filenametest.txt
size67108865 (0x4000001)
md5042ef6b1b48a4bf57e6821caa0fde0b9
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
189307161
187307165
1883071619
1853071617
10132
1923071614
183307161
186307161

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x5010a433
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion10.10
SizeOfCode0xc400
SizeOfInitializedData0x42600
SizeOfUninitializedData0
AddressOfEntryPoint0x19a5
BaseOfCode0x1000
BaseOfData0xd000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.2
ImageVersion6.2
SubsystemVersion6.2
Reserved10
SizeOfImage0x52000
SizeOfHeaders0x400
CheckSum0x12201
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000xc2f00xc400R-X CODE
.data0xe0000x406c40x600RW- IDATA
.idata0x4f0000xbfe0xc00R-- IDATA
.rsrc0x500000x7e00x800R-- IDATA
.reloc0x510000x8ec0xa00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x4f1e80xa0
RESOURCE0x500000x7e0
EXCEPTION00
SECURITY00
BASERELOC0x510000x8ec
DEBUG0xd2940x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x6c680x40
Bound_IAT00
IAT0x4f0000x1e8
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12000
VERSION#18960
MANIFEST#16740
module_namehintordfunction_name
ADVAPI32.dll662RegQueryValueExW
ADVAPI32.dll652RegOpenKeyW
ADVAPI32.dll604RegConnectRegistryW
ADVAPI32.dll600RegCloseKey
ADVAPI32.dll609RegCreateKeyExW
ADVAPI32.dll656RegQueryInfoKeyW
ADVAPI32.dll634RegEnumValueW
ADVAPI32.dll649RegOpenKeyExW
ADVAPI32.dll631RegEnumKeyExW
ADVAPI32.dll678RegSetValueExW
ADVAPI32.dll530OpenProcessToken
ADVAPI32.dll668RegRestoreKeyW
ADVAPI32.dll672RegSaveKeyW
ADVAPI32.dll429LookupPrivilegeValueW
ADVAPI32.dll671RegSaveKeyExW
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll642RegLoadKeyW
ADVAPI32.dll681RegUnLoadKeyW
ADVAPI32.dll638RegGetValueW
ADVAPI32.dll615RegDeleteKeyExW
ADVAPI32.dll624RegDeleteValueW
ADVAPI32.dll632RegEnumKeyW
ADVAPI32.dll677RegSetValueExA
ADVAPI32.dll679RegSetValueW
ADVAPI32.dll635RegFlushKey
KERNEL32.dll767GetTempFileNameW
KERNEL32.dll769GetTempPathW
KERNEL32.dll618GetLastError
KERNEL32.dll1303SetLastError
KERNEL32.dll291DeleteFileW
KERNEL32.dll973LocalFree
KERNEL32.dll547GetCurrentProcess
KERNEL32.dll185CopyFileW
KERNEL32.dll142CloseHandle
KERNEL32.dll214CreateFileW
KERNEL32.dll596GetFileSize
KERNEL32.dll1215SearchPathW
KERNEL32.dll1288SetFilePointer
KERNEL32.dll1045OutputDebugStringW
KERNEL32.dll1521WriteFile
KERNEL32.dll1501WideCharToMultiByte
KERNEL32.dll976LocalReAlloc
KERNEL32.dll1112ReadFile
KERNEL32.dll1553lstrcmpW
KERNEL32.dll1004MultiByteToWideChar
KERNEL32.dll1565lstrlenW
KERNEL32.dll969LocalAlloc
KERNEL32.dll854HeapSize
KERNEL32.dll852HeapReAlloc
KERNEL32.dll845HeapAlloc
KERNEL32.dll857HeapValidate
KERNEL32.dll849HeapFree
KERNEL32.dll698GetProcessHeap
KERNEL32.dll524GetConsoleOutputCP
KERNEL32.dll365ExitProcess
KERNEL32.dll1520WriteConsoleW
KERNEL32.dll777GetThreadLocale
KERNEL32.dll167CompareStringW
KERNEL32.dll733GetStdHandle
KERNEL32.dll520GetConsoleMode
KERNEL32.dll599GetFileType
KERNEL32.dll436FormatMessageW
KERNEL32.dll1350SetThreadUILanguage
KERNEL32.dll784GetTickCount
KERNEL32.dll756GetSystemTimeAsFileTime
KERNEL32.dll552GetCurrentThreadId
KERNEL32.dll548GetCurrentProcessId
KERNEL32.dll1084QueryPerformanceCounter
KERNEL32.dll638GetModuleHandleA
KERNEL32.dll1391TerminateProcess
KERNEL32.dll1360SetUnhandledExceptionFilter
KERNEL32.dll1424UnhandledExceptionFilter
KERNEL32.dll875InterlockedCompareExchange
KERNEL32.dll878InterlockedExchange
KERNEL32.dll1375Sleep
KERNEL32.dll2147483647
msvcrt.dll1391wcstoul
msvcrt.dll368_fileno
msvcrt.dll429_get_osfhandle
msvcrt.dll1187fprintf
msvcrt.dll346_except_handler4_common
msvcrt.dll295_controlfp
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll472_initterm
msvcrt.dll190__p__fmode
msvcrt.dll276_cexit
msvcrt.dll355_exit
msvcrt.dll1171exit
msvcrt.dll210__set_app_type
msvcrt.dll225__wgetmainargs
msvcrt.dll257_amsg_exit
msvcrt.dll185__p__commode
msvcrt.dll106_XcptFilter
msvcrt.dll977_vsnwprintf
msvcrt.dll777_resetstkoflw
msvcrt.dll1035_wcstoui64
msvcrt.dll343_errno
msvcrt.dll1181fgetwc
msvcrt.dll1177fflush
msvcrt.dll147__iob_func
msvcrt.dll212__setusermatherr
msvcrt.dll737_memicmp
msvcrt.dll1388wcstol
msvcrt.dll1266memset
ntdll.dll533NtSetInformationKey
ntdll.dll442NtQueryKey
USER32.dll499IsCharAlphaNumericW
USER32.dll49CharNextW
USER32.dll559LoadStringW
USER32.dll60CharUpperW
WS2_32.dll116
SHLWAPI.dll282StrChrIW
SHLWAPI.dll334StrStrIW
SHLWAPI.dll304StrDupW
SHLWAPI.dll285StrChrW
SHLWAPI.dll343StrToIntW

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionRegistry Console Tool
FileVersion6.2.9200.16384 (win8_rtm.120725-1247)
InternalNamereg.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamereg.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.2.9200.16384

VS_FIXEDFILEINFO

FileVersion6.2.9200.16384
ProductVersion6.2.9200.16384
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
060416EXE07/26/2012 01:58:11#
15c115HTM#
ec0067048449BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 67108865 bytes (65 MiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK