filenameGrayFish
size573440 (0x8c000)
md59b1ca66aab784dc5f1dfe635d8f8a904
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x118

Rich Header

lib idversiontimes used
1272914
1180471
1472995
10804711
480472
96603015
9560301
10169
9321799
1097828
6492101
11978242
617351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x47a37dd9
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x1b000
SizeOfInitializedData0x70000
SizeOfUninitializedData0
AddressOfEntryPoint0x1590a
BaseOfCode0x1000
BaseOfData0x1c000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x8c000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x1a8cf0x1b000R-X CODE
.rdata0x1c0000x3eba0x4000R-- IDATA
.data0x200000x265c0x3000RW- IDATA
.sxdata0x230000x300x1000RW- IDATA
.rsrc0x240000x676880x68000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x1f1580x64
RESOURCE0x240000x67688
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x1c0000x2a4
Delay_IAT00
CLR_Header00
typenamesizecp
RCDATA#10043331252
RCDATA#10117721252
RCDATA#102549791252
RCDATA#103257511252
RCDATA#104330021252
RCDATA#105853511252
RCDATA#10661831252
RCDATA#1072089631252
RCDATA#108681252
RCDATA#40963971252
RCDATA#40973211252
RCDATA#40985651252
RCDATA#40991691252
VERSION#19481252
module_namehintordfunction_name
KERNEL32.dll959lstrlenA
KERNEL32.dll950lstrcmpiA
KERNEL32.dll797SetLastError
KERNEL32.dll901WaitForSingleObject
KERNEL32.dll842SleepEx
KERNEL32.dll696ReleaseMutex
KERNEL32.dll546InterlockedIncrement
KERNEL32.dll543InterlockedExchange
KERNEL32.dll90CreateMutexA
KERNEL32.dll542InterlockedDecrement
KERNEL32.dll312GetCurrentDirectoryA
KERNEL32.dll441GetSystemDirectoryA
KERNEL32.dll489GetWindowsDirectoryA
KERNEL32.dll459GetTempPathA
KERNEL32.dll77CreateFileA
KERNEL32.dll197FindClose
KERNEL32.dll201FindFirstFileA
KERNEL32.dll469GetTickCount
KERNEL32.dll891VirtualProtect
KERNEL32.dll315GetCurrentProcessId
KERNEL32.dll846SystemTimeToFileTime
KERNEL32.dll446GetSystemTime
KERNEL32.dll603LockResource
KERNEL32.dll840SizeofResource
KERNEL32.dll589LoadResource
KERNEL32.dll218FindResourceA
KERNEL32.dll779SetEvent
KERNEL32.dll73CreateEventA
KERNEL32.dll777SetEnvironmentVariableW
KERNEL32.dll337GetEnvironmentVariableW
KERNEL32.dll314GetCurrentProcess
KERNEL32.dll375GetModuleHandleA
KERNEL32.dll636OpenProcess
KERNEL32.dll479GetVersionExA
KERNEL32.dll555IsBadStringPtrW
KERNEL32.dll524HeapFree
KERNEL32.dll518HeapAlloc
KERNEL32.dll411GetProcessHeap
KERNEL32.dll131DeviceIoControl
KERNEL32.dll373GetModuleFileNameA
KERNEL32.dll890VirtualLock
KERNEL32.dll711ResumeThread
KERNEL32.dll806SetPriorityClass
KERNEL32.dll317GetCurrentThread
KERNEL32.dll824SetThreadPriority
KERNEL32.dll96CreateProcessA
KERNEL32.dll431GetStartupInfoA
KERNEL32.dll919WriteFile
KERNEL32.dll905WideCharToMultiByte
KERNEL32.dll374GetModuleFileNameW
KERNEL32.dll556IsBadWritePtr
KERNEL32.dll553IsBadReadPtr
KERNEL32.dll841Sleep
KERNEL32.dll634OpenMutexA
KERNEL32.dll849TerminateProcess
KERNEL32.dll708ResetEvent
KERNEL32.dll960lstrlenW
KERNEL32.dll951lstrcmpiW
KERNEL32.dll528HeapReAlloc
KERNEL32.dll336GetEnvironmentVariableA
KERNEL32.dll850TerminateThread
KERNEL32.dll105CreateThread
KERNEL32.dll665QueryPerformanceCounter
KERNEL32.dll46CloseHandle
KERNEL32.dll584LoadLibraryA
KERNEL32.dll408GetProcAddress
KERNEL32.dll239FreeLibrary
KERNEL32.dll179ExpandEnvironmentStringsW
KERNEL32.dll345GetFileAttributesW
KERNEL32.dll619MultiByteToWideChar
KERNEL32.dll361GetLastError
KERNEL32.dll778SetErrorMode
KERNEL32.dll460GetTempPathW
KERNEL32.dll458GetTempFileNameW
KERNEL32.dll79CreateFileMappingW
KERNEL32.dll443GetSystemInfo
KERNEL32.dll585LoadLibraryExA
KERNEL32.dll590LocalAlloc
KERNEL32.dll478GetVersion
KERNEL32.dll885VirtualAlloc
KERNEL32.dll888VirtualFree
KERNEL32.dll635OpenMutexW
KERNEL32.dll91CreateMutexW
KERNEL32.dll78CreateFileMappingA
KERNEL32.dll606MapViewOfFile
KERNEL32.dll869UnmapViewOfFile
KERNEL32.dll347GetFileSize
ADVAPI32.dll66ControlService
ADVAPI32.dll426OpenProcessToken
ADVAPI32.dll333LookupPrivilegeValueA
ADVAPI32.dll28AdjustTokenPrivileges
ADVAPI32.dll427OpenSCManagerA
ADVAPI32.dll101CreateServiceW
ADVAPI32.dll430OpenServiceW
ADVAPI32.dll449QueryServiceStatus
ADVAPI32.dll574StartServiceA
ADVAPI32.dll62CloseServiceHandle
ADVAPI32.dll306InitializeSecurityDescriptor
MSVCRT.dll430_snprintf
MSVCRT.dll659mbstowcs
MSVCRT.dll690sprintf
MSVCRT.dll431_snwprintf
MSVCRT.dll707strrchr
MSVCRT.dll705strncpy
MSVCRT.dll441_splitpath
MSVCRT.dll698strcpy
MSVCRT.dll665memset
MSVCRT.dll753wcstombs
MSVCRT.dll735wcscat
MSVCRT.dll736wcschr
MSVCRT.dll747wcsrchr
MSVCRT.dll316_local_unwind2
MSVCRT.dll744wcsncmp
MSVCRT.dll743wcsncat
MSVCRT.dll749wcsstr
MSVCRT.dll703strncat
MSVCRT.dll662memcmp
MSVCRT.dll257_getpid
MSVCRT.dll745wcsncpy
MSVCRT.dll85__dllonexit
MSVCRT.dll390_onexit
MSVCRT.dll14public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

MSVCRT.dll211_exit
MSVCRT.dll72_XcptFilter
MSVCRT.dll585exit
MSVCRT.dll143_acmdln
MSVCRT.dll88__getmainargs
MSVCRT.dll271_initterm
MSVCRT.dll131__setusermatherr
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll106__p__commode
MSVCRT.dll111__p__fmode
MSVCRT.dll129__set_app_type
MSVCRT.dll183_controlfp
MSVCRT.dll65_CxxThrowException
MSVCRT.dll739wcscpy
MSVCRT.dll702strlen
MSVCRT.dll449_stricmp
MSVCRT.dll490_wcsicmp
MSVCRT.dll494_wcsnicmp
MSVCRT.dll453_strnicmp
MSVCRT.dll715swprintf
MSVCRT.dll742wcslen
MSVCRT.dll663memcpy
MSVCRT.dll402_purecall
MSVCRT.dll657malloc
MSVCRT.dll606free
MSVCRT.dll73__CxxFrameHandler
MSVCRT.dll610fseek
MSVCRT.dll605fread
MSVCRT.dll245_get_osfhandle
MSVCRT.dll664memmove
MSVCRT.dll576calloc
MSVCRT.dll15void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCRT.dll588fclose
MSVCRT.dll515_wfopen
MSVCRT.dll709strstr
MSVCRT.dll696strcmp
MSVCRT.dll704strncmp
MSVCRT.dll16void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCRT.dll737wcscmp
USER32.dll691UnregisterClassW
USER32.dll617SetPropA
USER32.dll97CreateWindowExW
USER32.dll153DestroyWindow

StringTable 000004b0

CompanyNameMicrosoft Corporation
FileDescriptionWindows Configuration Services
FileVersion4.0.1374.1
InternalNameDOGROUND.exe
LegalCopyrightCopyright (C) Microsoft Corp. 1981-2001
OriginalFilenameDOGROUND.exe
ProductNameMicrosoft(R) Windows (R) 2000 Operating System
ProductVersion5.0.2074.0
PrivateBuild4.00.03.0004

VS_FIXEDFILEINFO

FileVersion1.0.0.1
ProductVersion1.0.0.1
StrucVersion0x10000
FileFlagsMask0x8001
FileFlags8
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0573440EXE02/01/2008 20:15:21#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK