filenameFar.exe
size3125248 (0x2fb000)
md5d0b64a5d2140c2553216fb9b66e8feb6
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
131307291
1473072925
10380
17030319200
1583031935
17130319195
154303191
157303191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x5179c3b9
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x122
Magic0x10b
LinkerVersion10.0
SizeOfCode0x249200
SizeOfInitializedData0x10a400
SizeOfUninitializedData0
AddressOfEntryPoint0x20b1aa
BaseOfCode0x1000
BaseOfData0x24b000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x358000
SizeOfHeaders0x400
CheckSum0x304170
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x2490c80x249200R-X CODE
.rdata0x24b0000x4dfc80x4e000R-- IDATA
.data0x2990000x687440xfe00RW- IDATA
.tls0x30200090x200RW- IDATA
.rsrc0x3030000x320800x32200R-- IDATA
.reloc0x3360000x217420x21800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x296aec0x104
RESOURCE0x3030000x32080
EXCEPTION00
SECURITY00
BASERELOC0x3360000x1b490
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x273a580x18
LOAD_CONFIG0x273a100x40
Bound_IAT00
IAT0x24b0000x61c
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x7020000x7020080x6ff53c0x64b69800
typenamesizecp
ICON#126640
ICON#225040
ICON#316400
ICON#412240
ICON#57440
ICON#64880
ICON#74240
ICON#82960
ICON#956720
ICON#1051440
ICON#1137520
ICON#1229840
ICON#1322160
ICON#1417360
ICON#1515440
ICON#1613840
ICON#1776150
ICON#18169360
ICON#19149200
ICON#2096400
ICON#2167600
ICON#2242640
ICON#2324400
ICON#2417200
ICON#2511280
ICON#2626640
ICON#2725040
ICON#2816400
ICON#2912240
ICON#307440
ICON#314880
ICON#324240
ICON#332960
ICON#3456720
ICON#3551440
ICON#3637520
ICON#3729840
ICON#3822160
ICON#3917360
ICON#4015440
ICON#4113840
ICON#4270190
ICON#43169360
ICON#44149200
ICON#4596400
ICON#4667600
ICON#4742640
ICON#4824400
ICON#4917200
ICON#5011280
GROUP_ICON#1003560
GROUP_ICON#1013560
VERSION#17640
MANIFEST#116450
module_namehintordfunction_name
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll631GetSystemTime
KERNEL32.dll627GetSystemInfo
KERNEL32.dll581GetProcAddress
KERNEL32.dll514GetLastError
KERNEL32.dll507GetFullPathNameW
KERNEL32.dll504GetFullPathNameA
KERNEL32.dll496GetFileSize
KERNEL32.dll487GetFileAttributesExW
KERNEL32.dll490GetFileAttributesW
KERNEL32.dll485GetFileAttributesA
KERNEL32.dll463GetDiskFreeSpaceW
KERNEL32.dll460GetDiskFreeSpaceA
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll354FreeLibrary
KERNEL32.dll350FormatMessageW
KERNEL32.dll349FormatMessageA
KERNEL32.dll343FlushFileBuffers
KERNEL32.dll214DeleteFileW
KERNEL32.dll211DeleteFileA
KERNEL32.dll158CreateMutexW
KERNEL32.dll140CreateFileMappingW
KERNEL32.dll137CreateFileMappingA
KERNEL32.dll143CreateFileW
KERNEL32.dll136CreateFileA
KERNEL32.dll82CloseHandle
KERNEL32.dll21AreFileApisANSI
KERNEL32.dll209DeleteCriticalSection
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll738InitializeCriticalSection
KERNEL32.dll747InterlockedDecrement
KERNEL32.dll221DeviceIoControl
KERNEL32.dll467GetDriveTypeW
KERNEL32.dll1177SetThreadPriority
KERNEL32.dll654GetThreadPriority
KERNEL32.dll452GetCurrentThread
KERNEL32.dll698GlobalFree
KERNEL32.dll709GlobalUnlock
KERNEL32.dll702GlobalLock
KERNEL32.dll691GlobalAlloc
KERNEL32.dll100CompareStringW
KERNEL32.dll353FreeEnvironmentStringsW
KERNEL32.dll474GetEnvironmentStringsW
KERNEL32.dll1111SetEnvironmentVariableW
KERNEL32.dll360GetACP
KERNEL32.dll567GetOEMCP
KERNEL32.dll370GetCPInfo
KERNEL32.dll372GetCPInfoExW
KERNEL32.dll264EnumSystemCodePagesW
KERNEL32.dll578GetPrivateProfileStringW
KERNEL32.dll1113SetEvent
KERNEL32.dll133CreateEventW
KERNEL32.dll1271WaitForMultipleObjects
KERNEL32.dll751InterlockedIncrement
KERNEL32.dll1039ResetEvent
KERNEL32.dll749InterlockedExchangeAdd
KERNEL32.dll16AllocConsole
KERNEL32.dll351FreeConsole
KERNEL32.dll612GetStdHandle
KERNEL32.dll439GetConsoleWindow
KERNEL32.dll434GetConsoleScreenBufferInfo
KERNEL32.dll1097SetConsoleWindowInfo
KERNEL32.dll410GetConsoleCP
KERNEL32.dll1068SetConsoleCP
KERNEL32.dll432GetConsoleOutputCP
KERNEL32.dll1090SetConsoleOutputCP
KERNEL32.dll1069SetConsoleCtrlHandler
KERNEL32.dll428GetConsoleMode
KERNEL32.dll1085SetConsoleMode
KERNEL32.dll1310WriteConsoleInputW
KERNEL32.dll1316WriteConsoleW
KERNEL32.dll1094SetConsoleTextAttribute
KERNEL32.dll416GetConsoleCursorInfo
KERNEL32.dll1071SetConsoleCursorInfo
KERNEL32.dll342FlushConsoleInputBuffer
KERNEL32.dll565GetNumberOfConsoleInputEvents
KERNEL32.dll405GetConsoleAliasW
KERNEL32.dll418GetConsoleDisplayMode
KERNEL32.dll1067SetConsoleActiveScreenBuffer
KERNEL32.dll294FillConsoleOutputAttribute
KERNEL32.dll296FillConsoleOutputCharacterW
KERNEL32.dll1051ScrollConsoleScreenBufferW
KERNEL32.dll1093SetConsoleScreenBufferSize
KERNEL32.dll438GetConsoleTitleW
KERNEL32.dll1096SetConsoleTitleW
KERNEL32.dll908PeekConsoleInputW
KERNEL32.dll952ReadConsoleInputW
KERNEL32.dll1073SetConsoleCursorPosition
KERNEL32.dll420GetConsoleFontSize
KERNEL32.dll444GetCurrentConsoleFont
KERNEL32.dll513GetLargestConsoleWindowSize
KERNEL32.dll957ReadConsoleOutputW
KERNEL32.dll1315WriteConsoleOutputW
KERNEL32.dll1171SetThreadExecutionState
KERNEL32.dll1139SetLastError
KERNEL32.dll609GetShortPathNameW
KERNEL32.dll527GetLongPathNameW
KERNEL32.dll379GetCalendarInfoW
KERNEL32.dll518GetLocaleInfoW
KERNEL32.dll1214SystemTimeToTzSpecificLocalTime
KERNEL32.dll644GetTempPathA
KERNEL32.dll838LocalFileTimeToFileTime
KERNEL32.dll515GetLocalTime
KERNEL32.dll521GetLogicalDrives
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll225DisconnectNamedPipe
KERNEL32.dll126CreateDirectoryExW
KERNEL32.dll129CreateDirectoryW
KERNEL32.dll1027RemoveDirectoryW
KERNEL32.dll864MoveFileExW
KERNEL32.dll1121SetFileAttributesW
KERNEL32.dll147CreateHardLinkW
KERNEL32.dll232DuplicateHandle
KERNEL32.dll896OpenProcess
KERNEL32.dll1216TerminateProcess
KERNEL32.dll568GetOverlappedResult
KERNEL32.dll101ConnectNamedPipe
KERNEL32.dll22AssignProcessToJobObject
KERNEL32.dll1137SetInformationJobObject
KERNEL32.dll150CreateJobObjectW
KERNEL32.dll933QueryInformationJobObject
KERNEL32.dll160CreateNamedPipeW
KERNEL32.dll836LocalAlloc
KERNEL32.dll114CopyFileExW
KERNEL32.dll1280WaitNamedPipeW
KERNEL32.dll1112SetErrorMode
KERNEL32.dll447GetCurrentDirectoryW
KERNEL32.dll1101SetCurrentDirectoryW
KERNEL32.dll1127SetFilePointerEx
KERNEL32.dll492GetFileInformationByHandle
KERNEL32.dll497GetFileSizeEx
KERNEL32.dll520GetLogicalDriveStringsW
KERNEL32.dll476GetEnvironmentVariableW
KERNEL32.dll532GetModuleFileNameW
KERNEL32.dll679GetVolumeInformationW
KERNEL32.dll1053SearchPathW
KERNEL32.dll928QueryDosDeviceW
KERNEL32.dll867MoveFileW
KERNEL32.dll285ExpandEnvironmentStringsW
KERNEL32.dll499GetFileType
KERNEL32.dll462GetDiskFreeSpaceExW
KERNEL32.dll681GetVolumeNameForVolumeMountPointW
KERNEL32.dll302FindClose
KERNEL32.dll587GetProcessHeaps
KERNEL32.dll336FindVolumeClose
KERNEL32.dll330FindNextVolumeW
KERNEL32.dll319FindFirstVolumeW
KERNEL32.dll291FileTimeToDosDateTime
KERNEL32.dll96CompareFileTime
KERNEL32.dll303FindCloseChangeNotification
KERNEL32.dll305FindFirstChangeNotificationW
KERNEL32.dll813LCMapStringW
KERNEL32.dll1195SetVolumeMountPointW
KERNEL32.dll205DefineDosDeviceW
KERNEL32.dll676GetVersionExW
KERNEL32.dll168CreateProcessW
KERNEL32.dll536GetModuleHandleW
KERNEL32.dll628GetSystemPowerStatus
KERNEL32.dll704GlobalMemoryStatusEx
KERNEL32.dll399GetComputerNameW
KERNEL32.dll398GetComputerNameExW
KERNEL32.dll282ExitThread
KERNEL32.dll1159SetStdHandle
KERNEL32.dll936QueryPerformanceFrequency
KERNEL32.dll572GetPrivateProfileIntW
KERNEL32.dll748InterlockedExchange
KERNEL32.dll643GetTempFileNameW
KERNEL32.dll830LoadLibraryExW
KERNEL32.dll1117SetFileApisToOEM
KERNEL32.dll1116SetFileApisToANSI
KERNEL32.dll1018ReleaseMutex
KERNEL32.dll594GetProcessTimes
KERNEL32.dll563GetNumberFormatW
KERNEL32.dll1326WriteProcessMemory
KERNEL32.dll1263VirtualProtect
KERNEL32.dll780IsValidLocale
KERNEL32.dll269EnumSystemLocalesA
KERNEL32.dll516GetLocaleInfoA
KERNEL32.dll667GetUserDefaultLCID
KERNEL32.dll611GetStartupInfoW
KERNEL32.dll1135SetHandleCount
KERNEL32.dll739InitializeCriticalSectionAndSpinCount
KERNEL32.dll778IsValidCodePage
KERNEL32.dll617GetStringTypeW
KERNEL32.dll1222TlsFree
KERNEL32.dll1224TlsSetValue
KERNEL32.dll1223TlsGetValue
KERNEL32.dll1221TlsAlloc
KERNEL32.dll772IsProcessorFeaturePresent
KERNEL32.dll768IsDebuggerPresent
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll723HeapSetInformation
KERNEL32.dll391GetCommandLineW
KERNEL32.dll281ExitProcess
KERNEL32.dll721HeapQueryInformation
KERNEL32.dll664GetTimeZoneInformation
KERNEL32.dll181CreateThread
KERNEL32.dll945RaiseException
KERNEL32.dll1048RtlUnwind
KERNEL32.dll645GetTempPathW
KERNEL32.dll659GetTickCount
KERNEL32.dll675GetVersionExA
KERNEL32.dll715HeapAlloc
KERNEL32.dll717HeapCreate
KERNEL32.dll718HeapDestroy
KERNEL32.dll719HeapFree
KERNEL32.dll722HeapReAlloc
KERNEL32.dll724HeapSize
KERNEL32.dll727HeapValidate
KERNEL32.dll828LoadLibraryA
KERNEL32.dll831LoadLibraryW
KERNEL32.dll840LocalFree
KERNEL32.dll850LockFile
KERNEL32.dll851LockFileEx
KERNEL32.dll855MapViewOfFile
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll960ReadFile
KERNEL32.dll1107SetEndOfFile
KERNEL32.dll1126SetFilePointer
KERNEL32.dll1202Sleep
KERNEL32.dll1213SystemTimeToFileTime
KERNEL32.dll1236UnlockFile
KERNEL32.dll1237UnlockFileEx
KERNEL32.dll1238UnmapViewOfFile
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll1317WriteFile
KERNEL32.dll1273WaitForSingleObject
KERNEL32.dll905OutputDebugStringA
KERNEL32.dll906OutputDebugStringW
KERNEL32.dll293FileTimeToSystemTime
KERNEL32.dll586GetProcessHeap
KERNEL32.dll1110SetEnvironmentVariableA
USER32.dll418GetWindowTextLengthW
USER32.dll419GetWindowTextW
USER32.dll566PostMessageW
USER32.dll756ToUnicodeEx
USER32.dll801VkKeyScanW
USER32.dll406GetWindowLongW
USER32.dll480IsWindowVisible
USER32.dll242EnumWindows
USER32.dll420GetWindowThreadProcessId
USER32.dll736ShowWindowAsync
USER32.dll404GetWindowInfo
USER32.dll567PostQuitMessage
USER32.dll156DefWindowProcW
USER32.dll411GetWindowPlacement
USER32.dll482IsZoomed
USER32.dll452IsCharAlphaW
USER32.dll60CharUpperW
USER32.dll525MessageBeep
USER32.dll774UnregisterClassW
USER32.dll589RegisterClassExW
USER32.dll110CreateWindowExW
USER32.dll592RegisterClipboardFormatW
USER32.dll550OpenClipboard
USER32.dll299GetDoubleClickTime
USER32.dll73CloseClipboard
USER32.dll278GetClipboardData
USER32.dll458IsClipboardFormatAvailable
USER32.dll213EmptyClipboard
USER32.dll646SetClipboardData
USER32.dll175DispatchMessageW
USER32.dll349GetMessageW
USER32.dll748SystemParametersInfoW
USER32.dll659SetForegroundWindow
USER32.dll451IsCharAlphaNumericW
USER32.dll43CharLowerA
USER32.dll57CharUpperA
USER32.dll455IsCharUpperA
USER32.dll453IsCharLowerA
USER32.dll449IsCharAlphaA
USER32.dll545OemToCharA
USER32.dll53CharToOemA
USER32.dll546OemToCharBuffA
USER32.dll450IsCharAlphaNumericA
USER32.dll55CharToOemBuffW
USER32.dll46CharLowerW
USER32.dll735ShowWindow
USER32.dll166DestroyWindow
USER32.dll252FlashWindowEx
USER32.dll465IsIconic
USER32.dll382GetSystemMetrics
USER32.dll319GetKeyboardLayoutList
USER32.dll764TranslateMessage
USER32.dll800VkKeyScanExW
USER32.dll456IsCharUpperW
USER32.dll520MapVirtualKeyW
USER32.dll317GetKeyState
USER32.dll816keybd_event
USER32.dll495LoadImageW
USER32.dll454IsCharLowerW
USER32.dll45CharLowerBuffW
USER32.dll636SendMessageW
USER32.dll806WaitForInputIdle
USER32.dll59CharUpperBuffW
WINSPOOL.DRV203
WINSPOOL.DRV29ClosePrinter
WINSPOOL.DRV81EndDocPrinter
WINSPOOL.DRV188WritePrinter
WINSPOOL.DRV104EnumPrintersW
WINSPOOL.DRV144OpenPrinterW
WINSPOOL.DRV182StartDocPrinterW
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll288FreeSid
ADVAPI32.dll694SetSecurityDescriptorDacl
ADVAPI32.dll678SetEntriesInAclW
ADVAPI32.dll375InitializeSecurityDescriptor
ADVAPI32.dll32AllocateAndInitializeSid
ADVAPI32.dll612RegOpenKeyW
ADVAPI32.dll594RegEnumValueW
ADVAPI32.dll591RegEnumKeyExW
ADVAPI32.dll216DecryptFileW
ADVAPI32.dll249EncryptFileW
ADVAPI32.dll682SetFileSecurityW
ADVAPI32.dll304GetFileSecurityW
ADVAPI32.dll689SetNamedSecurityInfoW
ADVAPI32.dll399LookupAccountNameW
ADVAPI32.dll116ConvertStringSidToSidW
ADVAPI32.dll263EqualSid
ADVAPI32.dll108ConvertSidToStringSidW
ADVAPI32.dll401LookupAccountSidW
ADVAPI32.dll118CopySid
ADVAPI32.dll310GetLengthSid
ADVAPI32.dll390IsValidSid
ADVAPI32.dll331GetSecurityDescriptorOwner
ADVAPI32.dll384IsTextUnicode
ADVAPI32.dll81CheckTokenMembership
ADVAPI32.dll357GetUserNameW
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll407LookupPrivilegeValueW
ADVAPI32.dll503OpenProcessToken
ADVAPI32.dll346GetTokenInformation
ADVAPI32.dll609RegOpenKeyExW
SHELL32.dll289ShellExecuteExW
SHELL32.dll195SHGetFolderPathW
SHELL32.dll290ShellExecuteW
SHELL32.dll172SHFileOperationW
NETAPI32.dll255NetUserGetInfo
NETAPI32.dll220NetServerGetInfo
NETAPI32.dll101NetApiBufferFree
MPR.dll12WNetCancelConnection2W
MPR.dll6WNetAddConnection2W
MPR.dll61WNetOpenEnumW
MPR.dll28WNetEnumResourceW
MPR.dll16WNetCloseEnum
MPR.dll36WNetGetConnectionW
MPR.dll56WNetGetUniversalNameW
ole32.dll108CoUninitialize
ole32.dll63CoInitializeEx
ole32.dll16CoCreateInstance
ole32.dll151GetRunningObjectTable
ole32.dll104CoTaskMemFree
ole32.dll15CoCreateGuid
ole32.dll126CreateFileMoniker
PSAPI.DLL16GetModuleFileNameExW
Secur32.dll30GetUserNameExW
SETUPAPI.dll95CM_Get_Device_ID_List_SizeW
SETUPAPI.dll91CM_Get_Device_ID_ListW
SETUPAPI.dll153CM_Locate_DevNodeW
SETUPAPI.dll323SetupDiEnumDeviceInterfaces
SETUPAPI.dll366SetupDiGetDeviceInterfaceDetailW
SETUPAPI.dll194CM_Request_Device_EjectW
SETUPAPI.dll84CM_Get_DevNode_Status
SETUPAPI.dll62CM_Get_Child
SETUPAPI.dll87CM_Get_Device_IDW
SETUPAPI.dll342SetupDiGetClassDevsW
SETUPAPI.dll405SetupDiOpenDeviceInfoW
SETUPAPI.dll372SetupDiGetDeviceRegistryPropertyW
SETUPAPI.dll319SetupDiDestroyDeviceInfoList
SETUPAPI.dll139CM_Get_Sibling
RPCRT4.dll512UuidFromStringW
RPCRT4.dll513UuidHash
RPCRT4.dll507UuidCreate

StringTable 000004E4

CompanyNameEugene Roshal & FAR Group
FileDescriptionFile and archive manager
FileVersionv3.0 (build 3367) x86
InternalNameFar
LegalCopyright© Eugene Roshal, 1996-2000. © Far Group, 2000-2013
OriginalFilenameFar.exe
ProductNameFar Manager

VS_FIXEDFILEINFO

FileVersion3.0.3367.0
ProductVersion3.0.3367.0
StrucVersion0x10000
FileFlagsMask0
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
03125248EXE04/26/2013 00:00:57#
15c115HTM#
2b07007615PNG(256 x 256)#
2c8e687019PNG(256 x 256)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER
[?] can't find file_offset of VA 0x2ff53c