| filename | FPSCFlodaaa_4.exe | |
|---|---|---|
| size | 3257344 (0x31b400) | |
| md5 | e59c7a7bfe6fbf73c6fde0108cb375e9 | |
| type | MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS | |
| mimetype | application/x-dosexec | |
| clamav | OK | |
| virustotal | → scan with virustotal.com | |
| histogram | ||
MZ Header
| signature | MZ |
| bytes_in_last_block | 0x40 |
| blocks_in_file | 1 |
| num_relocs | 0 |
| header_paragraphs | 2 |
| min_extra_paragraphs | 0 |
| max_extra_paragraphs | 0xffff |
| ss | 0 |
| sp | 0xb8 |
| checksum | 0 |
| ip | 0 |
| cs | 0 |
| reloc_table_offset | 0xa |
| overlay_number | 0 |
| reserved0 | 0xeba1f0e00000000 |
| oem_id | 0xb400 |
| oem_info | 0xcd09 |
| reserved2 | 0x4c01b821 |
| reserved3 | 0x695721cd |
| reserved4 | 0x2032336e |
| reserved5 | 0x4558452e |
| reserved6 | 0x240a0d2e |
| lfanew | 0x40 |
PE Header
Packer / Compiler
Sections
| name | va | vsize | raw size | flags | |
|---|---|---|---|---|---|
| .FPSCF1 | 0x1000 | 0x854000 | 0x316000 | RWX CODE IDATA UDATA | |
| .FPSCF2 | 0x855000 | 0x1289 | 0x1400 | RWX CODE IDATA UDATA | |
| .rsrc | 0x857000 | 0x3dcc | 0x3e00 | RW- IDATA |
Data Directory
TLS
| raw start | raw end | index | callbks | zero fill | flags | |
|---|---|---|---|---|---|---|
| 0xc56278 | 0xc56289 | 0xc5626c | 0 | 0 | 0 |
| module_name | hint | ord | function_name |
|---|---|---|---|
| KERNEL32.DLL | GetModuleHandleA | ||
| KERNEL32.DLL | GetProcAddress | ||
| msi.dll | 112 | ||
| ADVAPI32.dll | CopySid | ||
| WS2_32.dll | 3 | ||
| OLEAUT32.dll | 7 | ||
| urlmon.dll | URLDownloadToFileA | ||
| WININET.dll | DeleteUrlCacheEntryA | ||
| USER32.dll | GetDC | ||
| SHELL32.dll | SHGetMalloc | ||
| ole32.dll | DoDragDrop | ||
| GDI32.dll | BitBlt | ||
| IMM32.dll | ImmNotifyIME | ||
| WINMM.dll | PlaySoundW |
| ord | entry_va | function_name | |
|---|---|---|---|
| 1 | 0x114a50 | z_adler32 | |
| 2 | 0x114cc0 | z_adler32_combine | |
| 3 | 0x114cc0 | z_adler32_combine64 | |
| 4 | 0xc9ef0 | z_compress | |
| 5 | 0xc9f10 | z_compress2 | |
| 6 | 0xc9fc0 | z_compressBound | |
| 7 | 0x115170 | z_crc32 | |
| 8 | 0x115190 | z_crc32_combine | |
| 9 | 0x115190 | z_crc32_combine64 | |
| 10 | 0x106e10 | z_deflate | |
| 11 | 0x107650 | z_deflateBound | |
| 12 | 0x107730 | z_deflateCopy | |
| 13 | 0x1078e0 | z_deflateEnd | |
| 14 | 0x1079b0 | z_deflateInit2_ | |
| 15 | 0x107be0 | z_deflateInit_ | |
| 16 | 0x107c10 | z_deflateParams | |
| 17 | 0x107d00 | z_deflatePrime | |
| 18 | 0x107d40 | z_deflateReset | |
| 19 | 0x107e00 | z_deflateSetDictionary | |
| 20 | 0x107ef0 | z_deflateSetHeader | |
| 21 | 0x107f20 | z_deflateTune | |
| 22 | 0x1151a0 | z_get_crc_table | |
| 23 | 0x1080c0 | z_inflate | |
| 24 | 0x109770 | z_inflateCopy | |
| 25 | 0x1098d0 | z_inflateEnd | |
| 26 | 0x109920 | z_inflateGetHeader | |
| 27 | 0x109950 | z_inflateInit2_ | |
| 28 | 0x109a10 | z_inflateInit_ | |
| 29 | 0x109a30 | z_inflateMark | |
| 30 | 0x109a90 | z_inflatePrime | |
| 31 | 0x109b00 | z_inflateReset | |
| 32 | 0x109bb0 | z_inflateReset2 | |
| 33 | 0x109c40 | z_inflateSetDictionary | |
| 34 | 0x109d20 | z_inflateSync | |
| 35 | 0x109e00 | z_inflateSyncPoint | |
| 36 | 0x109e30 | z_inflateUndermine | |
| 37 | 0xc9fe0 | z_uncompress | |
| 38 | 0x1151b0 | z_zError | |
| 39 | 0x115200 | z_zlibCompileFlags | |
| 40 | 0x115210 | z_zlibVersion |
 |
| Please donate some bucks to keep this site up and running: | |
| Ko-fi | |
|---|---|
| Yandex.Money | |
| Thank you! | |
everything is OK