filenameWinHost32.exe
size82432 (0x14200)
md58f59992f33f4cd1ae942d50061073ca0
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
1492102216
1312102272
9540351
1235072715
10176
1322102227
148210221
145210221

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x57ac875e
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion9.0
SizeOfCode0x9600
SizeOfInitializedData0xb400
SizeOfUninitializedData0
AddressOfEntryPoint0x4395
BaseOfCode0x1000
BaseOfData0xb000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x18000
SizeOfHeaders0x400
CheckSum0x1bcfd
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x94040x9600R-X CODE
.rdata0xb0000x26a60x2800R-- IDATA
.data0xe0000x183c0xe00RW- IDATA
.rsrc0x100000x71100x7200R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0xc7f40xa0
RESOURCE0x100000x7110
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0xc4f80x40
Bound_IAT00
IAT0xb0000x2a8
Delay_IAT00
CLR_Header00
typenamesizecp
MENUQCAYXKBOX10860
DIALOG#124854340
DIALOG#145702980
DIALOG#259643320
STRING#129840
STRING#1311320
STRING#1331060
STRING#1401080
STRING#1551020
STRING#175740
STRING#1791060
STRING#1851380
STRING#1981160
STRING#2031140
STRING#205740
STRING#2121020
STRING#2841840
STRING#2901560
STRING#3011020
STRING#3061060
STRING#3121180
STRING#3341000
STRING#341580
STRING#345640
STRING#3511400
STRING#3531120
STRING#357660
STRING#3801480
STRING#3842560
STRING#387980
STRING#4081200
STRING#4221060
STRING#4291220
STRING#4361680
ACCELERATORSSDAIGSIQT480
RCDATA#33307204800
VERSION#16680
idlangstring
20551033huEGAH,ZUbiOEz,nStzyzIdBrZ
20931033pkAoYLzpLpL,SUvYfACÌbU,usvlHSunk,aZwcGpwv,rwivweÌU
21161033ZMDHZRDridZ,AfLxKarOtoDhOS,NTMKUvSADt
22241033hdpfnePfÌRNR,arNIuEiPÌhv,gVApFqaCXVooq
24761033RRYPWSziNVQr,KcNumSQYF,epkuUASPkMvI
27871033nPtYuZVR,DubtriyANZBZ
28571033HiiwZXfL,hhmdvkfcn,MDtBFiF,ripZvvdUnu
29451033ompowl,lzUGTtp,BhfQboDObis
29541033VrqSSqbHRoa,LkpsoK,DgMQChso
31521033BEzdOqod,tMZIsUZlLHQC,hnZtyLVIr,vXÌuAthsgg
32461033PSVKZxu,fmbGLQYhU,MkHZrt,RAguFPhhp,KtLPID
32641033RVlBup,FnlEmc,iOMuÌuw
33791033yiLzSeqY,pOcroKzsTs,QWeGQE,OPRSpIdO
45381033PxmZkctvQR,ÌGZkCSeReZ,gXnqBykwnGG
45431033mzGopHcxCNQ,ttsNo,KoNOibxri,ukcGk,pFeUFsPAV
46321033qBOoVc,bzuMdÌzZiPI,kYWdCqi,yObEsPSEM,qxdxMKzKXZIMFte,pLwrguOVm
48031033MFIuMfv,sFwiWIsTfYNzQ,SHppLMxsFFnAi
48871033hRQyO,NrXrNcx,FYKiX,AnkMEVZ,YhxvFiQCM
49871033ptUSwzS,uqRvTÌ,PKIusNge,Nblhpn,rSZBBnevbgkC
53401033MPFyce,rPWeuzCYKw,boTWXbqCB,pcKtHq
54421033uFbNdg,DredaS
55111033ypGYPXIGF,pUkNOe
56001033FQAFARKwÌ,dihXItlfLcN,RgrRCL,McVIUW,WrxMqlwdM,rBcqGVDc
56371033ifIQVSB,ETTngTY,rlNIOÌkQNblKpY,zYXTiTfFD
57091033NÌfsagDVbf,EgrWsÌ
60721033XULuMn,FvhtPuyThK,bgRFbOKWn,BzYqySeLRK,yQWXaQZEgBSz,vYKwMl
61301033ÌnMVpexTsbg,mEVdoNGi,bOrHwvaMgv,kSigLÌel,lZeNe,PRUGitIV,ropZwmQFM
61381033ÌSecTQz,KyVrkWm,vDzdWYuDWKodah,GrtfwYqi,xiYlhUa
61901033ICWpÌÌPHq,AVdkQtXHU,uhpNAnf,TRGoy
65171033WvzVBv,tAhrsz,OaANolhgNH,fZEnDSÌborpFL,rreYu
67421033pzyEmCw,nSFÌhMPCeGg,ncRbHgWkL,OaUHzhl
68511033gnFCQbGSnV,fyYmXueYlY,tnsrCLMIvtfCS,bGFtcBWLc
69651033LMNGmDG,wwSKcU,mXyiFAFFKlk,IAnnavLn,PCynqWX
69701033MNAIEa,TeisNYCYpsY,fKsnDq
module_namehintordfunction_name
KERNEL32.dll182DebugSetProcessKillOnExit
KERNEL32.dll186DefineDosDeviceW
KERNEL32.dll338GetACP
KERNEL32.dll347GetCPInfo
KERNEL32.dll737LCMapStringA
KERNEL32.dll573GetStringTypeA
KERNEL32.dll462GetFileAttributesW
KERNEL32.dll263ExpandEnvironmentStringsA
KERNEL32.dll672HeapDestroy
KERNEL32.dll1124WaitForSingleObject
KERNEL32.dll547GetProcessHeap
KERNEL32.dll569GetStartupInfoA
KERNEL32.dll771LocalUnlock
KERNEL32.dll979SetEvent
KERNEL32.dll208DosDateTimeToFileTime
KERNEL32.dll1194lstrcmpW
KERNEL32.dll853QueryPerformanceFrequency
KERNEL32.dll673HeapFree
KERNEL32.dll659GlobalReAlloc
KERNEL32.dll114CreateEventA
KERNEL32.dll487GetLocalTime
KERNEL32.dll267FatalAppExitA
KERNEL32.dll656GlobalLock
KERNEL32.dll564GetProfileStringW
KERNEL32.dll326FoldStringW
KERNEL32.dll815OpenMutexA
KERNEL32.dll794MultiByteToWideChar
KERNEL32.dll621GetUserDefaultLCID
KERNEL32.dll124CreateFileMappingW
KERNEL32.dll450GetEnvironmentVariableA
KERNEL32.dll1154WriteConsoleA
KERNEL32.dll163CreateThread
KERNEL32.dll1074TlsAlloc
KERNEL32.dll429GetCurrentThreadId
KERNEL32.dll1199lstrcpyA
KERNEL32.dll1070TerminateThread
KERNEL32.dll260ExitProcess
KERNEL32.dll442GetDriveTypeA
KERNEL32.dll576GetStringTypeW
KERNEL32.dll739LCMapStringW
KERNEL32.dll488GetLocaleInfoA
KERNEL32.dll678HeapSize
KERNEL32.dll914RtlUnwind
KERNEL32.dll676HeapReAlloc
KERNEL32.dll669HeapAlloc
KERNEL32.dll731IsValidCodePage
KERNEL32.dll531GetOEMCP
KERNEL32.dll693InitializeCriticalSectionAndSpinCount
KERNEL32.dll721IsDebuggerPresent
KERNEL32.dll1086UnhandledExceptionFilter
KERNEL32.dll425GetCurrentProcess
KERNEL32.dll1069TerminateProcess
KERNEL32.dll217EnterCriticalSection
KERNEL32.dll751LeaveCriticalSection
KERNEL32.dll591GetSystemTimeAsFileTime
KERNEL32.dll426GetCurrentProcessId
KERNEL32.dll614GetTickCount
KERNEL32.dll852QueryPerformanceCounter
KERNEL32.dll1111VirtualFree
KERNEL32.dll671HeapCreate
KERNEL32.dll700InterlockedDecrement
KERNEL32.dll1004SetLastError
KERNEL32.dll704InterlockedIncrement
KERNEL32.dll1075TlsFree
KERNEL32.dll1077TlsSetValue
KERNEL32.dll1076TlsGetValue
KERNEL32.dll190DeleteCriticalSection
KERNEL32.dll471GetFileType
KERNEL32.dll1000SetHandleCount
KERNEL32.dll449GetEnvironmentStringsW
KERNEL32.dll500GetModuleFileNameA
KERNEL32.dll312FindResourceExW
KERNEL32.dll915RtlZeroMemory
KERNEL32.dll148CreateProcessA
KERNEL32.dll324FlushViewOfFile
KERNEL32.dll1109VirtualAllocEx
KERNEL32.dll1174WriteProcessMemory
KERNEL32.dll1146WideCharToMultiByte
KERNEL32.dll331FreeEnvironmentStringsW
KERNEL32.dll1030SetThreadContext
KERNEL32.dll1118VirtualUnlock
KERNEL32.dll909ResumeThread
KERNEL32.dll486GetLastError
KERNEL32.dll310FindResourceA
KERNEL32.dll502GetModuleHandleA
KERNEL32.dll758LoadResource
KERNEL32.dll775LockResource
KERNEL32.dll756LoadLibraryW
KERNEL32.dll544GetProcAddress
KERNEL32.dll1108VirtualAlloc
KERNEL32.dll753LoadLibraryA
KERNEL32.dll447GetEnvironmentStrings
KERNEL32.dll330FreeEnvironmentStringsA
KERNEL32.dll367GetCommandLineA
KERNEL32.dll1045SetUnhandledExceptionFilter
KERNEL32.dll505GetModuleHandleW
KERNEL32.dll1057Sleep
KERNEL32.dll1165WriteFile
KERNEL32.dll571GetStdHandle
USER32.dll149DefWindowProcA
USER32.dll588ReleaseDC
USER32.dll483LoadStringA
USER32.dll540PeekMessageW
USER32.dll47CharNextW
USER32.dll539PeekMessageA
USER32.dll405HideCaret
USER32.dll211EndDialog
USER32.dll316GetMenu
USER32.dll441IsDialogMessageW
USER32.dll565RegisterClassExW
USER32.dll440IsDialogMessageA
USER32.dll392GetWindowRect
USER32.dll445IsIconic
USER32.dll165DialogBoxParamA
USER32.dll9AppendMenuA
USER32.dll674SetWinEventHook
USER32.dll768WinHelpW
USER32.dll152DeleteMenu
USER32.dll585RegisterWindowMessageA
USER32.dll364GetSysColor
USER32.dll391GetWindowPlacement
USER32.dll437IsChild
USER32.dll481LoadMenuW
USER32.dll606SendMessageA
USER32.dll289GetDlgItemTextA
USER32.dll367GetSystemMetrics
USER32.dll470LoadIconA
USER32.dll460IsZoomed
USER32.dll160DestroyWindow
USER32.dll71CloseClipboard
USER32.dll464LoadBitmapA
USER32.dll285GetDialogBaseUnits
USER32.dll166DialogBoxParamW
USER32.dll453IsWindow
USER32.dll526OffsetRect
USER32.dll504MessageBoxA
USER32.dll420InsertMenuItemA
USER32.dll158DestroyMenu
USER32.dll287GetDlgItem
USER32.dll684SetWindowTextW
USER32.dll207EnableMenuItem
USER32.dll12AttachThreadInput
USER32.dll200DrawTextW
GDI32.dll672TextOutW
GDI32.dll46CreateCompatibleDC
GDI32.dll484GetObjectW
GDI32.dll221EndPage
GDI32.dll663StartDocW
GDI32.dll205DeleteDC
GDI32.dll219EndDoc
WINSPOOL.DRV29ClosePrinter
COMDLG32.dll10GetFileTitleW
COMDLG32.dll11GetOpenFileNameA
COMDLG32.dll20PrintDlgExW
COMDLG32.dll13GetSaveFileNameA
COMDLG32.dllChooseColorA
ADVAPI32.dll546QueryServiceStatus
ADVAPI32.dll561RegCreateKeyA
ADVAPI32.dll83CloseServiceHandle
ADVAPI32.dll497OpenProcessToken
ADVAPI32.dll88ControlService
ADVAPI32.dll632RegSetValueExW
SHELL32.dll28DragFinish

StringTable 040904E7

CompanyNameSySoft, Corporation.
FileDescriptionWNhT
FileVersion9,25,8,7
LegalCopyrightCopyright 1992 - 2001
OriginalFilenameGAiRvqfNmMxDI.exe
ProductVersion9,25,8,7
ProductNameuFgRHgDfvM

VS_FIXEDFILEINFO

FileVersion9.25.8.7
ProductVersion9.25.8.7
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
082432EXE08/11/2016 14:10:38#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK