
=== MZ Header ===

                     signature:                     "MZ"
           bytes_in_last_block:        144          0x90
                blocks_in_file:          3             3
                    num_relocs:          0             0
             header_paragraphs:          4             4
          min_extra_paragraphs:          0             0
          max_extra_paragraphs:      65535        0xffff
                            ss:          0             0
                            sp:        184          0xb8
                      checksum:          0             0
                            ip:          0             0
                            cs:          0             0
            reloc_table_offset:         64          0x40
                overlay_number:          0             0
                     reserved0:          0             0
                        oem_id:          0             0
                      oem_info:          0             0
                     reserved2:          0             0
                     reserved3:          0             0
                     reserved4:          0             0
                     reserved5:          0             0
                     reserved6:          0             0
                        lfanew:        128          0x80

=== DOS STUB ===

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

=== PE Header ===

                     signature:             "PE\x00\x00"

# IMAGE_FILE_HEADER:
                       Machine:        332         0x14c  x86
              NumberOfSections:          3             3
                 TimeDateStamp:    "2022-03-15 23:42:27"
          PointerToSymbolTable:          0             0
               NumberOfSymbols:          0             0
          SizeOfOptionalHeader:        224          0xe0
               Characteristics:        290         0x122  EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                          32BIT_MACHINE

# IMAGE_OPTIONAL_HEADER32:
                         Magic:        267         0x10b  32-bit executable
                 LinkerVersion:                      8.0
                    SizeOfCode:     492544       0x78400
         SizeOfInitializedData:       1536         0x600
       SizeOfUninitializedData:          0             0
           AddressOfEntryPoint:     500382       0x7a29e
                    BaseOfCode:       8192        0x2000
                    BaseOfData:     507904       0x7c000
                     ImageBase:    4194304      0x400000
              SectionAlignment:       8192        0x2000
                 FileAlignment:        512         0x200
        OperatingSystemVersion:                      4.0
                  ImageVersion:                      0.0
              SubsystemVersion:                      4.0
                     Reserved1:          0             0
                   SizeOfImage:     524288       0x80000
                 SizeOfHeaders:        512         0x200
                      CheckSum:     540409       0x83ef9
                     Subsystem:          2             2  WINDOWS_GUI
            DllCharacteristics:      34112        0x8540  DYNAMIC_BASE, NX_COMPAT, NO_SEH
                                                          TERMINAL_SERVER_AWARE
            SizeOfStackReserve:    1048576      0x100000
             SizeOfStackCommit:       4096        0x1000
             SizeOfHeapReserve:    1048576      0x100000
              SizeOfHeapCommit:       4096        0x1000
                   LoaderFlags:          0             0
           NumberOfRvaAndSizes:         16          0x10

=== DATA DIRECTORY ===

  EXPORT        rva:0x       0   size:0x        0
  IMPORT        rva:0x   7a248   size:0x       53
  RESOURCE      rva:0x   7c000   size:0x      3b8
  EXCEPTION     rva:0x       0   size:0x        0
  SECURITY      rva:0x       0   size:0x        0
  BASERELOC     rva:0x   7e000   size:0x        c
  DEBUG         rva:0x       0   size:0x        0
  ARCHITECTURE  rva:0x       0   size:0x        0
  GLOBALPTR     rva:0x       0   size:0x        0
  TLS           rva:0x       0   size:0x        0
  LOAD_CONFIG   rva:0x       0   size:0x        0
  Bound_IAT     rva:0x       0   size:0x        0
  IAT           rva:0x    2000   size:0x        8
  Delay_IAT     rva:0x       0   size:0x        0
  CLR_Header    rva:0x    2008   size:0x       48
                rva:0x       0   size:0x        0

=== SECTIONS ===

  NAME          RVA      VSZ   RAW_SZ  RAW_PTR  nREL  REL_PTR nLINE LINE_PTR     FLAGS
  .text        2000    782a4    78400      200     0        0     0        0  60000020  R-X CODE
  .rsrc       7c000      3b8      400    78600     0        0     0        0  40000040  R-- IDATA
  .reloc      7e000        c      200    78a00     0        0     0        0  42000040  R-- IDATA DISCARDABLE

=== RESOURCES ===

FILE_OFFSET    CP  LANG     SIZE  TYPE          NAME
    0x78658  1252 0x409      864  VERSION       #1

=== IMPORTS ===

MODULE_NAME      HINT   ORD  FUNCTION_NAME
mscoree.dll         0        _CorExeMain

=== VERSION INFO ===

# VS_FIXEDFILEINFO:
  FileVersion         :  934.864.230.656
  ProductVersion      :  886.816.416.565
  StrucVersion        :  0x10000
  FileFlagsMask       :  0x3f
  FileFlags           :  0
  FileOS              :  4
  FileType            :  0
  FileSubtype         :  0

# StringTable 040904b0:
  ProductName         :  "c4Pxy9GG7NzdzzNJ"
  CompanyName         :  "WADJF2m6ocg37Y5rfeE3whBg1"
  InternalName        :  "eXUMHAyDeZuVjBZb6NeM9mnJGQIQY.exe"
  LegalCopyright      :  "8YRGZwsWffY46y7RvDrfl"
  Comments            :  "Lh8fpLF02OgcwHEps7MapnbF"
  OriginalFilename    :  "SMmtFvx8KNdHv2ZQbcKPLD0NNw.exe"
  ProductVersion      :  "886.816.416.565"
  FileVersion         :  "934.864.230.656"

  VarFileInfo         :  [ 0x409, 0x514 ]

=== Packer / Compiler ===

  MS Visual C# / Basic .NET
