filenameBubbles (1).scr
size778752 (0xbe200)
md524649ef11310bccf0bb3b1260da6b547
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
207655012
2066550121
205655015
2036550119
10224
2116550171
201655011
204655011

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x54504666
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion11.0
SizeOfCode0x12200
SizeOfInitializedData0xae400
SizeOfUninitializedData0
AddressOfEntryPoint0x12460
BaseOfCode0x1000
BaseOfData0x14000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.3
ImageVersion6.3
SubsystemVersion6.3
Reserved10
SizeOfImage0xc3000
SizeOfHeaders0x400
CheckSum0xc3be0
Subsystem2
DllCharacteristics0xc140
SizeOfStackReserve0x61a80
SizeOfStackCommit0x9000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0 2005

Sections

namevavsizeraw sizeflags
.text0x10000x120040x12200R-X CODE
.data0x140000x38e40x1200RW- IDATA
.idata0x180000xd680xe00R-- IDATA
.rsrc0x190000xa8d800xa8e00R-- IDATA
.reloc0xc20000xd240xe00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x182280xc8
RESOURCE0x190000xa8d80
EXCEPTION00
SECURITY00
BASERELOC0xc20000xd24
DEBUG0x13200x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x22000x5c
Bound_IAT00
IAT0x180000x224
Delay_IAT00
CLR_Header00
typenamesizecp
BMP#1171542620
BMP#1181299820
BMP#119926680
BMP#120483420
BMP#1212621880
MUI#12240
ICON#13040
ICON#27440
GROUP_ICON#101340
VERSION#19000
MANIFEST#112060
module_namehintordfunction_name
ADVAPI32.dll645RegOpenKeyExW
ADVAPI32.dll658RegQueryValueExW
ADVAPI32.dll596RegCloseKey
ADVAPI32.dll605RegCreateKeyExW
ADVAPI32.dll644RegOpenKeyExA
ADVAPI32.dll657RegQueryValueExA
KERNEL32.dll754GetTickCount
KERNEL32.dll1070QueryPerformanceFrequency
KERNEL32.dll976MulDiv
KERNEL32.dll457GetCommandLineW
KERNEL32.dll615GetModuleHandleW
KERNEL32.dll701GetStartupInfoA
KERNEL32.dll1347SetUnhandledExceptionFilter
KERNEL32.dll612GetModuleHandleA
KERNEL32.dll1069QueryPerformanceCounter
KERNEL32.dll522GetCurrentProcessId
KERNEL32.dll526GetCurrentThreadId
KERNEL32.dll726GetSystemTimeAsFileTime
KERNEL32.dll1410UnhandledExceptionFilter
KERNEL32.dll521GetCurrentProcess
KERNEL32.dll1377TerminateProcess
KERNEL32.dll772GetVersionExA
KERNEL32.dll877IsProcessorFeaturePresent
KERNEL32.dll669GetProcAddress
KERNEL32.dll1017OutputDebugStringA
KERNEL32.dll977MultiByteToWideChar
KERNEL32.dll393FindResourceW
KERNEL32.dll1361SizeofResource
KERNEL32.dll939LoadResource
KERNEL32.dll957LockResource
KERNEL32.dll839InitializeCriticalSection
KERNEL32.dll261DeleteCriticalSection
KERNEL32.dll1362Sleep
GDI32.dll19BitBlt
GDI32.dll271DeleteObject
GDI32.dll268DeleteDC
GDI32.dll569GetStockObject
GDI32.dll502GetDIBits
GDI32.dll772SetTextColor
GDI32.dll732SetBkColor
GDI32.dll725SelectObject
GDI32.dll41CreateBitmap
GDI32.dll49CreateCompatibleDC
GDI32.dll503GetDeviceCaps
GDI32.dll66CreateFontW
GDI32.dll346ExcludeClipRect
USER32.dll214DrawTextW
USER32.dll755SetRect
USER32.dll855UpdateWindow
USER32.dll495InvalidateRect
USER32.dll685ScreenToClient
USER32.dll836UnionRect
USER32.dll783SetWindowPos
USER32.dll161DefWindowProcW
USER32.dll233EndPaint
USER32.dll261FillRect
USER32.dll14BeginPaint
USER32.dll713SetCursor
USER32.dll537KillTimer
USER32.dll769SetTimer
USER32.dll620PeekMessageW
USER32.dll815SystemParametersInfoW
USER32.dll308GetDC
USER32.dll243EnumDisplayMonitors
USER32.dll605OffsetRect
USER32.dll494IntersectRect
USER32.dll560LoadStringW
USER32.dll589MessageBoxW
USER32.dll625PostQuitMessage
USER32.dll426GetSystemMetrics
USER32.dll814SystemParametersInfoA
USER32.dll756SetRectEmpty
USER32.dll624PostMessageW
USER32.dll371GetMessageW
USER32.dll113CreateWindowExW
USER32.dll831TranslateMessage
USER32.dll181DispatchMessageW
USER32.dll247EnumDisplaySettingsW
USER32.dll545LoadCursorW
USER32.dll547LoadIconW
USER32.dll650RegisterClassW
USER32.dll293GetClientRect
USER32.dll2AdjustWindowRect
msvcrt.dll20void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll18void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

msvcrt.dll113_XcptFilter
msvcrt.dll203__p__commode
msvcrt.dll275_amsg_exit
msvcrt.dll163__getmainargs
msvcrt.dll228__set_app_type
msvcrt.dll1200exit
msvcrt.dll373_exit
msvcrt.dll294_cexit
msvcrt.dll208__p__fmode
msvcrt.dll521_ismbblead
msvcrt.dll230__setusermatherr
msvcrt.dll490_initterm
msvcrt.dll249_acmdln
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll313_controlfp
msvcrt.dll1291memcpy
msvcrt.dll364_except_handler4_common
msvcrt.dll610_lock
msvcrt.dll966_unlock
msvcrt.dll779_onexit
msvcrt.dll394_finite
msvcrt.dll1262iswdigit
msvcrt.dll1365time
msvcrt.dll1307qsort
msvcrt.dll1166_wtol
msvcrt.dll1006_vsnwprintf
msvcrt.dll796_purecall
msvcrt.dll1310rand
msvcrt.dll1327srand
msvcrt.dll159__dllonexit
msvcrt.dll425_ftol2_sse
msvcrt.dll424_ftol2
msvcrt.dll71_CIsqrt
msvcrt.dll58_CIacos
msvcrt.dll61_CIatan2
msvcrt.dll69_CIsin
msvcrt.dll1295memset
COMCTL32.dll344
COMCTL32.dll123InitCommonControlsEx
ole32.dll127CoUninitialize
ole32.dll80CoInitializeEx
d3d9.dll10Direct3DCreate9
WINMM.dll148timeGetTime

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionBubbles Screen Saver
FileVersion6.3.9600.17415 (winblue_r4.141028-1500)
InternalNameBubbles
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameBubbles
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.3.9600.17415

VS_FIXEDFILEINFO

FileVersion6.3.9600.17415
ProductVersion6.3.9600.17415
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0778752EXE10/29/2014 01:44:06#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK