55a4ff89bfd05c9697c7edbb3e822a0e142430d174c56133db028447e77252dd

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Nov-09 16:22:39
Detected languages English - United States
Debug artifacts D:\HWID-Spoofer\x64\Release\Spectacle.pdb

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Suspicious PEiD Signature: UPolyX V0.1 -> Delikon
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to system / monitoring tools:
  • vssadmin.exe
 Tries to detect virtualized environments:
  • HARDWARE\DESCRIPTION\System
  • HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0
  • SYSTEM\CurrentControlSet\Control\SystemInformation
 May have dropper capabilities:
  • %TEMP%
  • CurrentControlSet\Services
 Contains another PE executable:
  • This program cannot be run in DOS mode.
 Miscellaneous malware strings:
  • cmd.exe
 Contains domain names:
  • acutedotcomb.cn
  • aia.ws.symantec.com
  • breveacutecomb.cn
  • brevegravecomb.cn
  • brevetildecomb.cn
  • circumflexacutecomb.cn
  • circumflexgravecomb.cn
  • circumflexhookcomb.cn
  • circumflextildecomb.cn
  • commaaccentright.cn
  • commaaccentrotate.cn
  • crl.microsoft.com
  • crl.thawte.com
  • crl.ws.symantec.com
  • d.symcb.com
  • github.com
  • http://crl.microsoft.com
  • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0
  • http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z
  • http://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0
  • http://crl.thawte.com
  • http://crl.thawte.com/ThawteTimestampingCA.crl0
  • http://ocsp.thawte.com0
  • http://s1.symcb.com
  • http://s1.symcb.com/pca3-g5.crl0
  • http://s2.symcb.com0
  • http://scripts.sil.org
  • http://scripts.sil.org/OFLInterMediumInterMediumOpen
  • http://scripts.sil.org/OFLhttp
  • http://sv.symcb.com
  • http://sv.symcb.com/sv.crl0f
  • http://sv.symcb.com/sv.crt0
  • http://sv.symcd.com0
  • http://sv.symcd.com0&
  • http://ts-aia.ws.symantec.com
  • http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
  • http://ts-crl.ws.symantec.com
  • http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
  • http://ts-ocsp.ws.symantec.com07
  • http://www.microsoft.com
  • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0
  • http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
  • http://www.microsoft.com/pkiops/Docs/Repository.htm0
  • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0
  • http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010
  • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a
  • http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010
  • http://www.microsoft.com/pkiops/docs/primarycps.htm0
  • http://www.microsoft.com0
  • http://www.symauth.com
  • http://www.symauth.com/cps0
  • http://www.symauth.com/rpa00
  • https://d.symcb.com
  • https://d.symcb.com/cps0%
  • https://d.symcb.com/rpa0
  • https://discord.gg
  • https://github.com
  • https://msdl.microsoft.com
  • https://msdl.microsoft.com/download/symbols/
  • https://rsms.me
  • https://scripts.sil.org
  • https://scripts.sil.org/OFLThis
  • https://scripts.sil.org/OFLhttps
  • https://www.lexend.comBonnie
  • koronisaccentleft.cn
  • macrondieresiscomb.cn
  • microsoft.com
  • msdl.microsoft.com
  • s1.symcb.com
  • scripts.sil.org
  • sv.symcb.com
  • symantec.com
  • symauth.com
  • symcb.com
  • thawte.com
  • tildecross.cn
  • tildemacroncomb.cn
  • tonos.top
  • ts-aia.ws.symantec.com
  • ts-crl.ws.symantec.com
  • uni02E5.cn
  • uni02E6.cn
  • uni02E7.cn
  • uni02E8.cn
  • uni02E9.cn
  • uni1DC4.cn
  • uni1DC6.cn
  • ws.symantec.com
  • www.microsoft.com
  • www.symauth.com
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to RC5 or RC6
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
 Can access the registry:
  • RegEnumKeyExW
  • RegOpenKeyExW
  • RegGetValueW
  • RegQueryValueExW
  • RegCloseKey
 Possibly launches other programs:
  • CreateProcessW
  • ShellExecuteA
  • system
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
  • CreateFileA
 Uses functions commonly found in keyloggers:
  • GetAsyncKeyState
  • GetForegroundWindow
 Functions related to the privilege level:
  • OpenProcessToken
 Enumerates local disk drives:
  • GetVolumeInformationA
 Reads the contents of the clipboard:
  • GetClipboardData
Malicious The PE is possibly a dropper. Resource 200 detected as a PE Executable.
Resource 201 detected as a PE Executable.
Malicious VirusTotal score: 21/71 (Scanned on 2026-11-11 10:54:01) ALYac: Gen:Variant.Yogi.108078
APEX: Malicious
Arcabit: Trojan.Yogi.D1A62E
BitDefender: Gen:Variant.Yogi.108078
Bkav: W32.Malware.5D30B774
CTX: exe.unknown.yogi
CrowdStrike: win/malicious_confidence_90% (D)
Cynet: Malicious (score: 100)
ESET-NOD32: Win64/GameHack_AGen.ANB potentially unsafe application
Elastic: malicious (high confidence)
Emsisoft: Gen:Variant.Yogi.108078 (B)
GData: Gen:Variant.Yogi.108078
Google: Detected
Ikarus: Trojan.Win64.Krypt
Malwarebytes: Malware.AI.4112577006
McAfeeD: ti!55A4FF89BFD0
MicroWorld-eScan: Gen:Variant.Yogi.108078
Microsoft: Trojan:Win32/Wacatac.C!ml
SentinelOne: Static AI - Malicious PE
Symantec: ML.Attribute.HighConfidence
VIPRE: Gen:Variant.Yogi.108078

Hashes

MD5 fa99cfef80dff8e029fd01603bf32231 🔍
SHA1 0715411e71e56f6366b32e772e0508b00ce4c3f0 🔍
SHA256 55a4ff89bfd05c9697c7edbb3e822a0e142430d174c56133db028447e77252dd 🔍
SHA3 abb5b3a6b8d22fb34d141e0cffb299edd463eb6208789fb7098ac23c986b1c39 🔍
SSDeep 49152:Dl+7rlLVTUiAzxcynS/BO6mYJM341mq8jW/Gu2VIDE5hvVvtTFbi6rYUNMJuxwl:8rDTDAgBOmM3Kz2VQSvtTJYUNzxkL90 🔍
Imports Hash 2af81d51967a304ee8f3bd1a1b10d558 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x110

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Nov-09 16:22:39
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xc7200
SizeOfInitializedData 0x3ba600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000000C5A1C (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x486000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 ec36553a9196186cdd08898a42c48f1a 🔍
SHA1 8d7a6751c2e74de25a89d5fe48ccffd1057d42ea 🔍
SHA256 84d438cbf44c91809f5179a09e51849f9e296da23a1df4c51e5485327f1ef281 🔍
SHA3 0a2143478c339b27956daf9644f5435cd2ef534670647cf0bc9ae26abe1977ac 🔍
VirtualSize 0xc70e3
VirtualAddress 0x1000
SizeOfRawData 0xc7200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.53534

.rdata

MD5 027ca45056680f95294cda842dc7b470 🔍
SHA1 c8008631abd1de3a9a6c28a8be82816749b6057b 🔍
SHA256 39787c067d73b52fc6d6efd63e16ab3ba9b21c09417d0d3239c5678d3e3d70a2 🔍
SHA3 989aab36185b321510b42604d790d419ce202fac3befda0e60fb2e805a217b0c 🔍
VirtualSize 0x3d728
VirtualAddress 0xc9000
SizeOfRawData 0x3d800
PointerToRawData 0xc7600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.42847

.data

MD5 4c802963844499b10c87ff95c363e7a2 🔍
SHA1 c7600e8ecd5f57028bc707e71e4f210ace7f47e3 🔍
SHA256 bd3620f0df7ffad7597d624a850744141302fe2f5c1bc746a1b372ac452a438f 🔍
SHA3 76e11167685acea1f5dc98c2f841e57a49d9349c814f863016e2e3796dfa8361 🔍
VirtualSize 0xbe7d0
VirtualAddress 0x107000
SizeOfRawData 0xbde00
PointerToRawData 0x104e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.08804

.pdata

MD5 d34a6a7326292ce94659da0518cadb0e 🔍
SHA1 0fe3f79f44c9d8043e734faad0e5b349de056ba0 🔍
SHA256 17a6d2104e462b0d3a0a72c1aceee2e1bbe60fa6099cea5ace367cfa87c25053 🔍
SHA3 4ab0b045a64d861ad096554303196e76530beaff773b5f9c32dd442f4d14c0c7 🔍
VirtualSize 0x900c
VirtualAddress 0x1c6000
SizeOfRawData 0x9200
PointerToRawData 0x1c2c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.04138

.rsrc

MD5 0f6d1004eb4023ba6f6f2e1872874052 🔍
SHA1 dcc9a94c6442d2827b972384da6c16fb8e96024d 🔍
SHA256 2eaabce83db106a50f201966c06a486b4e7c489a4daee1ed7169283c8dac64dd 🔍
SHA3 e33191afd98f2591736ea1238e7fba75a08843d50625f92c64316ef7c3008567 🔍
VirtualSize 0x2b4280
VirtualAddress 0x1d0000
SizeOfRawData 0x2b4400
PointerToRawData 0x1cbe00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.41502

.reloc

MD5 59c35caff307d1dcf8ca308c1e17aa99 🔍
SHA1 fb6e2cf343e77a2d4d721021dc43b5a67fd516c3 🔍
SHA256 6fba71ed81439db06c745194d85972b09067e27491aab200f793194b021a9cb7 🔍
SHA3 43ee3a05149de765cf69bb6025bb340566c582460b0635e6483efa1ff4756a0f 🔍
VirtualSize 0xe7c
VirtualAddress 0x485000
SizeOfRawData 0x1000
PointerToRawData 0x480200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.2457

Imports

d3d11.dll D3D11CreateDeviceAndSwapChain
D3DCOMPILER_47.dll D3DCompile
dxgi.dll CreateDXGIFactory
KERNEL32.dll GlobalMemoryStatusEx
GetModuleHandleW
CreateDirectoryW
ReadFile
SizeofResource
FindFirstFileW
GetFileSizeEx
FindNextFileW
GetCurrentProcess
WriteFile
TerminateProcess
GetModuleFileNameW
GetProcessId
GetEnvironmentVariableW
GetTempPathW
FindClose
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetLastError
GetFileAttributesExW
LockResource
DeleteFileW
CloseHandle
LoadResource
FindResourceW
GetTickCount64
CopyFileW
FreeLibrary
GetSystemFirmwareTable
DeviceIoControl
GetVolumeInformationA
CreateFileA
GetComputerNameA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
InitOnceComplete
InitOnceBeginInitialize
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
GetDiskFreeSpaceExW
GetLocaleInfoA
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
QueryPerformanceCounter
GetProcAddress
QueryPerformanceFrequency
GetExitCodeProcess
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
HeapFree
LoadLibraryA
HeapAlloc
CreateProcessW
USER32.dll GetWindowRect
SetWindowPos
ReleaseCapture
GetAsyncKeyState
GetWindowLongW
DefWindowProcW
DestroyWindow
CreateWindowExW
GetSystemMetrics
UnregisterClassW
RegisterClassExW
DispatchMessageW
SetWindowLongA
PeekMessageW
SetLayeredWindowAttributes
TranslateMessage
PostQuitMessage
UpdateWindow
ShowWindow
IsWindow
GetKeyState
GetMessageExtraInfo
ScreenToClient
SetClipboardData
GetCursorPos
GetCapture
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
LoadCursorW
GetClipboardData
IsWindowUnicode
GetClientRect
SetCursor
SetCapture
GetForegroundWindow
OpenClipboard
CloseClipboard
EmptyClipboard
SetCursorPos
ADVAPI32.dll GetTokenInformation
RegEnumKeyExW
RegOpenKeyExW
RegGetValueW
RegQueryValueExW
GetUserNameA
RegCloseKey
OpenProcessToken
SHELL32.dll ShellExecuteExW
ShellExecuteA
ole32.dll CoCreateInstance
CoInitializeEx
MSVCP140.dll ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??Bios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Query_perf_frequency
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_lock
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Query_perf_counter
_Thrd_detach
_Thrd_join
_Mtx_unlock
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Id_cnt@id@locale@std@@0HA
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
IMM32.dll ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
dwmapi.dll DwmExtendFrameIntoClientArea
IPHLPAPI.DLL GetAdaptersInfo
VCRUNTIME140_1.dll __CxxFrameHandler4
VCRUNTIME140.dll memset
__current_exception
__current_exception_context
__intrinsic_setjmp
_CxxThrowException
memmove
memcmp
longjmp
strrchr
strchr
strstr
__std_terminate
__std_exception_copy
__std_exception_destroy
memcpy
memchr
__C_specific_handler
api-ms-win-crt-heap-l1-1-0.dll free
_set_new_mode
malloc
_callnewh
api-ms-win-crt-runtime-l1-1-0.dll system
_beginthreadex
_invoke_watson
abort
terminate
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_register_thread_local_exe_atexit_callback
_get_narrow_winmain_command_line
_initterm
_initterm_e
_exit
exit
_c_exit
api-ms-win-crt-math-l1-1-0.dll sqrtf
floorf
sinf
powf
ceilf
__setusermatherr
fmodf
acosf
roundf
expf
cosf
api-ms-win-crt-stdio-l1-1-0.dll fputc
__p__commode
_fseeki64
__stdio_common_vsprintf
fgetc
fgetpos
ftell
__acrt_iob_func
fflush
_ftelli64
fclose
fsetpos
setvbuf
_wfopen_s
fseek
ungetc
__stdio_common_vfprintf
_get_stream_buffer_pointers
_set_fmode
fwrite
_wfopen
__stdio_common_vsscanf
fread
api-ms-win-crt-string-l1-1-0.dll strncpy
strcmp
tolower
strncmp
api-ms-win-crt-utility-l1-1-0.dll qsort
api-ms-win-crt-convert-l1-1-0.dll strtol
wcstombs_s
atoi
api-ms-win-crt-time-l1-1-0.dll _time64
_localtime64_s
api-ms-win-crt-filesystem-l1-1-0.dll _unlock_file
_lock_file
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale

Delayed Imports

200

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x84200
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.47194
Detected Filetype PE Executable
MD5 576e37a80524bd5f3248d7748d477b39 🔍
SHA1 a725bd2e13758f210edcc9499cd4a0baf884df4b 🔍
SHA256 ba2c51ca7fcd8990021fb66b2c16a1bf08c99aa36adc77c3be1214dacaafad2a 🔍
SHA3 1b1dc493b4471b63342d9034fbf4bc844d808dbf7378817fe1b0b282128fd2cd 🔍

201

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x22fe28
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.38557
Detected Filetype PE Executable
MD5 d1ea309e7ceacb6c91a79277b60f4b8e 🔍
SHA1 337eb967c4f6a5e0a83300b228acd1dcff5715c6 🔍
SHA256 c6cb047398680aa7093e3d4f1768977ef8ded90ad961225d633407a0ed1c881f 🔍
SHA3 5c14ebf71d1766700010c20aecd8c425ec5898746c7fb37403e46eb59283015c 🔍

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x188
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.89623
MD5 b8e76ddb52d0eb41e972599ff3ca431b 🔍
SHA1 fc12d7ad112ddabfcd8f82f290d84e637a4d62f8 🔍
SHA256 165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8 🔍
SHA3 37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd 🔍

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Nov-09 16:22:39
Version 0.0
SizeofData 66
AddressOfRawData 0xf5f44
PointerToRawData 0xf4544
Referenced File D:\HWID-Spoofer\x64\Release\Spectacle.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2026-Nov-09 16:22:39
Version 0.0
SizeofData 20
AddressOfRawData 0xf5f88
PointerToRawData 0xf4588

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Nov-09 16:22:39
Version 0.0
SizeofData 912
AddressOfRawData 0xf5f9c
PointerToRawData 0xf459c

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2026-Nov-09 16:22:39
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

StartAddressOfRawData 0x1400f6350
EndAddressOfRawData 0x1400f6358
AddressOfIndex 0x1401c52d8
AddressOfCallbacks 0x1400c9bb0
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140107040

RICH Header

XOR Key 0xe83df4f
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 22
253 (35207) 1
C objects (35207) 10
C++ objects (35207) 33
ASM objects (35207) 6
Imports (35207) 6
C objects (VS2022 Update 1 (17.1.6) compiler 31107) 26
C++ objects (33145) 1
Imports (33145) 25
Total imports 303
C++ objects (LTCG) (35229) 22
Resource objects (35229) 1
151 1
Linker (35229) 1

Errors

Leave a comment

No comments yet.