Manalyze report for 00a7f60cd40f5da961265de7026c77b35d8e7629587c53c935e7bea4d2f9e5ae

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Jul-16 11:14:13
Detected languages	English - United States
TLS Callbacks	2 callback(s) detected.
Debug artifacts	Embedded COFF debugging symbols

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`Tries to detect virtualized environments: HARDWARE\DESCRIPTION\System` `Contains domain names: .gameloft.com .oac-head.com cdn.oac-head.com confirmation.oac-head.com gameloft.com gllive.oac-head.com http://129.159.147.18 http://129.159.147.18/game/patches/manifest.txt https://cdn.oac-head.com https://cdn.oac-head.com/assets/client_assets.zip https://discord.gg https://oac-head.com oac-head.com scroll.info`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to MD5` `Microsoft's Cryptography API`
Suspicious	The PE is possibly packed.	`Unusual section name found: .xdata`
Suspicious	The PE contains functions most legitimate programs don't use.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryA` `Can access the registry: RegCloseKey RegEnumValueA RegOpenKeyExA RegQueryInfoKeyA RegQueryValueExA` `Possibly launches other programs: CreateProcessA ShellExecuteA` `Uses Windows's Native API: ntohl ntohs` `Uses Microsoft's cryptographic API: CRYPTO_free` `Has Internet access capabilities: WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest` `Leverages the raw socket API to access the Internet: WSACleanup WSAGetLastError WSAStartup __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyname gethostname getsockname getsockopt htonl htons inet_addr inet_ntoa ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt shutdown socket` `Manipulates other processes: ReadProcessMemory` `Reads the contents of the clipboard: GetClipboardData`
Suspicious	The file contains overlay data.	`30170 bytes of data starting at offset 0xcc1c00.`
Suspicious	No VirusTotal score.	`This file has never been scanned on VirusTotal.`

Hashes

MD5	`3b340ba2a9539e9eec95ca7404d15296`
SHA1	`be27ed29d24dfbcadf3364ba5ffe2a87596beabf`
SHA256	`00a7f60cd40f5da961265de7026c77b35d8e7629587c53c935e7bea4d2f9e5ae`
SHA3	`60973784a1c06cf974c65bc5f542f34d44d6a45831ebe747a04deb386ccc6197`
SSDeep	`98304:LuY0YQ6+A8ScfNQeVkaXkuOllkyik2VJ4ttJYYssJURWY/Wx8/XG0IkZXeWUbxYB:Lu/6+AgVXk3jkLVfYszRWW/XG0IkZAk`
Imports Hash	`44b25a77946f405a1ba5413512b9a47e`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`10`
TimeDateStamp	2026-Jul-16 11:14:13
PointerToSymbolTable	`0xcc1c00`
NumberOfSymbols	`690`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_DEBUG_STRIPPED` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE` `IMAGE_FILE_LINE_NUMS_STRIPPED`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`2.0`
SizeOfCode	`0xa74800`
SizeOfInitializedData	`0x24d000`
SizeOfUninitializedData	`0x7de00`
AddressOfEntryPoint	`0x00000000000013E0 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`5.2`
Win32VersionValue	`0`
SizeOfImage	`0xd46000`
SizeOfHeaders	`0x400`
Checksum	`0xcd4ea2`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT`
SizeofStackReserve	`0x200000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`036864aed39ee3297a1b1fcddf65ece3`
SHA1	`33f3cdb83fc9913ebb424d0b1bd429425f2862db`
SHA256	`3d523b909e17afa66bc05760d3ff6f1c414a20095606ae4b470c842bc9027c2c`
SHA3	`c14212155b5a4a8d826b592e06cadfac8bc6de503e798f6274e12351ffea3767`
VirtualSize	`0xa74670`
VirtualAddress	`0x1000`
SizeOfRawData	`0xa74800`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.3051`

.data

MD5	`ee483351e279ba4858adc9b4fa2d6575`
SHA1	`aed274a60c620dbb8f311ae30000b26a59744b8a`
SHA256	`a59a90fccdb0a545b7073b0d1e6379074fa5da98f460acccd2c2613fb51953e4`
SHA3	`ecdbde84f09eb7c86b28b5a14f8934d0237a00fa3db3e5dbddb5632734e8659e`
VirtualSize	`0xd300`
VirtualAddress	`0xa76000`
SizeOfRawData	`0xd400`
PointerToRawData	`0xa74c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.54845`

.rdata

MD5	`b72b3b1505967c56df09f707d087e757`
SHA1	`e960e87bb644c77162193d35e0c3a57092ad6e00`
SHA256	`89d0151462a97d5746d027dd532a8d320fb5c9a4f1f06121bca58ff2b0b1219c`
SHA3	`e2236971a2a46844f72db054e5ebac63e77025755626704f9092a66eccbf88fe`
VirtualSize	`0x108020`
VirtualAddress	`0xa84000`
SizeOfRawData	`0x108200`
PointerToRawData	`0xa82000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.35514`

.pdata

MD5	`685141a1e164e4679cb01992f2972afd`
SHA1	`825842cf1a6fc050ff61a942369273dc0881e1f8`
SHA256	`0b82f8db1363ca6736bb718986aa74d08b651ac23a78176928190330284bb8f0`
SHA3	`9cef702a6a86b2d293e605e976a90197f4b8c72e7a4e29eaf5c5172ac6b598e8`
VirtualSize	`0x56c88`
VirtualAddress	`0xb8d000`
SizeOfRawData	`0x56e00`
PointerToRawData	`0xb8a200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.49861`

.xdata

MD5	`0a491a6c23f918353c7e0bba2d812cdb`
SHA1	`037faa21bdfb15ea33e24a78c7984af0e9bf058f`
SHA256	`e5345fecce867b22f630d00f3c016bbe1900568238a65cffb15e965c8f9c6c3c`
SHA3	`dedb9865875252202bffc018103b5962ed5dcb1de2607bd20a2df78f9f0a6f12`
VirtualSize	`0x8e66c`
VirtualAddress	`0xbe4000`
SizeOfRawData	`0x8e800`
PointerToRawData	`0xbe1000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.30854`

.bss

MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a`
VirtualSize	`0x7ddb0`
VirtualAddress	`0xc73000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.idata

MD5	`f3fc8396b3ce96e82d1e60b4627e9b42`
SHA1	`e468a67361a1b8d4b95892522582465bc61c7cc8`
SHA256	`a426987bbc117c5a03819c70781b83806dd75ab521c5d1077d2b75cf0277a255`
SHA3	`0b1ca8d0d087307a9a83da994b91c97a84ed534e8f87108a0e893f363fb8b4e6`
VirtualSize	`0x6850`
VirtualAddress	`0xcf1000`
SizeOfRawData	`0x6a00`
PointerToRawData	`0xc6f800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.90063`

.tls

MD5	`bf619eac0cdf3f68d496ea9344137e8b`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59`
VirtualSize	`0x10`
VirtualAddress	`0xcf8000`
SizeOfRawData	`0x200`
PointerToRawData	`0xc76200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`ede43082fdbb4df09e5acf6d583202eb`
SHA1	`68c9e0156d43deab8cf73b0430940f744b91df3c`
SHA256	`20a77304e98493a42c1ea3e1b5984997becfe009b15111f47d0a1e5bb7f94795`
SHA3	`2d935576d659d8bd4ce96594837c29da74b2635e3f4cd646ace598aec81381b8`
VirtualSize	`0x35190`
VirtualAddress	`0xcf9000`
SizeOfRawData	`0x35200`
PointerToRawData	`0xc76400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.99377`

.reloc

MD5	`706d4de69385828264025ff6f9f90232`
SHA1	`7e9a4d66bb470b04d611b055fbd307bec7fe44a0`
SHA256	`b9848fcbb4aed103cfdb4ea7b632b32e75f8569ecbc83be66080c82425e209e9`
SHA3	`06d6c2572a5d4a73a4ae66b16db47d7df236151dfe2d713716ee102236cbce7f`
VirtualSize	`0x16598`
VirtualAddress	`0xd2f000`
SizeOfRawData	`0x16600`
PointerToRawData	`0xcab600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.44001`

Imports

ADVAPI32.dll	`GetUserNameA` `RegCloseKey` `RegEnumValueA` `RegOpenKeyExA` `RegQueryInfoKeyA` `RegQueryValueExA`
COMCTL32.dll	`InitCommonControlsEx`
dbghelp.dll	`MiniDumpWriteDump`
libgcc_s_seh-1.dll	`_Unwind_Resume`
GDI32.dll	`ChoosePixelFormat` `CreateFontW` `DeleteObject` `DescribePixelFormat` `GetPixelFormat` `SetPixelFormat` `SwapBuffers`
KERNEL32.dll	`AllocConsole` `CloseHandle` `CopyFileA` `CreateDirectoryA` `CreateEventA` `CreateFileA` `CreateMutexExA` `CreateProcessA` `CreateThread` `DeleteCriticalSection` `DeleteFileA` `EnterCriticalSection` `FindClose` `FindFirstFileA` `FindNextFileA` `FreeConsole` `FreeLibrary` `GetCurrentDirectoryA` `GetCurrentProcess` `GetCurrentProcessId` `GetCurrentThread` `GetCurrentThreadId` `GetEnvironmentVariableA` `GetExitCodeProcess` `GetFileAttributesA` `GetFileAttributesExA` `GetLastError` `GetLocalTime` `GetModuleFileNameA` `GetModuleHandleA` `GetPrivateProfileIntA` `GetPrivateProfileStringA` `GetProcAddress` `GetStdHandle` `GetSystemInfo` `GetThreadContext` `GetTickCount` `GetVersionExA` `GlobalAlloc` `GlobalLock` `GlobalMemoryStatus` `GlobalUnlock` `InitializeCriticalSection` `LeaveCriticalSection` `LoadLibraryA` `MoveFileA` `MultiByteToWideChar` `OutputDebugStringA` `QueryPerformanceCounter` `QueryPerformanceFrequency` `ReadConsoleA` `ReadFileEx` `ReadProcessMemory` `ReleaseMutex` `RemoveDirectoryA` `ResetEvent` `ResumeThread` `RtlCaptureContext` `SetConsoleMode` `SetCurrentDirectoryA` `SetEvent` `SetLastError` `SetThreadAffinityMask` `SetThreadPriority` `SetUnhandledExceptionFilter` `Sleep` `SleepEx` `SuspendThread` `TerminateProcess` `TlsGetValue` `TryEnterCriticalSection` `VirtualProtect` `VirtualQuery` `WaitForSingleObject` `WaitForSingleObjectEx` `WideCharToMultiByte` `WriteConsoleA` `WritePrivateProfileStringA` `__C_specific_handler` `lstrcmpiA`
msvcrt.dll	`___lc_codepage_func` `___mb_cur_max_func` `__argc` `__argv` `__getmainargs` `__initenv` `__iob_func` `__set_app_type` `__setusermatherr` `_amsg_exit` `_cexit` `_chdir` `_commode` `_ctime64` `_errno` `_fdopen` `_findclose` `_findfirst64` `_findnext64` `_fmode` `_fullpath` `_gcvt` `_getcwd` `_gmtime64` `_initterm` `_isnan` `_itoa` `_localtime64` `_lock` `_mktime64` `_open_osfhandle` `_setjmp` `_snprintf` `_snwprintf` `_strdup` `_stricmp` `_strnicmp` `_strtoi64` `_strtoui64` `_strtoui64` `_time64` `_unlock` `_vscprintf` `_vsnprintf` `_wcsicmp` `_wcstoui64` `abort` `acos` `asin` `atan` `atexit` `atof` `atoi` `atol` `calloc` `clearerr` `exit` `fclose` `feof` `fflush` `fgets` `fopen` `fprintf` `fputc` `fputs` `fputwc` `fread` `free` `fseek` `fwprintf` `ftell` `fwrite` `getc` `getenv` `isalpha` `isdigit` `isleadbyte` `isspace` `isxdigit` `localeconv` `log10` `longjmp` `malloc` `memchr` `memcmp` `memcpy` `memmove` `memset` `qsort` `remove` `rand` `realloc` `rename` `setlocale` `signal` `srand` `strcat` `strchr` `strcmp` `strcpy` `strerror` `strftime` `strlen` `strncat` `strncmp` `strncpy` `strpbrk` `strrchr` `strstr` `strtol` `strtoul` `tan` `tolower` `toupper` `ungetc` `vfprintf` `wcscat` `wcscmp` `wcscpy` `wcslen` `wcsncpy` `wcstombs`
OPENGL32.dll	`glBindTexture` `glBlendFunc` `glClear` `glClearColor` `glClearDepth` `glClearStencil` `glColorMask` `glCopyTexSubImage2D` `glCullFace` `glDeleteTextures` `glDepthFunc` `glDepthMask` `glDepthRange` `glDisable` `glDrawArrays` `glDrawElements` `glEnable` `glFlush` `glFrontFace` `glGenTextures` `glGetError` `glGetFloatv` `glGetIntegerv` `glGetString` `glLineWidth` `glPixelStorei` `glPointSize` `glPolygonMode` `glPolygonOffset` `glReadPixels` `glScissor` `glStencilFunc` `glStencilMask` `glStencilOp` `glTexImage2D` `glTexParameterf` `glTexParameteri` `glTexSubImage2D` `glViewport` `wglCreateContext` `wglDeleteContext` `wglGetProcAddress` `wglMakeCurrent`
libwinpthread-1.dll	`nanosleep64` `pthread_cond_destroy` `pthread_cond_init` `pthread_cond_signal` `pthread_cond_timedwait` `pthread_create` `pthread_exit` `pthread_join` `pthread_kill` `pthread_mutex_destroy` `pthread_mutex_init` `pthread_mutex_lock` `pthread_mutex_trylock` `pthread_mutex_unlock` `pthread_self` `pthread_setcanceltype` `pthread_testcancel`
SHELL32.dll	`ShellExecuteA`
SHLWAPI.dll	`PathFindExtensionA`
libstdc++-6.dll	`_ZNKSt12__basic_fileIcE7is_openEv` `_ZNKSt5ctypeIcE13_M_widen_initEv` `_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE12find_last_ofEPKcyy` `_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE13find_first_ofEPKcyy` `_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE16find_last_not_ofEPKcyy` `_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE17find_first_not_ofEPKcyy` `_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4findEPKcyy` `_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4findEcy` `_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5rfindEPKcyy` `_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5rfindEcy` `_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6substrEyy` `_ZNKSt7__cxx1115basic_stringbufIcSt11char_traitsIcESaIcEE3strEv` `_ZNKSt8__detail20_Prime_rehash_policy14_M_need_rehashEyyy` `_ZNKSt9exception4whatEv` `_ZNSi4readEPcx` `_ZNSi5seekgExSt12_Ios_Seekdir` `_ZNSi5tellgEv` `_ZNSo3putEc` `_ZNSo5flushEv` `_ZNSo5writeEPKcx` `_ZNSo9_M_insertIdEERSoT_` `_ZNSo9_M_insertImEERSoT_` `_ZNSo9_M_insertIyEERSoT_` `_ZNSolsEi` `_ZNSt12__basic_fileIcED1Ev` `_ZNSt13basic_filebufIcSt11char_traitsIcEE4openEPKcSt13_Ios_Openmode` `_ZNSt13basic_filebufIcSt11char_traitsIcEE5closeEv` `_ZNSt13basic_filebufIcSt11char_traitsIcEEC1Ev` `_ZNSt13basic_filebufIcSt11char_traitsIcEED1Ev` `_ZNSt13basic_fstreamIcSt11char_traitsIcEED1Ev` `_ZNSt13runtime_errorC1EPKc` `_ZNSt13runtime_errorC1ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE` `_ZNSt13runtime_errorD1Ev` `_ZNSt14basic_ifstreamIcSt11char_traitsIcEED1Ev` `_ZNSt14basic_ofstreamIcSt11char_traitsIcEEC1EPKcSt13_Ios_Openmode` `_ZNSt14basic_ofstreamIcSt11char_traitsIcEED1Ev` `_ZNSt15basic_streambufIcSt11char_traitsIcEE4syncEv` `_ZNSt15basic_streambufIcSt11char_traitsIcEE5imbueERKSt6locale` `_ZNSt15basic_streambufIcSt11char_traitsIcEE5uflowEv` `_ZNSt15basic_streambufIcSt11char_traitsIcEE6xsgetnEPcx` `_ZNSt15basic_streambufIcSt11char_traitsIcEE6xsputnEPKcx` `_ZNSt6localeC1Ev` `_ZNSt6localeD1Ev` `_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE10_M_disposeEv` `_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE10_M_replaceEyyPKcy` `_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE12_M_constructEyc` `_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE14_M_replace_auxEyyyc` `_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6appendEPKc` `_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6appendEPKcy` `_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6resizeEyc` `_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE7reserveEy` `_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE8_M_eraseEyy` `_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_appendEPKcy` `_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_assignERKS4_` `_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_createERyy` `_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_mutateEyyPKcy` `_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EOS4_` `_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE10_M_disposeEv` `_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE10_M_replaceEyyPKwy` `_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE9_M_assignERKS4_` `_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE9_M_createERyy` `_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE9_M_mutateEyyPKwy` `_ZNSt7__cxx1115basic_stringbufIcSt11char_traitsIcESaIcEE7_M_syncEPcyy` `_ZNSt7__cxx1118basic_stringstreamIcSt11char_traitsIcESaIcEEC1Ev` `_ZNSt7__cxx1118basic_stringstreamIcSt11char_traitsIcESaIcEED1Ev` `_ZNSt7__cxx1119basic_istringstreamIcSt11char_traitsIcESaIcEED1Ev` `_ZNSt7__cxx1119basic_ostringstreamIcSt11char_traitsIcESaIcEEC1Ev` `_ZNSt7__cxx1119basic_ostringstreamIcSt11char_traitsIcESaIcEED1Ev` `_ZNSt8__detail15_List_node_base11_M_transferEPS0_S1_` `_ZNSt8__detail15_List_node_base7_M_hookEPS0_` `_ZNSt8__detail15_List_node_base9_M_unhookEv` `_ZNSt8ios_baseC2Ev` `_ZNSt8ios_baseD2Ev` `_ZNSt9basic_iosIcSt11char_traitsIcEE4initEPSt15basic_streambufIcS1_E` `_ZNSt9basic_iosIcSt11char_traitsIcEE5clearESt12_Ios_Iostate` `_ZNSt9exceptionD2Ev` `_ZSt16__ostream_insertIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_PKS3_x` `_ZSt16__throw_bad_castv` `_ZSt17__throw_bad_allocv` `_ZSt18_Rb_tree_decrementPSt18_Rb_tree_node_base` `_ZSt18_Rb_tree_incrementPSt18_Rb_tree_node_base` `_ZSt19__throw_logic_errorPKc` `_ZSt20__throw_length_errorPKc` `_ZSt24__throw_out_of_range_fmtPKcz` `_ZSt28_Rb_tree_rebalance_for_erasePSt18_Rb_tree_node_baseRS_` `_ZSt28__throw_bad_array_new_lengthv` `_ZSt29_Rb_tree_insert_and_rebalancebPSt18_Rb_tree_node_baseS0_RS_` `_ZSt7getlineIcSt11char_traitsIcESaIcEERSt13basic_istreamIT_T0_ES7_RNSt7__cxx1112basic_stringIS4_S5_T1_EES4_` `_ZSt7nothrow` `_ZTISd` `_ZTISi` `_ZTISo` `_ZTISt15basic_streambufIcSt11char_traitsIcEE` `_ZTTNSt7__cxx1118basic_stringstreamIcSt11char_traitsIcESaIcEEE` `_ZTTNSt7__cxx1119basic_istringstreamIcSt11char_traitsIcESaIcEEE` `_ZTTNSt7__cxx1119basic_ostringstreamIcSt11char_traitsIcESaIcEEE` `_ZTTSt13basic_fstreamIcSt11char_traitsIcEE` `_ZTTSt14basic_ifstreamIcSt11char_traitsIcEE` `_ZTTSt14basic_ofstreamIcSt11char_traitsIcEE` `_ZTVN10__cxxabiv117__class_type_infoE` `_ZTVN10__cxxabiv120__si_class_type_infoE` `_ZTVN10__cxxabiv121__vmi_class_type_infoE` `_ZTVNSt7__cxx1115basic_stringbufIcSt11char_traitsIcESaIcEEE` `_ZTVNSt7__cxx1118basic_stringstreamIcSt11char_traitsIcESaIcEEE` `_ZTVNSt7__cxx1119basic_istringstreamIcSt11char_traitsIcESaIcEEE` `_ZTVNSt7__cxx1119basic_ostringstreamIcSt11char_traitsIcESaIcEEE` `_ZTVSt13basic_filebufIcSt11char_traitsIcEE` `_ZTVSt13basic_fstreamIcSt11char_traitsIcEE` `_ZTVSt14basic_ifstreamIcSt11char_traitsIcEE` `_ZTVSt14basic_ofstreamIcSt11char_traitsIcEE` `_ZTVSt15basic_streambufIcSt11char_traitsIcEE` `_ZTVSt9basic_iosIcSt11char_traitsIcEE` `_ZnayRKSt9nothrow_t` `_ZnwyRKSt9nothrow_t` `__cxa_allocate_exception` `__cxa_begin_catch` `__cxa_call_unexpected` `__cxa_end_catch` `__cxa_free_exception` `__cxa_guard_abort` `__cxa_guard_acquire` `__cxa_guard_release` `__cxa_rethrow` `__cxa_throw` `__cxa_throw_bad_array_new_length` `__dynamic_cast` `__gxx_personality_seh0`
USER32.dll	`AdjustWindowRect` `BeginPaint` `ChangeDisplaySettingsA` `ClientToScreen` `CloseClipboard` `CreateWindowExA` `DefWindowProcA` `DestroyWindow` `DispatchMessageA` `EmptyClipboard` `EndPaint` `EnumDisplaySettingsA` `GetActiveWindow` `GetAsyncKeyState` `GetCapture` `GetClientRect` `GetClipboardData` `GetCursorPos` `GetDC` `GetFocus` `GetKeyboardState` `GetSystemMetrics` `GetWindowLongPtrA` `GetWindowPlacement` `GetWindowRect` `GetWindowTextA` `InvalidateRect` `LoadCursorA` `LoadIconA` `LoadImageA` `MessageBoxA` `MoveWindow` `OpenClipboard` `PeekMessageA` `PostQuitMessage` `RedrawWindow` `RegisterClassA` `RegisterClassExA` `ReleaseCapture` `ReleaseDC` `SendMessageA` `SendMessageTimeoutA` `SendMessageTimeoutW` `SetActiveWindow` `SetCapture` `SetClipboardData` `SetCursor` `SetCursorPos` `SetFocus` `SetForegroundWindow` `SetWindowLongPtrA` `SetWindowPos` `SetWindowTextA` `ShowWindow` `ToAscii` `TranslateMessage` `UpdateWindow`
VERSION.dll	`GetFileVersionInfoA` `GetFileVersionInfoSizeA` `VerQueryValueA`
WINHTTP.dll	`WinHttpAddRequestHeaders` `WinHttpCloseHandle` `WinHttpConnect` `WinHttpOpen` `WinHttpOpenRequest` `WinHttpQueryDataAvailable` `WinHttpQueryHeaders` `WinHttpReadData` `WinHttpReceiveResponse` `WinHttpSendRequest`
WINMM.dll	`timeBeginPeriod` `timeGetTime`
WS2_32.dll	`WSACleanup` `WSAGetLastError` `WSAStartup` `__WSAFDIsSet` `accept` `bind` `closesocket` `connect` `freeaddrinfo` `getaddrinfo` `gethostbyname` `gethostname` `getsockname` `getsockopt` `htonl` `htons` `inet_addr` `inet_ntoa` `ioctlsocket` `listen` `ntohl` `ntohs` `recv` `recvfrom` `select` `send` `sendto` `setsockopt` `shutdown` `socket`
zlib1.dll	`crc32` `deflate` `deflateEnd` `deflateInit2_` `deflateReset` `inflate` `inflateEnd` `inflateInit2_` `inflateInit_` `inflateReset`
libcrypto-3-x64.dll	`BIO_ctrl` `BIO_f_base64` `BIO_free` `BIO_free_all` `BIO_gets` `BIO_new` `BIO_new_mem_buf` `BIO_push` `BIO_s_mem` `BIO_set_flags` `BIO_write` `CRYPTO_free` `ERR_error_string` `ERR_get_error` `EVP_PKEY_free` `PEM_read_bio_X509` `RAND_poll` `RAND_seed` `RAND_status` `SHA256` `X509_NAME_print_ex` `X509_STORE_add_cert` `X509_STORE_new` `X509_free` `X509_get_issuer_name` `X509_get_pubkey` `X509_get_subject_name` `i2d_PUBKEY`
libopenal-1.dll	`alBufferData` `alDeleteBuffers` `alDeleteSources` `alDistanceModel` `alDopplerFactor` `alGenBuffers` `alGenSources` `alGetError` `alGetFloat` `alGetInteger` `alGetListenerfv` `alGetSourcef` `alGetSourcefv` `alGetSourcei` `alListener3f` `alListenerfv` `alSource3f` `alSourcePause` `alSourcePlay` `alSourceQueueBuffers` `alSourceStop` `alSourceUnqueueBuffers` `alSourcef` `alSourcei` `alSpeedOfSound` `alcCloseDevice` `alcCreateContext` `alcDestroyContext` `alcGetError` `alcMakeContextCurrent` `alcOpenDevice` `alcProcessContext` `alcSuspendContext`
libssl-3-x64.dll	`OPENSSL_init_ssl` `SSL_CTX_ctrl` `SSL_CTX_free` `SSL_CTX_new` `SSL_CTX_set_cert_store` `SSL_CTX_set_verify` `SSL_connect` `SSL_ctrl` `SSL_free` `SSL_get1_peer_certificate` `SSL_get_error` `SSL_get_verify_result` `SSL_new` `SSL_read` `SSL_set_fd` `SSL_shutdown` `SSL_write` `TLS_client_method`

Delayed Imports

1

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x3b1`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.75992`
Detected Filetype	PNG graphic file
MD5	`8b65153aabeb2878e62b71606a5cbd3c`
SHA1	`110a85bc7c17f8a216a834bd5e5cc5e3fd6bdb1e`
SHA256	`c260703a4f9aa6a4c411cf7e71cfea6a5062944a4dc66a2778012d7aab4e2259`
SHA3	`b7cab905e1c6b1996af8693c321b498105b42387203b627e2a54fd50f10de91a`

2

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x764`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.87639`
Detected Filetype	PNG graphic file
MD5	`c1c25205d050c9d9f347f1b26d56e3e9`
SHA1	`19b1367368f4687d9f81f15c7aa1c848c3ba0abd`
SHA256	`42c4fc3f7c7db744ac4d98bcb629bfb1a294df3b8f3c9ccb2e2a90005c954a01`
SHA3	`68ecfbfbfe9027d5395f121b6d2cffdf742703c32d7b5f2713df8888e7b86e70`

3

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0xc81`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.92124`
Detected Filetype	PNG graphic file
MD5	`0fb4335571d462dfab5dda8e03be18af`
SHA1	`95e6d85a167720565ed7359aef999d9f692f6428`
SHA256	`bc074c1aef72a2181faf2a7386176b7ff01328601f512dbb4113e2524caf64cc`
SHA3	`01d3f7f9ecb9f9eb131450bac6e46c6b804a425c93cc5ff8501282d24269982e`

4

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x1a46`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.95731`
Detected Filetype	PNG graphic file
MD5	`a978716ee0720ee4b3b53196d89eebec`
SHA1	`9a15e777a5a596794b218505626ab976bbf05068`
SHA256	`fd86f5f6d91ffadf4e1c88068b0470cae8995fd0f87989c1162c17403a42c547`
SHA3	`fc985f0077e82acf2442dcf4da52cb85795b7990eb3c96a2e20cbc3740705600`

5

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x2ca3`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.97467`
Detected Filetype	PNG graphic file
MD5	`669ebc538e33b16638c2157787132801`
SHA1	`9fb35d8d0e1eaffbabbf3497679cfd8ad026d209`
SHA256	`df472bc698fbf6590c5a35f462637b9b61ae4d00632d98b82ba1f08bdb324337`
SHA3	`23991192cba03c2284639e630ca2aad62012a2abb95c558af683d4ff79325827`

6

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0xa3cb`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.98677`
Detected Filetype	PNG graphic file
MD5	`b1c68374d8dede2cbb75aece8d3989e6`
SHA1	`777cbe696d6a3bbb22be7128632db1d9202b7dd0`
SHA256	`cb13e09ba80dbbd96fb77201d13eb9d6b17005a431c9ac29b5b12e17de803760`
SHA3	`482722b4f53ab8b9c4b05f7f1b002437710ed00b8e76b03dee99f22ec921cd9d`

7

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x24817`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99437`
Detected Filetype	PNG graphic file
MD5	`d2f86f27c8c9fd1f15d4d9d975ba51b4`
SHA1	`6ae2bf760dba79a552f6a26dae3eab6d6c992360`
SHA256	`c454050bc7f211fe22091f18bdedba803f68a22135e0ff8790350c8ca0d8d28e`
SHA3	`984587ea881b8a7efc12988ca4e442792b35f0ce36025641bd26d6baeaa5d959`

101

Type	`RT_GROUP_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x68`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.96412`
Detected Filetype	Icon file
MD5	`29d3bfba4135493d366bfc3d31d1bac3`
SHA1	`d5b7a76342d3abc0ac3ad4f18d18acc09df09d62`
SHA256	`166a21905e000703c0a768668545e7c2551cbc37ffa2d5a73f0edeb407e0b35f`
SHA3	`b9cba410b7d7ac92348b1b0025b7bec16f5552b2e9d5a49b112fccf45bf33ac1`

1 (#2)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x48f`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.13793`
MD5	`5aa04ce935e78505e230765e85c34355`
SHA1	`6c93b8c5fde8be4b2231dca6b8ec513cdc82c991`
SHA256	`a73f26a8d504043f785d7360e8febf2eeb8522ec873a0d4dd5d1d4bfd1e67d3d`
SHA3	`149467cafc03ba34b33cd8076fc2771413760822357952de205dbae2b5cb8059`

Version Info

TLS Callbacks

StartAddressOfRawData	`0x140cf8000`
EndAddressOfRawData	`0x140cf8008`
AddressOfIndex	`0x140cf028c`
AddressOfCallbacks	`0x140b8bff8`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_TYPE_REG`
Callbacks	`0x0000000140842350` `0x0000000140842330`

Load Configuration

RICH Header

Errors

[*] Warning: COFF String Table's reported size is bigger than the remaining bytes!
[*] Warning: Section .bss has a size of 0!

Leave a comment

No comments yet.