filenameielowutil.exe
size221696 (0x36200)
md56d4e007e07cbd396f56e95756ab2eb09
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
243401161
241401162
2424011620
2394011619
10183
2474011617
237401161
240401161

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x55920082
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion12.10
SizeOfCode0x2000
SizeOfInitializedData0x34200
SizeOfUninitializedData0
AddressOfEntryPoint0x2880
BaseOfCode0x1000
BaseOfData0x3000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion10.0
ImageVersion10.0
SubsystemVersion6.1
Reserved10
SizeOfImage0x39000
SizeOfHeaders0x400
CheckSum0x439eb
Subsystem2
DllCharacteristics0xc140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x1eb40x2000R-X CODE
.data0x30000x4580x200RW- IDATA
.idata0x40000x89a0xa00R-- IDATA
.rsrc0x50000x32c980x32e00R-- IDATA
.reloc0x380000x29c0x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x41500x8c
RESOURCE0x50000x32c98
EXCEPTION00
SECURITY00
BASERELOC0x380000x29c
DEBUG0x13000x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x13580x40
Bound_IAT00
IAT0x40000x14c
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#116400
ICON#27440
ICON#34880
ICON#42960
ICON#537520
ICON#622160
ICON#717360
ICON#813840
ICON#9521730
ICON#10676240
ICON#11380560
ICON#12169360
ICON#1396400
ICON#1442640
ICON#1524400
ICON#1611280
GROUP_ICONIDI_APPICON2300
VERSION#19040
MANIFEST#113070
module_namehintordfunction_name
KERNEL32.dll616GetModuleHandleW
KERNEL32.dll670GetProcAddress
KERNEL32.dll827HeapSetInformation
KERNEL32.dll231CreateThread
KERNEL32.dll522GetCurrentProcess
KERNEL32.dll414FreeLibrary
KERNEL32.dll125CloseHandle
KERNEL32.dll1195ResetEvent
KERNEL32.dll1302SetLastError
KERNEL32.dll180CreateEventW
KERNEL32.dll593GetLastError
KERNEL32.dll1315SetProcessDEPPolicy
KERNEL32.dll1448VirtualAlloc
KERNEL32.dll676GetProcessHeap
KERNEL32.dll891IsWow64Process
KERNEL32.dll776GetVersionExA
KERNEL32.dll999OpenEventW
KERNEL32.dll1003OpenFileMappingW
KERNEL32.dll964MapViewOfFile
KERNEL32.dll939LoadLibraryExW
KERNEL32.dll612GetModuleFileNameW
KERNEL32.dll246DeactivateActCtx
KERNEL32.dll2ActivateActCtx
KERNEL32.dll1171ReleaseActCtx
KERNEL32.dll166CreateActCtxW
KERNEL32.dll1274SetEvent
KERNEL32.dll1465WaitForSingleObject
KERNEL32.dll823HeapFree
KERNEL32.dll819HeapAlloc
KERNEL32.dll1426UnmapViewOfFile
KERNEL32.dll1375Sleep
KERNEL32.dll704GetStartupInfoW
KERNEL32.dll1360SetUnhandledExceptionFilter
KERNEL32.dll613GetModuleHandleA
KERNEL32.dll1075QueryPerformanceCounter
KERNEL32.dll523GetCurrentProcessId
KERNEL32.dll527GetCurrentThreadId
KERNEL32.dll729GetSystemTimeAsFileTime
KERNEL32.dll758GetTickCount
KERNEL32.dll1423UnhandledExceptionFilter
KERNEL32.dll1390TerminateProcess
USER32.dll611MsgWaitForMultipleObjects
USER32.dll640PostQuitMessage
USER32.dll867TranslateMessage
USER32.dll182DispatchMessageW
USER32.dll635PeekMessageW
msvcrt.dll1309rand_s
msvcrt.dll1160_wtoi
msvcrt.dll1004_vsnwprintf
msvcrt.dll362_except_handler4_common
msvcrt.dll311_controlfp
msvcrt.dll53void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll1029_wcmdln
msvcrt.dll488_initterm
msvcrt.dll228__setusermatherr
msvcrt.dll206__p__fmode
msvcrt.dll292_cexit
msvcrt.dll371_exit
msvcrt.dll1198exit
msvcrt.dll226__set_app_type
msvcrt.dll241__wgetmainargs
msvcrt.dll273_amsg_exit
msvcrt.dll201__p__commode
msvcrt.dll111_XcptFilter
msvcrt.dll1414wcstok_s
msvcrt.dll1047_wcsnicmp
ole32.dll95CoInitializeSecurity
ole32.dll12CLSIDFromString
ole32.dll141CoUninitialize
ole32.dll115CoRegisterClassObject
ole32.dll127CoRevokeClassObject
ole32.dll40CoCreateInstance
ole32.dll94CoInitializeEx
WININET.dll180InternetGetCookieExW
WININET.dll212InternetSetCookieExW
iertutil.dll650
iertutil.dll466

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionInternet Low-Mic Utility Tool
FileVersion11.00.10162.0 (fbl_impressive.150629-1700)
InternalNameielowutil.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameielowutil.exe
ProductNameInternet Explorer
ProductVersion11.00.10162.0

VS_FIXEDFILEINFO

FileVersion11.0.10162.0
ProductVersion11.0.10162.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
0221696EXE06/30/2015 02:35:46#
15c115HTM#
692052173PNG(256 x 256)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER