Manalyze report for cb5de97e9244216b395d884cb3cff3d55f988e2790c9c4e6a65b110d6ccc2f03

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-May-29 12:47:17
Detected languages	English - United States
TLS Callbacks	1 callback(s) detected.
Debug artifacts	ui.pdb
CompanyName	savage
FileDescription	ui
FileVersion	`1.0.0`
ProductName	ui
ProductVersion	`1.0.0`

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`Miscellaneous malware strings: cmd.exe` Contains domain names: GoDaddy.com apis.roblox.com birthpopuptypesapplyImagebeinguppernoteseveryshowsmeansextramatchtrackknownearlybegansuperpapernorthlearngivennamedendedTermspartsGroupbrandusingwomanfalsereadyaudiotakeswhile.com clientsettings.roblox.com create.roblox.com developer.microsoft.com en.wikipedia.org games.roblox.com genretrucklooksValueFrame.net github.com githubusercontent.com http://dummy.testC http://www.C http://www.a http://www.css http://www.hortcut http://www.icon http://www.interpretation http://www.language http://www.roblox.com http://www.style http://www.text-decoration http://www.w3.org http://www.w3.org/shortcut http://www.wencodeURIComponent http://www.years https://apis.roblox.com https://apis.roblox.com/universes/v1/places/ https://auth.cosmic.best https://auth.cosmic.best/beta/download/dllhttps https://auth.cosmic.best/beta/download/injectorhttps https://auth.cosmic.best/files/secureengineDownloading https://auth.cosmic.best/infoSelect https://auth.cosmic.best/users/auth/freeapplication/json https://auth.cosmic.best/users/checkvalid https://clientsettings.roblox.com https://clientsettings.roblox.com/v2/client-version/WindowsPlayerclientVersionUploadSaved https://create.roblox.com https://create.roblox.com/docs/reference/engine/classes/BasePart https://create.roblox.com/docs/reference/engine/classes/BasePart#Touched https://create.roblox.com/docs/reference/engine/classes/ClickDetector https://create.roblox.com/docs/reference/engine/classes/ClickDetector#MouseClick https://create.roblox.com/docs/reference/engine/classes/ProximityPrompt https://create.roblox.com/docs/reference/engine/classes/ProximityPrompt#HoldDuration https://developer.microsoft.com https://developer.microsoft.com/en-us/microsoft-edge/webview2 https://docs.rs https://en.wikipedia.org https://en.wikipedia.org/wiki/Base64 https://en.wikipedia.org/wiki/LZ4_ https://en.wikipedia.org/wiki/SHA-2 https://games.roblox.com https://games.roblox.com/v1/games?universeIds https://github.com https://raw.githubusercontent.com https://raw.githubusercontent.com/JohnnyMorganz/luau-lsp/main/scripts/globalTypes.d.luaudocs.jsonhttps https://raw.githubusercontent.com/MaximumADHD/Roblox-Client-Tracker/roblox/api-docs/en-us.jsonsunc.d.luatype https://setup.rbxcdn.com https://setup.rbxcdn.com/ https://thumbnails.roblox.com https://thumbnails.roblox.com/v1/users/avatar-headshot?userIds https://users.roblox.com https://users.roblox.com/v1/users/ https://www.World https://www.recent microsoft.com openssl.org raw.githubusercontent.com rbxcdn.com roblox.com setup.rbxcdn.com thing.org thumbnails.roblox.com users.roblox.com wikipedia.org www.roblox.com www.w3.org
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32` `Uses constants related to SHA1` `Uses constants related to SHA256` `Uses constants related to SHA512` `Uses constants related to RC5 or RC6`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: LoadLibraryExW GetProcAddress LoadLibraryA LoadLibraryW LoadLibraryExA` `Functions which can be used for anti-debugging purposes: SwitchToThread` `Can access the registry: RegQueryValueExW RegCloseKey RegGetValueW RegOpenKeyExW` `Possibly launches other programs: ShellExecuteW CreateProcessW` `Uses Windows's Native API: NtCreateFile NtWriteFile NtCancelIoFileEx NtDeviceIoControlFile NtOpenFile NtReadFile NtCreateNamedPipeFile` `Can create temporary files: CreateFileW CreateFileA GetTempPathW` `Uses functions commonly found in keyloggers: GetForegroundWindow MapVirtualKeyW GetAsyncKeyState` `Leverages the raw socket API to access the Internet: freeaddrinfo getaddrinfo WSACleanup socket WSAGetLastError shutdown listen bind WSASocketW WSAStartup connect ioctlsocket setsockopt send WSASend recv getsockname getpeername accept getsockopt closesocket WSAIoctl` `Can take screenshots: GetDC CreateCompatibleDC BitBlt`
Malicious	VirusTotal score: 3/61 (Scanned on 2026-07-09 04:12:27)	`Malwarebytes: Adware.Agent` `Sophos: Generic Reputation PUA (PUA)` `Trapmine: malicious.high.ml.score`

Hashes

MD5	`748bd6d13b47240599f0bb4ed892b21c`
SHA1	`24773fbb2c15212bc1845bb9326c178d25c3fed5`
SHA256	`cb5de97e9244216b395d884cb3cff3d55f988e2790c9c4e6a65b110d6ccc2f03`
SHA3	`3b8515a055f4fedae2770295b8d34947fcf666c7058d5a892513bb03768826c2`
SSDeep	`196608:hrXVG3JHAFzmqXKC8V6Faaya8l0S7oxT8TSfg2lhu:hXVG3JgF3Z46FaayFsxT8TSfg4h`
Imports Hash	`62f0383404f06951746d72084b01a844`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x100`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`6`
TimeDateStamp	2026-May-29 12:47:17
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x9f5200`
SizeOfInitializedData	`0x640400`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00000000009CA0EC (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x1039000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`5d4ff216696fd714b4b71952d5592d50`
SHA1	`2f466cad04195bf3d6ce4c7606645c79914c0c4d`
SHA256	`7401f385276c95b6e9c56bea6085c025c37db48ad42c5730a807c1d87047429a`
SHA3	`6903e6826008f25c0daf78f8ef53aa935876189911c1507243a3dd594b998dc8`
VirtualSize	`0x9f50a0`
VirtualAddress	`0x1000`
SizeOfRawData	`0x9f5200`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.21836`

.rdata

MD5	`c3c2c65a1ba9329741dd98237876c3b0`
SHA1	`ca76e21db37938807f0023ad89184134388eec11`
SHA256	`942afefc2e1231c1c4c651ab72549a2467a4b7c700d1df9e6bec65c058b37994`
SHA3	`1ff9cf93c8dfc32d48a8f32f48dc42323df8aa2cdc513c5ddd4b0c9ff361de9e`
VirtualSize	`0x5902bc`
VirtualAddress	`0x9f7000`
SizeOfRawData	`0x590400`
PointerToRawData	`0x9f5600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.83313`

.data

MD5	`4d39e643ac645c7c962a924b777cca86`
SHA1	`a91d2fb28d0294b79c88ba91096e14703d38ae3d`
SHA256	`1dd278e5e3111fed5955c1f2babfb6fea87af51c9d9de676f403178a108ba0b9`
SHA3	`d57731942ed08cbbe34f2a19158486aace7b6ed8494cf5f69c7d0331205c1271`
VirtualSize	`0x4408`
VirtualAddress	`0xf88000`
SizeOfRawData	`0x2000`
PointerToRawData	`0xf85a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`3.72378`

.pdata

MD5	`37de2d70be34cca36cacc0d07605325f`
SHA1	`516335e40b8588d0a182419dc6e3a8831e0a64be`
SHA256	`43f5f0479fdf27abf6666f9dcda462dca059a0bb03ad16eab28129101e734726`
SHA3	`443070fb28237592539d4abec5f18401e6a1d67da87ab8ae8818565ad54ceb74`
VirtualSize	`0x8dec4`
VirtualAddress	`0xf8d000`
SizeOfRawData	`0x8e000`
PointerToRawData	`0xf87a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.58706`

.rsrc

MD5	`a62f615bff93155a13fd37e1784f0874`
SHA1	`9d2a51a8052196ff82997faae98782da88db196b`
SHA256	`cd6da44212af583a8b4a5f9cf62548fc183e59f745fda4b5ce539d20f9fa40e8`
SHA3	`982246621497b411ba7f0e4d2629926c0b756beb0a0dea46fd0a5677ff036cf5`
VirtualSize	`0x16848`
VirtualAddress	`0x101b000`
SizeOfRawData	`0x16a00`
PointerToRawData	`0x1015a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.97318`

.reloc

MD5	`c63503ef1e6e4555c0c363672fcb4e81`
SHA1	`c8e01631913ca2d3307fdc75c0b2613b51d9651c`
SHA256	`a9af948eb1f4e05667c0c95f040fd20d4ee3606c042586c2dbbde2a6e1cff60f`
SHA3	`3c95493fb4e795f8461e6af947e82d50b24d72b6d4df4f7139f364e93cbb7c49`
VirtualSize	`0x6fb0`
VirtualAddress	`0x1032000`
SizeOfRawData	`0x7000`
PointerToRawData	`0x102c400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.47551`

Imports

bcryptprimitives.dll	`ProcessPrng`
ntdll.dll	`RtlGetVersion` `NtCreateFile` `NtWriteFile` `NtCancelIoFileEx` `NtDeviceIoControlFile` `NtOpenFile` `NtReadFile` `RtlNtStatusToDosError` `NtCreateNamedPipeFile`
advapi32.dll	`RegQueryValueExW` `RegCloseKey` `RegGetValueW` `RegOpenKeyExW`
kernel32.dll	`OutputDebugStringA` `OutputDebugStringW` `GetModuleFileNameW` `GetProcessHeap` `HeapFree` `LoadLibraryExW` `ReleaseSemaphore` `FreeLibrary` `GetModuleHandleA` `Sleep` `ReadDirectoryChangesW` `SetHandleInformation` `WaitForSingleObject` `GetProcAddress` `GetOverlappedResult` `ReleaseSRWLockExclusive` `AcquireSRWLockExclusive` `lstrlenW` `LoadLibraryA` `PostQueuedCompletionStatus` `ReadFile` `LoadLibraryW` `WakeAllConditionVariable` `CancelIoEx` `GetSystemFirmwareTable` `CreateIoCompletionPort` `GetModuleHandleW` `GetCurrentThreadId` `GetQueuedCompletionStatusEx` `GetFileAttributesW` `LCIDToLocaleName` `SetFileCompletionNotificationModes` `WaitForSingleObjectEx` `SleepConditionVariableSRW` `GetUserDefaultUILanguage` `GetConsoleMode` `GetSystemTimeAsFileTime` `LoadLibraryExA` `HeapAlloc` `RtlPcToFileHeader` `GetFileInformationByHandle` `RaiseException` `FlsAlloc` `CreateSemaphoreW` `FlsGetValue` `FormatMessageW` `CancelIo` `CreateFileW` `WriteFile` `FlsSetValue` `CreateFileA` `DeviceIoControl` `SetNamedPipeHandleState` `FlsFree` `CloseHandle` `GetLastError` `EncodePointer`
user32.dll	`DestroyIcon` `SetForegroundWindow` `RegisterRawInputDevices` `ReleaseCapture` `SetCapture` `MsgWaitForMultipleObjectsEx` `SendInput` `SetWindowDisplayAffinity` `RegisterWindowMessageA` `SetParent` `MapWindowPoints` `GetWindow` `SetFocus` `ShowWindow` `ReleaseDC` `GetSystemMenu` `EnableMenuItem` `SetPropW` `SetLayeredWindowAttributes` `ClipCursor` `IsProcessDPIAware` `GetDC` `GetClipCursor` `GetKeyState` `EnableWindow` `IsWindowEnabled` `ShowCursor` `GetMenu` `GetWindowRect` `SetWindowLongPtrW` `GetParent` `GetWindowLongPtrW` `FindWindowExW` `SetWindowRgn` `IsWindowVisible` `GetMessageA` `TranslateMessage` `GetWindowTextLengthW` `GetWindowTextW` `DispatchMessageA` `GetWindowLongW` `SetWindowLongW` `ToUnicodeEx` `GetKeyboardLayout` `MapVirtualKeyExW` `SetWindowTextW` `MonitorFromPoint` `GetKeyboardState` `EnumDisplayMonitors` `GetRawInputData` `AdjustWindowRect` `GetForegroundWindow` `DrawTextW` `GetWindowDC` `OffsetRect` `RegisterTouchWindow` `IsWindow` `AdjustWindowRectEx` `FlashWindowEx` `GetMenuBarInfo` `DestroyMenu` `DrawIconEx` `CheckMenuItem` `GetActiveWindow` `UpdateWindow` `InvalidateRect` `SetCursorPos` `RemoveMenu` `LoadCursorW` `InvalidateRgn` `GetWindowPlacement` `CreatePopupMenu` `DestroyWindow` `TranslateAcceleratorW` `CreateMenu` `SetMenu` `DrawMenuBar` `RegisterClassExW` `CreateWindowExW` `SetWindowPlacement` `ChangeDisplaySettingsExW` `GetUpdateRect` `MapVirtualKeyW` `ValidateRect` `SetCursor` `CloseTouchInputHandle` `GetTouchInputInfo` `TrackMouseEvent` `SystemParametersInfoW` `SetMenuItemInfoW` `FillRect` `AppendMenuW` `GetSystemMetrics` `InsertMenuW` `GetMonitorInfoW` `MonitorFromRect` `MonitorFromWindow` `GetCursorPos` `ClientToScreen` `GetClientRect` `ScreenToClient` `TrackPopupMenu` `DefWindowProcW` `PostThreadMessageW` `PeekMessageW` `DispatchMessageW` `GetMessageW` `IsIconic` `RedrawWindow` `SendMessageW` `PostQuitMessage` `PostMessageW` `CreateAcceleratorTableW` `DestroyAcceleratorTable` `GetMenuItemInfoW` `EnumChildWindows` `CreateIcon` `SystemParametersInfoA` `SetWindowPos` `GetAsyncKeyState`
dwmapi.dll	`DwmGetWindowAttribute` `DwmEnableBlurBehindWindow` `DwmSetWindowAttribute`
api-ms-win-core-synch-l1-2-0.dll	`WakeByAddressAll` `WakeByAddressSingle` `WaitOnAddress`
ole32.dll	`CoUninitialize` `CoTaskMemFree` `CoCreateInstance` `RegisterDragDrop` `CoInitialize` `CoTaskMemAlloc` `OleInitialize` `CoCreateFreeThreadedMarshaler` `RevokeDragDrop` `CoInitializeEx`
comctl32.dll	`SetWindowSubclass` `RemoveWindowSubclass` `TaskDialogIndirect` `DefSubclassProc`
shlwapi.dll	`SHCreateMemStream`
gdi32.dll	`CreateCompatibleDC` `SelectObject` `CreateDIBSection` `CreateSolidBrush` `BitBlt` `GetDeviceCaps` `DeleteDC` `SetBkMode` `CombineRgn` `CreateRectRgn` `DeleteObject` `SetTextColor`
shell32.dll	`DragFinish` `ILCreateFromPathW` `SHOpenFolderAndSelectItems` `ShellExecuteExW` `SHCreateItemFromParsingName` `SHGetKnownFolderPath` `ShellExecuteW` `ILFree` `DragQueryFileW` `SHAppBarMessage`
oleaut32.dll	`SysStringLen` `GetErrorInfo` `SetErrorInfo` `SysFreeString`
ws2_32.dll	`freeaddrinfo` `getaddrinfo` `WSACleanup` `socket` `WSAGetLastError` `shutdown` `listen` `bind` `WSASocketW` `WSAStartup` `connect` `ioctlsocket` `setsockopt` `send` `WSASend` `recv` `getsockname` `getpeername` `accept` `getsockopt` `closesocket` `WSAIoctl`
KERNEL32.dll	`SetUnhandledExceptionFilter` `InitializeSListHead` `DeleteCriticalSection` `RtlVirtualUnwind` `GetEnvironmentVariableW` `HeapReAlloc` `GetCurrentProcess` `WideCharToMultiByte` `GetCurrentProcessId` `CreateMutexA` `ReleaseMutex` `SetFilePointerEx` `SetFileInformationByHandle` `SetFileTime` `DuplicateHandle` `AddVectoredExceptionHandler` `SetThreadStackGuarantee` `GetCurrentThread` `SetLastError` `GetCurrentDirectoryW` `GetEnvironmentStringsW` `GetCommandLineW` `RtlUnwindEx` `CopyFileExW` `MoveFileExW` `CreateDirectoryW` `GetFinalPathNameByHandleW` `GetFileInformationByHandleEx` `SwitchToThread` `CreateEventW` `DeleteFileW` `FindFirstFileExW` `FindClose` `SetEnvironmentVariableW` `GetFullPathNameW` `GetTempPathW` `ExitProcess` `QueryPerformanceFrequency` `MultiByteToWideChar` `WriteConsoleW` `GetStdHandle` `GetConsoleOutputCP` `CreateWaitableTimerExW` `SetWaitableTimer` `CreateThread` `WaitForMultipleObjects` `ReadFileEx` `InitializeCriticalSectionEx` `SleepEx` `FreeEnvironmentStringsW` `CompareStringOrdinal` `FindNextFileW` `RtlLookupFunctionEntry` `RtlCaptureContext` `GetExitCodeProcess` `GetSystemInfo` `QueryPerformanceCounter` `GetSystemTimePreciseAsFileTime` `WriteFileEx` `CreateProcessW` `GetWindowsDirectoryW` `GetSystemDirectoryW`
bcrypt.dll	`BCryptGenRandom`
ADVAPI32.dll	`SystemFunction036` `EventSetInformation` `EventWriteTransfer` `EventUnregister` `EventRegister`
api-ms-win-crt-math-l1-1-0.dll	`pow` `roundf` `floor` `__setusermatherr` `round` `trunc`
api-ms-win-crt-runtime-l1-1-0.dll	`_cexit` `_c_exit` `__p___argc` `_exit` `exit` `_register_thread_local_exe_atexit_callback` `_initialize_onexit_table` `_register_onexit_function` `_crt_atexit` `terminate` `_initterm_e` `_initterm` `abort` `_get_initial_narrow_environment` `_initialize_narrow_environment` `_configure_narrow_argv` `_set_app_type` `_seh_filter_exe` `__p___argv` `_wassert`
api-ms-win-crt-heap-l1-1-0.dll	`malloc` `free` `calloc` `_set_new_mode` `_callnewh`
api-ms-win-crt-string-l1-1-0.dll	`strcpy_s` `wcscmp` `wcslen` `_wcsicmp` `strlen`
api-ms-win-crt-convert-l1-1-0.dll	`_wtoi` `wcstol` `_ultow_s`
api-ms-win-crt-stdio-l1-1-0.dll	`_set_fmode` `__p__commode`
api-ms-win-crt-locale-l1-1-0.dll	`_configthreadlocale`

Delayed Imports

1

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x16316`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.988`
Detected Filetype	PNG graphic file
MD5	`f838113f610fcb0f5b6f4626778ec1fb`
SHA1	`14766a34503e56f0ddf245da0f56590ee3dcac14`
SHA256	`a2786a0e83ce6cb4ddc2d4cf3d4aae79f4c305d711369699318d6dd4eb38a53b`
SHA3	`fe1311c38f0b7c7345c05c5e6955ac7fa300d75b2bac7751d45f90d742f8af5b`

32512

Type	`RT_GROUP_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x14`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`1.59047`
Detected Filetype	Icon file
MD5	`64afce67ccb3e8d2aae9a59f817ae3d3`
SHA1	`93a8db5131f80411b012906d0edd396c68bab28c`
SHA256	`3a481211390213b59449e75a6281925504630305ccd329c7e847969561b6c790`
SHA3	`76e35cc0907f0f62e98c7086675ee73635bd292b03d6b4fc7e6b70806baca841`

1 (#2)

Type	`RT_VERSION`
Language	English - United States
Codepage	UNKNOWN
Size	`0x1c0`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.06563`
MD5	`aaf91ca3e330168ec17b2c95ada05acd`
SHA1	`a88acb395568eee9a67ff9203a3bf37cf4fce65b`
SHA256	`c80ea18821a957e5d7d6babeeec4d4e5e8e6c0756ffbe32aa81cb1a54a4e5792`
SHA3	`86062f0cbb1ec82d7dc46298963e47e15efa934eaa4a14ef5f8c57c7e4694108`

1 (#3)

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x227`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.94436`
MD5	`2b352aa9d9c56b913da10b3e59bdf096`
SHA1	`9b2df5b38542aef50058e2f38f98884103b58900`
SHA256	`03bbdee05319634b5a1a264e77dcfb0528de7a20d59e9246cccc93c68d4f7b83`
SHA3	`721467542c298413497a91bbd031dc0c431784ebc020523d69aa54911970975b`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.0.0.0
ProductVersion	1.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT` `VOS_NT_WINDOWS32` `VOS_WINCE` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
CompanyName	savage
FileDescription	ui
FileVersion (#2)	1.0.0
ProductName	ui
ProductVersion (#2)	1.0.0

Resource LangID	English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2026-May-29 12:47:17
Version	`0.0`
SizeofData	`31`
AddressOfRawData	`0xd4f34c`
PointerToRawData	`0xd4d94c`
Referenced File	ui.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics	`0`
TimeDateStamp	2026-May-29 12:47:17
Version	`0.0`
SizeofData	`20`
AddressOfRawData	`0xd4f36c`
PointerToRawData	`0xd4d96c`

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2026-May-29 12:47:17
Version	`0.0`
SizeofData	`1048`
AddressOfRawData	`0xd4f380`
PointerToRawData	`0xd4d980`

TLS Callbacks

StartAddressOfRawData	`0x140d4f7e0`
EndAddressOfRawData	`0x140d4f9f4`
AddressOfIndex	`0x140f8c2b0`
AddressOfCallbacks	`0x1409f7cd8`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_8BYTES`
Callbacks	`0x0000000140925E90`

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x140f89d80`

RICH Header

XOR Key	`0xef0ba0f8`
Unmarked objects	`0`
Imports (VS2008 SP1 build 30729)	`14`
ASM objects (35403)	`9`
C objects (35403)	`13`
C++ objects (35403)	`46`
Imports (33145)	`7`
Total imports	`459`
C objects (35728)	`96`
Unmarked objects (#2)	`736`
Resource objects (35728)	`1`
Linker (35728)	`1`

Errors

Leave a comment

No comments yet.