filename2481804a1e1414cb02b62993fbeaf4d78e1cf8df997f4bc47fe94d0895131661
size495616 (0x79000)
md54c4ae0770df9638a45d6fbc2a3549415
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd0

Rich Header

lib idversiontimes used
1096
123507279
122507271
1095072712
124507271
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x56b86020
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion8.0
SizeOfCode0x4000
SizeOfInitializedData0x74000
SizeOfUninitializedData0
AddressOfEntryPoint0x3b90
BaseOfCode0x1000
BaseOfData0x5000
ImageBase0x70000000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x79000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x36b20x4000R-X CODE
.data0x50000x305280x31000RW- IDATA
.rsrc0x360000x42ba40x43000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x40c00x64
RESOURCE0x360000x42ba4
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x11400x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x10000x13c
Delay_IAT00
CLR_Header00
typenamesizecp
BITMAP#1028080
BITMAP#1038080
BITMAP#10431120
BITMAP#1118080
BITMAP#1128080
BITMAP#11331120
BITMAP#1208720
BITMAP#12131760
ICON#116400
ICON#27440
ICON#32960
ICON#437520
ICON#522160
ICON#613840
ICON#71033990
ICON#896400
ICON#942640
ICON#1011280
ICON#1116400
ICON#127440
ICON#132960
ICON#1437520
ICON#1522160
ICON#1613840
ICON#171033990
ICON#1896400
ICON#1942640
ICON#2011280
GROUP_ICON#1001460
GROUP_ICON#1011460
VERSION#19880
module_namehintordfunction_name
ADVAPI32.dll55ChangeServiceConfigW
ADVAPI32.dll7AccessCheckAndAuditAlarmW
ADVAPI32.dll320LockServiceDatabase
ADVAPI32.dll33BackupEventLogA
ADVAPI32.dll143CryptEncrypt
ADVAPI32.dll558SetPrivateObjectSecurityEx
ADVAPI32.dll216EqualSid
ADVAPI32.dll56CheckTokenMembership
ADVAPI32.dll571SetThreadToken
ADVAPI32.dll97CreateProcessAsUserW
ADVAPI32.dll276GetServiceKeyNameW
ADVAPI32.dll411NotifyChangeEventLog
ADVAPI32.dll61CloseEventLog
ADVAPI32.dll499RegRestoreKeyW
ADVAPI32.dll410NotifyBootConfigStatus
ADVAPI32.dll462RegCreateKeyExA
ADVAPI32.dll409MapGenericMask
ADVAPI32.dll233GetCurrentHwProfileW
ADVAPI32.dll170CryptVerifySignatureA
ADVAPI32.dll137CryptDecrypt
ADVAPI32.dll470RegEnumKeyA
USER32.dll444LoadCursorW
USER32.dll446LoadIconW
USER32.dll581SetActiveWindow
USER32.dll636SetTimer
USER32.dll492MsgWaitForMultipleObjects
USER32.dll94CreatePopupMenu
USER32.dll260GetClipboardFormatNameA
USER32.dll224EnumWindows
USER32.dll575SendMessageCallbackW
USER32.dll598SetDlgItemTextW
USER32.dll255GetClassNameW
USER32.dll364GetWindow
USER32.dll434IsZoomed
USER32.dll149DestroyAcceleratorTable
USER32.dll572SendInput
USER32.dll696UnregisterHotKey
USER32.dll430IsWindowEnabled
USER32.dll559RemovePropW
USER32.dll531RealGetWindowClassW
USER32.dll66CloseClipboard
USER32.dll401InsertMenuItemW
USER32.dll495OemKeyScan
USER32.dll730wsprintfA
USER32.dll160DialogBoxParamA
OLEAUT32.dll281
OLEAUT32.dll197
OLEAUT32.dll49
OLEAUT32.dll412
OLEAUT32.dll44
OLEAUT32.dll256
OLEAUT32.dll317
OLEAUT32.dll311
OLEAUT32.dll57
OLEAUT32.dll97
OLEAUT32.dll268
OLEAUT32.dll226
OLEAUT32.dll228
OLEAUT32.dll212
OLEAUT32.dll123
OLEAUT32.dll48
OLEAUT32.dll93
OLEAUT32.dll163
ESENT.dll86JetMakeKey
ESENT.dll26JetCreateTable
ESENT.dll12JetCloseFile
ESENT.dll45JetEndSession
ESENT.dll142JetUpdate
ESENT.dll113JetRetrieveColumns
ESENT.dll63JetGetLock
ESENT.dll1JetAttachDatabase
ESENT.dll56JetGetCurrentIndex
ESENT.dll87JetMove
ESENT.dll33JetDeleteColumn
ESENT.dll125JetSetDatabaseSize

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionApplication Control Policies Group Policy Editor Extension
FileVersion6.1.7600.16385 (win7_rtm.090713-1255)
InternalNamesrpuxgp.dll
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamesrpuxgp.dll
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion6.1.7600.16385
ProductVersion6.1.7600.16385
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
0495616EXE02/08/2016 09:30:08#
15c115HTM#
3c130103399PNG(256 x 256)#
5b7a0103399PNG(256 x 256)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER