filename4e7fd2fb5f7ad3fdf81fef387c77eb07a068bed50c57bb93a7bd4d4f8e5b3c7b
size277504 (0x43c00)
md50394320e56484cb00a130df9c5945a48
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd0

Rich Header

lib idversiontimes used
123403105
1016
1094031010
124403101
120403101

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x56b9034a
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion8.0
SizeOfCode0x3800
SizeOfInitializedData0x40400
SizeOfUninitializedData0
AddressOfEntryPoint0x103c
BaseOfCode0x1000
BaseOfData0x5000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x47000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x36e10x3800R-X CODE
.rdata0x50000x3240x400R-- IDATA
.data0x60000x372920x37000RW- IDATA
.idata0x3e0000x4f7d0x5000RW- IDATA
.edata0x430000x2fb80x3000RW- IDATA
.rsrc0x460000xa700xc00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x41d540xb4
RESOURCE0x460000xa70
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x50000x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x421200x318
Delay_IAT00
CLR_Header00
typenamesizecp
DIALOG#10212100
DIALOG#1032480
STRING#1560
VERSION#18760
idlangstring
11033Control
21033About
module_namehintordfunction_name
KERNEL32.dll428GetStartupInfoA
KERNEL32.dll55CompareStringA
KERNEL32.dll372GetModuleFileNameW
KERNEL32.dll237FreeConsole
SHLWAPI.dll302UrlIsA
SHLWAPI.dll33PathCanonicalizeW
WININET.dll147InternetOpenUrlA
WININET.dll133InternetGetCookieExA
WININET.dll58FtpRenameFileW
WININET.dll80HttpAddRequestHeadersA
WININET.dll210SetUrlCacheEntryInfoW
WININET.dll150InternetQueryDataAvailable
WININET.dll68GetUrlCacheGroupAttributeW
WININET.dll1CommitUrlCacheEntryW
WININET.dll103InternetCheckConnectionW
WININET.dll7CreateUrlCacheGroup
WININET.dll207SetUrlCacheEntryGroupA
WININET.dll53FtpPutFileEx
MPRAPI.dll26MprAdminInterfaceTransportGetInfo
MPRAPI.dll24MprAdminInterfaceSetInfo
MPRAPI.dll20MprAdminInterfaceGetInfo
MPRAPI.dll13MprAdminInterfaceDeviceGetInfo
MPRAPI.dll19MprAdminInterfaceGetHandle
MPRAPI.dll74MprConfigInterfaceGetHandle
MPRAPI.dll12MprAdminInterfaceDelete
MPRAPI.dll30MprAdminInterfaceUpdateRoutes
MPRAPI.dll2MprAdminConnectionClearStats
MPRAPI.dll45MprAdminPortGetInfo
MPRAPI.dll103MprInfoBlockQuerySize
MPRAPI.dll3MprAdminConnectionEnum
MPRAPI.dll41MprAdminMIBServerDisconnect
MPRAPI.dll59MprAdminUserGetInfo
MPRAPI.dll37MprAdminMIBEntryGetFirst
MPRAPI.dll17MprAdminInterfaceGetCredentials
MPRAPI.dll9MprAdminGetPDCServer
CLUSAPI.dll75GetClusterNetInterfaceKey
CLUSAPI.dll73GetClusterKey
CLUSAPI.dll8CloseClusterNetwork
CLUSAPI.dll35ClusterRegDeleteKey
CLUSAPI.dll10CloseClusterNotifyPort
CLUSAPI.dll99OpenClusterNode
CLUSAPI.dll87GetClusterResourceState
CLUSAPI.dll60DeleteClusterResource
CLUSAPI.dll67GetClusterFromNetwork
CLUSAPI.dll93OnlineClusterGroup
CLUSAPI.dll27ClusterNodeCloseEnum
CLUSAPI.dll55CreateClusterGroup
CLUSAPI.dllAddClusterResourceDependency
CLUSAPI.dll111SetClusterNetworkPriorityOrder
CLUSAPI.dll4ChangeClusterResourceGroup
CLUSAPI.dll84GetClusterQuorumResource
CLUSAPI.dll38ClusterRegEnumValue
CLUSAPI.dll56CreateClusterNotifyPort
CLUSAPI.dll41ClusterRegQueryInfoKey
CLUSAPI.dll71GetClusterGroupState
CLUSAPI.dll110SetClusterNetworkName
CLUSAPI.dll98OpenClusterNetwork
CLUSAPI.dll37ClusterRegEnumKey
CLUSAPI.dll22ClusterNetworkCloseEnum
CLUSAPI.dll58CreateClusterResourceType
urlmon.dll27CreateFormatEnumerator
urlmon.dll65RegisterMediaTypes
urlmon.dll7CoInternetCombineUrl
urlmon.dll67RevokeBindStatusCallback
urlmon.dll39FindMediaTypeClass
urlmon.dll37FaultInIEFeature
urlmon.dll55IsLoggingEnabledA
urlmon.dll12CoInternetGetProtocolFlags
urlmon.dll25CreateAsyncBindCtx
urlmon.dll59ObtainUserAgentString
urlmon.dll10CoInternetCreateZoneManager
urlmon.dll48HlinkNavigateMoniker
urlmon.dll29CreateURLMonikerEx
urlmon.dll74URLDownloadToFileW
urlmon.dll73URLDownloadToFileA
urlmon.dll18CoInternetParseUrl
urlmon.dll56IsLoggingEnabledW
urlmon.dll76URLOpenBlockingStreamA
urlmon.dll24CopyStgMedium
urlmon.dll81URLOpenStreamW
urlmon.dll85WriteHitLogging
urlmon.dll61RegisterBindStatusCallback
urlmon.dll63RegisterFormatEnumerator
urlmon.dll72URLDownloadToCacheFileW
urlmon.dll80URLOpenStreamA
urlmon.dll21CompareSecurityIds
urlmon.dll5CoGetClassObjectFromURL
Secur32.dll50QuerySecurityPackageInfoA
Secur32.dll5AddSecurityPackageA
Secur32.dll12DeleteSecurityContext
Secur32.dll7ApplyControlToken
Secur32.dll45QueryContextAttributesA
MPR.dll47WNetGetNetworkInformationW
MPR.dll20WNetConnectionDialog1W

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionMicrosoft MPEG-4 Video Decompressor
FileVersion8.00.00.4504
InternalNamempg4ds32.ax
LegalCopyrightCopyright (C) Microsoft Corp. 1996 - 2001
OriginalFilenamempg4ds32.ax
ProductNameMicrosoft MPEG-4 Video Decompressor
ProductVersion8.00.00.4504

VS_FIXEDFILEINFO

FileVersion8.0.0.4504
ProductVersion8.0.0.4504
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType3
FileSubtype0
offsetsizetypecomment
0277504EXE02/08/2016 21:06:18#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK