filenamedlimage11.php?ho=abtf
size89600 (0x15e00)
md51a51a510499fc850f093d5df95c5b337
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd0

Rich Header

lib idversiontimes used
1235072711
10105
001
131210221
148210221
145210221

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x51569395
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion9.0
SizeOfCode0xba00
SizeOfInitializedData0xa000
SizeOfUninitializedData0
AddressOfEntryPoint0xbc40
BaseOfCode0x1000
BaseOfData0xd000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x106000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000xb9320xba00R-X CODE
.data0xd0000x2da80x2e00RW- IDATA
.rdata30x100000x3e80x400R-- IDATA
.rdata20x110000x3e80x400R-- IDATA
.rsrc0x120000xf39c00x6a00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0xbfb80x78
RESOURCE0x120000x69c0
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x10000x1b8
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#12960
ICON#213840
ICON#311280
ICON#43040
ICON#57440
ICON#622160
ICON#742640
ICON#837520
ICON#996400
FONTDIRFONTDIR1640
FONT#112320
GROUP_ICON#2001320
VERSION#15480
MANIFEST#14070
module_namehintordfunction_name
KERNEL32.dll569GetStartupInfoA
KERNEL32.dll607GetThreadLocale
KERNEL32.dll629GetVersionExA
KERNEL32.dll630GetVersionExW
KERNEL32.dll640GetWindowsDirectoryA
KERNEL32.dll641GetWindowsDirectoryW
KERNEL32.dll669HeapAlloc
KERNEL32.dll673HeapFree
KERNEL32.dll676HeapReAlloc
KERNEL32.dll692InitializeCriticalSection
KERNEL32.dll701InterlockedExchange
KERNEL32.dll704InterlockedIncrement
KERNEL32.dll751LeaveCriticalSection
KERNEL32.dll761LocalAlloc
KERNEL32.dll765LocalFree
KERNEL32.dll787MoveFileExW
KERNEL32.dll794MultiByteToWideChar
KERNEL32.dll827OutputDebugStringW
KERNEL32.dll547GetProcessHeap
KERNEL32.dll887ReleaseMutex
KERNEL32.dll979SetEvent
KERNEL32.dll983SetFileAttributesA
KERNEL32.dll991SetFilePointer
KERNEL32.dll1004SetLastError
KERNEL32.dll1031SetThreadExecutionState
KERNEL32.dll1033SetThreadLocale
KERNEL32.dll1057Sleep
KERNEL32.dll1122WaitForMultipleObjects
KERNEL32.dll1146WideCharToMultiByte
KERNEL32.dll1165WriteFile
KERNEL32.dll1194lstrcmpW
KERNEL32.dll1199lstrcpyA
KERNEL32.dll1205lstrlenA
KERNEL32.dll1108VirtualAlloc
KERNEL32.dll756LoadLibraryW
KERNEL32.dll67CloseHandle
KERNEL32.dll502GetModuleHandleA
KERNEL32.dll501GetModuleFileNameW
KERNEL32.dll486GetLastError
KERNEL32.dll429GetCurrentThreadId
KERNEL32.dll376GetComputerNameW
KERNEL32.dll328FormatMessageW
KERNEL32.dll327FormatMessageA
KERNEL32.dll260ExitProcess
KERNEL32.dll217EnterCriticalSection
KERNEL32.dll192DeleteFileA
KERNEL32.dll190DeleteCriticalSection
KERNEL32.dll151CreateProcessW
KERNEL32.dll139CreateMutexA
KERNEL32.dll120CreateFileA
KERNEL32.dll114CreateEventA
KERNEL32.dll858RaiseException
USER32.dll504MessageBoxA
USER32.dll518MsgWaitForMultipleObjects
USER32.dll539PeekMessageA
USER32.dll542PostMessageA
USER32.dll588ReleaseDC
USER32.dll601SendDlgItemMessageA
USER32.dll606SendMessageA
USER32.dll630SetDlgItemTextA
USER32.dll633SetFocus
USER32.dll676SetWindowLongA
USER32.dll696ShowWindow
USER32.dll775wsprintfA
USER32.dll471LoadIconW
USER32.dll149DefWindowProcA
USER32.dll544PostQuitMessage
USER32.dll213EndPaint
USER32.dll269GetClientRect
USER32.dll14BeginPaint
USER32.dll503MessageBeep
USER32.dll483LoadStringA
USER32.dll442IsDlgButtonChecked
USER32.dll392GetWindowRect
USER32.dll385GetWindowLongA
USER32.dll367GetSystemMetrics
USER32.dll341GetParent
USER32.dll289GetDlgItemTextA
USER32.dll287GetDlgItem
USER32.dll282GetDC
USER32.dll209EnableWindow
USER32.dll168DispatchMessageA
USER32.dll63CheckRadioButton
USER32.dll60CheckDlgButton
USER32.dll48CharPrevA
USER32.dll45CharNextA
USER32.dll28CallWindowProcA
GDI32.dll482GetObjectA
GDI32.dll500GetStockObject
GDI32.dll560PlayEnhMetaFile
GDI32.dll442GetEnhMetaFileA
GDI32.dll206DeleteEnhMetaFile
GDI32.dll437GetDeviceCaps
GDI32.dll541LineTo
GDI32.dll545MoveToEx
GDI32.dll582Rectangle
GDI32.dll56CreateEnhMetaFileA
GDI32.dll208DeleteObject
GDI32.dll28CloseEnhMetaFile
GDI32.dll59CreateFontIndirectA
ADVAPI32.dll606RegOpenKeyW
ADVAPI32.dll616RegQueryValueExW
VERSION.dll2GetFileVersionInfoSizeA
VERSION.dll12VerQueryValueA
VERSION.dllGetFileVersionInfoA

StringTable 041904B0

CompanyNameКорпорация Майкрософт
FileDescriptionНапоминания Windows OOBE
FileVersion5.1.2600.5512 (xpsp.080413-2111)
InternalNameOOBEBALN.EXE

VS_FIXEDFILEINFO

FileVersion5.1.2600.5512
ProductVersion5.1.2600.5512
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
089600EXE03/30/2013 07:26:13#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK