f5b9806b73383596089332bc3bc34af8385b7cab0818e3dd5d64f0d90bab3272

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Apr-15 14:46:10
Detected languages English - United States

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to system / monitoring tools:
  • RUNDLL32.EXE
  • RunDll32.exe
 Contains references to security software:
  • CLEANER.EXE
 Tries to detect virtualized environments:
  • Hardware\Description\System
  • SYSTEM\CurrentControlSet\Control\SystemInformation
  • System\CurrentControlSet\Control\SystemInformation
 May have dropper capabilities:
  • %Temp%
  • %temp%
  • CurrentControlSet\Services
 Accesses the WMI:
  • ROOT\CIMV2
 Contains another PE executable:
  • This program cannot be run in DOS mode.
 Miscellaneous malware strings:
  • CMD.EXE
  • cmd.exe
  • virus
 Contains domain names:
  • 1991-06.com
  • 2010-aia.verisign.com
  • 2010-crl.verisign.com
  • Battle.net
  • aia.verisign.com
  • aia.ws.symantec.com
  • casedieresis.cn
  • crl.microsoft.com
  • crl.thawte.com
  • crl.verisign.com
  • crl.ws.symantec.com
  • csc3-2010-aia.verisign.com
  • csc3-2010-crl.verisign.com
  • epicgames.com
  • http://crl.microsoft.com
  • http://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0
  • http://crl.thawte.com
  • http://crl.thawte.com/ThawteTimestampingCA.crl0
  • http://crl.verisign.com
  • http://crl.verisign.com/pca3-g5.crl04
  • http://csc3-2010-aia.verisign.com
  • http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
  • http://csc3-2010-crl.verisign.com
  • http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
  • http://logo.verisign.com
  • http://logo.verisign.com/vslogo.gif04
  • http://ocsp.thawte.com0
  • http://ocsp.verisign.com0
  • http://ts-aia.ws.symantec.com
  • http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
  • http://ts-crl.ws.symantec.com
  • http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
  • http://ts-ocsp.ws.symantec.com07
  • https://fontawesome.comRegularF
  • https://www.verisign.com
  • https://www.verisign.com/cps0
  • https://www.verisign.com/rpa
  • https://www.verisign.com/rpa0
  • kaptcha.com
  • logo.verisign.com
  • microsoft.com
  • ol.epicgames.com
  • payment-website-pci.ol.epicgames.com
  • pci.ol.epicgames.com
  • regid.1991-06.com
  • ssl.kaptcha.com
  • symantec.com
  • thawte.com
  • ts-aia.ws.symantec.com
  • ts-crl.ws.symantec.com
  • verisign.com
  • website-pci.ol.epicgames.com
  • ws.symantec.com
  • www.epicgames.com
  • www.verisign.com
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to SHA1
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
 Possibly launches other programs:
  • ShellExecuteW
  • system
 Reads the contents of the clipboard:
  • GetClipboardData
Malicious VirusTotal score: 52/70 (Scanned on 2026-07-21 22:17:05) ALYac: Gen:Variant.Tedy.943380
APEX: Malicious
AVG: Win64:MalwareX-gen [Expl]
AhnLab-V3: Trojan/Win.Generic.C5889967
Alibaba: Exploit:Win32/PolarBear.779b9ac9
Antiy-AVL: Trojan/Win32.Ravartar
Arcabit: Trojan.Tedy.DE6514
Avast: Win64:MalwareX-gen [Expl]
Avira: EXP/W64.MalwareX
BitDefender: Gen:Variant.Tedy.943380
Bkav: W32.Malware.DF52B0B3
CTX: exe.trojan.polarbear
ClamAV: Win.Packed.Ursu-9873051-0
CrowdStrike: win/malicious_confidence_90% (D)
Cylance: Unsafe
Cynet: Malicious (score: 100)
ESET-NOD32: Win64/GenKryptik.HPNU trojan
Elastic: malicious (high confidence)
Emsisoft: Gen:Variant.Tedy.943380 (B)
F-Secure: Exploit.EXP/W64.MalwareX
Fortinet: W64/GenKryptik.HPNU!tr
GData: Gen:Variant.Tedy.943380
Google: Detected
Ikarus: Trojan.Win64.Krypt
K7AntiVirus: Exploit ( 006de4cd1 )
K7GW: Exploit ( 006de4cd1 )
Kaspersky: HEUR:Exploit.Win32.PolarBear.f
Kingsoft: Win32.Exploit.PolarBear.f
Lionic: Trojan.Win32.PolarBear.3!c
Malwarebytes: Malware.AI.3124972055
MaxSecure: Trojan.Malware.679002843.susgen
McAfeeD: Trojan:Win/Vulndriver.EAG
MicroWorld-eScan: Gen:Variant.Tedy.943380
Microsoft: Trojan:Win32/Ravartar!rfn
Paloalto: generic.ml
Panda: Trj/GdSda.A
Rising: Exploit.Vulndriver!8.1B9F1 (TFE:5:wmHm6mce1MV)
Sangfor: Trojan.Win32.Save.a
SentinelOne: Static AI - Malicious PE
Sophos: Mal/Generic-S
Symantec: ML.Attribute.HighConfidence
Tencent: Malware.Win32.Gencirc.14acea7d
TrellixENS: Artemis!15CF0FE9D227
TrendMicro: TROJ_GEN.R002C0DDH26
TrendMicro-HouseCall: TROJ_GEN.R002C0DDH26
VBA32: Exploit.PolarBear
VIPRE: Gen:Variant.Tedy.943380
Varist: W64/ABTrojan.HCBJ-1369
ViRobot: Trojan.Win.Z.Agent.5675008
Zillya: Trojan.GenKryptik.Win64.71948
alibabacloud: Exploit:Win/PolarBear.f
huorong: Exploit/Vulndriver.c!crit

Hashes

MD5 15cf0fe9d22747a3b55572b309ac6168
SHA1 79696352e5e9ec3a7c684f2d1972355ae5a92fae
SHA256 f5b9806b73383596089332bc3bc34af8385b7cab0818e3dd5d64f0d90bab3272
SHA3 bd10276ad3997a97a771fa684de4796730254238f2f9a1aecde4e0aec6391450
SSDeep 49152:KWkqv1TmhXnspnsuxK0Ervgir1B4xpTX3eYdr1TYxYFUfT/7z+zdzuaU48rJcXr:KW1EhXaxqbX4WH/7CIeBI
Imports Hash 4f19b8b7522b5d03f4fba57ca7d5fe09

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x110

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Apr-15 14:46:10
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xa2000
SizeOfInitializedData 0x4c7a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000000A10E8 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x56c000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 cdce7d9efc5d4907b101af9bc36ed09b
SHA1 21030284c8465be054b052f81b6a526731f1cce5
SHA256 7e5ce697dcbd930a0b087a18a0879e973d2c5c5ffe01b01c2a18ae39752e6c39
SHA3 4b9b86e0ca494cb52e406d5e24787c1dcb992868391fe0de08665fcaeca2e90d
VirtualSize 0xa1f4e
VirtualAddress 0x1000
SizeOfRawData 0xa2000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.5148

.rdata

MD5 b1c043e44d5b8ea795c961ee483f185b
SHA1 9ee79208ff83a88eb0235663c94d2b716b44bc16
SHA256 3941b3df983db58e560b07f0dbbed49b204b62e6e75090fdedee95bc9cdb1977
SHA3 d111936f9046fb0d59d6b5cdaac20669c1ea10a5d4b4544375ab35c0602a621a
VirtualSize 0x497ef0
VirtualAddress 0xa3000
SizeOfRawData 0x498000
PointerToRawData 0xa2400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.14657

.data

MD5 e0c0db602c6f05215fb7bef9acd47098
SHA1 98d8a9766eedc65005aa78829e1c20b7a9371e54
SHA256 0e37018a4a77e2dc64b859fa498de64a280272e6be6f387eb39c3dbc411c6849
SHA3 012f9d0d59a6668d6bb3696f77bdda7677c69a9a2f9f4894c46170477c8363de
VirtualSize 0x26e00
VirtualAddress 0x53b000
SizeOfRawData 0x26800
PointerToRawData 0x53a400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.98681

.pdata

MD5 5447748ade73465643f077dd277cdc34
SHA1 19a9332f2e9c634c18b0f4c1ab2bdb032e07267d
SHA256 26eaacd83411d6db0387de709580fdddcd4018a8f4e2d7677f44f010289db4ed
SHA3 4cc72160508ae00aae06b735a9660906893a41f0f8341d49d90bbf155f2929ec
VirtualSize 0x7b18
VirtualAddress 0x562000
SizeOfRawData 0x7c00
PointerToRawData 0x560c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.024

.rsrc

MD5 4904ba76384ac9f949c064a2d25b5e9a
SHA1 e9c493eca6bac737af659cd7f43505e08c817427
SHA256 a864a0b933b08107a42df027d184837240e5c61bddc7033a36c03eeb2948ab08
SHA3 fc31aa16833b188428b06f4b3cf0f42d66aeeaa346408ce40933498bd29bbb80
VirtualSize 0x1e8
VirtualAddress 0x56a000
SizeOfRawData 0x200
PointerToRawData 0x568800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.76813

.reloc

MD5 3771b35d6106e0d0ca1c3f8a5326a456
SHA1 9cd3ec03861011509358602aca29cdb390b5e3c2
SHA256 67394ba4b7a62d100e7efe4e8883e5b99e00508d5bf3d705a6f03de3e483151c
SHA3 ac5949d8d5ca57235e1b978d3c55dd7b80c7db3eaa52953883dddd44cc25f533
VirtualSize 0xd20
VirtualAddress 0x56b000
SizeOfRawData 0xe00
PointerToRawData 0x568a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.2674

Imports

d3d11.dll D3D11CreateDeviceAndSwapChain
d3dx11_43.dll D3DX11CreateShaderResourceViewFromMemory
KERNEL32.dll GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
WideCharToMultiByte
CreateDirectoryA
DeleteFileW
CloseHandle
GetLastError
WaitForSingleObject
Sleep
GetConsoleWindow
CreateFileA
GetFileSizeEx
ReadFile
HeapAlloc
HeapFree
LoadLibraryA
MapViewOfFile
UnmapViewOfFile
GetLocaleInfoA
GetProcAddress
LocalFree
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateFileMappingA
MultiByteToWideChar
FreeLibrary
QueryPerformanceFrequency
QueryPerformanceCounter
USER32.dll GetMessageExtraInfo
GetCapture
TrackMouseEvent
ReleaseCapture
IsWindowUnicode
GetForegroundWindow
GetKeyState
GetKeyboardLayout
SetCapture
GetWindowRect
UpdateWindow
SetWindowPos
ShowWindow
DestroyWindow
UnregisterClassA
PostQuitMessage
DefWindowProcA
PeekMessageA
DispatchMessageA
TranslateMessage
MessageBoxA
PostMessageA
CreateWindowExA
RegisterClassA
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
LoadCursorA
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
GetClientRect
OpenClipboard
SHELL32.dll ShellExecuteExW
SHGetFolderPathW
ShellExecuteW
ole32.dll CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoUninitialize
OLEAUT32.dll SysAllocString
SysFreeString
VariantClear
D3DCOMPILER_43.dll D3DCompile
dwmapi.dll DwmExtendFrameIntoClientArea
IMM32.dll ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext
ImmReleaseContext
MSVCP140.dll ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xbad_alloc@std@@YAXXZ
?uncaught_exception@std@@YA_NXZ
_Thrd_detach
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??7ios_base@std@@QEBA_NXZ
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
IPHLPAPI.DLL GetAdaptersInfo
VCRUNTIME140.dll __std_exception_destroy
_CxxThrowException
strrchr
longjmp
__std_exception_copy
__current_exception
__current_exception_context
__intrinsic_setjmp
__C_specific_handler
memcpy
strstr
memmove
memcmp
memchr
__std_terminate
memset
VCRUNTIME140_1.dll __CxxFrameHandler4
api-ms-win-crt-string-l1-1-0.dll toupper
strlen
strcpy_s
wcslen
strcmp
strncmp
strncpy
api-ms-win-crt-stdio-l1-1-0.dll __stdio_common_vsprintf_s
ungetc
setvbuf
_fseeki64
fsetpos
fputc
fgetpos
fgetc
_set_fmode
fwrite
__acrt_iob_func
fseek
fread
__p__commode
ftell
fflush
fclose
_wfopen
__stdio_common_vfprintf
__stdio_common_vsscanf
_get_stream_buffer_pointers
__stdio_common_vsprintf
api-ms-win-crt-heap-l1-1-0.dll malloc
_callnewh
free
_set_new_mode
api-ms-win-crt-utility-l1-1-0.dll qsort
api-ms-win-crt-math-l1-1-0.dll ceilf
acosf
sinf
cosf
fmodf
sqrtf
fabs
__setusermatherr
api-ms-win-crt-convert-l1-1-0.dll strtol
api-ms-win-crt-runtime-l1-1-0.dll _exit
exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
system
_set_app_type
_c_exit
_invalid_parameter_noinfo_noreturn
_seh_filter_exe
terminate
_beginthreadex
_register_thread_local_exe_atexit_callback
_cexit
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_configure_narrow_argv
api-ms-win-crt-environment-l1-1-0.dll getenv
api-ms-win-crt-filesystem-l1-1-0.dll _lock_file
_unlock_file
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x188
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.89623
MD5 b8e76ddb52d0eb41e972599ff3ca431b
SHA1 fc12d7ad112ddabfcd8f82f290d84e637a4d62f8
SHA256 165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8
SHA3 37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Apr-15 14:46:10
Version 0.0
SizeofData 912
AddressOfRawData 0x52dcdc
PointerToRawData 0x52d0dc

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2026-Apr-15 14:46:10
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

StartAddressOfRawData 0x14052e090
EndAddressOfRawData 0x14052e098
AddressOfIndex 0x140561800
AddressOfCallbacks 0x1400a3950
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140561280

RICH Header

XOR Key 0x7c56a5d9
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 20
C objects (33145) 1
Imports (34321) 6
253 (34321) 1
ASM objects (34321) 4
C objects (34321) 10
C++ objects (34321) 38
Imports (33145) 18
C objects (VS2022 Update 7 (17.7.0-3) compiler 32822) 27
Imports (21202) 7
Total imports 309
C++ objects (34444) 15
Resource objects (34444) 1
Linker (34444) 1

Errors

Leave a comment

No comments yet.