filenamemstsc.exe
size677888 (0xa5800)
md516fee292e95edc274385103e6b498019
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
1255072714
1095072797
1235072741
10457
1105072798
126507271
124507271
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4d0b6b7a
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion8.0
SizeOfCode0x51600
SizeOfInitializedData0x55000
SizeOfUninitializedData0
AddressOfEntryPoint0x3564e
BaseOfCode0x1000
BaseOfData0x53000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion6.0
SubsystemVersion5.1
Reserved10
SizeOfImage0xa9000
SizeOfHeaders0x400
CheckSum0xb181e
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x40000
SizeOfStackCommit0x8000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x5144a0x51600R-X CODE
.data0x530000x259c0x1400RW- IDATA
.rsrc0x560000x4ce700x4d000R-- IDATA
.reloc0xa30000x581e0x5a00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x5035c0x17c
RESOURCE0x560000x4ce70
EXCEPTION00
SECURITY00
BASERELOC0xa30000x4464
DEBUG0x18000x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x13f400x40
Bound_IAT00
IAT0x10000x618
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12400
BITMAP#620102800
BITMAP#62193560
BITMAP#62293040
BITMAP#62347120
BITMAP#62561200
BITMAP#62631040
BITMAP#627102800
BITMAP#67572300
BITMAP#67677980
BITMAP#677150020
BITMAP#67864260
BITMAP#67972300
BITMAP#680168780
ICON#116400
ICON#27440
ICON#32960
ICON#437520
ICON#522160
ICON#613840
ICON#7562090
ICON#896400
ICON#942640
ICON#1011280
ICON#112960
ICON#1213840
ICON#1311280
ICON#1413840
ICON#1511280
ICON#167440
ICON#1722160
ICON#1842640
ICON#197440
ICON#2022160
ICON#2142640
ICON#227440
ICON#2322160
ICON#2442640
ICON#257440
ICON#2622160
ICON#2742640
ICON#287440
ICON#2922160
ICON#3042640
ICON#317440
ICON#3222160
ICON#3342640
ICON#347440
ICON#3522160
ICON#3642640
ICON#377440
ICON#3822160
ICON#3942640
ICON#402960
ICON#4113840
ICON#427440
ICON#4322160
ICON#4411280
ICON#4542640
ICON#467440
ICON#472960
ICON#4822160
ICON#4913840
ICON#5042640
ICON#5111280
ICON#527440
ICON#5322160
ICON#5442640
ICON#557440
ICON#5622160
ICON#5742640
ICON#587440
ICON#5922160
ICON#6042640
ICON#617440
ICON#6222160
ICON#6342640
GROUP_ICON#1011460
GROUP_ICON#380480
GROUP_ICON#381340
GROUP_ICON#13000480
GROUP_ICON#13001480
GROUP_ICON#13002480
GROUP_ICON#13003480
GROUP_ICON#13004480
GROUP_ICON#13005480
GROUP_ICON#13006480
GROUP_ICON#13007900
GROUP_ICON#13008900
GROUP_ICON#13009480
GROUP_ICON#13010480
GROUP_ICON#13011480
GROUP_ICON#13012480
GROUP_ICON#14026480
VERSION#19200
MANIFEST#19420
module_namehintordfunction_name
ADVAPI32.dll752TraceMessage
ADVAPI32.dll554RegCloseKey
ADVAPI32.dll603RegOpenKeyExW
ADVAPI32.dll616RegQueryValueExW
ADVAPI32.dll578RegDeleteValueW
ADVAPI32.dll588RegEnumValueW
ADVAPI32.dll585RegEnumKeyExW
ADVAPI32.dll341GetTraceEnableFlags
ADVAPI32.dll342GetTraceEnableLevel
ADVAPI32.dll343GetTraceLoggerHandle
ADVAPI32.dll644RegisterTraceGuidsW
ADVAPI32.dll763UnregisterTraceGuids
ADVAPI32.dll631RegSetValueExA
ADVAPI32.dll165CredWriteW
ADVAPI32.dll154CredReadW
ADVAPI32.dll350GetUserNameA
ADVAPI32.dll130CredDeleteW
ADVAPI32.dll136CredFree
ADVAPI32.dll153CredReadDomainCredentialsW
ADVAPI32.dll164CredWriteDomainCredentialsW
ADVAPI32.dll615RegQueryValueExA
ADVAPI32.dll602RegOpenKeyExA
ADVAPI32.dll159CredUnmarshalCredentialW
ADVAPI32.dll632RegSetValueExW
ADVAPI32.dll563RegCreateKeyExW
ADVAPI32.dll562RegCreateKeyExA
KERNEL32.dll878ReadFile
KERNEL32.dll469GetFileSize
KERNEL32.dll329FormatMessageW
KERNEL32.dll114CreateDirectoryW
KERNEL32.dll313FindResourceExW
KERNEL32.dll783MapViewOfFile
KERNEL32.dll125CreateFileMappingW
KERNEL32.dll703InterlockedCompareExchange
KERNEL32.dll491GetLocaleInfoW
KERNEL32.dll1100UnmapViewOfFile
KERNEL32.dll682HeapSetInformation
KERNEL32.dll265ExpandEnvironmentStringsW
KERNEL32.dll152CreateProcessW
KERNEL32.dll369GetCommandLineW
KERNEL32.dll1157WideCharToMultiByte
KERNEL32.dll460GetFileAttributesExW
KERNEL32.dll293FindFirstFileW
KERNEL32.dll305FindNextFileW
KERNEL32.dll282FindClose
KERNEL32.dll607GetTempPathW
KERNEL32.dll999SetFilePointer
KERNEL32.dll633GetVersion
KERNEL32.dll339GetACP
KERNEL32.dll118CreateEventW
KERNEL32.dll164CreateThread
KERNEL32.dll987SetEvent
KERNEL32.dll705InterlockedDecrement
KERNEL32.dll584GetSystemDefaultUILanguage
KERNEL32.dll629GetUserDefaultUILanguage
KERNEL32.dll1086TlsFree
KERNEL32.dll1085TlsAlloc
KERNEL32.dll927SearchPathW
KERNEL32.dll697InitializeCriticalSection
KERNEL32.dll314FindResourceW
KERNEL32.dll763LoadResource
KERNEL32.dll780LockResource
KERNEL32.dll1077SystemTimeToFileTime
KERNEL32.dll1176WriteFile
KERNEL32.dll1217lstrlenW
KERNEL32.dll593GetSystemTime
KERNEL32.dll1135WaitForSingleObject
KERNEL32.dll758LoadLibraryA
KERNEL32.dll264ExpandEnvironmentStringsA
KERNEL32.dll674HeapAlloc
KERNEL32.dll191DeleteCriticalSection
KERNEL32.dll550GetProcessHeap
KERNEL32.dll678HeapFree
KERNEL32.dll756LeaveCriticalSection
KERNEL32.dll218EnterCriticalSection
KERNEL32.dll203DeviceIoControl
KERNEL32.dll1118VerifyVersionInfoW
KERNEL32.dll760LoadLibraryExW
KERNEL32.dll502GetModuleFileNameW
KERNEL32.dll1097UnhandledExceptionFilter
KERNEL32.dll595GetSystemTimeAsFileTime
KERNEL32.dll427GetCurrentProcessId
KERNEL32.dll430GetCurrentThreadId
KERNEL32.dll618GetTickCount
KERNEL32.dll857QueryPerformanceCounter
KERNEL32.dll503GetModuleHandleA
KERNEL32.dll1056SetUnhandledExceptionFilter
KERNEL32.dll831OutputDebugStringA
KERNEL32.dll706InterlockedExchange
KERNEL32.dll333FreeLibrary
KERNEL32.dll761LoadLibraryW
KERNEL32.dll709InterlockedIncrement
KERNEL32.dll1208lstrcmpiW
KERNEL32.dll798MulDiv
KERNEL32.dll181DebugBreak
KERNEL32.dll426GetCurrentProcess
KERNEL32.dll1080TerminateProcess
KERNEL32.dll572GetStartupInfoA
KERNEL32.dll799MultiByteToWideChar
KERNEL32.dll546GetProcAddress
KERNEL32.dll634GetVersionExA
KERNEL32.dll1012SetLastError
KERNEL32.dll1068Sleep
KERNEL32.dll143CreateMutexW
KERNEL32.dll196DeleteFileW
KERNEL32.dll506GetModuleHandleW
KERNEL32.dll128CreateFileW
KERNEL32.dll68CloseHandle
KERNEL32.dll487GetLastError
KERNEL32.dll480GetFullPathNameW
KERNEL32.dll463GetFileAttributesW
KERNEL32.dll86CompareStringW
KERNEL32.dll766LocalAlloc
KERNEL32.dll770LocalFree
KERNEL32.dll425GetCurrentDirectoryW
KERNEL32.dll635GetVersionExW
GDI32.dll18BitBlt
GDI32.dll606SelectObject
GDI32.dll46CreateCompatibleDC
GDI32.dll62CreateFontIndirectW
GDI32.dll673TranslateCharsetInfo
GDI32.dll635SetMapMode
GDI32.dll614SetBkMode
GDI32.dll653SetTextColor
GDI32.dll666StretchBlt
GDI32.dll45CreateCompatibleBitmap
GDI32.dll484GetObjectW
GDI32.dll205DeleteDC
GDI32.dll676UpdateColors
GDI32.dll437GetDeviceCaps
GDI32.dll579RealizePalette
GDI32.dll280EqualRgn
GDI32.dll607SelectPalette
GDI32.dll71CreatePalette
GDI32.dll435GetDIBColorTable
GDI32.dll77CreateRectRgn
GDI32.dll78CreateRectRgnIndirect
GDI32.dll208DeleteObject
GDI32.dll647SetRectRgn
GDI32.dll433GetDCOrgEx
GDI32.dll426GetClipBox
GDI32.dll33CombineRgn
GDI32.dll500GetStockObject
USER32.dll696ShowWindow
USER32.dll445IsIconic
USER32.dll391GetWindowPlacement
USER32.dll243FindWindowW
USER32.dll610SendMessageTimeoutW
USER32.dll708SystemParametersInfoA
USER32.dll441IsDialogMessageW
USER32.dll634SetForegroundWindow
USER32.dll543PostMessageW
USER32.dll453IsWindow
USER32.dll611SendMessageW
USER32.dll684SetWindowTextW
USER32.dll207EnableMenuItem
USER32.dll2AdjustWindowRect
USER32.dll425IntersectRect
USER32.dll209EnableWindow
USER32.dll79CopyRect
USER32.dll236EqualRect
USER32.dll100CreateMenu
USER32.dll513ModifyMenuW
USER32.dll366GetSystemMenu
USER32.dll517MoveWindow
USER32.dll269GetClientRect
USER32.dll679SetWindowPos
USER32.dll460IsZoomed
USER32.dll469LoadCursorW
USER32.dll624SetCursor
USER32.dll10AppendMenuW
USER32.dll678SetWindowPlacement
USER32.dll735UnregisterClassW
USER32.dll262GetClassInfoExW
USER32.dll526OffsetRect
USER32.dll392GetWindowRect
USER32.dll471LoadIconW
USER32.dll367GetSystemMetrics
USER32.dll723TranslateAcceleratorW
USER32.dll437IsChild
USER32.dll544PostQuitMessage
USER32.dll160DestroyWindow
USER32.dll150DefWindowProcW
USER32.dll386GetWindowLongW
USER32.dll104CreateWindowExW
USER32.dll565RegisterClassExW
USER32.dll14BeginPaint
USER32.dll463LoadAcceleratorsW
USER32.dll166DialogBoxParamW
USER32.dll93CreateDialogParamW
USER32.dll461KillTimer
USER32.dll670SetTimer
USER32.dll709SystemParametersInfoW
USER32.dll263GetClassInfoW
USER32.dll143DefDlgProcW
USER32.dll566RegisterClassW
USER32.dll516MonitorFromWindow
USER32.dll336GetMonitorInfoW
USER32.dll484LoadStringW
USER32.dll633SetFocus
USER32.dll745UpdateWindow
USER32.dll426InvalidateRect
USER32.dll487LockWindowUpdate
USER32.dll458IsWindowVisible
USER32.dll287GetDlgItem
USER32.dll3AdjustWindowRectEx
USER32.dll284GetDesktopWindow
USER32.dll697ShowWindowAsync
USER32.dll316GetMenu
USER32.dll562RedrawWindow
USER32.dll454IsWindowEnabled
USER32.dll657SetRect
USER32.dll157DestroyIcon
USER32.dll473LoadImageW
USER32.dll334GetMessageW
USER32.dll725TranslateMessage
USER32.dll169DispatchMessageW
USER32.dll281GetCursorPos
USER32.dll596ScreenToClient
USER32.dll383GetWindowDC
USER32.dll192DrawIconEx
USER32.dll200DrawTextW
USER32.dll494MapDialogRect
USER32.dll381GetWindow
USER32.dll239FillRect
USER32.dll60CheckDlgButton
USER32.dll442IsDlgButtonChecked
USER32.dll602SendDlgItemMessageW
USER32.dll91CreateDialogIndirectParamW
USER32.dll290GetDlgItemTextW
USER32.dll499MapWindowPoints
USER32.dll588ReleaseDC
USER32.dll191DrawIcon
USER32.dll213EndPaint
USER32.dll211EndDialog
USER32.dll631SetDlgItemTextW
USER32.dll282GetDC
USER32.dll677SetWindowLongW
msvcrt.dll342_errno
msvcrt.dll1011_wcslwr
msvcrt.dll145__getmainargs
msvcrt.dll276_cexit
msvcrt.dll354_exit
msvcrt.dll106_XcptFilter
msvcrt.dll500_ismbblead
msvcrt.dll1167exit
msvcrt.dll1376wcsrchr
msvcrt.dll1294srand
msvcrt.dll1332time
msvcrt.dll1361wcschr
msvcrt.dll1234iswspace
msvcrt.dll1338toupper
msvcrt.dll1129_wtoi
msvcrt.dll1375wcspbrk
msvcrt.dll1339towlower
msvcrt.dll231_acmdln
msvcrt.dll469_initterm
msvcrt.dll257_amsg_exit
msvcrt.dll212__setusermatherr
msvcrt.dll245_adjust_fdiv
msvcrt.dll1229iswdigit
msvcrt.dll1133_wtol
msvcrt.dll41void * __cdecl operator new[](unsigned int)

??_U@YAPAXI@Z

msvcrt.dll1007_wcsicmp
msvcrt.dll1382wcstok
msvcrt.dll1017_wcsnicmp
msvcrt.dll1340towupper
msvcrt.dll968_vsnprintf
msvcrt.dll1190free
msvcrt.dll185__p__commode
msvcrt.dll190__p__fmode
msvcrt.dll210__set_app_type
msvcrt.dll934_unlock
msvcrt.dll141__dllonexit
msvcrt.dll578_lock
msvcrt.dll747_onexit
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll295_controlfp
msvcrt.dll1157calloc
msvcrt.dll1154bsearch
msvcrt.dll1341ungetc
msvcrt.dll367_fileno
msvcrt.dll772_read
msvcrt.dll207__pioinfo
msvcrt.dll133__badioinfo
msvcrt.dll1279realloc
msvcrt.dll1385wcstombs
msvcrt.dll1216isdigit
msvcrt.dll1371wcsncmp
msvcrt.dll1380wcsstr
msvcrt.dll1260memmove
msvcrt.dll974_vsnwprintf
msvcrt.dll1262memset
msvcrt.dll1258memcpy
msvcrt.dll764_purecall
msvcrt.dll1246malloc
msvcrt.dll1390wctomb
msvcrt.dll43void __cdecl operator delete[](void *)

??_V@YAXPAX@Z

msvcrt.dll1241localeconv
msvcrt.dll1237isxdigit
msvcrt.dll1218isleadbyte
msvcrt.dll176__mb_cur_max
msvcrt.dll1255mbtowc
msvcrt.dll1228iswctype
ole32.dll16CoCreateInstance
ole32.dll107CoUninitialize
ole32.dll103CoTaskMemFree
ole32.dll102CoTaskMemAlloc
ole32.dll61CoInitialize
OLEAUT32.dll4
OLEAUT32.dll150
OLEAUT32.dll8
OLEAUT32.dll9
OLEAUT32.dll7
OLEAUT32.dll2
OLEAUT32.dll6
SHELL32.dll201SHGetMalloc
SHELL32.dll209SHGetPathFromIDListW
SHELL32.dll216SHGetSpecialFolderLocation
SHELL32.dll179SHGetDesktopFolder
SHELL32.dll44ExtractIconW
COMCTL32.dll110ImageList_ReplaceIcon
COMCTL32.dll99ImageList_GetImageCount
COMCTL32.dll122InitCommonControlsEx
COMCTL32.dll83ImageList_Create
COMCTL32.dll17
COMDLG32.dll14GetSaveFileNameW
COMDLG32.dll12GetOpenFileNameW
COMDLG32.dll10GetFileTitleW
SHLWAPI.dll73PathFindFileNameW
SHLWAPI.dll139PathRemoveFileSpecW
SHLWAPI.dll71PathFindExtensionW
SHLWAPI.dll52PathAppendW
SHLWAPI.dll388
CRYPT32.dll63CertFreeCertificateContext
CRYPT32.dll61CertFreeCertificateChain
CRYPT32.dll123CryptBinaryToStringW
CRYPT32.dll213CryptStringToBinaryW
CRYPT32.dll37CertDuplicateCertificateContext
CRYPT32.dll36CertDuplicateCertificateChain
CRYPT32.dll69CertGetCertificateContextProperty
CRYPT32.dll114CertVerifyCertificateChainPolicy
CRYPT32.dll172CryptMsgClose
CRYPT32.dll86CertOpenStore
CRYPT32.dll183CryptMsgUpdate
CRYPT32.dll180CryptMsgOpenToDecode
CRYPT32.dll210CryptSignMessage
CRYPT32.dll18CertCloseStore
CRYPT32.dll224CryptVerifyDetachedMessageSignature
CRYPT32.dll128CryptDecodeObject
CRYPT32.dll55CertFindExtension
CRYPT32.dll68CertGetCertificateChain
CRYPT32.dll70CertGetEnhancedKeyUsage
credui.dll10CredUIPromptForCredentialsW
credui.dll8CredUIParseUserNameW
CRYPTUI.dll16CryptUIDlgViewCertificateW
ntdll.dll882RtlInitializeCriticalSection
ntdll.dll331NtOpenFile
ntdll.dll876RtlInitUnicodeString
ntdll.dll1282VerSetConditionMask
ntdll.dll1163RtlUnwind
WINHTTP.dll8WinHttpCloseHandle
WINHTTP.dll16WinHttpOpen
WINHTTP.dll9WinHttpConnect
WINHTTP.dll17WinHttpOpenRequest
WINHTTP.dll24WinHttpSendRequest
WINHTTP.dll21WinHttpQueryOption
Secur32.dll57QuerySecurityPackageInfoW
Secur32.dll24FreeContextBuffer
Secur32.dll30GetUserNameExW
NETAPI32.dll163NetGetJoinInformation
NETAPI32.dll113NetApiBufferFree

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionRemote Desktop Connection
FileVersion6.0.6002.18356 (vistasp2_gdr.101217-0236)
InternalNamemstsc.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamemstsc.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.0.6002.18356

VS_FIXEDFILEINFO

FileVersion6.0.6002.18356
ProductVersion6.0.6002.18356
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0677888EXE12/17/2010 13:54:02#
15c115HTM#
56f2856209PNG(256 x 256)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER