filenametzupd.exe
size40448 (0x9e00)
md51c45fe48852bf6c4909aa42053e87514
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd8

Rich Header

lib idversiontimes used
149307294
1313072923
147307299
1088
132307294
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4e17bd5d
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x8600
SizeOfInitializedData0x1a00
SizeOfUninitializedData0
AddressOfEntryPoint0x6508
BaseOfCode0x1000
BaseOfData0xa000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0xd000
SizeOfHeaders0x400
CheckSum0xdb9e
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x856c0x8600R-X CODE
.data0xa0000x6c80x200RW- IDATA
.rsrc0xb0000x4100x600R-- IDATA
.reloc0xc0000xaec0xc00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x8e1c0x64
RESOURCE0xb0000x410
EXCEPTION00
SECURITY00
BASERELOC0xc0000x97c
DEBUG0x11600x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x55d00x40
Bound_IAT0x2700x6c
IAT0x10000x144
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#19400
module_namehintordfunction_name
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll407LookupPrivilegeValueW
ADVAPI32.dll503OpenProcessToken
ADVAPI32.dll598RegGetValueW
ADVAPI32.dll638RegSetValueExW
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll591RegEnumKeyExW
KERNEL32.dll449GetCurrentProcess
KERNEL32.dll514GetLocalTime
KERNEL32.dll471GetDynamicTimeZoneInformation
KERNEL32.dll1108SetDynamicTimeZoneInformation
KERNEL32.dll101CompareStringW
KERNEL32.dll282ExitProcess
KERNEL32.dll724HeapSetInformation
KERNEL32.dll1054SearchPathW
KERNEL32.dll670GetUserDefaultUILanguage
KERNEL32.dll622GetSystemDefaultUILanguage
KERNEL32.dll513GetLastError
KERNEL32.dll355FreeLibrary
KERNEL32.dll517GetLocaleInfoW
KERNEL32.dll676GetVersionExW
KERNEL32.dll144CreateFileW
KERNEL32.dll141CreateFileMappingW
KERNEL32.dll855MapViewOfFile
KERNEL32.dll831LoadLibraryExW
KERNEL32.dll1140SetLastError
KERNEL32.dll624GetSystemDirectoryW
KERNEL32.dll334FindResourceExW
KERNEL32.dll834LoadResource
KERNEL32.dll852LockResource
KERNEL32.dll664GetTimeZoneInformation
KERNEL32.dll239EnterCriticalSection
KERNEL32.dll826LeaveCriticalSection
KERNEL32.dll210DeleteCriticalSection
KERNEL32.dll83CloseHandle
KERNEL32.dll1241UnmapViewOfFile
KERNEL32.dll749InterlockedExchange
KERNEL32.dll1205Sleep
KERNEL32.dll746InterlockedCompareExchange
KERNEL32.dll1191SetUnhandledExceptionFilter
KERNEL32.dll532GetModuleHandleA
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll659GetTickCount
KERNEL32.dll454GetCurrentThreadId
KERNEL32.dll450GetCurrentProcessId
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll1219TerminateProcess
KERNEL32.dll1238UnhandledExceptionFilter
KERNEL32.dll740InitializeCriticalSection
msvcrt.dll295_controlfp
msvcrt.dll345_except_handler4_common
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll210__set_app_type
msvcrt.dll190__p__fmode
msvcrt.dll185__p__commode
msvcrt.dll212__setusermatherr
msvcrt.dll257_amsg_exit
msvcrt.dll469_initterm
msvcrt.dll1167exit
msvcrt.dll106_XcptFilter
msvcrt.dll354_exit
msvcrt.dll276_cexit
msvcrt.dll145__getmainargs
msvcrt.dll1262memset
msvcrt.dll1392wprintf
msvcrt.dll1007_wcsicmp
msvcrt.dll564_itow_s
msvcrt.dll1129_wtoi
msvcrt.dll1361wcschr
msvcrt.dll974_vsnwprintf
msvcrt.dll1371wcsncmp
msvcrt.dll1017_wcsnicmp
msvcrt.dll1258memcpy
msvcrt.dll1154bsearch
USER32.dll21BroadcastSystemMessageW

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionMicrosoft timezone refresh utility
FileVersion6.1.7601.17647 (win7sp1_gdr.110708-1503)
InternalNametzupd.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenametzupd.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7601.17647

VS_FIXEDFILEINFO

FileVersion6.1.7601.17647
ProductVersion6.1.7601.17647
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
040448EXE07/09/2011 02:30:53#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x270