1.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	1.exe
size	1561600 (0x17d400)
md5	8701af6a7c231ecb94c1bc21ce689f34

type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x50
blocks_in_file	2
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0xf
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0x1a
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x2a425e19
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x818f
Magic	0x10b
LinkerVersion	2.25
SizeOfCode	0x179000
SizeOfInitializedData	0x5000
SizeOfUninitializedData	0xec2000
AddressOfEntryPoint	0x103b9d0
BaseOfCode	0xec3000
BaseOfData	0x103c000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x1041000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x4000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

UPX v0.89.6 - v1.02 / v1.05 - v1.22

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
UPX0	0x1000	0xec2000	0	RWX UDATA
UPX1	0xec3000	0x179000	0x178c00	RWX IDATA
.rsrc	0x103c000	0x5000	0x4400	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x103fef0	0x38c
RESOURCE	0x103c000	0x3ef0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x103bb74	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x143bb8c	0x143bbc8	0x7340cc	0	0	0

show previews

type	name	size
CURSOR	#1	308
CURSOR	#2	308
CURSOR	#3	308
CURSOR	#4	308
CURSOR	#5	308
CURSOR	#6	308
CURSOR	#7	308
CURSOR	#8	308
CURSOR	#9	308
CURSOR	#10	308
CURSOR	#11	308
BITMAP	BBABORT	464
BITMAP	BBALL	484
BITMAP	BBCANCEL	464
BITMAP	BBCLOSE	464
BITMAP	BBHELP	464
BITMAP	BBIGNORE	464
BITMAP	BBNO	464
BITMAP	BBOK	464
BITMAP	BBRETRY	464
BITMAP	BBYES	464
BITMAP	CDROM	192
BITMAP	CLOSEDFOLDER	224
BITMAP	CURRENTFOLDER	224
BITMAP	DBEDIT	92
BITMAP	DBGARROW	92
BITMAP	DBINSERT	92
BITMAP	DBMULTIARROW	92
BITMAP	DBMULTIDOT	92
BITMAP	DBN_CANCEL	312
BITMAP	DBN_DELETE	312
BITMAP	DBN_EDIT	312
BITMAP	DBN_FIRST	312
BITMAP	DBN_INSERT	312
BITMAP	DBN_LAST	312
BITMAP	DBN_NEXT	260
BITMAP	DBN_POST	312
BITMAP	DBN_PRIOR	260
BITMAP	DBN_REFRESH	312
BITMAP	EXECUTABLE	224
BITMAP	FLOPPY	192
BITMAP	FRXDEVICE_FNT	200
BITMAP	FRXOTHER_FNT	616
BITMAP	FRXTRUETYPE_FNT	200
BITMAP	HARD	192
BITMAP	KNOWNFILE	224
BITMAP	MENUBTN	3160
BITMAP	METRIC	808
BITMAP	NETWORK	192
BITMAP	OPENFOLDER	224
BITMAP	PREVIEWGLYPH	232
BITMAP	PS	808
BITMAP	RAM	192
BITMAP	RASTER	808
BITMAP	SHMC_NEXT	184
BITMAP	SHMC_PRIOR	184
BITMAP	SPINDOWN	152
BITMAP	SPINUP	152
BITMAP	TEXSHDATEPICKER	392
BITMAP	TSHDATEPICKER	392
BITMAP	TSHMONTHCALENDAR	392
BITMAP	TTF	808
BITMAP	UNKNOWN	808
BITMAP	UNKNOWNFILE	224
ICON	#1	3240
DIALOG	DLGTEMPLATE	82
STRING	#3682	76
STRING	#3683	146
STRING	#3684	390
STRING	#3685	462
STRING	#3686	322
STRING	#3687	140
STRING	#3688	42
STRING	#4056	212
STRING	#4057	332
STRING	#4058	328
STRING	#4059	264
STRING	#4060	1076
STRING	#4061	1064
STRING	#4062	500
STRING	#4063	1492
STRING	#4064	1028
STRING	#4065	1308
STRING	#4066	1368
STRING	#4067	868
STRING	#4068	976
STRING	#4069	880
STRING	#4070	1020
STRING	#4071	948
STRING	#4072	788
STRING	#4073	828
STRING	#4074	876
STRING	#4075	1388
STRING	#4076	864
STRING	#4077	468
STRING	#4078	384
STRING	#4079	488
STRING	#4080	972
STRING	#4081	384
STRING	#4082	236
STRING	#4083	440
RCDATA	TFORMMGRVBR	11592
RCDATA	TFORMMSG	22511
RCDATA	TFORMNEMODAR	9673
RCDATA	TFORMPLZSLEEP	1133
RCDATA	TFORMPROCC	1007
RCDATA	TFORMPROGMSG	1220
RCDATA	TFORMREPORT	3435
RCDATA	TFORMROLE	2705
RCDATA	TFORMSENDER	3848
RCDATA	TFORMSETTINGS	26576
RCDATA	TFORMSHOWMSG	5269
RCDATA	TFORMSUBGROUP	19401
RCDATA	TFORMVCODE	9904
RCDATA	TFORMVIEWREPORT	22212
RCDATA	TFORMVM	28270
RCDATA	TFRXCHARTEDITORFORM	5199
RCDATA	TFRXCSVEXPORTDIALOG	1846
RCDATA	TFRXDIALOGFORM	304
RCDATA	TFRXFORMATEDITORFORM	1367
RCDATA	TFRXHIGHLIGHTEDITORFORM	1978
RCDATA	TFRXIMGEXPORTDIALOG	2027
RCDATA	TFRXINHERITERRORFORM	18082
RCDATA	TFRXMAILEXPORTDIALOG	3446
RCDATA	TFRXMEMOEDITORFORM	1408
RCDATA	TFRXOBJECTINSPECTOR	3077
RCDATA	TFRXPAGESETTINGSFORM	4450
RCDATA	TFRXPASSWORDFORM	7174
RCDATA	TFRXPDFEXPORTDIALOG	2059
RCDATA	TFRXPOPUPFORM	364
RCDATA	TFRXPREVIEWFORM	3621
RCDATA	TFRXPRINTDIALOG	109742
RCDATA	TFRXPROGRESS	965
RCDATA	TFRXRTFEXPORTDIALOG	2192
RCDATA	TFRXSEARCHDIALOG	1506
RCDATA	TFRXSIMPLETEXTEXPORTDIALOG	2052
RCDATA	TFRXSYSMEMOEDITORFORM	2793
RCDATA	TFRXXLSEXPORTDIALOG	2405
RCDATA	TFRXXMLEXPORTDIALOG	1998
RCDATA	TLOGINDIALOG	1172
RCDATA	TPASSWORDDIALOG	964
RCDATA	TSCALCFORM	6919
RCDATA	TSCOLORDIALOGFORM	7053
RCDATA	TTEEGALLERY	691
GROUP_CURSOR	FRXFORMAT	20
GROUP_CURSOR	FRXHAND	20
GROUP_CURSOR	FRXZOOM	20
GROUP_CURSOR	TEE_CURSOR_HAND	20
GROUP_CURSOR	#32761	20
GROUP_CURSOR	#32762	20
GROUP_CURSOR	#32763	20
GROUP_CURSOR	#32764	20
GROUP_CURSOR	#32765	20
GROUP_CURSOR	#32766	20
GROUP_CURSOR	#32767	20
GROUP_ICON	MAINICON	20

module_name	hint	ord	function_name
KERNEL32.DLL			LoadLibraryA
KERNEL32.DLL			GetProcAddress
KERNEL32.DLL			VirtualProtect
KERNEL32.DLL			VirtualAlloc
KERNEL32.DLL			VirtualFree
KERNEL32.DLL			ExitProcess
advapi32.dll			RegFlushKey
comctl32.dll			ImageList_Add
comdlg32.dll			PrintDlgA
gdi32.dll			Pie
mpr.dll			WNetGetConnectionA
netapi32.dll			Netbios
ole32.dll			OleDraw
oleaut32.dll			VariantCopy
shell32.dll			ShellExecuteA
user32.dll			GetDC
version.dll			VerQueryValueA
wininet.dll			InternetOpenA
winspool.drv			WritePrinter
wsock32.dll			send

show previews

offset	size	type	comment
0	1561600	EXE	06/19/1992 22:22:17	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x38722c

[?] can't find file_offset of VA 0x387360

[?] can't find file_offset of VA 0x387494

[?] can't find file_offset of VA 0x3875c8

[?] can't find file_offset of VA 0x3876fc

[?] can't find file_offset of VA 0x387830

[?] can't find file_offset of VA 0x387964

[?] can't find file_offset of VA 0x387a98

[?] can't find file_offset of VA 0x387bcc

[?] can't find file_offset of VA 0x387d00

[?] can't find file_offset of VA 0x387e34

[?] can't find file_offset of VA 0x387f68

[?] can't find file_offset of VA 0x388138

[?] can't find file_offset of VA 0x38831c

[?] can't find file_offset of VA 0x3884ec

[?] can't find file_offset of VA 0x3886bc

[?] can't find file_offset of VA 0x38888c

[?] can't find file_offset of VA 0x388a5c

[?] can't find file_offset of VA 0x388c2c

[?] can't find file_offset of VA 0x388dfc

[?] can't find file_offset of VA 0x388fcc

[?] can't find file_offset of VA 0x38919c

[?] can't find file_offset of VA 0x38925c

[?] can't find file_offset of VA 0x38933c

[?] can't find file_offset of VA 0x38941c

[?] can't find file_offset of VA 0x389478

[?] can't find file_offset of VA 0x3894d4

[?] can't find file_offset of VA 0x389530

[?] can't find file_offset of VA 0x38958c

[?] can't find file_offset of VA 0x3895e8

[?] can't find file_offset of VA 0x389720

[?] can't find file_offset of VA 0x389858

[?] can't find file_offset of VA 0x389990

[?] can't find file_offset of VA 0x389ac8

[?] can't find file_offset of VA 0x389c00

[?] can't find file_offset of VA 0x389d38

[?] can't find file_offset of VA 0x389e3c

[?] can't find file_offset of VA 0x389f74

[?] can't find file_offset of VA 0x38a078

[?] can't find file_offset of VA 0x38a1b0

[?] can't find file_offset of VA 0x38a290

[?] can't find file_offset of VA 0x38a350

[?] can't find file_offset of VA 0x38a418

[?] can't find file_offset of VA 0x38a680

[?] can't find file_offset of VA 0x38a748

[?] can't find file_offset of VA 0x38a808

[?] can't find file_offset of VA 0x38a8e8

[?] can't find file_offset of VA 0x38b540

[?] can't find file_offset of VA 0x38b868

[?] can't find file_offset of VA 0x38b928

[?] can't find file_offset of VA 0x38ba08

[?] can't find file_offset of VA 0x38baf0

[?] can't find file_offset of VA 0x38be18

[?] can't find file_offset of VA 0x38bed8

[?] can't find file_offset of VA 0x38c200

[?] can't find file_offset of VA 0x38c2b8

[?] can't find file_offset of VA 0x38c370

[?] can't find file_offset of VA 0x38c408

[?] can't find file_offset of VA 0x38c4a0

[?] can't find file_offset of VA 0x38c628

[?] can't find file_offset of VA 0x38c7b0

[?] can't find file_offset of VA 0x38c938

[?] can't find file_offset of VA 0x38cc60

[?] can't find file_offset of VA 0x38cf88

[?] can't find file_offset of VA 0x38dd10

[?] can't find file_offset of VA 0x38dd64

[?] can't find file_offset of VA 0x38ddb0

[?] can't find file_offset of VA 0x38de44

[?] can't find file_offset of VA 0x38dfcc

[?] can't find file_offset of VA 0x38e19c

[?] can't find file_offset of VA 0x38e2e0

[?] can't find file_offset of VA 0x38e36c

[?] can't find file_offset of VA 0x38e398

[?] can't find file_offset of VA 0x38e46c

[?] can't find file_offset of VA 0x38e5b8

[?] can't find file_offset of VA 0x38e700

[?] can't find file_offset of VA 0x38e808

[?] can't find file_offset of VA 0x38ec3c

[?] can't find file_offset of VA 0x38f064

[?] can't find file_offset of VA 0x38f258

[?] can't find file_offset of VA 0x38f82c

[?] can't find file_offset of VA 0x38fc30

[?] can't find file_offset of VA 0x39014c

[?] can't find file_offset of VA 0x3906a4

[?] can't find file_offset of VA 0x390a08

[?] can't find file_offset of VA 0x390dd8

[?] can't find file_offset of VA 0x391148

[?] can't find file_offset of VA 0x391544

[?] can't find file_offset of VA 0x3918f8

[?] can't find file_offset of VA 0x391c0c

[?] can't find file_offset of VA 0x391f48

[?] can't find file_offset of VA 0x3922b4

[?] can't find file_offset of VA 0x392820

[?] can't find file_offset of VA 0x392b80

[?] can't find file_offset of VA 0x392d54

[?] can't find file_offset of VA 0x392ed4

[?] can't find file_offset of VA 0x3930bc

[?] can't find file_offset of VA 0x393488

[?] can't find file_offset of VA 0x393608

[?] can't find file_offset of VA 0x3936f4

[?] can't find file_offset of VA 0x3938ac

[?] too many errors getting resource data, stopped on 0 of 1

[!] refusing to read CURDIRENTRY beyond resource size

[?] can't find file_offset of VA 0x3340cc