Manalyze report for 43ad75f9e60dce92af8e90dbe76d4c1e1002c6607fef432c7e21236c19a223c8

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Jul-05 14:03:29
TLS Callbacks	6 callback(s) detected.
Debug artifacts	UpdaterSetup.exe.pdb

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C++ 6.0 - 8.0`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`Contains references to system / monitoring tools: rundll32.exe` `May have dropper capabilities: CurrentControlSet\Services CurrentVersion\Run` `Contains another PE executable: This program cannot be run in DOS mode.` `Miscellaneous malware strings: cmd.exe` `References the BITS service` Contains domain names: birthpopuptypesapplyImagebeinguppernoteseveryshowsmeansextramatchtrackknownearlybegansuperpapernorthlearngivennamedendedTermspartsGroupbrandusingwomanfalsereadyaudiotakeswhile.com cacerts.digicert.com chromium.org clients2.google.com crashpad.chromium.org crl3.digicert.com crl4.digicert.com digicert.com dl.google.com genretrucklooksValueFrame.net google.com googleapis.com http://cacerts.digicert.com http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0 http://cacerts.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crt0_ http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C http://crl3.digicert.com http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0 http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S http://crl3.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crl0 http://crl3.digicert.com/DigiCertTrustedRootG4.crl0 http://crl4.digicert.com http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0 http://ocsp.digicert.com0 http://ocsp.digicert.com0A http://ocsp.digicert.com0C http://ocsp.digicert.com0\ http://support.google.com http://support.google.com/installer/ http://www.C http://www.a http://www.css http://www.digicert.com http://www.digicert.com/CPS0 http://www.hortcut http://www.icon http://www.interpretation http://www.language http://www.style http://www.text-decoration http://www.w3.org http://www.w3.org/shortcut http://www.wencodeURIComponent http://www.years https://clients2.google.com https://clients2.google.com/cr/report https://crashpad.chromium.org https://crashpad.chromium.org/ https://crashpad.chromium.org/bug/new https://dl.google.com https://dl.google.com/update2/installers/icons/ https://play.googleapis.com https://play.googleapis.com/log https://update.googleapis.com https://update.googleapis.com/service/update2/json https://www.World https://www.recent openssl.org play.googleapis.com support.google.com thing.org update.googleapis.com www.digicert.com www.w3.org
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32` `Uses constants related to MD5` `Uses constants related to SHA1` `Uses constants related to SHA256` `Uses constants related to SHA512`
Suspicious	The PE is possibly packed.	`Unusual section name found: CPADinfo` `Unusual section name found: malloc_h`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryExA LoadLibraryExW LoadLibraryW` `Functions which can be used for anti-debugging purposes: CreateToolhelp32Snapshot SwitchToThread NtQueryInformationProcess` `Can access the registry: RegCloseKey RegCreateKeyExW RegDeleteKeyExW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW` `Possibly launches other programs: CreateProcessAsUserW CreateProcessWithTokenW CreateProcessW` `Uses Windows's Native API: NtDeleteKey NtQueryInformationProcess NtQueryObject` `Can create temporary files: CreateFileA CreateFileW GetTempPathW` `Memory manipulation functions often used by packers: VirtualAlloc VirtualProtect` `Has Internet access capabilities: WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpGetProxyForUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetStatusCallback` `Functions related to the privilege level: AdjustTokenPrivileges CheckTokenMembership DuplicateTokenEx OpenProcessToken` `Interacts with services: ChangeServiceConfigW CreateServiceW DeleteService OpenSCManagerW OpenServiceW QueryServiceConfigW` `Enumerates local disk drives: GetDriveTypeW` `Manipulates other processes: OpenProcess Process32FirstW Process32NextW ReadProcessMemory` `Changes object ACLs: SetNamedSecurityInfoW SetSecurityInfo`
Info	The PE is digitally signed.	`Signer: Google LLC` `Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1`
Safe	VirusTotal score: 0/71 (Scanned on 2026-10-15 07:52:28)	`All the AVs think this file is safe.`

Hashes

MD5	`f6f38a76de48f0d81935624661141d03` 🔍
SHA1	`db5599f3de40aa340d5c36637cc5889355684a90` 🔍
SHA256	`43ad75f9e60dce92af8e90dbe76d4c1e1002c6607fef432c7e21236c19a223c8` 🔍
SHA3	`65a24c774bd751a1a5c13a1e3d233adbdafa45a2347157585b9e3a66016ad7d5` 🔍
SSDeep	`196608:XBUF+eb6FLXBpbbSnW0uXhq0ww0dqcoFKMOC7mipZ5i+z8vHJiaVb/8dtU1Msot8:XBUF+eOFLXBpbbSnW0uXhVwNdqcn5C7e` 🔍
Imports Hash	`66558e195499928411d1632df64272c9` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x78`
e_cp	`0x1`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0`
e_ss	`0`
e_sp	`0`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x78`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`9`
TimeDateStamp	2026-Jul-05 14:03:29
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`14.0`
SizeOfCode	`0x38e600`
SizeOfInitializedData	`0x842c00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00221C10 (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`A.0`
ImageVersion	`0.0`
SubsystemVersion	`A.0`
Win32VersionValue	`0`
SizeOfImage	`0xc00000`
SizeOfHeaders	`0x400`
Checksum	`0xbd65c0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_GUARD_CF` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`77bce1ad8547dbabd8fc65bd44765434 🔍`
SHA1	`4c7bba98054f0b9beccf4bf3e3d4dd80c72ce0f6 🔍`
SHA256	`b6feb4d117e0d748011709ac4191eb81f8b5cb9712e2a984614669f12ca873a6 🔍`
SHA3	`b178172ee403ebe664e54b913dcf07706bc63d28531509d0c89c25f9dbcbdcbb 🔍`
VirtualSize	`0x38e5dc`
VirtualAddress	`0x1000`
SizeOfRawData	`0x38e600`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.69858`

.rdata

MD5	`6a01e96ba2d31514574ddd77116757e0 🔍`
SHA1	`cc4d0dbeb8b6b20ac8f9c84fbe3097ca21060484 🔍`
SHA256	`5b59643edbfd9ddcfad4cdd0b559c177c03b9b6ae8db304a66565eea47e2e134 🔍`
SHA3	`a9f46765823487ad6570abed768c84add9d3de477238ac7fccb6ef9108c28154 🔍`
VirtualSize	`0x86208`
VirtualAddress	`0x390000`
SizeOfRawData	`0x86400`
PointerToRawData	`0x38ea00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.0772`

.data

MD5	`9fa9499d9bf42ccc4db849baa4e0af20 🔍`
SHA1	`7eca4be9b7edc91a32f6b08a78165e4236b3017a 🔍`
SHA256	`2d52ad4a58122f9b5c56fc1c06c6c50cb9c3fd9a0e9d44dc22daf8e319603470 🔍`
SHA3	`b6e06903a808576634e951793988f87e04007fc22cfe0c455479dfd391b062bf 🔍`
VirtualSize	`0x2d094`
VirtualAddress	`0x417000`
SizeOfRawData	`0x5400`
PointerToRawData	`0x414e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`3.68218`

.fptable

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x80`
VirtualAddress	`0x445000`
SizeOfRawData	`0x200`
PointerToRawData	`0x41a200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.tls

MD5	`b87505e7f4efe229cd71b5a7eb449528 🔍`
SHA1	`267c3edcf08da54dce699ee32b154ab1d835fac1 🔍`
SHA256	`e52713f8f0a80e5d0e11d04fcb553df3e9d262cfb4bff380af14fc99420bba0c 🔍`
SHA3	`42c0191fa3c6635c51a4c85bcdbe1da4a4b32b66f09766e03008865e6d486bd2 🔍`
VirtualSize	`0x1b5`
VirtualAddress	`0x446000`
SizeOfRawData	`0x200`
PointerToRawData	`0x41a400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.362891`

CPADinfo

MD5	`842689af09e7bf563672a4b43f1a2286 🔍`
SHA1	`87fd79e9cdafca9f691aeb6345b577953f4f53d0 🔍`
SHA256	`c6ab4dedabd0103aa45921ac166f6a9046356cb6073e10e06a3a8503472530cf 🔍`
SHA3	`abbb3e8624739cecd33afe9b57a68095eefc456c46e7dcc62374ca1c59012890 🔍`
VirtualSize	`0x28`
VirtualAddress	`0x447000`
SizeOfRawData	`0x200`
PointerToRawData	`0x41a600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.122276`

malloc_h

MD5	`5f439edb45aeae4e9804608c3fe499a1 🔍`
SHA1	`6f97fe23acf6f42596b95aa6886b9939df36502b 🔍`
SHA256	`a2faadef39f27c6835ea205e158562a7ce902ffda993f592e5d99c16e513b2f1 🔍`
SHA3	`097bd62d6132be7e88bc976a2e2e3eef2698ff47ce0d6ae8155952503ab11a20 🔍`
VirtualSize	`0x30b`
VirtualAddress	`0x448000`
SizeOfRawData	`0x400`
PointerToRawData	`0x41a800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.35548`

.rsrc

MD5	`ff102d7604c0eb6b25788a3b6f6848d3 🔍`
SHA1	`1942656f1b3183d0707437b1cbe50b87b00d91f0 🔍`
SHA256	`a8d019874f01c1cbbefa0c7ca1db4a0780daad5545bc9a06cb6a2a4179936362 🔍`
SHA3	`1ee06fb64d2b8868647475feb540ca48f6dded037f983af538c6d2a811482e21 🔍`
VirtualSize	`0x79acbc`
VirtualAddress	`0x449000`
SizeOfRawData	`0x79ae00`
PointerToRawData	`0x41ac00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.6008`

.reloc

MD5	`742a292c83e3e658ab295c610575548c 🔍`
SHA1	`97ec34d322d6353e7989b0b4851b5d7a8d75f095 🔍`
SHA256	`67610493659b6ed84532f71ae3af412c9269fa908132620e6be0f9ae01f466c9 🔍`
SHA3	`13e6cd88f7f8aacec5a9405eb5bd938c76bd8d0968ffeb41ca759e419537ab47 🔍`
VirtualSize	`0x1be04`
VirtualAddress	`0xbe4000`
SizeOfRawData	`0x1c000`
PointerToRawData	`0xbb5a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`6.73358`

Imports

ADVAPI32.dll	`AddAce` `AdjustTokenPrivileges` `BuildTrusteeWithSidW` `ChangeServiceConfig2W` `ChangeServiceConfigW` `CheckTokenMembership` `CloseServiceHandle` `ConvertSecurityDescriptorToStringSecurityDescriptorW` `ConvertSidToStringSidW` `ConvertStringSecurityDescriptorToSecurityDescriptorW` `ConvertStringSidToSidW` `CopySid` `CreateProcessAsUserW` `CreateProcessWithTokenW` `CreateServiceW` `DeleteService` `DuplicateTokenEx` `EqualSid` `GetAce` `GetAclInformation` `GetLengthSid` `GetNamedSecurityInfoW` `GetSecurityDescriptorControl` `GetSecurityDescriptorDacl` `GetSecurityDescriptorGroup` `GetSecurityDescriptorOwner` `GetSecurityDescriptorSacl` `GetSecurityInfo` `GetSidIdentifierAuthority` `GetSidLengthRequired` `GetSidSubAuthority` `GetSidSubAuthorityCount` `GetTokenInformation` `GetTraceEnableFlags` `GetTraceEnableLevel` `GetTraceLoggerHandle` `ImpersonateLoggedOnUser` `InitializeAcl` `InitializeSid` `IsValidAcl` `IsValidSecurityDescriptor` `IsValidSid` `LookupAccountSidW` `LookupPrivilegeValueW` `OpenProcessToken` `OpenSCManagerW` `OpenServiceW` `OpenThreadToken` `QueryServiceConfigW` `RegCloseKey` `RegCreateKeyExW` `RegDeleteKeyExW` `RegDeleteValueW` `RegEnumKeyExW` `RegEnumValueW` `RegOpenKeyExW` `RegQueryInfoKeyW` `RegQueryValueExW` `RegSetValueExW` `RegisterTraceGuidsW` `RevertToSelf` `SetEntriesInAclW` `SetNamedSecurityInfoW` `SetSecurityInfo` `TraceEvent` `UnregisterTraceGuids`
dbghelp.dll	`SymCleanup` `SymFromAddr` `SymGetLineFromAddr64` `SymGetModuleInfo64` `SymGetSearchPathW` `SymInitialize` `SymSetOptions` `SymSetSearchPathW`
GDI32.dll	`CreateCompatibleDC` `CreateDIBSection` `DeleteDC` `DeleteObject` `GetObjectW` `GetStockObject` `SelectObject` `SetBrushOrgEx` `SetStretchBltMode` `StretchBlt`
OLEAUT32.dll	`LoadTypeLib` `SafeArrayAccessData` `SafeArrayCreateVector` `SafeArrayDestroy` `SafeArrayGetDim` `SafeArrayGetLBound` `SafeArrayGetUBound` `SafeArrayGetVartype` `SafeArrayUnaccessData` `SysAllocString` `SysAllocStringByteLen` `SysAllocStringLen` `SysFreeString` `SystemTimeToVariantTime` `VariantClear`
SHELL32.dll	`CommandLineToArgvW` `#680` `SHGetFolderPathW` `SHGetKnownFolderPath` `ShellExecuteExW`
USER32.dll	`AllowSetForegroundWindow` `BeginPaint` `CharUpperW` `CreateWindowExW` `DefWindowProcW` `DestroyIcon` `DestroyWindow` `DispatchMessageW` `EndPaint` `GetActiveWindow` `GetClassInfoExW` `GetClientRect` `GetDesktopWindow` `GetDpiForWindow` `GetGuiResources` `GetMessageW` `GetQueueStatus` `GetShellWindow` `GetSystemMetrics` `GetWindowLongW` `GetWindowRect` `GetWindowThreadProcessId` `InvalidateRect` `IsDialogMessageW` `IsWindow` `KillTimer` `LoadImageW` `LoadStringW` `MessageBoxExW` `MsgWaitForMultipleObjectsEx` `PeekMessageW` `PostMessageW` `PostQuitMessage` `RegisterClassExW` `SendMessageW` `SetForegroundWindow` `SetTimer` `SetWindowLongW` `SetWindowPos` `ShowWindow` `SystemParametersInfoW` `TranslateMessage` `UnregisterClassW` `UpdateWindow`
KERNEL32.dll	`AcquireSRWLockExclusive` `AcquireSRWLockShared` `AssignProcessToJobObject` `CancelIoEx` `CloseHandle` `CompareStringW` `ConnectNamedPipe` `CopyFileW` `CreateDirectoryW` `CreateEventW` `CreateFileA` `CreateFileMappingW` `CreateFileW` `CreateIoCompletionPort` `CreateMutexW` `CreateNamedPipeW` `CreatePipe` `CreateProcessW` `CreateThread` `CreateToolhelp32Snapshot` `DecodePointer` `DeleteCriticalSection` `DeleteFileW` `DeleteProcThreadAttributeList` `DeviceIoControl` `DuplicateHandle` `EncodePointer` `EnterCriticalSection` `EnumResourceNamesW` `EnumSystemLocalesW` `ExitProcess` `ExpandEnvironmentStringsW` `FileTimeToLocalFileTime` `FileTimeToSystemTime` `FindClose` `FindFirstFileExW` `FindFirstFileW` `FindNextFileW` `FindResourceW` `FlsAlloc` `FlsFree` `FlsGetValue` `FlsSetValue` `FlushFileBuffers` `FormatMessageW` `FreeEnvironmentStringsW` `FreeLibrary` `GetACP` `GetCPInfo` `GetCommandLineA` `GetCommandLineW` `GetConsoleMode` `GetConsoleOutputCP` `GetCurrentDirectoryW` `GetCurrentProcess` `GetCurrentProcessId` `GetCurrentThread` `GetCurrentThreadId` `GetDateFormatW` `GetDiskFreeSpaceExW` `GetDriveTypeW` `GetEnvironmentStringsW` `GetEnvironmentVariableW` `GetExitCodeProcess` `GetFileAttributesExW` `GetFileAttributesW` `GetFileInformationByHandle` `GetFileInformationByHandleEx` `GetFileSize` `GetFileSizeEx` `GetFileType` `GetFullPathNameW` `GetLastError` `GetLocalTime` `GetLocaleInfoW` `GetLogicalProcessorInformation` `GetLogicalProcessorInformationEx` `GetLongPathNameW` `GetModuleFileNameW` `GetModuleHandleA` `GetModuleHandleExA` `GetModuleHandleExW` `GetModuleHandleW` `GetNamedPipeClientProcessId` `GetNamedPipeServerProcessId` `GetNativeSystemInfo` `GetOEMCP` `GetOverlappedResult` `GetProcAddress` `GetProcessHeap` `GetProcessId` `GetProcessInformation` `GetProcessMitigationPolicy` `GetProcessTimes` `GetProductInfo` `GetQueuedCompletionStatus` `GetStartupInfoW` `GetStdHandle` `GetStringTypeW` `GetSystemDirectoryW` `GetSystemInfo` `GetSystemTimeAsFileTime` `GetSystemTimePreciseAsFileTime` `GetTempPathW` `GetThreadId` `GetThreadPreferredUILanguages` `GetThreadPriority` `GetTickCount` `GetTimeFormatW` `GetTimeZoneInformation` `GetUserDefaultLCID` `GetUserPreferredUILanguages` `GetVersionExW` `GetWindowsDirectoryW` `GlobalAlloc` `GlobalFree` `GlobalMemoryStatusEx` `HeapAlloc` `HeapDestroy` `HeapFree` `HeapReAlloc` `HeapSetInformation` `HeapSize` `InitOnceExecuteOnce` `InitializeConditionVariable` `InitializeCriticalSectionEx` `InitializeProcThreadAttributeList` `InitializeSListHead` `InitializeSRWLock` `InterlockedPushEntrySList` `IsDebuggerPresent` `IsProcessorFeaturePresent` `IsValidCodePage` `IsValidLocale` `IsWow64Process` `K32GetModuleInformation` `K32GetProcessMemoryInfo` `LCMapStringW` `LeaveCriticalSection` `LoadLibraryExA` `LoadLibraryExW` `LoadLibraryW` `LoadResource` `LocalFree` `LockResource` `MapViewOfFile` `MoveFileExW` `MoveFileW` `MulDiv` `MultiByteToWideChar` `OpenProcess` `OutputDebugStringA` `OutputDebugStringW` `PeekNamedPipe` `PostQueuedCompletionStatus` `Process32FirstW` `Process32NextW` `ProcessIdToSessionId` `QueryFullProcessImageNameW` `QueryPerformanceCounter` `QueryPerformanceFrequency` `QueryThreadCycleTime` `RaiseException` `ReadConsoleW` `ReadFile` `ReadProcessMemory` `RegisterWaitForSingleObject` `ReleaseMutex` `ReleaseSRWLockExclusive` `ReleaseSRWLockShared` `RemoveDirectoryW` `ReplaceFileW` `ResetEvent` `RtlCaptureStackBackTrace` `RtlUnwind` `SetCurrentDirectoryW` `SetDefaultDllDirectories` `SetEndOfFile` `SetEnvironmentVariableW` `SetEvent` `SetFileAttributesW` `SetFileInformationByHandle` `SetFilePointer` `SetFilePointerEx` `SetFileTime` `SetHandleInformation` `SetInformationJobObject` `SetLastError` `SetPriorityClass` `SetProcessInformation` `SetProcessWorkingSetSize` `SetStdHandle` `SetThreadInformation` `SetThreadPriority` `SetUnhandledExceptionFilter` `SizeofResource` `Sleep` `SleepConditionVariableSRW` `SwitchToThread` `SystemTimeToFileTime` `SystemTimeToTzSpecificLocalTime` `TerminateProcess` `TlsAlloc` `TlsFree` `TlsGetValue` `TlsSetValue` `TryAcquireSRWLockExclusive` `TzSpecificLocalTimeToSystemTime` `UnhandledExceptionFilter` `UnmapViewOfFile` `UnregisterWaitEx` `UpdateProcThreadAttribute` `VerSetConditionMask` `VerifyVersionInfoW` `VirtualAlloc` `VirtualFree` `VirtualProtect` `VirtualQuery` `WTSGetActiveConsoleSessionId` `WaitForMultipleObjects` `WaitForSingleObject` `WaitNamedPipeW` `WakeAllConditionVariable` `WakeConditionVariable` `WideCharToMultiByte` `WriteConsoleW` `WriteFile` `lstrcmpW` `lstrcmpiW`
ole32.dll	`CoAddRefServerProcess` `CoCreateInstance` `CoGetCallContext` `CoInitializeEx` `CoRegisterClassObject` `CoRegisterInitializeSpy` `CoReleaseServerProcess` `CoResumeClassObjects` `CoRevokeClassObject` `CoRevokeInitializeSpy` `CoTaskMemFree` `CoUninitialize` `IIDFromString` `StringFromGUID2`
ntdll.dll	`NtDeleteKey` `NtQueryInformationProcess` `NtQueryObject` `RtlGetVersion`
Secur32.dll	`GetUserNameExW`
WTSAPI32.dll	`WTSEnumerateSessionsW` `WTSFreeMemory` `WTSQuerySessionInformationW`
USERENV.dll	`CreateEnvironmentBlock` `DestroyEnvironmentBlock` `EnterCriticalPolicySection` `LeaveCriticalPolicySection`
WINHTTP.dll	`WinHttpAddRequestHeaders` `WinHttpCloseHandle` `WinHttpConnect` `WinHttpGetProxyForUrl` `WinHttpOpen` `WinHttpOpenRequest` `WinHttpQueryHeaders` `WinHttpReadData` `WinHttpReceiveResponse` `WinHttpSendRequest` `WinHttpSetOption` `WinHttpSetStatusCallback`
SHLWAPI.dll	`#437` `PathMatchSpecW`
WINMM.dll	`timeBeginPeriod` `timeEndPeriod` `timeGetTime`
api-ms-win-core-synch-l1-2-0.dll	`WaitOnAddress` `WakeByAddressAll` `WakeByAddressSingle`
api-ms-win-core-winrt-l1-1-0.dll	`RoInitialize` `RoUninitialize`

Delayed Imports

GetHandleVerifier

Ordinal	`1`
Address	`0xeea60`

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2026-Jul-05 14:03:29
Version	`0.0`
SizeofData	`45`
AddressOfRawData	`0x40c00c`
PointerToRawData	`0x40aa0c`
Referenced File	UpdaterSetup.exe.pdb

TLS Callbacks

StartAddressOfRawData	`0x846000`
EndAddressOfRawData	`0x8461b4`
AddressOfIndex	`0x81c3a8`
AddressOfCallbacks	`0x810828`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_32BYTES`
Callbacks	`0x0052FD80` `0x00620AE0` `0x00537F90` `0x006206B0` `0x004A1230` `0x00536470`

Load Configuration

Size	`0xc0`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0x800`
EditList	`0`
SecurityCookie	`0x817040`
SEHandlerTable	`0x80c039`
SEHandlerCount	`147`
GuardCFCheckFunctionPointer	`8456108`
GuardCFDispatchFunctionPointer	`0`
GuardCFFunctionTable	`0`
GuardCFFunctionCount	`0`
GuardFlags	`(EMPTY)`
CodeIntegrity.Flags	`0`
CodeIntegrity.Catalog	`0`
CodeIntegrity.CatalogOffset	`0`
CodeIntegrity.Reserved	`0`
GuardAddressTakenIatEntryTable	`0`
GuardAddressTakenIatEntryCount	`0`
GuardLongJumpTargetTable	`0`
GuardLongJumpTargetCount	`0`

RICH Header

Errors

[!] Error: The PE's resource section exceeds the parsing limits. Resources will not be parsed.

Leave a comment

No comments yet.