filename0f232006fef60db8d9561e78c2f9124ed0db1a7ad4065dc5422bc5ab2a641810
size335872 (0x52000)
md5344297c5b28af76967bf32551abf747d
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x120

Rich Header

lib idversiontimes used
1081681
11816815
1187983
9521908
14729928
11804710
108047171
11856980
1272913
00119
9621901
10535
93217929
1089661
11896680
617351
484471

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x575acdf9
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10b
Magic0x10b
LinkerVersion6.0
SizeOfCode0x1b000
SizeOfInitializedData0x36000
SizeOfUninitializedData0
AddressOfEntryPoint0x1023
BaseOfCode0x1000
BaseOfData0x1c000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x52000
SizeOfHeaders0x1000
CheckSum0
Subsystem3
DllCharacteristics0x8000
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x1ada80x1b000R-X CODE
.rdata0x1c0000x13ec30x14000R-- IDATA
.data0x300000x53ac0x6000RW- IDATA
.idata0x360000xe240x1000RW- IDATA
INIT0x370000x194aa0x1a000RW- IDATA
.rsrc0x510000x6d00x1000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x360000xc8
RESOURCE0x510000x6d0
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x1c0000
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x363f40x32c
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#116561252
module_namehintordfunction_name
GDI32.dll429GetTextCharset
GDI32.dll406GetObjectType
GDI32.dll443GetTextFaceW
ADVAPI32.dll317IsValidSecurityDescriptor
ADVAPI32.dll564SetSecurityDescriptorSacl
ADVAPI32.dll468RegDeleteValueW
ADVAPI32.dll332LookupPrivilegeNameW
ADVAPI32.dll20AddAccessDeniedAceEx
ADVAPI32.dll32AreAnyAccessesGranted
ADVAPI32.dll333LookupPrivilegeValueA
ADVAPI32.dll409MapGenericMask
ADVAPI32.dll279GetSidSubAuthority
ADVAPI32.dll472RegEnumKeyExW
ADVAPI32.dll157CryptHashData
ADVAPI32.dll212EnumServicesStatusW
ADVAPI32.dll161CryptSetHashParam
ADVAPI32.dll203EncryptFileW
ADVAPI32.dll56CheckTokenMembership
ADVAPI32.dll141CryptDuplicateHash
ADVAPI32.dll164CryptSetProviderA
ADVAPI32.dll415ObjectDeleteAuditAlarmW
KERNEL32.dll328GetDiskFreeSpaceW
KERNEL32.dll66CopyFileW
USER32.dll47CharPrevW
ole32.dll296OleDoAutoConvert
ole32.dll21CoDisableCallCancellation
ole32.dll214HACCEL_UserFree
ole32.dll35CoGetCancelObject
ole32.dll308OleLoad
ole32.dll43CoGetInstanceFromFile
ole32.dll306OleIsCurrentClipboard
ole32.dll272MonikerCommonPrefixWith
ole32.dll109CoUnmarshalInterface
msvcrt.dll1224iswalnum
msvcrt.dll1052_wexecv
msvcrt.dll1048_wexecl
msvcrt.dll1300strcmp
msvcrt.dll766_putenv
msvcrt.dll1366wcscspn
msvcrt.dll1130_wtoi64
msvcrt.dll1364wcscpy
msvcrt.dll1281rename
msvcrt.dll1304strcspn
msvcrt.dll1125_wtmpnam
msvcrt.dll1095_wrename
msvcrt.dll1341ungetc
msvcrt.dll1176fgets
msvcrt.dll1270putchar
msvcrt.dll1269putc
msvcrt.dll1233iswpunct
msvcrt.dll843_splitpath
msvcrt.dll1258memcpy
msvcrt.dll1154bsearch
msvcrt.dll561_itoa
msvcrt.dll1178fgetws
msvcrt.dll1196fseek
msvcrt.dll1202fwscanf
msvcrt.dll1394wscanf
msvcrt.dll815_snprintf
msvcrt.dll1392wprintf
msvcrt.dll1106_wspawnle
msvcrt.dll360_fdopen
msvcrt.dll1223isupper
msvcrt.dll1372wcsncpy
msvcrt.dll1071_wgetdcwd
msvcrt.dll1219islower
msvcrt.dll1234iswspace
msvcrt.dll968_vsnprintf
OLEAUT32.dll279
OLEAUT32.dll5
OLEAUT32.dll135
OLEAUT32.dll161
OLEAUT32.dll79
OLEAUT32.dll147
OLEAUT32.dll164
OLEAUT32.dll239
OLEAUT32.dll80
OLEAUT32.dll58
OLEAUT32.dll113
OLEAUT32.dll221
rtm.dll89RtmLockRoute
rtm.dll62RtmGetEnumRoutes
urlmon.dll61RegisterBindStatusCallback
urlmon.dll8CoInternetCompareUrl
urlmon.dll25CreateAsyncBindCtx
urlmon.dll50HlinkSimpleNavigateToMoniker
urlmon.dll9CoInternetCreateSecurityManager
urlmon.dll64RegisterMediaTypeClass
urlmon.dll80URLOpenStreamA
urlmon.dll76URLOpenBlockingStreamA

StringTable 040904e4

CompanyNameAdobe Systems, Inc.
FileDescriptionShockwave Flash 17.0 r0
FileExtentsswf|spl|mfp
FileOpenNameAdobe Flash movie (*.swf)|FutureSplash movie (*.spl)|Adobe Flash Paper (*.mfp)
MIMETypeapplication/x-shockwave-flash|application/futuresplash
ProductNameShockwave Flash
FileVersion17,0,0,134
InternalNameAdobe Flash Player 17.0
LegalCopyrightAdobe® Flash® Player. Copyright © 1996 - 2015 Adobe Systems Incorporated. All Rights Reserved. Adobe and Flash are either trademarks or registered trademarks in the United States and/or other countries.
LegalTrademarksAdobe Flash Player
OriginalFilenamepepflashplayer.dll
ProductVersion17,0,0,134
Debugger0

VS_FIXEDFILEINFO

FileVersion17.0.0.134
ProductVersion17.0.0.134
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS4
FileType2
FileSubtype0
offsetsizetypecomment
0335872EXE06/10/2016 14:26:01#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK