Manalyze report for b9bb790e719ef3a5d1959db5ec3330e7cdbec530b8d09b951d013c26c629e29f

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Jul-14 20:56:24
Detected languages	English - United States
TLS Callbacks	1 callback(s) detected.
Debug artifacts	archievable.pdb
CompanyName	xirium
FileDescription	Xirium
FileVersion	`0.3.0`
ProductName	Xirium
ProductVersion	`0.3.0`

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`Contains references to security software: rshell.exe` `Miscellaneous malware strings: cmd.exe` Contains domain names: birthpopuptypesapplyImagebeinguppernoteseveryshowsmeansextramatchtrackknownearlybegansuperpapernorthlearngivennamedendedTermspartsGroupbrandusingwomanfalsereadyaudiotakeswhile.com developer.microsoft.com genretrucklooksValueFrame.net github.com http://www.C http://www.a http://www.css http://www.hortcut http://www.icon http://www.interpretation http://www.language http://www.style http://www.text-decoration http://www.w3.org http://www.w3.org/shortcut http://www.wencodeURIComponent http://www.years https://developer.microsoft.com https://developer.microsoft.com/en-us/microsoft-edge/webview2 https://github.com https://www.World https://www.recent microsoft.com thing.org www.w3.org
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32` `Uses constants related to RC5 or RC6` `Microsoft's Cryptography API`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: LoadLibraryW LoadLibraryExW LoadLibraryA GetProcAddress LoadLibraryExA` `Functions which can be used for anti-debugging purposes: SwitchToThread` `Can access the registry: RegQueryValueExW RegOpenKeyExW RegGetValueW RegCloseKey RegSetValueExW` `Possibly launches other programs: ShellExecuteW CreateProcessW` `Uses Windows's Native API: NtReadFile NtWriteFile` `Uses Microsoft's cryptographic API: CryptProtectData` `Can create temporary files: GetTempPathW CreateFileW` `Uses functions commonly found in keyloggers: GetForegroundWindow GetAsyncKeyState MapVirtualKeyW` `Can take screenshots: GetDC BitBlt CreateCompatibleDC` `Reads the contents of the clipboard: GetClipboardData`
Suspicious	No VirusTotal score.	`This file has never been scanned on VirusTotal.`

Hashes

MD5	`fe70e92be7d7e3bbb264d8502391fb03`
SHA1	`5b1f12b459231bd7268908ce455d398bf128a4eb`
SHA256	`b9bb790e719ef3a5d1959db5ec3330e7cdbec530b8d09b951d013c26c629e29f`
SHA3	`52ee8e45bebffc46e62e28cb7700dd43d1f630c5b7b27a10141e972b4722c2b7`
SSDeep	`98304:f6+smBfdtoAgFWKfiS+KWaVNqVwUY2TrmiD+1tU1yNoPo7+DZbrfqSWTM9:wTTy8yhg49`
Imports Hash	`197f757d4b1e8d50cfe964010d43edde`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xf8`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`6`
TimeDateStamp	2026-Jul-14 20:56:24
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x4b4200`
SizeOfInitializedData	`0x209a00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000000000499738 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x6c2000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`32921f3d90dd64fff16e5bd5ca080d7e`
SHA1	`1ffa989397a703abb9f34bc7169b37f7fc773fa4`
SHA256	`c627ce32e45a8668adf1366a41c12420f4a056fa13fbd502686fdf449fbd5332`
SHA3	`39cbf0a5222b41abb5968d52be6e966a471bc9f035401ad1a35b56577d51beed`
VirtualSize	`0x4b4180`
VirtualAddress	`0x1000`
SizeOfRawData	`0x4b4200`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.17776`

.rdata

MD5	`f792f0014fa0456427bfcc0dc5d93bfc`
SHA1	`b7108c05c77814f4c189ed4ca13be654c79fa256`
SHA256	`d601217b5a4b5b1f06486343772f71cc3d8a51f9543bb0ab5e3f86a8a77f97ec`
SHA3	`67615cdce7ca3646f766f1d3dbdc2b6a28369f7ff76744d6a88fb4a39de71950`
VirtualSize	`0x1bae98`
VirtualAddress	`0x4b6000`
SizeOfRawData	`0x1bb000`
PointerToRawData	`0x4b4600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.98008`

.data

MD5	`06aa266db4ef9b983a8a46130ed3e2fa`
SHA1	`e7d3f3fbc2143c0df2df81b1c94bae326c8affa6`
SHA256	`b687cfbd3059241afec33cd5457a634e43f47f6a43b2827f8663ed4915b3eb3f`
SHA3	`6c1e9d1811af4ca003c123afb847b78f60e4461e437d4460ae07bd603a2f6e6b`
VirtualSize	`0x3528`
VirtualAddress	`0x671000`
SizeOfRawData	`0xa00`
PointerToRawData	`0x66f600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`1.75333`

.pdata

MD5	`6fe7245c5d527b5198b29d579e4f2d5d`
SHA1	`94c37a81c7e2ef8395d85ce9d16e0165fd05f628`
SHA256	`b56ae6f84f62091c7ec67d9bd144331621f3e4a79946a07c6b658470dea86944`
SHA3	`589b076335990a9366c2e0ef7247cf70631c723e1d0ece918dd718ac73655d45`
VirtualSize	`0x40080`
VirtualAddress	`0x675000`
SizeOfRawData	`0x40200`
PointerToRawData	`0x670000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.59313`

.rsrc

MD5	`cafbd61df74560d9d1330d27f5ccdda5`
SHA1	`c6159d1cd7b314689fcfe25e0e8d3867c403432e`
SHA256	`7edeac7235c3a2b7f399482ad0204cc2cddc5d3558334d66233de12e0623fc4f`
SHA3	`9c0ea6bd6822cf2481b9bec357f7a369ba3df73c3e5e4f395aa2c4bbb17403a9`
VirtualSize	`0x7580`
VirtualAddress	`0x6b6000`
SizeOfRawData	`0x7600`
PointerToRawData	`0x6b0200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.89968`

.reloc

MD5	`2f94d984b2f1c6fc2e208df5727ca8dc`
SHA1	`9682bd6a3ec33c725ff9809c8aecedb57c9bd5bb`
SHA256	`2da7f134266482f40b43b71be80934f53d58771798912fab4402d74ac1345370`
SHA3	`1d950ef4bd2af683ba5203724a992e297240f443c9df2905fdb339594dd8a4db`
VirtualSize	`0x3af4`
VirtualAddress	`0x6be000`
SizeOfRawData	`0x3c00`
PointerToRawData	`0x6b7800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.44176`

Imports

bcryptprimitives.dll	`ProcessPrng`
ntdll.dll	`RtlNtStatusToDosError` `NtReadFile` `NtWriteFile` `RtlGetVersion`
kernel32.dll	`WideCharToMultiByte` `ReleaseMutex` `WaitForSingleObject` `OutputDebugStringA` `MultiByteToWideChar` `EncodePointer` `SetWaitableTimer` `FormatMessageW` `GetModuleFileNameW` `CompareStringOrdinal` `GetSystemDirectoryW` `GetWindowsDirectoryW` `DuplicateHandle` `SleepEx` `WaitForMultipleObjects` `GetExitCodeProcess` `ExitProcess` `HeapAlloc` `RaiseException` `RtlPcToFileHeader` `TerminateProcess` `IsProcessorFeaturePresent` `IsDebuggerPresent` `GetSystemTimeAsFileTime` `SleepConditionVariableSRW` `WakeAllConditionVariable` `AcquireSRWLockExclusive` `GetCurrentProcessId` `SetThreadStackGuarantee` `GetCurrentThread` `GetProcessHeap` `HeapReAlloc` `HeapFree` `SwitchToThread` `GetCurrentProcess` `WaitForSingleObjectEx` `GetCurrentThreadId` `SetLastError` `RtlLookupFunctionEntry` `TlsAlloc` `TlsGetValue` `GetModuleHandleW` `TlsSetValue` `GetUserDefaultUILanguage` `LCIDToLocaleName` `GlobalLock` `GlobalSize` `GlobalUnlock` `LocalFree` `LoadLibraryW` `GetSystemTimePreciseAsFileTime` `OutputDebugStringW` `GetSystemInfo` `TlsFree` `lstrlenW` `GetFileAttributesW` `FindFirstFileExW` `FindNextFileW` `GetFullPathNameW` `GetFileInformationByHandleEx` `GetFileInformationByHandle` `GetTempPathW` `WriteConsoleW` `FreeLibrary` `GetConsoleOutputCP` `GetConsoleMode` `GetStdHandle` `GetFinalPathNameByHandleW` `FindClose` `SetFileInformationByHandle` `DeleteFileW` `CreateEventW` `LoadLibraryExW` `LoadLibraryA` `GetModuleHandleA` `Sleep` `GetProcAddress` `CloseHandle` `GetLastError` `ReleaseSRWLockExclusive` `LoadLibraryExA`
api-ms-win-core-synch-l1-2-0.dll	`WaitOnAddress` `WakeByAddressSingle` `WakeByAddressAll`
user32.dll	`GetTouchInputInfo` `SetCapture` `ScreenToClient` `CloseTouchInputHandle` `RegisterTouchWindow` `IsWindow` `UpdateWindow` `InvalidateRect` `SetCursorPos` `GetForegroundWindow` `FlashWindowEx` `IsWindowEnabled` `GetDC` `MonitorFromWindow` `TrackPopupMenu` `SetForegroundWindow` `ClientToScreen` `GetCursorPos` `CreateAcceleratorTableW` `DestroyAcceleratorTable` `VkKeyScanW` `SetMenuItemInfoW` `AppendMenuW` `InsertMenuW` `CreatePopupMenu` `CreateMenu` `SendInput` `CheckMenuItem` `ShowWindow` `PostQuitMessage` `GetActiveWindow` `DrawMenuBar` `DestroyMenu` `SetMenu` `RemoveMenu` `EnableWindow` `DestroyIcon` `IsWindowVisible` `MonitorFromRect` `SetCursor` `TrackMouseEvent` `CloseClipboard` `SetWindowDisplayAffinity` `GetWindowTextW` `GetWindowTextLengthW` `SetWindowTextW` `RegisterRawInputDevices` `GetMonitorInfoW` `GetClipboardData` `LoadCursorW` `IsProcessDPIAware` `GetWindowRect` `GetAsyncKeyState` `EnumChildWindows` `ClipCursor` `GetClipCursor` `DispatchMessageA` `GetMessageA` `SetWindowPos` `RegisterClassExW` `GetKeyState` `ChangeWindowMessageFilterEx` `RegisterClassW` `GetMenuItemInfoW` `FindWindowExW` `SendMessageW` `TranslateAcceleratorW` `ShowCursor` `SetWindowLongPtrW` `CreateWindowExW` `SetWindowLongW` `GetWindowLongPtrW` `GetSystemMenu` `AdjustWindowRect` `EnumDisplayMonitors` `MonitorFromPoint` `GetParent` `SetWindowRgn` `SetPropW` `MsgWaitForMultipleObjectsEx` `PostMessageW` `CreateIcon` `DispatchMessageW` `TranslateMessage` `GetMessageW` `GetSystemMetrics` `MapVirtualKeyW` `GetUpdateRect` `PeekMessageW` `PostThreadMessageW` `ValidateRect` `RedrawWindow` `DefWindowProcW` `GetRawInputData` `EnableMenuItem` `DestroyWindow` `AdjustWindowRectEx` `GetMenu` `GetWindowLongW` `SystemParametersInfoW` `KillTimer` `ReleaseCapture` `SetTimer` `InvalidateRgn` `GetWindowPlacement` `SetWindowPlacement` `ChangeDisplaySettingsExW` `RegisterWindowMessageA` `SetParent` `ToUnicodeEx` `GetKeyboardLayout` `MapVirtualKeyExW` `GetKeyboardState` `GetMenuBarInfo` `GetClientRect` `SetFocus` `MapWindowPoints` `SystemParametersInfoA` `DrawIconEx` `DrawTextW` `ReleaseDC` `FillRect` `GetWindowDC` `OffsetRect` `GetWindow` `OpenClipboard` `IsIconic`
oleaut32.dll	`GetErrorInfo` `SysFreeString` `SysStringLen` `SetErrorInfo`
comctl32.dll	`DefSubclassProc` `TaskDialogIndirect` `SetWindowSubclass` `RemoveWindowSubclass`
advapi32.dll	`RegQueryValueExW` `RegOpenKeyExW` `EventUnregister` `EventWriteTransfer` `EventSetInformation` `RegGetValueW` `EventRegister` `RegCloseKey` `RegSetValueExW`
dwmapi.dll	`DwmGetWindowAttribute` `DwmEnableBlurBehindWindow` `DwmSetWindowAttribute`
shell32.dll	`Shell_NotifyIconGetRect` `ShellExecuteW` `SHAppBarMessage` `Shell_NotifyIconW` `DragFinish` `SHGetKnownFolderPath` `DragQueryFileW`
ole32.dll	`CoTaskMemFree` `RegisterDragDrop` `RevokeDragDrop` `CoInitializeEx` `CoTaskMemAlloc` `CoCreateFreeThreadedMarshaler` `CoIncrementMTAUsage` `CoUninitialize` `CoCreateInstance` `OleInitialize`
shlwapi.dll	`SHCreateMemStream`
gdi32.dll	`BitBlt` `CreateDIBSection` `DeleteObject` `CreateCompatibleDC` `SelectObject` `CreateSolidBrush` `GetDeviceCaps` `SetTextColor` `DeleteDC` `SetBkMode` `CombineRgn` `CreateRectRgn`
api-ms-win-core-winrt-l1-1-0.dll	`RoGetActivationFactory`
KERNEL32.dll	`InitializeCriticalSectionAndSpinCount` `DeleteCriticalSection` `RtlUnwindEx` `SetUnhandledExceptionFilter` `UnhandledExceptionFilter` `InitializeSListHead` `QueryPerformanceCounter` `ReadFile` `CancelIo` `GetOverlappedResult` `WriteFileEx` `AddVectoredExceptionHandler` `ReadFileEx` `SetEnvironmentVariableW` `GetCommandLineW` `RtlCaptureContext` `RtlVirtualUnwind` `GetCurrentDirectoryW` `CreateMutexA` `GetEnvironmentVariableW` `CreateWaitableTimerExW` `QueryPerformanceFrequency` `CreateFileW` `CreateDirectoryW` `CreateProcessW` `GetEnvironmentStringsW` `FreeEnvironmentStringsW` `CreateThread` `CreateNamedPipeW`
crypt32.dll	`CryptProtectData`
api-ms-win-crt-math-l1-1-0.dll	`fmod` `round` `pow` `trunc` `floor` `roundf` `__setusermatherr`
api-ms-win-crt-string-l1-1-0.dll	`strlen` `wcslen` `_wcsicmp` `strcpy_s` `strcmp` `wcsncmp` `wcscmp`
api-ms-win-crt-convert-l1-1-0.dll	`wcstol` `_ultow_s` `_wtoi`
api-ms-win-crt-runtime-l1-1-0.dll	`_configure_narrow_argv` `_cexit` `_c_exit` `_set_app_type` `_seh_filter_exe` `__p___argv` `_get_initial_narrow_environment` `_initialize_narrow_environment` `_initialize_onexit_table` `_register_onexit_function` `_crt_atexit` `terminate` `_initterm_e` `exit` `_exit` `abort` `_register_thread_local_exe_atexit_callback` `__p___argc` `_initterm`
api-ms-win-crt-stdio-l1-1-0.dll	`_set_fmode` `__p__commode`
api-ms-win-crt-locale-l1-1-0.dll	`_configthreadlocale`
api-ms-win-crt-heap-l1-1-0.dll	`calloc` `malloc` `free` `_set_new_mode` `_callnewh`

Delayed Imports

1

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x1a5`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.172`
Detected Filetype	PNG graphic file
MD5	`d1159ab46ac28c34ca45bb710f852666`
SHA1	`7ad013707ce502c92568eb20ad5dca0c038f6251`
SHA256	`04410ef4281e6508e7ec14d3cf9f4dc1025270cb01a0b247b69eaed4c2a61344`
SHA3	`af31f6bcad5295f031a1741ce5f5b27ef9ad1d11ac47f413cfc88c7b1aa07d30`

2

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x341`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.67759`
Detected Filetype	PNG graphic file
MD5	`6d9268c1ba586ff6ad62a2cce0d0d360`
SHA1	`839402895998630c17d9f5e12f7b98c225c0fcc4`
SHA256	`3cfe7d4146e18e713bd7712727c5b236d6900fee1ca2c7b9dced3a7be4584ec5`
SHA3	`93917e9be939d13cc438add25b724b441f0e1f5ecd5d01fe3bce6e6bd68f77a8`

3

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x55c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.8069`
Detected Filetype	PNG graphic file
MD5	`27409e11ba99c4da3e52cf2a787e96c4`
SHA1	`affaea98d9118d1073c2de5e9debe571efd0ecb0`
SHA256	`a3c2097c751feb004d695b983500a4b723e8174102fba1a4798ea9f9089433b3`
SHA3	`b15cb4a41af25d9c5c42a3c8feff0d43a0bd88420a5d017cf7f7184309de912e`

4

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x7d3`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.84188`
Detected Filetype	PNG graphic file
MD5	`cf5b74e07e53cb27db3cc3fc1b0bbbf4`
SHA1	`710bf5b742a0f5430fd4f76731a64dab04f01e43`
SHA256	`c295233e38274288c1c4bff5069b1d4f9ddf290dd7da2c42419785a23841d305`
SHA3	`8ab7b445ffc39695528e72daab94d1a0107c268a0f80da19b8003e0abe1ac558`

5

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x1613`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.94997`
Detected Filetype	PNG graphic file
MD5	`fc06d828f64f56c59b4d4318b1fc1397`
SHA1	`3bc282b75cdc12ca3f0433ad169a6ae7d3b1d3f6`
SHA256	`8fc881acb995924cafda8b9b8888547e1d5e61fa70d4d66a108ec020db89d8c3`
SHA3	`2feeedc30121284fd2622e241b838406e1cb4a880b5fba968432345a51823e3f`

6

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x479a`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96452`
Detected Filetype	PNG graphic file
MD5	`9282f7eec919c1ae9f7561be57c0f4f2`
SHA1	`7ada78072dbb5f5144c247ddcd67e982a83300cd`
SHA256	`2f28722595a24b745867b4415c3bb8d2d272584de3c7504d3b7a4c0cfce277ef`
SHA3	`1494b9726d3f73a1ca5dbcd7958999241054ef89d10d5203dac9851e883eb65c`

32512

Type	`RT_GROUP_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x5a`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.77399`
Detected Filetype	Icon file
MD5	`b303236235bbd6978c48fb40fac7324e`
SHA1	`6a9dc145cf671537bc30ed28ddb55635d661bfd8`
SHA256	`24c06fc8a0ff833da5f02696c9964e6f4aacc6cb73e5a007b902492450f8f2f5`
SHA3	`79f81103e1a032c1c25619e0575087f7f0aa4223007408957f6812ba3fcb8cd1`

1 (#2)

Type	`RT_VERSION`
Language	English - United States
Codepage	UNKNOWN
Size	`0x1d0`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.09057`
MD5	`75f4c306a5183f06cfb89874154ce536`
SHA1	`853bdf73096799026c4797bd9080efeba690ac10`
SHA256	`735704aaf566a27579de2ca4a46a8833d8d6f5b51061fb5c0badeeb24c6fe928`
SHA3	`281b4f9e30ca39247c6e248e3e7c80960fc7ff4fb51a5d20a6969ebf482bdced`

1 (#3)

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x14e`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.96056`
MD5	`01e4c8c046a47771f13cd120b53303e7`
SHA1	`2a4224d31c916a5cff4f2636a3cb47fdd84a5cc9`
SHA256	`b1cb832f790c153aa0e9a66f76e75460263cf1d41971d2dbcc9a4d87ec18b7d8`
SHA3	`680120ec819e7ba66519d9a8a3e446973c4cb28aa0146c91cceaa8c8fadc90ae`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	0.3.0.0
ProductVersion	0.3.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT` `VOS_NT_WINDOWS32` `VOS_WINCE` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
CompanyName	xirium
FileDescription	Xirium
FileVersion (#2)	0.3.0
ProductName	Xirium
ProductVersion (#2)	0.3.0

Resource LangID	English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2026-Jul-14 20:56:24
Version	`0.0`
SizeofData	`40`
AddressOfRawData	`0x568af4`
PointerToRawData	`0x5670f4`
Referenced File	archievable.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics	`0`
TimeDateStamp	2026-Jul-14 20:56:24
Version	`0.0`
SizeofData	`20`
AddressOfRawData	`0x568b1c`
PointerToRawData	`0x56711c`

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2026-Jul-14 20:56:24
Version	`0.0`
SizeofData	`1048`
AddressOfRawData	`0x568b30`
PointerToRawData	`0x567130`

TLS Callbacks

StartAddressOfRawData	`0x140568f90`
EndAddressOfRawData	`0x14056912c`
AddressOfIndex	`0x140673e0c`
AddressOfCallbacks	`0x1404b6be8`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_8BYTES`
Callbacks	`0x00000001403CB870`

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x1406717c0`

RICH Header

XOR Key	`0xcf6b1521`
Unmarked objects	`0`
Imports (VS2008 SP1 build 30729)	`14`
ASM objects (35207)	`9`
C objects (35207)	`13`
C++ objects (35207)	`47`
Imports (33145)	`3`
Total imports	`353`
Unmarked objects (#2)	`53`
Resource objects (35228)	`1`
Linker (35228)	`1`

Errors

Leave a comment

No comments yet.