filenameexecutable.2292.exe
size81920 (0x14000)
md5c0c1b95c800cd73733dc0db30ece6b25
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
149307298
1313072970
1473072915
10223
1323072918
126507271
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4ce792c4
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0xce00
SizeOfInitializedData0x5200
SizeOfUninitializedData0
AddressOfEntryPoint0x3db0
BaseOfCode0x1000
BaseOfData0x13000
ImageBase0x3e0000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion5.0
Reserved10
SizeOfImage0x14000
SizeOfHeaders0x400
CheckSum0x1a42f
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000xd0000xd000R-X CODE
.data0xe0000x30000x3000RW- IDATA
.rsrc0x110000x20000x2000R-- IDATA
.reloc0x130000x10000x1000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xcd540xa0
RESOURCE0x110000x1e18
EXCEPTION00
SECURITY00
BASERELOC0x130000xac8
DEBUG0xdba40x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x7f480x40
Bound_IAT0x2880x94
IAT0x10000x2b4
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12080
ICON#12960
ICON#213840
ICON#37440
ICON#422160
GROUP_ICON#1620
VERSION#18880
MANIFEST#113730
module_namehintordfunction_name
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll569RegCreateKeyExW
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll407LookupPrivilegeValueW
ADVAPI32.dll503OpenProcessToken
ADVAPI32.dll508OpenThreadToken
ADVAPI32.dll288FreeSid
ADVAPI32.dll310GetLengthSid
ADVAPI32.dll32AllocateAndInitializeSid
ADVAPI32.dll219DeregisterEventSource
ADVAPI32.dll655ReportEventW
ADVAPI32.dll643RegisterEventSourceW
ADVAPI32.dll482MakeSelfRelativeSD
ADVAPI32.dll330GetSecurityDescriptorLength
ADVAPI32.dll695SetSecurityDescriptorGroup
ADVAPI32.dll696SetSecurityDescriptorOwner
ADVAPI32.dll694SetSecurityDescriptorDacl
ADVAPI32.dll375InitializeSecurityDescriptor
ADVAPI32.dll291GetAce
ADVAPI32.dll16AddAccessAllowedAce
ADVAPI32.dll374InitializeAcl
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll638RegSetValueExW
ADVAPI32.dll580RegDeleteKeyW
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll584RegDeleteValueW
ADVAPI32.dll592RegEnumKeyW
ADVAPI32.dll87CloseServiceHandle
ADVAPI32.dll129CreateServiceW
ADVAPI32.dll505OpenSCManagerW
ADVAPI32.dll705SetThreadToken
ADVAPI32.dll218DeleteService
ADVAPI32.dll552QueryServiceStatus
ADVAPI32.dll92ControlService
ADVAPI32.dll507OpenServiceW
ADVAPI32.dll591RegEnumKeyExW
ADVAPI32.dll704SetServiceStatus
ADVAPI32.dll648RegisterServiceCtrlHandlerW
ADVAPI32.dll263EqualSid
ADVAPI32.dll331GetSecurityDescriptorOwner
ADVAPI32.dll596RegGetKeySecurity
ADVAPI32.dll480MakeAbsoluteSD
ADVAPI32.dll346GetTokenInformation
ADVAPI32.dll656RevertToSelf
ADVAPI32.dll712StartServiceCtrlDispatcherW
KERNEL32.dll1358lstrlenW
KERNEL32.dll1349lstrcmpiW
KERNEL32.dll82CloseHandle
KERNEL32.dll748InterlockedExchange
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll512GetLastError
KERNEL32.dll452GetCurrentThread
KERNEL32.dll1202Sleep
KERNEL32.dll675GetVersionExW
KERNEL32.dll476GetEnvironmentVariableW
KERNEL32.dll739InitializeCriticalSection
KERNEL32.dll209DeleteCriticalSection
KERNEL32.dll579GetProcAddress
KERNEL32.dll831LoadLibraryW
KERNEL32.dll870MultiByteToWideChar
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll1137SetLastError
KERNEL32.dll691GlobalAlloc
KERNEL32.dll698GlobalFree
KERNEL32.dll354FreeLibrary
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll673GetVersion
KERNEL32.dll534GetModuleHandleW
KERNEL32.dll1273WaitForSingleObject
KERNEL32.dll168CreateProcessW
KERNEL32.dll530GetModuleFileNameW
KERNEL32.dll747InterlockedDecrement
KERNEL32.dll751InterlockedIncrement
KERNEL32.dll1346lstrcmpW
KERNEL32.dll350FormatMessageW
KERNEL32.dll619GetSystemDefaultLangID
KERNEL32.dll830LoadLibraryExW
KERNEL32.dll1100SetCurrentDirectoryW
KERNEL32.dll905OutputDebugStringW
KERNEL32.dll1317WriteFile
KERNEL32.dll516GetLocaleInfoW
KERNEL32.dll360GetACP
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll895OpenProcess
KERNEL32.dll133CreateEventW
KERNEL32.dll884OpenEventW
KERNEL32.dll100CompareStringW
KERNEL32.dll497GetFileType
KERNEL32.dll611GetStdHandle
KERNEL32.dll391GetCommandLineW
KERNEL32.dll281ExitProcess
KERNEL32.dll1112SetEvent
KERNEL32.dll1068SetConsoleCtrlHandler
KERNEL32.dll181CreateThread
KERNEL32.dll623GetSystemDirectoryW
KERNEL32.dll632GetSystemTimeAsFileTime
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll658GetTickCount
KERNEL32.dll934QueryPerformanceCounter
KERNEL32.dll531GetModuleHandleA
KERNEL32.dll1216TerminateProcess
KERNEL32.dll1188SetUnhandledExceptionFilter
KERNEL32.dll609GetStartupInfoA
KERNEL32.dll745InterlockedCompareExchange
USER32.dll540MsgWaitForMultipleObjects
USER32.dll451IsCharAlphaNumericW
USER32.dll349GetMessageW
USER32.dll563PeekMessageW
USER32.dll175DispatchMessageW
USER32.dll764TranslateMessage
USER32.dll567PostQuitMessage
USER32.dll569PostThreadMessageW
msvcrt.dll231_acmdln
msvcrt.dll469_initterm
msvcrt.dll257_amsg_exit
msvcrt.dll212__setusermatherr
msvcrt.dll185__p__commode
msvcrt.dll190__p__fmode
msvcrt.dll210__set_app_type
msvcrt.dll934_unlock
msvcrt.dll141__dllonexit
msvcrt.dll578_lock
msvcrt.dll747_onexit
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll295_controlfp
msvcrt.dll1167exit
msvcrt.dll500_ismbblead
msvcrt.dll106_XcptFilter
msvcrt.dll354_exit
msvcrt.dll276_cexit
msvcrt.dll145__getmainargs
msvcrt.dll968_vsnprintf
msvcrt.dll974_vsnwprintf
msvcrt.dll1007_wcsicmp
msvcrt.dll1258memcpy
msvcrt.dll1262memset
msvcrt.dll1376wcsrchr
ntdll.dll1044RtlNtStatusToDosError
ntdll.dll1236RtlUnwind
ntdll.dll398NtQueryInformationProcess
ole32.dll62CoInitialize
ole32.dll95CoRevokeClassObject
ole32.dll83CoRegisterClassObject
ole32.dll370StgOpenStorage
ole32.dll108CoUninitialize
msi.dll141
msi.dll70
msi.dll190
msi.dll280
msi.dll197
msi.dll228
msi.dll136
msi.dll169
msi.dll78
msi.dll148
msi.dll8
msi.dll88
msi.dll199
msi.dll131
msi.dll184
msi.dll175
msi.dll240
msi.dll222
msi.dll196

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWindows® installer
FileVersion5.0.7601.17514 (win7sp1_rtm.101119-1850)
InternalNamemsiexec
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamemsiexec.exe
ProductNameWindows Installer - Unicode
ProductVersion5.0.7601.17514

VS_FIXEDFILEINFO

FileVersion5.0.7601.17514
ProductVersion5.0.7601.17514
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
081920EXE11/20/2010 09:20:04#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x288