2e7c984e220a8ee2caf781b945d1d58c5e7571f8f2e071517255a90e16d2398c

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2025-May-12 19:40:42
Detected languages English - United States

Plugin Output

Info Matching compiler(s): Microsoft Visual C# v7.0 / Basic .NET
MASM/TASM - sig1(h)
Suspicious Strings found in the binary may indicate undesirable behavior: May have dropper capabilities:
  • CurrentControlSet\Services
 Contains another PE executable:
  • This program cannot be run in DOS mode.
 Contains domain names:
  • google.com
  • http://scripts.sil.org
  • http://scripts.sil.org/OFL
  • http://scripts.sil.org/OFLhttp
  • http://www.google.com
  • http://www.google.com/fontshttp
  • http://www.hubertfischer.comThis
  • openssl.org
  • scripts.sil.org
  • www.google.com
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to MD5
Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to SHA512
Uses constants related to AES
Uses constants related to Blowfish
Microsoft's Cryptography API
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
  • LoadLibraryW
 Functions which can be used for anti-debugging purposes:
  • SwitchToThread
 Can access the registry:
  • RegOpenKeyExW
  • RegEnumKeyExW
  • RegQueryInfoKeyW
  • RegEnumValueW
  • RegCloseKey
 Possibly launches other programs:
  • CreateProcessA
 Uses Microsoft's cryptographic API:
  • CryptEnumProvidersW
  • CryptSignHashW
  • CryptDestroyHash
  • CryptCreateHash
  • CryptDecrypt
  • CryptExportKey
  • CryptGetUserKey
  • CryptGetProvParam
  • CryptSetHashParam
  • CryptDestroyKey
  • CryptReleaseContext
  • CryptAcquireContextW
  • CryptCATCatalogInfoFromContext
  • CryptCATAdminCalcHashFromFileHandle
  • CryptCATAdminReleaseContext
  • CryptCATAdminAcquireContext
  • CryptCATAdminReleaseCatalogContext
  • CryptCATAdminEnumCatalogFromHash
 Can create temporary files:
  • CreateFileA
  • GetTempPathA
  • CreateFileW
 Leverages the raw socket API to access the Internet:
  • WS2_32.dll
 Functions related to the privilege level:
  • LsaEnumerateLogonSessions
 Enumerates local disk drives:
  • GetLogicalDriveStringsW
 Reads the contents of the clipboard:
  • GetClipboardData
 Interacts with the certificate store:
  • CertOpenStore
Info The PE is digitally signed. Signer: espouken
Issuer: espouken
Malicious VirusTotal score: 35/71 (Scanned on 2026-10-08 19:46:01) ALYac: Trojan.GenericKD.78935338
AVG: Win64:PUP-gen [PUP]
Alibaba: Trojan:Win64/Redcap.ae82ebdb
Arcabit: Trojan.Generic.D4B4752A
Avast: Win64:PUP-gen [PUP]
Avira: PUA/W64.UnwantedX
BitDefender: Trojan.GenericKD.78935338
Bkav: W32.Malware.3EE1E028
CTX: exe.trojan.tnega
DeepInstinct: MALICIOUS
DrWeb: Trojan.Inject5.62898
Elastic: malicious (moderate confidence)
Emsisoft: Trojan.GenericKD.78935338 (B)
F-Secure: PotentialRisk.PUA/W64.UnwantedX
Fortinet: Riskware/Application
GData: Trojan.GenericKD.78935338
Google: Detected
Gridinsoft: Trojan.Win64.Kryptik.dd!c
Ikarus: PUA.RiskWare.Hacktool
Kingsoft: Win32.Troj.Tnega.v
Lionic: Trojan.Win32.Tnega.4!c
MaxSecure: Trojan.Malware.337453387.susgen
McAfeeD: ti!2E7C984E220A
MicroWorld-eScan: Trojan.GenericKD.78935338
Microsoft: Adware:Win32/Tnega!MTB
Paloalto: generic.ml
Rising: Trojan.Kryptik@AI.80 (RDML:+wPCER1IVuVS1Uy46I5NZg)
Skyhigh: Artemis!PUP
Sophos: Generic Reputation PUA (PUA)
Symantec: ML.Attribute.HighConfidence
TrellixENS: Artemis!02D7B50296FA
VBA32: Trojan.Inject
VIPRE: Trojan.GenericKD.78935338
Varist: W64/ABApplication.LEBR-5712
alibabacloud: Suspicious

Hashes

MD5 02d7b50296fa2ef337e25079d5e32cd8 🔍
SHA1 6ae99e12a438c2b85ac94870cb7d7d6c77531391 🔍
SHA256 2e7c984e220a8ee2caf781b945d1d58c5e7571f8f2e071517255a90e16d2398c 🔍
SHA3 84e36cb7a3424dd5bded946da17919ba09e2f33ff001d232913d2f1d538d118a 🔍
SSDeep 49152:DOjPW8JTKuk2wmIU6iZiD+I8H2ENUk91n2asKOImcoNTULJ8vyYfOh5P+TNxiPkS:th+nU6ZZtuRxn7e 🔍
Imports Hash bf7c38991b6d7d71a66701f1b6e20dbf 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x128

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2025-May-12 19:40:42
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x209000
SizeOfInitializedData 0xf1a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000207EC8 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x2ff000
SizeOfHeaders 0x400
Checksum 0x30196c
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 bba36edc7e021365c221056dcec488d3 🔍
SHA1 c6045524d7c36536a26029038a049d3fdcec40a0 🔍
SHA256 e26a9de6d11f52188114dfe0d0b4d887c78431157d8e1c879dabb35f2e68ade7 🔍
SHA3 fdd96253f042650bf1a8b6267366e7870353685506c82ad908bb02f9412e016d 🔍
VirtualSize 0x208f83
VirtualAddress 0x1000
SizeOfRawData 0x209000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.79429

.rdata

MD5 dfe2763552e89f6cbfbb4cc1a6dbf799 🔍
SHA1 a84e4838b81a480af2c57ecc09a898c5ccdd0ccf 🔍
SHA256 4a3294f8bb3965586f3f709c223d2be4c935a94f53a737541044e96f17925c4d 🔍
SHA3 48851128f993fc8a62a1e9dbbc3b712d34099a667a20d2fdd9d79f32e2504fc7 🔍
VirtualSize 0xbbc24
VirtualAddress 0x20a000
SizeOfRawData 0xbbe00
PointerToRawData 0x209400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.96551

.data

MD5 cf0d0df6498feadea624aae01a49d745 🔍
SHA1 1f3e6d63ef1af056ef1f98c3917b425af3f354b2 🔍
SHA256 8bcf1d1ab054ccec7ec514e708e82cb6e5e52e56531766d2b340d1f6732743ba 🔍
SHA3 12b0bbfa43b211de80893196c0b6a675626b1f982aae65743c1e0400d8bbe145 🔍
VirtualSize 0x1d3f0
VirtualAddress 0x2c6000
SizeOfRawData 0x19600
PointerToRawData 0x2c5200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.05815

.pdata

MD5 47e4cf6c823066166b95e5567f82c89c 🔍
SHA1 decf1371cd0fdc11c9ea8831109b2d2d9a2160ff 🔍
SHA256 466123fe0fe9f8d83120d81937797838d2b3176bb16f88abb50be41820206ade 🔍
SHA3 4776959b70d03f86311093fae51bb98c05e22b8f7bceab870339a5aa366784fc 🔍
VirtualSize 0x13278
VirtualAddress 0x2e4000
SizeOfRawData 0x13400
PointerToRawData 0x2de800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.1613

.rsrc

MD5 cec0d7024db57e615b34abecdf01f01e 🔍
SHA1 a9a788582a6f9353eab49975b7e5252724caca6b 🔍
SHA256 6097d02ad44a68b7562bd1b36f4ef4ee9fdfaa2fbb2668ed5f34e4acbc3d1de2 🔍
SHA3 3ba5a8816e86d65cb8058e8f3aa3064be03f03119d985ffff52756596b7423d2 🔍
VirtualSize 0x1e8
VirtualAddress 0x2f8000
SizeOfRawData 0x200
PointerToRawData 0x2f1c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.75904

.reloc

MD5 720a98c013765e38e1b856bd32f15376 🔍
SHA1 f80e85c683c6e32d3dc94b3216dee3042c0fb24c 🔍
SHA256 7df0c250177dc59ff76b788f909a082ab05add50f7e5f7510d2038289bf7610c 🔍
SHA3 4ec2dd35553dc1f1a253b651869d80b4191067d3c2c54589f34383bc0a4a3172 🔍
VirtualSize 0x5060
VirtualAddress 0x2f9000
SizeOfRawData 0x5200
PointerToRawData 0x2f1e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.42499

Imports

KERNEL32.dll CreateFileMappingA
GetCurrentProcess
GetStdHandle
GetEnvironmentVariableW
GetFileType
WriteFile
GetModuleHandleW
SetLastError
GetCurrentProcessId
SwitchToThread
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetModuleHandleExW
RtlVirtualUnwind
MapViewOfFile
GetFileSizeEx
CreateFileA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentThreadId
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
HeapCreate
DeleteFiber
GetFileAttributesA
CreateDirectoryA
CreateProcessA
GetLastError
GetTempPathA
WaitForSingleObject
QueryPerformanceCounter
FreeLibrary
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GetModuleHandleA
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
GetSystemTime
WideCharToMultiByte
SystemTimeToFileTime
FileTimeToLocalFileTime
CloseHandle
FileTimeToSystemTime
TzSpecificLocalTimeToSystemTime
GetLogicalDriveStringsW
CreateFileW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetFileInformationByHandleEx
AreFileApisANSI
ConvertFiberToThread
LoadLibraryW
FindClose
FindFirstFileW
FindNextFileW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
LocalFree
FormatMessageA
GetLocaleInfoEx
FindFirstFileExW
GetFileAttributesExW
SetFileInformationByHandle
UnmapViewOfFile
CompareFileTime
QueryDosDeviceW
USER32.dll LoadCursorA
UpdateWindow
RegisterClassExA
PostQuitMessage
UnregisterClassA
SetClipboardData
PeekMessageA
TranslateMessage
CreateWindowExA
DefWindowProcA
SetCapture
TrackMouseEvent
ScreenToClient
GetCapture
ClientToScreen
IsChild
GetForegroundWindow
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
ReleaseCapture
GetClientRect
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
DestroyIcon
GetClipboardData
ShowWindow
DispatchMessageA
DestroyWindow
GetIconInfo
SetCursor
GDI32.dll DeleteObject
GetObjectA
SelectObject
CreateCompatibleDC
GetDIBits
DeleteDC
ADVAPI32.dll DeregisterEventSource
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
RegEnumValueW
RegCloseKey
SHELL32.dll SHGetFileInfoA
d3d9.dll Direct3DCreate9
CRYPT32.dll CertFindCertificateInStore
CertCloseStore
CertFreeCertificateContext
CertNameToStrA
CertDuplicateCertificateContext
CertOpenStore
CertGetCertificateContextProperty
CertEnumCertificatesInStore
WS2_32.dll closesocket
WSACleanup
WSAGetLastError
recv
send
WSASetLastError
MSVCP140.dll ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?fail@ios_base@std@@QEBA_NXZ
?good@ios_base@std@@QEBA_NXZ
?_Throw_Cpp_error@std@@YAXH@Z
?_Winerror_map@std@@YAHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Syserror_map@std@@YAPEBDH@Z
_Mtx_lock
_Mtx_unlock
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??7ios_base@std@@QEBA_NXZ
??Bios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Thrd_join
?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD4@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?uncaught_exceptions@std@@YAHXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?_Xbad_alloc@std@@YAXXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Id_cnt@id@locale@std@@0HA
?_Xout_of_range@std@@YAXPEBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?id@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Getcat@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?get@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEB_W4@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
WINTRUST.dll WinVerifyTrust
CryptCATCatalogInfoFromContext
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminReleaseContext
WTHelperGetProvCertFromChain
CryptCATAdminAcquireContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminEnumCatalogFromHash
SHLWAPI.dll PathFileExistsW
Secur32.dll LsaFreeReturnBuffer
LsaEnumerateLogonSessions
LsaGetLogonSessionData
IMM32.dll ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
bcrypt.dll BCryptGenRandom
VCRUNTIME140_1.dll __CxxFrameHandler4
VCRUNTIME140.dll __std_exception_destroy
__std_exception_copy
__std_terminate
strstr
_CxxThrowException
__intrinsic_setjmp
__current_exception_context
strchr
wcsstr
memchr
memmove
__C_specific_handler
longjmp
strrchr
memcmp
memcpy
memset
__current_exception
api-ms-win-crt-heap-l1-1-0.dll calloc
malloc
_callnewh
free
realloc
_set_new_mode
api-ms-win-crt-string-l1-1-0.dll isspace
strspn
strcspn
_strdup
strcmp
tolower
_strnicmp
strncpy
strncmp
_stricmp
isdigit
isxdigit
strnlen
isprint
api-ms-win-crt-runtime-l1-1-0.dll raise
strerror_s
_register_thread_local_exe_atexit_callback
_c_exit
_invalid_parameter_noinfo_noreturn
exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_set_app_type
abort
_seh_filter_exe
_cexit
_crt_atexit
_errno
signal
_configure_narrow_argv
_register_onexit_function
_initialize_narrow_environment
_exit
_beginthreadex
_initialize_onexit_table
_wassert
terminate
api-ms-win-crt-stdio-l1-1-0.dll fopen
_close
_filelength
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
_sopen_s
clearerr
fgetc
fputc
ferror
getc
fputs
__stdio_common_vsscanf
fread
_setmode
__stdio_common_vsprintf
_wfopen
fwrite
_fileno
fgets
fseek
fclose
fflush
__acrt_iob_func
feof
ftell
_set_fmode
__p__commode
_read
__stdio_common_vswprintf
__stdio_common_vfprintf
_get_stream_buffer_pointers
api-ms-win-crt-utility-l1-1-0.dll qsort
srand
rand
api-ms-win-crt-convert-l1-1-0.dll strtoul
atof
strtod
strtol
strtoll
_strtoi64
atoi
api-ms-win-crt-filesystem-l1-1-0.dll _lock_file
_stat64i32
_unlock_file
api-ms-win-crt-time-l1-1-0.dll _time64
_mktime64
_mkgmtime64
_gmtime64_s
api-ms-win-crt-math-l1-1-0.dll fmodf
_dclass
log2
cosf
_isnan
__setusermatherr
ceilf
acosf
pow
sinf
sqrtf
api-ms-win-crt-locale-l1-1-0.dll ___lc_codepage_func
_configthreadlocale
localeconv
api-ms-win-crt-environment-l1-1-0.dll getenv

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x188
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.89623
MD5 b8e76ddb52d0eb41e972599ff3ca431b 🔍
SHA1 fc12d7ad112ddabfcd8f82f290d84e637a4d62f8 🔍
SHA256 165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8 🔍
SHA3 37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd 🔍

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2025-May-12 19:40:42
Version 0.0
SizeofData 928
AddressOfRawData 0x2ab904
PointerToRawData 0x2aad04

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2025-May-12 19:40:42
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

StartAddressOfRawData 0x1402abcc8
EndAddressOfRawData 0x1402abcd0
AddressOfIndex 0x1402e2dec
AddressOfCallbacks 0x14020ae38
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1402d8ac0

RICH Header

XOR Key 0x4d75c8d9
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 22
253 (34321) 3
ASM objects (34321) 4
C objects (34321) 10
C++ objects (34321) 36
Imports (34321) 6
C objects (VS2015 UPD3.1 build 24215) 10
ASM objects (VS2017 v15.9.19 compiler 27035) 28
C objects (VS2017 v15.9.19 compiler 27035) 503
C objects (33521) 54
Imports (30795) 29
Total imports 511
C++ objects (LTCG) (34809) 12
Resource objects (34809) 1
Linker (34809) 1

Errors

Leave a comment

No comments yet.