filenamedecb2ae018e3af596db1369ae8fc157a1448d07be91789a7c3736108134c6419.bin
size114688 (0x1c000)
md57ca93d8651b7b1695a3ce56bb842c5a1
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
14729974
198034138
198034127
14729941
1980341
19803431
00180
14729932
00135

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x47388c6e
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x15000
SizeOfInitializedData0x122000
SizeOfUninitializedData0
AddressOfEntryPoint0x15086
BaseOfCode0x1000
BaseOfData0x16000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x138000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x143440x15000R-X CODE
.rdata0x160000x31820x4000R-- IDATA
.data0x1a0000x11c0b40x1000RW- IDATA
.rsrc0x1370000xd80x1000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x1671c0x1a4
RESOURCE0x1370000xd8
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x160000x6c4
Delay_IAT00
CLR_Header00
typenamesizecp
DIALOG#396901140
module_namehintordfunction_name
GDI32.dll3AddFontResourceA
MPR.dll60WNetGetUniversalNameW
MPR.dll24WNetDisconnectDialog
MPR.dll14WNetCancelConnectionA
MPR.dll8WNetAddConnection3A
MPR.dll40WNetGetConnectionW
MPR.dll19WNetConnectionDialog1A
MPR.dll44WNetGetLastErrorA
Msi.dll24
Msi.dll23
Msi.dll47
Msi.dll25
Msi.dll74
Msi.dll41
OLEACC.dllAccessibleChildren
OLEACC.dll9GetStateTextA
RASAPI32.dll72RasSetEntryDialParamsA
RASAPI32.dll34RasGetConnectStatusA
RASAPI32.dll24RasEnumEntriesA
RASAPI32.dll43RasGetEntryDialParamsW
RASAPI32.dll75RasSetEntryPropertiesW
RASAPI32.dll58RasHangUpW
RASAPI32.dll20RasEnumConnectionsW
RASAPI32.dll16RasEditPhonebookEntryW
RASAPI32.dll79RasValidateEntryNameA
RASAPI32.dll15RasEditPhonebookEntryA
RASAPI32.dll52RasGetProjectionInfoW
KERNEL32.dll261GetDriveTypeW
KERNEL32.dll142FindAtomA
KERNEL32.dll4AllocConsole
KERNEL32.dll87DeleteFileA
KERNEL32.dll272GetFileAttributesW
KERNEL32.dll317GetPrivateProfileStructW
KERNEL32.dll356GetTempFileNameW
KERNEL32.dll374GetVersionExW
KERNEL32.dll340GetStringTypeExA
KERNEL32.dll402GlobalUnfix
KERNEL32.dll280GetHandleInformation
KERNEL32.dll177FreeConsole
KERNEL32.dll52CreateFileA
KERNEL32.dll358GetTempPathW
KERNEL32.dll8BackupSeek
KERNEL32.dll510Process32Next
KERNEL32.dll270GetFileAttributesExA
KERNEL32.dll49CreateEventA
KERNEL32.dll303GetNumberOfConsoleInputEvents
KERNEL32.dll11Beep
KERNEL32.dll248GetCurrentProcessId
KERNEL32.dll25ClearCommError
KERNEL32.dll197GetCommMask
KERNEL32.dll251GetDateFormatA
KERNEL32.dll313GetPrivateProfileSectionW
KERNEL32.dll344GetSystemDefaultLangID
KERNEL32.dll375GetVolumeInformationA
KERNEL32.dll156FindNextChangeNotification
KERNEL32.dll267GetExitCodeProcess
KERNEL32.dll116EnumResourceTypesW
KERNEL32.dll139FillConsoleOutputAttribute
KERNEL32.dll173FoldStringA
KERNEL32.dll413HeapDestroy
KERNEL32.dll309GetPrivateProfileIntW
KERNEL32.dll50CreateEventW
KERNEL32.dll37ContinueDebugEvent
KERNEL32.dll362GetThreadPriorityBoost
KERNEL32.dll308GetPrivateProfileIntA
KERNEL32.dll74CreateThread
KERNEL32.dll370GetUserDefaultLangID
KERNEL32.dll334GetShortPathNameA
KERNEL32.dllAddAtomA
KERNEL32.dll24ClearCommBreak
KERNEL32.dll191GetCPInfo
KERNEL32.dll199GetCommProperties
KERNEL32.dll246GetCurrentDirectoryW
KERNEL32.dll282GetLastError
KERNEL32.dll112EnumResourceLanguagesW
KERNEL32.dll122EnumTimeFormatsW
KERNEL32.dll107EnumDateFormatsA
KERNEL32.dll336GetStartupInfoA
KERNEL32.dll17BuildCommDCBW
KERNEL32.dll198GetCommModemStatus
KERNEL32.dll133FatalAppExitA
KERNEL32.dll294GetModuleHandleA
KERNEL32.dll224GetConsoleCursorInfo
ADVAPI32.dll295LsaSetDomainInformationPolicy
ADVAPI32.dll27AreAnyAccessesGranted
COMCTL32.dll3CreatePropertySheetPageW
COMCTL32.dll6
COMCTL32.dll46ImageList_GetIcon
COMCTL32.dll18FlatSB_GetScrollInfo
COMCTL32.dll36ImageList_DragLeave
COMCTL32.dll17
COMCTL32.dll59ImageList_SetBkColor
COMCTL32.dll31ImageList_BeginDrag
COMCTL32.dll74PropertySheetW
COMCTL32.dll73PropertySheetA
COMCTL32.dll3
COMCTL32.dll33ImageList_Create
COMCTL32.dll53ImageList_LoadImageW
COMCTL32.dll19FlatSB_GetScrollPos
COMCTL32.dll21FlatSB_GetScrollRange
ole32.dll197OleGetAutoConvert
ole32.dll30CoGetCurrentProcess
ole32.dll63CoRegisterMallocSpy
ole32.dll185OleCreateLinkEx
ole32.dll136HGLOBAL_UserFree
ole32.dll203OleIsCurrentClipboard
ole32.dll69CoResumeClassObjects
ole32.dll205OleLoad
ole32.dll82CoTreatAsClass
ole32.dll36CoGetObject
ole32.dll255StgCreatePropSetStg
ole32.dll92CreateDataCache
ole32.dll102CreateStreamOnHGlobal
ole32.dll97CreateItemMoniker
ole32.dll200OleGetIconOfFile
ole32.dll94CreateFileMoniker
ole32.dll235ReadClassStm
ole32.dll140HMENU_UserFree
ole32.dll123HACCEL_UserUnmarshal
ole32.dll154HPALETTE_UserSize
ole32.dll137HGLOBAL_UserMarshal
ole32.dll78CoTaskMemAlloc
ole32.dll223OleTranslateAccelerator
ole32.dll199OleGetIconOfClass
ole32.dll262StgOpenAsyncDocfileOnIFillLockBytes
ole32.dll194OleDraw
ole32.dll218OleSaveToStream
ole32.dll179OleCreateEx
ole32.dll21CoFreeLibrary
ole32.dll249STGMEDIUM_UserUnmarshal
ole32.dll253StgCreateDocfile
ole32.dll120HACCEL_UserFree
ole32.dll157HWND_UserMarshal
ole32.dll67CoReleaseMarshalData
ole32.dll209OleNoteObjectVisible
ole32.dll80CoTaskMemRealloc
ole32.dll42CoGetStdMarshalEx
ole32.dll64CoRegisterMessageFilter
ole32.dll187OleCreateLinkFromDataEx
ole32.dll86CoUnmarshalInterface
ole32.dll124HBITMAP_UserFree
ole32.dll119GetRunningObjectTable
ole32.dll56CoMarshalInterface
ole32.dll175OleConvertOLESTREAMToIStorageEx
ole32.dll66CoRegisterSurrogate
LZ32.dll8LZOpenFileW
USER32.dll385IsCharLowerA
USER32.dll503RegisterClipboardFormatW
USER32.dll301GetMessageTime
USER32.dll533SendMessageCallbackA
USER32.dll41CharPrevExA
USER32.dll569SetMenuItemBitmaps
USER32.dll333GetUpdateRect
USER32.dll534SendMessageCallbackW
USER32.dll471OpenInputDesktop
USER32.dll146DialogBoxIndirectParamW
USER32.dll548SetClipboardViewer
USER32.dll117DdeQueryConvInfo
USER32.dll21CallNextHookEx
USER32.dll517RemovePropA
USER32.dll677WaitMessage
USER32.dll597SetUserObjectSecurity
USER32.dll345GetWindowModuleFileNameA
USER32.dll442MenuItemFromPoint
USER32.dll137DestroyAcceleratorTable
USER32.dll522ScreenToClient
USER32.dll176DrawTextExA
USER32.dll95DdeAddData
USER32.dll525ScrollWindow
USER32.dll644UnhookWinEvent
USER32.dll451MessageBoxW
USER32.dll9ArrangeIconicWindows
USER32.dll445MessageBeep
USER32.dll351GetWindowTextLengthA
USER32.dll296GetMenuStringA
USER32.dll115DdeNameService
USER32.dll306GetNextDlgGroupItem
USER32.dll81CreateIcon
USER32.dll465OemToCharW
USER32.dll336GetUserObjectInformationW
USER32.dll85CreateMDIWindowA
USER32.dll228GetCapture
USER32.dll45CharToOemBuffW
USER32.dll69CountClipboardFormats
USER32.dll388IsCharUpperW
USER32.dll181EnableMenuItem
USER32.dll524ScrollDC
USER32.dll610SetWindowsHookExA
USER32.dll235GetClassLongA
USER32.dll328GetTabbedTextExtentW
USER32.dll191EnumDesktopWindows
USER32.dll633ToUnicode
USER32.dll440MapVirtualKeyW
USER32.dll87CreateMenu
USER32.dll352GetWindowTextLengthW
USER32.dll476PeekMessageA
USER32.dll207EnumWindowStationsW
USER32.dll616ShowScrollBar
USER32.dll238GetClassNameW
USER32.dll300GetMessagePos
USER32.dll256GetDialogBaseUnits
USER32.dll215FindWindowExW
USER32.dll582SetScrollInfo
USER32.dll173DrawStateA
USER32.dll73CreateCursor
USER32.dll540SetActiveWindow
USER32.dll415LoadIconW
USER32.dll155DlgDirSelectComboBoxExA
USER32.dll53CheckMenuRadioItem
USER32.dll142DestroyWindow
USER32.dll320GetScrollRange
USER32.dll550SetCursor
USER32.dll204EnumPropsW
USER32.dll625SystemParametersInfoA
USER32.dll227GetAsyncKeyState
USER32.dll337GetUserObjectSecurity
USER32.dll169DrawIcon
USER32.dll158DlgDirSelectExW
USER32.dll583SetScrollPos
USER32.dll174DrawStateW
USER32.dll666ValidateRect
USER32.dll642TranslateMessage
USER32.dll307GetNextDlgTabItem
USER32.dll407LoadAcceleratorsW
USER32.dll92CreateWindowStationW
USER32.dll151DlgDirListA
USER32.dll389IsChild
USER32.dll535SendMessageTimeoutA
USER32.dll1AdjustWindowRect
USER32.dll147DialogBoxParamA
USER32.dll411LoadCursorFromFileA
USER32.dll378InvalidateRect
USER32.dll581SetRectEmpty
USER32.dll422LoadMenuA
USER32.dll468OpenDesktopA
USER32.dll498RegisterClassA
USER32.dll330GetThreadDesktop
USER32.dll464OemToCharBuffW
USER32.dll363IMPQueryIMEW
USER32.dll44CharToOemBuffA
USER32.dll134DeferWindowPos
USER32.dll75CreateDesktopW
USER32.dll193EnumDesktopsW
USER32.dll245GetClipboardOwner
USER32.dll477PeekMessageW
USER32.dll90CreateWindowExW
USER32.dll219FrameRect
USER32.dll243GetClipboardFormatNameA
USER32.dll32ChangeMenuW
USER32.dll26ChangeClipboardChain
USER32.dll79CreateDialogParamA
USER32.dll618ShowWindow
USER32.dll335GetUserObjectInformationA
USER32.dll286GetMenuCheckMarkDimensions
USER32.dll497RedrawWindow
USER32.dll58ClientToScreen
USER32.dll640TranslateAcceleratorW
USER32.dll332GetTopWindow
USER32.dll449MessageBoxIndirectA
USER32.dll452ModifyMenuA
USER32.dll129DefFrameProcW
USER32.dll458MsgWaitForMultipleObjects
USER32.dll515ReleaseDC
USER32.dll343GetWindowLongW
USER32.dll91CreateWindowStationA
USER32.dll233GetClassInfoExW
USER32.dll563SetLastErrorEx
USER32.dll479PostMessageW
USER32.dll639TranslateAcceleratorA
USER32.dll46CharToOemW
MSVCRT.dll183_controlfp
MSVCRT.dll129__set_app_type
MSVCRT.dll111__p__fmode
MSVCRT.dll106__p__commode
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll131__setusermatherr
MSVCRT.dll271_initterm
MSVCRT.dll88__getmainargs
MSVCRT.dll143_acmdln
MSVCRT.dll202_except_handler3
MSVCRT.dll585exit
MSVCRT.dll72_XcptFilter
MSVCRT.dll211_exit
OLEAUT32.dll75
OLEAUT32.dll114
OLEAUT32.dll234
OLEAUT32.dll323
OLEAUT32.dll36
OLEAUT32.dll292
IMM32.dll20ImmGetCandidateListA
IMM32.dll25ImmGetCompositionFontA
WININET.dll117InternetQueryOptionA
RPCRT4.dll333RpcMgmtEpEltInqBegin
RPCRT4.dll409RpcSsDontSerializeContext
RPCRT4.dll398RpcSmDestroyClientContext
RPCRT4.dll87MesIncrementalHandleReset
RPCRT4.dll257NdrSimpleStructMemorySize
RPCRT4.dll297RpcBindingInqAuthClientW
RPCRT4.dll311RpcBindingSetOption
RPCRT4.dll205NdrNonConformantStringMarshall
RPCRT4.dll57I_RpcSend
RPCRT4.dll449short_from_ndr
RPCRT4.dll446long_from_ndr
RPCRT4.dll124NdrComplexStructMemorySize
RPCRT4.dll56I_RpcRequestMutex
RPCRT4.dll279NdrXmitOrRepAsFree
RPCRT4.dll442enum_from_ndr
RPCRT4.dll133NdrConformantStringMemorySize
RPCRT4.dll334RpcMgmtEpEltInqDone
RPCRT4.dll147NdrConformantVaryingStructMarshall
RPCRT4.dll364RpcProtseqVectorFreeW
RPCRT4.dll302RpcBindingInqObject
RPCRT4.dll165NdrEncapsulatedUnionMarshall
RPCRT4.dll224NdrPointerMarshall
RPCRT4.dll305RpcBindingServerFromClient
RPCRT4.dll281NdrXmitOrRepAsMemorySize
RPCRT4.dll379RpcServerUnregisterIf
RPCRT4.dll214NdrNsSendReceive
RPCRT4.dll282NdrXmitOrRepAsUnmarshall
RPCRT4.dll86MesHandleFree
RPCRT4.dll163NdrEncapsulatedUnionBufferSize
RPCRT4.dll375RpcServerRegisterAuthInfoW
RPCRT4.dll225NdrPointerMemorySize
RPCRT4.dll251NdrServerInitializeUnmarshall
RPCRT4.dll122NdrComplexStructFree
RPCRT4.dll301RpcBindingInqAuthInfoW
RPCRT4.dll22I_RpcAsyncAbortCall
RPCRT4.dll351RpcMgmtStatsVectorFree
RPCRT4.dll94NDRSContextMarshallEx
RPCRT4.dll103NdrByteCountPointerBufferSize
RPCRT4.dll138NdrConformantStructMemorySize
RPCRT4.dll204NdrNonConformantStringBufferSize
RPCRT4.dll324RpcEpUnregister
RPCRT4.dll27I_RpcBindingInqDynamicEndpointW
RPCRT4.dll144NdrConformantVaryingArrayUnmarshall
RPCRT4.dll389RpcServerUseProtseqExA
RPCRT4.dll60I_RpcServerInqTransportType
RPCRT4.dll396RpcSmAllocate
RPCRT4.dll342RpcMgmtInqServerPrincNameA
RPCRT4.dll235NdrRpcSmSetClientToOsf
RPCRT4.dll404RpcSmSetThreadHandle
RPCRT4.dll300RpcBindingInqAuthInfoExW
RPCRT4.dll451tree_into_ndr
RPCRT4.dll397RpcSmClientFree
RPCRT4.dll419RpcStringBindingParseW
RPCRT4.dll286RpcAsyncAbortCall
RPCRT4.dll295RpcBindingFromStringBindingW
RPCRT4.dll370RpcServerInqDefaultPrincNameA
RPCRT4.dll104NdrByteCountPointerFree
RPCRT4.dll92NDRSContextMarshall
RPCRT4.dll113NdrClientContextUnmarshall
RPCRT4.dll312RpcBindingToStringBindingA
RPCRT4.dll34I_RpcConnectionSetSockBuffSize
RPCRT4.dll153NdrConvert2
RPCRT4.dll352RpcMgmtStopServerListening
RPCRT4.dll83MesEncodeDynBufferHandleCreate
RPCRT4.dll26I_RpcBindingInqDynamicEndpointA
RPCRT4.dll395RpcServerUseProtseqW
RPCRT4.dll174NdrFullPointerFree
RPCRT4.dll146NdrConformantVaryingStructFree
RPCRT4.dll248NdrServerInitializeMarshall
RPCRT4.dll307RpcBindingSetAuthInfoExA
RPCRT4.dll339RpcMgmtInqDefaultProtectLevel
RPCRT4.dll243NdrServerContextMarshall
RPCRT4.dll193NdrInterfacePointerUnmarshall
SHLWAPI.dll79PathRemoveArgsA
SHLWAPI.dll60PathIsUNCServerA
SHLWAPI.dll19PathCommonPrefixA
RESUTILS.dll23ResUtilGetPropertiesToParameterBlock
RESUTILS.dll46ResUtilVerifyPrivatePropertyList
RESUTILS.dll45ResUtilStopService
CLUSAPI.dll18ClusterNetworkCloseEnum
CLUSAPI.dll1AddClusterResourceNode
CLUSAPI.dll42ClusterResourceOpenEnum
CLUSAPI.dll90SetClusterName
CLUSAPI.dll53GetClusterGroupKey
CLUSAPI.dll70GetClusterResourceState
CLUSAPI.dll64GetClusterNodeKey
CLUSAPI.dll14ClusterGroupControl
CLUSAPI.dll47CreateClusterResourceType
CLUSAPI.dll72MoveClusterGroup
CLUSAPI.dll62GetClusterNetworkState
CLUSAPI.dll24ClusterNodeEnum
CLUSAPI.dll51EvictClusterNode
CLUSAPI.dll2CanResourceBeDependent
CLUSAPI.dll48DeleteClusterGroup
CLUSAPI.dll79OpenClusterNetInterface
CLUSAPI.dll80OpenClusterNetwork
CLUSAPI.dll67GetClusterQuorumResource
CLUSAPI.dll85RemoveClusterResourceDependency
CLUSAPI.dll10CloseClusterResource
CLUSAPI.dll61GetClusterNetworkKey
CLUSAPI.dll17ClusterNetInterfaceControl
CLUSAPI.dll77OpenCluster
urlmon.dll30FindMediaType
urlmon.dll40HlinkNavigateString
urlmon.dll49ObtainUserAgentString
urlmon.dll46IsValidURL
urlmon.dll37HlinkGoBack
urlmon.dll44IsLoggingEnabledA
urlmon.dll22CreateURLMoniker
urlmon.dll39HlinkNavigateMoniker
urlmon.dll16CopyBindInfo
urlmon.dll34GetClassURL
urlmon.dll73UrlMkSetSessionOption
urlmon.dll68URLOpenPullStreamW
urlmon.dll65URLOpenBlockingStreamA
urlmon.dll19CreateAsyncBindCtxEx
urlmon.dll69URLOpenStreamA
urlmon.dll61URLDownloadToCacheFileW
urlmon.dll12CoInternetGetSecurityUrl
urlmon.dll36GetSoftwareUpdateInfo
urlmon.dll58SetSoftwareUpdateAdvertisementState
offsetsizetypecomment
0114688EXE11/12/2007 17:25:02#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK