filenameupdata.exe
size239616 (0x3a800)
md5123eea567f5754280e5e36669b44d245
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd8

Rich Header

lib idversiontimes used
147307299
1038
1713031941
155303191
154303191
157303191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x4f45047c
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion10.0
SizeOfCode0x31800
SizeOfInitializedData0x70000
SizeOfUninitializedData0
AddressOfEntryPoint0x1be0
BaseOfCode0x1000
BaseOfData0x33000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0xa5000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8540
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x317c50x31800R-X CODE
.rdata0x330000x35050x3600R-- IDATA
.data0x370000x67ded0xa00RW- IDATA
.rsrc0x9f0000x7700x800R-- IDATA
.reloc0xa00000x43620x4400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x362e00x225
IMPORT0x35f080x64
RESOURCE0x9f0000x770
EXCEPTION00
SECURITY00
BASERELOC0xa00000x3ea4
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x330000xa8
Delay_IAT00
CLR_Header00
typenamesizecp
BITMAP#1032240
MENU#102120
DIALOG#1011480
DIALOG#1061480
STRING#72520
VERSION#16680
idlangstring
1052052You must have cookies enabled to log in to StrategyWiki
1062052Your Slim Women Perm anomalous
1072052create account Namespaces
module_namehintordfunction_name
KERNEL32.dll514GetLastError
KERNEL32.dll143CreateFileW
KERNEL32.dll388GetCommState
KERNEL32.dll581GetProcAddress
KERNEL32.dll348FoldStringW
KERNEL32.dll1126SetFilePointer
KERNEL32.dll365GetAtomNameA
KERNEL32.dll1175SetThreadLocale
KERNEL32.dll137CreateFileMappingA
KERNEL32.dll758IsBadHugeWritePtr
KERNEL32.dll1202Sleep
KERNEL32.dll1317WriteFile
KERNEL32.dll82CloseHandle
KERNEL32.dll65CancelDeviceWakeupRequest
KERNEL32.dll1116SetFileApisToANSI
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll399GetComputerNameW
KERNEL32.dll828LoadLibraryA
KERNEL32.dll659GetTickCount
KERNEL32.dll636GetSystemWindowsDirectoryW
USER32.dll419GetWindowTextW
USER32.dll274GetClassNameW
USER32.dll94CreateDesktopW
USER32.dll698SetThreadDesktop
USER32.dll623ScrollDC
USER32.dll556OpenWindowStationA
USER32.dll266GetCaretPos
USER32.dll624ScrollWindow
USER32.dll259GetAltTabInfoW
USER32.dll356GetParent
GDI32.dll293EnumFontFamiliesExW
GDI32.dll598Polygon
GDI32.dll601PtInRegion
GDI32.dll8AngleArc
GDI32.dll442GetCharWidthFloatW
ADVAPI32.dll628RegRestoreKeyW
ADVAPI32.dll128CreateServiceA
ADVAPI32.dll631RegSaveKeyExW
ordentry_vafunction_name
10x1f90SjfgBbih
20x2450SjfgDecxab
30x2230SjfgEgsls
40x1d70SjfgEtg
50x1ea0SjfgFp
60x25b0SjfgGegqd
70x22d0SjfgGi
80x1e60SjfgIoto
90x1f00SjfgJi
100x2300SjfgLyot
110x2000SjfgMeohnu
120x2350SjfgMn
130x2120SjfgMqt
140x2340SjfgNz
150x23e0SjfgPzx
160x1ec0SjfgQhgvd
170x2090SjfgQkx
180x22f0SjfgQp
190x1990SjfgRv
200x1ce0SjfgTauxf
210x2530SjfgVs
220x1e90SjfgWmnlt
230x21b0SjfgWndtnl
240x2320SjfgXgobl
250x1e80SjfgXl
260x1e10SjfgYtx
270x24c0SjfgZq
module_nameIdzyryt.
flags0
timestamp2012-02-22 15:06:36
version0.0
ordinal_base1
nFunctions27
nNames27
Names(27)0x36374
Functions(27)0x36308
NameOrdinals(27)0x363e0

StringTable 000804b0

CompanyNameXXXXXXX
FileDescriptionXXXXXXX
FileVersion1.0.0.1
InternalNameXXXXXXX
LegalCopyrightXXXXXXX Copyright (C) 2011
OriginalFilenameXXXXXXX
ProductNameXXXXXXX
ProductVersion1.0.0.1

VS_FIXEDFILEINFO

FileVersion1.0.0.1
ProductVersion1.0.0.1
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0239616EXE02/22/2012 15:06:36#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK