filenamemsiexec.exe
size73216 (0x11e00)
md589aa398ae90968de48fee793bd98f124
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
149307298
1313072970
1473072915
10223
1323072918
126507271
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x56f57794
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0xce00
SizeOfInitializedData0x5200
SizeOfUninitializedData0
AddressOfEntryPoint0x3db0
BaseOfCode0x1000
BaseOfData0x13000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion5.0
Reserved10
SizeOfImage0x14000
SizeOfHeaders0x400
CheckSum0x19d2a
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000xcc240xce00R-X CODE
.data0xe0000x248c0x2000RW- IDATA
.rsrc0x110000x1e180x2000R-- IDATA
.reloc0x130000xac80xc00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xcd740xa0
RESOURCE0x110000x1e18
EXCEPTION00
SECURITY00
BASERELOC0x130000xac8
DEBUG0xdbc40x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x7f600x40
Bound_IAT00
IAT0x10000x2b4
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12080
ICON#12960
ICON#213840
ICON#37440
ICON#422160
GROUP_ICON#1620
VERSION#18880
MANIFEST#113730
module_namehintordfunction_name
ADVAPI32.dll610RegOpenKeyExW
ADVAPI32.dll570RegCreateKeyExW
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll408LookupPrivilegeValueW
ADVAPI32.dll504OpenProcessToken
ADVAPI32.dll509OpenThreadToken
ADVAPI32.dll289FreeSid
ADVAPI32.dll311GetLengthSid
ADVAPI32.dll32AllocateAndInitializeSid
ADVAPI32.dll219DeregisterEventSource
ADVAPI32.dll656ReportEventW
ADVAPI32.dll644RegisterEventSourceW
ADVAPI32.dll483MakeSelfRelativeSD
ADVAPI32.dll331GetSecurityDescriptorLength
ADVAPI32.dll696SetSecurityDescriptorGroup
ADVAPI32.dll697SetSecurityDescriptorOwner
ADVAPI32.dll695SetSecurityDescriptorDacl
ADVAPI32.dll376InitializeSecurityDescriptor
ADVAPI32.dll292GetAce
ADVAPI32.dll16AddAccessAllowedAce
ADVAPI32.dll375InitializeAcl
ADVAPI32.dll561RegCloseKey
ADVAPI32.dll639RegSetValueExW
ADVAPI32.dll581RegDeleteKeyW
ADVAPI32.dll623RegQueryValueExW
ADVAPI32.dll585RegDeleteValueW
ADVAPI32.dll593RegEnumKeyW
ADVAPI32.dll87CloseServiceHandle
ADVAPI32.dll129CreateServiceW
ADVAPI32.dll506OpenSCManagerW
ADVAPI32.dll706SetThreadToken
ADVAPI32.dll218DeleteService
ADVAPI32.dll553QueryServiceStatus
ADVAPI32.dll92ControlService
ADVAPI32.dll508OpenServiceW
ADVAPI32.dll592RegEnumKeyExW
ADVAPI32.dll705SetServiceStatus
ADVAPI32.dll649RegisterServiceCtrlHandlerW
ADVAPI32.dll263EqualSid
ADVAPI32.dll332GetSecurityDescriptorOwner
ADVAPI32.dll597RegGetKeySecurity
ADVAPI32.dll481MakeAbsoluteSD
ADVAPI32.dll347GetTokenInformation
ADVAPI32.dll657RevertToSelf
ADVAPI32.dll713StartServiceCtrlDispatcherW
KERNEL32.dll1364lstrlenW
KERNEL32.dll1355lstrcmpiW
KERNEL32.dll83CloseHandle
KERNEL32.dll749InterlockedExchange
KERNEL32.dll449GetCurrentProcess
KERNEL32.dll513GetLastError
KERNEL32.dll453GetCurrentThread
KERNEL32.dll1206Sleep
KERNEL32.dll676GetVersionExW
KERNEL32.dll477GetEnvironmentVariableW
KERNEL32.dll740InitializeCriticalSection
KERNEL32.dll210DeleteCriticalSection
KERNEL32.dll580GetProcAddress
KERNEL32.dll832LoadLibraryW
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll1303WideCharToMultiByte
KERNEL32.dll1141SetLastError
KERNEL32.dll692GlobalAlloc
KERNEL32.dll699GlobalFree
KERNEL32.dll355FreeLibrary
KERNEL32.dll1241UnhandledExceptionFilter
KERNEL32.dll674GetVersion
KERNEL32.dll535GetModuleHandleW
KERNEL32.dll1279WaitForSingleObject
KERNEL32.dll169CreateProcessW
KERNEL32.dll531GetModuleFileNameW
KERNEL32.dll748InterlockedDecrement
KERNEL32.dll752InterlockedIncrement
KERNEL32.dll1352lstrcmpW
KERNEL32.dll351FormatMessageW
KERNEL32.dll620GetSystemDefaultLangID
KERNEL32.dll831LoadLibraryExW
KERNEL32.dll1103SetCurrentDirectoryW
KERNEL32.dll906OutputDebugStringW
KERNEL32.dll1323WriteFile
KERNEL32.dll517GetLocaleInfoW
KERNEL32.dll361GetACP
KERNEL32.dll826LeaveCriticalSection
KERNEL32.dll239EnterCriticalSection
KERNEL32.dll896OpenProcess
KERNEL32.dll134CreateEventW
KERNEL32.dll885OpenEventW
KERNEL32.dll101CompareStringW
KERNEL32.dll498GetFileType
KERNEL32.dll612GetStdHandle
KERNEL32.dll392GetCommandLineW
KERNEL32.dll282ExitProcess
KERNEL32.dll1116SetEvent
KERNEL32.dll1071SetConsoleCtrlHandler
KERNEL32.dll182CreateThread
KERNEL32.dll624GetSystemDirectoryW
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll450GetCurrentProcessId
KERNEL32.dll454GetCurrentThreadId
KERNEL32.dll659GetTickCount
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll532GetModuleHandleA
KERNEL32.dll1221TerminateProcess
KERNEL32.dll1192SetUnhandledExceptionFilter
KERNEL32.dll610GetStartupInfoA
KERNEL32.dll746InterlockedCompareExchange
USER32.dll540MsgWaitForMultipleObjects
USER32.dll451IsCharAlphaNumericW
USER32.dll349GetMessageW
USER32.dll563PeekMessageW
USER32.dll175DispatchMessageW
USER32.dll764TranslateMessage
USER32.dll567PostQuitMessage
USER32.dll569PostThreadMessageW
msvcrt.dll231_acmdln
msvcrt.dll469_initterm
msvcrt.dll257_amsg_exit
msvcrt.dll212__setusermatherr
msvcrt.dll185__p__commode
msvcrt.dll190__p__fmode
msvcrt.dll210__set_app_type
msvcrt.dll934_unlock
msvcrt.dll141__dllonexit
msvcrt.dll578_lock
msvcrt.dll747_onexit
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll295_controlfp
msvcrt.dll1167exit
msvcrt.dll500_ismbblead
msvcrt.dll106_XcptFilter
msvcrt.dll354_exit
msvcrt.dll276_cexit
msvcrt.dll145__getmainargs
msvcrt.dll968_vsnprintf
msvcrt.dll974_vsnwprintf
msvcrt.dll1007_wcsicmp
msvcrt.dll1258memcpy
msvcrt.dll1262memset
msvcrt.dll1376wcsrchr
ntdll.dll1047RtlNtStatusToDosError
ntdll.dll1239RtlUnwind
ntdll.dll400NtQueryInformationProcess
ole32.dll62CoInitialize
ole32.dll95CoRevokeClassObject
ole32.dll83CoRegisterClassObject
ole32.dll370StgOpenStorage
ole32.dll108CoUninitialize
msi.dll141
msi.dll70
msi.dll190
msi.dll280
msi.dll197
msi.dll228
msi.dll136
msi.dll169
msi.dll78
msi.dll148
msi.dll8
msi.dll88
msi.dll199
msi.dll131
msi.dll184
msi.dll175
msi.dll240
msi.dll222
msi.dll196

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWindows® installer
FileVersion5.0.7601.23403 (win7sp1_ldr.160325-0600)
InternalNamemsiexec
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamemsiexec.exe
ProductNameWindows Installer - Unicode
ProductVersion5.0.7601.23403

VS_FIXEDFILEINFO

FileVersion5.0.7601.23403
ProductVersion5.0.7601.23403
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
073216EXE03/25/2016 17:38:28#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK