filenamed1.exe
size252416 (0x3da00)
md595e64c0e5816de657cb119b3a4eda1ed
typePE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
1584021916
1704021999
147307299
10102
1714021934
154402191
157402191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x52b83776
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion10.0
SizeOfCode0x2e000
SizeOfInitializedData0x1000
SizeOfUninitializedData0xd000
AddressOfEntryPoint0x44d1
BaseOfCode0xe000
BaseOfData0x3c000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x3da00
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0x8100
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
UPX00x10000xd0000xd000RWX UDATA
UPX10xe0000x2e0000x2e000RWX IDATA
.rsrc0x3c0000x10000x1000RW- IDATA
.idata20x3d0000x10000xa00RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x3d0000x14c
RESOURCE0x3c0000x460
EXCEPTION00
SECURITY00
BASERELOC0x3c5ac0x10
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x3be040x48
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
BINARY#5931392640
VERSION#19400
module_namehintordfunction_name
advapi32.dll1508OpenServiceW
advapi32.dll1089CloseServiceHandle
advapi32.dll1131CreateServiceW
advapi32.dll1080ChangeServiceConfig2W
advapi32.dll1506OpenSCManagerW
kernel32.dll172CreateRemoteThread
kernel32.dll1019ReleaseMutex
kernel32.dll1332WriteProcessMemory
kernel32.dll1264VirtualAllocEx
kernel32.dll897OpenProcess
kernel32.dll921Process32NextW
kernel32.dll919Process32FirstW
kernel32.dll193CreateToolhelp32Snapshot
kernel32.dll533GetModuleFileNameW
kernel32.dll1323WriteFile
kernel32.dll1180SetThreadPriority
kernel32.dll662GetTickCount
kernel32.dll360FreeResource
kernel32.dll853LockResource
kernel32.dll835LoadResource
kernel32.dll1205SizeofResource
kernel32.dll337FindResourceW
kernel32.dll120CopyFileW
kernel32.dll587GetProcessHeap
kernel32.dll1110SetEndOfFile
kernel32.dll85CloseHandle
kernel32.dll161CreateMutexW
kernel32.dll1279WaitForSingleObject
kernel32.dll833LoadLibraryW
kernel32.dll146CreateFileW
kernel32.dll582GetProcAddress
kernel32.dll725HeapReAlloc
kernel32.dll946RaiseException
kernel32.dll1050RtlUnwind
kernel32.dll394GetCommandLineW
kernel32.dll726HeapSetInformation
kernel32.dll613GetStartupInfoW
kernel32.dll774IsProcessorFeaturePresent
kernel32.dll718HeapAlloc
kernel32.dll515GetLastError
kernel32.dll722HeapFree
kernel32.dll373GetCPInfo
kernel32.dll754InterlockedIncrement
kernel32.dll750InterlockedDecrement
kernel32.dll363GetACP
kernel32.dll568GetOEMCP
kernel32.dll780IsValidCodePage
kernel32.dll237EncodePointer
kernel32.dll1226TlsAlloc
kernel32.dll1228TlsGetValue
kernel32.dll1229TlsSetValue
kernel32.dll205DecodePointer
kernel32.dll1227TlsFree
kernel32.dll537GetModuleHandleW
kernel32.dll1141SetLastError
kernel32.dll456GetCurrentThreadId
kernel32.dll1241UnhandledExceptionFilter
kernel32.dll1192SetUnhandledExceptionFilter
kernel32.dll770IsDebuggerPresent
kernel32.dll1221TerminateProcess
kernel32.dll451GetCurrentProcess
kernel32.dll241EnterCriticalSection
kernel32.dll827LeaveCriticalSection
kernel32.dll1303WideCharToMultiByte
kernel32.dll413GetConsoleCP
kernel32.dll431GetConsoleMode
kernel32.dll743InitializeCriticalSectionAndSpinCount
kernel32.dll284ExitProcess
kernel32.dll614GetStdHandle
kernel32.dll356FreeEnvironmentStringsW
kernel32.dll477GetEnvironmentStringsW
kernel32.dll1137SetHandleCount
kernel32.dll500GetFileType
kernel32.dll212DeleteCriticalSection
kernel32.dll720HeapCreate
kernel32.dll936QueryPerformanceCounter
kernel32.dll452GetCurrentProcessId
kernel32.dll635GetSystemTimeAsFileTime
kernel32.dll815LCMapStringW
kernel32.dll872MultiByteToWideChar
kernel32.dll619GetStringTypeW
kernel32.dll1206Sleep
kernel32.dll727HeapSize
kernel32.dll1162SetStdHandle
kernel32.dll346FlushFileBuffers
kernel32.dll1128SetFilePointer
kernel32.dll1322WriteConsoleW
kernel32.dll961ReadFile
shell32.dll373SHGetFolderPathW
shell32.dll437ShellExecuteW
user32.dll2039MessageBoxA

StringTable 000004b0

CompanyNameMicrosoft Corporation
FileDescriptionWindows Updater keeps your Windows up to date
FileVersion6.1.7600.16385
InternalNameWindowsUpdater
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameWindowsUpdater.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion6.1.7600.16385
ProductVersion6.1.7600.16385
StrucVersion0x10000
FileFlagsMask0
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
0252416EXE12/23/2013 13:15:34#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK