filenameRestoration.exe
size204800 (0x32000)
md50d4dc44e802cc69818b731b2569994cd
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
1272912
0019
19803415
10405
14729927
108168122
11816868
617201

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x3cfcd5ec
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x23000
SizeOfInitializedData0x16000
SizeOfUninitializedData0
AddressOfEntryPoint0xcfa2
BaseOfCode0x1000
BaseOfData0x24000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x3a000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x2207a0x23000R-X CODE
.rdata0x240000x63e40x7000R-- IDATA
.data0x2b0000xa0a80x3000RW- IDATA
.rsrc0x360000x35980x4000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x28c280xb4
RESOURCE0x360000x3598
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x240000x470
Delay_IAT00
CLR_Header00
typenamesizecp
CURSOR#23080
CURSOR#31800
BITMAP#2656715080
BITMAP#309941840
BITMAP#309953640
BITMAP#309963240
ICON#17440
MENU#1321120
DIALOG#10212600
DIALOG#1053300
DIALOG#307212320
STRING#72280
STRING#38411300
STRING#3842420
STRING#38433300
STRING#385712500
STRING#38586740
STRING#38597320
STRING#38651720
STRING#38662220
STRING#386712200
STRING#38686120
STRING#3869440
GROUP_CURSOR#30977340
GROUP_ICON#128200
VERSION#18760
idlangstring
1041033\xffN\xff\xff\xffX\xff^\xffX\xffL\xff\xff\xff\xff
1061033\xffN\xff\xff\xffX\xff^\xffX\xffL\xff\xff\xff\xff
614401033Open
614411033Save As
614421033All Files (*.*)
614431033Untitled
614461033an unnamed file
614571033&Hide
614721033No error message is available.
614731033An unsupported operation was attempted.
614741033A required resource was unavailable.
614751033Out of memory.
614761033An unknown error has occurred.
616961033Invalid filename.
616971033Failed to open document.
616981033Failed to save document.
616991033Save changes to %1?
617001033Failed to create empty document.
617011033The file is too large to open.
617021033Could not start print job.
617031033Failed to launch help.
617041033Internal application error.
617051033Command failed.
617061033Insufficient memory to perform operation.
617071033System registry entries have been removed and the INI file (if any) was deleted.
617081033Not all of the system registry entries (or INI file) were removed.
617091033This program requires the file %s, which was not found on this system.
617101033This program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.
617121033Please enter an integer.
617131033Please enter a number.
617141033Please enter an integer between %1 and %2.
617151033Please enter a number between %1 and %2.
617161033Please enter no more than %1 characters.
617171033Please select a button.
617181033Please enter an integer between 0 and 255.
617191033Please enter a positive integer.
617201033Please enter a date and/or time.
617211033Please enter a currency.
617281033Unexpected file format.
617291033%1 Cannot find this file. Please verify that the correct path and file name are given.
617301033Destination disk drive is full.
617311033Unable to read from %1, it is opened by someone else.
617321033Unable to write to %1, it is read-only or opened by someone else.
617331033An unexpected error occurred while reading %1.
617341033An unexpected error occurred while writing %1.
618361033Unable to read write-only property.
618371033Unable to write read-only property.
618401033Unable to load mail system support.
618411033Mail system DLL is invalid.
618421033Send Mail failed to send message.
618561033No error occurred.
618571033An unknown error occurred while accessing %1.
618581033%1 was not found.
618591033%1 contains an invalid path.
618601033%1 could not be opened because there are too many open files.
618611033Access to %1 was denied.
618621033An invalid file handle was associated with %1.
618631033%1 could not be removed because it is the current directory.
618641033%1 could not be created because the directory is full.
618651033Seek failed on %1
618661033A hardware I/O error was reported while accessing %1.
618671033A sharing violation occurred while accessing %1.
618681033A locking violation occurred while accessing %1.
618691033Disk full while accessing %1.
618701033An attempt was made to access %1 past its end.
618721033No error occurred.
618731033An unknown error occurred while accessing %1.
618741033An attempt was made to write to the reading %1.
618751033An attempt was made to access %1 past its end.
618761033An attempt was made to read from the writing %1.
618771033%1 has a bad format.
618781033%1 contained an unexpected object.
618791033%1 contains an incorrect schema.
618881033pixels
module_namehintordfunction_name
KERNEL32.dll559RtlUnwind
KERNEL32.dll415HeapFree
KERNEL32.dll409HeapAlloc
KERNEL32.dll662Sleep
KERNEL32.dll368GetTimeZoneInformation
KERNEL32.dll349GetSystemTime
KERNEL32.dll283GetLocalTime
KERNEL32.dll336GetStartupInfoA
KERNEL32.dll202GetCommandLineA
KERNEL32.dll125ExitProcess
KERNEL32.dll523RaiseException
KERNEL32.dll670TerminateProcess
KERNEL32.dll418HeapReAlloc
KERNEL32.dll419HeapSize
KERNEL32.dll185GetACP
KERNEL32.dll413HeapDestroy
KERNEL32.dll411HeapCreate
KERNEL32.dll703VirtualFree
KERNEL32.dll699VirtualAlloc
KERNEL32.dll440IsBadWritePtr
KERNEL32.dll446IsValidLocale
KERNEL32.dll445IsValidCodePage
KERNEL32.dll119EnumSystemLocalesA
KERNEL32.dll369GetUserDefaultLCID
KERNEL32.dll447LCMapStringA
KERNEL32.dll448LCMapStringW
KERNEL32.dll685UnhandledExceptionFilter
KERNEL32.dll178FreeEnvironmentStringsA
KERNEL32.dll179FreeEnvironmentStringsW
KERNEL32.dll262GetEnvironmentStrings
KERNEL32.dll264GetEnvironmentStringsW
KERNEL32.dll621SetHandleCount
KERNEL32.dll338GetStdHandle
KERNEL32.dll277GetFileType
KERNEL32.dll651SetUnhandledExceptionFilter
KERNEL32.dll339GetStringTypeA
KERNEL32.dll342GetStringTypeW
KERNEL32.dll437IsBadReadPtr
KERNEL32.dll434IsBadCodePtr
KERNEL32.dll636SetStdHandle
KERNEL32.dll285GetLocaleInfoW
KERNEL32.dll33CompareStringA
KERNEL32.dll34CompareStringW
KERNEL32.dll610SetEnvironmentVariableA
KERNEL32.dll331GetProfileStringA
KERNEL32.dll609SetEndOfFile
KERNEL32.dll170FlushFileBuffers
KERNEL32.dll618SetFilePointer
KERNEL32.dll247GetCurrentProcess
KERNEL32.dll612SetErrorMode
KERNEL32.dll741WritePrivateProfileStringA
KERNEL32.dll305GetOEMCP
KERNEL32.dll191GetCPInfo
KERNEL32.dll325GetProcessVersion
KERNEL32.dll676TlsGetValue
KERNEL32.dll463LocalReAlloc
KERNEL32.dll677TlsSetValue
KERNEL32.dll102EnterCriticalSection
KERNEL32.dll399GlobalReAlloc
KERNEL32.dll449LeaveCriticalSection
KERNEL32.dll675TlsFree
KERNEL32.dll395GlobalHandle
KERNEL32.dll85DeleteCriticalSection
KERNEL32.dll674TlsAlloc
KERNEL32.dll426InitializeCriticalSection
KERNEL32.dll456LocalAlloc
KERNEL32.dll661SizeofResource
KERNEL32.dll391GlobalFlags
KERNEL32.dll773lstrcpynA
KERNEL32.dll483MulDiv
KERNEL32.dll625SetLastError
KERNEL32.dll292GetModuleFileNameA
KERNEL32.dll385GlobalAlloc
KERNEL32.dll764lstrcmpA
KERNEL32.dll249GetCurrentThread
KERNEL32.dll484MultiByteToWideChar
KERNEL32.dll722WideCharToMultiByte
KERNEL32.dll429InterlockedDecrement
KERNEL32.dll432InterlockedIncrement
KERNEL32.dll776lstrlenA
KERNEL32.dll536ReadFile
KERNEL32.dll372GetVersion
KERNEL32.dll761lstrcatA
KERNEL32.dll250GetCurrentThreadId
KERNEL32.dll393GlobalGetAtomNameA
KERNEL32.dll767lstrcmpiA
KERNEL32.dll383GlobalAddAtomA
KERNEL32.dll388GlobalFindAtomA
KERNEL32.dll387GlobalDeleteAtom
KERNEL32.dll770lstrcpyA
KERNEL32.dll294GetModuleHandleA
KERNEL32.dll396GlobalLock
KERNEL32.dll403GlobalUnlock
KERNEL32.dll392GlobalFree
KERNEL32.dll469LockResource
KERNEL32.dll163FindResourceA
KERNEL32.dll455LoadResource
KERNEL32.dll365GetTickCount
KERNEL32.dll137FileTimeToLocalFileTime
KERNEL32.dll138FileTimeToSystemTime
KERNEL32.dll256GetDiskFreeSpaceA
KERNEL32.dll92DeviceIoControl
KERNEL32.dll180FreeLibrary
KERNEL32.dll286GetLogicalDriveStringsA
KERNEL32.dll260GetDriveTypeA
KERNEL32.dll373GetVersionExA
KERNEL32.dll450LoadLibraryA
KERNEL32.dll318GetProcAddress
KERNEL32.dll148FindFirstFileA
KERNEL32.dll45CreateDirectoryA
KERNEL32.dll52CreateFileA
KERNEL32.dll27CloseHandle
KERNEL32.dll151FindFirstFileW
KERNEL32.dll48CreateDirectoryW
KERNEL32.dll175FormatMessageA
KERNEL32.dll282GetLastError
KERNEL32.dll460LocalFree
KERNEL32.dll375GetVolumeInformationA
KERNEL32.dll735WriteFile
KERNEL32.dll284GetLocaleInfoA
USER32.dll286GetMenuCheckMarkDimensions
USER32.dll515ReleaseDC
USER32.dll253GetDC
USER32.dll480PostQuitMessage
USER32.dll550SetCursor
USER32.dll252GetCursorPos
USER32.dll666ValidateRect
USER32.dll298GetMessageA
USER32.dll58ClientToScreen
USER32.dll340GetWindowDC
USER32.dll12BeginPaint
USER32.dll187EndPaint
USER32.dll627TabbedTextOutA
USER32.dll175DrawTextA
USER32.dll356GrayStringA
USER32.dll141DestroyMenu
USER32.dll237GetClassNameA
USER32.dll490PtInRect
USER32.dll410LoadCursorA
USER32.dll324GetSysColorBrush
USER32.dll369InflateRect
USER32.dll427LoadStringA
USER32.dll618ShowWindow
USER32.dll606SetWindowTextA
USER32.dll392IsDialogMessageA
USER32.dll478PostMessageA
USER32.dll527SendDlgItemMessageA
USER32.dll441MapWindowPoints
USER32.dll323GetSysColor
USER32.dll263GetFocus
USER32.dll559SetFocus
USER32.dll2AdjustWindowRectEx
USER32.dll522ScreenToClient
USER32.dll408LoadBitmapA
USER32.dll68CopyRect
USER32.dll402IsWindowVisible
USER32.dll332GetTopWindow
USER32.dll446MessageBoxA
USER32.dll228GetCapture
USER32.dll678WinHelpA
USER32.dll231GetClassInfoA
USER32.dll498RegisterClassA
USER32.dll290GetMenuItemCount
USER32.dll322GetSubMenu
USER32.dll291GetMenuItemID
USER32.dll351GetWindowTextLengthA
USER32.dll350GetWindowTextA
USER32.dll257GetDlgCtrlID
USER32.dll274GetKeyState
USER32.dll132DefWindowProcA
USER32.dll89CreateWindowExA
USER32.dll610SetWindowsHookExA
USER32.dll21CallNextHookEx
USER32.dll235GetClassLongA
USER32.dll578SetPropA
USER32.dll646UnhookWindowsHookEx
USER32.dll314GetPropA
USER32.dll22CallWindowProcA
USER32.dll517RemovePropA
USER32.dll301GetMessageTime
USER32.dll300GetMessagePos
USER32.dll281GetLastActivePopup
USER32.dll264GetForegroundWindow
USER32.dll560SetForegroundWindow
USER32.dll338GetWindow
USER32.dll600SetWindowLongA
USER32.dll603SetWindowPos
USER32.dll512RegisterWindowMessageA
USER32.dll466OffsetRect
USER32.dll377IntersectRect
USER32.dll625SystemParametersInfoA
USER32.dll347GetWindowPlacement
USER32.dll348GetWindowRect
USER32.dll307GetNextDlgTabItem
USER32.dll185EndDialog
USER32.dll532SendMessageA
USER32.dll642TranslateMessage
USER32.dll149DispatchMessageA
USER32.dll651UnregisterClassA
USER32.dll358HideCaret
USER32.dll613ShowCaret
USER32.dll210ExcludeUpdateRgn
USER32.dll221GetActiveWindow
USER32.dll540SetActiveWindow
USER32.dll399IsWindow
USER32.dll76CreateDialogIndirectParamA
USER32.dll142DestroyWindow
USER32.dll309GetParent
USER32.dll342GetWindowLongA
USER32.dll258GetDlgItem
USER32.dll400IsWindowEnabled
USER32.dll295GetMenuState
USER32.dll452ModifyMenuA
USER32.dll569SetMenuItemBitmaps
USER32.dll52CheckMenuItem
USER32.dll284GetMenu
USER32.dll181EnableMenuItem
USER32.dll657UpdateWindow
USER32.dll430LockWindowUpdate
USER32.dll396IsIconic
USER32.dll326GetSystemMetrics
USER32.dll240GetClientRect
USER32.dll169DrawIcon
USER32.dll414LoadIconA
USER32.dll183EnableWindow
USER32.dll378InvalidateRect
USER32.dll476PeekMessageA
USER32.dll401IsWindowUnicode
USER32.dll37CharNextA
USER32.dll126DefDlgProcA
USER32.dll166DrawFocusRect
USER32.dll684wsprintfA
GDI32.dll502SetViewportOrgEx
GDI32.dll396OffsetViewportOrgEx
GDI32.dll501SetViewportExtEx
GDI32.dll449ScaleViewportExtEx
GDI32.dll505SetWindowExtEx
GDI32.dll450ScaleWindowExtEx
GDI32.dll384IntersectClipRect
GDI32.dll83DeleteObject
GDI32.dll482SetMapMode
GDI32.dll293GetDeviceCaps
GDI32.dll77CreateSolidBrush
GDI32.dll426PtVisible
GDI32.dll430RectVisible
GDI32.dll517TextOutA
GDI32.dll158ExtTextOutA
GDI32.dll149Escape
GDI32.dll462SetBkMode
GDI32.dll351GetStockObject
GDI32.dll455SelectObject
GDI32.dll441RestoreDC
GDI32.dll448SaveDC
GDI32.dll80DeleteDC
GDI32.dll404PatBlt
GDI32.dll36CreateBitmap
GDI32.dll335GetObjectA
GDI32.dll461SetBkColor
GDI32.dll499SetTextColor
GDI32.dll282GetClipBox
GDI32.dll48CreateDIBitmap
GDI32.dll368GetTextExtentPointA
GDI32.dll17BitBlt
GDI32.dll42CreateCompatibleDC
comdlg32.dll11GetSaveFileNameA
WINSPOOL.DRV71DocumentPropertiesA
WINSPOOL.DRV28ClosePrinter
WINSPOOL.DRV124OpenPrinterA
ADVAPI32.dll347RegCloseKey
ADVAPI32.dll370RegOpenKeyExA
ADVAPI32.dll390RegSetValueExA
ADVAPI32.dll351RegCreateKeyExA
SHELL32.dll72SHGetFileInfoA
COMCTL32.dll17
COMCTL32.dll34ImageList_Destroy
COMCTL32.dll59ImageList_SetBkColor

StringTable 041104b0

Comments
CompanyName
FileDescriptionRestoration MFC Application
FileVersion1, 0, 0, 1
InternalNameRestoration
LegalCopyrightCopyright (C) 2000
LegalTrademarks
OriginalFilenameRestoration.EXE
PrivateBuild
ProductNameRestoration Application
ProductVersion1, 0, 0, 1
SpecialBuild

VS_FIXEDFILEINFO

FileVersion1.0.0.1
ProductVersion1.0.0.1
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
0204800EXE06/04/2002 14:59:56#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK