filenameeclipse.exe
size312320 (0x4c400)
md5306b855fd6ea1d1935902ead5f7f1fa5
typePE32+ executable (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
125403101
123403109
1073
1094031015
124403101
120403101

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections5
TimeDateStamp0x4fad6d5e
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x23
Magic0x20b
LinkerVersion8.0
SizeOfCode0x2e00
SizeOfInitializedData0x49800
SizeOfUninitializedData0
AddressOfEntryPoint0x38c0
BaseOfCode0x1000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x4f000
SizeOfHeaders0x400
CheckSum0x534ea
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x2cde0x2e00R-X CODE
.rdata0x40000xace0xc00R-- IDATA
.data0x50000xa800x600RW- IDATA
.pdata0x60000x1a40x200R-- IDATA
.rsrc0x70000x47c380x47e00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x43dc0x64
RESOURCE0x70000x47c38
EXCEPTION0x60000x1a4
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x40000x258
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#137520
ICON#222160
ICON#313840
ICON#42703760
ICON#596400
ICON#642640
ICON#711280
GROUP_ICON#4011040
MANIFEST#15490
module_namehintordfunction_name
KERNEL32.dll922WideCharToMultiByte
KERNEL32.dll209FindClose
KERNEL32.dll224FindNextFileW
KERNEL32.dll216FindFirstFileW
KERNEL32.dll592LoadLibraryExW
KERNEL32.dll388GetModuleHandleW
KERNEL32.dll593LoadLibraryW
KERNEL32.dll384GetModuleFileNameW
KERNEL32.dll418GetProcAddress
KERNEL32.dll727RtlLookupFunctionEntry
KERNEL32.dll734RtlVirtualUnwind
KERNEL32.dll848SetUnhandledExceptionFilter
KERNEL32.dll884UnhandledExceptionFilter
KERNEL32.dll325GetCurrentProcess
KERNEL32.dll251FreeLibrary
KERNEL32.dll625MultiByteToWideChar
KERNEL32.dll868TerminateProcess
KERNEL32.dll460GetSystemTimeAsFileTime
KERNEL32.dll326GetCurrentProcessId
KERNEL32.dll329GetCurrentThreadId
KERNEL32.dll481GetTickCount
KERNEL32.dll671QueryPerformanceCounter
KERNEL32.dll720RtlCaptureContext
USER32.dll489MessageBoxW
USER32.dll97CreateWindowExW
USER32.dll450LoadIconW
USER32.dll588SetClassLongPtrW
COMCTL32.dll17
msvcrt.dll750wcscat
msvcrt.dll477_wcsicmp
msvcrt.dll754wcscpy
msvcrt.dll512_wgetcwd
msvcrt.dll741towupper
msvcrt.dll762wcsrchr
msvcrt.dll542_wstat
msvcrt.dll757wcslen
msvcrt.dll730swscanf
msvcrt.dll689realloc
msvcrt.dll600fgetws
msvcrt.dll508_wfopen
msvcrt.dll760wcsncpy
msvcrt.dll514_wgetenv
msvcrt.dll767wcstol
msvcrt.dll673memset
msvcrt.dll759wcsncmp
msvcrt.dll166_errno
msvcrt.dll761wcspbrk
msvcrt.dll752wcscmp
msvcrt.dll54_XcptFilter
msvcrt.dll127_c_exit
msvcrt.dll175_exit
msvcrt.dll130_cexit
msvcrt.dll109__winitenv
msvcrt.dll108__wgetmainargs
msvcrt.dll244_initterm
msvcrt.dll98__setusermatherr
msvcrt.dll142_commode
msvcrt.dll198_fmode
msvcrt.dll96__set_app_type
msvcrt.dll729swprintf
msvcrt.dll245_iob
msvcrt.dll619fwprintf
msvcrt.dll588exit
msvcrt.dll665malloc
msvcrt.dll612free
msvcrt.dll696setlocale
msvcrt.dll671memcpy
msvcrt.dll751wcschr
msvcrt.dll55__C_specific_handler
msvcrt.dll475_wcsdup
msvcrt.dll592fclose
offsetsizetypecomment
15c115HTM#
15d0306736BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK