filename | _00B70000.mem | |
---|---|---|
size | 339968 (0x53000) | |
md5 | 67ea75b78328e2c13b8dacce7f7a8737 | |
type | PE32 executable (DLL) (GUI) Intel 80386, for MS Windows | |
mimetype | application/x-dosexec | |
clamav | OK | |
virustotal | → scan with virustotal.com | |
histogram |
MZ Header
signature | MZ |
bytes_in_last_block | 0x90 |
blocks_in_file | 3 |
num_relocs | 0 |
header_paragraphs | 4 |
min_extra_paragraphs | 0 |
max_extra_paragraphs | 0xffff |
ss | 0 |
sp | 0xb8 |
checksum | 0 |
ip | 0 |
cs | 0 |
reloc_table_offset | 0x40 |
overlay_number | 0 |
reserved0 | 0 |
oem_id | 0 |
oem_info | 0 |
reserved2 | 0 |
reserved3 | 0 |
reserved4 | 0 |
reserved5 | 0 |
reserved6 | 0 |
lfanew | 0x110 |
Rich Header
lib id | version | times used |
---|---|---|
95 | 2179 | 1 |
25 | 9210 | 4 |
28 | 9178 | 1 |
93 | 2179 | 10 |
4 | 8168 | 2 |
10 | 8168 | 4 |
93 | 6030 | 3 |
1 | 0 | 196 |
96 | 6030 | 45 |
14 | 7299 | 8 |
95 | 3077 | 3 |
15 | 3077 | 1 |
90 | 6030 | 1 |
DOS stub
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th| 00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno| 00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS | 00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
PE Header
Packer / Compiler
Sections
name | va | vsize | raw size | flags | |
---|---|---|---|---|---|
.text | 0x1000 | 0x2ac82 | 0x2b000 | R-X CODE | |
.rdata | 0x2c000 | 0x5c44 | 0x6000 | R-- IDATA | |
.data | 0x32000 | 0x1db6c | 0x4000 | RW- IDATA | |
.reloc | 0x50000 | 0x29b4 | 0x3000 | R-- IDATA DISCARDABLE |
Data Directory
type | va | size | |
---|---|---|---|
EXPORT | 0 | 0 | |
IMPORT | 0x30c5c | 0xc8 | |
RESOURCE | 0 | 0 | |
EXCEPTION | 0 | 0 | |
SECURITY | 0 | 0 | |
BASERELOC | 0x50000 | 0x1f10 | |
DEBUG | 0 | 0 | |
ARCHITECTURE | 0 | 0 | |
GLOBALPTR | 0 | 0 | |
TLS | 0 | 0 | |
LOAD_CONFIG | 0 | 0 | |
Bound_IAT | 0 | 0 | |
IAT | 0x2c000 | 0x314 | |
Delay_IAT | 0 | 0 | |
CLR_Header | 0 | 0 |
module_name | hint | ord | function_name |
---|---|---|---|
ntdll.dll | 2 | NtSetInformationProcess | |
ntdll.dll | NtQueryInformationProcess | ||
MSVCRT.dll | 720 | time | |
MSVCRT.dll | 157 | _adjust_fdiv | |
MSVCRT.dll | 657 | malloc | |
MSVCRT.dll | 271 | _initterm | |
MSVCRT.dll | 606 | free | |
MSVCRT.dll | 707 | strrchr | |
MSVCRT.dll | 693 | sscanf | |
MSVCRT.dll | 708 | strspn | |
MSVCRT.dll | 456 | _strrev | |
MSVCRT.dll | 676 | qsort | |
MSVCRT.dll | 624 | isalnum | |
MSVCRT.dll | 670 | printf | |
MSVCRT.dll | 703 | strncat | |
MSVCRT.dll | 449 | _stricmp | |
MSVCRT.dll | 752 | wcstol | |
MSVCRT.dll | 742 | wcslen | |
MSVCRT.dll | 739 | wcscpy | |
MSVCRT.dll | 704 | strncmp | |
MSVCRT.dll | 664 | memmove | |
MSVCRT.dll | 453 | _strnicmp | |
MSVCRT.dll | 451 | _strlwr | |
MSVCRT.dll | 661 | memchr | |
MSVCRT.dll | 385 | _memicmp | |
MSVCRT.dll | 699 | strcspn | |
MSVCRT.dll | 692 | srand | |
MSVCRT.dll | 678 | rand | |
MSVCRT.dll | 351 | _mbsicmp | |
MSVCRT.dll | 380 | _mbsstr | |
MSVCRT.dll | 663 | memcpy | |
MSVCRT.dll | 662 | memcmp | |
MSVCRT.dll | 749 | wcsstr | |
MSVCRT.dll | 712 | strtol | |
MSVCRT.dll | 711 | strtok | |
MSVCRT.dll | 574 | atol | |
MSVCRT.dll | 200 | _errno | |
MSVCRT.dll | 431 | _snwprintf | |
MSVCRT.dll | 473 | _ultoa | |
MSVCRT.dll | 694 | strcat | |
MSVCRT.dll | 690 | sprintf | |
MSVCRT.dll | 695 | strchr | |
MSVCRT.dll | 696 | strcmp | |
MSVCRT.dll | 705 | strncpy | |
MSVCRT.dll | 665 | memset | |
MSVCRT.dll | 713 | strtoul | |
MSVCRT.dll | 430 | _snprintf | |
MSVCRT.dll | 709 | strstr | |
MSVCRT.dll | 698 | strcpy | |
MSVCRT.dll | 702 | strlen | |
KERNEL32.dll | 777 | SetEvent | |
KERNEL32.dll | 663 | QueryPerformanceCounter | |
KERNEL32.dll | 175 | ExitProcess | |
KERNEL32.dll | 714 | RtlUnwind | |
KERNEL32.dll | 879 | VerSetConditionMask | |
KERNEL32.dll | 881 | VerifyVersionInfoA | |
KERNEL32.dll | 478 | GetVersion | |
KERNEL32.dll | 839 | Sleep | |
KERNEL32.dll | 518 | HeapAlloc | |
KERNEL32.dll | 411 | GetProcessHeap | |
KERNEL32.dll | 524 | HeapFree | |
KERNEL32.dll | 483 | GetVolumeNameForVolumeMountPointA | |
KERNEL32.dll | 481 | GetVolumeInformationA | |
KERNEL32.dll | 201 | FindFirstFileA | |
KERNEL32.dll | 197 | FindClose | |
KERNEL32.dll | 73 | CreateEventA | |
KERNEL32.dll | 176 | ExitThread | |
KERNEL32.dll | 239 | FreeLibrary | |
KERNEL32.dll | 408 | GetProcAddress | |
KERNEL32.dll | 584 | LoadLibraryA | |
KERNEL32.dll | 441 | GetSystemDirectoryA | |
KERNEL32.dll | 537 | InitializeCriticalSection | |
KERNEL32.dll | 122 | DeleteCriticalSection | |
KERNEL32.dll | 318 | GetCurrentThreadId | |
KERNEL32.dll | 583 | LeaveCriticalSection | |
KERNEL32.dll | 143 | EnterCriticalSection | |
KERNEL32.dll | 46 | CloseHandle | |
KERNEL32.dll | 105 | CreateThread | |
KERNEL32.dll | 373 | GetModuleFileNameA | |
KERNEL32.dll | 543 | InterlockedExchange | |
KERNEL32.dll | 315 | GetCurrentProcessId | |
KERNEL32.dll | 848 | TerminateThread | |
KERNEL32.dll | 230 | FlushInstructionCache | |
KERNEL32.dll | 314 | GetCurrentProcess | |
KERNEL32.dll | 889 | VirtualProtect | |
KERNEL32.dll | 886 | VirtualFree | |
KERNEL32.dll | 883 | VirtualAlloc | |
KERNEL32.dll | 361 | GetLastError | |
KERNEL32.dll | 594 | LocalFree | |
KERNEL32.dll | 140 | DuplicateHandle | |
KERNEL32.dll | 634 | OpenProcess | |
KERNEL32.dll | 652 | Process32Next | |
KERNEL32.dll | 654 | ProcessIdToSessionId | |
KERNEL32.dll | 650 | Process32First | |
KERNEL32.dll | 108 | CreateToolhelp32Snapshot | |
KERNEL32.dll | 375 | GetModuleHandleA | |
KERNEL32.dll | 795 | SetLastError | |
KERNEL32.dll | 512 | GlobalUnlock | |
KERNEL32.dll | 505 | GlobalLock | |
KERNEL32.dll | 956 | lstrlenA | |
KERNEL32.dll | 957 | lstrlenW | |
KERNEL32.dll | 822 | SetThreadPriority | |
KERNEL32.dll | 465 | GetThreadPriority | |
KERNEL32.dll | 317 | GetCurrentThread | |
KERNEL32.dll | 619 | MultiByteToWideChar | |
KERNEL32.dll | 546 | InterlockedIncrement | |
KERNEL32.dll | 542 | InterlockedDecrement | |
KERNEL32.dll | 469 | GetTickCount | |
KERNEL32.dll | 448 | GetSystemTimeAsFileTime | |
KERNEL32.dll | 632 | OpenMutexA | |
KERNEL32.dll | 90 | CreateMutexA | |
KERNEL32.dll | 694 | ReleaseMutex | |
KERNEL32.dll | 899 | WaitForSingleObject | |
ADVAPI32.dll | 523 | RevertToSelf | |
ADVAPI32.dll | 29 | AllocateAndInitializeSid | |
ADVAPI32.dll | 216 | EqualSid | |
ADVAPI32.dll | 225 | FreeSid | |
ADVAPI32.dll | 431 | OpenThreadToken | |
ADVAPI32.dll | 318 | IsValidSid | |
ADVAPI32.dll | 246 | GetLengthSid | |
ADVAPI32.dll | 90 | CopySid | |
ADVAPI32.dll | 480 | RegOpenCurrentUser | |
ADVAPI32.dll | 306 | InitializeSecurityDescriptor | |
ADVAPI32.dll | 559 | SetSecurityDescriptorDacl | |
ADVAPI32.dll | 85 | ConvertStringSecurityDescriptorToSecurityDescriptorA | |
ADVAPI32.dll | 269 | GetSecurityDescriptorSacl | |
ADVAPI32.dll | 563 | SetSecurityDescriptorSacl | |
ADVAPI32.dll | 470 | RegEnumKeyExA | |
ADVAPI32.dll | 505 | RegSetValueExA | |
ADVAPI32.dll | 302 | ImpersonateLoggedOnUser | |
ADVAPI32.dll | 543 | SetEntriesInAclA | |
ADVAPI32.dll | 564 | SetSecurityInfo | |
ADVAPI32.dll | 281 | GetTokenInformation | |
ADVAPI32.dll | 426 | OpenProcessToken | |
ADVAPI32.dll | 333 | LookupPrivilegeValueA | |
ADVAPI32.dll | 28 | AdjustTokenPrivileges | |
ADVAPI32.dll | 479 | RegNotifyChangeKeyValue | |
ADVAPI32.dll | 469 | RegEnumKeyA | |
ADVAPI32.dll | 487 | RegQueryInfoKeyA | |
ADVAPI32.dll | 492 | RegQueryValueExA | |
ADVAPI32.dll | 482 | RegOpenKeyExA | |
ADVAPI32.dll | 461 | RegCreateKeyExA | |
ADVAPI32.dll | 466 | RegDeleteValueA | |
ADVAPI32.dll | 473 | RegEnumValueA | |
ADVAPI32.dll | 457 | RegCloseKey | |
SHELL32.dll | 167 | SHGetDesktopFolder | |
SHELL32.dll | 194 | SHGetSpecialFolderLocation | |
ole32.dll | 58 | CoInitialize | |
ole32.dll | 16 | CoCreateInstance | |
ole32.dll | 104 | CoUninitialize | |
ole32.dll | 100 | CoTaskMemFree | |
ole32.dll | 59 | CoInitializeEx | |
WININET.dll | 154 | InternetReadFile | |
WININET.dll | 87 | HttpQueryInfoA | |
WININET.dll | 173 | InternetSetStatusCallback | |
WININET.dll | 167 | InternetSetOptionA | |
WININET.dll | 105 | InternetCloseHandle | |
WININET.dll | 89 | HttpSendRequestA | |
WININET.dll | 80 | HttpAddRequestHeadersA | |
WININET.dll | 85 | HttpOpenRequestA | |
WININET.dll | 111 | InternetConnectA | |
WININET.dll | 146 | InternetOpenA | |
WININET.dll | 113 | InternetCrackUrlA | |
WININET.dll | 152 | InternetQueryOptionA | |
WININET.dll | 147 | InternetOpenUrlA | |
WININET.dll | 128 | InternetGetConnectedState | |
WS2_32.dll | 11 | ||
WS2_32.dll | 111 | ||
WS2_32.dll | 52 | ||
WS2_32.dll | 12 | ||
WS2_32.dll | 8 | ||
WS2_32.dll | 55 | ||
WS2_32.dll | 9 | ||
WS2_32.dll | 51 | ||
WS2_32.dll | 15 | ||
WS2_32.dll | 56 | ||
WS2_32.dll | 5 | WSAAddressToStringA | |
WS2_32.dll | 112 | ||
WS2_32.dll | 7 | ||
WS2_32.dll | 5 | ||
SHLWAPI.dll | 85 | PathIsURLA | |
SHLWAPI.dll | 266 | StrTrimA | |
SHLWAPI.dll | 104 | PathRemoveBlanksW | |
SHLWAPI.dll | 103 | PathRemoveBlanksA | |
SHLWAPI.dll | 43 | PathFindFileNameA | |
SHLWAPI.dll | 282 | UrlGetPartA | |
SHLWAPI.dll | 248 | StrRetToBufA | |
SHLWAPI.dll | 140 | SHDeleteKeyA |
Scanning the drive for archives: 1 file, 339968 bytes (332 KiB) Errors: 1
Please donate some bucks to keep this site up and running: | |
Ko-fi | |
---|---|
Yandex.Money | |
Thank you! |
everything is OK