filenameHWspoofer_gameUnban_forGameHackers.exe
size166400 (0x28a00)
md5ff258e28d17d1ed0901a8926c3bf4aa3
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
2602741211
259274125
26127412148
2612861937
2602861918
259286199
2572741211
10123
264288062
255288061
258288061

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections7
TimeDateStamp0x5f00c7b5
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion14.26
SizeOfCode0x18c00
SizeOfInitializedData0x10e00
SizeOfUninitializedData0
AddressOfEntryPoint0x64a4
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x2e000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x8160
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x18b300x18c00R-X CODE
.rdata0x1a0000xcc1c0xce00R-- IDATA
.data0x270000x1e700xc00RW- IDATA
.pdata0x290000x12f00x1400R-- IDATA
_RDATA0x2b0000x940x200R-- IDATA
.rsrc0x2c0000x1e80x200R-- IDATA
.reloc0x2d0000x6600x800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x260080x78
RESOURCE0x2c0000x1e8
EXCEPTION0x290000x12f0
SECURITY00
BASERELOC0x2d0000x660
DEBUG0x249b00x70
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x24a200x130
Bound_IAT00
IAT0x1a0000x388
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#13920
module_namehintordfunction_name
KERNEL32.dll695GetProcAddress
KERNEL32.dll640GetModuleHandleW
KERNEL32.dll784GetTickCount
KERNEL32.dll543GetCurrentProcess
KERNEL32.dll1324SetFileAttributesW
KERNEL32.dll970LoadLibraryW
KERNEL32.dll280DeleteFileW
KERNEL32.dll981LocalFree
KERNEL32.dll1570WriteConsoleW
KERNEL32.dll855HeapReAlloc
KERNEL32.dll136CloseHandle
KERNEL32.dll1072Process32FirstW
KERNEL32.dll1074Process32NextW
KERNEL32.dll253CreateToolhelp32Snapshot
KERNEL32.dll1041OpenProcess
KERNEL32.dll205CreateFileW
KERNEL32.dll381FindClose
KERNEL32.dll767GetTempPathW
KERNEL32.dll1329SetFilePointer
KERNEL32.dll1436TerminateProcess
KERNEL32.dll1571WriteFile
KERNEL32.dll404FindNextFileW
KERNEL32.dll392FindFirstFileW
KERNEL32.dll624GetLogicalDrives
KERNEL32.dll617GetLastError
KERNEL32.dll1144ReadFile
KERNEL32.dll857HeapSize
KERNEL32.dll1330SetFilePointerEx
KERNEL32.dll597GetFileSizeEx
KERNEL32.dll516GetConsoleMode
KERNEL32.dll520GetConsoleOutputCP
KERNEL32.dll423FlushFileBuffers
KERNEL32.dll701GetProcessHeap
KERNEL32.dll1236RtlCaptureContext
KERNEL32.dll1243RtlLookupFunctionEntry
KERNEL32.dll1250RtlVirtualUnwind
KERNEL32.dll1470UnhandledExceptionFilter
KERNEL32.dll1405SetUnhandledExceptionFilter
KERNEL32.dll907IsProcessorFeaturePresent
KERNEL32.dll1105QueryPerformanceCounter
KERNEL32.dll544GetCurrentProcessId
KERNEL32.dll548GetCurrentThreadId
KERNEL32.dll754GetSystemTimeAsFileTime
KERNEL32.dll878InitializeSListHead
KERNEL32.dll900IsDebuggerPresent
KERNEL32.dll729GetStartupInfoW
KERNEL32.dll1249RtlUnwindEx
KERNEL32.dll1344SetLastError
KERNEL32.dll311EnterCriticalSection
KERNEL32.dll963LeaveCriticalSection
KERNEL32.dll275DeleteCriticalSection
KERNEL32.dll874InitializeCriticalSectionAndSpinCount
KERNEL32.dll1454TlsAlloc
KERNEL32.dll1456TlsGetValue
KERNEL32.dll1457TlsSetValue
KERNEL32.dll1455TlsFree
KERNEL32.dll435FreeLibrary
KERNEL32.dll969LoadLibraryExW
KERNEL32.dll1127RaiseException
KERNEL32.dll731GetStdHandle
KERNEL32.dll636GetModuleFileNameW
KERNEL32.dll358ExitProcess
KERNEL32.dll639GetModuleHandleExW
KERNEL32.dll478GetCommandLineA
KERNEL32.dll479GetCommandLineW
KERNEL32.dll848HeapAlloc
KERNEL32.dll852HeapFree
KERNEL32.dll157CompareStringW
KERNEL32.dll951LCMapStringW
KERNEL32.dll599GetFileType
KERNEL32.dll1512WaitForSingleObject
KERNEL32.dll581GetExitCodeProcess
KERNEL32.dll231CreateProcessW
KERNEL32.dll587GetFileAttributesExW
KERNEL32.dll736GetStringTypeW
KERNEL32.dll387FindFirstFileExW
KERNEL32.dll913IsValidCodePage
KERNEL32.dll442GetACP
KERNEL32.dll672GetOEMCP
KERNEL32.dll457GetCPInfo
KERNEL32.dll1013MultiByteToWideChar
KERNEL32.dll1551WideCharToMultiByte
KERNEL32.dll576GetEnvironmentStringsW
KERNEL32.dll434FreeEnvironmentStringsW
KERNEL32.dll1315SetEnvironmentVariableW
KERNEL32.dll1369SetStdHandle
USER32.dll1001wsprintfW
ADVAPI32.dll431LookupPrivilegeValueW
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll32AllocateAndInitializeSid
ADVAPI32.dll728SetEntriesInAclW
ADVAPI32.dll612RegCreateKeyExW
ADVAPI32.dll739SetNamedSecurityInfoW
ADVAPI32.dll681RegSetValueExW
ADVAPI32.dll533OpenProcessToken
ADVAPI32.dll308FreeSid
ADVAPI32.dll609RegCopyTreeW
ADVAPI32.dll615RegCreateKeyW
ADVAPI32.dll665RegQueryValueExW
ADVAPI32.dll603RegCloseKey
ADVAPI32.dll634RegEnumKeyExW
ADVAPI32.dll652RegOpenKeyExW
SHELL32.dll335SHGetFolderPathW
SHELL32.dll312SHFileOperationW
SHLWAPI.dll73PathFileExistsW
SHLWAPI.dll184SHDeleteKeyW
SHLWAPI.dll188SHDeleteValueW
SHLWAPI.dll338StrStrW
offsetsizetypecomment
15c115HTM#
15d0160816BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK