filename1138a97b311d27dfc64a0bbaddb952ed.exe
size487424 (0x77000)
md51138a97b311d27dfc64a0bbaddb952ed
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

Rich Header

lib idversiontimes used
15603036
956030125
96603015
2592104
9320672
93217923
10170
10060301
9260301
9430521
9060301

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x592d263a
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.10
SizeOfCode0x1b000
SizeOfInitializedData0x5b000
SizeOfUninitializedData0
AddressOfEntryPoint0x67b0
BaseOfCode0x1000
BaseOfData0x1c000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x79000
SizeOfHeaders0x1000
CheckSum0x7ad6b
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

InstallShield 2000

Sections

namevavsizeraw sizeflags
.text0x10000x1a0cf0x1b000R-X CODE
.rdata0x1c0000x44310x5000R-- IDATA
.data0x210000x41d40x3000RW- IDATA
.rsrc0x260000x52e540x53000R-- IDATA

Data Directory

typevasize
EXPORT0x203f00x41
IMPORT0x1f6d00xf0
RESOURCE0x260000x52e54
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x1c2500x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x1f2380x40
Bound_IAT00
IAT0x1c0000x244
Delay_IAT00
CLR_Header00
typenamesizecp
RCDATA#2351805191252
RCDATA#9724882231252
RCDATA#97251343001252
BITMAP#9892241252
ICON#1169361252
ICON#296401252
ICON#342641252
ICON#411281252
DIALOG#14773441252
DIALOG#14783421252
STRING#1924201252
STRING#1934901252
GROUP_ICON#571621252
VERSION#112001252
MANIFEST#14951252
idlangstring
30561033Slovenian
30571033Spanish
30581033Swedish
30591033Turkish
30601033Hebrew
30611033Japanese
30621033Thai
30631033Valencian
30641033Ireland
30651033Hong Kong
30661033Serbian
30671033Spanish_Latin American
30681033http://products.foxitsoftware.com/foxithomepage.php?product=Reader5
30691033Yes
30701033No
30711033Clockwise rotation
30721033Error writing to file
30731033Unsupported file attrib for overwrite
30761033Cabinets in the set do not have the same reserved space
30781033Error closing file
30801033Incomplete code set
30811033Invalid commandline param(s)
30821033Corrupt input
30861033Error creating dir
30871033File fails CRC check
module_namehintordfunction_name
KERNEL32.dll315GetCurrentProcessId
KERNEL32.dll469GetTickCount
KERNEL32.dll663QueryPerformanceCounter
KERNEL32.dll229FlushFileBuffers
KERNEL32.dll537InitializeCriticalSection
KERNEL32.dll543InterlockedExchange
KERNEL32.dll891VirtualQuery
KERNEL32.dll395GetOEMCP
KERNEL32.dll245GetACP
KERNEL32.dll448GetSystemTimeAsFileTime
KERNEL32.dll252GetCPInfo
KERNEL32.dll434GetStringTypeA
KERNEL32.dll619MultiByteToWideChar
KERNEL32.dll782SetFilePointer
KERNEL32.dll883VirtualAlloc
KERNEL32.dll528HeapReAlloc
KERNEL32.dll550IsBadCodePtr
KERNEL32.dll810SetStdHandle
KERNEL32.dll889VirtualProtect
KERNEL32.dll570LCMapStringA
KERNEL32.dll571LCMapStringW
KERNEL32.dll46CloseHandle
KERNEL32.dll375GetModuleHandleA
KERNEL32.dll443GetSystemInfo
KERNEL32.dll364GetLocaleInfoA
KERNEL32.dll507GlobalMemoryStatusEx
KERNEL32.dll827SetUnhandledExceptionFilter
KERNEL32.dll886VirtualFree
KERNEL32.dll522HeapDestroy
KERNEL32.dll350GetFileType
KERNEL32.dll706ResetEvent
KERNEL32.dll361GetLastError
KERNEL32.dll520HeapCreate
KERNEL32.dll791SetHandleCount
KERNEL32.dll335GetEnvironmentStringsW
KERNEL32.dll903WideCharToMultiByte
KERNEL32.dll238FreeEnvironmentStringsW
KERNEL32.dll333GetEnvironmentStrings
KERNEL32.dll237FreeEnvironmentStringsA
KERNEL32.dll864UnhandledExceptionFilter
KERNEL32.dll524HeapFree
KERNEL32.dll899WaitForSingleObject
KERNEL32.dll518HeapAlloc
KERNEL32.dll437GetStringTypeW
KERNEL32.dll175ExitProcess
KERNEL32.dll314GetCurrentProcess
KERNEL32.dll847TerminateProcess
KERNEL32.dll122DeleteCriticalSection
KERNEL32.dll583LeaveCriticalSection
KERNEL32.dll143EnterCriticalSection
KERNEL32.dll795SetLastError
KERNEL32.dll854TlsGetValue
KERNEL32.dll855TlsSetValue
KERNEL32.dll853TlsFree
KERNEL32.dll318GetCurrentThreadId
KERNEL32.dll852TlsAlloc
KERNEL32.dll546InterlockedIncrement
KERNEL32.dll584LoadLibraryA
KERNEL32.dll373GetModuleFileNameA
KERNEL32.dll431GetStartupInfoA
KERNEL32.dll264GetCommandLineA
KERNEL32.dll479GetVersionExA
KERNEL32.dll714RtlUnwind
KERNEL32.dll667RaiseException
KERNEL32.dll556IsBadWritePtr
KERNEL32.dll553IsBadReadPtr
KERNEL32.dll534HeapValidate
KERNEL32.dll115DebugBreak
KERNEL32.dll433GetStdHandle
KERNEL32.dll916WriteFile
KERNEL32.dll542InterlockedDecrement
KERNEL32.dll641OutputDebugStringA
KERNEL32.dll408GetProcAddress
USER32.dll150DestroyIcon
USER32.dll441LoadCursorA
USER32.dll349GetSystemMetrics
USER32.dll161DispatchMessageA
USER32.dll658ShowWindow
USER32.dll142DefWindowProcA
USER32.dll699UpdateWindow
USER32.dll198EndDialog
USER32.dll273GetDlgItem
USER32.dll96CreateWindowExA
USER32.dll478MessageBoxA
USER32.dll200EndPaint
USER32.dll153DestroyWindow
USER32.dll210EnumDisplayMonitors
USER32.dll634SetTimer
USER32.dll535RegisterClassExA
USER32.dll515PostQuitMessage
USER32.dll226FillRect
USER32.dll314GetMessageA
USER32.dll188DrawTextA
USER32.dll255GetClientRect
USER32.dll571SendMessageA
USER32.dll13BeginPaint
USER32.dll90CreateIconIndirect
USER32.dll282GetIconInfo
USER32.dll268GetDC
USER32.dll500OffsetRect
GDI32.dll572SetTextColor
GDI32.dll140DeleteDC
GDI32.dll58CreateFontIndirectA
GDI32.dll533SetBkColor
GDI32.dll534SetBkMode
GDI32.dll143DeleteObject
GDI32.dll526SelectObject
GDI32.dll45CreateCompatibleDC
GDI32.dll44CreateCompatibleBitmap
GDI32.dll541SetDCPenColor
GDI32.dll565SetROP2
GDI32.dll405GetObjectA
GDI32.dll421GetStockObject
GDI32.dll80CreateSolidBrush
GDI32.dll18BitBlt
ADVAPI32.dll126CredWriteDomainCredentialsA
ADVAPI32.dll123CredUnmarshalCredentialA
ADVAPI32.dll118CredReadDomainCredentialsA
SHELL32.dll4
ole32.dll99CoTaskMemAlloc
ole32.dll104CoUninitialize
ole32.dll100CoTaskMemFree
ole32.dll58CoInitialize
AVIFIL32.dll14AVIFileInit
AVIFIL32.dll9AVIFileExit
AVIFIL32.dll47AVIStreamOpenFromFileA
AVIFIL32.dll43AVIStreamInfoA
WINMM.dll166waveInAddBuffer
WINMM.dll179waveInStart
WINMM.dll177waveInPrepareHeader
SHLWAPI.dll229StrFormatByteSizeA
TRAFFIC.dll6TcEnumerateFlows
TAPI32.dll277tapiRequestMediaCallW
TAPI32.dll29lineAccept
ordentry_vafunction_name
10x10b1Take
module_nametrain.exe
flags0
timestamp2017-05-30 07:58:50
version0.0
ordinal_base1
nFunctions1
nNames1
Names(1)0x2041c
Functions(1)0x20418
NameOrdinals(1)0x20420

StringTable 040904b0

PrivateBuild9.1.84.8
FileDescriptionWebring Fully Harvest Leaps Abroad
CompanyNameDoubleGIS Ltd.
LanguagesEnglish
LegalCopyright©. All rights reserved. DoubleGIS Ltd.
Assembly Version9.1.84.8
OriginalFilenameTerms Patterns.exe
FileVersion9.1.84.8
InternalNameTerms Patterns
ProductNameTerms Patterns
LegalTrademarks©. All rights reserved. DoubleGIS Ltd.
CommentsWebring Fully Harvest Leaps Abroad
ProductVersion9.1.84.8

VS_FIXEDFILEINFO

FileVersion9.1.84.8
ProductVersion9.1.84.8
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0487424EXE05/30/2017 07:58:50#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK