payload1.exe

info
MZ
PE
imports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	payload1.exe
size	3739841 (0x3910c1)
md5	6b757d9ed9ee6212b7c839c00a5693c9

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
150	20413	1
132	21022	34
149	21022	22
123	50727	9
1	0	132
131	21022	109
145	21022	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x53789d1f
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x103
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0x10000
SizeOfInitializedData	0x23c800
SizeOfUninitializedData	0
AddressOfEntryPoint	0x7772
BaseOfCode	0x1000
BaseOfData	0x11000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0x24f000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0x8000
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xfe48	0x10000	R-X CODE
.rdata	0x11000	0x246e	0x2600	R-- IDATA
.data	0x14000	0x23a0c8	0x238400	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x12974	0x64
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x12460	0x40
Bound_IAT	0	0
IAT	0x11000	0x1e4
Delay_IAT	0	0
CLR_Header	0	0

hint	ord	function_name
	1617500928
	846142232
52428		cc cc cc 55 8b ec 51 68 bc 9e 64 \|...U..Qh..d \|
35670		44 24 18 0b c0 75 18 8b 4c 24 14 8b 44 24 10 33 \|D$...u..L$..D$.3\| d2 f7 f1 8b d8 8b 44 24 0c f7 f1 8b d3 eb 41 8b \|......D$......A.\| c8 8b 5c 24 14 8b 54 24 10 8b 44 24 0c d1 e9 d1 \|..\$..T$..D$....\| db d1 ea d1 d8 0b c9 75 f4 f7 f3 8b f0 f7 64 24 \|.......u......d$\| 18 8b c8 8b 44 24 14 f7 e6 03 d1 72 0e 3b 54 24 \|....D$.....r.;T$\| 10 77 08 72 07 3b 44 24 0c 76 01 4e 33 d2 8b c6 \|.w.r.;D$.v.N3...\| 5e 5b c2 10 \|^[.. \|
		04 23 b0 81 02 0f 61 75 74 68 70 72 6f 62 6c 65 \|.#....authproble\| 6d \|m \|
59444		47 5e 01 \|G^. \|
33931		24 dc \|$. \|
9284		10 33 d2 f7 f1 8b d8 8b 44 24 0c f7 f1 8b d3 eb \|.3......D$......\| 41 8b c8 8b 5c 24 14 8b 54 24 10 8b 44 24 0c d1 \|A...\$..T$..D$..\| e9 d1 db d1 ea d1 d8 0b c9 75 f4 f7 f3 8b f0 f7 \|.........u......\| 64 24 18 8b c8 8b 44 24 14 f7 e6 03 d1 72 0e 3b \|d$....D$.....r.;\| 54 24 10 77 08 72 07 3b 44 24 0c 76 01 4e 33 d2 \|T$.w.r.;D$.v.N3.\| 8b c6 5e 5b c2 10 \|..^[.. \|
	1769587
	193010432
63442		f1 8b d8 8b 44 24 0c f7 f1 8b d3 eb 41 8b c8 8b \|....D$......A...\| 5c 24 14 8b 54 24 10 8b 44 24 0c d1 e9 d1 db d1 \|\$..T$..D$......\| ea d1 d8 0b c9 75 f4 f7 f3 8b f0 f7 64 24 18 8b \|.....u......d$..\| c8 8b 44 24 14 f7 e6 03 d1 72 0e 3b 54 24 10 77 \|..D$.....r.;T$.w\| 08 72 07 3b 44 24 0c 76 01 4e 33 d2 8b c6 5e 5b \|.r.;D$.v.N3...^[\| c2 10 \|.. \|
	169541733

54155		eb 41 8b c8 8b 5c 24 14 8b 54 24 10 8b 44 24 0c \|.A...\$..T$..D$.\| d1 e9 d1 db d1 ea d1 d8 0b c9 75 f4 f7 f3 8b f0 \|..........u.....\| f7 64 24 18 8b c8 8b 44 24 14 f7 e6 03 d1 72 0e \|.d$....D$.....r.\| 3b 54 24 10 77 08 72 07 3b 44 24 0c 76 01 4e 33 \|;T$.w.r.;D$.v.N3\| d2 8b c6 5e 5b c2 10 \|...^[.. \|
	253427813
65535		b6 bc \|.. \|
	194190080
9308		14 8b 54 24 10 8b 44 24 0c d1 e9 d1 db d1 ea d1 \|..T$..D$........\| d8 0b c9 75 f4 f7 f3 8b f0 f7 64 24 18 8b c8 8b \|...u......d$....\| 44 24 14 f7 e6 03 d1 72 0e 3b 54 24 10 77 08 72 \|D$.....r.;T$.w.r\| 07 3b 44 24 0c 76 01 4e 33 d2 8b c6 5e 5b c2 10 \|.;D$.v.N3...^[..\|
14708		8d 95 e8 fe ff ff 52 6a 04 8d 85 ec fe ff ff 50 \|......Rj.......P\| 8b 4d fc 51 e8 1b 22 \|.M.Q.." \|
26207		romhere
874		e8 5f 72 ff ff cc cc cc cc cc cc 53 56 8b 44 24 \|._r........SV.D$\| 18 0b c0 75 18 8b 4c 24 14 8b 44 24 10 33 d2 f7 \|...u..L$..D$.3..\| f1 8b d8 8b 44 24 0c f7 f1 8b d3 eb 41 8b c8 8b \|....D$......A...\| 5c 24 14 8b 54 24 10 8b 44 24 0c d1 e9 d1 db d1 \|\$..T$..D$......\| ea d1 d8 0b c9 75 f4 f7 f3 8b f0 f7 64 24 18 8b \|.....u......d$..\| c8 8b 44 24 14 f7 e6 03 d1 72 0e 3b 54 24 10 77 \|..D$.....r.;T$.w\| 08 72 07 3b 44 24 0c 76 01 4e 33 d2 8b c6 5e 5b \|.r.;D$.v.N3...^[\| c2 10 \|.. \|
	1652497944
64492		ff ff 0f be 8c 05 f8 fb ff ff 51 e8 dc 30 \|..........Q..0 \|
	18743296
64496		ff ff 50 ff 15 30 10 41 \|..P..0.A \|
	52297728
	102630431
51199		85 fc ef ff ff \|..... \|
62605		fe ff ff 83 c1 01 89 8d f4 fe ff ff 83 3d e8 c2 \|.............=..\| 64 \|d \|
65535		b8 \|. \|
	1880358947
25199		al_init
	1752505856
52293		c7 40 18 \|.@. \|
		b8 \|. \|
17607		24 04 01 \|$.. \|
	478420480
20365		e0 d3 eb 8b 4d fc 8d 8c 88 c4 \|....M..... \|
57423		d3 eb 8b 4d fc 8d 8c 88 c4 \|...M..... \|
2117		50 e8 ee 45 \|P..E \|
31855		24 70 89 f2 8d 8e \|$p.... \|
49699		83 c4 10 83 f8 ff 0f 84 44 ff ff ff ff 75 08 e8 \|........D....u..\| 96 df ff ff 59 50 ff 15 58 10 41 \|....YP..X.A \|
3149		51 8b 55 08 52 e8 85 fe ff ff 83 c4 0c 89 45 f8 \|Q.U.R.........E.\| b8 01 \|.. \|
19
	1662452767
100		ff 15 a0 10 41 \|....A \|
	48895752
	1863778304
62533		c7 40 04 \|.@. \|
4087		84 01 01 \|... \|
59392		f0 2e \|.. \|
14596		85 ec fb ff ff 73 26 8b 85 ec fb ff ff 0f be 8c \|.....s&.........\| 05 f8 fb ff ff 51 e8 dc 30 \|.....Q..0 \|
	1308697623
256
493		j9
29957		0b e8 36 86 ff ff c7 \|..6.... \|
49285		0f 88 82 \|... \|
13059
	1795240471
	1895907095
55435		eb 0a c7 85 e8 fd ff ff a3 \|......... \|
46733
36237		68 fe ff ff 51 e8 42 ff ff ff 83 c4 04 85 c0 75 \|h...Q.B........u\| 07 b8 01 \|... \|
29700		01 \|. \|
31464		1e \|. \|
4
	822174487
50307		04 8b 95 ec fb ff ff 88 84 15 f8 fb ff ff eb b4 \|................\| 68 90 9e 64 \|h..d \|
36096		45 10 50 68 a0 2e 40 \|E.Ph..@ \|
	1795265303
	353828985
16898		0d 05 \|.. \|
	387383396
	1795267607
	521601140
	1795268887
	706150503
	1795272727
	941031424
	1795278871
	1795279383
19853		08 51 ff 15 d0 11 41 \|.Q....A \|
	1293357056
	637658903
35556		80 e1 \|.. \|
53736		-
	1828848151
	1208030720
15866		75 06 c6 45 fa \|u..E. \|
512		70 03 01 be 12 \|p.... \|
	906111255
17607		24 08 \|$. \|
	2013295731
	838997527
17803		e0 89 50 04 8b 15 40 60 84 70 8b 45 e0 8b 40 04 \|..P...@`.p.E..@.\| 89 04 24 ff d2 89 c2 8b 45 e0 89 10 8b 45 e0 8b \|..$.....E....E..\|
33807		01 01 \|.. \|
35607		45 9c 8b 55 d0 89 50 24 8b 45 9c 8b 55 d0 89 50 \|E..U..P$.E..U..P\| 0c e9 20 02 \|.. . \|
	1795303447
19851		f8 51 e8 0f 37 \|.Q..7 \|
1		89 b5 e8 fd ff ff 8b 40 fc 6a 50 89 85 e4 fd ff \|.......@.jP.....\| ff 8d 85 d8 fc ff ff 6a \|.......j \|
	1795307543
29531		tream->buffer_pos] == c
52428		cc 55 8b ec 81 ec d8 \|.U..... \|
	1277362944
	1344471808
2084		8d 45 ef 89 44 24 04 8b 45 08 89 04 24 e8 0a fc \|.E..D$..E...$...\| ff ff 89 45 f0 83 7d f0 \|...E..}. \|
	1478689536
	1795315991
35622		85 ec fb ff ff 0f be 8c 05 f8 fb ff ff 51 e8 9c \|.............Q..\| 32 \|2 \|
	1795316247
	18284660
	35061861
52428		cc cc 55 8b ec 83 ec 10 c7 45 fc \|..U......E. \|
3467		e0 c2 64 \|..d \|
	337051751
	2130877975
	605487211
20744		68 cc b0 64 \|h..d \|
	1008140288
65413		74 3f 57 ff 15 98 11 41 \|t?W....A \|
1161		24 e8 3a 1f \|$.:. \|
	605487104
19617		a2 64 \|.d \|
	1795425024
	184620544
	2030043136
17805		ef 89 44 24 04 8b 45 08 89 04 24 e8 0a fc ff ff \|..D$..E...$.....\| 89 45 f0 83 7d f0 \|.E..}. \|
	1594098432
	2031550464
2
63637		fb ff ff 52 e8 e8 32 \|...R..2 \|
		74 2f 8d 85 f8 fe ff ff 50 8b 0d 48 a2 64 \|t/......P..H.d \|
59473		6c fc ff ff 83 c4 14 a3 d0 c2 64 \|l.........d \|
	1394016256
4086		85 dc fb ff ff 0f b6 70 e5 0f b6 51 e5 2b f2 74 \|.......p...Q.+.t\| 15 33 d2 85 f6 0f 9f c2 8d 54 12 ff 8b f2 85 f6 \|.3.......T......\| 0f 85 bb fb ff ff 0f b6 70 e6 0f b6 51 e6 2b f2 \|........p...Q.+.\| 74 11 33 d2 85 f6 0f 9f c2 8d 54 12 ff 8b f2 eb \|t.3.......T.....\| 02 33 f6 85 f6 0f 85 96 fb ff ff 8b 50 e7 3b 51 \|.3..........P.;Q\| e7 74 7d 0f b6 f2 0f b6 51 e7 2b f2 74 15 33 d2 \|.t}.....Q.+.t.3.\| 85 f6 0f 9f c2 8d 54 12 ff 8b f2 85 f6 0f 85 6e \|......T........n\| fb ff ff 0f b6 70 e8 0f b6 51 e8 2b f2 74 15 33 \|.....p...Q.+.t.3\| d2 85 f6 0f 9f c2 8d 54 12 ff 8b f2 85 f6 0f 85 \|.......T........\| 4d fb ff ff 0f b6 70 e9 0f b6 51 e9 2b f2 74 15 \|M.....p...Q.+.t.\| 33 d2 85 f6 0f 9f c2 8d 54 12 ff 8b f2 85 f6 0f \|3.......T.......\| 85 2c fb ff ff 0f b6 70 ea 0f b6 51 ea 2b f2 74 \|.,.....p...Q.+.t\| 11 33 d2 85 f6 0f 9f c2 8d 54 12 ff 8b f2 eb 02 \|.3.......T......\| 33 f6 85 f6 0f 85 07 fb ff ff 8b 50 eb 3b 51 eb \|3..........P.;Q.\| 74 7d 0f b6 f2 0f b6 51 eb 2b f2 74 15 33 d2 85 \|t}.....Q.+.t.3..\| f6 0f 9f c2 8d 54 12 ff 8b f2 85 f6 0f 85 df fa \|.....T..........\| ff ff 0f b6 70 ec 0f b6 51 ec 2b f2 74 15 33 d2 \|....p...Q.+.t.3.\| 85 f6 0f 9f c2 8d 54 12 ff 8b f2 85 f6 0f 85 be \|......T.........\| fa ff ff 0f b6 70 ed 0f b6 51 ed 2b f2 74 15 33 \|.....p...Q.+.t.3\| d2 85 f6 0f 9f c2 8d 54 12 ff 8b f2 85 f6 0f 85 \|.......T........\| 9d fa ff ff 0f b6 70 ee 0f b6 51 ee 2b f2 74 11 \|......p...Q.+.t.\| 33 d2 85 f6 0f 9f c2 8d 54 12 ff 8b f2 eb 02 33 \|3.......T......3\| f6 85 f6 0f 85 78 fa ff ff 8b 50 ef 3b 51 ef 74 \|.....x....P.;Q.t\| 7d 0f b6 f2 0f b6 51 ef 2b f2 74 15 33 d2 85 f6 \|}.....Q.+.t.3...\| 0f 9f c2 8d 54 12 ff 8b f2 85 f6 0f 85 50 fa ff \|....T........P..\| ff 0f b6 70 f0 0f b6 51 f0 2b f2 74 15 33 d2 85 \|...p...Q.+.t.3..\| f6 0f 9f c2 8d 54 12 ff 8b f2 85 f6 0f 85 2f fa \|.....T......../.\| ff ff 0f b6 70 f1 0f b6 51 f1 2b f2 74 15 33 d2 \|....p...Q.+.t.3.\| 85 f6 0f 9f c2 8d 54 12 ff 8b f2 85 f6 0f 85 0e \|......T.........\| fa ff ff 0f b6 70 f2 0f b6 51 f2 2b f2 74 11 33 \|.....p...Q.+.t.3\| d2 85 f6 0f 9f c2 8d 54 12 ff 8b f2 eb 02 33 f6 \|.......T......3.\| 85 f6 0f 85 e9 f9 ff ff 8b 50 f3 3b 51 f3 74 7d \|.........P.;Q.t}\| 0f b6 f2 0f b6 51 f3 2b f2 74 15 33 d2 85 f6 0f \|.....Q.+.t.3....\| 9f c2 8d 54 12 ff 8b f2 85 f6 0f 85 c1 f9 ff ff \|...T............\| 0f b6 70 f4 0f b6 51 f4 2b f2 74 15 33 d2 85 f6 \|..p...Q.+.t.3...\| 0f 9f c2 8d 54 12 ff 8b f2 85 f6 0f 85 a0 f9 ff \|....T...........\| ff 0f b6 70 f5 0f b6 51 f5 2b f2 74 15 33 d2 85 \|...p...Q.+.t.3..\| f6 0f 9f c2 8d 54 12 ff 8b f2 85 f6 0f 85 7f f9 \|.....T..........\| ff ff 0f b6 70 f6 0f b6 51 f6 2b f2 74 11 33 d2 \|....p...Q.+.t.3.\| 85 f6 0f 9f c2 8d 54 12 ff 8b f2 eb 02 33 f6 85 \|......T......3..\| f6 0f 85 5a f9 ff ff 8b 50 f7 3b 51 f7 74 7e 0f \|...Z....P.;Q.t~.\| b6 51 f7 0f b6 70 f7 2b f2 74 15 33 d2 85 f6 0f \|.Q...p.+.t.3....\| 9f c2 8d 54 12 ff 8b f2 85 f6 0f 85 31 f9 ff ff \|...T........1...\| 0f b6 70 f8 0f b6 51 f8 2b f2 74 15 33 d2 85 f6 \|..p...Q.+.t.3...\| 0f 9f c2 8d 54 12 ff 8b f2 85 f6 0f 85 10 f9 ff \|....T...........\| ff 0f b6 70 f9 0f b6 51 f9 2b f2 74 15 33 d2 85 \|...p...Q.+.t.3..\| f6 0f 9f c2 8d 54 12 ff 8b f2 85 f6 0f 85 ef f8 \|.....T..........\| ff ff 0f b6 70 fa 0f b6 51 fa 2b f2 74 11 33 d2 \|....p...Q.+.t.3.\| 85 f6 0f 9f c2 8d 54 12 ff 8b f2 eb 02 33 f6 85 \|......T......3..\| f6 0f 85 ca f8 ff ff 8b 50 fb 3b 51 fb 74 7d 0f \|........P.;Q.t}.\| b6 f2 0f b6 51 fb 2b f2 74 15 33 d2 85 f6 0f 9f \|....Q.+.t.3.....\| c2 8d 54 12 ff 8b f2 85 f6 0f 85 a2 f8 ff ff 0f \|..T.............\| b6 70 fc 0f b6 51 fc 2b f2 74 15 33 d2 85 f6 0f \|.p...Q.+.t.3....\| 9f c2 8d 54 12 ff 8b f2 85 f6 0f 85 81 f8 ff ff \|...T............\| 0f b6 70 fd 0f b6 51 fd 2b f2 74 15 33 d2 85 f6 \|..p...Q.+.t.3...\| 0f 9f c2 8d 54 12 ff 8b f2 85 f6 0f 85 60 f8 ff \|....T........`..\| ff 0f b6 70 fe 0f b6 51 fe 2b f2 74 11 33 d2 85 \|...p...Q.+.t.3..\| f6 0f 9f c2 8d 54 12 ff 8b f2 eb 02 33 f6 85 f6 \|.....T......3...\| 0f 85 3b f8 ff ff 0f b6 49 ff 0f b6 40 ff 2b c1 \|..;.....I...@.+.\| 0f 84 \|.. \|
	906371351
	807600896
	1210254080
	606274560
	230957828
33807		c2 \|. \|
35820		45 08 8b \|E.. \|
	974585856
2125		51 68 68 b1 64 \|Qhh.d \|
64728		ff ff 6a \|..j \|
59472		e:
35072		b5 e8 fd ff ff 8b 40 fc 6a 50 89 85 e4 fd ff ff \|......@.jP......\| 8d 85 d8 fc ff ff 6a \|......j \|
26624		2c 01 \|,. \|
	672596067
33756		7d dc \|}. \|
26878		d0 24 41 \|.$A \|
3563		8b 4d fc 83 c1 01 89 4d fc eb c1 33 c0 8b e5 5d \|.M.....M...3...]\| c3 55 8b ec 83 ec 10 c7 45 fc \|.U......E. \|
52428		cc 55 8b ec 83 ec 14 c7 45 f0 04 \|.U......E.. \|
17805		f4 50 6a \|.Pj \|
65		85 c0 74 02 eb 07 33 c0 e9 94 \|..t...3... \|
	67371776
35593		45 fc 83 c0 01 89 45 fc 83 7d fc 03 7d 42 8b 4d \|E.....E..}..}B.M\| fc 6b c9 7c 8b 91 38 a0 64 \|.k.\|..8.d \|
60352		74 8b 55 ec 52 e8 1c 3b \|t.U.R..; \|
	2013265920
65008		ff ff 50 6a \|..Pj \|
	1310130277
60160		04 83 65 e0 \|..e. \|
32256		29 dc 0c f5 58 e3 42 \|)...X.B \|
	1308874263
	1308874519
	1477902444
388		01 \|. \|
	1511456883
2501		31 ef 8b 6c 24 18 89 7c 24 08 01 fb c1 c3 0d 31 \|1..l$..\|$......1\| d9 8b 5c 24 28 89 4c 24 14 01 f9 c1 c1 12 8d 3c \|..\$(.L$.......<\| 2e c1 c7 07 31 fb 89 5c 24 18 8b 7c 24 38 31 ca \|....1..\$..\|$81.\| 8d 4c 1d \|.L. \|
	1545011316
29184		07 b8 03 \|... \|
	1729560692
	1779892340
	337838848
	654568471
12374
	1795423255
64637		ff 74 06 33 c0 eb 07 eb 05 b8 01 \|.t.3....... \|
	184811031
17174		URLWC_ERROR
	1308887575
40005		8b 55 d0 89 50 24 8b 45 9c 8b 55 d0 89 50 0c e9 \|.U..P$.E..U..P..\| 20 02 \| . \|
	136512256
	402918679
21000		8b 85 e4 fd ff ff 50 ff 15 24 10 41 \|......P..$.A \|
29888		02 eb 07 33 c0 e9 e2 \|...3... \|
628		eb 04 33 c0 eb 5f 83 bd e4 fd ff ff \|..3.._...... \|
	486809111
19849		f4 8a 15 d6 b1 64 \|.....d \|
512		23 0c 0d 64 6f 5f 6d 6f 72 65 \|#..do_more \|
	956579095
	1308901655
	1795441431
	1795442455
21208		e8 a0 27 \|..' \|
35664		4d f8 51 e8 a2 3a \|M.Q..: \|
62091		85 f6 0f 85 a0 f9 ff ff 0f b6 70 f5 0f b6 51 f5 \|..........p...Q.\| 2b f2 74 15 33 d2 85 f6 0f 9f c2 8d 54 12 ff 8b \|+.t.3.......T...\| f2 85 f6 0f 85 7f f9 ff ff 0f b6 70 f6 0f b6 51 \|...........p...Q\| f6 2b f2 74 11 33 d2 85 f6 0f 9f c2 8d 54 12 ff \|.+.t.3.......T..\| 8b f2 eb 02 33 f6 85 f6 0f 85 5a f9 ff ff 8b 50 \|....3.....Z....P\| f7 3b 51 f7 74 7e 0f b6 51 f7 0f b6 70 f7 2b f2 \|.;Q.t~..Q...p.+.\| 74 15 33 d2 85 f6 0f 9f c2 8d 54 12 ff 8b f2 85 \|t.3.......T.....\| f6 0f 85 31 f9 ff ff 0f b6 70 f8 0f b6 51 f8 2b \|...1.....p...Q.+\| f2 74 15 33 d2 85 f6 0f 9f c2 8d 54 12 ff 8b f2 \|.t.3.......T....\| 85 f6 0f 85 10 f9 ff ff 0f b6 70 f9 0f b6 51 f9 \|..........p...Q.\| 2b f2 74 15 33 d2 85 f6 0f 9f c2 8d 54 12 ff 8b \|+.t.3.......T...\| f2 85 f6 0f 85 ef f8 ff ff 0f b6 70 fa 0f b6 51 \|...........p...Q\| fa 2b f2 74 11 33 d2 85 f6 0f 9f c2 8d 54 12 ff \|.+.t.3.......T..\| 8b f2 eb 02 33 f6 85 f6 0f 85 ca f8 ff ff 8b 50 \|....3..........P\| fb 3b 51 fb 74 7d 0f b6 f2 0f b6 51 fb 2b f2 74 \|.;Q.t}.....Q.+.t\| 15 33 d2 85 f6 0f 9f c2 8d 54 12 ff 8b f2 85 f6 \|.3.......T......\| 0f 85 a2 f8 ff ff 0f b6 70 fc 0f b6 51 fc 2b f2 \|........p...Q.+.\| 74 15 33 d2 85 f6 0f 9f c2 8d 54 12 ff 8b f2 85 \|t.3.......T.....\| f6 0f 85 81 f8 ff ff 0f b6 70 fd 0f b6 51 fd 2b \|.........p...Q.+\| f2 74 15 33 d2 85 f6 0f 9f c2 8d 54 12 ff 8b f2 \|.t.3.......T....\| 85 f6 0f 85 60 f8 ff ff 0f b6 70 fe 0f b6 51 fe \|....`.....p...Q.\| 2b f2 74 11 33 d2 85 f6 0f 9f c2 8d 54 12 ff 8b \|+.t.3.......T...\| f2 eb 02 33 f6 85 f6 0f 85 3b f8 ff ff 0f b6 49 \|...3.....;.....I\| ff 0f b6 40 ff 2b c1 0f 84 \|...@.+... \|
63108		03 \|. \|
	1394017316
33536		c4 0c e8 5c f7 ff ff 6b c0 16 05 80 a2 64 \|...\...k.....d \|
	1444348016
	1461125232
	1511456884
14056		86 ff ff c7 \|.... \|
	1528234083
	1545011304
32773		a2 64 \|.d \|
26624		10 9f 64 \|..d \|
10172
	10494724
	1308914967
	1008927744
	12591876
	1143145472
	1795456023
	1277363200
	236388468
	539165696
	28320516
	286720109
5
	1076036608
	402954519
	437715045
	1344472064
	504823912
	1814234112
	555155557
	1881342976
	1293222529
	1795466519
	1795467031
	33301252
	41952004
	42214148
	1041694820
	203621376
	42803972
	1125580901
	270730240
	1209466993
257
	44311300
	44573444
	1645674606
	807601152
	45359876
	1426326272
4224		A
	1914110051
	1947664483
	324887
28771		ip.h
1
	1795511319
	1795511575
	184900887
	1476747287
29811		r
9908
	1493530903
	1308982807
	1308983063
	1308983831
	68616292
	152502388
27748		l
	1680016128
	1795525143
	236388453
	1948451584
	365079
	1293222548
	538378337
	672596083
	1814233856
	1308994071
	1275440919
	184922391
	1761981719
	907477104
	203621120
	1795537943
	1795538711
	1108803700
	371393280
	1795539735
	1795540247
	1795541015
	1795542039
	1377239140
	706937600
	1394016360
	723714816
	1410793472
	740492032
	1427570688
	757269248
	1511456872
	874709760
	941818624
	1795546135
	1645674617
	1092813568
	1679229040
	1746337907
	1763115123
	1779892325
	1411580672
	1813446770
	1627778327
	1847001203
	1881342720
	1863778419
	389911
	1309013527
	1997996136
	69403392
	2048327780
261
	2081882216
6913		CURL_LOCK_ACCESS_SINGLE
	270729984
	1828979456
	1946419968
15671
	190644736
47238
	190775808
	1879151361
	1970307772
	385941607
	45939201
	45940592
	1023345051
	1023701122
	1016492162
	1852867261
	1024983463
	1025339522
	1030910082
	687931490
	45948161
	45949552
	1025638827
	1025994882
	1036677250
	1026294191
	1026650242
	1042444418
	1027277239
	1027633282
	1051095170
	1383105213
	1027932603
	1028288642
	1056862338
138
	1028915650
	1029271682
	1065513090
	1029243332
	1029599362
	1068396674
	1029898696
	1030254722
	1074163842
	45967360
	46039152
	2038432256
	1803616768
	1317274112
49021
	1057095796
	46039040
	46073712
	1057095680
25758
	285343744
2084
	619250176
	1177288849
	1812070400
	1083245312
	1945174528
	704053760
	1761280512
	1143954577
	285409280
	1077752164
	1092251778
	2016608364
	1215333057
	46364672
	46402928
	671219712
	738328690
	1208025578
	2138079940
	1651540676
	268435648
	604105218
	1963065445
	46426163
	46456944
116		.tftp_state_machine
	46464769
	46497136
	46497024
	46535536
	1208098306
	1175650562
	1206218882
	1097232514
	590675968
	100794468
	1206190080
	1254322306
	1100116098
	117571584
	184680448
	201457765
	235012215
	402821122
	1614434449
	1246036698
	1124139752
	1047560907
	604170242
	1177878673
	184741378
	184756226
	184756738
48640		Y@
	184763906
	1144413329
	1208175362
29841
	47256064
	47386224
14
	419692802
	2030305794
	402918658
	1393426432
	1408987266
	1114534018
	1177945233
	1399599976
	1408200834
	47446784
	47463280
	218234880
	235012203
	436797538
	2013266177
	259031768
25778
	1392771188
	67305588
	84082789
	100860007
	117637221
	159908608
29264		oviderA
16132		Pj
	1413218707
	1413574786
	1120301186
	1919976148
	453050475
	47467265
	47468656
	1414857119
	1415213186
	1134719106
	1315996372
	2054193876
	654377058
	47473665
	47475056
	721485922
	47476225
	47477616
	712016596
	788594786
	47478785
	47480176
	40927956
	1417806260
	1418162306
	1160671362
	922812485
	47482625
	47484016
	1418461625
	1418817666
	1166438530
	989921396
	47485185
	47486576
	1419116989
	1419473026
	1172205698
	453099265
	544244436
	1107361895
	47489025
	47490416
	1140916327
	47490305
	47491696
	704759297
	795902676
	242254548
	1208025204
	47492865
	47494256
51336		d
26228		ieldsize
	1427767296
	1442934914
	1195274370
	1695744000
	47579392
	47638640
24389		TFTP_PERM
	1744933122
	376472279
	1661049858
	1114669783
	151102466
	1852867288
	939524295
	620888180
	1593835777
	1482424418
	1610576002
	441479298
	1389560832
	1686242080
	2105737984
	143196928
	2106196736
	1646986496
	1644953600

show previews

offset	size	type	comment
0	2403840	EXE	05/18/2014 11:44:31	#
15c1	15	HTM		#
24ae00	1336001	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 3739841 bytes (3653 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] non-empty last IMAGE_IMPORT_DESCRIPTOR: #<struct PEdump::IMAGE_IMPORT_DESCRIPTOR OriginalFirstThunk=104, TimeDateStamp=1919051078, ForwarderChain=2037539189, Name=0, FirstThunk=1970168138, module_name=nil, original_first_thunk=nil, first_thunk=nil>

[?] can't find file_offset of VA 0x840084

[!] too many bad imported function names. skipping further imports parsing