filename321.ddd
size1032192 (0xfc000)
md50cc601bd2cd417fbc927cfed6bb91336
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x50
blocks_in_file2
num_relocs0
header_paragraphs4
min_extra_paragraphs0xf
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0x1a
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x585332e2
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0xa18e
Magic0x10b
LinkerVersion2.25
SizeOfCode0xd0a00
SizeOfInitializedData0x1ac00
SizeOfUninitializedData0
AddressOfEntryPoint0xd265c
BaseOfCode0x1000
BaseOfData0xd3000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0xfc000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x1000
SizeOfStackCommit0x100000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

Borland Delphi 2006

Sections

namevavsizeraw sizeflags
.text0x10000xf60000xf6000RWX CODE
.rsrc0xf70000x20000x2000RWX CODE
.reloc0xf90000x30000x3000RW- IDATA

Data Directory

typevasize
EXPORT0xf72f40x52
IMPORT0xdd0000xc8
RESOURCE0xf70000x2e0
EXCEPTION00
SECURITY00
BASERELOC0xe00000x18
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT0xde0000x154
CLR_Header00
typenamesizecp
STRING#40867800
STRING#40878920
STRING#408810920
STRING#40898960
STRING#40908000
STRING#40912120
STRING#40921640
STRING#40937080
STRING#409411320
STRING#40958600
STRING#40966640
RCDATADVCLAL160
RCDATAPACKAGEINFO6400
idlangstring
653600Windows XP
653610Windows Server 2003
653620Windows Server 2003 R2
653630Windows Server 2012
653640Windows 8
653650Observer is not supported
653660Cannot have multiple single cast observers added to the observers collection
653670The object does not implement the observer interface
653680No single cast observer with ID %d was added to the observer collection
653690No multi cast observer with ID %d was added to the observer collection
653760Item not found
653770Duplicates not allowed
653780Insufficient RTTI available to support this operation
653790Parameter count mismatch
653800Type '%s' is not declared in the interface section of a unit
653810VAR and OUT arguments must match parameter type exactly
653820%s (Version %d.%d, Build %d, %5:s)
653830%s Service Pack %4:d (Version %1:d.%2:d, Build %3:d, %5:s)
65384032-bit Edition
65385064-bit Edition
653860Windows
653870Windows Vista
653880Windows Server 2008
653890Windows 7
653900Windows Server 2008 R2
653910Windows 2000
653920%s.Seek not implemented
653930%s not in a class registration group
653940Property %s does not exist
653950Stream write error
653960Parameter %s cannot be a negative value
653970Input buffer exceeded for %s = %d, %s = %d
653980The specified file was not found
653990Invalid Timeout value: %s
654000Timespan too long
654010The duration cannot be returned because the absolute value exceeds the value of TTimeSpan.MaxValue
654020Value cannot be NaN
654030Negating the minimum value of a Timespan is invalid
654040Invalid Timespan format
654050Timespan element too long
654060''%s'' is not a valid integer value
654070Argument out of range
654080Cannot create file "%s". %s
654090Cannot open file "%s". %s
654100Invalid file name - %s
654110Invalid stream format
654120''%s'' is not a valid component name
654130Invalid property value
654140Invalid property path
654150Invalid property value
654160List capacity out of bounds (%d)
654170List count out of bounds (%d)
654180List index out of bounds (%d)
654190Out of memory while expanding memory stream
654200%s has not been registered as a COM class
654210Error reading %s%s%s: %s
654220Stream read error
654230Property is read-only
654240Friday
654250Saturday
654260Invalid source array
654270Invalid destination array
654280Character index out of bounds (%d)
654290Start index out of bounds (%d)
654300Invalid count (%d)
654310Invalid destination index (%d)
654320Invalid code page
654330Invalid encoding name
654340Ancestor for '%s' not found
654350Cannot assign a %s to a %s
654360Class %s not found
654370A class named %s already exists
654380List does not allow duplicates ($0%x)
654390A component named %s already exists
654400September
654410October
654420November
654430December
654440Sun
654450Mon
654460Tue
654470Wed
654480Thu
654490Fri
654500Sat
654510Sunday
654520Monday
654530Tuesday
654540Wednesday
654550Thursday
654560May
654570Jun
654580Jul
654590Aug
654600Sep
654610Oct
654620Nov
654630Dec
654640January
654650February
654660March
654670April
654680May
654690June
654700July
654710August
654720External exception %x
654730Assertion failed
654740Interface not supported
654750Exception in safecall method
654760Object lock not owned
654770Monitor support function not initialized
654780Feature not implemented
654790%s (%s, line %d)
654800Abstract Error
654810Access violation at address %p in module '%s'. %s of address %p
654820System Error. Code: %d. %s%s
654830A call to an OS function failed
654840Jan
654850Feb
654860Mar
654870Apr
654880Variant or safe array is locked
654890Invalid variant type conversion
654900Invalid variant operation
654910Invalid NULL variant operation
654920Invalid variant operation (%s%.8x) %s
654930Custom variant type (%s%.4x) is out of range
654940Custom variant type (%s%.4x) already used by %s
654950Custom variant type (%s%.4x) is not usable
654960Too many custom variant types have been registered
654970Could not convert variant of type (%s) into type (%s)
654980Overflow while converting variant of type (%s) into type (%s)
654990Variant overflow
655000Invalid argument
655010Invalid variant type
655020Operation not supported
655030Unexpected variant error
655040Invalid pointer operation
655050Invalid class typecast
655060Access violation at address %p. %s of address %p
655070Access violation
655080Stack overflow
655090Control-C hit
655100Privileged instruction
655110Exception %s in module %s at %p. %s%s
655120Application Error
655130Format '%s' invalid or incompatible with argument
655140No argument for format '%s'
655150Variant method calls not supported
655160Read
655170Write
655180Error creating variant or safe array
655190Variant or safe array index out of bounds
655200<unknown>
655210'%d.%d' is not a valid timestamp
655220Out of memory
655230I/O error %d
655240Too many open files
655250File access denied
655260Read beyond end of file
655270Disk full
655280Invalid numeric input
655290Division by zero
655300Range check error
655310Integer overflow
655320Invalid floating point operation
655330Floating point division by zero
655340Floating point overflow
655350Floating point underflow
module_namehintordfunction_name
oleaut32.dllSysFreeString
oleaut32.dllSysReAllocStringLen
oleaut32.dllSysAllocStringLen
advapi32.dllRegQueryValueExW
advapi32.dllRegOpenKeyExW
advapi32.dllRegCloseKey
user32.dllMessageBoxA
user32.dllCharNextW
user32.dllLoadStringW
kernel32.dllSleep
kernel32.dllVirtualFree
kernel32.dllVirtualAlloc
kernel32.dlllstrlenW
kernel32.dlllstrcpynW
kernel32.dllVirtualQuery
kernel32.dllGetTickCount
kernel32.dllGetSystemInfo
kernel32.dllGetVersion
kernel32.dllCompareStringW
kernel32.dllIsValidLocale
kernel32.dllSetThreadLocale
kernel32.dllGetSystemDefaultUILanguage
kernel32.dllGetUserDefaultUILanguage
kernel32.dllGetLocaleInfoW
kernel32.dllWideCharToMultiByte
kernel32.dllMultiByteToWideChar
kernel32.dllGetACP
kernel32.dllLoadLibraryExW
kernel32.dllGetStartupInfoW
kernel32.dllGetProcAddress
kernel32.dllGetModuleHandleW
kernel32.dllGetModuleFileNameW
kernel32.dllGetCommandLineW
kernel32.dllFreeLibrary
kernel32.dllGetLastError
kernel32.dllUnhandledExceptionFilter
kernel32.dllRtlUnwind
kernel32.dllRaiseException
kernel32.dllExitProcess
kernel32.dllGetCurrentThreadId
kernel32.dllDeleteCriticalSection
kernel32.dllLeaveCriticalSection
kernel32.dllEnterCriticalSection
kernel32.dllInitializeCriticalSection
kernel32.dllFindFirstFileW
kernel32.dllFindClose
kernel32.dllWriteFile
kernel32.dllGetStdHandle
kernel32.dllCloseHandle
kernel32.dllGetProcAddress
kernel32.dllRaiseException
kernel32.dllLoadLibraryA
kernel32.dllGetLastError
kernel32.dllTlsSetValue
kernel32.dllTlsGetValue
kernel32.dllTlsFree
kernel32.dllTlsAlloc
kernel32.dllLocalFree
kernel32.dllLocalAlloc
kernel32.dllFreeLibrary
user32.dllMessageBoxW
user32.dllLoadStringW
user32.dllGetSystemMetrics
user32.dllCharUpperBuffW
user32.dllCharUpperW
user32.dllCharLowerBuffW
kernel32.dllWriteProcessMemory
kernel32.dllWriteFile
kernel32.dllWideCharToMultiByte
kernel32.dllWaitForSingleObject
kernel32.dllVirtualQueryEx
kernel32.dllVirtualQuery
kernel32.dllVirtualProtect
kernel32.dllVirtualFree
kernel32.dllTryEnterCriticalSection
kernel32.dllSwitchToThread
kernel32.dllSetLastError
kernel32.dllSetFilePointer
kernel32.dllSetEvent
kernel32.dllSetEndOfFile
kernel32.dllResetEvent
kernel32.dllReadProcessMemory
kernel32.dllReadFile
kernel32.dllLocalFree
kernel32.dllLoadLibraryW
kernel32.dllLeaveCriticalSection
kernel32.dllIsValidLocale
kernel32.dllInitializeCriticalSection
kernel32.dllHeapSize
kernel32.dllHeapFree
kernel32.dllHeapDestroy
kernel32.dllHeapCreate
kernel32.dllHeapAlloc
kernel32.dllGetVersionExW
kernel32.dllGetThreadLocale
kernel32.dllGetStdHandle
kernel32.dllGetProcAddress
kernel32.dllGetModuleHandleW
kernel32.dllGetModuleFileNameW
kernel32.dllGetLocaleInfoW
kernel32.dllGetLocalTime
kernel32.dllGetLastError
kernel32.dllGetFullPathNameW
kernel32.dllGetDiskFreeSpaceW
kernel32.dllGetDateFormatW
kernel32.dllGetCurrentThreadId
kernel32.dllGetCurrentProcess
kernel32.dllGetCPInfoExW
kernel32.dllGetCPInfo
kernel32.dllGetACP
kernel32.dllFreeLibrary
kernel32.dllFormatMessageW
kernel32.dllEnumSystemLocalesW
kernel32.dllEnumCalendarInfoW
kernel32.dllEnterCriticalSection
kernel32.dllDeleteCriticalSection
kernel32.dllCreateFileW
kernel32.dllCreateEventW
kernel32.dllCompareStringW
kernel32.dllCloseHandle
kernel32.dllSleep
oleaut32.dllSafeArrayPtrOfIndex
oleaut32.dllSafeArrayGetUBound
oleaut32.dllSafeArrayGetLBound
oleaut32.dllSafeArrayCreate
oleaut32.dllVariantChangeType
oleaut32.dllVariantCopy
oleaut32.dllVariantClear
oleaut32.dllVariantInit
ordentry_vafunction_name
10xce030Unfuqpjkjxo
20xcdf14fuqpjkjxo
module_namen9v4d1m.dll
flags0
timestamp0
version0.0
ordinal_base1
nFunctions2
nNames2
Names(2)0xf7320
Functions(2)0xf7328
NameOrdinals(2)0xf731c
offsetsizetypecomment
01032192DLL12/16/2016 00:18:42#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK