filenamePhotoLine portable.exe
size33619968 (0x2010000)
md5a70ab9bb600ff9a91e0ebecf2481472e
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x50

DOS stub

00000000: 2e 5e 00 02 00 00 00 00  30 0a 00 00 00 00 00 00  |.^......0.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x56023910
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion9.0
SizeOfCode0x15800
SizeOfInitializedData0x2ca00
SizeOfUninitializedData0
AddressOfEntryPoint0x13a6
BaseOfCode0x1000
BaseOfData0x17000
ImageBase0x66200000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x8b000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x157e50x15800R-X CODE
.rdata0x170000x4b420x4c00R-- IDATA
.data0x1c0000x27c780x26000RW- IDATA
.rsrc0x440000x46a880x46c00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x1ad940x50
RESOURCE0x440000x46a88
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x172900x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x170000x24c
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#311280
ICON#442640
ICON#596400
ICON#6676240
ICON#7607460
ICON#911280
ICON#1042640
ICON#1196400
ICON#12676240
ICON#13607460
GROUP_ICON#2760
GROUP_ICON#8760
VERSION#115440
module_namehintordfunction_name
ntdll.dll47NtProtectVirtualMemory
ntdll.dll91NtWriteVirtualMemory
ntdll.dll106RtlCreateSecurityDescriptor
ntdll.dll92RtlAddAccessAllowedAce
ntdll.dll152RtlSetDaclSecurityDescriptor
ntdll.dll93RtlAllocateAndInitializeSid
ntdll.dll138RtlLengthSid
ntdll.dll102RtlCreateAcl
ntdll.dll163RtlUnwind
ntdll.dll154RtlSetSaclSecurityDescriptor
ntdll.dll123RtlFreeSid
ntdll.dll68NtRaiseHardError
ntdll.dll85NtTerminateProcess
ntdll.dll70NtReadVirtualMemory
ntdll.dll65NtQueryVirtualMemory
ntdll.dll35NtOpenEvent
ntdll.dll71NtReleaseMutant
ntdll.dll76NtSetEvent
ntdll.dll121RtlFreeHeap
ntdll.dll94RtlAllocateHeap
ntdll.dll148RtlRaiseException
ntdll.dll17NtCreateMutant
ntdll.dll50NtQueryDirectoryFile
ntdll.dll77NtSetInformationFile
ntdll.dll42NtOpenSection
ntdll.dll159RtlUnicodeStringToAnsiString
ntdll.dll120RtlFreeAnsiString
ntdll.dll34NtOpenDirectoryObject
ntdll.dll63NtQuerySystemInformation
ntdll.dll53NtQueryInformationProcess
ntdll.dll127RtlGetVersion
ntdll.dll137RtlLeaveCriticalSection
ntdll.dll117RtlEnterCriticalSection
ntdll.dll133RtlInitializeCriticalSection
ntdll.dll21NtDelayExecution
ntdll.dll24NtDuplicateObject
ntdll.dll36NtOpenFile
ntdll.dll52NtQueryInformationFile
ntdll.dll7LdrLoadDll
ntdll.dll14NtCreateEvent
ntdll.dll12NtClearEvent
ntdll.dll69NtReadFile
ntdll.dll89NtWaitForSingleObject
ntdll.dll8LdrUnloadDll
ntdll.dll51NtQueryFullAttributesFile
ntdll.dll19NtCreateSection
ntdll.dll33NtMapViewOfSection
ntdll.dll13NtClose
ntdll.dll87NtUnmapViewOfSection
ntdll.dll146RtlQueryEnvironmentVariable_U
ntdll.dll140RtlMultiByteToUnicodeN
ntdll.dll100RtlCompareUnicodeString
ntdll.dll132RtlInitUnicodeString
ntdll.dll5LdrGetDllHandle
ntdll.dll131RtlInitAnsiString
ntdll.dll6LdrGetProcedureAddress
ntdll.dll10NtAllocateVirtualMemory
ntdll.dll142RtlNtStatusToDosError
KERNEL32.dll432GetConsoleOutputCP
KERNEL32.dll1306WriteConsoleA
KERNEL32.dll1159SetStdHandle
KERNEL32.dll724HeapSize
KERNEL32.dll516GetLocaleInfoA
KERNEL32.dll617GetStringTypeW
KERNEL32.dll614GetStringTypeA
KERNEL32.dll813LCMapStringW
KERNEL32.dll811LCMapStringA
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll428GetConsoleMode
KERNEL32.dll410GetConsoleCP
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll1126SetFilePointer
KERNEL32.dll739InitializeCriticalSectionAndSpinCount
KERNEL32.dll828LoadLibraryA
KERNEL32.dll531GetModuleFileNameA
KERNEL32.dll1317WriteFile
KERNEL32.dll722HeapReAlloc
KERNEL32.dll1257VirtualAlloc
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll1316WriteConsoleW
KERNEL32.dll715HeapAlloc
KERNEL32.dll778IsValidCodePage
KERNEL32.dll567GetOEMCP
KERNEL32.dll360GetACP
KERNEL32.dll370GetCPInfo
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll659GetTickCount
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll1260VirtualFree
KERNEL32.dll718HeapDestroy
KERNEL32.dll717HeapCreate
KERNEL32.dll209DeleteCriticalSection
KERNEL32.dll610GetStartupInfoA
KERNEL32.dll499GetFileType
KERNEL32.dll612GetStdHandle
KERNEL32.dll1135SetHandleCount
KERNEL32.dll719HeapFree
KERNEL32.dll747InterlockedDecrement
KERNEL32.dll751InterlockedIncrement
KERNEL32.dll1222TlsFree
KERNEL32.dll1224TlsSetValue
KERNEL32.dll1221TlsAlloc
KERNEL32.dll1223TlsGetValue
KERNEL32.dll768IsDebuggerPresent
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll1216TerminateProcess
KERNEL32.dll945RaiseException
KERNEL32.dll390GetCommandLineA
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll136CreateFileA
KERNEL32.dll343FlushFileBuffers
KERNEL32.dll1265VirtualQuery
KERNEL32.dll1273WaitForSingleObject
KERNEL32.dll831LoadLibraryW
KERNEL32.dll581GetProcAddress
KERNEL32.dll1139SetLastError
KERNEL32.dll350FormatMessageW
KERNEL32.dll840LocalFree
KERNEL32.dll532GetModuleFileNameW
KERNEL32.dll281ExitProcess
KERNEL32.dll391GetCommandLineW
KERNEL32.dll1111SetEnvironmentVariableW
KERNEL32.dll514GetLastError
KERNEL32.dll536GetModuleHandleW
KERNEL32.dll168CreateProcessW
KERNEL32.dll232DuplicateHandle
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll611GetStartupInfoW
KERNEL32.dll325FindNextFileW
KERNEL32.dll864MoveFileExW
KERNEL32.dll313FindFirstFileW
KERNEL32.dll214DeleteFileW
KERNEL32.dll82CloseHandle
KERNEL32.dll1202Sleep
KERNEL32.dll867MoveFileW
KERNEL32.dll117CopyFileW
KERNEL32.dll490GetFileAttributesW
KERNEL32.dll476GetEnvironmentVariableW
KERNEL32.dll285ExpandEnvironmentStringsW
USER32.dll533MessageBoxW
USER32.dll819wsprintfW

StringTable 040704b0

CommentsBildbearbeitungssoftware
CompanyNameComputerinsel GmbH
FileDescriptionPhotoLine
FileVersion19.02
InternalNamePL
LegalCopyrightCopyright © 2015
OriginalFilenamePhotoLine.exe
ProductNamePhotoLine
ProductVersion19.02
ThinAppBuildDateTime20150924 195558
ThinAppLicensekoshar.blogspot.com ---
ThinAppVersion5.1.1-2722044

StringTable 040904b0

CommentsImaging & Painting Software
CompanyNameComputerinsel GmbH
FileDescriptionPhotoLine
FileVersion19.02
InternalNamePL
LegalCopyrightCopyright © 2015
OriginalFilenamePhotoLine.exe
ProductNamePhotoLine
ProductVersion19.02

VS_FIXEDFILEINFO

FileVersion19.0.2.0
ProductVersion19.0.2.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
0553984EXE09/23/2015 05:30:56#
15c115HTM#
54c8060746PNG(256 x 256)#
77dc060746PNG(256 x 256)#
29000020480DLL04/27/2004 08:01:35#
730000488448DLL06/24/2010 14:41:11#
9f0000609280DLL12/18/2011 08:18:27#
ad447864313ZIP#
af985a9169JPG#
afbd5d165200JPG#
b4a0479181JPG#
b4c96c6100PNG(60 x 217)#
b4e186258PNG(60 x 217)#
b4e3403233PNG(60 x 243)#
b4f027279PNG(60 x 243)#
b4f2572126PNG(56 x 31)#
b4fb682099PNG(56 x 31)#
b504582415PNG(81 x 31)#
b50e831360PNG(56 x 31)#
b514821864PNG(56 x 31)#
b51c851286PNG(56 x 31)#
b522501204PNG(81 x 31)#
b527c76603PNG(356 x 31)#
b542532599PNG(106 x 31)#
b54d331960PNG(156 x 31)#
b5559b2200PNG(106 x 31)#
b55ef81432PNG(56 x 31)#
b78a903982JPG#
b79b565166PNG(70 x 97)#
b7afdd913PNG(70 x 97)#
b7b44413799PNG(70 x 98)#
b7ea841020PNG(70 x 98)#
b7ef568954PNG(97 x 101)#
b812a91342PNG(97 x 101)#
b818bd13129PNG(70 x 100)#
b84c5f905PNG(70 x 100)#
b89d0e2240PNG(115 x 110)#
b8a6a49460PNG(70 x 100)#
b8cbf1963PNG(70 x 100)#
b8d08a12852PNG(104 x 67)#
b90317821PNG(104 x 67)#
b9072214402PNG(124 x 115)#
b93fbd2388PNG(124 x 115)#
b9938f2405PNG(129 x 114)#
b99dca13758PNG(75 x 101)#
b9d3e11182PNG(75 x 101)#
b9d95510759PNG(76 x 103)#
ba03b51014PNG(76 x 103)#
ba08819575PNG(73 x 102)#
ba2e411029PNG(73 x 102)#
ba332f12962PNG(106 x 70)#
ba662a839PNG(106 x 70)#
ba8dd81385PNG(100 x 102)#
ba941714343PNG(116 x 116)#
bacc772394PNG(116 x 116)#
bad6a719497PNG(117 x 111)#
bb23292285PNG(117 x 111)#
bb2cec11911PNG(110 x 117)#
bb5bcc2255PNG(110 x 117)#
bfe00273166WAV#
c0fdf215986WAV#
dcf1c158518WAV#
de010d16134PNG(128 x 128)#
de40a441513PNG(128 x 128)#
df13a447365PNG(128 x 128)#
e05fc49885JPG#
e086f215695JPG#
e0c4d26815JPG#
e0e00213389JPG#
e114e014877JPG#
e14f8e14963JPG#
e18a9221126JPG#
e1dda92846JPG#
e1e95819372JPG#
e235958382JPG#
e256e410701JPG#
e281426897JPG#
e29cc412141PNG(80 x 80)#
e2cc5d1005PNG(80 x 80)#
e2d0ca3355PNG(54 x 48)#
e2de11626PNG(54 x 48)#
e2e103727PNG(64 x 67)#
e2e406975PNG(64 x 67)#
1a961941837GIF(0 x 9032)#
1ab96141191HTM#
1ab9ae8123HTM#
1f2e29060746PNG(256 x 256)#
1f3cfdc31785PNG(256 x 256)#
1fc0000136192EXE05/07/2015 12:06:14#
1fe1400191488BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 33619968 bytes (33 MiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER