filenamedthlawka.exe
size159744 (0x27000)
md59b011c8f47d228d12160ca7cd6ca9c1f
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
1255072723
1105072752
10950727142
1235072719
10292
1145072726
124507271
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x547b5f4f
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10e
Magic0x10b
LinkerVersion6.0
SizeOfCode0
SizeOfInitializedData0x26000
SizeOfUninitializedData0
AddressOfEntryPoint0x33f0
BaseOfCode0x1000
BaseOfData0x1000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xa26000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

namevavsizeraw sizeflags
.rdata0x10000x8e80x1000R-- IDATA
.dwta��0x20000xa00d140x2000RW- IDATA
.idata0xa030000x9320x1000RW- IDATA
.rsrc0xa040000x1e2000x1f000R-- IDATA
.reloc0xa230000x2d300x3000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xa030000x78
RESOURCE0xa040000x1e200
EXCEPTION00
SECURITY00
BASERELOC0xa230000x600
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0xa034080x390
Delay_IAT00
CLR_Header00
typenamesizecp
16#781074001252
BITMAP#12810641252
ICON#196401252
MENU#1281081252
DIALOG#1002741252
DIALOG#13017981252
STRING#91621252
STRING#3585661252
STRING#36012301252
STRING#36021921252
STRING#36033101252
STRING#3604601252
STRING#3605961252
STRING#3606841252
STRING#3697581252
STRING#3713881252
STRING#38251641252
STRING#3826621252
STRING#3841581252
ACCELERATORS#1281121252
GROUP_ICON#1201252
#241#128301252
idlangstring
1282052roundabout_show Rounda Roundaboutshow.Document Rounda Document
573442052roundabout_show
573452052就绪
576002052建立新文档 新建
576012052打开一个现有文档 打开
576022052关闭活动文档 关闭
576032052保存活动文档 保存
576042052将活动文档以一个新文件名保存 另存为
576052052改变打印选项 页面设置
576062052改变打印机及打印选项 打印设置
576072052打印活动文档 打印
576092052显示整页 打印预览
576162052打开该文档
576172052打开该文档
576182052打开该文档
576192052打开该文档
576202052打开该文档
576212052打开该文档
576222052打开该文档
576232052打开该文档
576242052打开该文档
576252052打开该文档
576262052打开该文档
576272052打开该文档
576282052打开该文档
576292052打开该文档
576302052打开该文档
576312052打开该文档
576322052删除被选对象 删除
576332052全部删除 全部删除
576342052复制被选对象并将其置于剪贴板上 复制
576352052剪切被选对象并将其置于剪贴板上 剪切
576362052查找指定的正文 查找
576372052插入剪贴板内容 粘贴
576402052重复上一步操作 重复
576412052用不同的正文替换指定的正文 替换
576422052选择整个文档 选择全部
576432052撤消最后一步操作 撤消
576442052重新执行先前已撤消的操作 重新执行
576532052将活动的窗口分隔成窗格 分隔
576642052显示程序信息，版本号和版权 关于
576652052退出应用程序；提示保存文档 退出
576802052切换到下一个窗格 下一窗格
576812052切换回前一个窗格 前一窗格
591362052扩展名
591372052大写
591382052数字
591392052滚动
591402052改写
591412052记录
593922052显示或隐藏工具栏 显隐工具栏
593932052显示或隐藏状态栏 显隐状态栏
611842052改变窗口大小
611852052改变窗口位置
611862052将窗口缩小成图标
611872052把窗口放大到最大尺寸
611882052切换到下一个文档窗口
611892052切换到先前的文档窗口
611902052关闭活动的窗口并提示保存所有文档
612022052把窗口恢复到正常大小
612032052激活任务表
614452052关闭打印预览模式 取消预阅
module_namehintordfunction_name
MFC42u.DLL2382
MFC42u.DLL3054
MFC42u.DLL5094
MFC42u.DLL5097
MFC42u.DLL4461
MFC42u.DLL4298
MFC42u.DLL3345
MFC42u.DLL5006
MFC42u.DLL975
MFC42u.DLL5468
MFC42u.DLL3398
MFC42u.DLL2874
MFC42u.DLL2873
MFC42u.DLL4146
MFC42u.DLL6051
MFC42u.DLL4072
MFC42u.DLL1768
MFC42u.DLL4401
MFC42u.DLL5233
MFC42u.DLL2377
MFC42u.DLL5157
MFC42u.DLL6370
MFC42u.DLL4347
MFC42u.DLL5278
MFC42u.DLL2641
MFC42u.DLL1658
MFC42u.DLL3793
MFC42u.DLL4831
MFC42u.DLL4430
MFC42u.DLL2640
MFC42u.DLL2047
MFC42u.DLL6372
MFC42u.DLL3744
MFC42u.DLL5059
MFC42u.DLL1720
MFC42u.DLL2438
MFC42u.DLL2116
MFC42u.DLL5273
MFC42u.DLL2977
MFC42u.DLL3142
MFC42u.DLL3254
MFC42u.DLL4459
MFC42u.DLL3131
MFC42u.DLL3257
MFC42u.DLL2980
MFC42u.DLL3076
MFC42u.DLL2971
MFC42u.DLL3825
MFC42u.DLL3826
MFC42u.DLL3820
MFC42u.DLL3074
MFC42u.DLL4075
MFC42u.DLL4621
MFC42u.DLL4421
MFC42u.DLL796
MFC42u.DLL674
MFC42u.DLL554
MFC42u.DLL529
MFC42u.DLL366
MFC42u.DLL825
MFC42u.DLL807
MFC42u.DLL2486
MFC42u.DLL2619
MFC42u.DLL2618
MFC42u.DLL5996
MFC42u.DLL2109
MFC42u.DLL4158
MFC42u.DLL6617
MFC42u.DLL4451
MFC42u.DLL5248
MFC42u.DLL4609
MFC42u.DLL4606
MFC42u.DLL4604
MFC42u.DLL4269
MFC42u.DLL6371
MFC42u.DLL4480
MFC42u.DLL2546
MFC42u.DLL2504
MFC42u.DLL5727
MFC42u.DLL3917
MFC42u.DLL1089
MFC42u.DLL5193
MFC42u.DLL2388
MFC42u.DLL3341
MFC42u.DLL5296
MFC42u.DLL5298
MFC42u.DLL2717
MFC42u.DLL4074
MFC42u.DLL4692
MFC42u.DLL5303
MFC42u.DLL5285
MFC42u.DLL5710
MFC42u.DLL4616
MFC42u.DLL4418
MFC42u.DLL3733
MFC42u.DLL561
MFC42u.DLL815
MFC42u.DLL617
MFC42u.DLL2715
MFC42u.DLL5297
MFC42u.DLL5208
MFC42u.DLL296
MFC42u.DLL986
MFC42u.DLL520
MFC42u.DLL4154
MFC42u.DLL6113
MFC42u.DLL2613
MFC42u.DLL1131
MFC42u.DLL5261
MFC42u.DLL4370
MFC42u.DLL4847
MFC42u.DLL4992
MFC42u.DLL4704
MFC42u.DLL2506
MFC42u.DLL6048
MFC42u.DLL4073
MFC42u.DLL1767
MFC42u.DLL5237
MFC42u.DLL5276
MFC42u.DLL4435
MFC42u.DLL5257
MFC42u.DLL4419
MFC42u.DLL3592
MFC42u.DLL324
MFC42u.DLL641
MFC42u.DLL2354
MFC42u.DLL4229
MFC42u.DLL1817
MFC42u.DLL4233
MFC42u.DLL4690
MFC42u.DLL3053
MFC42u.DLL3060
MFC42u.DLL6332
MFC42u.DLL2502
MFC42u.DLL2534
MFC42u.DLL5239
MFC42u.DLL5736
MFC42u.DLL1739
MFC42u.DLL5573
MFC42u.DLL3167
MFC42u.DLL5649
MFC42u.DLL4414
MFC42u.DLL4947
MFC42u.DLL4852
MFC42u.DLL2391
MFC42u.DLL4381
MFC42u.DLL3449
MFC42u.DLL3193
MFC42u.DLL6076
MFC42u.DLL6171
MFC42u.DLL4617
MFC42u.DLL4420
MFC42u.DLL338
MFC42u.DLL652
MFC42u.DLL4817
MFC42u.DLL4608
MFC42u.DLL4607
MFC42u.DLL533
MFC42u.DLL798
MFC42u.DLL1937
MFC42u.DLL4268
MFC42u.DLL4583
MFC42u.DLL4893
MFC42u.DLL5070
MFC42u.DLL4335
MFC42u.DLL4343
MFC42u.DLL4717
MFC42u.DLL4884
MFC42u.DLL4525
MFC42u.DLL4539
MFC42u.DLL4537
MFC42u.DLL4520
MFC42u.DLL4523
MFC42u.DLL4518
MFC42u.DLL4958
MFC42u.DLL4955
MFC42u.DLL4103
MFC42u.DLL5236
MFC42u.DLL5286
MFC42u.DLL3743
MFC42u.DLL1719
MFC42u.DLL4426
MFC42u.DLL560
MFC42u.DLL813
MFC42u.DLL1989
MFC42u.DLL5256
MFC42u.DLL2527
MFC42u.DLL6330
MFC42u.DLL1569
MFC42u.DLL4237
MFC42u.DLL1834
MFC42u.DLL823
MFC42u.DLL354
MFC42u.DLL5180
MFC42u.DLL3313
MFC42u.DLL1971
MFC42u.DLL800
MFC42u.DLL6211
MFC42u.DLL665
MFC42u.DLL1165
MSVCRT.dll202_except_handler3
MSVCRT.dll85__dllonexit
MSVCRT.dll390_onexit
MSVCRT.dll183_controlfp
MSVCRT.dll111__p__fmode
MSVCRT.dll106__p__commode
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll131__setusermatherr
MSVCRT.dll271_initterm
MSVCRT.dll139__wgetmainargs
MSVCRT.dll73__CxxFrameHandler
MSVCRT.dll211_exit
MSVCRT.dll72_XcptFilter
MSVCRT.dll585exit
MSVCRT.dll487_wcmdln
MSVCRT.dll129__set_app_type
KERNEL32.dll440GetStartupInfoW
KERNEL32.dll386GetModuleHandleW
KERNEL32.dll86CreateFileW
KERNEL32.dll382GetModuleFileNameW
USER32.dll196EnableWindow
USER32.dll700UpdateWindow
GDI32.dll502Rectangle
offsetsizetypecomment
0159744EXE11/30/2014 18:17:51#
15c115HTM#
55101203GIF(250 x 135)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK