Manalyze report for 8178bf87091e32bbce49bdb73c49dd87fd9faf7cee9ee78c23efcf2c919724f3

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Sep-26 12:20:45
Detected languages	English - United States

Plugin Output

Info	Matching compiler(s):	`MASM/TASM - sig1(h)`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`Contains references to system / monitoring tools: procexp.exe procmon.exe wireshark.exe` `Contains references to debugging or reversing tools: immunitydebugger.exe lordpe.exe ollydbg.exe` `Looks for VMWare presence: VMware vmmouse` `Looks for Sandboxie presence: sbiedll.dll` `Looks for VirtualBox presence: SOFTWARE\Oracle\VirtualBox Guest Additions VBoxGuest` `Contains domain names: fontello.com http://fontello.com http://scripts.sil.org http://scripts.sil.org/OFL https://aka.ms https://discord.gg https://rsms.me https://t.me https://vexor.wtf scripts.sil.org`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32` `Microsoft's Cryptography API`
Suspicious	The PE contains functions most legitimate programs don't use.	`[!] The program may be hiding some of its imports: LoadLibraryA GetProcAddress LoadLibraryW` `Functions which can be used for anti-debugging purposes: CreateToolhelp32Snapshot CheckRemoteDebuggerPresent` `Can access the registry: RegQueryValueExW RegCloseKey RegOpenKeyExW` `Possibly launches other programs: ShellExecuteA CreateProcessW` `Uses Microsoft's cryptographic API: CryptAcquireContextW CryptReleaseContext CryptGenRandom CryptCreateHash CryptGetHashParam CryptDestroyHash CryptHashData CryptProtectData CryptUnprotectData` `Can create temporary files: GetTempPathW CreateFileW CreateFileA` `Has Internet access capabilities: WinHttpSendRequest WinHttpQueryHeaders WinHttpConnect WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpReceiveResponse WinHttpAddRequestHeaders WinHttpOpen` `Enumerates local disk drives: GetVolumeInformationW` `Manipulates other processes: OpenProcess Process32NextW Process32FirstW` `Reads the contents of the clipboard: GetClipboardData`
Malicious	VirusTotal score: 42/71 (Scanned on 2026-10-31 02:43:40)	`ALYac: Application.Generic.37091822` `APEX: Malicious` `AVG: Win64:MalwareX-gen [Misc]` `Antiy-AVL: RiskWare/Win64.Gamehack` `Arcabit: Application.Generic.D235F9EE` `Avast: Win64:MalwareX-gen [Misc]` `Avira: TR/W64.Agent` `BitDefender: Application.Generic.37091822` `Bkav: W32.Malware.10B5EC69` `CAT-QuickHeal: Trojan.Multi` `CTX: exe.unknown.generic` `CrowdStrike: win/malicious_confidence_70% (W)` `Cylance: Unsafe` `Cynet: Malicious (score: 99)` `ESET-NOD32: Win64/GameHack_AGen.ANB potentially unsafe application` `Elastic: malicious (high confidence)` `Emsisoft: Application.Generic.37091822 (B)` `F-Secure: Trojan.TR/W64.Agent` `Fortinet: Adware/GameHack_AGen` `GData: Application.Generic.37091822` `Google: Detected` `Ikarus: Trojan.Win64.Tedy` `K7AntiVirus: Unwanted-Program ( 006d74b71 )` `K7GW: Unwanted-Program ( 006d74b71 )` `Kaspersky: UDS:DangerousObject.Multi.Generic` `Kingsoft: Win32.Troj.Unknown.a` `Lionic: Trojan.Win32.GameHack.4!c` `Malwarebytes: RiskWare.GameHack` `MaxSecure: Trojan.Malware.412922207.susgen` `McAfeeD: Trojan:Win/GenericY.EIK` `MicroWorld-eScan: Application.Generic.37091822` `Microsoft: Trojan:Win32/Kepavll!rfn` `Paloalto: generic.ml` `Rising: Trojan.Kryptik@AI.97 (RDML:yGTJEOyKva1den6D+7ew4A)` `SentinelOne: Static AI - Malicious PE` `Sophos: Mal/Generic-S` `Symantec: ML.Attribute.HighConfidence` `TrellixENS: Artemis!6C37BEE4F46D` `TrendMicro: Trojan.Win32.GAMEHACKAGEN.USBLIS26` `TrendMicro-HouseCall: Trojan.Win32.GAMEHACKAGEN.USBLIS26` `VIPRE: Application.Generic.37091822` `Varist: W64/ABApplication.LDZX-2979`

Hashes

MD5	`6c37bee4f46d3a8c40b4ee66664abdde` 🔍
SHA1	`e434b8a39894d97adca5f2e318c02433e53599c6` 🔍
SHA256	`8178bf87091e32bbce49bdb73c49dd87fd9faf7cee9ee78c23efcf2c919724f3` 🔍
SHA3	`48f18a80ff2b0a43b97893ce2bce5f2f7c34f05bafe989c4eeb03660d608a545` 🔍
SSDeep	`49152:1LiScUkNMeAuSBriDtn8C2FPoWPaD2Q6I3jWASp:1e4BR+AgDo` 🔍
Imports Hash	`1d86bd3d2b096833b3e3f4706882b453` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x120`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`6`
TimeDateStamp	2026-Sep-26 12:20:45
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0xd6800`
SizeOfInitializedData	`0x22a600`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00000000000D3F60 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x305000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_GUARD_CF` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`188a6e49de4a7e36ae7b705c14cc5724 🔍`
SHA1	`96a25909eb4614b91c0dfe5068165242283b9338 🔍`
SHA256	`18cd968c865b018c3e9210040a5a761c794b3fe647d1c7eb6e839a9255784fe1 🔍`
SHA3	`4c02898f0fea514dff946b294b95e3532bf463da7bdfae5992e59fe6c49cd247 🔍`
VirtualSize	`0xd67d7`
VirtualAddress	`0x1000`
SizeOfRawData	`0xd6800`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.51808`

.rdata

MD5	`aff788ed01d9b226447e479cc4eff835 🔍`
SHA1	`d9cf7a9220e08e7f0eff4cdfcbf9a5452f0b4fd8 🔍`
SHA256	`c08fa450965c1899c3e91c259faa94a2bb9a555556c8bebcfe31268c1f4c6b28 🔍`
SHA3	`212ca4fda4e51623ef03c1d51743f9d94362b561885d18aab4d153f386b29a52 🔍`
VirtualSize	`0x3e3ac`
VirtualAddress	`0xd8000`
SizeOfRawData	`0x3e400`
PointerToRawData	`0xd6c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.29861`

.data

MD5	`d0b790fbbf11b99141d8b5d2b5055939 🔍`
SHA1	`31ab4097466937cfbcbae4f7e3ca5b841ea2f757 🔍`
SHA256	`89c0547df897f3e9fb93f8750b0abc1e31187ce8b55486a459b14821ed2be67c 🔍`
SHA3	`28e58eee8981cd6b9f127cea48e1d4359c12901d0764516cfae5d56cf2fcde24 🔍`
VirtualSize	`0x1932f0`
VirtualAddress	`0x117000`
SizeOfRawData	`0x192600`
PointerToRawData	`0x115000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`6.70143`

.pdata

MD5	`61e293117a21d98edb70309e4ff7c7a4 🔍`
SHA1	`ff5bf147f38fb6ef564a4d65d753e1605251091c 🔍`
SHA256	`1722de46cff4acb0a65c3a5d89ac281ffa4ba025b15efb078f8a5e05ab9eb877 🔍`
SHA3	`ecf13af4c1e4a8d495e4c4953836cf95328965bb93526adc0446c9361f105f4f 🔍`
VirtualSize	`0x97c8`
VirtualAddress	`0x2ab000`
SizeOfRawData	`0x9800`
PointerToRawData	`0x2a7600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.10852`

.rsrc

MD5	`4f55b95fa0afa26d2033019043d109e9 🔍`
SHA1	`4b3729a12fdfea4d30f784452c1d2dc8bce7b36a 🔍`
SHA256	`d235ed39215562a627685fa6ea09b68cbe1ad92ad876da3d7d5f8bf157895e54 🔍`
SHA3	`1129b877d67c06e8a7b8a393e58d7b5eabb6b174ada8d6e155932f3c8954aa59 🔍`
VirtualSize	`0x4e7f8`
VirtualAddress	`0x2b5000`
SizeOfRawData	`0x4e800`
PointerToRawData	`0x2b0e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.92387`

.reloc

MD5	`39e944511506c5a13f5c23a0147b610f 🔍`
SHA1	`efa12d07477ef1efade1c4f229070bbbccaab9a5 🔍`
SHA256	`0d14596090c2d6699efff78a282a93a52feb90ab40ba1fbfbbb0cc03ed3cf11d 🔍`
SHA3	`4ab2a5b391b5791464de79a35639d3fda41dfd1f213a5f5fe10e139855dbcb71 🔍`
VirtualSize	`0xd9c`
VirtualAddress	`0x304000`
SizeOfRawData	`0xe00`
PointerToRawData	`0x2ff600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.34161`

Imports

d3d11.dll	`D3D11CreateDeviceAndSwapChain`
D3DCOMPILER_47.dll	`D3DCompile`
d3dx11_43.dll	`D3DX11CreateShaderResourceViewFromMemory`
dwmapi.dll	`DwmExtendFrameIntoClientArea`
WINHTTP.dll	`WinHttpSendRequest` `WinHttpQueryHeaders` `WinHttpConnect` `WinHttpQueryDataAvailable` `WinHttpCloseHandle` `WinHttpSetOption` `WinHttpOpenRequest` `WinHttpReadData` `WinHttpReceiveResponse` `WinHttpAddRequestHeaders` `WinHttpOpen`
SHELL32.dll	`ShellExecuteA` `SHGetFolderPathW`
ole32.dll	`CoUninitialize` `CoInitializeEx` `CoCreateInstance`
KERNEL32.dll	`GetLocaleInfoA` `MultiByteToWideChar` `LoadLibraryA` `QueryPerformanceFrequency` `GetProcAddress` `FreeLibrary` `QueryPerformanceCounter` `GlobalAlloc` `GlobalFree` `GlobalLock` `WideCharToMultiByte` `GlobalUnlock` `SizeofResource` `GetCommandLineW` `GetEnvironmentVariableW` `Sleep` `LockResource` `LoadResource` `FindResourceW` `GetModuleHandleW` `CreateDirectoryW` `ReadFile` `GetVolumeInformationW` `WriteFile` `GetTempPathW` `CreateFileW` `GetLastError` `CloseHandle` `LoadLibraryW` `GetComputerNameW` `HeapFree` `HeapAlloc` `GetProcessHeap` `GetFileAttributesW` `DeleteFileW` `MoveFileExW` `GetFileSizeEx` `LocalFree` `FindFirstFileW` `SetHandleInformation` `FindNextFileW` `GetStdHandle` `OutputDebugStringA` `TerminateProcess` `GetModuleFileNameW` `SetEnvironmentVariableW` `CreatePipe` `PeekNamedPipe` `FindClose` `WaitForSingleObject` `OpenProcess` `CreateToolhelp32Snapshot` `Process32NextW` `Process32FirstW` `GetStartupInfoW` `CreateProcessW` `QueryFullProcessImageNameW` `GetFileType` `GetTickCount` `GetExitCodeProcess` `SetLastError` `GetCurrentProcess` `GetCurrentThread` `K32GetModuleBaseNameA` `GetThreadContext` `K32EnumProcessModules` `IsDebuggerPresent` `CheckRemoteDebuggerPresent` `CreateFileA` `MapViewOfFile` `UnmapViewOfFile` `CreateFileMappingA` `InitOnceComplete` `GetTickCount64` `UnhandledExceptionFilter` `SetUnhandledExceptionFilter` `FlushFileBuffers` `InitOnceBeginInitialize` `ReleaseSRWLockExclusive` `AcquireSRWLockExclusive` `InitializeSListHead` `GetSystemTimeAsFileTime` `SleepConditionVariableSRW` `GetCurrentThreadId` `WakeAllConditionVariable` `RtlCaptureContext` `RtlLookupFunctionEntry` `RtlVirtualUnwind` `IsProcessorFeaturePresent` `GetCurrentProcessId`
USER32.dll	`EnumWindows` `DefWindowProcW` `DestroyWindow` `CreateWindowExW` `GetSystemMetrics` `UnregisterClassW` `RegisterClassExW` `ShowWindow` `DispatchMessageW` `PeekMessageW` `SetLayeredWindowAttributes` `TranslateMessage` `PostQuitMessage` `UpdateWindow` `OpenClipboard` `CloseClipboard` `EmptyClipboard` `GetClipboardData` `SetClipboardData` `GetKeyState` `GetWindowLongW` `IsWindowVisible` `ScreenToClient` `GetCapture` `ClientToScreen` `TrackMouseEvent` `GetKeyboardLayout` `GetForegroundWindow` `LoadCursorW` `SetCapture` `SetCursor` `GetClientRect` `IsWindowUnicode` `ReleaseCapture` `SetCursorPos` `GetCursorPos` `GetWindowTextW` `SendMessageW` `MessageBoxA` `CharLowerBuffA` `MoveWindow` `IsWindow` `GetWindowThreadProcessId` `GetMessageExtraInfo` `GetWindowRect`
ADVAPI32.dll	`CryptAcquireContextW` `CredWriteW` `CryptReleaseContext` `RegQueryValueExW` `CredReadW` `CredFree` `CredDeleteW` `RegCloseKey` `RegOpenKeyExW` `CryptGenRandom` `CryptCreateHash` `CryptGetHashParam` `CryptDestroyHash` `CryptHashData`
MSVCP140.dll	`?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z` `?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A` `?_Id_cnt@id@locale@std@@0HA` `?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ` `??0_Lockit@std@@QEAA@H@Z` `??1_Lockit@std@@QEAA@XZ` `_Query_perf_frequency` `?_Xout_of_range@std@@YAXPEBD@Z` `?_Xbad_alloc@std@@YAXXZ` `_Mtx_unlock` `_Thrd_detach` `_Cnd_do_broadcast_at_thread_exit` `_Mtx_lock` `?_Throw_Cpp_error@std@@YAXH@Z` `?good@ios_base@std@@QEBA_NXZ` `??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ` `_Query_perf_counter` `?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ` `?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z` `?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z` `?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z` `?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ` `?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ` `?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z` `??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z` `?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ` `?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z` `?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z` `?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z` `?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z` `??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ` `?always_noconv@codecvt_base@std@@QEBA_NXZ` `_Thrd_id` `_Thrd_join` `?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z` `?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ` `?uncaught_exceptions@std@@YAHXZ` `?_Xlength_error@std@@YAXPEBD@Z` `?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ` `?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ` `?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z` `??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ` `?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z` `?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z` `??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ` `??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z` `??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ` `??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ` `?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ` `?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ`
IMM32.dll	`ImmSetCompositionWindow` `ImmReleaseContext` `ImmGetContext` `ImmSetCandidateWindow`
DNSAPI.dll	`DnsFree` `DnsQuery_W`
bcrypt.dll	`BCryptGetProperty` `BCryptCreateHash` `BCryptHashData` `BCryptDestroyHash` `BCryptCloseAlgorithmProvider` `BCryptFinishHash` `BCryptOpenAlgorithmProvider`
RPCRT4.dll	`UuidCreate` `RpcStringFreeA` `UuidToStringA`
CRYPT32.dll	`CryptProtectData` `CryptUnprotectData`
VCRUNTIME140_1.dll	`__CxxFrameHandler4`
VCRUNTIME140.dll	`_CxxThrowException` `__intrinsic_setjmp` `__C_specific_handler` `__current_exception_context` `__current_exception` `memcmp` `memchr` `memset` `memmove` `__std_terminate` `memcpy` `longjmp` `strrchr` `wcsstr` `__std_exception_destroy` `__std_exception_copy` `strstr`
api-ms-win-crt-runtime-l1-1-0.dll	`_invoke_watson` `_exit` `exit` `_initterm_e` `_initterm` `abort` `terminate` `_get_narrow_winmain_command_line` `_set_app_type` `_beginthreadex` `_seh_filter_exe` `_cexit` `_crt_atexit` `_register_onexit_function` `_c_exit` `_initialize_onexit_table` `_initialize_narrow_environment` `_configure_narrow_argv` `_register_thread_local_exe_atexit_callback`
api-ms-win-crt-string-l1-1-0.dll	`strncmp` `strcmp` `strncpy` `strncpy_s` `wcscpy_s` `_stricmp` `_strnicmp` `isxdigit` `towlower` `isdigit` `tolower`
api-ms-win-crt-stdio-l1-1-0.dll	`__stdio_common_vsprintf` `__stdio_common_vsscanf` `__stdio_common_vfprintf` `fseek` `fclose` `fflush` `_get_stream_buffer_pointers` `_fseeki64` `__acrt_iob_func` `fsetpos` `ungetc` `setvbuf` `_wfopen` `fgetpos` `fputc` `ftell` `fgetc` `__stdio_common_vsprintf_s` `_set_fmode` `__stdio_common_vswprintf_s` `fread` `fwrite` `__p__commode`
api-ms-win-crt-utility-l1-1-0.dll	`qsort`
api-ms-win-crt-heap-l1-1-0.dll	`malloc` `free` `_set_new_mode` `_callnewh`
api-ms-win-crt-convert-l1-1-0.dll	`strtol` `strtoull`
api-ms-win-crt-filesystem-l1-1-0.dll	`_unlock_file` `_lock_file`
api-ms-win-crt-time-l1-1-0.dll	`_time64` `_localtime64_s`
api-ms-win-crt-math-l1-1-0.dll	`sinf` `fmodf` `cosf` `ceilf` `__setusermatherr` `powf` `acosf` `sqrtf`
api-ms-win-crt-locale-l1-1-0.dll	`_configthreadlocale`

Delayed Imports

101

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0xc93e`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.8922`
Detected Filetype	PNG graphic file
MD5	`19d1e6a3ac2fa89ddd5ac1249ec6c984 🔍`
SHA1	`eb2a16c26945d12c0916696549291308010fd772 🔍`
SHA256	`23bc397a722b455ee80071bbdb53af746519acdbdfbdd267f7047cfd11b87a65 🔍`
SHA3	`92107346b49074d7e43083287c9cc2376a036687bd9a8651adbcca5a741c5653 🔍`

102

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x6c22`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.886`
Detected Filetype	PNG graphic file
MD5	`5951c1c43ffb3784b05d5607868988c6 🔍`
SHA1	`45d416f96b333bef9bd15bb737908a00c40aac7b 🔍`
SHA256	`ea5b857cc07357a8441c90f45a9c6b7d2b4acf7729c6cb24c663397edcf8f2f6 🔍`
SHA3	`d7e95bbb6f317dfc3db7825c57afd6c8e2408e9dc8f6d630f9f18123a113f88c 🔍`

103

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x6c22`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.886`
Detected Filetype	PNG graphic file
MD5	`5951c1c43ffb3784b05d5607868988c6 🔍`
SHA1	`45d416f96b333bef9bd15bb737908a00c40aac7b 🔍`
SHA256	`ea5b857cc07357a8441c90f45a9c6b7d2b4acf7729c6cb24c663397edcf8f2f6 🔍`
SHA3	`d7e95bbb6f317dfc3db7825c57afd6c8e2408e9dc8f6d630f9f18123a113f88c 🔍`

104

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x2d758`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.88289`
Detected Filetype	PNG graphic file
MD5	`d9459b1b0748c4b3611a8ba9b1599758 🔍`
SHA1	`1344f8d4403e98ffbdcf4d35f520e542e7cc2af2 🔍`
SHA256	`a112426c2a29cbd852add29baecccda232d99420c06bc19c2b85753c1f7b44bc 🔍`
SHA3	`7269524b9484bb0182d9bfcff64ddd849e9addbbb5c8a850f1d07889c43a1af1 🔍`

105

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x6c22`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.886`
Detected Filetype	PNG graphic file
MD5	`5951c1c43ffb3784b05d5607868988c6 🔍`
SHA1	`45d416f96b333bef9bd15bb737908a00c40aac7b 🔍`
SHA256	`ea5b857cc07357a8441c90f45a9c6b7d2b4acf7729c6cb24c663397edcf8f2f6 🔍`
SHA3	`d7e95bbb6f317dfc3db7825c57afd6c8e2408e9dc8f6d630f9f18123a113f88c 🔍`

1

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x188`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.89623`
MD5	`b8e76ddb52d0eb41e972599ff3ca431b 🔍`
SHA1	`fc12d7ad112ddabfcd8f82f290d84e637a4d62f8 🔍`
SHA256	`165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8 🔍`
SHA3	`37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd 🔍`

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2026-Sep-26 12:20:45
Version	`0.0`
SizeofData	`944`
AddressOfRawData	`0x10344c`
PointerToRawData	`0x10204c`

IMAGE_DEBUG_TYPE_ILTCG

Characteristics	`0`
TimeDateStamp	2026-Sep-26 12:20:45
Version	`0.0`
SizeofData	`0`
AddressOfRawData	`0`
PointerToRawData	`0`

TLS Callbacks

StartAddressOfRawData	`0x140103820`
EndAddressOfRawData	`0x140103938`
AddressOfIndex	`0x1402a9b70`
AddressOfCallbacks	`0x1400d8c58`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_8BYTES`
Callbacks	`(EMPTY)`

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x140117040`
GuardCFCheckFunctionPointer	`5369596704`
GuardCFDispatchFunctionPointer	`0`
GuardCFFunctionTable	`0`
GuardCFFunctionCount	`0`
GuardFlags	`(EMPTY)`
CodeIntegrity.Flags	`0`
CodeIntegrity.Catalog	`0`
CodeIntegrity.CatalogOffset	`0`
CodeIntegrity.Reserved	`0`
GuardAddressTakenIatEntryTable	`0`
GuardAddressTakenIatEntryCount	`0`
GuardLongJumpTargetTable	`0`
GuardLongJumpTargetCount	`0`

RICH Header

XOR Key	`0xf235c102`
Unmarked objects	`0`
Imports (VS2008 SP1 build 30729)	`22`
253 (35207)	`1`
C objects (35207)	`10`
C++ objects (35207)	`33`
ASM objects (35207)	`6`
Imports (35207)	`6`
C objects (VS2022 Update 1 (17.1.6) compiler 31107)	`26`
C++ objects (33145)	`1`
Imports (21202)	`2`
Imports (33145)	`31`
Total imports	`379`
C++ objects (LTCG) (35229)	`25`
Resource objects (35229)	`1`
151	`1`
Linker (35229)	`1`

Errors

Leave a comment

No comments yet.