edccchk.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	edccchk.exe
size	477539 (0x74963)
md5	1540fbe703488e50bb3e84f785e6198a

type	PE32+ executable (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	0x11
TimeDateStamp	0x5eaee109
PointerToSymbolTable	0x6aa00
NumberOfSymbols	0x734
SizeOfOptionalHeader	0xf0
Characteristics	0x27
Magic	0x20b
LinkerVersion	2.30
SizeOfCode	0x3e00
SizeOfInitializedData	0x6800
SizeOfUninitializedData	0x1000
AddressOfEntryPoint	0x1500
BaseOfCode	0x1000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	5.2
Reserved1	0
SizeOfImage	0x74000
SizeOfHeaders	0x600
CheckSum	0x81b06
Subsystem	3
DllCharacteristics	0x160
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x3d58	0x3e00	R-X CODE IDATA
.data	0x5000	0xa0	0x200	RW- IDATA
.rdata	0x6000	0xf90	0x1000	R-- IDATA
.pdata	0x7000	0x324	0x400	R-- IDATA
.xdata	0x8000	0x2e4	0x400	R-- IDATA
.bss	0x9000	0xff0	0	RW- UDATA
.idata	0xa000	0xb50	0xc00	RW- IDATA
.CRT	0xb000	0x68	0x200	RW- IDATA
.tls	0xc000	0x68	0x200	RW- IDATA
/4	0xd000	0x470	0x600	R-- IDATA DISCARDABLE
/19	0xe000	0x54948	0x54a00	R-- IDATA DISCARDABLE
/31	0x63000	0x2d13	0x2e00	R-- IDATA DISCARDABLE
/45	0x66000	0x3062	0x3200	R-- IDATA DISCARDABLE
/57	0x6a000	0xfa8	0x1000	R-- IDATA DISCARDABLE
/70	0x6b000	0x8c5	0xa00	R-- IDATA DISCARDABLE
/81	0x6c000	0x67c7	0x6800	R-- IDATA DISCARDABLE
/92	0x73000	0x910	0xa00	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xa000	0xb50
RESOURCE	0	0
EXCEPTION	0x7000	0x324
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0xc020	0x28
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0xa2e0	0x290
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x40c000	0x40c060	0x409c5c	0x40b040	0	0

module_name	hint	function_name
KERNEL32.dll	217	DeleteCriticalSection
KERNEL32.dll	250	EnterCriticalSection
KERNEL32.dll	463	GetCurrentProcess
KERNEL32.dll	464	GetCurrentProcessId
KERNEL32.dll	468	GetCurrentThreadId
KERNEL32.dll	530	GetLastError
KERNEL32.dll	550	GetModuleHandleA
KERNEL32.dll	600	GetProcAddress
KERNEL32.dll	629	GetStartupInfoA
KERNEL32.dll	652	GetSystemTimeAsFileTime
KERNEL32.dll	679	GetTickCount
KERNEL32.dll	695	GetVersion
KERNEL32.dll	763	InitializeCriticalSection
KERNEL32.dll	845	LeaveCriticalSection
KERNEL32.dll	959	QueryPerformanceCounter
KERNEL32.dll	1030	RtlAddFunctionTable
KERNEL32.dll	1031	RtlCaptureContext
KERNEL32.dll	1038	RtlLookupFunctionEntry
KERNEL32.dll	1045	RtlVirtualUnwind
KERNEL32.dll	1188	SetUnhandledExceptionFilter
KERNEL32.dll	1201	Sleep
KERNEL32.dll	1215	TerminateProcess
KERNEL32.dll	1222	TlsGetValue
KERNEL32.dll	1235	UnhandledExceptionFilter
KERNEL32.dll	1265	VirtualProtect
KERNEL32.dll	1267	VirtualQuery
msvcrt.dll	56	__C_specific_handler
msvcrt.dll	79	__dllonexit
msvcrt.dll	80	__doserrno
msvcrt.dll	82	__getmainargs
msvcrt.dll	83	__initenv
msvcrt.dll	84	__iob_func
msvcrt.dll	91	__lconv_init
msvcrt.dll	94	__pioinfo
msvcrt.dll	97	__set_app_type
msvcrt.dll	99	__setusermatherr
msvcrt.dll	114	_acmdln
msvcrt.dll	121	_amsg_exit
msvcrt.dll	139	_cexit
msvcrt.dll	189	_errno
msvcrt.dll	209	_filelengthi64
msvcrt.dll	210	_fileno
msvcrt.dll	220	_fmode
msvcrt.dll	281	_initterm
msvcrt.dll	383	_lock
msvcrt.dll	392	_lseeki64
msvcrt.dll	548	_onexit
msvcrt.dll	709	_unlock
msvcrt.dll	855	_write
msvcrt.dll	897	abort
msvcrt.dll	914	calloc
msvcrt.dll	927	exit
msvcrt.dll	931	fclose
msvcrt.dll	932	feof
msvcrt.dll	934	fflush
msvcrt.dll	935	fgetc
msvcrt.dll	936	fgetpos
msvcrt.dll	944	fopen
msvcrt.dll	946	fprintf
msvcrt.dll	948	fputc
msvcrt.dll	952	fread
msvcrt.dll	953	free
msvcrt.dll	960	fsetpos
msvcrt.dll	965	fwrite
msvcrt.dll	978	isalpha
msvcrt.dll	986	isspace
msvcrt.dll	987	isupper
msvcrt.dll	1011	malloc
msvcrt.dll	1019	memcpy
msvcrt.dll	1020	memmove
msvcrt.dll	1028	printf
msvcrt.dll	1032	puts
msvcrt.dll	1049	signal
msvcrt.dll	1068	strerror
msvcrt.dll	1070	strlen
msvcrt.dll	1073	strncmp
msvcrt.dll	1098	tolower
msvcrt.dll	1104	vfprintf
USER32.dll	392	GetWindowThreadProcessId

show previews

offset	size	type	comment
0	477539	EXE	05/03/2020 15:19:37	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x9c5c