pexe_output_example
Never
{
"bytes": {},
"meta": {
"isDOS": true,
"isNT": true,
"machine": "I386",
"magic": "PE32",
"subsystem": "WindowsCui",
"chars": [
"ExecutableImage",
"32BitMachine",
"DLL"
],
"dllChars": [
"DynamicBase",
"NxCompat",
"GuardCf"
],
"sections": [
".text",
".data",
".idata",
".rsrc",
".reloc"
],
"osVersion": "Windows 10",
"dateStamp": "2032-06-14T19:14:36.000Z",
"isDLL": true,
"is64": false
},
"headers": {
"dos": {
"e_magic": {
"size": 2,
"name": "e_magic",
"desc": "Magic number (MZ)",
"offset": 0,
"type": "Word",
"raw": {
"0": 77,
"1": 90
},
"num": 23117,
"text": "MZ",
"hex": "5A4D"
},
"e_cblp": {
"size": 2,
"name": "e_cblp",
"desc": "Bytes on last page of file",
"offset": 2,
"type": "Word",
"raw": {
"0": 144,
"1": 0
},
"num": 144,
"text": "�\u0000",
"hex": "0090"
},
"e_cp": {
"size": 2,
"name": "e_cp",
"desc": "Pages in file",
"offset": 4,
"type": "Word",
"raw": {
"0": 3,
"1": 0
},
"num": 3,
"text": "\u0003\u0000",
"hex": "0003"
},
"e_crlc": {
"size": 2,
"name": "e_crlc",
"desc": "Relocations",
"offset": 6,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"e_cparhdr": {
"size": 2,
"name": "e_cparhdr",
"desc": "Size of header in paragraphs",
"offset": 8,
"type": "Word",
"raw": {
"0": 4,
"1": 0
},
"num": 4,
"text": "\u0004\u0000",
"hex": "0004"
},
"e_minalloc": {
"size": 2,
"name": "e_minalloc",
"desc": "Minimum extra paragraphs needed",
"offset": 10,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"e_maxalloc": {
"size": 2,
"name": "e_maxalloc",
"desc": "Maximum extra paragraphs needed",
"offset": 12,
"type": "Word",
"raw": {
"0": 255,
"1": 255
},
"num": 65535,
"text": "��",
"hex": "FFFF"
},
"e_ss": {
"size": 2,
"name": "e_ss",
"desc": "Initial (relative) SS value",
"offset": 14,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"e_sp": {
"size": 2,
"name": "e_sp",
"desc": "Initial SP value",
"offset": 16,
"type": "Word",
"raw": {
"0": 184,
"1": 0
},
"num": 184,
"text": "�\u0000",
"hex": "00B8"
},
"e_csum": {
"size": 2,
"name": "e_csum",
"desc": "Checksum",
"offset": 18,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"e_ip": {
"size": 2,
"name": "e_ip",
"desc": "Initial IP value",
"offset": 20,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"e_cs": {
"size": 2,
"name": "e_cs",
"desc": "Initial CS value",
"offset": 22,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"e_lfarlc": {
"size": 2,
"name": "e_lfarlc",
"desc": "File address of relocation table",
"offset": 24,
"type": "Word",
"raw": {
"0": 64,
"1": 0
},
"num": 64,
"text": "@\u0000",
"hex": "0040"
},
"e_ovno": {
"size": 2,
"name": "e_ovno",
"desc": "Overlay number",
"offset": 26,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"e_res": {
"size": 8,
"name": "e_res",
"desc": "Reserved",
"offset": 28,
"type": "QWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0,
"4": 0,
"5": 0,
"6": 0,
"7": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"hex": "0000000000000000"
},
"e_oemid": {
"size": 2,
"name": "e_oemid",
"desc": "OEM identifier",
"offset": 36,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"e_oeminfo": {
"size": 2,
"name": "e_oeminfo",
"desc": "OEM information; e_oemid specific",
"offset": 38,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"e_res2": {
"size": 20,
"name": "e_res2",
"desc": "Reserved",
"offset": 40,
"type": "Data",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0,
"4": 0,
"5": 0,
"6": 0,
"7": 0,
"8": 0,
"9": 0,
"10": 0,
"11": 0,
"12": 0,
"13": 0,
"14": 0,
"15": 0,
"16": 0,
"17": 0,
"18": 0,
"19": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"hex": "0000000000000000000000000000000000000000"
},
"e_lfanew": {
"size": 2,
"name": "e_lfanew",
"desc": "File address of new exe header",
"offset": 60,
"type": "Word",
"raw": {
"0": 240,
"1": 0
},
"num": 240,
"text": "�\u0000",
"hex": "00F0"
}
},
"nt": {
"Signature": {
"size": 4,
"name": "Signature",
"desc": "PE\\0\\0",
"offset": 240,
"type": "DWord",
"raw": {
"0": 80,
"1": 69,
"2": 0,
"3": 0
},
"num": 17744,
"text": "PE\u0000\u0000",
"hex": "00004550"
},
"file": {
"Machine": {
"size": 2,
"name": "Machine",
"desc": "Architecture type of the computer",
"offset": 244,
"type": "Word",
"raw": {
"0": 76,
"1": 1
},
"num": 332,
"text": "L\u0001",
"hex": "014C"
},
"NumberOfSections": {
"size": 2,
"name": "NumberOfSections",
"desc": "Size of the section table",
"offset": 246,
"type": "Word",
"raw": {
"0": 5,
"1": 0
},
"num": 5,
"text": "\u0005\u0000",
"hex": "0005"
},
"TimeDataStamp": {
"size": 4,
"name": "TimeDataStamp",
"desc": "Date and time the image was created",
"offset": 248,
"type": "DWord",
"raw": {
"0": 156,
"1": 213,
"2": 120,
"3": 117
},
"num": 1970853276,
"text": "��xu",
"hex": "7578D59C"
},
"PointerToSymbolTable": {
"size": 4,
"name": "PointerToSymbolTable",
"desc": "Offset of the symbol table, or zero if no COFF symbol table exists",
"offset": 252,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"NumberOfSymbols": {
"size": 4,
"name": "NumberOfSymbols",
"desc": "Number of symbols in the symbol table",
"offset": 256,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"SizeOfOptionalHeader": {
"size": 2,
"name": "SizeOfOptionalHeader",
"desc": "NtOptional32Header",
"offset": 260,
"type": "Word",
"raw": {
"0": 224,
"1": 0
},
"num": 224,
"text": "�\u0000",
"hex": "00E0"
},
"Characteristics": {
"size": 2,
"name": "Characteristics",
"desc": "ExecutableImage, 32BitMachine",
"offset": 262,
"type": "Word",
"raw": {
"0": 2,
"1": 33
},
"num": 8450,
"text": "\u0002!",
"hex": "2102"
}
},
"optional": {
"Magic": {
"size": 2,
"name": "Magic",
"desc": "PE32 - State of the image file",
"offset": 264,
"type": "Word",
"raw": {
"0": 11,
"1": 1
},
"num": 267,
"text": "\u000b\u0001",
"hex": "010B"
},
"MajorLinkerVersion": {
"size": 1,
"name": "MajorLinkerVersion",
"desc": "",
"offset": 266,
"type": "Byte",
"raw": {
"0": 14
},
"num": 14,
"text": "\u000e",
"hex": "0E"
},
"MinorLinkerVersion": {
"size": 1,
"name": "MinorLinkerVersion",
"desc": "",
"offset": 267,
"type": "Byte",
"raw": {
"0": 15
},
"num": 15,
"text": "\u000f",
"hex": "0F"
},
"SizeOfCode": {
"size": 4,
"name": "SizeOfCode",
"desc": "Size of the code section",
"offset": 268,
"type": "DWord",
"raw": {
"0": 0,
"1": 212,
"2": 0,
"3": 0
},
"num": 54272,
"text": "\u0000�\u0000\u0000",
"hex": "0000D400"
},
"SizeOfInitializedData": {
"size": 4,
"name": "SizeOfInitializedData",
"desc": "Size of the initialized data section",
"offset": 272,
"type": "DWord",
"raw": {
"0": 0,
"1": 40,
"2": 0,
"3": 0
},
"num": 10240,
"text": "\u0000(\u0000\u0000",
"hex": "00002800"
},
"SizeOfUninitializedData": {
"size": 4,
"name": "SizeOfUninitializedData",
"desc": "Size of the uninitialized data section",
"offset": 276,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"AddressOfEntryPoint": {
"size": 4,
"name": "AddressOfEntryPoint",
"desc": "Pointer to the entry point function, relative to the image base address, or zero if no entry point is present",
"offset": 280,
"type": "DWord",
"raw": {
"0": 80,
"1": 217,
"2": 0,
"3": 0
},
"num": 55632,
"text": "P�\u0000\u0000",
"hex": "0000D950"
},
"BaseOfCode": {
"size": 4,
"name": "BaseOfCode",
"desc": "Pointer to the beginning of the code section, relative to the image base",
"offset": 284,
"type": "DWord",
"raw": {
"0": 0,
"1": 16,
"2": 0,
"3": 0
},
"num": 4096,
"text": "\u0000\u0010\u0000\u0000",
"hex": "00001000"
},
"BaseOfData": {
"size": 4,
"name": "BaseOfData",
"desc": "Pointer to the beginning of the data section, relative to the image base",
"offset": 288,
"type": "DWord",
"raw": {
"0": 0,
"1": 240,
"2": 0,
"3": 0
},
"num": 61440,
"text": "\u0000�\u0000\u0000",
"hex": "0000F000"
},
"ImageBase": {
"size": 4,
"name": "ImageBase",
"desc": "Preferred address of the first byte of the image when it is loaded in memory",
"offset": 292,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 32,
"3": 102
},
"num": 1713373184,
"text": "\u0000\u0000 f",
"hex": "66200000"
},
"SectionAlignment": {
"size": 4,
"name": "SectionAlignment",
"desc": "Alignment of the section loaded in memory",
"offset": 296,
"type": "DWord",
"raw": {
"0": 0,
"1": 16,
"2": 0,
"3": 0
},
"num": 4096,
"text": "\u0000\u0010\u0000\u0000",
"hex": "00001000"
},
"FileAlignment": {
"size": 4,
"name": "FileAlignment",
"desc": "Alignment of the raw data of sections in the image file",
"offset": 300,
"type": "DWord",
"raw": {
"0": 0,
"1": 2,
"2": 0,
"3": 0
},
"num": 512,
"text": "\u0000\u0002\u0000\u0000",
"hex": "00000200"
},
"MajorOperatingSystemVersion": {
"size": 2,
"name": "MajorOperatingSystemVersion",
"desc": "Major version number of the required operating system",
"offset": 304,
"type": "Word",
"raw": {
"0": 10,
"1": 0
},
"num": 10,
"text": "\n\u0000",
"hex": "000A"
},
"MinorOperatingSystemVersion": {
"size": 2,
"name": "MinorOperatingSystemVersion",
"desc": "Minor version number of the required operating system",
"offset": 306,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"MajorImageVersion": {
"size": 2,
"name": "MajorImageVersion",
"desc": "",
"offset": 308,
"type": "Word",
"raw": {
"0": 10,
"1": 0
},
"num": 10,
"text": "\n\u0000",
"hex": "000A"
},
"MinorImageVersion": {
"size": 2,
"name": "MinorImageVersion",
"desc": "",
"offset": 310,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"MajorSubsystemVersion": {
"size": 2,
"name": "MajorSubsystemVersion",
"desc": "",
"offset": 312,
"type": "Word",
"raw": {
"0": 10,
"1": 0
},
"num": 10,
"text": "\n\u0000",
"hex": "000A"
},
"MinorSubsystemVersion": {
"size": 2,
"name": "MinorSubsystemVersion",
"desc": "",
"offset": 314,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"Win32VersionValue": {
"size": 4,
"name": "Win32VersionValue",
"desc": "Reserved",
"offset": 316,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"SizeOfImage": {
"size": 4,
"name": "SizeOfImage",
"desc": "Size of the image including all headers",
"offset": 320,
"type": "DWord",
"raw": {
"0": 0,
"1": 48,
"2": 1,
"3": 0
},
"num": 77824,
"text": "\u00000\u0001\u0000",
"hex": "00013000"
},
"SizeOfHeaders": {
"size": 4,
"name": "SizeOfHeaders",
"desc": "",
"offset": 324,
"type": "DWord",
"raw": {
"0": 0,
"1": 4,
"2": 0,
"3": 0
},
"num": 1024,
"text": "\u0000\u0004\u0000\u0000",
"hex": "00000400"
},
"CheckSum": {
"size": 4,
"name": "CheckSum",
"desc": "Image file checksum",
"offset": 328,
"type": "DWord",
"raw": {
"0": 69,
"1": 95,
"2": 1,
"3": 0
},
"num": 89925,
"text": "E_\u0001\u0000",
"hex": "00015F45"
},
"Subsystem": {
"size": 2,
"name": "Subsystem",
"desc": "WindowsCui - Subsystem required to run this image",
"offset": 332,
"type": "Word",
"raw": {
"0": 3,
"1": 0
},
"num": 3,
"text": "\u0003\u0000",
"hex": "0003"
},
"DllCharacteristics": {
"size": 2,
"name": "DllCharacteristics",
"desc": "DynamicBase, NxCompat, TerminalServerAware - DLL characteristics of the image",
"offset": 334,
"type": "Word",
"raw": {
"0": 64,
"1": 65
},
"num": 16704,
"text": "@A",
"hex": "4140"
},
"SizeOfStackReserve": {
"size": 4,
"name": "SizeOfStackReserve",
"desc": "Number of bytes to reserve for the stack",
"offset": 336,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 4,
"3": 0
},
"num": 262144,
"text": "\u0000\u0000\u0004\u0000",
"hex": "00040000"
},
"SizeOfStackCommit": {
"size": 4,
"name": "SizeOfStackCommit",
"desc": "Number of bytes to commit for the stack",
"offset": 340,
"type": "DWord",
"raw": {
"0": 0,
"1": 16,
"2": 0,
"3": 0
},
"num": 4096,
"text": "\u0000\u0010\u0000\u0000",
"hex": "00001000"
},
"SizeOfHeapReserve": {
"size": 4,
"name": "SizeOfHeapReserve",
"desc": "Number of bytes to reserve for the local heap",
"offset": 344,
"type": "DWord",
"raw": {
"0": 0,
"1": 20,
"2": 0,
"3": 0
},
"num": 5120,
"text": "\u0000\u0014\u0000\u0000",
"hex": "00001400"
},
"SizeOfHeapCommit": {
"size": 4,
"name": "SizeOfHeapCommit",
"desc": "Number of bytes to commit for the local heap",
"offset": 348,
"type": "DWord",
"raw": {
"0": 0,
"1": 16,
"2": 0,
"3": 0
},
"num": 4096,
"text": "\u0000\u0010\u0000\u0000",
"hex": "00001000"
},
"LoaderFlags": {
"size": 4,
"name": "LoaderFlags",
"desc": "Obsolete",
"offset": 352,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"NumberOfRvaAndSizes": {
"size": 4,
"name": "NumberOfRvaAndSizes",
"desc": "Number of directory entries in the remainder of the optional header",
"offset": 356,
"type": "DWord",
"raw": {
"0": 16,
"1": 0,
"2": 0,
"3": 0
},
"num": 16,
"text": "\u0010\u0000\u0000\u0000",
"hex": "00000010"
},
"DataDirectory": [
{
"VirtualAddress": {
"size": 4,
"name": "VirtualAddress",
"desc": "",
"offset": 360,
"type": "DWord",
"raw": {
"0": 96,
"1": 226,
"2": 0,
"3": 0
},
"num": 57952,
"text": "`�\u0000\u0000",
"hex": "0000E260"
},
"Size": {
"size": 4,
"name": "Size",
"desc": "",
"offset": 364,
"type": "DWord",
"raw": {
"0": 163,
"1": 0,
"2": 0,
"3": 0
},
"num": 163,
"text": "�\u0000\u0000\u0000",
"hex": "000000A3"
}
},
{
"VirtualAddress": {
"size": 4,
"name": "VirtualAddress",
"desc": "",
"offset": 368,
"type": "DWord",
"raw": {
"0": 44,
"1": 2,
"2": 1,
"3": 0
},
"num": 66092,
"text": ",\u0002\u0001\u0000",
"hex": "0001022C"
},
"Size": {
"size": 4,
"name": "Size",
"desc": "",
"offset": 372,
"type": "DWord",
"raw": {
"0": 120,
"1": 0,
"2": 0,
"3": 0
},
"num": 120,
"text": "x\u0000\u0000\u0000",
"hex": "00000078"
}
},
{
"VirtualAddress": {
"size": 4,
"name": "VirtualAddress",
"desc": "",
"offset": 376,
"type": "DWord",
"raw": {
"0": 0,
"1": 16,
"2": 1,
"3": 0
},
"num": 69632,
"text": "\u0000\u0010\u0001\u0000",
"hex": "00011000"
},
"Size": {
"size": 4,
"name": "Size",
"desc": "",
"offset": 380,
"type": "DWord",
"raw": {
"0": 88,
"1": 4,
"2": 0,
"3": 0
},
"num": 1112,
"text": "X\u0004\u0000\u0000",
"hex": "00000458"
}
},
{
"VirtualAddress": {
"size": 4,
"name": "VirtualAddress",
"desc": "",
"offset": 384,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"Size": {
"size": 4,
"name": "Size",
"desc": "",
"offset": 388,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
}
},
{
"VirtualAddress": {
"size": 4,
"name": "VirtualAddress",
"desc": "",
"offset": 392,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"Size": {
"size": 4,
"name": "Size",
"desc": "",
"offset": 396,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
}
},
{
"VirtualAddress": {
"size": 4,
"name": "VirtualAddress",
"desc": "",
"offset": 400,
"type": "DWord",
"raw": {
"0": 0,
"1": 32,
"2": 1,
"3": 0
},
"num": 73728,
"text": "\u0000 \u0001\u0000",
"hex": "00012000"
},
"Size": {
"size": 4,
"name": "Size",
"desc": "",
"offset": 404,
"type": "DWord",
"raw": {
"0": 80,
"1": 13,
"2": 0,
"3": 0
},
"num": 3408,
"text": "P\r\u0000\u0000",
"hex": "00000D50"
}
},
{
"VirtualAddress": {
"size": 4,
"name": "VirtualAddress",
"desc": "",
"offset": 408,
"type": "DWord",
"raw": {
"0": 64,
"1": 61,
"2": 0,
"3": 0
},
"num": 15680,
"text": "@=\u0000\u0000",
"hex": "00003D40"
},
"Size": {
"size": 4,
"name": "Size",
"desc": "",
"offset": 412,
"type": "DWord",
"raw": {
"0": 84,
"1": 0,
"2": 0,
"3": 0
},
"num": 84,
"text": "T\u0000\u0000\u0000",
"hex": "00000054"
}
},
{
"VirtualAddress": {
"size": 4,
"name": "VirtualAddress",
"desc": "",
"offset": 416,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"Size": {
"size": 4,
"name": "Size",
"desc": "",
"offset": 420,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
}
},
{
"VirtualAddress": {
"size": 4,
"name": "VirtualAddress",
"desc": "",
"offset": 424,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"Size": {
"size": 4,
"name": "Size",
"desc": "",
"offset": 428,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
}
},
{
"VirtualAddress": {
"size": 4,
"name": "VirtualAddress",
"desc": "",
"offset": 432,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"Size": {
"size": 4,
"name": "Size",
"desc": "",
"offset": 436,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
}
},
{
"VirtualAddress": {
"size": 4,
"name": "VirtualAddress",
"desc": "",
"offset": 440,
"type": "DWord",
"raw": {
"0": 240,
"1": 17,
"2": 0,
"3": 0
},
"num": 4592,
"text": "�\u0011\u0000\u0000",
"hex": "000011F0"
},
"Size": {
"size": 4,
"name": "Size",
"desc": "",
"offset": 444,
"type": "DWord",
"raw": {
"0": 164,
"1": 0,
"2": 0,
"3": 0
},
"num": 164,
"text": "�\u0000\u0000\u0000",
"hex": "000000A4"
}
},
{
"VirtualAddress": {
"size": 4,
"name": "VirtualAddress",
"desc": "",
"offset": 448,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"Size": {
"size": 4,
"name": "Size",
"desc": "",
"offset": 452,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
}
},
{
"VirtualAddress": {
"size": 4,
"name": "VirtualAddress",
"desc": "",
"offset": 456,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 1,
"3": 0
},
"num": 65536,
"text": "\u0000\u0000\u0001\u0000",
"hex": "00010000"
},
"Size": {
"size": 4,
"name": "Size",
"desc": "",
"offset": 460,
"type": "DWord",
"raw": {
"0": 40,
"1": 2,
"2": 0,
"3": 0
},
"num": 552,
"text": "(\u0002\u0000\u0000",
"hex": "00000228"
}
},
{
"VirtualAddress": {
"size": 4,
"name": "VirtualAddress",
"desc": "",
"offset": 464,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"Size": {
"size": 4,
"name": "Size",
"desc": "",
"offset": 468,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
}
},
{
"VirtualAddress": {
"size": 4,
"name": "VirtualAddress",
"desc": "",
"offset": 472,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"Size": {
"size": 4,
"name": "Size",
"desc": "",
"offset": 476,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
}
},
{
"VirtualAddress": {
"size": 4,
"name": "VirtualAddress",
"desc": "",
"offset": 480,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"Size": {
"size": 4,
"name": "Size",
"desc": "",
"offset": 484,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
}
}
]
}
}
},
"sections": [
{
"Name": {
"size": 8,
"name": "Name",
"desc": "",
"offset": 488,
"type": "QWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 116,
"4": 120,
"5": 101,
"6": 116,
"7": 46
},
"num": 500236121134,
"text": ".text\u0000\u0000\u0000",
"hex": "000000747865742E"
},
"VirtualSize": {
"size": 4,
"name": "VirtualSize",
"desc": "",
"offset": 496,
"type": "DWord",
"raw": {
"0": 3,
"1": 211,
"2": 0,
"3": 0
},
"num": 54019,
"text": "\u0003�\u0000\u0000",
"hex": "0000D303"
},
"VirtualAddress": {
"size": 4,
"name": "VirtualAddress",
"desc": "",
"offset": 500,
"type": "DWord",
"raw": {
"0": 0,
"1": 16,
"2": 0,
"3": 0
},
"num": 4096,
"text": "\u0000\u0010\u0000\u0000",
"hex": "00001000"
},
"SizeOfRawData": {
"size": 4,
"name": "SizeOfRawData",
"desc": "",
"offset": 504,
"type": "DWord",
"raw": {
"0": 0,
"1": 212,
"2": 0,
"3": 0
},
"num": 54272,
"text": "\u0000�\u0000\u0000",
"hex": "0000D400"
},
"PointerToRawData": {
"size": 4,
"name": "PointerToRawData",
"desc": "",
"offset": 508,
"type": "DWord",
"raw": {
"0": 0,
"1": 4,
"2": 0,
"3": 0
},
"num": 1024,
"text": "\u0000\u0004\u0000\u0000",
"hex": "00000400"
},
"PointerToRelocations": {
"size": 4,
"name": "PointerToRelocations",
"desc": "",
"offset": 512,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"PointerToLinenumbers": {
"size": 4,
"name": "PointerToLinenumbers",
"desc": "",
"offset": 516,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"NumberOfRelocations": {
"size": 2,
"name": "NumberOfRelocations",
"desc": "",
"offset": 520,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"NumberOfLinenumbers": {
"size": 2,
"name": "NumberOfLinenumbers",
"desc": "",
"offset": 522,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"Characteristics": {
"size": 4,
"name": "Characteristics",
"desc": "",
"offset": 524,
"type": "DWord",
"raw": {
"0": 32,
"1": 0,
"2": 0,
"3": 96
},
"num": 1610612768,
"text": " \u0000\u0000`",
"hex": "60000020"
}
},
{
"Name": {
"size": 8,
"name": "Name",
"desc": "",
"offset": 528,
"type": "QWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 97,
"4": 116,
"5": 97,
"6": 100,
"7": 46
},
"num": 418564367406,
"text": ".data\u0000\u0000\u0000",
"hex": "000000617461642E"
},
"VirtualSize": {
"size": 4,
"name": "VirtualSize",
"desc": "",
"offset": 536,
"type": "DWord",
"raw": {
"0": 224,
"1": 5,
"2": 0,
"3": 0
},
"num": 1504,
"text": "�\u0005\u0000\u0000",
"hex": "000005E0"
},
"VirtualAddress": {
"size": 4,
"name": "VirtualAddress",
"desc": "",
"offset": 540,
"type": "DWord",
"raw": {
"0": 0,
"1": 240,
"2": 0,
"3": 0
},
"num": 61440,
"text": "\u0000�\u0000\u0000",
"hex": "0000F000"
},
"SizeOfRawData": {
"size": 4,
"name": "SizeOfRawData",
"desc": "",
"offset": 544,
"type": "DWord",
"raw": {
"0": 0,
"1": 2,
"2": 0,
"3": 0
},
"num": 512,
"text": "\u0000\u0002\u0000\u0000",
"hex": "00000200"
},
"PointerToRawData": {
"size": 4,
"name": "PointerToRawData",
"desc": "",
"offset": 548,
"type": "DWord",
"raw": {
"0": 0,
"1": 216,
"2": 0,
"3": 0
},
"num": 55296,
"text": "\u0000�\u0000\u0000",
"hex": "0000D800"
},
"PointerToRelocations": {
"size": 4,
"name": "PointerToRelocations",
"desc": "",
"offset": 552,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"PointerToLinenumbers": {
"size": 4,
"name": "PointerToLinenumbers",
"desc": "",
"offset": 556,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"NumberOfRelocations": {
"size": 2,
"name": "NumberOfRelocations",
"desc": "",
"offset": 560,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"NumberOfLinenumbers": {
"size": 2,
"name": "NumberOfLinenumbers",
"desc": "",
"offset": 562,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"Characteristics": {
"size": 4,
"name": "Characteristics",
"desc": "",
"offset": 564,
"type": "DWord",
"raw": {
"0": 64,
"1": 0,
"2": 0,
"3": 192
},
"num": 3221225536,
"text": "@\u0000\u0000�",
"hex": "C0000040"
}
},
{
"Name": {
"size": 8,
"name": "Name",
"desc": "",
"offset": 568,
"type": "QWord",
"raw": {
"0": 0,
"1": 0,
"2": 97,
"3": 116,
"4": 97,
"5": 100,
"6": 105,
"7": 46
},
"num": 107152478071086,
"text": ".idata\u0000\u0000",
"hex": "000061746164692E"
},
"VirtualSize": {
"size": 4,
"name": "VirtualSize",
"desc": "",
"offset": 576,
"type": "DWord",
"raw": {
"0": 156,
"1": 13,
"2": 0,
"3": 0
},
"num": 3484,
"text": "�\r\u0000\u0000",
"hex": "00000D9C"
},
"VirtualAddress": {
"size": 4,
"name": "VirtualAddress",
"desc": "",
"offset": 580,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 1,
"3": 0
},
"num": 65536,
"text": "\u0000\u0000\u0001\u0000",
"hex": "00010000"
},
"SizeOfRawData": {
"size": 4,
"name": "SizeOfRawData",
"desc": "",
"offset": 584,
"type": "DWord",
"raw": {
"0": 0,
"1": 14,
"2": 0,
"3": 0
},
"num": 3584,
"text": "\u0000\u000e\u0000\u0000",
"hex": "00000E00"
},
"PointerToRawData": {
"size": 4,
"name": "PointerToRawData",
"desc": "",
"offset": 588,
"type": "DWord",
"raw": {
"0": 0,
"1": 218,
"2": 0,
"3": 0
},
"num": 55808,
"text": "\u0000�\u0000\u0000",
"hex": "0000DA00"
},
"PointerToRelocations": {
"size": 4,
"name": "PointerToRelocations",
"desc": "",
"offset": 592,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"PointerToLinenumbers": {
"size": 4,
"name": "PointerToLinenumbers",
"desc": "",
"offset": 596,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"NumberOfRelocations": {
"size": 2,
"name": "NumberOfRelocations",
"desc": "",
"offset": 600,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"NumberOfLinenumbers": {
"size": 2,
"name": "NumberOfLinenumbers",
"desc": "",
"offset": 602,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"Characteristics": {
"size": 4,
"name": "Characteristics",
"desc": "",
"offset": 604,
"type": "DWord",
"raw": {
"0": 64,
"1": 0,
"2": 0,
"3": 64
},
"num": 1073741888,
"text": "@\u0000\u0000@",
"hex": "40000040"
}
},
{
"Name": {
"size": 8,
"name": "Name",
"desc": "",
"offset": 608,
"type": "QWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 99,
"4": 114,
"5": 115,
"6": 114,
"7": 46
},
"num": 427121930798,
"text": ".rsrc\u0000\u0000\u0000",
"hex": "000000637273722E"
},
"VirtualSize": {
"size": 4,
"name": "VirtualSize",
"desc": "",
"offset": 616,
"type": "DWord",
"raw": {
"0": 88,
"1": 4,
"2": 0,
"3": 0
},
"num": 1112,
"text": "X\u0004\u0000\u0000",
"hex": "00000458"
},
"VirtualAddress": {
"size": 4,
"name": "VirtualAddress",
"desc": "",
"offset": 620,
"type": "DWord",
"raw": {
"0": 0,
"1": 16,
"2": 1,
"3": 0
},
"num": 69632,
"text": "\u0000\u0010\u0001\u0000",
"hex": "00011000"
},
"SizeOfRawData": {
"size": 4,
"name": "SizeOfRawData",
"desc": "",
"offset": 624,
"type": "DWord",
"raw": {
"0": 0,
"1": 6,
"2": 0,
"3": 0
},
"num": 1536,
"text": "\u0000\u0006\u0000\u0000",
"hex": "00000600"
},
"PointerToRawData": {
"size": 4,
"name": "PointerToRawData",
"desc": "",
"offset": 628,
"type": "DWord",
"raw": {
"0": 0,
"1": 232,
"2": 0,
"3": 0
},
"num": 59392,
"text": "\u0000�\u0000\u0000",
"hex": "0000E800"
},
"PointerToRelocations": {
"size": 4,
"name": "PointerToRelocations",
"desc": "",
"offset": 632,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"PointerToLinenumbers": {
"size": 4,
"name": "PointerToLinenumbers",
"desc": "",
"offset": 636,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"NumberOfRelocations": {
"size": 2,
"name": "NumberOfRelocations",
"desc": "",
"offset": 640,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"NumberOfLinenumbers": {
"size": 2,
"name": "NumberOfLinenumbers",
"desc": "",
"offset": 642,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"Characteristics": {
"size": 4,
"name": "Characteristics",
"desc": "",
"offset": 644,
"type": "DWord",
"raw": {
"0": 64,
"1": 0,
"2": 0,
"3": 64
},
"num": 1073741888,
"text": "@\u0000\u0000@",
"hex": "40000040"
}
},
{
"Name": {
"size": 8,
"name": "Name",
"desc": "",
"offset": 648,
"type": "QWord",
"raw": {
"0": 0,
"1": 0,
"2": 99,
"3": 111,
"4": 108,
"5": 101,
"6": 114,
"7": 46
},
"num": 109330211107374,
"text": ".reloc\u0000\u0000",
"hex": "0000636F6C65722E"
},
"VirtualSize": {
"size": 4,
"name": "VirtualSize",
"desc": "",
"offset": 656,
"type": "DWord",
"raw": {
"0": 80,
"1": 13,
"2": 0,
"3": 0
},
"num": 3408,
"text": "P\r\u0000\u0000",
"hex": "00000D50"
},
"VirtualAddress": {
"size": 4,
"name": "VirtualAddress",
"desc": "",
"offset": 660,
"type": "DWord",
"raw": {
"0": 0,
"1": 32,
"2": 1,
"3": 0
},
"num": 73728,
"text": "\u0000 \u0001\u0000",
"hex": "00012000"
},
"SizeOfRawData": {
"size": 4,
"name": "SizeOfRawData",
"desc": "",
"offset": 664,
"type": "DWord",
"raw": {
"0": 0,
"1": 14,
"2": 0,
"3": 0
},
"num": 3584,
"text": "\u0000\u000e\u0000\u0000",
"hex": "00000E00"
},
"PointerToRawData": {
"size": 4,
"name": "PointerToRawData",
"desc": "",
"offset": 668,
"type": "DWord",
"raw": {
"0": 0,
"1": 238,
"2": 0,
"3": 0
},
"num": 60928,
"text": "\u0000�\u0000\u0000",
"hex": "0000EE00"
},
"PointerToRelocations": {
"size": 4,
"name": "PointerToRelocations",
"desc": "",
"offset": 672,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"PointerToLinenumbers": {
"size": 4,
"name": "PointerToLinenumbers",
"desc": "",
"offset": 676,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"NumberOfRelocations": {
"size": 2,
"name": "NumberOfRelocations",
"desc": "",
"offset": 680,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"NumberOfLinenumbers": {
"size": 2,
"name": "NumberOfLinenumbers",
"desc": "",
"offset": 682,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"Characteristics": {
"size": 4,
"name": "Characteristics",
"desc": "",
"offset": 684,
"type": "DWord",
"raw": {
"0": 64,
"1": 0,
"2": 0,
"3": 66
},
"num": 1107296320,
"text": "@\u0000\u0000B",
"hex": "42000040"
}
}
],
"directories": {
"import": [
{
"OriginalFirstThunk": {
"size": 4,
"name": "OriginalFirstThunk",
"desc": "",
"offset": 56364,
"type": "DWord",
"raw": {
"0": 48,
"1": 4,
"2": 1,
"3": 0
},
"num": 66608,
"text": "0\u0004\u0001\u0000",
"hex": "00010430"
},
"TimeDateStamp": {
"size": 4,
"name": "TimeDateStamp",
"desc": "",
"offset": 56368,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"ForwarderChain": {
"size": 4,
"name": "ForwarderChain",
"desc": "",
"offset": 56372,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"Name": {
"size": 4,
"name": "Name",
"desc": "",
"offset": 56376,
"type": "DWord",
"raw": {
"0": 38,
"1": 6,
"2": 1,
"3": 0
},
"num": 67110,
"text": "&\u0006\u0001\u0000",
"hex": "00010626"
},
"FirstThunk": {
"size": 4,
"name": "FirstThunk",
"desc": "",
"offset": 56380,
"type": "DWord",
"raw": {
"0": 140,
"1": 1,
"2": 1,
"3": 0
},
"num": 65932,
"text": "�\u0001\u0001\u0000",
"hex": "0001018C"
}
},
{
"OriginalFirstThunk": {
"size": 4,
"name": "OriginalFirstThunk",
"desc": "",
"offset": 56384,
"type": "DWord",
"raw": {
"0": 164,
"1": 2,
"2": 1,
"3": 0
},
"num": 66212,
"text": "�\u0002\u0001\u0000",
"hex": "000102A4"
},
"TimeDateStamp": {
"size": 4,
"name": "TimeDateStamp",
"desc": "",
"offset": 56388,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"ForwarderChain": {
"size": 4,
"name": "ForwarderChain",
"desc": "",
"offset": 56392,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"Name": {
"size": 4,
"name": "Name",
"desc": "",
"offset": 56396,
"type": "DWord",
"raw": {
"0": 178,
"1": 10,
"2": 1,
"3": 0
},
"num": 68274,
"text": "�\n\u0001\u0000",
"hex": "00010AB2"
},
"FirstThunk": {
"size": 4,
"name": "FirstThunk",
"desc": "",
"offset": 56400,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 1,
"3": 0
},
"num": 65536,
"text": "\u0000\u0000\u0001\u0000",
"hex": "00010000"
}
},
{
"OriginalFirstThunk": {
"size": 4,
"name": "OriginalFirstThunk",
"desc": "",
"offset": 56404,
"type": "DWord",
"raw": {
"0": 148,
"1": 3,
"2": 1,
"3": 0
},
"num": 66452,
"text": "�\u0003\u0001\u0000",
"hex": "00010394"
},
"TimeDateStamp": {
"size": 4,
"name": "TimeDateStamp",
"desc": "",
"offset": 56408,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"ForwarderChain": {
"size": 4,
"name": "ForwarderChain",
"desc": "",
"offset": 56412,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"Name": {
"size": 4,
"name": "Name",
"desc": "",
"offset": 56416,
"type": "DWord",
"raw": {
"0": 232,
"1": 12,
"2": 1,
"3": 0
},
"num": 68840,
"text": "�\f\u0001\u0000",
"hex": "00010CE8"
},
"FirstThunk": {
"size": 4,
"name": "FirstThunk",
"desc": "",
"offset": 56420,
"type": "DWord",
"raw": {
"0": 240,
"1": 0,
"2": 1,
"3": 0
},
"num": 65776,
"text": "�\u0000\u0001\u0000",
"hex": "000100F0"
}
},
{
"OriginalFirstThunk": {
"size": 4,
"name": "OriginalFirstThunk",
"desc": "",
"offset": 56424,
"type": "DWord",
"raw": {
"0": 40,
"1": 4,
"2": 1,
"3": 0
},
"num": 66600,
"text": "(\u0004\u0001\u0000",
"hex": "00010428"
},
"TimeDateStamp": {
"size": 4,
"name": "TimeDateStamp",
"desc": "",
"offset": 56428,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"ForwarderChain": {
"size": 4,
"name": "ForwarderChain",
"desc": "",
"offset": 56432,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"Name": {
"size": 4,
"name": "Name",
"desc": "",
"offset": 56436,
"type": "DWord",
"raw": {
"0": 6,
"1": 13,
"2": 1,
"3": 0
},
"num": 68870,
"text": "\u0006\r\u0001\u0000",
"hex": "00010D06"
},
"FirstThunk": {
"size": 4,
"name": "FirstThunk",
"desc": "",
"offset": 56440,
"type": "DWord",
"raw": {
"0": 132,
"1": 1,
"2": 1,
"3": 0
},
"num": 65924,
"text": "�\u0001\u0001\u0000",
"hex": "00010184"
}
},
{
"OriginalFirstThunk": {
"size": 4,
"name": "OriginalFirstThunk",
"desc": "",
"offset": 56444,
"type": "DWord",
"raw": {
"0": 20,
"1": 4,
"2": 1,
"3": 0
},
"num": 66580,
"text": "\u0014\u0004\u0001\u0000",
"hex": "00010414"
},
"TimeDateStamp": {
"size": 4,
"name": "TimeDateStamp",
"desc": "",
"offset": 56448,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"ForwarderChain": {
"size": 4,
"name": "ForwarderChain",
"desc": "",
"offset": 56452,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"Name": {
"size": 4,
"name": "Name",
"desc": "",
"offset": 56456,
"type": "DWord",
"raw": {
"0": 96,
"1": 13,
"2": 1,
"3": 0
},
"num": 68960,
"text": "`\r\u0001\u0000",
"hex": "00010D60"
},
"FirstThunk": {
"size": 4,
"name": "FirstThunk",
"desc": "",
"offset": 56460,
"type": "DWord",
"raw": {
"0": 112,
"1": 1,
"2": 1,
"3": 0
},
"num": 65904,
"text": "p\u0001\u0001\u0000",
"hex": "00010170"
}
}
],
"export": [
{
"Characteristics": {
"size": 4,
"name": "Characteristics",
"desc": "",
"offset": 54880,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"TimeDateStamp": {
"size": 4,
"name": "TimeDateStamp",
"desc": "",
"offset": 54884,
"type": "DWord",
"raw": {
"0": 156,
"1": 213,
"2": 120,
"3": 117
},
"num": 1970853276,
"text": "��xu",
"hex": "7578D59C"
},
"MajorVersion": {
"size": 2,
"name": "MajorVersion",
"desc": "",
"offset": 54888,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"MinorVersion": {
"size": 2,
"name": "MinorVersion",
"desc": "",
"offset": 54890,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"Name": {
"size": 4,
"name": "Name",
"desc": "",
"offset": 54892,
"type": "DWord",
"raw": {
"0": 190,
"1": 226,
"2": 0,
"3": 0
},
"num": 58046,
"text": "��\u0000\u0000",
"hex": "0000E2BE"
},
"Base": {
"size": 4,
"name": "Base",
"desc": "",
"offset": 54896,
"type": "DWord",
"raw": {
"0": 1,
"1": 0,
"2": 0,
"3": 0
},
"num": 1,
"text": "\u0001\u0000\u0000\u0000",
"hex": "00000001"
},
"NumberOfFunctions": {
"size": 4,
"name": "NumberOfFunctions",
"desc": "",
"offset": 54900,
"type": "DWord",
"raw": {
"0": 6,
"1": 0,
"2": 0,
"3": 0
},
"num": 6,
"text": "\u0006\u0000\u0000\u0000",
"hex": "00000006"
},
"NumberOfNames": {
"size": 4,
"name": "NumberOfNames",
"desc": "",
"offset": 54904,
"type": "DWord",
"raw": {
"0": 5,
"1": 0,
"2": 0,
"3": 0
},
"num": 5,
"text": "\u0005\u0000\u0000\u0000",
"hex": "00000005"
},
"AddressOfFunctions": {
"size": 4,
"name": "AddressOfFunctions",
"desc": "",
"offset": 54908,
"type": "DWord",
"raw": {
"0": 136,
"1": 226,
"2": 0,
"3": 0
},
"num": 57992,
"text": "��\u0000\u0000",
"hex": "0000E288"
},
"AddressOfNames": {
"size": 4,
"name": "AddressOfNames",
"desc": "",
"offset": 54912,
"type": "DWord",
"raw": {
"0": 160,
"1": 226,
"2": 0,
"3": 0
},
"num": 58016,
"text": "��\u0000\u0000",
"hex": "0000E2A0"
},
"AddressOfNameOrdinals": {
"size": 4,
"name": "AddressOfNameOrdinals",
"desc": "",
"offset": 54916,
"type": "DWord",
"raw": {
"0": 180,
"1": 226,
"2": 0,
"3": 0
},
"num": 58036,
"text": "��\u0000\u0000",
"hex": "0000E2B4"
}
},
{
"Characteristics": {
"size": 4,
"name": "Characteristics",
"desc": "",
"offset": 54920,
"type": "DWord",
"raw": {
"0": 64,
"1": 174,
"2": 0,
"3": 0
},
"num": 44608,
"text": "@�\u0000\u0000",
"hex": "0000AE40"
},
"TimeDateStamp": {
"size": 4,
"name": "TimeDateStamp",
"desc": "",
"offset": 54924,
"type": "DWord",
"raw": {
"0": 0,
"1": 0,
"2": 0,
"3": 0
},
"num": 0,
"text": "\u0000\u0000\u0000\u0000",
"hex": "00000000"
},
"MajorVersion": {
"size": 2,
"name": "MajorVersion",
"desc": "",
"offset": 54928,
"type": "Word",
"raw": {
"0": 96,
"1": 143
},
"num": 36704,
"text": "`�",
"hex": "8F60"
},
"MinorVersion": {
"size": 2,
"name": "MinorVersion",
"desc": "",
"offset": 54930,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"Name": {
"size": 4,
"name": "Name",
"desc": "",
"offset": 54932,
"type": "DWord",
"raw": {
"0": 64,
"1": 148,
"2": 0,
"3": 0
},
"num": 37952,
"text": "@�\u0000\u0000",
"hex": "00009440"
},
"Base": {
"size": 4,
"name": "Base",
"desc": "",
"offset": 54936,
"type": "DWord",
"raw": {
"0": 96,
"1": 149,
"2": 0,
"3": 0
},
"num": 38240,
"text": "`�\u0000\u0000",
"hex": "00009560"
},
"NumberOfFunctions": {
"size": 4,
"name": "NumberOfFunctions",
"desc": "",
"offset": 54940,
"type": "DWord",
"raw": {
"0": 160,
"1": 149,
"2": 0,
"3": 0
},
"num": 38304,
"text": "��\u0000\u0000",
"hex": "000095A0"
},
"NumberOfNames": {
"size": 4,
"name": "NumberOfNames",
"desc": "",
"offset": 54944,
"type": "DWord",
"raw": {
"0": 203,
"1": 226,
"2": 0,
"3": 0
},
"num": 58059,
"text": "��\u0000\u0000",
"hex": "0000E2CB"
},
"AddressOfFunctions": {
"size": 4,
"name": "AddressOfFunctions",
"desc": "",
"offset": 54948,
"type": "DWord",
"raw": {
"0": 216,
"1": 226,
"2": 0,
"3": 0
},
"num": 58072,
"text": "��\u0000\u0000",
"hex": "0000E2D8"
},
"AddressOfNames": {
"size": 4,
"name": "AddressOfNames",
"desc": "",
"offset": 54952,
"type": "DWord",
"raw": {
"0": 230,
"1": 226,
"2": 0,
"3": 0
},
"num": 58086,
"text": "��\u0000\u0000",
"hex": "0000E2E6"
},
"AddressOfNameOrdinals": {
"size": 4,
"name": "AddressOfNameOrdinals",
"desc": "",
"offset": 54956,
"type": "DWord",
"raw": {
"0": 240,
"1": 226,
"2": 0,
"3": 0
},
"num": 58096,
"text": "��\u0000\u0000",
"hex": "0000E2F0"
}
},
{
"Characteristics": {
"size": 4,
"name": "Characteristics",
"desc": "",
"offset": 54960,
"type": "DWord",
"raw": {
"0": 249,
"1": 226,
"2": 0,
"3": 0
},
"num": 58105,
"text": "��\u0000\u0000",
"hex": "0000E2F9"
},
"TimeDateStamp": {
"size": 4,
"name": "TimeDateStamp",
"desc": "",
"offset": 54964,
"type": "DWord",
"raw": {
"0": 3,
"1": 0,
"2": 2,
"3": 0
},
"num": 131075,
"text": "\u0003\u0000\u0002\u0000",
"hex": "00020003"
},
"MajorVersion": {
"size": 2,
"name": "MajorVersion",
"desc": "",
"offset": 54968,
"type": "Word",
"raw": {
"0": 0,
"1": 0
},
"num": 0,
"text": "\u0000\u0000",
"hex": "0000"
},
"MinorVersion": {
"size": 2,
"name": "MinorVersion",
"desc": "",
"offset": 54970,
"type": "Word",
"raw": {
"0": 5,
"1": 0
},
"num": 5,
"text": "\u0005\u0000",
"hex": "0005"
},
"Name": {
"size": 4,
"name": "Name",
"desc": "",
"offset": 54972,
"type": "DWord",
"raw": {
"0": 4,
"1": 0,
"2": 84,
"3": 87
},
"num": 1465122820,
"text": "\u0004\u0000TW",
"hex": "57540004"
},
"Base": {
"size": 4,
"name": "Base",
"desc": "",
"offset": 54976,
"type": "DWord",
"raw": {
"0": 65,
"1": 73,
"2": 78,
"3": 95
},
"num": 1598966081,
"text": "AIN_",
"hex": "5F4E4941"
},
"NumberOfFunctions": {
"size": 4,
"name": "NumberOfFunctions",
"desc": "",
"offset": 54980,
"type": "DWord",
"raw": {
"0": 51,
"1": 50,
"2": 46,
"3": 100
},
"num": 1680749107,
"text": "32.d",
"hex": "642E3233"
},
"NumberOfNames": {
"size": 4,
"name": "NumberOfNames",
"desc": "",
"offset": 54984,
"type": "DWord",
"raw": {
"0": 108,
"1": 108,
"2": 0,
"3": 65
},
"num": 1090546796,
"text": "ll\u0000A",
"hex": "41006C6C"
},
"AddressOfFunctions": {
"size": 4,
"name": "AddressOfFunctions",
"desc": "",
"offset": 54988,
"type": "DWord",
"raw": {
"0": 98,
"1": 111,
"2": 117,
"3": 116
},
"num": 1953853282,
"text": "bout",
"hex": "74756F62"
},
"AddressOfNames": {
"size": 4,
"name": "AddressOfNames",
"desc": "",
"offset": 54992,
"type": "DWord",
"raw": {
"0": 68,
"1": 108,
"2": 103,
"3": 80
},
"num": 1348955204,
"text": "DlgP",
"hex": "50676C44"
},
"AddressOfNameOrdinals": {
"size": 4,
"name": "AddressOfNameOrdinals",
"desc": "",
"offset": 54996,
"type": "DWord",
"raw": {
"0": 114,
"1": 111,
"2": 99,
"3": 0
},
"num": 6516594,
"text": "roc\u0000",
"hex": "00636F72"
}
},
{
"Characteristics": {
"size": 4,
"name": "Characteristics",
"desc": "",
"offset": 55000,
"type": "DWord",
"raw": {
"0": 67,
"1": 104,
"2": 111,
"3": 111
},
"num": 1869572163,
"text": "Choo",
"hex": "6F6F6843"
},
"TimeDateStamp": {
"size": 4,
"name": "TimeDateStamp",
"desc": "",
"offset": 55004,
"type": "DWord",
"raw": {
"0": 115,
"1": 101,
"2": 68,
"3": 108
},
"num": 1816421747,
"text": "seDl",
"hex": "6C446573"
},
"MajorVersion": {
"size": 2,
"name": "MajorVersion",
"desc": "",
"offset": 55008,
"type": "Word",
"raw": {
"0": 103,
"1": 80
},
"num": 20583,
"text": "gP",
"hex": "5067"
},
"MinorVersion": {
"size": 2,
"name": "MinorVersion",
"desc": "",
"offset": 55010,
"type": "Word",
"raw": {
"0": 114,
"1": 111
},
"num": 28530,
"text": "ro",
"hex": "6F72"
},
"Name": {
"size": 4,
"name": "Name",
"desc": "",
"offset": 55012,
"type": "DWord",
"raw": {
"0": 99,
"1": 0,
"2": 68,
"3": 83
},
"num": 1396965475,
"text": "c\u0000DS",
"hex": "53440063"
},
"Base": {
"size": 4,
"name": "Base",
"desc": "",
"offset": 55016,
"type": "DWord",
"raw": {
"0": 77,
"1": 95,
"2": 69,
"3": 110
},
"num": 1850040141,
"text": "M_En",
"hex": "6E455F4D"
},
"NumberOfFunctions": {
"size": 4,
"name": "NumberOfFunctions",
"desc": "",
"offset": 55020,
"type": "DWord",
"raw": {
"0": 116,
"1": 114,
"2": 121,
"3": 0
},
"num": 7959156,
"text": "try\u0000",
"hex": "00797274"
},
"NumberOfNames": {
"size": 4,
"name": "NumberOfNames",
"desc": "",
"offset": 55024,
"type": "DWord",
"raw": {
"0": 73,
"1": 110,
"2": 102,
"3": 111
},
"num": 1868983881,
"text": "Info",
"hex": "6F666E49"
},
"AddressOfFunctions": {
"size": 4,
"name": "AddressOfFunctions",
"desc": "",
"offset": 55028,
"type": "DWord",
"raw": {
"0": 72,
"1": 111,
"2": 111,
"3": 107
},
"num": 1802465096,
"text": "Hook",
"hex": "6B6F6F48"
},
"AddressOfNames": {
"size": 4,
"name": "AddressOfNames",
"desc": "",
"offset": 55032,
"type": "DWord",
"raw": {
"0": 0,
"1": 87,
"2": 71,
"3": 68
},
"num": 1145526016,
"text": "\u0000WGD",
"hex": "44475700"
},
"AddressOfNameOrdinals": {
"size": 4,
"name": "AddressOfNameOrdinals",
"desc": "",
"offset": 55036,
"type": "DWord",
"raw": {
"0": 108,
"1": 103,
"2": 80,
"3": 114
},
"num": 1917871980,
"text": "lgPr",
"hex": "7250676C"
}
}
]
}
}
Raw Text
-
Perfect 10 College Babe Rammed Analy - Hazel Moore - DarkX
7 min ago
-
Ersties - Die süße Victoria P fingert ihre rasierte Muschi
38 min ago
-
Untitled
43 min ago
-
fitspresso
1 hour ago
-
TRUE AMATEURS - Xreindeers Waits For Her BF To Arrive While Touching Her Wet Pussy On The Bed
1 hour ago
-
asxczsd
1 hour ago
-
Location Tracker
JavaScript | 1 hour ago
-
ProfilePage
JavaScript | 1 hour ago
-
rrr
1 hour ago
-
Gorgeous babe loves taking his big hard cock
1 hour ago