Manalyze report for 8ea7f1591427a371dcefde01ecdd63a13ca5e88cc6fba879f6402dab931456d1

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2020-Jul-13 02:40:56
Detected languages	English - United States Japanese - Japan

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C++ 6.0 - 8.0`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`Looks for VMWare presence: VMDebug`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32` `Uses known Mersenne Twister constants`
Suspicious	The PE contains functions most legitimate programs don't use.	`[!] The program may be hiding some of its imports: LoadLibraryW LoadLibraryExW LoadLibraryA GetProcAddress` `Functions which can be used for anti-debugging purposes: SwitchToThread` `Can access the registry: RegCloseKey RegOpenKeyExA` `Possibly launches other programs: ShellExecuteA` `Memory manipulation functions often used by packers: VirtualProtect VirtualAlloc` `Has Internet access capabilities: InternetReadFile InternetConnectA InternetAttemptConnect InternetOpenA InternetCloseHandle` `Manipulates other processes: OpenProcess` `Can take screenshots: GetDC BitBlt CreateCompatibleDC` `Reads the contents of the clipboard: GetClipboardData`
Info	The PE's resources present abnormal characteristics.	`Resource 131 is possibly compressed or encrypted.` `Resource 132 is possibly compressed or encrypted.`
Suspicious	VirusTotal score: 1/69 (Scanned on 2026-08-19 04:22:58)	`CrowdStrike: win/grayware_confidence_60% (D)`

Hashes

MD5	`50fc77e6bdaf79b91fa4bf29a8e605c0` 🔍
SHA1	`0453e710d9ce7bebb62f2612be6ab0d63029fd37` 🔍
SHA256	`8ea7f1591427a371dcefde01ecdd63a13ca5e88cc6fba879f6402dab931456d1` 🔍
SHA3	`65ca2407be7cd14a799d3b34943bff261006351bb9725df33c59dda24626fb98` 🔍
SSDeep	`98304:GMoyu/d4TZHD7gH0WzBvM10M/RH3a+bWsDpZZZdZt8FD:M/d49HXgjvM1Pxa+vlZZZdZt8Z` 🔍
Imports Hash	`e7723a9b7fca5f7ba1da8ab141cee2b3` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x120`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`7`
TimeDateStamp	2020-Jul-13 02:40:56
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE` `IMAGE_FILE_RELOCS_STRIPPED`

Image Optional Header

Magic	`PE32`
LinkerVersion	`14.0`
SizeOfCode	`0x3bb600`
SizeOfInitializedData	`0x133000`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0034BDB9 (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0x3bd000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x4f4000`
SizeOfHeaders	`0x400`
Checksum	`0x4e6986`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`f7293f73c4226c92539074dc2c27ceff 🔍`
SHA1	`527343ed078a56cdacdbfea01b3af5bf7b026a3a 🔍`
SHA256	`8d0619bbf07b4e40e56298bb766d008a2496e18cb8af4429734231b7f26d4015 🔍`
SHA3	`c62e2189f5939121599d6b41c11fde7c8971d8191bb8aa0e7473eeab99ee2ae5 🔍`
VirtualSize	`0x3bb440`
VirtualAddress	`0x1000`
SizeOfRawData	`0x3bb600`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.58021`

.rdata

MD5	`9201681f4b7d9fbf3cec06ec03a72561 🔍`
SHA1	`8ab84466df7eef41c0263da37a64e0d3d4a309a4 🔍`
SHA256	`7e396670e7b811ecc6831b33c7af218d1312a17f2053686c37b9609b1005cd43 🔍`
SHA3	`0c78cbbf8e6b5f372d4111a06350634b7120d8136b044c2cfd4a6205c89ef8c2 🔍`
VirtualSize	`0xa57b2`
VirtualAddress	`0x3bd000`
SizeOfRawData	`0xa5800`
PointerToRawData	`0x3bba00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.50792`

.data

MD5	`e526d2f2199fe51410b39d7644de311e 🔍`
SHA1	`4d739f5d92e503a35a8895bc93f2a7d3f60d5820 🔍`
SHA256	`4632c962c621461f73c48f3cf0ad2698c5fe20e4ac775791a9c131361ab0536e 🔍`
SHA3	`a61914545e23c7186769b1f5514fb86d225fb1bbb2a2e6acf029b3ae3aa7591d 🔍`
VirtualSize	`0x25400`
VirtualAddress	`0x463000`
SizeOfRawData	`0x1b800`
PointerToRawData	`0x461200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`5.32321`

.gfids

MD5	`e5a7c46eaf776967716cc681b16a1812 🔍`
SHA1	`e8538828c1829b600e10e2db7a4059ad97e5b6fa 🔍`
SHA256	`1fb1898547733acd1bc33cc998cab579c702d8d47b82aa65b07c62db17221200 🔍`
SHA3	`ccb3b6eb570965bb1d1afd17567c95c2b384d54f39998d9ddc0488800c714afe 🔍`
VirtualSize	`0x1100`
VirtualAddress	`0x489000`
SizeOfRawData	`0x1200`
PointerToRawData	`0x47ca00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.94699`

.tls

MD5	`1f354d76203061bfdd5a53dae48d5435 🔍`
SHA1	`aa0d33a0c854e073439067876e932688b65cb6a9 🔍`
SHA256	`4c6474903705cb450bb6434c29e8854f17d8324efca1fdb9ee9008599060883a 🔍`
SHA3	`991fbbd46bbd69198269fe6c247d440e0f8a7d38259b7a1e04b74790301d1d2b 🔍`
VirtualSize	`0x9`
VirtualAddress	`0x48b000`
SizeOfRawData	`0x200`
PointerToRawData	`0x47dc00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.0203931`

_RDATA

MD5	`3572694b6b2205862bde5f60eae95671 🔍`
SHA1	`94d70ba712c73a8ca5f2165da0350c093b724415 🔍`
SHA256	`b33f667b64daad2a75be8091ffd7a97d59215b0206f516b8ba6261931dc92db1 🔍`
SHA3	`b6a5bf852d0cc32721d3b7caf1bf5d9473bd27fb2b0698748ffad8813747c796 🔍`
VirtualSize	`0x5e0`
VirtualAddress	`0x48c000`
SizeOfRawData	`0x600`
PointerToRawData	`0x47de00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.68054`

.rsrc

MD5	`d1cd9ed823161f629f7726ee59c6246c 🔍`
SHA1	`79e016c2c22628ada6fe5e45aaa917928fefa7d1 🔍`
SHA256	`85bad72033de43ef1a5b25b697f0aad840da30ccfa22c15d11e608a10b9d7638 🔍`
SHA3	`7c13956ad4c809dad56df278b484f49874274a00b7649f47e3e9ae0716c4a85e 🔍`
VirtualSize	`0x66913`
VirtualAddress	`0x48d000`
SizeOfRawData	`0x66a00`
PointerToRawData	`0x47e400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.89113`

Imports

KERNEL32.dll	`FindClose` `GetFileAttributesA` `CopyFileA` `FileTimeToSystemTime` `DeleteFileA` `FileTimeToLocalFileTime` `RemoveDirectoryA` `CreateDirectoryA` `GetFileTime` `ExitProcess` `GlobalAlloc` `GlobalFree` `GlobalLock` `GlobalUnlock` `CreateMutexA` `GetLastError` `UnmapViewOfFile` `CreateFileMappingA` `OpenFileMappingA` `MapViewOfFile` `QueryPerformanceFrequency` `QueryPerformanceCounter` `GetCurrentDirectoryA` `SizeofResource` `FindResourceA` `LockResource` `LoadResource` `VerifyVersionInfoA` `GetLocaleInfoA` `GetNativeSystemInfo` `VerSetConditionMask` `GlobalMemoryStatusEx` `SetCurrentDirectoryA` `WriteConsoleW` `SetEnvironmentVariableA` `FreeEnvironmentStringsW` `GetEnvironmentStringsW` `GetCommandLineW` `GetCommandLineA` `GetOEMCP` `IsValidCodePage` `FindFirstFileExA` `SetStdHandle` `FlushFileBuffers` `GetTimeZoneInformation` `EnumSystemLocalesW` `GetUserDefaultLCID` `IsValidLocale` `GetTimeFormatW` `GetDateFormatW` `GetConsoleCP` `ReadConsoleW` `GetConsoleMode` `GetACP` `GetStdHandle` `GetFileType` `CreateFileW` `SetFilePointerEx` `GetModuleHandleExW` `ExitThread` `RtlUnwind` `LoadLibraryW` `FindNextFileA` `QueryDepthSList` `InterlockedFlushSList` `InterlockedPushEntrySList` `InterlockedPopEntrySList` `ReleaseSemaphore` `VirtualProtect` `VirtualFree` `VirtualAlloc` `GetVersionExW` `LoadLibraryExW` `GetModuleFileNameW` `FreeLibraryAndExitThread` `GetThreadTimes` `UnregisterWait` `RegisterWaitForSingleObject` `SetThreadAffinityMask` `GetProcessAffinityMask` `GetNumaHighestNodeNumber` `DeleteTimerQueueTimer` `ChangeTimerQueueTimer` `CreateTimerQueueTimer` `GetLogicalProcessorInformation` `GetThreadPriority` `SetThreadPriority` `CreateThread` `SwitchToThread` `SignalObjectAndWait` `CreateTimerQueue` `InitializeSListHead` `GetCurrentProcessId` `GetStartupInfoW` `IsDebuggerPresent` `TerminateProcess` `SetUnhandledExceptionFilter` `UnhandledExceptionFilter` `GetLocaleInfoW` `LCMapStringW` `CompareStringW` `GetCurrentThread` `WaitForSingleObjectEx` `DuplicateHandle` `GetModuleHandleW` `GetTickCount` `GetSystemTimeAsFileTime` `TlsFree` `TlsSetValue` `TlsGetValue` `TlsAlloc` `CreateEventW` `InitializeCriticalSectionAndSpinCount` `SetLastError` `GetCPInfo` `TryEnterCriticalSection` `FindFirstFileA` `GetFileSize` `CreateFileA` `SetFilePointer` `WriteFile` `HeapFree` `ReadFile` `GetModuleFileNameA` `GetCurrentThreadId` `FreeLibrary` `LoadLibraryA` `GetProcAddress` `GetModuleHandleA` `GetProcessId` `Sleep` `WaitForMultipleObjects` `GetExitCodeProcess` `OpenProcess` `CreateEventA` `ResetEvent` `CloseHandle` `SetEvent` `WaitForSingleObject` `DeleteCriticalSection` `InitializeCriticalSection` `QueueUserWorkItem` `IsProcessorFeaturePresent` `RaiseException` `DecodePointer` `EncodePointer` `WideCharToMultiByte` `GetStringTypeW` `MultiByteToWideChar` `AcquireSRWLockShared` `AcquireSRWLockExclusive` `ReleaseSRWLockShared` `LeaveCriticalSection` `EnterCriticalSection` `OutputDebugStringA` `K32GetProcessMemoryInfo` `GetCurrentProcess` `GetProcessHeap` `HeapAlloc` `HeapReAlloc` `UnregisterWaitEx` `ReleaseSRWLockExclusive` `HeapSize`
USER32.dll	`GetCursorPos` `ShowCursor` `PtInRect` `GetKeyState` `GetForegroundWindow` `ScreenToClient` `UpdateWindow` `GetParent` `GetWindowThreadProcessId` `GetWindow` `SetActiveWindow` `GetTopWindow` `SendMessageA` `SetForegroundWindow` `DispatchMessageA` `TranslateMessage` `PeekMessageA` `GetClientRect` `LoadCursorA` `RegisterClassA` `CreateWindowExA` `UnregisterClassA` `SetTimer` `KillTimer` `CreatePopupMenu` `SetMenuItemInfoA` `GetMenuItemInfoA` `InsertMenuItemA` `ChangeDisplaySettingsA` `EnumDisplaySettingsA` `GetDesktopWindow` `DialogBoxParamA` `OpenClipboard` `CloseClipboard` `EmptyClipboard` `GetClipboardData` `SetClipboardData` `TranslateAcceleratorA` `LoadAcceleratorsA` `EndDialog` `GetDlgItem` `EnableWindow` `IsDlgButtonChecked` `SetScrollInfo` `GetScrollInfo` `GetScrollPos` `SetScrollPos` `GetWindowPlacement` `GetDC` `DrawTextA` `ReleaseDC` `CloseWindow` `LoadMenuA` `OpenIcon` `GetMenu` `InsertMenuA` `FillRect` `SetKeyboardState` `GetKeyboardState` `GetSubMenu` `GetActiveWindow` `SetWindowLongA` `ClientToScreen` `GetWindowLongA` `ValidateRect` `SetWindowTextA` `MessageBoxA` `DestroyMenu` `SetCapture` `LoadIconA` `PostQuitMessage` `ReleaseCapture` `InvalidateRect` `IsIconic` `SetCursorPos` `BeginPaint` `EndPaint` `GetSystemMenu` `GetWindowRect` `DestroyWindow` `SetWindowPos` `PostMessageA` `GetSystemMetrics` `ShowWindow` `GetWindowTextA` `MoveWindow` `SetMenu` `DefWindowProcA` `SetFocus` `DrawMenuBar` `EnableMenuItem`
GDI32.dll	`CreateFontA` `SelectObject` `DeleteDC` `SetTextColor` `DeleteObject` `CreateSolidBrush` `BitBlt` `CreateCompatibleBitmap` `CreateCompatibleDC` `CreateFontIndirectA` `GetDeviceCaps` `CreateDIBSection` `TextOutA` `SetBkMode` `SetBkColor` `GetStockObject`
COMDLG32.dll	`GetOpenFileNameA` `GetSaveFileNameA`
ADVAPI32.dll	`RegCloseKey` `RegOpenKeyExA`
SHELL32.dll	`DragAcceptFiles` `DragFinish` `ShellExecuteA` `DragQueryFileA` `SHGetFolderPathA` `SHGetMalloc` `SHBrowseForFolderA` `SHGetPathFromIDListA` `ShellExecuteExA`
ole32.dll	`CoInitializeEx` `CoUninitialize` `CoCreateInstance`
IMM32.dll	`ImmNotifyIME` `ImmSetOpenStatus` `ImmGetOpenStatus` `ImmSetCompositionWindow` `ImmGetCandidateListA` `ImmReleaseContext` `ImmGetContext` `ImmSetCompositionFontA`
WINMM.dll	`timeEndPeriod` `timeBeginPeriod` `timeGetTime` `timeGetDevCaps`
WININET.dll	`InternetReadFile` `HttpSendRequestA` `InternetConnectA` `InternetAttemptConnect` `HttpOpenRequestA` `InternetOpenA` `InternetCloseHandle`
d3d11.dll	`D3D11CreateDevice`

Delayed Imports

111

Type	`PSO`
Language	Japanese - Japan
Codepage	UNKNOWN
Size	`0x7ec`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.22233`
MD5	`8de1a8324a81a8ee6905e8f62fbed4eb 🔍`
SHA1	`e41ccb37d3169fa8ab92662e26c337c00042ebf9 🔍`
SHA256	`4e8be3e3ac97728a6f918cf7d33a09a4eb9059ef7ec43897f8df686386841d1e 🔍`
SHA3	`e1391a3e16dcb5d2fc322366a1fc6150c54fb2f70ee815c57d836490bd6d06d3 🔍`

131

Type	`SLK`
Language	Japanese - Japan
Codepage	UNKNOWN
Size	`0x4d7f6`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.95474`
MD5	`9a2091939329a63c6852898edc781d5c 🔍`
SHA1	`41c201101a391ec2d16abb948e8335f3cf4dee52 🔍`
SHA256	`96d52cc93f1a8ebd4c6ec8c194c386db7dc341ca544355baefaf9db1a8fcb19a 🔍`
SHA3	`035db38963b767a3597397752141a290f7c0dfd185c41c69cacdd6f9f8ac9b7e 🔍`

132

Type	`SLK`
Language	Japanese - Japan
Codepage	UNKNOWN
Size	`0x30ca`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.78996`
MD5	`beeac1c4eb37e162f3251eda0682f618 🔍`
SHA1	`7785e773a435fcf41342700c9781835baf36bb20 🔍`
SHA256	`a5928a816ce596fcf047abcff852758f444bfa2c34297f55e185454a72116cbc 🔍`
SHA3	`2f7770eb89b2123dd3e6291ef7aeed22e56c381c49b4f60cd142d468865b0026 🔍`

120

Type	`VSO`
Language	Japanese - Japan
Codepage	UNKNOWN
Size	`0x360`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.23231`
MD5	`134aec8e22a3d193bdf83b938186bbf1 🔍`
SHA1	`034bbc7ede6e938cf7fb664d28bcedc89d253d31 🔍`
SHA256	`fa2e03a9cea0c49d82222384de34c482f630b0873aa4ebb2671ae09de5eba674 🔍`
SHA3	`a51e748dd2b40ba5bdb7aad4e153d134101bdb4bf2aafe7eadc6a6a3880a2e75 🔍`

1

Type	`RT_ICON`
Language	Japanese - Japan
Codepage	UNKNOWN
Size	`0x668`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.55826`
MD5	`c69a86672077fbd624bd897ea8b34030 🔍`
SHA1	`0bce97f98afe8d5581e162078b03a9fc55966a6c 🔍`
SHA256	`07ab4a5edc0d2f70b824d05b4b0e6489dafc7bbb0ea6edad45dac28d88e1dcc3 🔍`
SHA3	`b02ab0778b1e4e928679b9acbe1a02d73ef879cc1680ce8a783061e688dbee8f 🔍`

2

Type	`RT_ICON`
Language	Japanese - Japan
Codepage	UNKNOWN
Size	`0x2e8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.67481`
MD5	`78e609c0db0fd06ff7a3e8bfc2e5cd76 🔍`
SHA1	`f0ab23e2e206883492908ba889bf006bcb16d8be 🔍`
SHA256	`1d993a0351b90ab31b2797923a77396da5ea123a709f2030db4c5b9ee14a3d12 🔍`
SHA3	`f6e81973620bebe4f9ed3480588074d9810d67c11dd2561fb9221432a204dc31 🔍`

3

Type	`RT_ICON`
Language	Japanese - Japan
Codepage	UNKNOWN
Size	`0x128`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.60187`
MD5	`1c326f2899a5ea5ceadf2947c9b2474e 🔍`
SHA1	`c50e48985c480baa02ba1c300a7deaa09f539f8e 🔍`
SHA256	`1a801bbd0f9ccf048d93eb734748c8fdb94b6e4228eb692e94a1ab221ae5a9fb 🔍`
SHA3	`1d45c688ba40f6801846a29cbde3b22a438750bf927bacefd54481d81dfd3d15 🔍`

4

Type	`RT_ICON`
Language	Japanese - Japan
Codepage	UNKNOWN
Size	`0xea8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.91046`
MD5	`4b36833d16d5a682bb3d8ed796909dd6 🔍`
SHA1	`043aa4b59fc93e990e1f8e0bf071902355e971eb 🔍`
SHA256	`13f0d3973b24c28af4d122e0e53d61dd285c1c0ee51b3fa5c3d3ff24a93ba281 🔍`
SHA3	`600981cfbdad9b76adcd861ca342fb5841f8083a73456ecba586efe6cf470f56 🔍`

5

Type	`RT_ICON`
Language	Japanese - Japan
Codepage	UNKNOWN
Size	`0x8a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`6.13479`
MD5	`a95ba4cbca28d0aca49bbe66924ad4f6 🔍`
SHA1	`bed02d63298fb17089678227f43f40716cb8941c 🔍`
SHA256	`0931b6c39f84ace77dc8646ad031a34c7e44fc0a90f8601131e61ec222aa78f5 🔍`
SHA3	`0d6914a520b586d8156f93ba3e62020200fad78b5b3b7b38e05e6a0bf7fb798e 🔍`

6

Type	`RT_ICON`
Language	Japanese - Japan
Codepage	UNKNOWN
Size	`0x568`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.61991`
MD5	`ee6175594554139520c7278d4a83e938 🔍`
SHA1	`9f1332b7f45c1501f63c8a79c76877b2081c35d0 🔍`
SHA256	`fd4aa17939dc1372e1f5a5dfeea1fefcbfa950e317cc45198eed60eafa6ad25b 🔍`
SHA3	`ab55e588f021321180beec61eaeece7f2f932dc4a594318c67cee837832a2f85 🔍`

7

Type	`RT_ICON`
Language	Japanese - Japan
Codepage	UNKNOWN
Size	`0xe61f`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.98865`
Detected Filetype	PNG graphic file
MD5	`c657a4b714c8cd78f0114f90c988f6d0 🔍`
SHA1	`4f1cd7f9b0cff210a7af7394211864d0a70edd54 🔍`
SHA256	`ac2f686e50cde39b7bbab40086938eacc9470ac3b675fd985f6081ae4773c5e1 🔍`
SHA3	`b3c5af683ae5908b055c559664107b96c50c4efd8db1c3608235dd9edc7f33d9 🔍`

8

Type	`RT_ICON`
Language	Japanese - Japan
Codepage	UNKNOWN
Size	`0x25a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.29518`
MD5	`b1eea04e8ef5293d49dc876ff9ff2a49 🔍`
SHA1	`df93f3b09e97ac4f0f7e20da990017bca741292d 🔍`
SHA256	`f52336764a9ea435216c5e62fa64fec362f16451774d69423ec745acb62e1869 🔍`
SHA3	`028654c03f8c9fa09e23034d77bae035cac8e89cfb7847f3f937db3f122093f9 🔍`

9

Type	`RT_ICON`
Language	Japanese - Japan
Codepage	UNKNOWN
Size	`0x10a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.64943`
MD5	`cb51e0c851627fccb94b529eae581288 🔍`
SHA1	`ab37c6fbb9bb5e233e685156b79489936b09ea80 🔍`
SHA256	`fc8213c32cc0c44d3fb401caa707c74b059d8cdd84244922b5a0be94f67b98af 🔍`
SHA3	`d9665b0d117597ae4da7d5aaf6995110b8e218d4636e56629f4e093fe288b1ac 🔍`

10

Type	`RT_ICON`
Language	Japanese - Japan
Codepage	UNKNOWN
Size	`0x468`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.95357`
MD5	`d0fd1fccc4075539be1e50a52225d90e 🔍`
SHA1	`ea2abfeda364e74cc98e7d164fd8fb6d0667d767 🔍`
SHA256	`f2ee9db30bb2d41bcd831408c92a8e0da8616c75295e85f49012b00fb208516d 🔍`
SHA3	`224f8d3edadb9b1ba7b4c204e06f49efb4b47d8e0db6cc760ee4bdcc88ef4ace 🔍`

102

Type	`RT_MENU`
Language	Japanese - Japan
Codepage	UNKNOWN
Size	`0x120`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.29249`
MD5	`cabd30970ba703afa8bde90e2260247d 🔍`
SHA1	`673ca82bc4c3852563d5b6b65195784add607bd0 🔍`
SHA256	`61215f1b01d5c9b096faa8a7ce02e220efdf346dc6a7afc719ab3be7a61857e3 🔍`
SHA3	`becb8f5f974185cc8afd1b1f3f033ce6eff0ee22126a53af61905dbe3d3a513c 🔍`

160

Type	`RT_MENU`
Language	Japanese - Japan
Codepage	UNKNOWN
Size	`0x94`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.09246`
MD5	`acc9acfe7d12e7e903709dbdb08bea4f 🔍`
SHA1	`f409347c71a83e1af86b013120be65cf71175b90 🔍`
SHA256	`a81cf4b0a731f7c2de66a0e1486ecde96a0bf82507fd7c370946c59ff65f5ace 🔍`
SHA3	`1e0988e33f3dd0f0a8c3093f4174c93af567d9f35544f310e89f0086cc4adc04 🔍`

150

Type	`RT_DIALOG`
Language	Japanese - Japan
Codepage	UNKNOWN
Size	`0x18a`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.88827`
MD5	`15e0fb5c3b4717d227ae919a886959d2 🔍`
SHA1	`840af8e0a1abb89642f4bd2991cf1fe6bfdfb4a3 🔍`
SHA256	`259f35f92316340cffc354b268e3ce29b145f1f43204cc0d350d9a7dfcd93431 🔍`
SHA3	`a2af13df0edf480439abb618fdd1557aeb7762504b7e9ad463c8552d6a81cd24 🔍`

170

Type	`RT_DIALOG`
Language	Japanese - Japan
Codepage	UNKNOWN
Size	`0x120`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.45724`
MD5	`735ce197c8e6bd958a51627a9d4c9815 🔍`
SHA1	`49491075a6c30a8196f0412ef72756e64bd0e55b 🔍`
SHA256	`54e8070248413044b1fed0116afcf2f9cfe336e0503dc351251dae7197c3625f 🔍`
SHA3	`79a90ba27e0313ea75c67ab1f2972b7d8173330f0f78d3000383e407779467ff 🔍`

103

Type	`RT_ACCELERATOR`
Language	Japanese - Japan
Codepage	UNKNOWN
Size	`0x28`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.84209`
MD5	`edeab4afbe5fbefb5a2f4cff90911fa2 🔍`
SHA1	`5c416978b522d4f8db8780d468126a810b86a649 🔍`
SHA256	`4c95a2129ebb3649e09db03b1546613e532c6aa57990ca19ab1f2818f52a3529 🔍`
SHA3	`fa79496c4650b7980eeeeb5f4a18cc82bf1ff26635a474585753c8d6e8935935 🔍`

101

Type	`RT_GROUP_ICON`
Language	Japanese - Japan
Codepage	UNKNOWN
Size	`0x92`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.90294`
Detected Filetype	Icon file
MD5	`8e6771fb7853dbf33c3f4a3258eb6181 🔍`
SHA1	`a21f71b547a14680d5e8d6c1936b2bbae4f2840f 🔍`
SHA256	`6f5b8a713f39bbcecebe841f37d0cbc6d4cdf504e6ddf6f0a6cfa8a29bb1bac8 🔍`
SHA3	`a4da62d79b1246250fe33c5af70aab4e35a21f23dc71df45efb53bdac98e9cb3 🔍`

1 (#2)

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x2ef`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.32302`
MD5	`392f359d0a66270bf9192653bdfad3b8 🔍`
SHA1	`e761e6a2b84b127a03d97ee19c6edb2ef906d244 🔍`
SHA256	`8b9803d131b4e926016ea44d959c3681ee35ef49a65fe3b5421a12f050d83ee6 🔍`
SHA3	`eedffd5a48dcdb784f70db57573a7de51c5a240d3042275dc5f3ffac5f46521e 🔍`

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2020-Jul-13 02:40:56
Version	`0.0`
SizeofData	`972`
AddressOfRawData	`0x42fd84`
PointerToRawData	`0x42e784`

IMAGE_DEBUG_TYPE_ILTCG

Characteristics	`0`
TimeDateStamp	2020-Jul-13 02:40:56
Version	`0.0`
SizeofData	`0`
AddressOfRawData	`0`
PointerToRawData	`0`

TLS Callbacks

StartAddressOfRawData	`0x88b000`
EndAddressOfRawData	`0x88b008`
AddressOfIndex	`0x87efc0`
AddressOfCallbacks	`0x7bd7f8`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_4BYTES`
Callbacks	`(EMPTY)`

Load Configuration

Size	`0x5c`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x863070`
SEHandlerTable	`0`
SEHandlerCount	`0`

RICH Header

XOR Key	`0x8c21fe80`
Unmarked objects	`0`
241 (40116)	`27`
243 (40116)	`165`
242 (40116)	`57`
C++ objects (65501)	`1`
208 (65501)	`1`
199 (41118)	`4`
ASM objects (VS2015 UPD3 build 24123)	`31`
C++ objects (VS2015 UPD3 build 24123)	`121`
C objects (VS2015 UPD3 build 24123)	`39`
C objects (65501)	`1`
Imports (65501)	`23`
Total imports	`328`
C++ objects (LTCG) (VS2015 UPD3.1 build 24215)	`1008`
Resource objects (VS2015 UPD3 build 24210)	`1`
151	`1`
Linker (VS2015 UPD3.1 build 24215)	`1`

Errors

Leave a comment

No comments yet.