getpid.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	getpid.exe
size	101376 (0x18c00)
md5	02f02cdbad7eb18180967605efecc1da

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

Rich Header

lib id	version	times used
259	26213	10
261	26213	140
260	26213	18
257	26213	3
1	0	80
261	26706	36
260	26706	17
259	26706	17
260	27025	1
258	27025	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x5d230f1f
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	14.16
SizeOfCode	0x10a00
SizeOfInitializedData	0x8800
SizeOfUninitializedData	0
AddressOfEntryPoint	0x12e1
BaseOfCode	0x1000
BaseOfData	0x12000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x1c000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x108bb	0x10a00	R-X CODE
.rdata	0x12000	0x62da	0x6400	R-- IDATA
.data	0x19000	0x12f4	0xa00	RW- IDATA
.reloc	0x1b000	0xec0	0x1000	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x17cd4	0x28
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x1b000	0xec0
DEBUG	0x17590	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x175b0	0x40
Bound_IAT	0	0
IAT	0x12000	0x10c
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
KERNEL32.dll	1101	QueryPerformanceCounter
KERNEL32.dll	536	GetCurrentProcessId
KERNEL32.dll	540	GetCurrentThreadId
KERNEL32.dll	745	GetSystemTimeAsFileTime
KERNEL32.dll	867	InitializeSListHead
KERNEL32.dll	895	IsDebuggerPresent
KERNEL32.dll	1453	UnhandledExceptionFilter
KERNEL32.dll	1389	SetUnhandledExceptionFilter
KERNEL32.dll	720	GetStartupInfoW
KERNEL32.dll	902	IsProcessorFeaturePresent
KERNEL32.dll	632	GetModuleHandleW
KERNEL32.dll	535	GetCurrentProcess
KERNEL32.dll	1420	TerminateProcess
KERNEL32.dll	1553	WriteConsoleW
KERNEL32.dll	1235	RtlUnwind
KERNEL32.dll	609	GetLastError
KERNEL32.dll	1330	SetLastError
KERNEL32.dll	305	EnterCriticalSection
KERNEL32.dll	957	LeaveCriticalSection
KERNEL32.dll	272	DeleteCriticalSection
KERNEL32.dll	863	InitializeCriticalSectionAndSpinCount
KERNEL32.dll	1438	TlsAlloc
KERNEL32.dll	1440	TlsGetValue
KERNEL32.dll	1441	TlsSetValue
KERNEL32.dll	1439	TlsFree
KERNEL32.dll	427	FreeLibrary
KERNEL32.dll	686	GetProcAddress
KERNEL32.dll	963	LoadLibraryExW
KERNEL32.dll	1122	RaiseException
KERNEL32.dll	722	GetStdHandle
KERNEL32.dll	1554	WriteFile
KERNEL32.dll	628	GetModuleFileNameW
KERNEL32.dll	350	ExitProcess
KERNEL32.dll	631	GetModuleHandleExW
KERNEL32.dll	470	GetCommandLineA
KERNEL32.dll	471	GetCommandLineW
KERNEL32.dll	837	HeapAlloc
KERNEL32.dll	841	HeapFree
KERNEL32.dll	155	CompareStringW
KERNEL32.dll	945	LCMapStringW
KERNEL32.dll	590	GetFileType
KERNEL32.dll	373	FindClose
KERNEL32.dll	379	FindFirstFileExW
KERNEL32.dll	396	FindNextFileW
KERNEL32.dll	907	IsValidCodePage
KERNEL32.dll	434	GetACP
KERNEL32.dll	663	GetOEMCP
KERNEL32.dll	449	GetCPInfo
KERNEL32.dll	1007	MultiByteToWideChar
KERNEL32.dll	1534	WideCharToMultiByte
KERNEL32.dll	567	GetEnvironmentStringsW
KERNEL32.dll	426	FreeEnvironmentStringsW
KERNEL32.dll	1300	SetEnvironmentVariableW
KERNEL32.dll	1354	SetStdHandle
KERNEL32.dll	727	GetStringTypeW
KERNEL32.dll	692	GetProcessHeap
KERNEL32.dll	415	FlushFileBuffers
KERNEL32.dll	490	GetConsoleCP
KERNEL32.dll	508	GetConsoleMode
KERNEL32.dll	588	GetFileSizeEx
KERNEL32.dll	1315	SetFilePointerEx
KERNEL32.dll	846	HeapSize
KERNEL32.dll	844	HeapReAlloc
KERNEL32.dll	134	CloseHandle
KERNEL32.dll	203	CreateFileW
KERNEL32.dll	265	DecodePointer

show previews

offset	size	type	comment
0	101376	EXE	07/08/2019 09:38:39	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK