d73c9230811f1075d5697679b6007f5c15a90177991e238c5adc3ed55ce04988

info
MZ
PE
imports
exports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	d73c9230811f1075d5697679b6007f5c15a90177991e238c5adc3ed55ce04988
size	1429508 (0x15d004)
md5	1db3cfb81651db0ff82a937c69bce107

type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	0xb
TimeDateStamp	0
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x30f
Magic	0x10b
LinkerVersion	2.24
SizeOfCode	0x15ca00
SizeOfInitializedData	0x200
SizeOfUninitializedData	0x1800
AddressOfEntryPoint	0x306899
BaseOfCode	0x1000
BaseOfData	0x4f000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	1.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0x307000
SizeOfHeaders	0x400
CheckSum	0x15e9f7
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x4d754	0	R-X CODE IDATA
.data	0x4f000	0x3a4	0	RW- IDATA
.rdata	0x50000	0x15f50	0	R-- IDATA
.eh_fram	0x66000	0xe64	0	R-- IDATA
.bss	0x67000	0x1750	0	RW- UDATA
.edata	0x69000	0x1d4	0	R-- IDATA
.idata	0x6a000	0x106c	0	RW- IDATA
.CRT	0x6c000	0x18	0	RW- IDATA
.tls	0x6d000	0x20	0x200	RW- IDATA
.nice020	0x6e000	0x13b92c	0	R-X CODE IDATA
.nice021	0x1aa000	0x15c8b0	0x15ca00	R-X CODE IDATA

Data Directory

type	va	size
EXPORT	0x1e53f4	0x1d4
IMPORT	0x1e41e0	0xf0
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x1f43f0	0x28
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x304000	0x9c
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x46d001	0x46d01c	0x467d44	0x5f4408	0	0

module_name	hint	ord	function_name
ADVAPI32.DLL			RegisterServiceCtrlHandlerA
KERNEL32.dll			CloseHandle
msvcrt.dll			_chdir
msvcrt.dll			__getmainargs
WS2_32.dll			WSACleanup
WTSAPI32.dll			WTSSendMessageW
KERNEL32.dll			LoadLibraryA
USER32.dll			CharUpperBuffW
ADVAPI32.DLL			RegQueryValueExA
KERNEL32.dll			LocalAlloc
KERNEL32.dll			GetCurrentProcess
KERNEL32.dll			GetCurrentThread
KERNEL32.dll			LocalFree
KERNEL32.dll			GetModuleFileNameW
KERNEL32.dll			GetProcessAffinityMask
KERNEL32.dll			SetProcessAffinityMask
KERNEL32.dll			SetThreadAffinityMask
KERNEL32.dll			Sleep
KERNEL32.dll			ExitProcess
KERNEL32.dll			GetLastError
KERNEL32.dll			FreeLibrary
KERNEL32.dll			LoadLibraryA
KERNEL32.dll			GetModuleHandleA
ADVAPI32.DLL			OpenSCManagerW
ADVAPI32.DLL			EnumServicesStatusExW
ADVAPI32.DLL			OpenServiceW
ADVAPI32.DLL			QueryServiceConfigW
ADVAPI32.DLL			CloseServiceHandle

ord	entry_va	function_name
1	0x51980	luaJIT_BC_config
2	0x54bc0	luaJIT_BC_hider
3	0x51d20	luaJIT_BC_install
4	0x59a20	luaJIT_BC_ltn12
5	0x51100	luaJIT_BC_main
6	0x57520	luaJIT_BC_md5
7	0x5ae60	luaJIT_BC_mime
8	0x53560	luaJIT_BC_miner
9	0x55e60	luaJIT_BC_process
10	0x5b520	luaJIT_BC_socket
11	0x5f920	luaJIT_BC_socket_headers
12	0x5d5c0	luaJIT_BC_socket_http
13	0x5c220	luaJIT_BC_socket_url
14	0x54e20	luaJIT_BC_sysinfo
15	0x53fe0	luaJIT_BC_updater

module_name	release.exe
flags	0
timestamp	0
version	0.0
ordinal_base	1
nFunctions	15
nNames	15
Names(15)	0x1e5476
Functions(15)	0x1e541c
NameOrdinals(15)	0x1e5458

show previews

offset	size	type	comment
0	1429504	EXE	01/01/1970 00:00:00	#
15c1	15	HTM		#
15d000	4	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 1429508 bytes (1397 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x67d44