Manalyze report for d4b6bffd06c47e756386cca4c47ff5bf029458599208f03572ea2f47be8fa523

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Nov-01 12:46:52
Detected languages	English - United States
TLS Callbacks	3 callback(s) detected.

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`Contains another PE executable: This program cannot be run in DOS mode.` `Contains domain names: gcc.gnu.org https://gcc.gnu.org https://gcc.gnu.org/bugs/`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to SHA256` `Uses constants related to RC5 or RC6` `Uses known Mersenne Twister constants`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryA` `Functions which can be used for anti-debugging purposes: CheckRemoteDebuggerPresent CreateToolhelp32Snapshot FindWindowW` `Code injection capabilities: CreateRemoteThread OpenProcess VirtualAllocEx WriteProcessMemory` `Code injection capabilities (process hollowing): ResumeThread SetThreadContext WriteProcessMemory` `Can create temporary files: CreateFileA CreateFileW GetTempPathA GetTempPathW` `Memory manipulation functions often used by packers: VirtualAllocEx VirtualProtect` `Leverages the raw socket API to access the Internet: WS2_32.dll` `Functions related to the privilege level: AdjustTokenPrivileges OpenProcessToken` `Manipulates other processes: OpenProcess Process32FirstW Process32NextW WriteProcessMemory` `Can take screenshots: BitBlt CreateCompatibleDC FindWindowW`
Malicious	The PE is possibly a dropper.	`Resource 101 detected as a PE Executable.`
Malicious	VirusTotal score: 9/71 (Scanned on 2026-11-01 13:40:28)	`Bkav: W32.Malware.2C186CE` `CrowdStrike: win/malicious_confidence_70% (D)` `Cylance: Unsafe` `Elastic: malicious (high confidence)` `Kaspersky: HEUR:Trojan.Win64.Generic` `MaxSecure: Trojan.Malware.300983.susgen` `McAfeeD: ti!D4B6BFFD06C4` `SentinelOne: Static AI - Suspicious PE` `Symantec: ML.Attribute.HighConfidence`

Hashes

MD5	`767395e5b285f1fbe8abfeb3344c8a2d` 🔍
SHA1	`1cfddb16d6544300b83e3302ac9da04804e9105b` 🔍
SHA256	`d4b6bffd06c47e756386cca4c47ff5bf029458599208f03572ea2f47be8fa523` 🔍
SHA3	`e472995a112144eb9c729877f7c987c01af5fbb30e3908081755950b9fb8769d` 🔍
SSDeep	`49152:NTfkC1WGE1E5v04yQJennE53UB4QxcuLCjQFmCwnWnEWS2ED8savnZWV:NLISH4eacuqSmBX` 🔍
Imports Hash	`af9ad9abc57d32bc3f5c74fd6d2dbcd3` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`11`
TimeDateStamp	2026-Nov-01 12:46:52
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_DEBUG_STRIPPED` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`2.0`
SizeOfCode	`0x169600`
SizeOfInitializedData	`0x1d7000`
SizeOfUninitializedData	`0xe00`
AddressOfEntryPoint	`0x0000000000001030 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`5.2`
Win32VersionValue	`0`
SizeOfImage	`0x348000`
SizeOfHeaders	`0x400`
Checksum	`0x34c69b`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT`
SizeofStackReserve	`0x200000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`f5c307acea781d028c86929d60fe238a 🔍`
SHA1	`ad247c630c0b898e006b639dad0a0cf8bb48fec4 🔍`
SHA256	`57acf92820404634acfc8cb0af265fa4ccaaba897ec5d289656307ed6966262b 🔍`
SHA3	`1311b3fb1dc372f75a17309be1ae19b8c293765a2434f03a4e91cae8a98f37d3 🔍`
VirtualSize	`0x1695c0`
VirtualAddress	`0x1000`
SizeOfRawData	`0x169600`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.21673`

.data

MD5	`7b27b035508da8f342aafdbf7f07908a 🔍`
SHA1	`88086aa27c0dcf8c5505a071e6e0de7a1aed8ef5 🔍`
SHA256	`2b3b9be9b641c63c729326a43b6acb1e10a8fafd51a317f4a5ad8c0882af6762 🔍`
SHA3	`5bc91d37a0d690206d1cf10af4d57806c4796114adeeb143f34753fa6a7c001a 🔍`
VirtualSize	`0x89a0`
VirtualAddress	`0x16b000`
SizeOfRawData	`0x8a00`
PointerToRawData	`0x169a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.17771`

.rdata

MD5	`b3a5dc24b637905fc4f9030327dd6900 🔍`
SHA1	`e5e144d2676e6417c39c1d9d835b9241f96d60e9 🔍`
SHA256	`0f2c89addfc9775b095a8a50b977f5ff8086d8ff7cbddaa1b6e76316d0cb4d2b 🔍`
SHA3	`dc3a14c24c79739018630169434f6b405dccb2ddb5892d13b0eb494b3d4d8a8f 🔍`
VirtualSize	`0x55690`
VirtualAddress	`0x174000`
SizeOfRawData	`0x55800`
PointerToRawData	`0x172400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.65522`

.eh_fram

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x4`
VirtualAddress	`0x1ca000`
SizeOfRawData	`0x200`
PointerToRawData	`0x1c7c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.pdata

MD5	`acb38b06f5dc90b9530c92737c001392 🔍`
SHA1	`4e3d70b7617d1e67c8b49da38d65afb96798fbb8 🔍`
SHA256	`1d3073c4b265bd3dc51eb25781a80a747ec92c98a3bfde6896fd3651af0dae8e 🔍`
SHA3	`20d27b3b5980d22b11351d119cba47a64e15e570ededd8091a9ac2ed872f444c 🔍`
VirtualSize	`0xf000`
VirtualAddress	`0x1cb000`
SizeOfRawData	`0xf000`
PointerToRawData	`0x1c7e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.10416`

.xdata

MD5	`141a7536d524dbbdc0bc98a8fce43c39 🔍`
SHA1	`c27756bdcf212179597dddc3eb191309281a5f0f 🔍`
SHA256	`afed93d38473be17d3ba5d050bfcb52927495f1e70a7c2aa12f28812306dc882 🔍`
SHA3	`439100130ed609bf3de34b4c73ab0da0b0b2d8bb4803d4aa6814d50f931f1004 🔍`
VirtualSize	`0x18d48`
VirtualAddress	`0x1da000`
SizeOfRawData	`0x18e00`
PointerToRawData	`0x1d6e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.19291`

.bss

MD5	`d41d8cd98f00b204e9800998ecf8427e 🔍`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍`
VirtualSize	`0xc10`
VirtualAddress	`0x1f3000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.idata

MD5	`af8bf380181cef2a18452cb176efceab 🔍`
SHA1	`d3da9135beaa6e7cdd0895e88f300563bf7ff707 🔍`
SHA256	`3bf6664208ec443882db9e3fd7c80ccf09070c59b149b1b1914e3e0208961bd4 🔍`
SHA3	`d6b89e1c7117d23c90500563f5220a5612d1be990958fed636e245cce3eec3a9 🔍`
VirtualSize	`0x308c`
VirtualAddress	`0x1f4000`
SizeOfRawData	`0x3200`
PointerToRawData	`0x1efc00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.5354`

.tls

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x10`
VirtualAddress	`0x1f8000`
SizeOfRawData	`0x200`
PointerToRawData	`0x1f2e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`d929167562d6a86079fd7316b82b07a4 🔍`
SHA1	`da2cdc34457cd00b96020be3b004aa2e98273d9a 🔍`
SHA256	`757c0976f34e682ad434049c04fdd6f7828b9e240be00674e9efabeb6def8fd3 🔍`
SHA3	`f55edde256a0c226c8a765faee080d403ea6eb84c76887c1c6999ac2e0bad2fb 🔍`
VirtualSize	`0x14c298`
VirtualAddress	`0x1f9000`
SizeOfRawData	`0x14c298`
PointerToRawData	`0x1f3000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.27838`

.reloc

MD5	`d77586d57a48c716b068db9f95221f61 🔍`
SHA1	`cc84963261d44fa69f7f0ea16adee5b5b7792e50 🔍`
SHA256	`b95a541d78749f90e3567b630421fa1f3acfe99066cb68c73d06ee68e8c0a2dc 🔍`
SHA3	`0b769f72d7b27f2ac031f72165865a96ef3cf1436d96e0c9446f91237f929d11 🔍`
VirtualSize	`0x1568`
VirtualAddress	`0x346000`
SizeOfRawData	`0x1600`
PointerToRawData	`0x33f400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.42149`

Imports

ADVAPI32.dll	`AdjustTokenPrivileges` `LookupPrivilegeValueW` `OpenProcessToken`
GDI32.dll	`BitBlt` `CreateCompatibleBitmap` `CreateCompatibleDC` `DeleteDC` `DeleteObject` `SelectObject`
gdiplus.dll	`GdipAddPathArc` `GdipAlloc` `GdipCloneBrush` `GdipClosePathFigure` `GdipCreateFont` `GdipCreateFontFamilyFromName` `GdipCreateFromHDC` `GdipCreatePath` `GdipCreatePen1` `GdipCreateSolidFill` `GdipCreateStringFormat` `GdipDeleteBrush` `GdipDeleteFont` `GdipDeleteFontFamily` `GdipDeleteGraphics` `GdipDeletePath` `GdipDeletePen` `GdipDeleteStringFormat` `GdipDrawArc` `GdipDrawPath` `GdipDrawPolygon` `GdipDrawRectangleI` `GdipDrawString` `GdipFillEllipse` `GdipFillPath` `GdipFillRectangle` `GdipFillRectangleI` `GdipFree` `GdipSetPenLineJoin` `GdipSetSmoothingMode` `GdipSetStringFormatAlign` `GdipSetStringFormatLineAlign` `GdipSetTextRenderingHint` `GdiplusShutdown` `GdiplusStartup`
KERNEL32.dll	`CheckRemoteDebuggerPresent` `CloseHandle` `CreateDirectoryA` `CreateEventA` `CreateFileA` `CreateFileW` `CreateHardLinkW` `CreateRemoteThread` `CreateSemaphoreA` `CreateToolhelp32Snapshot` `DeleteCriticalSection` `DeleteFileA` `DeleteFileW` `DuplicateHandle` `EnterCriticalSection` `FindClose` `FindFirstFileA` `FindNextFileA` `FindResourceW` `FlushInstructionCache` `FormatMessageA` `FreeEnvironmentStringsA` `FreeLibrary` `GetCurrentProcess` `GetCurrentProcessId` `GetCurrentThread` `GetCurrentThreadId` `GetDiskFreeSpaceExW` `GetEnvironmentStrings` `GetEnvironmentVariableA` `GetExitCodeProcess` `GetExitCodeThread` `GetFileAttributesA` `GetFileAttributesW` `GetFileInformationByHandle` `GetFileSizeEx` `GetFullPathNameW` `GetLastError` `GetLocalTime` `GetModuleFileNameA` `GetModuleFileNameW` `GetModuleHandleA` `GetModuleHandleW` `GetProcAddress` `GetProcessAffinityMask` `GetStartupInfoW` `GetSystemInfo` `GetSystemTimeAsFileTime` `GetTempPathA` `GetTempPathW` `GetThreadContext` `GetThreadPriority` `GetTickCount` `GetTickCount64` `GlobalMemoryStatusEx` `InitializeCriticalSection` `IsDebuggerPresent` `LeaveCriticalSection` `LoadLibraryA` `LoadResource` `LocalFree` `LockResource` `MoveFileExW` `MultiByteToWideChar` `OpenEventW` `OpenProcess` `OutputDebugStringA` `Process32FirstW` `Process32NextW` `ProcessIdToSessionId` `QueryPerformanceCounter` `QueryPerformanceFrequency` `RaiseException` `ReadFile` `ReleaseSemaphore` `RemoveDirectoryA` `RemoveDirectoryW` `ResetEvent` `ResumeThread` `RtlCaptureContext` `RtlLookupFunctionEntry` `RtlUnwindEx` `RtlVirtualUnwind` `SetEvent` `SetFileAttributesA` `SetLastError` `SetProcessAffinityMask` `SetThreadContext` `SetThreadPriority` `SetUnhandledExceptionFilter` `SizeofResource` `Sleep` `SuspendThread` `TlsAlloc` `TlsGetValue` `TlsSetValue` `TryEnterCriticalSection` `VirtualAllocEx` `VirtualFreeEx` `VirtualProtect` `VirtualQuery` `WaitForMultipleObjects` `WaitForSingleObject` `WriteFile` `WriteProcessMemory` `__C_specific_handler` `lstrcmpiW`
api-ms-win-crt-convert-l1-1-0.dll	`mbrtowc` `mbsrtowcs` `strtoul` `wcrtomb`
api-ms-win-crt-environment-l1-1-0.dll	`__p__wenviron` `_wdupenv_s` `_wgetcwd` `getenv`
api-ms-win-crt-filesystem-l1-1-0.dll	`_findclose` `_fstat64` `_lock_file` `_unlock_file` `_wchdir` `_wchmod` `_wfindfirst64i32` `_wfindnext64i32` `_wfullpath` `_wmkdir` `_wstat64`
api-ms-win-crt-heap-l1-1-0.dll	`_set_new_mode` `calloc` `free` `malloc` `realloc`
api-ms-win-crt-locale-l1-1-0.dll	`___mb_cur_max_func` `_configthreadlocale` `localeconv` `setlocale`
api-ms-win-crt-math-l1-1-0.dll	`__setusermatherr` `_fdopen` `cosf` `sinf`
api-ms-win-crt-private-l1-1-0.dll	`__intrinsic_setjmp` `longjmp` `memchr` `memcmp` `memcpy` `memmove` `strchr`
api-ms-win-crt-runtime-l1-1-0.dll	`__p___argc` `__p___wargv` `__p__wcmdln` `_assert` `_beginthreadex` `_cexit` `_configure_wide_argv` `_crt_atexit` `_endthreadex` `_errno` `_exit` `_get_errno` `_set_app_type` `_initialize_wide_environment` `_initterm` `_initterm_e` `_set_errno` `_set_invalid_parameter_handler` `abort` `exit` `signal` `strerror`
api-ms-win-crt-stdio-l1-1-0.dll	`__acrt_iob_func` `__p__commode` `__p__fmode` `__stdio_common_vfprintf` `__stdio_common_vfwprintf` `__stdio_common_vsprintf` `_chsize_s` `_close` `_fileno` `_get_osfhandle` `_lseeki64` `_read` `_setmode` `_wfopen` `_wopen` `_write` `fclose` `fflush` `fopen` `fputc` `fputs` `fputwc` `fread` `fwrite` `setvbuf`
api-ms-win-crt-string-l1-1-0.dll	`_strdup` `_stricmp` `isalnum` `iswctype` `memset` `strcmp` `strcoll` `strlen` `strncmp` `strnlen` `strxfrm` `tolower` `towlower` `towupper` `wcscat` `wcscmp` `wcscoll` `wcscpy` `wcslen` `wcsnlen` `wcsxfrm` `wctype`
api-ms-win-crt-time-l1-1-0.dll	`_wutime64` `strftime` `wcsftime`
api-ms-win-crt-utility-l1-1-0.dll	`rand_s`
Secur32.dll	`AcquireCredentialsHandleA` `DecryptMessage` `DeleteSecurityContext` `EncryptMessage` `FreeContextBuffer` `FreeCredentialsHandle` `InitializeSecurityContextA` `QueryContextAttributesA`
USER32.dll	`BeginPaint` `CreateWindowExW` `DefWindowProcW` `DispatchMessageW` `EndPaint` `EnumWindows` `FindWindowW` `GetCursorPos` `GetMessageW` `GetSystemMetrics` `GetWindowTextW` `GetWindowThreadProcessId` `InvalidateRect` `IsWindowVisible` `KillTimer` `LoadCursorW` `PostQuitMessage` `RegisterClassExW` `ReleaseCapture` `SetCapture` `SetCursor` `SetTimer` `SetWindowPos` `ShowWindow` `TranslateMessage` `UpdateWindow`
WS2_32.dll	`WSAStartup` `closesocket` `connect` `freeaddrinfo` `getaddrinfo` `recv` `send` `setsockopt` `socket`

Delayed Imports

101

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x14b800`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`6.2741`
Detected Filetype	PE Executable
MD5	`d6115b31000d48a4c9e8c86dbc6c5aea 🔍`
SHA1	`03f81f19b55e4fa42e9d49df83ccd3f2ced7dbc0 🔍`
SHA256	`3cfb286a66a215ccbab82166f7667fd4fb933495f2782d349e6dd7a1e0d6970c 🔍`
SHA3	`d9d58d3ea17a703a3594e56505181dc6357f06c48e33c9d4199ca7cce2eb4bb3 🔍`

1

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x747`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.15732`
MD5	`3505d107a2a41a318904c45b80168a46 🔍`
SHA1	`992aa1c99a4f8ef2f11a404b0d091c89565ca770 🔍`
SHA256	`edfeae7ebadcb97e3eba5a964e75d1f7855809e791f7e01e1a3c7937f336dfc3 🔍`
SHA3	`35f760374afa34cc867346fc65b8e7d2665dda2f949dd1f6db511f5edc58951a 🔍`

1 (#2)

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x257`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.04147`
MD5	`f850e84490dc41c5d338603995669c51 🔍`
SHA1	`30bd7d8bdea468695a155f550736e200b3ee97f8 🔍`
SHA256	`c49e12b411ba820555aa7d693881fb66907e32f8e0c27c0908955f12f24f1254 🔍`
SHA3	`e6b2a0361666e50dcbfe97b05273fdb348b8b45d3648747162e127a892d20f09 🔍`

Version Info

TLS Callbacks

StartAddressOfRawData	`0x1401f8000`
EndAddressOfRawData	`0x1401f8008`
AddressOfIndex	`0x1401f30c0`
AddressOfCallbacks	`0x1401c9660`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_TYPE_REG`
Callbacks	`0x000000014000DEE0` `0x000000014000DF99` `0x0000000140021AED`

Load Configuration

RICH Header

Errors

[*] Warning: Section .bss has a size of 0!

Leave a comment

No comments yet.