_00B70000.mem

info
MZ
PE
imports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	_00B70000.mem
size	339968 (0x53000)
md5	67ea75b78328e2c13b8dacce7f7a8737

type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x110

Rich Header

lib id	version	times used
95	2179	1
25	9210	4
28	9178	1
93	2179	10
4	8168	2
10	8168	4
93	6030	3
1	0	196
96	6030	45
14	7299	8
95	3077	3
15	3077	1
90	6030	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x5006f50c
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x210e
Magic	0x10b
LinkerVersion	7.10
SizeOfCode	0x2b000
SizeOfInitializedData	0x27000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x2bbc0
BaseOfCode	0x1000
BaseOfData	0x2c000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x53000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ 6.0 DLL

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x2ac82	0x2b000	R-X CODE
.rdata	0x2c000	0x5c44	0x6000	R-- IDATA
.data	0x32000	0x1db6c	0x4000	RW- IDATA
.reloc	0x50000	0x29b4	0x3000	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x30c5c	0xc8
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x50000	0x1f10
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x2c000	0x314
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	ord	function_name
ntdll.dll	2		NtSetInformationProcess
ntdll.dll			NtQueryInformationProcess
MSVCRT.dll	720		time
MSVCRT.dll	157		_adjust_fdiv
MSVCRT.dll	657		malloc
MSVCRT.dll	271		_initterm
MSVCRT.dll	606		free
MSVCRT.dll	707		strrchr
MSVCRT.dll	693		sscanf
MSVCRT.dll	708		strspn
MSVCRT.dll	456		_strrev
MSVCRT.dll	676		qsort
MSVCRT.dll	624		isalnum
MSVCRT.dll	670		printf
MSVCRT.dll	703		strncat
MSVCRT.dll	449		_stricmp
MSVCRT.dll	752		wcstol
MSVCRT.dll	742		wcslen
MSVCRT.dll	739		wcscpy
MSVCRT.dll	704		strncmp
MSVCRT.dll	664		memmove
MSVCRT.dll	453		_strnicmp
MSVCRT.dll	451		_strlwr
MSVCRT.dll	661		memchr
MSVCRT.dll	385		_memicmp
MSVCRT.dll	699		strcspn
MSVCRT.dll	692		srand
MSVCRT.dll	678		rand
MSVCRT.dll	351		_mbsicmp
MSVCRT.dll	380		_mbsstr
MSVCRT.dll	663		memcpy
MSVCRT.dll	662		memcmp
MSVCRT.dll	749		wcsstr
MSVCRT.dll	712		strtol
MSVCRT.dll	711		strtok
MSVCRT.dll	574		atol
MSVCRT.dll	200		_errno
MSVCRT.dll	431		_snwprintf
MSVCRT.dll	473		_ultoa
MSVCRT.dll	694		strcat
MSVCRT.dll	690		sprintf
MSVCRT.dll	695		strchr
MSVCRT.dll	696		strcmp
MSVCRT.dll	705		strncpy
MSVCRT.dll	665		memset
MSVCRT.dll	713		strtoul
MSVCRT.dll	430		_snprintf
MSVCRT.dll	709		strstr
MSVCRT.dll	698		strcpy
MSVCRT.dll	702		strlen
KERNEL32.dll	777		SetEvent
KERNEL32.dll	663		QueryPerformanceCounter
KERNEL32.dll	175		ExitProcess
KERNEL32.dll	714		RtlUnwind
KERNEL32.dll	879		VerSetConditionMask
KERNEL32.dll	881		VerifyVersionInfoA
KERNEL32.dll	478		GetVersion
KERNEL32.dll	839		Sleep
KERNEL32.dll	518		HeapAlloc
KERNEL32.dll	411		GetProcessHeap
KERNEL32.dll	524		HeapFree
KERNEL32.dll	483		GetVolumeNameForVolumeMountPointA
KERNEL32.dll	481		GetVolumeInformationA
KERNEL32.dll	201		FindFirstFileA
KERNEL32.dll	197		FindClose
KERNEL32.dll	73		CreateEventA
KERNEL32.dll	176		ExitThread
KERNEL32.dll	239		FreeLibrary
KERNEL32.dll	408		GetProcAddress
KERNEL32.dll	584		LoadLibraryA
KERNEL32.dll	441		GetSystemDirectoryA
KERNEL32.dll	537		InitializeCriticalSection
KERNEL32.dll	122		DeleteCriticalSection
KERNEL32.dll	318		GetCurrentThreadId
KERNEL32.dll	583		LeaveCriticalSection
KERNEL32.dll	143		EnterCriticalSection
KERNEL32.dll	46		CloseHandle
KERNEL32.dll	105		CreateThread
KERNEL32.dll	373		GetModuleFileNameA
KERNEL32.dll	543		InterlockedExchange
KERNEL32.dll	315		GetCurrentProcessId
KERNEL32.dll	848		TerminateThread
KERNEL32.dll	230		FlushInstructionCache
KERNEL32.dll	314		GetCurrentProcess
KERNEL32.dll	889		VirtualProtect
KERNEL32.dll	886		VirtualFree
KERNEL32.dll	883		VirtualAlloc
KERNEL32.dll	361		GetLastError
KERNEL32.dll	594		LocalFree
KERNEL32.dll	140		DuplicateHandle
KERNEL32.dll	634		OpenProcess
KERNEL32.dll	652		Process32Next
KERNEL32.dll	654		ProcessIdToSessionId
KERNEL32.dll	650		Process32First
KERNEL32.dll	108		CreateToolhelp32Snapshot
KERNEL32.dll	375		GetModuleHandleA
KERNEL32.dll	795		SetLastError
KERNEL32.dll	512		GlobalUnlock
KERNEL32.dll	505		GlobalLock
KERNEL32.dll	956		lstrlenA
KERNEL32.dll	957		lstrlenW
KERNEL32.dll	822		SetThreadPriority
KERNEL32.dll	465		GetThreadPriority
KERNEL32.dll	317		GetCurrentThread
KERNEL32.dll	619		MultiByteToWideChar
KERNEL32.dll	546		InterlockedIncrement
KERNEL32.dll	542		InterlockedDecrement
KERNEL32.dll	469		GetTickCount
KERNEL32.dll	448		GetSystemTimeAsFileTime
KERNEL32.dll	632		OpenMutexA
KERNEL32.dll	90		CreateMutexA
KERNEL32.dll	694		ReleaseMutex
KERNEL32.dll	899		WaitForSingleObject
ADVAPI32.dll	523		RevertToSelf
ADVAPI32.dll	29		AllocateAndInitializeSid
ADVAPI32.dll	216		EqualSid
ADVAPI32.dll	225		FreeSid
ADVAPI32.dll	431		OpenThreadToken
ADVAPI32.dll	318		IsValidSid
ADVAPI32.dll	246		GetLengthSid
ADVAPI32.dll	90		CopySid
ADVAPI32.dll	480		RegOpenCurrentUser
ADVAPI32.dll	306		InitializeSecurityDescriptor
ADVAPI32.dll	559		SetSecurityDescriptorDacl
ADVAPI32.dll	85		ConvertStringSecurityDescriptorToSecurityDescriptorA
ADVAPI32.dll	269		GetSecurityDescriptorSacl
ADVAPI32.dll	563		SetSecurityDescriptorSacl
ADVAPI32.dll	470		RegEnumKeyExA
ADVAPI32.dll	505		RegSetValueExA
ADVAPI32.dll	302		ImpersonateLoggedOnUser
ADVAPI32.dll	543		SetEntriesInAclA
ADVAPI32.dll	564		SetSecurityInfo
ADVAPI32.dll	281		GetTokenInformation
ADVAPI32.dll	426		OpenProcessToken
ADVAPI32.dll	333		LookupPrivilegeValueA
ADVAPI32.dll	28		AdjustTokenPrivileges
ADVAPI32.dll	479		RegNotifyChangeKeyValue
ADVAPI32.dll	469		RegEnumKeyA
ADVAPI32.dll	487		RegQueryInfoKeyA
ADVAPI32.dll	492		RegQueryValueExA
ADVAPI32.dll	482		RegOpenKeyExA
ADVAPI32.dll	461		RegCreateKeyExA
ADVAPI32.dll	466		RegDeleteValueA
ADVAPI32.dll	473		RegEnumValueA
ADVAPI32.dll	457		RegCloseKey
SHELL32.dll	167		SHGetDesktopFolder
SHELL32.dll	194		SHGetSpecialFolderLocation
ole32.dll	58		CoInitialize
ole32.dll	16		CoCreateInstance
ole32.dll	104		CoUninitialize
ole32.dll	100		CoTaskMemFree
ole32.dll	59		CoInitializeEx
WININET.dll	154		InternetReadFile
WININET.dll	87		HttpQueryInfoA
WININET.dll	173		InternetSetStatusCallback
WININET.dll	167		InternetSetOptionA
WININET.dll	105		InternetCloseHandle
WININET.dll	89		HttpSendRequestA
WININET.dll	80		HttpAddRequestHeadersA
WININET.dll	85		HttpOpenRequestA
WININET.dll	111		InternetConnectA
WININET.dll	146		InternetOpenA
WININET.dll	113		InternetCrackUrlA
WININET.dll	152		InternetQueryOptionA
WININET.dll	147		InternetOpenUrlA
WININET.dll	128		InternetGetConnectedState
WS2_32.dll		11
WS2_32.dll		111
WS2_32.dll		52
WS2_32.dll		12
WS2_32.dll		8
WS2_32.dll		55
WS2_32.dll		9
WS2_32.dll		51
WS2_32.dll		15
WS2_32.dll		56
WS2_32.dll	5		WSAAddressToStringA
WS2_32.dll		112
WS2_32.dll		7
WS2_32.dll		5
SHLWAPI.dll	85		PathIsURLA
SHLWAPI.dll	266		StrTrimA
SHLWAPI.dll	104		PathRemoveBlanksW
SHLWAPI.dll	103		PathRemoveBlanksA
SHLWAPI.dll	43		PathFindFileNameA
SHLWAPI.dll	282		UrlGetPartA
SHLWAPI.dll	248		StrRetToBufA
SHLWAPI.dll	140		SHDeleteKeyA

show previews

offset	size	type	comment
0	233472	DLL	07/18/2012 17:40:28	#
15c1	15	HTM		#
39000	106496	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 339968 bytes (332 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK