filenameDeathTrash.exe
size641536 (0x9ca00)
md58d156f060bdb50033434773c8ecb05c9
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x118

Rich Header

lib idversiontimes used
2592671510
26126715139
2602671518
257267152
2612911837
2602911817
2592911817
257293333
1081
261293333
256293331
255293331
258293331

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x6407c929
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x122
Magic0x10b
LinkerVersion14.28
SizeOfCode0xb000
SizeOfInitializedData0x92000
SizeOfUninitializedData0
AddressOfEntryPoint0x125d
BaseOfCode0x1000
BaseOfData0xc000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0xa0000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000xaedf0xb000R-X CODE
.rdata0xc0000x5a9e0x5c00R-- IDATA
.data0x120000x13b40xa00RW- IDATA
.rsrc0x140000x8a1980x8a200R-- IDATA
.reloc0x9f0000xdcc0xe00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x114200x88
IMPORT0x114a80x3c
RESOURCE0x140000x8a198
EXCEPTION00
SECURITY00
BASERELOC0x9f0000xdcc
DEBUG0x10bcc0x54
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x10c200x40
Bound_IAT00
IAT0xc0000x108
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#12703760
ICON#21521040
ICON#3676240
ICON#4380560
ICON#5169360
ICON#696400
ICON#742640
ICON#824400
ICON#911280
GROUP_ICON#1031320
VERSION#15240
MANIFEST#117290
module_namehintordfunction_name
UnityPlayer.dllUnityMain
KERNEL32.dll837HeapAlloc
KERNEL32.dll1553WriteConsoleW
KERNEL32.dll1101QueryPerformanceCounter
KERNEL32.dll536GetCurrentProcessId
KERNEL32.dll540GetCurrentThreadId
KERNEL32.dll745GetSystemTimeAsFileTime
KERNEL32.dll867InitializeSListHead
KERNEL32.dll895IsDebuggerPresent
KERNEL32.dll1453UnhandledExceptionFilter
KERNEL32.dll1389SetUnhandledExceptionFilter
KERNEL32.dll720GetStartupInfoW
KERNEL32.dll902IsProcessorFeaturePresent
KERNEL32.dll632GetModuleHandleW
KERNEL32.dll535GetCurrentProcess
KERNEL32.dll1420TerminateProcess
KERNEL32.dll134CloseHandle
KERNEL32.dll1235RtlUnwind
KERNEL32.dll609GetLastError
KERNEL32.dll1330SetLastError
KERNEL32.dll305EnterCriticalSection
KERNEL32.dll957LeaveCriticalSection
KERNEL32.dll272DeleteCriticalSection
KERNEL32.dll863InitializeCriticalSectionAndSpinCount
KERNEL32.dll1438TlsAlloc
KERNEL32.dll1440TlsGetValue
KERNEL32.dll1441TlsSetValue
KERNEL32.dll1439TlsFree
KERNEL32.dll427FreeLibrary
KERNEL32.dll686GetProcAddress
KERNEL32.dll963LoadLibraryExW
KERNEL32.dll1122RaiseException
KERNEL32.dll722GetStdHandle
KERNEL32.dll1554WriteFile
KERNEL32.dll628GetModuleFileNameW
KERNEL32.dll350ExitProcess
KERNEL32.dll631GetModuleHandleExW
KERNEL32.dll265DecodePointer
KERNEL32.dll841HeapFree
KERNEL32.dll373FindClose
KERNEL32.dll379FindFirstFileExW
KERNEL32.dll396FindNextFileW
KERNEL32.dll907IsValidCodePage
KERNEL32.dll434GetACP
KERNEL32.dll663GetOEMCP
KERNEL32.dll449GetCPInfo
KERNEL32.dll470GetCommandLineA
KERNEL32.dll471GetCommandLineW
KERNEL32.dll1007MultiByteToWideChar
KERNEL32.dll1534WideCharToMultiByte
KERNEL32.dll567GetEnvironmentStringsW
KERNEL32.dll426FreeEnvironmentStringsW
KERNEL32.dll1354SetStdHandle
KERNEL32.dll590GetFileType
KERNEL32.dll727GetStringTypeW
KERNEL32.dll945LCMapStringW
KERNEL32.dll692GetProcessHeap
KERNEL32.dll846HeapSize
KERNEL32.dll844HeapReAlloc
KERNEL32.dll415FlushFileBuffers
KERNEL32.dll490GetConsoleCP
KERNEL32.dll508GetConsoleMode
KERNEL32.dll1315SetFilePointerEx
KERNEL32.dll203CreateFileW
ordentry_vafunction_name
10x12004AmdPowerXpressRequestHighPerformance
20x12000NvOptimusEnablement
module_nameWindowsPlayer.exe
flags0
timestamp2106-02-07 06:28:15
version0.0
ordinal_base1
nFunctions2
nNames2
Names(2)0x11450
Functions(2)0x11448
NameOrdinals(2)0x11458

StringTable 040904b0

FileVersion2021.3.21.1774945
LegalCopyright(c) 2023 Unity Technologies ApS. All rights reserved.
ProductVersion2021.3.21f1 (1b156197d683)

VS_FIXEDFILEINFO

FileVersion2021.3.21.5473
ProductVersion2021.3.21.5473
StrucVersion0x10000
FileFlagsMask0x17
FileFlags0
FileOS4
FileType0
FileSubtype0
offsetsizetypecomment
0641536EXE03/07/2023 23:30:49#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK