filenamehook.exe
size316416 (0x4d400)
md5eacac9bb5bdb7c1f1f7608eb7544119a
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

Rich Header

lib idversiontimes used
2592741210
26127412143
2602741218
2613062537
2603062517
2593062519
257274129
10106
265307061
255307061
15101
258307061

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x62f64dc8
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion14.30
SizeOfCode0xb400
SizeOfInitializedData0x42600
SizeOfUninitializedData0
AddressOfEntryPoint0x1ba4
BaseOfCode0x1000
BaseOfData0xd000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x50000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000xb2680xb400R-X CODE
.rdata0xd0000x5d8c0x5e00R-- IDATA
.data0x130000x19cc0x1000RW- IDATA
.rsrc0x150000x39dc80x39e00R-- IDATA
.reloc0x4f0000xe180x1000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x1255c0x64
RESOURCE0x150000x39dc8
EXCEPTION00
SECURITY00
BASERELOC0x4f0000xe18
DEBUG0x11d040x70
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x11d780x40
Bound_IAT00
IAT0xd0000x168
Delay_IAT00
CLR_Header00
typenamesizecp
HOOKDLL#1012355200
VERSION#18320
MANIFEST#13920
module_namehintordfunction_name
KERNEL32.dll1558WriteFile
KERNEL32.dll1424TerminateProcess
KERNEL32.dll1000Module32Next
KERNEL32.dll406FindResourceA
KERNEL32.dll1499WaitForSingleObject
KERNEL32.dll998Module32First
KERNEL32.dll632GetModuleHandleA
KERNEL32.dll1039OpenProcess
KERNEL32.dll255CreateToolhelp32Snapshot
KERNEL32.dll1409Sleep
KERNEL32.dll612GetLastError
KERNEL32.dll538GetCurrentProcess
KERNEL32.dll198CreateFileA
KERNEL32.dll991LockResource
KERNEL32.dll1071Process32Next
KERNEL32.dll137CloseHandle
KERNEL32.dll971LoadResource
KERNEL32.dll689GetProcAddress
KERNEL32.dll1483VirtualAllocEx
KERNEL32.dll234CreateRemoteThread
KERNEL32.dll1486VirtualFreeEx
KERNEL32.dll1557WriteConsoleW
KERNEL32.dll1567WriteProcessMemory
KERNEL32.dll1069Process32First
KERNEL32.dll1408SizeofResource
KERNEL32.dll206CreateFileW
KERNEL32.dll847HeapReAlloc
KERNEL32.dll1457UnhandledExceptionFilter
KERNEL32.dll1393SetUnhandledExceptionFilter
KERNEL32.dll905IsProcessorFeaturePresent
KERNEL32.dll1103QueryPerformanceCounter
KERNEL32.dll539GetCurrentProcessId
KERNEL32.dll543GetCurrentThreadId
KERNEL32.dll748GetSystemTimeAsFileTime
KERNEL32.dll870InitializeSListHead
KERNEL32.dll898IsDebuggerPresent
KERNEL32.dll723GetStartupInfoW
KERNEL32.dll635GetModuleHandleW
KERNEL32.dll1237RtlUnwind
KERNEL32.dll1332SetLastError
KERNEL32.dll308EnterCriticalSection
KERNEL32.dll961LeaveCriticalSection
KERNEL32.dll275DeleteCriticalSection
KERNEL32.dll866InitializeCriticalSectionAndSpinCount
KERNEL32.dll1442TlsAlloc
KERNEL32.dll1444TlsGetValue
KERNEL32.dll1445TlsSetValue
KERNEL32.dll1443TlsFree
KERNEL32.dll430FreeLibrary
KERNEL32.dll967LoadLibraryExW
KERNEL32.dll1124RaiseException
KERNEL32.dll725GetStdHandle
KERNEL32.dll631GetModuleFileNameW
KERNEL32.dll353ExitProcess
KERNEL32.dll634GetModuleHandleExW
KERNEL32.dll840HeapAlloc
KERNEL32.dll844HeapFree
KERNEL32.dll949LCMapStringW
KERNEL32.dll593GetFileType
KERNEL32.dll376FindClose
KERNEL32.dll382FindFirstFileExW
KERNEL32.dll399FindNextFileW
KERNEL32.dll911IsValidCodePage
KERNEL32.dll437GetACP
KERNEL32.dll666GetOEMCP
KERNEL32.dll452GetCPInfo
KERNEL32.dll473GetCommandLineA
KERNEL32.dll474GetCommandLineW
KERNEL32.dll1011MultiByteToWideChar
KERNEL32.dll1538WideCharToMultiByte
KERNEL32.dll570GetEnvironmentStringsW
KERNEL32.dll429FreeEnvironmentStringsW
KERNEL32.dll1358SetStdHandle
KERNEL32.dll730GetStringTypeW
KERNEL32.dll695GetProcessHeap
KERNEL32.dll418FlushFileBuffers
KERNEL32.dll515GetConsoleOutputCP
KERNEL32.dll511GetConsoleMode
KERNEL32.dll1317SetFilePointerEx
KERNEL32.dll849HeapSize
KERNEL32.dll268DecodePointer
ADVAPI32.dll430LookupPrivilegeValueA
ADVAPI32.dll533OpenProcessToken
ADVAPI32.dll31AdjustTokenPrivileges
SHELL32.dll331SHGetFolderPathA
ole32.dll93CoInitialize

StringTable 040904b0

CompanyNameMicrosoft
FileDescriptionRuntime Broker
FileVersion10.0.2200.1
InternalNameRuntimeBroker.exe
LegalCopyrightMicrosoft Corporation.All rights reserved.
OriginalFilenameRuntimeBroker.exe
ProductNameMicrosoft Windows Operating System
ProductVersion10.0.2200.1

VS_FIXEDFILEINFO

FileVersion10.0.2200.1
ProductVersion10.0.2200.1
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0316416EXE08/12/2022 12:55:36#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK