filenameCrossriderApp009317.exe
size3656285 (0x37ca5d)
md58cd91ca76e13ace8b43ddf914e50fad0
typePE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0x50be00b6
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x30f
Magic0x10b
LinkerVersion2.22
SizeOfCode0x8a00
SizeOfInitializedData0x6c00
SizeOfUninitializedData0x3dc00
AddressOfEntryPoint0x4323
BaseOfCode0x1000
BaseOfData0xa000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion6.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x9a000
SizeOfHeaders0x400
CheckSum0x191d8
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x88400x8a00R-X CODE
.data0xa0000x8c0x200RW- IDATA
.rdata0xb0000x23940x2400R-- IDATA
.bss0xe0000x3dbd00RW- UDATA
.idata0x4c0000x13040x1400RW- IDATA
.ndata0x4e0000x460000x2000RW- IDATA
.rsrc0x940000x5a900x5c00RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x4c0000x1304
RESOURCE0x940000x5a90
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#196400
ICON#242640
ICON#322160
ICON#413840
ICON#511280
ICON#67440
ICON#72960
DIALOG#1055740
DIALOG#1062600
DIALOG#1112380
GROUP_ICON#1031040
VERSION#16040
MANIFEST#19600
module_namehintordfunction_name
ADVAPI32.dll568RegCloseKey
ADVAPI32.dll576RegCreateKeyExA
ADVAPI32.dll581RegDeleteKeyA
ADVAPI32.dll591RegDeleteValueA
ADVAPI32.dll597RegEnumKeyA
ADVAPI32.dll601RegEnumValueA
ADVAPI32.dll616RegOpenKeyExA
ADVAPI32.dll629RegQueryValueExA
ADVAPI32.dll645RegSetValueExA
COMCTL32.DLL59ImageList_AddMasked
COMCTL32.DLL62ImageList_Create
COMCTL32.DLL63ImageList_Destroy
COMCTL32.DLL94InitCommonControls
GDI32.dll30CreateBrushIndirect
GDI32.dll47CreateFontIndirectA
GDI32.dll75DeleteObject
GDI32.dll168GetDeviceCaps
GDI32.dll305SelectObject
GDI32.dll311SetBkColor
GDI32.dll312SetBkMode
GDI32.dll348SetTextColor
KERNEL32.dll69CloseHandle
KERNEL32.dll83CompareFileTime
KERNEL32.dll100CopyFileA
KERNEL32.dll112CreateDirectoryA
KERNEL32.dll124CreateFileA
KERNEL32.dll152CreateProcessA
KERNEL32.dll167CreateThread
KERNEL32.dll198DeleteFileA
KERNEL32.dll266ExitProcess
KERNEL32.dll269ExpandEnvironmentStringsA
KERNEL32.dll288FindClose
KERNEL32.dll292FindFirstFileA
KERNEL32.dll309FindNextFileA
KERNEL32.dll339FreeLibrary
KERNEL32.dll375GetCommandLineA
KERNEL32.dll433GetCurrentProcess
KERNEL32.dll444GetDiskFreeSpaceA
KERNEL32.dll461GetExitCodeProcess
KERNEL32.dll465GetFileAttributesA
KERNEL32.dll476GetFileSize
KERNEL32.dll484GetFullPathNameA
KERNEL32.dll494GetLastError
KERNEL32.dll508GetModuleFileNameA
KERNEL32.dll510GetModuleHandleA
KERNEL32.dll549GetPrivateProfileStringA
KERNEL32.dll553GetProcAddress
KERNEL32.dll578GetShortPathNameA
KERNEL32.dll593GetSystemDirectoryA
KERNEL32.dll612GetTempFileNameA
KERNEL32.dll614GetTempPathA
KERNEL32.dll627GetTickCount
KERNEL32.dll641GetVersion
KERNEL32.dll653GetWindowsDirectoryA
KERNEL32.dll658GlobalAlloc
KERNEL32.dll665GlobalFree
KERNEL32.dll669GlobalLock
KERNEL32.dll677GlobalUnlock
KERNEL32.dll771LoadLibraryA
KERNEL32.dll772LoadLibraryExA
KERNEL32.dll804MoveFileA
KERNEL32.dll812MulDiv
KERNEL32.dll813MultiByteToWideChar
KERNEL32.dll893ReadFile
KERNEL32.dll915RemoveDirectoryA
KERNEL32.dll942SearchPathA
KERNEL32.dll991SetCurrentDirectoryA
KERNEL32.dll1003SetErrorMode
KERNEL32.dll1008SetFileAttributesA
KERNEL32.dll1016SetFilePointer
KERNEL32.dll1020SetFileTime
KERNEL32.dll1085Sleep
KERNEL32.dll1161WaitForSingleObject
KERNEL32.dll1202WriteFile
KERNEL32.dll1208WritePrivateProfileStringA
KERNEL32.dll1229lstrcatA
KERNEL32.dll1232lstrcmpA
KERNEL32.dll1235lstrcmpiA
KERNEL32.dll1241lstrcpynA
KERNEL32.dll1244lstrlenA
ole32.dll16CoCreateInstance
ole32.dll105CoTaskMemFree
ole32.dll247OleInitialize
ole32.dll270OleUninitialize
SHELL32.DLL63SHBrowseForFolderA
SHELL32.DLL77SHFileOperationA
SHELL32.DLL88SHGetFileInfoA
SHELL32.DLL104SHGetPathFromIDListA
SHELL32.DLL108SHGetSpecialFolderLocation
SHELL32.DLL148ShellExecuteA
USER32.dll6AppendMenuA
USER32.dll11BeginPaint
USER32.dll24CallWindowProcA
USER32.dll39CharNextA
USER32.dll42CharPrevA
USER32.dll53CheckDlgButton
USER32.dll61CloseClipboard
USER32.dll80CreateDialogParamA
USER32.dll89CreatePopupMenu
USER32.dll90CreateWindowExA
USER32.dll134DefWindowProcA
USER32.dll144DestroyWindow
USER32.dll147DialogBoxParamA
USER32.dll149DispatchMessageA
USER32.dll172DrawTextA
USER32.dll177EmptyClipboard
USER32.dll178EnableMenuItem
USER32.dll180EnableWindow
USER32.dll182EndDialog
USER32.dll184EndPaint
USER32.dll208ExitWindowsEx
USER32.dll209FillRect
USER32.dll211FindWindowExA
USER32.dll227GetClassInfoA
USER32.dll236GetClientRect
USER32.dll248GetDC
USER32.dll253GetDlgItem
USER32.dll255GetDlgItemTextA
USER32.dll295GetMessagePos
USER32.dll323GetSysColor
USER32.dll325GetSystemMenu
USER32.dll326GetSystemMetrics
USER32.dll342GetWindowLongA
USER32.dll348GetWindowRect
USER32.dll370InvalidateRect
USER32.dll394IsWindow
USER32.dll395IsWindowEnabled
USER32.dll397IsWindowVisible
USER32.dll403LoadBitmapA
USER32.dll405LoadCursorA
USER32.dll411LoadImageA
USER32.dll437MessageBoxIndirectA
USER32.dll455OpenClipboard
USER32.dll464PeekMessageA
USER32.dll468PostQuitMessage
USER32.dll479RegisterClassA
USER32.dll500ScreenToClient
USER32.dll508SendMessageA
USER32.dll511SendMessageTimeoutA
USER32.dll520SetClassLongA
USER32.dll523SetClipboardData
USER32.dll525SetCursor
USER32.dll530SetDlgItemTextA
USER32.dll534SetForegroundWindow
USER32.dll563SetTimer
USER32.dll569SetWindowLongA
USER32.dll572SetWindowPos
USER32.dll574SetWindowTextA
USER32.dll585ShowWindow
USER32.dll591SystemParametersInfoA
USER32.dll602TrackPopupMenu
USER32.dll638wsprintfA
VERSION.dllGetFileVersionInfoA
VERSION.dll1GetFileVersionInfoSizeA
VERSION.dll10VerQueryValueA

StringTable 04090000

CompanyNamealiottaleon
FileDescriptionFlower girl Dres staging Installer
FileVersion1.34.4.10
LegalCopyrightCopyright aliottaleon
ProductNameFlower girl Dres staging

VS_FIXEDFILEINFO

FileVersion1.34.4.10
ProductVersion1.34.4.10
StrucVersion0
FileFlagsMask0
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
082944EXE12/04/2012 13:55:02#
15c115HTM#
144003573341BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 3656285 bytes (3571 KiB)


--
Type = Nsis
Physical Size = 3656285
Method = LZMA:23
Solid = +
Headers Size = 14411
Embedded Stub Size = 82944
SubType = NSIS-2

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
                    .....        11264      3573337  $PLUGINSDIR/System.dll
2014-05-08 21:03:04 .....      3515088               $PLUGINSDIR/pre-installer.tmp
                    .....        20992               $PLUGINSDIR/inetc.dll
                    .....        71168               $PLUGINSDIR/WrapperUtils.dll
                    .....                            $PLUGINSDIR/StdUtils.dll
------------------- ----- ------------ ------------  ------------------------
2014-05-08 21:03:04            3618512      3573337  5 files
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







[?] ignoring invalid PEdump::BITMAPINFOHEADER