memrs-540a5fb39194d46f.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	memrs-540a5fb39194d46f.exe
size	612352 (0x95800)
md5	8bd11fb637dd2c50c402be764ffad00b

type	PE32+ executable (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf8

Rich Header

lib id	version	times used
147	30729	12
257	24123	2
259	24123	2
261	24123	21
260	24123	10
257	23917	11
1	0	161
0	0	12
258	24210	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	7
TimeDateStamp	0x589617ce
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.0
SizeOfCode	0x6e800
SizeOfInitializedData	0x26c00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x6ecf0
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x9a000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8160
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ 8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x6e718	0x6e800	R-X CODE
.rdata	0x70000	0x201f0	0x20200	R-- IDATA
.data	0x91000	0x5d8	0x600	RW- IDATA
.pdata	0x92000	0x4fe0	0x5000	R-- IDATA
.gfids	0x97000	0x20	0x200	R-- IDATA
.tls	0x98000	2	0x200	RW- IDATA
.reloc	0x99000	0xea4	0x1000	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x8f52c	0xf0
RESOURCE	0	0
EXCEPTION	0x92000	0x4fe0
SECURITY	0	0
BASERELOC	0x99000	0xea4
DEBUG	0x80370	0x54
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x80468	0x28
LOAD_CONFIG	0x803d0	0x94
Bound_IAT	0	0
IAT	0x70000	0x378
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x140098000	0x140098001	0x140091548	0x1400703c8	0	0x100000

module_name	hint	function_name
KERNEL32.dll	1025	OpenProcess
KERNEL32.dll	721	GetStdHandle
KERNEL32.dll	509	GetConsoleMode
KERNEL32.dll	738	GetSystemInfo
KERNEL32.dll	1279	SetConsoleTextAttribute
KERNEL32.dll	515	GetConsoleScreenBufferInfo
KERNEL32.dll	269	DeleteCriticalSection
KERNEL32.dll	132	CloseHandle
KERNEL32.dll	1435	TlsGetValue
KERNEL32.dll	1436	TlsSetValue
KERNEL32.dll	1410	SwitchToThread
KERNEL32.dll	1326	SetLastError
KERNEL32.dll	607	GetLastError
KERNEL32.dll	569	GetEnvironmentVariableW
KERNEL32.dll	536	GetCurrentProcess
KERNEL32.dll	472	GetCommandLineW
KERNEL32.dll	1127	ReadFile
KERNEL32.dll	1547	WriteFile
KERNEL32.dll	860	InitializeCriticalSection
KERNEL32.dll	305	EnterCriticalSection
KERNEL32.dll	947	LeaveCriticalSection
KERNEL32.dll	351	ExitProcess
KERNEL32.dll	1089	QueryPerformanceCounter
KERNEL32.dll	1090	QueryPerformanceFrequency
KERNEL32.dll	744	GetSystemTimeAsFileTime
KERNEL32.dll	985	Module32NextW
KERNEL32.dll	685	GetProcAddress
KERNEL32.dll	964	LocalFree
KERNEL32.dll	428	FreeLibrary
KERNEL32.dll	200	CreateFileW
KERNEL32.dll	583	GetFileInformationByHandle
KERNEL32.dll	285	DeviceIoControl
KERNEL32.dll	537	GetCurrentProcessId
KERNEL32.dll	424	FormatMessageW
KERNEL32.dll	238	CreateThread
KERNEL32.dll	1433	TlsAlloc
KERNEL32.dll	1434	TlsFree
KERNEL32.dll	1546	WriteConsoleW
KERNEL32.dll	954	LoadLibraryW
KERNEL32.dll	540	GetCurrentThread
KERNEL32.dll	1218	RtlCaptureContext
KERNEL32.dll	19	AddVectoredExceptionHandler
KERNEL32.dll	691	GetProcessHeap
KERNEL32.dll	836	HeapAlloc
KERNEL32.dll	840	HeapFree
KERNEL32.dll	843	HeapReAlloc
KERNEL32.dll	247	CreateToolhelp32Snapshot
KERNEL32.dll	983	Module32FirstW
KERNEL32.dll	1058	Process32NextW
KERNEL32.dll	1056	Process32FirstW
KERNEL32.dll	630	GetModuleHandleW
KERNEL32.dll	1385	SetUnhandledExceptionFilter
KERNEL32.dll	1449	UnhandledExceptionFilter
KERNEL32.dll	887	IsDebuggerPresent
KERNEL32.dll	1232	RtlVirtualUnwind
KERNEL32.dll	1225	RtlLookupFunctionEntry
KERNEL32.dll	865	InitializeSListHead
KERNEL32.dll	541	GetCurrentThreadId
KERNEL32.dll	894	IsProcessorFeaturePresent
ADVAPI32.dll	532	OpenProcessToken
ADVAPI32.dll	192	CryptAcquireContextA
ADVAPI32.dll	219	CryptReleaseContext
ADVAPI32.dll	209	CryptGenRandom
USERENV.dll	38	GetUserProfileDirectoryW
SHELL32.dll	7	CommandLineToArgvW
VCRUNTIME140.dll	61	memmove
VCRUNTIME140.dll	62	memset
VCRUNTIME140.dll	14	__CxxFrameHandler3
VCRUNTIME140.dll	1	_CxxThrowException
VCRUNTIME140.dll	8	__C_specific_handler
VCRUNTIME140.dll	60	memcpy
VCRUNTIME140.dll	59	memcmp
api-ms-win-crt-math-l1-1-0.dll	9	__setusermatherr
api-ms-win-crt-math-l1-1-0.dll	195	fmax
api-ms-win-crt-math-l1-1-0.dll	190	floor
api-ms-win-crt-math-l1-1-0.dll	198	fmin
api-ms-win-crt-string-l1-1-0.dll	139	strlen
api-ms-win-crt-runtime-l1-1-0.dll	61	_register_thread_local_exe_atexit_callback
api-ms-win-crt-runtime-l1-1-0.dll	21	_c_exit
api-ms-win-crt-runtime-l1-1-0.dll	22	_cexit
api-ms-win-crt-runtime-l1-1-0.dll	5	__p___argv
api-ms-win-crt-runtime-l1-1-0.dll	4	__p___argc
api-ms-win-crt-runtime-l1-1-0.dll	52	_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll	60	_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll	30	_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll	103	terminate
api-ms-win-crt-runtime-l1-1-0.dll	35	_exit
api-ms-win-crt-runtime-l1-1-0.dll	85	exit
api-ms-win-crt-runtime-l1-1-0.dll	55	_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll	64	_seh_filter_exe
api-ms-win-crt-runtime-l1-1-0.dll	54	_initterm
api-ms-win-crt-runtime-l1-1-0.dll	24	_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll	51	_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll	66	_set_app_type
api-ms-win-crt-runtime-l1-1-0.dll	40	_get_initial_narrow_environment
api-ms-win-crt-stdio-l1-1-0.dll	84	_set_fmode
api-ms-win-crt-stdio-l1-1-0.dll	1	__p__commode
api-ms-win-crt-locale-l1-1-0.dll	8	_configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll	24	free
api-ms-win-crt-heap-l1-1-0.dll	22	_set_new_mode

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	606768	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK