filename20240426_161716_Terminator_x64.exe
size404992 (0x62e00)
md5f2c820d92e99f88274350c4da479bc49
typePE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections0xb
TimeDateStamp0x662bb406
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22e
Magic0x20b
LinkerVersion2.38
SizeOfCode0x7000
SizeOfInitializedData0x62a00
SizeOfUninitializedData0xe00
AddressOfEntryPoint0x14d0
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x6a000
SizeOfHeaders0x400
CheckSum0x70ce8
Subsystem2
DllCharacteristics0x160
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x6fd80x7000R-X CODE IDATA
.data0x80000x583300x58400RW- IDATA
.rdata0x610000xe100x1000R-- IDATA
.pdata0x620000x5040x600R-- IDATA
.xdata0x630000x4c40x600R-- IDATA
.bss0x640000xc800RW- UDATA
.idata0x650000x9d40xa00RW- IDATA
.CRT0x660000x680x200RW- IDATA
.tls0x670000x100x200RW- IDATA
.rsrc0x680000x8900xa00RW- IDATA
.reloc0x690000x880x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x650000x9d4
RESOURCE0x680000x890
EXCEPTION0x620000x504
SECURITY00
BASERELOC0x690000x88
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x610800x28
LOAD_CONFIG00
Bound_IAT00
IAT0x6526c0x230
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x1400670000x1400670080x14006414c0x14006604000
typenamesizecp
MUI#12160
ICON#12960
ICON#22960
GROUP_ICON#30300200
GROUP_ICON#30301200
VERSION#19360
module_namehintordfunction_name
KERNEL32.dll141CloseHandle
KERNEL32.dll172ConvertThreadToFiber
KERNEL32.dll201CreateFiber
KERNEL32.dll204CreateFileA
KERNEL32.dll221CreateMailslotA
KERNEL32.dll252CreateThread
KERNEL32.dll283DeleteCriticalSection
KERNEL32.dll284DeleteFiber
KERNEL32.dll319EnterCriticalSection
KERNEL32.dll552GetCurrentProcess
KERNEL32.dll557GetCurrentThreadId
KERNEL32.dll630GetLastError
KERNEL32.dll645GetMailslotInfo
KERNEL32.dll651GetModuleHandleA
KERNEL32.dll710GetProcAddress
KERNEL32.dll743GetStartupInfoA
KERNEL32.dll799GetTickCount
KERNEL32.dll863HeapAlloc
KERNEL32.dll865HeapCreate
KERNEL32.dll873HeapReAlloc
KERNEL32.dll892InitializeCriticalSection
KERNEL32.dll919IsDBCSLeadByteEx
KERNEL32.dll984LeaveCriticalSection
KERNEL32.dll1036MultiByteToWideChar
KERNEL32.dll1170ReadFile
KERNEL32.dll1394SetUnhandledExceptionFilter
KERNEL32.dll1410Sleep
KERNEL32.dll1413SleepEx
KERNEL32.dll1419SwitchToFiber
KERNEL32.dll1445TlsGetValue
KERNEL32.dll1492VirtualProtect
KERNEL32.dll1494VirtualQuery
KERNEL32.dll1503WaitForSingleObject
KERNEL32.dll1547WideCharToMultiByte
KERNEL32.dll1567WriteFile
msvcrt.dll56__C_specific_handler
msvcrt.dll64___lc_codepage_func
msvcrt.dll67___mb_cur_max_func
msvcrt.dll82__getmainargs
msvcrt.dll83__initenv
msvcrt.dll84__iob_func
msvcrt.dll91__lconv_init
msvcrt.dll97__set_app_type
msvcrt.dll99__setusermatherr
msvcrt.dll114_acmdln
msvcrt.dll121_amsg_exit
msvcrt.dll139_cexit
msvcrt.dll151_commode
msvcrt.dll190_errno
msvcrt.dll220_fmode
msvcrt.dll285_initterm
msvcrt.dll553_onexit
msvcrt.dll906abort
msvcrt.dll923calloc
msvcrt.dll936exit
msvcrt.dll956fprintf
msvcrt.dll958fputc
msvcrt.dll963free
msvcrt.dll976fwrite
msvcrt.dll1017localeconv
msvcrt.dll1023malloc
msvcrt.dll1031memcpy
msvcrt.dll1063signal
msvcrt.dll1084strerror
msvcrt.dll1086strlen
msvcrt.dll1089strncmp
msvcrt.dll1123vfprintf
msvcrt.dll1149wcslen

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionNetwork Configuration Objects
FileVersion10.0.19041.3636 (WinBuild.160101.0800)
InternalNamenetcfgx.dll
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamenetcfgx.dll
ProductNameMicrosoft® Windows® Operating System
ProductVersion10.0.19041.3636

VS_FIXEDFILEINFO

FileVersion10.0.19041.3636
ProductVersion10.0.19041.3636
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d0399408BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x6414c