extractedmw.exe

info
MZ
PE
imports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	extractedmw.exe
size	121046 (0x1d8d6)
md5	555f58e7020c6e72230b0f270f6f3b15

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: bb 11 01 0f 1e b5 0a cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0a 0d 24 37  00 00 00 00 00 00 00 00  |in32..$7........|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x51bd9ffa
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	8.0
SizeOfCode	0xc00
SizeOfInitializedData	0x200
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1aaa
BaseOfCode	0x1000
BaseOfData	0x2000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	0.0
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0x20000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	2
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1000	0xc00	R-X CODE
.rdata	0x2000	0x344	0x400	RW- IDATA UDATA
.fdata	0x3000	0x1c400	0x1c400	RW- UDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x2074	0x50
RESOURCE	0x3000	0x68aa6af4
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0x1aec	0x90
CLR_Header	0	0
	0x2000	0x1a

module_name	hint	function_name
KERNEL32.dll	1203	Sleep
KERNEL32.dll	1127	SetFilePointer
KERNEL32.dll	831	LoadLibraryExW
KERNEL32.dll	1349	lstrcmpiA
KERNEL32.dll	750	InterlockedExchange
KERNEL32.dll	893	OpenMutexA
KERNEL32.dll	1112	SetEnvironmentVariableW
KERNEL32.dll	574	GetPrivateProfileIntW
KERNEL32.dll	132	CreateEventA
KERNEL32.dll	572	GetPriorityClass
KERNEL32.dll	1272	WaitForMultipleObjects
KERNEL32.dll	575	GetPrivateProfileSectionA
KERNEL32.dll	127	CreateDirectoryW
KERNEL32.dll	1346	lstrcmpA
KERNEL32.dll	481	GetExitCodeProcess
KERNEL32.dll	487	GetFileAttributesA
KERNEL32.dll	463	GetDiskFreeSpaceA
KERNEL32.dll	719	HeapCreate
KERNEL32.dll	535	GetModuleHandleA
catsrv.dll	4	DllCanUnloadNow
catsrv.dll	3	GetCatalogCRMClerk
catsrv.dll	2	CreateComponentLibraryTS
catsrv.dll	6	OpenComponentLibraryTS

show previews

offset	size	type	comment
0	120832	EXE	06/16/2013 11:22:34	#
15c1	15	HTM		#
1d800	214	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 121046 bytes (119 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK