3.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	3.exe
size	35328 (0x8a00)
md5	19929e0a05cfe4b8d99690476db6cc26

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

Rich Header

lib id	version	times used
257	26706	3
261	26706	23
260	26706	13
257	26213	4
1	0	67
260	27031	1
255	27031	1
258	27031	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	7
TimeDateStamp	0x5cea71f4
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x103
Magic	0x10b
LinkerVersion	14.16
SizeOfCode	0x4c00
SizeOfInitializedData	0x3e00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x11f4
BaseOfCode	0x1000
BaseOfData	0x6000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0xe000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8000
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

Free Pascal v1.06

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x4b24	0x4c00	R-X CODE
.rdata	0x6000	0x2129	0x2200	R-- IDATA
.data	0x9000	0x5c0	0x200	RW- IDATA
.idata	0xa000	0xaa8	0xc00	R-- IDATA
.msvcjmc	0xb000	0x113	0x200	RW- IDATA
.00cfg	0xc000	0x104	0x200	R-- IDATA
.rsrc	0xd000	0x43c	0x600	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xa1c0	0x50
RESOURCE	0xd000	0x43c
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0x74e0	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x7518	0x40
Bound_IAT	0	0
IAT	0xa000	0x1c0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
MANIFEST	#1	381	0

module_name	hint	function_name
VCRUNTIME140D.dll	46	__vcrt_GetModuleFileNameW
VCRUNTIME140D.dll	53	_except_handler4_common
VCRUNTIME140D.dll	72	memset
VCRUNTIME140D.dll	47	__vcrt_GetModuleHandleW
VCRUNTIME140D.dll	49	__vcrt_LoadLibraryExW
VCRUNTIME140D.dll	37	__std_type_info_destroy_list
ucrtbased.dll	750	_seh_filter_dll
ucrtbased.dll	407	_initialize_onexit_table
ucrtbased.dll	738	_register_onexit_function
ucrtbased.dll	268	_execute_onexit_table
ucrtbased.dll	762	_set_new_mode
ucrtbased.dll	231	_crt_at_quick_exit
ucrtbased.dll	224	_controlfp_s
ucrtbased.dll	1382	terminate
ucrtbased.dll	1353	strcpy_s
ucrtbased.dll	1349	strcat_s
ucrtbased.dll	142	__stdio_common_vsprintf_s
ucrtbased.dll	969	_wmakepath_s
ucrtbased.dll	997	_wsplitpath_s
ucrtbased.dll	1407	wcscpy_s
ucrtbased.dll	115	__p__commode
ucrtbased.dll	219	_configthreadlocale
ucrtbased.dll	739	_register_thread_local_exe_atexit_callback
ucrtbased.dll	197	_c_exit
ucrtbased.dll	202	_cexit
ucrtbased.dll	112	__p___argv
ucrtbased.dll	111	__p___argc
ucrtbased.dll	759	_set_fmode
ucrtbased.dll	273	_exit
ucrtbased.dll	1142	exit
ucrtbased.dll	410	_initterm_e
ucrtbased.dll	409	_initterm
ucrtbased.dll	354	_get_initial_narrow_environment
ucrtbased.dll	406	_initialize_narrow_environment
ucrtbased.dll	220	_configure_narrow_argv
ucrtbased.dll	129	__setusermatherr
ucrtbased.dll	754	_set_app_type
ucrtbased.dll	751	_seh_filter_exe
ucrtbased.dll	21	_CrtDbgReportW
ucrtbased.dll	20	_CrtDbgReport
ucrtbased.dll	1352	strcpy
ucrtbased.dll	130	__stdio_common_vfprintf
ucrtbased.dll	69	__acrt_iob_func
ucrtbased.dll	232	_crt_atexit
KERNEL32.dll	609	GetLastError
KERNEL32.dll	1101	QueryPerformanceCounter
KERNEL32.dll	536	GetCurrentProcessId
KERNEL32.dll	745	GetSystemTimeAsFileTime
KERNEL32.dll	867	InitializeSListHead
KERNEL32.dll	895	IsDebuggerPresent
KERNEL32.dll	1420	TerminateProcess
KERNEL32.dll	535	GetCurrentProcess
KERNEL32.dll	686	GetProcAddress
KERNEL32.dll	427	FreeLibrary
KERNEL32.dll	1486	VirtualQuery
KERNEL32.dll	692	GetProcessHeap
KERNEL32.dll	841	HeapFree
KERNEL32.dll	837	HeapAlloc
KERNEL32.dll	540	GetCurrentThreadId
KERNEL32.dll	1534	WideCharToMultiByte
KERNEL32.dll	1007	MultiByteToWideChar
KERNEL32.dll	1122	RaiseException
KERNEL32.dll	632	GetModuleHandleW
KERNEL32.dll	902	IsProcessorFeaturePresent
KERNEL32.dll	720	GetStartupInfoW
KERNEL32.dll	1389	SetUnhandledExceptionFilter
KERNEL32.dll	1453	UnhandledExceptionFilter

show previews

offset	size	type	comment
0	35328	EXE	05/26/2019 11:01:08	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK