filenamehook64.dll
size167424 (0x28e00)
md5abda58c32dc94903055c3e14d44d9d05
typePE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x108

Rich Header

lib idversiontimes used
2602741219
2592741211
26127412171
2603062514
2593062510
2613062568
257274125
10112
261299143
261307061
255307061
258307061

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections9
TimeDateStamp0x62f648d3
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion14.30
SizeOfCode0x14e00
SizeOfInitializedData0x15200
SizeOfUninitializedData0
AddressOfEntryPoint0x531c
BaseOfCode0x1000
ImageBase0x180000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x30000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x160
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig4

Sections

namevavsizeraw sizeflags
.text0x10000x14db40x14e00R-X CODE
.rdata0x160000xdf8a0xe000R-- IDATA
.data0x240000x29800x1400RW- IDATA
.pdata0x270000x138c0x1400R-- IDATA
.detourc0x290000x21f00x2200R-- IDATA
.detourd0x2c0000x180x200RW- IDATA
_RDATA0x2d0000xf40x200R-- IDATA
.rsrc0x2e0000x1e00x200R-- IDATA
.reloc0x2f0000xb6c0xc00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x236b40x28
RESOURCE0x2e0000x1e0
EXCEPTION0x270000x138c
SECURITY00
BASERELOC0x2f0000xb6c
DEBUG0x21db80x54
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x21e100x138
Bound_IAT00
IAT0x160000x298
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#23810
module_namehintordfunction_name
KERNEL32.dll245CreateThread
KERNEL32.dll548GetCurrentThread
KERNEL32.dll638GetModuleHandleA
KERNEL32.dll696GetProcAddress
KERNEL32.dll618GetLastError
KERNEL32.dll544GetCurrentProcess
KERNEL32.dll549GetCurrentThreadId
KERNEL32.dll1431SuspendThread
KERNEL32.dll1235ResumeThread
KERNEL32.dll769GetThreadContext
KERNEL32.dll1381SetThreadContext
KERNEL32.dll425FlushInstructionCache
KERNEL32.dll1497VirtualAlloc
KERNEL32.dll1503VirtualProtect
KERNEL32.dll1500VirtualFree
KERNEL32.dll1505VirtualQuery
KERNEL32.dll1345SetLastError
KERNEL32.dll436FreeLibrary
KERNEL32.dll641GetModuleHandleW
KERNEL32.dll970LoadLibraryExW
KERNEL32.dll1572WriteConsoleW
KERNEL32.dll858HeapSize
KERNEL32.dll206CreateFileW
KERNEL32.dll1553WideCharToMultiByte
KERNEL32.dll312EnterCriticalSection
KERNEL32.dll964LeaveCriticalSection
KERNEL32.dll876InitializeCriticalSectionEx
KERNEL32.dll276DeleteCriticalSection
KERNEL32.dll308EncodePointer
KERNEL32.dll269DecodePointer
KERNEL32.dll1014MultiByteToWideChar
KERNEL32.dll737GetStringTypeW
KERNEL32.dll458GetCPInfo
KERNEL32.dll1237RtlCaptureContext
KERNEL32.dll1244RtlLookupFunctionEntry
KERNEL32.dll1251RtlVirtualUnwind
KERNEL32.dll1472UnhandledExceptionFilter
KERNEL32.dll1407SetUnhandledExceptionFilter
KERNEL32.dll1438TerminateProcess
KERNEL32.dll908IsProcessorFeaturePresent
KERNEL32.dll1106QueryPerformanceCounter
KERNEL32.dll545GetCurrentProcessId
KERNEL32.dll755GetSystemTimeAsFileTime
KERNEL32.dll879InitializeSListHead
KERNEL32.dll901IsDebuggerPresent
KERNEL32.dll730GetStartupInfoW
KERNEL32.dll1246RtlPcToFileHeader
KERNEL32.dll1128RaiseException
KERNEL32.dll1250RtlUnwindEx
KERNEL32.dll883InterlockedFlushSList
KERNEL32.dll875InitializeCriticalSectionAndSpinCount
KERNEL32.dll1456TlsAlloc
KERNEL32.dll1458TlsGetValue
KERNEL32.dll1459TlsSetValue
KERNEL32.dll1457TlsFree
KERNEL32.dll359ExitProcess
KERNEL32.dll640GetModuleHandleExW
KERNEL32.dll637GetModuleFileNameW
KERNEL32.dll849HeapAlloc
KERNEL32.dll853HeapFree
KERNEL32.dll952LCMapStringW
KERNEL32.dll732GetStdHandle
KERNEL32.dll600GetFileType
KERNEL32.dll137CloseHandle
KERNEL32.dll424FlushFileBuffers
KERNEL32.dll1573WriteFile
KERNEL32.dll521GetConsoleOutputCP
KERNEL32.dll517GetConsoleMode
KERNEL32.dll1331SetFilePointerEx
KERNEL32.dll856HeapReAlloc
KERNEL32.dll382FindClose
KERNEL32.dll388FindFirstFileExW
KERNEL32.dll405FindNextFileW
KERNEL32.dll914IsValidCodePage
KERNEL32.dll443GetACP
KERNEL32.dll673GetOEMCP
KERNEL32.dll479GetCommandLineA
KERNEL32.dll480GetCommandLineW
KERNEL32.dll577GetEnvironmentStringsW
KERNEL32.dll435FreeEnvironmentStringsW
KERNEL32.dll702GetProcessHeap
KERNEL32.dll1371SetStdHandle
offsetsizetypecomment
15c115HTM#
15d0161840BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK