vertzah_client.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	vertzah_client.exe
size	32256 (0x7e00)
md5	1bd72ea92ad713e340e243e6cd1140a2

type	PE32+ executable (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

Rich Header

lib id	version	times used
147	30729	16
260	31328	10
259	31328	4
261	31328	26
257	31328	6
257	27412	9
1	0	147
265	31332	2
255	31332	1
258	31332	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	6
TimeDateStamp	0x62f64195
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.32
SizeOfCode	0x3c00
SizeOfInitializedData	0x4400
SizeOfUninitializedData	0
AddressOfEntryPoint	0x3f68
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0xc000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8160
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x3b07	0x3c00	R-X CODE
.rdata	0x5000	0x2ee6	0x3000	R-- IDATA
.data	0x8000	0x930	0x400	RW- IDATA
.pdata	0x9000	0x4ec	0x600	R-- IDATA
.rsrc	0xa000	0x1e0	0x200	R-- IDATA
.reloc	0xb000	0x98	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x6af4	0x140
RESOURCE	0xa000	0x1e0
EXCEPTION	0x9000	0x4ec
SECURITY	0	0
BASERELOC	0xb000	0x98
DEBUG	0x58a0	0x70
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x5760	0x140
Bound_IAT	0	0
IAT	0x5000	0x420
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
MANIFEST	#1	381	0

module_name	hint	function_name
KERNEL32.dll	1042	OpenProcess
KERNEL32.dll	254	CreateToolhelp32Snapshot
KERNEL32.dll	1075	Process32NextW
KERNEL32.dll	1073	Process32FirstW
KERNEL32.dll	137	CloseHandle
KERNEL32.dll	1607	lstrcmpW
KERNEL32.dll	1582	WriteProcessMemory
KERNEL32.dll	1423	Sleep
KERNEL32.dll	586	GetFileAttributesA
KERNEL32.dll	968	LoadLibraryA
KERNEL32.dll	696	GetProcAddress
KERNEL32.dll	1498	VirtualAllocEx
KERNEL32.dll	1148	ReadProcessMemory
KERNEL32.dll	234	CreateRemoteThread
KERNEL32.dll	1501	VirtualFreeEx
KERNEL32.dll	582	GetExitCodeProcess
KERNEL32.dll	1244	RtlLookupFunctionEntry
KERNEL32.dll	1251	RtlVirtualUnwind
KERNEL32.dll	1472	UnhandledExceptionFilter
KERNEL32.dll	1407	SetUnhandledExceptionFilter
KERNEL32.dll	544	GetCurrentProcess
KERNEL32.dll	1438	TerminateProcess
KERNEL32.dll	908	IsProcessorFeaturePresent
KERNEL32.dll	901	IsDebuggerPresent
KERNEL32.dll	641	GetModuleHandleW
KERNEL32.dll	1106	QueryPerformanceCounter
KERNEL32.dll	545	GetCurrentProcessId
KERNEL32.dll	549	GetCurrentThreadId
KERNEL32.dll	755	GetSystemTimeAsFileTime
KERNEL32.dll	879	InitializeSListHead
KERNEL32.dll	1237	RtlCaptureContext
USER32.dll	652	MessageBoxW
MSVCP140.dll	433	public: static unsigned __int64 __cdecl std::codecvt<char, char, struct _Mbstatet>::_Getcat(class std::locale::facet const * __ptr64 * __ptr64, class std::locale const * __ptr64) ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
MSVCP140.dll	1319	public: int __cdecl std::codecvt<char, char, struct _Mbstatet>::unshift(struct _Mbstatet & __ptr64, char * __ptr64, char * __ptr64, char * __ptr64 & __ptr64)const __ptr64 ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
MSVCP140.dll	47	protected: __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::basic_streambuf<char, struct std::char_traits<char> >(void) __ptr64 ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
MSVCP140.dll	960	public: class std::locale __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::getloc(void)const __ptr64 ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
MSVCP140.dll	501	protected: void __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::_Init(void) __ptr64 ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
MSVCP140.dll	1018	public: int __cdecl std::codecvt<char, char, struct _Mbstatet>::in(struct _Mbstatet & __ptr64, char const * __ptr64, char const * __ptr64, char const * __ptr64 & __ptr64, char * __ptr64, char * __ptr64, char * __ptr64 & __ptr64)const __ptr64 ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
MSVCP140.dll	1075	public: int __cdecl std::codecvt<char, char, struct _Mbstatet>::out(struct _Mbstatet & __ptr64, char const * __ptr64, char const * __ptr64, char const * __ptr64 & __ptr64, char * __ptr64, char * __ptr64, char * __ptr64 & __ptr64)const __ptr64 ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
MSVCP140.dll	969	public: static class std::locale::id std::codecvt<char, char, struct _Mbstatet>::id ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
MSVCP140.dll	586	protected: char * __ptr64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::_Pninc(void) __ptr64 ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
MSVCP140.dll	1221	public: void __cdecl std::basic_ios<char, struct std::char_traits<char> >::setstate(int, bool) __ptr64 ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
MSVCP140.dll	12	protected: __cdecl std::basic_ios<char, struct std::char_traits<char> >::basic_ios<char, struct std::char_traits<char> >(void) __ptr64 ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
MSVCP140.dll	26	public: __cdecl std::basic_istream<char, struct std::char_traits<char> >::basic_istream<char, struct std::char_traits<char> >(class std::basic_streambuf<char, struct std::char_traits<char> > * __ptr64, bool) __ptr64 ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
MSVCP140.dll	137	public: virtual __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::~basic_streambuf<char, struct std::char_traits<char> >(void) __ptr64 ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
MSVCP140.dll	1237	protected: virtual __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::showmanyc(void) __ptr64 ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
MSVCP140.dll	1347	protected: virtual __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::xsgetn(char * __ptr64, __int64) __ptr64 ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
MSVCP140.dll	1350	protected: virtual __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::xsputn(char const * __ptr64, __int64) __ptr64 ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
MSVCP140.dll	125	public: virtual __cdecl std::basic_ios<char, struct std::char_traits<char> >::~basic_ios<char, struct std::char_traits<char> >(void) __ptr64 ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
MSVCP140.dll	131	public: virtual __cdecl std::basic_istream<char, struct std::char_traits<char> >::~basic_istream<char, struct std::char_traits<char> >(void) __ptr64 ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
MSVCP140.dll	1165	public: class std::basic_istream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_istream<char, struct std::char_traits<char> >::read(char * __ptr64, __int64) __ptr64 ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
MSVCP140.dll	1183	public: class std::basic_istream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_istream<char, struct std::char_traits<char> >::seekg(__int64, int) __ptr64 ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
MSVCP140.dll	1283	public: class std::fpos<struct _Mbstatet> __cdecl std::basic_istream<char, struct std::char_traits<char> >::tellg(void) __ptr64 ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
MSVCP140.dll	669	public: bool __cdecl std::codecvt_base::always_noconv(void)const __ptr64 ?always_noconv@codecvt_base@std@@QEBA_NXZ
MSVCP140.dll	305	public: __cdecl std::locale::id::operator unsigned __int64(void) __ptr64 ??Bid@locale@std@@QEAA_KXZ
MSVCP140.dll	427	struct _iobuf * __ptr64 __cdecl std::_Fiopen(char const * __ptr64, int, int) ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
MSVCP140.dll	469	private: static class std::locale::_Locimp * __ptr64 __cdecl std::locale::_Getgloballocale(void) ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
MSVCP140.dll	109	public: __cdecl std::_Lockit::_Lockit(int) __ptr64 ??0_Lockit@std@@QEAA@H@Z
MSVCP140.dll	165	public: __cdecl std::_Lockit::~_Lockit(void) __ptr64 ??1_Lockit@std@@QEAA@XZ
MSVCP140.dll	654	void __cdecl std::_Xlength_error(char const * __ptr64) ?_Xlength_error@std@@YAXPEBD@Z
urlmon.dll	115	URLDownloadToFileA
WININET.dll	32	DeleteUrlCacheEntryA
VCRUNTIME140_1.dll		__CxxFrameHandler4
VCRUNTIME140.dll	8	__C_specific_handler
VCRUNTIME140.dll	27	__current_exception
VCRUNTIME140.dll	33	__std_exception_copy
VCRUNTIME140.dll	34	__std_exception_destroy
VCRUNTIME140.dll	60	memcpy
VCRUNTIME140.dll	1	_CxxThrowException
VCRUNTIME140.dll	28	__current_exception_context
VCRUNTIME140.dll	35	__std_terminate
VCRUNTIME140.dll	62	memset
VCRUNTIME140.dll	61	memmove
api-ms-win-crt-heap-l1-1-0.dll	24	free
api-ms-win-crt-heap-l1-1-0.dll	8	_callnewh
api-ms-win-crt-heap-l1-1-0.dll	25	malloc
api-ms-win-crt-heap-l1-1-0.dll	22	_set_new_mode
api-ms-win-crt-filesystem-l1-1-0.dll	36	_unlock_file
api-ms-win-crt-filesystem-l1-1-0.dll	63	remove
api-ms-win-crt-filesystem-l1-1-0.dll	22	_lock_file
api-ms-win-crt-utility-l1-1-0.dll	27	rand
api-ms-win-crt-runtime-l1-1-0.dll	66	_set_app_type
api-ms-win-crt-runtime-l1-1-0.dll	64	_seh_filter_exe
api-ms-win-crt-runtime-l1-1-0.dll	40	_get_initial_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll	54	_initterm
api-ms-win-crt-runtime-l1-1-0.dll	55	_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll	22	_cexit
api-ms-win-crt-runtime-l1-1-0.dll	35	_exit
api-ms-win-crt-runtime-l1-1-0.dll	4	__p___argc
api-ms-win-crt-runtime-l1-1-0.dll	5	__p___argv
api-ms-win-crt-runtime-l1-1-0.dll	30	_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll	61	_register_thread_local_exe_atexit_callback
api-ms-win-crt-runtime-l1-1-0.dll	60	_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll	52	_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll	103	terminate
api-ms-win-crt-runtime-l1-1-0.dll	51	_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll	24	_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll	57	_invalid_parameter_noinfo_noreturn
api-ms-win-crt-runtime-l1-1-0.dll	85	exit
api-ms-win-crt-runtime-l1-1-0.dll	21	_c_exit
api-ms-win-crt-environment-l1-1-0.dll	16	getenv
api-ms-win-crt-stdio-l1-1-0.dll	57	_get_stream_buffer_pointers
api-ms-win-crt-stdio-l1-1-0.dll	47	_fseeki64
api-ms-win-crt-stdio-l1-1-0.dll	120	fgetc
api-ms-win-crt-stdio-l1-1-0.dll	116	fclose
api-ms-win-crt-stdio-l1-1-0.dll	119	fflush
api-ms-win-crt-stdio-l1-1-0.dll	127	fputc
api-ms-win-crt-stdio-l1-1-0.dll	131	fread
api-ms-win-crt-stdio-l1-1-0.dll	138	fwrite
api-ms-win-crt-stdio-l1-1-0.dll	152	setvbuf
api-ms-win-crt-stdio-l1-1-0.dll	136	fsetpos
api-ms-win-crt-stdio-l1-1-0.dll	1	__p__commode
api-ms-win-crt-stdio-l1-1-0.dll	157	ungetc
api-ms-win-crt-stdio-l1-1-0.dll	84	_set_fmode
api-ms-win-crt-stdio-l1-1-0.dll	121	fgetpos
api-ms-win-crt-math-l1-1-0.dll	9	__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll	8	_configthreadlocale

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	26672	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK