7b45abde4f92d3977f25cec4f41ec4c3b6bd0188073410144f596ef8986ac2d7

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Oct-28 01:52:39
Detected languages English - United States
TLS Callbacks 2 callback(s) detected.

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to security software:
  • rshell.exe
 May have dropper capabilities:
  • CurrentControlSet\Services
 Miscellaneous malware strings:
  • exploit
  • virus
 Contains domain names:
  • apple.com
  • casedieresis.cn
  • casetilde.cn
  • commaaccentright.cn
  • crl.microsoft.com
  • cyrillictail.cn
  • cyrillictic.cn
  • fontello.com
  • github.com
  • gmail.com
  • http://crl.microsoft.com
  • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0
  • http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z
  • http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z
  • http://fontello.com
  • http://sajatypeworks.comMicrosoft
  • http://scripts.sil.org
  • http://scripts.sil.org/OFL
  • http://scripts.sil.org/OFLThis
  • http://scripts.sil.org/OFLhttps
  • http://www.apple.com
  • http://www.apple.com/Copyright
  • http://www.apple.com/This
  • http://www.apple.com/http
  • http://www.microsoft.com
  • http://www.microsoft.com/PKI/docs/CPS/default.htm0
  • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0
  • http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
  • http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
  • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0
  • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a
  • http://www.microsoft.com/pkiops/docs/primarycps.htm0
  • http://www.microsoft.com0
  • http://www.zkysky.com.ar
  • http://www.zkysky.com.ar/
  • https://fivem.ovh
  • https://github.com
  • https://rsms.me
  • https://scripts.sil.org
  • https://scripts.sil.org/OFL
  • koronisaccentleft.cn
  • microsoft.com
  • scripts.sil.org
  • tildecross.cn
  • www.apple.com
  • www.microsoft.com
  • www.zkysky.com
  • zkysky.com
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to SHA256
Uses known Mersenne Twister constants
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
  • LoadLibraryW
 Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
  • FindWindowA
 Code injection capabilities:
  • WriteProcessMemory
  • VirtualAllocEx
  • OpenProcess
 Code injection capabilities (PowerLoader):
  • GetWindowLongA
  • FindWindowA
 Can access the registry:
  • RegUnLoadKeyW
  • RegLoadKeyW
  • RegOpenKeyExW
  • RegDeleteValueW
  • RegEnumValueW
  • RegQueryValueExW
  • RegEnumKeyExW
  • RegFlushKey
  • RegDeleteKeyW
  • RegCloseKey
  • RegSetValueExW
  • RegCreateKeyExW
 Possibly launches other programs:
  • CreateProcessW
  • ShellExecuteW
 Uses Windows's Native API:
  • ZwReadVirtualMemory
  • ZwWriteVirtualMemory
 Can create temporary files:
  • CreateFileA
  • CreateFileW
  • GetTempPathW
 Uses functions commonly found in keyloggers:
  • GetForegroundWindow
  • MapVirtualKeyA
  • GetAsyncKeyState
 Memory manipulation functions often used by packers:
  • VirtualProtectEx
  • VirtualAllocEx
 Has Internet access capabilities:
  • WinHttpOpenRequest
  • WinHttpSendRequest
  • WinHttpConnect
  • WinHttpQueryHeaders
  • WinHttpCloseHandle
  • WinHttpReadData
  • WinHttpSetTimeouts
  • WinHttpQueryDataAvailable
  • WinHttpSetOption
  • WinHttpOpen
  • WinHttpReceiveResponse
  • InternetCloseHandle
  • InternetOpenA
  • InternetOpenUrlA
  • InternetReadFile
 Functions related to the privilege level:
  • OpenProcessToken
  • AdjustTokenPrivileges
 Enumerates local disk drives:
  • GetVolumeInformationW
 Manipulates other processes:
  • ReadProcessMemory
  • WriteProcessMemory
  • Process32First
  • Process32FirstW
  • Process32Next
  • Process32NextW
  • OpenProcess
 Deletes entries from the event log:
  • ClearEventLogW
 Can take screenshots:
  • GetDC
  • FindWindowA
  • BitBlt
  • CreateCompatibleDC
 Reads the contents of the clipboard:
  • GetClipboardData
Malicious VirusTotal score: 25/71 (Scanned on 2026-10-28 01:54:31) ALYac: Gen:Variant.Cerbu.287030
APEX: Malicious
AhnLab-V3: Trojan/Win.Generic.R794482
Antiy-AVL: Trojan/Win32.Sdum
Arcabit: Trojan.Cerbu.D46136
BitDefender: Gen:Variant.Cerbu.287030
Bkav: W32.Malware.63AED33D
CTX: exe.unknown.cerbu
ClamAV: Win.Malware.Zusy-10058122-0
CrowdStrike: win/malicious_confidence_90% (D)
Cynet: Malicious (score: 100)
ESET-NOD32: Win64/GameHack_AGen.CFP potentially unsafe application
Elastic: malicious (high confidence)
Emsisoft: Gen:Variant.Cerbu.287030 (B)
GData: Gen:Variant.Cerbu.287030
Google: Detected
Ikarus: Trojan.Win32.Generic
Kaspersky: VHO:Trojan.Win32.Sdum.gen
Malwarebytes: Malware.AI.1135740240
MaxSecure: Trojan.Malware.300983.susgen
McAfeeD: ti!7B45ABDE4F92
MicroWorld-eScan: Gen:Variant.Cerbu.287030
SentinelOne: Static AI - Malicious PE
Symantec: ML.Attribute.HighConfidence
VIPRE: Gen:Variant.Cerbu.287030

Hashes

MD5 0e525e9aaac5cf6eb403d423a7c266ea 🔍
SHA1 7d23cfbd1ce77874ce4b03250b3b7f77a92d06b8 🔍
SHA256 7b45abde4f92d3977f25cec4f41ec4c3b6bd0188073410144f596ef8986ac2d7 🔍
SHA3 0c7155612bd805acfb22ab152b4ddc45d66a52c10b7e7719280876a5bd0cbad0 🔍
SSDeep 98304:/BtLtXI/g5mFEdA2YUiEZdmIdUwpCplBbBRdPP3Onf5:xLmFoA2tiEZ/duB9nenh 🔍
Imports Hash 9e6aec9bee2afc578850dd020ae95a54 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x110

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Oct-28 01:52:39
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x18b000
SizeOfInitializedData 0x489e00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000180EE0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x618000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 be0815f681cee94b6bc2f5b3ce058d4d 🔍
SHA1 507f3e61c0b679679e8c3fa46dd57914de4821b9 🔍
SHA256 070e69fe6e59bc13841331561c84d4f7c4c3696dc91be39fb61a2f818ddafc85 🔍
SHA3 cb3df9474ad73d0dc8b8f9d2c923f65862b01bde34ab349272b5409f63ce7a1c 🔍
VirtualSize 0x18aff1
VirtualAddress 0x1000
SizeOfRawData 0x18b000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.52747

.rdata

MD5 11892f0eb8e488a5dffe440d738ad056 🔍
SHA1 eecb4e8c2cdd865cbaab231d03a871da3beb189f 🔍
SHA256 830c53449e1bf199748e3a53e8175083dade16aeea88ad0bdc00c6fa3541fe96 🔍
SHA3 b762fcd6290b8c73d118c63955203842140da3b65f339b4519129a5f736bee9e 🔍
VirtualSize 0xb4d24
VirtualAddress 0x18c000
SizeOfRawData 0xb4e00
PointerToRawData 0x18b400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.93423

.data

MD5 a51e7b31a801cbfcffe8dbe66b4e061c 🔍
SHA1 24335988296e7918cabe12e73c15dc3b75f41e47 🔍
SHA256 781b8e101421d22f4ff9a78dacf7ce39828505efccba3b1335926bc2c346123d 🔍
SHA3 a69a1b422193181681e56ea0d87ad4d56edf0de75d4410fd89b469c70de4dcf2 🔍
VirtualSize 0x3c3eb7
VirtualAddress 0x241000
SizeOfRawData 0x3bfa00
PointerToRawData 0x240200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 6.83548

.pdata

MD5 60bec7504ad2720dad44a58018cfc3dd 🔍
SHA1 f9495bb4f3d2dc17c9decafdce88e0aeade371c5 🔍
SHA256 e69217bf0a5be13cab6876d183dd50fe438f91edc7db481f0be3143849d60b29 🔍
SHA3 d57ca6c5d161761b028cb41592478731785025176001ffadd8849beb01e0775b 🔍
VirtualSize 0xf780
VirtualAddress 0x605000
SizeOfRawData 0xf800
PointerToRawData 0x5ffc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.1979

.rsrc

MD5 fe693ae6b789e570c7495829205482c9 🔍
SHA1 d51c0cae9f5daad8f651a0db8b30cfefac332286 🔍
SHA256 d0998f8c790d68b72438354b89d88fed66827367cf78920b13e002a2aa9251b5 🔍
SHA3 bbe772259d4cc5458b2bffa675f847c9a85daea0a12c61cc18bab2a1b015a1f0 🔍
VirtualSize 0x1e8
VirtualAddress 0x615000
SizeOfRawData 0x200
PointerToRawData 0x60f400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.75696

.reloc

MD5 e00e4f3d26c9530b2d3607f0a8d1ef27 🔍
SHA1 1bff273e85c258ffe157c91877e1a30ce0054f6f 🔍
SHA256 708ef5a2435557d258c053d84f1f857ea84f68cb3664121280e8facf107f909c 🔍
SHA3 9925c7ce1b57d2223640ccc6a5c4e4af68e7ffc1f9f004e66603d0fc22d1f4bc 🔍
VirtualSize 0x1420
VirtualAddress 0x616000
SizeOfRawData 0x1600
PointerToRawData 0x60f600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.29504

Imports

d3d11.dll D3D11CreateDeviceAndSwapChain
KERNEL32.dll GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
GetLocaleInfoA
LoadLibraryA
QueryPerformanceFrequency
QueryPerformanceCounter
Sleep
TerminateProcess
SetErrorMode
GetTickCount
SetUnhandledExceptionFilter
GetSystemInfo
GetProcessId
MultiByteToWideChar
QueryFullProcessImageNameW
GetSystemTimeAsFileTime
GetProcessTimes
Module32Next
GetModuleHandleW
ReadProcessMemory
GetCurrentThreadId
SleepConditionVariableSRW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
HeapFree
HeapAlloc
GetFileSizeEx
CreateFileA
WakeAllConditionVariable
GetStartupInfoW
InitializeSListHead
VirtualProtectEx
Module32FirstW
GetLastError
GetVolumeInformationW
Module32NextW
FreeLibrary
WriteProcessMemory
Process32First
VirtualFreeEx
VirtualAllocEx
WideCharToMultiByte
FlushInstructionCache
GetTickCount64
CreateProcessW
GetCurrentProcessId
ExitProcess
GetProcAddress
GetWindowsDirectoryW
CloseHandle
DeleteFileW
SetFileAttributesW
GetModuleHandleA
CreateFileW
FindClose
GetTempPathW
GetModuleFileNameW
LoadLibraryW
Process32FirstW
Process32Next
Process32NextW
K32GetModuleFileNameExA
GetExitCodeThread
CreateToolhelp32Snapshot
OpenProcess
Module32First
WaitForSingleObject
DeviceIoControl
WriteFile
GetCurrentProcess
FindNextFileW
FindFirstFileW
ReadFile
USER32.dll GetForegroundWindow
SetLayeredWindowAttributes
SetFocus
CreateWindowExA
GetKeyNameTextA
MapVirtualKeyA
MessageBoxA
GetWindowThreadProcessId
GetSystemMetrics
TranslateMessage
LoadIconA
GetKeyState
GetMessageExtraInfo
LoadCursorA
ScreenToClient
GetCapture
TrackMouseEvent
GetKeyboardLayout
SetCapture
DefWindowProcA
RegisterClassA
EnumDisplaySettingsA
GetMonitorInfoA
GetWindowLongA
ClientToScreen
SetWindowLongA
ShowWindow
RegisterClassExW
UnregisterClassW
CreateWindowExW
EnumDisplayMonitors
SetActiveWindow
MonitorFromWindow
SetWindowPos
GetDC
DestroyWindow
GetWindowRect
DispatchMessageA
SetClipboardData
SetCursor
IsWindowUnicode
ReleaseCapture
GetCursorPos
OpenClipboard
CloseClipboard
PeekMessageA
GetClipboardData
EmptyClipboard
PostQuitMessage
FindWindowA
UpdateWindow
SetForegroundWindow
IsIconic
GetClientRect
SetCursorPos
ReleaseDC
BeginPaint
EndPaint
IsWindow
SetWindowDisplayAffinity
mouse_event
GetAsyncKeyState
GDI32.dll BitBlt
CreateCompatibleBitmap
SelectObject
StretchBlt
DeleteDC
SetStretchBltMode
DeleteObject
CreateCompatibleDC
ADVAPI32.dll OpenProcessToken
OpenEventLogW
RegUnLoadKeyW
RegLoadKeyW
RegOpenKeyExW
RegDeleteValueW
RegEnumValueW
RegQueryValueExW
RegEnumKeyExW
CloseEventLog
RegFlushKey
LookupPrivilegeValueA
RegDeleteKeyW
ClearEventLogW
RegCloseKey
AdjustTokenPrivileges
GetTokenInformation
RegSetValueExW
RegDeleteTreeW
RegCreateKeyExW
SHELL32.dll ShellExecuteW
SHGetFolderPathW
ole32.dll CoUninitialize
CoCreateInstance
CoInitializeEx
MSVCP140.dll ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?good@ios_base@std@@QEBA_NXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
__crtLCMapStringA
__crtLCMapStringW
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_frequency
?_Throw_Cpp_error@std@@YAXH@Z
?_Xbad_alloc@std@@YAXXZ
?_Random_device@std@@YAIXZ
_Mtx_lock
_Query_perf_counter
_Mtx_unlock
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Id_cnt@id@locale@std@@0HA
?id@?$ctype@D@std@@2V0locale@2@A
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??Bios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
_Strxfrm
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Xbad_function_call@std@@YAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Thrd_detach
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
_Wcscoll
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?id@?$ctype@_W@std@@2V0locale@2@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?id@?$collate@_W@std@@2V0locale@2@A
_Wcsxfrm
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Thrd_join
WINHTTP.dll WinHttpOpenRequest
WinHttpSendRequest
WinHttpConnect
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpReadData
WinHttpSetTimeouts
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpOpen
WinHttpReceiveResponse
ntdll.dll ZwReadVirtualMemory
ZwWriteVirtualMemory
WININET.dll InternetCloseHandle
InternetOpenA
InternetOpenUrlA
InternetReadFile
IMM32.dll ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
D3DCOMPILER_47.dll D3DCompile
dwmapi.dll DwmExtendFrameIntoClientArea
VCRUNTIME140_1.dll __CxxFrameHandler4
VCRUNTIME140.dll memcpy
memmove
memset
memchr
memcmp
__current_exception
__current_exception_context
__intrinsic_setjmp
_CxxThrowException
longjmp
__std_exception_destroy
strrchr
__C_specific_handler
__std_exception_copy
strstr
__std_terminate
__RTtypeid
strchr
__std_type_info_compare
api-ms-win-crt-string-l1-1-0.dll strncmp
strcmp
strncpy
isdigit
_stricmp
_wcsicmp
isspace
toupper
towupper
tolower
towlower
strlen
wcslen
api-ms-win-crt-heap-l1-1-0.dll free
_set_new_mode
realloc
_callnewh
malloc
api-ms-win-crt-math-l1-1-0.dll sqrtf
roundf
cosf
acosf
pow
_dsign
_hypotf
expf
fmodf
sqrt
ceilf
__setusermatherr
powf
floorf
sinf
atan2f
api-ms-win-crt-convert-l1-1-0.dll strtoull
strtol
mbstowcs
strtoul
strtod
strtoll
api-ms-win-crt-runtime-l1-1-0.dll _initterm
_initterm_e
_exit
_get_narrow_winmain_command_line
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_beginthreadex
_register_onexit_function
_initialize_narrow_environment
_configure_narrow_argv
terminate
exit
_initialize_onexit_table
_errno
api-ms-win-crt-time-l1-1-0.dll _time64
_mktime64
_localtime64_s
api-ms-win-crt-stdio-l1-1-0.dll _set_fmode
__stdio_common_vsscanf
_wfopen
__stdio_common_vfprintf
fseek
__acrt_iob_func
ftell
_get_stream_buffer_pointers
_fseeki64
fread
__p__commode
ungetc
setvbuf
fgetpos
fwrite
fgetc
fclose
fflush
fputc
__stdio_common_vsprintf
fsetpos
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale
localeconv
___lc_locale_name_func
___lc_collate_cp_func
api-ms-win-crt-utility-l1-1-0.dll rand
qsort
api-ms-win-crt-filesystem-l1-1-0.dll _unlock_file
_lock_file
api-ms-win-crt-environment-l1-1-0.dll _wgetenv

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x188
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.89623
MD5 b8e76ddb52d0eb41e972599ff3ca431b 🔍
SHA1 fc12d7ad112ddabfcd8f82f290d84e637a4d62f8 🔍
SHA256 165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8 🔍
SHA3 37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd 🔍

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Oct-28 01:52:39
Version 0.0
SizeofData 992
AddressOfRawData 0x22152c
PointerToRawData 0x22092c

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2026-Oct-28 01:52:39
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

StartAddressOfRawData 0x140221930
EndAddressOfRawData 0x140221af8
AddressOfIndex 0x1406008d0
AddressOfCallbacks 0x14018d258
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_16BYTES
Callbacks 0x0000000140180410
0x00000001401806F0

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140241040

RICH Header

XOR Key 0x76803f2c
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 24
253 (35721) 1
ASM objects (35721) 4
C objects (35721) 10
C++ objects (35721) 42
Imports (35721) 6
C objects (VS2022 Update 1 (17.1.6) compiler 31107) 26
C objects (33145) 1
Imports (33145) 27
Total imports 549
C++ objects (LTCG) (36260) 58
Resource objects (36260) 1
Linker (36260) 1

Errors

Leave a comment

No comments yet.