fd8b9a5a2cea4260cb9c3d6746e1637237ac60575456b064a1d054d494b65f49

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2071-Nov-21 11:02:20
Detected languages English - United States
Debug artifacts BootstrapPackagedGame-Win64-Shipping.pdb
FileVersion ++UE5+Release-5.7-CL-51494982
CompanyName Epic Games, Inc.
LegalCopyright Fill out your copyright notice in the Description page of Project Settings.
ProductName BootstrapPackagedGame
ProductVersion ++UE5+Release-5.7-CL-51494982
FileDescription BootstrapPackagedGame
InternalName UnrealEngine
OriginalFilename BootstrapPackagedGame-Win64-Shipping.exe

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • adobe.com
  • http://ns.adobe.com
  • http://ns.adobe.com/photoshop/1.0/
  • http://ns.adobe.com/xap/1.0/
  • http://ns.adobe.com/xap/1.0/mm/
  • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
  • http://purl.org
  • http://www.w3.org
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#
  • ns.adobe.com
  • www.w3.org
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryW
  • LoadLibraryExW
 Can access the registry:
  • RegOpenKeyExW
  • RegCloseKey
  • RegQueryValueExW
 Possibly launches other programs:
  • CreateProcessW
Suspicious VirusTotal score: 1/67 (Scanned on 2026-07-21 07:28:56) Zillya: Trojan.AgentAGen.Win64.43334

Hashes

MD5 fecc6d53f2fee814086cbb92724b5f1b
SHA1 8b7d9a7267a89f1d7d30d637ecb0b58fdb086fd6
SHA256 fd8b9a5a2cea4260cb9c3d6746e1637237ac60575456b064a1d054d494b65f49
SHA3 4c605c32ba2edd93cb77bc3067188833317f2b111f0445f08e3773f64afa7249
SSDeep 3072:bFIyuaR5V3hVd6719Qtb2676RP7gYrmddhdLIrOcd5P:b6zY5lfd6nQtC67xdhdL
Imports Hash a8ff415d7b5164307cdba18944ae4f5d

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2071-Nov-21 11:02:20
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x13c00
SizeOfInitializedData 0x14400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000000023D8 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x2d000
SizeOfHeaders 0x400
Checksum 0x315d6
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0xb71b00
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 f79533e951aa1e3c696c64ef576222c8
SHA1 5a5aa07e16aba3c3fbcb51abdd5fdffddd341298
SHA256 14fd5fb1fcf5af80fa9c4e0b16cf68af2ca83c5b1838c31ae0ae2088ba913f89
SHA3 92f5ce0eafe99577a3e477f253838fcd868bdd3121ad751832a69cc9c49bb443
VirtualSize 0x13a80
VirtualAddress 0x1000
SizeOfRawData 0x13c00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.4785

.rdata

MD5 7d2b0b06015290e650fe61078a05e042
SHA1 cf6298025feaa98338e74eeed3ffdbc0d7e783f9
SHA256 ceb2caf654707e59375b5c46e9bb6ebc490998a63bc9479d873eb99f9054e147
SHA3 cd25880b60be68f1cabc01d87cc9a3aff4327996b852a44f5e2e15097023caea
VirtualSize 0xb1ee
VirtualAddress 0x15000
SizeOfRawData 0xb200
PointerToRawData 0x14000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.93249

.data

MD5 51cdcf2b319b148356517a71d2a15734
SHA1 3c029708daad7f3d34b9e96ee4a72f870a534ab2
SHA256 4f3a34df17de6cc2cab519b027509a62f72af4ae9e10495ca4b72494d12e85b6
SHA3 8cb3d1edf87c0bfe1cf229622d93b7e0b37a421291aa0c9b8b0eba3d26eabdc2
VirtualSize 0x1dd0
VirtualAddress 0x21000
SizeOfRawData 0xc00
PointerToRawData 0x1f200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.07541

.pdata

MD5 630b56fae76a1d70bb6c75e772c43ba4
SHA1 2e1d22fa35017b5f0b71b8b9af034280455a7181
SHA256 5939dd3502bee923d80c4da24106e7e8fb02775b66e5edf3a297d7441d0c0f38
SHA3 cc2688000aec0fac3b8d62b465199564757d2c2dd9482af5cfe755e2dc3bbd40
VirtualSize 0x1248
VirtualAddress 0x23000
SizeOfRawData 0x1400
PointerToRawData 0x1fe00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.67216

.rsrc

MD5 f99b34b8873f94ca9e3562e89a62a3d5
SHA1 829018118a774fa9b4e174712777fd1314a2c1ea
SHA256 52686b896f8c92a2dcdbc85f5fd8516da1277c658fb9db0144db2ada91a445c7
SHA3 294da3d03b7c36f7171e9741a074e3c0e3daf93eca93abfc5585b24af67683f7
VirtualSize 0x69ac
VirtualAddress 0x25000
SizeOfRawData 0x6a00
PointerToRawData 0x21200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.24529

.reloc

MD5 a857e5bacb1711debcc69ee1d3a70f0b
SHA1 8790b607728f777db830e07d263c065043dfcdd3
SHA256 34230426a93e28a8a56e6ac4a285d4a64731fa2f607628e5562cdfa07abfb5b5
SHA3 d1a48aa1e7809cc7a54cc5d8ad91692e5e5ce4a4edf92ce461b0c730e5886cec
VirtualSize 0x694
VirtualAddress 0x2c000
SizeOfRawData 0x800
PointerToRawData 0x27c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.95434

Imports

KERNEL32.dll WaitForSingleObject
GetCurrentProcess
GetExitCodeProcess
CreateProcessW
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetLastError
LockResource
SizeofResource
FindResourceW
LoadLibraryW
WriteConsoleW
CreateFileW
CloseHandle
GetFileAttributesW
LoadResource
GetEnvironmentVariableW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
SetFilePointerEx
GetProcessHeap
LCMapStringW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
HeapAlloc
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
USER32.dll MessageBoxW
wsprintfW
ADVAPI32.dll RegOpenKeyExW
RegCloseKey
RegQueryValueExW
SHELL32.dll ShellExecuteExW
SHLWAPI.dll PathCanonicalizeW
PathRemoveFileSpecW
PathCombineW
VERSION.dll GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x7cc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.47242
Detected Filetype PNG graphic file
MD5 bbc79abe5bf55b2147f03652d77f400a
SHA1 02d3ed8d564dc353386d9b9a189786fd759d25d6
SHA256 16197bc88f2ec77ad2690fae280bf3584c54c7d7b018d8fa4086b7c00fd4effc
SHA3 bd3ecc69926e52944fedbd98a52b5d52520473285bb296f7e2ffccbc5701a9c8

2

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x98f
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.91141
Detected Filetype PNG graphic file
MD5 bef45cf74ce0e6af1083e7ad651daa2f
SHA1 f2b6ff7137a11ced55a45484597b71def44492d1
SHA256 b6f068b2ff5f3831494b913e9bfff69349c88087205579a6b9a96c167e524e60
SHA3 13913a986a0d6d489bc9c049310f3d9cc2e543d8ab9bffac1b92c87b672eab2d

3

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x9e7
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.00143
Detected Filetype PNG graphic file
MD5 5308d41a3c949ba0599038317e2c042e
SHA1 4f62cd9108deb0a2b2af1a83a5d9d04ce3f149a9
SHA256 c10cdd1b627ee53548140c4a255032d39dfb0039413b5c1b9765a1fa0d3f27a9
SHA3 eedc41d70787700439e368b8be2ad33f0ed514fff34eb12649aa8dbb6580d493

4

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0xbdd
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.22958
Detected Filetype PNG graphic file
MD5 e592ecd29b8047d0a19d511e1bfa77d4
SHA1 25d32e28490be0bf188f6b1c184a996cb466c63e
SHA256 bd35429f29158026133e8d2d7b0a5d295913934c6bd8c4d8f2c1457bb824ad11
SHA3 072f081abda262627317d936fdfed74e284231e5cd6d38f95131558b2382ac54

5

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0xcac
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.34056
Detected Filetype PNG graphic file
MD5 2d7063768024087fc9677df50060499e
SHA1 286ce58ffccdfcba5ad60d11af2db07f987d0a48
SHA256 521e6a42b587f6e9b964ba2a14c93bfadd94f1f06a2560ed09a7e7dd5043c61e
SHA3 e1724a3a38c17996aea1e777df540d48d98e6c21b1d78d92c318e7f9e50533ee

6

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0xdcb
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.41581
Detected Filetype PNG graphic file
MD5 7bf36c29bcb6b5839d85c9c836216593
SHA1 86e7a55cacd17d1bda55a1a1de5a03adcba06c2b
SHA256 7a96ab7db1fa191a6bd087497c2f55239d7cda01dcc226e742daa80c5bc37de2
SHA3 72655fed7cd84d2c2de3957446a52a6a22dff86ca62a37d4e8586e86a1e613f0

7

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x1b13
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.73886
Detected Filetype PNG graphic file
MD5 1f48923337871ba25cf266bba17429cc
SHA1 279f47235e20eedee5daa535ea611e0aed1157d0
SHA256 2399dfb472a6c753447b847fbb144235145ca6507a60941b5295389c6fc45639
SHA3 06825c34eb7fe14d622735aa986a3e26247e95d5493a5b22eb3884f51b155493

201

Type RT_RCDATA
Language English - United States
Codepage Latin 1 / Western European
Size 0x4e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.94115
MD5 8b48a201c062456a71a1c56974dbf893
SHA1 a602f9251ff70c7375b41bdd920fea4e88df82c9
SHA256 36fa1c8d52b6c462f48af942ce461f718482258bd745edc9743149268d77a6e3
SHA3 3e6369bd40859a1bd0b79f0abbdab9c08c03f4b1dd2d7653bf051d50dccad90d

202

Type RT_RCDATA
Language English - United States
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.41924
MD5 00a493d07b9330b62798f65f60b62a25
SHA1 2a7c4ce96128639e984112f4567d1d21b962f22b
SHA256 a04ab9f94b01902bc741c3e1d24c16e8576ee4216e254e461528f6913d230fef
SHA3 45afa3221505609aa6c45f421c9a1aa544a394c9639be679c548b92b1ec3c871

205

Type RT_RCDATA
Language English - United States
Codepage Latin 1 / Western European
Size 0x2
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 0
MD5 c4103f122d27677c9db144cae1394a66
SHA1 1489f923c4dca729178b3e3233458550d8dddf29
SHA256 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
SHA3 762ba6a3d9312bf3e6dc71e74f34208e889fc44e6ff400724deecfeda7d5b3ce

101

Type RT_GROUP_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.93324
Detected Filetype Icon file
MD5 26e4bbdda9f8e58b060feaa53c3083e2
SHA1 bd724469fc43a9a58679a7016c303a5693fe9f94
SHA256 74c73b469e08909c1b539a80c66cb442d04b3c29cd03e8a533a3c349c5cc84c4
SHA3 49df4b8afdcf81a2097c2608740540f7e25ce3aa86c892702db1183998142c1b

123

Type RT_GROUP_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.93324
Detected Filetype Icon file
MD5 26e4bbdda9f8e58b060feaa53c3083e2
SHA1 bd724469fc43a9a58679a7016c303a5693fe9f94
SHA256 74c73b469e08909c1b539a80c66cb442d04b3c29cd03e8a533a3c349c5cc84c4
SHA3 49df4b8afdcf81a2097c2608740540f7e25ce3aa86c892702db1183998142c1b

1 (#2)

Type RT_VERSION
Language English - United States
Codepage Latin 1 / Western European
Size 0x3f0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.52269
MD5 e6bb02f30122d2be744fbc720ebae68f
SHA1 96bad17b8c318e5bcd7c80f1757fdecebac20984
SHA256 981c6000d1378b0b2cd6c1a81b6af49b424383ffc5e93445e3eaf8daf1c2473c
SHA3 b229e2f62a3b2c39fe56b36a2981605d7559d32b7c3af604f2eff60b7432c89f

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage Latin 1 / Western European
Size 0x4ab
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.17111
MD5 95c2c9489bd148da2aa8a81ad0ed51fd
SHA1 f0183299607f193ce5ea333a13d0da18c5855e25
SHA256 e2acd718de40a9dba7f7f7c596987e9b6c96ad3b447e28d2565e467b4f294593
SHA3 4b305a1395c563907fca1139de6d7109ade1e8bca0df9227287e06625a88ba1f

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 5.7.4.0
ProductVersion 5.7.4.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_DLL
Language English - United States
FileVersion (#2) ++UE5+Release-5.7-CL-51494982
CompanyName Epic Games, Inc.
LegalCopyright Fill out your copyright notice in the Description page of Project Settings.
ProductName BootstrapPackagedGame
ProductVersion (#2) ++UE5+Release-5.7-CL-51494982
FileDescription BootstrapPackagedGame
InternalName UnrealEngine
OriginalFilename BootstrapPackagedGame-Win64-Shipping.exe
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2071-Nov-21 11:02:20
Version 0.0
SizeofData 65
AddressOfRawData 0x1e1e8
PointerToRawData 0x1d1e8
Referenced File BootstrapPackagedGame-Win64-Shipping.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2071-Nov-21 11:02:20
Version 0.0
SizeofData 20
AddressOfRawData 0x1e22c
PointerToRawData 0x1d22c

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2071-Nov-21 11:02:20
Version 0.0
SizeofData 820
AddressOfRawData 0x1e240
PointerToRawData 0x1d240

UNKNOWN

Characteristics 0
TimeDateStamp 2071-Nov-21 11:02:20
Version 0.0
SizeofData 36
AddressOfRawData 0x1e59c
PointerToRawData 0x1d59c

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140021040

RICH Header

XOR Key 0x3fc0667d
Unmarked objects 0
ASM objects (30795) 7
C++ objects (30795) 139
C objects (30795) 10
ASM objects (35207) 9
C objects (35207) 16
C++ objects (35207) 45
Imports (30795) 13
Total imports 111
C++ objects (35223) 1
Resource objects (35223) 1
151 1
Linker (35223) 1

Errors

[*] Warning: Could not read a WIN_CERTIFICATE's header.
Leave a comment

No comments yet.