Manalyze report for 7e06e120739fd86803f9fab4ad84bf1bf61e91bb2d134fd9754959fb07663bc3

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Aug-26 13:31:05
Detected languages	English - United States
TLS Callbacks	2 callback(s) detected.

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`Tries to detect virtualized environments: HARDWARE\DESCRIPTION\System` `Looks for VMWare presence: VMWARE VMware Vmware vmmemctl vmmouse vmware` `Looks for Sandboxie presence: sbiedll.dll` `Looks for VirtualBox presence: VBoxGuest VBoxMouse VBoxSF VBoxTray` `Looks for Qemu presence: QEMU qemu` `Contains another PE executable: This program cannot be run in DOS mode.` `Miscellaneous malware strings: CWSandbox` `Contains domain names: http://schemas.microsoft.com http://schemas.microsoft.com/SMI/2016/WindowsSettings https://doxbin.cyXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXA microsoft.com schemas.microsoft.com`
Info	Libraries used to perform cryptographic operations:	`Microsoft's Cryptography API`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryExW LoadLibraryW LoadLibraryA` `Functions which can be used for anti-debugging purposes: CreateToolhelp32Snapshot` `Can access the registry: RegGetValueW RegOpenKeyExW RegEnumKeyExW RegQueryValueExA RegCreateKeyExW RegSetValueExW RegQueryValueExW RegCloseKey` `Possibly launches other programs: CreateProcessA CreateProcessW` `Uses Microsoft's cryptographic API: CryptBinaryToStringA CryptUnprotectData CryptStringToBinaryA CryptGetHashParam CryptAcquireContextA CryptAcquireContextW CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptReleaseContext` `Can create temporary files: GetTempPathW CreateFileW GetTempPathA CreateFileA` `Has Internet access capabilities: WinHttpSetOption WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpCrackUrl WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpWebSocketCompleteUpgrade WinHttpWebSocketClose WinHttpWebSocketReceive WinHttpWebSocketSend WinHttpQueryDataAvailable WinHttpOpen` `Functions related to the privilege level: OpenProcessToken AdjustTokenPrivileges` `Enumerates local disk drives: GetLogicalDriveStringsW GetDriveTypeW GetVolumeInformationW GetDriveTypeA` `Manipulates other processes: Process32NextW Process32FirstW` `Can take screenshots: GetDC BitBlt CreateCompatibleDC` `Reads the contents of the clipboard: GetClipboardData`
Suspicious	The file contains overlay data.	`13163672 bytes of data starting at offset 0x325c00.` `Overlay data amounts for 79.9542% of the executable.`
Malicious	VirusTotal score: 26/58 (Scanned on 2026-08-31 15:44:28)	`ALYac: Gen:Variant.Midie.187621` `APEX: Malicious` `AhnLab-V3: Malware/Win.MalwareX-gen.R791730` `Antiy-AVL: Trojan[PSW]/Win64.Coins` `Arcabit: Trojan.Mikey.D2F608` `Avira: TR/W64.MalwareX` `BitDefender: Gen:Variant.Mikey.194056` `CTX: exe.unknown.mikey` `CrowdStrike: win/malicious_confidence_90% (D)` `Cylance: Unsafe` `Cynet: Malicious (score: 100)` `ESET-NOD32: Win64/Spy.Agent.AZL trojan` `Elastic: malicious (high confidence)` `Emsisoft: Gen:Variant.Mikey.194056 (B)` `F-Secure: Trojan.TR/W64.MalwareX` `Fortinet: W64/Kryptik.HUAI!tr` `GData: Gen:Variant.Mikey.194056` `Gridinsoft: Trojan.Win64.Agent.oa!s1` `K7AntiVirus: Password-Stealer ( 006e59d11 )` `K7GW: Password-Stealer ( 006e59d11 )` `McAfeeD: ti!7E06E120739F` `MicroWorld-eScan: Gen:Variant.Mikey.194056` `Rising: Trojan.Agent!8.B1E (CLOUD)` `SentinelOne: Static AI - Suspicious PE` `Tencent: Malware.Win32.Gencirc.10c4b227` `VIPRE: Gen:Variant.Mikey.194056`

Hashes

MD5	`4f3bfc0ab3a802d00289678dc3ee01b1` 🔍
SHA1	`70a80432f146db841121fdb170c2de6de456b007` 🔍
SHA256	`7e06e120739fd86803f9fab4ad84bf1bf61e91bb2d134fd9754959fb07663bc3` 🔍
SHA3	`f09ff62ff9c39de6ff9195ba5aab0779b0efcf20e45ef1330150fba34eaf6cad` 🔍
SSDeep	`196608:fxY3xYUMNTPY7QEbGXqEICteEroXGzlxZV3Gu5D4S26/CS32uTdq/:K3xYtYkEhEInEroXC14S26Wuxq/` 🔍
Imports Hash	`4c0115dd8e02b0ab89a1574a0348cde5` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x118`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`7`
TimeDateStamp	2026-Aug-26 13:31:05
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x246a00`
SizeOfInitializedData	`0xf2a00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00000000001EBDF8 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x33e000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`0e5d64d1f81586c3ee440892357f097c 🔍`
SHA1	`ffcfcafec044fadff0bbd463603617a96dff4fb0 🔍`
SHA256	`aadbd599145b3e411e49f86e2ddfce496af80972fbefaa68c19eb88bf9bfe7d1 🔍`
SHA3	`9351bbdcf04c77bcdc9885c4647d832278ad6ff292496919248b0d290ecd4288 🔍`
VirtualSize	`0x2469ec`
VirtualAddress	`0x1000`
SizeOfRawData	`0x246a00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.51401`

.rdata

MD5	`7f358bd65bc29fa05babf2a3ddc0742e 🔍`
SHA1	`b4e4db54f210079c499e64af4c7a97184bf49df4 🔍`
SHA256	`66d4c1a63be4019a44230d8a862476604873b4c3414252a005b2a94793a16cae 🔍`
SHA3	`837954f85ff83e82cf021afe38874510441477070faa1913dedd5d7ecf927585 🔍`
VirtualSize	`0xc2984`
VirtualAddress	`0x248000`
SizeOfRawData	`0xc2a00`
PointerToRawData	`0x246e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.63669`

.data

MD5	`a9b5dbd5bd3560c74e2373af0f0737dc 🔍`
SHA1	`87447e3554041a70a7cf1f3c845dfd0ce6b62cd0 🔍`
SHA256	`1ed4db77def967a669f781d698cf6f4c267c9553859f916f7f182da1087d33ec 🔍`
SHA3	`fcd90d73b6cf6301324e7646177181aa3cec56eaa7865463e487a407c21fc266 🔍`
VirtualSize	`0x1b078`
VirtualAddress	`0x30b000`
SizeOfRawData	`0x7600`
PointerToRawData	`0x309800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`3.02405`

.pdata

MD5	`d31cec4b6b4e1b3be9f256b2965e72da 🔍`
SHA1	`9c8329edd5bda0144393357e1d53f5fac5713a04 🔍`
SHA256	`855d9033dc9227d511039dfdba665e65d2961f03f740ffe200c425d446f51055 🔍`
SHA3	`78d36ae25ed97306b52cfd2222c0dd2b790606ee164a00c9fb49b33f52d337c0 🔍`
VirtualSize	`0x12c9c`
VirtualAddress	`0x327000`
SizeOfRawData	`0x12e00`
PointerToRawData	`0x310e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.32414`

.fptable

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x100`
VirtualAddress	`0x33a000`
SizeOfRawData	`0x200`
PointerToRawData	`0x323c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`cbdf4693b8e20778ae1cc5801c8153d9 🔍`
SHA1	`dc71e9ab3e305c1a0aa7d6b6bb1b85450ddf4454 🔍`
SHA256	`4fd3c7b01272eb5adfc675acebb6d2b450d147403affacba78bd7a3c1aa526d2 🔍`
SHA3	`5581842f1719c5e3c6528ee209f91091804b4ef0f55e610719dd8f3f0315dcc3 🔍`
VirtualSize	`0x1e0`
VirtualAddress	`0x33b000`
SizeOfRawData	`0x200`
PointerToRawData	`0x323e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.71377`

.reloc

MD5	`5564d0e211eacdbb83410e0bdf141eb3 🔍`
SHA1	`8ac141677f9ac0f661e5d00641237ab005d683dc 🔍`
SHA256	`45b6fdd97eb7994063c337ab58a14a85c006957e6736e9618aef45d02d65700e 🔍`
SHA3	`bda2550f34c33e97b7267a80f2f802ff6855b23dfe929a2b72bf0de34a8c3a32 🔍`
VirtualSize	`0x1b00`
VirtualAddress	`0x33c000`
SizeOfRawData	`0x1c00`
PointerToRawData	`0x324000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.38941`

Imports

WINHTTP.dll	`WinHttpSetOption` `WinHttpOpenRequest` `WinHttpCloseHandle` `WinHttpSendRequest` `WinHttpSetTimeouts` `WinHttpConnect` `WinHttpCrackUrl` `WinHttpReadData` `WinHttpQueryHeaders` `WinHttpAddRequestHeaders` `WinHttpReceiveResponse` `WinHttpWebSocketCompleteUpgrade` `WinHttpWebSocketClose` `WinHttpWebSocketReceive` `WinHttpWebSocketSend` `WinHttpQueryDataAvailable` `WinHttpOpen`
CRYPT32.dll	`CryptBinaryToStringA` `CryptUnprotectData` `CryptStringToBinaryA`
bcrypt.dll	`BCryptDestroyHash` `BCryptSetProperty` `BCryptCloseAlgorithmProvider` `BCryptHashData` `BCryptDestroyKey` `BCryptGenerateSymmetricKey` `BCryptDecrypt` `BCryptCreateHash` `BCryptEncrypt` `BCryptOpenAlgorithmProvider` `BCryptFinishHash`
SHELL32.dll	`ShellExecuteExW` `ExtractIconExW`
SHLWAPI.dll	`PathFindFileNameW`
ole32.dll	`CreateStreamOnHGlobal` `CoInitializeEx` `CoTaskMemFree`
ntdll.dll	`RtlPcToFileHeader` `RtlUnwind` `RtlUnwindEx` `RtlInitUnicodeString`
gdiplus.dll	`GdipGetImageGraphicsContext` `GdipDeleteGraphics` `GdipCreateBitmapFromScan0` `GdiplusStartup` `GdiplusShutdown` `GdipGetImageEncoders` `GdipSetInterpolationMode` `GdipAlloc` `GdipCreateBitmapFromHBITMAP` `GdipDisposeImage` `GdipFree` `GdipGetImageEncodersSize` `GdipSaveImageToStream` `GdipDrawImageRectI` `GdipCloneImage` `GdipSetCompositingQuality` `GdipSetPixelOffsetMode`
KERNEL32.dll	`EnumSystemLocalesW` `GetUserDefaultLCID` `IsValidLocale` `GetLocaleInfoW` `LCMapStringW` `CompareStringW` `VirtualProtect` `FlsFree` `FlsSetValue` `FlsGetValue` `FlsAlloc` `GetFileType` `GetStdHandle` `GetModuleHandleExW` `FreeLibraryAndExitThread` `TlsFree` `TlsSetValue` `TlsGetValue` `TlsAlloc` `GetModuleFileNameA` `GetLastError` `GetProcAddress` `ExitProcess` `GetModuleHandleW` `SetThreadAffinityMask` `GetSystemFirmwareTable` `GetPhysicallyInstalledSystemMemory` `LocalAlloc` `GetModuleHandleA` `CreateToolhelp32Snapshot` `Process32NextW` `QueryPerformanceFrequency` `Process32FirstW` `CloseHandle` `GetNativeSystemInfo` `LocalFree` `WideCharToMultiByte` `SleepEx` `BuildCommDCBAndTimeoutsA` `EnumSystemFirmwareTables` `QueryPerformanceCounter` `VirtualQuery` `GetComputerNameA` `SizeofResource` `WriteFile` `GetModuleFileNameW` `EnumResourceNamesW` `GetTempPathW` `WaitForSingleObject` `CreateFileW` `SetFileAttributesW` `GetLogicalDriveStringsW` `EndUpdateResourceW` `LockResource` `DeleteFileW` `EnumResourceLanguagesW` `FindResourceExW` `LoadResource` `UpdateResourceW` `FreeLibrary` `BeginUpdateResourceW` `QueryFullProcessImageNameW` `GetTempFileNameW` `GetDriveTypeW` `LoadLibraryExW` `GetVolumeInformationW` `GetComputerNameW` `GlobalMemoryStatusEx` `GlobalAlloc` `GlobalFree` `GetConsoleOutputCP` `GlobalUnlock` `FindFirstFileW` `FindNextFileW` `FindClose` `GetFileAttributesExW` `GetCurrentThreadId` `GetSystemTime` `ExitThread` `GetTickCount64` `ResetEvent` `CreateEventA` `SetUnhandledExceptionFilter` `GetTimeZoneInformation` `GetSystemInfo` `GetLocalTime` `CreateDirectoryW` `ReadFile` `OpenEventA` `QueryDosDeviceW` `GetFileSizeEx` `GetLongPathNameW` `GetCurrentProcess` `RemoveDirectoryW` `GetEnvironmentVariableW` `CreateMutexA` `GetFileAttributesW` `UnmapViewOfFile` `MultiByteToWideChar` `SetEvent` `TerminateThread` `CreateThread` `MoveFileExW` `GetCurrentProcessId` `CreateFileMappingW` `MapViewOfFile` `LoadLibraryW` `SetDllDirectoryW` `GetLogicalDrives` `GetDriveTypeA` `CreatePipe` `SetErrorMode` `FileTimeToSystemTime` `SetFilePointerEx` `CreateProcessA` `GetDiskFreeSpaceExA` `GetTickCount` `AreFileApisANSI` `TryEnterCriticalSection` `HeapCreate` `HeapFree` `EnterCriticalSection` `GetFullPathNameW` `GetDiskFreeSpaceW` `OutputDebugStringA` `LockFile` `LeaveCriticalSection` `InitializeCriticalSection` `SetFilePointer` `GetFullPathNameA` `SetEndOfFile` `UnlockFileEx` `CreateMutexW` `GetVersionExW` `HeapValidate` `HeapSize` `Sleep` `GetTempPathA` `FormatMessageW` `GetDiskFreeSpaceA` `GetFileAttributesA` `OutputDebugStringW` `FlushViewOfFile` `CreateFileA` `LoadLibraryA` `WaitForSingleObjectEx` `GetVersionExA` `DeleteFileA` `HeapReAlloc` `RaiseException` `HeapAlloc` `HeapCompact` `HeapDestroy` `UnlockFile` `CreateFileMappingA` `LockFileEx` `GetFileSize` `DeleteCriticalSection` `GetProcessHeap` `SystemTimeToFileTime` `GetSystemTimeAsFileTime` `FormatMessageA` `FlushFileBuffers` `CreateProcessW` `GetConsoleMode` `PeekNamedPipe` `ConnectNamedPipe` `ReadConsoleW` `IsValidCodePage` `GetACP` `GetOEMCP` `GetCommandLineA` `GetCommandLineW` `GetEnvironmentStringsW` `FreeEnvironmentStringsW` `SetEnvironmentVariableW` `SetStdHandle` `WriteConsoleW` `InitializeCriticalSectionAndSpinCount` `SetLastError` `GlobalLock` `CreateNamedPipeW`
USER32.dll	`GetDC` `DestroyIcon` `GetIconInfo` `EnumDisplayDevicesW` `EnumDisplayMonitors` `QueryDisplayConfig` `SetClipboardData` `GetClipboardData` `ReleaseDC` `EmptyClipboard` `CloseClipboard` `OpenClipboard` `SendInput` `GetMonitorInfoW` `GetSystemMetrics`
GDI32.dll	`CreateCompatibleBitmap` `SelectObject` `BitBlt` `DeleteDC` `CreateCompatibleDC` `GetDeviceCaps` `DeleteObject` `GetDIBits` `GetObjectW`
ADVAPI32.dll	`RegGetValueW` `RegOpenKeyExW` `OpenProcessToken` `RegEnumKeyExW` `RegQueryValueExA` `GetTokenInformation` `CryptGetHashParam` `CryptAcquireContextA` `RegCreateKeyExW` `RegSetValueExW` `SetSecurityDescriptorDacl` `InitializeSecurityDescriptor` `GetUserNameW` `RegQueryValueExW` `LookupPrivilegeValueW` `AdjustTokenPrivileges` `RegCloseKey` `CryptAcquireContextW` `CryptDestroyHash` `CryptHashData` `CryptCreateHash` `CryptGenRandom` `CryptReleaseContext`
SETUPAPI.dll	`SetupDiEnumDeviceInfo` `SetupDiGetClassDevsW` `SetupDiDestroyDeviceInfoList` `SetupDiOpenDevRegKey` `SetupDiGetDeviceRegistryPropertyW` `SetupDiGetDeviceRegistryPropertyA` `SetupDiGetDevicePropertyW`
api-ms-win-core-realtime-l1-1-1.dll	`QueryInterruptTime`
IPHLPAPI.DLL	`GetAdaptersInfo`
api-ms-win-core-synch-l1-1-0.dll	`TryAcquireSRWLockExclusive` `AcquireSRWLockExclusive` `InitializeCriticalSectionEx` `ReleaseSRWLockExclusive`
api-ms-win-core-processthreads-l1-1-0.dll	`TerminateProcess` `GetExitCodeThread` `GetStartupInfoW`
api-ms-win-core-synch-l1-2-0.dll	`InitOnceBeginInitialize` `InitOnceComplete` `WakeAllConditionVariable` `WakeConditionVariable` `SleepConditionVariableSRW`
api-ms-win-core-file-l1-1-0.dll	`FindFirstFileExW` `GetFinalPathNameByHandleW`
api-ms-win-core-file-l2-1-0.dll	`GetFileInformationByHandleEx`
api-ms-win-core-localization-l1-2-0.dll	`GetCPInfo` `LCMapStringEx` `GetLocaleInfoEx`
api-ms-win-core-util-l1-1-0.dll	`DecodePointer` `EncodePointer`
api-ms-win-core-string-l1-1-0.dll	`GetStringTypeW` `CompareStringEx`
api-ms-win-core-processthreads-l1-1-1.dll	`IsProcessorFeaturePresent`
api-ms-win-core-rtlsupport-l1-1-0.dll	`RtlVirtualUnwind` `RtlLookupFunctionEntry` `RtlCaptureContext`
api-ms-win-core-errorhandling-l1-1-0.dll	`UnhandledExceptionFilter`
api-ms-win-core-debug-l1-1-0.dll	`IsDebuggerPresent`
api-ms-win-core-interlocked-l1-1-0.dll	`InitializeSListHead`
wevtapi.dll	`EvtNext` `EvtRender` `EvtClose` `EvtCreateRenderContext` `EvtQuery`
d3d11.dll	`D3D11CreateDevice`
dxgi.dll	`CreateDXGIFactory1`
MF.dll	`MFEnumDeviceSources`
MFPlat.DLL	`MFShutdown` `MFCreateMediaType` `MFCreateAttributes` `MFStartup`
MFReadWrite.dll	`MFCreateSourceReaderFromMediaSource`

Delayed Imports

1

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x17d`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.91161`
MD5	`1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍`
SHA1	`4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍`
SHA256	`4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍`
SHA3	`4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍`

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2026-Aug-26 13:31:05
Version	`0.0`
SizeofData	`1132`
AddressOfRawData	`0x2c65ac`
PointerToRawData	`0x2c53ac`

IMAGE_DEBUG_TYPE_ILTCG

Characteristics	`0`
TimeDateStamp	2026-Aug-26 13:31:05
Version	`0.0`
SizeofData	`0`
AddressOfRawData	`0`
PointerToRawData	`0`

TLS Callbacks

StartAddressOfRawData	`0x1402c6a60`
EndAddressOfRawData	`0x1402dd43b`
AddressOfIndex	`0x140313258`
AddressOfCallbacks	`0x140248d28`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_16BYTES`
Callbacks	`0x00000001401EB74C` `0x00000001401EBA54`

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x14030b140`

RICH Header

XOR Key	`0x44c3e166`
Unmarked objects	`0`
ASM objects (33145)	`8`
C++ objects (33145)	`181`
Imports (VS2008 SP1 build 30729)	`42`
C objects (35207)	`18`
ASM objects (35207)	`12`
C++ objects (35207)	`97`
C objects (33145)	`21`
C++ objects (CVTCIL) (33145)	`1`
Imports (33145)	`39`
Total imports	`379`
C++ objects (LTCG) (35228)	`37`
ASM objects (35228)	`2`
Resource objects (35228)	`1`
Linker (35228)	`1`

Errors

[*] Warning: Yara callback received an unhandled message (6).

Leave a comment

No comments yet.