par3j.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	par3j.exe
size	188928 (0x2e200)
md5	5c333edbd28643991499723e42a57067

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd8

Rich Header

lib id	version	times used
11	9782	1
14	7299	20
93	2179	5
1	0	89
48	8943	4
10	9782	99

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x5186662b
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x28600
SizeOfInitializedData	0x9200
SizeOfUninitializedData	0
AddressOfEntryPoint	0x23759
BaseOfCode	0x1000
BaseOfData	0x2a000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x34000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0
SizeOfStackReserve	0x400000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x284b8	0x28600	R-X CODE
.rdata	0x2a000	0xd74	0xe00	R-- IDATA
.data	0x2b000	0x8264	0x4a00	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x2a5a4	0x3c
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x2a000	0x15c
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
KERNEL32.dll	518	HeapAlloc
KERNEL32.dll	905	WideCharToMultiByte
KERNEL32.dll	619	MultiByteToWideChar
KERNEL32.dll	683	ReadFile
KERNEL32.dll	784	SetFilePointer
KERNEL32.dll	919	WriteFile
KERNEL32.dll	72	CreateDirectoryW
KERNEL32.dll	345	GetFileAttributesW
KERNEL32.dll	705	ReplaceFileW
KERNEL32.dll	615	MoveFileW
KERNEL32.dll	783	SetFileAttributesW
KERNEL32.dll	125	DeleteFileW
KERNEL32.dll	699	RemoveDirectoryW
KERNEL32.dll	773	SetEndOfFile
KERNEL32.dll	46	CloseHandle
KERNEL32.dll	80	CreateFileW
KERNEL32.dll	443	GetSystemInfo
KERNEL32.dll	507	GlobalMemoryStatusEx
KERNEL32.dll	594	LocalFree
KERNEL32.dll	234	FormatMessageA
KERNEL32.dll	235	FormatMessageW
KERNEL32.dll	344	GetFileAttributesExW
KERNEL32.dll	779	SetEvent
KERNEL32.dll	708	ResetEvent
KERNEL32.dll	901	WaitForSingleObject
KERNEL32.dll	105	CreateThread
KERNEL32.dll	74	CreateEventW
KERNEL32.dll	469	GetTickCount
KERNEL32.dll	64	CopyFileW
KERNEL32.dll	197	FindClose
KERNEL32.dll	212	FindNextFileW
KERNEL32.dll	204	FindFirstFileW
KERNEL32.dll	448	GetSystemTimeAsFileTime
KERNEL32.dll	229	FlushFileBuffers
KERNEL32.dll	925	WritePrivateProfileStringW
KERNEL32.dll	405	GetPrivateProfileStringW
KERNEL32.dll	347	GetFileSize
KERNEL32.dll	399	GetPrivateProfileIntW
KERNEL32.dll	346	GetFileInformationByHandle
KERNEL32.dll	374	GetModuleFileNameW
KERNEL32.dll	301	GetConsoleOutputCP
KERNEL32.dll	314	GetCurrentProcess
KERNEL32.dll	793	SetHandleCount
KERNEL32.dll	524	HeapFree
KERNEL32.dll	361	GetLastError
KERNEL32.dll	528	HeapReAlloc
KERNEL32.dll	354	GetFullPathNameW
KERNEL32.dll	672	ReadConsoleInputA
KERNEL32.dll	754	SetConsoleMode
KERNEL32.dll	299	GetConsoleMode
KERNEL32.dll	645	PeekConsoleInputA
KERNEL32.dll	393	GetNumberOfConsoleInputEvents
KERNEL32.dll	478	GetVersion
KERNEL32.dll	175	ExitProcess
KERNEL32.dll	375	GetModuleHandleA
KERNEL32.dll	373	GetModuleFileNameA
KERNEL32.dll	336	GetEnvironmentVariableA
KERNEL32.dll	479	GetVersionExA
KERNEL32.dll	522	HeapDestroy
KERNEL32.dll	520	HeapCreate
KERNEL32.dll	888	VirtualFree
KERNEL32.dll	885	VirtualAlloc
KERNEL32.dll	313	GetCurrentDirectoryW
KERNEL32.dll	849	TerminateProcess
KERNEL32.dll	335	GetEnvironmentStringsW
KERNEL32.dll	333	GetEnvironmentStrings
KERNEL32.dll	433	GetStdHandle
KERNEL32.dll	350	GetFileType
KERNEL32.dll	431	GetStartupInfoA
KERNEL32.dll	77	CreateFileA
KERNEL32.dll	570	LCMapStringA
KERNEL32.dll	571	LCMapStringW
KERNEL32.dll	866	UnhandledExceptionFilter
KERNEL32.dll	237	FreeEnvironmentStringsA
KERNEL32.dll	238	FreeEnvironmentStringsW
KERNEL32.dll	331	GetDriveTypeA
KERNEL32.dll	265	GetCommandLineW
KERNEL32.dll	264	GetCommandLineA
KERNEL32.dll	716	RtlUnwind
KERNEL32.dll	408	GetProcAddress
KERNEL32.dll	812	SetStdHandle
KERNEL32.dll	434	GetStringTypeA
KERNEL32.dll	437	GetStringTypeW
KERNEL32.dll	584	LoadLibraryA
SHELL32.dll	155	SHFileOperationW

show previews

offset	size	type	comment
0	188928	EXE	05/05/2013 14:01:15	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK