filenamejinui.exe
size450560 (0x6e000)
md5f8c3112e45fdfc14bafa82aca5c4c4fc
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
1255072717
10950727111
1105072738
9340355
10106
114507271
124507271
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x521b4341
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion8.0
SizeOfCode0x11000
SizeOfInitializedData0x1bb000
SizeOfUninitializedData0
AddressOfEntryPoint0x78b9
BaseOfCode0x1000
BaseOfData0x12000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x1cd000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0 2005

Sections

namevavsizeraw sizeflags
.text0x10000x1009c0x11000R-X CODE
.rdata0x120000x2657c0x27000R-- IDATA
.data0x390000x1928a40x34000RW- IDATA
.rsrc0x1cc0000x5380x1000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x37da40x3c
RESOURCE0x1cc0000x538
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x376e80x40
Bound_IAT00
IAT0x120000x170
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#18240
MANIFEST#13460
module_namehintordfunction_name
GDI32.dll607SaveDC
GDI32.dll191EndPage
GDI32.dll144CreatePen
GDI32.dll534RestoreDC
GDI32.dll70CreateDCA
GDI32.dll418GetObjectA
GDI32.dll669StartDocA
GDI32.dll59CreateFontIndirectA
GDI32.dll159DeleteDC
GDI32.dll269ExtTextOutA
GDI32.dll596Rectangle
GDI32.dll67BitBlt
GDI32.dll156DPtoLP
GDI32.dll222DeleteObject
KERNEL32.dll472GetLogicalDriveStringsA
KERNEL32.dll477GetProcAddress
KERNEL32.dll402GetModuleHandleA
KERNEL32.dll876SetSystemTimeAdjustment
KERNEL32.dll427GetLastError
KERNEL32.dll109CloseHandle
KERNEL32.dll200DuplicateHandle
KERNEL32.dll332GetCurrentProcess
KERNEL32.dll213DeleteCriticalSection
KERNEL32.dll323GetCommandLineA
KERNEL32.dll600HeapFree
KERNEL32.dll548GetVersionExA
KERNEL32.dll582HeapAlloc
KERNEL32.dll471GetProcessHeap
KERNEL32.dll480GetStartupInfoA
KERNEL32.dll930TerminateProcess
KERNEL32.dll906UnhandledExceptionFilter
KERNEL32.dll842SetUnhandledExceptionFilter
KERNEL32.dll625IsDebuggerPresent
KERNEL32.dll879SetStdHandle
KERNEL32.dll206EnterCriticalSection
KERNEL32.dll689LeaveCriticalSection
KERNEL32.dll368GetFileType
KERNEL32.dll864SetHandleCount
KERNEL32.dll494GetStdHandle
KERNEL32.dll750RtlUnwind
KERNEL32.dll158CreateFileA
KERNEL32.dll686MultiByteToWideChar
KERNEL32.dll265ExitProcess
KERNEL32.dll947WriteFile
KERNEL32.dll384GetModuleFileNameA
KERNEL32.dll337FreeEnvironmentStringsA
KERNEL32.dll384GetEnvironmentStrings
KERNEL32.dll316FreeEnvironmentStringsW
KERNEL32.dll1005WideCharToMultiByte
KERNEL32.dll399GetEnvironmentStringsW
KERNEL32.dll950TlsGetValue
KERNEL32.dll937TlsAlloc
KERNEL32.dll895TlsSetValue
KERNEL32.dll957TlsFree
KERNEL32.dll634InterlockedIncrement
KERNEL32.dll820SetLastError
KERNEL32.dll365GetCurrentThreadId
KERNEL32.dll580InterlockedDecrement
KERNEL32.dll553HeapDestroy
KERNEL32.dll614HeapCreate
KERNEL32.dll951VirtualFree
KERNEL32.dll764QueryPerformanceCounter
KERNEL32.dll554GetTickCount
KERNEL32.dll340GetCurrentProcessId
KERNEL32.dll514GetSystemTimeAsFileTime
KERNEL32.dll680RaiseException
KERNEL32.dll877SetFilePointer
KERNEL32.dll734ReadFile
KERNEL32.dll590InitializeCriticalSection
KERNEL32.dll935Sleep
KERNEL32.dll344GetConsoleCP
KERNEL32.dll375GetConsoleMode
KERNEL32.dll864SetEndOfFile
KERNEL32.dll970VirtualAlloc
KERNEL32.dll617HeapReAlloc
KERNEL32.dll278FlushFileBuffers
KERNEL32.dll334GetCPInfo
KERNEL32.dll273GetACP
KERNEL32.dll404GetOEMCP
KERNEL32.dll628IsValidCodePage
KERNEL32.dll597LoadLibraryA
KERNEL32.dll556HeapSize
KERNEL32.dll666LCMapStringA
KERNEL32.dll594LCMapStringW
KERNEL32.dll1001WriteConsoleA
KERNEL32.dll406GetConsoleOutputCP
KERNEL32.dll986WriteConsoleW
KERNEL32.dll457GetStringTypeA
KERNEL32.dll456GetStringTypeW
KERNEL32.dll391GetLocaleInfoA

StringTable 047f04E4

CompanyNameComplete Bit Inc.
FileDescriptionComplete Bit Bring
FileVersion11.0.45.452 liquid
InternalNamesurpriseKi.exe
LegalCopyright(c) Complete Bit. All rights reserved.
OriginalFilenamesurpriseKi.exe
ProductNameComplete Bit Bring
ProductVersion11.0.45.452

VS_FIXEDFILEINFO

FileVersion11.0.45.452
ProductVersion11.0.45.452
StrucVersion0x10000
FileFlagsMask0
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0450560EXE08/26/2013 12:00:01#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK