filename613a409be8e6431661e4779ce68578842f2de70a3d7dd21c3737f3d480465a01
size41441 (0xa1e1)
md5189e90320cb7f1d8ad9df4e17387a7df
typePE32+ executable (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
207655011
203655017
1060
206655016
205655011
210655013
201655011
204655011

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x54e37cb4
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion11.0
SizeOfCode0x2400
SizeOfInitializedData0x179400
SizeOfUninitializedData0
AddressOfEntryPoint0x13f8
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.3
ImageVersion6.3
SubsystemVersion5.2
Reserved10
SizeOfImage0x181000
SizeOfHeaders0x400
CheckSum0x18971a
Subsystem2
DllCharacteristics0x8160
SizeOfStackReserve0x80000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x23b80x2400R-X CODE
.data0x40000x5c80x200RW- IDATA
.pdata0x50000x2340x400R-- IDATA
.idata0x60000x8d40xa00R-- IDATA
.rsrc0x70000x1780300x178200R-- IDATA
.reloc0x1800000x720x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x61f80x50
RESOURCE0x70000x178030
EXCEPTION0x50000x234
SECURITY0x17bc000x3cf8
BASERELOC0x1800000x14
DEBUG0x10100x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x12a00x94
Bound_IAT00
IAT0x60000x1f8
Delay_IAT00
CLR_Header00
typenamesizecp
BINARY1.193.7.0_TO_1.193.100.0_MPASDLTA.VDM._P6985461252
BINARY1.193.7.0_TO_1.193.100.0_MPAVDLTA.VDM._P8391291252
VERSION#115461252
MANIFEST#14561252
module_namehintordfunction_name
KERNEL32.dll1387TerminateProcess
KERNEL32.dll527GetCurrentProcess
KERNEL32.dll1357SetUnhandledExceptionFilter
KERNEL32.dll1421UnhandledExceptionFilter
KERNEL32.dll1208RtlVirtualUnwind
KERNEL32.dll1201RtlLookupFunctionEntry
KERNEL32.dll1194RtlCaptureContext
KERNEL32.dll761GetTickCount
KERNEL32.dll733GetSystemTimeAsFileTime
KERNEL32.dll532GetCurrentThreadId
KERNEL32.dll528GetCurrentProcessId
KERNEL32.dll1069QueryPerformanceCounter
KERNEL32.dll463GetCommandLineW
KERNEL32.dll343ExitProcess
KERNEL32.dll832HeapSetInformation
KERNEL32.dll399FindResourceW
KERNEL32.dll420FreeLibrary
KERNEL32.dll942LoadResource
KERNEL32.dll219CreateProcessW
KERNEL32.dll824HeapAlloc
KERNEL32.dll737GetSystemWindowsDirectoryW
KERNEL32.dll828HeapFree
KERNEL32.dll178CreateDirectoryW
KERNEL32.dll1462WaitForSingleObject
KERNEL32.dll681GetProcessHeap
KERNEL32.dll1516WriteFile
KERNEL32.dll724GetSystemDirectoryW
KERNEL32.dll939LoadLibraryW
KERNEL32.dll1371SizeofResource
KERNEL32.dll563GetExitCodeProcess
KERNEL32.dll194CreateFileW
KERNEL32.dll598GetLastError
KERNEL32.dll521GetCurrentDirectoryW
KERNEL32.dll676GetProcAddress
KERNEL32.dll960LockResource
KERNEL32.dll1262SetCurrentDirectoryW
KERNEL32.dll1173RemoveDirectoryW
KERNEL32.dll127CloseHandle
KERNEL32.dll267DeleteFileW
KERNEL32.dll1282SetFileAttributesW
ADVAPI32.dll674RegSetValueExW
ADVAPI32.dll596RegCloseKey
ADVAPI32.dll330GetLengthSid
ADVAPI32.dll645RegOpenKeyExW
ADVAPI32.dll307FreeSid
ADVAPI32.dll412IsValidSid
ADVAPI32.dll16AddAccessAllowedAce
ADVAPI32.dll32AllocateAndInitializeSid
ADVAPI32.dll396InitializeAcl
ADVAPI32.dll620RegDeleteValueW
ADVAPI32.dll735SetSecurityDescriptorDacl
ADVAPI32.dll397InitializeSecurityDescriptor
ADVAPI32.dll658RegQueryValueExW
ADVAPI32.dll605RegCreateKeyExW
ADVAPI32.dll133CopySid
ADVAPI32.dll530OpenProcessToken
ADVAPI32.dll367GetTokenInformation
ntdll.dll2104memset
ntdll.dll33DbgPrint
ntdll.dll2100memcpy

VS_FIXEDFILEINFO

dwSignature0
FileVersion0.0.0.0
ProductVersion0.0.0.0
StrucVersion0
FileFlagsMask0
FileFlags0
FileOS0
FileType0
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d035857BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] invalid VS_VERSIONINFO child type nil