filename7u65j5hg.exe
size266752 (0x41200)
md59c8b2d84665aeedc1368e9951c07a469
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
1493072918
13130729102
1323072947
109507271
1235072723
10168
138307291
148210221
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x56a8c3e1
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion9.0
SizeOfCode0x2ea00
SizeOfInitializedData0x12400
SizeOfUninitializedData0
AddressOfEntryPoint0xdbb4
BaseOfCode0x1000
BaseOfData0x30000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x45000
SizeOfHeaders0x400
CheckSum0x4bf33
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x2e90e0x2ea00R-X CODE
.rdata0x300000xe0400xe200R-- IDATA
.data0x3f0000x2c9c0x1200RW- IDATA
.rsrc0x420000x2ea80x3000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x3d2700xdc
RESOURCE0x420000x2ea8
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x302a00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x3b0900x40
Bound_IAT00
IAT0x300000x260
Delay_IAT00
CLR_Header00
typenamesizecp
BITMAPIDB_BANNER_25636121252
DIALOG#114761252
DIALOG#2088281252
DIALOG#2126861252
DIALOG#213441252
STRING#13061252
STRING#22641252
STRING#31661252
STRING#42101252
STRING#52641252
STRING#66481252
STRING#73101252
RCDATA#115541252
RCDATA#1165701252
RCDATA#1171621252
RCDATA#12011141252
RCDATA#12021321252
MESSAGETABLE#110801252
VERSION#18761252
MANIFEST#13461252
idlangstring
11033IME Pad
21033IME Pad Menu
31033Applet Menu
41033Back
51033Version
61033Help
71033IME Pad's Help
81033Close
91033IME Pad Properties
101033Add Applets
111033Left
121033Right
131033Applet's title
141033FileName
151033User Settings
161033Undef
171033Undef
181033Undef
191033Property
201033Help
211033< &Back
221033&Next >
231033&Finish
241033Undef
251033Undef
261033Undef
271033Auto
281033English
291033Chinese(PRC)
301033Chinese(Traditional)
311033Japanese
321033Korean
331033BS
341033Enter
351033Space
361033Del
371033Esc
381033Home
391033PgUp
401033Tab
411033Win
421033End
431033PgDn
441033Insert
451033Appkey
461033None
471033Pinyin
481033BPMF/Chgjie
491033Conv
501033Hanja
5110330x00
5210330xC0
5310330x1C/0x1C
5410330x1C
5510330x19
561033BackSpace
571033Enter
581033Space
591033Delete
601033Escape
611033Home
621033PageUp
631033Tab
641033Window
651033End
661033PageDown
671033Insert
681033AppKey
691033ArrowLeft
701033ArrowRight
711033ArrowUp
721033ArrowDown
731033None
741033PinYin
751033Bopomofo/ChangJie
761033Conversion
771033Undef
781033Undef
791033Undef
801033Undef
811033Undef
821033The specified folder does not exist.
831033The specified folder does not exist. Do you want to create it?
841033Failed to create folder.
851033There is no IME Pad Applet in this folder.
861033Not enough memory.
871033Cannot find specified Applet.
881033This operation requires Administrator privileges.
891033Undef
901033Undef
911033Undef
921033Undef
931033Undef
941033Undef
951033Segoe UI
961033Segoe UI
971033Segoe UI
981033Segoe UI
991033Segoe UI
1001033Segoe UI
1011033Segoe UI
1021033Segoe UI
1031033About IME Pad
1041033Microsoft® IME Pad
1051033© 2012 Microsoft Corporation. All rights reserved.
1061033OK
module_namehintordfunction_name
KERNEL32.dll1190lstrcatA
KERNEL32.dll571GetStdHandle
KERNEL32.dll486GetLastError
KERNEL32.dll544GetProcAddress
KERNEL32.dll753LoadLibraryA
KERNEL32.dll411GetConsoleScreenBufferInfo
KERNEL32.dll761LocalAlloc
KERNEL32.dll502GetModuleHandleA
KERNEL32.dll273FillConsoleOutputAttribute
KERNEL32.dll82CompareStringA
KERNEL32.dll67CloseHandle
KERNEL32.dll765LocalFree
KERNEL32.dll1199lstrcpyA
KERNEL32.dll1020SetStdHandle
KERNEL32.dll1164WriteConsoleW
KERNEL32.dll409GetConsoleOutputCP
KERNEL32.dll1154WriteConsoleA
KERNEL32.dll991SetFilePointer
KERNEL32.dll321FlushFileBuffers
KERNEL32.dll405GetConsoleMode
KERNEL32.dll387GetConsoleCP
KERNEL32.dll490GetLocaleInfoW
KERNEL32.dll678HeapSize
KERNEL32.dll739LCMapStringW
KERNEL32.dll737LCMapStringA
KERNEL32.dll939SetConsoleCursorPosition
KERNEL32.dll426GetCurrentProcessId
KERNEL32.dll614GetTickCount
KERNEL32.dll852QueryPerformanceCounter
KERNEL32.dll471GetFileType
KERNEL32.dll1000SetHandleCount
KERNEL32.dll821OpenSemaphoreA
KERNEL32.dll331FreeEnvironmentStringsW
KERNEL32.dll447GetEnvironmentStrings
KERNEL32.dll330FreeEnvironmentStringsA
KERNEL32.dll693InitializeCriticalSectionAndSpinCount
KERNEL32.dll576GetStringTypeW
KERNEL32.dll794MultiByteToWideChar
KERNEL32.dll573GetStringTypeA
KERNEL32.dll733IsValidLocale
KERNEL32.dll248EnumSystemLocalesA
KERNEL32.dll488GetLocaleInfoA
KERNEL32.dll621GetUserDefaultLCID
KERNEL32.dll731IsValidCodePage
KERNEL32.dll531GetOEMCP
KERNEL32.dll338GetACP
KERNEL32.dll347GetCPInfo
KERNEL32.dll429GetCurrentThreadId
KERNEL32.dll1004SetLastError
KERNEL32.dll1057Sleep
KERNEL32.dll756LoadLibraryW
KERNEL32.dll1165WriteFile
KERNEL32.dll414GetConsoleTitleA
KERNEL32.dll591GetSystemTimeAsFileTime
KERNEL32.dll547GetProcessHeap
KERNEL32.dll673HeapFree
KERNEL32.dll425GetCurrentProcess
KERNEL32.dll1075TlsFree
KERNEL32.dll1077TlsSetValue
KERNEL32.dll1074TlsAlloc
KERNEL32.dll1076TlsGetValue
KERNEL32.dll500GetModuleFileNameA
KERNEL32.dll676HeapReAlloc
KERNEL32.dll1108VirtualAlloc
KERNEL32.dll217EnterCriticalSection
KERNEL32.dll751LeaveCriticalSection
KERNEL32.dll669HeapAlloc
KERNEL32.dll274FillConsoleOutputCharacterA
KERNEL32.dll120CreateFileA
KERNEL32.dll449GetEnvironmentStringsW
KERNEL32.dll190DeleteCriticalSection
KERNEL32.dll1111VirtualFree
KERNEL32.dll671HeapCreate
KERNEL32.dll914RtlUnwind
KERNEL32.dll858RaiseException
KERNEL32.dll569GetStartupInfoA
KERNEL32.dll367GetCommandLineA
KERNEL32.dll260ExitProcess
KERNEL32.dll505GetModuleHandleW
KERNEL32.dll700InterlockedDecrement
KERNEL32.dll704InterlockedIncrement
KERNEL32.dll1146WideCharToMultiByte
KERNEL32.dll721IsDebuggerPresent
KERNEL32.dll1045SetUnhandledExceptionFilter
KERNEL32.dll1069TerminateProcess
KERNEL32.dll1086UnhandledExceptionFilter
USER32.dll61CheckMenuItem
USER32.dll671SetUserObjectInformationA
USER32.dll466LoadCursorA
USER32.dll240FindWindowA
USER32.dll158DestroyMenu
USER32.dll400GetWindowThreadProcessId
USER32.dll458IsWindowVisible
USER32.dll242FindWindowExW
USER32.dll9AppendMenuA
USER32.dll101CreatePopupMenu
USER32.dll563RegisterClassA
USER32.dll381GetWindow
USER32.dll606SendMessageA
USER32.dll213EndPaint
USER32.dll670SetTimer
USER32.dll392GetWindowRect
USER32.dll373GetTopWindow
USER32.dll200DrawTextW
USER32.dll470LoadIconA
USER32.dll241FindWindowExA
USER32.dll100CreateMenu
USER32.dll397GetWindowTextLengthA
USER32.dll269GetClientRect
USER32.dll14BeginPaint
USER32.dll282GetDC
USER32.dll396GetWindowTextA
USER32.dll720TrackPopupMenuEx
USER32.dll426InvalidateRect
USER32.dll10AppendMenuW
USER32.dll385GetWindowLongA
USER32.dll103CreateWindowExA
USER32.dll327GetMenuState
USER32.dll149DefWindowProcA
USER32.dll679SetWindowPos
USER32.dll216EnumChildWindows
GDI32.dll59CreateFontIndirectA
GDI32.dll208DeleteObject
GDI32.dll606SelectObject
GDI32.dll63CreateFontW
GDI32.dll653SetTextColor
ADVAPI32.dll185CryptEnumProvidersA
SHELL32.dll30DragQueryFileA
SHELL32.dll117SHBindToParent
SHELL32.dll239SHParseDisplayName
ole32.dll15CoCreateGuid
ole32.dll61CoInitialize
ole32.dll315StringFromGUID2
ole32.dll107CoUninitialize
ole32.dll16CoCreateInstance
CRYPT32.dll87CertOpenSystemStoreA
CRYPT32.dll53CertFindCertificateInStore
CRYPT32.dll63CertFreeCertificateContext
RASAPI32.dll102RasValidateEntryNameA
RASAPI32.dll56RasGetErrorStringA
USP10.dll16ScriptIsComplex
RASDLG.dll6RasDialDlgA

StringTable 040904b0

FileDescriptionSpheres Knowing Foundation Upload Forensics
PrivateBuild2.3.4.480
CommentsSpheres Knowing Foundation Upload Forensics
LegalTrademarksOuterspace Software (C)
CompanyNameOuterspace Software
LegalCopyrightOuterspace Software (C)
ProductNameInto Retireved
ProductVersion2.3.4.480

VS_FIXEDFILEINFO

FileVersion2.3.4.480
ProductVersion2.3.4.480
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0266752EXE01/27/2016 13:19:29#
15c115HTM#
Scanning the drive for archives:
1 file, 266752 bytes (261 KiB)


--
Type = PE
Physical Size = 266752
CPU = x86
Characteristics = Executable 32-bit NoRelocs
Created = 2016-01-27 13:19:29
Headers Size = 1024
Checksum = 311091
Image Size = 282624
Section Alignment = 4096
File Alignment = 512
Code Size = 190976
Initialized Data Size = 74752
Uninitialized Data Size = 0
Linker Version = 9.0
OS Version = 5.0
Image Version = 0.0
Subsystem Version = 5.0
Subsystem = Windows GUI
DLL Characteristics = TerminalServerAware
Stack Reserve = 1048576
Stack Commit = 4096
Heap Reserve = 1048576
Heap Commit = 4096
Image Base = 4194304
Comment = FileVersion: 2.3.4.480
ProductVersion: 2.3.4.480
FileDescription: Spheres Knowing Foundation Upload Forensics
PrivateBuild: 2.3.4.480
Comments: Spheres Knowing Foundation Upload Forensics
LegalTrademarks: Outerspace Software (C)
CompanyName: Outerspace Software
LegalCopyright: Outerspace Software (C)
ProductName: Into Retireved
----
Path = .rsrc/RCDATA/116
Size = 570
Packed Size = 570
--
Path = .rsrc/RCDATA/116
Type = lzma

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
                    ..... 108852188028928               116~
------------------- ----- ------------ ------------  ------------------------
                          108852188028928       266752  1 files
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK