NET Core 5 (5.0.0-preview.7) VS2019 Preview (16.8-preview1)-WindowsFormsApp.exe - NET Core 5 (5.0.0-preview.7) VS2019 Preview (16.8-preview1)-WindowsFormsApp.dll - NET Core 5 (5.0.0-preview.7) VS2019 Preview (16.8-preview1)-WindowsFormsApp

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	NET Core 5 (5.0.0-preview.7) VS2019 Preview (16.8-preview1)-WindowsFormsApp.exe
size	144384 (0x23400)
md5	2bed78914f4557c94077f8f04d17e44c

type	PE32+ executable (GUI) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

Rich Header

lib id	version	times used
260	28619	12
259	28619	10
261	28619	80
147	30729	16
257	27412	9
1	0	165
265	28806	10
258	28806	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	7
TimeDateStamp	0x5f0eac8e
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.26
SizeOfCode	0x14200
SizeOfInitializedData	0xee00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x10120
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x29000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0xc160
SizeOfStackReserve	0x180000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig4

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1416c	0x14200	R-X CODE
.rdata	0x16000	0xbf2a	0xc000	R-- IDATA
.data	0x22000	0x1630	0xa00	RW- IDATA
.pdata	0x24000	0x1200	0x1200	R-- IDATA
_RDATA	0x26000	0x94	0x200	R-- IDATA
.rsrc	0x27000	0x7e0	0x800	R-- IDATA
.reloc	0x28000	0x6c8	0x800	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x210bc	0x104
RESOURCE	0x27000	0x7e0
EXCEPTION	0x24000	0x1200
SECURITY	0	0
BASERELOC	0x28000	0x6c8
DEBUG	0x1e2f0	0x54
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x1e480	0x28
LOAD_CONFIG	0x1e350	0x130
Bound_IAT	0	0
IAT	0x16000	0x400
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x14001f388	0x14001f398	0x140023618	0x1400164d0	0	0x400000

show previews

type	name	size	cp
VERSION	#1	1364	1252
MANIFEST	#1	490	1252

module_name	hint	function_name
KERNEL32.dll	404	FindNextFileW
KERNEL32.dll	543	GetCurrentProcess
KERNEL32.dll	639	GetModuleHandleExW
KERNEL32.dll	636	GetModuleFileNameW
KERNEL32.dll	963	LeaveCriticalSection
KERNEL32.dll	873	InitializeCriticalSection
KERNEL32.dll	578	GetEnvironmentVariableW
KERNEL32.dll	381	FindClose
KERNEL32.dll	1013	MultiByteToWideChar
KERNEL32.dll	617	GetLastError
KERNEL32.dll	587	GetFileAttributesExW
KERNEL32.dll	610	GetFullPathNameW
KERNEL32.dll	695	GetProcAddress
KERNEL32.dll	275	DeleteCriticalSection
KERNEL32.dll	1551	WideCharToMultiByte
KERNEL32.dll	919	IsWow64Process
KERNEL32.dll	969	LoadLibraryExW
KERNEL32.dll	435	FreeLibrary
KERNEL32.dll	1127	RaiseException
KERNEL32.dll	1245	RtlPcToFileHeader
KERNEL32.dll	311	EnterCriticalSection
KERNEL32.dll	387	FindFirstFileExW
KERNEL32.dll	1053	OutputDebugStringW
KERNEL32.dll	967	LoadLibraryA
KERNEL32.dll	640	GetModuleHandleW
KERNEL32.dll	1249	RtlUnwindEx
KERNEL32.dll	878	InitializeSListHead
KERNEL32.dll	548	GetCurrentThreadId
KERNEL32.dll	544	GetCurrentProcessId
KERNEL32.dll	1105	QueryPerformanceCounter
KERNEL32.dll	900	IsDebuggerPresent
KERNEL32.dll	907	IsProcessorFeaturePresent
KERNEL32.dll	1436	TerminateProcess
KERNEL32.dll	1405	SetUnhandledExceptionFilter
KERNEL32.dll	1470	UnhandledExceptionFilter
KERNEL32.dll	1250	RtlVirtualUnwind
KERNEL32.dll	1243	RtlLookupFunctionEntry
KERNEL32.dll	1236	RtlCaptureContext
KERNEL32.dll	951	LCMapStringW
KERNEL32.dll	268	DecodePointer
KERNEL32.dll	307	EncodePointer
KERNEL32.dll	754	GetSystemTimeAsFileTime
KERNEL32.dll	1455	TlsFree
KERNEL32.dll	1457	TlsSetValue
KERNEL32.dll	1456	TlsGetValue
KERNEL32.dll	1454	TlsAlloc
KERNEL32.dll	1431	SwitchToThread
KERNEL32.dll	874	InitializeCriticalSectionAndSpinCount
KERNEL32.dll	1344	SetLastError
KERNEL32.dll	736	GetStringTypeW
USER32.dll	652	MessageBoxW
SHELL32.dll	430	ShellExecuteW
ADVAPI32.dll	652	RegOpenKeyExW
ADVAPI32.dll	641	RegGetValueW
ADVAPI32.dll	237	DeregisterEventSource
ADVAPI32.dll	686	RegisterEventSourceW
ADVAPI32.dll	704	ReportEventW
ADVAPI32.dll	603	RegCloseKey
api-ms-win-crt-runtime-l1-1-0.dll	30	_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll	33	_errno
api-ms-win-crt-runtime-l1-1-0.dll	22	_cexit
api-ms-win-crt-runtime-l1-1-0.dll	64	_seh_filter_exe
api-ms-win-crt-runtime-l1-1-0.dll	66	_set_app_type
api-ms-win-crt-runtime-l1-1-0.dll	57	_invalid_parameter_noinfo_noreturn
api-ms-win-crt-runtime-l1-1-0.dll	60	_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll	25	_configure_wide_argv
api-ms-win-crt-runtime-l1-1-0.dll	55	_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll	85	exit
api-ms-win-crt-runtime-l1-1-0.dll	53	_initialize_wide_environment
api-ms-win-crt-runtime-l1-1-0.dll	41	_get_initial_wide_environment
api-ms-win-crt-runtime-l1-1-0.dll	54	_initterm
api-ms-win-crt-runtime-l1-1-0.dll	52	_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll	35	_exit
api-ms-win-crt-runtime-l1-1-0.dll	103	terminate
api-ms-win-crt-runtime-l1-1-0.dll	84	abort
api-ms-win-crt-runtime-l1-1-0.dll	4	__p___argc
api-ms-win-crt-runtime-l1-1-0.dll	6	__p___wargv
api-ms-win-crt-runtime-l1-1-0.dll	21	_c_exit
api-ms-win-crt-runtime-l1-1-0.dll	61	_register_thread_local_exe_atexit_callback
api-ms-win-crt-stdio-l1-1-0.dll	17	__stdio_common_vswprintf
api-ms-win-crt-stdio-l1-1-0.dll	1	__p__commode
api-ms-win-crt-stdio-l1-1-0.dll	84	_set_fmode
api-ms-win-crt-stdio-l1-1-0.dll	15	__stdio_common_vsprintf_s
api-ms-win-crt-stdio-l1-1-0.dll	152	setvbuf
api-ms-win-crt-stdio-l1-1-0.dll	98	_wfopen
api-ms-win-crt-stdio-l1-1-0.dll	7	__stdio_common_vfwprintf
api-ms-win-crt-stdio-l1-1-0.dll	119	fflush
api-ms-win-crt-stdio-l1-1-0.dll		__acrt_iob_func
api-ms-win-crt-stdio-l1-1-0.dll	129	fputwc
api-ms-win-crt-stdio-l1-1-0.dll	130	fputws
api-ms-win-crt-heap-l1-1-0.dll	25	malloc
api-ms-win-crt-heap-l1-1-0.dll	24	free
api-ms-win-crt-heap-l1-1-0.dll	22	_set_new_mode
api-ms-win-crt-heap-l1-1-0.dll	8	_callnewh
api-ms-win-crt-heap-l1-1-0.dll	23	calloc
api-ms-win-crt-string-l1-1-0.dll	73	_wcsdup
api-ms-win-crt-string-l1-1-0.dll	166	wcsncmp
api-ms-win-crt-string-l1-1-0.dll	138	strcspn
api-ms-win-crt-string-l1-1-0.dll	169	wcsnlen
api-ms-win-crt-string-l1-1-0.dll	137	strcpy_s
api-ms-win-crt-convert-l1-1-0.dll	71	_wtoi
api-ms-win-crt-convert-l1-1-0.dll	115	wcstoul
api-ms-win-crt-locale-l1-1-0.dll	15	_unlock_locales
api-ms-win-crt-locale-l1-1-0.dll	19	setlocale
api-ms-win-crt-locale-l1-1-0.dll	6	__pctype_func
api-ms-win-crt-locale-l1-1-0.dll	2	___lc_locale_name_func
api-ms-win-crt-locale-l1-1-0.dll		___lc_codepage_func
api-ms-win-crt-locale-l1-1-0.dll	3	___mb_cur_max_func
api-ms-win-crt-locale-l1-1-0.dll	13	_lock_locales
api-ms-win-crt-locale-l1-1-0.dll	8	_configthreadlocale
api-ms-win-crt-locale-l1-1-0.dll	18	localeconv
api-ms-win-crt-math-l1-1-0.dll	203	frexp
api-ms-win-crt-math-l1-1-0.dll	9	__setusermatherr
api-ms-win-crt-time-l1-1-0.dll	31	_gmtime64
api-ms-win-crt-time-l1-1-0.dll	71	wcsftime
api-ms-win-crt-time-l1-1-0.dll	48	_time64

StringTable 000004b0

CompanyName	NET Core 5 (5.0.0-preview.7) VS2019 Preview (16.8-preview1)-WindowsFormsApp
FileDescription	NET Core 5 (5.0.0-preview.7) VS2019 Preview (16.8-preview1)-WindowsFormsApp
FileVersion	1.0.0.0
InternalName	NET Core 5 (5.0.0-preview.7) VS2019 Preview (16.8-preview1)-WindowsFormsApp.dll
LegalCopyright
OriginalFilename	NET Core 5 (5.0.0-preview.7) VS2019 Preview (16.8-preview1)-WindowsFormsApp.dll
ProductName	NET Core 5 (5.0.0-preview.7) VS2019 Preview (16.8-preview1)-WindowsFormsApp
ProductVersion	1.0.0
Assembly Version	1.0.0.0

VS_FIXEDFILEINFO

FileVersion	1.0.0.0
ProductVersion	1.0.0.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	138800	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x23618

NET Core 5 (5.0.0-preview.7) VS2019 Preview (16.8-preview1)-WindowsFormsApp.exe-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

TLS

StringTable 000004b0

VS_FIXEDFILEINFO

NET Core 5 (5.0.0-preview.7) VS2019 Preview (16.8-preview1)-WindowsFormsApp.exe
-