Manalyze report for 49ed78325573b1778507ad88912beda4534a2e7817d10ad165b613a9b5947289

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2026-Aug-10 02:28:18
Detected languages	English - United States

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`Miscellaneous malware strings: cmd.exe virus` `Contains domain names: RetroUSB.com http://www.marksimonson.com http://www.marksimonson.comProxima http://www.marksimonson.comhttp http://www.openssl.org http://www.openssl.org/support/faq.html http://www.vape.gg http://www.vape.gg/update.php?edition https://www.vape.gg https://www.vape.gg/ https://www.vape.gg/app-auth/proceed/ https://www.vape.gg/support marksimonson.com openssl.org raphnet.net www.marksimonson.com www.openssl.org`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32` `Uses constants related to MD5` `Uses constants related to SHA1` `Uses constants related to SHA256` `Uses constants related to SHA512` `Uses constants related to AES` `Uses constants related to Blowfish` `Uses known Mersenne Twister constants` `Microsoft's Cryptography API`
Suspicious	The PE is possibly packed.	`Unusual section name found: .vlizer` `Section .vlizer is both writable and executable.`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: LoadLibraryA LoadLibraryW GetProcAddress LoadLibraryExW` `Functions which can be used for anti-debugging purposes: CreateToolhelp32Snapshot` `Code injection capabilities: OpenProcess WriteProcessMemory VirtualAllocEx CreateRemoteThread` `Code injection capabilities (mapping injection): CreateFileMappingW MapViewOfFile CreateRemoteThread` `Can access the registry: RegCloseKey RegOpenKeyExA RegQueryValueExA` `Possibly launches other programs: CreateProcessW ShellExecuteA` `Uses Windows's Native API: ntohs ntohl` `Uses Microsoft's cryptographic API: CryptEnumProvidersA CryptGenRandom CryptReleaseContext CryptAcquireContextA` `Uses functions commonly found in keyloggers: MapVirtualKeyW GetAsyncKeyState` `Memory manipulation functions often used by packers: VirtualProtect VirtualProtectEx VirtualAllocEx` `Has Internet access capabilities: WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpOpen WinHttpSetTimeouts WinHttpConnect WinHttpCloseHandle WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest` `Leverages the raw socket API to access the Internet: WS2_32.dll` `Functions related to the privilege level: OpenProcessToken AdjustTokenPrivileges` `Enumerates local disk drives: GetVolumeInformationA GetDriveTypeW` `Manipulates other processes: OpenProcess Process32FirstW Process32NextW ReadProcessMemory WriteProcessMemory` `Reads the contents of the clipboard: GetClipboardData`
Info	The PE is digitally signed.	`Signer: Manthe Industries LLC` `Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1`
Suspicious	VirusTotal score: 2/70 (Scanned on 2026-10-22 09:58:04)	`CrowdStrike: win/malicious_confidence_60% (D)` `DeepInstinct: MALICIOUS`

Hashes

MD5	`bf4ceca429398bb97ad7fe0585249138` 🔍
SHA1	`0c8e2d5fd8e92d6c74df73396b72a42911be7427` 🔍
SHA256	`49ed78325573b1778507ad88912beda4534a2e7817d10ad165b613a9b5947289` 🔍
SHA3	`30ffda68ed2272d930c05222a82dc2637bcd81383b220bf4b55a9927f13c618f` 🔍
SSDeep	`98304:R8CwAZqGrSzyBfzzWInx77mcDjAR7ufb0uCfi81qvo0yz2r49bP:RaUqmSzyZWc/AR7BugqyBbP` 🔍
Imports Hash	`38345af6d13aeaa28c6234e1bf17bfd6` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x148`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`8`
TimeDateStamp	2026-Aug-10 02:28:18
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x301c00`
SizeOfInitializedData	`0x18d200`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00000000002A6344 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0xe67000`
SizeOfHeaders	`0x400`
Checksum	`0x7525e1`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`37376ebc37fd22d5ea1fcf04be9da1b1 🔍`
SHA1	`194941c7e87660dfd54bb77e1f1e6dbb63243294 🔍`
SHA256	`7e1f021f44a7a9e6e9896a5705cbbf2d7db5ee8846bd5469cb2722eb77c3a94e 🔍`
SHA3	`b891c57a329e75c607691c7bdc2c50d7dd8421aa79d6efef27024d6ffea4005e 🔍`
VirtualSize	`0x301a20`
VirtualAddress	`0x1000`
SizeOfRawData	`0x301c00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.16874`

.rdata

MD5	`c961e021855b507ca9ee6fe7d764cf45 🔍`
SHA1	`54204faccc1c102de58ac99637089e44e45f4e59 🔍`
SHA256	`80bed77538302c37f47f24c207f9757735047015644b0531f572a41d0683e010 🔍`
SHA3	`feb333d9c80d1b2c40346f512fddfd562b56e8b89a67d9a8c1b63044bfba7c8a 🔍`
VirtualSize	`0xd0a9c`
VirtualAddress	`0x303000`
SizeOfRawData	`0xd0c00`
PointerToRawData	`0x302000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.76039`

.data

MD5	`9be3c8dec06051d7fed10eefa08eded1 🔍`
SHA1	`bf6822e82f43265e335cf59029ff409384d62902 🔍`
SHA256	`a2a5ee103934d9ffa62896c49fa52ba7fab1bfbadbf61eaaaad27524157e3e3a 🔍`
SHA3	`eb8ff68178fadeac9d98b4a281b1facda1d4dc6a353c4667d8fc38956ac0c64f 🔍`
VirtualSize	`0x7dc24`
VirtualAddress	`0x3d4000`
SizeOfRawData	`0x6ce00`
PointerToRawData	`0x3d2c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`5.88572`

.pdata

MD5	`b469cc0a26f51b0cb2584e7543e739f1 🔍`
SHA1	`db8804e8253d7923e064e73a7b17121a5b0d8fe4 🔍`
SHA256	`21d55f4b4925b9202093fbab00560aedfa43946b372238af5b37502620e5310d 🔍`
SHA3	`2a4b2cf41dd58ee101f61338529ee529c8c3bdd9d59cf18fa1e6e3daa41c88b1 🔍`
VirtualSize	`0x329b8`
VirtualAddress	`0x452000`
SizeOfRawData	`0x32a00`
PointerToRawData	`0x43fa00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.17016`

.fptable

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x100`
VirtualAddress	`0x485000`
SizeOfRawData	`0x200`
PointerToRawData	`0x472400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`4ed690571d8050107c197fa3c376198d 🔍`
SHA1	`da615ea9fc5fe82dd1b08c3280b4e2186be4921b 🔍`
SHA256	`60dcb9eb9489b649ae93cd8da3cd0c07b99794f63591cb2791d34462a5168fae 🔍`
SHA3	`fdae3c506938418fedab91e6ecd59dc8954b48188ee3655c9c3b5334d2ce69bc 🔍`
VirtualSize	`0x3708`
VirtualAddress	`0x486000`
SizeOfRawData	`0x3800`
PointerToRawData	`0x472600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.70726`

.reloc

MD5	`71d4b03e5d8ca3aa20eb7fd7c8a956b4 🔍`
SHA1	`51f8230950b32b2ed5a405c968843987dabcb226 🔍`
SHA256	`cdd94a8208744faf134763899756a0bf8ab09a648f4a93884d5f4f2c45839fa1 🔍`
SHA3	`929f5ebef6dd346458187a536a07f896f90138f695be722b03c055033d6c7418 🔍`
VirtualSize	`0x82f0`
VirtualAddress	`0x48a000`
SizeOfRawData	`0x8400`
PointerToRawData	`0x475e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.45188`

.vlizer

MD5	`6e277b981c3b1e9cf6bdb84feca49e3d 🔍`
SHA1	`09ea4460d9638a05c572b0a353d7458a1f95311f 🔍`
SHA256	`d870721076a2acbb78d1786ad0f6a2692fb58927b467c7f488d688ddd15679b5 🔍`
SHA3	`0aef01a03a8366442fe34660a2ef283aa7d769c069a35a3b6302466a2b93bb72 🔍`
VirtualSize	`0x9d4000`
VirtualAddress	`0x493000`
SizeOfRawData	`0x2c76a5`
PointerToRawData	`0x47e200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`7.99993`

Imports

OPENGL32.dll	`glColor4d` `glIsEnabled` `glDrawArrays` `glDeleteTextures` `glPopAttrib` `glPopMatrix` `glDisableClientState` `glDrawElements` `glScissor` `glColorPointer` `glTexCoordPointer` `glVertexPointer` `glPushMatrix` `glPolygonMode` `glEnableClientState` `glPushAttrib` `glTexImage2D` `glTexParameteri` `glPixelStorei` `glBindTexture` `glGenTextures` `glBlendFunc` `glEnable` `glAlphaFunc` `glReadPixels` `glReadBuffer` `glFinish` `glEnd` `glVertex2f` `wglGetProcAddress` `wglGetCurrentDC` `glBegin` `glColor4f` `glOrtho` `glLoadIdentity` `glMatrixMode` `glDisable` `glGetIntegerv` `glClear` `glClearColor` `glViewport` `glGetError` `glGetString`
KERNEL32.dll	`GetModuleHandleA` `OpenProcess` `GetNativeSystemInfo` `CloseHandle` `FormatMessageA` `MultiByteToWideChar` `LocalFree` `LoadLibraryA` `FreeLibrary` `QueryPerformanceCounter` `QueryPerformanceFrequency` `GetTickCount64` `FindFirstFileA` `FindClose` `GetFileAttributesA` `CreateDirectoryA` `CreateFileA` `SetLastError` `GlobalAlloc` `GlobalLock` `GlobalUnlock` `Sleep` `CreateThread` `TerminateProcess` `GetCurrentProcess` `SetConsoleTextAttribute` `WriteConsoleA` `GetConsoleScreenBufferInfo` `GetConsoleWindow` `FreeConsole` `GetStdHandle` `SetConsoleCursorPosition` `SetConsoleTitleA` `SetConsoleOutputCP` `GetConsoleMode` `SetConsoleMode` `GetConsoleCursorInfo` `SetConsoleCursorInfo` `FillConsoleOutputCharacterA` `FillConsoleOutputAttribute` `CreateToolhelp32Snapshot` `Process32FirstW` `Process32NextW` `FindResourceA` `LoadResource` `LockResource` `SizeofResource` `CreateNamedPipeA` `GetCurrentThreadId` `AttachConsole` `AllocConsole` `AcquireSRWLockExclusive` `CreateEventW` `ReleaseSRWLockExclusive` `SetEvent` `WaitForSingleObject` `GetExitCodeProcess` `GetUserGeoID` `GetUserDefaultLocaleName` `IsWow64Process` `VirtualQueryEx` `VirtualFreeEx` `AddVectoredExceptionHandler` `SetUnhandledExceptionFilter` `VirtualProtect` `FormatMessageW` `TlsAlloc` `EnterCriticalSection` `LeaveCriticalSection` `InitializeCriticalSectionAndSpinCount` `DeleteCriticalSection` `WaitForMultipleObjects` `TerminateThread` `QueueUserAPC` `SleepEx` `PostQueuedCompletionStatus` `CreateIoCompletionPort` `SetWaitableTimer` `GetQueuedCompletionStatus` `VerSetConditionMask` `VerifyVersionInfoW` `CreateWaitableTimerW` `GetSystemTimeAsFileTime` `AcquireSRWLockShared` `ReleaseSRWLockShared` `TlsGetValue` `TlsSetValue` `TlsFree` `DuplicateHandle` `GetFinalPathNameByHandleA` `lstrcpyW` `GetVolumeInformationA` `CreateFileW` `SetFilePointer` `ReadFile` `VirtualProtectEx` `GetCurrentDirectoryW` `LocalFileTimeToFileTime` `GetFileAttributesW` `CreateDirectoryW` `WriteFile` `SetFileTime` `FileTimeToSystemTime` `GetFileInformationByHandle` `GetFileSize` `CreateFileMappingW` `MapViewOfFile` `UnmapViewOfFile` `GetLocalTime` `GetTickCount` `GlobalFree` `SetThreadExecutionState` `InitializeCriticalSection` `GetFileType` `LoadLibraryW` `GetCurrentProcessId` `ReadProcessMemory` `FlushConsoleInputBuffer` `GetSystemTime` `WriteProcessMemory` `SystemTimeToTzSpecificLocalTime` `PeekNamedPipe` `GetDriveTypeW` `RtlUnwind` `VirtualAllocEx` `GetLastError` `GetModuleHandleW` `GetProcAddress` `SetEndOfFile` `WriteConsoleW` `GetProcessHeap` `SetEnvironmentVariableW` `FreeEnvironmentStringsW` `GetEnvironmentStringsW` `GetOEMCP` `GetACP` `IsValidCodePage` `FindNextFileW` `FindFirstFileExW` `HeapQueryInformation` `HeapSize` `SetStdHandle` `GetTimeZoneInformation` `GetFileSizeEx` `SetFilePointerEx` `HeapReAlloc` `ReadConsoleW` `PeekConsoleInputA` `ReadConsoleInputW` `GetNumberOfConsoleInputEvents` `GetConsoleOutputCP` `FlushFileBuffers` `GetFileAttributesExW` `CreateProcessW` `EnumSystemLocalesW` `GetUserDefaultLCID` `IsValidLocale` `GetLocaleInfoW` `LCMapStringW` `CompareStringW` `GetTimeFormatW` `GetDateFormatW` `FlsFree` `FlsSetValue` `FlsGetValue` `FlsAlloc` `HeapAlloc` `HeapFree` `GetCommandLineW` `GetCommandLineA` `GetModuleFileNameW` `ExitProcess` `SetConsoleCtrlHandler` `GetConsoleCP` `FreeLibraryAndExitThread` `ExitThread` `LoadLibraryExW` `InterlockedPushEntrySList` `RtlUnwindEx` `GetStartupInfoW` `IsDebuggerPresent` `UnhandledExceptionFilter` `RtlVirtualUnwind` `RtlLookupFunctionEntry` `RtlCaptureContext` `InitializeSListHead` `GetCPInfo` `GetStringTypeW` `LCMapStringEx` `DecodePointer` `EncodePointer` `InitializeCriticalSectionEx` `GetLocaleInfoEx` `InitOnceComplete` `InitOnceBeginInitialize` `RaiseException` `RtlPcToFileHeader` `IsProcessorFeaturePresent` `GetModuleHandleExW` `CloseThreadpoolWork` `SubmitThreadpoolWork` `CreateThreadpoolWork` `FreeLibraryWhenCallbackReturns` `WakeAllConditionVariable` `SleepConditionVariableSRW` `TryAcquireSRWLockExclusive` `GetExitCodeThread` `WaitForSingleObjectEx` `WideCharToMultiByte` `GlobalMemoryStatus` `CreateRemoteThread` `SystemTimeToFileTime` `GetFullPathNameW`
USER32.dll	`EmptyClipboard` `SetClipboardData` `CloseClipboard` `GetWindowTextA` `UpdateWindow` `SetForegroundWindow` `IsWindow` `IsWindowVisible` `ShowWindow` `SystemParametersInfoW` `DefWindowProcW` `MapWindowPoints` `PtInRect` `CallWindowProcW` `GetWindowLongW` `SetWindowLongPtrW` `SetWindowPos` `GetSystemMetrics` `GetWindowThreadProcessId` `EnumWindows` `GetDesktopWindow` `GetClassNameA` `GetClipboardData` `TranslateMessage` `DispatchMessageW` `PeekMessageW` `UnregisterDeviceNotification` `CreateWindowExW` `PostMessageW` `ToUnicode` `MapVirtualKeyW` `TrackMouseEvent` `GetMessageTime` `UnregisterClassW` `RegisterClassExW` `IsIconic` `BringWindowToTop` `IsZoomed` `SetFocus` `GetActiveWindow` `GetKeyState` `GetAsyncKeyState` `SetCapture` `ReleaseCapture` `GetDC` `SetPropW` `GetPropW` `RemovePropW` `GetClientRect` `AdjustWindowRectEx` `SetCursorPos` `OpenClipboard` `SetWindowLongW` `EnumDisplayDevicesA` `wsprintfW` `DestroyWindow` `RegisterRawInputDevices` `SetCursor` `MessageBoxW` `GetUserObjectInformationW` `GetProcessWindowStation` `EnumDisplayMonitors` `EnumDisplayDevicesW` `EnumDisplaySettingsExW` `EnumDisplaySettingsW` `ChangeDisplaySettingsExW` `GetRawInputData` `GetMonitorInfoW` `MonitorFromWindow` `CopyIcon` `LoadImageW` `DestroyIcon` `LoadCursorW` `SetRect` `ClipCursor` `WindowFromPoint` `ScreenToClient` `ClientToScreen` `GetCursorPos`
GDI32.dll	`DescribePixelFormat` `ChoosePixelFormat` `SwapBuffers` `DeleteObject` `CreateRectRgn` `CreateDCW` `DeleteDC` `SetPixelFormat` `GetDeviceCaps` `SetDeviceGammaRamp`
ADVAPI32.dll	`OpenProcessToken` `CryptEnumProvidersA` `CryptGenRandom` `CryptReleaseContext` `CryptAcquireContextA` `LookupPrivilegeValueW` `GetUserNameW` `DeregisterEventSource` `RegCloseKey` `RegOpenKeyExA` `RegQueryValueExA` `RegisterEventSourceW` `ReportEventW` `AdjustTokenPrivileges`
SHELL32.dll	`ShellExecuteA` `DragQueryPoint` `DragFinish` `DragAcceptFiles` `DragQueryFileW`
ole32.dll	`CoInitializeEx` `CoUninitialize`
WS2_32.dll	`bind` `WSAStartup` `WSAIoctl` `ntohs` `ioctlsocket` `htons` `select` `listen` `WSARecv` `ntohl` `__WSAFDIsSet` `htonl` `shutdown` `WSACleanup` `recv` `send` `freeaddrinfo` `closesocket` `connect` `socket` `getaddrinfo` `inet_ntop` `setsockopt` `WSAGetLastError` `getsockopt` `WSAAddressToStringW` `WSASocketW` `WSASend` `WSASetLastError` `accept` `getpeername` `getsockname`
bcrypt.dll	`BCryptCloseAlgorithmProvider` `BCryptGenRandom` `BCryptOpenAlgorithmProvider`
WINHTTP.dll	`WinHttpQueryHeaders` `WinHttpQueryDataAvailable` `WinHttpReadData` `WinHttpReceiveResponse` `WinHttpOpen` `WinHttpSetTimeouts` `WinHttpConnect` `WinHttpCloseHandle` `WinHttpOpenRequest` `WinHttpAddRequestHeaders` `WinHttpSendRequest`
dwmapi.dll	`DwmExtendFrameIntoClientArea` `DwmEnableBlurBehindWindow`
IMM32.dll	`ImmSetCompositionWindow` `ImmGetContext`
IPHLPAPI.DLL	`GetAdaptersInfo`

Delayed Imports

LOGO_TEXTURE

Type	`PNG`
Language	English - United States
Codepage	UNKNOWN
Size	`0x75d`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.85721`
Detected Filetype	PNG graphic file
MD5	`180cf1da0373e16093c876cc7c8c242e 🔍`
SHA1	`79a12f101b2a34bdb247af4076234142da40b5b5 🔍`
SHA256	`838f41e2081733f644d998b610d67abbe03af2d4b4a82bb50b87b7761bb2922e 🔍`
SHA3	`da42d849a067f15c6d6ec761a7bd0e24b741c9df1ddfa7ee5e3df3cc8404756f 🔍`

MASK_BOTTOM_TEXTURE

Type	`PNG`
Language	English - United States
Codepage	UNKNOWN
Size	`0x34d`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.64172`
Detected Filetype	PNG graphic file
MD5	`c9f3cf365bb308e613a387873e478f6d 🔍`
SHA1	`6ad025978c61ff5008e6ca8a055b01e197826a81 🔍`
SHA256	`abd5577042089d503cd917e553bb91fc77505dde2d635ce8576ee4e3a141c15f 🔍`
SHA3	`39096412976df195738cde5f8ffa061a5f77888e28c1f51e29cc1f2deeb8f12e 🔍`

MASK_LEFT_TEXTURE

Type	`PNG`
Language	English - United States
Codepage	UNKNOWN
Size	`0xbf1`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.83464`
Detected Filetype	PNG graphic file
MD5	`3fde2fe13d7b18766deba38fb9374611 🔍`
SHA1	`f873413f221fca91882038f60c95b2c35c67500d 🔍`
SHA256	`e70e678d0c9a8deeca6759f419a28c1522e52c82b97dbc766da49abd8031a46e 🔍`
SHA3	`2a65208ce5be6e6b01e88148f0a73be8e9ce24a0db7843909f736fe382d65770 🔍`

MASK_RIGHT_TEXTURE

Type	`PNG`
Language	English - United States
Codepage	UNKNOWN
Size	`0x933`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.84893`
Detected Filetype	PNG graphic file
MD5	`49df04214e3221402f25ee371e67bde6 🔍`
SHA1	`929b066edab91afdae9c1608a06997f851699482 🔍`
SHA256	`c489c0d8f05c34aacb88c28efd51ce9035cdd962c209790012c7cb7cae6975cf 🔍`
SHA3	`9215baf5300d69918f2f248d0341aa205af6da8f2c34e837b1397d05fda36575 🔍`

MASK_TOP_TEXTURE

Type	`PNG`
Language	English - United States
Codepage	UNKNOWN
Size	`0xde2`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.6038`
Detected Filetype	PNG graphic file
MD5	`7b6f694d55094f7e34c38f39291f6c01 🔍`
SHA1	`d0592a752159c32ee6788e3ec33124dd7b1a4733 🔍`
SHA256	`980603fd7e71be3e6b737890da51c15eea7cb5de5441613eb4b00885b990e691 🔍`
SHA3	`3ff84e54c1646d2362557b8f01ad18dda9aaf455a58c0c5438a4bc6018724787 🔍`

MIN_TEXTURE

Type	`PNG`
Language	English - United States
Codepage	UNKNOWN
Size	`0x62`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.8384`
Detected Filetype	PNG graphic file
MD5	`676a2d34973d6ca1fe7d2e3302941e13 🔍`
SHA1	`0aaf283945930f495b24a624b53697a6ccd2d5c8 🔍`
SHA256	`6a62a85c4fd860ded7d9e9d9446b9cbc05e64eacbace6b2fd1e805ecd27e54ec 🔍`
SHA3	`aa74eff6175475a425bd6d3f54c25730d283b29c028f2e47dd91eb4cf339af74 🔍`

RECT_TEXTURE

Type	`PNG`
Language	English - United States
Codepage	UNKNOWN
Size	`0x381`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.34253`
Detected Filetype	PNG graphic file
MD5	`74afe23f69c33d92a396b9220e2bdf50 🔍`
SHA1	`7a47bfaab430321a20fd58df71661a9cc46beeb1 🔍`
SHA256	`cb99b5833d18d28e38a2230bf22bbce674468a4c972f9b72878d43d2931a9b03 🔍`
SHA3	`8de1127d5d69d184b3822e50faf2b6addd891bd34cf5d03cb00aadba4630081b 🔍`

X_TEXTURE

Type	`PNG`
Language	English - United States
Codepage	UNKNOWN
Size	`0xd2`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`6.24094`
Detected Filetype	PNG graphic file
MD5	`201fc926fd6bee4e5614638fcbfd9807 🔍`
SHA1	`b4fad83fb01a654c5063b365026cbfc108c57271 🔍`
SHA256	`5041ef6f6b0bce2f4e4218dc793dd3889096cd049a179ce16cd6b0da6dd3c4a1 🔍`
SHA3	`c3f7948c5e1d6a83b17f72d24c0ac58c285e12d7086365af2f24461a51115375 🔍`

1

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x184`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.91862`
MD5	`3250787fdcd75aa2587529b89c7738b2 🔍`
SHA1	`622b5627941ecee9cfe6179c3017bbf7b43fffaa 🔍`
SHA256	`8b0de2e560d8476fb0013b44f1e10c2789ae71e0353866890dc5f9c57fb1f44a 🔍`
SHA3	`6bf4f0eaf6795c219d4d808caa895dcb53f7fe9c81e92ce03da1db7841bfcd3d 🔍`

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2026-Aug-10 02:28:18
Version	`0.0`
SizeofData	`1052`
AddressOfRawData	`0x3a87f4`
PointerToRawData	`0x3a77f4`

IMAGE_DEBUG_TYPE_ILTCG

Characteristics	`0`
TimeDateStamp	2026-Aug-10 02:28:18
Version	`0.0`
SizeofData	`0`
AddressOfRawData	`0`
PointerToRawData	`0`

TLS Callbacks

StartAddressOfRawData	`0x1403a8c58`
EndAddressOfRawData	`0x1403a8c60`
AddressOfIndex	`0x14044cfa0`
AddressOfCallbacks	`0x140304108`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_4BYTES`
Callbacks	`(EMPTY)`

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x1404087c0`

RICH Header

XOR Key	`0x136fc016`
Unmarked objects	`0`
C++ objects (33140)	`216`
C objects (33140)	`28`
ASM objects (33140)	`21`
C++ objects (VS2017 v15.9.0-1 compiler 27023)	`1`
C objects (35207)	`19`
Imports (2207)	`2`
ASM objects (35207)	`12`
C++ objects (35207)	`106`
C objects (VS2013 UPD5 build 40629)	`1`
C++ objects (VS2017 v15.3.* compiler 25506)	`33`
ASM objects (VS2017 v15.3.* compiler 25506)	`1`
C objects (24231)	`480`
C objects (35214)	`13`
Imports (33140)	`33`
Total imports	`491`
C++ objects (LTCG) (35214)	`78`
Resource objects (35214)	`1`
151	`1`
Linker (35214)	`1`

Errors

Leave a comment

No comments yet.