filenameGeneious Prime.exe
size303616 (0x4a200)
md541c2755d00581185d92955de912e70e4
typePE32+ executable (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
150204134
13121022170
1492102213
110507271
123507279
10182
1322102283
148307291
145210221

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x5d2efe10
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion9.0
SizeOfCode0x2f000
SizeOfInitializedData0x28a00
SizeOfUninitializedData0
AddressOfEntryPoint0x1a48c
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.2
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x5c000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x2ef660x2f000R-X CODE
.rdata0x300000xc3ba0xc400R-- IDATA
.data0x3d0000x119040x2400RW- IDATA
.pdata0x4f0000x20a00x2200R-- IDATA
.rsrc0x520000x82000x8200R-- IDATA
.reloc0x5b0000x6e00x800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x3b2540x64
RESOURCE0x520000x8200
EXCEPTION0x4f0000x20a0
SECURITY00
BASERELOC0x5b0000x2e8
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x300000x520
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#1123860
ICON#298320
ICON#343920
ICON#424880
ICON#511280
DIALOG#1013020
GROUP_ICON#1001760
MANIFEST#114930
module_namehintordfunction_name
USER32.dll640SetForegroundWindow
USER32.dll508MessageBoxA
USER32.dll238ExitWindowsEx
USER32.dll235EnumWindows
USER32.dll449IsIconic
USER32.dll704ShowWindow
USER32.dll515MessageBoxW
USER32.dll314GetLastActivePopup
USER32.dll462IsWindowVisible
USER32.dll404GetWindowThreadProcessId
USER32.dll518MonitorFromPoint
ADVAPI32.dll400LookupPrivilegeValueA
ADVAPI32.dll30AdjustTokenPrivileges
ADVAPI32.dll584RegEnumKeyExA
ADVAPI32.dll602RegOpenKeyExA
ADVAPI32.dll615RegQueryValueExA
ADVAPI32.dll562RegCreateKeyExA
ADVAPI32.dll631RegSetValueExA
ADVAPI32.dll554RegCloseKey
ADVAPI32.dll497OpenProcessToken
ole32.dll137CreateStreamOnHGlobal
ole32.dll20CoCreateInstance
ole32.dll66CoInitializeEx
ole32.dll152GetHGlobalFromStream
ole32.dll111CoUninitialize
KERNEL32.dll579GetStringTypeW
KERNEL32.dll576GetStringTypeA
KERNEL32.dll736LCMapStringA
KERNEL32.dll1034SetStdHandle
KERNEL32.dll698InitializeCriticalSectionAndSpinCount
KERNEL32.dll681HeapReAlloc
KERNEL32.dll851QueryPerformanceCounter
KERNEL32.dll623GetTimeZoneInformation
KERNEL32.dll489GetLocaleInfoA
KERNEL32.dll83CompareStringA
KERNEL32.dll86CompareStringW
KERNEL32.dll986SetEndOfFile
KERNEL32.dll1168WriteConsoleA
KERNEL32.dll425GetCurrentDirectoryA
KERNEL32.dll738LCMapStringW
KERNEL32.dll676HeapCreate
KERNEL32.dll682HeapSetInformation
KERNEL32.dll730IsValidCodePage
KERNEL32.dll487GetLastError
KERNEL32.dll129CreateFileW
KERNEL32.dll1004SetFilePointer
KERNEL32.dll1179WriteFile
KERNEL32.dll872ReadFile
KERNEL32.dll546GetProcAddress
KERNEL32.dll752LoadLibraryA
KERNEL32.dll626GetUserDefaultLCID
KERNEL32.dll68CloseHandle
KERNEL32.dll122CreateFileA
KERNEL32.dll110CreateDirectoryA
KERNEL32.dll323FlushFileBuffers
KERNEL32.dll1178WriteConsoleW
KERNEL32.dll473GetFileType
KERNEL32.dll574GetStdHandle
KERNEL32.dll499GetLongPathNameW
KERNEL32.dll262ExitProcess
KERNEL32.dll893RemoveDirectoryA
KERNEL32.dll283FindClose
KERNEL32.dll304FindNextFileA
KERNEL32.dll194DeleteFileA
KERNEL32.dll287FindFirstFileA
KERNEL32.dll793MultiByteToWideChar
KERNEL32.dll20AreFileApisANSI
KERNEL32.dll294FindFirstFileW
KERNEL32.dll1083TerminateProcess
KERNEL32.dll455GetExitCodeProcess
KERNEL32.dll153CreateProcessW
KERNEL32.dll646GetWindowsDirectoryW
KERNEL32.dll1013SetHandleInformation
KERNEL32.dll147CreatePipe
KERNEL32.dll570GetShortPathNameA
KERNEL32.dll501GetModuleFileNameA
KERNEL32.dll571GetShortPathNameW
KERNEL32.dll502GetModuleFileNameW
KERNEL32.dll428GetCurrentProcessId
KERNEL32.dll496GetLongPathNameA
KERNEL32.dll645GetWindowsDirectoryA
KERNEL32.dll452GetEnvironmentVariableA
KERNEL32.dll606GetTempPathA
KERNEL32.dll453GetEnvironmentVariableW
KERNEL32.dll607GetTempPathW
KERNEL32.dll604GetTempFileNameA
KERNEL32.dll481GetFullPathNameW
KERNEL32.dll478GetFullPathNameA
KERNEL32.dll755LoadLibraryW
KERNEL32.dll333FreeEnvironmentStringsW
KERNEL32.dll451GetEnvironmentStringsW
KERNEL32.dll332FreeEnvironmentStringsA
KERNEL32.dll449GetEnvironmentStrings
KERNEL32.dll411GetConsoleOutputCP
KERNEL32.dll214DuplicateHandle
KERNEL32.dll427GetCurrentProcess
KERNEL32.dll989SetEnvironmentVariableA
KERNEL32.dll1138WaitForSingleObject
KERNEL32.dll150CreateProcessA
KERNEL32.dll979SetCurrentDirectoryA
KERNEL32.dll550GetProcessHeap
KERNEL32.dll634GetVersionExA
KERNEL32.dll931SearchPathA
KERNEL32.dll595GetSystemTimeAsFileTime
KERNEL32.dll219EnterCriticalSection
KERNEL32.dll697InitializeCriticalSection
KERNEL32.dll750LeaveCriticalSection
KERNEL32.dll1071Sleep
KERNEL32.dll500GetMailslotInfo
KERNEL32.dll164CreateThread
KERNEL32.dll138CreateMailslotA
KERNEL32.dll370GetCommandLineW
KERNEL32.dll155CreateSemaphoreA
KERNEL32.dll1070SizeofResource
KERNEL32.dll774LockResource
KERNEL32.dll757LoadResource
KERNEL32.dll312FindResourceA
KERNEL32.dll668GlobalUnlock
KERNEL32.dll665GlobalSize
KERNEL32.dll661GlobalLock
KERNEL32.dll618GetTickCount
KERNEL32.dll15AllocConsole
KERNEL32.dll503GetModuleHandleA
KERNEL32.dll753LoadLibraryExA
KERNEL32.dll990SetEnvironmentVariableW
KERNEL32.dll980SetCurrentDirectoryW
KERNEL32.dll1160WideCharToMultiByte
KERNEL32.dll1100UnhandledExceptionFilter
KERNEL32.dll1059SetUnhandledExceptionFilter
KERNEL32.dll720IsDebuggerPresent
KERNEL32.dll927RtlVirtualUnwind
KERNEL32.dll920RtlLookupFunctionEntry
KERNEL32.dll913RtlCaptureContext
KERNEL32.dll858RaiseException
KERNEL32.dll922RtlPcToFileHeader
KERNEL32.dll926RtlUnwindEx
KERNEL32.dll115CreateDirectoryW
KERNEL32.dll896RemoveDirectoryW
KERNEL32.dll674HeapAlloc
KERNEL32.dll678HeapFree
KERNEL32.dll182DebugBreak
KERNEL32.dll369GetCommandLineA
KERNEL32.dll572GetStartupInfoA
KERNEL32.dll215EncodePointer
KERNEL32.dll185DecodePointer
KERNEL32.dll320FlsGetValue
KERNEL32.dll321FlsSetValue
KERNEL32.dll319FlsFree
KERNEL32.dll1016SetLastError
KERNEL32.dll431GetCurrentThreadId
KERNEL32.dll318FlsAlloc
KERNEL32.dll683HeapSize
KERNEL32.dll506GetModuleHandleW
KERNEL32.dll389GetConsoleCP
KERNEL32.dll407GetConsoleMode
KERNEL32.dll192DeleteCriticalSection
KERNEL32.dll1012SetHandleCount
KERNEL32.dll349GetCPInfo
KERNEL32.dll340GetACP
KERNEL32.dll532GetOEMCP
offsetsizetypecomment
15c115HTM#
3fff012386PNG(256 x 256)#
4305229102BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 303616 bytes (297 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER