Manalyze report for 137a9a60b3e81c1311dacf73eb54112b53a1449ffd3113f91d7e4477f49ed588

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Sep-23 23:42:06
Detected languages	English - United States
CompanyName	TMOG
FileDescription	Task Manager TMOG
FileVersion	`1.0.0.0`
InternalName	tmog_windows
OriginalFilename	Task Manager.exe
ProductName	Task Manager TMOG
ProductVersion	`1.0.0.0`

Plugin Output

Info	Matching compiler(s):	`MASM/TASM - sig2(h)` `MASM/TASM - sig1(h)`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`Contains references to system / monitoring tools: taskmgr.exe` `Tries to detect virtualized environments: HARDWARE\DESCRIPTION\System` `Looks for Qemu presence: QEMU` `May have dropper capabilities: %TEMP% CurrentControlSet\Services` `Accesses the WMI: ROOT\Microsoft` Contains domain names: Mtmog.org adobe.com cloudflare.com cv.iptc.org ejemplo.com example.com exemple.com github.com http://cv.iptc.org http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia http://ns.adobe.com http://ns.adobe.com/photoshop/1.0/ http://ns.adobe.com/xap/1.0/ http://ns.adobe.com/xap/1.0/mm/ http://ns.adobe.com/xap/1.0/sType/ResourceEvent# http://purl.org http://www.kraftilab.com http://www.sansoxygen.comThis http://www.w3.org http://www.w3.org/1999/02/22-rdf-syntax-ns# https://github.com https://scripts.sil.org https://scripts.sil.org/OFLhttps https://scripts.sil.org/OFLss01ss02 https://tmog.org https://www.bing.com https://www.bing.com/search?q https://www.tmog.org https://www.tmog.org/ https://www.tmog.org/feedback.html https://www.tmog.org/privacy.html https://www.tmog.org/pro.html https://www.tmog.org/release-download.html?platform https://www.tmog.org/support.html kraftilab.com license-tmog.com ns.adobe.com pro.license-tmog.com scripts.sil.org speed.cloudflare.com voorbeeld.com win.proc.net www.bing.com www.kraftilab.com www.tmog.org www.w3.org
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to SHA256` `Uses constants related to SHA512` `Uses constants related to RC5 or RC6`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryExW LoadLibraryW` `Functions which can be used for anti-debugging purposes: FindWindowW CreateToolhelp32Snapshot SwitchToThread` `Can access the registry: RegCloseKey RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RegDeleteKeyExW RegDeleteValueW RegQueryInfoKeyW RegSetValueExW RegGetValueW RegEnumKeyExW RegEnumValueW` `Possibly launches other programs: ShellExecuteW CreateProcessW` `Can create temporary files: GetTempPathW CreateFileW` `Memory manipulation functions often used by packers: VirtualAlloc VirtualProtect` `Has Internet access capabilities: WinHttpQueryHeaders WinHttpSetOption WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpWriteData` `Leverages the raw socket API to access the Internet: WS2_32.dll` `Functions related to the privilege level: OpenProcessToken AdjustTokenPrivileges` `Interacts with services: ControlService OpenSCManagerW OpenServiceW QueryServiceStatusEx QueryServiceConfigW QueryServiceStatus EnumServicesStatusExW QueryServiceConfig2W` `Enumerates local disk drives: GetLogicalDriveStringsW GetDriveTypeW GetVolumeInformationW` `Manipulates other processes: ReadProcessMemory Process32NextW OpenProcess Process32FirstW` `Can take screenshots: BitBlt CreateCompatibleDC FindWindowW PrintWindow GetDC`
Info	The PE's resources present abnormal characteristics.	`Resource 110 is possibly compressed or encrypted.`
Info	The PE is digitally signed.	`Signer: David Plummer` `Issuer: SSL.com Code Signing Intermediate CA RSA R1`
Suspicious	No VirusTotal score.	`This file has never been scanned on VirusTotal.`

Hashes

MD5	`46b9055204180747530297518a8e216b` 🔍
SHA1	`553153a36ad2214cffbc4fecfc89cd48f0d4203a` 🔍
SHA256	`137a9a60b3e81c1311dacf73eb54112b53a1449ffd3113f91d7e4477f49ed588` 🔍
SHA3	`358f90b5fbdc3021217b016ce2f638a582bb53303421ce0b1f6567e825540abb` 🔍
SSDeep	`49152:8Bj/yKahwJxJbi3SK1CsmacQqblizwyZolvL1nUlxQOTnJdcHoNlxUxxGDY9Crc5:g/2vtpmD1UlSoRYoJsAZApQXXb9cEU` 🔍
Imports Hash	`16bf87f974c2a94086d3ebc4936a0cb6` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x108`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`7`
TimeDateStamp	2026-Sep-23 23:42:06
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x377000`
SizeOfInitializedData	`0x2bf600`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000000000326AA0 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x63b000`
SizeOfHeaders	`0x400`
Checksum	`0x644d98`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`53c4f5647ba6df20e43bef6b43721c3c 🔍`
SHA1	`cfba73e05875da85b5efb3de597d3ca69b4dd94c 🔍`
SHA256	`43a5ed0c0c12eb3945bb7ce0d123fde929ff3a8762dc93282252211cb0249270 🔍`
SHA3	`22d1150c682c14ea1999df713bd6a500a70e0d4bb6aa33ea0f03352fef78582e 🔍`
VirtualSize	`0x376e5c`
VirtualAddress	`0x1000`
SizeOfRawData	`0x377000`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.39042`

.rdata

MD5	`aa584cad12a552ce0031ac2b45c9166c 🔍`
SHA1	`91c6490d7664f2ca24147a273c777417336cce64 🔍`
SHA256	`f66878f33cfb93dc8f1770e7a532cce09336ec76746de8b1b9ebfa5c12ba6c88 🔍`
SHA3	`2eef19ecd0041eec468c1692429f24fc6c964e26d7442530f8a57d19a32d4ee6 🔍`
VirtualSize	`0x147292`
VirtualAddress	`0x378000`
SizeOfRawData	`0x147400`
PointerToRawData	`0x377400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.01799`

.data

MD5	`4ce20ecb32a34d24a145a38c5b3fb55b 🔍`
SHA1	`9476257157215fd5b79fa38035463812e3f8bdbc 🔍`
SHA256	`26c3b7d848e900610e25acd0b8d9f9737ed28670f3d6534cd68df7f40285580d 🔍`
SHA3	`8e678f0695ec0502c11dfb5fce635cb91349d54a0d0fb9b7cbcbc115e0ace632 🔍`
VirtualSize	`0xc4bc`
VirtualAddress	`0x4c0000`
SizeOfRawData	`0x9a00`
PointerToRawData	`0x4be800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`3.11985`

.pdata

MD5	`3c21f27ca51eba7c1f34425c925b870e 🔍`
SHA1	`89925553852c3c6c704abe7b3ed707c7bbc41b93 🔍`
SHA256	`464267678d915639e1377c6221480f530c0a79034b2043aae50c318f641c1fff 🔍`
SHA3	`1ae3fce3caf5a79c906855dab8c17cc48f2f75348636190d2b14e0a53cec9eee 🔍`
VirtualSize	`0x1c320`
VirtualAddress	`0x4cd000`
SizeOfRawData	`0x1c400`
PointerToRawData	`0x4c8200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.36849`

.fptable

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x100`
VirtualAddress	`0x4ea000`
SizeOfRawData	`0x200`
PointerToRawData	`0x4e4600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`60264a5aab2b74f6a854985b8c8ed4bc 🔍`
SHA1	`05c9a001851d38441e56d03848825320e3c31ef7 🔍`
SHA256	`4ba72f7f10ce6b26c3c7398c0b8b838b1752b340c40c26e5b6cd06970cff0be8 🔍`
SHA3	`ffb86ec64a26456f8489d07be731f54de1d08094c32184430e1286f01581a033 🔍`
VirtualSize	`0x1454d0`
VirtualAddress	`0x4eb000`
SizeOfRawData	`0x145600`
PointerToRawData	`0x4e4800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.93419`

.reloc

MD5	`11f149ab853ed2eab61732b35557bb25 🔍`
SHA1	`c06b0c0025b048f43059bb08e4425a6c1b116b79 🔍`
SHA256	`cc105fcc2d3354c0239293bd9360cfd764a2334fabdcdfb686cf771ffb0080a1 🔍`
SHA3	`f8f2691e39b55d6a6decc128acf9518100636e529bf9825388ba59f518c94482 🔍`
VirtualSize	`0x9f88`
VirtualAddress	`0x631000`
SizeOfRawData	`0xa000`
PointerToRawData	`0x629e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.11721`

Imports

ADVAPI32.dll	`CloseServiceHandle` `ControlService` `OpenSCManagerW` `OpenServiceW` `QueryServiceStatusEx` `StartServiceW` `RegCloseKey` `RegOpenKeyExW` `RegQueryValueExW` `RegCreateKeyExW` `RegDeleteKeyExW` `RegDeleteValueW` `RegQueryInfoKeyW` `RegSetValueExW` `OpenProcessToken` `AdjustTokenPrivileges` `LookupPrivilegeValueW` `RegGetValueW` `GetTokenInformation` `SetTokenInformation` `OpenThreadWaitChainSession` `CloseThreadWaitChainSession` `GetThreadWaitChain` `QueryServiceConfigW` `CloseEventLog` `OpenEventLogW` `ReadEventLogW` `RegEnumKeyExW` `QueryServiceStatus` `GetLengthSid` `GetSidLengthRequired` `IsValidSid` `LookupAccountSidW` `EnumServicesStatusExW` `EqualSid` `GetSecurityInfo` `RegEnumValueW` `QueryServiceConfig2W`
COMCTL32.dll	`#413` `InitCommonControlsEx` `#345` `ImageList_Create` `ImageList_Destroy` `#412` `#411` `#410`
CRYPT32.dll	`CertGetNameStringW`
d3d11.dll	`D3D11CreateDevice`
D3DCOMPILER_47.dll	`D3DCompile`
d2d1.dll	`#1`
dcomp.dll	`DCompositionCreateDevice`
DWrite.dll	`DWriteCreateFactory`
dbghelp.dll	`MiniDumpWriteDump`
dwmapi.dll	`DwmSetWindowAttribute` `DwmFlush` `DwmGetWindowAttribute`
dxgi.dll	`CreateDXGIFactory1`
gdiplus.dll	`GdipCreateBitmapFromStream` `GdipBitmapUnlockBits` `GdipGetImageWidth` `GdipGetRegionHRgn` `GdipDeleteRegion` `GdipCreateRegionPath` `GdipGetPathWorldBounds` `GdipAddPathPolygon` `GdipAddPathEllipse` `GdipAddPathRectangle` `GdipFillPath` `GdipFillEllipse` `GdipAddPathArc` `GdipClosePathFigure` `GdipRestoreGraphics` `GdipSaveGraphics` `GdipSetClipRect` `GdipCreateImageAttributes` `GdipDisposeImageAttributes` `GdipSetImageAttributesColorMatrix` `GdipSetImageAttributesWrapMode` `GdipSetInterpolationMode` `GdipGraphicsClear` `GdipDrawImageRectI` `GdipDrawImageRectRectI` `GdipSetClipRectI` `GdipResetClip` `GdipCreatePathGradientFromPath` `GdipSetPathGradientPresetBlend` `GdipSetCompositingQuality` `GdipFillRectangle` `GdipSetClipPath` `GdipGetSmoothingMode` `GdipSetTextRenderingHint` `GdipResetWorldTransform` `GdipFillRectangleI` `GdipCreateFontFromDC` `GdipCreateFontFromLogfontA` `GdipDeleteFont` `GdipDrawString` `GdipCreateStringFormat` `GdipDeleteStringFormat` `GdipSetStringFormatAlign` `GdipSetStringFormatLineAlign` `GdiplusStartup` `GdiplusShutdown` `GdipCloneBitmapAreaI` `GdipSetPathGradientCenterColor` `GdipSetPathGradientSurroundColorsWithCount` `GdipSetPathGradientCenterPoint` `GdipGetPathGradientPointCount` `GdipDrawEllipse` `GdipCreateLineBrushI` `GdipDrawRectangle` `GdipSaveImageToStream` `GdipGetImageEncodersSize` `GdipGetImageEncoders` `GdipDrawLines` `GdipRotateWorldTransform` `GdipCreateFontFamilyFromName` `GdipDeleteFontFamily` `GdipGetGenericFontFamilySansSerif` `GdipCreateFont` `GdipMeasureString` `GdipAddPathRectangleI` `GdipGetImageHeight` `GdipBitmapLockBits` `GdipAlloc` `GdipFree` `GdipCreatePath` `GdipClonePath` `GdipDeletePath` `GdipStartPathFigure` `GdipAddPathLine` `GdipAddPathLine2` `GdipAddPathBezier` `GdipFillPolygon` `GdipDrawPath` `GdipDrawPolygon` `GdipTranslateWorldTransform` `GdipSetPixelOffsetMode` `GdipSetSmoothingMode` `GdipDeleteGraphics` `GdipCreateFromHDC` `GdipFlush` `GdipCreateBitmapFromScan0` `GdipGetImageGraphicsContext` `GdipDisposeImage` `GdipCloneImage` `GdipSetPenDashStyle` `GdipSetPenLineJoin` `GdipSetPenEndCap` `GdipSetPenStartCap` `GdipDeletePen` `GdipCreatePen2` `GdipCreatePen1` `GdipSetLineWrapMode` `GdipSetLinePresetBlend` `GdipCreateLineBrush` `GdipCreateSolidFill` `GdipDeleteBrush` `GdipCloneBrush` `GdipScaleMatrix` `GdipTranslateMatrix` `GdipDeleteMatrix` `GdipCreateMatrix` `GdipTransformPath`
GDI32.dll	`DeleteObject` `GetDCPenColor` `GetStockObject` `DeleteDC` `Ellipse` `LineTo` `SetWindowOrgEx` `GetRegionData` `GetClipBox` `SetViewportOrgEx` `GetDIBits` `Rectangle` `PatBlt` `ExtSelectClipRgn` `SelectClipRgn` `CreateRoundRectRgn` `SetDCBrushColor` `GetObjectType` `GetClipRgn` `CreateRectRgnIndirect` `CreateCompatibleBitmap` `BitBlt` `Polyline` `Polygon` `RemoveFontMemResourceEx` `AddFontMemResourceEx` `Arc` `GdiFlush` `TextOutW` `GetObjectA` `RoundRect` `FillRgn` `ExtCreateRegion` `SelectObject` `CreateCompatibleDC` `CreatePen` `GetTextExtentPoint32W` `CreateBitmap` `GetTextFaceW` `GetGlyphIndicesW` `GetGlyphOutlineW` `CreateFontW` `SetTextCharacterExtra` `GetTextCharacterExtra` `CreateRectRgn` `CombineRgn` `SetBkColor` `CreateSolidBrush` `SetTextColor` `SetBkMode` `GetTextColor` `GetBkColor` `SaveDC` `RestoreDC` `RectVisible` `IntersectClipRect` `CreateFontIndirectW` `GetTextMetricsW` `GetObjectW` `GetCurrentObject` `MoveToEx` `CreateDIBSection` `SetDCPenColor`
MFPlat.DLL	`MFCopyImage` `MFStartup` `MFShutdown` `MFCreateMemoryBuffer` `MFCreateSample` `MFCreateAttributes` `MFCreateMediaType`
MFPlay.DLL	`MFPCreateMediaPlayer`
MFReadWrite.dll	`MFCreateSourceReaderFromURL` `MFCreateSinkWriterFromURL`
MSIMG32.dll	`AlphaBlend` `GradientFill`
ole32.dll	`CoDecrementMTAUsage` `CoIncrementMTAUsage` `GetHGlobalFromStream` `CreateStreamOnHGlobal` `CoCreateGuid` `StringFromGUID2` `CoCreateInstance` `CoTaskMemFree` `CoInitializeEx` `CoSetProxyBlanket` `CoUninitialize`
pdh.dll	`PdhOpenQueryW` `PdhCollectQueryData` `PdhCloseQuery` `PdhGetFormattedCounterValue` `PdhGetFormattedCounterArrayW` `PdhAddEnglishCounterW`
POWRPROF.dll	`PowerGetActiveScheme` `PowerReadACValueIndex` `PowerReadDCValueIndex` `CallNtPowerInformation`
SHELL32.dll	`SetCurrentProcessExplicitAppUserModelID` `ShellExecuteExW` `SHGetKnownFolderPath` `ShellExecuteW` `Shell_NotifyIconW` `SHCreateItemFromParsingName` `#18` `#155` `#16` `#17` `#190` `SHOpenFolderAndSelectItems` `SHGetFileInfoW` `SHGetFolderLocation` `SHGetDesktopFolder` `CommandLineToArgvW`
SHLWAPI.dll	`#12` `StrRetToBufW` `PathFindFileNameW`
api-ms-win-shcore-scaling-l1-1-1.dll	`GetDpiForMonitor`
USER32.dll	`SetWindowLongPtrW` `FindWindowW` `GetClassNameW` `LoadIconW` `DestroyIcon` `LoadImageW` `DrawIconEx` `CreateIconIndirect` `GetMonitorInfoW` `TrackPopupMenu` `MapWindowPoints` `ShowWindowAsync` `DialogBoxParamW` `EndDialog` `SendDlgItemMessageW` `SetMenuDefaultItem` `ScreenToClient` `EnumWindows` `GetLastActivePopup` `GetWindow` `GetDlgCtrlID` `DrawFocusRect` `RegisterClassExW` `DialogBoxIndirectParamW` `SetCapture` `ReleaseCapture` `DestroyAcceleratorTable` `SetMenu` `DrawMenuBar` `UpdateWindow` `RedrawWindow` `ShowScrollBar` `AdjustWindowRectExForDpi` `GetSysColor` `EnumChildWindows` `LoadCursorW` `SetScrollInfo` `GetScrollInfo` `SystemParametersInfoForDpi` `MonitorFromPoint` `DefWindowProcW` `SetLayeredWindowAttributes` `CreateAcceleratorTableW` `CreateMenu` `CheckMenuItem` `GetMenuItemCount` `RemoveMenu` `DeleteMenu` `PtInRect` `SetWindowRgn` `ModifyMenuW` `WindowFromPoint` `CheckMenuRadioItem` `SystemParametersInfoW` `MonitorFromRect` `GetAncestor` `EnumDisplayMonitors` `GetCapture` `CheckRadioButton` `IsDlgButtonChecked` `EnableMenuItem` `PrintWindow` `SetParent` `UpdateLayeredWindow` `GetSystemMetricsForDpi` `GetMenu` `GetMenuItemInfoW` `GetWindowDC` `GetUpdateRgn` `SetScrollPos` `SetCursor` `OffsetRect` `GetMenuBarInfo` `GetGUIThreadInfo` `IsHungAppWindow` `GetWindowTextLengthW` `GetWindowTextW` `DrawTextW` `EmptyClipboard` `SetClipboardData` `CloseClipboard` `OpenClipboard` `GetDpiForSystem` `GetDpiForWindow` `MonitorFromWindow` `EqualRect` `IsRectEmpty` `UnionRect` `IntersectRect` `ReleaseDC` `GetDC` `SetProcessDpiAwarenessContext` `GetWindowThreadProcessId` `FindWindowExW` `AllowSetForegroundWindow` `SetForegroundWindow` `SendMessageTimeoutW` `GetWindowLongPtrW` `GetCursorPos` `MessageBeep` `DestroyMenu` `TrackPopupMenuEx` `CreatePopupMenu` `GetSystemMetrics` `TranslateAcceleratorW` `KillTimer` `SetTimer` `GetKeyState` `GetActiveWindow` `SetWindowPlacement` `GetWindowPlacement` `SetWindowPos` `MoveWindow` `IsChild` `RegisterWindowMessageW` `InflateRect` `MessageBoxW` `GetWindowRect` `AppendMenuW` `SetActiveWindow` `SetFocus` `GetDlgItem` `SetWindowTextW` `InsertMenuW` `SetDlgItemTextW` `IsDialogMessageW` `ClientToScreen` `GetShellWindow` `GetMessageW` `EnableWindow` `MsgWaitForMultipleObjects` `DestroyWindow` `IsIconic` `IsWindowVisible` `ShowWindow` `IsWindow` `PostQuitMessage` `PostMessageW` `PeekMessageW` `DispatchMessageW` `TranslateMessage` `GetParent` `FillRect` `GetSysColorBrush` `GetClientRect` `InvalidateRect` `EndPaint` `BeginPaint` `IsWindowEnabled` `GetFocus` `CreateWindowExW` `SendMessageW` `SetMenuItemInfoW` `TrackMouseEvent`
UxTheme.dll	`SetWindowTheme`
VERSION.dll	`VerQueryValueW` `GetFileVersionInfoExW` `GetFileVersionInfoSizeExW` `GetFileVersionInfoW` `GetFileVersionInfoSizeW`
WINTRUST.dll	`WTHelperGetProvCertFromChain` `WTHelperGetProvSignerFromChain` `WTHelperProvDataFromStateData` `WinVerifyTrust`
WINHTTP.dll	`WinHttpQueryHeaders` `WinHttpSetOption` `WinHttpReceiveResponse` `WinHttpSendRequest` `WinHttpOpenRequest` `WinHttpSetTimeouts` `WinHttpOpen` `WinHttpCloseHandle` `WinHttpConnect` `WinHttpReadData` `WinHttpWriteData`
IPHLPAPI.DLL	`GetIfTable2` `GetIfStackTable` `GetUnicastIpAddressTable` `GetBestRoute2` `FreeMibTable` `GetExtendedUdpTable` `GetExtendedTcpTable`
WS2_32.dll	`WSACleanup` `WSAStartup` `getservbyport` `InetNtopW` `inet_ntop` `ntohs` `InetPtonW`
WTSAPI32.dll	`WTSEnumerateSessionsW` `WTSDisconnectSession` `WTSSendMessageW` `WTSLogoffSession` `WTSQuerySessionInformationW` `WTSFreeMemory`
bcrypt.dll	`BCryptDestroyHash` `BCryptCreateHash` `BCryptOpenAlgorithmProvider` `BCryptCloseAlgorithmProvider` `BCryptHashData` `BCryptFinishHash`
CFGMGR32.dll	`CM_Get_DevNode_PropertyW` `CM_Locate_DevNodeW`
dxcore.dll	`DXCoreCreateAdapterFactory`
ESENT.dll	`JetGetObjectInfoW` `JetGetTableColumnInfoW` `JetOpenDatabaseW` `JetDetachDatabaseW` `JetAttachDatabaseW` `JetMove` `JetRetrieveColumn` `JetCloseDatabase` `JetOpenTableW` `JetCloseTable` `JetInit` `JetCreateInstanceW` `JetTerm` `JetSetSystemParameterW` `JetBeginSessionW` `JetEndSession`
OLEAUT32.dll	`SysStringLen` `SetErrorInfo` `SysAllocString` `SysFreeString` `VariantInit` `VariantClear` `GetErrorInfo`
SETUPAPI.dll	`SetupDiGetDeviceInterfaceDetailW` `SetupDiGetClassDevsW` `SetupDiEnumDeviceInterfaces` `SetupDiGetDeviceInstanceIdW` `SetupDiDestroyDeviceInfoList`
VSSAPI.DLL	`VssFreeSnapshotPropertiesInternal` `CreateVssBackupComponentsInternal`
wlanapi.dll	`WlanGetNetworkBssList` `WlanQueryInterface` `WlanEnumInterfaces` `WlanCloseHandle` `WlanOpenHandle` `WlanFreeMemory`
KERNEL32.dll	`GetLogicalDriveStringsW` `GetLocalTime` `GetVolumePathNameW` `GetSystemTime` `GetCurrentThreadId` `GetEnvironmentVariableW` `lstrcmpiW` `GetProcAddress` `Thread32Next` `Thread32First` `GetActiveProcessorCount` `GetActiveProcessorGroupCount` `SetProcessAffinityMask` `GetProcessAffinityMask` `GetProcessIdOfThread` `GetThreadId` `GetProcessId` `GetPriorityClass` `OpenThread` `SetFileInformationByHandle` `GetWindowsDirectoryW` `GetSystemDirectoryW` `GetFileInformationByHandleEx` `FindFirstFileExW` `VirtualFree` `VirtualAlloc` `GetDiskFreeSpaceExW` `GetSystemTimeAsFileTime` `CompareStringOrdinal` `LoadLibraryExW` `GetTempFileNameW` `GetVolumeNameForVolumeMountPointW` `OutputDebugStringW` `FindFirstVolumeW` `FindNextVolumeW` `FindVolumeClose` `DeviceIoControl` `IsDebuggerPresent` `GetComputerNameExW` `GetEnvironmentVariableA` `GetFileType` `DuplicateHandle` `ReadProcessMemory` `FreeLibrary` `IsWow64Process` `IsWow64Process2` `GetProcessIoCounters` `K32GetProcessMemoryInfo` `GetSystemWindowsDirectoryW` `RemoveDirectoryW` `ResumeThread` `CreateJobObjectW` `AssignProcessToJobObject` `SetInformationJobObject` `AddDllDirectory` `IsProcessorFeaturePresent` `GetSystemTimes` `GlobalMemoryStatusEx` `GetSystemInfo` `GetLogicalProcessorInformationEx` `GetSystemFirmwareTable` `GetSystemPowerStatus` `GetNumaProcessorNodeEx` `K32GetPerformanceInfo` `K32EnumPageFilesW` `LoadLibraryW` `RtlPcToFileHeader` `RaiseException` `RtlLookupFunctionEntry` `RtlUnwindEx` `InterlockedPushEntrySList` `FlsAlloc` `FlsGetValue` `FlsSetValue` `FlsFree` `CreateThread` `ExitThread` `FreeLibraryAndExitThread` `GetModuleHandleExW` `ExitProcess` `RtlCaptureContext` `RtlVirtualUnwind` `UnhandledExceptionFilter` `GetStdHandle` `HeapFree` `HeapAlloc` `VirtualProtect` `GetDateFormatW` `GetTimeFormatW` `CompareStringW` `LCMapStringW` `GetLocaleInfoW` `IsValidLocale` `GetUserDefaultLCID` `EnumSystemLocalesW` `GetConsoleOutputCP` `GetConsoleMode` `ReadConsoleW` `GetTimeZoneInformation` `SetStdHandle` `SetEndOfFile` `IsValidCodePage` `GetACP` `GetOEMCP` `HeapReAlloc` `GetCommandLineA` `GetEnvironmentStringsW` `CopyFileW` `QueryFullProcessImageNameW` `SetFilePointerEx` `OutputDebugStringA` `GetDateFormatEx` `GetTimeFormatEx` `FileTimeToSystemTime` `FileTimeToLocalFileTime` `MoveFileExW` `WriteFile` `ReadFile` `GetFileSizeEx` `GetFileInformationByHandle` `GetDriveTypeW` `FlushFileBuffers` `FindNextFileW` `FindFirstFileW` `FindClose` `DeleteFileW` `FreeEnvironmentStringsW` `GetCommandLineW` `GetTempPathW` `CloseHandle` `GetLastError` `CreateMutexW` `Sleep` `GetTickCount64` `SetDefaultDllDirectories` `LocalFree` `GetModuleHandleW` `LoadResource` `LockResource` `SizeofResource` `GetVolumeInformationW` `SetEnvironmentVariableW` `GetProcessHeap` `HeapSize` `WriteConsoleW` `RtlUnwind` `FormatMessageW` `GetComputerNameW` `FindResourceW` `MulDiv` `GlobalAlloc` `GlobalUnlock` `CreateDirectoryW` `Process32NextW` `GlobalLock` `GlobalFree` `MultiByteToWideChar` `WideCharToMultiByte` `CreateFileW` `GetFinalPathNameByHandleW` `SetLastError` `GetExitCodeProcess` `GetModuleFileNameW` `GetCurrentProcess` `SetPriorityClass` `ExpandEnvironmentStringsW` `GetFileAttributesW` `WaitForSingleObject` `GetProcessTimes` `GetCurrentProcessId` `TerminateProcess` `CreateProcessW` `ProcessIdToSessionId` `OpenProcess` `CreateToolhelp32Snapshot` `Process32FirstW`
api-ms-win-core-localization-l1-2-0.dll	`FormatMessageA` `GetCPInfo` `LCMapStringEx` `GetLocaleInfoEx`
api-ms-win-core-synch-l1-1-0.dll	`ReleaseSRWLockExclusive` `InitializeCriticalSectionEx` `WaitForSingleObjectEx` `DeleteCriticalSection` `TryAcquireSRWLockExclusive` `LeaveCriticalSection` `AcquireSRWLockExclusive` `EnterCriticalSection`
api-ms-win-core-processthreads-l1-1-0.dll	`GetExitCodeThread` `SwitchToThread` `GetStartupInfoW`
api-ms-win-core-synch-l1-2-0.dll	`WakeConditionVariable` `SleepConditionVariableSRW` `WakeAllConditionVariable` `WaitOnAddress` `WakeByAddressAll`
api-ms-win-core-profile-l1-1-0.dll	`QueryPerformanceFrequency` `QueryPerformanceCounter`
api-ms-win-core-sysinfo-l1-2-0.dll	`GetSystemTimePreciseAsFileTime`
api-ms-win-core-file-l1-1-0.dll	`GetFileAttributesExW`
api-ms-win-core-file-l1-2-0.dll	`CreateFile2`
api-ms-win-core-file-l1-2-2.dll	`AreFileApisANSI`
api-ms-win-core-file-l2-1-0.dll	`CreateHardLinkW`
api-ms-win-core-util-l1-1-0.dll	`DecodePointer` `EncodePointer`
api-ms-win-core-string-l1-1-0.dll	`GetStringTypeW`
api-ms-win-core-errorhandling-l1-1-0.dll	`SetUnhandledExceptionFilter`
api-ms-win-core-interlocked-l1-1-0.dll	`InitializeSListHead`
api-ms-win-core-winrt-l1-1-0.dll	`RoGetActivationFactory`
api-ms-win-core-winrt-error-l1-1-1.dll	`RoOriginateLanguageException`

Delayed Imports

1

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x301`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.6594`
Detected Filetype	PNG graphic file
MD5	`86347fd5c2a2190b3bf5dddc4ea6eabc 🔍`
SHA1	`40c94591d72d4f304fb577db48d87e082afca2f2 🔍`
SHA256	`9f3e5fa90334eb3c2d3123b444dba347fe54b7bb6e034f7c48360bed4ef4a0f1 🔍`
SHA3	`d55d28b8e1e5a7c0b8e65f34a6f3e9acb9d57f0a8d68bdab7f0789d9fe9ca0b1 🔍`

2

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x43d`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.80179`
Detected Filetype	PNG graphic file
MD5	`eac8d4098d3bc6b3199af398958a3cc7 🔍`
SHA1	`709e4de9634f18848e6d813ebda485514af064a3 🔍`
SHA256	`8a33a06e82030b0d2bd00d2f5f014befcc037d89918d765e496002ead54329d4 🔍`
SHA3	`0715313803a98efc11391b14cd2ed21a8422782ba2d4dff5e80049be22715d67 🔍`

3

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x5a0`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.85044`
Detected Filetype	PNG graphic file
MD5	`03e089c7e93c58571adab0aa395e569c 🔍`
SHA1	`e9858667932d66e9dc1c79e35542d5b7518b15d8 🔍`
SHA256	`55931b533471d68b8f9f90268ff88a508ed002a7001060497dfc1d27c6880bd0 🔍`
SHA3	`5edf9bebad4969a0eafdf05a1110f350a543bfaf166e9aad389c89670f925678 🔍`

4

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x8ca`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.92337`
Detected Filetype	PNG graphic file
MD5	`1292a7399c77d0e8e4e9f017bfab84a9 🔍`
SHA1	`54a9727037be46c648f9969fc86c7729b5ed3213 🔍`
SHA256	`7f26c443570cb70f42344c2c7dd86139fbfeb2bd515aa3fa8b2446916a413421 🔍`
SHA3	`3c5411f4b682e551890d822224de0819afef463583f88b7e35f0ab3470e4a6c0 🔍`

5

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0xc9e`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.93526`
Detected Filetype	PNG graphic file
MD5	`34cac7e920c426734db4462548c07127 🔍`
SHA1	`5224bcd9648845250fb94270a4c020e66af5d7a4 🔍`
SHA256	`8883a61ec744b3cfde10527d232471bcb7d2418fa3a5329dbbd73924c83cf882 🔍`
SHA3	`dde140154c2ec6f3cc42aac50e27855ace0f965935c175d3f7a6477cb3efff89 🔍`

6

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x1110`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.94889`
Detected Filetype	PNG graphic file
MD5	`c7c3a5d1fb8b5381c69f4c3622dfdbf9 🔍`
SHA1	`83d947a2e0278aa78a02451cb853fff0a406b1e3 🔍`
SHA256	`93b83c4aef03cb419c6484245ef13a70fa4ee0c3858c660ccc73296fbb1d092f 🔍`
SHA3	`9e1422ad673a1200e1fc6c28ac202463ecfeb47f183c1cf05438b7e3b6be2068 🔍`

7

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x1acd`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96618`
Detected Filetype	PNG graphic file
MD5	`98d4f096a2742e7e3c1b84464a8e8b9a 🔍`
SHA1	`1a49d4b54621d530fe3cd56e94ac0ca5ee8d1219 🔍`
SHA256	`7992d395855b0be45afadeefba108afd9399722a6afaa0a72329ef269ac5bb89 🔍`
SHA3	`1a769bb18b81ae769cd47e35efb74d260582cb2bdd89b1c8372d14d2fd872ac7 🔍`

8

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x5303`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.98619`
Detected Filetype	PNG graphic file
MD5	`23aead87ef2882e880a147c270fcd510 🔍`
SHA1	`98aa8ef386a106a388dd10c02e944009b1ce1e9d 🔍`
SHA256	`25a0a17715db9a88c3c18b0f1c59449afd1dc18775549238d1ed028d27a68af7 🔍`
SHA3	`87526e4ecf8f1dedb3b0cbdc81a4b5c35b13ac5adcf56eb9ea1f1de6fe41d4af 🔍`

9

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x112e5`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99096`
Detected Filetype	PNG graphic file
MD5	`3088caac1758bc4dbfbf635b149fb927 🔍`
SHA1	`b6e94c09e760be8c2a90e10be12f975da26857e6 🔍`
SHA256	`e717268c07b6be1ab618e5e5e392899885651d00b06e2b128396bedbb8efa524 🔍`
SHA3	`e7635a26e209fe4d605998e194240d3fce1bd6bf2de4598ca4d5d6055f0793c5 🔍`

107

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0x1d8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.16706`
MD5	`bfc3614ceedbb58038ec42ef8e063c59 🔍`
SHA1	`39a1bd9a6da39426aa97c6ea99a3d8eae049e2b8 🔍`
SHA256	`a439916e2a7e34212a04983c8a638b618b26be1e6eb8b6db5d2517312b72a95b 🔍`
SHA3	`82ee968a22d29b9721bb10981ceb181a0b19c009aa4428f92eac49255ae2eeb2 🔍`

109

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0x340`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.23414`
MD5	`6601c0b84df0452ea6faf20776169c74 🔍`
SHA1	`97cde84d37bbaba410c5c914df50b9f7414ac2aa 🔍`
SHA256	`843ed214dbd91020f31970e17f656cd167eeff2cf20ba35feb0c343eebfdf476 🔍`
SHA3	`53d1d6d31ca158c662e73a14fd6e92928e0be524c7b65a77a026c39fc85b67e0 🔍`

111

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0x164`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.05525`
MD5	`d9c0951a386d09a5cd1210dad4eed2a8 🔍`
SHA1	`ec56dd313d151e2841988f8bd6cc3a5c7b9e4740 🔍`
SHA256	`f9e413d5a4281c938429f89864df0d5f22fd0a8104529558606595e15db4a72f 🔍`
SHA3	`9c2cf9c1aba8fffc633220788f2e7ed6cf996792b8c85204316d28d89ea59785 🔍`

102

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0xfb58`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`6.29438`
Detected Filetype	TrueType font file
MD5	`0b351794097c0555098ee56ae5ab22bf 🔍`
SHA1	`0a7c420d18378e3fb797cfb3407ca743cc50cad9 🔍`
SHA256	`b62301163788bc5b7f8fcac0b74b184e34e1827e577b499ecb724da065098f87 🔍`
SHA3	`6b96c53fe728cfe508187adaf5c400f3f9116548a067beaee4df5ca7786e61ac 🔍`

103

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0xb564`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.6576`
Detected Filetype	TrueType font file
MD5	`2427d7acdb15d5c064b9ced748f0da75 🔍`
SHA1	`8f898b1ff95ac829cba51a7755fd8d1754edb162 🔍`
SHA256	`7ff4532d7f855d80f7066c558e50a959ad8561c2cd4c711dd3b84bdd5facdb9e 🔍`
SHA3	`6229a31e5f526f0a6a21ed7a8795294d2186a9dc1ea43ee24c95dfb44a5372d0 🔍`

104

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x464df`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.86016`
Detected Filetype	JPEG graphic file
MD5	`358e9f0faad6844293096c85cf6ba4d7 🔍`
SHA1	`1353b215ba48c608d996e0ab550d0763709add48 🔍`
SHA256	`bca0234206bb4af34b86436bada8539b708dc2df691c39be4931a38cba0736fe 🔍`
SHA3	`81969a10bbabecec469fa3eb00ede796ba047942959bd41177a896e84c3575ee 🔍`

105

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x3dec4`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99484`
Detected Filetype	PNG graphic file
MD5	`cff26b0cafb3c6ca7c4ab4719809cf41 🔍`
SHA1	`18d9b2e31bde3aa619df497458e1e5625fa16570 🔍`
SHA256	`c7c6daf26215316160a4f8d4d77dcaaf6db9e7a17e94721cd1f3bca936572f65 🔍`
SHA3	`3302f9bcd388c7230e0fa76db899bca00e1d7b3465faeb724c7d8b9aa19c733f 🔍`

106

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x33a`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.65786`
Detected Filetype	PNG graphic file
MD5	`3948dbf587b51bccd9a40dd33a97e38b 🔍`
SHA1	`dd99576f1263895764911098d6d779f693fa111a 🔍`
SHA256	`9cb35ed7364bfb42b7d5923d3218d72e953d1de6928409c44db8062947f72e25 🔍`
SHA3	`b0fe8d420165e5b8644a5040d1fea43876a19483db7abe1d50aeb15ab242e661 🔍`

108

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x10980`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99157`
Detected Filetype	PNG graphic file
MD5	`da586cd8bc8fba9aae0923330428d98c 🔍`
SHA1	`7280541b6b911d39b057d46470af5d8335043a2c 🔍`
SHA256	`d2b2e90f77273a6070ab6a6ccae8e650fbea1c2e43d9a760f6046f7dd7d10ad7 🔍`
SHA3	`a05dbbe9eab0b5239b9fba042808166e97dbfe8fb4ed90ce7437071a90737854 🔍`

110

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x72eb4`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.98523`
MD5	`3ab03e613fe336d864819c51786d92c4 🔍`
SHA1	`f6769ca4223ff5e5cd8478dec8b449526f285342 🔍`
SHA256	`ce7fbc09744237e6d89332de97f180dfa770df24e4dbfef0aa2830e517c8034a 🔍`
SHA3	`05429fdfbf369232c75c1be8255c2995d7c4df3c14f7eb57daef2ba08e9db1e4 🔍`

112

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x5c34`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.40047`
Detected Filetype	PNG graphic file
MD5	`57b25e357b23694ea4df9bfdc5310051 🔍`
SHA1	`5d9bc3e95e8d52bd5592922bc64129272b9ab7df 🔍`
SHA256	`2a72fa9dddbd9049a4b96a58a69dadc78be23ccbd4399813692ae6a145483f01 🔍`
SHA3	`2c739e0f53a7c2c25c562e4e388fc0ecda115de2caf7e4f5a0dd1f8bd737b7f2 🔍`

101

Type	`RT_GROUP_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x84`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.03215`
Detected Filetype	Icon file
MD5	`827a0f5d49f8ce68501f520e6e820b32 🔍`
SHA1	`ec93e01d88aaf098f0e34edb66a193fffe4b4287 🔍`
SHA256	`9c88439a012f6eafe8d847580628258f537a10aaf0237eeadcd6ca15b8ac0cca 🔍`
SHA3	`ce8893ef3b87ffe18aca89750772175e8978321469aa0203c82c9caaee1a6016 🔍`

1 (#2)

Type	`RT_VERSION`
Language	English - United States
Codepage	UNKNOWN
Size	`0x284`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.29481`
MD5	`e25d34bb69359af392c6f63251ef0436 🔍`
SHA1	`ad2b99fd1ae5f015d27f02233b35521e6e5bccf2 🔍`
SHA256	`e45913c1ef32d95999bf7cf17d43b77b2a2d84493dfa9378ec7dff3634a69690 🔍`
SHA3	`48734b7127cf45e405bcdf8c0002d8286bd64a3e38ec2bc7adfe88246eb68803 🔍`

1 (#3)

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x60a`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.06853`
MD5	`d081dddb3cea7d409f53138649f7355c 🔍`
SHA1	`d8503d269cbce66856c908114a1717ee43a5fbb9 🔍`
SHA256	`fed047f620f750e9edaf679d3c8588f29fc08022f636b1d4521af4255a0304c5 🔍`
SHA3	`71c4c07381d073c04cd0604feed947a0ad285342991fe1cf3739a163c8c3eb7c 🔍`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.0.0.0
ProductVersion	1.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT` `VOS_NT_WINDOWS32` `VOS_WINCE` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	English - United States
CompanyName	TMOG
FileDescription	Task Manager TMOG
FileVersion (#2)	1.0.0.0
InternalName	tmog_windows
OriginalFilename	Task Manager.exe
ProductName	Task Manager TMOG
ProductVersion (#2)	1.0.0.0

Resource LangID	English - United States

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2026-Sep-23 23:42:06
Version	`0.0`
SizeofData	`1072`
AddressOfRawData	`0x47a4d8`
PointerToRawData	`0x4798d8`

TLS Callbacks

StartAddressOfRawData	`0x14047a960`
EndAddressOfRawData	`0x14047a97c`
AddressOfIndex	`0x1404cb7b0`
AddressOfCallbacks	`0x140379968`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_8BYTES`
Callbacks	`(EMPTY)`

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x1404c4ac0`

RICH Header

XOR Key	`0xf13603e8`
Unmarked objects	`0`
ASM objects (33145)	`27`
ASM objects (35721)	`10`
C objects (35721)	`17`
C++ objects (35721)	`100`
Imports (VS2008 SP1 build 30729)	`36`
C objects (CVTCIL) (33145)	`1`
C++ objects (33145)	`186`
C objects (33145)	`47`
Imports (33145)	`79`
Total imports	`750`
C++ objects (36256)	`114`
Resource objects (36256)	`1`
Linker (36256)	`1`

Errors

Leave a comment

No comments yet.