filenamecr_13.exe
size147456 (0x24000)
md5f9f9f10f98db27e36275b3101514aaed
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
198034121
61720207
147299137
118168217
6172033
00224
61720211
118168104
147299252

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x47987840
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x1f000
SizeOfInitializedData0x4000
SizeOfUninitializedData0
AddressOfEntryPoint0x1f416
BaseOfCode0x1000
BaseOfData0x20000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x24000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x1e9260x1f000R-X CODE
.rdata0x200000x17900x2000R-- IDATA
.data0x220000x2440x1000RW- IDATA
.rsrc0x230000x9880x1000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x206600x1a4
RESOURCE0x230000x988
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x200000x3d0
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#17440
ICON#22960
DIALOG#1021680
GROUP_ICON#128340
VERSION#18400
module_namehintordfunction_name
MPR.dll2MultinetGetConnectionPerformanceW
SHLWAPI.dll122SHOpenRegStreamA
SHLWAPI.dll120SHGetValueW
COMCTL32.dll2CreatePropertySheetPageA
MSVCRT.dll106__p__commode
MSVCRT.dll271_initterm
MSVCRT.dll183_controlfp
MSVCRT.dll426_setmbcp
MSVCRT.dll111__p__fmode
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll73__CxxFrameHandler
MSVCRT.dll16void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCRT.dll85__dllonexit
MSVCRT.dll390_onexit
MSVCRT.dll211_exit
MSVCRT.dll72_XcptFilter
MSVCRT.dll585exit
MSVCRT.dll143_acmdln
MSVCRT.dll88__getmainargs
MSVCRT.dll202_except_handler3
MSVCRT.dll129__set_app_type
MSVCRT.dll131__setusermatherr
ole32.dll221OleSetContainedObject
ole32.dll139HGLOBAL_UserUnmarshal
ole32.dll244SNB_UserSize
ole32.dll4CLIPFORMAT_UserUnmarshal
ole32.dll228ProgIDFromCLSID
ole32.dll242SNB_UserFree
ole32.dll159HWND_UserUnmarshal
ole32.dll203OleIsCurrentClipboard
ole32.dll50CoIsHandlerConnected
ole32.dll117GetHGlobalFromStream
CLUSAPI.dll47CreateClusterResourceType
CLUSAPI.dll30ClusterRegDeleteValue
CLUSAPI.dll44CreateClusterGroup
CLUSAPI.dll52FailClusterResource
Msi.dll42
Msi.dll10
Msi.dll54
Msi.dll62
USER32.dll679WinHelpW
USER32.dll206EnumWindowStationsA
USER32.dll387IsCharUpperA
USER32.dll325GetSystemMenu
USER32.dll183EnableWindow
USER32.dll490PtInRect
USER32.dll54CheckRadioButton
USER32.dll133DefWindowProcW
USER32.dll354GetWindowThreadProcessId
USER32.dll66CopyIcon
USER32.dll386IsCharLowerW
USER32.dll540SetActiveWindow
USER32.dll398IsRectEmpty
USER32.dll627TabbedTextOutA
USER32.dll555SetDlgItemInt
USER32.dll326GetSystemMetrics
USER32.dll414LoadIconA
USER32.dll39CharNextW
USER32.dll272GetKeyNameTextA
USER32.dll292GetMenuItemInfoA
USER32.dll602SetWindowPlacement
USER32.dll637TrackPopupMenuEx
USER32.dll440MapVirtualKeyW
USER32.dll516RemoveMenu
USER32.dll532SendMessageA
USER32.dll607SetWindowTextW
USER32.dll396IsIconic
GDI32.dll504SetWinMetaFileBits
GDI32.dll512StretchBlt
GDI32.dll490SetPixelV
GDI32.dll359GetTextCharset
GDI32.dll41CreateCompatibleBitmap
GDI32.dll458SetArcDirection
GDI32.dll73CreateRectRgnIndirect
GDI32.dll522UpdateColors
WINSPOOL.DRV106GetJobA
WINSPOOL.DRV151SetPrinterDataA
WINSPOOL.DRV97EnumPrintersA
WINSPOOL.DRV76EndPagePrinter
WINSPOOL.DRV85EnumPrintProcessorDatatypesA
WINSPOOL.DRV7AddMonitorW
WINSPOOL.DRV14AddPrintProvidorA
WINSPOOL.DRV39DeleteFormA
WINSPOOL.DRV124OpenPrinterA
WINSPOOL.DRV98EnumPrintersW
WINSPOOL.DRV130PrinterMessageBoxA
OLEAUT32.dll299
OLEAUT32.dll174
OLEAUT32.dll265
SETUPAPI.dll200SetupDiUnremoveDevice
SETUPAPI.dll61SetupCommitFileQueueA
SETUPAPI.dll280SetupQuerySpaceRequiredOnDriveA
SETUPAPI.dll46SetupAddInstallSectionToDiskSpaceListA
SETUPAPI.dll150SetupDiGetDriverInstallParamsW
pdh.dll33PdhGetDefaultPerfObjectA
pdh.dll25PdhFormatFromRawValue
VERSION.dll3GetFileVersionInfoW
RASAPI32.dll72RasSetEntryDialParamsA
RASAPI32.dll15RasEditPhonebookEntryA
RASAPI32.dll8RasCreatePhonebookEntryA
RASAPI32.dll79RasValidateEntryNameA
RASAPI32.dll45RasGetEntryPropertiesW
RASAPI32.dll43RasGetEntryDialParamsW
KERNEL32.dll136FileTimeToDosDateTime
KERNEL32.dll282GetLastError
KERNEL32.dll157FindNextFileA
KERNEL32.dll384GlobalAddAtomW
KERNEL32.dll308GetPrivateProfileIntA
KERNEL32.dll137FileTimeToLocalFileTime
KERNEL32.dll288GetLogicalDrives
KERNEL32.dll303GetNumberOfConsoleInputEvents
KERNEL32.dll38ConvertDefaultLocale
KERNEL32.dll85DeleteCriticalSection
KERNEL32.dll68CreateProcessA
KERNEL32.dll360GetThreadLocale
KERNEL32.dll258GetDiskFreeSpaceExW
KERNEL32.dll280GetHandleInformation
KERNEL32.dll266GetEnvironmentVariableW
KERNEL32.dll318GetProcAddress
KERNEL32.dll163FindResourceA
KERNEL32.dll245GetCurrentDirectoryA
KERNEL32.dll179FreeEnvironmentStringsW
KERNEL32.dll262GetEnvironmentStrings
KERNEL32.dll294GetModuleHandleA
KERNEL32.dll383GlobalAddAtomA
KERNEL32.dll336GetStartupInfoA
ADVAPI32.dll252LsaClose
ADVAPI32.dll216GetUserNameW
ADVAPI32.dll397RegisterEventSourceW
ADVAPI32.dll25AllocateLocallyUniqueId
ADVAPI32.dll45ChangeServiceConfigA
ADVAPI32.dll408SetEntriesInAclW
ADVAPI32.dll292LsaRemoveAccountRights
ADVAPI32.dll337QueryServiceConfigW
ADVAPI32.dll380RegQueryValueExW
ADVAPI32.dll411SetFileSecurityA
ADVAPI32.dll413SetKernelObjectSecurity
ADVAPI32.dll425SetSecurityInfo
ADVAPI32.dll407SetEntriesInAclA
ADVAPI32.dll123DuplicateToken
ADVAPI32.dll24AllocateAndInitializeSid
IMM32.dll61ImmInstallIMEA
IMM32.dll29ImmGetCompositionWindow
IMM32.dll5ImmConfigureIMEW
OLEACC.dll1AccessibleObjectFromEvent
MFC42.DLL2985
MFC42.DLL3262
MFC42.DLL3136
MFC42.DLL4465
MFC42.DLL3259
MFC42.DLL3147
MFC42.DLL2982
MFC42.DLL5714
MFC42.DLL5289
MFC42.DLL5307
MFC42.DLL3081
MFC42.DLL4079
MFC42.DLL2725
MFC42.DLL5302
MFC42.DLL2976
MFC42.DLL3830
MFC42.DLL3831
MFC42.DLL3825
MFC42.DLL3079
MFC42.DLL4080
MFC42.DLL4622
MFC42.DLL4424
MFC42.DLL3738
MFC42.DLL5300
MFC42.DLL3346
MFC42.DLL2396
MFC42.DLL5199
MFC42.DLL1089
MFC42.DLL3922
MFC42.DLL5731
MFC42.DLL2512
MFC42.DLL2554
MFC42.DLL4486
MFC42.DLL6375
MFC42.DLL4274
MFC42.DLL4673
MFC42.DLL561
MFC42.DLL815
MFC42.DLL2514
MFC42.DLL641
MFC42.DLL5265
MFC42.DLL4376
MFC42.DLL4853
MFC42.DLL4998
MFC42.DLL6052
MFC42.DLL4078
MFC42.DLL1775
MFC42.DLL4407
MFC42.DLL5241
MFC42.DLL2385
MFC42.DLL5163
MFC42.DLL6374
MFC42.DLL4353
MFC42.DLL5280
MFC42.DLL3798
MFC42.DLL4837
MFC42.DLL4441
MFC42.DLL2648
MFC42.DLL2055
MFC42.DLL6376
MFC42.DLL3749
MFC42.DLL5065
MFC42.DLL1576
MFC42.DLL1727
MFC42.DLL5261
MFC42.DLL2446
MFC42.DLL2124
MFC42.DLL5277
MFC42.DLL4627
MFC42.DLL4425
MFC42.DLL3597
MFC42.DLL324
MFC42.DLL4234
MFC42.DLL755
MFC42.DLL470
MFC42.DLL1168
MFC42.DLL2379
MFC42.DLL1146
MFC42.DLL4698

StringTable 040904b0

Comments
CompanyName
FileDescriptionsoma spherically orientate
FileVersion1, 0, 0, 1
InternalNamescout
LegalCopyrightCopyright (C) 2015
LegalTrademarks
OriginalFilenameravisher.EXE
PrivateBuild
ProductNamesolar pleas
ProductVersion1, 0, 0, 1
SpecialBuild

VS_FIXEDFILEINFO

FileVersion1.0.0.1
ProductVersion1.0.0.1
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
0147456EXE01/24/2008 11:36:32#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK