filenamevol2-C..WINNT.system32.os2.dll.update.exe
size122880 (0x1e000)
md57882f377e64f0f362062e6d2fff71f12
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
1272911
1180471
14729921
10804790
10116
2592107
1089662
617351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x3c7aa42e
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x8000
SizeOfInitializedData0x2b000
SizeOfUninitializedData0
AddressOfEntryPoint0x3597
BaseOfCode0x1000
BaseOfData0x9000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x34000
SizeOfHeaders0x1000
CheckSum0
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x7c360x8000R-X CODE
.rdata0x90000xfec0x1000R-- IDATA
.data0xa0000x196c40x4000RW- IDATA
.rsrc0x240000xf4280x10000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x97500x50
RESOURCE0x240000xf428
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x90000x188
Delay_IAT00
CLR_Header00
typenamesizecp
BINRESPSEXESVC614400
VERSION#18720
module_namehintordfunction_name
MPR.dll6WNetAddConnection2A
KERNEL32.dll212FindResourceA
KERNEL32.dll809Sleep
KERNEL32.dll120DeleteFileA
KERNEL32.dll303GetCurrentProcess
KERNEL32.dll748SetEvent
KERNEL32.dll328GetFileAttributesA
KERNEL32.dll129DisconnectNamedPipe
KERNEL32.dll886WriteFile
KERNEL32.dll644ReadConsoleA
KERNEL32.dll869WaitForSingleObject
KERNEL32.dll414GetStdHandle
KERNEL32.dll563LoadResource
KERNEL32.dll867WaitForMultipleObjects
KERNEL32.dll736SetConsoleTitleA
KERNEL32.dll827TransactNamedPipe
KERNEL32.dll304GetCurrentProcessId
KERNEL32.dll58CopyFileA
KERNEL32.dll712SetConsoleCtrlHandler
KERNEL32.dll70CreateEventA
KERNEL32.dll322GetEnvironmentVariableA
KERNEL32.dll339GetFullPathNameA
KERNEL32.dll253GetCommandLineA
KERNEL32.dll455GetVersion
KERNEL32.dll257GetComputerNameA
KERNEL32.dll808SizeofResource
KERNEL32.dll577LockResource
KERNEL32.dll224FormatMessageA
KERNEL32.dll568LocalFree
KERNEL32.dll74CreateFileA
KERNEL32.dll44CloseHandle
KERNEL32.dll446GetTickCount
KERNEL32.dll346GetLastError
KERNEL32.dll766SetLastError
KERNEL32.dll656ReadFile
KERNEL32.dll684ResumeThread
KERNEL32.dll645ReadConsoleInputA
KERNEL32.dll727SetConsoleMode
KERNEL32.dll288GetConsoleMode
KERNEL32.dll139EnterCriticalSection
KERNEL32.dll557LeaveCriticalSection
KERNEL32.dll501HeapFree
KERNEL32.dll495HeapAlloc
KERNEL32.dll101CreateThread
KERNEL32.dll825TlsSetValue
KERNEL32.dll172ExitThread
KERNEL32.dll171ExitProcess
KERNEL32.dll817TerminateProcess
KERNEL32.dll514InitializeCriticalSection
KERNEL32.dll118DeleteCriticalSection
KERNEL32.dll219FlushFileBuffers
KERNEL32.dll762SetHandleCount
KERNEL32.dll336GetFileType
KERNEL32.dll412GetStartupInfoA
KERNEL32.dll359GetModuleHandleA
KERNEL32.dll357GetModuleFileNameA
KERNEL32.dll456GetVersionExA
KERNEL32.dll499HeapDestroy
KERNEL32.dll497HeapCreate
KERNEL32.dll856VirtualFree
KERNEL32.dll853VirtualAlloc
KERNEL32.dll505HeapReAlloc
KERNEL32.dll689RtlUnwind
KERNEL32.dll306GetCurrentThreadId
KERNEL32.dll822TlsAlloc
KERNEL32.dll824TlsGetValue
KERNEL32.dll834UnhandledExceptionFilter
KERNEL32.dll227FreeEnvironmentStringsA
KERNEL32.dll228FreeEnvironmentStringsW
KERNEL32.dll873WideCharToMultiByte
KERNEL32.dll319GetEnvironmentStrings
KERNEL32.dll321GetEnvironmentStringsW
KERNEL32.dll753SetFilePointer
KERNEL32.dll518InterlockedDecrement
KERNEL32.dll522InterlockedIncrement
KERNEL32.dll780SetStdHandle
KERNEL32.dll241GetCPInfo
KERNEL32.dll235GetACP
KERNEL32.dll380GetOEMCP
KERNEL32.dll393GetProcAddress
KERNEL32.dll558LoadLibraryA
KERNEL32.dll744SetEndOfFile
KERNEL32.dll593MultiByteToWideChar
KERNEL32.dll544LCMapStringA
KERNEL32.dll545LCMapStringW
KERNEL32.dll415GetStringTypeA
KERNEL32.dll418GetStringTypeW
ADVAPI32.dll174DeleteService
ADVAPI32.dll66ControlService
ADVAPI32.dll425OpenSCManagerA
ADVAPI32.dll427OpenServiceA
ADVAPI32.dll573StartServiceA
ADVAPI32.dll447QueryServiceStatus
ADVAPI32.dll99CreateServiceA
ADVAPI32.dll62CloseServiceHandle

StringTable 040904b0

Comments
CompanyNameSysinternals
FileDescriptionRemote process launcher
FileVersion1.31
InternalNamePsExec
LegalCopyrightCopyright © 2001 Mark Russinovich
LegalTrademarks
OriginalFilenamepsexec.c
PrivateBuild
ProductNameSysinternals PsExec
ProductVersion1.31
SpecialBuild

VS_FIXEDFILEINFO

FileVersion1.31.0.0
ProductVersion1.31.0.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0122880EXE02/25/2002 20:53:02#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK