1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
|
--- !COFF
OptionalHeader:
AddressOfEntryPoint: 4512
ImageBase: 6442450944
SectionAlignment: 4096
FileAlignment: 512
MajorOperatingSystemVersion: 6
MinorOperatingSystemVersion: 0
MajorImageVersion: 0
MinorImageVersion: 0
MajorSubsystemVersion: 6
MinorSubsystemVersion: 0
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
DLLCharacteristics: [ IMAGE_DLL_CHARACTERISTICS_HIGH_ENTROPY_VA, IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE, IMAGE_DLL_CHARACTERISTICS_NX_COMPAT ]
SizeOfStackReserve: 1048576
SizeOfStackCommit: 4096
SizeOfHeapReserve: 1048576
SizeOfHeapCommit: 4096
ExportTable:
RelativeVirtualAddress: 6962976
Size: 75
ImportTable:
RelativeVirtualAddress: 6963051
Size: 420
ResourceTable:
RelativeVirtualAddress: 0
Size: 0
ExceptionTable:
RelativeVirtualAddress: 6995968
Size: 1812
CertificateTable:
RelativeVirtualAddress: 0
Size: 0
BaseRelocationTable:
RelativeVirtualAddress: 7004160
Size: 156
Debug:
RelativeVirtualAddress: 6987776
Size: 28
Architecture:
RelativeVirtualAddress: 0
Size: 0
GlobalPtr:
RelativeVirtualAddress: 0
Size: 0
TlsTable:
RelativeVirtualAddress: 6962168
Size: 40
LoadConfigTable:
RelativeVirtualAddress: 0
Size: 0
BoundImport:
RelativeVirtualAddress: 0
Size: 0
IAT:
RelativeVirtualAddress: 6965496
Size: 2024
DelayImportDescriptor:
RelativeVirtualAddress: 0
Size: 0
ClrRuntimeHeader:
RelativeVirtualAddress: 0
Size: 0
header:
Machine: IMAGE_FILE_MACHINE_AMD64
Characteristics: [ IMAGE_FILE_EXECUTABLE_IMAGE, IMAGE_FILE_LARGE_ADDRESS_AWARE, IMAGE_FILE_DLL ]
sections:
- Name: .text
Characteristics: [ IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ ]
VirtualAddress: 4096
VirtualSize: 59030
SectionData: ''
- Name: .rdata
Characteristics: [ IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ ]
VirtualAddress: 65536
VirtualSize: 6919008
SectionData: ''
- Name: .buildid
Characteristics: [ IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ ]
VirtualAddress: 6987776
VirtualSize: 53
SectionData: 00000000A9D795620000000002000000190000001CA06A001C040000525344535450075756EAA5DB4C4C44205044422E0100000000
- Name: .data
Characteristics: [ IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE ]
VirtualAddress: 6991872
VirtualSize: 1960
SectionData: ''
- Name: .pdata
Characteristics: [ IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ ]
VirtualAddress: 6995968
VirtualSize: 1812
SectionData: ''
- Name: .tls
Characteristics: [ IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE ]
VirtualAddress: 7000064
VirtualSize: 16
SectionData: ''
- Name: .reloc
Characteristics: [ IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ ]
VirtualAddress: 7004160
VirtualSize: 156
SectionData: ''
- Name: .debug_info
Characteristics: [ IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ ]
VirtualAddress: 7008256
VirtualSize: 64
SectionData: DEADBEEFBAADF00D
symbols: []
...
|
