Memory from Process ID:
BaseAddress:
(possible MZ header found)
State:
Protect:
Type:
AllocationBase:
(possible MZ header found)
AllocationProtect:
RegionSize:
SectionName:
MappedFileName:
Process ID:
Module Name:
Arch: x64
Linker Time/Version:
Major:
Minor:
--Visual Studio (original)
--Visual Studio 97
--Visual Studio 6
--Visual Studio 2003
--Visual Studio 2003 .NET
--Visual Studio 2005
--Visual Studio 2008
--Visual Studio 2010
base address:
image size:
Linker Version:
PE Checksum:
Export Name:
ExportCount:
ExportLinkerTimeStamp:
Compare to file on disk:
MATCH
file not found
file read error
Invalid PE
PE mismatch
PE section mismatch
UNKNOWN_ERROR
Process ID:
Module Name:
base address:
image size:
Found hidden process PID
created
No hidden processes found
Unable to open modules for process ID
(PAGE_NOACCESS)
(PAGE_READONLY)
(PAGE_READWRITE)
(PAGE_WRITECOPY)
(PAGE_EXECUTE)
(PAGE_EXECUTE_READ)
(PAGE_EXECUTE_READWRITE)
(PAGE_EXECUTE_WRITECOPY)
(PAGE_GUARD)
(PAGE_NOCACHE)
(PAGE_WRITECOMBINE)
(MEM_COMMIT)
(MEM_RESERVE)
(MEM_DECOMMIT)
(MEM_RELEASE)
(MEM_FREE)
(MEM_PRIVATE)
(MEM_MAPPED)
(MEM_RESET)
(MEM_TOP_DOWN)
(MEM_WRITE_WATCH)
(MEM_PHYSICAL)
(MEM_ROTATE)
(MEM_LARGE_PAGES)
(MEM_4MB_PAGES)
PE header data
Dos magic :
Dos_lfanew :
NT_Machine :
NT_NumberofSections :
NT_TimeDateStamp :
NT_NumberofSymbols :
NT_SizeOfOptionalHeader :
NT_Characteristics :
NT_Magic :
NT_MajorLinkerVersion :
NT_MinorLinkerVersion :
NT_SizeOfCode :
NT_SizeOfInitializedData :
NT_SizeOfUninitializedData :
NT_AddressOfEntryPoint :
NT_BaseOfCode :
NT_BaseOfData :
NT_ImageBase :
NT_SectionAlignment :
NT_FileAlignment :
NT_MajorOperatingSystemVersion :
NT_MinorOperatingSystemVersion :
NT_MajorImageVersion :
NT_MinorImageVersion :
NT_MajorSubsystemVersion :
NT_MinorSubsystemVersion :
NT_Win32VersionValue :
NT_SizeOfImage :
NT_SizeOfHeaders :
NT_CheckSum :
NT_Subsystem :
NT_DllCharacteristics :
NT_SizeOfStackReserve :
NT_SizeOfStackCommit :
NT_SizeOfHeapReserve :
NT_SizeOfHeapCommit :
NT_LoaderFlags :
NT_NumberOfRvaAndSizes :
Sections Name SizeofRawData VirtualAddress Characteristics
----------------------------------------------------------------------------------