iadvisoragnt.unpacked.exe - piaagent - Network Inventory Advisor Agent

info
MZ
PE
resources
imports
foremost
7zip
version info
hexdump
disasm
log
discuss
donate

parent	iadvisoragnt.exe
filename	iadvisoragnt.unpacked.exe
size	1563088 (0x17d9d0)
md5	89465c0f80e9f25ed91255521319d423

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf8

Rich Header

lib id	version	times used
150	20413	3
149	30729	42
132	30729	87
131	30729	199
132	21022	5
123	50727	23
1	0	223
109	50727	1
138	30729	25
148	21022	1
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x550f909b
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x103
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0x14a200
SizeOfInitializedData	0x31c00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x5be42
BaseOfCode	0x1000
BaseOfData	0x14c000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0x189000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	3
DllCharacteristics	0x8000
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x14a16b	0x14a200	R-X CODE
.rdata	0x14c000	0x27bb8	0x27c00	R-- IDATA
.data	0x174000	0x13ea4	0x9a00	RW- IDATA
.rsrc	0x188000	0x540	0x600	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x1728fc	0xf0
RESOURCE	0x188000	0x540
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x165520	0x40
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
VERSION	#1	836	1252
MANIFEST	#1	346	1252

module_name	ord	function_name
KERNEL32.DLL		ResetEvent
KERNEL32.DLL		GetLocalTime
KERNEL32.DLL		CreateEventW
KERNEL32.DLL		SetNamedPipeHandleState
KERNEL32.DLL		CancelIo
KERNEL32.DLL		CloseHandle
KERNEL32.DLL		GetCurrentProcess
KERNEL32.DLL		QueryPerformanceCounter
KERNEL32.DLL		GetModuleHandleW
KERNEL32.DLL		GetSystemInfo
KERNEL32.DLL		GetFileSize
KERNEL32.DLL		FindResourceExW
KERNEL32.DLL		FindResourceW
KERNEL32.DLL		LoadResource
KERNEL32.DLL		SizeofResource
KERNEL32.DLL		GetCurrentDirectoryW
KERNEL32.DLL		LockResource
KERNEL32.DLL		lstrlenA
KERNEL32.DLL		GetFileAttributesA
KERNEL32.DLL		GetModuleFileNameW
KERNEL32.DLL		MultiByteToWideChar
KERNEL32.DLL		FindFirstFileA
KERNEL32.DLL		FindClose
KERNEL32.DLL		FindNextFileA
KERNEL32.DLL		ConnectNamedPipe
KERNEL32.DLL		CreateNamedPipeW
KERNEL32.DLL		DisconnectNamedPipe
KERNEL32.DLL		FlushFileBuffers
KERNEL32.DLL		GetModuleFileNameA
KERNEL32.DLL		CreateFileA
KERNEL32.DLL		GetDriveTypeW
KERNEL32.DLL		GetLogicalDriveStringsW
KERNEL32.DLL		GetTickCount
KERNEL32.DLL		WideCharToMultiByte
KERNEL32.DLL		FormatMessageW
KERNEL32.DLL		GetEnvironmentVariableA
KERNEL32.DLL		GetDiskFreeSpaceW
KERNEL32.DLL		OpenThread
KERNEL32.DLL		DeviceIoControl
KERNEL32.DLL		GetCurrentThreadId
KERNEL32.DLL		GetProcAddress
KERNEL32.DLL		GetVolumeInformationW
KERNEL32.DLL		GetFullPathNameW
KERNEL32.DLL		GetFullPathNameA
KERNEL32.DLL		HeapReAlloc
KERNEL32.DLL		CreateMutexW
KERNEL32.DLL		SetFilePointer
KERNEL32.DLL		MapViewOfFile
KERNEL32.DLL		UnmapViewOfFile
KERNEL32.DLL		SetEndOfFile
KERNEL32.DLL		HeapAlloc
KERNEL32.DLL		SystemTimeToFileTime
KERNEL32.DLL		HeapFree
KERNEL32.DLL		InterlockedCompareExchange
KERNEL32.DLL		UnlockFile
KERNEL32.DLL		LockFile
KERNEL32.DLL		OutputDebugStringW
KERNEL32.DLL		UnlockFileEx
KERNEL32.DLL		GetProcessHeap
KERNEL32.DLL		GetSystemTimeAsFileTime
KERNEL32.DLL		FormatMessageA
KERNEL32.DLL		InitializeCriticalSection
KERNEL32.DLL		GetVersionExW
KERNEL32.DLL		HeapDestroy
KERNEL32.DLL		LeaveCriticalSection
KERNEL32.DLL		HeapCreate
KERNEL32.DLL		HeapValidate
KERNEL32.DLL		GetFileAttributesW
KERNEL32.DLL		GetTempPathW
KERNEL32.DLL		HeapSize
KERNEL32.DLL		LockFileEx
KERNEL32.DLL		EnterCriticalSection
KERNEL32.DLL		LoadLibraryA
KERNEL32.DLL		CreateFileMappingA
KERNEL32.DLL		CreateFileMappingW
KERNEL32.DLL		GetDiskFreeSpaceA
KERNEL32.DLL		GetFileAttributesExW
KERNEL32.DLL		DeleteCriticalSection
KERNEL32.DLL		OutputDebugStringA
KERNEL32.DLL		GetVersionExA
KERNEL32.DLL		DeleteFileW
KERNEL32.DLL		GetCurrentProcessId
KERNEL32.DLL		GetTempPathA
KERNEL32.DLL		GetSystemTime
KERNEL32.DLL		AreFileApisANSI
KERNEL32.DLL		DeleteFileA
KERNEL32.DLL		GetStartupInfoA
KERNEL32.DLL		GetFileType
KERNEL32.DLL		GetLastError
KERNEL32.DLL		GetOverlappedResult
KERNEL32.DLL		CreateFileW
KERNEL32.DLL		ReadFile
KERNEL32.DLL		Sleep
KERNEL32.DLL		LoadLibraryW
KERNEL32.DLL		WriteFile
KERNEL32.DLL		WaitNamedPipeW
KERNEL32.DLL		WaitForSingleObject
KERNEL32.DLL		CreateDirectoryW
KERNEL32.DLL		InterlockedDecrement
KERNEL32.DLL		InterlockedIncrement
KERNEL32.DLL		FreeLibrary
KERNEL32.DLL		GetConsoleCP
KERNEL32.DLL		GetConsoleMode
KERNEL32.DLL		GetTimeZoneInformation
KERNEL32.DLL		FreeEnvironmentStringsA
KERNEL32.DLL		GetEnvironmentStrings
KERNEL32.DLL		FreeEnvironmentStringsW
KERNEL32.DLL		GetEnvironmentStringsW
KERNEL32.DLL		LocalFree
KERNEL32.DLL		SetHandleCount
KERNEL32.DLL		GetStringTypeExW
KERNEL32.DLL		SetEnvironmentVariableA
KERNEL32.DLL		CompareStringW
KERNEL32.DLL		CompareStringA
KERNEL32.DLL		SetStdHandle
KERNEL32.DLL		GetStringTypeA
KERNEL32.DLL		IsValidLocale
KERNEL32.DLL		EnumSystemLocalesA
KERNEL32.DLL		GetLocaleInfoA
KERNEL32.DLL		GetUserDefaultLCID
KERNEL32.DLL		GetDateFormatA
KERNEL32.DLL		GetTimeFormatA
KERNEL32.DLL		GetStdHandle
KERNEL32.DLL		ExitProcess
KERNEL32.DLL		VirtualFree
KERNEL32.DLL		SetLastError
KERNEL32.DLL		TlsFree
KERNEL32.DLL		TlsSetValue
KERNEL32.DLL		TlsAlloc
KERNEL32.DLL		TlsGetValue
KERNEL32.DLL		IsValidCodePage
KERNEL32.DLL		GetOEMCP
KERNEL32.DLL		WriteConsoleW
KERNEL32.DLL		GetConsoleOutputCP
KERNEL32.DLL		WriteConsoleA
KERNEL32.DLL		GetLocaleInfoW
KERNEL32.DLL		InitializeCriticalSectionAndSpinCount
KERNEL32.DLL		InterlockedExchange
KERNEL32.DLL		TerminateProcess
KERNEL32.DLL		UnhandledExceptionFilter
KERNEL32.DLL		SetUnhandledExceptionFilter
KERNEL32.DLL		IsDebuggerPresent
KERNEL32.DLL		VirtualProtect
KERNEL32.DLL		VirtualAlloc
KERNEL32.DLL		VirtualQuery
KERNEL32.DLL		GetCommandLineA
KERNEL32.DLL		RtlUnwind
KERNEL32.DLL		RaiseException
KERNEL32.DLL		GetCPInfo
KERNEL32.DLL		LCMapStringA
KERNEL32.DLL		LCMapStringW
KERNEL32.DLL		GetStringTypeW
KERNEL32.DLL		GetACP
KERNEL32.DLL		GetModuleHandleA
ADVAPI32.dll		RegOpenKeyExW
ADVAPI32.dll		RegEnumKeyExW
ADVAPI32.dll		QueryServiceStatusEx
ADVAPI32.dll		RegCreateKeyExW
ADVAPI32.dll		RegEnumValueW
ADVAPI32.dll		RegEnumKeyW
ADVAPI32.dll		RegCloseKey
ADVAPI32.dll		SetServiceStatus
ADVAPI32.dll		RegCreateKeyA
ADVAPI32.dll		CreateServiceA
ADVAPI32.dll		RegisterServiceCtrlHandlerA
ADVAPI32.dll		RegSetValueExA
ADVAPI32.dll		StartServiceCtrlDispatcherA
ADVAPI32.dll		OpenServiceA
ADVAPI32.dll		StartServiceW
ADVAPI32.dll		OpenServiceW
ADVAPI32.dll		OpenSCManagerW
ADVAPI32.dll		DeleteService
ADVAPI32.dll		CloseServiceHandle
ADVAPI32.dll		RegQueryValueExW
IPHLPAPI.DLL		GetIpAddrTable
MPR.dll		WNetCancelConnection2W
MPR.dll		WNetGetConnectionW
MPR.dll		WNetAddConnection2W
NETAPI32.dll		NetUserGetInfo
NETAPI32.dll		NetApiBufferFree
ole32.dll		CoSetProxyBlanket
ole32.dll		CoInitializeEx
ole32.dll		CoUninitialize
ole32.dll		CoCreateInstance
OLEAUT32.dll	150
OLEAUT32.dll	27
OLEAUT32.dll	77
OLEAUT32.dll	411
OLEAUT32.dll	24
OLEAUT32.dll	8
OLEAUT32.dll	149
OLEAUT32.dll	23
OLEAUT32.dll	9
OLEAUT32.dll	2
OLEAUT32.dll	6
OLEAUT32.dll	185
OLEAUT32.dll	7
OLEAUT32.dll	331
OLEAUT32.dll	184
OLEAUT32.dll	12
OLEAUT32.dll	10
SHELL32.dll		SHGetFolderPathA
SHLWAPI.dll		PathFileExistsW
USER32.dll		LoadStringW
USER32.dll		ShowWindow
WTSAPI32.dll		WTSFreeMemory
WTSAPI32.dll		WTSEnumerateSessionsW
WTSAPI32.dll		WTSQuerySessionInformationW

StringTable 409004e4

CompanyName	ClearApps
FileDescription	Network Inventory Advisor Agent
FileVersion	4.30.2938
InternalName	iadvisor.exe
LegalCopyright	Copyright (c) 1999-2012. All rights reseved by ClearApps.
OriginalFilename	piaagent
ProductName	Network Inventory Advisor
ProductVersion	4.30

VS_FIXEDFILEINFO

FileVersion	4.30.2938.0
ProductVersion	4.30.2938.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	1556992	EXE	03/23/2015 04:03:39	#
15c1	15	HTM		#
17c200	6096	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 1563088 bytes (1527 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

iadvisoragnt.unpacked.exe-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 409004e4

VS_FIXEDFILEINFO

iadvisoragnt.unpacked.exe
-