parentg2mdlhlpx.exe
filenameg2mdlhlpx.unpacked.exe
size109456 (0x1ab90)
md54073adf46d2a0b257e03d0884052b004
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x130

Rich Header

lib idversiontimes used
2592102
9320672
9321798
9560306
1180471
10804711
1472996
480473
10239
9660155
9530775
1530773
9630772
96603053
9260301
9430521
9060301

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4ec192f5
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.10
SizeOfCode0x11800
SizeOfInitializedData0x7a00
SizeOfUninitializedData0
AddressOfEntryPoint0x3ecc
BaseOfCode0x1000
BaseOfData0x13000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x1c000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x1179f0x11800R-X CODE
.rdata0x130000x6d8c0x6e00R-- IDATA
.data0x1a0000x5040x200RW- IDATA
.rsrc0x1b0000x91c0xa00R-- IDATA

Data Directory

typevasize
EXPORT0x19cf00x9c
IMPORT0x191700x8c
RESOURCE0x1b0000x91c
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
STRING#386261252
STRING#393861252
STRING#40961252
STRING#41721252
MANIFEST#18431252
idlangstring
6001033The downloader could not locate the system directory.
6011033Unable to create directory %1.
6021033Unable to copy file %1 to directory %2: %3
6041033The downloader could not locate the Program Files folder.
6061033The downloader could not locate your temporary folder.
6071033Unable to get a unique '%1' temp directory name within %2: %3
6081033GoToMeeting cannot be installed on this computer. Installation requires Windows 2000, Windows XP or newer.
6211033An unknown error occurred.
6221033Error determining host operating system: %1
6231033%1
6241033A call to function %1 failed: %2
6501033Starting GoToMeeting
module_namehintordfunction_name
KERNEL32.DLLVirtualAlloc
KERNEL32.DLLVirtualQuery
KERNEL32.DLLVirtualProtect
KERNEL32.DLLSleep
KERNEL32.DLLGetLastError
KERNEL32.DLLCloseHandle
KERNEL32.DLLGetVersionExA
KERNEL32.DLLGetModuleFileNameA
KERNEL32.DLLGetCurrentProcess
KERNEL32.DLLWaitForSingleObject
KERNEL32.DLLGetProcAddress
KERNEL32.DLLGetModuleHandleA
KERNEL32.DLLLocalFree
KERNEL32.DLLFormatMessageA
KERNEL32.DLLExitProcess
KERNEL32.DLLRaiseException
KERNEL32.DLLQueryPerformanceCounter
KERNEL32.DLLGetTickCount
KERNEL32.DLLGetCurrentThreadId
KERNEL32.DLLGetCurrentProcessId
KERNEL32.DLLGetSystemTimeAsFileTime
KERNEL32.DLLGetStartupInfoA
KERNEL32.DLLFreeLibrary
KERNEL32.DLLLoadLibraryA
KERNEL32.DLLLoadLibraryExA
KERNEL32.DLLCreateDirectoryA
KERNEL32.DLLGetSystemDirectoryA
KERNEL32.DLLGetTempPathA
KERNEL32.DLLTlsGetValue
KERNEL32.DLLTlsSetValue
KERNEL32.DLLTlsAlloc
KERNEL32.DLLIsBadReadPtr
KERNEL32.DLLSetUnhandledExceptionFilter
KERNEL32.DLLFindClose
KERNEL32.DLLWriteFile
KERNEL32.DLLDeleteFileA
KERNEL32.DLLGetFileSize
KERNEL32.DLLFileTimeToSystemTime
KERNEL32.DLLSystemTimeToFileTime
KERNEL32.DLLGetTempFileNameA
KERNEL32.DLLCreateFileA
KERNEL32.DLLFindFirstFileA
KERNEL32.DLLGetSystemTime
KERNEL32.DLLGetWindowsDirectoryA
KERNEL32.DLLGetSystemInfo
KERNEL32.DLLUnmapViewOfFile
KERNEL32.DLLMapViewOfFile
KERNEL32.DLLCreateFileMappingA
KERNEL32.DLLHeapCreate
KERNEL32.DLLHeapDestroy
KERNEL32.DLLHeapAlloc
KERNEL32.DLLHeapFree
KERNEL32.DLLCreateMutexA
KERNEL32.DLLReleaseMutex
KERNEL32.DLLTlsFree
KERNEL32.DLLInitializeCriticalSection
KERNEL32.DLLDeleteCriticalSection
KERNEL32.DLLEnterCriticalSection
KERNEL32.DLLLeaveCriticalSection
KERNEL32.DLLGetCurrentThread
KERNEL32.DLLSetLastError
ADVAPI32.dllRegEnumValueA
ADVAPI32.dllOpenProcessToken
ADVAPI32.dllOpenThreadToken
ADVAPI32.dllRegOpenKeyExA
ADVAPI32.dllRegDeleteKeyA
ADVAPI32.dllRegDeleteValueA
ADVAPI32.dllRegSetValueExA
ADVAPI32.dllRegQueryValueExA
ADVAPI32.dllRegCreateKeyExA
ADVAPI32.dllRegCloseKey
ADVAPI32.dllRegQueryInfoKeyA
ADVAPI32.dllRegEnumKeyExA
MSVCRT.dll_mbslwr
MSVCRT.dllstrlen
MSVCRT.dllmemcpy
MSVCRT.dllvoid * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCRT.dll_amsg_exit
MSVCRT.dllcalloc
MSVCRT.dllmbstowcs
MSVCRT.dlliswctype
MSVCRT.dllwcstombs
MSVCRT.dllatof
MSVCRT.dllisspace
MSVCRT.dllisdigit
MSVCRT.dllisalpha
MSVCRT.dlliswspace
MSVCRT.dlltoupper
MSVCRT.dll_controlfp
MSVCRT.dll__set_app_type
MSVCRT.dll__p__fmode
MSVCRT.dll__p__commode
MSVCRT.dll_adjust_fdiv
MSVCRT.dll__setusermatherr
MSVCRT.dll_initterm
MSVCRT.dll__getmainargs
MSVCRT.dll_acmdln
MSVCRT.dllexit
MSVCRT.dll_XcptFilter
MSVCRT.dll_exit
MSVCRT.dll_onexit
MSVCRT.dll__dllonexit
MSVCRT.dllsprintf
MSVCRT.dllstrcat
MSVCRT.dllmemcmp
MSVCRT.dll_except_handler3
MSVCRT.dll_snprintf
MSVCRT.dllstrcpy
MSVCRT.dllmemset
MSVCRT.dllprintf
MSVCRT.dllpublic: virtual __thiscall bad_cast::~bad_cast(void)

??1bad_cast@@UAE@XZ

MSVCRT.dllpublic: __thiscall exception::exception(char const * const &)

??0exception@@QAE@ABQBD@Z

MSVCRT.dllpublic: virtual char const * __thiscall exception::what(void)const

?what@exception@@UBEPBDXZ

MSVCRT.dllmalloc
MSVCRT.dllfree
MSVCRT.dll_errno
MSVCRT.dllfputs
MSVCRT.dll_iob
MSVCRT.dllfflush
MSVCRT.dll_mbslen
MSVCRT.dllvoid __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCRT.dllmemmove
MSVCRT.dll_mbsrchr
MSVCRT.dll_mbsstr
MSVCRT.dll_mbscmp
MSVCRT.dll_mbsnbcmp
MSVCRT.dll_vsnprintf
MSVCRT.dll_purecall
MSVCRT.dll_mbschr
MSVCRT.dll_itoa
MSVCRT.dlltime
MSVCRT.dll_beginthreadex
ole32.dllCoGetCurrentProcess
USER32.dllLoadStringA
USER32.dllMessageBoxA
VERSION.dllVerQueryValueA
VERSION.dllGetFileVersionInfoA
VERSION.dllGetFileVersionInfoSizeA
ordentry_vafunction_name
10x11e4b_resetstkoflw
20x1a130_sys_errlist
30x1a1e0_sys_nerr
40x12005_wcserror
50x11f2e_wtof
module_nameg2mdlhlp.exe
flags0
timestamp2011-11-14 22:15:17
version0.0
ordinal_base1
nFunctions5
nNames5
Names(5)0x19d2c
Functions(5)0x19d18
NameOrdinals(5)0x19d40
offsetsizetypecomment
0103936EXE11/14/2011 22:15:17#
15c115HTM#
196005520BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 109456 bytes (107 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK