filenameg2k.exe
size521728 (0x7f600)
md5b61f51916de0ce358f991ff951ac812b
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x362f0606
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion5.0
SizeOfCode0x74a00
SizeOfInitializedData0x1c000
SizeOfUninitializedData0
AddressOfEntryPoint0x6ba10
BaseOfCode0x1000
BaseOfData0x76000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x94000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v5.0

Sections

namevavsizeraw sizeflags
.text0x10000x748800x74a00R-X CODE
.rdata0x760000x77f0x800R-- IDATA
.data0x770000x1a7100x9000RW- IDATA
.idata0x920000xbe80xc00RW- IDATA
.rsrc0x930000x39c0x400R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x920000xf0
RESOURCE0x930000x39c
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x922b80x1c8
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#17440
GROUP_ICON#101200
module_namehintordfunction_name
DSOUND.dll3DirectSoundCreate
WINMM.dll122mmioClose
WINMM.dll131mmioRead
WINMM.dll124mmioDescend
WINMM.dll129mmioOpenA
WINMM.dll46mciGetErrorStringA
WINMM.dll121mmioAscend
WINMM.dll50mciSendCommandA
DINPUT.dllDirectInputCreateA
DDRAW.dll5DirectDrawCreate
KERNEL32.dll325GetTickCount
KERNEL32.dll353GlobalMemoryStatus
KERNEL32.dll575Sleep
KERNEL32.dll24CloseHandle
KERNEL32.dll118FileTimeToDosDateTime
KERNEL32.dll238GetFileTime
KERNEL32.dll49CreateFileA
KERNEL32.dll410LocalFree
KERNEL32.dll147FormatMessageA
KERNEL32.dll244GetLastError
KERNEL32.dll427MultiByteToWideChar
KERNEL32.dll245GetLocalTime
KERNEL32.dll580SystemTimeToFileTime
KERNEL32.dll352GlobalLock
KERNEL32.dll341GlobalAlloc
KERNEL32.dll30CompareStringA
KERNEL32.dll78DeleteFileA
KERNEL32.dll107ExitProcess
KERNEL32.dll142FlushFileBuffers
KERNEL32.dll582TerminateProcess
KERNEL32.dll485RtlUnwind
KERNEL32.dll265GetOEMCP
KERNEL32.dll553SetStdHandle
KERNEL32.dll163GetCPInfo
KERNEL32.dll227GetEnvironmentStringsW
KERNEL32.dll157GetACP
KERNEL32.dll151FreeEnvironmentStringsW
KERNEL32.dll150FreeEnvironmentStringsA
KERNEL32.dll225GetEnvironmentStrings
KERNEL32.dll592UnhandledExceptionFilter
KERNEL32.dll398LCMapStringW
KERNEL32.dll400LoadLibraryA
KERNEL32.dll61CreateProcessA
KERNEL32.dll211GetCurrentProcess
KERNEL32.dll252GetModuleFileNameA
KERNEL32.dll239GetFileType
KERNEL32.dll298GetStdHandle
KERNEL32.dll539SetHandleCount
KERNEL32.dll618WaitForSingleObject
KERNEL32.dll230GetExitCodeProcess
KERNEL32.dll528SetEndOfFile
KERNEL32.dll302GetStringTypeW
KERNEL32.dll254GetModuleHandleA
KERNEL32.dll299GetStringTypeA
KERNEL32.dll369HeapReAlloc
KERNEL32.dll529SetEnvironmentVariableA
KERNEL32.dll31CompareStringW
KERNEL32.dll328GetTimeZoneInformation
KERNEL32.dll309GetSystemTime
KERNEL32.dll360HeapAlloc
KERNEL32.dll366HeapFree
KERNEL32.dll397LCMapStringA
KERNEL32.dll537SetFilePointer
KERNEL32.dll470ReadFile
KERNEL32.dll622WideCharToMultiByte
KERNEL32.dll232GetFileAttributesA
KERNEL32.dll296GetStartupInfoA
KERNEL32.dll170GetCommandLineA
KERNEL32.dll332GetVersion
KERNEL32.dll603VirtualAlloc
KERNEL32.dll635WriteFile
KERNEL32.dll278GetProcAddress
KERNEL32.dll364HeapDestroy
KERNEL32.dll362HeapCreate
KERNEL32.dll606VirtualFree
USER32.dll492SetCursor
USER32.dll128DefWindowProcA
USER32.dll374LoadIconA
USER32.dll431PeekMessageA
USER32.dll85CreateWindowExA
USER32.dll446RegisterClassA
USER32.dll300GetSystemMetrics
USER32.dll277GetMessageA
USER32.dll557ShowWindow
USER32.dll593UpdateWindow
USER32.dll435PostQuitMessage
USER32.dll581TranslateMessage
USER32.dll144DispatchMessageA
USER32.dll433PostMessageA
GDI32.dll337SetBkMode
GDI32.dll370SetTextColor
GDI32.dll70DeleteObject
GDI32.dll44CreateFontIndirectA
GDI32.dll250GetStockObject
GDI32.dll330SelectObject
GDI32.dll387TextOutA
ADVAPI32.dll279RegCloseKey
ADVAPI32.dll310RegQueryValueExA
ADVAPI32.dll302RegOpenKeyExA
ADVAPI32.dll283RegCreateKeyExA
ADVAPI32.dll321RegSetValueExA
ole32.dll38CoInitialize
ole32.dll12CoCreateInstance
offsetsizetypecomment
0521728EXE10/22/1998 10:16:38#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK