4cd99490846b9c301c9a46ae88802eccae008124c41bf202582da77309192300

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	4cd99490846b9c301c9a46ae88802eccae008124c41bf202582da77309192300
size	225280 (0x37000)
md5	49caeb41e5236a2812327163715b171d

type	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xc0

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|
00000040: cc dd 94 67 88 bc fa 34  88 bc fa 34 88 bc fa 34  |...g...4...4...4|
00000050: af 7a 94 34 8a bc fa 34  88 bc fa 34 8b bc fa 34  |.z.4...4...4...4|
00000060: af 7a 81 34 85 bc fa 34  88 bc fb 34 e9 bc fa 34  |.z.4...4...4...4|
00000070: af 7a 97 34 9b bc fa 34  af 7a 82 34 89 bc fa 34  |.z.4...4.z.4...4|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x56ccb1d0
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x30f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x8000
SizeOfInitializedData	0x2e000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x2fb0
BaseOfCode	0x1000
BaseOfData	0x9000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x37000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	3
DllCharacteristics	0x8100
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig4

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x71dc	0x8000	R-X CODE
.data	0x9000	0x18378	0x19000	RW- IDATA
INIT	0x22000	0x537f	0x6000	RW- IDATA
.tls	0x28000	0xe241	0xf000	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x70e0	0x104
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x1000	0x278
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
GDI32.dll	385	GetGlyphOutlineW
GDI32.dll	509	ResetDCA
GDI32.dll	344	GetCharWidthA
GDI32.dll	45	CreateCompatibleDC
GDI32.dll	594	UnrealizeObject
GDI32.dll	54	CreateEllipticRgnIndirect
GDI32.dll	467	OffsetClipRgn
GDI32.dll	410	GetPaletteEntries
GDI32.dll	520	ScaleViewportExtEx
GDI32.dll	202	EnumFontFamiliesExA
GDI32.dll	523	SelectClipPath
GDI32.dll	587	StrokeAndFillPath
GDI32.dll	65	CreateICA
GDI32.dll	143	DeleteObject
GDI32.dll	336	GetBrushOrgEx
KERNEL32.dll	237	FreeConsole
USER32.dll	514	PostMessageW
USER32.dll	270	GetDC
USER32.dll	572	SendInput
USER32.dll	711	ValidateRect
USER32.dll	378	GetWindowTextLengthA
USER32.dll	27	CallWindowProcA
USER32.dll	584	SetCaretPos
USER32.dll	360	GetUserObjectInformationA
USER32.dll	177	DrawCaption
USER32.dll	583	SetCaretBlinkTime
USER32.dll	90	CreateIconIndirect
USER32.dll	687	UnhookWindowsHook
USER32.dll	384	GrayStringW
USER32.dll	362	GetUserObjectSecurity
USER32.dll	225	EqualRect
USER32.dll	99	CreateWindowStationW
USER32.dll	566	ScrollWindow
USER32.dll	413	IsCharLowerW
USER32.dll	593	SetCursorPos
USER32.dll	643	SetWindowLongW
USER32.dll	472	MapVirtualKeyW
USER32.dll	504	OpenIcon
USER32.dll	358	GetUpdateRect
USER32.dll	469	MapVirtualKeyA
USER32.dll	233	FlashWindow
USER32.dll	353	GetTabbedTextExtentW
ole32.dll	338	ReadFmtUserTypeStg
ole32.dll	258	HWND_UserFree
ole32.dll	296	OleDoAutoConvert
ole32.dll	48	CoGetMalloc
ole32.dll	39	CoGetContextToken
ole32.dll	35	CoGetCancelObject
ole32.dll	326	OleTranslateAccelerator
ole32.dll	274	OleBuildVersion
comdlg32.dll	1	ChooseColorW
comdlg32.dll	21	ReplaceTextW
comdlg32.dll	15	PageSetupDlgW
comdlg32.dll	12	GetSaveFileNameW
comdlg32.dll	10	GetOpenFileNameW
comdlg32.dll	4	CommDlgExtendedError
comdlg32.dll	11	GetSaveFileNameA
SHLWAPI.dll	268	StrSpnA
SHLWAPI.dll	46	PathFindExtensionA
SETUPAPI.dll	227	SetupAdjustDiskSpaceListW
SETUPAPI.dll	343	SetupDiGetWizardPage
SETUPAPI.dll	445	SetupInstallServicesFromInfSectionW
SETUPAPI.dll	411	SetupGetLineByIndexA
SETUPAPI.dll	283	SetupDiDestroyDeviceInfoList
SETUPAPI.dll	342	SetupDiGetSelectedDriverW
SETUPAPI.dll	273	SetupDiCreateDeviceInfoW
SETUPAPI.dll	495	SetupRemoveFileLogEntryW
SETUPAPI.dll	444	SetupInstallServicesFromInfSectionExW
SETUPAPI.dll	274	SetupDiCreateDeviceInterfaceA
SETUPAPI.dll	319	SetupDiGetDeviceInstallParamsW
SETUPAPI.dll	471	SetupQueryInfOriginalFileInformationW
SETUPAPI.dll	446	SetupIterateCabinetA
SETUPAPI.dll	254	SetupDiBuildClassInfoListExW
SETUPAPI.dll	408	SetupGetInfInformationW
SETUPAPI.dll	268	SetupDiCreateDevRegKeyW
SETUPAPI.dll	309	SetupDiGetClassInstallParamsA
SETUPAPI.dll	212	InstallHinfSectionA
SETUPAPI.dll	393	SetupFreeSourceListA
SETUPAPI.dll	414	SetupGetLineCountW
SETUPAPI.dll	346	SetupDiInstallClassExW
SETUPAPI.dll	433	SetupInitializeFileLogW
SETUPAPI.dll	374	SetupDiSetDeviceInstallParamsW
RPCRT4.dll	418	RpcServerListen
RPCRT4.dll	134	NdrComplexArrayMarshall
RPCRT4.dll	136	NdrComplexArrayUnmarshall
RPCRT4.dll	329	RpcBindingInqAuthClientExA
RPCRT4.dll	375	RpcImpersonateClient
RPCRT4.dll	39	I_RpcClearMutex
RPCRT4.dll	180	NdrEncapsulatedUnionBufferSize
RPCRT4.dll	42	I_RpcDeleteMutex
MPRAPI.dll	18	MprAdminInterfaceGetCredentialsEx
MPRAPI.dll	77	MprConfigInterfaceTransportAdd
MPRAPI.dll	7	MprAdminEstablishDomainRasServer
MPRAPI.dll	29	MprAdminInterfaceUpdatePhonebookInfo
MPRAPI.dll	87	MprConfigServerInstall
MPRAPI.dll	108	MprInfoDuplicate
MPRAPI.dll	37	MprAdminMIBEntryGetFirst
MPRAPI.dll	26	MprAdminInterfaceTransportGetInfo
MPRAPI.dll	106	MprInfoCreate
MPRAPI.dll	71	MprConfigInterfaceCreate
MPRAPI.dll	94	MprConfigTransportGetInfo
MPRAPI.dll	34	MprAdminMIBEntryCreate
MPRAPI.dll	47	MprAdminRegisterConnectionNotification
MPRAPI.dll	41	MprAdminMIBServerDisconnect
MPRAPI.dll	56	MprAdminTransportSetInfo
MPRAPI.dll	8	MprAdminGetErrorString
MPRAPI.dll	44	MprAdminPortEnum
pdh.dll	14	PdhCollectQueryDataEx
pdh.dll	42	PdhGetCounterInfoW
pdh.dll	40	PdhFormatFromRawValue
pdh.dll	79	PdhOpenLogA
pdh.dll	126	PdhSetDefaultRealTimeDataSource
pdh.dll	6	PdhBrowseCountersA
pdh.dll	39	PdhExpandWildCardPathW
pdh.dll	51	PdhGetDefaultPerfObjectA
pdh.dll	122	PdhRemoveCounter
pdh.dll	77	PdhMakeCounterPathA
pdh.dll	16	PdhConnectMachineA
pdh.dll	33	PdhEnumObjectsW
pdh.dll	22	PdhEnumMachinesA
pdh.dll	64	PdhGetRawCounterArrayW
pdh.dll	26	PdhEnumObjectItemsA
pdh.dll	2	PdhAddCounterA
pdh.dll	12	PdhCloseQuery
pdh.dll	17	PdhConnectMachineW
pdh.dll	88	PdhParseInstanceNameW
mscms.dll	34	InstallColorProfileW
mscms.dll	52	SetStandardColorSpaceProfileA
mscms.dll	4	CloseColorProfile
mscms.dll	51	SetColorProfileHeader
mscms.dll	27	GetNamedProfileInfo
mscms.dll	42	IsColorProfileValid
mscms.dll	20	GetColorDirectoryA
mscms.dll	16	EnumColorProfilesA
mscms.dll	11	CreateProfileFromLogColorSpaceA
mscms.dll	13	DeleteColorTransform
mscms.dll	19	GetCMMInfo
ntdll.dll	129	NtCreateSection
ntdll.dll	255	NtQuerySystemInformation
ntdll.dll	1071	ZwQuerySystemInformation
ntdll.dll	529	RtlEnlargedUnsignedMultiply
ntdll.dll	731	RtlPrefixUnicodeString
ntdll.dll	102	NtClearEvent
ntdll.dll	724	RtlOemStringToUnicodeString
ntdll.dll	103	NtClose
ntdll.dll	194	NtOpenEvent

show previews

offset	size	type	comment
0	225280	EXE	02/23/2016 19:24:00	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK