Manalyze report for 686e06e7ef58c399ad06b73a51e9187122adad73d446f9eb972d257af5f250ab

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2026-Nov-02 15:57:37
Detected languages	English - United States
Debug artifacts	C:\Users\Admin\Desktop\Current Projects\Noro\Noro External FREE\Noro\x64\Release\Noro.pdb

Plugin Output

Info	Matching compiler(s):	`MASM/TASM - sig1(h)`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`May have dropper capabilities: CurrentControlSet\Services` `Contains another PE executable: This program cannot be run in DOS mode.` `Miscellaneous malware strings: cmd.exe` Contains domain names: 2010-aia.verisign.com 2010-crl.verisign.com aia.verisign.com aia.ws.symantec.com crl.microsoft.com crl.thawte.com crl.verisign.com crl.ws.symantec.com csc3-2010-aia.verisign.com csc3-2010-crl.verisign.com dearimgui.org http://crl.microsoft.com http://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0 http://crl.thawte.com http://crl.thawte.com/ThawteTimestampingCA.crl0 http://crl.verisign.com http://crl.verisign.com/pca3-g5.crl04 http://csc3-2010-aia.verisign.com http://csc3-2010-aia.verisign.com/CSC3-2010.cer0 http://csc3-2010-crl.verisign.com http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D http://logo.verisign.com http://logo.verisign.com/vslogo.gif04 http://ocsp.thawte.com0 http://ocsp.verisign.com0 http://ts-aia.ws.symantec.com http://ts-aia.ws.symantec.com/tss-ca-g2.cer0 http://ts-crl.ws.symantec.com http://ts-crl.ws.symantec.com/tss-ca-g2.crl0 http://ts-ocsp.ws.symantec.com07 http://www.dearimgui.org http://www.dearimgui.org/faq/ http://www.microsoft.com http://www.microsoft.com/truetype/0 https://msdl.microsoft.com https://msdl.microsoft.com/download/symbols/ https://www.verisign.com https://www.verisign.com/CPS https://www.verisign.com/cps0 https://www.verisign.com/repository/CPS https://www.verisign.com/repository/RPA0 https://www.verisign.com/repository/verisignlogo.gif0 https://www.verisign.com/rpa https://www.verisign.com/rpa0 logo.verisign.com microsoft.com msdl.microsoft.com symantec.com thawte.com ts-aia.ws.symantec.com ts-crl.ws.symantec.com verisign.com ws.symantec.com www.dearimgui.org www.microsoft.com www.verisign.com
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32` `Uses constants related to MD5` `Uses constants related to SHA1`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryA LoadLibraryExW` `Functions which can be used for anti-debugging purposes: CreateToolhelp32Snapshot SwitchToThread FindWindowW FindWindowA` `Code injection capabilities (PowerLoader): FindWindowW FindWindowA GetWindowLongA` `Possibly launches other programs: CreateProcessA CreateProcessW` `Can create temporary files: CreateFileW GetTempPathW` `Uses functions commonly found in keyloggers: CallNextHookEx GetAsyncKeyState GetForegroundWindow` `Manipulates other processes: Process32FirstW Process32NextW` `Can take screenshots: FindWindowW FindWindowA GetDC` `Reads the contents of the clipboard: GetClipboardData`
Malicious	VirusTotal score: 39/71 (Scanned on 2026-11-05 15:59:19)	`ALYac: Gen:Variant.Yogi.112344` `AVG: FileRepMalware [Misc]` `Arcabit: Trojan.Yogi.D1B6D8` `Avast: FileRepMalware [Misc]` `BitDefender: Gen:Variant.Yogi.112344` `Bkav: W32.Malware.7A5B2C7D` `CAT-QuickHeal: Trojan.Win64` `CTX: exe.unknown.yogi` `CrowdStrike: win/malicious_confidence_70% (W)` `Cylance: Unsafe` `DeepInstinct: MALICIOUS` `ESET-NOD32: Win64/HackTool.GameHack_AGen.BG trojan` `Elastic: malicious (high confidence)` `Emsisoft: Gen:Variant.Yogi.112344 (B)` `Fortinet: W32/PossibleThreat` `GData: Gen:Variant.Yogi.112344` `Google: Detected` `Gridinsoft: Trojan.Win64.Wacatac.sa` `Ikarus: PUA.Generic` `K7AntiVirus: Hacktool ( 005cec841 )` `K7GW: Hacktool ( 005cec841 )` `Kaspersky: UDS:Trojan.Win64.Injector.gen` `Lionic: Trojan.Win32.Injector.4!c` `Malwarebytes: Malware.AI.2266143858` `McAfeeD: Trojan:Win/Vulndriver.EAG` `MicroWorld-eScan: Gen:Variant.Yogi.112344` `Microsoft: Trojan:Win32/Wacatac.B!ml` `Paloalto: generic.ml` `Rising: Trojan.Injector!8.C4 (CLOUD)` `Sangfor: Hacktool.Win64.Injector.V4ew` `SentinelOne: Static AI - Suspicious PE` `Sophos: Mal/Generic-S` `Symantec: ML.Attribute.HighConfidence` `TrellixENS: Artemis!E46E93D7E139` `TrendMicro: Trojan.Win32.INJECTOR.USBLK326` `TrendMicro-HouseCall: Trojan.Win32.INJECTOR.USBLK326` `VIPRE: Gen:Variant.Yogi.112344` `Varist: W64/ABTrojan.LTNY-2897` `huorong: HVM:Trojan/BSOD.b`

Hashes

MD5	`e46e93d7e139700dbec76ae7442a8a76` 🔍
SHA1	`fb22dc1ea1718b1c9d11d74f01dda85e0789f740` 🔍
SHA256	`686e06e7ef58c399ad06b73a51e9187122adad73d446f9eb972d257af5f250ab` 🔍
SHA3	`ec46e10f3694ccc0654d6d55675aabb00ed6888c19fe387ffa59161b4f243ea0` 🔍
SSDeep	`98304:7KsrIJQTeCUnjhMkB+Q2L+Qd+Skl/wFQs2rBsZZP:3gQySkGHrFp2rBsZZP` 🔍
Imports Hash	`b44afec8c04c2e7d9fad6d17b6736888` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x108`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`10`
TimeDateStamp	2026-Nov-02 15:57:37
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x22f400`
SizeOfInitializedData	`0x28ba00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000000000005ED9 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x4c2000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`478752b072fa5353abcd8c0c0813733f 🔍`
SHA1	`9b597e13feb2b76bed613efa0f79147ff0a19505 🔍`
SHA256	`4e892f94808e65960390c208c26194e34dc7fc4e714b62b3ddd73d0d7849e4fb 🔍`
SHA3	`635f038ae27a746013f45c06ffecb74478c16a3d0b62df9b5268f37c15094013 🔍`
VirtualSize	`0x22f31d`
VirtualAddress	`0x1000`
SizeOfRawData	`0x22f400`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.84354`

.rdata

MD5	`c3b967084a4312755a6f9b3061a4a692 🔍`
SHA1	`b826a3676e571be53d880640be0aa581fd3a03e4 🔍`
SHA256	`4e596031eaca4c401cb0dc7208eef303864d753fd8b590779b1f3cb2cf677d87 🔍`
SHA3	`3653dfc334b49dc1a7e2cd83a966081b10b939ba861d69aca7e6f76ab7b47bf5 🔍`
VirtualSize	`0xc623b`
VirtualAddress	`0x231000`
SizeOfRawData	`0xc6400`
PointerToRawData	`0x22f800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.32298`

.data

MD5	`55a4a50bb2185618a00ac867dd65631a 🔍`
SHA1	`32e93da5973c233f91e97a47eaca7b952dc5db13 🔍`
SHA256	`2599c8e37c19fa963fbcccff5672a0216c0887cd0d26cec6f4eccf6753de89c7 🔍`
SHA3	`e235c94a411cd471875ae026ee82accea09c7d6581d3765577ea9468acdb1bbf 🔍`
VirtualSize	`0x1a8600`
VirtualAddress	`0x2f8000`
SizeOfRawData	`0x19d200`
PointerToRawData	`0x2f5c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`6.74724`

.pdata

MD5	`00d7457492534cc1294c19b4522b4195 🔍`
SHA1	`08d9c74614c76ca850a5a18d09312d49a44987ce 🔍`
SHA256	`7eae60435119eb2dc7fb005cf21b81cb4fc384057592317c4bd8fb8c422d39ef 🔍`
SHA3	`153c179ccbd50bc8441221ede1d3d75aec192dafe2e43011581d626a05dfa749 🔍`
VirtualSize	`0x149dc`
VirtualAddress	`0x4a1000`
SizeOfRawData	`0x14a00`
PointerToRawData	`0x492e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.92192`

.idata

MD5	`a799bb04f57ed27f66a9cdd268025be3 🔍`
SHA1	`6233343e6aa2d58bb194967ceda6f381a6f908a9 🔍`
SHA256	`407f72f4e4cba7766fd7d085999d8eb4722796269e9185d0703486f7c563c45f 🔍`
SHA3	`8ea7953c0d9c226ddf24fa0dbf423c1b47541b721f90c0a620573985e2f97bc1 🔍`
VirtualSize	`0x2da9`
VirtualAddress	`0x4b6000`
SizeOfRawData	`0x2e00`
PointerToRawData	`0x4a7800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.97215`

.tls

MD5	`8ac34424b13359dc8ddde554275da357 🔍`
SHA1	`ddaa306fd23bc97ed7ef8c4c419e8cb3fd311dfc 🔍`
SHA256	`e457cc361b1501f7b8e567ffe4ba0e3cb414b172d2838e892cd92740b5d4b00a 🔍`
SHA3	`0d6d540ceff10d1edafdec4cd91000e1c7ee15d8d97a5d5f431d62d2fed7e1b4 🔍`
VirtualSize	`0x336`
VirtualAddress	`0x4b9000`
SizeOfRawData	`0x400`
PointerToRawData	`0x4aa600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.0111738`

.00cfg

MD5	`a9582a7de64932643de1b8db49a548e1 🔍`
SHA1	`042738f757677fec8574473fb6b3a7814880f0b8 🔍`
SHA256	`76a7c5de77f1d79f4261ededa524236c98c8b95e673a73a5f213ba3805d9ac3f 🔍`
SHA3	`0148cbd166f207cf7375653044ee0de689f5415f1fc817e5c584ce32d8b30feb 🔍`
VirtualSize	`0x175`
VirtualAddress	`0x4ba000`
SizeOfRawData	`0x200`
PointerToRawData	`0x4aaa00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`0.411681`

.fptable

MD5	`0f343b0931126a20f133d67c2b018a3b 🔍`
SHA1	`60cacbf3d72e1e7834203da608037b1bf83b40e8 🔍`
SHA256	`5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef 🔍`
SHA3	`6841b2c10aa6e5f7a384143e4de58fbc9aa28a4b742e9ad4ed14ba148a723a43 🔍`
VirtualSize	`0x233`
VirtualAddress	`0x4bb000`
SizeOfRawData	`0x400`
PointerToRawData	`0x4aac00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`0028105f6b4a245d442dae3a6a461ce6 🔍`
SHA1	`109c522aa2de0cdfcb5474241888405138569ce4 🔍`
SHA256	`79a55e5e048a74c34203ee89b4d949b36bc9fc4bec8b337d2ce9819f35545df7 🔍`
SHA3	`31b164c2fa93f8b6c28fb8b1a0ab5fb589a2dd7d391e709d8f650df3d0f33e83 🔍`
VirtualSize	`0x446`
VirtualAddress	`0x4bc000`
SizeOfRawData	`0x600`
PointerToRawData	`0x4ab000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`2.18533`

.reloc

MD5	`fa01948404a4bfa5397ee32e816adec5 🔍`
SHA1	`9d2ea23e95782794b5949f278a197b4d7a15b840 🔍`
SHA256	`0841fc2d8b32cc17e983d54caf315dcedcb084a05008b92657d99275ed4aeb4d 🔍`
SHA3	`f5b448b2146f6709ea3bf072d090d77d9c1222b08975d402014730ce05ecf3fa 🔍`
VirtualSize	`0x46b1`
VirtualAddress	`0x4bd000`
SizeOfRawData	`0x4800`
PointerToRawData	`0x4ab600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`2.01992`

Imports

d3d11.dll	`D3D11CreateDeviceAndSwapChain`
KERNEL32.dll	`FreeLibrary` `GetProcAddress` `LoadLibraryA` `VerifyVersionInfoW` `CreateFileW` `DeleteFileA` `CloseHandle` `DeviceIoControl` `WaitForSingleObject` `Sleep` `CreateThread` `CreateProcessA` `CreateProcessW` `MapViewOfFile` `GetModuleHandleA` `CreateFileMappingA` `SetConsoleTitleW` `CreateToolhelp32Snapshot` `Process32FirstW` `Process32NextW` `WriteConsoleW` `HeapSize` `SetStdHandle` `OutputDebugStringW` `SetConsoleCtrlHandler` `GetProcessHeap` `SetEnvironmentVariableW` `FreeEnvironmentStringsW` `GetEnvironmentStringsW` `GetOEMCP` `GetACP` `IsValidCodePage` `GetExitCodeProcess` `HeapReAlloc` `GetTimeZoneInformation` `ReadConsoleW` `SetFilePointerEx` `GetFileSizeEx` `GlobalAlloc` `QueryPerformanceFrequency` `FlushFileBuffers` `GetFileType` `EnumSystemLocalesW` `GetUserDefaultLCID` `IsValidLocale` `GetLocaleInfoW` `LCMapStringW` `CompareStringW` `GetTimeFormatW` `GetDateFormatW` `VirtualProtect` `IsThreadAFiber` `FlsFree` `FlsSetValue` `FlsGetValue` `FlsAlloc` `HeapFree` `HeapAlloc` `GetCurrentThread` `GetCommandLineW` `GetCommandLineA` `WriteFile` `GetStdHandle` `GetModuleFileNameW` `ExitProcess` `GetModuleHandleExW` `FreeLibraryAndExitThread` `ResumeThread` `ExitThread` `ReadFile` `LoadLibraryExW` `TlsFree` `TlsSetValue` `TlsGetValue` `TlsAlloc` `InitializeCriticalSectionAndSpinCount` `SetLastError` `QueryPerformanceCounter` `VerSetConditionMask` `WideCharToMultiByte` `MultiByteToWideChar` `GetFileAttributesA` `SetEndOfFile` `GlobalFree` `GlobalLock` `GetConsoleOutputCP` `GlobalUnlock` `GetConsoleMode` `LocalFree` `InterlockedFlushSList` `InterlockedPushEntrySList` `RtlUnwindEx` `RaiseException` `RtlPcToFileHeader` `ReleaseSRWLockExclusive` `AcquireSRWLockExclusive` `WakeAllConditionVariable` `SleepConditionVariableSRW` `RtlCaptureContext` `RtlLookupFunctionEntry` `RtlVirtualUnwind` `UnhandledExceptionFilter` `SetUnhandledExceptionFilter` `GetCurrentProcess` `TerminateProcess` `IsProcessorFeaturePresent` `IsDebuggerPresent` `GetStartupInfoW` `GetModuleHandleW` `GetCurrentProcessId` `GetCurrentThreadId` `GetSystemTimeAsFileTime` `InitializeSListHead` `RtlUnwind` `FormatMessageA` `GetLocaleInfoEx` `SetCurrentDirectoryW` `GetCurrentDirectoryW` `CreateDirectoryW` `FindClose` `FindFirstFileW` `FindFirstFileExW` `FindNextFileW` `GetDiskFreeSpaceExW` `GetFileAttributesW` `GetFileAttributesExW` `GetFileInformationByHandle` `GetFinalPathNameByHandleW` `GetFullPathNameW` `SetFileAttributesW` `SetFileInformationByHandle` `SetFileTime` `GetTempPathW` `AreFileApisANSI` `GetLastError` `CreateDirectoryExW` `CopyFileW` `MoveFileExW` `CreateHardLinkW` `GetFileInformationByHandleEx` `CreateSymbolicLinkW` `WaitForSingleObjectEx` `SwitchToThread` `GetExitCodeThread` `GetNativeSystemInfo` `ReleaseSRWLockShared` `AcquireSRWLockShared` `TryAcquireSRWLockExclusive` `TryAcquireSRWLockShared` `GetTickCount64` `EnterCriticalSection` `LeaveCriticalSection` `InitializeCriticalSectionEx` `DeleteCriticalSection` `InitOnceExecuteOnce` `CreateEventExW` `CreateSemaphoreExW` `FlushProcessWriteBuffers` `GetCurrentProcessorNumber` `FreeLibraryWhenCallbackReturns` `CreateThreadpoolTimer` `SetThreadpoolTimer` `WaitForThreadpoolTimerCallbacks` `CloseThreadpoolTimer` `CreateThreadpoolWait` `SetThreadpoolWait` `CloseThreadpoolWait` `EncodePointer` `DecodePointer` `LCMapStringEx` `WakeConditionVariable` `GetStringTypeW` `CompareStringEx` `GetCPInfo`
USER32.dll	`UnregisterClassA` `OpenClipboard` `CloseClipboard` `SetClipboardData` `EmptyClipboard` `LoadIconW` `CallNextHookEx` `UnhookWindowsHookEx` `SetWindowsHookExW` `FindWindowW` `FindWindowA` `GetDesktopWindow` `SetWindowLongA` `GetWindowLongA` `MessageBoxW` `GetWindowRect` `SetForegroundWindow` `SetActiveWindow` `UpdateWindow` `GetSystemMetrics` `keybd_event` `GetAsyncKeyState` `SetFocus` `IsIconic` `SetWindowPos` `SetLayeredWindowAttributes` `ShowWindow` `DestroyWindow` `IsWindow` `CreateWindowExA` `RegisterClassExA` `IsChild` `PostQuitMessage` `DefWindowProcA` `PeekMessageA` `DispatchMessageW` `TranslateMessage` `GetMessageW` `SetProcessDPIAware` `MonitorFromWindow` `LoadCursorW` `ScreenToClient` `ClientToScreen` `GetCursorPos` `SetCursor` `SetCursorPos` `GetClientRect` `ReleaseDC` `GetDC` `GetForegroundWindow` `ReleaseCapture` `SetCapture` `GetCapture` `GetKeyState` `GetClipboardData`
GDI32.dll	`DeleteObject` `GetDeviceCaps` `CreateRectRgn`
ADVAPI32.dll	`GetUserNameW`
IMM32.dll	`ImmGetContext` `ImmReleaseContext` `ImmSetCompositionWindow`
D3DCOMPILER_47.dll	`D3DCompile`
dwmapi.dll	`DwmIsCompositionEnabled` `DwmExtendFrameIntoClientArea` `DwmGetColorizationColor` `DwmEnableBlurBehindWindow`

Delayed Imports

1

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x188`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.89623`
MD5	`b8e76ddb52d0eb41e972599ff3ca431b 🔍`
SHA1	`fc12d7ad112ddabfcd8f82f290d84e637a4d62f8 🔍`
SHA256	`165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8 🔍`
SHA3	`37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd 🔍`

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2026-Nov-02 15:57:37
Version	`0.0`
SizeofData	`114`
AddressOfRawData	`0x2d0b3c`
PointerToRawData	`0x2cf33c`
Referenced File	C:\Users\Admin\Desktop\Current Projects\Noro\Noro External FREE\Noro\x64\Release\Noro.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics	`0`
TimeDateStamp	2026-Nov-02 15:57:37
Version	`0.0`
SizeofData	`20`
AddressOfRawData	`0x2d0bb0`
PointerToRawData	`0x2cf3b0`

TLS Callbacks

StartAddressOfRawData	`0x1404b9000`
EndAddressOfRawData	`0x1404b9235`
AddressOfIndex	`0x14049d810`
AddressOfCallbacks	`0x140231d40`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_8BYTES`
Callbacks	`(EMPTY)`

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x140492440`

RICH Header

XOR Key	`0xefcd27b0`
Unmarked objects	`0`
C++ objects (35222)	`192`
C objects (35222)	`43`
ASM objects (35222)	`28`
ASM objects (35207)	`10`
C objects (35207)	`18`
C++ objects (35207)	`95`
Imports (35222)	`17`
Total imports	`242`
C++ objects (35229)	`10`
Resource objects (35229)	`1`
Linker (35229)	`1`

Errors

Leave a comment

No comments yet.