filenameasddddd.ex_
size166400 (0x28a00)
md51b9f7d4c8a918cc8fb1cddadab9ee81b
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
149307298
1313072962
1323072953
126507271
1473072931
10705
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x56c5aecf
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0xea00
SizeOfInitializedData0x1ae00
SizeOfUninitializedData0
AddressOfEntryPoint0x69d8
BaseOfCode0x1000
BaseOfData0x10000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x2d000
SizeOfHeaders0x400
CheckSum0x2d15b
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000xe8360xea00R-X CODE
.rdata0x100000x47f80x4800R-- IDATA
.data0x150000x20980x1000RW- IDATA
.rsrc0x180000x137300x13800R-- IDATA
.reloc0x2c0000xbfa0xc00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x139e80xdc
RESOURCE0x180000x13730
EXCEPTION00
SECURITY00
BASERELOC0x2c0000x948
DEBUG0x11ec00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x100000x294
Delay_IAT00
CLR_Header00
typenamesizecp
BITMAP2178+1112480
BITMAP#2178379600
ICON#142640
ICON#224400
ICON#311280
ICON#4169360
ICON#517200
ICON#637520
ICON#796400
GROUP_ICONIDI_ICON3760
GROUP_ICONIDI_ICON4340
VERSION#17040
module_namehintordfunction_name
KERNEL32.dll354FreeLibrary
KERNEL32.dll82CloseHandle
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll533GetModuleHandleA
KERNEL32.dll504GetFullPathNameA
KERNEL32.dll1351lstrcpyA
KERNEL32.dll581GetProcAddress
KERNEL32.dll21AreFileApisANSI
KERNEL32.dll514GetLastError
KERNEL32.dll828LoadLibraryA
KERNEL32.dll531GetModuleFileNameA
KERNEL32.dll691GlobalAlloc
KERNEL32.dll155CreateMutexA
KERNEL32.dll1358lstrlenW
KERNEL32.dll485GetFileAttributesA
KERNEL32.dll747InterlockedDecrement
KERNEL32.dll610GetStartupInfoA
KERNEL32.dll164CreateProcessA
KERNEL32.dll1139SetLastError
KERNEL32.dll698GlobalFree
KERNEL32.dll2ActivateActCtx
KERNEL32.dll360GetACP
KERNEL32.dll567GetOEMCP
KERNEL32.dll840LocalFree
KERNEL32.dll1263VirtualProtect
KERNEL32.dll905OutputDebugStringA
KERNEL32.dll1357lstrlenA
KERNEL32.dll1354lstrcpynA
USER32.dll318GetKeyboardLayout
USER32.dll479IsWindowUnicode
USER32.dll480IsWindowVisible
USER32.dll294GetDlgCtrlID
USER32.dll714SetWindowTextA
USER32.dll659SetForegroundWindow
USER32.dll205DrawTextA
USER32.dll382GetSystemMetrics
USER32.dll475IsWindow
USER32.dll785UpdateWindow
USER32.dll631SendMessageA
USER32.dll301GetForegroundWindow
USER32.dll482IsZoomed
USER32.dll640SetCapture
USER32.dll412GetWindowRect
USER32.dll416GetWindowTextA
USER32.dll749TabbedTextOutA
USER32.dll576PtInRect
USER32.dll423GrayStringA
USER32.dll155DefWindowProcA
USER32.dll223EnumChildWindows
USER32.dll356GetParent
USER32.dll216EnableWindow
USER32.dll381GetSystemMenu
USER32.dll299GetDoubleClickTime
USER32.dll246FillRect
USER32.dll549OffsetRect
USER32.dll612ReleaseCapture
USER32.dll686SetRect
GDI32.dll8AngleArc
GDI32.dll2AddFontMemResourceEx
GDI32.dllAbortDoc
GDI32.dll606RectVisible
GDI32.dll564LPtoDP
GDI32.dll672SetRectRgn
GDI32.dll19BitBlt
GDI32.dll696TextOutA
GDI32.dll61CreateFontIndirectA
GDI32.dll164DPtoLP
GDI32.dll78CreatePolygonRgn
GDI32.dll536GetTextColor
GDI32.dll34CombineRgn
GDI32.dll599Polyline
GDI32.dll73CreatePalette
GDI32.dll79CreateRectRgn
GDI32.dll601PtInRegion
GDI32.dll507GetObjectA
GDI32.dll667SetPixel
GDI32.dll602PtVisible
GDI32.dll1AbortPath
ADVAPI32.dll427LsaFreeMemory
ADVAPI32.dll182CryptDestroyHash
ADVAPI32.dll413LsaClose
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll181CryptDeriveKey
ADVAPI32.dll608RegOpenKeyExA
ADVAPI32.dll583RegDeleteValueA
ADVAPI32.dll584RegDeleteValueW
ADVAPI32.dll186CryptEncrypt
ADVAPI32.dll593RegEnumValueA
ADVAPI32.dll176CryptAcquireContextA
ADVAPI32.dll445LsaOpenPolicy
ADVAPI32.dll263EqualSid
ADVAPI32.dll203CryptReleaseContext
ADVAPI32.dll594RegEnumValueW
ADVAPI32.dll568RegCreateKeyExA
ADVAPI32.dll288FreeSid
ADVAPI32.dll569RegCreateKeyExW
ADVAPI32.dll179CryptCreateHash
ADVAPI32.dll183CryptDestroyKey
ADVAPI32.dll180CryptDecrypt
ADVAPI32.dll638RegSetValueExW
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll384IsTextUnicode
ADVAPI32.dll621RegQueryValueExA
ADVAPI32.dll580RegDeleteKeyW
ADVAPI32.dll606RegOpenCurrentUser
ADVAPI32.dll592RegEnumKeyW
ADVAPI32.dll200CryptHashData
ADVAPI32.dll637RegSetValueExA
ADVAPI32.dll612RegOpenKeyW
SHELL32.dll286ShellExecuteA
SHELL32.dll213SHGetPathFromIDListA
SHELL32.dll207SHGetMalloc
SHELL32.dll182SHGetDesktopFolder
ole32.dll62CoInitialize
ole32.dll6CLSIDFromProgID
ole32.dll16CoCreateInstance
ole32.dll376StringFromCLSID
ole32.dll104CoTaskMemFree
ole32.dll108CoUninitialize
COMCTL32.dll146_TrackMouseEvent
COMCTL32.dll123InitCommonControlsEx
VERSION.dll3GetFileVersionInfoSizeA
VERSION.dllGetFileVersionInfoA
VERSION.dll13VerQueryValueA
oledlg.dll3OleUIBusyW
msvcrt.dll78_XcptFilter
msvcrt.dll59_CIcos
msvcrt.dll435_onexit
msvcrt.dll646calloc
msvcrt.dll389_mbscmp
msvcrt.dll152__set_app_type
msvcrt.dll314_initterm
msvcrt.dll542_vsnprintf
msvcrt.dll16public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

msvcrt.dll214_controlfp
msvcrt.dll82__CxxFrameHandler
msvcrt.dll52void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll154__setusermatherr
msvcrt.dll676free
msvcrt.dll128__p__commode
msvcrt.dll395_mbsicmp
msvcrt.dll109__getmainargs
msvcrt.dll501_strdup
msvcrt.dll133__p__fmode
msvcrt.dll477_setmbcp
msvcrt.dll237_except_handler3
msvcrt.dll494_splitpath
msvcrt.dll182_adjust_fdiv
msvcrt.dll71_CxxThrowException
msvcrt.dll655exit
msvcrt.dll246_exit
msvcrt.dll168_acmdln
msvcrt.dll106__dllonexit

StringTable 040904E4

CompanyNameInfo-ZIP
FileDescriptionInfo-2Ij 2ij for 1inme 2qnjole
FileVersion5.2
InternalName!2z
LegalCopyrightCopyright © Info-ZIP 1997 - 2008
OriginalFilenamem1c2.dll
ProductNameZip
ProductVersion5.5

VS_FIXEDFILEINFO

FileVersion5.0.5.0
ProductVersion5.0.6.0
StrucVersion0x10000
FileFlagsMask0
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
0166400EXE02/18/2016 11:45:19#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK