| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2024-Apr-27 21:31:19 |
| Detected languages |
English - United States
|
| Debug artifacts |
C:\Users\karag\Desktop\fxhgdfhdf\Gaming-Lag-Switch-main\x64\Release\GLS.pdb
|
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Cryptographic algorithms detected in the binary: | Uses constants related to CRC32 |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x108 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2024-Apr-27 21:31:19 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x43c00 |
| SizeOfInitializedData | 0x18e00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000004373C (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x61000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
CloseHandle
FreeConsole Beep WinExec CreateDirectoryA FreeLibrary InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId Sleep SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleHandleW CreateEventW DeleteCriticalSection InitializeCriticalSectionAndSpinCount CreateFileA GetModuleHandleA QueryPerformanceCounter IsProcessorFeaturePresent GetProcAddress QueryPerformanceFrequency LoadLibraryA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar GetCurrentProcessId |
|---|---|
| USER32.dll |
OpenClipboard
GetCapture DispatchMessageA GetWindowRect DestroyWindow SetWindowPos ShowWindow GetAsyncKeyState DefWindowProcA CreateWindowExA TranslateMessage PeekMessageA UnregisterClassA PostQuitMessage CloseClipboard GetDesktopWindow RegisterClassExA UpdateWindow GetKeyState GetCursorPos SetCursorPos ReleaseCapture ClientToScreen SetClipboardData GetClipboardData EmptyClipboard LoadCursorA IsChild GetForegroundWindow SetCapture SetCursor GetClientRect ScreenToClient |
| COMDLG32.dll |
GetOpenFileNameA
|
| SHELL32.dll |
ShellExecuteA
|
| d3d9.dll |
Direct3DCreate9
|
| MSVCP140.dll |
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_sleep _Query_perf_counter _Xtime_get_ticks ?uncaught_exceptions@std@@YAHXZ |
| IMM32.dll |
ImmReleaseContext
ImmGetContext ImmSetCompositionWindow |
| fwpuclnt.dll |
FwpmEngineOpen0
FwpmFilterDeleteById0 FwpmFilterAdd0 |
| VCRUNTIME140.dll |
__current_exception
__current_exception_context memset _CxxThrowException __std_exception_copy __std_exception_destroy memcpy memmove memchr strstr __C_specific_handler memcmp |
| api-ms-win-crt-stdio-l1-1-0.dll |
_fseeki64
_set_fmode __p__commode fread fsetpos ungetc _get_stream_buffer_pointers setvbuf fgetpos fwrite ftell __stdio_common_vsscanf fgetc __stdio_common_vsprintf fclose fflush _wfopen fputc __acrt_iob_func fseek |
| api-ms-win-crt-heap-l1-1-0.dll |
free
_set_new_mode malloc _callnewh |
| api-ms-win-crt-filesystem-l1-1-0.dll |
_lock_file
_unlock_file remove |
| api-ms-win-crt-convert-l1-1-0.dll |
mbstowcs
atoi |
| api-ms-win-crt-runtime-l1-1-0.dll |
_configure_narrow_argv
_initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type terminate _get_initial_narrow_environment _initterm _initterm_e _exit _invalid_parameter_noinfo_noreturn __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _beginthreadex exit _wassert _initialize_narrow_environment |
| api-ms-win-crt-string-l1-1-0.dll |
strncpy
strcmp |
| api-ms-win-crt-utility-l1-1-0.dll |
rand
qsort |
| api-ms-win-crt-math-l1-1-0.dll |
sqrtf
fmodf acosf __setusermatherr cosf sinf ceilf |
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
| VCRUNTIME140_1.dll |
__CxxFrameHandler4
|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2024-Apr-27 21:31:19 |
| Version | 0.0 |
| SizeofData | 100 |
| AddressOfRawData | 0x529e4 |
| PointerToRawData | 0x519e4 |
| Referenced File | C:\Users\karag\Desktop\fxhgdfhdf\Gaming-Lag-Switch-main\x64\Release\GLS.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2024-Apr-27 21:31:19 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x52a48 |
| PointerToRawData | 0x51a48 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2024-Apr-27 21:31:19 |
| Version | 0.0 |
| SizeofData | 932 |
| AddressOfRawData | 0x52a5c |
| PointerToRawData | 0x51a5c |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2024-Apr-27 21:31:19 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
| StartAddressOfRawData | 0x140052e20 |
|---|---|
| EndAddressOfRawData | 0x140052e28 |
| AddressOfIndex | 0x14005aa68 |
| AddressOfCallbacks | 0x140045850 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x14005a038 |
| XOR Key | 0x8b7b39bb |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 20 |
| C objects (VS2022 Update 4 (17.4.2) compiler 31935) | 9 |
| ASM objects (VS2022 Update 4 (17.4.2) compiler 31935) | 3 |
| C++ objects (VS2022 Update 4 (17.4.2) compiler 31935) | 28 |
| Imports (VS2022 Update 4 (17.4.2) compiler 31935) | 6 |
| Imports (VS2012 build 50727 / VS2005 build 50727) | 2 |
| C objects (30795) | 1 |
| Imports (30795) | 21 |
| Total imports | 284 |
| C++ objects (LTCG) (VS2022 Update 5 (17.5.0-2) compiler 32215) | 13 |
| Resource objects (VS2022 Update 5 (17.5.0-2) compiler 32215) | 1 |
| Linker (VS2022 Update 5 (17.5.0-2) compiler 32215) | 1 |