0f976a71b1863f5ce5f26218bdb0e7f58e3b0fb41043ff54387d95290eb4d06f

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Aug-04 06:33:58
Detected languages English - United States

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Info Interesting strings found in the binary: Contains domain names:
  • https://offsets.ntgetwritewatch.workers.dev
  • https://offsets.ntgetwritewatch.workers.dev/offsets.json
  • roblox.com
  • thumbnails.roblox.com
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses known Mersenne Twister constants
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
 Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
  • CheckRemoteDebuggerPresent
  • SwitchToThread
  • FindWindowA
 Code injection capabilities:
  • WriteProcessMemory
  • VirtualAlloc
  • OpenProcess
 Can access the registry:
  • RegCloseKey
  • RegOpenKeyExA
  • RegQueryValueExA
 Possibly launches other programs:
  • ShellExecuteA
  • system
 Uses functions commonly found in keyloggers:
  • MapVirtualKeyA
  • GetForegroundWindow
  • GetAsyncKeyState
 Memory manipulation functions often used by packers:
  • VirtualProtect
  • VirtualProtectEx
  • VirtualAlloc
 Has Internet access capabilities:
  • WinHttpOpenRequest
  • WinHttpOpen
  • WinHttpSendRequest
  • WinHttpReadData
  • WinHttpConnect
  • WinHttpCloseHandle
  • WinHttpQueryHeaders
  • WinHttpQueryDataAvailable
  • WinHttpReceiveResponse
  • WinHttpSetTimeouts
  • InternetCloseHandle
  • InternetReadFile
  • InternetOpenA
  • InternetOpenUrlA
 Functions related to the privilege level:
  • AdjustTokenPrivileges
  • OpenProcessToken
 Manipulates other processes:
  • WriteProcessMemory
  • Process32First
  • Process32Next
  • ReadProcessMemory
  • OpenProcess
 Can take screenshots:
  • FindWindowA
  • GetDC
 Reads the contents of the clipboard:
  • GetClipboardData
Malicious VirusTotal score: 17/71 (Scanned on 2026-08-04 06:37:22) APEX: Malicious
Bkav: W32.Malware.ED50D681
CrowdStrike: win/malicious_confidence_90% (D)
ESET-NOD32: Win64/GenKryptik_AGen.BVS trojan
Elastic: malicious (high confidence)
Fortinet: Riskware/GameHack
Google: Detected
Ikarus: Trojan.Win64.Krypt
K7AntiVirus: Trojan ( 006d847c1 )
K7GW: Trojan ( 006d847c1 )
Malwarebytes: Trojan.MalPack.FKG
MaxSecure: Trojan.Malware.300983.susgen
McAfeeD: ti!0F976A71B186
Microsoft: Trojan:Win32/Wacatac.C!ml
Rising: Trojan.Kryptik@AI.100 (RDML:CgLFNA+zQRzgriM07YYpRw)
SentinelOne: Static AI - Malicious PE
Symantec: ML.Attribute.HighConfidence

Hashes

MD5 fac641ecd0523047d0aad59a69de7100
SHA1 76f587fe17341147da0a90fb844f078003d5b8a7
SHA256 0f976a71b1863f5ce5f26218bdb0e7f58e3b0fb41043ff54387d95290eb4d06f
SHA3 d8d8bf2c42c7a096ff89437c16159820303a03307b83c256d6b5c811ea99336e
SSDeep 49152:g5cUAiE80VWYYz0bo18jRbLJvz6pnAyAi:2ksALJe
Imports Hash 54f993a97009d51e277e6f9291435e04

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Aug-04 06:33:58
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x155200
SizeOfInitializedData 0x62600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000014DA70 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x1bd000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 bfcb58e6c8c62ab46d187c87c3ec137a
SHA1 ff201dd945308d26ac2f60fdfc1eb5660f0f51d5
SHA256 6da38b7852175e5dacc1b810758753fef74ff066afd4a9328a1ff64432cef168
SHA3 c2444beedf05a1dadc0e09f7fe08031cce1cf8f2239a0c31084e6cc22403702c
VirtualSize 0x155071
VirtualAddress 0x1000
SizeOfRawData 0x155200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.50801

.rdata

MD5 65fc78a05bf2b5201774a2dabaa41efc
SHA1 95f2c31049a6222d83a94d3296c751319ffc85ae
SHA256 da508b781b906f2065bae8d6592aafa347d170f354eec6a80919a99f4db85eb5
SHA3 f9949e609f3cf28514917c40600b3a3a241277b05d597aad45061aff37eb9c80
VirtualSize 0x4d9ec
VirtualAddress 0x157000
SizeOfRawData 0x4da00
PointerToRawData 0x155600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.27049

.data

MD5 63012d01a94e885e704d0861d33fe87f
SHA1 c957c4495ed94af0f2ea7cdb1f4e85f3647969ae
SHA256 f8d42449c526302d41027f01aae047248d1bc34365b1db7e3608bef46c4a5123
SHA3 46a5bec433c4182ddb9139df12f21d53dcdd934bf9d5b9de42c71e6e0d80431d
VirtualSize 0x5468
VirtualAddress 0x1a5000
SizeOfRawData 0x3400
PointerToRawData 0x1a3000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.9698

.pdata

MD5 29c7e1a06540a519e1b887a69a2916e2
SHA1 80d56ccf94ef9616b7deac804d73004826ac020e
SHA256 1b3e90a3ab2af3744638e7f1167c1dfdf91b23fd07b2951e5c8792b17af22276
SHA3 e8746c4f3e8bdc1da4debc0ce947ca2730e829a38bb56cd8271266209cea4938
VirtualSize 0xe184
VirtualAddress 0x1ab000
SizeOfRawData 0xe200
PointerToRawData 0x1a6400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.20337

.rsrc

MD5 587d40d2c1d07c491772b87cfa86fb96
SHA1 b16600d4f1b6efdb83d64ee5c12088f5f4daa008
SHA256 606b1eae0a097108f5974769d85277881ad6638bc370183f472ba56c5ad9d524
SHA3 06ac6a1b01fa37f8402474a673f5422f23def32e55a2ba90b6160315d48457a2
VirtualSize 0x1e8
VirtualAddress 0x1ba000
SizeOfRawData 0x200
PointerToRawData 0x1b4600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.77204

.reloc

MD5 10d82e558f67566d64b25229f2de169f
SHA1 3f9660e706ddece2b972e94bf5fff0f7b481de92
SHA256 1f67eff9cf0b57727a1564ac2cf4dd7c2d5cac3d25fd4be6f7327f3af72912b4
SHA3 10774abb57d02b077367a1b343eca02ce3f3fdac8c99d7ab2d1d06f71f511d5c
VirtualSize 0x116c
VirtualAddress 0x1bb000
SizeOfRawData 0x1200
PointerToRawData 0x1b4800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.39901

Imports

d3d11.dll D3D11CreateDeviceAndSwapChain
WINHTTP.dll WinHttpOpenRequest
WinHttpOpen
WinHttpSendRequest
WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpSetTimeouts
KERNEL32.dll VerSetConditionMask
FreeLibrary
QueryPerformanceCounter
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
VirtualProtect
WriteProcessMemory
GetTickCount64
VirtualProtectEx
GetTickCount
VirtualQueryEx
Process32First
VirtualFree
GetCurrentProcess
GetStdHandle
VirtualAlloc
Module32Next
Module32First
GetCurrentThreadId
CreateToolhelp32Snapshot
Sleep
GetCurrentThread
Process32Next
CloseHandle
GetSystemInfo
GetThreadContext
GetCurrentProcessId
VirtualQuery
IsDebuggerPresent
CheckRemoteDebuggerPresent
SetThreadAffinityMask
SetThreadPriority
SwitchToThread
ReadProcessMemory
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetProcessId
DuplicateHandle
QueryPerformanceFrequency
GetLastError
GetModuleHandleW
AreFileApisANSI
CreateFile2
SetFileInformationByHandle
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateDirectoryW
GetLocaleInfoEx
FormatMessageA
LocalFree
SleepConditionVariableSRW
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
HeapFree
HeapAlloc
ReadFile
GetFileSizeEx
CreateFileA
GetProcAddress
LoadLibraryA
MultiByteToWideChar
GetModuleHandleA
GetLocaleInfoA
GetFileInformationByHandleEx
InitOnceComplete
InitOnceBeginInitialize
WakeAllConditionVariable
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
InitializeSListHead
OpenProcess
USER32.dll GetKeyboardLayout
GetWindowThreadProcessId
GetDesktopWindow
ShowCursor
IsWindow
keybd_event
MapVirtualKeyA
FindWindowA
PostQuitMessage
PeekMessageA
OpenClipboard
CloseClipboard
CreateWindowExW
SendInput
DefWindowProcW
DispatchMessageA
GetWindowRect
DestroyWindow
EmptyClipboard
GetClipboardData
SetClipboardData
GetKeyState
LoadIconA
GetMessageExtraInfo
LoadCursorA
TranslateMessage
GetForegroundWindow
SetCapture
TrackMouseEvent
SetCursor
ClientToScreen
SetWindowDisplayAffinity
GetClientRect
SetProcessDPIAware
IsWindowUnicode
SetWindowLongA
GetAsyncKeyState
ReleaseCapture
SetCursorPos
ReleaseDC
GetCursorPos
UpdateWindow
GetMonitorInfoA
GetCapture
ScreenToClient
MonitorFromWindow
GetDC
ShowWindow
MoveWindow
RegisterClassExW
SetLayeredWindowAttributes
GetSystemMetrics
UnregisterClassW
GDI32.dll GetDeviceCaps
CreateSolidBrush
ADVAPI32.dll RegCloseKey
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegOpenKeyExA
RegQueryValueExA
SHELL32.dll ShellExecuteA
D3DCOMPILER_43.dll D3DCompile
MSVCP140.dll ??Bios_base@std@@QEBA_NXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?good@ios_base@std@@QEBA_NXZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Id_cnt@id@locale@std@@0HA
_Xtime_get_ticks
_Query_perf_frequency
?_Xbad_function_call@std@@YAXXZ
_Query_perf_counter
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?_Throw_Cpp_error@std@@YAXH@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xinvalid_argument@std@@YAXPEBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Winerror_map@std@@YAHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Random_device@std@@YAIXZ
?_Syserror_map@std@@YAPEBDH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
_Mtx_lock
_Thrd_id
_Thrd_join
_Mtx_unlock
_Cnd_broadcast
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
??0task_continuation_context@Concurrency@@AEAA@XZ
_Cnd_unregister_at_thread_exit
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
_Cnd_register_at_thread_exit
_Cnd_wait
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@AEAD@Z
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
dwmapi.dll DwmExtendFrameIntoClientArea
IMM32.dll ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
WININET.dll InternetCloseHandle
InternetReadFile
InternetOpenA
InternetOpenUrlA
WINMM.dll timeBeginPeriod
timeGetTime
VCRUNTIME140_1.dll __CxxFrameHandler4
VCRUNTIME140.dll memset
__std_exception_destroy
__std_exception_copy
__std_terminate
strstr
_CxxThrowException
__C_specific_handler
_purecall
__intrinsic_setjmp
__current_exception_context
__current_exception
memchr
memcmp
memmove
memcpy
longjmp
strrchr
api-ms-win-crt-heap-l1-1-0.dll free
_set_new_mode
realloc
malloc
_callnewh
api-ms-win-crt-math-l1-1-0.dll fmodf
cos
_dsign
log
logf
acosf
pow
roundf
powf
sin
cosf
sinf
asinf
__setusermatherr
sqrt
sqrtf
ldexp
atan2f
ceilf
api-ms-win-crt-string-l1-1-0.dll tolower
strncpy_s
strncpy
strcmp
strlen
strncmp
strcpy_s
wcslen
api-ms-win-crt-stdio-l1-1-0.dll fflush
fclose
ftell
__stdio_common_vsscanf
_get_stream_buffer_pointers
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
_set_fmode
__acrt_iob_func
fgetc
__p__commode
fputc
__stdio_common_vsprintf_s
fseek
__stdio_common_vfprintf
fwrite
_wfopen
__stdio_common_vsprintf
fread
api-ms-win-crt-utility-l1-1-0.dll rand
srand
qsort
api-ms-win-crt-convert-l1-1-0.dll strtoll
strtoull
strtod
atof
strtol
api-ms-win-crt-runtime-l1-1-0.dll _beginthreadex
terminate
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
_errno
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
exit
abort
system
api-ms-win-crt-time-l1-1-0.dll _localtime64_s
_time64
strftime
api-ms-win-crt-filesystem-l1-1-0.dll _lock_file
_unlock_file
api-ms-win-crt-locale-l1-1-0.dll ___lc_codepage_func
_configthreadlocale
localeconv
api-ms-win-crt-environment-l1-1-0.dll _dupenv_s

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x188
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.89623
MD5 b8e76ddb52d0eb41e972599ff3ca431b
SHA1 fc12d7ad112ddabfcd8f82f290d84e637a4d62f8
SHA256 165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8
SHA3 37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Aug-04 06:33:58
Version 0.0
SizeofData 912
AddressOfRawData 0x188880
PointerToRawData 0x186e80

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2026-Aug-04 06:33:58
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

StartAddressOfRawData 0x140188c30
EndAddressOfRawData 0x140188d00
AddressOfIndex 0x1401a83a0
AddressOfCallbacks 0x140157eb8
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_16BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1401a5040

RICH Header

XOR Key 0xb4b87dca
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 22
253 (35721) 1
C objects (35721) 10
C++ objects (35721) 37
ASM objects (35721) 6
Imports (35721) 6
Imports (21202) 2
C objects (VS2022 Update 7 (17.7.0-3) compiler 32822) 27
Imports (33145) 23
Total imports 480
C++ objects (LTCG) (36252) 64
Resource objects (36252) 1
Linker (36252) 1

Errors

Leave a comment

No comments yet.