KeePass.exe - KeePass

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	KeePass.exe
size	1823744 (0x1bd400)
md5	c43f3cf82c120232a53f57ddd30d6da3

type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x4f056e13
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	8.0
SizeOfCode	0x1ace00
SizeOfInitializedData	0x10400
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1aed8e
BaseOfCode	0x2000
BaseOfData	0x1b0000
ImageBase	0x400000
SectionAlignment	0x2000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x1c4000
SizeOfHeaders	0x200
CheckSum	0x1c0528
Subsystem	2
DllCharacteristics	0x8540
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C# / Basic .NET

Sections

name	va	vsize	raw size	flags
.text	0x2000	0x1acd94	0x1ace00	R-X CODE
.rsrc	0x1b0000	0x10170	0x10200	R-- IDATA
.reloc	0x1c2000	0xc	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x1aed3c	0x4f
RESOURCE	0x1b0000	0x10170
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x1c2000	0xc
DEBUG	0x1aecc4	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x2000	8
Delay_IAT	0	0
CLR_Header	0x2008	0x48

show previews

type	name	size
ICON	#2	744
ICON	#3	296
ICON	#4	3752
ICON	#5	2216
ICON	#6	1384
ICON	#7	40302
ICON	#8	9640
ICON	#9	4264
ICON	#10	1128
GROUP_ICON	#32512	132
VERSION	#1	852
MANIFEST	#1	490

module_name	hint	ord	function_name
mscoree.dll			_CorExeMain

StringTable 000004b0

Comments	KeePass Password Safe
CompanyName	Dominik Reichl
FileDescription	KeePass
FileVersion	2.1.8.0
InternalName	KeePass.exe
LegalCopyright	Copyright © 2003-2012 Dominik Reichl
OriginalFilename	KeePass.exe
ProductName	KeePass
ProductVersion	2.1.8.0
Assembly Version	2.1.8.18961

VS_FIXEDFILEINFO

FileVersion	2.1.8.0
ProductVersion	2.1.8.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	1823744	EXE	01/05/2012 09:32:03	#
15c1	15	HTM		#
9a0de	741	PNG	(16 x 14)	#
9a466	604	PNG	(15 x 14)	#
9a765	709	PNG	(16 x 16)	#
9aacd	709	PNG	(16 x 16)	#
9ae35	927	PNG	(16 x 16)	#
9b277	934	PNG	(16 x 16)	#
9b6c0	660	PNG	(16 x 16)	#
9b9f7	799	PNG	(16 x 16)	#
9bdb9	921	PNG	(16 x 16)	#
9c1f5	747	PNG	(16 x 16)	#
9c583	751	PNG	(16 x 16)	#
9c915	1014	PNG	(16 x 16)	#
9cdae	912	PNG	(16 x 16)	#
9d1e1	997	PNG	(16 x 16)	#
9d669	711	PNG	(16 x 16)	#
9d9d3	838	PNG	(16 x 16)	#
9ddbc	961	PNG	(16 x 16)	#
9e220	646	PNG	(16 x 16)	#
9e549	714	PNG	(16 x 16)	#
9e8b6	820	PNG	(16 x 16)	#
9ec8d	746	PNG	(16 x 16)	#
9f01a	786	PNG	(16 x 16)	#
9f3cf	918	PNG	(16 x 16)	#
9f808	733	PNG	(16 x 16)	#
9fb88	1010	PNG	(16 x 16)	#
a001d	856	PNG	(16 x 16)	#
a0418	1038	PNG	(16 x 16)	#
a08c9	809	PNG	(16 x 16)	#
a0c95	976	PNG	(16 x 16)	#
a1108	1052	PNG	(16 x 16)	#
a15c7	859	PNG	(16 x 16)	#
a19c5	931	PNG	(16 x 16)	#
a1e0b	611	PNG	(16 x 16)	#
a2111	670	PNG	(16 x 16)	#
a2452	982	PNG	(16 x 16)	#
a28cb	516	PNG	(16 x 16)	#
a2b72	488	PNG	(16 x 16)	#
a2dfd	515	PNG	(16 x 16)	#
a30a3	940	PNG	(16 x 16)	#
a34f2	401	PNG	(16 x 16)	#
a3726	676	PNG	(16 x 16)	#
a3a6d	374	PNG	(16 x 16)	#
a3c86	562	PNG	(16 x 16)	#
a3f5b	731	PNG	(16 x 16)	#
a42d9	515	PNG	(16 x 16)	#
a457f	198	PNG	(16 x 16)	#
a46e8	205	PNG	(16 x 16)	#
a4858	181	PNG	(16 x 16)	#
a49b0	157	PNG	(16 x 16)	#
a4af0	920	PNG	(16 x 16)	#
a4f2b	1056	PNG	(16 x 16)	#
a53ee	986	PNG	(16 x 16)	#
a586b	1024	PNG	(16 x 16)	#
a5d0e	1032	PNG	(16 x 16)	#
a61b9	830	PNG	(16 x 16)	#
a659a	587	PNG	(16 x 16)	#
a6888	343	PNG	(16 x 16)	#
a6a82	527	PNG	(16 x 16)	#
a6d34	965	PNG	(16 x 16)	#
a719c	356	PNG	(16 x 16)	#
a73a3	357	PNG	(16 x 16)	#
a75ab	816	PNG	(16 x 16)	#
a797e	315	PNG	(16 x 16)	#
a7b5c	886	PNG	(16 x 16)	#
a7f75	213	PNG	(16 x 16)	#
a80ed	212	PNG	(16 x 16)	#
a8264	298	PNG	(16 x 16)	#
a8431	291	PNG	(16 x 16)	#
a85f7	239	PNG	(16 x 16)	#
a8789	688	PNG	(16 x 16)	#
a8adc	590	PNG	(16 x 16)	#
a8dcd	779	PNG	(16 x 16)	#
a917b	200	PNG	(16 x 16)	#
a92e6	310	PNG	(16 x 16)	#
a94bf	290	PNG	(16 x 16)	#
a9684	328	PNG	(16 x 16)	#
a986f	921	PNG	(16 x 16)	#
a9cab	348	PNG	(16 x 16)	#
a9eaa	366	PNG	(16 x 16)	#
aa0bb	193	PNG	(16 x 16)	#
aa21f	801	PNG	(16 x 16)	#
aa5e3	610	PNG	(16 x 16)	#
aa8e8	280	PNG	(16 x 16)	#
aaaa3	252	PNG	(16 x 16)	#
aac42	927	PNG	(16 x 16)	#
ab084	845	PNG	(16 x 16)	#
ab474	771	PNG	(16 x 16)	#
ab81a	490	PNG	(16 x 16)	#
abaa7	761	PNG	(16 x 16)	#
abe43	836	PNG	(16 x 16)	#
ac22a	823	PNG	(16 x 16)	#
ac604	849	PNG	(16 x 16)	#
ac9f8	951	PNG	(16 x 16)	#
ace52	694	PNG	(16 x 16)	#
ad1ab	932	PNG	(16 x 16)	#
ad5f2	810	PNG	(16 x 16)	#
ad9bf	1013	PNG	(16 x 16)	#
ade57	1064	PNG	(16 x 16)	#
ae322	712	PNG	(16 x 16)	#
ae68d	957	PNG	(16 x 16)	#
aeaed	386	PNG	(16 x 16)	#
aed12	923	PNG	(16 x 16)	#
af150	767	PNG	(16 x 16)	#
af4f2	855	PNG	(16 x 16)	#
af8ec	1038	PNG	(16 x 16)	#
afd9d	1005	PNG	(16 x 16)	#
b022d	621	PNG	(16 x 16)	#
b053d	1055	PNG	(16 x 16)	#
b09ff	947	PNG	(16 x 16)	#
b0e55	479	PNG	(16 x 16)	#
b10d7	482	PNG	(16 x 16)	#
b135c	474	PNG	(16 x 16)	#
b15d9	858	PNG	(16 x 16)	#
b19d6	991	PNG	(16 x 16)	#
b1e58	599	PNG	(16 x 16)	#
b2152	963	PNG	(16 x 16)	#
b25b8	1014	PNG	(16 x 16)	#
b2a51	641	PNG	(16 x 16)	#
b2d75	778	PNG	(16 x 16)	#
b3122	746	PNG	(16 x 16)	#
b34af	761	PNG	(16 x 16)	#
b384b	844	PNG	(16 x 16)	#
b3c3a	124	PNG	(17 x 5)	#
b3d59	30879	PNG	(284 x 231)	#
bb69b	2582	PNG	(32 x 32)	#
bc154	4042	PNG	(48 x 48)	#
bd1c1	2720	PNG	(48 x 48)	#
bdd04	3088	PNG	(48 x 48)	#
be9b7	3945	PNG	(48 x 48)	#
bf9c3	4966	PNG	(48 x 48)	#
c0dcc	5262	PNG	(48 x 48)	#
c22fd	2438	PNG	(48 x 48)	#
c2d26	3964	PNG	(48 x 48)	#
c3d45	4641	PNG	(48 x 48)	#
c5009	3691	PNG	(48 x 48)	#
c5f17	3868	PNG	(48 x 48)	#
c6ed6	3912	PNG	(48 x 48)	#
c7ec1	5608	PNG	(48 x 48)	#
c954c	3583	PNG	(48 x 48)	#
ca3ee	4040	PNG	(48 x 48)	#
cb459	3816	PNG	(48 x 48)	#
cc3e4	5152	PNG	(48 x 48)	#
cd8a7	3248	PNG	(48 x 48)	#
ce5fa	3425	PNG	(48 x 48)	#
cf3fe	3759	PNG	(48 x 48)	#
d0350	5186	PNG	(48 x 48)	#
d1835	2373	PNG	(48 x 48)	#
d221d	3468	PNG	(48 x 48)	#
d5208	40302	PNG	(256 x 256)	#
f0c49	163	PNG	(16 x 16)	#
1065a6	698	PNG	(16 x 16)	#
1af6d0	40302	PNG	(256 x 256)	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

KeePass.exe- KeePass

MZ Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 000004b0

VS_FIXEDFILEINFO

KeePass.exe
- KeePass