c570ce9209dd54f4dd33ab7aaf8a3db4824f9a0ba69c90704b0fd3ce8b06ebd9

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-May-19 08:46:01
Comments https://discord.gg/FreeUp
CompanyName ModadByLUc2s
FileDescription Creative EAX Setting
FileVersion 1.0.0.0
InternalName Creative EAX Setting.exe
LegalCopyright CodedBySamurai
LegalTrademarks https://guns.lol/xhy
OriginalFilename Creative EAX Setting.exe
ProductName Creative EAX Setting
ProductVersion 1.0.0.0
Assembly Version 1.0.0.0

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 DLL (Debug)
Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C# v7.0 / Basic .NET
.NET DLL -> Microsoft
Microsoft Visual C++
Microsoft Visual C++ v6.0
.NET executable -> Microsoft
Suspicious Strings found in the binary may indicate undesirable behavior: Looks for VirtualBox presence:
  • 080027
 May have dropper capabilities:
  • CurrentControlSet\Services
 Contains another PE executable:
  • This program cannot be run in DOS mode.
 Contains domain names:
  • cacerts.digicert.com
  • crl.globalsign.com
  • crl3.digicert.com
  • digicert.com
  • globalsign.com
  • http://cacerts.digicert.com
  • http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
  • http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
  • http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
  • http://crl.globalsign.com
  • http://crl.globalsign.com/codesigningrootr45.crl0U
  • http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
  • http://crl.globalsign.com/gsoffliner45timestampca2025.crl0V
  • http://crl.globalsign.com/root-r3.crl0G
  • http://crl.globalsign.com/root.crl0G
  • http://crl.globalsign.com/timestamprootr45.crl0
  • http://crl3.digicert.com
  • http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
  • http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
  • http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
  • http://ocsp.digicert.com0A
  • http://ocsp.digicert.com0C
  • http://ocsp.digicert.com0X
  • http://ocsp.globalsign.com
  • http://ocsp.globalsign.com/codesigningrootr450F
  • http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
  • http://ocsp.globalsign.com/gsoffliner45timestampca20250O
  • http://ocsp.globalsign.com/rootr103
  • http://ocsp.globalsign.com/rootr30
  • http://ocsp.globalsign.com/timestamprootr450D
  • http://secure.globalsign.com
  • http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
  • http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
  • http://secure.globalsign.com/cacert/gsoffliner45timestampca2025.crt0J
  • http://secure.globalsign.com/cacert/root-r3.crt06
  • http://secure.globalsign.com/cacert/timestamprootr45.crt0?
  • https://discord.gg
  • https://guns.lol
  • https://www.globalsign.com
  • https://www.globalsign.com/repository/0
  • ocsp.globalsign.com
  • secure.globalsign.com
  • www.globalsign.com
Info Cryptographic algorithms detected in the binary: Uses constants related to SHA1
Uses constants related to SHA256
Malicious VirusTotal score: 5/69 (Scanned on 2026-07-18 17:40:08) APEX: Malicious
CrowdStrike: win/malicious_confidence_60% (D)
Cylance: Unsafe
DrWeb: Program.Unwanted.4661
MaxSecure: Trojan.Malware.300983.susgen

Hashes

MD5 94e77f2c413af9d2ea24e7ac7ecd18b1
SHA1 30d8b33a12a1878515f3beb00bec493ce4f64231
SHA256 c570ce9209dd54f4dd33ab7aaf8a3db4824f9a0ba69c90704b0fd3ce8b06ebd9
SHA3 0b50cbc3a8957dd2999dbde3f5f0d3321e5ef3cda0495c181223f6275a3a6f69
SSDeep 49152:UuKhkAIKyo+HgbY8DkRmaZ8V7Fy1ti1Rm:UtiA7yB4Oi3m
Imports Hash f34d5f2d4577ed6d9ceec516c1f5a744

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2026-May-19 08:46:01
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 11.0
SizeOfCode 0x274600
SizeOfInitializedData 0x1f200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x002765CE (Section: .text)
BaseOfCode 0x2000
BaseOfData 0x278000
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x29a000
SizeOfHeaders 0x200
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d4fef67e8a7ec0c00ec8047158f2d9fe
SHA1 6dcb50a67e88782e1945c333657e0fe3000892f0
SHA256 024416a7d90a7705ae90bd8b2357e084675af792a6772e13f98abc782fdae353
SHA3 b3775ed99fcb7eaceb46e03febe6351b85f162372530cbfdd0366bd246d5e0a2
VirtualSize 0x2745d4
VirtualAddress 0x2000
SizeOfRawData 0x274600
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.03468

.rsrc

MD5 2905915ba290974118506a289ed992bf
SHA1 1fabecf7eab2c2c4f40f8ba64db30fea57ed3cd4
SHA256 ba1d5971b02ddeaf06338b40dd86f9c11029b36c8211a58bbc0d9288215535fd
SHA3 3359aa2649c30350c8a7ebb66a22fdf73baaeaf1a40d50661cab9ba7ef9c0cf5
VirtualSize 0x1eea6
VirtualAddress 0x278000
SizeOfRawData 0x1f000
PointerToRawData 0x274800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.96879

.reloc

MD5 476b467c229101c92990e48e9ba178a9
SHA1 8c66cf6e467483bec8bbd5a48608923b13f7d2e6
SHA256 0f632a137adef118a7d218e70d9821042b7877ccc09435ea2d7953464407a97c
SHA3 4077acf032de610581976ec739105154b602878fb98550f70bc65d75c7dd751f
VirtualSize 0xc
VirtualAddress 0x298000
SizeOfRawData 0x200
PointerToRawData 0x293800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.10191

Imports

mscoree.dll _CorExeMain

Delayed Imports

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x2cc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.54628
Detected Filetype PNG graphic file
MD5 4651c5064295409a0fde007611c3ccaa
SHA1 7268a442c80a87d6d7189b40553f45f233deddab
SHA256 99b1a8b454177885b6d896f4a25e5ec3fee3b12e787547056c3787f9d4fe5562
SHA3 c54db5edb5e0faa567bfad874a3f7ebb37f0c9e51990763d02711d6e12e6a072

3

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x882
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.86635
Detected Filetype PNG graphic file
MD5 0ec759a1c0c77a91e797fa2965c11398
SHA1 0365a3cb243d32b266be5453951198893a90e42d
SHA256 eb6ef3b54e92b7b4e161783e8b07d3262705bb6d05e0d76d11d65b47607bd994
SHA3 800b060733d09b1dd8757ea08d278a38cfd4ba1ad2b07b7dea3933edc1f9e10c

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x110e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.94675
Detected Filetype PNG graphic file
MD5 d6c0a317984c536d028380011fb3ca5f
SHA1 20b20d13f7c5753bfb9e1ba1cc25c9a65d40a74f
SHA256 aed0aa44db833b6c752284e08fd897f2a37fb937e1da7df19edfb47d7ad30be8
SHA3 054cb9fffe03d592eda9716f5a0d1257a0650fdd6cda66e78f14dbb6f6f32314

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x1c72
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.96317
Detected Filetype PNG graphic file
MD5 591ba4ea8585fc7e876c7a869f6239bc
SHA1 5d4db3b247f015e5fb4bf13123407215f7e668c9
SHA256 c0f69bf64bbbe4f74d0c05dc171e1a301eabfa166b27787bd7d45f594945e8f5
SHA3 02c6b59b00daaa5825fc859818697cbfab5c63fda507329fb53b1ac5f7afcd03

6

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x624b
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.9801
Detected Filetype PNG graphic file
MD5 ec6dd989de3555f23aa580843a1f812e
SHA1 6ce84a91f55f599e10abd44dda2aa427ed586728
SHA256 a3dc61b530d98a7b88be0b7e65dd7e6497e706cdf15e8162289d0a985ea9abfc
SHA3 36e55765f5cb03a1e904da34dde8ed54d147756191223314ec4a904237b03ba6

7

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x14b36
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.98812
Detected Filetype PNG graphic file
MD5 c4a1e7b821144dd4cae6c6022c09fcf7
SHA1 0ef71e3d3cd2b6eda85c4e8e6d690b06ebc42ed1
SHA256 e969208cec891991547c9c67fe49d744af9d62417af079821ffa3de92191dadd
SHA3 b33de1ab766d2df8d2e7eff72e0d29727c5a86cb87ca36daf8f807d22275d038

32512

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.90223
Detected Filetype Icon file
MD5 129c821d8042b60266ac9d793ff3bc71
SHA1 3513b65b2f296c1ffe1429d1145e3d0311d7ea54
SHA256 1e79b68f58a034e138db1bd766e2ef19e3b58ed24ec49ecb6870f6c82e4223c5
SHA3 6ae7252fc2ae111ada3af08a28ae487e909947967420fbfeacc537dc10f6979c

1

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x3e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.36405
MD5 5ab62f2f0749b915a8fa48f263b04e0d
SHA1 da47929e8bdec41a60e5a0299b7bf749ff9e7b05
SHA256 08139ed526a2c57e1262279cfad872682ab45aaaec828d05329182a8a00c3b1f
SHA3 3b1a79a71ec6f7ae55b2202f719454dcc3816c45fea4029d2f42665170162580

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x1ea
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.00112
MD5 b7db84991f23a680df8e95af8946f9c9
SHA1 cac699787884fb993ced8d7dc47b7c522c7bc734
SHA256 539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a
SHA3 4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
Comments https://discord.gg/FreeUp
CompanyName ModadByLUc2s
FileDescription Creative EAX Setting
FileVersion (#2) 1.0.0.0
InternalName Creative EAX Setting.exe
LegalCopyright CodedBySamurai
LegalTrademarks https://guns.lol/xhy
OriginalFilename Creative EAX Setting.exe
ProductName Creative EAX Setting
ProductVersion (#2) 1.0.0.0
Assembly Version 1.0.0.0
Resource LangID UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.