01cfbcab3e5cab149c55e5782d8267ba5ed071e236bcd7d2fc19fc877d5a0ea8
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-May-13 02:29:21 |
| Detected languages |
Chinese - PRC
English - United States |
| TLS Callbacks | 1 callback(s) detected. |
| Debug artifacts |
E:\VisualStudio\TxClient\TxWinBuilder\Bin\BinComV2\ComV2Installer.pdb
|
| CompanyName | FRESHFIRE FELLOWSHIP CHURCH INDIA FOUNDATION |
| FileDescription | Launch Server Setup |
| FileVersion | 1.2.0.2 |
| InternalName | Launch Server Setup.exe |
| LegalCopyright | FRESHFIRE FELLOWSHIP CHURCH INDIA FOUNDATION |
| OriginalFilename | Launch Server Setup.exe |
| ProductName | Launch Server |
| ProductVersion | 1.2.0.2 |
Plugin Output
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
May have dropper capabilities:
|
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
Hashes
| MD5 | 1b28e81f99d946f1a19325cf94c59dee 🔍 |
|---|---|
| SHA1 | e5cc71036f08b925f19a484fa03edb796b2a7ea5 🔍 |
| SHA256 | 01cfbcab3e5cab149c55e5782d8267ba5ed071e236bcd7d2fc19fc877d5a0ea8 🔍 |
| SHA3 | a70c5d2e405a2eeeb5fdab64b31af07d3642b4afb856510cf1964727f5a5381c 🔍 |
| SSDeep | 6144:vjeC3mKxASR+LCFT/alFsPV2xvCg6u+2QTTtrhzyx01lTpu2pN90/6fcrImcqDJ:vjfaFsPskgyXRFNlTs2e/68Dawqo6GN 🔍 |
| Imports Hash | d829af45a23d5a38545a1aa5a32bb2da 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x138 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2026-May-13 02:29:21 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0xbe00 |
| SizeOfInitializedData | 0x8e600 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00007910 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0xd000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.1 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.1 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x9c000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | 679b52f9db9eb2fffa1055da76c550f9 🔍 |
|---|---|
| SHA1 | 87f70ae0a3763921bf2fd84159a23bb76055ac90 🔍 |
| SHA256 | 522c444585ce0fe194718ebaceaabae8fe54f51186582525641013a4cee62b52 🔍 |
| SHA3 | a8049fd635ac1d145d9e4b792c911a0d873856b008e91312d9a3f18eed4cef53 🔍 |
| VirtualSize | 0xbc69 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0xbe00 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.13082 |
.rdata
| MD5 | 95e62f31fe4ef6d2b48f9b650963c94c 🔍 |
|---|---|
| SHA1 | db11c4f778ef57f42dc453bc7350bb21dd6abcd1 🔍 |
| SHA256 | 7b6fb0449d57173ab493fae18efc2027bf41592fc535fe5ceebf33f770a458fa 🔍 |
| SHA3 | 3ba9e6dc91ae75af6acb80c4573fce7359dc161f82a9134de69347540b604570 🔍 |
| VirtualSize | 0x6f54 |
| VirtualAddress | 0xd000 |
| SizeOfRawData | 0x7000 |
| PointerToRawData | 0xc200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 5.54928 |
.data
| MD5 | a5903da65a1575de4e4a4f9de754c922 🔍 |
|---|---|
| SHA1 | e94afb8736547a1f15f34e01acf376f206a91d88 🔍 |
| SHA256 | c06ee2eaba7118b0db6b934ff512b5bbbeae9e99e85f75e25f30a7863a6226b5 🔍 |
| SHA3 | eab10e8f5b08536224b19aa947ce0e9425824ec13abea23dbbd5c4b8270ef4ae 🔍 |
| VirtualSize | 0x84c18 |
| VirtualAddress | 0x14000 |
| SizeOfRawData | 0x44600 |
| PointerToRawData | 0x13200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 6.86352 |
.rsrc
| MD5 | 0243912c0f64cbb4e9e32e08778484eb 🔍 |
|---|---|
| SHA1 | 64e77d6cb9c7397eba5605e37a55e7e763c9f62d 🔍 |
| SHA256 | 1ae397083cc5f0a00cd7268634e208cc380ba4420c467b1664d412f42d46d4aa 🔍 |
| SHA3 | c8d9a4393a12ddf47efe5c1383b3094cbfeb3d9bf08e9fe231c7fc5ba4d353b2 🔍 |
| VirtualSize | 0x16e0 |
| VirtualAddress | 0x99000 |
| SizeOfRawData | 0x1800 |
| PointerToRawData | 0x57800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 5.61785 |
.reloc
| MD5 | 5556e7115673e6668393740f408aaddc 🔍 |
|---|---|
| SHA1 | d2a37bf77631d59ba1fe3099c9abd7bd0123be76 🔍 |
| SHA256 | afc86647518d31377390a1c06a46d69781adfb29898509e3d7918b637dd0eef4 🔍 |
| SHA3 | 7f0340436f99fc0e193bf2cb215dac47c6cb3d5c473ceaecea88dbfd711eb8c2 🔍 |
| VirtualSize | 0xe24 |
| VirtualAddress | 0x9b000 |
| SizeOfRawData | 0x1000 |
| PointerToRawData | 0x59000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.26671 |
Imports
| KERNEL32.dll |
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection Sleep GetFileSize ReadFile WinExec GetLocalTime GetTickCount lstrcmpiA lstrcatA RaiseException CreateProcessA GetEnvironmentVariableA GetTempPathA GetTempFileNameA MultiByteToWideChar CreateToolhelp32Snapshot Process32First Process32Next OpenProcess LoadLibraryExW GetProcAddress FreeLibrary GetShortPathNameA CreateFileA CreateDirectoryA OutputDebugStringA CloseHandle SetFilePointer FlushFileBuffers WriteFile GetLastError GetModuleFileNameA GetSystemDirectoryW DeviceIoControl SetLastError GetFullPathNameW TerminateProcess InterlockedFlushSList RtlUnwind LeaveCriticalSection EnterCriticalSection OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent GetCurrentProcess |
|---|---|
| USER32.dll |
UnregisterClassA
wsprintfA |
| ADVAPI32.dll |
RevertToSelf
QueryServiceStatusEx CreateServiceA CloseServiceHandle ChangeServiceConfigA RegCloseKey EqualSid CreateWellKnownSid GetTokenInformation OpenProcessToken ImpersonateSelf |
| SHELL32.dll |
SHGetSpecialFolderPathA
ShellExecuteA |
| ole32.dll |
CoCreateInstance
CoInitialize |
| OLEAUT32.dll |
SysFreeString
SysAllocStringLen |
| SHLWAPI.dll |
SHSetValueA
|
| WTSAPI32.dll |
WTSFreeMemory
|
| msvcrt.dll |
atexit
__setusermatherr _initterm exit _exit _c_exit __p__commode malloc __CxxFrameHandler _lock _unlock __dllonexit __set_app_type _ismbblead _acmdln _wcmdln _itow _ltow _ultow _i64tow _ui64tow _wsplitpath _wsearchenv __doserrno _itoa _ltoa _ultoa _i64toa _ui64toa _ecvt _fcvt _gcvt _splitpath _errno _controlfp _control87 _wmktemp _wenviron _mktemp _wstrtime _strtime tmpfile _cgets _cgetws _XcptFilter memcpy _pwctype __lc_collate_cp _fmode abort _cexit _environ __wgetmainargs __getmainargs ??3@YAXPAX@Z _CxxThrowException strncpy _stricmp _isatty fflush _fileno _iob ?terminate@@YAXXZ _msize realloc strcpy strcmp printf _vsnprintf sprintf free memset _time64 strftime _localtime64 strlen ??_V@YAXPAX@Z ??_U@YAPAXI@Z _chsize _amsg_exit _searchenv strcat memmove |
| ntdll.dll |
NtClose
RtlAdjustPrivilege RtlNtStatusToDosError RtlDetermineDosPathNameType_U NtSetInformationFile NtCreateFile RtlFreeUnicodeString RtlDosPathNameToNtPathName_U |
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | Chinese - PRC |
| Codepage | UNKNOWN |
| Size | 0x10a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.97201 |
| MD5 | 06da6dc41bd015c6585af1de6f583785 🔍 |
| SHA1 | 7b9bae171efcdeebbebf8c53df72c7bfc63f083f 🔍 |
| SHA256 | f0fd7af9747cdc680086ad45c0518ce2e002a92fe6251f0ac6f61103b14b6b69 🔍 |
| SHA3 | 93a61232d375b61a86d8473c19760974c4b9cb95a6478fbc2690189a4835f00e 🔍 |
106
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | Chinese - PRC |
| Codepage | UNKNOWN |
| Size | 0x14 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.7815 |
| Detected Filetype | Icon file |
| MD5 | 3c68f77c35c26ff079a1c410ee44fa62 🔍 |
| SHA1 | 0b40150c95fc2c6414c90d44ee78b8d8814b3393 🔍 |
| SHA256 | a14e70ed824f3f17d3a51136aa08839954d6d3ccadaa067415c7bfc08e6636b0 🔍 |
| SHA3 | 590dcbf2ec3f485a6c24e3e627f383ee7588eb49978321f12c07d8190a6c1396 🔍 |
1 (#2)
| Type |
RT_VERSION
|
|---|---|
| Language | Chinese - PRC |
| Codepage | UNKNOWN |
| Size | 0x370 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.50277 |
| MD5 | 4abb53ce41db606e8da9d86bb61ebeae 🔍 |
| SHA1 | ecb7ec655705eb33f846807e75dbcce2c26ff3a1 🔍 |
| SHA256 | eb5e0b8d52e3b5ef8e2e837cb872a82800806872843c393a229b8e0a02ed93bc 🔍 |
| SHA3 | b2c2cf21d64bfe5978e25e6fef29e8bfc1cd5bad374e08dcd6b805e55b34f718 🔍 |
1 (#3)
| Type |
RT_MANIFEST
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x17d |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.91161 |
| MD5 | 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍 |
| SHA1 | 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍 |
| SHA256 | 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍 |
| SHA3 | 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍 |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.2.0.2 |
| ProductVersion | 1.2.0.2 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| CompanyName | FRESHFIRE FELLOWSHIP CHURCH INDIA FOUNDATION |
| FileDescription | Launch Server Setup |
| FileVersion (#2) | 1.2.0.2 |
| InternalName | Launch Server Setup.exe |
| LegalCopyright | FRESHFIRE FELLOWSHIP CHURCH INDIA FOUNDATION |
| OriginalFilename | Launch Server Setup.exe |
| ProductName | Launch Server |
| ProductVersion (#2) | 1.2.0.2 |
| Resource LangID | Chinese - PRC |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-May-13 02:29:21 |
| Version | 0.0 |
| SizeofData | 94 |
| AddressOfRawData | 0x1286c |
| PointerToRawData | 0x11a6c |
| Referenced File | E:\VisualStudio\TxClient\TxWinBuilder\Bin\BinComV2\ComV2Installer.pdb |
IMAGE_DEBUG_TYPE_VC_FEATURE
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-May-13 02:29:21 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x128cc |
| PointerToRawData | 0x11acc |
IMAGE_DEBUG_TYPE_POGO
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-May-13 02:29:21 |
| Version | 0.0 |
| SizeofData | 808 |
| AddressOfRawData | 0x128e0 |
| PointerToRawData | 0x11ae0 |
IMAGE_DEBUG_TYPE_ILTCG
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-May-13 02:29:21 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
TLS Callbacks
| StartAddressOfRawData | 0x412c08 |
|---|---|
| EndAddressOfRawData | 0x412c10 |
| AddressOfIndex | 0x4588e8 |
| AddressOfCallbacks | 0x40d350 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks |
0x0040C7A0
|
Load Configuration
| Size | 0xa0 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x45842c |
| SEHandlerTable | 0x412810 |
| SEHandlerCount | 23 |
RICH Header
| XOR Key | 0x10797ff3 |
|---|---|
| Unmarked objects | 0 |
| Imports (24225) | 2 |
| Imports (VS2019 Update 4 (16.4.4-5) compiler 28316) | 2 |
| 199 (41118) | 9 |
| C objects (VS 2015/2017 runtime 26706) | 2 |
| ASM objects (VS 2015/2017 runtime 26706) | 4 |
| 242 (40116) | 1 |
| C++ objects (VS2019 Update 6 (16.6.1-5) compiler 28806) | 14 |
| ASM objects (VS2008 SP1 build 30729) | 2 |
| C++ objects (VS 2015/2017 runtime 26706) | 3 |
| C++ objects (VS2017 v15.9.16-18 compiler 27034) | 22 |
| C objects (VS2017 v15.9.16-18 compiler 27034) | 10 |
| C objects (VS2008 SP1 build 30729) | 2 |
| Imports (VS2008 SP1 build 30729) | 17 |
| Total imports | 167 |
| C++ objects (27054) | 2 |
| Resource objects (27054) | 1 |
| 151 | 1 |
| Linker (27054) | 1 |
Errors
Leave a comment
No comments yet.