73419b4a291edc85c3be04d770f624057358640f7bcccb1ddd99313982796467

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2025-Dec-18 23:39:28
Detected languages English - United States
TLS Callbacks 2 callback(s) detected.
Debug artifacts librewolf.pdb
Comments
LegalCopyright ©Firefox and Mozilla Developers; available under the MPL 2 license.
CompanyName Mozilla Corporation
FileDescription LibreWolf
FileVersion 146.0.1
ProductVersion 146.0.1-1
InternalName LibreWolf
LegalTrademarks Firefox is a Trademark of The Mozilla Foundation.
OriginalFilename librewolf.exe
ProductName LibreWolf
BuildID 20251218232703

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Suspicious The PE is possibly packed. Unusual section name found: .freestd
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExA
  • LoadLibraryExW
  • LoadLibraryW
 Functions which can be used for anti-debugging purposes:
  • NtQueryInformationProcess
 Code injection capabilities:
  • CreateRemoteThread
  • OpenProcess
  • VirtualAlloc
  • VirtualAllocEx
  • WriteProcessMemory
 Code injection capabilities (mapping injection):
  • CreateFileMappingA
  • CreateFileMappingW
  • CreateRemoteThread
  • MapViewOfFile
 Possibly launches other programs:
  • CreateProcessW
 Uses Windows's Native API:
  • NtMapViewOfSection
  • NtOpenFile
  • NtQueryInformationProcess
  • NtQueryObject
  • NtQueryVirtualMemory
  • NtReadVirtualMemory
  • NtUnmapViewOfSection
 Memory manipulation functions often used by packers:
  • VirtualAlloc
  • VirtualAllocEx
  • VirtualProtect
  • VirtualProtectEx
 Manipulates other processes:
  • OpenProcess
  • ReadProcessMemory
  • WriteProcessMemory
Malicious The program tries to mislead users about its origins. The PE pretends to be from Firefox but is not signed!
Safe VirusTotal score: 0/67 (Scanned on 2026-05-28 05:01:21) All the AVs think this file is safe.

Hashes

MD5 ef97851537f0e68cca1e6b0f2d2e9199 🔍
SHA1 68ef8fb8a5196f4bc7db9aa97cd84afcf0cc0342 🔍
SHA256 73419b4a291edc85c3be04d770f624057358640f7bcccb1ddd99313982796467 🔍
SHA3 9124db716275e01090c263eba62b631fb03fb909de50d43c59294353572ae447 🔍
SSDeep 6144:45PjTwaL3JcKvNHdevk9mRNglXW1dN5XHBBcFkTivFGaQdzDuNuZvgtX/IS:45v7TqAd+npXHBB5dvuNYCvIS 🔍
Imports Hash f4952d3f36359e7ec6b15e093544bc59 🔍

DOS Header

e_magic MZ
e_cblp 0x78
e_cp 0x1
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0
e_ss 0
e_sp 0
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x78

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 7
TimeDateStamp 2025-Dec-18 23:39:28
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0x4ea00
SizeOfInitializedData 0x1a200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0004EFA0 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion A.0
ImageVersion 0.0
SubsystemVersion A.0
Win32VersionValue 0
SizeOfImage 0x6f000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x180000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x40000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 36c0e133348191b168e69f3997b6a16a 🔍
SHA1 acb8292f65d3be85bfd5dac7bbf0571f913c89ed 🔍
SHA256 bfc5a10695d520a7d2642d36b40e5a6551aa0ddc867e800a2a7e3c42799e76ed 🔍
SHA3 e9f8a1d8aaf0e156e5b799e757496a35c4c55745806440f0c988bb27a2e71fe7 🔍
VirtualSize 0x4e884
VirtualAddress 0x1000
SizeOfRawData 0x4ea00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.52189

.rdata

MD5 5167ae1d569beb7c18a61a47ec034d2d 🔍
SHA1 6b7fedf70923b0b431e976ff73f6e2995974aecf 🔍
SHA256 6737ab8bba055147888d0137291c0eb37500acee586daa9ab383b670c4d32b31 🔍
SHA3 3764781ce6c9fd58d8eedc89b906cafcd339294d36087b644572a1a1f72734c8 🔍
VirtualSize 0xadfc
VirtualAddress 0x50000
SizeOfRawData 0xae00
PointerToRawData 0x4ee00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.39177

.data

MD5 dd326396d2829b1fd3d0edbfa0c842cf 🔍
SHA1 28d6ae24115a6f4cc2e37875b1ab612077c3e427 🔍
SHA256 c5d503c9d9bdc8e45555dfab980c85a7b85449693bf72c7b9714a8107e109220 🔍
SHA3 e1e2f85c9da846a51ac0d43c2ea57d5fc420039b1d6bb21dd49b5ffe62101c5f 🔍
VirtualSize 0x1d44
VirtualAddress 0x5b000
SizeOfRawData 0x400
PointerToRawData 0x59c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.44121

.freestd

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x8
VirtualAddress 0x5d000
SizeOfRawData 0x200
PointerToRawData 0x5a000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0

.tls

MD5 4d7cf0be12f1f5a6886274cd99a356b9 🔍
SHA1 aba1c7f0876bbf42ab06ddfb07c6852c03d57338 🔍
SHA256 a432ccf11697f193442e2bbf490e2d2ec5766486c29d545bbc7e94537dd1b898 🔍
SHA3 87de318a30e899313e507054b3cd6c7ebe17433c270f5726d9a9e9bc0e885f9b 🔍
VirtualSize 0x16
VirtualAddress 0x5e000
SizeOfRawData 0x200
PointerToRawData 0x5a200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.0815394

.rsrc

MD5 fae7cc6abf9e043a22b9a4c1e9bc831f 🔍
SHA1 8a4198e84413931e1996baee6002a512479d257b 🔍
SHA256 94aa0d5fe7b4c6adac8972d15db1437ef09e47558f8ddba63e2ff8070018f273 🔍
SHA3 2a98f851f4372f714807cf9e9f1bbcbed8ef1938992473e4d9b7617f4e4d5184 🔍
VirtualSize 0xb910
VirtualAddress 0x5f000
SizeOfRawData 0xba00
PointerToRawData 0x5a400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.6616

.reloc

MD5 4f355024646a8a9d1e1482140d72815f 🔍
SHA1 53be2dd1a4ce8dff18feb5a2f5afad2cceb0cae2 🔍
SHA256 1c6b312b686c2da4c0b6221958e5582acd5770af40c32c0cc37ac6d87092cddf 🔍
SHA3 2f7d12e2e80f799a937ed964c86d6b67ddf5ba77fe57ef69707d1899857925fa 🔍
VirtualSize 0x30e8
VirtualAddress 0x6b000
SizeOfRawData 0x3200
PointerToRawData 0x65e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.69663

Imports

mozglue.dll ??0MutexImpl@detail@mozilla@@QAE@XZ
??0PrintfTarget@mozilla@@IAE@XZ
??1MutexImpl@detail@mozilla@@QAE@XZ
??2@YAPAXI@Z
??3@YAXPAX@Z
??3@YAXPAXI@Z
??_U@YAPAXI@Z
??_V@YAXPAX@Z
?BeginProcessRuntimeInit@detail@mscom@mozilla@@YAAAW4ProcessInitState@123@XZ
?CleanupProcessRuntime@mozilla@@YAXXZ
?CreateAndStorePreXULSkeletonUI@mozilla@@YAXPAUHINSTANCE__@@HPAPAD@Z
?DllBlocklist_Initialize@@YAXI@Z
?EndProcessRuntimeInit@detail@mscom@mozilla@@YAXXZ
?GetClearedBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAPAVProfileChunkedBuffer@2@XZ
?GetProfilingStack@AutoProfilerLabel@baseprofiler@mozilla@@SAPAVProfilingStack@23@XZ
?InvalidArrayIndex_CRASH@detail@mozilla@@YAXII@Z
?IsActiveAndUnpaused@RacyFeatures@detail@baseprofiler@mozilla@@SA_NXZ
?IsWin32kLockedDown@mozilla@@YA_NXZ
?MapRemoteViewOfFile@mozilla@@YAPAXPAX0_K0KKK@Z
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z
?PollPreXULSkeletonUIEvents@mozilla@@YAXXZ
?RegisterRuntimeExceptionModule@CrashReporter@@YAXXZ
?SetGeckoChildID@mozilla@@YAXPBD@Z
?SetGeckoProcessType@mozilla@@YAXPBD@Z
?SetWin32kLockedDownInPolicy@mozilla@@YAXXZ
?TagForMarkerTypeFunctions@Streaming@base_profiler_markers_detail@mozilla@@SAEP6AXAAVProfileBufferEntryReader@3@AAVSpliceableJSONWriter@baseprofiler@3@@ZP6A?AV?$Span@$$CBD$0PPPPPPPP@@3@XZP6A?AVMarkerSchema@3@XZ@Z
?UnregisterRuntimeExceptionModule@CrashReporter@@YAXXZ
?WindowsDpiInitialization@mozilla@@YA?AW4WindowsDpiInitializationResult@1@XZ
?ensureCapacitySlow@ProfilingStack@baseprofiler@mozilla@@AAEXXZ
?lock@MutexImpl@detail@mozilla@@IAEXXZ
?profiler_active_without_feature@baseprofiler@mozilla@@YA_NI@Z
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z
?profiler_current_thread_id@baseprofiler@mozilla@@YA?AVBaseProfilerThreadId@12@XZ
?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z
?profiler_shutdown@baseprofiler@mozilla@@YAXXZ
?sChildProcessType@startup@mozilla@@3W4GeckoProcessType@@A
?unlock@MutexImpl@detail@mozilla@@IAEXXZ
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z
_wcsdup
free
malloc
malloc_good_size
moz_xmalloc
mozalloc_abort
printf_stderr
realloc
strdup
ntdll.dll NtMapViewOfSection
NtOpenFile
NtQueryInformationProcess
NtQueryObject
NtQueryVirtualMemory
NtReadVirtualMemory
NtUnmapViewOfSection
RtlAcquireSRWLockExclusive
RtlAcquireSRWLockShared
RtlAllocateHeap
RtlAnsiStringToUnicodeString
RtlCaptureStackBackTrace
RtlCompareMemory
RtlCompareUnicodeString
RtlDuplicateUnicodeString
RtlEqualUnicodeString
RtlFreeHeap
RtlFreeUnicodeString
RtlGetLastWin32Error
RtlInitAnsiString
RtlInitUnicodeString
RtlNtStatusToDosError
RtlQueryPerformanceCounter
RtlReAllocateHeap
RtlReleaseSRWLockExclusive
RtlReleaseSRWLockShared
RtlRunOnceExecuteOnce
RtlRunOnceInitialize
RtlSetLastWin32Error
RtlSleepConditionVariableSRW
RtlWakeAllConditionVariable
VerSetConditionMask
memcmp
memcpy
memmove
memset
MSVCP140.dll ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0ios_base@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1ios_base@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Raise_handler@std@@3P6AXABVexception@stdext@@@ZA
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?good@ios_base@std@@QBE_NXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
KERNEL32.dll AcquireSRWLockExclusive
AssignProcessToJobObject
AttachConsole
CloseHandle
CreateEventW
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateIoCompletionPort
CreateJobObjectW
CreateMutexW
CreateNamedPipeW
CreateProcessW
CreateRemoteThread
CreateThread
DebugBreak
DeleteProcThreadAttributeList
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesEx
ExpandEnvironmentStringsW
FlushInstructionCache
FreeEnvironmentStringsW
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentProcessorNumber
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileType
GetLastError
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetProcAddress
GetProcessHandleCount
GetProcessHeaps
GetProcessId
GetProcessMitigationPolicy
GetProductInfo
GetQueuedCompletionStatus
GetStartupInfoW
GetStdHandle
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadId
GetTickCount
GetUserDefaultLCID
GetUserDefaultLangID
GetUserDefaultLocaleName
GetVersionExW
HeapDestroy
HeapSetInformation
InitOnceExecuteOnce
InitializeCriticalSectionEx
InitializeProcThreadAttributeList
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsWow64Process
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalFree
MapViewOfFile
MultiByteToWideChar
OpenProcess
PostQueuedCompletionStatus
QueryFullProcessImageNameW
QueryInformationJobObject
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
ReadProcessMemory
RegisterWaitForSingleObject
ReleaseSRWLockExclusive
ResumeThread
SetDefaultDllDirectories
SetDllDirectoryW
SetEnvironmentVariableW
SetEvent
SetFilePointerEx
SetHandleInformation
SetInformationJobObject
SetLastError
SetProcessDEPPolicy
SetProcessMitigationPolicy
SetStdHandle
SetThreadAffinityMask
SetThreadInformation
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
TerminateJobObject
TerminateProcess
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
UnmapViewOfFile
UnregisterWaitEx
UpdateProcThreadAttribute
VerifyVersionInfoW
VirtualAlloc
VirtualAllocEx
VirtualFree
VirtualFreeEx
VirtualProtect
VirtualProtectEx
VirtualQuery
VirtualQueryEx
WaitForSingleObject
WakeAllConditionVariable
WideCharToMultiByte
WriteProcessMemory
VCRUNTIME140.dll _CxxThrowException
__CxxFrameHandler3
__current_exception
__current_exception_context
__std_terminate
_except_handler3
_except_handler4_common
strrchr
wcschr
api-ms-win-crt-runtime-l1-1-0.dll __p___argc
__p___wargv
_c_exit
_cexit
_configure_wide_argv
_controlfp_s
_crt_atexit
_errno
_exit
_get_initial_wide_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_invoke_watson
_register_onexit_function
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_app_type
exit
terminate
api-ms-win-crt-stdio-l1-1-0.dll __acrt_iob_func
__p__commode
__stdio_common_vfwprintf_s
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf
__stdio_common_vswprintf
_fileno
_get_osfhandle
_set_fmode
_wfopen
fclose
fgets
freopen
api-ms-win-crt-math-l1-1-0.dll __setusermatherr
ceil
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale
api-ms-win-crt-environment-l1-1-0.dll __p__environ
_putenv
_wgetenv
getenv
api-ms-win-crt-convert-l1-1-0.dll _ltoa_s
wcstoul
api-ms-win-crt-string-l1-1-0.dll _stricmp
_wcsnicmp
strcpy
strlen
towlower
wcscmp
wcscpy
wcscpy_s
wcslen
wcsncmp
wcspbrk
wcstok_s
api-ms-win-crt-filesystem-l1-1-0.dll _wsplitpath_s
api-ms-win-crt-utility-l1-1-0.dll rand_s
api-ms-win-crt-heap-l1-1-0.dll _set_new_mode
OLEAUT32.dll (delay-loaded) SetOaNoCache
SysAllocString
SysFreeString
VariantClear
VariantInit

Delayed Imports

Attributes 0x1
Name OLEAUT32.dll
ModuleHandle 0x5b220
DelayImportAddressTable 0x5b260
DelayImportNameTable 0x56f5c
BoundDelayImportTable 0
UnloadDelayImportTable 0
TimeStamp 1970-Jan-01 00:00:00

GetHandleVerifier

Ordinal 1
Address 0x28070

GetNtLoaderAPI

Ordinal 2
Address 0xd090

IsSandboxedProcess

Ordinal 3
Address 0x3e990

NativeNtBlockSet_Write

Ordinal 4
Address 0x15650

_TargetCreateNamedPipeW@36

Ordinal 5
Address 0x39690

_TargetCreateThread@28

Ordinal 6
Address 0x3c220

_TargetGdiDllInitialize@12

Ordinal 7
Address 0x18660

_TargetGetForegroundWindow@4

Ordinal 8
Address 0x11030

_TargetGetStockObject@8

Ordinal 9
Address 0x18c40

_TargetNtCreateFile@48

Ordinal 10
Address 0x30e10

_TargetNtCreateKey@32

Ordinal 11
Address 0x1d5b0

_TargetNtCreateSection@32

Ordinal 12
Address 0x44db0

_TargetNtImpersonateAnonymousToken@8

Ordinal 13
Address 0x3ad50

_TargetNtMapViewOfSection@44

Ordinal 14
Address 0x45c90

_TargetNtOpenFile@28

Ordinal 15
Address 0x31300

_TargetNtOpenKey@16

Ordinal 16
Address 0x1dee0

_TargetNtOpenKeyEx@20

Ordinal 17
Address 0x1df40

_TargetNtOpenProcess@20

Ordinal 18
Address 0x3bfc0

_TargetNtOpenProcessToken@16

Ordinal 19
Address 0x3c0a0

_TargetNtOpenProcessTokenEx@20

Ordinal 20
Address 0x3c1e0

_TargetNtOpenSection@16

Ordinal 21
Address 0x3ae50

_TargetNtOpenThread@20

Ordinal 22
Address 0x3bcc0

_TargetNtOpenThreadToken@20

Ordinal 23
Address 0x3af30

_TargetNtOpenThreadTokenEx@24

Ordinal 24
Address 0x3af80

_TargetNtQueryAttributesFile@12

Ordinal 25
Address 0x316a0

_TargetNtQueryFullAttributesFile@12

Ordinal 26
Address 0x31930

_TargetNtSetInformationFile@24

Ordinal 27
Address 0x31ac0

_TargetNtSetInformationThread@20

Ordinal 28
Address 0x3aed0

_TargetNtUnmapViewOfSection@12

Ordinal 29
Address 0x45e90

_TargetRegisterClassW@8

Ordinal 30
Address 0x3b9e0

g_current_mitigations

Ordinal 31
Address 0x5c7d0

g_delegate_data_size

Ordinal 32
Address 0x5c884

g_handles_to_close

Ordinal 33
Address 0x5c748

g_interceptions

Ordinal 34
Address 0x5c7c4

g_nt

Ordinal 35
Address 0x5c7f8

g_originals

Ordinal 36
Address 0x5c74c

g_sentinel_value_end

Ordinal 37
Address 0x5b16c

g_sentinel_value_start

Ordinal 38
Address 0x5b168

g_shared_IPC_size

Ordinal 39
Address 0x5c87c

g_shared_delayed_integrity_level

Ordinal 40
Address 0x5b164

g_shared_delayed_mitigations

Ordinal 41
Address 0x5c8a0

g_shared_policy_size

Ordinal 42
Address 0x5c880

g_shared_section

Ordinal 43
Address 0x5c7f4

g_shared_startup_mitigations

Ordinal 44
Address 0x5c8a8

IDENTITY

Type LIMITEDACCESSFEATURE
Language English - United States
Codepage UNKNOWN
Size 0x38
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.091
MD5 36e6ead806a73a5a3bc2ce4f4271ab6a 🔍
SHA1 81a2c65bdd3b4acf0fe59c492c9b5bb0f707d5f7 🔍
SHA256 fb2ff6c0153228b41d9724562e77a0c6216a2e7ae8eddd4dd55441d737b3c73b 🔍
SHA3 5b806c73e94216aafbd67724a64e74cabcfcfa7e7f6a2d95945725baca3646d0 🔍

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x824
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.88369
Detected Filetype PNG graphic file
MD5 4ce40ab5e994aff41d2c30ff97e7b11a 🔍
SHA1 8d4e040ace2943e9fd7da4f4c8fd2ce1cc11ad11 🔍
SHA256 107622cc8565b76116ad9abfde54044623dd2c63f8d5e924e1a16da9908ca7a5 🔍
SHA3 829ff8aa5e8deda4e638fa9ddbe74c6cb5af1de089f96a2d85713ceae63366f9 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xa31
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.91395
Detected Filetype PNG graphic file
MD5 f0e9b896d70793cb2f0a533a0b92a8dd 🔍
SHA1 a8de33e38f2b4ca1323c41633e9852b117e6b21e 🔍
SHA256 05e0dc57c5395ba71b2728d808106c22ba17526698bcf09d28f6bd51c06b5ff7 🔍
SHA3 d228087a5d4245ba2802081d8bf93b675adcd9712badbd83c595e63e9542ce91 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x5d4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.85357
Detected Filetype PNG graphic file
MD5 c5f7f0f8e9443cf1d3fc232c425a4aac 🔍
SHA1 c20de51f866b8a264560cf8d8443f75533f48bab 🔍
SHA256 9a18f4a6ecde0fb02b948e4b1228d671827e535431b0e22accd1ea73f27feef4 🔍
SHA3 d6c196e689d7d0f6d0fb0c39e0532cae3e34968f19a9121031fcc2138f451073 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x26e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.60089
Detected Filetype PNG graphic file
MD5 288cbcd1720003c5e672921686ee2ce9 🔍
SHA1 8fabeff40c161b3294d0fc3b40b1205f5556358f 🔍
SHA256 b775c9946809a4b4434f2fb56a90dd6331458f3f57254b3d8a4bc5b6d70c9573 🔍
SHA3 b7aeefa773529b93815414bf90c7bd71fecbacfb1d537505efbb8c77779a46cd 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x1c1
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.41095
Detected Filetype PNG graphic file
MD5 ca293768e794ab92316d6e5f22f0a711 🔍
SHA1 4187fdf976971f09b392fcd541e92f310743fc82 🔍
SHA256 18d5c2f330c643fea96d9091c067365ca58910dbafcd7c2087ed6b42b7edfeb2 🔍
SHA3 9f2424c6dabd43e07bb95e09bcebd878c50f013cfb69f4ad0591aa2c43fcfdb1 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x336
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.61555
Detected Filetype PNG graphic file
MD5 f10b3ffdc691351a81861b7462f2f04e 🔍
SHA1 0daa431aecc4f7c9e984d34789585fad28c1749c 🔍
SHA256 c41d5157b05e47c84402823c7de7b56d36b1a155953c70850de633cb06a5ecfd 🔍
SHA3 09174d72daa3dfffcacf58454bc1553bd4a456cdb4e2a1ec90cdec29d237c76a 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4c2
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.78397
Detected Filetype PNG graphic file
MD5 52f2544f49d8221d489eff7b6b7ca335 🔍
SHA1 05af41ef9c8722c26184c383c15bf769c63a7485 🔍
SHA256 ee01becac283f4c467049af9ff2596fb544c4a6847c0d8ae2e9cbcaa844c9a6e 🔍
SHA3 a003c769a56db59d834f2d48080d5ad15415936216ce2cf12dbcd06e3102cd6b 🔍

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x68c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.80981
Detected Filetype PNG graphic file
MD5 24d2bbb71cba50657c8cac0fc300715b 🔍
SHA1 3367cf69ec778a38c573644657685522ca7e91bc 🔍
SHA256 29528b48cade9c6fcf0b15b1b610942c9312129fe5c07e97af19d2ec76294f02 🔍
SHA3 842af7cb5ad5c17adafd0d5d5b7b53bdeb7938c9f1d786a68826ebaf0c98f27b 🔍

9

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xdba
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.85729
Detected Filetype PNG graphic file
MD5 ba5eb6ace36108759718e3b7a48b130d 🔍
SHA1 09ceed8760139c7cf18a683de6de3c89caa940f4 🔍
SHA256 b47b6219a0499fd0a3d2890cfab7df1113ac4eaaaf7830e40ed9f44d3560adea 🔍
SHA3 ed82a8e912119147dd36ddbcb7fee35f194f8855c538132ca1345b4042b977f2 🔍

10

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x15a6
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.70432
Detected Filetype PNG graphic file
MD5 c31edf5fc20cd5c84c5ed52247d9e160 🔍
SHA1 3c788a69dcfc387a33c5c5084cf721741c007ecd 🔍
SHA256 65e010a6c70f83322a7d484fffa58f68d26eae2c3bd7beea7af559611bce7a29 🔍
SHA3 0bf261a23719e03e5402f94f2e2d3ad5b1d4d098ccd4a34f668b6c0058611569 🔍

11

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x824
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.88369
Detected Filetype PNG graphic file
MD5 4ce40ab5e994aff41d2c30ff97e7b11a 🔍
SHA1 8d4e040ace2943e9fd7da4f4c8fd2ce1cc11ad11 🔍
SHA256 107622cc8565b76116ad9abfde54044623dd2c63f8d5e924e1a16da9908ca7a5 🔍
SHA3 829ff8aa5e8deda4e638fa9ddbe74c6cb5af1de089f96a2d85713ceae63366f9 🔍

12

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xa31
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.91395
Detected Filetype PNG graphic file
MD5 f0e9b896d70793cb2f0a533a0b92a8dd 🔍
SHA1 a8de33e38f2b4ca1323c41633e9852b117e6b21e 🔍
SHA256 05e0dc57c5395ba71b2728d808106c22ba17526698bcf09d28f6bd51c06b5ff7 🔍
SHA3 d228087a5d4245ba2802081d8bf93b675adcd9712badbd83c595e63e9542ce91 🔍

13

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x5d4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.85357
Detected Filetype PNG graphic file
MD5 c5f7f0f8e9443cf1d3fc232c425a4aac 🔍
SHA1 c20de51f866b8a264560cf8d8443f75533f48bab 🔍
SHA256 9a18f4a6ecde0fb02b948e4b1228d671827e535431b0e22accd1ea73f27feef4 🔍
SHA3 d6c196e689d7d0f6d0fb0c39e0532cae3e34968f19a9121031fcc2138f451073 🔍

14

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x26e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.60089
Detected Filetype PNG graphic file
MD5 288cbcd1720003c5e672921686ee2ce9 🔍
SHA1 8fabeff40c161b3294d0fc3b40b1205f5556358f 🔍
SHA256 b775c9946809a4b4434f2fb56a90dd6331458f3f57254b3d8a4bc5b6d70c9573 🔍
SHA3 b7aeefa773529b93815414bf90c7bd71fecbacfb1d537505efbb8c77779a46cd 🔍

15

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x156
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.08687
Detected Filetype PNG graphic file
MD5 47a534e72a11b4902d1fe66f4ea479e0 🔍
SHA1 938a05ab59ba0a4b9bb026cf3b682120ec13349f 🔍
SHA256 b7aa4adca23b4997b8e4f04dd2c7e097cbd03ecebae05a8192f41a9eb2c372fe 🔍
SHA3 4184fe8800392738d82bffa6a78ecfacc6c3dea2bab3c0b1f0a7aa26bb6d0d2a 🔍

16

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x241
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.49216
Detected Filetype PNG graphic file
MD5 b33500551ab431e2c3431c90e581a0b2 🔍
SHA1 ff83cf61dc0d4fb34d02105ece59d5984f3d29d4 🔍
SHA256 7bae635c63d86ce1c20386c1a1ddcd61a05ec8bf93d7f0ab957eb26168beaa7f 🔍
SHA3 b36f8edcfeee28e357f4afd017649006a25757f4993a8eeac8eee84ed8b241d4 🔍

17

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x190
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.33045
Detected Filetype PNG graphic file
MD5 d4b063695642ab98e3e81179142bd5b2 🔍
SHA1 3f6a1d9727a9d240c07c2dca2047c8c90a2c8111 🔍
SHA256 2a39df255e4b384c559bd98202c0f2c70a8beab0354148f436f0afe8acb754ff 🔍
SHA3 69e24731f803c645c5d7c1798969f4bf2d14b23cf8e14001d6bdeb3d0198209d 🔍

18

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2fd
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.69346
Detected Filetype PNG graphic file
MD5 8dda90c1473b659d323a90ad7bf9db64 🔍
SHA1 336de25571fb3988163b658d82223b712b895829 🔍
SHA256 25b2f4cf635905f9ded4503cb3e3ef4d7e1565c913010a402d33be6fa74caa9b 🔍
SHA3 6e42de581cf77b40046885b7ba901e782491371bf8efc2c8f5551f73584cdfc4 🔍

19

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x202
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.53195
Detected Filetype PNG graphic file
MD5 90ca44a9a36de4ee854c4d416fc78718 🔍
SHA1 aef46ee0da34766c84a483791aac9ea8647d3045 🔍
SHA256 abac571f5944384e6d48a365cc5870870789cd9a6e47359176b3493e752d1fca 🔍
SHA3 035d0261ebb3326041d8bb8a3c0376f1c123d2e992a0d889685317793fb18236 🔍

20

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x557
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.82328
Detected Filetype PNG graphic file
MD5 1165fc96a4673445919f693c64ae44a9 🔍
SHA1 603b71d2e429ad5ec62593a1e28ee086b113b4d4 🔍
SHA256 77231d8219420f725b3eb0ca894574d7d1940e2afc8f95031a2519b74d59e4ce 🔍
SHA3 df3536b18ad8c1cbf32ffd7f5a541cddc44d414c6b4a8ee27d12dc3bbe5d8856 🔍

21

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x214
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.4972
Detected Filetype PNG graphic file
MD5 fe1bbdb6449ebf25fbea19d9fb65af59 🔍
SHA1 b8d5ca75eef44c9dc1e37cf11aa5287aee743ae7 🔍
SHA256 cfe19bb4777c1619317d0bfb28cd8d3846547020074dd9fb0d2fbbe0c3a99117 🔍
SHA3 a36bc4b98ab364005f4ca6524514c69221dbc54630d5180cfe9a53f37e00c210 🔍

22

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x3c5
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.68572
Detected Filetype PNG graphic file
MD5 94936224a5a642d7cb6262c4454ed2d7 🔍
SHA1 100d234082ab04fd1488f0c4010309ad4e6ecd58 🔍
SHA256 2c022dceabd9e4c5d0878a7ded20310a6ab12f1d4af8a9b92e122d7a0a82a74c 🔍
SHA3 c418ce88499d91a815941d58a341514a1ec3b9c454ade7e1c56519e3a3918676 🔍

23

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x510
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.78043
Detected Filetype PNG graphic file
MD5 cc3cdf71740190cf729806a96d1b44c2 🔍
SHA1 f345b327c71b73d01b90ecfed487211e79fc14b7 🔍
SHA256 2a300d9f032500976157695c2d27f8d9a054b0e86ac99fbcf28bc92067b22fc0 🔍
SHA3 5f0aa0004a47e80c6890f19bcb497c95f1c00d764f1740cc5028c188a605114b 🔍

24

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x6ab
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.8408
Detected Filetype PNG graphic file
MD5 064abd2e543d45d410af011569d44710 🔍
SHA1 4931ebeb0faa5134fc9a8924c7d94cfeeb3ebf7c 🔍
SHA256 5eca5ab410e0bdb9ae32b0d9585bc6c70f384c06bf2defaa3dbaa7ef54b657b3 🔍
SHA3 4cf8c0830fc0670a77799c240b18ee7ac860c8e34657c4009e93dc39f89f9105 🔍

25

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xb98
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.84236
Detected Filetype PNG graphic file
MD5 7bc64c23291f15d6b881fdb4c76f78d6 🔍
SHA1 e61a0690a94bfc800dfe3c8b669fe474ba308dc8 🔍
SHA256 54700299aca660226b62468898d3b48f5b42fe919b353e51ec7fd4a13f378fd0 🔍
SHA3 7bd34e4f61ca7fa7858e074430dca4fa6e3d72f5151b678c86a8e13911ae47f6 🔍

26

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xe9b
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.37529
Detected Filetype PNG graphic file
MD5 91322ba511c992765e8c6d2fb8408b51 🔍
SHA1 217f2503aefcf96c068858cc29ddd5c2dc594639 🔍
SHA256 2fbf77f0339108c9b4597ff0108f9b9db9cb69d0b8438f9018c0fff2fd99745b 🔍
SHA3 fa6bcc1f9179b5f6f8fc03c4bde5d63d8a16e1a1dab893a82dbdac9d2bb4ba4c 🔍

7 (#2)

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x32
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.38631
MD5 6acb3673e36ba488a28e378755d410a8 🔍
SHA1 af7598c0c6e6c47934cc9fb7d9151af22f9cb1ec 🔍
SHA256 8d2ab50f69b99869c081e290aaba42fe129e1b6b7849680ff670b119d056aee2 🔍
SHA3 139d19cc1997a1baa872f5de1b4aeda69bf048ce7b7088ff1ebbe4cd341d69df 🔍

1 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x3e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71195
Detected Filetype Icon file
MD5 09aff6ca42db78892b5f219bb9cac35e 🔍
SHA1 64c40d87e6025757ec1d16e084cedc82a6d598fe 🔍
SHA256 a446ec8913e5f3509606c9aa627349cf076041ed7fc3e46c2e45dd652950b395 🔍
SHA3 90ffc9878a437ef62ae2362fa60bb5a94ec0a17dd2a22786810eb8534ecb6bdb 🔍

2 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.83815
Detected Filetype Icon file
MD5 5dae505f379828518a6576be7b4ce65b 🔍
SHA1 bf472c61e59aaf7c0a21a7b97ab644115cdd4a49 🔍
SHA256 55e1f4c1eff5a0ae07b9512b972a015fa6c982e143f45b234aa5086d47b2f5df 🔍
SHA3 3d6e20be9d251a885fafd7d996551cdb420baf698bca93b34a95747742fc43cb 🔍

3 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.21059
Detected Filetype Icon file
MD5 2843f8ea3aa08c5eb6738dd4c874307b 🔍
SHA1 02e2e7edcdc9fc837e29095a25e248bb43ef2b5f 🔍
SHA256 55e5eb9a9c2e967c107f88d87f6963dd083b9ed6d42e3add620a13e2a1a5f87f 🔍
SHA3 bb33f542530c6ac3e8e893ac8317310c56766357f9e771c22a8ac6eae18fada1 🔍

4 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.29162
Detected Filetype Icon file
MD5 e7d212cfc38dadaee8ab9681d8ff0d67 🔍
SHA1 3ca7a867b1f1a33d697f83fa4c090c599648d8f1 🔍
SHA256 e42fbc78110870541151ae4be2beddef0c5450897fba57b595b5a583519f1eee 🔍
SHA3 9d3a2e6abe19c9b1a32343baf220ecaa3f5f0e2500ab13f93dbec1bc1fd3a3db 🔍

5 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.30604
Detected Filetype Icon file
MD5 c1205c2c9f6d951687dd3c552d634116 🔍
SHA1 5ce332f004ea624370337e060ecc3d3d072d7c30 🔍
SHA256 49e8de4cc356f8380b1371f3a01f11beb0a522335b2f84c54a687e099a9db6fb 🔍
SHA3 c66a9fb673992e1b2ebbc92ec4eab11cdc8761fd0d537ba333dbe623871fab2d 🔍

6 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.88647
Detected Filetype Icon file
MD5 ae721e963b41e7b1975ae03a0df5226d 🔍
SHA1 59a8c6ef849dd70702c1103c81350188f9bfd061 🔍
SHA256 54a99c69175b3584da9faefbaa8984880443d81e4fdd9fe50f267875c3a69b41 🔍
SHA3 c54b828f39299a258d07ac8b0d91689308c978a9ae38c022c2fdcc77ab30c3a0 🔍

32512

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x3e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.83937
Detected Filetype Icon file
MD5 5bc5c9a76718131dd17de753ffa203a8 🔍
SHA1 ceb1aeb86def2071ac079ba94624687b052b17bc 🔍
SHA256 62a39bcd0548d689571f39ea6b29fb0ffaee41a0168e3fae4846ff7411a3fee5 🔍
SHA3 6153cb3cc282fc519464996802cfb894cbcc251f0a25054ab789eff33896757e 🔍

1 (#3)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x400
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.44392
MD5 82f3e712dc4375b84c208835a9dce6fc 🔍
SHA1 00a1e795282c8d0b912be9da34a96851272692a9 🔍
SHA256 8eed6fe44919126fc45c560751a0a2e33b1319f4eb497083af2ab46e6913852e 🔍
SHA3 eef00c8e5cd120a379bc7877615ae886fd49a2e8a1603d1de67b3eeacee58aa5 🔍

1 (#4)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x6a0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.7416
MD5 af1e65908400ab3029e08c930e199e7e 🔍
SHA1 f941f6b8ecaa9e7b654a8915c14c4cd6d22053b8 🔍
SHA256 86fa4dd6733bb3b5b8b45b2685e3665fd2ffca8cc21a989ddf7527a78fd17ec9 🔍
SHA3 988c3c1982a16657afea0058fd953f0ea1d47e0968e0017fcbdba943cee583b3 🔍

String Table contents

LibreWolf

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 146.0.1.65535
ProductVersion 146.0.1.0
FileFlags VS_FF_PRIVATEBUILD
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_DLL
Language UNKNOWN
Comments
LegalCopyright ©Firefox and Mozilla Developers; available under the MPL 2 license.
CompanyName Mozilla Corporation
FileDescription LibreWolf
FileVersion (#2) 146.0.1
ProductVersion (#2) 146.0.1-1
InternalName LibreWolf
LegalTrademarks Firefox is a Trademark of The Mozilla Foundation.
OriginalFilename librewolf.exe
ProductName LibreWolf
BuildID 20251218232703
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2025-Dec-18 23:39:28
Version 0.0
SizeofData 38
AddressOfRawData 0x568dc
PointerToRawData 0x556dc
Referenced File librewolf.pdb

TLS Callbacks

StartAddressOfRawData 0x45e000
EndAddressOfRawData 0x45e015
AddressOfIndex 0x45c9f4
AddressOfCallbacks 0x456e20
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks 0x00425350
0x0044E1B0

Load Configuration

Size 0xc0
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x45b180
SEHandlerTable 0x456902
SEHandlerCount 5
GuardCFCheckFunctionPointer 4550120
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

Errors

Leave a comment

No comments yet.