filenameFar.exe
size4444672 (0x43d200)
md5333d24679e834bcfe38aa985433c83fd
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
1583031913
131307292
1473072927
10382
17030319197
17130319208
154303191
157303191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections7
TimeDateStamp0x53c3c28b
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion10.0
SizeOfCode0x2eea00
SizeOfInitializedData0x199000
SizeOfUninitializedData0
AddressOfEntryPoint0x2975e8
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.2
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x48e000
SizeOfHeaders0x400
CheckSum0x4429f9
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x2ee95a0x2eea00R-X CODE
.rdata0x2f00000xda03e0xda200R-- IDATA
.data0x3cb0000x595380xea00RW- IDATA
.pdata0x4250000x1d0a00x1d200R-- IDATA
.tls0x4430000x100390x10200RW- IDATA
.rsrc0x4540000x321000x32200R-- IDATA
.reloc0x4870000x60a80x6200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x3c74fc0x118
RESOURCE0x4540000x32100
EXCEPTION0x4250000x1d0a0
SECURITY00
BASERELOC0x4870000x35b0
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x34b3280x28
LOAD_CONFIG00
Bound_IAT00
IAT0x2f00000xc50
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x1404430000x1404530380x140421ba40x1402f0d8800
typenamesizecp
ICON#126640
ICON#225040
ICON#316400
ICON#412240
ICON#57440
ICON#64880
ICON#74240
ICON#82960
ICON#956720
ICON#1051440
ICON#1137520
ICON#1229840
ICON#1322160
ICON#1417360
ICON#1515440
ICON#1613840
ICON#1776150
ICON#18169360
ICON#19149200
ICON#2096400
ICON#2167600
ICON#2242640
ICON#2324400
ICON#2417200
ICON#2511280
ICON#2626640
ICON#2725040
ICON#2816400
ICON#2912240
ICON#307440
ICON#314880
ICON#324240
ICON#332960
ICON#3456720
ICON#3551440
ICON#3637520
ICON#3729840
ICON#3822160
ICON#3917360
ICON#4015440
ICON#4113840
ICON#4270190
ICON#43169360
ICON#44149200
ICON#4596400
ICON#4667600
ICON#4742640
ICON#4824400
ICON#4917200
ICON#5011280
GROUP_ICON#1003560
GROUP_ICON#1013560
VERSION#17640
MANIFEST#117750
module_namehintordfunction_name
KERNEL32.dll666GetTickCount
KERNEL32.dll652GetTempPathW
KERNEL32.dll651GetTempPathA
KERNEL32.dll640GetSystemTimeAsFileTime
KERNEL32.dll638GetSystemTime
KERNEL32.dll634GetSystemInfo
KERNEL32.dll588GetProcAddress
KERNEL32.dll520GetLastError
KERNEL32.dll514GetFullPathNameW
KERNEL32.dll511GetFullPathNameA
KERNEL32.dll503GetFileSize
KERNEL32.dll494GetFileAttributesExW
KERNEL32.dll497GetFileAttributesW
KERNEL32.dll492GetFileAttributesA
KERNEL32.dll470GetDiskFreeSpaceW
KERNEL32.dll467GetDiskFreeSpaceA
KERNEL32.dll455GetCurrentProcessId
KERNEL32.dll360FreeLibrary
KERNEL32.dll356FormatMessageW
KERNEL32.dll355FormatMessageA
KERNEL32.dll349FlushFileBuffers
KERNEL32.dll215DeleteFileW
KERNEL32.dll212DeleteFileA
KERNEL32.dll158CreateMutexW
KERNEL32.dll140CreateFileMappingW
KERNEL32.dll137CreateFileMappingA
KERNEL32.dll143CreateFileW
KERNEL32.dll136CreateFileA
KERNEL32.dll82CloseHandle
KERNEL32.dll21AreFileApisANSI
KERNEL32.dll210DeleteCriticalSection
KERNEL32.dll242EnterCriticalSection
KERNEL32.dll827LeaveCriticalSection
KERNEL32.dll746InitializeCriticalSection
KERNEL32.dll1271VerifyVersionInfoW
KERNEL32.dll1267VerSetConditionMask
KERNEL32.dll474GetDriveTypeW
KERNEL32.dll1190SetThreadPriority
KERNEL32.dll661GetThreadPriority
KERNEL32.dll458GetCurrentThread
KERNEL32.dll706GlobalFree
KERNEL32.dll717GlobalUnlock
KERNEL32.dll710GlobalLock
KERNEL32.dll699GlobalAlloc
KERNEL32.dll100CompareStringW
KERNEL32.dll366GetACP
KERNEL32.dll574GetOEMCP
KERNEL32.dll376GetCPInfo
KERNEL32.dll378GetCPInfoExW
KERNEL32.dll269EnumSystemCodePagesW
KERNEL32.dll579GetPrivateProfileIntW
KERNEL32.dll1127SetEvent
KERNEL32.dll1286WaitForMultipleObjects
KERNEL32.dll133CreateEventW
KERNEL32.dll1042ResetEvent
KERNEL32.dll619GetStdHandle
KERNEL32.dll16AllocConsole
KERNEL32.dll357FreeConsole
KERNEL32.dll445GetConsoleWindow
KERNEL32.dll440GetConsoleScreenBufferInfo
KERNEL32.dll1111SetConsoleWindowInfo
KERNEL32.dll416GetConsoleCP
KERNEL32.dll1082SetConsoleCP
KERNEL32.dll438GetConsoleOutputCP
KERNEL32.dll1104SetConsoleOutputCP
KERNEL32.dll1083SetConsoleCtrlHandler
KERNEL32.dll434GetConsoleMode
KERNEL32.dll1099SetConsoleMode
KERNEL32.dll1325WriteConsoleInputW
KERNEL32.dll1331WriteConsoleW
KERNEL32.dll1108SetConsoleTextAttribute
KERNEL32.dll422GetConsoleCursorInfo
KERNEL32.dll1085SetConsoleCursorInfo
KERNEL32.dll348FlushConsoleInputBuffer
KERNEL32.dll572GetNumberOfConsoleInputEvents
KERNEL32.dll411GetConsoleAliasW
KERNEL32.dll424GetConsoleDisplayMode
KERNEL32.dll1081SetConsoleActiveScreenBuffer
KERNEL32.dll300FillConsoleOutputAttribute
KERNEL32.dll302FillConsoleOutputCharacterW
KERNEL32.dll1065ScrollConsoleScreenBufferW
KERNEL32.dll910PeekConsoleInputW
KERNEL32.dll955ReadConsoleInputW
KERNEL32.dll1087SetConsoleCursorPosition
KERNEL32.dll426GetConsoleFontSize
KERNEL32.dll450GetCurrentConsoleFont
KERNEL32.dll519GetLargestConsoleWindowSize
KERNEL32.dll1110SetConsoleTitleW
KERNEL32.dll1107SetConsoleScreenBufferSize
KERNEL32.dll1330WriteConsoleOutputW
KERNEL32.dll960ReadConsoleOutputW
KERNEL32.dll1184SetThreadExecutionState
KERNEL32.dll1152SetLastError
KERNEL32.dll616GetShortPathNameW
KERNEL32.dll533GetLongPathNameW
KERNEL32.dll385GetCalendarInfoW
KERNEL32.dll1228SystemTimeToTzSpecificLocalTime
KERNEL32.dll299FileTimeToSystemTime
KERNEL32.dll840LocalFileTimeToFileTime
KERNEL32.dll521GetLocalTime
KERNEL32.dll527GetLogicalDrives
KERNEL32.dll459GetCurrentThreadId
KERNEL32.dll683GetVersionExA
KERNEL32.dll126CreateDirectoryExW
KERNEL32.dll129CreateDirectoryW
KERNEL32.dll1030RemoveDirectoryW
KERNEL32.dll114CopyFileExW
KERNEL32.dll866MoveFileExW
KERNEL32.dll1135SetFileAttributesW
KERNEL32.dll147CreateHardLinkW
KERNEL32.dll236DuplicateHandle
KERNEL32.dll454GetCurrentProcess
KERNEL32.dll898OpenProcess
KERNEL32.dll1230TerminateProcess
KERNEL32.dll575GetOverlappedResult
KERNEL32.dll101ConnectNamedPipe
KERNEL32.dll22AssignProcessToJobObject
KERNEL32.dll1150SetInformationJobObject
KERNEL32.dll150CreateJobObjectW
KERNEL32.dll935QueryInformationJobObject
KERNEL32.dll160CreateNamedPipeW
KERNEL32.dll838LocalAlloc
KERNEL32.dll1295WaitNamedPipeW
KERNEL32.dll1126SetErrorMode
KERNEL32.dll1115SetCurrentDirectoryW
KERNEL32.dll453GetCurrentDirectoryW
KERNEL32.dll1141SetFilePointerEx
KERNEL32.dll499GetFileInformationByHandle
KERNEL32.dll225DeviceIoControl
KERNEL32.dll504GetFileSizeEx
KERNEL32.dll1125SetEnvironmentVariableW
KERNEL32.dll481GetEnvironmentStringsW
KERNEL32.dll359FreeEnvironmentStringsW
KERNEL32.dll538GetModuleFileNameW
KERNEL32.dll308FindClose
KERNEL32.dll1067SearchPathW
KERNEL32.dll506GetFileType
KERNEL32.dll469GetDiskFreeSpaceExW
KERNEL32.dll930QueryDosDeviceW
KERNEL32.dll594GetProcessHeaps
KERNEL32.dll585GetPrivateProfileStringW
KERNEL32.dll687GetVolumeInformationW
KERNEL32.dll689GetVolumeNameForVolumeMountPointW
KERNEL32.dll483GetEnvironmentVariableW
KERNEL32.dll291ExpandEnvironmentStringsW
KERNEL32.dll869MoveFileW
KERNEL32.dll526GetLogicalDriveStringsW
KERNEL32.dll342FindVolumeClose
KERNEL32.dll336FindNextVolumeW
KERNEL32.dll325FindFirstVolumeW
KERNEL32.dll297FileTimeToDosDateTime
KERNEL32.dll309FindCloseChangeNotification
KERNEL32.dll311FindFirstChangeNotificationW
KERNEL32.dll815LCMapStringW
KERNEL32.dll1209SetVolumeMountPointW
KERNEL32.dll206DefineDosDeviceW
KERNEL32.dll938QueryPerformanceFrequency
KERNEL32.dll168CreateProcessW
KERNEL32.dll542GetModuleHandleW
KERNEL32.dll635GetSystemPowerStatus
KERNEL32.dll712GlobalMemoryStatusEx
KERNEL32.dll405GetComputerNameW
KERNEL32.dll404GetComputerNameExW
KERNEL32.dll288ExitThread
KERNEL32.dll1172SetStdHandle
KERNEL32.dll524GetLocaleInfoW
KERNEL32.dll650GetTempFileNameW
KERNEL32.dll832LoadLibraryExW
KERNEL32.dll1131SetFileApisToOEM
KERNEL32.dll1130SetFileApisToANSI
KERNEL32.dll1021ReleaseMutex
KERNEL32.dll601GetProcessTimes
KERNEL32.dll570GetNumberFormatW
KERNEL32.dll782IsValidLocale
KERNEL32.dll274EnumSystemLocalesA
KERNEL32.dll522GetLocaleInfoA
KERNEL32.dll675GetUserDefaultLCID
KERNEL32.dll618GetStartupInfoW
KERNEL32.dll1148SetHandleCount
KERNEL32.dll747InitializeCriticalSectionAndSpinCount
KERNEL32.dll624GetStringTypeW
KERNEL32.dll780IsValidCodePage
KERNEL32.dll344FlsAlloc
KERNEL32.dll345FlsFree
KERNEL32.dll347FlsSetValue
KERNEL32.dll346FlsGetValue
KERNEL32.dll682GetVersion
KERNEL32.dll731HeapSetInformation
KERNEL32.dll1048RtlCaptureContext
KERNEL32.dll1062RtlVirtualUnwind
KERNEL32.dll770IsDebuggerPresent
KERNEL32.dll1203SetUnhandledExceptionFilter
KERNEL32.dll1250UnhandledExceptionFilter
KERNEL32.dll397GetCommandLineW
KERNEL32.dll287ExitProcess
KERNEL32.dll729HeapQueryInformation
KERNEL32.dll671GetTimeZoneInformation
KERNEL32.dll180CreateThread
KERNEL32.dll238EncodePointer
KERNEL32.dll203DecodePointer
KERNEL32.dll1057RtlPcToFileHeader
KERNEL32.dll948RaiseException
KERNEL32.dll1061RtlUnwindEx
KERNEL32.dll1055RtlLookupFunctionEntry
KERNEL32.dll684GetVersionExW
KERNEL32.dll723HeapAlloc
KERNEL32.dll725HeapCreate
KERNEL32.dll726HeapDestroy
KERNEL32.dll727HeapFree
KERNEL32.dll730HeapReAlloc
KERNEL32.dll732HeapSize
KERNEL32.dll735HeapValidate
KERNEL32.dll724HeapCompact
KERNEL32.dll830LoadLibraryA
KERNEL32.dll833LoadLibraryW
KERNEL32.dll842LocalFree
KERNEL32.dll852LockFile
KERNEL32.dll853LockFileEx
KERNEL32.dll857MapViewOfFile
KERNEL32.dll873MultiByteToWideChar
KERNEL32.dll937QueryPerformanceCounter
KERNEL32.dll963ReadFile
KERNEL32.dll1121SetEndOfFile
KERNEL32.dll1140SetFilePointer
KERNEL32.dll1216Sleep
KERNEL32.dll1227SystemTimeToFileTime
KERNEL32.dll1251UnlockFile
KERNEL32.dll1252UnlockFileEx
KERNEL32.dll1253UnmapViewOfFile
KERNEL32.dll1312WideCharToMultiByte
KERNEL32.dll1332WriteFile
KERNEL32.dll1288WaitForSingleObject
KERNEL32.dll907OutputDebugStringA
KERNEL32.dll908OutputDebugStringW
KERNEL32.dll229DisconnectNamedPipe
KERNEL32.dll593GetProcessHeap
KERNEL32.dll1124SetEnvironmentVariableA
USER32.dll665SetForegroundWindow
USER32.dll756SystemParametersInfoW
USER32.dll242EnumWindows
USER32.dll406GetWindowInfo
USER32.dll156DefWindowProcW
USER32.dll571PostQuitMessage
USER32.dll166DestroyWindow
USER32.dll175DispatchMessageW
USER32.dll772TranslateMessage
USER32.dll351GetMessageW
USER32.dll458IsCharLowerW
USER32.dll593RegisterClassExW
USER32.dll415GetWindowPlacement
USER32.dll456IsCharAlphaW
USER32.dll486IsZoomed
USER32.dll596RegisterClipboardFormatW
USER32.dll554OpenClipboard
USER32.dll73CloseClipboard
USER32.dll213EmptyClipboard
USER32.dll280GetClipboardData
USER32.dll529MessageBeep
USER32.dll652SetClipboardData
USER32.dll462IsClipboardFormatAvailable
USER32.dll469IsIconic
USER32.dll422GetWindowTextLengthW
USER32.dll782UnregisterClassW
USER32.dll744ShowWindowAsync
USER32.dll455IsCharAlphaNumericW
USER32.dll43CharLowerA
USER32.dll57CharUpperA
USER32.dll459IsCharUpperA
USER32.dll457IsCharLowerA
USER32.dll453IsCharAlphaA
USER32.dll53CharToOemA
USER32.dll549OemToCharA
USER32.dll550OemToCharBuffA
USER32.dll454IsCharAlphaNumericA
USER32.dll55CharToOemBuffW
USER32.dll46CharLowerW
USER32.dll60CharUpperW
USER32.dll743ShowWindow
USER32.dll110CreateWindowExW
USER32.dll423GetWindowTextW
USER32.dll384GetSystemMetrics
USER32.dll321GetKeyboardLayoutList
USER32.dll252FlashWindowEx
USER32.dll301GetDoubleClickTime
USER32.dll814WaitForInputIdle
USER32.dll640SendMessageW
USER32.dll45CharLowerBuffW
USER32.dll484IsWindowVisible
USER32.dll409GetWindowLongPtrW
USER32.dll424GetWindowThreadProcessId
USER32.dll570PostMessageW
USER32.dll809VkKeyScanW
USER32.dll460IsCharUpperW
USER32.dll808VkKeyScanExW
USER32.dll524MapVirtualKeyW
USER32.dll319GetKeyState
USER32.dll824keybd_event
USER32.dll764ToUnicodeEx
USER32.dll499LoadImageW
USER32.dll59CharUpperBuffW
WINSPOOL.DRV203
WINSPOOL.DRV144OpenPrinterW
WINSPOOL.DRV182StartDocPrinterW
WINSPOOL.DRV188WritePrinter
WINSPOOL.DRV81EndDocPrinter
WINSPOOL.DRV29ClosePrinter
WINSPOOL.DRV104EnumPrintersW
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll32AllocateAndInitializeSid
ADVAPI32.dll288FreeSid
ADVAPI32.dll694SetSecurityDescriptorDacl
ADVAPI32.dll678SetEntriesInAclW
ADVAPI32.dll375InitializeSecurityDescriptor
ADVAPI32.dll216DecryptFileW
ADVAPI32.dll249EncryptFileW
ADVAPI32.dll591RegEnumKeyExW
ADVAPI32.dll594RegEnumValueW
ADVAPI32.dll304GetFileSecurityW
ADVAPI32.dll682SetFileSecurityW
ADVAPI32.dll310GetLengthSid
ADVAPI32.dll263EqualSid
ADVAPI32.dll118CopySid
ADVAPI32.dll108ConvertSidToStringSidW
ADVAPI32.dll401LookupAccountSidW
ADVAPI32.dll689SetNamedSecurityInfoW
ADVAPI32.dll399LookupAccountNameW
ADVAPI32.dll116ConvertStringSidToSidW
ADVAPI32.dll390IsValidSid
ADVAPI32.dll331GetSecurityDescriptorOwner
ADVAPI32.dll384IsTextUnicode
ADVAPI32.dll81CheckTokenMembership
ADVAPI32.dll357GetUserNameW
ADVAPI32.dll407LookupPrivilegeValueW
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll346GetTokenInformation
ADVAPI32.dll503OpenProcessToken
ADVAPI32.dll622RegQueryValueExW
SHELL32.dll195SHGetFolderPathW
SHELL32.dll290ShellExecuteW
SHELL32.dll289ShellExecuteExW
SHELL32.dll172SHFileOperationW
NETAPI32.dll101NetApiBufferFree
NETAPI32.dll220NetServerGetInfo
NETAPI32.dll255NetUserGetInfo
MPR.dll56WNetGetUniversalNameW
MPR.dll36WNetGetConnectionW
MPR.dll16WNetCloseEnum
MPR.dll28WNetEnumResourceW
MPR.dll61WNetOpenEnumW
MPR.dll12WNetCancelConnection2W
MPR.dll6WNetAddConnection2W
ole32.dll112CoUninitialize
ole32.dll20CoCreateInstance
ole32.dll155GetRunningObjectTable
ole32.dll130CreateFileMoniker
ole32.dll108CoTaskMemFree
ole32.dll19CoCreateGuid
ole32.dll67CoInitializeEx
PSAPI.DLL16GetModuleFileNameExW
Secur32.dll30GetUserNameExW
SETUPAPI.dll194CM_Request_Device_EjectW
SETUPAPI.dll139CM_Get_Sibling
SETUPAPI.dll95CM_Get_Device_ID_List_SizeW
SETUPAPI.dll91CM_Get_Device_ID_ListW
SETUPAPI.dll153CM_Locate_DevNodeW
SETUPAPI.dll366SetupDiGetDeviceInterfaceDetailW
SETUPAPI.dll84CM_Get_DevNode_Status
SETUPAPI.dll62CM_Get_Child
SETUPAPI.dll87CM_Get_Device_IDW
SETUPAPI.dll342SetupDiGetClassDevsW
SETUPAPI.dll319SetupDiDestroyDeviceInfoList
SETUPAPI.dll405SetupDiOpenDeviceInfoW
SETUPAPI.dll323SetupDiEnumDeviceInterfaces
SETUPAPI.dll372SetupDiGetDeviceRegistryPropertyW
RPCRT4.dll521UuidHash
RPCRT4.dll515UuidCreate
RPCRT4.dll520UuidFromStringW
VERSION.dll5GetFileVersionInfoSizeW
VERSION.dll6GetFileVersionInfoW
VERSION.dll14VerQueryValueW

StringTable 000004E4

CompanyNameEugene Roshal & FAR Group
FileDescriptionFile and archive manager
FileVersionv3.0 (build 4000) x64
InternalNameFar
LegalCopyright© Eugene Roshal, 1996-2000. © Far Group, 2000-2014
OriginalFilenameFar.exe
ProductNameFar Manager

VS_FIXEDFILEINFO

FileVersion3.0.4000.0
ProductVersion3.0.4000.0
StrucVersion0x10000
FileFlagsMask0
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
40df007615PNG(256 x 256)#
4266687019PNG(256 x 256)#
4281d386061BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER
[?] can't find file_offset of VA 0x421ba4