"qicon changer.exe" v1.0 PEStudio analysis

<?xml version="1.0" encoding="utf-8"?>
<!--this document has been created with PeStudio Version 3.61-->
<assembly name="qicon changer.exe">
<characteristics>
<image_size_in_bytes>1934848</image_size_in_bytes>
<image_version>n/a</image_version>
</characteristics>
<today>
<time>17/09/2013</time>
<date>13:16:53</date>
</today>
<file_header>
<image_signature>Windows Application</image_signature>
<target_cpu>Intel 386 or later</target_cpu>
<sections_number>10</sections_number>
<creation_time>Tue Mar 13 17:04:34 2012
</creation_time>
<characteristics hexadecimal="0x0000818E">
<relocations_stripped>No</relocations_stripped>
<large_address_aware>No</large_address_aware>
<executable>Yes</executable>
<architecture_32bit>Yes</architecture_32bit>
<uniprocessor_only>No</uniprocessor_only>
<system_image>No</system_image>
<dynamic_link_library>No</dynamic_link_library>
<debug_stripped>No</debug_stripped>
<copy_from_removable_media>No</copy_from_removable_media>
<copy_from_network>No</copy_from_network>
</characteristics>
</file_header>
<evidences>
<entry_point_outside_code_section>No</entry_point_outside_code_section>
<import_address_table_too_small>Yes</import_address_table_too_small>
<image_imports_obsolete_functions>No</image_imports_obsolete_functions>
<image_exports_obsolete_functions>No</image_exports_obsolete_functions>
<image_contains_caves>Yes</image_contains_caves>
<number_of_imported_symbols_too_small>Yes</number_of_imported_symbols_too_small>
<image_checksum_empty>Yes</image_checksum_empty>
<image_digitally_signed>No</image_digitally_signed>
<image_bound>Yes</image_bound>
<image_binds_libraries_dynamically>No</image_binds_libraries_dynamically>
<image_uses_static_thread_local_storage>No</image_uses_static_thread_local_storage>
<image_is_large_address_space_aware>No</image_is_large_address_space_aware>
<image_creates_processes>No</image_creates_processes>
<image_compressed_or_encrypted>No</image_compressed_or_encrypted>
<number_of_sections_suspicious>No</number_of_sections_suspicious>
<image_file_has_been_renamed>No</image_file_has_been_renamed>
<image_has_non_standard_section_names>Yes</image_has_non_standard_section_names>
<size_of_dos_stub_is_unusual>No</size_of_dos_stub_is_unusual>
<unusual_resources_types>No</unusual_resources_types>
<resources_bigger_than_code>No</resources_bigger_than_code>
<image_is_a_com_server>No</image_is_a_com_server>
<image_is_aslr_aware>No</image_is_aslr_aware>
<image_is_dep_aware>No</image_is_dep_aware>
</evidences>
<sections count="10">
<section>
<name>.text</name>
<virtual_size>1526536 (bytes)</virtual_size>
<virtual_address>0x00001000</virtual_address>
<size_of_raw_data>1526784 (bytes)</size_of_raw_data>
<pointer_to_raw_data>0x00000400</pointer_to_raw_data>
<cave_size>248 (bytes)</cave_size>
<contains_initialized_data>No</contains_initialized_data>
<contains_uninitialized_data>No</contains_uninitialized_data>
<contains_extented_relocations>No</contains_extented_relocations>
<can_be_discarded>No</can_be_discarded>
<can_be_cached>No</can_be_cached>
<can_be_paged>Yes</can_be_paged>
<can_be_shared>No</can_be_shared>
<can_be_executed>Yes</can_be_executed>
<can_be_read>Yes</can_be_read>
<can_be_written_to>No</can_be_written_to>
</section>
<section>
<name>.itext</name>
<virtual_size>4944 (bytes)</virtual_size>
<virtual_address>0x00176000</virtual_address>
<size_of_raw_data>5120 (bytes)</size_of_raw_data>
<pointer_to_raw_data>0x00175000</pointer_to_raw_data>
<cave_size>176 (bytes)</cave_size>
<contains_initialized_data>No</contains_initialized_data>
<contains_uninitialized_data>No</contains_uninitialized_data>
<contains_extented_relocations>No</contains_extented_relocations>
<can_be_discarded>No</can_be_discarded>
<can_be_cached>No</can_be_cached>
<can_be_paged>Yes</can_be_paged>
<can_be_shared>No</can_be_shared>
<can_be_executed>Yes</can_be_executed>
<can_be_read>Yes</can_be_read>
<can_be_written_to>No</can_be_written_to>
</section>
<section>
<name>.data</name>
<virtual_size>34124 (bytes)</virtual_size>
<virtual_address>0x00178000</virtual_address>
<size_of_raw_data>34304 (bytes)</size_of_raw_data>
<pointer_to_raw_data>0x00176400</pointer_to_raw_data>
<cave_size>180 (bytes)</cave_size>
<contains_initialized_data>Yes</contains_initialized_data>
<contains_uninitialized_data>No</contains_uninitialized_data>
<contains_extented_relocations>No</contains_extented_relocations>
<can_be_discarded>No</can_be_discarded>
<can_be_cached>No</can_be_cached>
<can_be_paged>Yes</can_be_paged>
<can_be_shared>No</can_be_shared>
<can_be_executed>No</can_be_executed>
<can_be_read>Yes</can_be_read>
<can_be_written_to>Yes</can_be_written_to>
</section>
<section>
<name>.bss</name>
<virtual_size>31328 (bytes)</virtual_size>
<virtual_address>0x00181000</virtual_address>
<size_of_raw_data>0 (bytes)</size_of_raw_data>
<pointer_to_raw_data>0x0017EA00</pointer_to_raw_data>
<cave_size>0 (bytes)</cave_size>
<contains_initialized_data>No</contains_initialized_data>
<contains_uninitialized_data>No</contains_uninitialized_data>
<contains_extented_relocations>No</contains_extented_relocations>
<can_be_discarded>No</can_be_discarded>
<can_be_cached>No</can_be_cached>
<can_be_paged>Yes</can_be_paged>
<can_be_shared>No</can_be_shared>
<can_be_executed>No</can_be_executed>
<can_be_read>Yes</can_be_read>
<can_be_written_to>Yes</can_be_written_to>
</section>
<section>
<name>.idata</name>
<virtual_size>13674 (bytes)</virtual_size>
<virtual_address>0x00189000</virtual_address>
<size_of_raw_data>13824 (bytes)</size_of_raw_data>
<pointer_to_raw_data>0x0017EA00</pointer_to_raw_data>
<cave_size>150 (bytes)</cave_size>
<contains_initialized_data>Yes</contains_initialized_data>
<contains_uninitialized_data>No</contains_uninitialized_data>
<contains_extented_relocations>No</contains_extented_relocations>
<can_be_discarded>No</can_be_discarded>
<can_be_cached>No</can_be_cached>
<can_be_paged>Yes</can_be_paged>
<can_be_shared>No</can_be_shared>
<can_be_executed>No</can_be_executed>
<can_be_read>Yes</can_be_read>
<can_be_written_to>Yes</can_be_written_to>
</section>
<section>
<name>.didata</name>
<virtual_size>928 (bytes)</virtual_size>
<virtual_address>0x0018D000</virtual_address>
<size_of_raw_data>1024 (bytes)</size_of_raw_data>
<pointer_to_raw_data>0x00182000</pointer_to_raw_data>
<cave_size>96 (bytes)</cave_size>
<contains_initialized_data>Yes</contains_initialized_data>
<contains_uninitialized_data>No</contains_uninitialized_data>
<contains_extented_relocations>No</contains_extented_relocations>
<can_be_discarded>No</can_be_discarded>
<can_be_cached>No</can_be_cached>
<can_be_paged>Yes</can_be_paged>
<can_be_shared>No</can_be_shared>
<can_be_executed>No</can_be_executed>
<can_be_read>Yes</can_be_read>
<can_be_written_to>Yes</can_be_written_to>
</section>
<section>
<name>.tls</name>
<virtual_size>60 (bytes)</virtual_size>
<virtual_address>0x0018E000</virtual_address>
<size_of_raw_data>0 (bytes)</size_of_raw_data>
<pointer_to_raw_data>0x00182400</pointer_to_raw_data>
<cave_size>0 (bytes)</cave_size>
<contains_initialized_data>No</contains_initialized_data>
<contains_uninitialized_data>No</contains_uninitialized_data>
<contains_extented_relocations>No</contains_extented_relocations>
<can_be_discarded>No</can_be_discarded>
<can_be_cached>No</can_be_cached>
<can_be_paged>Yes</can_be_paged>
<can_be_shared>No</can_be_shared>
<can_be_executed>No</can_be_executed>
<can_be_read>Yes</can_be_read>
<can_be_written_to>Yes</can_be_written_to>
</section>
<section>
<name>.rdata</name>
<virtual_size>24 (bytes)</virtual_size>
<virtual_address>0x0018F000</virtual_address>
<size_of_raw_data>512 (bytes)</size_of_raw_data>
<pointer_to_raw_data>0x00182400</pointer_to_raw_data>
<cave_size>488 (bytes)</cave_size>
<contains_initialized_data>Yes</contains_initialized_data>
<contains_uninitialized_data>No</contains_uninitialized_data>
<contains_extented_relocations>No</contains_extented_relocations>
<can_be_discarded>No</can_be_discarded>
<can_be_cached>No</can_be_cached>
<can_be_paged>Yes</can_be_paged>
<can_be_shared>No</can_be_shared>
<can_be_executed>No</can_be_executed>
<can_be_read>Yes</can_be_read>
<can_be_written_to>No</can_be_written_to>
</section>
<section>
<name>.reloc</name>
<virtual_size>107184 (bytes)</virtual_size>
<virtual_address>0x00190000</virtual_address>
<size_of_raw_data>107520 (bytes)</size_of_raw_data>
<pointer_to_raw_data>0x00182600</pointer_to_raw_data>
<cave_size>336 (bytes)</cave_size>
<contains_initialized_data>Yes</contains_initialized_data>
<contains_uninitialized_data>No</contains_uninitialized_data>
<contains_extented_relocations>No</contains_extented_relocations>
<can_be_discarded>Yes</can_be_discarded>
<can_be_cached>No</can_be_cached>
<can_be_paged>Yes</can_be_paged>
<can_be_shared>No</can_be_shared>
<can_be_executed>No</can_be_executed>
<can_be_read>Yes</can_be_read>
<can_be_written_to>No</can_be_written_to>
</section>
<section>
<name>.rsrc</name>
<virtual_size>244736 (bytes)</virtual_size>
<virtual_address>0x001AB000</virtual_address>
<size_of_raw_data>244736 (bytes)</size_of_raw_data>
<pointer_to_raw_data>0x0019CA00</pointer_to_raw_data>
<cave_size>0 (bytes)</cave_size>
<contains_initialized_data>Yes</contains_initialized_data>
<contains_uninitialized_data>No</contains_uninitialized_data>
<contains_extented_relocations>No</contains_extented_relocations>
<can_be_discarded>No</can_be_discarded>
<can_be_cached>No</can_be_cached>
<can_be_paged>Yes</can_be_paged>
<can_be_shared>No</can_be_shared>
<can_be_executed>No</can_be_executed>
<can_be_read>Yes</can_be_read>
<can_be_written_to>No</can_be_written_to>
</section>
</sections>
<directories>
<directory>
<name>import_libraries</name>
<section>.idata</section>
<virtual_addresss>0x189000</virtual_addresss>
<size>13674 (bytes)</size>
<is_valid>Yes</is_valid>
</directory>
<directory>
<name>resources</name>
<section>.rsrc</section>
<virtual_addresss>0x1AB000</virtual_addresss>
<size>244736 (bytes)</size>
<is_valid>Yes</is_valid>
</directory>
<directory>
<name>relocations</name>
<section>.reloc</section>
<virtual_addresss>0x190000</virtual_addresss>
<size>107184 (bytes)</size>
<is_valid>Yes</is_valid>
</directory>
<directory>
<name>thread_local_storage</name>
<section>.rdata</section>
<virtual_addresss>0x18F000</virtual_addresss>
<size>24 (bytes)</size>
<is_valid>Yes</is_valid>
</directory>
<directory>
<name>import_address_table</name>
<section>.idata</section>
<virtual_addresss>0x1899CC</virtual_addresss>
<size>2108 (bytes)</size>
<is_valid>Yes</is_valid>
</directory>
<directory>
<name>delay_loaded_imports</name>
<section>.didata</section>
<virtual_addresss>0x18D000</virtual_addresss>
<size>928 (bytes)</size>
<is_valid>Yes</is_valid>
</directory>
</directories>
<libraries count="0"/>
<debuggers>
<debugger>n/a</debugger>
</debuggers>
<imported_symbols count="0">
<symbol>n/a</symbol>
<symbol>n/a</symbol>
<symbol>n/a</symbol>
</imported_symbols>
<exported_symbols count="0">
<symbol>n/a</symbol>
</exported_symbols>
<manifest>
<assemblies count="1">
<assembly>
<name>Microsoft.Windows.Common-Controls</name>
<version>win32</version>
<version>6.0.0.0</version>
<token>6595b64144ccf1df</token>
<language>*</language>
</assembly>
</assemblies>
</manifest>
<resources count="8">
<resource>
<name>Cursor</name>
<size_in_bytes>308</size_in_bytes>
<instances>7</instances>
</resource>
<resource>
<name>Bitmap</name>
<size_in_bytes>464</size_in_bytes>
<instances>120</instances>
</resource>
<resource>
<name>Icon</name>
<size_in_bytes>1128</size_in_bytes>
<instances>7</instances>
</resource>
<resource>
<name>String Table</name>
<size_in_bytes>1152</size_in_bytes>
<instances>19</instances>
</resource>
<resource>
<name>Binary</name>
<size_in_bytes>16</size_in_bytes>
<instances>4</instances>
</resource>
<resource>
<name>Cursor Group</name>
<size_in_bytes>20</size_in_bytes>
<instances>7</instances>
</resource>
<resource>
<name>Icon Group</name>
<size_in_bytes>104</size_in_bytes>
<instances>1</instances>
</resource>
<resource>
<name>Manifest</name>
<size_in_bytes>850</size_in_bytes>
<instances>1</instances>
</resource>
</resources>
</assembly>