3aa4ecf2f1e4312c2f5a7544547bddf81001553b896c5ec09a22fac6eee85db2

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	3aa4ecf2f1e4312c2f5a7544547bddf81001553b896c5ec09a22fac6eee85db2
size	204800 (0x32000)
md5	0057608cc3530f991072071c8019dcb3

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xc0

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|
00000040: a8 8a 5a 25 ec eb 34 76  ec eb 34 76 ec eb 34 76  |..Z%..4v..4v..4v|
00000050: ec eb 35 76 fc eb 34 76  cb 2d 4f 76 e9 eb 34 76  |..5v..4v.-Ov..4v|
00000060: cb 2d 59 76 e5 eb 34 76  cb 2d 4e 76 ed eb 34 76  |.-Yv..4v.-Nv..4v|
00000070: cb 2d 48 76 ed eb 34 76  cb 2d 4c 76 ed eb 34 76  |.-Hv..4v.-Lv..4v|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x56c785cb
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x7000
SizeOfInitializedData	0x2a000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x34f0
BaseOfCode	0x1000
BaseOfData	0x8000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x32000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	3
DllCharacteristics	0x8000
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x6f5c	0x7000	R-X CODE
.data	0x8000	0x26c4	0x3000	RW- IDATA
CODE	0xb000	0x1f54c	0x20000	RW- IDATA
.cdata	0x2b000	0x6c0b	0x7000	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x6d9c	0xf0
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x1000	0x290
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
GDI32.dll	234	FlattenPath
GDI32.dll	476	PaintRgn
GDI32.dll	350	GetCharacterPlacementA
GDI32.dll	596	UpdateICMRegKeyA
GDI32.dll	416	GetRandomRgn
GDI32.dll	63	CreateHalftonePalette
GDI32.dll	493	Polygon
GDI32.dll	333	GetBkMode
GDI32.dll	426	GetSystemPaletteUse
GDI32.dll	22	CancelDC
GDI32.dll	368	GetEnhMetaFileA
GDI32.dll	588	StrokePath
GDI32.dll	508	RemoveFontResourceW
GDI32.dll	55	CreateEnhMetaFileA
GDI32.dll	355	GetColorSpace
GDI32.dll	30	CloseMetaFile
GDI32.dll	528	SetAbortProc
KERNEL32.dll	556	IsProcessorFeaturePresent
KERNEL32.dll	237	FreeConsole
USER32.dll	68	CloseWindow
USER32.dll	296	GetKeyboardState
USER32.dll	521	PrivateExtractIconsA
USER32.dll	297	GetKeyboardType
USER32.dll	76	CreateAcceleratorTableA
USER32.dll	623	SetRectEmpty
USER32.dll	247	GetCaretPos
USER32.dll	535	RedrawWindow
USER32.dll	410	IsCharAlphaNumericW
USER32.dll	281	GetForegroundWindow
USER32.dll	357	GetTopWindow
USER32.dll	234	FlashWindowEx
ole32.dll	25	CoFileTimeNow
ole32.dll	68	CoLoadLibrary
ole32.dll	204	FmtIdToPropStgName
ole32.dll	99	CoSuspendClassObjects
ole32.dll	259	HWND_UserMarshal
ole32.dll	241	HICON_UserUnmarshal
ole32.dll	280	OleCreateDefaultHandler
ole32.dll	341	RegisterDragDrop
ole32.dll	16	CoCreateGuid
ole32.dll	329	ProgIDFromCLSID
ole32.dll	103	CoTaskMemRealloc
ole32.dll	92	CoRevertToSelf
ole32.dll	171	DoDragDrop
ole32.dll	309	OleLoadFromStream
ole32.dll	344	SNB_UserFree
ole32.dll	96	CoSetCancelObject
ole32.dll	133	CreateAntiMoniker
ole32.dll	343	RevokeDragDrop
ole32.dll	323	OleSetClipboard
ole32.dll	106	CoUninitialize
ole32.dll	310	OleLockRunning
comdlg32.dll	9	GetOpenFileNameA
comdlg32.dll	12	GetSaveFileNameW
comdlg32.dll	20	ReplaceTextA
comdlg32.dll	1	ChooseColorW
comdlg32.dll	5	FindTextA
SHLWAPI.dll	68	PathIsFileSpecA
SETUPAPI.dll	249	SetupDeleteErrorW
SETUPAPI.dll	273	SetupDiCreateDeviceInfoW
SETUPAPI.dll	322	SetupDiGetDeviceInterfaceAlias
SETUPAPI.dll	434	SetupInstallFileA
SETUPAPI.dll	484	SetupQueueDefaultCopyA
SETUPAPI.dll	451	SetupLogFileW
SETUPAPI.dll	301	SetupDiGetClassDevsA
SETUPAPI.dll	325	SetupDiGetDeviceRegistryPropertyA
SETUPAPI.dll	253	SetupDiBuildClassInfoListExA
SETUPAPI.dll	449	SetupLogErrorW
SETUPAPI.dll	395	SetupGetBackupInformationA
SETUPAPI.dll	430	SetupInitDefaultQueueCallback
SETUPAPI.dll	399	SetupGetFileCompressionInfoA
SETUPAPI.dll	450	SetupLogFileA
SETUPAPI.dll	238	SetupCopyErrorW
SETUPAPI.dll	289	SetupDiEnumDriverInfoW
SETUPAPI.dll	231	SetupCloseFileQueue
SETUPAPI.dll	309	SetupDiGetClassInstallParamsA
RPCRT4.dll	435	RpcServerUseProtseqEpW
RPCRT4.dll	41	I_RpcConnectionSetSockBuffSize
RPCRT4.dll	261	NdrServerContextMarshall
RPCRT4.dll	470	RpcStringBindingParseW
RPCRT4.dll	135	NdrComplexArrayMemorySize
RPCRT4.dll	340	RpcBindingSetAuthInfoA
RPCRT4.dll	229	NdrNonEncapsulatedUnionMemorySize
RPCRT4.dll	357	RpcEpRegisterNoReplaceW
RPCRT4.dll	297	NdrVaryingArrayBufferSize
RPCRT4.dll	332	RpcBindingInqAuthInfoA
RPCRT4.dll	343	RpcBindingSetAuthInfoW
RPCRT4.dll	121	NdrByteCountPointerMarshall
RPCRT4.dll	446	RpcSmDestroyClientContext
RPCRT4.dll	464	RpcSsSetClientAllocFree
RPCRT4.dll	327	RpcBindingFromStringBindingW
RPCRT4.dll	393	RpcMgmtSetServerStackSize
RPCRT4.dll	113	NDRSContextUnmarshall2
RPCRT4.dll	293	NdrUserMarshalMarshall
RPCRT4.dll	453	RpcSmSwapClientAllocFree
RPCRT4.dll	296	NdrUserMarshalUnmarshall
RPCRT4.dll	73	I_RpcServerInqTransportType
pdh.dll	6	PdhBrowseCountersA
pdh.dll	12	PdhCloseQuery
pdh.dll	86	PdhParseCounterPathW
pdh.dll	119	PdhReadRawLogRecord
pdh.dll	44	PdhGetDataSourceTimeRangeA
pdh.dll	40	PdhFormatFromRawValue
pdh.dll	26	PdhEnumObjectItemsA
pdh.dll	9	PdhBrowseCountersW
pdh.dll	75	PdhLookupPerfNameByIndexA
pdh.dll	123	PdhSelectDataSourceA
pdh.dll	88	PdhParseInstanceNameW
pdh.dll	41	PdhGetCounterInfoA
pdh.dll	3	PdhAddCounterW
pdh.dll	65	PdhGetRawCounterValue
pdh.dll	17	PdhConnectMachineW
pdh.dll	74	PdhLookupPerfIndexByNameW
mscms.dll	32	GetStandardColorSpaceProfileW
mscms.dll	3	CheckColors
mscms.dll	51	SetColorProfileHeader
mscms.dll	14	DisassociateColorProfileFromDeviceA
mscms.dll	57	UninstallColorProfileA
mscms.dll	22	GetColorProfileElement
mscms.dll	28	GetPS2ColorRenderingDictionary
mscms.dll	27	GetNamedProfileInfo
mscms.dll	41	IsColorProfileTagPresent
mscms.dll	53	SetStandardColorSpaceProfileW
mscms.dll	44	OpenColorProfileW
mscms.dll	59	UnregisterCMMA
mscms.dll	48	SetColorProfileElement
mscms.dll	49	SetColorProfileElementReference
mscms.dll	5	ConvertColorNameToIndex
mscms.dll	50	SetColorProfileElementSize
mscms.dll	19	GetCMMInfo
mscms.dll	17	EnumColorProfilesW
mscms.dll	8	CreateColorTransformW
mscms.dll	46	RegisterCMMW
mscms.dll	23	GetColorProfileElementTag
ntdll.dll	891	RtlxOemStringToUnicodeSize
ntdll.dll	511	RtlDetermineDosPathNameType_U
ntdll.dll	1148	ZwShutdownSystem
ntdll.dll	1127	ZwSetInformationProcess
ntdll.dll	724	RtlOemStringToUnicodeString
ntdll.dll	912	ZwAllocateVirtualMemory
ntdll.dll	405	RtlAppendUnicodeStringToString
ntdll.dll	774	RtlSecondsSince1970ToTime
ntdll.dll	355	NtWaitForSingleObject
ntdll.dll	1051	ZwQueryInformationProcess
ntdll.dll	210	NtOpenThreadToken
ntdll.dll	529	RtlEnlargedUnsignedMultiply
ntdll.dll	208	NtOpenSymbolicLinkObject
ntdll.dll	520	RtlDowncaseUnicodeString
ntdll.dll	818	RtlTimeFieldsToTime
ntdll.dll	130	NtCreateSemaphore
ntdll.dll	102	NtClearEvent
ntdll.dll	46	LdrDisableThreadCalloutsForDll
ntdll.dll	432	RtlCompareUnicodeString

show previews

offset	size	type	comment
0	204800	EXE	02/19/2016 21:14:51	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK