Manalyze report for 218860fecc251ac5b6763887a95adca1d6112f2975db77101d76f25642d84ea3

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-May-08 15:54:33
Detected languages	English - United States French - France
Debug artifacts	E:\sources\oc2022\x64\RandomD3D_x64\Mossx64.pdb
CompanyName	Nohope
FileDescription	Moss
FileVersion	`7,2,2,0`
InternalName	M.O.S.S.
LegalCopyright	Copyright Nohope (C) 2025
OriginalFilename	MOSS.exe
ProductName	MOSS
ProductVersion	`7,2,2,0`

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`Contains references to security software: AU.exe GUARD.EXE` `Tries to detect virtualized environments: HARDWARE\DESCRIPTION\System` `Accesses the WMI: ROOT\CIMV2 Root\CIMv2 Root\Security` `Contains domain names: http://msdl.microsoft.com http://msdl.microsoft.com/download/symbols http://nohope.eu https://discord.gg https://nohope.eu https://twitter.com https://www.microsoft.com https://www.microsoft.com/en-us/download/details.aspx?displaylang https://www.paypal.com https://www.paypal.com/donate?token microsoft.com msdl.microsoft.com openssl.org paypal.com twitter.com www.microsoft.com www.paypal.com`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32` `Uses constants related to SHA256` `Microsoft's Cryptography API`
Suspicious	The PE is possibly packed.	`Unusual section name found: .gehcont`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: LoadLibraryExA LoadLibraryExW GetProcAddress LoadLibraryW` `Functions which can be used for anti-debugging purposes: SwitchToThread FindWindowW` `Code injection capabilities (PowerLoader): GetWindowLongW FindWindowW` `Can access the registry: RegEnumKeyExW RegOpenKeyExA RegCloseKey RegCreateKeyExW RegQueryValueExA RegSetValueExA RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteKeyW RegDeleteValueW` `Possibly launches other programs: ShellExecuteW` `Uses Microsoft's cryptographic API: CryptMsgClose CryptMsgGetParam CryptQueryObject` `Can create temporary files: CreateFileA CreateFileW GetTempPathW` `Uses functions commonly found in keyloggers: GetForegroundWindow GetAsyncKeyState CallNextHookEx MapVirtualKeyW` `Memory manipulation functions often used by packers: VirtualProtect VirtualAlloc` `Has Internet access capabilities: InternetOpenW InternetReadFile InternetOpenUrlW InternetCanonicalizeUrlW InternetGetConnectedState InternetCloseHandle URLDownloadToFileW` `Functions related to the privilege level: OpenProcessToken AdjustTokenPrivileges` `Enumerates local disk drives: GetVolumeInformationW` `Manipulates other processes: EnumProcesses EnumProcessModules EnumProcessModulesEx ReadProcessMemory OpenProcess` `Can take screenshots: CreateCompatibleDC BitBlt GetDC FindWindowW`
Malicious	VirusTotal score: 43/70 (Scanned on 2026-10-27 00:57:19)	`ALYac: Trojan.GenericKD.80093221` `AVG: Win64:MalwareX-gen [Misc]` `AhnLab-V3: Trojan/Win.Generic.R730625` `Antiy-AVL: Trojan/Win32.Sabsik` `Arcabit: Trojan.Generic.D4C62025` `Avast: Win64:MalwareX-gen [Misc]` `Avira: TR/W64.Agent` `BitDefender: Trojan.GenericKD.80093221` `Bkav: W32.Malware.ED9703ED` `Cylance: Unsafe` `Cynet: Malicious (score: 99)` `DeepInstinct: MALICIOUS` `ESET-NOD32: Win64/Moss.A potentially unsafe application` `Elastic: malicious (high confidence)` `Emsisoft: Trojan.GenericKD.80093221 (B)` `F-Secure: Trojan.TR/W64.Agent` `GData: Trojan.GenericKD.80093221` `Google: Detected` `Gridinsoft: Ransom.Win64.Sabsik.cl` `Ikarus: Trojan.W64.Agent` `K7AntiVirus: Unwanted-Program ( 005cecc11 )` `K7GW: Unwanted-Program ( 005cecc11 )` `Lionic: Trojan.Win32.Moss.4!c` `Malwarebytes: Trojan.Dropper` `MaxSecure: Trojan.Malware.325819608.susgen` `McAfeeD: ti!218860FECC25` `MicroWorld-eScan: Trojan.GenericKD.80093221` `Microsoft: Trojan:Win32/Acll!rfn` `Paloalto: generic.ml` `Panda: PUP/Generic` `Rising: PUF.Moss!8.1377D (TFE:5:owxkf54UVPJ)` `Sangfor: Trojan.Win32.Save.a` `Skyhigh: BehavesLike.Win64.Dropper.rm` `Sophos: Mal/Generic-S` `Symantec: ML.Attribute.HighConfidence` `TrellixENS: Artemis!507584223564` `TrendMicro: Trojan.Win64.MOSS.TL0101E926ZQ` `TrendMicro-HouseCall: Trojan.Win64.MOSS.TL0101E926ZQ` `VIPRE: Trojan.GenericKD.80093221` `Varist: W64/ABTrojan.UAAC-2563` `ViRobot: Trojan.Win.Z.Agent.4220416.C` `Webroot: W32.Adware.Gen` `alibabacloud: Trojan:Win/Moss.A`

Hashes

MD5	`5075842235642e895ee88f2101f17138` 🔍
SHA1	`dc47a3c7f51bf89088058ca37b7998596db93194` 🔍
SHA256	`218860fecc251ac5b6763887a95adca1d6112f2975db77101d76f25642d84ea3` 🔍
SHA3	`e475fd4e892fc3cb0d1513b3eb11aeb4f4996b8a411bb14b69888221730ddcb5` 🔍
SSDeep	`49152:qGtlqyXOV7DxNNKkmT8FMDlK/glETGA93hNm+RC446:0gYglEiqhM` 🔍
Imports Hash	`487457b2c725736b0f255d4d16a7423f` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x128`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`8`
TimeDateStamp	2026-May-08 15:54:33
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x1f7e00`
SizeOfInitializedData	`0x226800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00000000001B7F20 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x423000`
SizeOfHeaders	`0x400`
Checksum	`0x411f36`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`81536c8a26f08e654dcf07b5d89935c5 🔍`
SHA1	`54ee69bb64d90158de4cdb5279d062f367185db6 🔍`
SHA256	`e1701bd2ade89078c0e9d08f8f259090375110caace122d8df365d624effc2dc 🔍`
SHA3	`2e6a58a4fd0c46663fd075dcdeaf444296ba8afceaeb5bd5aa2e31fe3d89dde2 🔍`
VirtualSize	`0x1f7d8e`
VirtualAddress	`0x1000`
SizeOfRawData	`0x1f7e00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.42013`

.rdata

MD5	`c62b5b9f2343a57e4de9311f64a5870e 🔍`
SHA1	`08dcac1d438c38015671c1706a1cff0c374b43b6 🔍`
SHA256	`5f56dc4635477920ec7a62f7d2c15135bd05e3491b00bc2b22689dc47adb18c5 🔍`
SHA3	`9b1119ec5c8a338db39f583e5e1285aac9d15fa7fb8e86e777ca5536f6b94d51 🔍`
VirtualSize	`0xae9ce`
VirtualAddress	`0x1f9000`
SizeOfRawData	`0xaea00`
PointerToRawData	`0x1f8200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.59174`

.data

MD5	`bb518734160541902ce358d99380f5a0 🔍`
SHA1	`56261e3dbefe4da673a6c7ced71e22cda90959fc 🔍`
SHA256	`a1f8489d9847a5e5de92a14bf4681fae42ae9034f908954d7e685a2cb19df252 🔍`
SHA3	`0e8509e9756e6c6da3473fb6395382dbc84164137905b432456181b75058c6fc 🔍`
VirtualSize	`0x125268`
VirtualAddress	`0x2a8000`
SizeOfRawData	`0x10d000`
PointerToRawData	`0x2a6c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.281613`

.pdata

MD5	`4f815eee77c3a0b00a9277b1b5736045 🔍`
SHA1	`ef685fd6f3a93920bbb351306b8633ca2052fb87 🔍`
SHA256	`e38a5bee611d489a28e92e46d03523d9371aa1318c79f39fe5c259191ca3c67b 🔍`
SHA3	`b21c2412982867c8d1593476b695ee857ca8de784d367033ad56f94403be092f 🔍`
VirtualSize	`0x16dd0`
VirtualAddress	`0x3ce000`
SizeOfRawData	`0x16e00`
PointerToRawData	`0x3b3c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.19251`

.gehcont

MD5	`24c31e98acf8640a31e75256c53932df 🔍`
SHA1	`0533cb98bc75843284603e601c651089c2ed712c 🔍`
SHA256	`ca49cce31bed4437d3fcf5fefad79492d55e37fc2cdc9894cfc48d69e11b70e5 🔍`
SHA3	`f999480e8aa39411ccf8798aa9780b030085ca678e396801d96980e8d5c44f5d 🔍`
VirtualSize	`0x1c`
VirtualAddress	`0x3e5000`
SizeOfRawData	`0x200`
PointerToRawData	`0x3caa00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`0.142636`

.fptable

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x100`
VirtualAddress	`0x3e6000`
SizeOfRawData	`0x200`
PointerToRawData	`0x3cac00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`f8b7ae28fc4b63ef3ad7e0a4d2fd9e6f 🔍`
SHA1	`15077c1f0c1929396f0bd6d38b5372856ebdc58d 🔍`
SHA256	`5743db2fc2a02872e8413ec5af15162c4bb8bd27477c8cc53942cf3d875e12f2 🔍`
SHA3	`a8e9c7892291de4e1ed12db70878e6eb95119557762a7d962b414839cd589a9b 🔍`
VirtualSize	`0x2c888`
VirtualAddress	`0x3e7000`
SizeOfRawData	`0x2ca00`
PointerToRawData	`0x3cae00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`1.95373`

.reloc

MD5	`a604065dd56d206513fb865d45fc08a4 🔍`
SHA1	`a150b3fe60da886aebe0056840a967d4b7e06e61 🔍`
SHA256	`a43167f04b1b6529d47429d2660f8b5b944af8bde5c44a7fdc51eceb63c4fc88 🔍`
SHA3	`c8c1448757b1f7ab6e0589351ba904d1dbe3750305484e6689d8c6674a51ceb3 🔍`
VirtualSize	`0xec84`
VirtualAddress	`0x414000`
SizeOfRawData	`0xee00`
PointerToRawData	`0x3f7800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.44661`

Imports

WINMM.dll	`timeBeginPeriod` `PlaySoundW` `timeEndPeriod` `timeGetTime`
ADVAPI32.dll	`RegEnumKeyExW` `RegOpenKeyExA` `RegCloseKey` `InitializeSecurityDescriptor` `RegCreateKeyExW` `RegQueryValueExA` `GetUserNameA` `OpenProcessToken` `GetTokenInformation` `LookupPrivilegeValueW` `AdjustTokenPrivileges` `RegSetValueExA` `RegSetValueExW` `RegQueryValueExW` `RegOpenKeyExW` `RegDeleteKeyW` `RegDeleteValueW`
GDI32.dll	`DeleteObject` `GetTextFaceW` `SetTextAlign` `SetROP2` `SetPolyFillMode` `GetViewportOrgEx` `GetWindowOrgEx` `SetPixelV` `SetPaletteEntries` `ExtFloodFill` `PtInRegion` `GetBoundsRect` `FrameRgn` `FillRgn` `RoundRect` `OffsetRgn` `GetRgnBox` `Rectangle` `LPtoDP` `CreateRoundRectRgn` `Polyline` `GetLayout` `SetLayout` `SetMapMode` `SelectObject` `SetBkMode` `CreateCompatibleBitmap` `CreateCompatibleDC` `CreateDCW` `RealizePalette` `SelectPalette` `CreatePalette` `BitBlt` `Polygon` `CreatePolygonRgn` `GetTextColor` `Ellipse` `CreateEllipticRgn` `SetDIBColorTable` `CreateDIBSection` `StretchBlt` `SetPixel` `GetTextCharsetInfo` `EnumFontFamiliesW` `CreateDIBitmap` `GetBkColor` `GetSystemPaletteEntries` `GetPaletteEntries` `GetNearestPaletteIndex` `EnumFontFamiliesExW` `DPtoLP` `SetRectRgn` `PatBlt` `CreateRectRgnIndirect` `CombineRgn` `GetTextMetricsW` `GetTextExtentPoint32W` `CreateFontIndirectW` `ScaleWindowExtEx` `ScaleViewportExtEx` `OffsetWindowOrgEx` `OffsetViewportOrgEx` `SetWindowOrgEx` `SetWindowExtEx` `SetViewportOrgEx` `SetViewportExtEx` `ExtTextOutW` `TextOutW` `MoveToEx` `SetTextColor` `DeleteDC` `GetDeviceCaps` `CreateICW` `CopyMetaFileW` `CreateBitmap` `SetBkColor` `GetObjectW` `CreateHatchBrush` `CreatePen` `CreatePatternBrush` `CreateRectRgn` `CreateSolidBrush` `Escape` `ExcludeClipRect` `GetClipBox` `GetObjectType` `GetPixel` `GetStockObject` `GetViewportExtEx` `GetWindowExtEx` `IntersectClipRect` `LineTo` `PtVisible` `RectVisible` `RestoreDC` `SaveDC` `SelectClipRgn` `ExtSelectClipRgn`
SHLWAPI.dll	`PathIsUNCW` `PathFindFileNameW` `PathFindExtensionW` `PathAppendW` `PathStripToRootW` `StrFormatKBSizeW` `PathRemoveFileSpecW` `PathFileExistsA` `PathAppendA`
SHELL32.dll	`DragAcceptFiles` `ShellExecuteW` `SHGetFolderPathA` `DragQueryFileW` `SHAppBarMessage` `DragFinish` `SHGetFolderPathW` `SHBrowseForFolderW` `SHGetDesktopFolder` `SHGetSpecialFolderLocation` `SHGetPathFromIDListW` `SHGetFileInfoW`
gdiplus.dll	`GdipDisposeImage` `GdipAlloc` `GdipFree` `GdiplusStartup` `GdiplusShutdown` `GdipGetImageEncoders` `GdipGetImageEncodersSize` `GdipCreateBitmapFromHBITMAP` `GdipDrawImageRectI` `GdipSaveImageToFile` `GdipCreateFromHDC` `GdipDrawImageI` `GdipDeleteGraphics` `GdipBitmapUnlockBits` `GdipBitmapLockBits` `GdipCreateBitmapFromScan0` `GdipCreateBitmapFromStream` `GdipGetImagePaletteSize` `GdipGetImagePalette` `GdipGetImagePixelFormat` `GdipGetImageHeight` `GdipGetImageWidth` `GdipGetImageGraphicsContext` `GdipSetInterpolationMode` `GdipCloneImage`
imagehlp.dll	`MapFileAndCheckSumW` `MapFileAndCheckSumA`
IPHLPAPI.DLL	`GetAdaptersInfo`
WININET.dll	`InternetOpenW` `InternetReadFile` `InternetOpenUrlW` `InternetCanonicalizeUrlW` `InternetGetConnectedState` `InternetCloseHandle`
VERSION.dll	`VerQueryValueA` `GetFileVersionInfoSizeA` `VerQueryValueW` `GetFileVersionInfoW` `GetFileVersionInfoSizeW` `GetFileVersionInfoA`
urlmon.dll	`URLDownloadToFileW`
PSAPI.DLL	`GetModuleBaseNameW` `EnumProcesses` `GetModuleFileNameExW` `EnumProcessModules` `EnumProcessModulesEx`
CRYPT32.dll	`CryptMsgClose` `CertCloseStore` `CertFreeCertificateContext` `CertGetNameStringW` `CertFindCertificateInStore` `CryptMsgGetParam` `CryptQueryObject`
pdh.dll	`PdhAddEnglishCounterW` `PdhCollectQueryData` `PdhOpenQueryW` `PdhGetFormattedCounterValue`
KERNEL32.dll	`WideCharToMultiByte` `GetComputerNameA` `GlobalMemoryStatusEx` `lstrcpyW` `lstrcmpA` `DeviceIoControl` `CreateDirectoryW` `SetFileTime` `SetFilePointer` `DuplicateHandle` `GetCurrentDirectoryW` `SystemTimeToFileTime` `GetFileType` `DosDateTimeToFileTime` `UnmapViewOfFile` `GetFileInformationByHandle` `CreateFileMappingW` `FileTimeToDosDateTime` `RtlVirtualUnwind` `GetSystemInfo` `VirtualProtect` `VirtualQuery` `LoadLibraryExA` `GlobalAlloc` `GlobalSize` `GlobalLock` `GlobalUnlock` `GlobalFree` `MulDiv` `FormatMessageW` `GetVersionExW` `GetModuleHandleExW` `CreateActCtxW` `ActivateActCtx` `DeactivateActCtx` `FindActCtxSectionStringW` `QueryActCtxW` `SystemTimeToTzSpecificLocalTime` `EncodePointer` `LoadLibraryExW` `InitializeCriticalSectionAndSpinCount` `CompareStringW` `TlsAlloc` `TlsGetValue` `TlsSetValue` `TlsFree` `GlobalReAlloc` `GlobalHandle` `LocalReAlloc` `GlobalGetAtomNameW` `FreeResource` `GlobalDeleteAtom` `lstrcmpW` `GlobalAddAtomW` `GlobalFindAtomW` `GetLocaleInfoW` `GetUserDefaultUILanguage` `FlushFileBuffers` `GetFullPathNameW` `GetVolumeInformationW` `LockFile` `SetEndOfFile` `UnlockFile` `lstrcmpiW` `GlobalFlags` `CreateEventW` `SetThreadPriority` `GetFileTime` `FindResourceExW` `GetWindowsDirectoryW` `GetTickCount` `GetProfileIntW` `SearchPathW` `GetUserDefaultLCID` `RtlLookupFunctionEntry` `UnhandledExceptionFilter` `TerminateProcess` `IsProcessorFeaturePresent` `QueryPerformanceCounter` `GetSystemTimeAsFileTime` `LocalAlloc` `GetStartupInfoW` `DecodePointer` `HeapAlloc` `RaiseException` `HeapReAlloc` `HeapSize` `InitializeCriticalSectionEx` `HeapFree` `GetCurrentThreadId` `OutputDebugStringA` `GetVersionExA` `ReadProcessMemory` `GetThreadContext` `SuspendThread` `RtlCaptureContext` `GetEnvironmentVariableA` `GetModuleFileNameA` `GetCurrentDirectoryA` `SetLastError` `GetEnvironmentVariableW` `FindNextFileW` `FindFirstFileExW` `SetCurrentDirectoryW` `GetFileAttributesExW` `GetTempFileNameW` `WriteFile` `CreateSemaphoreW` `CopyFileW` `GetFileSizeEx` `GetProcessTimes` `FindFirstFileW` `ReadFile` `GetFileSize` `CreateFileA` `FindClose` `FindNextFileA` `FindFirstFileExA` `OpenProcess` `FileTimeToSystemTime` `FileTimeToLocalFileTime` `LocalFree` `VerifyVersionInfoW` `VerSetConditionMask` `GetProcessHeap` `LeaveCriticalSection` `CreateFileW` `EnterCriticalSection` `GetFirmwareEnvironmentVariableW` `WaitForSingleObject` `TerminateThread` `ResumeThread` `CreateThread` `GetExitCodeThread` `Sleep` `FreeLibrary` `SetUnhandledExceptionFilter` `GetProcAddress` `LoadLibraryW` `InitializeCriticalSection` `IsDebuggerPresent` `SetProcessDEPPolicy` `GetSystemDirectoryW` `GetLocalTime` `GetLastError` `MoveFileExW` `GetFileAttributesW` `SetFileAttributesW` `GetTempPathW` `MultiByteToWideChar` `CloseHandle` `DeleteFileW` `GetCurrentThread` `GetCurrentProcessId` `GetCurrentProcess` `FindResourceW` `LoadResource` `LockResource` `SizeofResource` `GetModuleFileNameW` `GetModuleHandleW` `GetCPInfo` `RtlUnwindEx` `RtlPcToFileHeader` `RtlUnwind` `ExitProcess` `HeapQueryInformation` `ExitThread` `FreeLibraryAndExitThread` `GetCommandLineA` `GetCommandLineW` `VirtualAlloc` `QueryPerformanceFrequency` `SetStdHandle` `GetStdHandle` `GetTimeZoneInformation` `FlsAlloc` `FlsGetValue` `FlsSetValue` `FlsFree` `GetSystemTime` `InitializeSListHead` `IsValidLocale` `EnumSystemLocalesW` `GetConsoleMode` `ReadConsoleW` `GetConsoleOutputCP` `SetFilePointerEx` `IsValidCodePage` `GetACP` `GetOEMCP` `GetEnvironmentStringsW` `FreeEnvironmentStringsW` `SetEnvironmentVariableW` `DeleteCriticalSection` `WriteConsoleW` `MapViewOfFile` `OutputDebugStringW` `GetStringTypeW` `SwitchToThread` `LCMapStringW`
USER32.dll	`ToUnicodeEx` `GetKeyboardState` `CreateAcceleratorTableW` `DestroyAcceleratorTable` `CopyAcceleratorTableW` `LockWindowUpdate` `SetMenuDefaultItem` `GetDoubleClickTime` `ModifyMenuW` `RegisterClipboardFormatW` `CharUpperBuffW` `IsClipboardFormatAvailable` `GetUpdateRect` `DrawMenuBar` `DefFrameProcW` `DefMDIChildProcW` `TranslateMDISysAccel` `SubtractRect` `CreateMenu` `GetWindowRgn` `DestroyCursor` `PtInRect` `ReleaseCapture` `SetCapture` `GetNextDlgGroupItem` `MapWindowPoints` `ScreenToClient` `AdjustWindowRectEx` `IsCharLowerW` `GetKeyboardLayout` `GetWindowRect` `RemovePropW` `WaitMessage` `PostThreadMessageW` `GetComboBoxInfo` `ReuseDDElParam` `UnpackDDElParam` `InsertMenuItemW` `MonitorFromPoint` `UpdateLayeredWindow` `DrawIcon` `FrameRect` `CopyIcon` `SetCursorPos` `GetSystemMenu` `IsZoomed` `DrawFrameControl` `SetPropW` `ShowScrollBar` `GetScrollRange` `SetScrollRange` `GetScrollPos` `SetScrollPos` `ScrollWindow` `RedrawWindow` `ValidateRect` `GetForegroundWindow` `SetActiveWindow` `TrackPopupMenu` `SetMenu` `GetCapture` `GetKeyState` `GetDlgCtrlID` `GetDlgItem` `IsIconic` `IsWindowVisible` `EndDeferWindowPos` `DeferWindowPos` `GetMenuDefaultItem` `SetWindowPlacement` `GetWindowPlacement` `IsChild` `IsMenu` `GetClassInfoExW` `GetClassInfoW` `RegisterClassW` `CallWindowProcW` `PostMessageW` `GetMessageTime` `GetMessagePos` `PeekMessageW` `SetMenuItemInfoW` `GetMenuCheckMarkDimensions` `SetMenuItemBitmaps` `CheckMenuItem` `GetWindowTextLengthW` `GetLastActivePopup` `GetWindowThreadProcessId` `GetWindowLongW` `GetSysColorBrush` `GetSysColor` `ReleaseDC` `GetDC` `DrawEdge` `SystemParametersInfoW` `CopyImage` `GetParent` `IsWindowEnabled` `EnableWindow` `GetFocus` `SetFocus` `IsWindow` `SendMessageW` `RemoveMenu` `AppendMenuW` `InsertMenuW` `GetMenuItemCount` `GetMenuItemID` `GetSubMenu` `GetMenuState` `GetMenuStringW` `GetSystemMetrics` `FindWindowW` `GetWindowLongPtrW` `GetWindowTextW` `BringWindowToTop` `SetCursor` `GetCursorPos` `GetAsyncKeyState` `CreatePopupMenu` `KillTimer` `SetTimer` `DeleteMenu` `ShowOwnedPopups` `LoadImageW` `TrackMouseEvent` `IntersectRect` `MapDialogRect` `SetRectEmpty` `SendDlgItemMessageA` `InflateRect` `GetMenuItemInfoW` `DestroyMenu` `FillRect` `GetWindowDC` `TabbedTextOutW` `GrayStringW` `DrawTextExW` `DrawTextW` `RealChildWindowFromPoint` `ClientToScreen` `CharUpperW` `DestroyIcon` `GetNextDlgTabItem` `CreateDialogIndirectParamW` `IsDialogMessageW` `SetWindowTextW` `MoveWindow` `MonitorFromWindow` `WinHelpW` `GetScrollInfo` `SetScrollInfo` `CallNextHookEx` `SetWindowsHookExW` `EmptyClipboard` `SetClipboardData` `CloseClipboard` `OpenClipboard` `SetParent` `SetWindowRgn` `GetWindow` `GetTopWindow` `GetClassNameW` `GetClassLongPtrW` `SetWindowPos` `PostQuitMessage` `GetClientRect` `DrawStateW` `DefWindowProcW` `DestroyWindow` `DrawTextA` `EndPaint` `BeginPaint` `DialogBoxParamW` `EnableMenuItem` `GetMenu` `UpdateWindow` `InvalidateRect` `ShowWindow` `SetLayeredWindowAttributes` `LoadBitmapW` `GetDesktopWindow` `CreateWindowExW` `RegisterClassExW` `LoadIconW` `LoadCursorW` `DispatchMessageW` `TranslateMessage` `TranslateAcceleratorW` `GetMessageW` `LoadAcceleratorsW` `LoadStringW` `GetPropW` `IsDlgButtonChecked` `CheckDlgButton` `SetForegroundWindow` `SetDlgItemTextW` `EndDialog` `EnumDisplayMonitors` `OffsetRect` `EqualRect` `CopyRect` `UnionRect` `SetRect` `GetMonitorInfoW` `wsprintfW` `GetActiveWindow` `MessageBoxW` `MessageBoxA` `SetWindowLongPtrW` `SetClassLongPtrW` `LoadMenuW` `GetKeyNameTextW` `MapVirtualKeyW` `NotifyWinEvent` `InvertRect` `HideCaret` `EnableScrollBar` `MessageBeep` `GetIconInfo` `DrawIconEx` `MapVirtualKeyExW` `IsRectEmpty` `DrawFocusRect` `UnhookWindowsHookEx` `WindowFromPoint` `BeginDeferWindowPos` `SetWindowLongW` `RegisterWindowMessageW`
MSIMG32.dll	`AlphaBlend` `TransparentBlt`
WINSPOOL.DRV	`ClosePrinter` `DocumentPropertiesW` `OpenPrinterW`
UxTheme.dll	`GetThemePartSize` `GetThemeSysColor` `IsThemeBackgroundPartiallyTransparent` `IsAppThemed` `GetWindowTheme` `GetCurrentThemeName` `GetThemeColor` `DrawThemeBackground` `CloseThemeData` `DrawThemeParentBackground` `DrawThemeText` `OpenThemeData`
ole32.dll	`CoTaskMemFree` `CoTaskMemAlloc` `CoSetProxyBlanket` `OleUninitialize` `CoCreateInstance` `ReleaseStgMedium` `CoUninitialize` `CoInitialize` `CoDisconnectObject` `CreateStreamOnHGlobal` `DoDragDrop` `OleGetClipboard` `CoLockObjectExternal` `RegisterDragDrop` `RevokeDragDrop` `OleLockRunning` `OleCreateMenuDescriptor` `OleDestroyMenuDescriptor` `OleTranslateAccelerator` `IsAccelerator` `OleDuplicateData` `CoInitializeEx`
OLEAUT32.dll	`VarBstrFromDate` `VariantChangeType` `VariantCopy` `SysStringLen` `SysAllocStringLen` `LoadTypeLib` `GetErrorInfo` `VariantClear` `VariantInit` `SystemTimeToVariantTime` `VariantTimeToSystemTime` `SysFreeString` `SysAllocString`
SETUPAPI.dll	`SetupDiGetDeviceRegistryPropertyW` `CM_Get_Device_IDW` `SetupDiGetClassDevsW` `SetupDiEnumDeviceInfo`
OLEACC.dll	`AccessibleObjectFromWindow` `LresultFromObject` `CreateStdAccessibleObject`
IMM32.dll	`ImmReleaseContext` `ImmGetOpenStatus` `ImmGetContext`
d3d11.dll (delay-loaded)	`D3D11CreateDevice`

Delayed Imports

Attributes	`0x1`
Name	`d3d11.dll`
ModuleHandle	`0x3b4f90`
DelayImportAddressTable	`0x3b4f60`
DelayImportNameTable	`0x2a2fc0`
BoundDelayImportTable	`0x2a3038`
UnloadDelayImportTable	`0`
TimeStamp	`1970-Jan-01 00:00:00`

138

Type	`RT_BITMAP`
Language	English - United States
Codepage	UNKNOWN
Size	`0x20068`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`0.00930635`
MD5	`6107f2222cd8ac0634d7fb76f7929ae3 🔍`
SHA1	`23ae6afc0414df7e9b1a59f5dedbc8b27ec822f8 🔍`
SHA256	`7583aa4dda3a35bbba1cef9650648c128dbf389e034cdd9d322ea31dbfe22dcd 🔍`
SHA3	`492665222e37317e98f31e120b34a93ec24fdd9be9319d2a3686309980b6bbaa 🔍`
Preview

142

Type	`RT_BITMAP`
Language	English - United States
Codepage	UNKNOWN
Size	`0x14b8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`1.53657`
MD5	`0f2b86f54a2a4359ac4f0a1d59270c86 🔍`
SHA1	`47e3dc71e53778ae39caa218ecca638c47f9a824 🔍`
SHA256	`2c3ac5cf7074c42f5406b67c048c63ed49ad0a852380fa3ccae78dd6ab21c531 🔍`
SHA3	`4376c44a4ac75b233107b6f9463945608baa01985d5152a514f1dc5ff3db8e57 🔍`
Preview

143

Type	`RT_BITMAP`
Language	English - United States
Codepage	UNKNOWN
Size	`0x14b8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.04985`
MD5	`6f6d6f3037a88f7dd475f0f30f418e25 🔍`
SHA1	`f7a0717ef7ac057df5331a6b70a8af38556769b1 🔍`
SHA256	`6ac83462f2cdfadf681f1df2b6c6fdc6089cc09fc231bd025e97a2c6380a87c0 🔍`
SHA3	`76aaf04efcb02658c868ca0c562a55126ced65f7475b7e9030135c09fe0096ca 🔍`
Preview

200

Type	`RT_BITMAP`
Language	English - United States
Codepage	UNKNOWN
Size	`0xc28`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.7596`
MD5	`668877da2b456d06152dcd0d8e204e64 🔍`
SHA1	`e8f60272f14e4ebb16315063bf1355fd11e8d480 🔍`
SHA256	`2b5ddd9b7eb124d26e0d49aa6ba9c847eb686f41eaea64a3d2be6cf015b434e1 🔍`
SHA3	`f954ecd5b0c078ee31b69473cb828038d285c364e5f21141f98ce3282a36d391 🔍`
Preview

201

Type	`RT_BITMAP`
Language	English - United States
Codepage	UNKNOWN
Size	`0x1828`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.08433`
MD5	`f9248292d901c5958aa5c537ed85ca1f 🔍`
SHA1	`2f3cfbfc073ada4b80044338f12a531e4cbef514 🔍`
SHA256	`dfd04f5c70db62c7916b9a18fdc1ec3b000f4fad1fc6bd88208deb13f861a2f3 🔍`
SHA3	`71cf21a6542738cf752d5456d166bd7a15c04cb68e6247e5597c1497daf4b4d7 🔍`
Preview

1

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x10a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.50814`
MD5	`a0f1c426b8fd313669b6ec5f3280f37b 🔍`
SHA1	`c053b06682d7512754521a9a24508ac6533b7d91 🔍`
SHA256	`e724a65aa84ddc6516b82f484c5032f53a4838e245799f04e6ece06dcb5fe65a 🔍`
SHA3	`d58a3135c28900710161a190708c9f7cf93f121bfd30e43d77bf247a6945bbab 🔍`

2

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x8a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.84505`
MD5	`c86b6f7d9df7fbd16f8bb8c5c0d3f4a5 🔍`
SHA1	`ea831334d118c9e8b5004e30466e8635e3c3a39b 🔍`
SHA256	`cbe1077c41009bb42a96a7bc1861473887c4fe0d2046e7eea3bd69893f06d3f5 🔍`
SHA3	`e40d0794a3630b353b3c8e81dfea675632b1d3bfc12e5087a2d73def7e6b07c2 🔍`

3

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x468`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.20016`
MD5	`a4e05c423cdeb95467db951410b21bb9 🔍`
SHA1	`adc6ecd3eed53dd3700a52da169113c680e07505 🔍`
SHA256	`57a1fbea28f6f3a97e366404ee215c6f23161b463e497dfb3383cb693a8f7e76 🔍`
SHA3	`bb8dde4ed7100ca2889d9ddb46d260267d4eca690e37f27d423eb3b31f693de2 🔍`

4

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x568`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.18008`
MD5	`8770b198a9c402039adfd94ecab817a7 🔍`
SHA1	`51305c85821d4d0e50792899046cc6a768c6feed 🔍`
SHA256	`fabb499f888f215bec1f317dfefa1e478135f9fd8e3a7ca9d2dc8569b4af93af 🔍`
SHA3	`f1d5ae7b61bb7c2ef7fa84ea18b2e966cd86c61548a2a8dae860cad06849bbed 🔍`

5

Type	`RT_ICON`
Language	French - France
Codepage	UNKNOWN
Size	`0x10a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.50814`
MD5	`a0f1c426b8fd313669b6ec5f3280f37b 🔍`
SHA1	`c053b06682d7512754521a9a24508ac6533b7d91 🔍`
SHA256	`e724a65aa84ddc6516b82f484c5032f53a4838e245799f04e6ece06dcb5fe65a 🔍`
SHA3	`d58a3135c28900710161a190708c9f7cf93f121bfd30e43d77bf247a6945bbab 🔍`

6

Type	`RT_ICON`
Language	French - France
Codepage	UNKNOWN
Size	`0x8a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.84505`
MD5	`c86b6f7d9df7fbd16f8bb8c5c0d3f4a5 🔍`
SHA1	`ea831334d118c9e8b5004e30466e8635e3c3a39b 🔍`
SHA256	`cbe1077c41009bb42a96a7bc1861473887c4fe0d2046e7eea3bd69893f06d3f5 🔍`
SHA3	`e40d0794a3630b353b3c8e81dfea675632b1d3bfc12e5087a2d73def7e6b07c2 🔍`

7

Type	`RT_ICON`
Language	French - France
Codepage	UNKNOWN
Size	`0x468`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.20016`
MD5	`a4e05c423cdeb95467db951410b21bb9 🔍`
SHA1	`adc6ecd3eed53dd3700a52da169113c680e07505 🔍`
SHA256	`57a1fbea28f6f3a97e366404ee215c6f23161b463e497dfb3383cb693a8f7e76 🔍`
SHA3	`bb8dde4ed7100ca2889d9ddb46d260267d4eca690e37f27d423eb3b31f693de2 🔍`

8

Type	`RT_ICON`
Language	French - France
Codepage	UNKNOWN
Size	`0x568`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.18008`
MD5	`8770b198a9c402039adfd94ecab817a7 🔍`
SHA1	`51305c85821d4d0e50792899046cc6a768c6feed 🔍`
SHA256	`fabb499f888f215bec1f317dfefa1e478135f9fd8e3a7ca9d2dc8569b4af93af 🔍`
SHA3	`f1d5ae7b61bb7c2ef7fa84ea18b2e966cd86c61548a2a8dae860cad06849bbed 🔍`

109

Type	`RT_MENU`
Language	English - United States
Codepage	UNKNOWN
Size	`0x106`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.24832`
MD5	`ad00dfaa015cf3033bd8ace5e3ec02a2 🔍`
SHA1	`a6c6c0d62ca2c46a7f992ba2d91f02c014c392fa 🔍`
SHA256	`a032d3d8103837e4be5c5ef8d5f1f315028fcbfee2f63c888111080edb4ac42f 🔍`
SHA3	`28d2ae94fa99b91abb4d4a743e5568d442fa0eadf4247860780fe3a26d50acae 🔍`

101

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0x560`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.43231`
MD5	`27e712e06128c3fc3b565d4ad70880cc 🔍`
SHA1	`a111ca355e8417203dc9f1c47b5b573ad00ac9e9 🔍`
SHA256	`3ccdbbcbab63a460bd99868b9dfc0cd14750ec1e3ec2f350018ff1b92f93c3a3 🔍`
SHA3	`6a19f780343a62abc8ac435198034e59ce6136bdbadda52f20d707fd75e1d24a 🔍`

110

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0x61c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.40229`
MD5	`666d54fe131147552329ee0e13d2e5e3 🔍`
SHA1	`3e88805fd2d09d1767d1b9ed86dd3ed339497ef3 🔍`
SHA256	`db5f5b747111a31e1dc9f889aa4d9468cd9acc13448b5ee51a823b117819f09c 🔍`
SHA3	`4550249834dfcbf591c226ccf80beb2cb1a90eb13ba9b84e01e976c188b3ffd3 🔍`

130

Type	`RT_DIALOG`
Language	French - France
Codepage	UNKNOWN
Size	`0x158`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.29816`
MD5	`9cc0f29de5570312a409053e4fb30425 🔍`
SHA1	`a51325a7f85db002f2ffd5e4aafa2d0c4d97bf35 🔍`
SHA256	`1034cb352c30e2d68bd1c51ed0880f569c4879efa134fd466503eaafbda4b5ec 🔍`
SHA3	`c23d4c9195a3d6c7110636e9bfc332c9d6b7505bc2c2da4ece23bc8c5ed9b6af 🔍`

134

Type	`RT_DIALOG`
Language	French - France
Codepage	UNKNOWN
Size	`0x1a2e`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.46902`
MD5	`17691be80a739b7d81960f6fdec497f2 🔍`
SHA1	`2c2a0219b83fb5c4443327fa698f15c2de6360c1 🔍`
SHA256	`0b20a57fce599f21816f6b8b09e13f6081861c24b9b93daacbd8a45f18de58a1 🔍`
SHA3	`946355e92dcc19b9d6e345981de9e8eec06e0310f374192537b14ddb6c0f6e7d 🔍`

135

Type	`RT_DIALOG`
Language	French - France
Codepage	UNKNOWN
Size	`0x148`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.23135`
MD5	`dc758f82553a94f7b7fdb58fb650f54d 🔍`
SHA1	`c09c2d82e7f31914eff561482a298a583c351eea 🔍`
SHA256	`e48c60ec4302aef66c2756dc0b246681d40eab0324e1f3fc902820d619d9d449 🔍`
SHA3	`74cbac7e9acf163468799b552289d33547d943d15d9b1e10794278cc9ded517b 🔍`

7 (#2)

Type	`RT_STRING`
Language	English - United States
Codepage	UNKNOWN
Size	`0x30`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`1.26369`
MD5	`73d5d61f41eefd2f24ee37c0506bfc47 🔍`
SHA1	`96efcee0b797f5ad92503a42bb119868c7b210e2 🔍`
SHA256	`7b95ff0e1dd389bab6bd3173921a5daf4957a3dcfa4944050463c9d07fd1a6cc 🔍`
SHA3	`cbd65a65516f79ec72951cc4561c2d658435fd118c0601a90fb599c06f7e6179 🔍`

5 (#2)

Type	`RT_GROUP_ICON`
Language	French - France
Codepage	UNKNOWN
Size	`0x3e`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.49082`
Detected Filetype	Icon file
MD5	`3a8787993f968f700f67aad94b46dac8 🔍`
SHA1	`83b13f1e36aca3c2965ca69e6cc9ae3e6203c01d 🔍`
SHA256	`f679bf337d839c7b980946d130ea70fe7d92d1d2005445cdd30db487155b125a 🔍`
SHA3	`56f39448f2eadd9e8fd7972a1e51503af31ac561b2e1d6ef333ce8971a05490e 🔍`

107

Type	`RT_GROUP_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x3e`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.46808`
Detected Filetype	Icon file
MD5	`3c069249eb2e0b2256ee690875dd0784 🔍`
SHA1	`a17ba78935f0601dba12d0dc3cd0a80d770b541b 🔍`
SHA256	`fbaee59a7324de1da237e7986281007fce6523442fed7892636a26c6e87756d1 🔍`
SHA3	`9a910ad3079edc6456204a3536464f4f96afd424f9df38de71fd3c5a1c908f32 🔍`

1 (#2)

Type	`RT_VERSION`
Language	French - France
Codepage	UNKNOWN
Size	`0x298`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.35447`
MD5	`f946155e1c9785b5fac85b89140e0cf8 🔍`
SHA1	`51c99547e8d437d961fd0c4e414b38103738c0ed 🔍`
SHA256	`35be6cfca576a423b2dac7294f991d99b3eaf3fff4764ca5731782b283eeaaea 🔍`
SHA3	`df5cb7ad5ccf7e23367be9a96fecf0c6873ab7bf77c73d09b45605322c8ab720 🔍`

1 (#3)

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x22f`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.02293`
MD5	`152bb89e1c983ac83f61f234467ce37b 🔍`
SHA1	`80fbd63597a74720f3564b4a285e074e768fd0a8 🔍`
SHA256	`c33fffcaf40d812614f14a0a6441a425ab9f0114d82a65072bb4b443cdb23614 🔍`
SHA3	`7c63b7dcf97ab61479aabc3f427c03cae0982fd8784546e844e8d1bd0ddb9fca 🔍`

String Table contents

Moss
MOSS

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	7.2.2.0
ProductVersion	7.2.2.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	French - France
CompanyName	Nohope
FileDescription	Moss
FileVersion (#2)	7,2,2,0
InternalName	M.O.S.S.
LegalCopyright	Copyright Nohope (C) 2025
OriginalFilename	MOSS.exe
ProductName	MOSS
ProductVersion (#2)	7,2,2,0

Resource LangID	French - France

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2026-May-08 15:54:33
Version	`0.0`
SizeofData	`72`
AddressOfRawData	`0x278cc4`
PointerToRawData	`0x277ec4`
Referenced File	E:\sources\oc2022\x64\RandomD3D_x64\Mossx64.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics	`0`
TimeDateStamp	2026-May-08 15:54:33
Version	`0.0`
SizeofData	`20`
AddressOfRawData	`0x278d0c`
PointerToRawData	`0x277f0c`

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2026-May-08 15:54:33
Version	`0.0`
SizeofData	`1144`
AddressOfRawData	`0x278d20`
PointerToRawData	`0x277f20`

IMAGE_DEBUG_TYPE_ILTCG

Characteristics	`0`
TimeDateStamp	2026-May-08 15:54:33
Version	`0.0`
SizeofData	`0`
AddressOfRawData	`0`
PointerToRawData	`0`

TLS Callbacks

StartAddressOfRawData	`0x1402791e0`
EndAddressOfRawData	`0x1402791e8`
AddressOfIndex	`0x1403bb788`
AddressOfCallbacks	`0x1401facd8`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_4BYTES`
Callbacks	`(EMPTY)`

Load Configuration

Size	`0x100`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x1402a97a8`

RICH Header

XOR Key	`0xe3292e76`
Unmarked objects	`0`
ASM objects (33145)	`20`
199 (41118)	`2`
C++ objects (33145)	`218`
C objects (VS 2015/2017 runtime 26706)	`35`
ASM objects (VS 2015/2017 runtime 26706)	`10`
C++ objects (VS 2015/2017 runtime 26706)	`388`
Unmarked objects (#2)	`3`
C objects (VS2019 Update 11 (16.11.13) compiler 30143)	`3`
C++ objects (CVTCIL) (33145)	`1`
Imports (33145)	`53`
Total imports	`901`
C objects (33145)	`43`
C++ objects (LTCG) (27054)	`17`
Resource objects (27054)	`1`
151	`1`
Linker (27054)	`1`

Errors

[*] Warning: Yara callback received an unhandled message (6).

Leave a comment

No comments yet.