filenameTwinz Rohan.exe
size2656867 (0x288a63)
md5ad5843478e07435910704645a7bff0a7
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavTrojan.Vilsel-142 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x50
blocks_in_file2
num_relocs0
header_paragraphs4
min_extra_paragraphs0xf
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0x1a
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

SignaturePE
Machine0x14c
NumberOfSections0xa
TimeDateStamp0x4d3cf918
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x818f
Magic0x10b
LinkerVersion2.25
SizeOfCode0x217c00
SizeOfInitializedData0x55400
SizeOfUninitializedData0
AddressOfEntryPoint0x218984
BaseOfCode0x1000
BaseOfData0x219000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x27a000
SizeOfHeaders0x400
CheckSum0x277726
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x4000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x215ad80x215c00R-X CODE
.itext0x2170000x1e440x2000R-X CODE
.data0x2190000x12fd80x13000RW- IDATA
.bss0x22c0000x6f1c0RW-
.idata0x2330000x45ce0x4600RW- IDATA
.didata0x2380000x3260x400RW- IDATA
.edata0x2390000x4b0x200R-- IDATA
.tls0x23a0000x1180RW-
.rdata0x23b0000x180x200R-- IDATA
.rsrc0x23c0000x3d40c0x3d600R-- IDATA

Data Directory

typevasize
EXPORT0x2390000x4b
IMPORT0x2330000x45ce
RESOURCE0x23c0000x3d40c
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x23b0000x18
LOAD_CONFIG00
Bound_IAT00
IAT0x233cb80xac4
Delay_IAT0x2380000x326
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x63a0000x63a1180x6199fc0x63b01000
typenamesizecp
MADCALIBRATE200
MADEXCEPT1065040
CURSOR#13080
CURSOR#23080
CURSOR#33080
CURSOR#43080
CURSOR#53080
CURSOR#63080
CURSOR#73080
CURSOR#83080
BITMAPBBABORT4640
BITMAPBBALL4840
BITMAPBBCANCEL4640
BITMAPBBCLOSE4640
BITMAPBBHELP4640
BITMAPBBIGNORE4640
BITMAPBBNO4640
BITMAPBBOK4640
BITMAPBBRETRY4640
BITMAPBBYES4640
BITMAPMEIBIG41360
BITMAPMEICANTCONTINUE10640
BITMAPMEICLOSE10640
BITMAPMEICONTINUE10640
BITMAPMEIPLWAIT41360
BITMAPMEIPRINT10640
BITMAPMEIRESTART10640
BITMAPMEISAVE10640
BITMAPMEISEND10640
BITMAPMEISEND3241360
BITMAPMEISHOW10640
BITMAPPREVIEWGLYPH2320
BITMAPRZCMBOBX_DEVICE12080
BITMAPRZCMBOBX_FIXEDPITCH12080
BITMAPRZCMBOBX_PRINTER12080
BITMAPRZCMBOBX_TRUETYPE12080
BITMAPRZCMBOBX_TRUETYPEFIXED12080
BITMAPRZCOMMON_ABORT15760
BITMAPRZCOMMON_ALL15760
BITMAPRZCOMMON_CANCEL15760
BITMAPRZCOMMON_CLOSE15760
BITMAPRZCOMMON_HELP15760
BITMAPRZCOMMON_IGNORE15760
BITMAPRZCOMMON_NO15760
BITMAPRZCOMMON_OK15760
BITMAPRZCOMMON_RETRY15760
BITMAPRZCOMMON_YES15760
ICON#113840
ICON#222160
ICON#337520
DIALOGDLGTEMPLATE820
DIALOGTEXTFILEDLG820
STRING#4061640
STRING#406211320
STRING#40639760
STRING#406414680
STRING#40659800
STRING#406619320
STRING#406730240
STRING#40686560
STRING#40693800
STRING#40702840
STRING#40712560
STRING#40728960
STRING#40739920
STRING#40748600
STRING#407511920
STRING#40768560
STRING#40779160
STRING#40786120
STRING#40798080
STRING#40807640
STRING#40811880
STRING#40822240
STRING#40835040
STRING#40849720
STRING#408510040
STRING#40868240
STRING#408715120
STRING#40889080
STRING#40899360
STRING#40908720
STRING#40912120
STRING#40921640
STRING#40937080
STRING#409411680
STRING#40958120
STRING#40967240
RCDATACHARTABLE335120
RCDATADVCLAL160
RCDATAPACKAGEINFO36880
RCDATATMADEXCEPT26760
RCDATATMAINFRM6630
RCDATATMECONTACTFORM8460
RCDATATMEDETAILSFORM5520
RCDATATMESCRSHOTFORM6750
RCDATATRZFRMCUSTOMIZETOOLBAR48440
GROUP_CURSORRZCOMMON_HANDCURSOR200
GROUP_CURSOR#32761200
GROUP_CURSOR#32762200
GROUP_CURSOR#32763200
GROUP_CURSOR#32764200
GROUP_CURSOR#32765200
GROUP_CURSOR#32766200
GROUP_CURSOR#32767200
GROUP_ICONMAINICON480
VERSION#17120
MANIFEST#18600
idlangstring
649600JPEG Image File
649760Mode has not been set.
649770Could not load SSL library.
649780SSL status: "%s"
649790IOHandler is of wrong type.
649800The destination filename can not be empty
649810Unsupported object type. You can assign only one of the following types or their descendants: TStrings, TStream.
649820Protocol field is empty
649830Host field is empty
649840SSL IOHandler is required for this setting
649850This value can not be set while the client is connected.
649860SSL is not available on this server.
649870Start SSL negotiation command failed.
649880Unsupported operation.
649890Unknown OTP method
649900Cannot change the size of a JPEG image
649910JPEG error #%d
649920No Compressor is assigned.
649930Compressor is not ready.
649940Unsupported transfer mode.
649950Unsupported transfer type.
649960Destination file already exists.
649970Error accepting connection with SSL.
649980Error connecting with SSL.
649990SetCipher failed.
650000Error creating SSL context.
650010Could not load root certificate.
650020Could not load certificate.
650030Could not load key, check password.
650040Error geting SSL method.
650050Error setting File Descriptor for SSL
650060Error binding data to SSL socket.
650070EOF was observed that violates the protocol
650080OnCustomFTPProxy required but not assigned
650090UseExtensionDataPort must be true for IPv6 connections.
650100UseExtensionDataPort must be true for NAT fasttracking.
650110Can not use active transfers with NAT fastracking.
650120Server sent invalid port number (%s)
650130No Site to Site transfers are permitted with a FTP NAT fastracked connection.
650140Can't use dataprotection on site to site transfer.
650150Transport protocols must be the same.
650160SSCN is not supported on both servers.
650170Can not set DataPortProtection after CCC issued.
650180Can not set DataPortProtection with unencrypted connections.
650190Can not set CCC without encyption.
650200Can not set AUTH without SSL.
650210Can not set AUTH while connected.
650220Transfer modes must be the same.
650230No FTP list parsers have been registered.
650240Unable to retrieve a pointer to a running object registered with OLE for %s/%s
650250IOHandler value is not valid
650260Extension is empty
650270Mimetype is empty
650280Extension already exits
650290Chunk Started
650300Not Acceptable
650310Unknown Protocol
650320Request method requires HTTP version 1.1
650330This authentication method is already registered with class name %s.
650340Unsupported hash algorithm. This implementation supports only MD5 encoding.
650350Unknown
650360Connection established
650370Starting FTP transfer
650380Transfer complete
650390Transfer aborted
650400The png image could not be loaded from the resource ID.
650410Some operation could not be performed because the system is out of resources. Close some windows and try again.
650420Setting bit transparency color is not allowed for png images containing alpha value for each pixel (COLOR_RGBALPHA and COLOR_GRAYSCALEALPHA)
650430This operation is not valid because the current image contains no valid header.
650440The new size provided for image resizing is invalid.
650450The "Portable Network Graphics" could not be created because invalid image type parameters have being provided.
650460OLE error %.8x
650470Method '%s' not supported by automation object
650480Variant does not reference an automation object
650490Dispatch methods do not support more than 64 parameters
650500DCOM not installed
650510'%s' is not a valid property value
650520OLE control activation failed
650530Could not obtain OLE control window handle
650540License information for %s is invalid
650550License information for %s not found. You cannot use this control in design mode
650560The "Portable Network Graphics" image could not be loaded because one of its main piece of data (ihdr) might be corrupted
650570This "Portable Network Graphics" image is invalid because it has missing image parts.
650580Could not decompress the image because it contains invalid compressed data. Description:
650590The "Portable Network Graphics" image contains an invalid palette.
650600The file being readed is not a valid "Portable Network Graphics" image because it contains an invalid header. This file may be corruped, try obtaining it again.
650610This "Portable Network Graphics" image is not supported or it might be invalid. (IHDR chunk is not the first)
650620This "Portable Network Graphics" image is not supported because either it's width or height exceeds the maximum size, which is 65535 pixels length.
650630There is no such palette entry.
650640This "Portable Network Graphics" image contains an unknown critical part which could not be decoded.
650650This "Portable Network Graphics" image is encoded with an unknown compression scheme which could not be decoded.
650660This "Portable Network Graphics" image uses an unknown interlace scheme which could not be decoded.
650670The chunks must be compatible to be assigned.
650680This "Portable Network Graphics" image is invalid because the decoder found an unexpected end of the file.
650690This "Portable Network Graphics" image contains no data.
650700The program tried to add a existent critical chunk to the current image which is not allowed.
650710It's not allowed to add a new chunk because the current image is invalid.
650720Button Face
650730Button Shadow
650740Gray Text
650750Button Text
650760Inactive Caption Text
650770Button Highlight
6507803D Dark Shadow
6507903D Light
650800Info Text
650810Info Background
650820Hot Light
650830Gradient Active Caption
650840Gradient Inactive Caption
650850Menu Highlight
650860Menu Bar
650870This "Portable Network Graphics" image is not valid because it contains invalid pieces of data (crc error)
650880White
650890Scroll Bar
650900Background
650910Active Caption
650920Inactive Caption
650930Menu
650940Window
650950Window Frame
650960Menu Text
650970Window Text
650980Caption Text
650990Active Border
651000Inactive Border
651010App WorkSpace
651020Highlight
651030Highlight Text
651040Gray 40%
651050Pink
651060Gold
651070Yellow
651080Bright Green
651090Turquoise
651100Sky Blue
651110Plum
651120Gray 25%
651130Rose
651140Tan
651150Light Yellow
651160Light Green
651170Light Turquoise
651180Pale Blue
651190Lavender
651200Gray 80%
651210Dark Red
651220Orange
651230Dark Yellow
651240Green
651250Teal
651260Blue
651270Blue Gray
651280Gray 50%
651290Red
651300Light Orange
651310Lime
651320Sea Green
651330Aqua
651340Light Blue
651350Violet
651360Buffer terminator must be specified.
651370Buffer start position is invalid.
651380Cannot change a connected IOHandler.
651390No IOHandler of type %s is installed.
651400Reply Code is not valid: %s
651410Reply Code already exists: %s
651420Cannot use a non-socket IOHandler
651430Cannot load Custom Framing settings--No TRzRegIniFile component specified
651440Cannot save Custom Framing settings--No TRzRegIniFile component specified
651450Black
651460Brown
651470Olive Green
651480Dark Green
651490Dark Teal
651500Dark Blue
651510Indigo
651520Not Connected
651530Object type not supported.
651540No data to read.
651550Read timed out.
651560Max line read attempts exceeded.
651570Accept timed out.
651580Max line length exceeded.
651590Set LargeStream to True to send streams greater than 2GB
651600Data is too large for stream
651610Connect timed out.
651620Cannot call TerminateAndWaitFor on FreeAndTerminate threads
651630Already connected.
651640Maximum number of line allowed exceeded
651650The IOHandler already has a different Intercept assigned
651660Transparent proxy cannot bind.
651670UDP Not supported by this proxy.
651680Unknown socks error.
651690Socks server did not respond.
651700Invalid socks authentication method.
651710Authentication error to socks server.
651720General SOCKS server failure.
651730Connection not allowed by ruleset.
651740Network unreachable.
651750Host unreachable.
651760Connection refused.
651770TTL expired.
651780Command not supported.
651790Address type not supported.
651800%d: Circular links are not allowed
651810Not enough data in buffer. (%d/%d)
651820Too much data in buffer.
651830File "%s" not found
651840Cannot change IPVersion when connected
651850Can not bind in port range (%d - %d)
651860Connection Closed Gracefully.
651870Could not bind socket. Address and port are already in use.
651880Invalid Port Range (%d - %d)
651890%s is not a valid service.
651900IPv6 unavailable
651910%s is not a valid IPv6 address
651920The requested IPVersion / Address family is not supported.
651930Not all bytes sent.
651940Package Size Too Big.
651950Set Size Exceeded.
651960UDP is not support in this SOCKS version.
651970Request rejected or failed.
651980Request rejected because SOCKS server cannot connect.
651990Request rejected because the client program and identd report different user-ids.
652000No buffer space available.
652010Socket is already connected.
652020Socket is not connected.
652030Cannot send or receive after socket is closed.
652040Too many references, cannot splice.
652050Connection timed out.
652060Connection refused.
652070Too many levels of symbolic links.
652080File name too long.
652090Host is down.
652100No route to host.
652110Directory not empty
652120Host not found.
652130Stack Class is undefined.
652140Stack already created.
652150Only one TIdAntiFreeze can exist per application.
652160Destination address required.
652170Message too long.
652180Protocol wrong type for socket.
652190Bad protocol option.
652200Protocol not supported.
652210Socket type not supported.
652220Operation not supported on socket.
652230Protocol family not supported.
652240Address family not supported by protocol family.
652250Address already in use.
652260Cannot assign requested address.
652270Network is down.
652280Network is unreachable.
652290Net dropped connection or reset.
652300Software caused connection abort.
652310Connection reset by peer.
652320Connecting to %s.
652330Connected.
652340Disconnecting.
652350Disconnected.
652360%s
652370Socket Error # %d %s
652380Interrupted system call.
652390Bad file number.
652400Access denied.
652410Buffer fault.
652420Invalid argument.
652430Too many open files.
652440Operation would block.
652450Operation now in progress.
652460Operation already in progress.
652470Socket operation on non-socket.
652480Error loading dock zone from the stream. Expecting version %d, but found %d.
652490ANSI
652500ASCII
652510Unicode
652520Big Endian Unicode
652530UTF-8
652540UTF-7
652550%s requires Windows Vista or later
652560%s requires themes to be enabled
652570Button%d
652580RadioButton%d
652590Caption cannot be empty
652600Failed attempting to retrieve time zone information.
652610Error on call to Winsock2 library function %s
652620Error on loading Winsock2 library (%s)
652630Resolving hostname %s.
652640Ins
652650Del
652660Shift+
652670Ctrl+
652680Alt+
652690Value must be between %d and %d
652700All
652710Clipboard does not support Icons
652720Cannot open clipboard: %s
652730Operation not supported on selected printer
652740There is no default printer currently selected
652750Menu '%s' is already being used by another form
652760Docked control must have a name
652770Error removing control from dock tree
652780- Dock zone not found
652790- Dock zone has no control
652800N&o to All
652810Yes to &All
652820&Close
652830BkSp
652840Tab
652850Esc
652860Enter
652870Space
652880PgUp
652890PgDn
652900End
652910Home
652920Left
652930Up
652940Right
652950Down
652960Icons
652970Bitmaps
652980TIFF Images
652990Warning
653000Error
653010Information
653020Confirm
653030&Yes
653040&No
653050OK
653060Cancel
653070&Help
653080&Abort
653090&Retry
653100&Ignore
653110&All
653120Cannot create form. No MDI forms are currently active
653130Can only modify an image if it contains a bitmap
653140A control cannot have itself as its parent
653150OK
653160Cancel
653170&Yes
653180&No
653190&Help
653200&Close
653210&Ignore
653220&Retry
653230Abort
653240&All
653250Cannot drag a form
653260Metafiles
653270Enhanced Metafiles
653280Control '%s' has no parent window
653290Parent given is not a parent of '%s'
653300Cannot hide an MDI Child Form
653310Cannot change Visible in OnShow or OnHide
653320Cannot make a visible window modal
653330%s property out of range
653340Menu index out of range
653350Menu inserted twice
653360Sub-menu is not in menu
653370Not enough timers available
653380Printer is not currently printing
653390Printing in progress
653400Printer index out of range
653410Printer selected is not valid
653420%s on %s
653430GroupIndex cannot be less than a previous menu item's GroupIndex
653440Cannot change the size of an icon
653450Cannot change the size of a WIC Image
653460Invalid operation on TOleGraphic
653470Unknown picture file extension (.%s)
653480Unsupported clipboard format
653490Out of system resources
653500Canvas does not allow drawing
653510Invalid image size
653520Invalid ImageList
653530Unable to Replace Image
653540Invalid ImageList Index
653550Failed to read ImageList data from stream
653560Failed to write ImageList data to stream
653570Error creating window device context
653580Error creating window class
653590Cannot focus a disabled or invisible window
653600Invalid argument to time encode
653610No context-sensitive help installed
653620No help found for context
653630Unable to open Index
653640Unable to open Search
653650Unable to find a Table of Contents
653660No topic-based help system installed
653670No help found for %s
653680Argument out of range
653690Duplicates not allowed
653700Bitmap image is not valid
653710Icon image is not valid
653720Metafile is not valid
653730Invalid pixel format
653740Invalid image
653750Scan line index out of range
653760Thread Error: %s (%d)
653770Cannot terminate an externally created thread
653780Cannot wait for an externally created thread
653790Cannot call Start on a running or suspended thread
653800Parameter %s cannot be a negative value
653810Input buffer exceeded for %s = %d, %s = %d
653820The specified file was not found
653830No help viewer that supports filters
653840String index out of range (%d). Must be >= 1 and <= %d
653850High surrogate char without a following low surrogate char at index: %d. Check that the string is encoded properly
653860Low surrogate char without a preceding high surrogate char at index: %d. Check that the string is encoded properly
653870Invalid Timeout value: %s
653880''%s'' is not a valid date
653890''%s'' is not a valid date and time
653900''%s'' is not a valid integer value
653910''%s'' is not a valid time
653920List index out of bounds (%d)
653930Out of memory while expanding memory stream
653940%s has not been registered as a COM class
653950Error reading %s%s%s: %s
653960Stream read error
653970Property is read-only
653980Failed to create key %s
653990Failed to get data for '%s'
654000Failed to set data for '%s'
654010Resource %s not found
654020%s.Seek not implemented
654030Operation not allowed on sorted list
654040%s not in a class registration group
654050Property %s does not exist
654060Stream write error
654070Thread creation error: %s
654080A class named %s already exists
654090List does not allow duplicates ($0%x)
654100A component named %s already exists
654110String list does not allow duplicates
654120Cannot create file "%s". %s
654130Cannot open file "%s". %s
654140Invalid file name - %s
654150Invalid stream format
654160''%s'' is not a valid component name
654170Invalid property value
654180Invalid property element: %s
654190Invalid property path
654200Invalid property value
654210Invalid data type for '%s'
654220List capacity out of bounds (%d)
654230List count out of bounds (%d)
654240Friday
654250Saturday
654260Unable to create directory
654270Invalid source array
654280Invalid destination array
654290Character index out of bounds (%d)
654300Start index out of bounds (%d)
654310Invalid count (%d)
654320Invalid destination index (%d)
654330Invalid code page
654340Ancestor for '%s' not found
654350Cannot assign a %s to a %s
654360Bits index out of range
654370Can't write to a read-only resource stream
654380CheckSynchronize called from thread $%x, which is NOT the main thread
654390Class %s not found
654400September
654410October
654420November
654430December
654440Sun
654450Mon
654460Tue
654470Wed
654480Thu
654490Fri
654500Sat
654510Sunday
654520Monday
654530Tuesday
654540Wednesday
654550Thursday
654560May
654570Jun
654580Jul
654590Aug
654600Sep
654610Oct
654620Nov
654630Dec
654640January
654650February
654660March
654670April
654680May
654690June
654700July
654710August
654720Unexpected variant error
654730External exception %x
654740Assertion failed
654750Interface not supported
654760Exception in safecall method
654770Object lock not owned
654780Monitor support function not initialized
654790%s (%s, line %d)
654800Abstract Error
654810Access violation at address %p in module '%s'. %s of address %p
654820System Error. Code: %d. %s
654830A call to an OS function failed
654840Jan
654850Feb
654860Mar
654870Apr
654880Variant or safe array index out of bounds
654890Variant or safe array is locked
654900Invalid variant type conversion
654910Invalid variant operation
654920Invalid NULL variant operation
654930Invalid variant operation (%s%.8x) %s
654940Custom variant type (%s%.4x) is out of range
654950Custom variant type (%s%.4x) already used by %s
654960Custom variant type (%s%.4x) is not usable
654970Too many custom variant types have been registered
654980Could not convert variant of type (%s) into type (%s)
654990Overflow while converting variant of type (%s) into type (%s)
655000Variant overflow
655010Invalid argument
655020Invalid variant type
655030Operation not supported
655040Invalid pointer operation
655050Invalid class typecast
655060Access violation at address %p. %s of address %p
655070Access violation
655080Stack overflow
655090Control-C hit
655100Privileged instruction
655110Operation aborted
655120Exception %s in module %s at %p. %s%s
655130Application Error
655140Format '%s' invalid or incompatible with argument
655150No argument for format '%s'
655160Variant method calls not supported
655170Read
655180Write
655190Error creating variant or safe array
655200'%s' is not a valid floating point value
655210Invalid argument to date encode
655220Out of memory
655230I/O error %d
655240Too many open files
655250File access denied
655260Read beyond end of file
655270Disk full
655280Invalid numeric input
655290Division by zero
655300Range check error
655310Integer overflow
655320Invalid floating point operation
655330Floating point division by zero
655340Floating point overflow
655350Floating point underflow
module_namehintordfunction_name
oleaut32.dllSysFreeString
oleaut32.dllSysReAllocStringLen
oleaut32.dllSysAllocStringLen
advapi32.dllRegQueryValueExW
advapi32.dllRegOpenKeyExW
advapi32.dllRegCloseKey
user32.dllLoadStringW
user32.dllMessageBoxA
user32.dllCharNextW
kernel32.dlllstrcmpiA
kernel32.dllLoadLibraryA
kernel32.dllLocalFree
kernel32.dllLocalAlloc
kernel32.dllGetACP
kernel32.dllSleep
kernel32.dllVirtualFree
kernel32.dllVirtualAlloc
kernel32.dllGetSystemInfo
kernel32.dllGetTickCount
kernel32.dllQueryPerformanceCounter
kernel32.dllGetVersion
kernel32.dllGetCurrentThreadId
kernel32.dllVirtualQuery
kernel32.dllWideCharToMultiByte
kernel32.dllMultiByteToWideChar
kernel32.dlllstrlenW
kernel32.dlllstrcpynW
kernel32.dllLoadLibraryExW
kernel32.dllIsValidLocale
kernel32.dllGetSystemDefaultUILanguage
kernel32.dllGetStartupInfoA
kernel32.dllGetProcAddress
kernel32.dllGetModuleHandleW
kernel32.dllGetModuleFileNameW
kernel32.dllGetUserDefaultUILanguage
kernel32.dllGetLocaleInfoW
kernel32.dllGetLastError
kernel32.dllGetCommandLineW
kernel32.dllFreeLibrary
kernel32.dllFindFirstFileW
kernel32.dllFindClose
kernel32.dllExitProcess
kernel32.dllExitThread
kernel32.dllCreateThread
kernel32.dllCompareStringW
kernel32.dllWriteFile
kernel32.dllUnhandledExceptionFilter
kernel32.dllSetFilePointer
kernel32.dllSetEndOfFile
kernel32.dllRtlUnwind
kernel32.dllReadFile
kernel32.dllRaiseException
kernel32.dllGetStdHandle
kernel32.dllGetFileSize
kernel32.dllGetFileType
kernel32.dllDeleteCriticalSection
kernel32.dllLeaveCriticalSection
kernel32.dllEnterCriticalSection
kernel32.dllInitializeCriticalSection
kernel32.dllCreateFileW
kernel32.dllCloseHandle
kernel32.dllTlsSetValue
kernel32.dllTlsGetValue
kernel32.dllLocalAlloc
kernel32.dllGetModuleHandleW
user32.dllCreateWindowExA
user32.dllCreateWindowExW
user32.dllWindowFromPoint
user32.dllWaitMessage
user32.dllUpdateWindow
user32.dllUnregisterClassW
user32.dllUnhookWindowsHookEx
user32.dllTranslateMessage
user32.dllTranslateMDISysAccel
user32.dllTrackPopupMenu
user32.dllSystemParametersInfoW
user32.dllShowWindow
user32.dllShowScrollBar
user32.dllShowOwnedPopups
user32.dllSetWindowRgn
user32.dllSetWindowsHookExW
user32.dllSetWindowTextA
user32.dllSetWindowTextW
user32.dllSetWindowPos
user32.dllSetWindowPlacement
user32.dllSetWindowLongA
user32.dllSetWindowLongW
user32.dllSetTimer
user32.dllSetScrollRange
user32.dllSetScrollPos
user32.dllSetScrollInfo
user32.dllSetRect
user32.dllSetPropW
user32.dllSetParent
user32.dllSetMenuItemInfoW
user32.dllSetMenu
user32.dllSetForegroundWindow
user32.dllSetFocus
user32.dllSetCursorPos
user32.dllSetCursor
user32.dllSetClipboardData
user32.dllSetClassLongW
user32.dllSetCapture
user32.dllSetActiveWindow
user32.dllSendMessageTimeoutA
user32.dllSendMessageA
user32.dllSendMessageW
user32.dllScrollWindow
user32.dllScreenToClient
user32.dllRemovePropW
user32.dllRemoveMenu
user32.dllReleaseDC
user32.dllReleaseCapture
user32.dllRegisterWindowMessageW
user32.dllRegisterClipboardFormatW
user32.dllRegisterClassA
user32.dllRegisterClassW
user32.dllRedrawWindow
user32.dllPtInRect
user32.dllPostThreadMessageA
user32.dllPostThreadMessageW
user32.dllPostQuitMessage
user32.dllPostMessageA
user32.dllPostMessageW
user32.dllPeekMessageA
user32.dllPeekMessageW
user32.dllOpenClipboard
user32.dllOffsetRect
user32.dllMsgWaitForMultipleObjectsEx
user32.dllMsgWaitForMultipleObjects
user32.dllMessageBoxA
user32.dllMessageBoxW
user32.dllMessageBeep
user32.dllMapWindowPoints
user32.dllMapVirtualKeyW
user32.dllLoadStringW
user32.dllLoadKeyboardLayoutW
user32.dllLoadImageA
user32.dllLoadIconW
user32.dllLoadCursorW
user32.dllLoadBitmapW
user32.dllKillTimer
user32.dllIsZoomed
user32.dllIsWindowVisible
user32.dllIsWindowUnicode
user32.dllIsWindowEnabled
user32.dllIsWindow
user32.dllIsIconic
user32.dllIsDialogMessageA
user32.dllIsDialogMessageW
user32.dllIsChild
user32.dllInvalidateRect
user32.dllIntersectRect
user32.dllInsertMenuItemW
user32.dllInsertMenuW
user32.dllInflateRect
user32.dllGetWindowThreadProcessId
user32.dllGetWindowTextA
user32.dllGetWindowTextW
user32.dllGetWindowRect
user32.dllGetWindowPlacement
user32.dllGetWindowLongW
user32.dllGetWindowDC
user32.dllGetTopWindow
user32.dllGetSystemMetrics
user32.dllGetSystemMenu
user32.dllGetSysColorBrush
user32.dllGetSysColor
user32.dllGetSubMenu
user32.dllGetScrollRange
user32.dllGetScrollPos
user32.dllGetScrollInfo
user32.dllGetPropW
user32.dllGetParent
user32.dllGetWindow
user32.dllGetMessageTime
user32.dllGetMessagePos
user32.dllGetMessageExtraInfo
user32.dllGetMessageA
user32.dllGetMessageW
user32.dllGetMenuStringW
user32.dllGetMenuState
user32.dllGetMenuItemInfoW
user32.dllGetMenuItemID
user32.dllGetMenuItemCount
user32.dllGetMenu
user32.dllGetLastActivePopup
user32.dllGetKeyboardState
user32.dllGetKeyboardLayoutNameW
user32.dllGetKeyboardLayoutList
user32.dllGetKeyboardLayout
user32.dllGetKeyState
user32.dllGetKeyNameTextW
user32.dllGetIconInfo
user32.dllGetForegroundWindow
user32.dllGetFocus
user32.dllGetDesktopWindow
user32.dllGetDCEx
user32.dllGetDC
user32.dllGetCursorPos
user32.dllGetCursor
user32.dllGetClipboardData
user32.dllGetClientRect
user32.dllGetClassNameA
user32.dllGetClassLongW
user32.dllGetClassInfoW
user32.dllGetCapture
user32.dllGetActiveWindow
user32.dllFrameRect
user32.dllFlashWindowEx
user32.dllFlashWindow
user32.dllFindWindowExW
user32.dllFindWindowW
user32.dllFillRect
user32.dllEnumWindows
user32.dllEnumThreadWindows
user32.dllEnumChildWindows
user32.dllEndPaint
user32.dllEnableWindow
user32.dllEnableScrollBar
user32.dllEnableMenuItem
user32.dllEmptyClipboard
user32.dllDrawTextExW
user32.dllDrawTextA
user32.dllDrawTextW
user32.dllDrawMenuBar
user32.dllDrawIconEx
user32.dllDrawIcon
user32.dllDrawFrameControl
user32.dllDrawFocusRect
user32.dllDrawEdge
user32.dllDispatchMessageA
user32.dllDispatchMessageW
user32.dllDestroyWindow
user32.dllDestroyMenu
user32.dllDestroyIcon
user32.dllDestroyCursor
user32.dllDeleteMenu
user32.dllDefWindowProcA
user32.dllDefWindowProcW
user32.dllDefMDIChildProcW
user32.dllDefFrameProcW
user32.dllCreatePopupMenu
user32.dllCreateMenu
user32.dllCreateIcon
user32.dllCreateAcceleratorTableW
user32.dllCopyIcon
user32.dllCloseClipboard
user32.dllClientToScreen
user32.dllCheckMenuItem
user32.dllCharUpperBuffW
user32.dllCharNextW
user32.dllCharLowerBuffW
user32.dllCharLowerW
user32.dllCallWindowProcW
user32.dllCallNextHookEx
user32.dllBringWindowToTop
user32.dllBeginPaint
user32.dllAttachThreadInput
user32.dllAdjustWindowRectEx
user32.dllActivateKeyboardLayout
msimg32.dllAlphaBlend
gdi32.dllUnrealizeObject
gdi32.dllTextOutA
gdi32.dllStretchDIBits
gdi32.dllStretchBlt
gdi32.dllStartPage
gdi32.dllStartDocA
gdi32.dllStartDocW
gdi32.dllSetWindowOrgEx
gdi32.dllSetWinMetaFileBits
gdi32.dllSetViewportOrgEx
gdi32.dllSetTextColor
gdi32.dllSetTextAlign
gdi32.dllSetStretchBltMode
gdi32.dllSetROP2
gdi32.dllSetPixel
gdi32.dllSetPaletteEntries
gdi32.dllSetMapMode
gdi32.dllSetEnhMetaFileBits
gdi32.dllSetDIBits
gdi32.dllSetDIBColorTable
gdi32.dllSetBrushOrgEx
gdi32.dllSetBkMode
gdi32.dllSetBkColor
gdi32.dllSetAbortProc
gdi32.dllSelectPalette
gdi32.dllSelectObject
gdi32.dllSelectClipRgn
gdi32.dllSaveDC
gdi32.dllRoundRect
gdi32.dllRestoreDC
gdi32.dllResizePalette
gdi32.dllRectangle
gdi32.dllRectVisible
gdi32.dllRealizePalette
gdi32.dllPolyline
gdi32.dllPolygon
gdi32.dllPolyBezierTo
gdi32.dllPolyBezier
gdi32.dllPlayEnhMetaFile
gdi32.dllPie
gdi32.dllPathToRegion
gdi32.dllPatBlt
gdi32.dllMoveToEx
gdi32.dllMaskBlt
gdi32.dllLineTo
gdi32.dllLPtoDP
gdi32.dllIntersectClipRect
gdi32.dllGetWindowOrgEx
gdi32.dllGetWinMetaFileBits
gdi32.dllGetTextMetricsW
gdi32.dllGetTextFaceA
gdi32.dllGetTextExtentPointW
gdi32.dllGetTextExtentPoint32A
gdi32.dllGetTextExtentPoint32W
gdi32.dllGetSystemPaletteEntries
gdi32.dllGetStockObject
gdi32.dllGetRgnBox
gdi32.dllGetPixel
gdi32.dllGetPaletteEntries
gdi32.dllGetObjectW
gdi32.dllGetNearestPaletteIndex
gdi32.dllGetEnhMetaFilePaletteEntries
gdi32.dllGetEnhMetaFileHeader
gdi32.dllGetEnhMetaFileDescriptionW
gdi32.dllGetEnhMetaFileBits
gdi32.dllGetDeviceCaps
gdi32.dllGetDIBits
gdi32.dllGetDIBColorTable
gdi32.dllGetDCOrgEx
gdi32.dllGetCurrentPositionEx
gdi32.dllGetClipBox
gdi32.dllGetBrushOrgEx
gdi32.dllGetBitmapBits
gdi32.dllGdiFlush
gdi32.dllFrameRgn
gdi32.dllExtTextOutW
gdi32.dllExtFloodFill
gdi32.dllExcludeClipRect
gdi32.dllEnumFontsW
gdi32.dllEnumFontFamiliesExW
gdi32.dllEndPath
gdi32.dllEndPage
gdi32.dllEndDoc
gdi32.dllEllipse
gdi32.dllDeleteObject
gdi32.dllDeleteEnhMetaFile
gdi32.dllDeleteDC
gdi32.dllCreateSolidBrush
gdi32.dllCreateRectRgnIndirect
gdi32.dllCreateRectRgn
gdi32.dllCreatePenIndirect
gdi32.dllCreatePen
gdi32.dllCreatePalette
gdi32.dllCreateICW
gdi32.dllCreateHalftonePalette
gdi32.dllCreateFontIndirectW
gdi32.dllCreateFontA
gdi32.dllCreateFontW
gdi32.dllCreateEnhMetaFileW
gdi32.dllCreateDIBitmap
gdi32.dllCreateDIBSection
gdi32.dllCreateDCW
gdi32.dllCreateCompatibleDC
gdi32.dllCreateCompatibleBitmap
gdi32.dllCreateBrushIndirect
gdi32.dllCreateBitmap
gdi32.dllCopyEnhMetaFileW
gdi32.dllCombineRgn
gdi32.dllCloseFigure
gdi32.dllCloseEnhMetaFile
gdi32.dllChord
gdi32.dllBitBlt
gdi32.dllBeginPath
gdi32.dllArc
gdi32.dllAbortDoc
version.dllVerQueryValueA
version.dllVerQueryValueW
version.dllGetFileVersionInfoSizeA
version.dllGetFileVersionInfoSizeW
version.dllGetFileVersionInfoA
version.dllGetFileVersionInfoW
kernel32.dlllstrlenW
kernel32.dlllstrcpyW
kernel32.dlllstrcmpA
kernel32.dllWriteFile
kernel32.dllWideCharToMultiByte
kernel32.dllWaitForSingleObject
kernel32.dllWaitForMultipleObjectsEx
kernel32.dllVirtualQueryEx
kernel32.dllVirtualQuery
kernel32.dllVirtualProtect
kernel32.dllVirtualFree
kernel32.dllVirtualAlloc
kernel32.dllUnmapViewOfFile
kernel32.dllTryEnterCriticalSection
kernel32.dllTerminateThread
kernel32.dllTerminateProcess
kernel32.dllSystemTimeToFileTime
kernel32.dllSwitchToThread
kernel32.dllSuspendThread
kernel32.dllSleep
kernel32.dllSizeofResource
kernel32.dllSignalObjectAndWait
kernel32.dllSetUnhandledExceptionFilter
kernel32.dllSetThreadPriority
kernel32.dllSetThreadLocale
kernel32.dllSetLastError
kernel32.dllSetFilePointer
kernel32.dllSetFileAttributesA
kernel32.dllSetEvent
kernel32.dllSetErrorMode
kernel32.dllSetEndOfFile
kernel32.dllSetCurrentDirectoryW
kernel32.dllResumeThread
kernel32.dllResetEvent
kernel32.dllRemoveDirectoryA
kernel32.dllReleaseMutex
kernel32.dllReadProcessMemory
kernel32.dllReadFile
kernel32.dllRaiseException
kernel32.dllQueryPerformanceFrequency
kernel32.dllQueryPerformanceCounter
kernel32.dllIsDebuggerPresent
kernel32.dllOpenProcess
kernel32.dllOpenFileMappingA
kernel32.dllOpenFileMappingW
kernel32.dllMultiByteToWideChar
kernel32.dllMulDiv
kernel32.dllMapViewOfFile
kernel32.dllLockResource
kernel32.dllLocalSize
kernel32.dllLocalFree
kernel32.dllLocalAlloc
kernel32.dllLoadResource
kernel32.dllLoadLibraryExA
kernel32.dllLoadLibraryW
kernel32.dllLeaveCriticalSection
kernel32.dllIsBadReadPtr
kernel32.dllInitializeCriticalSection
kernel32.dllGlobalUnlock
kernel32.dllGlobalSize
kernel32.dllGlobalReAlloc
kernel32.dllGlobalMemoryStatus
kernel32.dllGlobalHandle
kernel32.dllGlobalLock
kernel32.dllGlobalFree
kernel32.dllGlobalFindAtomW
kernel32.dllGlobalDeleteAtom
kernel32.dllGlobalAlloc
kernel32.dllGlobalAddAtomW
kernel32.dllGetWindowsDirectoryA
kernel32.dllGetVersionExA
kernel32.dllGetVersionExW
kernel32.dllGetVersion
kernel32.dllGetUserDefaultLangID
kernel32.dllGetUserDefaultLCID
kernel32.dllGetTimeZoneInformation
kernel32.dllGetTickCount
kernel32.dllGetThreadPriority
kernel32.dllGetThreadLocale
kernel32.dllGetThreadContext
kernel32.dllGetTempPathA
kernel32.dllGetTempPathW
kernel32.dllGetSystemTime
kernel32.dllGetSystemDirectoryW
kernel32.dllGetStdHandle
kernel32.dllGetProcAddress
kernel32.dllGetPriorityClass
kernel32.dllGetModuleHandleA
kernel32.dllGetModuleHandleW
kernel32.dllGetModuleFileNameA
kernel32.dllGetModuleFileNameW
kernel32.dllGetLocaleInfoA
kernel32.dllGetLocaleInfoW
kernel32.dllGetLocalTime
kernel32.dllGetLastError
kernel32.dllGetFullPathNameW
kernel32.dllGetFileTime
kernel32.dllGetFileSize
kernel32.dllGetFileAttributesA
kernel32.dllGetFileAttributesW
kernel32.dllGetExitCodeThread
kernel32.dllGetDiskFreeSpaceA
kernel32.dllGetDiskFreeSpaceW
kernel32.dllGetDateFormatW
kernel32.dllGetCurrentThreadId
kernel32.dllGetCurrentThread
kernel32.dllGetCurrentProcessId
kernel32.dllGetCurrentProcess
kernel32.dllGetComputerNameA
kernel32.dllGetComputerNameW
kernel32.dllGetCommandLineA
kernel32.dllGetCommandLineW
kernel32.dllGetCPInfo
kernel32.dllFreeResource
kernel32.dllInterlockedIncrement
kernel32.dllInterlockedExchangeAdd
kernel32.dllInterlockedExchange
kernel32.dllInterlockedDecrement
kernel32.dllInterlockedCompareExchange
kernel32.dllFreeLibrary
kernel32.dllFormatMessageA
kernel32.dllFormatMessageW
kernel32.dllFindResourceA
kernel32.dllFindResourceW
kernel32.dllFindNextFileA
kernel32.dllFindNextFileW
kernel32.dllFindFirstFileA
kernel32.dllFindFirstFileW
kernel32.dllFindClose
kernel32.dllFileTimeToSystemTime
kernel32.dllFileTimeToLocalFileTime
kernel32.dllFileTimeToDosDateTime
kernel32.dllExpandEnvironmentStringsA
kernel32.dllExitThread
kernel32.dllExitProcess
kernel32.dllEnumCalendarInfoW
kernel32.dllEnterCriticalSection
kernel32.dllDuplicateHandle
kernel32.dllDeleteFileA
kernel32.dllDeleteFileW
kernel32.dllDeleteCriticalSection
kernel32.dllCreateThread
kernel32.dllCreateRemoteThread
kernel32.dllCreateProcessA
kernel32.dllCreateProcessW
kernel32.dllCreatePipe
kernel32.dllCreateMutexA
kernel32.dllCreateMutexW
kernel32.dllCreateFileMappingA
kernel32.dllCreateFileMappingW
kernel32.dllCreateFileA
kernel32.dllCreateFileW
kernel32.dllCreateEventW
kernel32.dllCreateDirectoryA
kernel32.dllCreateDirectoryW
kernel32.dllCopyFileA
kernel32.dllCopyFileW
kernel32.dllCompareStringW
kernel32.dllCloseHandle
kernel32.dllBeep
advapi32.dllSetSecurityDescriptorDacl
advapi32.dllRegUnLoadKeyW
advapi32.dllRegSetValueExA
advapi32.dllRegSetValueExW
advapi32.dllRegSaveKeyW
advapi32.dllRegRestoreKeyW
advapi32.dllRegReplaceKeyW
advapi32.dllRegQueryValueExA
advapi32.dllRegQueryValueExW
advapi32.dllRegQueryInfoKeyW
advapi32.dllRegOpenKeyExA
advapi32.dllRegOpenKeyExW
advapi32.dllRegLoadKeyW
advapi32.dllRegFlushKey
advapi32.dllRegEnumValueW
advapi32.dllRegEnumKeyA
advapi32.dllRegEnumKeyExW
advapi32.dllRegDeleteValueA
advapi32.dllRegDeleteValueW
advapi32.dllRegDeleteKeyW
advapi32.dllRegCreateKeyExA
advapi32.dllRegCreateKeyExW
advapi32.dllRegConnectRegistryW
advapi32.dllRegCloseKey
advapi32.dllInitializeSecurityDescriptor
advapi32.dllGetUserNameA
advapi32.dllFreeSid
advapi32.dllAllocateAndInitializeSid
wsock32.dllWSACleanup
wsock32.dllWSAStartup
wsock32.dllgethostbyname
wsock32.dllsocket
wsock32.dllsetsockopt
wsock32.dllsendto
wsock32.dllsend
wsock32.dllselect
wsock32.dllrecvfrom
wsock32.dllrecv
wsock32.dllinet_addr
wsock32.dllhtons
wsock32.dllconnect
wsock32.dllclosesocket
wsock32.dllbind
shell32.dllShellExecuteExA
shell32.dllShellExecuteA
shell32.dllShellExecuteW
oleaut32.dllGetErrorInfo
oleaut32.dllGetActiveObject
oleaut32.dllSysFreeString
ole32.dllCreateStreamOnHGlobal
ole32.dllOleRegEnumVerbs
ole32.dllIsAccelerator
ole32.dllOleDraw
ole32.dllOleSetMenuDescriptor
ole32.dllOleUninitialize
ole32.dllOleInitialize
ole32.dllCoTaskMemFree
ole32.dllCoTaskMemAlloc
ole32.dllProgIDFromCLSID
ole32.dllStringFromCLSID
ole32.dllCoCreateInstance
ole32.dllCoGetClassObject
ole32.dllCoUninitialize
ole32.dllCoInitialize
ole32.dllIsEqualGUID
comctl32.dllInitializeFlatSB
comctl32.dllFlatSB_SetScrollProp
comctl32.dllFlatSB_SetScrollPos
comctl32.dllFlatSB_SetScrollInfo
comctl32.dllFlatSB_GetScrollPos
comctl32.dllFlatSB_GetScrollInfo
comctl32.dll_TrackMouseEvent
comctl32.dllImageList_GetImageInfo
comctl32.dllImageList_SetIconSize
comctl32.dllImageList_GetIconSize
comctl32.dllImageList_Write
comctl32.dllImageList_Read
comctl32.dllImageList_GetDragImage
comctl32.dllImageList_DragShowNolock
comctl32.dllImageList_DragMove
comctl32.dllImageList_DragLeave
comctl32.dllImageList_DragEnter
comctl32.dllImageList_EndDrag
comctl32.dllImageList_BeginDrag
comctl32.dllImageList_Copy
comctl32.dllImageList_LoadImageW
comctl32.dllImageList_GetIcon
comctl32.dllImageList_Remove
comctl32.dllImageList_DrawEx
comctl32.dllImageList_Replace
comctl32.dllImageList_Draw
comctl32.dllImageList_SetOverlayImage
comctl32.dllImageList_GetBkColor
comctl32.dllImageList_SetBkColor
comctl32.dllImageList_ReplaceIcon
comctl32.dllImageList_Add
comctl32.dllImageList_SetImageCount
comctl32.dllImageList_GetImageCount
comctl32.dllImageList_Destroy
comctl32.dllImageList_Create
comctl32.dllInitCommonControls
comdlg32.dllPrintDlgW
comdlg32.dllGetSaveFileNameA
kernel32.dllRtlUnwind
shell32.dllSHGetPathFromIDListA
shell32.dllSHGetSpecialFolderLocation
shell32.dllSHGetMalloc
kernel32.dllSleep
ole32.dllIsEqualGUID
oleaut32.dllSafeArrayPtrOfIndex
oleaut32.dllSafeArrayGetUBound
oleaut32.dllSafeArrayGetLBound
oleaut32.dllSafeArrayCreate
oleaut32.dllVariantChangeType
oleaut32.dllVariantCopy
oleaut32.dllVariantClear
oleaut32.dllVariantInit
winspool.drvOpenPrinterW
winspool.drvEnumPrintersW
winspool.drvDocumentPropertiesW
winspool.drvClosePrinter
winspool.drvGetDefaultPrinterW
ordentry_vafunction_name
10x65378madTraceProcess
module_nameThor.exe
flags0
timestamp0
version0.0
ordinal_base1
nFunctions1
nNames1
Names(1)0x23902c
Functions(1)0x239028
NameOrdinals(1)0x239030

StringTable 040904E4

CompanyName
FileDescriptionThor Patcher
FileVersion2.6.1.66
InternalName
LegalCopyrightAED
LegalTrademarks
OriginalFilenameThor.exe
ProductNameAeomin DLIB Core
ProductVersion2.4.3
SpecialBuild

VS_FIXEDFILEINFO

FileVersion2.6.1.66
ProductVersion2.6.1.66
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
02544640EXE01/24/2011 03:59:20#
15c115HTM#
26b9fd1590BMP(32 x 16)#
26c0c91590BMP(32 x 16)#
26e4003978PNG(93 x 43)#
2705043389PNG(93 x 43)#
27124c3948PNG(93 x 43)#
2721c34341PNG(93 x 43)#
2732c33401PNG(93 x 43)#
27400c84567BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 2656867 bytes (2595 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK