27aca43f39a2dcd49b3e36e6578ef3a69674ad5a92be192710d5c3c1394fdad1

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 1970-Jan-01 00:00:00
Detected languages English - United States
Debug artifacts Embedded COFF debugging symbols

Plugin Output

Suspicious PEiD Signature: XWD graphics format
HQR data file
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to debugging or reversing tools:
  • ida.exe
  • ida64.exe
  • ollydbg.exe
  • windbg.exe
  • x64dbg.exe
 Contains domain names:
  • .eq.github.com
  • .hash.net
  • 2Faccounts.epicgames.com
  • 2Fwww.epicgames.com
  • 81931294547-ict6llss8611g9nglndn2bnln48bo59d.apps.googleusercontent.com
  • account-public-service-prod.ol.epicgames.com
  • account-public-service-prod03.ol.epicgames.com
  • accounts.epicgames.com
  • accounts.google.com
  • accounts.nintendo.com
  • apps.googleusercontent.com
  • auth.onrender.com
  • cn-auth.onrender.com
  • encodingaccount.live.com
  • entitlement-public-service-prod08.ol.epicgames.com
  • epicgames.com
  • eq.github.com
  • facebook.com
  • fngw-mcp-gc-livefn.ol.epicgames.com
  • fortnite-public-service-prod11.ol.epicgames.com
  • gc-livefn.ol.epicgames.com
  • github.com
  • golang.org
  • google.com
  • googleusercontent.com
  • http://Results1-9.txt10
  • https://account-public-service-prod.ol.epicgames.com
  • https://account-public-service-prod.ol.epicgames.com/account/api/oauth/exchangecannot
  • https://account-public-service-prod.ol.epicgames.com/account/api/oauth/token%s
  • https://account-public-service-prod.ol.epicgames.com/account/api/public/account/%s
  • https://account-public-service-prod.ol.epicgames.com/account/api/public/account/%s/deviceAuthtls
  • https://account-public-service-prod03.ol.epicgames.com
  • https://account-public-service-prod03.ol.epicgames.com/account/api/oauth/tokenrange
  • https://account-public-service-prod03.ol.epicgames.com/account/api/public/account/%stls
  • https://accounts.epicgames.com
  • https://accounts.epicgames.com/OAuthAuthorized&response_type
  • https://accounts.epicgames.com/OAuthAuthorized&state
  • https://accounts.google.com
  • https://accounts.google.com/o/oauth2/auth?client_id
  • https://accounts.nintendo.com
  • https://accounts.nintendo.com/connect/1.0.0/authorize?client_id
  • https://cn-auth.onrender.com
  • https://cn-auth.onrender.com%-3s
  • https://entitlement-public-service-prod08.ol.epicgames.com
  • https://entitlement-public-service-prod08.ol.epicgames.com/entitlement/api/account/%s
  • https://entitlement-public-service-prod08.ol.epicgames.com/entitlement/api/account/%s/entitlementsNoClientCertRequestClientCertRequireAnyClientCertVerifyClientCertIfGivenRequireAndVerifyClientCerted25519
  • https://fngw-mcp-gc-livefn.ol.epicgames.com
  • https://fngw-mcp-gc-livefn.ol.epicgames.com/fortnite/api/game/v2/profile/%s/client/QueryProfile?profileId
  • https://fortnite-public-service-prod11.ol.epicgames.com
  • https://fortnite-public-service-prod11.ol.epicgames.com/fortnite/api/game/v2/profile/%s
  • https://go.dev
  • https://login.live.com
  • https://login.live.com/oauth20_authorize.srf?client_id
  • https://login.live.com/ppsecure/post.srf?client_id
  • https://login.live.comabuse
  • https://login.live.comabuse/recover
  • https://statsproxy-public-service-live.ol.epicgames.com
  • https://statsproxy-public-service-live.ol.epicgames.com/statsproxy/api/statsv2/account/M2Y2OWU1NmM3NjQ5NDkyYzhjYzI5ZjFhZjA4YThhMTI6YjUxZWU5Y2IxMjIzNGY1MGE2OWVmYTY3ZWY1MzgxMmU
  • https://tracking.epicgames.com
  • https://tracking.epicgames.com,https
  • https://tracking.unrealengine.com
  • https://www.epicgames.com
  • https://www.epicgames.com/account/personalasn1
  • https://www.epicgames.com/id/exchange?exchangeCode
  • https://www.epicgames.com/id/login?exchangeCode
  • https://www.epicgames.com/id/login?redirectUrl
  • https://www.facebook.com
  • https://www.facebook.com/dialog/oauth?client_id
  • ict6llss8611g9nglndn2bnln48bo59d.apps.googleusercontent.com
  • itab.github.com
  • live.ol.epicgames.com
  • livefn.ol.epicgames.com
  • login.live.com
  • mcp-gc-livefn.ol.epicgames.com
  • nintendo.com
  • ol.epicgames.com
  • onrender.com
  • passkeyerrors.com
  • prod.ol.epicgames.com
  • prod03.ol.epicgames.com
  • prod08.ol.epicgames.com
  • prod11.ol.epicgames.com
  • public-service-live.ol.epicgames.com
  • public-service-prod.ol.epicgames.com
  • public-service-prod03.ol.epicgames.com
  • public-service-prod08.ol.epicgames.com
  • public-service-prod11.ol.epicgames.com
  • redirecterrors.com
  • service-live.ol.epicgames.com
  • service-prod.ol.epicgames.com
  • service-prod03.ol.epicgames.com
  • service-prod08.ol.epicgames.com
  • service-prod11.ol.epicgames.com
  • sizeerrors.com
  • statsproxy-public-service-live.ol.epicgames.com
  • textproto.nl
  • tracking.epicgames.com
  • tracking.unrealengine.com
  • unrealengine.com
  • www.epicgames.com
  • www.facebook.com
Info Cryptographic algorithms detected in the binary: Uses constants related to MD5
Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to SHA512
Uses constants related to AES
Suspicious The PE is possibly packed. Unusual section name found: /4
Unusual section name found: /19
Unusual section name found: /32
Unusual section name found: /46
Unusual section name found: /65
Unusual section name found: /78
Unusual section name found: /95
Unusual section name found: /112
Unusual section name found: .symtab
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
 Functions which can be used for anti-debugging purposes:
  • SwitchToThread
Malicious VirusTotal score: 12/71 (Scanned on 2026-10-17 18:26:40) AVG: Win64:Malware-gen
AhnLab-V3: Unwanted/Win.BruteForce.R781613
Antiy-AVL: RiskWare/Win32.BruteForce
Avast: Win64:Malware-gen
Bkav: W32.Malware.2A1E3E3A
ESET-NOD32: WinGo/Riskware.BruteForce.T application
Google: Detected
Ikarus: Trojan.WinGo.Clipbanker
Rising: Hacktool.BruteForce!8.762 (C64:YzY0OpIA07ovLfer)
Sangfor: Trojan.Win32.Save.a
Trapmine: malicious.moderate.ml.score
Zillya: Tool.BruteForce.Win32.11059

Hashes

MD5 f30b0df947e9b09ec6e5b9e25acd448e 🔍
SHA1 3352400f36e87ee540e3332e62fab30bfa689db4 🔍
SHA256 27aca43f39a2dcd49b3e36e6578ef3a69674ad5a92be192710d5c3c1394fdad1 🔍
SHA3 47947b38d760efdcc621672632609a85289b796b84c9626c3efb9fb89abf176d 🔍
SSDeep 98304:7YRtsd2RIkD2fy05dUumvBh8huTA3EEv7xX/R/1FQbo4Fqr9hhQPviY4EE:7spRIkgy010EDxX/7FHug3 🔍
Imports Hash ed8b780a3ce7ca4aba78a21f6bc3d4e0 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0x8b
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 17
TimeDateStamp 1970-Jan-01 00:00:00
PointerToSymbolTable 0x95e200
NumberOfSymbols 10165
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 3.0
SizeOfCode 0x32aa00
SizeOfInitializedData 0x5d800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000087DA0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.1
ImageVersion 1.0
SubsystemVersion 6.1
Win32VersionValue 0
SizeOfImage 0x2a58000
SizeOfHeaders 0x600
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 fa0d923dcb1d42ac8e90825b4311b942 🔍
SHA1 6c85ae8355656f547f82124c8b5b41a051a40bb9 🔍
SHA256 104de7e0d8036ed4c96264c4e7a7f03d58b07fd92009d56f9f06470ebfce2c63 🔍
SHA3 093f52354dd2ab81ad83f07d434c8f7be6eb27da6ee07772e5897b992cfb14fd 🔍
VirtualSize 0x32a931
VirtualAddress 0x1000
SizeOfRawData 0x32aa00
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.21354

.rdata

MD5 c64ec68b8d0a95e9967a585454529c43 🔍
SHA1 8466bb7dfdca4556e59743ef49678ba008024e73 🔍
SHA256 517cf5a70c489cefd8d427584c684a60bc6f94c5bb656b22d9eda987ae654539 🔍
SHA3 8bd60ed793e03d4019c3f5eef4a6744e551185eb6c84ec5186097998ce4fffe9 🔍
VirtualSize 0x350688
VirtualAddress 0x32c000
SizeOfRawData 0x350800
PointerToRawData 0x32b000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.66645

.data

MD5 36be34e7203e6e711f018cbd766a6182 🔍
SHA1 7172f0021c89a3dd34469b7bcbe05a552f654863 🔍
SHA256 6e34a7133cd1439136d651ce2b2e91188df313bcca643fe3db58ccdfddd5787c 🔍
SHA3 385950b171572e3e986ac1917932ed1a3dc3c5f6d56a7997b89e5218dcb47b21 🔍
VirtualSize 0x20b46e0
VirtualAddress 0x67d000
SizeOfRawData 0x5d800
PointerToRawData 0x67b800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.98695

.pdata

MD5 37dcb0aa427f8d39058c18f6368c5134 🔍
SHA1 54c64ff303dbd4b1e2e5c45ed40ac02035f6b669 🔍
SHA256 17621a3561d1242af93fda657b3837110b7891dea3f1ddf87e4b77ff7388c4bb 🔍
SHA3 a997c82bde7396f5579a73de44554c3c5cc318f487cd3f85ce5f9a56493495fc 🔍
VirtualSize 0x1245c
VirtualAddress 0x2732000
SizeOfRawData 0x12600
PointerToRawData 0x6d9000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.66716

.xdata

MD5 306d924a4f10c8d9e3997eb4f6f7c172 🔍
SHA1 260b4424f5d4900c8cda1e9032c520c3d40cc0a5 🔍
SHA256 e172f0b688bf526e55e1854f51446d99242eafd3c7ef858bb69a0e294d597303 🔍
SHA3 14fe39f02bed8495c26c85366d8fc582e80f4138733f154b0d3d9ab044666522 🔍
VirtualSize 0xb4
VirtualAddress 0x2745000
SizeOfRawData 0x200
PointerToRawData 0x6eb600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.78711

/4

MD5 bcddef00414a946919302442928e542e 🔍
SHA1 b0fbeae40093e8241edcbdeae94ba06880dedf04 🔍
SHA256 fb7bf682d27ba8920146a9b134a183cd2109b202916488b9b3a4f7d623f0b484 🔍
SHA3 7d5b252590738bde977b6dfab9c3034c2ad82b952980a3585c1dc88e1f06f005 🔍
VirtualSize 0x154
VirtualAddress 0x2746000
SizeOfRawData 0x200
PointerToRawData 0x6eb800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.67257

/19

MD5 5084affa070467c2e8bf0e956d96fbbd 🔍
SHA1 85bbf705c6bc548d8cb6f20856ff27592127d467 🔍
SHA256 e00f157fd09298d0620e1fcbff697cfa370469e2351b33bf2776ea2e462cc9d5 🔍
SHA3 4217ef42f41699711bfa1f5eed30ebaf840ce5c3f5da40a63be53cc208f91dd3 🔍
VirtualSize 0x8fe8f
VirtualAddress 0x2747000
SizeOfRawData 0x90000
PointerToRawData 0x6eba00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 7.99636

/32

MD5 ab2d0f574676211096eb50a10d50df3b 🔍
SHA1 c31bf5594da8a102f4873e7a56ef636bb2106181 🔍
SHA256 a1d5797fc73b9e6788ccce2147bb3a2ad25533275140afa4b7969157455f9e05 🔍
SHA3 94cf768b664d6061ade73f82284d49773ace50f52f3ee11217966f26ee7e76b9 🔍
VirtualSize 0x1d572
VirtualAddress 0x27d7000
SizeOfRawData 0x1d600
PointerToRawData 0x77ba00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 7.9428

/46

MD5 40cca7c46fc713b4f088e5d440ca7931 🔍
SHA1 3aaa1650bfaf5325fa9cb3a1a284aebcc92aebf4 🔍
SHA256 3e3c5f5d419b70e588da0ef0e3d9ce1a5863a5624febc16cd0c007cd14e89015 🔍
SHA3 a0e18fe9f6ac46417d52cdc99cf9ae56edb5a53f788995a085b10f88f348a0e4 🔍
VirtualSize 0x30
VirtualAddress 0x27f5000
SizeOfRawData 0x200
PointerToRawData 0x799000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.855685

/65

MD5 24d47287e40f53fb1ece9765894f7416 🔍
SHA1 6bf7edc236cf54c227c0d1e253856a5e54d5cd9b 🔍
SHA256 278174e2b3df8c3c37e6dba0b8046ab5deda8b3adc25012f67de1ed41857c554 🔍
SHA3 a927a760eb15e99a699cea2bbbbd83b68a6033d9669fbbd779b9a2ecebb9ac91 🔍
VirtualSize 0xeaafa
VirtualAddress 0x27f6000
SizeOfRawData 0xeac00
PointerToRawData 0x799200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 7.99797

/78

MD5 a175f5cfa9331478f892620c33be5814 🔍
SHA1 1a4bee90da4168f033cf714b3e49718320382ce3 🔍
SHA256 0f95a3df34c08060b9da37686b3a95e8bdff3bd54a91695c54be4f3ba94043c4 🔍
SHA3 e23801f154426cdd4c7fb80045c1de2dc237ab33a8c2cc38a1dcf81f2a636ad1 🔍
VirtualSize 0x8d561
VirtualAddress 0x28e1000
SizeOfRawData 0x8d600
PointerToRawData 0x883e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 7.99761

/95

MD5 9b6e3cd327eb57aa5c76d35a6f9e7728 🔍
SHA1 fa939760fa6a87af79f50cb3902b46d4e9dcbada 🔍
SHA256 efe9934ef9d8965b15b0133088f838bc31ef2803556e4a9fda8e8303a5dd3530 🔍
SHA3 d6ce871367b5ca2d26283f4b91abd392f810ea1371051f307727368c5332ebde 🔍
VirtualSize 0x394f4
VirtualAddress 0x296f000
SizeOfRawData 0x39600
PointerToRawData 0x911400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 7.99482

/112

MD5 b553899fd2e9aa049fa890c0686403a8 🔍
SHA1 b9aa74ec2f7fcc8d14f0417d53230ff6c83ec2f4 🔍
SHA256 adfd3264cac4ee4dddae3adf34475fc786460deaea6c136dcb9f1c8ba6e321d6 🔍
SHA3 0c360368a26e9c1ccc4fc221c4bfe1d8aeefa241c137dc90c1a5ca109416c7f1 🔍
VirtualSize 0x3a03
VirtualAddress 0x29a9000
SizeOfRawData 0x3c00
PointerToRawData 0x94aa00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 7.72633

.idata

MD5 aff609e314ab9d21b1e28ca85fe5db95 🔍
SHA1 675c8d247a569a35af5ed45fea7fe8219d3852cd 🔍
SHA256 a850bc5b5f8ad33ebc73883893e731ce9fbde10d2fbb8b5a842acf175bfeacde 🔍
SHA3 7ffc6bcb3f53dc15ed5186ce74c24e2eff219c33311e62fb08b37dd2969b8f94 🔍
VirtualSize 0x57c
VirtualAddress 0x29ad000
SizeOfRawData 0x600
PointerToRawData 0x94e600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.29649

.reloc

MD5 b6caabb7f6afd557d12a7f2058fa88d9 🔍
SHA1 f3a393e3b405fc767717bf8f756d11fa161b4079 🔍
SHA256 83ab8a072fa4ac7eff2294913dde8873d54568acdb1224ad23b55f59a8f3ae18 🔍
SHA3 f893d0b97c63cdff5051b9d3dad3e7f0a45cc7e4d7298b4ca73c6642c29d4bea 🔍
VirtualSize 0xf470
VirtualAddress 0x29ae000
SizeOfRawData 0xf600
PointerToRawData 0x94ec00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.43344

.symtab

MD5 ac1aa4f85fef3e39adefdf702134ecbf 🔍
SHA1 b69a54e35cc2d4b7b9fa5cca83903decf6bc9b89 🔍
SHA256 d2e66334f32c2d2a3d1ab396b479236c7422d0111d15044131ab5c692b94d2df 🔍
SHA3 ec6a0d62f3e03a549da004c103d86632dc16f1d8592320be3319406021373ed6 🔍
VirtualSize 0x81c5c
VirtualAddress 0x29be000
SizeOfRawData 0x81e00
PointerToRawData 0x95e200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.37838

.rsrc

MD5 d0a652c3f3a0b968fc8eb4659dcc5894 🔍
SHA1 7c75322d2ef99e724a241aae66b34e336b5465f9 🔍
SHA256 d0e17d9929a12b24469a5e0b4c127e76bb6e97276d7507268046bf920811a844 🔍
SHA3 a9e457a6b00ecbe6c375c7868c355610c8bfe4fc2539f9e116eb42b80bd178fa 🔍
VirtualSize 0x172f0
VirtualAddress 0x2a40000
SizeOfRawData 0x17400
PointerToRawData 0x9e0000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.64236

Imports

kernel32.dll GetProcAddress
LoadLibraryExW
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
QueryPerformanceCounter
PostQueuedCompletionStatus
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler

Delayed Imports

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.13339
MD5 a1756b5ae3da5df04d47a9713a53dc88 🔍
SHA1 010e3f1127fd346d1fb08788dac9d51385aaab68 🔍
SHA256 22320f2488a0d0f74f7d673b7e166b154182d3ad4dbe43e77cd6519078ce29d2 🔍
SHA3 36e5c3c46aefc8195be571328ac19489c7ffb2001a98192f23c0a5c7c73361e9 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.24282
MD5 b653947d05417d08b0caeefe686f2cb7 🔍
SHA1 e080ca611b83e5252317719cc9b05b6170fcff50 🔍
SHA256 96ae72c6e5f07c88f563d199329162ed12984e88a706c5957e91c4dde42d7848 🔍
SHA3 eea37ab6940de9a05d1f6a132aa6de58468ade5c4232ce54a44d22cf57bcdaa3 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.24304
MD5 bd04549d991bf050521bb2165c8b9546 🔍
SHA1 5ae6913fa14aa2e70f7b21e566a5e64d5168a50d 🔍
SHA256 ed6545642ca7ca5f8cc40b1d86d4509c7bb055efa174e07133652fc8548ce4ca 🔍
SHA3 0470554f8c43574113bb42a3b3e15a956a71ab5d270ad4aa9c31c5ed1d53a3d3 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.27702
MD5 a8618dc3738b94ad7804234981fb2a2b 🔍
SHA1 73df22930fe6261cf563e65dbaaff5aaac14642a 🔍
SHA256 d47c9c465af6c469765e36488be1cc4a383c08ee660a65a72b37c964eb02df73 🔍
SHA3 6422f40d935f568b48e2d1b53d47e03697fbff53a09abf98747ffe40987eb65d 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xf20f
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.99263
Detected Filetype PNG graphic file
MD5 682a203c96ad6417392a679c34ca636d 🔍
SHA1 213cc9db08da6c13f38abcddd813350167237b87 🔍
SHA256 4d0e723327dfa548862d1c0d4aa4a82977760c51270c71d1f2e725d99c48aef9 🔍
SHA3 5940e89ad097e681fc47523b53dd6a0a4c3e8f4230002c46bef341da1aba391f 🔍

2

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.70088
Detected Filetype Icon file
MD5 92c2a8ec23eb6f52e218045312925086 🔍
SHA1 fc8b95dc57cab34f93da5e5a18cfb05f2b8d3da8 🔍
SHA256 c4414eefca5434d1501843abfb4b64f689ff127a52d0c1987e6de790be023336 🔍
SHA3 62a729b61f6faad56081b42218b40aa6490d0ba4da958df5c6c6f873cd15f086 🔍

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x203
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.03868
MD5 704ef24d0dd5468b938468e6e3a90c84 🔍
SHA1 26b7bbf5f0889710fa1383478073604dc859cebd 🔍
SHA256 e7e121634146802a9581a437b89f01e8565efa2c3f280df19743119b87e8136c 🔍
SHA3 b665826e3b25d0a42541a331f5a9733a0c5345cc4a8edb77be888b796b1e94d0 🔍

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

[*] Warning: Tried to read outside the COFF string table to get the name of section /4! [*] Warning: Tried to read outside the COFF string table to get the name of section /19! [*] Warning: Tried to read outside the COFF string table to get the name of section /32! [*] Warning: Tried to read outside the COFF string table to get the name of section /46! [*] Warning: Tried to read outside the COFF string table to get the name of section /65! [*] Warning: Tried to read outside the COFF string table to get the name of section /78! [*] Warning: Tried to read outside the COFF string table to get the name of section /95! [*] Warning: Tried to read outside the COFF string table to get the name of section /112!
Leave a comment

No comments yet.