dll209DeleteCriticalSection
KERNEL32.dll533GetModuleHandleA
KERNEL32.dll1130SetFileTime
KERNEL32.dll960ReadFile
KERNEL32.dll1126SetFilePointer
KERNEL32.dll496GetFileSize
KERNEL32.dll624GetSystemDirectoryW
KERNEL32.dll350FormatMessageW
KERNEL32.dll1352lstrcpyW
KERNEL32.dll840LocalFree
KERNEL32.dll759IsBadReadPtr
KERNEL32.dll1210SuspendThread
KERNEL32.dll1043ResumeThread
KERNEL32.dll1217TerminateThread
KERNEL32.dll738InitializeCriticalSection
KERNEL32.dll1039ResetEvent
KERNEL32.dll1113SetEvent
KERNEL32.dll133CreateEventW
KERNEL32.dll676GetVersionExW
KERNEL32.dll391GetCommandLineW
KERNEL32.dll532GetModuleFileNameW
KERNEL32.dll1101SetCurrentDirectoryW
KERNEL32.dll467GetDriveTypeW
KERNEL32.dll143CreateFileW
KERNEL32.dll82CloseHandle
KERNEL32.dll1111SetEnvironmentVariableW
KERNEL32.dll645GetTempPathW
KERNEL32.dll1358lstrlenW
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll96CompareFileTime
KERNEL32.dll1175SetThreadLocale
KERNEL32.dll313FindFirstFileW
KERNEL32.dll214DeleteFileW
KERNEL32.dll325FindNextFileW
KERNEL32.dll302FindClose
KERNEL32.dll1027RemoveDirectoryW
KERNEL32.dll285ExpandEnvironmentStringsW
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll1257VirtualAlloc
KERNEL32.dll704GlobalMemoryStatusEx
KERNEL32.dll1346lstrcmpW
KERNEL32.dll476GetEnvironmentVariableW
KERNEL32.dll1349lstrcmpiW
KERNEL32.dll1357lstrlenA
KERNEL32.dll518GetLocaleInfoW
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll670GetUserDefaultUILanguage
KERNEL32.dll622GetSystemDefaultUILanguage
KERNEL32.dll619GetSystemDefaultLCID
KERNEL32.dll1348lstrcmpiA
KERNEL32.dll691GlobalAlloc
KERNEL32.dll698GlobalFree
KERNEL32.dll870MulDiv
KERNEL32.dll332FindResourceExA
KERNEL32.dll1201SizeofResource
KERNEL32.dll833LoadResource
KERNEL32.dll852LockResource
KERNEL32.dll828LoadLibraryA
KERNEL32.dll581GetProcAddress
KERNEL32.dll536GetModuleHandleW
KERNEL32.dll1260VirtualFree
KERNEL32.dll612GetStdHandle
KERNEL32.dll281ExitProcess
KERNEL32.dll1343lstrcatW
KERNEL32.dll462GetDiskFreeSpaceExW
KERNEL32.dll1121SetFileAttributesW
KERNEL32.dll1139SetLastError
KERNEL32.dll1202Sleep
KERNEL32.dll480GetExitCodeThread
KERNEL32.dll1273WaitForSingleObject
KERNEL32.dll181CreateThread
KERNEL32.dll514GetLastError
KERNEL32.dll1213SystemTimeToFileTime
KERNEL32.dll515GetLocalTime
KERNEL32.dll490GetFileAttributesW
KERNEL32.dll129CreateDirectoryW
KERNEL32.dll1317WriteFile
KERNEL32.dll610GetStartupInfoA
MSVCRT.dll15void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCRT.dll402_purecall
MSVCRT.dll662memcmp
MSVCRT.dll606free
MSVCRT.dll663memcpy
MSVCRT.dll183_controlfp
MSVCRT.dll202_except_handler3
MSVCRT.dll129__set_app_type
MSVCRT.dll111__p__fmode
MSVCRT.dll106__p__commode
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll131__setusermatherr
MSVCRT.dll271_initterm
MSVCRT.dll88__getmainargs
MSVCRT.dll143_acmdln
MSVCRT.dll585exit
MSVCRT.dll72_XcptFilter
MSVCRT.dll211_exit
MSVCRT.dll14public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

MSVCRT.dll390_onexit
MSVCRT.dll85__dllonexit
MSVCRT.dll65_CxxThrowException
MSVCRT.dll166_beginthreadex
MSVCRT.dll66_EH_prolog
MSVCRT.dll37int (__cdecl*__cdecl _set_new_handler(int (__cdecl*)(unsigned int)))(unsigned int)

?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z

MSVCRT.dll665memset
MSVCRT.dll494_wcsnicmp
MSVCRT.dll704strncmp
MSVCRT.dll657malloc
MSVCRT.dll664memmove
MSVCRT.dll558_wtol
MSVCRT.dll16void __cdecl operator delete(void *)

??3@YAXPAX@Z

StringTable 000004b0

CompanyNameTektonIT
FileDescriptionRMS Component
FileVersion5.5
InternalName
LegalCopyrightCopyright © 2013 TektonIT. All rights reserved.
OriginalFilenameRMS Module
PrivateBuild
ProductNameRMS
ProductVersion5.5

VS_FIXEDFILEINFO

FileVersion5.5.2.0
ProductVersion5.5.2.0
StrucVersion0x10000
FileFlagsMask8
FileFlags8
FileOS0x50004
FileType1
FileSubtype0
offsetsizetypecomment
0146432EXE04/28/2011 11:38:20#
15c115HTM#
1746034383PNG(256 x 256)#
23c007466742BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 7613174 bytes (7435 KiB)


--
Type = 7z
Offset = 146563
Physical Size = 7466611
Headers Size = 268
Method = LZMA:23 BCJ
Solid = -
Blocks = 4

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2013-09-03 20:07:21 ....A         3090          637  28.reg
2014-06-08 16:27:02 ....A      8320512      7458101  rms.host5.5ru.msi
2014-06-09 16:35:05 ....A          823          385  install.cmd
2013-09-03 17:22:29 ....A        22016         7220  winmm.dll
------------------- ----- ------------ ------------  ------------------------
2014-06-09 16:35:05            8346441      7466343  4 files
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







[?] ignoring invalid PEdump::BITMAPINFOHEADER