memory_0x01310000_0x00031000.dat

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	memory_0x01310000_0x00031000.dat
size	200704 (0x31000)
md5	53199133560799ab6aa02fd11ea7c933

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf8

Rich Header

lib id	version	times used
12	7291	3
93	2179	4
14	7299	3
4	8047	4
1	0	118
4	9782	3
10	9782	7
11	9782	13
6	1735	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x4fbf8dee
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10e
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x8000
SizeOfInitializedData	0x28000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1000
BaseOfCode	0x1000
BaseOfData	0x9000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x31000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x7ec9	0x8000	R-X CODE
.rdata	0x9000	0x10e6	0x2000	R-- IDATA
.data	0xb000	0x237ec	0x24000	RW- IDATA
.rsrc	0x2f000	0x7e8	0x1000	R-- IDATA
.reloc	0x30000	0x9c0	0x1000	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x9ab0	0x78
RESOURCE	0x2f000	0x7e8
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x30000	0x5a0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x9000	0x1b8
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
ICON	#1	744
ICON	#2	296
GROUP_ICON	#128	34
VERSION	#1	656

module_name	hint	ord	function_name
MFC42.DLL		2976
MFC42.DLL		800
MFC42.DLL		860
MFC42.DLL		535
MFC42.DLL		4202
MFC42.DLL		858
MFC42.DLL		2915
MFC42.DLL		5572
MFC42.DLL		2818
MFC42.DLL		540
MFC42.DLL		4226
MFC42.DLL		2726
MFC42.DLL		823
MFC42.DLL		817
MFC42.DLL		565
MFC42.DLL		4424
MFC42.DLL		4622
MFC42.DLL		4080
MFC42.DLL		3079
MFC42.DLL		3825
MFC42.DLL		3831
MFC42.DLL		3830
MFC42.DLL		825
MFC42.DLL		3081
MFC42.DLL		2985
MFC42.DLL		3262
MFC42.DLL		3136
MFC42.DLL		4465
MFC42.DLL		3259
MFC42.DLL		3147
MFC42.DLL		2982
MFC42.DLL		5715
MFC42.DLL		5289
MFC42.DLL		5307
MFC42.DLL		4699
MFC42.DLL		4079
MFC42.DLL		5303
MFC42.DLL		5300
MFC42.DLL		3346
MFC42.DLL		2396
MFC42.DLL		1948
MFC42.DLL		537
MFC42.DLL		1106
MSVCRT.dll	600		fprintf
MSVCRT.dll	275		_iob
MSVCRT.dll	585		exit
MSVCRT.dll	696		strcmp
MSVCRT.dll	449		_stricmp
MSVCRT.dll	705		strncpy
MSVCRT.dll	665		memset
MSVCRT.dll	657		malloc
MSVCRT.dll	702		strlen
MSVCRT.dll	663		memcpy
MSVCRT.dll	606		free
MSVCRT.dll	679		realloc
MSVCRT.dll	662		memcmp
MSVCRT.dll	73		__CxxFrameHandler
MSVCRT.dll	698		strcpy
KERNEL32.dll	239		FreeLibrary
KERNEL32.dll	584		LoadLibraryA
KERNEL32.dll	408		GetProcAddress
KERNEL32.dll	841		Sleep
KERNEL32.dll	634		OpenMutexA
KERNEL32.dll	361		GetLastError
KERNEL32.dll	784		SetFilePointer
KERNEL32.dll	919		WriteFile
KERNEL32.dll	77		CreateFileA
KERNEL32.dll	347		GetFileSize
KERNEL32.dll	683		ReadFile
KERNEL32.dll	46		CloseHandle
KERNEL32.dll	901		WaitForSingleObject
KERNEL32.dll	375		GetModuleHandleA
KERNEL32.dll	889		VirtualFreeEx
KERNEL32.dll	73		CreateEventA
KERNEL32.dll	779		SetEvent
KERNEL32.dll	90		CreateMutexA
KERNEL32.dll	696		ReleaseMutex
KERNEL32.dll	619		MultiByteToWideChar
KERNEL32.dll	959		lstrlenA
KERNEL32.dll	654		Process32Next
KERNEL32.dll	652		Process32First
KERNEL32.dll	108		CreateToolhelp32Snapshot
KERNEL32.dll	947		lstrcmpA
KERNEL32.dll	891		VirtualProtect
KERNEL32.dll	888		VirtualFree
KERNEL32.dll	885		VirtualAlloc
KERNEL32.dll	100		CreateRemoteThread
KERNEL32.dll	928		WriteProcessMemory
KERNEL32.dll	886		VirtualAllocEx
KERNEL32.dll	636		OpenProcess
KERNEL32.dll	315		GetCurrentProcessId
KERNEL32.dll	314		GetCurrentProcess
KERNEL32.dll	373		GetModuleFileNameA
KERNEL32.dll	105		CreateThread
KERNEL32.dll	175		ExitProcess
ADVAPI32.dll	426		OpenProcessToken
ADVAPI32.dll	281		GetTokenInformation
ADVAPI32.dll	327		LookupAccountSidA
ADVAPI32.dll	291		GetUserNameA
ADVAPI32.dll	505		RegSetValueExA
ADVAPI32.dll	482		RegOpenKeyExA
ADVAPI32.dll	457		RegCloseKey
ADVAPI32.dll	492		RegQueryValueExA
MSVCP60.dll	162		public: __thiscall std::_Lockit::_Lockit(void) ??0_Lockit@std@@QAE@XZ
MSVCP60.dll	267		public: __thiscall std::_Lockit::~_Lockit(void) ??1_Lockit@std@@QAE@XZ

StringTable 040904b0

Comments
CompanyName
FileDescription
FileVersion	2
InternalName
LegalCopyright	(C) 2012
LegalTrademarks
OriginalFilename
PrivateBuild
ProductName
ProductVersion	2
SpecialBuild

VS_FIXEDFILEINFO

FileVersion	1.0.0.1
ProductVersion	1.0.0.1
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	200704	EXE	05/25/2012 13:49:34	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK