filenameG7vuYhjb.exe
size320000 (0x4e200)
md5b550c37041614c944eb28b35aa8be452
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
1493072933
13130729142
109507272
1235072743
10309
1323072953
148210221
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x57ab0b88
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion9.0
SizeOfCode0x1c200
SizeOfInitializedData0x31c00
SizeOfUninitializedData0
AddressOfEntryPoint0xb817
BaseOfCode0x1000
BaseOfData0x1e000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x54000
SizeOfHeaders0x400
CheckSum0x5c905
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x1c1450x1c200R-X CODE
.rdata0x1e0000x89340x8a00R-- IDATA
.data0x270000x1aae80x18e00RW- IDATA
.tls0x4200090x200RW- IDATA
.rsrc0x430000x1006c0x10200R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x24dcc0x1b8
RESOURCE0x430000x1006c
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x241580x18
LOAD_CONFIG0x241100x40
Bound_IAT00
IAT0x1e0000x504
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x4420000x4420080x43fed00x41e53000
typenamesizecp
CURSOR#113081252
CURSOR#123081252
ICON#1194961252
ICON#2114321252
ICON#371121252
ICON#456721252
ICON#537521252
ICON#622161252
ICON#717361252
DIALOG#1032761252
DIALOG#1055001252
DIALOG#1062361252
DIALOG#1071481252
DIALOG#1112101252
DIALOG#2032761252
STRING#38651721252
STRING#38662221252
STRING#386711921252
STRING#405511681252
STRING#405613841252
STRING#405713241252
STRING#405810401252
STRING#405910041252
RCDATAIW_GFX_SB_VTHUMB1131252
RCDATAIW_GFX_SB_VUP1051252
RCDATAIW_GFX_SB_VUP2771252
RCDATAIW_GFX_SESSIONTIMEOUT11141252
GROUP_CURSOR#31002201252
GROUP_CURSOR#31003201252
GROUP_ICON#1831041252
VERSION#16401252
MANIFEST#13461252
idlangstring
618361033Unable to read write-only property.
618371033Unable to write read-only property.
618401033Unable to load mail system support.
618411033Mail system DLL is invalid.
618421033Send Mail failed to send message.
618561033No error occurred.
618571033An unknown error occurred while accessing %1.
618581033%1 was not found.
618591033%1 contains an incorrect path.
618601033Could not open %1 because there are too many open files.
618611033Access to %1 was denied.
618621033An incorrect file handle was associated with %1.
618631033Could not remove %1 because it is the current directory.
618641033Could not create %1 because the directory is full.
618651033Seek failed on %1
618661033Encountered a hardware I/O error while accessing %1.
618671033Encountered a sharing violation while accessing %1.
618681033Encountered a locking violation while accessing %1.
618691033Disk full while accessing %1.
618701033Attempted to access %1 past its end.
648641033Cannot merge because [%s] %s
648651033Column or function [%s] is not found. Hint: if the name is a function name, then add FireDAC.Stan.ExprFuncs to uses clause
648661033Expression unexpectedly terminated
648671033Expression must be aggregated
648681033Expression cannot be aggregated
648691033Type mismatch in expression
648701033Expression is incorrect
648711033Invalid use of keyword
648721033Invalid character found [%s]
648731033Name is not terminated properly
648741033String constant is not terminated properly or is too long
648751033'(' expected but [%s] found
648761033')' or ',' expected but [%s] found
648771033')' expected but [%s] found
648781033IN predicate list may not be empty
648791033Expected [%s]
648801033Cannot perform operation for row state
648811033Cannot change updates registry for DatS manager [%s]
648821033Too many aggregate values per view
648831033Grouping level exceeds maximum allowed for aggregate [%s]
648841033Variable length column [%s] overflow. Value length - [%d], column maximum length - [%d]
648851033Invalid foreign key [%s]
648861033Invalid unique key [%s]
648871033Cannot change column [%s] data type
648881033Invalid relation [%s]
648891033Cannot create parent view. Relation [%s]
648901033Cannot change table [%s] structure, when table has rows
648911033Found a cascading actions loop at checking foreign key [%s]
648921033Record already locked
648931033Record is not locked
648941033Assigning value [%s] is not compatible with column [%s] data type. %s
648951033Value [%s] is out of [%s] data type range
648961033Row is not in editable state
648971033Column [%s] is read only
648981033Cannot insert row into table
648991033Column [%s] value must be not null
649001033Duplicate row found on unique index. Constraint [%s]
649011033Cannot process - no parent row. Constraint [%s]
649021033Cannot process - child rows found. Constraint [%s]
649031033Cannot compare rows
649041033Data type conversion is not supported
649051033Column [%s] is not searchable
649061033Row may have only single column of [dtParentRowRef] data type
649071033Cannot read data from or write data to the invariant column [%s]. Hint: use properties and methods, like a NestedTable
649081033Cannot set parent row
649091033Row is not nested
649101033Column [%s] is not reference to other row
649111033Column [%s] is not reference to row set
649121033Record not found
649131033BCD overflow
649141033%s is not a valid BCD value
649151033Could not parse SQL TimeStamp string
649161033Invalid SQL date/time values
649171033FireDAC Login
649181033Name [%s] is duplicated in the list
649191033Object [%s] is not found
649201033Column [%s] type is unknown or undefined
649211033No columns defined for table
649221033Check condition violated. Constraint [%s]
649231033Cannot begin edit row
649241033Cannot create child view. Relation [%s]
649251033Cannot delete row
649261033Column [%s] must have blob value
649271033Fixed length column [%s] data length mismatch. Value length - [%d], column fixed length - [%d]
649281033DataSource cannot be changed
649291033Cannot perform this operation on an open dataset
649301033Dataset not in edit or insert mode
649311033Cannot perform this operation on a closed dataset
649321033Cannot perform this operation on an empty dataset
649331033Cannot modify a read-only dataset
649341033Nested dataset must inherit from %s
649351033False
649361033True
649371033Parameter '%s' not found
649381033Unable to load bind parameters
649391033Field '%s' is of an unsupported type
649401033SQL not supported
649411033Execute not supported
649421033Operation not allowed on a unidirectional dataset
649431033Unassigned variant value
module_namehintordfunction_name
KERNEL32.dll488GetLocaleInfoA
KERNEL32.dll678HeapSize
KERNEL32.dll731IsValidCodePage
KERNEL32.dll531GetOEMCP
KERNEL32.dll338GetACP
KERNEL32.dll347GetCPInfo
KERNEL32.dll991SetFilePointer
KERNEL32.dll619GetTimeZoneInformation
KERNEL32.dll676HeapReAlloc
KERNEL32.dll1108VirtualAlloc
KERNEL32.dll426GetCurrentProcessId
KERNEL32.dll614GetTickCount
KERNEL32.dll852QueryPerformanceCounter
KERNEL32.dll1111VirtualFree
KERNEL32.dll671HeapCreate
KERNEL32.dll471GetFileType
KERNEL32.dll1000SetHandleCount
KERNEL32.dll449GetEnvironmentStringsW
KERNEL32.dll331FreeEnvironmentStringsW
KERNEL32.dll447GetEnvironmentStrings
KERNEL32.dll330FreeEnvironmentStringsA
KERNEL32.dll321FlushFileBuffers
KERNEL32.dll405GetConsoleMode
KERNEL32.dll387GetConsoleCP
KERNEL32.dll1146WideCharToMultiByte
KERNEL32.dll693InitializeCriticalSectionAndSpinCount
KERNEL32.dll1020SetStdHandle
KERNEL32.dll190DeleteCriticalSection
KERNEL32.dll500GetModuleFileNameA
KERNEL32.dll751LeaveCriticalSection
KERNEL32.dll217EnterCriticalSection
KERNEL32.dll700InterlockedDecrement
KERNEL32.dll429GetCurrentThreadId
KERNEL32.dll1004SetLastError
KERNEL32.dll704InterlockedIncrement
KERNEL32.dll1075TlsFree
KERNEL32.dll1077TlsSetValue
KERNEL32.dll1074TlsAlloc
KERNEL32.dll1076TlsGetValue
KERNEL32.dll569GetStartupInfoA
KERNEL32.dll367GetCommandLineA
KERNEL32.dll260ExitProcess
KERNEL32.dll505GetModuleHandleW
KERNEL32.dll914RtlUnwind
KERNEL32.dll858RaiseException
KERNEL32.dll721IsDebuggerPresent
KERNEL32.dll1045SetUnhandledExceptionFilter
KERNEL32.dll1086UnhandledExceptionFilter
KERNEL32.dll425GetCurrentProcess
KERNEL32.dll1069TerminateProcess
KERNEL32.dll591GetSystemTimeAsFileTime
KERNEL32.dll1154WriteConsoleA
KERNEL32.dll409GetConsoleOutputCP
KERNEL32.dll1164WriteConsoleW
KERNEL32.dll794MultiByteToWideChar
KERNEL32.dll737LCMapStringA
KERNEL32.dll739LCMapStringW
KERNEL32.dll573GetStringTypeA
KERNEL32.dll576GetStringTypeW
KERNEL32.dll973SetEndOfFile
KERNEL32.dll82CompareStringA
KERNEL32.dll85CompareStringW
KERNEL32.dll114CreateEventA
KERNEL32.dll132CreateIoCompletionPort
KERNEL32.dll1124WaitForSingleObject
KERNEL32.dll935SetConsoleCtrlHandler
KERNEL32.dll831PostQueuedCompletionStatus
KERNEL32.dll1122WaitForMultipleObjects
KERNEL32.dll67CloseHandle
KERNEL32.dll327FormatMessageA
KERNEL32.dll487GetLocalTime
KERNEL32.dll621GetUserDefaultLCID
KERNEL32.dll430GetDateFormatA
KERNEL32.dll310FindResourceA
KERNEL32.dll758LoadResource
KERNEL32.dll775LockResource
KERNEL32.dll335FreeResource
KERNEL32.dll547GetProcessHeap
KERNEL32.dll753LoadLibraryA
KERNEL32.dll669HeapAlloc
KERNEL32.dll673HeapFree
KERNEL32.dll192DeleteFileA
KERNEL32.dll120CreateFileA
KERNEL32.dll872ReadFile
KERNEL32.dll1165WriteFile
KERNEL32.dll652GlobalFree
KERNEL32.dll660GlobalSize
KERNEL32.dll645GlobalAlloc
KERNEL32.dll656GlobalLock
KERNEL32.dll1199lstrcpyA
KERNEL32.dll663GlobalUnlock
KERNEL32.dll1057Sleep
KERNEL32.dll544GetProcAddress
KERNEL32.dll1196lstrcmpiA
KERNEL32.dll961SetConsoleTitleA
KERNEL32.dll540GetPrivateProfileStringA
KERNEL32.dll486GetLastError
KERNEL32.dll571GetStdHandle
KERNEL32.dll502GetModuleHandleA
KERNEL32.dll976SetEnvironmentVariableA
USER32.dll256GetAsyncKeyState
USER32.dll426InvalidateRect
USER32.dll670SetTimer
USER32.dll565RegisterClassExW
USER32.dll466LoadCursorA
USER32.dll168DispatchMessageA
USER32.dll725TranslateMessage
USER32.dll359GetScrollPos
USER32.dll679SetWindowPos
USER32.dll601SendDlgItemMessageA
USER32.dll630SetDlgItemTextA
USER32.dll285GetDialogBaseUnits
USER32.dll152DeleteMenu
USER32.dll366GetSystemMenu
USER32.dll775wsprintfA
USER32.dll691ShowCursor
USER32.dll657SetRect
USER32.dll149DefWindowProcA
USER32.dll722TranslateAcceleratorA
USER32.dll553PtInRect
USER32.dll282GetDC
USER32.dll588ReleaseDC
USER32.dll367GetSystemMetrics
USER32.dll103CreateWindowExA
USER32.dll483LoadStringA
USER32.dll45CharNextA
USER32.dll661SetScrollRange
USER32.dll660SetScrollPos
USER32.dll517MoveWindow
USER32.dll633SetFocus
USER32.dll472LoadImageA
USER32.dll281GetCursorPos
USER32.dll330GetMessageA
USER32.dll462LoadAcceleratorsA
USER32.dll382GetWindowContextHelpId
USER32.dll286GetDlgCtrlID
USER32.dll611SendMessageW
USER32.dll544PostQuitMessage
USER32.dll574RegisterHotKey
USER32.dll773keybd_event
USER32.dll331GetMessageExtraInfo
USER32.dll593ReplyMessage
USER32.dll771WindowFromPoint
USER32.dll266GetClassNameA
USER32.dll381GetWindow
USER32.dll69ClientToScreen
USER32.dll283GetDCEx
USER32.dll28CallWindowProcA
USER32.dll364GetSysColor
USER32.dll399GetWindowTextW
USER32.dll624SetCursor
USER32.dll405HideCaret
USER32.dll60CheckDlgButton
USER32.dll454IsWindowEnabled
USER32.dll209EnableWindow
USER32.dll719TrackPopupMenu
USER32.dll504MessageBoxA
USER32.dll494MapDialogRect
USER32.dll160DestroyWindow
USER32.dll499MapWindowPoints
USER32.dll606SendMessageA
USER32.dll269GetClientRect
USER32.dll341GetParent
USER32.dll392GetWindowRect
USER32.dll213EndPaint
USER32.dll158DestroyMenu
USER32.dll590RemoveMenu
USER32.dll197DrawTextA
USER32.dll440IsDialogMessageA
USER32.dll14BeginPaint
USER32.dll363GetSubMenu
USER32.dll478LoadMenuA
USER32.dll639SetMenu
USER32.dll737UnregisterHotKey
USER32.dll470LoadIconA
USER32.dll365GetSysColorBrush
USER32.dll564RegisterClassExA
USER32.dll696ShowWindow
USER32.dll745UpdateWindow
USER32.dll742UpdateLayeredWindow
USER32.dll587ReleaseCapture
USER32.dll284GetDesktopWindow
USER32.dll708SystemParametersInfoA
USER32.dll734UnregisterClassA
USER32.dll287GetDlgItem
USER32.dll527OpenClipboard
USER32.dll271GetClipboardData
USER32.dll385GetWindowLongA
USER32.dll542PostMessageA
USER32.dll71CloseClipboard
USER32.dll206EmptyClipboard
USER32.dll621SetClipboardData
USER32.dll211EndDialog
USER32.dll289GetDlgItemTextA
USER32.dll239FillRect
USER32.dll191DrawIcon
USER32.dll157DestroyIcon
USER32.dll240FindWindowA
USER32.dll241FindWindowExA
USER32.dll396GetWindowTextA
USER32.dll614SetActiveWindow
USER32.dll683SetWindowTextA
USER32.dll101CreatePopupMenu
USER32.dll9AppendMenuA
USER32.dll100CreateMenu
GDI32.dll482GetObjectA
GDI32.dll46CreateCompatibleDC
GDI32.dll208DeleteObject
GDI32.dll58CreateFontA
GDI32.dll205DeleteDC
GDI32.dll59CreateFontIndirectA
GDI32.dll51CreateDIBSection
GDI32.dll45CreateCompatibleBitmap
GDI32.dll73CreatePen
GDI32.dll500GetStockObject
GDI32.dll548OffsetRgn
GDI32.dll306FrameRgn
GDI32.dll604SelectClipRgn
GDI32.dll82CreateSolidBrush
GDI32.dll41CreateBitmapIndirect
GDI32.dll557PatBlt
GDI32.dll642SetPixel
GDI32.dll491GetPixel
GDI32.dll291ExtTextOutW
GDI32.dll651SetTextAlign
GDI32.dll666StretchBlt
GDI32.dll18BitBlt
GDI32.dll671TextOutA
GDI32.dll614SetBkMode
GDI32.dll613SetBkColor
GDI32.dll653SetTextColor
GDI32.dll524GetTextMetricsA
GDI32.dll606SelectObject
GDI32.dll582Rectangle
WINSPOOL.DRV34ConnectToPrinterDlg
COMDLG32.dll11GetOpenFileNameA
ADVAPI32.dll199CryptReleaseContext
ADVAPI32.dll194CryptGetProvParam
ADVAPI32.dll172CryptAcquireContextA
ADVAPI32.dll650RevertToSelf
ole32.dll33CoGetCallContext
ole32.dll282ReleaseStgMedium
ole32.dll62CoInitializeEx
ole32.dll107CoUninitialize
ole32.dll16CoCreateInstance
ole32.dll61CoInitialize
OLEAUT32.dll10
OLEAUT32.dll8
WS2_32.dll2
WS2_32.dll82WSASocketA
WS2_32.dll115
WS2_32.dll13
WS2_32.dll22
WS2_32.dll3
WS2_32.dll116
WS2_32.dll9
NETAPI32.dll271NetWkstaUserGetInfo
AVIFIL32.dll6AVIFileCreateStreamA
AVIFIL32.dll54AVIStreamSetFormat
AVIFIL32.dll28AVISaveOptions
AVIFIL32.dll16AVIFileOpenA
AVIFIL32.dll29AVISaveOptionsFree
AVIFIL32.dll14AVIFileInit
AVIFIL32.dll57AVIStreamWrite
AVIFIL32.dll52AVIStreamRelease
AVIFIL32.dll19AVIFileRelease
AVIFIL32.dll9AVIFileExit
AVIFIL32.dll22AVIMakeCompressedStream
MSACM32.dll26acmFormatEnumA
MSACM32.dll35acmMetrics
WINMM.dll148timeGetTime
SHLWAPI.dll68PathFileExistsA
COMCTL32.dll412
COMCTL32.dll122InitCommonControlsEx
COMCTL32.dll65FlatSB_GetScrollRange
gdiplus.dll438GdipLoadImageFromFileICM
gdiplus.dll152GdipDisposeImage
gdiplus.dll144GdipDeleteGraphics
gdiplus.dll300GdipGetImageWidth
gdiplus.dll237GdipFree
gdiplus.dll290GdipGetImageHeight
gdiplus.dll91GdipCreateFromHDC
gdiplus.dll184GdipDrawImageRectI
gdiplus.dll54GdipCloneImage
gdiplus.dll628GdiplusShutdown
gdiplus.dll629GdiplusStartup
gdiplus.dll437GdipLoadImageFromFile
gdiplus.dll33GdipAlloc
OPENGL32.dll247glRectf
OPENGL32.dll27glColor3f
OPENGL32.dll16glClear
OPENGL32.dll181glMatrixMode
OPENGL32.dll103glFrustum
OPENGL32.dll316glTranslatef
RASAPI32.dll15RasDeleteEntryW
urlmon.dll24CoInternetParseUrl
RASDLG.dll10RasPhonebookDlgA
RASDLG.dll9RasEntryDlgW
snmpapi.dll25SnmpUtilOidCpy
snmpapi.dll26SnmpUtilOidFree

StringTable 040904b0

LegalCopyrightCopyright 1999 - 2014 Masters ITC Tools
CompanyNameMasters ITC Tools
ProductNameDavies
FileDescriptionViewer Wtb Designates
InternalNameDavies
ProductVersion3.8.2.877

VS_FIXEDFILEINFO

FileVersion3.8.2.877
ProductVersion3.8.2.877
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0320000EXE08/10/2016 11:10:00#
15c115HTM#
4d674113GIF(16 x 17)#
4d6e8105GIF(16 x 16)#
4d75477GIF(16 x 16)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x3fed0