filenameconime.exe
size86528 (0x15200)
md500e1d5f656b13c00cc31ceb6b43c1d69
typePE32+ executable (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
110507271
125507272
1235072721
10131
1095072722
1145072723
124507271
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections5
TimeDateStamp0x49e02617
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion8.0
SizeOfCode0x13200
SizeOfInitializedData0x2200
SizeOfUninitializedData0
AddressOfEntryPoint0x1209c
BaseOfCode0x1000
ImageBase0x100000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion6.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x19000
SizeOfHeaders0x400
CheckSum0x22532
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x80000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x1314c0x13200R-X CODE
.data0x150000x9980x400RW- IDATA
.pdata0x160000x9f00xa00R-- IDATA
.rsrc0x170000x8d00xa00R-- IDATA
.reloc0x180000x2600x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x133200xdc
RESOURCE0x170000x8d0
EXCEPTION0x160000x9f0
SECURITY00
BASERELOC0x180000x128
DEBUG0x14b00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT0x2b00xec
IAT0x10000x458
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#17440
ICON#22960
GROUP_ICON#1340
VERSION#18880
module_namehintordfunction_name
ADVAPI32.dll616RegQueryValueExW
ADVAPI32.dll554RegCloseKey
ADVAPI32.dll603RegOpenKeyExW
KERNEL32.dll1224lstrlenA
KERNEL32.dll793MultiByteToWideChar
KERNEL32.dll1107UnregisterConsoleIME
KERNEL32.dll635GetVersionExW
KERNEL32.dll589GetSystemInfo
KERNEL32.dll1131VirtualQuery
KERNEL32.dll1123VirtualAlloc
KERNEL32.dll1129VirtualProtect
KERNEL32.dll1225lstrlenW
KERNEL32.dll1161WideCharToMultiByte
KERNEL32.dll164CreateThread
KERNEL32.dll992SetEvent
KERNEL32.dll431GetCurrentThreadId
KERNEL32.dll68CloseHandle
KERNEL32.dll1139WaitForSingleObject
KERNEL32.dll807OpenEventW
KERNEL32.dll340GetACP
KERNEL32.dll682HeapSetInformation
KERNEL32.dll370GetCommandLineW
KERNEL32.dll877RegisterApplicationRestart
KERNEL32.dll767LocalReAlloc
KERNEL32.dll760LocalAlloc
KERNEL32.dll764LocalFree
KERNEL32.dll1072Sleep
KERNEL32.dll573GetStartupInfoW
KERNEL32.dll913RtlCaptureContext
KERNEL32.dll920RtlLookupFunctionEntry
KERNEL32.dll927RtlVirtualUnwind
KERNEL32.dll1101UnhandledExceptionFilter
KERNEL32.dll427GetCurrentProcess
KERNEL32.dll1084TerminateProcess
KERNEL32.dll595GetSystemTimeAsFileTime
KERNEL32.dll428GetCurrentProcessId
KERNEL32.dll618GetTickCount
KERNEL32.dll851QueryPerformanceCounter
KERNEL32.dll506GetModuleHandleW
KERNEL32.dll1060SetUnhandledExceptionFilter
KERNEL32.dll878RegisterConsoleIME
GDI32.dll500GetStockObject
GDI32.dll673TranslateCharsetInfo
USER32.dll457IsWindow
USER32.dll336GetMessageW
USER32.dll733TranslateMessage
USER32.dll169DispatchMessageW
USER32.dll590RegisterWindowMessageW
USER32.dll475LoadIconW
USER32.dll473LoadCursorW
USER32.dll570RegisterClassW
USER32.dll104CreateWindowExW
USER32.dll12AttachThreadInput
USER32.dll296GetGUIThreadInfo
USER32.dll160DestroyWindow
USER32.dll743UnregisterClassW
USER32.dll150DefWindowProcW
USER32.dll548PostQuitMessage
USER32.dll209EnableWindow
USER32.dll458IsWindowEnabled
USER32.dll307GetKeyState
USER32.dll311GetKeyboardLayoutNameW
USER32.dll640SetForegroundWindow
USER32.dll465KillTimer
USER32.dllActivateKeyboardLayout
USER32.dll676SetTimer
USER32.dll614SendMessageTimeoutW
USER32.dll547PostMessageW
msvcrt.dll128__set_app_type
msvcrt.dll109__dllonexit
msvcrt.dll469_lock
msvcrt.dll280_fmode
msvcrt.dll639_onexit
msvcrt.dll48void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll1156memset
msvcrt.dll1152memcpy
msvcrt.dll1154memmove
msvcrt.dll856_vsnwprintf
msvcrt.dll1140malloc
msvcrt.dll1082free
msvcrt.dll113__getmainargs
msvcrt.dll83__C_specific_handler
msvcrt.dll82_XcptFilter
msvcrt.dll255_exit
msvcrt.dll392_ismbblead
msvcrt.dll179_cexit
msvcrt.dll148_acmdln
msvcrt.dll364_initterm
msvcrt.dll160_amsg_exit
msvcrt.dll130__setusermatherr
msvcrt.dll816_unlock
msvcrt.dll196_commode
msvcrt.dll1056exit
msvcrt.dll464_local_unwind
ole32.dll111CoUninitialize
ole32.dll66CoInitializeEx
ole32.dll20CoCreateInstance
OLEAUT32.dll2
OLEAUT32.dll3
OLEAUT32.dll4
OLEAUT32.dll7
OLEAUT32.dll6
OLEAUT32.dll8
OLEAUT32.dll9
UxTheme.dll67SetThemeAppProperties
IMM32.dll110ImmSetActiveContextConsoleIME
IMM32.dll56ImmGetContext
IMM32.dll104ImmReleaseContext
IMM32.dll74ImmGetOpenStatus
IMM32.dll59ImmGetConversionStatus
IMM32.dll64ImmGetGuideLineW
IMM32.dll24ImmAssociateContext
IMM32.dll75ImmGetProperty
IMM32.dll117ImmSetConversionStatus
IMM32.dll26ImmCallImeConsoleIME
IMM32.dll124ImmTranslateMessage
IMM32.dll122ImmSimulateHotKey
IMM32.dll42ImmEscapeW
IMM32.dll70ImmGetIMEFileNameW
IMM32.dll49ImmGetCandidateListW
IMM32.dll97ImmNotifyIME
IMM32.dll54ImmGetCompositionStringW
IMM32.dll65ImmGetHotKey
IMM32.dll32ImmDestroyContext
IMM32.dll29ImmCreateContext
IMM32.dll119ImmSetOpenStatus
MSCTF.dll71TF_Notify
MSCTF.dll66TF_IsCtfmonRunning
MSCTF.dll81TF_WaitForInitialized

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionConsole IME
FileVersion6.0.6002.18005 (lh_sp2rtm.090410-1830)
InternalNameConsole
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameCONIME.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.0.6002.18005

VS_FIXEDFILEINFO

FileVersion6.0.6002.18005
ProductVersion6.0.6002.18005
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d080944BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x2b0