filenamezz.exe
size1704448 (0x1a0200)
md523ff7bc2a3c97d25e82a1a50e5be0c86
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xb8

Rich Header

lib idversiontimes used
2730390
616681
00373

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x3c4c456b
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion5.10
SizeOfCode0x15d200
SizeOfInitializedData0x49800
SizeOfUninitializedData0
AddressOfEntryPoint0x15dae0
BaseOfCode0x1000
BaseOfData0x15f000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x1aa000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++

Sections

namevavsizeraw sizeflags
.text0x10000x15d1120x15d200R-X CODE
.rdata0x15f0000x279be0x27a00R-- IDATA
.data0x1870000x1f1000x18600RW- IDATA
.rsrc0x1a70000x2b900x2c00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x18552c0xc8
RESOURCE0x1a70000x2b90
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x15f0000x470
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#17440
ICON#27440
ICON#313840
DIALOG#17020
DIALOG#28220
DIALOG#31900
DIALOG#59880
STRING#11580
STRING#32740
STRING#44520
STRING#58660
STRING#1315880
STRING#144500
GROUP_ICON#1007200
GROUP_ICON#1008200
GROUP_ICON#1009200
VERSION#17160
idlangstring
110TCP/IP Client Support
120NetBEUI Client Support
130Local Client Support
470An attempt to attach to the InterBase Configuration Service failed. Please verify that InterBase is installed correctly.
480Internal InterBase Service error: Get Config Service failed
620Internal InterBase Service error: Set Config Service failed
630You must be the System Database Administrator to modify the server configuration parameters
640Invalid administrator password
700REGCFG.DLL not found
710LaunchInstReg entrypoint not found in REGCFG.DLL
720The database cache must be at least 50 pages, and the client map must be at least 1024 bytes.
730The working set must be a positive number with the maximum not less than the minimum, or zero to use the operating system defaults.
740&Modify...
750&Reset
760InterBase SQL Server for Windows
770Local InterBase Server
780 User
790Unlimited Access
2000A device which is in use by InterBase is going to be removed. The InterBase server will have to be shotdown before the device can be removed.
2010Any uncommitted data will be lost. Choose OK when you are ready to shutdown the server, or Cancel to abort the removal of the device.
2020Note: The removal of this device may not be cancelable in which case another warning will follow.
2030connections active; Are you sure you want to exit?
2040The InterBase server failed to startup because a needed resource is in use. Insure that all previously connected InterBase client applications have terminated and try again.
2050Error registering main window class
2060The InterBase license file is missing or corrupt. Check that InterBase is installed correctly.
2070InterBase remote server support is not licensed.
2080InterBase local server support is not licensed.
2090InterBase database support is not licensed.
2100P&roperties
2120&Shutdown
2130The InterBase Server failed to startup because another instance of the server is already running.
module_namehintordfunction_name
GDI32.dll250GetStockObject
GDI32.dll337SetBkMode
GDI32.dll64CreateSolidBrush
USER32.dll297GetSysColor
USER32.dll433PostMessageA
USER32.dll502SetForegroundWindow
USER32.dll144DispatchMessageA
USER32.dll84CreatePopupMenu
USER32.dll138DestroyWindow
USER32.dll277GetMessageA
USER32.dll581TranslateMessage
USER32.dll474SendMessageA
USER32.dll85CreateWindowExA
USER32.dll39CharToOemA
USER32.dll30CharLowerBuffA
USER32.dll180EndDialog
USER32.dll314GetWindowLongA
USER32.dll142DialogBoxParamA
USER32.dll244GetDlgItemInt
USER32.dll178EnableWindow
USER32.dll497SetDlgItemInt
USER32.dll542SetWindowPos
USER32.dll285GetParent
USER32.dll243GetDlgItem
USER32.dll472SendDlgItemMessageA
USER32.dll492SetCursor
USER32.dll498SetDlgItemTextA
USER32.dll606WinHelpA
USER32.dll539SetWindowLongA
USER32.dll136DestroyIcon
USER32.dll557ShowWindow
USER32.dll299GetSystemMenu
USER32.dll593UpdateWindow
USER32.dll4AppendMenuA
USER32.dll509SetMenuDefaultItem
USER32.dll237GetCursorPos
USER32.dll575TrackPopupMenu
USER32.dll137DestroyMenu
USER32.dll435PostQuitMessage
USER32.dll376LoadImageA
USER32.dll205FindWindowA
USER32.dll131DeleteMenu
USER32.dll128DefWindowProcA
USER32.dll501SetFocus
USER32.dll370LoadCursorA
USER32.dll446RegisterClassA
USER32.dll387LoadStringA
USER32.dll405MessageBoxA
USER32.dll374LoadIconA
MSVCRT.dll387_onexit
MSVCRT.dll85__dllonexit
MSVCRT.dll180_controlfp
MSVCRT.dll603free
MSVCRT.dll729vsprintf
MSVCRT.dll128__set_app_type
MSVCRT.dll239_fullpath
MSVCRT.dll268_initterm
MSVCRT.dll88__getmainargs
MSVCRT.dll141_acmdln
MSVCRT.dll72_XcptFilter
MSVCRT.dll208_exit
MSVCRT.dll614getchar
MSVCRT.dll676realloc
MSVCRT.dll130__setusermatherr
MSVCRT.dll155_adjust_fdiv
MSVCRT.dll650localtime
MSVCRT.dll238_ftol
MSVCRT.dll438_splitpath
MSVCRT.dll700strncat
MSVCRT.dll273_isatty
MSVCRT.dll708strtok
MSVCRT.dll140_access
MSVCRT.dll668putc
MSVCRT.dll607fseek
MSVCRT.dll609ftell
MSVCRT.dll105__p__commode
MSVCRT.dll110__p__fmode
MSVCRT.dll703strpbrk
MSVCRT.dll589fgetc
MSVCRT.dll714system
MSVCRT.dll570atoi
MSVCRT.dll446_stricmp
MSVCRT.dll197_errno
MSVCRT.dll272_iob
MSVCRT.dll599fputs
MSVCRT.dll598fputc
MSVCRT.dll588fflush
MSVCRT.dll615getenv
MSVCRT.dll596fopen
MSVCRT.dll579ctime
MSVCRT.dll597fprintf
MSVCRT.dll726vfprintf
MSVCRT.dll585fclose
MSVCRT.dll459_sys_nerr
MSVCRT.dll458_sys_errlist
MSVCRT.dll692strchr
MSVCRT.dll654malloc
MSVCRT.dll661memmove
MSVCRT.dll717time
MSVCRT.dll702strncpy
MSVCRT.dll653longjmp
MSVCRT.dll421_setjmp3
MSVCRT.dll667printf
MSVCRT.dll582exit
MSVCRT.dll704strrchr
MSVCRT.dll687sprintf
MSVCRT.dll416_seh_longjmp_unwind
MSVCRT.dll199_except_handler3
MSVCRT.dll613getc
MSVCRT.dll389_open_osfhandle
MSVCRT.dll684signal
MSVCRT.dll164_beginthreadex
MSVCRT.dll561abort
MSVCRT.dll701strncmp
MSVCRT.dll690sscanf
MSVCRT.dll96__mb_cur_max
MSVCRT.dll274_isctype
MSVCRT.dll395_pctype
MSVCRT.dll571atol
MSVCRT.dll591fgets
MSVCRT.dll721toupper
MSVCRT.dll624isdigit
MSVCRT.dll219_fileno
MSVCRT.dll384_mktemp
MSVCRT.dll254_getpid
MSVCRT.dll246_getcwd
MSVCRT.dll532_write
MSVCRT.dll439_stat
MSVCRT.dll450_strnicmp
MSVCRT.dll191_dup2
MSVCRT.dll472_umask
MSVCRT.dll305_itoa
MSVCRT.dll474_unlink
MSVCRT.dll388_open
MSVCRT.dll321_lseek
MSVCRT.dll405_read
MSVCRT.dll176_close
COMCTL32.dll59PropertySheetA
COMCTL32.dll2CreatePropertySheetPageA
WSOCK32.dll4
WSOCK32.dll8
WSOCK32.dll55
WSOCK32.dll13
WSOCK32.dll3
WSOCK32.dll1
WSOCK32.dll21
WSOCK32.dll2
WSOCK32.dll7
WSOCK32.dll23
WSOCK32.dll111
WSOCK32.dll52
WSOCK32.dll57
WSOCK32.dll115
WSOCK32.dll22
WSOCK32.dll116
WSOCK32.dll151
WSOCK32.dll18
WSOCK32.dll16
WSOCK32.dll19
WSOCK32.dll20
WSOCK32.dll9
WSOCK32.dll17
WSOCK32.dll14
WSOCK32.dll6
ADVAPI32.dll159GetUserNameA
ADVAPI32.dll359StartServiceCtrlDispatcherA
ADVAPI32.dll328RegisterServiceCtrlHandlerA
ADVAPI32.dll76DeregisterEventSource
ADVAPI32.dll332ReportEventA
ADVAPI32.dll326RegisterEventSourceA
ADVAPI32.dll355SetServiceStatus
ADVAPI32.dll36CloseServiceHandle
ADVAPI32.dll270QueryServiceConfigA
ADVAPI32.dll263OpenServiceA
ADVAPI32.dll261OpenSCManagerA
ADVAPI32.dll334RevertToSelf
ADVAPI32.dll167ImpersonateNamedPipeClient
ADVAPI32.dll279RegCloseKey
ADVAPI32.dll310RegQueryValueExA
ADVAPI32.dll302RegOpenKeyExA
ADVAPI32.dll348SetSecurityDescriptorDacl
ADVAPI32.dll170InitializeSecurityDescriptor
ADVAPI32.dll107FreeSid
ADVAPI32.dll105EqualSid
ADVAPI32.dll11AllocateAndInitializeSid
ADVAPI32.dll154GetTokenInformation
ADVAPI32.dll260OpenProcessToken
ADVAPI32.dll265OpenThreadToken
MPR.dll16WNetCloseEnum
MPR.dll58WNetGetUniversalNameA
MPR.dll63WNetOpenEnumA
MPR.dll27WNetEnumResourceA
SHELL32.dll104Shell_NotifyIconA
KERNEL32.dll399LeaveCriticalSection
KERNEL32.dll377InitializeCriticalSection
KERNEL32.dll76DeleteCriticalSection
KERNEL32.dll585TlsFree
KERNEL32.dll586TlsGetValue
KERNEL32.dll214GetCurrentThreadId
KERNEL32.dll387IsBadReadPtr
KERNEL32.dll577SuspendThread
KERNEL32.dll552SetProcessWorkingSetSize
KERNEL32.dll174GetComputerNameA
KERNEL32.dll317GetTempPathA
KERNEL32.dll606VirtualFree
KERNEL32.dll603VirtualAlloc
KERNEL32.dll330GetUserDefaultLangID
KERNEL32.dll147FormatMessageA
KERNEL32.dll478ReleaseSemaphore
KERNEL32.dll616WaitForMultipleObjects
KERNEL32.dll50CreateFileMappingA
KERNEL32.dll420MapViewOfFile
KERNEL32.dll587TlsSetValue
KERNEL32.dll88EnterCriticalSection
KERNEL32.dll528SetEndOfFile
KERNEL32.dll537SetFilePointer
KERNEL32.dll144FlushViewOfFile
KERNEL32.dll237GetFileSize
KERNEL32.dll56CreateMutexA
KERNEL32.dll157GetACP
KERNEL32.dll186GetConsoleCP
KERNEL32.dll78DeleteFileA
KERNEL32.dll558SetTapePosition
KERNEL32.dll223GetDriveTypeA
KERNEL32.dll294GetShortPathNameA
KERNEL32.dll236GetFileInformationByHandle
KERNEL32.dll152FreeLibrary
KERNEL32.dll278GetProcAddress
KERNEL32.dll400LoadLibraryA
KERNEL32.dll312GetTapeParameters
KERNEL32.dll422MoveFileA
KERNEL32.dll254GetModuleHandleA
KERNEL32.dll296GetStartupInfoA
KERNEL32.dll584TlsAlloc
KERNEL32.dll482ResumeThread
KERNEL32.dll563SetThreadPriority
KERNEL32.dll481ResetEvent
KERNEL32.dll429OpenEventA
KERNEL32.dll209GetCurrentDirectoryA
KERNEL32.dll244GetLastError
KERNEL32.dll49CreateFileA
KERNEL32.dll82DisconnectNamedPipe
KERNEL32.dll333GetVersionExA
KERNEL32.dll211GetCurrentProcess
KERNEL32.dll267GetPriorityClass
KERNEL32.dll548SetPriorityClass
KERNEL32.dll212GetCurrentProcessId
KERNEL32.dll667lstrcpyA
KERNEL32.dll658lstrcatA
KERNEL32.dll85DuplicateHandle
KERNEL32.dll213GetCurrentThread
KERNEL32.dll170GetCommandLineA
KERNEL32.dll67CreateThread
KERNEL32.dll24CloseHandle
KERNEL32.dll46CreateEventA
KERNEL32.dll532SetEvent
KERNEL32.dll252GetModuleFileNameA
KERNEL32.dll618WaitForSingleObject
KERNEL32.dll531SetErrorMode
KERNEL32.dll434OpenMutexA
KERNEL32.dll477ReleaseMutex
KERNEL32.dll575Sleep
KERNEL32.dll61CreateProcessA
KERNEL32.dll595UnmapViewOfFile
KERNEL32.dll576SleepEx
KERNEL32.dll32ConnectNamedPipe
KERNEL32.dll58CreateNamedPipeA
KERNEL32.dll620WaitNamedPipeA
KERNEL32.dll142FlushFileBuffers
KERNEL32.dll470ReadFile
KERNEL32.dll635WriteFile
KERNEL32.dll583TerminateThread
KERNEL32.dll108ExitThread
KERNEL32.dll64CreateSemaphoreA
KERNEL32.dll436OpenProcess

StringTable 040904E4

CompanyNameInprise Corporation
FileDescriptionInterBase Server
FileVersionWI-O6.0.2.0
InternalNameIBSERVER60
LegalCopyrightCopyright (c) 1999 Inprise Corporation
ProductNameInterBase Server
ProductVersion6.0.2.0

VS_FIXEDFILEINFO

FileVersion6.0.2.0
ProductVersion6.0.2.0
StrucVersion0x10000
FileFlagsMask2
FileFlags0x22
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
01704448EXE01/21/2002 16:44:27#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK