filename0a73c41b1dbb8f19b96d51f85a36c8dc
size86016 (0x15000)
md50a73c41b1dbb8f19b96d51f85a36c8dc
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavW32.Aliser FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
1084471
19802219
0029
19904923
10527
617351
11844742

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x3b57353f
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.20
SizeOfCode0x10000
SizeOfInitializedData0x4000
SizeOfUninitializedData0
AddressOfEntryPoint0x63a8
BaseOfCode0x1000
BaseOfData0x11000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion5.0
ImageVersion5.0
SubsystemVersion4.0
Reserved10x10000
SizeOfImage0x19000
SizeOfHeaders0x1000
CheckSum0x1b027
Subsystem2
DllCharacteristics0x8800
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000xf1320x10000RWX CODE
.data0x110000x2ac40x1000RW- IDATA
.rsrc0x140000x50000x3000RWX IDATA

Data Directory

typevasize
EXPORT00
IMPORT0xf44c0xa0
RESOURCE0x140000x670
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x12500x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x10000x250
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#115480
module_namehintordfunction_name
KERNEL32.dll329GetPrivateProfileIntA
KERNEL32.dll330GetPrivateProfileIntW
KERNEL32.dll313GetModuleFileNameW
KERNEL32.dll479LoadLibraryA
KERNEL32.dll312GetModuleFileNameA
KERNEL32.dll336GetPrivateProfileStringW
KERNEL32.dll339GetProcAddress
KERNEL32.dll467IsBadWritePtr
KERNEL32.dll478LeaveCriticalSection
KERNEL32.dll111EnterCriticalSection
KERNEL32.dll410GlobalAddAtomA
KERNEL32.dll414GlobalDeleteAtom
KERNEL32.dll399GetVersionExA
KERNEL32.dll468IsDBCSLeadByte
KERNEL32.dll268GetCurrentThreadId
KERNEL32.dll390GetTickCount
KERNEL32.dll374GetSystemTimeAsFileTime
KERNEL32.dll424GlobalMemoryStatus
KERNEL32.dll453InitializeCriticalSection
KERNEL32.dll661SetFilePointer
KERNEL32.dll90DeleteCriticalSection
KERNEL32.dll201GetACP
KERNEL32.dll400GetVersionExW
KERNEL32.dll456InterlockedDecrement
KERNEL32.dll459InterlockedIncrement
KERNEL32.dll56CreateFileMappingA
KERNEL32.dll57CreateFileMappingW
KERNEL32.dll555QueryPerformanceCounter
KERNEL32.dll556QueryPerformanceFrequency
KERNEL32.dll656SetEvent
KERNEL32.dll346GetProcessTimes
KERNEL32.dll265GetCurrentProcess
KERNEL32.dll303GetLocalTime
KERNEL32.dll185FlushFileBuffers
KERNEL32.dll202GetAtomNameA
KERNEL32.dll809lstrcmpA
KERNEL32.dll264GetCurrentDirectoryW
KERNEL32.dll263GetCurrentDirectoryA
KERNEL32.dll58CreateFileW
KERNEL32.dll55CreateFileA
KERNEL32.dll53CreateEventW
KERNEL32.dll52CreateEventA
KERNEL32.dll293GetFileSize
KERNEL32.dll501MapViewOfFile
KERNEL32.dll301GetLastError
KERNEL32.dll734UnmapViewOfFile
KERNEL32.dll30CloseHandle
KERNEL32.dll464IsBadReadPtr
KERNEL32.dll461IsBadCodePtr
KERNEL32.dll492LocalReAlloc
KERNEL32.dll485LocalAlloc
KERNEL32.dll360GetStdHandle
KERNEL32.dll436HeapAlloc
KERNEL32.dll818lstrcpynA
KERNEL32.dll782WriteFile
KERNEL32.dll140ExitProcess
KERNEL32.dll341GetProcessHeap
KERNEL32.dll218GetCommandLineA
KERNEL32.dll507MoveFileA
KERNEL32.dll514MultiByteToWideChar
KERNEL32.dll92DeleteFileA
KERNEL32.dll489LocalFree
KERNEL32.dll380GetTempFileNameA
KERNEL32.dll266GetCurrentProcessId
KERNEL32.dll335GetPrivateProfileStringA
KERNEL32.dll821lstrlenA
KERNEL32.dll822lstrlenW
KERNEL32.dll769WideCharToMultiByte
KERNEL32.dll715TerminateProcess
KERNEL32.dll599RtlUnwind
KERNEL32.dll560RaiseException
USER32.dll516RegisterWindowMessageA
USER32.dll517RegisterWindowMessageW
USER32.dll630SystemParametersInfoA
USER32.dll631SystemParametersInfoW
USER32.dll519ReleaseDC
USER32.dll326GetSysColor
USER32.dll329GetSystemMetrics
USER32.dll381IntersectRect
USER32.dll471OffsetRect
USER32.dll456MessageBoxW
USER32.dll451MessageBoxA
USER32.dll256GetDC
SHLWAPI.dll132SHCreateStreamOnFileW
SHLWAPI.dll70PathIsRelativeW
SHLWAPI.dll28PathCombineW
SHLWAPI.dll282wvnsprintfW
SHLWAPI.dll105PathRemoveFileSpecA
SHLWAPI.dll281wvnsprintfA
SHLWAPI.dll279wnsprintfA
SHLWAPI.dll212StrCmpNW
SHLWAPI.dll202StrCatBuffW
SHLWAPI.dll201StrCatBuffA
SHLWAPI.dll22PathAppendW
SHLWAPI.dll150SHGetValueW
SHLWAPI.dll147SHGetInverseCMAP
SHLWAPI.dll245StrStrIW
SHLWAPI.dll208StrCmpIW
SHLWAPI.dll130SHCreateShellPalette
SHLWAPI.dll280wnsprintfW
SHLWAPI.dll106PathRemoveFileSpecW
SHLWAPI.dll42PathFindFileNameW
SHLWAPI.dll196SHStrDupW
SHLWAPI.dll250StrToIntW
SHLWAPI.dll214StrCpyNW
ole32.dll15CoCreateInstance
ole32.dll85CoTaskMemFree
ole32.dll108CreateStreamOnHGlobal
ole32.dll84CoTaskMemAlloc
ole32.dll49CoInitialize
ole32.dll89CoUninitialize
OLEAUT32.dll6
OLEAUT32.dll4
OLEAUT32.dll150
OLEAUT32.dll12
OLEAUT32.dll7
OLEAUT32.dll2
ADVAPI32.dll423RegQueryValueExA
ADVAPI32.dll120CryptReleaseContext
ADVAPI32.dll388RegCloseKey
ADVAPI32.dll424RegQueryValueExW
ADVAPI32.dll414RegOpenKeyExW
ADVAPI32.dll413RegOpenKeyExA
GDI32.dll476SetDIBColorTable
GDI32.dll506SetTextColor
GDI32.dll502SetStretchBltMode
GDI32.dll469SetBkMode
GDI32.dll435RealizePalette
GDI32.dll463SelectPalette
GDI32.dll345GetObjectW
GDI32.dll343GetObjectA
GDI32.dll301GetDeviceCaps
GDI32.dll43CreateCompatibleDC
GDI32.dll462SelectObject
GDI32.dll81DeleteDC
GDI32.dll42CreateCompatibleBitmap
GDI32.dll300GetDIBits
GDI32.dll299GetDIBColorTable
GDI32.dll348GetPaletteEntries
GDI32.dll48CreateDIBSection
GDI32.dll84DeleteObject

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptioncopymar
FileVersion6.10.0016.1624
InternalNamecopymar
LegalCopyrightCopyright (C) Microsoft Corp. 1981-2000
OriginalFilenamecopymar.exe
ProductNameMicrosoft(R) MSN (R) Communications System
ProductVersion6.10.0016.1624
Built bymsnbld

StringTable 000004E4

CompanyNameMicrosoft Corporation
FileDescriptioncopymar
FileVersion6.10.0016.1624
InternalNamecopymar
LegalCopyrightCopyright (C) Microsoft Corp. 1981-2000
OriginalFilenamecopymar.exe
ProductNameMicrosoft(R) MSN (R) Communications System
ProductVersion6.10.0016.1624
Built bymsnbld

VS_FIXEDFILEINFO

FileVersion6.10.16.1624
ProductVersion6.10.16.1624
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags8
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
086016EXE07/19/2001 19:30:07#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK