def1c2f12307d598e42506a55f1a06ed5e652af0d260aac9572469429f10d04d

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2018-May-21 11:01:11
Detected languages English - United States
Process Default Language
Debug artifacts C:\Users\Ton\Documents\Visual Studio 2017\Projects\Xenos\build\Win32\Release\Xenos.pdb
FileDescription PE injector
FileVersion 2.3.2.0
InternalName Xenos.exe
LegalCopyright Copyright (C) 2017
OriginalFilename Xenos.exe
ProductName Xenos
ProductVersion 2.3.2.0

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ v6.0 DLL
Microsoft Visual C++ 6.0 - 8.0
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to system / monitoring tools:
  • Bcdedit.exe
 May have dropper capabilities:
  • CurrentControlSet\Services
 Contains another PE executable:
  • This program cannot be run in DOS mode.
 Miscellaneous malware strings:
  • cmd.exe
 Contains domain names:
  • http://msdl.microsoft.com
  • http://msdl.microsoft.com/download/symbols
  • microsoft.com
  • msdl.microsoft.com
Info Cryptographic algorithms detected in the binary: Uses constants related to SHA1
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryW
  • GetProcAddress
  • LoadLibraryExW
 Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
  • SwitchToThread
 Code injection capabilities:
  • VirtualAlloc
  • VirtualAllocEx
  • OpenProcess
  • WriteProcessMemory
  • CreateRemoteThread
 Code injection capabilities (process hollowing):
  • ResumeThread
  • WriteProcessMemory
  • SetThreadContext
 Code injection capabilities (mapping injection):
  • CreateFileMappingW
  • MapViewOfFile
  • CreateRemoteThread
 Can access the registry:
  • SHDeleteKeyW
  • RegCreateKeyW
  • RegOpenKeyExW
  • RegEnumValueW
  • RegOpenKeyW
  • RegSetValueExW
  • RegCloseKey
  • RegQueryValueExW
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • CreateFileW
  • GetTempPathW
 Memory manipulation functions often used by packers:
  • VirtualProtect
  • VirtualAlloc
  • VirtualAllocEx
  • VirtualProtectEx
 Functions related to the privilege level:
  • AdjustTokenPrivileges
  • OpenProcessToken
 Manipulates other processes:
  • Process32NextW
  • Process32FirstW
  • OpenProcess
  • WriteProcessMemory
  • ReadProcessMemory
Malicious The PE is possibly a dropper. Resource 142 detected as a PE Executable.
Resource 147 detected as a PE Executable.
Resource 149 detected as a PE Executable.
Resource 150 detected as a PE Executable.
Malicious VirusTotal score: 56/71 (Scanned on 2026-10-18 05:10:59) ALYac: Gen:Variant.Application.GenericFCA.7763
AVG: Win64:UnwantedX-gen [PUP]
AhnLab-V3: Malware/Win.Generic.R414074
Antiy-AVL: HackTool/Win32.Gamehack
Arcabit: Trojan.Application.GenericFCA.D1E53
Avast: Win64:UnwantedX-gen [PUP]
Avira: PUA/W32.UnwantedX
BitDefender: Gen:Variant.Application.GenericFCA.7763
Bkav: W32.Malware.4A73AC08
CTX: exe.trojan.generic
ClamAV: Win.Packed.Wacatac-9761042-0
CrowdStrike: win/malicious_confidence_100% (W)
Cylance: Unsafe
Cynet: Malicious (score: 100)
DeepInstinct: MALICIOUS
DrWeb: Tool.BlackBone.5
ESET-NOD32: Win32/DllInject.LJ potentially unsafe application
Elastic: malicious (high confidence)
Emsisoft: Gen:Variant.Application.GenericFCA.7763 (B)
F-Secure: PotentialRisk.PUA/W32.UnwantedX
Fortinet: W32/Kryptik.GAMH!tr
GData: Gen:Variant.Application.GenericFCA.7763
Google: Detected
Gridinsoft: Trojan.Win32.Agent.dg
Ikarus: Trojan.Detrahere
Jiangmin: SPR.GameInject.a
K7AntiVirus: Trojan ( 0056f4061 )
K7GW: Trojan ( 0056f4061 )
Lionic: Trojan.Win32.BlackBone.4!c
Malwarebytes: Trojan.Injector
MaxSecure: Trojan.Malware.73703108.susgen
MicroWorld-eScan: Gen:Variant.Application.GenericFCA.7763
Microsoft: Program:Win32/Unwaders.C!rfn
NANO-Antivirus: Trojan.Win32.Kryptik.hoiuck
Paloalto: generic.ml
Rising: HackTool.BlackBone!1.D7EA (CLASSIC)
SUPERAntiSpyware: Trojan.Agent/GenericKD
Sangfor: Virus.Win32.Save.a
SentinelOne: Static AI - Suspicious PE
Skyhigh: GenericRXHQ-AA!4731B90DB56F
Sophos: BlackBone (PUA)
Symantec: SecurityRisk.Gen
Tencent: Malware.Win32.Gencirc.10bdda61
Trapmine: malicious.high.ml.score
TrellixENS: GenericRXHQ-AA!4731B90DB56F
TrendMicro: TROJ_GEN.R03FC0DC721
TrendMicro-HouseCall: TROJ_GEN.R03FC0DC721
VBA32: BScope.Trojan.Kryptik
VIPRE: Gen:Variant.Application.GenericFCA.7763
Varist: W32/ABApplication.FOZL-2859
VirIT: PUP.Win32.Xenos.A
Webroot: W32.Trojan.Gen
Xcitium: Malware@#18grhao8k00hu
Yandex: Trojan.Igent.bU3Skj.10
alibabacloud: HackTool:Win/Tiggre
huorong: Trojan/Agent.ambn!crit

Hashes

MD5 4731b90db56fc5dd654d59deca1009e6 🔍
SHA1 7c486d696813b1e0102f2feb300e6c6a7610287c 🔍
SHA256 def1c2f12307d598e42506a55f1a06ed5e652af0d260aac9572469429f10d04d 🔍
SHA3 2ba3e3d4d1f0cee572aefc948af45b30c5d91af367bbdf825221fd99e2084b66 🔍
SSDeep 24576:F6vLpf9LJiOm0xg2VkVtw099I98mzGokH/Ngwpsu+VfSVgPCS3tMrMyj3F9hIF1:afJWVD99U8okH/NSVRSVE3tMx3FE1S0 🔍
Imports Hash 2c4f8364dc2c225221cd7dc66caea7e0 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 2018-May-21 11:01:11
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0x9f600
SizeOfInitializedData 0x81400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0005F40D (Section: .text)
BaseOfCode 0x1000
BaseOfData 0xa1000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x124000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 7bf139f2d7d42c16416d0ea8808bb7fd 🔍
SHA1 9de9c3e0d5161535032351827707461182e0a93f 🔍
SHA256 a8d57da24050ce8158d65a8a036adaaad015ac95e52cbcd8fd155be3963f2a04 🔍
SHA3 8238001d592c68c90f45a1246fbe219688b14cb6083174f33bd07c893fcd6ab3 🔍
VirtualSize 0x9f45b
VirtualAddress 0x1000
SizeOfRawData 0x9f600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.60541

.rdata

MD5 2386eb8a0a694b0ea282462174938b07 🔍
SHA1 040909932970df9da78034590d4fc38ef5aa75d5 🔍
SHA256 10ef5f94662fe60361830173079d548548b78fd4190a6996d42d32490535daeb 🔍
SHA3 d3b0db295281cc02bceae186ffee8cb1e604217a9422834247eb510b39d38459 🔍
VirtualSize 0x2c396
VirtualAddress 0xa1000
SizeOfRawData 0x2c400
PointerToRawData 0x9fa00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.78283

.data

MD5 7c65abec0f39023befa31e9ad35854f6 🔍
SHA1 0c9ee18746fb578d30bdf893ce96ef649ea7d38a 🔍
SHA256 9726d959263b7c5af4d16a71f32a14469ff919a30b7ad35cdf4343890098f1e1 🔍
SHA3 ac9d3649617a0e6b28bb84dc09a96a143830385f1d6cfcd62d911d959bdc9d85 🔍
VirtualSize 0x49d0
VirtualAddress 0xce000
SizeOfRawData 0x3000
PointerToRawData 0xcbe00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.75139

.rsrc

MD5 755b5ed5e748d2894e60d9803a7fe453 🔍
SHA1 517b368b526aab2b99814289325ad0fd3ab07139 🔍
SHA256 47edd9df3a6714558c270f0f6cae0540eac3b53178c1174ce4c0df30c07f8495 🔍
SHA3 13c098bba943ddb0620771278c919851ba28a92e6f008c24cf19f3073d984734 🔍
VirtualSize 0x50590
VirtualAddress 0xd3000
SizeOfRawData 0x50600
PointerToRawData 0xcee00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.16186

Imports

SHLWAPI.dll SHDeleteKeyW
SHSetValueW
dbghelp.dll MiniDumpWriteDump
KERNEL32.dll RaiseException
LoadResource
FindResourceW
DecodePointer
GetWindowsDirectoryW
DeleteCriticalSection
CreateProcessW
GetCurrentProcess
GetModuleFileNameW
WaitForSingleObject
GetCurrentThreadId
Sleep
CreateThread
GetLocalTime
ExitProcess
GetCurrentProcessId
SetUnhandledExceptionFilter
FlushFileBuffers
GetFileAttributesW
ResumeThread
CloseHandle
GetNativeSystemInfo
GetModuleHandleW
DeleteFileW
LockResource
GetLastError
Wow64RevertWow64FsRedirection
CreateFileW
InitializeCriticalSectionEx
Wow64DisableWow64FsRedirection
WriteFile
VirtualProtect
SetEndOfFile
WriteConsoleW
ReadConsoleW
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
GetTimeZoneInformation
SetFilePointerEx
EnumSystemLocalesW
SizeofResource
GetCommandLineW
GetCurrentDirectoryW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
HeapFree
GetConsoleMode
GetConsoleCP
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
MultiByteToWideChar
FormatMessageW
LocalFree
WideCharToMultiByte
DeviceIoControl
GetSystemTimeAsFileTime
QueryPerformanceCounter
VirtualFree
VirtualAlloc
TerminateProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetExitCodeProcess
Thread32Next
Thread32First
CreateActCtxW
GetTempPathW
UnmapViewOfFile
GetTempFileNameW
CreateFileMappingW
ReleaseActCtx
MapViewOfFile
DuplicateHandle
ResetEvent
GetTickCount
LoadLibraryW
GetProcAddress
FreeLibrary
GetCurrentThread
GetSystemInfo
VirtualAllocEx
VirtualFreeEx
ActivateActCtx
GetEnvironmentVariableW
GetSystemDirectoryW
DeactivateActCtx
GetSystemWow64DirectoryW
Module32FirstW
ReadFile
CreateNamedPipeW
TerminateThread
GetExitCodeThread
OpenProcess
IsWow64Process
SuspendThread
GetThreadTimes
OpenThread
WriteProcessMemory
VirtualProtectEx
GetThreadContext
ReadProcessMemory
CreateRemoteThread
SetThreadContext
VirtualQueryEx
GetStringTypeW
TryEnterCriticalSection
WaitForSingleObjectEx
SwitchToThread
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
InitializeSListHead
OutputDebugStringW
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
GetVersionExW
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
ExitThread
GetModuleHandleExW
GetStdHandle
GetFileType
HeapAlloc
USER32.dll GetWindowTextW
GetMenu
CreateWindowExW
DestroyIcon
LoadIconW
ChangeWindowMessageFilterEx
EnableMenuItem
wsprintfW
GetMessageW
CreateDialogParamW
CallWindowProcW
DestroyWindow
MessageBoxW
SendMessageW
EndDialog
SetWindowTextW
LoadAcceleratorsW
ShowWindow
IsWindow
DispatchMessageW
IsDialogMessageW
TranslateAcceleratorW
TranslateMessage
SendMessageA
SetWindowLongW
GetDlgItem
DialogBoxParamW
EnableWindow
COMDLG32.dll GetOpenFileNameW
GetSaveFileNameW
SHELL32.dll CommandLineToArgvW
DragQueryFileW
ole32.dll CoUninitialize
CoCreateInstance
CoInitialize
ADVAPI32.dll RegCreateKeyW
RegOpenKeyExW
RegEnumValueW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenThreadToken
RegOpenKeyW
OpenProcessToken
RegSetValueExW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW

Delayed Imports

??0Assembler@asmjit@@QAE@PAURuntime@1@@Z

Ordinal 1
Address 0x48f20

??0CodeGen@asmjit@@QAE@PAURuntime@1@@Z

Ordinal 2
Address 0x56500

??0HostRuntime@asmjit@@QAE@XZ

Ordinal 3
Address 0x4ed10

??0JitRuntime@asmjit@@QAE@XZ

Ordinal 4
Address 0x4ee90

??0Runtime@asmjit@@QAE@XZ

Ordinal 5
Address 0x4ecd0

??0StaticRuntime@asmjit@@QAE@PAXI@Z

Ordinal 6
Address 0x4edc0

??0VMemMgr@asmjit@@QAE@PAX@Z

Ordinal 7
Address 0x3e700

??0X86Assembler@asmjit@@QAE@PAURuntime@1@I@Z

Ordinal 8
Address 0x4f250

??0Zone@asmjit@@QAE@I@Z

Ordinal 9
Address 0x567f0

??1Assembler@asmjit@@UAE@XZ

Ordinal 10
Address 0x48fc0

??1CodeGen@asmjit@@UAE@XZ

Ordinal 11
Address 0x56560

??1HostRuntime@asmjit@@UAE@XZ

Ordinal 12
Address 0x4ed00

??1JitRuntime@asmjit@@UAE@XZ

Ordinal 13
Address 0x4ef20

??1Runtime@asmjit@@UAE@XZ

Ordinal 14
Address 0x4ed00

??1StaticRuntime@asmjit@@UAE@XZ

Ordinal 15
Address 0x4ed00

??1VMemMgr@asmjit@@QAE@XZ

Ordinal 16
Address 0x3e770

??1X86Assembler@asmjit@@UAE@XZ

Ordinal 17
Address 0x4f280

??1Zone@asmjit@@QAE@XZ

Ordinal 18
Address 0x56810

??_FVMemMgr@asmjit@@QAEXXZ

Ordinal 19
Address 0x1f130

?_alloc@Zone@asmjit@@QAEPAXI@Z

Ordinal 20
Address 0x568f0

?_emit@X86Assembler@asmjit@@UAEIIABUOperand@2@000@Z

Ordinal 21
Address 0x4f890

?_grow@Assembler@asmjit@@QAEII@Z

Ordinal 22
Address 0x49170

?_grow@PodVectorBase@asmjit@@IAEIII@Z

Ordinal 23
Address 0x566e0

?_newLabel@Assembler@asmjit@@QAEIPAULabel@2@@Z

Ordinal 24
Address 0x49330

?_newLabelLink@Assembler@asmjit@@QAEPAULabelLink@2@XZ

Ordinal 25
Address 0x493c0

?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B

Ordinal 26
Address 0xb7fd8

?_registerIndexedLabels@Assembler@asmjit@@QAEII@Z

Ordinal 27
Address 0x49290

?_relocCode@X86Assembler@asmjit@@UBEIPAX_K@Z

Ordinal 28
Address 0x4f710

?_reserve@Assembler@asmjit@@QAEII@Z

Ordinal 29
Address 0x49210

?_reserve@PodVectorBase@asmjit@@IAEIII@Z

Ordinal 30
Address 0x56780

?_x86CondToCmovcc@asmjit@@3QBIB

Ordinal 31
Address 0xb8268

?_x86CondToJcc@asmjit@@3QBIB

Ordinal 32
Address 0xb8308

?_x86CondToSetcc@asmjit@@3QBIB

Ordinal 33
Address 0xb82b8

?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B

Ordinal 34
Address 0xb8358

?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B

Ordinal 35
Address 0xb9dc8

?_x86ReverseCond@asmjit@@3QBIB

Ordinal 36
Address 0xb8218

?add@JitRuntime@asmjit@@UAEIPAPAXPAUAssembler@2@@Z

Ordinal 37
Address 0x4ef70

?add@StaticRuntime@asmjit@@UAEIPAPAXPAUAssembler@2@@Z

Ordinal 38
Address 0x4edf0

?align@X86Assembler@asmjit@@UAEIII@Z

Ordinal 39
Address 0x4f450

?alloc@VMemMgr@asmjit@@QAEPAXII@Z

Ordinal 40
Address 0x3e7c0

?alloc@VMemUtil@asmjit@@SAPAXIPAII@Z

Ordinal 41
Address 0x3dc60

?allocProcessMemory@VMemUtil@asmjit@@SAPAXPAXIPAII@Z

Ordinal 42
Address 0x3dcc0

?allocZeroed@Zone@asmjit@@QAEPAXI@Z

Ordinal 43
Address 0x569a0

?bind@Assembler@asmjit@@UAEIABULabel@2@@Z

Ordinal 44
Address 0x49420

?callCpuId@X86CpuUtil@asmjit@@SAXIIPATX86CpuId@2@@Z

Ordinal 45
Address 0x5b840

?detect@X86CpuUtil@asmjit@@SAXPAUX86CpuInfo@2@@Z

Ordinal 46
Address 0x5b870

?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ

Ordinal 47
Address 0x58160

?dup@Zone@asmjit@@QAEPAXPBXI@Z

Ordinal 48
Address 0x569e0

?embed@Assembler@asmjit@@UAEIPBXI@Z

Ordinal 49
Address 0x49530

?embedLabel@X86Assembler@asmjit@@QAEIABULabel@2@@Z

Ordinal 50
Address 0x4f310

?emit@Assembler@asmjit@@QAEII@Z

Ordinal 51
Address 0x49690

?emit@Assembler@asmjit@@QAEIIABUOperand@2@00@Z

Ordinal 52
Address 0x49710

?emit@Assembler@asmjit@@QAEIIABUOperand@2@00H@Z

Ordinal 53
Address 0x49910

?emit@Assembler@asmjit@@QAEIIABUOperand@2@00_K@Z

Ordinal 54
Address 0x49950

?emit@Assembler@asmjit@@QAEIIABUOperand@2@0@Z

Ordinal 55
Address 0x496f0

?emit@Assembler@asmjit@@QAEIIABUOperand@2@0H@Z

Ordinal 56
Address 0x49870

?emit@Assembler@asmjit@@QAEIIABUOperand@2@0_K@Z

Ordinal 57
Address 0x498c0

?emit@Assembler@asmjit@@QAEIIABUOperand@2@@Z

Ordinal 58
Address 0x496c0

?emit@Assembler@asmjit@@QAEIIABUOperand@2@H@Z

Ordinal 59
Address 0x497d0

?emit@Assembler@asmjit@@QAEIIABUOperand@2@_K@Z

Ordinal 60
Address 0x49820

?emit@Assembler@asmjit@@QAEIIH@Z

Ordinal 61
Address 0x49730

?emit@Assembler@asmjit@@QAEII_K@Z

Ordinal 62
Address 0x49780

?flush@HostRuntime@asmjit@@UAEXPAXI@Z

Ordinal 63
Address 0x4edb0

?getCpuInfo@HostRuntime@asmjit@@UAEPBUCpuInfo@2@XZ

Ordinal 64
Address 0x4ed40

?getHost@CpuInfo@asmjit@@SAPBU12@XZ

Ordinal 65
Address 0x4ed40

?getPageGranularity@VMemUtil@asmjit@@SAIXZ

Ordinal 66
Address 0x3dc50

?getPageSize@VMemUtil@asmjit@@SAIXZ

Ordinal 67
Address 0x3dc40

?getStackAlignment@HostRuntime@asmjit@@UAEIXZ

Ordinal 68
Address 0x4eda0

?make@Assembler@asmjit@@UAEPAXXZ

Ordinal 69
Address 0x49630

?noOperand@asmjit@@3UOperand@1@B

Ordinal 70
Address 0xb7fc8

?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KABUX86Reg@2@IHI@Z

Ordinal 71
Address 0x4f150

?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z

Ordinal 72
Address 0x4f120

?release@JitRuntime@asmjit@@UAEIPAX@Z

Ordinal 73
Address 0x4f110

?release@StaticRuntime@asmjit@@UAEIPAX@Z

Ordinal 74
Address 0x18e00

?release@VMemMgr@asmjit@@QAEIPAX@Z

Ordinal 75
Address 0x3e8b0

?release@VMemUtil@asmjit@@SAIPAXI@Z

Ordinal 76
Address 0x3dd30

?releaseProcessMemory@VMemUtil@asmjit@@SAIPAX0I@Z

Ordinal 77
Address 0x3dd60

?relocCode@Assembler@asmjit@@QBEIPAX_K@Z

Ordinal 78
Address 0x495a0

?reset@Assembler@asmjit@@QAEX_N@Z

Ordinal 79
Address 0x490a0

?reset@PodVectorBase@asmjit@@QAEX_N@Z

Ordinal 80
Address 0x566a0

?reset@VMemMgr@asmjit@@QAEXXZ

Ordinal 81
Address 0x3e7b0

?reset@Zone@asmjit@@QAEX_N@Z

Ordinal 82
Address 0x56870

?sdup@Zone@asmjit@@QAEPADPBD@Z

Ordinal 83
Address 0x56a30

?setArch@X86Assembler@asmjit@@QAEII@Z

Ordinal 84
Address 0x4f290

?setError@CodeGen@asmjit@@QAEIIPBD@Z

Ordinal 85
Address 0x56600

?setErrorHandler@CodeGen@asmjit@@QAEIPAUErrorHandler@2@@Z

Ordinal 86
Address 0x56660

?sformat@Zone@asmjit@@QAAPADPBDZZ

Ordinal 87
Address 0x56aa0

?shrink@VMemMgr@asmjit@@QAEIPAXI@Z

Ordinal 88
Address 0x3ea40

?x86RegData@asmjit@@3UX86RegData@1@B

Ordinal 89
Address 0xb2be8

142

Type DRIVER
Language Process Default Language
Codepage UNKNOWN
Size 0xfda8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.37578
Detected Filetype PE Executable
MD5 79345150da48a280edada33df0d0e8ff 🔍
SHA1 ff0a92999887f5778974ff930bd61708c9b604b9 🔍
SHA256 b43afdc71df4ce5ba88c52f5b749f0e955bef618925b5ce40b182be7962dd216 🔍
SHA3 fb1dee6d36a8338a22e592f4c4fb822fe51a44576814bfefb72182674679872b 🔍

147

Type DRIVER
Language Process Default Language
Codepage UNKNOWN
Size 0xf390
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.41236
Detected Filetype PE Executable
MD5 715c788552cd3127e43ec83fb360b50c 🔍
SHA1 d14420ab041a5fc974b5a3700e5a45ecb4552a6c 🔍
SHA256 3e5bb01499147bc4bd77deea3a8b653f19b9a7594a59e38f71d7f1b6c193a274 🔍
SHA3 794033038500ff9f91c4856390843ed35183e1c96e3219a37c222f9ab7922d49 🔍

149

Type DRIVER
Language Process Default Language
Codepage UNKNOWN
Size 0xf7a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.37485
Detected Filetype PE Executable
MD5 405a73df2bfe7045a5092f41240081ab 🔍
SHA1 c86f53e428f89f09cf19616a09effcaabf297749 🔍
SHA256 3178dafc6e523eb9f10f6347eeee823c105c51bf039c1d792589553a3c8378c3 🔍
SHA3 502493d2d47c1919fe410d82c87712a971ebd23caf245c12f91b1ce1d76d0852 🔍

150

Type DRIVER
Language Process Default Language
Codepage UNKNOWN
Size 0xfda8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.36652
Detected Filetype PE Executable
MD5 b4dc48ae93182ffb0eec2d7f6bb4fe79 🔍
SHA1 6cb8babdef338e2972feb983d9182e48ee042cff 🔍
SHA256 5f369dc17ac752ec3c76980ab4ced66b95e82e70606a4dd56abfe0b3e780ff59 🔍
SHA3 38914ccd92cdcf3619aa1cd1bccd9723b1e4e4676a26ac6538d176b9c0f0c09c 🔍

1

Type RT_ICON
Language Process Default Language
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.69295
MD5 4a994b6fb8e99b47f624d294413dbaa1 🔍
SHA1 249a690d82b75e6ee3ec2fefe44c8727d8a60d8d 🔍
SHA256 be1c0fb28239ac295f9967aba7decbaa1fe4a4b0216d9bf5a0729fe5308a4d63 🔍
SHA3 b4785851244e1a10a160976e79259ee8c52ed5c479942d3ab0ab26cd46812f86 🔍

138

Type RT_MENU
Language Process Default Language
Codepage UNKNOWN
Size 0xae
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.21441
MD5 649f78d03e85799736be08309f1e3843 🔍
SHA1 61398863c59da9f1abed1c6a6968f65d09b192b9 🔍
SHA256 ae228b2b8c0642dc9e67a792f8d718e9469a060e65b505bcc4f47c377db2ec53 🔍
SHA3 f7a63c8fa063dca3a97e07934b5eba82460f61a48286ccbb6b9d6cbcf3216f81 🔍

129

Type RT_DIALOG
Language Process Default Language
Codepage UNKNOWN
Size 0x306
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.24872
MD5 9ebd2015c88340d6fef55d9be7906729 🔍
SHA1 b91d9a7f0d90a63af3a5754f841b0282aec9178a 🔍
SHA256 dbfd4a675bff0c9bdcefaa6b3cc71ebc62979cc2d7c101d06d9f2621b6b0c8cd 🔍
SHA3 ffadebc268ffc31d08077642759a1dbf9227cf60afef12d3f8a36cec347ee28d 🔍

137

Type RT_DIALOG
Language Process Default Language
Codepage UNKNOWN
Size 0xec
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.0888
MD5 efb5b6c384fa47b323ddc4aaf0e53116 🔍
SHA1 49f9cced06eb388bcd36925f186a05eb9a9a81b8 🔍
SHA256 65723a3d84d14e2f28f3cac77381597ef18cc9ea41291c78538c86f79715af84 🔍
SHA3 2ce65944f4c4ccd0568d2b1fc6a89d05123942bfbed080bc5f6029142eddc3c6 🔍

139

Type RT_DIALOG
Language Process Default Language
Codepage UNKNOWN
Size 0xec
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.12361
MD5 525c79f5cb004ac34a5e651cb84ad5bf 🔍
SHA1 39a2e087b284ab9c64914b26891d61429cab23cb 🔍
SHA256 d6049c920805bf3a658dd3d3d6003d334acaac76c35ced0d24407e57915fb3e2 🔍
SHA3 547163e0d059fa30a0f47a10909e771008bedf3eec4fde66302966f46c86877f 🔍

140

Type RT_DIALOG
Language Process Default Language
Codepage UNKNOWN
Size 0x8a6
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.39845
MD5 5e897698ea512552e353d0464e304ca5 🔍
SHA1 a344c608671e9f34477aa11fe90e933c48775e8c 🔍
SHA256 2ffde3d121bb187f3bdfd8b0dfc8ed4dd300b8419ec49d2e6363d91bbbe82b0b 🔍
SHA3 ddef6f46ab0e13fc13da954b6b2d19c7d811d7965f6401980216687f98a37e08 🔍

141

Type RT_ACCELERATOR
Language Process Default Language
Codepage UNKNOWN
Size 0x10
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.375
MD5 6dbf0775ada550f4369a8bf121f45889 🔍
SHA1 e1f749f731e66a42ae0e8a440be5638998a66ec1 🔍
SHA256 e11b5bdf963397bf3b231c884d9ec106d93d874da153f96825bca559534a3b64 🔍
SHA3 de41aa477e4a069d40a689d4a2d2a523033dc97bcc989d2a682cb1f0e57b516e 🔍

135

Type RT_GROUP_ICON
Language Process Default Language
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.98048
Detected Filetype Icon file
MD5 38388dda6548693f4d42f2241a4218d7 🔍
SHA1 78bedd12a20f97e31e58742381f3d0ca1edb4715 🔍
SHA256 cd0991dd595a1392452a8c7ccf089e73626bc6eed1fd3f54ee4c6aa7ffbaedba 🔍
SHA3 9ace1e9f008d60580379cdfdcd4119706c82d52d2e5fdb9e5745fa00864cc1a8 🔍

1 (#2)

Type RT_VERSION
Language Process Default Language
Codepage UNKNOWN
Size 0x268
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.36651
MD5 e1aa9004b2f08e1045b16fd4e18c77dc 🔍
SHA1 bd4cda6ecb9c1b931bbf40e13b79f5f684afdd11 🔍
SHA256 306f9af07a2d70a63f4384c8abf2f09d240672d950ddca5ea36b1bfedfd8bb9d 🔍
SHA3 01792bcedb0bec3e34530bd58ffc72c58f272ca6984ad3e2bdd20fbbd9b5050b 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x289
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.05508
MD5 d28dfc8159f57a557fd3ac5ff8010b47 🔍
SHA1 269e00eb41eb2a102fdc24763539f758c4370a5f 🔍
SHA256 c687fd0335259d5149882376f6e7eb501aa1ccf5b4057c44e07760e1b1b799b9 🔍
SHA3 68f173ef697908b29e1cfeb47c9769a334914e4047c34fd9529fd2854aaeacf2 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 2.3.2.0
ProductVersion 2.3.2.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language Process Default Language
FileDescription PE injector
FileVersion (#2) 2.3.2.0
InternalName Xenos.exe
LegalCopyright Copyright (C) 2017
OriginalFilename Xenos.exe
ProductName Xenos
ProductVersion (#2) 2.3.2.0
Resource LangID Process Default Language

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2018-May-21 11:01:11
Version 0.0
SizeofData 111
AddressOfRawData 0xc2440
PointerToRawData 0xc0e40
Referenced File C:\Users\Ton\Documents\Visual Studio 2017\Projects\Xenos\build\Win32\Release\Xenos.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2018-May-21 11:01:11
Version 0.0
SizeofData 20
AddressOfRawData 0xc24b0
PointerToRawData 0xc0eb0

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2018-May-21 11:01:11
Version 0.0
SizeofData 956
AddressOfRawData 0xc24c4
PointerToRawData 0xc0ec4

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2018-May-21 11:01:11
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

StartAddressOfRawData 0x4c2890
EndAddressOfRawData 0x4c2898
AddressOfIndex 0x4d1338
AddressOfCallbacks 0x4a13fc
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0xa0
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x4ce06c
SEHandlerTable 0x4c1e80
SEHandlerCount 368

RICH Header

XOR Key 0x15af2d96
Unmarked objects 0
ASM objects (VS2015/2017 runtime 25711) 18
C++ objects (VS2015/2017 runtime 25711) 183
ASM objects (VS2017 v15.6.6 compiler 26131) 25
C++ objects (VS2017 v15.6.6 compiler 26131) 127
C objects (VS2017 v15.6.6 compiler 26131) 37
C objects (VS2015/2017 runtime 25711) 24
Imports (VS2015/2017 runtime 25711) 17
Total imports 237
C++ objects (LTCG) (VS2017 v15.7 compiler 26428) 55
Exports (VS2017 v15.7 compiler 26428) 1
Resource objects (VS2017 v15.7 compiler 26428) 1
151 1
Linker (VS2017 v15.7 compiler 26428) 1

Errors

Leave a comment

No comments yet.