filenameexecutable.1552.exe
size92672 (0x16a00)
md504cad3a14f8d750d4a37d2ebe9ca3aa4
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
149307293
1473072919
10315
1323072913
1383072935
1313072921
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4a5bc225
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x12e00
SizeOfInitializedData0x5200
SizeOfUninitializedData0
AddressOfEntryPoint0x542d
BaseOfCode0x1000
BaseOfData0x13000
ImageBase0x370000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x1a000
SizeOfHeaders0x400
CheckSum0x20fef
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

namevavsizeraw sizeflags
.text0x10000x12c800x12e00R-X CODE
.data0x140000x28700x1000RW- IDATA
.rsrc0x170000x17c00x1800R-- IDATA
.reloc0x190000xf4c0x1000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x120980xc8
RESOURCE0x170000x17c0
EXCEPTION00
SECURITY00
BASERELOC0x190000xf4c
DEBUG0x13c240x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0xbb200x40
Bound_IAT0x2880xc0
IAT0x10000x488
Delay_IAT0x11c780x120
CLR_Header00
typenamesizecp
MUI#12400
WEVT_TEMPLATE#133060
VERSION#19000
MANIFEST#112700
module_namehintordfunction_name
GDI32.dll459GetDeviceCaps
GDI32.dll145D3DKMTSetProcessSchedulingPriorityClass
GDI32.dll520GetRandomRgn
GDI32.dll525GetStockObject
GDI32.dll47CreateCompatibleBitmap
GDI32.dll230DeleteObject
GDI32.dll458GetDIBits
GDI32.dll19BitBlt
GDI32.dll227DeleteDC
GDI32.dll524GetRgnBox
GDI32.dll631SelectObject
GDI32.dll629SelectClipRgn
GDI32.dll48CreateCompatibleDC
GDI32.dll34CombineRgn
GDI32.dll573OffsetRgn
GDI32.dll331GdiAlphaBlend
GDI32.dll79CreateRectRgn
GDI32.dll53CreateDIBSection
USER32.dll274GetClassNameW
USER32.dll785UpdateWindow
USER32.dll715SetWindowTextW
USER32.dll163DestroyIcon
USER32.dll420GetWindowThreadProcessId
USER32.dll412GetWindowRect
USER32.dll549OffsetRect
USER32.dll644SetClassLongW
USER32.dll538MonitorFromWindow
USER32.dll3AdjustWindowRectEx
USER32.dll351GetMonitorInfoW
USER32.dll229EnumDisplayDevicesW
USER32.dll234EnumDisplaySettingsW
USER32.dll382GetSystemMetrics
USER32.dll541MsgWaitForMultipleObjectsEx
USER32.dll566PostMessageW
USER32.dll595RegisterErrorReportingDialog
USER32.dll597RegisterGhostWindow
USER32.dll427HungWindowFromGhostWindow
USER32.dll443InternalGetWindowIcon
USER32.dll422GhostWindowFromHungWindow
USER32.dll596RegisterFrostWindow
USER32.dll555OpenThreadDesktop
USER32.dll398GetWindow
USER32.dll74CloseDesktop
USER32.dll363GetPropW
USER32.dll779UnregisterSessionPort
USER32.dll604RegisterSessionPort
USER32.dll61CheckDesktopByThreadId
USER32.dll211DwmStopRedirection
USER32.dll210DwmStartRedirection
USER32.dll659SetForegroundWindow
USER32.dll464IsHungAppWindow
USER32.dll525MessageBeep
USER32.dll476IsWindowEnabled
USER32.dll242EnumWindows
USER32.dll252FlashWindowEx
USER32.dll635SendMessageTimeoutW
USER32.dll475IsWindow
USER32.dll265GetCaretBlinkTime
USER32.dll221EndTask
USER32.dll552OpenDesktopW
USER32.dll461IsDialogMessageW
USER32.dll260GetAncestor
USER32.dll698SetThreadDesktop
USER32.dll220EndPaint
USER32.dll71ClientToScreen
USER32.dll444InternalGetWindowText
USER32.dll392GetUpdateRgn
USER32.dll699SetTimer
USER32.dll465IsIconic
USER32.dll246FillRect
USER32.dll483KillTimer
USER32.dll482IsZoomed
USER32.dll387GetTitleBarInfo
USER32.dll404GetWindowInfo
USER32.dll511LogicalToPhysicalPoint
USER32.dll276GetClientRect
USER32.dll14BeginPaint
USER32.dll42ChangeWindowMessageFilterEx
USER32.dll446InvalidateRect
USER32.dll406GetWindowLongW
USER32.dll419GetWindowTextW
USER32.dll290GetDCEx
USER32.dll708SetWindowLongW
USER32.dll735ShowWindow
USER32.dll380GetSysColorBrush
USER32.dll99CreateDialogParamW
USER32.dll569PostThreadMessageW
USER32.dll480IsWindowVisible
USER32.dll306GetGuiResources
USER32.dll710SetWindowPos
USER32.dll506LoadStringW
USER32.dll493LoadIconW
USER32.dll611RegisterWindowMessageW
USER32.dll175DispatchMessageW
USER32.dll764TranslateMessage
USER32.dll563PeekMessageW
USER32.dll601RegisterPowerSettingNotification
USER32.dll613ReleaseDC
USER32.dll289GetDC
USER32.dll567PostQuitMessage
USER32.dll166DestroyWindow
USER32.dll778UnregisterPowerSettingNotification
USER32.dll156DefWindowProcW
USER32.dll110CreateWindowExW
USER32.dll589RegisterClassExW
USER32.dll386GetThreadDesktop
USER32.dll395GetUserObjectInformationW
USER32.dll748SystemParametersInfoW
USER32.dll636SendMessageW
msvcrt.dll1262memset
msvcrt.dll934_unlock
msvcrt.dll141__dllonexit
msvcrt.dll1017_wcsnicmp
msvcrt.dll747_onexit
msvcrt.dll345_except_handler4_common
msvcrt.dll71_CIsqrt
msvcrt.dll1258memcpy
msvcrt.dll1036_wcsupr_s
msvcrt.dll1361wcschr
msvcrt.dll1373wcsncpy_s
msvcrt.dll1376wcsrchr
msvcrt.dll41void * __cdecl operator new[](unsigned int)

??_U@YAPAXI@Z

msvcrt.dll43void __cdecl operator delete[](void *)

??_V@YAXPAX@Z

msvcrt.dll1277rand
msvcrt.dll1294srand
msvcrt.dll1007_wcsicmp
msvcrt.dll764_purecall
msvcrt.dll578_lock
msvcrt.dll974_vsnwprintf
msvcrt.dll295_controlfp
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll210__set_app_type
msvcrt.dll190__p__fmode
msvcrt.dll185__p__commode
msvcrt.dll212__setusermatherr
msvcrt.dll1260memmove
msvcrt.dll145__getmainargs
msvcrt.dll276_cexit
msvcrt.dll354_exit
msvcrt.dll106_XcptFilter
msvcrt.dll500_ismbblead
msvcrt.dll1167exit
msvcrt.dll231_acmdln
msvcrt.dll469_initterm
msvcrt.dll257_amsg_exit
msvcrt.dll404_ftol2
ntdll.dll35DbgPrompt
ntdll.dll425NtQuerySystemInformation
ntdll.dll33DbgPrintEx
ntdll.dll634RtlCaptureStackBackTrace
ntdll.dll1372WinSqmAddToStreamEx
ntdll.dll1388WinSqmIsOptedIn
ntdll.dll162NtAcceptConnectPort
ntdll.dll219NtCompleteConnectPort
ntdll.dll459NtReplyWaitReceivePort
ntdll.dll462NtRequestPort
ntdll.dll221NtConnectPort
ntdll.dll463NtRequestWaitReplyPort
ntdll.dll1236RtlUpcaseUnicodeChar
ntdll.dll1387WinSqmIncrementDWORD
ntdll.dll1043RtlNtStatusToDosError
ntdll.dll61EtwEventWriteNoRegistration
ntdll.dll212NtClose
ntdll.dll555NtWaitForSingleObject
ntdll.dll341NtOpenEvent
ntdll.dll842RtlFreeSid
ntdll.dll201NtAlpcSendWaitReceivePort
ntdll.dll184NtAlpcConnectPort
ntdll.dll609RtlAllocateAndInitializeSid
ntdll.dll398NtQueryInformationProcess
ntdll.dll458NtReplyPort
ntdll.dll256NtCreateWaitablePort
ntdll.dll923RtlInitUnicodeString
ntdll.dll944RtlInsertElementGenericTable
ntdll.dll982RtlIsGenericTableEmpty
ntdll.dll1021RtlLookupElementGenericTable
ntdll.dll935RtlInitializeGenericTable
ntdll.dll53EtwEventEnabled
ntdll.dll55EtwEventRegister
ntdll.dll56EtwEventUnregister
ntdll.dll784RtlEnumerateGenericTableWithoutSplaying
ntdll.dll730RtlDeleteElementGenericTable
ntdll.dll1371WinSqmAddToStream
ntdll.dll57EtwEventWrite
UxTheme.dll9CloseThemeData
UxTheme.dll67OpenThemeData
IMM32.dll35ImmDisableIME
dwmredir.dll5DwmRedirectionManagerLockMemoryAllocations
dwmredir.dll2DwmRedirectionManagerEnableMMCSS
dwmredir.dll6DwmRedirectionManagerPlayingVideo
dwmredir.dllDwmInitializeTransport
dwmredir.dll12DwmShutdownTransport
dwmredir.dll10DwmRedirectionManagerShutdown
dwmredir.dll9DwmRedirectionManagerShouldRemainOnHibernate
dwmredir.dll1DwmRedirectionManagerDispatchMessage
dwmredir.dll3DwmRedirectionManagerFailMessage
dwmredir.dll11DwmRedirectionManagerWaitForMultipleObjects
dwmredir.dll13DwmVersionCheck
dwmcore.dll5MilChannel_CommitChannel
dwmcore.dll21MilComposition_WaitForNextMessage
dwmcore.dll18MilCompositionEngine_UpdateSchedulerSettings
dwmcore.dll35MilResource_SendCommand
dwmcore.dll8MilChannel_GetMarshalType
dwmcore.dll24MilConnection_CreateChannel
dwmcore.dll26MilConnection_HandleSfmEventOnPartition
dwmcore.dll23MilConnection_ClearSfmEventOnPartition
dwmcore.dll25MilConnection_DestroyChannel
dwmcore.dll19MilComposition_PeekNextMessage
KERNEL32.dll747InterlockedExchange
KERNEL32.dll609GetStartupInfoA
KERNEL32.dll532GetModuleHandleA
KERNEL32.dll835LocalAlloc
KERNEL32.dll839LocalFree
KERNEL32.dll1040ResumeThread
KERNEL32.dll231DuplicateHandle
KERNEL32.dll746InterlockedDecrement
KERNEL32.dll750InterlockedIncrement
KERNEL32.dll1345lstrcmpiW
KERNEL32.dll1268WaitForMultipleObjectsEx
KERNEL32.dll781IsWow64Process
KERNEL32.dll1001RegSetValueExW
KERNEL32.dll964RegCreateKeyExW
KERNEL32.dll932QueryPerformanceCounter
KERNEL32.dll1174SetThreadPriority
KERNEL32.dll180CreateThread
KERNEL32.dll895OpenProcess
KERNEL32.dll1015ReleaseMutex
KERNEL32.dll158CreateMutexW
KERNEL32.dll1110SetEvent
KERNEL32.dll884OpenEventW
KERNEL32.dll1196SignalObjectAndWait
KERNEL32.dll1231UnhandledExceptionFilter
KERNEL32.dll451GetCurrentThread
KERNEL32.dll1213TerminateThread
KERNEL32.dll1212TerminateProcess
KERNEL32.dll198DebugBreak
KERNEL32.dll585GetProcessHeap
KERNEL32.dll721HeapReAlloc
KERNEL32.dll714HeapAlloc
KERNEL32.dll718HeapFree
KERNEL32.dll767IsDebuggerPresent
KERNEL32.dll535GetModuleHandleW
KERNEL32.dll828LoadLibraryExA
KERNEL32.dll744InterlockedCompareExchange
KERNEL32.dll353FreeLibrary
KERNEL32.dll205DelayLoadFailureHook
KERNEL32.dll1198Sleep
KERNEL32.dll667GetUserDefaultLangID
KERNEL32.dll349FormatMessageW
KERNEL32.dll479GetExitCodeThread
KERNEL32.dll1269WaitForSingleObject
KERNEL32.dll1010RegisterWaitForSingleObject
KERNEL32.dll649GetThreadId
KERNEL32.dll658GetTickCount
KERNEL32.dll918ProcessIdToSessionId
KERNEL32.dll133CreateEventW
KERNEL32.dll448GetCurrentProcessId
KERNEL32.dll1153SetProcessWorkingSetSize
KERNEL32.dll632GetSystemTimeAsFileTime
KERNEL32.dll979RegGetValueW
KERNEL32.dll626GetSystemInfo
KERNEL32.dll447GetCurrentProcess
KERNEL32.dll580GetProcAddress
KERNEL32.dll830LoadLibraryW
KERNEL32.dll1109SetErrorMode
KERNEL32.dll927QueryFullProcessImageNameW
KERNEL32.dll280ExitProcess
KERNEL32.dll452GetCurrentThreadId
KERNEL32.dll1152SetProcessShutdownParameters
KERNEL32.dll1185SetUnhandledExceptionFilter
KERNEL32.dll722HeapSetInformation
KERNEL32.dll1283WerSetFlags
KERNEL32.dll1136SetLastError
KERNEL32.dll82CloseHandle
KERNEL32.dll513GetLastError
KERNEL32.dll659GetTickCount64
KERNEL32.dll208DeleteCriticalSection
KERNEL32.dll737InitializeCriticalSection
KERNEL32.dll941QueueUserWorkItem
KERNEL32.dll824LeaveCriticalSection
KERNEL32.dll237EnterCriticalSection

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionDesktop Window Manager
FileVersion6.1.7600.16385 (win7_rtm.090713-1255)
InternalNamedwm.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamedwm.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion6.1.7600.16385
ProductVersion6.1.7600.16385
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
092672EXE07/13/2009 23:24:21#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x288