a.exe - SafeSvc.exe

info
MZ
PE
resources
imports
exports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	a.exe
size	188928 (0x2e200)
md5	0a1522e04150e00d1f42f684d0665013

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd0

Rich Header

lib id	version	times used
147	30729	9
1	0	105
171	30319	41
155	30319	1
154	30319	1
157	30319	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x4ee21dce
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	10.0
SizeOfCode	0x26400
SizeOfInitializedData	0x73600
SizeOfUninitializedData	0
AddressOfEntryPoint	0x18e0
BaseOfCode	0x1000
BaseOfData	0x28000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	0.0
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0x9e000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0x8540
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x262de	0x26400	R-X CODE
.rdata	0x28000	0x4394	0x4400	R-- IDATA
.data	0x2d000	0x6c551	0xa00	RW- IDATA
.rsrc	0x9a000	0x3e0	0x400	R-- IDATA
.reloc	0x9b000	0x26fc	0x2800	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x2bfc0	0x3d4
IMPORT	0x2b590	0x64
RESOURCE	0x9a000	0x3e0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x9b000	0x2188
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x28000	0x1b4
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
DIALOG	#101	156	0
VERSION	#1	668	0

module_name	hint	function_name
KERNEL32.dll	274	EnumTimeFormatsW
KERNEL32.dll	690	GlobalAddAtomW
KERNEL32.dll	1230	TryEnterCriticalSection
KERNEL32.dll	715	HeapAlloc
KERNEL32.dll	258	EnumResourceNamesW
KERNEL32.dll	696	GlobalFix
KERNEL32.dll	716	HeapCompact
KERNEL32.dll	1224	TlsSetValue
KERNEL32.dll	332	FindResourceExA
KERNEL32.dll	862	MoveFileA
KERNEL32.dll	96	CompareFileTime
KERNEL32.dll	1328	WriteProfileSectionW
KERNEL32.dll	743	InitializeSListHead
KERNEL32.dll	1246	UpdateResourceA
KERNEL32.dll	79	ClearCommBreak
KERNEL32.dll	459	GetDevicePowerState
KERNEL32.dll	1202	Sleep
KERNEL32.dll	262	EnumResourceTypesW
KERNEL32.dll	1095	SetConsoleTitleA
KERNEL32.dll	773	IsSystemResumeAutomatic
KERNEL32.dll	608	GetShortPathNameA
KERNEL32.dll	578	GetPrivateProfileStringW
KERNEL32.dll	760	IsBadStringPtrA
KERNEL32.dll	153	CreateMailslotW
KERNEL32.dll	828	LoadLibraryA
KERNEL32.dll	581	GetProcAddress
KERNEL32.dll	907	PeekConsoleInputA
KERNEL32.dll	636	GetSystemWindowsDirectoryW
KERNEL32.dll	903	OpenWaitableTimerA
KERNEL32.dll	143	CreateFileW
KERNEL32.dll	514	GetLastError
KERNEL32.dll	1126	SetFilePointer
KERNEL32.dll	1317	WriteFile
KERNEL32.dll	82	CloseHandle
KERNEL32.dll	1067	SetConsoleActiveScreenBuffer
KERNEL32.dll	1101	SetCurrentDirectoryW
KERNEL32.dll	263	EnumSystemCodePagesA
KERNEL32.dll	377	GetCalendarInfoA
KERNEL32.dll	659	GetTickCount
KERNEL32.dll	334	FindResourceW
USER32.dll	148	DefDlgProcA
USER32.dll	191	DrawAnimatedRects
USER32.dll	11	ArrangeIconicWindows
USER32.dll	711	SetWindowRgn
USER32.dll	425	HideCaret
USER32.dll	625	ScrollWindowEx
USER32.dll	736	ShowWindowAsync
USER32.dll	591	RegisterClipboardFormatA
USER32.dll	7	AnimateWindow
USER32.dll	246	FillRect
USER32.dll	269	GetClassInfoExW
USER32.dll	461	IsDialogMessageW
USER32.dll	44	CharLowerBuffA
USER32.dll	506	LoadStringW
USER32.dll	314	GetKBCodePage
USER32.dll	183	DlgDirSelectComboBoxExA
USER32.dll	72	ClipCursor
USER32.dll	479	IsWindowUnicode
USER32.dll	634	SendMessageTimeoutA
USER32.dll	565	PostMessageA
USER32.dll	545	OemToCharA
USER32.dll	279	GetClipboardFormatNameA
USER32.dll	775	UnregisterDeviceNotification
USER32.dll	245	ExitWindowsEx
USER32.dll	684	SetPropA
USER32.dll	747	SystemParametersInfoA
USER32.dll	773	UnregisterClassA
USER32.dll	296	GetDlgItemInt
USER32.dll	476	IsWindowEnabled
USER32.dll	489	LoadCursorFromFileA
GDI32.dll	30	CloseFigure
GDI32.dll	636	SetBitmapBits
GDI32.dll	516	GetPixel
GDI32.dll	588	PlayMetaFileRecord
GDI32.dll	501	GetMiterLimit
GDI32.dll	468	GetEnhMetaFileHeader
GDI32.dll	655	SetICMProfileA
GDI32.dll	644	SetColorSpace
GDI32.dll	654	SetICMMode
GDI32.dll	678	SetTextColor
GDI32.dll	650	SetDeviceGammaRamp
GDI32.dll	632	SelectPalette
GDI32.dll	555	GetWindowExtEx
GDI32.dll	58	CreateEnhMetaFileA
GDI32.dll	227	DeleteDC
GDI32.dll	564	LPtoDP
GDI32.dll	423	GetBitmapBits
ADVAPI32.dll	390	IsValidSid
ADVAPI32.dll	698	SetSecurityDescriptorSacl
ADVAPI32.dll	585	RegDisablePredefinedCache
ADVAPI32.dll	279	FileEncryptionStatusW
ADVAPI32.dll	405	LookupPrivilegeNameW
ADVAPI32.dll	498	OpenBackupEventLogW
ADVAPI32.dll	397	LogonUserW
ADVAPI32.dll	592	RegEnumKeyW
ADVAPI32.dll	712	StartServiceCtrlDispatcherW
ADVAPI32.dll	381	InitiateSystemShutdownExW
ADVAPI32.dll	685	SetKernelObjectSecurity
ADVAPI32.dll	34	AreAllAccessesGranted
ADVAPI32.dll	547	QueryServiceConfigA
ADVAPI32.dll	404	LookupPrivilegeNameA
ADVAPI32.dll	613	RegOpenUserClassesRoot
ADVAPI32.dll	371	ImpersonateLoggedOnUser
ADVAPI32.dll	559	ReadEventLogW
ADVAPI32.dll	590	RegEnumKeyExA

ord	entry_va	function_name
1	0x1a90	GnrkBltvkx
2	0x1aa0	GnrkBmoaar
3	0x1a40	GnrkCyrpw
4	0x1be0	GnrkEkp
5	0x1d80	GnrkEnjzs
6	0x1d60	GnrkFa
7	0x1940	GnrkFsx
8	0x1c70	GnrkGm
9	0x1b30	GnrkGt
10	0x1c20	GnrkHhcpo
11	0x1c10	GnrkHjtl
12	0x1d90	GnrkIiip
13	0x1d50	GnrkJird
14	0x1e20	GnrkJstv
15	0x1e10	GnrkKhlhca
16	0x1f00	GnrkKhqbbu
17	0x1dc0	GnrkLmkamk
18	0x1a10	GnrkLoc
19	0x1e00	GnrkNlqh
20	0x1da0	GnrkNofovl
21	0x1970	GnrkNr
22	0x1a70	GnrkNsdwzc
23	0x1ca0	GnrkOda
24	0x1ee0	GnrkOhqbhe
25	0x1db0	GnrkOi
26	0x1cb0	GnrkOksgc
27	0x1960	GnrkOxft
28	0x1b00	GnrkPp
29	0x1bf0	GnrkQm
30	0x1770	GnrkQr
31	0x1c90	GnrkQulon
32	0x1c50	GnrkRrdcfn
33	0x1990	GnrkSbq
34	0x1ec0	GnrkSf
35	0x1ae0	GnrkStso
36	0x1eb0	GnrkTcfv
37	0x1c30	GnrkTch
38	0x1ab0	GnrkTjxdo
39	0x1e60	GnrkTrg
40	0x1930	GnrkUsmc
41	0x1b10	GnrkVnndq
42	0x1de0	GnrkWapq
43	0x1ad0	GnrkWsnq
44	0x1c00	GnrkWtlrh
45	0x1c40	GnrkWyey
46	0x1950	GnrkXalbb
47	0x1a50	GnrkXzwnp
48	0x1d20	GnrkZewk
49	0x1b70	GnrkZtdij

module_name	TVT.
flags	0
timestamp	2011-12-09 14:40:14
version	0.0
ordinal_base	1
nFunctions	49
nNames	49
Names(49)	0x2c0ac
Functions(49)	0x2bfe8
NameOrdinals(49)	0x2c170

StringTable 040904b0

CompanyName	SafeSvc
FileDescription	SafeSvc
FileVersion	1.0.0.1
InternalName	SafeSvc.exe
LegalCopyright	Copyright (C) 2011
OriginalFilename	SafeSvc.exe
ProductName	SafeSvc
ProductVersion	1.0.0.1

VS_FIXEDFILEINFO

FileVersion	1.0.0.1
ProductVersion	1.0.0.1
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	188928	EXE	12/09/2011 14:40:14	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

a.exe-

MZ Header

Rich Header

DOS stub

PE Header

Sections

Data Directory

StringTable 040904b0

VS_FIXEDFILEINFO

a.exe
-