| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2025-Dec-06 15:26:52 |
| Detected languages |
English - United States
|
| Debug artifacts |
D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb
|
| ProductName | WinRAR |
| CompanyName | Alexander Roshal |
| FileDescription | Command line RAR |
| FileVersion | 7.20.2 |
| ProductVersion | 7.20.2 |
| InternalName | Command line RAR |
| LegalCopyright | Copyright © Alexander Roshal 1993-2025 |
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to SHA1
Uses constants related to SHA256 Uses constants related to AES Microsoft's Cryptography API |
| Suspicious | The PE is possibly packed. | Unusual section name found: .fptable |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Info | The PE is digitally signed. |
Signer: win.rar GmbH
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 |
| Safe | VirusTotal score: 0/72 (Scanned on 2026-01-29 19:44:01) | All the AVs think this file is safe. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x110 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 7 |
| TimeDateStamp | 2025-Dec-06 15:26:52 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x9d000 |
| SizeOfInitializedData | 0x3d200 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000081A10 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xdf000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0xcd0d8 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
SetFileTime
CloseHandle DeviceIoControl BackupRead BackupSeek CreateHardLinkW GetLongPathNameW GetShortPathNameW MoveFileW FlushFileBuffers GetFileTime ReadFile SetEndOfFile SetFilePointer CreateDirectoryW GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesW GetVolumeInformationW SetFileAttributesW GetCurrentProcessId FindNextFileW GetVersionExW GetCurrentProcess VirtualAlloc VirtualFree SetCurrentDirectoryW GetCurrentDirectoryW GetFullPathNameW GetModuleFileNameW FoldStringW SetErrorMode FreeLibrary LoadLibraryExW ExpandEnvironmentStringsW CompareStringA GetLocaleInfoW CreateEventW GetCurrentThread RemoveDirectoryW SetPriorityClass GetSystemDirectoryW LoadLibraryW SetThreadExecutionState InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObject CreateSemaphoreW CreateThread GetProcessAffinityMask FileTimeToLocalFileTime LocalFileTimeToFileTime GetSystemTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime FileTimeToSystemTime SystemTimeToFileTime CompareStringW MultiByteToWideChar WideCharToMultiByte GetCPInfo IsDBCSLeadByte HeapSize SetFilePointerEx GetStringTypeW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileW FindClose DeleteFileW CreateFileW SetConsoleCtrlHandler FormatMessageW LocalFree Sleep GetLastError WriteConsoleW ReadConsoleW SetConsoleMode GetConsoleMode WriteFile GetFileType GetStdHandle GetCommandLineW GetProcAddress GetModuleHandleW SetLastError SetThreadPriority GetFileInformationByHandle FindFirstFileExW HeapReAlloc SetStdHandle GetConsoleOutputCP LCMapStringW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW QueryPerformanceFrequency GetCommandLineA HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect |
|---|---|
| USER32.dll |
CharLowerW
CharUpperW ExitWindowsEx LoadStringW OemToCharBuffW CharToOemBuffW CharToOemBuffA OemToCharBuffA OemToCharA CharToOemA MessageBeep |
| ADVAPI32.dll |
LookupPrivilegeValueW
FreeSid CheckTokenMembership AllocateAndInitializeSid AdjustTokenPrivileges RegQueryValueExW RegOpenKeyExW RegCloseKey LsaAddAccountRights LsaOpenPolicy LsaClose ConvertStringSidToSidW ConvertSidToStringSidW GetTokenInformation OpenProcessToken SetFileSecurityW GetSecurityDescriptorLength GetFileSecurityW CryptGenRandom CryptReleaseContext CryptAcquireContextW |
| SHELL32.dll |
SHGetPathFromIDListW
SHGetMalloc ShellExecuteExW SHFileOperationW SHGetSpecialFolderLocation |
| POWRPROF.dll |
SetSuspendState
|
| _Yes_No |
| _Yes_No_All |
| _Yes_No_All_nEver_Quit |
| _Yes_No_All_nEver_Rename_Quit |
| _Continue_Quit |
| _Retry_Abort |
| _Ignore_iGnore all_Retry_Quit |
| RAR %s Copyright (c) 1993-%d Alexander Roshal %d %.3s %d |
| Registered to %s |
| Trial version Type 'rar -?' for help |
| Available license key is valid only for %s |
| UNRAR %s freeware Copyright (c) 1993-%d Alexander Roshal |
| beta |
| x86 |
| x64 |
| January |
| February |
| March |
| April |
| May |
| June |
| July |
| August |
| September |
| October |
| November |
| December |
| Monday |
| Tuesday |
| Wednesday |
| Thursday |
| Friday |
| Saturday |
| Sunday |
| Usage: rar <command> -<switch 1> -<switch N> <archive> <files...> |
| Usage: unrar <command> -<switch 1> -<switch N> <archive> <files...> |
| <@listfiles...> <path_to_extract\> |
| <@listfiles...> <path_to_extract/> |
| <Commands> |
| a Add files to archive |
| c Add archive comment |
| ch Change archive parameters |
| cw Write archive comment to file |
| d Delete files from archive |
| e Extract files without archived paths |
| f Freshen files in archive |
| i[par]=<str> Find string in archives |
| k Lock archive |
| l[t[a],b] List archive contents [technical[all], bare] |
| m[f] Move to archive [files only] |
| p Print file to stdout |
| r Repair archive |
| rc Reconstruct missing volumes |
| rn Rename archived files |
| rr[N] Add data recovery record |
| rv[N] Create recovery volumes |
| s[name|-] Convert archive to or from SFX |
| t Test archive files |
| u Update files in archive |
| v[t[a],b] Verbosely list archive contents [technical[all],bare] |
| x Extract files with full path |
| <Switches> |
| - Stop switches scanning |
| @[+] Disable [enable] file lists |
| ac Clear Archive attribute after compression or extraction |
| ad[1,2] Alternate destination path |
| ag[format] Generate archive name using the current date |
| ai Ignore file attributes |
| am[s,r] Archive name and time [save, restore] |
| ao Add files with Archive attribute set |
| ap<path> Set path inside archive |
| as Synchronize archive contents |
| c- Disable comments show |
| cfg- Disable read configuration |
| cl Convert names to lower case |
| cu Convert names to upper case |
| df Delete files after archiving |
| dh Open shared files |
| dr Delete files to Recycle Bin |
| ds Disable name sort for solid archive |
| dw Wipe files after archiving |
| e[+]<attr> Set file exclude and include attributes |
| ed Do not add empty directories |
| ep Exclude paths from names |
| ep1 Exclude base directory from names |
| ep2 Expand paths to full |
| ep3 Expand paths to full including the drive letter |
| ep4<path> Exclude the path prefix from names |
| f Freshen files |
| hp[password] Encrypt both file data and headers |
| ht[b|c] Select hash type [BLAKE2,CRC32] for file checksum |
| id[c,d,n,p,q] Display or disable messages |
| ieml[addr] Send archive by email |
| ierr Send all messages to stderr |
| ilog[name] Log errors to file |
| inul Disable all messages |
| ioff[n] Turn PC off after completing an operation |
| isnd[-] Control notification sounds |
| iver Display the version number |
| k Lock archive |
| kb Keep broken extracted files |
| log[f][=name] Write names to log file |
| m<0..5> Set compression level (0-store...3-default...5-maximal) |
| mc<par> Set advanced compression parameters |
| md[x]<n>[kmg] Dictionary size in KB, MB or GB |
| me[par] Set encryption parameters |
| mlp Use large memory pages |
| ms[ext;ext] Specify file types to store |
| mt<threads> Set the number of threads |
| n<file> Additionally filter included files |
| n@ Read additional filter masks from stdin |
| n@<list> Read additional filter masks from list file |
| o[+|-] Set the overwrite mode |
| oc Set NTFS Compressed attribute |
| oh Save hard links as the link instead of the file |
| oi[0-4][:min] Save identical files as references |
| ol[a,-] Process symbolic links as the link [absolute paths, skip] |
| om[-|1][=lst] Propagate Mark of the Web |
| oni Allow potentially incompatible names |
| op<path> Set the output path for extracted files |
| or Rename files automatically |
| os Save NTFS streams |
| ow Save or restore file owner and group |
| p[password] Set password |
| qo[-|+] Add quick open information [none|force] |
| r Recurse subdirectories |
| r- Disable recursion |
| r0 Recurse subdirectories for wildcard names only |
| ri<P>[:<S>] Set priority (0-default,1-min..15-max) and sleep time in ms |
| rr[N] Add data recovery record |
| rv[N] Create recovery volumes |
| s[=<par>] Create solid archive |
| sc<chr>[obj] Specify the character set |
| sfx[name] Create SFX archive |
| si[name] Read data from standard input (stdin) |
| sl<size>[u] Process files with size less than specified |
| sm<size>[u] Process files with size more than specified |
| t Test files after archiving |
| tk[<date>] Keep the original or set the specified archive time |
| tl Set archive time to latest file |
| tn[mcao]<t> Process files newer than <t> time |
| to[mcao]<t> Process files older than <t> time |
| ta[mcao]<d> Process files modified after <d> YYYYMMDDHHMMSS date |
| tb[mcao]<d> Process files modified before <d> YYYYMMDDHHMMSS date |
| ts[m,c,a,p] Save or restore time (modification, creation, access, preserve) |
| u Update files |
| v Create volumes with size autodetection or list all volumes |
| v List all volumes |
| v<size>[u] Create volumes with size in [bBkKmMgGtT] units |
| vd Erase disk contents before creating volume |
| ver[n] File version control |
| vp Pause before each volume |
| w<path> Assign work directory |
| x<file> Exclude specified file |
| x@ Read file names to exclude from stdin |
| x@<list> Exclude files listed in specified list file |
| y Assume Yes on all queries |
| z[file] Read archive comment from file |
| ERROR: Bad archive %s |
| Enter password (will not be echoed) |
| Enter password (will not be echoed) for %s: |
| Reenter password: |
| ERROR: Passwords do not match |
| Write error in the file %s |
| Read error in the file %s |
| Seek error in the file %s |
| Cannot close the file %s |
| Not enough memory |
| Corrupt archive - use 'Repair' command |
| Program aborted |
| Cannot rename %s to %s |
| Cannot find volume %s |
| User break |
| Create next volume? |
| Disk full. Insert next |
| Creating %sarchive %s |
| Insert disk with %s |
| Testing archive %s |
| Extracting from %s |
| Converting %s |
| Convert archives to SFX |
| Removing SFX module |
| %s is not SFX archive |
| %s is not RAR archive |
| %s is not the first volume |
| %s - cannot convert to SFX archive with old format |
| Cannot create %s |
| Cannot open %s |
| Unknown method in %s |
| Unsupported archive format. Please update RAR to a newer version. |
| OK |
| Done |
| Locking archive |
| ERROR: Cannot modify old format archive |
| ERROR: Locked archive |
| ERROR: Cannot modify volume |
| Evaluation copy. Please register. |
| Creating %sarchive %s |
| Updating %sarchive %s |
| solid |
| Adding %-58s |
| Updating %-58s |
| ... %-58s |
| Deleting files %s... |
| and directories |
| Deleting %-30s |
| deleted |
| NOT DELETED |
| Clearing attributes... |
| Deleting directory %-30s |
| WARNING: Cannot open %d %s |
| files |
| file |
| WARNING: No files |
| %s: encrypted |
| Analyzing archived files: |
| Repacking archived files: |
| %-20s - checksum error |
| Testing archive %s |
| Extracting from %s |
| %s - use current password? |
| Creating %-56s |
| Skipping %-56s |
| Testing %-56s |
| Extracting %-56s |
| ... %-56s |
| Cannot create directory %s |
| ------ Printing %s |
| Checksum error in the encrypted file %s. Corrupt file or wrong password. |
| No files to extract |
| All OK |
| Total errors: %ld |
| Would you like to replace the existing file %s |
| %6s bytes, modified on %s |
| with a new one |
| %6s bytes, modified on %s |
| Overwrite %s? |
| Enter new name: |
| Corrupt header is found |
| Main archive header is corrupt |
| %s - the file header is corrupt |
| The data recovery header is corrupt |
| Archive comment |
| Reading comment from stdin |
| Reading comment from %s |
| Deleting a comment from %s |
| Adding a comment to %s |
| The archive comment is corrupt |
| Press 'Enter' to continue or 'Q' to quit: |
| Write comment to %s |
| Comment is not present |
| Deleting from %s |
| Deleting %s |
| Erasing empty archive %s |
| No files to delete |
| -------- %2d %s %d, archive %s |
| ERROR: Path too long |
| Archive |
| Details |
| solid |
| SFX |
| volume |
| recovery record |
| lock |
| encrypted |
| encrypted headers |
| Attributes Size Date Time Name |
| Attributes Size Packed Ratio Date Time Checksum Name |
| Name |
| Type |
| File |
| Directory |
| Unix symbolic link |
| Windows symbolic link |
| NTFS junction point |
| Hard link |
| File reference |
| NTFS alternate data stream |
| Target |
| Size |
| Packed size |
| Ratio |
| mtime |
| ctime |
| atime |
| Modified |
| Created |
| Accessed |
| Attributes |
| Flags |
| Compression |
| Host OS |
| File version |
| Service |
| NTFS security data |
| NTFS stream: %s |
| Unknown subheader type: 0x%04x |
| Yes |
| No |
| 0 files |
| Reconstructing %s |
| Building %s |
| Cannot repair archive with old format |
| Found %s |
| The archive header is corrupt. Mark archive as solid? |
| No files found |
| Unexpected end of archive |
| Reconstruct archive structure? |
| Searching for recovery record |
| Analyzing file data |
| Data recovery record not found |
| Data recovery record found |
| Sector %ld (offsets %lX...%lX) damaged |
| - data recovered |
| - cannot recover data |
| Adding the data recovery record |
| Erasing contents of drive %c: |
| WARNING: Cannot get %s owner and group |
| WARNING: Cannot get owner %s ID |
| WARNING: Cannot get group %s ID |
| ERROR: %s group and owner data are corrupt |
| WARNING: Cannot set %s owner and group |
| WARNING: Cannot read symbolic link %s |
| WARNING: Symbolic link %s already exists |
| Cannot create %s. Retry? |
| %-20s : packed data checksum error in volume %s |
| %s is read-only |
| WARNING: Cannot get %s security data |
| WARNING: Cannot set %s security data |
| ERROR: %s security data are corrupt |
| WARNING: Unknown format of %s security data |
| ERROR: %s stream data are corrupt |
| WARNING: Unknown format of %s stream data |
| ERROR: Invalid file name %s |
| Processing archive %s |
| WARNING: Attempting to correct the invalid file or directory name |
| WARNING: You need to start extraction from a previous volume to unpack %s |
| ERROR: Unknown option: %s |
| ERROR: '-' is expected in the beginning of: %s |
| ERROR: Corrupt data header found, ignored |
| WARNING: Unknown data header format, ignored |
| ERROR: Corrupt %s data block |
| Cannot read contents of %s |
| %s is not volume |
| ERROR: %s and %s belong to different sets |
| %d volumes missing |
| %d recovery volumes found |
| Nothing to reconstruct |
| Reconstruction impossible |
| Reconstructing... |
| Creating %s |
| Renaming %s to %s |
| Write error: only NTFS file system supports files larger than 4 GB |
| WARNING: FAT32 file system does not support 4 GB or larger files |
| WARNING: Cannot change attributes of %s |
| ERROR: default SFX module does not support RAR %d.%d archives |
| Cannot change the header encryption mode in already encrypted archive |
| Cannot email the file %s |
| RAR SFX archive |
| <Commands> |
| -x Extract from archive (default) |
| -t Test archive files |
| -v Verbosely list contents of archive |
| Total number of usual and recovery volumes must not exceed %d |
| volume %d |
| Cannot delete %s |
| Cannot move some files and directories to Recycle Bin |
| Calculating the checksum |
| Too large SFX archive. Windows cannot run the executable file exceeding 4 GB. |
| Calculating checksums of all volumes. |
| ERROR: Not enough disk space for %s. |
| You may need a newer version of RAR. |
| Unknown encryption method in %s |
| The specified password is incorrect. |
| Incorrect password for %s |
| Corrupt %d bytes at %08x %08x |
| %u blocks are recovered, %u blocks are relocated |
| Recovery record is corrupt. |
| Testing the recovery record |
| Failed |
| %s switch is not supported for RAR %d.x archive format. |
| Searching for identical files |
| %d found. |
| Unknown extra field in %s. |
| Corrupt %s extra field in %s. |
| Cannot copy %s to %s. |
| You need to unpack the entire archive to create file reference entries. |
| Copying data |
| Cannot create symbolic link %s |
| Cannot create hard link %s |
| You need to unpack the link target first |
| You may need to run RAR as administrator |
| Not enough memory for %d MB compression dictionary, changed to %d MB. |
| Please use a smaller compression dictionary. |
| Not enough memory to unpack the archive with %u GB compression dictionary. |
| 64-bit RAR version is necessary. |
| You may need to remove -tsp switch or run RAR as administrator to open this file. |
| Choose 'Ignore' to continue with the already read file part only, 'Ignore all' to do it for all read errors, 'Retry' to repeat read and 'Quit' to abort. |
| %s is archived incompletely because of read error. |
| %u files are archived incompletely because of read errors. |
| Directory with such name already exists |
| Keyboard input is not allowed when reading data from stdin |
| Password exceeds the maximum allowed length of %u characters and will be truncated. |
| Adjusting %s value to %s. |
| Operation failed |
| Skipping the encrypted archive %s |
| Original name |
| Original time |
| %s is renamed to %s |
| %u GB dictionary exceeds %u GB limit and needs more than %u GB memory to unpack. |
| Use -md%ug or -mdx%ug switches to extract anyway. |
| %u GB dictionary exceeds %u GB limit and not allowed when compressing data. |
| 64-bit self-extracting module is necessary for %u GB compression dictionary. |
| Skipping the potentially unsafe %s -> %s link. For archives from a trustworthy source use -ola to extract it anyway. |
| Truncated at the service block: %s |
| quick open information |
| recovery record |
| -mlp switch requires "Lock pages in memory" privilege. Do you wish to assign it to the current user account? |
| User privilege has been successfully assigned and will be activated after Windows restart. Restart now? |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 7.20.2.0 |
| ProductVersion | 7.20.2.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| ProductName | WinRAR |
| CompanyName | Alexander Roshal |
| FileDescription | Command line RAR |
| FileVersion (#2) | 7.20.2 |
| ProductVersion (#2) | 7.20.2 |
| InternalName | Command line RAR |
| LegalCopyright | Copyright © Alexander Roshal 1993-2025 |
| Resource LangID | English - United States |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-Dec-06 15:26:52 |
| Version | 0.0 |
| SizeofData | 75 |
| AddressOfRawData | 0xae494 |
| PointerToRawData | 0xad894 |
| Referenced File | D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-Dec-06 15:26:52 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0xae4e0 |
| PointerToRawData | 0xad8e0 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-Dec-06 15:26:52 |
| Version | 0.0 |
| SizeofData | 1028 |
| AddressOfRawData | 0xae4f4 |
| PointerToRawData | 0xad8f4 |
| StartAddressOfRawData | 0x1400ae940 |
|---|---|
| EndAddressOfRawData | 0x1400ae948 |
| AddressOfIndex | 0x1400cc758 |
| AddressOfCallbacks | 0x14009e6b0 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x1400bba80 |
| GuardCFCheckFunctionPointer | 5369357768 |
| GuardCFDispatchFunctionPointer | 0 |
| GuardCFFunctionTable | 0 |
| GuardCFFunctionCount | 0 |
| GuardFlags | (EMPTY) |
| CodeIntegrity.Flags | 0 |
| CodeIntegrity.Catalog | 0 |
| CodeIntegrity.CatalogOffset | 0 |
| CodeIntegrity.Reserved | 0 |
| GuardAddressTakenIatEntryTable | 0 |
| GuardAddressTakenIatEntryCount | 0 |
| GuardLongJumpTargetTable | 0 |
| GuardLongJumpTargetCount | 0 |
| XOR Key | 0x2d1597cd |
|---|---|
| Unmarked objects | 0 |
| C++ objects (33145) | 152 |
| 253 (35207) | 2 |
| ASM objects (35207) | 8 |
| C objects (35207) | 17 |
| C++ objects (35207) | 52 |
| ASM objects (33145) | 11 |
| C objects (33145) | 14 |
| Imports (33145) | 11 |
| Total imports | 192 |
| C++ objects (35221) | 75 |
| Resource objects (35221) | 1 |
| Linker (35221) | 1 |