GFilterSvc.exe.sss

info
MZ
PE
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	GFilterSvc.exe.sss
size	121856 (0x1dc00)
md5	cb36d9fa2e728e71ec79dcdecfe58ce5

type	PE32+ executable (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe8

Rich Header

lib id	version	times used
131	30729	69
149	30729	10
123	50727	15
1	0	162
132	30729	41
146	30729	1
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	3
TimeDateStamp	0x51b9cb88
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x23
Magic	0x20b
LinkerVersion	9.0
SizeOfCode	0x1b200
SizeOfInitializedData	0x3c00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x11be4
BaseOfCode	0x1000
ImageBase	0x36000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.2
ImageVersion	0.0
SubsystemVersion	5.2
Reserved1	0
SizeOfImage	0x22000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8000
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1b1e7	0x1b200	R-X CODE
.data	0x1d000	0x2678	0x1200	RW- IDATA
.pdata	0x20000	0x12f0	0x1400	R-- IDATA

Data Directory

type	va	size
EXPORT	0x1c140	0xa7
IMPORT	0x1b0d8	0xa0
RESOURCE	0	0
EXCEPTION	0x20000	0x12f0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x1000	0x4d0
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
SHLWAPI.dll	307	StrRChrA
SHLWAPI.dll	126	PathQuoteSpacesA
SHLWAPI.dll	68	PathFileExistsA
SHLWAPI.dll	130	PathRemoveArgsA
SHLWAPI.dll	158	PathUnquoteSpacesA
ADVAPI32.dll	369	InitializeSecurityDescriptor
ADVAPI32.dll	705	StartServiceCtrlDispatcherA
ADVAPI32.dll	640	RegisterServiceCtrlHandlerExA
ADVAPI32.dll	541	QueryServiceConfigA
ADVAPI32.dll	124	CreateServiceA
ADVAPI32.dll	350	GetUserNameA
ADVAPI32.dll	577	RegDeleteValueA
ADVAPI32.dll	554	RegCloseKey
ADVAPI32.dll	562	RegCreateKeyExA
ADVAPI32.dll	602	RegOpenKeyExA
ADVAPI32.dll	631	RegSetValueExA
ADVAPI32.dll	615	RegQueryValueExA
ADVAPI32.dll	199	CryptReleaseContext
ADVAPI32.dll	178	CryptDestroyHash
ADVAPI32.dll	192	CryptGetHashParam
ADVAPI32.dll	196	CryptHashData
ADVAPI32.dll	175	CryptCreateHash
ADVAPI32.dll	172	CryptAcquireContextA
ADVAPI32.dll	688	SetSecurityDescriptorDacl
ADVAPI32.dll	547	QueryServiceStatusEx
ADVAPI32.dll	83	CloseServiceHandle
ADVAPI32.dll	340	GetTokenInformation
ADVAPI32.dll	497	OpenProcessToken
ADVAPI32.dll	214	DeleteService
ADVAPI32.dll	500	OpenServiceA
ADVAPI32.dll	498	OpenSCManagerA
ADVAPI32.dll	704	StartServiceA
ADVAPI32.dll	88	ControlService
ADVAPI32.dll	698	SetServiceStatus
ADVAPI32.dll	567	RegDeleteKeyA
ADVAPI32.dll	251	EnumServicesStatusExA
USER32.dll	41	CharLowerA
USER32.dll	45	CharNextA
USER32.dll	487	LoadStringA
USER32.dll	785	wvsprintfA
KERNEL32.dll	733	LCMapStringW
KERNEL32.dll	600	GetTempFileNameA
KERNEL32.dll	731	LCMapStringA
KERNEL32.dll	576	GetStringTypeW
KERNEL32.dll	788	MultiByteToWideChar
KERNEL32.dll	573	GetStringTypeA
KERNEL32.dll	1213	lstrlenA
KERNEL32.dll	67	CloseHandle
KERNEL32.dll	502	GetModuleHandleA
KERNEL32.dll	1150	WideCharToMultiByte
KERNEL32.dll	574	GetStringTypeExA
KERNEL32.dll	607	GetThreadLocale
KERNEL32.dll	1201	lstrcmpA
KERNEL32.dll	1204	lstrcmpiA
KERNEL32.dll	544	GetProcAddress
KERNEL32.dll	866	ReadFile
KERNEL32.dll	469	GetFileSize
KERNEL32.dll	121	CreateFileA
KERNEL32.dll	1169	WriteFile
KERNEL32.dll	193	DeleteFileA
KERNEL32.dll	629	GetVersionExA
KERNEL32.dll	426	GetCurrentProcess
KERNEL32.dll	747	LoadLibraryA
KERNEL32.dll	1120	VirtualQuery
KERNEL32.dll	1061	Sleep
KERNEL32.dll	427	GetCurrentProcessId
KERNEL32.dll	1093	UnmapViewOfFile
KERNEL32.dll	881	ReleaseMutex
KERNEL32.dll	1128	WaitForSingleObject
KERNEL32.dll	140	CreateMutexA
KERNEL32.dll	773	MapViewOfFileEx
KERNEL32.dll	984	SetEvent
KERNEL32.dll	801	OpenEventA
KERNEL32.dll	486	GetLastError
KERNEL32.dll	614	GetTickCount
KERNEL32.dll	471	GetFileTime
KERNEL32.dll	631	GetVolumeInformationA
KERNEL32.dll	125	CreateFileMappingW
KERNEL32.dll	500	GetModuleFileNameA
KERNEL32.dll	780	MoveFileExA
KERNEL32.dll	454	GetExitCodeProcess
KERNEL32.dll	1214	lstrlenW
KERNEL32.dll	374	GetComputerNameA
KERNEL32.dll	839	QueryDosDeviceA
KERNEL32.dll	491	GetLogicalDriveStringsA
KERNEL32.dll	264	ExpandEnvironmentStringsA
KERNEL32.dll	333	FreeLibrary
KERNEL32.dll	602	GetTempPathA
KERNEL32.dll	1210	lstrcpynA
KERNEL32.dll	273	FileTimeToSystemTime
KERNEL32.dll	706	IsBadReadPtr
KERNEL32.dll	163	CreateThread
KERNEL32.dll	261	ExitProcess
KERNEL32.dll	118	CreateEventW
KERNEL32.dll	802	OpenEventW
KERNEL32.dll	334	FreeLibraryAndExitThread
KERNEL32.dll	115	CreateEventA
KERNEL32.dll	488	GetLocaleInfoA
KERNEL32.dll	676	HeapReAlloc
KERNEL32.dll	725	IsValidCodePage
KERNEL32.dll	531	GetOEMCP
KERNEL32.dll	669	HeapAlloc
KERNEL32.dll	673	HeapFree
KERNEL32.dll	912	RtlLookupFunctionEntry
KERNEL32.dll	918	RtlUnwindEx
KERNEL32.dll	505	GetModuleHandleW
KERNEL32.dll	368	GetCommandLineA
KERNEL32.dll	571	GetStdHandle
KERNEL32.dll	677	HeapSetInformation
KERNEL32.dll	671	HeapCreate
KERNEL32.dll	852	RaiseException
KERNEL32.dll	914	RtlPcToFileHeader
KERNEL32.dll	214	EncodePointer
KERNEL32.dll	184	DecodePointer
KERNEL32.dll	319	FlsGetValue
KERNEL32.dll	320	FlsSetValue
KERNEL32.dll	318	FlsFree
KERNEL32.dll	1008	SetLastError
KERNEL32.dll	430	GetCurrentThreadId
KERNEL32.dll	317	FlsAlloc
KERNEL32.dll	678	HeapSize
KERNEL32.dll	191	DeleteCriticalSection
KERNEL32.dll	745	LeaveCriticalSection
KERNEL32.dll	218	EnterCriticalSection
KERNEL32.dll	1073	TerminateProcess
KERNEL32.dll	1090	UnhandledExceptionFilter
KERNEL32.dll	1049	SetUnhandledExceptionFilter
KERNEL32.dll	715	IsDebuggerPresent
KERNEL32.dll	919	RtlVirtualUnwind
KERNEL32.dll	905	RtlCaptureContext
KERNEL32.dll	693	InitializeCriticalSectionAndSpinCount
KERNEL32.dll	331	FreeEnvironmentStringsA
KERNEL32.dll	448	GetEnvironmentStrings
KERNEL32.dll	332	FreeEnvironmentStringsW
KERNEL32.dll	450	GetEnvironmentStringsW
KERNEL32.dll	1004	SetHandleCount
KERNEL32.dll	472	GetFileType
KERNEL32.dll	569	GetStartupInfoA
KERNEL32.dll	846	QueryPerformanceCounter
KERNEL32.dll	591	GetSystemTimeAsFileTime
KERNEL32.dll	348	GetCPInfo
KERNEL32.dll	339	GetACP
SHELL32.dll	278	ShellExecuteExA
ole32.dll	65	CoInitialize
ole32.dll	375	StringFromGUID2
ole32.dll	111	CoUninitialize
PSAPI.DLL	19	GetProcessImageFileNameA

ord	entry_va	function_name
1	0x3df0	DllCanUnloadNow
2	0x3dfc	DllGetClassObject
3	0x3e04	DllRegisterServer
4	0x3e04	DllUnregisterServer

module_name	GFilterSvc.exe
flags	0
timestamp	2013-06-13 13:39:20
version	0.0
ordinal_base	1
nFunctions	4
nNames	4
Names(4)	0x1c178
Functions(4)	0x1c168
NameOrdinals(4)	0x1c188

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	116272	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK