filenameEST2_0_UPD_F_windows_2_0_1606_1_42.exe
size26569216 (0x1956a00)
md5525be8d1c137432082248201a9eb1da6
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
1502041311
1493072928
1235072711
10182
1323072983
13130729204
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x547f2e03
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x2d200
SizeOfInitializedData0x2c200
SizeOfUninitializedData0
AddressOfEntryPoint0x1b114
BaseOfCode0x1000
BaseOfData0x2f000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x5c000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x50000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x2d1660x2d200R-X CODE
.rdata0x2f0000xbb880xbc00R-- IDATA
.data0x3b0000x154c40x1e00RW- IDATA
.rsrc0x510000x80000x8000R-- IDATA
.reloc0x590000x2e520x3000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x39c040x78
RESOURCE0x510000x8000
EXCEPTION00
SECURITY00
BASERELOC0x590000x1fe8
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x38aa80x40
Bound_IAT00
IAT0x2f0000x2b8
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#12960
ICON#213840
ICON#317360
ICON#47440
ICON#522160
ICON#637520
ICON#711280
ICON#824400
ICON#942640
ICON#1096400
DIALOG#1013020
DIALOG#1032860
DIALOG#1042260
GROUP_ICON#10011460
VERSION#17761200
MANIFEST#111770
module_namehintordfunction_name
USER32.dll630SetDlgItemTextA
USER32.dll683SetWindowTextA
USER32.dll165DialogBoxParamA
USER32.dll211EndDialog
USER32.dll287GetDlgItem
USER32.dll142DefDlgProcA
USER32.dll470LoadIconA
USER32.dll466LoadCursorA
USER32.dll563RegisterClassA
USER32.dll601SendDlgItemMessageA
USER32.dll238ExitWindowsEx
USER32.dll235EnumWindows
USER32.dll445IsIconic
USER32.dll696ShowWindow
USER32.dll634SetForegroundWindow
USER32.dll312GetLastActivePopup
USER32.dll458IsWindowVisible
USER32.dll400GetWindowThreadProcessId
USER32.dll240FindWindowA
USER32.dll341GetParent
USER32.dll284GetDesktopWindow
USER32.dll392GetWindowRect
USER32.dll79CopyRect
USER32.dll526OffsetRect
USER32.dll679SetWindowPos
USER32.dll504MessageBoxA
USER32.dll511MessageBoxW
ADVAPI32.dll30AdjustTokenPrivileges
ADVAPI32.dll631RegSetValueExA
ADVAPI32.dll562RegCreateKeyExA
ADVAPI32.dll577RegDeleteValueA
ADVAPI32.dll497OpenProcessToken
ADVAPI32.dll400LookupPrivilegeValueA
ADVAPI32.dll554RegCloseKey
ADVAPI32.dll584RegEnumKeyExA
ADVAPI32.dll602RegOpenKeyExA
ADVAPI32.dll615RegQueryValueExA
COMCTL32.dll17
COMDLG32.dll11GetOpenFileNameA
KERNEL32.dll857QueryPerformanceCounter
KERNEL32.dll698InitializeCriticalSectionAndSpinCount
KERNEL32.dll443GetDriveTypeA
KERNEL32.dll463GetFileAttributesW
KERNEL32.dll1164WriteConsoleA
KERNEL32.dll985SetEnvironmentVariableW
KERNEL32.dll761LoadLibraryW
KERNEL32.dll744LCMapStringW
KERNEL32.dll736IsValidCodePage
KERNEL32.dll532GetOEMCP
KERNEL32.dll339GetACP
KERNEL32.dll1030SetStdHandle
KERNEL32.dll742LCMapStringA
KERNEL32.dll576GetStringTypeA
KERNEL32.dll579GetStringTypeW
KERNEL32.dll489GetLocaleInfoA
KERNEL32.dll83CompareStringA
KERNEL32.dll86CompareStringW
KERNEL32.dll981SetEndOfFile
KERNEL32.dll623GetTimeZoneInformation
KERNEL32.dll926SearchPathA
KERNEL32.dll128CreateFileW
KERNEL32.dll999SetFilePointer
KERNEL32.dll487GetLastError
KERNEL32.dll1175WriteFile
KERNEL32.dll878ReadFile
KERNEL32.dll546GetProcAddress
KERNEL32.dll758LoadLibraryA
KERNEL32.dll626GetUserDefaultLCID
KERNEL32.dll68CloseHandle
KERNEL32.dll121CreateFileA
KERNEL32.dll109CreateDirectoryA
KERNEL32.dll499GetLongPathNameW
KERNEL32.dll261ExitProcess
KERNEL32.dll899RemoveDirectoryA
KERNEL32.dll282FindClose
KERNEL32.dll303FindNextFileA
KERNEL32.dll193DeleteFileA
KERNEL32.dll286FindFirstFileA
KERNEL32.dll1156WideCharToMultiByte
KERNEL32.dll799MultiByteToWideChar
KERNEL32.dll20AreFileApisANSI
KERNEL32.dll293FindFirstFileW
KERNEL32.dll570GetShortPathNameA
KERNEL32.dll501GetModuleFileNameA
KERNEL32.dll571GetShortPathNameW
KERNEL32.dll502GetModuleFileNameW
KERNEL32.dll645GetWindowsDirectoryA
KERNEL32.dll496GetLongPathNameA
KERNEL32.dll451GetEnvironmentVariableA
KERNEL32.dll606GetTempPathA
KERNEL32.dll646GetWindowsDirectoryW
KERNEL32.dll452GetEnvironmentVariableW
KERNEL32.dll607GetTempPathW
KERNEL32.dll604GetTempFileNameA
KERNEL32.dll480GetFullPathNameW
KERNEL32.dll477GetFullPathNameA
KERNEL32.dll332FreeEnvironmentStringsW
KERNEL32.dll450GetEnvironmentStringsW
KERNEL32.dll331FreeEnvironmentStringsA
KERNEL32.dll448GetEnvironmentStrings
KERNEL32.dll410GetConsoleOutputCP
KERNEL32.dll213DuplicateHandle
KERNEL32.dll426GetCurrentProcess
KERNEL32.dll1079TerminateProcess
KERNEL32.dll454GetExitCodeProcess
KERNEL32.dll1134WaitForSingleObject
KERNEL32.dll149CreateProcessA
KERNEL32.dll984SetEnvironmentVariableA
KERNEL32.dll550GetProcessHeap
KERNEL32.dll196DeleteFileW
KERNEL32.dll218EnterCriticalSection
KERNEL32.dll697InitializeCriticalSection
KERNEL32.dll756LeaveCriticalSection
KERNEL32.dll427GetCurrentProcessId
KERNEL32.dll1067Sleep
KERNEL32.dll500GetMailslotInfo
KERNEL32.dll164CreateThread
KERNEL32.dll137CreateMailslotA
KERNEL32.dll369GetCommandLineW
KERNEL32.dll154CreateSemaphoreA
KERNEL32.dll1066SizeofResource
KERNEL32.dll780LockResource
KERNEL32.dll763LoadResource
KERNEL32.dll311FindResourceA
KERNEL32.dll969SetConsoleTitleA
KERNEL32.dll618GetTickCount
KERNEL32.dll415GetConsoleTitleA
KERNEL32.dll15AllocConsole
KERNEL32.dll503GetModuleHandleA
KERNEL32.dll152CreateProcessW
KERNEL32.dll975SetCurrentDirectoryW
KERNEL32.dll1045SetThreadPriority
KERNEL32.dll974SetCurrentDirectoryA
KERNEL32.dll424GetCurrentDirectoryA
KERNEL32.dll1096UnhandledExceptionFilter
KERNEL32.dll1055SetUnhandledExceptionFilter
KERNEL32.dll726IsDebuggerPresent
KERNEL32.dll864RaiseException
KERNEL32.dll922RtlUnwind
KERNEL32.dll595GetSystemTimeAsFileTime
KERNEL32.dll114CreateDirectoryW
KERNEL32.dll902RemoveDirectoryW
KERNEL32.dll674HeapAlloc
KERNEL32.dll678HeapFree
KERNEL32.dll1174WriteConsoleW
KERNEL32.dll472GetFileType
KERNEL32.dll574GetStdHandle
KERNEL32.dll506GetModuleHandleW
KERNEL32.dll368GetCommandLineA
KERNEL32.dll572GetStartupInfoA
KERNEL32.dll1086TlsGetValue
KERNEL32.dll1084TlsAlloc
KERNEL32.dll1087TlsSetValue
KERNEL32.dll1085TlsFree
KERNEL32.dll709InterlockedIncrement
KERNEL32.dll1012SetLastError
KERNEL32.dll430GetCurrentThreadId
KERNEL32.dll705InterlockedDecrement
KERNEL32.dll683HeapSize
KERNEL32.dll388GetConsoleCP
KERNEL32.dll406GetConsoleMode
KERNEL32.dll322FlushFileBuffers
KERNEL32.dll191DeleteCriticalSection
KERNEL32.dll1008SetHandleCount
KERNEL32.dll1121VirtualFree
KERNEL32.dll1118VirtualAlloc
KERNEL32.dll681HeapReAlloc
KERNEL32.dll676HeapCreate
KERNEL32.dll348GetCPInfo

StringTable 000004b0

CompanyNameInnovapost
FileDescriptionEST Desktop 2.0
FileVersion2.0.1606.1.42
LegalCopyrightInnovapost
ProductNameEST Desktop 2.0
ProductVersion2.0.1606.1.42
OriginalFilenameEST2_0_UPD_F_windows_2_0_1606_1_42.exe
InternalNameEST2_0_UPD_F

VS_FIXEDFILEINFO

FileVersion2.0.1606.1
ProductVersion2.0.1606.1
StrucVersion0x10000
FileFlagsMask0x17
FileFlags1
FileOS4
FileType0
FileSubtype0
offsetsizetypecomment
0286720EXE12/03/2014 15:36:35#
15c115HTM#
1132a8275251ZIP#
1565db25166683JAR#
1956936202BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 26569216 bytes (26 MiB)


--
Type = zip
WARNINGS:
There are data after the end of archive
Offset = 1127080
Physical Size = 275251
Tail Size = 25166885

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2016-06-15 16:48:24 D....            0            0  .install4j\
2016-06-15 16:48:24 .....       227328       119793  .install4j/EST Updater.exe
2016-06-15 16:48:24 .....       310272       155066  uninstall.exe
------------------- ----- ------------ ------------  ------------------------
2016-06-15 16:48:24             537600       274859  2 files, 1 folders

Warnings: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK