filenametaskkill.exe
size95744 (0x17600)
md53bbee3ac757ca54f33710df8fb9d47a7
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
147307292
259267152
2602671522
261267155
2572671531
10194
2652671515
255267151
258267151

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x20917486
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion14.15
SizeOfCode0x10000
SizeOfInitializedData0x7800
SizeOfUninitializedData0
AddressOfEntryPoint0xf890
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion10.0
ImageVersion10.0
SubsystemVersion10.0
Reserved10
SizeOfImage0x1b000
SizeOfHeaders0x400
CheckSum0x23d57
Subsystem3
DllCharacteristics0xc160
SizeOfStackReserve0x80000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000xff800x10000R-X CODE
.rdata0x110000x57580x5800R-- IDATA
.data0x170000x7740x200RW- IDATA
.pdata0x180000xad40xc00R-- IDATA
.rsrc0x190000x8f80xa00R-- IDATA
.reloc0x1a0000x300x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x152b40x154
RESOURCE0x190000x8f8
EXCEPTION0x180000xad4
SECURITY00
BASERELOC0x1a0000x30
DEBUG0x128400x54
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x110200x108
Bound_IAT00
IAT0x111280x610
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12000
VERSION#19280
MANIFEST#19250
module_namehintordfunction_name
ADVAPI32.dll607RegConnectRegistryW
ADVAPI32.dll603RegCloseKey
ADVAPI32.dll425LookupAccountSidW
ADVAPI32.dll535OpenSCManagerW
ADVAPI32.dll276EnumServicesStatusExW
ADVAPI32.dll101CloseServiceHandle
ADVAPI32.dll665RegQueryValueExW
ADVAPI32.dll533OpenProcessToken
ADVAPI32.dll431LookupPrivilegeValueW
ADVAPI32.dll31AdjustTokenPrivileges
KERNEL32.dll1040OpenProcess
KERNEL32.dll134CloseHandle
KERNEL32.dll579GetExitCodeProcess
KERNEL32.dll1434TerminateProcess
KERNEL32.dll1568WriteConsoleW
KERNEL32.dll729GetStdHandle
KERNEL32.dll973LocalAlloc
KERNEL32.dll429FormatMessageW
KERNEL32.dll433FreeLibrary
KERNEL32.dll542GetCurrentProcessId
KERNEL32.dll743GetSystemDirectoryW
KERNEL32.dll967LoadLibraryW
KERNEL32.dll693GetProcAddress
KERNEL32.dll541GetCurrentProcess
KERNEL32.dll1343SetLastError
KERNEL32.dll634GetModuleFileNameW
KERNEL32.dll484GetComputerNameExW
KERNEL32.dll615GetLastError
KERNEL32.dll853HeapReAlloc
KERNEL32.dll846HeapAlloc
KERNEL32.dll858HeapValidate
KERNEL32.dll850HeapFree
KERNEL32.dll699GetProcessHeap
KERNEL32.dll1140ReadConsoleW
KERNEL32.dll1143ReadFile
KERNEL32.dll1287SetConsoleMode
KERNEL32.dll1010MultiByteToWideChar
KERNEL32.dll518GetConsoleOutputCP
KERNEL32.dll356ExitProcess
KERNEL32.dll152CompareStringA
KERNEL32.dll774GetThreadLocale
KERNEL32.dll155CompareStringW
KERNEL32.dll1614lstrlenA
KERNEL32.dll514GetConsoleMode
KERNEL32.dll597GetFileType
KERNEL32.dll1549WideCharToMultiByte
KERNEL32.dll1488VerSetConditionMask
KERNEL32.dll1392SetThreadUILanguage
KERNEL32.dll782GetTickCount
KERNEL32.dll752GetSystemTimeAsFileTime
KERNEL32.dll1104QueryPerformanceCounter
KERNEL32.dll638GetModuleHandleW
KERNEL32.dll1403SetUnhandledExceptionFilter
KERNEL32.dll1468UnhandledExceptionFilter
KERNEL32.dll1419Sleep
KERNEL32.dll978LocalFree
KERNEL32.dll1615lstrlenW
KERNEL32.dll546GetCurrentThreadId
KERNEL32.dll855HeapSize
msvcrt.dll1302wcstok
msvcrt.dll1300wcsstr
msvcrt.dll75_CxxThrowException
msvcrt.dll1170memcpy
msvcrt.dll1081fflush
msvcrt.dll1093fprintf
msvcrt.dll341_get_osfhandle
msvcrt.dll283_fileno
msvcrt.dll1304wcstol
msvcrt.dll1301wcstod
msvcrt.dll47void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll18public: virtual __cdecl type_info::~type_info(void) __ptr64

??1type_info@@UEAA@XZ

msvcrt.dll210_commode
msvcrt.dll295_fmode
msvcrt.dll87__C_specific_handler
msvcrt.dll381_initterm
msvcrt.dll144__setusermatherr
msvcrt.dll193_cexit
msvcrt.dll270_exit
msvcrt.dll1074exit
msvcrt.dll142__set_app_type
msvcrt.dll157__wgetmainargs
msvcrt.dll174_amsg_exit
msvcrt.dll85_XcptFilter
msvcrt.dll191_callnewh
msvcrt.dll1158malloc
msvcrt.dll261_errno
msvcrt.dll1307wcstoul
msvcrt.dll1281wcschr
msvcrt.dll1030_wtoi64
msvcrt.dll906_wcsicmp
msvcrt.dll1296wcsrchr
msvcrt.dll901_wcsdup
msvcrt.dll1100free
msvcrt.dll91__CxxFrameHandler3
msvcrt.dll129__iob_func
msvcrt.dll642_memicmp
msvcrt.dll873_vsnwprintf
msvcrt.dll1174memset
ntdll.dll1532RtlVirtualUnwind
ntdll.dll1461RtlTimeToElapsedTimeFields
ntdll.dll1207RtlLargeIntegerToChar
ntdll.dll1235RtlLookupFunctionEntry
ntdll.dll747RtlCaptureContext
ntdll.dll1531RtlVerifyVersionInfo
VERSION.dll3GetFileVersionInfoExW
VERSION.dll6GetFileVersionInfoSizeExW
VERSION.dll16VerQueryValueW
USER32.dll63CharUpperW
USER32.dll503GetWindowThreadProcessId
USER32.dll275FindWindowExW
USER32.dll266EnumWindows
USER32.dll80CloseDesktop
USER32.dll867SetThreadDesktop
USER32.dll613LoadStringW
USER32.dll459GetThreadDesktop
USER32.dll251EnumDesktopsW
USER32.dll84CloseWindowStation
USER32.dll850SetProcessWindowStation
USER32.dll674OpenWindowStationW
USER32.dll429GetProcessWindowStation
USER32.dll265EnumWindowStationsW
USER32.dll997wsprintfW
USER32.dll488GetWindowLongW
USER32.dll685PostMessageW
USER32.dll502GetWindowTextW
USER32.dll562IsHungAppWindow
USER32.dll474GetWindow
USER32.dll669OpenDesktopW
MPR.dll13WNetAddConnection2W
MPR.dll19WNetCancelConnection2W
MPR.dll48WNetGetLastErrorW
OLEAUT32.dll10
OLEAUT32.dll7
OLEAUT32.dll150
OLEAUT32.dll8
OLEAUT32.dll6
OLEAUT32.dll2
OLEAUT32.dll12
OLEAUT32.dll9
WS2_32.dll111
WS2_32.dll7GetAddrInfoW
WS2_32.dll2FreeAddrInfoW
WS2_32.dll116
WS2_32.dll9GetNameInfoW
WS2_32.dll115
framedynos.dll141public: class CHString const & __ptr64 __cdecl CHString::operator+=(unsigned short const * __ptr64) __ptr64

??YCHString@@QEAAAEBV0@PEBG@Z

framedynos.dll313protected: struct CHStringData * __ptr64 __cdecl CHString::GetData(void)const __ptr64

?GetData@CHString@@IEBAPEAUCHStringData@@XZ

framedynos.dll232public: void __cdecl CHString::Empty(void) __ptr64

?Empty@CHString@@QEAAXXZ

framedynos.dll443public: class CHString __cdecl CHString::Mid(int, int)const __ptr64

?Mid@CHString@@QEBA?AV1@HH@Z

framedynos.dll195public: int __cdecl CHString::Compare(unsigned short const * __ptr64)const __ptr64

?Compare@CHString@@QEBAHPEBG@Z

framedynos.dll442public: class CHString __cdecl CHString::Mid(int)const __ptr64

?Mid@CHString@@QEBA?AV1@H@Z

framedynos.dll250public: int __cdecl CHString::Find(unsigned short)const __ptr64

?Find@CHString@@QEBAHG@Z

framedynos.dll252public: int __cdecl CHString::FindOneOf(unsigned short const * __ptr64)const __ptr64

?FindOneOf@CHString@@QEBAHPEBG@Z

framedynos.dll80public: class CHString const & __ptr64 __cdecl CHString::operator=(char const * __ptr64) __ptr64

??4CHString@@QEAAAEBV0@PEBD@Z

framedynos.dll138public: class CHString const & __ptr64 __cdecl CHString::operator+=(class CHString const & __ptr64) __ptr64

??YCHString@@QEAAAEBV0@AEBV0@@Z

framedynos.dll56public: __cdecl CHString::~CHString(void) __ptr64

??1CHString@@QEAA@XZ

framedynos.dll12public: __cdecl CHString::CHString(void) __ptr64

??0CHString@@QEAA@XZ

framedynos.dll477public: void __cdecl CHString::ReleaseBuffer(int) __ptr64

?ReleaseBuffer@CHString@@QEAAXH@Z

framedynos.dll282public: unsigned short * __ptr64 __cdecl CHString::GetBufferSetLength(int) __ptr64

?GetBufferSetLength@CHString@@QEAAPEAGH@Z

framedynos.dll281public: unsigned short * __ptr64 __cdecl CHString::GetBuffer(int) __ptr64

?GetBuffer@CHString@@QEAAPEAGH@Z

framedynos.dll426public: class CHString __cdecl CHString::Left(int)const __ptr64

?Left@CHString@@QEBA?AV1@H@Z

framedynos.dll256public: void __cdecl CHString::Format(unsigned short const * __ptr64, ...) __ptr64

?Format@CHString@@QEAAXPEBGZZ

framedynos.dll76public: class CHString const & __ptr64 __cdecl CHString::operator=(class CHString const & __ptr64) __ptr64

??4CHString@@QEAAAEBV0@AEBV0@@Z

framedynos.dll82public: class CHString const & __ptr64 __cdecl CHString::operator=(unsigned short const * __ptr64) __ptr64

??4CHString@@QEAAAEBV0@PEBG@Z

dbghelp.dll8EnumerateLoadedModulesW64
SHLWAPI.dll335StrStrIW
SHLWAPI.dll338StrStrW
SHLWAPI.dll286StrChrW
SHLWAPI.dll283StrChrIW
api-ms-win-core-com-l1-1-0.dll9CoCreateInstance
api-ms-win-core-com-l1-1-0.dll65CoTaskMemFree
api-ms-win-core-com-l1-1-0.dll68CoUninitialize
api-ms-win-core-com-l1-1-0.dll40CoInitializeEx
api-ms-win-core-com-l1-1-0.dll64CoTaskMemAlloc
api-ms-win-core-com-l1-1-0.dll41CoInitializeSecurity
SspiCli.dll25GetUserNameExW
srvcli.dll32NetServerGetInfo
netutils.dll1NetApiBufferFree

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionTerminates Processes
FileVersion10.0.18362.1 (WinBuild.160101.0800)
InternalNametaskkill.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenametaskkill.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion10.0.18362.1

VS_FIXEDFILEINFO

FileVersion10.0.18362.1
ProductVersion10.0.18362.1
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d090160BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK