filenameOSVolOSVol--Windows--System32--svchost.exe.fullextract
size28672 (0x7000)
md549138b9aa2ead2987c45d28e5675a200
typePE32+ executable (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
132307291
149307291
10121
1473072917
1313072919
1373072910
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x4a5bc3c1
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion9.0
SizeOfCode0x3200
SizeOfInitializedData0x3400
SizeOfUninitializedData0
AddressOfEntryPoint0x246c
BaseOfCode0x1000
ImageBase0x100000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0xb000
SizeOfHeaders0x600
CheckSum0x13157
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x80000
SizeOfStackCommit0x8000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x30a00x3200R-X CODE
.rdata0x50000x17f40x1800R-- IDATA
.data0x70000xaa00xa00RW- IDATA
.pdata0x80000x3fc0x400R-- IDATA
.rsrc0x90000x8180xa00R-- IDATA
.reloc0xa0000x540x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x58480xb4
RESOURCE0x90000x818
EXCEPTION0x80000x3fc
SECURITY00
BASERELOC0xa0000x54
DEBUG0x40400x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT0x2e00x124
IAT0x50000x358
Delay_IAT0x57640x40
CLR_Header00
typenamesizecp
MUI#12000
VERSION#19360
MANIFEST#16900
module_namehintordfunction_name
msvcrt.dll1152memcpy
msvcrt.dll48void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll128__set_app_type
msvcrt.dll280_fmode
msvcrt.dll196_commode
msvcrt.dll130__setusermatherr
msvcrt.dll160_amsg_exit
msvcrt.dll364_initterm
msvcrt.dll1056exit
msvcrt.dll179_cexit
msvcrt.dll255_exit
msvcrt.dll82_XcptFilter
msvcrt.dll83__C_specific_handler
msvcrt.dll143__wgetmainargs
msvcrt.dll1156memset
ntdll.dll1195RtlSubAuthoritySid
ntdll.dll1003RtlLengthRequiredSid
ntdll.dll842RtlFreeHeap
ntdll.dll679RtlCopySid
ntdll.dll613RtlAllocateHeap
ntdll.dll949RtlInitializeSid
ntdll.dll1194RtlSubAuthorityCountSid
ntdll.dll57EtwEventWrite
ntdll.dll915RtlImageNtHeader
ntdll.dll55EtwEventRegister
ntdll.dll1219RtlUnhandledExceptionFilter
ntdll.dll53EtwEventEnabled
ntdll.dll1166RtlSetProcessIsCritical
ntdll.dll635RtlCaptureContext
ntdll.dll1025RtlLookupFunctionEntry
ntdll.dll1264RtlVirtualUnwind
ntdll.dll937RtlInitializeCriticalSection
API-MS-Win-Core-ProcessThreads-L1-1-0.dll11GetCurrentProcessId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll42TerminateProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll10GetCurrentProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll26OpenProcessToken
API-MS-Win-Core-ProcessThreads-L1-1-0.dll13GetCurrentThreadId
KERNEL32.dll837LocalAlloc
KERNEL32.dll82CloseHandle
KERNEL32.dll841LocalFree
KERNEL32.dll290ExpandEnvironmentStringsW
KERNEL32.dll1308WideCharToMultiByte
KERNEL32.dll359FreeLibrary
KERNEL32.dll519GetLastError
KERNEL32.dll587GetProcAddress
KERNEL32.dll830LoadLibraryExA
KERNEL32.dll206DelayLoadFailureHook
KERNEL32.dll1212Sleep
KERNEL32.dll1199SetUnhandledExceptionFilter
KERNEL32.dll541GetModuleHandleW
KERNEL32.dll934QueryPerformanceCounter
KERNEL32.dll665GetTickCount
KERNEL32.dll639GetSystemTimeAsFileTime
KERNEL32.dll1246UnhandledExceptionFilter
KERNEL32.dll286ExitProcess
KERNEL32.dll396GetCommandLineW
KERNEL32.dll1123SetErrorMode
KERNEL32.dll831LoadLibraryExW
KERNEL32.dll592GetProcessHeap
KERNEL32.dll120CreateActCtxW
KERNEL32.dll745InitializeCriticalSection
KERNEL32.dll2ActivateActCtx
KERNEL32.dll997RegQueryValueExW
KERNEL32.dll826LeaveCriticalSection
KERNEL32.dll1361lstrcmpW
KERNEL32.dll1373lstrlenW
KERNEL32.dll196DeactivateActCtx
KERNEL32.dll1017ReleaseActCtx
KERNEL32.dll241EnterCriticalSection
KERNEL32.dll1161SetProcessAffinityUpdateMode
KERNEL32.dll1014RegisterWaitForSingleObjectEx
KERNEL32.dll992RegOpenKeyExW
KERNEL32.dll1364lstrcmpiW
KERNEL32.dll730HeapSetInformation
KERNEL32.dll974RegDisablePredefinedCacheEx
KERNEL32.dll965RegCloseKey
KERNEL32.dll814LCMapStringW
KERNEL32.dll726HeapFree
KERNEL32.dll722HeapAlloc
API-MS-Win-Security-Base-L1-1-0.dll91SetSecurityDescriptorDacl
API-MS-Win-Security-Base-L1-1-0.dll64InitializeSecurityDescriptor
API-MS-Win-Security-Base-L1-1-0.dll58GetTokenInformation
API-MS-Win-Security-Base-L1-1-0.dll92SetSecurityDescriptorGroup
API-MS-Win-Security-Base-L1-1-0.dll93SetSecurityDescriptorOwner
API-MS-Win-Security-Base-L1-1-0.dll7AddAccessAllowedAce
API-MS-Win-Security-Base-L1-1-0.dll45GetLengthSid
API-MS-Win-Security-Base-L1-1-0.dll63InitializeAcl
API-MS-WIN-Service-Core-L1-1-0.dll1SetServiceStatus
API-MS-WIN-Service-Core-L1-1-0.dll2StartServiceCtrlDispatcherW
API-MS-WIN-Service-winsvc-L1-1-0.dll23RegisterServiceCtrlHandlerW
RPCRT4.dll458RpcServerUnregisterIf
RPCRT4.dll469RpcServerUseProtseqEpW
RPCRT4.dll61I_RpcMapWin32Status
RPCRT4.dll424RpcMgmtSetServerStackSize
RPCRT4.dll453RpcServerRegisterIf
RPCRT4.dll426RpcMgmtStopServerListening
RPCRT4.dll427RpcMgmtWaitServerListen
RPCRT4.dll450RpcServerListen
RPCRT4.dll459RpcServerUnregisterIfEx

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionHost Process for Windows Services
FileVersion6.1.7600.16385 (win7_rtm.090713-1255)
InternalNamesvchost.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamesvchost.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion6.1.7600.16385
ProductVersion6.1.7600.16385
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d023088BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 28672 bytes (28 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x2e0