filename7008.SkypeApp.exe.0x7ff6bcbd0000.dmp
size1073152 (0x106000)
md5a11805e2ba5b5f41b7df0d992fed4be2
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x110

Rich Header

lib idversiontimes used
2593079510
26130795191
2603079517
2593380810
2603380817
2613380895
257307957
10165
2613412047
259341201
265341205
255341201
15101
258341201

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x66f6ca32
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion14.41
SizeOfCode0xb6400
SizeOfInitializedData0x4b800
SizeOfUninitializedData0
AddressOfEntryPoint0x7a550
BaseOfCode0x1000
ImageBase0x7ff6bcbd0000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x106000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x8160
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000xb70000xb7000R-X CODE
.rdata0xb80000x360000x36000R-- IDATA
.data0xee0000xb0000xb000RW- IDATA
.pdata0xf90000x90000x9000R-- IDATA
.rsrc0x1020000x10000x1000R-- IDATA
.reloc0x1030000x30000x3000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xed24c0x50
RESOURCE0x1020000x410
EXCEPTION0xf90000x8208
SECURITY00
BASERELOC0x1030000x23fc
DEBUG0xd3d900x70
ARCHITECTURE00
GLOBALPTR00
TLS0xd3f800x28
LOAD_CONFIG0xd3c500x140
Bound_IAT00
IAT0xb80000x3f0
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x7ff6bccafff80x7ff6bccb00000x7ff6bccc78d00x7ff6bcc8874000x300000
typenamesizecp
PUBLIC_KEY#1014580
MANIFEST#13810
module_namehintordfunction_name
KERNEL32.dll148CloseHandle
KERNEL32.dll615GetFileSize
KERNEL32.dll296DeleteFileW
KERNEL32.dll1459SizeofResource
KERNEL32.dll644GetLogicalDrives
KERNEL32.dll231CreateMutexA
KERNEL32.dll1022LockResource
KERNEL32.dll1002LoadResource
KERNEL32.dll432FindResourceW
KERNEL32.dll637GetLastError
KERNEL32.dll505GetComputerNameW
KERNEL32.dll1380SetLastError
KERNEL32.dll1136QueryPerformanceCounter
KERNEL32.dll1137QueryPerformanceFrequency
KERNEL32.dll1346SetEndOfFile
KERNEL32.dll1610WriteConsoleW
KERNEL32.dll1407SetStdHandle
KERNEL32.dll1460Sleep
KERNEL32.dll218CreateFileW
KERNEL32.dll399FindClose
KERNEL32.dll422FindNextFileW
KERNEL32.dll545GetConsoleWindow
KERNEL32.dll410FindFirstFileW
KERNEL32.dll1042MultiByteToWideChar
KERNEL32.dll448FormatMessageA
KERNEL32.dll1591WideCharToMultiByte
KERNEL32.dll1010LocalFree
KERNEL32.dll640GetLocaleInfoEx
KERNEL32.dll405FindFirstFileExW
KERNEL32.dll606GetFileAttributesExW
KERNEL32.dll36AreFileApisANSI
KERNEL32.dll661GetModuleHandleW
KERNEL32.dll717GetProcAddress
KERNEL32.dll612GetFileInformationByHandleEx
KERNEL32.dll1240ReleaseSRWLockExclusive
KERNEL32.dllAcquireSRWLockExclusive
KERNEL32.dll1501TryAcquireSRWLockExclusive
KERNEL32.dll567GetCurrentThreadId
KERNEL32.dll329EnterCriticalSection
KERNEL32.dll992LeaveCriticalSection
KERNEL32.dll903InitializeCriticalSectionEx
KERNEL32.dll291DeleteCriticalSection
KERNEL32.dll325EncodePointer
KERNEL32.dll284DecodePointer
KERNEL32.dll979LCMapStringEx
KERNEL32.dll778GetSystemTimeAsFileTime
KERNEL32.dll760GetStringTypeW
KERNEL32.dll168CompareStringEx
KERNEL32.dll475GetCPInfo
KERNEL32.dll906InitializeSListHead
KERNEL32.dll1269RtlCaptureContext
KERNEL32.dll1277RtlLookupFunctionEntry
KERNEL32.dll1284RtlVirtualUnwind
KERNEL32.dll1510UnhandledExceptionFilter
KERNEL32.dll1444SetUnhandledExceptionFilter
KERNEL32.dll562GetCurrentProcess
KERNEL32.dll1476TerminateProcess
KERNEL32.dll936IsProcessorFeaturePresent
KERNEL32.dll1560WakeAllConditionVariable
KERNEL32.dll1462SleepConditionVariableSRW
KERNEL32.dll928IsDebuggerPresent
KERNEL32.dll753GetStartupInfoW
KERNEL32.dll563GetCurrentProcessId
KERNEL32.dll1283RtlUnwindEx
KERNEL32.dll912InterlockedPushEntrySList
KERNEL32.dll1279RtlPcToFileHeader
KERNEL32.dll1159RaiseException
KERNEL32.dll902InitializeCriticalSectionAndSpinCount
KERNEL32.dll1494TlsAlloc
KERNEL32.dll1496TlsGetValue
KERNEL32.dll1497TlsSetValue
KERNEL32.dll1495TlsFree
KERNEL32.dll453FreeLibrary
KERNEL32.dll998LoadLibraryExW
KERNEL32.dll376ExitProcess
KERNEL32.dll660GetModuleHandleExW
KERNEL32.dll657GetModuleFileNameW
KERNEL32.dll755GetStdHandle
KERNEL32.dll1611WriteFile
KERNEL32.dll496GetCommandLineA
KERNEL32.dll497GetCommandLineW
KERNEL32.dll616GetFileSizeEx
KERNEL32.dll1365SetFilePointerEx
KERNEL32.dll618GetFileType
KERNEL32.dll441FlushFileBuffers
KERNEL32.dll538GetConsoleOutputCP
KERNEL32.dll534GetConsoleMode
KERNEL32.dll880HeapFree
KERNEL32.dll876HeapAlloc
KERNEL32.dll436FlsAlloc
KERNEL32.dll438FlsGetValue
KERNEL32.dll439FlsSetValue
KERNEL32.dll437FlsFree
KERNEL32.dll573GetDateFormatW
KERNEL32.dll817GetTimeFormatW
KERNEL32.dll170CompareStringW
KERNEL32.dll980LCMapStringW
KERNEL32.dll641GetLocaleInfoW
KERNEL32.dll944IsValidLocale
KERNEL32.dll825GetUserDefaultLCID
KERNEL32.dll365EnumSystemLocalesW
KERNEL32.dll1176ReadFile
KERNEL32.dll1173ReadConsoleW
KERNEL32.dll1552WaitForSingleObject
KERNEL32.dll600GetExitCodeProcess
KERNEL32.dll246CreateProcessW
KERNEL32.dll819GetTimeZoneInformation
KERNEL32.dll883HeapReAlloc
KERNEL32.dll885HeapSize
KERNEL32.dll942IsValidCodePage
KERNEL32.dll460GetACP
KERNEL32.dll694GetOEMCP
KERNEL32.dll595GetEnvironmentStringsW
KERNEL32.dll452FreeEnvironmentStringsW
KERNEL32.dll1350SetEnvironmentVariableW
KERNEL32.dll724GetProcessHeap
KERNEL32.dll1282RtlUnwind
USER32.dll922ShowWindow
ADVAPI32.dll220CryptReleaseContext
ADVAPI32.dll193CryptAcquireContextA
ADVAPI32.dll295GetCurrentHwProfileW
ADVAPI32.dll358GetUserNameW
ADVAPI32.dll210CryptGenRandom
offsetsizetypecomment
15c115HTM#
15d01067568BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK