5.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	5.exe
size	555008 (0x87800)
md5	6a50d5e91b193be284aa02106ee35e97

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

Rich Header

lib id	version	times used
152	20115	1
158	30319	31
131	30729	2
147	30729	25
1	0	209
170	30319	170
171	30319	74
157	30319	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x603d4670
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x103
Magic	0x10b
LinkerVersion	10.0
SizeOfCode	0x70e00
SizeOfInitializedData	0x19000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x5b83d
BaseOfCode	0x1000
BaseOfData	0x72000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	0.0
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0x8c000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0x8100
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x70c91	0x70e00	R-X CODE
.rdata	0x72000	0x13d9a	0x13e00	R-- IDATA
.data	0x86000	0x5104	0x2800	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x84a34	0xf0
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x80498	0x40
Bound_IAT	0	0
IAT	0x72000	0x350
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
KERNEL32.dll	1357	lstrlenA
KERNEL32.dll	117	CopyFileW
KERNEL32.dll	82	CloseHandle
KERNEL32.dll	1317	WriteFile
KERNEL32.dll	136	CreateFileA
KERNEL32.dll	871	MultiByteToWideChar
KERNEL32.dll	960	ReadFile
KERNEL32.dll	496	GetFileSize
KERNEL32.dll	675	GetVersionExA
KERNEL32.dll	836	LocalAlloc
KERNEL32.dll	497	GetFileSizeEx
KERNEL32.dll	446	GetCurrentDirectoryA
KERNEL32.dll	919	Process32Next
KERNEL32.dll	917	Process32First
KERNEL32.dll	190	CreateToolhelp32Snapshot
KERNEL32.dll	1216	TerminateProcess
KERNEL32.dll	896	OpenProcess
KERNEL32.dll	581	GetProcAddress
KERNEL32.dll	828	LoadLibraryA
KERNEL32.dll	293	FileTimeToSystemTime
KERNEL32.dll	354	FreeLibrary
KERNEL32.dll	574	GetPrivateProfileSectionNamesA
KERNEL32.dll	490	GetFileAttributesW
KERNEL32.dll	738	InitializeCriticalSection
KERNEL32.dll	745	InterlockedCompareExchange
KERNEL32.dll	209	DeleteCriticalSection
KERNEL32.dll	238	EnterCriticalSection
KERNEL32.dll	825	LeaveCriticalSection
KERNEL32.dll	21	AreFileApisANSI
KERNEL32.dll	514	GetLastError
KERNEL32.dll	1126	SetFilePointer
KERNEL32.dll	1107	SetEndOfFile
KERNEL32.dll	343	FlushFileBuffers
KERNEL32.dll	1236	UnlockFile
KERNEL32.dll	850	LockFile
KERNEL32.dll	851	LockFileEx
KERNEL32.dll	1237	UnlockFileEx
KERNEL32.dll	485	GetFileAttributesA
KERNEL32.dll	487	GetFileAttributesExW
KERNEL32.dll	831	LoadLibraryW
KERNEL32.dll	935	QueryPerformanceCounter
KERNEL32.dll	659	GetTickCount
KERNEL32.dll	631	GetSystemTime
KERNEL32.dll	633	GetSystemTimeAsFileTime
KERNEL32.dll	1238	UnmapViewOfFile
KERNEL32.dll	644	GetTempPathA
KERNEL32.dll	645	GetTempPathW
KERNEL32.dll	349	FormatMessageA
KERNEL32.dll	350	FormatMessageW
KERNEL32.dll	504	GetFullPathNameA
KERNEL32.dll	507	GetFullPathNameW
KERNEL32.dll	460	GetDiskFreeSpaceA
KERNEL32.dll	463	GetDiskFreeSpaceW
KERNEL32.dll	143	CreateFileW
KERNEL32.dll	627	GetSystemInfo
KERNEL32.dll	855	MapViewOfFile
KERNEL32.dll	137	CreateFileMappingA
KERNEL32.dll	396	GetComputerNameA
KERNEL32.dll	782	IsWow64Process
KERNEL32.dll	1100	SetCurrentDirectoryA
KERNEL32.dll	703	GlobalMemoryStatus
KERNEL32.dll	533	GetModuleHandleA
KERNEL32.dll	669	GetUserDefaultLocaleName
KERNEL32.dll	1232	TzSpecificLocalTimeToSystemTime
KERNEL32.dll	664	GetTimeZoneInformation
KERNEL32.dll	516	GetLocaleInfoA
KERNEL32.dll	492	GetFileInformationByHandle
KERNEL32.dll	1213	SystemTimeToFileTime
KERNEL32.dll	515	GetLocalTime
KERNEL32.dll	100	CompareStringW
KERNEL32.dll	1159	SetStdHandle
KERNEL32.dll	780	IsValidLocale
KERNEL32.dll	269	EnumSystemLocalesA
KERNEL32.dll	667	GetUserDefaultLCID
KERNEL32.dll	518	GetLocaleInfoW
KERNEL32.dll	617	GetStringTypeW
KERNEL32.dll	531	GetModuleFileNameA
KERNEL32.dll	474	GetEnvironmentStringsW
KERNEL32.dll	449	GetCurrentProcessId
KERNEL32.dll	1202	Sleep
KERNEL32.dll	211	DeleteFileA
KERNEL32.dll	519	GetLogicalDriveStringsA
KERNEL32.dll	466	GetDriveTypeA
KERNEL32.dll	306	FindFirstFileA
KERNEL32.dll	715	HeapAlloc
KERNEL32.dll	112	CopyFileA
KERNEL32.dll	323	FindNextFileA
KERNEL32.dll	1352	lstrcpyW
KERNEL32.dll	1343	lstrcatW
KERNEL32.dll	313	FindFirstFileW
KERNEL32.dll	1346	lstrcmpW
KERNEL32.dll	214	DeleteFileW
KERNEL32.dll	325	FindNextFileW
KERNEL32.dll	302	FindClose
KERNEL32.dll	124	CreateDirectoryA
KERNEL32.dll	1342	lstrcatA
KERNEL32.dll	719	HeapFree
KERNEL32.dll	1297	WideCharToMultiByte
KERNEL32.dll	353	FreeEnvironmentStringsW
KERNEL32.dll	1110	SetEnvironmentVariableA
KERNEL32.dll	1111	SetEnvironmentVariableW
KERNEL32.dll	428	GetConsoleMode
KERNEL32.dll	410	GetConsoleCP
KERNEL32.dll	717	HeapCreate
KERNEL32.dll	532	GetModuleFileNameW
KERNEL32.dll	499	GetFileType
KERNEL32.dll	739	InitializeCriticalSectionAndSpinCount
KERNEL32.dll	612	GetStdHandle
KERNEL32.dll	1135	SetHandleCount
KERNEL32.dll	281	ExitProcess
KERNEL32.dll	724	HeapSize
KERNEL32.dll	453	GetCurrentThreadId
KERNEL32.dll	1139	SetLastError
KERNEL32.dll	536	GetModuleHandleW
KERNEL32.dll	1222	TlsFree
KERNEL32.dll	1224	TlsSetValue
KERNEL32.dll	1223	TlsGetValue
KERNEL32.dll	1221	TlsAlloc
KERNEL32.dll	778	IsValidCodePage
KERNEL32.dll	567	GetOEMCP
KERNEL32.dll	360	GetACP
KERNEL32.dll	768	IsDebuggerPresent
KERNEL32.dll	1189	SetUnhandledExceptionFilter
KERNEL32.dll	1235	UnhandledExceptionFilter
KERNEL32.dll	772	IsProcessorFeaturePresent
KERNEL32.dll	370	GetCPInfo
KERNEL32.dll	813	LCMapStringW
KERNEL32.dll	611	GetStartupInfoW
KERNEL32.dll	723	HeapSetInformation
KERNEL32.dll	390	GetCommandLineA
KERNEL32.dll	722	HeapReAlloc
KERNEL32.dll	1048	RtlUnwind
KERNEL32.dll	945	RaiseException
KERNEL32.dll	202	DecodePointer
KERNEL32.dll	234	EncodePointer
KERNEL32.dll	840	LocalFree
KERNEL32.dll	586	GetProcessHeap
KERNEL32.dll	448	GetCurrentProcess
KERNEL32.dll	751	InterlockedIncrement
KERNEL32.dll	747	InterlockedDecrement
KERNEL32.dll	748	InterlockedExchange
KERNEL32.dll	1316	WriteConsoleW
USER32.dll	291	GetDesktopWindow
USER32.dll	382	GetSystemMetrics
USER32.dll	229	EnumDisplayDevicesW
USER32.dll	53	CharToOemA
USER32.dll	526	MessageBoxA
USER32.dll	289	GetDC
USER32.dll	319	GetKeyboardLayoutList
USER32.dll	818	wsprintfA
USER32.dll	613	ReleaseDC
GDI32.dll	47	CreateCompatibleBitmap
GDI32.dll	631	SelectObject
GDI32.dll	19	BitBlt
GDI32.dll	230	DeleteObject
GDI32.dll	49	CreateDCA
GDI32.dll	459	GetDeviceCaps
GDI32.dll	48	CreateCompatibleDC
ADVAPI32.dll	598	RegGetValueW
ADVAPI32.dll	608	RegOpenKeyExA
ADVAPI32.dll	560	RegCloseKey
ADVAPI32.dll	356	GetUserNameA
ADVAPI32.dll	295	GetCurrentHwProfileA
ADVAPI32.dll	609	RegOpenKeyExW
ADVAPI32.dll	593	RegEnumValueA
ADVAPI32.dll	597	RegGetValueA
ADVAPI32.dll	590	RegEnumKeyExA
ADVAPI32.dll	621	RegQueryValueExA
SHELL32.dll	171	SHFileOperationA
SHELL32.dll	286	ShellExecuteA
SHELL32.dll	191	SHGetFolderPathA
ole32.dll	16	CoCreateInstance
ole32.dll	108	CoUninitialize
SHLWAPI.dll	123	PathMatchSpecW
SHLWAPI.dll	120	PathMatchSpecA
PSAPI.DLL	15	GetModuleFileNameExA
PSAPI.DLL	13	GetModuleBaseNameA
PSAPI.DLL	4	EnumProcessModules
WININET.dll	113	InternetConnectA
WININET.dll	152	InternetOpenUrlA
WININET.dll	172	InternetSetOptionA
WININET.dll	171	InternetSetFilePointer
WININET.dll	89	HttpQueryInfoA
WININET.dll	82	HttpAddRequestHeadersA
WININET.dll	107	InternetCloseHandle
WININET.dll	159	InternetReadFile
WININET.dll	91	HttpSendRequestA
WININET.dll	87	HttpOpenRequestA
WININET.dll	151	InternetOpenA
gdiplus.dll	54	GdipCloneImage
gdiplus.dll	629	GdiplusStartup
gdiplus.dll	77	GdipCreateBitmapFromHBITMAP
gdiplus.dll	286	GdipGetImageEncoders
gdiplus.dll	496	GdipSaveImageToFile
gdiplus.dll	287	GdipGetImageEncodersSize
gdiplus.dll	237	GdipFree
gdiplus.dll	33	GdipAlloc
gdiplus.dll	628	GdiplusShutdown
gdiplus.dll	152	GdipDisposeImage
CRYPT32.dll	216	CryptStringToBinaryA
CRYPT32.dll	219	CryptUnprotectData

show previews

offset	size	type	comment
0	555008	EXE	03/01/2021 19:54:24	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK