273d35cadd1481eb7b090d668a0a5b3887860511e72c26b870d9cb3fe1cced74

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Nov-12 22:43:45
Detected languages English - United States
TLS Callbacks 2 callback(s) detected.
Debug artifacts PawPaint.pdb
CompanyName PawWorks
FileDescription PawPaint 3D Painter
FileVersion 1.25.349
InternalName PawPaint
LegalCopyright Copyright © 2026 PawWorks. All rights reserved.
OriginalFilename PawPaint.exe
ProductName PawPaint 3D Painter
ProductVersion 1.25.349

Plugin Output

Suspicious PEiD Signature: HQR data file
Suspicious Strings found in the binary may indicate undesirable behavior: Miscellaneous malware strings:
  • cmd.exe
 Contains domain names:
  • RetroUSB.com
  • assimp.org
  • birthpopuptypesapplyImagebeinguppernoteseveryshowsmeansextramatchtrackknownearlybegansuperpapernorthlearngivennamedendedTermspartsGroupbrandusingwomanfalsereadyaudiotakeswhile.com
  • collada.org
  • genretrucklooksValueFrame.net
  • github.com
  • gmail.com
  • http://collada.org
  • http://www.C
  • http://www.a
  • http://www.css
  • http://www.hortcut
  • http://www.icon
  • http://www.interpretation
  • http://www.language
  • http://www.style
  • http://www.text-decoration
  • http://www.w3.org
  • http://www.w3.org/shortcut
  • http://www.wencodeURIComponent
  • http://www.winimage.com
  • http://www.winimage.com/zLibDll
  • http://www.years
  • https://github.com
  • https://pawworks.dev
  • https://steamcommunity.com
  • https://store.steampowered.com
  • https://store.steampowered.com/app/4776250/
  • https://store.steampowered.com/app/4776250/PawPaint
  • https://www.World
  • https://www.assimp.org
  • https://www.recent
  • memtest86.com
  • sourceware.org
  • steamcommunity.com
  • steampowered.com
  • store.steampowered.com
  • thing.org
  • winimage.com
  • www.assimp.org
  • www.memtest86.com
  • www.w3.org
  • www.winimage.com
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to RC5 or RC6
Uses known Mersenne Twister constants
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • LoadLibraryW
  • GetProcAddress
  • LoadLibraryA
  • LoadLibraryExA
 Functions which can be used for anti-debugging purposes:
  • SwitchToThread
 Can access the registry:
  • RegGetValueA
  • RegOpenKeyExW
  • RegCloseKey
  • RegSetValueExA
  • RegCreateKeyExA
  • RegEnumValueW
 Possibly launches other programs:
  • ShellExecuteW
  • ShellExecuteA
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
  • CreateFileA
 Uses functions commonly found in keyloggers:
  • MapVirtualKeyW
  • GetAsyncKeyState
  • CallNextHookEx
 Memory manipulation functions often used by packers:
  • VirtualProtect
  • VirtualAlloc
 Enumerates local disk drives:
  • GetDriveTypeW
 Manipulates other processes:
  • OpenProcess
 Can take screenshots:
  • BitBlt
  • CreateCompatibleDC
  • GetDC
 Reads the contents of the clipboard:
  • GetClipboardData
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 390509c79eba9c4d46235c69f278fae4 🔍
SHA1 e47c18f39725224f0222e11de92147d0fdf55de8 🔍
SHA256 273d35cadd1481eb7b090d668a0a5b3887860511e72c26b870d9cb3fe1cced74 🔍
SHA3 7d68c1c9377a46a2d9fa814a6db72fb882e93796b01cf5ea7e2ef43e8a564677 🔍
SSDeep 196608:AUrw9fw8PZAyClXXCxfRtnxQze9n3v/L:ew8RAjXmtay9XL 🔍
Imports Hash 2666615f32df4ec23d2698b1ae883fa6 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x138

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Nov-12 22:43:45
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x76ec00
SizeOfInitializedData 0x290a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000594114 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xa04000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 c041d2cbab652a0a8141b4fdc90b8135 🔍
SHA1 52fb59ae26b6b3a11ec88df2465ee68f60cc053e 🔍
SHA256 9b9ab87a1c53228e9b59d3a3b72e9d8ce94b695b3a4bedf2344e2c55acfd1478 🔍
SHA3 754fb6d9040adfcc50d2d5fed27d6efdfbd1f09dcc55e7497ddb035e3bf0304f 🔍
VirtualSize 0x76ebd8
VirtualAddress 0x1000
SizeOfRawData 0x76ec00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.49615

.rdata

MD5 19f6947ed24e8ca9e608c49e58e1e317 🔍
SHA1 bfaa032da7ce27cb712936f1e089f3afb9fdf3d3 🔍
SHA256 d15034d7b94fa2c7c91aff26fb238bda1586b41cccbec83dc555f49dcbe47823 🔍
SHA3 92b28f3dbf2f42cb566c66bfc9f122bc948acf7357f20f454c273b0bdd177937 🔍
VirtualSize 0x1a7b2a
VirtualAddress 0x770000
SizeOfRawData 0x1a7c00
PointerToRawData 0x76f000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.45073

.data

MD5 781d5aafb8a3e1ccac32d7a5210928d0 🔍
SHA1 6195a53e9b92a67868bc6ddf75560bd01df136c8 🔍
SHA256 621243441fa39f64a2aedc3b9276ab5412e98370f8b5d641029938201e7fab40 🔍
SHA3 c6f8ebf15f4a13e0b3d6fe0700954e3b0e7b5c8e58a4c8690a1ce72d8829b534 🔍
VirtualSize 0x4a2a4
VirtualAddress 0x918000
SizeOfRawData 0x2a000
PointerToRawData 0x916c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.61594

.pdata

MD5 155b01a072f6594feab56f460d22c127 🔍
SHA1 09713873e32f38a8b0be96add011d88ea4e15a0e 🔍
SHA256 3831eb93837a5cbe9c30a962b84a59da0d99bb3e4706e1b4f72adc526d922a06 🔍
SHA3 342c969c00082ea26fe0148ffd2eb7fedfa74bda1e65c576bb34725bc62770d7 🔍
VirtualSize 0x40428
VirtualAddress 0x963000
SizeOfRawData 0x40600
PointerToRawData 0x940c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.49691

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x100
VirtualAddress 0x9a4000
SizeOfRawData 0x200
PointerToRawData 0x981200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 5feb53cbd30254934fcd4791be3271ab 🔍
SHA1 d7572a9c84d09e15054cd286d2ad08ed898e1816 🔍
SHA256 006b4c4d97bff0c4eaf2eb631a64ba80e6b169eb0c52ce92cd1f863da943ea45 🔍
SHA3 0ac4e0bdcc3a17d1745e373ff5731fd38c427b27cd7bce301e59943ab373907e 🔍
VirtualSize 0x58498
VirtualAddress 0x9a5000
SizeOfRawData 0x58600
PointerToRawData 0x981400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.6497

.reloc

MD5 b8a01eb0db42252a5f9c03a7b6697fc7 🔍
SHA1 826a818edb17e424dcbef179301e6d647d7d4406 🔍
SHA256 d6200fa71cd9fea34881bdd6ad39d44995d0335f0deeb6eb2eb543e719199801 🔍
SHA3 591ab97b0dcdd1c7e8a2b129dd25f8cec2ff3d749f1190bdb5a9d9b1e6ebbee5 🔍
VirtualSize 0x5b9c
VirtualAddress 0x9fe000
SizeOfRawData 0x5c00
PointerToRawData 0x9d9a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.44692

Imports

GDI32.dll GetDeviceCaps
GetDeviceGammaRamp
SetDeviceGammaRamp
DeleteObject
DescribePixelFormat
CreateDIBSection
SwapBuffers
GetDIBits
BitBlt
SelectObject
CreateCompatibleBitmap
CreateDCW
CreateRectRgn
CreateBitmap
SetPixelFormat
DeleteDC
ChoosePixelFormat
CreateCompatibleDC
USER32.dll GetWindowLongPtrW
SetWindowLongPtrW
SetWindowPos
TranslateMessage
GetPointerDevice
GetPointerType
GetPointerFramePenInfoHistory
ClientToScreen
DispatchMessageW
PeekMessageW
IsWindowEnabled
IsWindowVisible
EnableWindow
EnumThreadWindows
GetWindowThreadProcessId
IsWindow
GetActiveWindow
GetPointerDeviceRects
ScreenToClient
SetWindowLongA
GetWindowLongA
GetPropA
CallWindowProcW
GetRawInputDeviceList
GetRawInputDeviceInfoA
EnumDisplayMonitors
EnumDisplayDevicesW
EnumDisplaySettingsExW
EnumDisplaySettingsW
ChangeDisplaySettingsExW
ToUnicode
UnregisterClassW
UnregisterDeviceNotification
RegisterDeviceNotificationW
RegisterRawInputDevices
GetRawInputData
GetMonitorInfoW
MonitorFromWindow
SystemParametersInfoW
CreateIconIndirect
LoadImageW
DestroyIcon
LoadCursorW
GetClassLongPtrW
SetWindowLongW
GetWindowLongW
PtInRect
OffsetRect
SetRect
ClipCursor
WindowFromPoint
SetCursor
SetCursorPos
AdjustWindowRectEx
GetWindowRect
GetClientRect
SetWindowTextW
RemovePropW
GetPropW
SetPropW
GetSystemMetrics
MsgWaitForMultipleObjects
ReleaseCapture
SetCapture
MapVirtualKeyW
GetKeyState
SetFocus
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
IsZoomed
BringWindowToTop
MoveWindow
FlashWindow
SetLayeredWindowAttributes
GetLayeredWindowAttributes
WaitMessage
PostMessageW
SendMessageW
GetMessageTime
TrackMouseEvent
ReleaseDC
GetDC
UnhookWindowsHookEx
SetWindowsHookExW
GetAsyncKeyState
CallNextHookEx
DisableProcessWindowsGhosting
SetWindowPlacement
GetWindowPlacement
GetMessageExtraInfo
DestroyWindow
ChangeWindowMessageFilterEx
CreateWindowExW
RegisterClassExW
SendMessageTimeoutW
AllowSetForegroundWindow
FindWindowExW
DefWindowProcW
SetForegroundWindow
ShowWindow
IsIconic
GetCursorPos
SkipPointerFrameMessages
ADVAPI32.dll RegGetValueA
RegOpenKeyExW
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegEnumValueW
SHELL32.dll SHChangeNotify
SHGetKnownFolderPath
DragQueryFileW
ShellExecuteW
ShellExecuteA
DragQueryPoint
DragFinish
DragAcceptFiles
SHCreateItemFromParsingName
COMCTL32.dll #410
#412
#413
ole32.dll CoInitializeEx
CoUninitialize
CoTaskMemFree
CoCreateInstance
steam_api64.dll SteamInternal_SteamAPI_Init
SteamAPI_RegisterCallback
SteamAPI_RestartAppIfNecessary
SteamAPI_GetHSteamUser
SteamInternal_ContextInit
SteamInternal_FindOrCreateUserInterface
SteamAPI_RunCallbacks
SteamAPI_Shutdown
SteamAPI_UnregisterCallResult
SteamAPI_UnregisterCallback
KERNEL32.dll GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileType
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
VirtualProtect
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetCommandLineW
GetCommandLineA
GetStdHandle
CreateProcessW
DuplicateHandle
SetEnvironmentVariableW
ExitProcess
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetLastError
InterlockedPushEntrySList
RtlUnwindEx
IsDebuggerPresent
InitializeSListHead
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
GetCPInfo
ReadConsoleW
LCMapStringEx
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
InitializeCriticalSectionEx
GetStringTypeW
GetNativeSystemInfo
GetExitCodeThread
SwitchToThread
WaitForSingleObjectEx
InitOnceComplete
InitOnceBeginInitialize
RaiseException
RtlPcToFileHeader
IsProcessorFeaturePresent
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
SleepConditionVariableSRW
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetFileInformationByHandleEx
MoveFileExW
AreFileApisANSI
GetTempPathW
DeleteFileW
CreatePipe
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFileTime
GetFullPathNameW
GetFinalPathNameByHandleW
GetFileInformationByHandle
GetFileAttributesExW
GetFileAttributesW
FindNextFileW
FindFirstFileExW
FindFirstFileW
SetStdHandle
HeapSize
SetEndOfFile
WriteConsoleW
FindClose
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetLocaleInfoEx
LocalFree
GetConsoleMode
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
WaitForSingleObject
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
GetProcessHeap
VirtualQuery
GetModuleFileNameW
GetCurrentProcess
GetCurrentThread
GetLocalTime
CreateFileW
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
WriteFile
CopyFileW
RtlCaptureContext
GetEnvironmentVariableW
LoadLibraryW
GetProcAddress
SetUnhandledExceptionFilter
CreateFileA
PeekNamedPipe
ReadFile
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceFrequency
QueryPerformanceCounter
GetLastError
LoadLibraryA
FreeLibrary
GetModuleHandleW
SetEnvironmentVariableA
GetACP
GetTickCount64
SetFileInformationByHandle
GetVolumePathNameW
DeviceIoControl
GetDiskFreeSpaceExW
TerminateProcess
GetModuleFileNameA
GetFileAttributesA
GetWindowsDirectoryW
GlobalMemoryStatusEx
K32GetProcessMemoryInfo
OpenProcess
GetExitCodeProcess
QueryFullProcessImageNameW
Sleep
GetStartupInfoW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
SetThreadExecutionState
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
VerSetConditionMask
GetModuleHandleExW
FormatMessageW
GetFileSizeEx
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
VirtualAlloc
VirtualFree
LoadLibraryExA
FormatMessageA
HeapAlloc
HeapReAlloc
HeapFree
FileTimeToSystemTime
dwmapi.dll DwmSetWindowAttribute
IMM32.dll ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.36477
MD5 f70bf346d3ebe6f68cb4b0925ba949ec 🔍
SHA1 5ee020bcd931258ba518b424f0568def115603ec 🔍
SHA256 dd6be524dba827da471c781ec3c17935df8f96be61b6c2c5eacd0b09724a9765 🔍
SHA3 148406fa3eeb7667ca0106434e955c397cac68ec9c7ddd19f91084a05d7d27f7 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.87205
MD5 d1ee7db8b07007e1e2d651c6fe1a100a 🔍
SHA1 f4e0479d81d5fe78752c2f3d329638af177442e7 🔍
SHA256 ec23551bfed54eb1f4cb30b00d6be5dce775a4b2bf1b2d2e367f68ee5c2c521a 🔍
SHA3 e7b329623b11bde34eba59e6de5736f8eac6c55928285240dc7bd026abd335e4 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.56808
MD5 0e4e958b9e7c3954a68ab923ef83d71d 🔍
SHA1 c692cf8647ca66e3ccc29f3f250649d23903813f 🔍
SHA256 36db138b9acd54a64c8090c1bbf9833ae532df8883808cb513c05af6dca0681c 🔍
SHA3 b4ff6f4c4cd491ccd1bc9a9a1c60fa370d8a856440b81a761491633059cb4760 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.22561
MD5 fc5ee09a806e52f7225d40a3e145d969 🔍
SHA1 d828a157ad7448b6a088b601a75a407b7a07a882 🔍
SHA256 3bea5b7af8e7641cccdec574055f44f0161993bc514e7de7101ffadb24cf21ad 🔍
SHA3 3a5657d00db2ac774063f58d9360de84a5a718d640e7e06401b9b6babd5d636f 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.00472
MD5 24c54b750d0a7580bc794b4704195c49 🔍
SHA1 8f5c16853badef8b3eb05fe9fd71666bcd396f52 🔍
SHA256 64765e55d727860b9e8e4dd32441d791b37fd98456b99a503acd1307be49235c 🔍
SHA3 d4c960a7fa8fb94329b5ba5a123ed7fed43ea0b8f8af474c0189551370fd34cd 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x5488
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.94862
MD5 9ccc6f4457254b3a0d4beb6feac93ee3 🔍
SHA1 8824a59f1ca26df0926b6543869faadc1a510512 🔍
SHA256 485be953a540a92ac01198aa9d6dab00f57aaaf4910c953c6d1d41c49729de36 🔍
SHA3 65a728f525a453b52901a7d5ae360e88733d9d36fe06bca50d479e5103ae9e49 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.73955
MD5 972526e1ee71514244f4c5308b71924e 🔍
SHA1 99252f5dba38521cce54eef26f4ccc6c4239687e 🔍
SHA256 3da94cadf88e29459516ba4eebd10523d23c6d43e0bf00fac8e8e89f24ce9b9d 🔍
SHA3 84996b94283a09d685f081f0ee26bccd06ccd2f27209e8db194367019ab94e41 🔍

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.61471
MD5 70c54d899a540c8f29099aeea18b7b81 🔍
SHA1 fffeaf9a28158c23e47381e3c9fc0bde542733f5 🔍
SHA256 285195aa08149a5a286b23fc2acf519b895caf5c1ec2727ce41c7e35b3aa71ca 🔍
SHA3 edfb33de9bd0cd389022421d79bf05676f1426c8b6d204d9f82ee69b8afe21b1 🔍

9

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4508
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.96448
Detected Filetype PNG graphic file
MD5 833788ea5853726d9a1c8db2ed5e809f 🔍
SHA1 9d518aa88cbb65696e41dd8f7a635ea776245452 🔍
SHA256 89d81c6f6c3214dd2a7137a3b1a187e00e38039ca54fe20a0a337ff89ee2ca94 🔍
SHA3 f6868af23092284263f2cb07fe92dcdb0b0bdbf6f77278cece43a43e8ca42413 🔍

10

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.36477
MD5 f70bf346d3ebe6f68cb4b0925ba949ec 🔍
SHA1 5ee020bcd931258ba518b424f0568def115603ec 🔍
SHA256 dd6be524dba827da471c781ec3c17935df8f96be61b6c2c5eacd0b09724a9765 🔍
SHA3 148406fa3eeb7667ca0106434e955c397cac68ec9c7ddd19f91084a05d7d27f7 🔍

11

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.87205
MD5 d1ee7db8b07007e1e2d651c6fe1a100a 🔍
SHA1 f4e0479d81d5fe78752c2f3d329638af177442e7 🔍
SHA256 ec23551bfed54eb1f4cb30b00d6be5dce775a4b2bf1b2d2e367f68ee5c2c521a 🔍
SHA3 e7b329623b11bde34eba59e6de5736f8eac6c55928285240dc7bd026abd335e4 🔍

12

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.56808
MD5 0e4e958b9e7c3954a68ab923ef83d71d 🔍
SHA1 c692cf8647ca66e3ccc29f3f250649d23903813f 🔍
SHA256 36db138b9acd54a64c8090c1bbf9833ae532df8883808cb513c05af6dca0681c 🔍
SHA3 b4ff6f4c4cd491ccd1bc9a9a1c60fa370d8a856440b81a761491633059cb4760 🔍

13

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.22561
MD5 fc5ee09a806e52f7225d40a3e145d969 🔍
SHA1 d828a157ad7448b6a088b601a75a407b7a07a882 🔍
SHA256 3bea5b7af8e7641cccdec574055f44f0161993bc514e7de7101ffadb24cf21ad 🔍
SHA3 3a5657d00db2ac774063f58d9360de84a5a718d640e7e06401b9b6babd5d636f 🔍

14

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.00472
MD5 24c54b750d0a7580bc794b4704195c49 🔍
SHA1 8f5c16853badef8b3eb05fe9fd71666bcd396f52 🔍
SHA256 64765e55d727860b9e8e4dd32441d791b37fd98456b99a503acd1307be49235c 🔍
SHA3 d4c960a7fa8fb94329b5ba5a123ed7fed43ea0b8f8af474c0189551370fd34cd 🔍

15

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x5488
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.94862
MD5 9ccc6f4457254b3a0d4beb6feac93ee3 🔍
SHA1 8824a59f1ca26df0926b6543869faadc1a510512 🔍
SHA256 485be953a540a92ac01198aa9d6dab00f57aaaf4910c953c6d1d41c49729de36 🔍
SHA3 65a728f525a453b52901a7d5ae360e88733d9d36fe06bca50d479e5103ae9e49 🔍

16

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.73955
MD5 972526e1ee71514244f4c5308b71924e 🔍
SHA1 99252f5dba38521cce54eef26f4ccc6c4239687e 🔍
SHA256 3da94cadf88e29459516ba4eebd10523d23c6d43e0bf00fac8e8e89f24ce9b9d 🔍
SHA3 84996b94283a09d685f081f0ee26bccd06ccd2f27209e8db194367019ab94e41 🔍

17

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.61471
MD5 70c54d899a540c8f29099aeea18b7b81 🔍
SHA1 fffeaf9a28158c23e47381e3c9fc0bde542733f5 🔍
SHA256 285195aa08149a5a286b23fc2acf519b895caf5c1ec2727ce41c7e35b3aa71ca 🔍
SHA3 edfb33de9bd0cd389022421d79bf05676f1426c8b6d204d9f82ee69b8afe21b1 🔍

18

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4508
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.96448
Detected Filetype PNG graphic file
MD5 833788ea5853726d9a1c8db2ed5e809f 🔍
SHA1 9d518aa88cbb65696e41dd8f7a635ea776245452 🔍
SHA256 89d81c6f6c3214dd2a7137a3b1a187e00e38039ca54fe20a0a337ff89ee2ca94 🔍
SHA3 f6868af23092284263f2cb07fe92dcdb0b0bdbf6f77278cece43a43e8ca42413 🔍

GLFW_ICON

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x84
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.08371
Detected Filetype Icon file
MD5 5718021f7ae803812de3836163c3a946 🔍
SHA1 810b6225da8f3f9877838557e6c90892581c62cb 🔍
SHA256 0f311d8faacf5e04d8f8b3b1c5157e50bd2d626f9b46054847e4a303b4187916 🔍
SHA3 e71bb562cf8004eb6f559fb47886a0910aebaa8726d24073f81e65479af3fdda 🔍

1 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x84
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.01379
Detected Filetype Icon file
MD5 b3f8cbbea38e449f001003a8b06c7348 🔍
SHA1 c04f8b07deda5bf8c252f36d96c111e8e9abb157 🔍
SHA256 39555bb1e010df2dedff7d73abbab864bf579924c1702b197fb5e5103ad13d3e 🔍
SHA3 11e5567edfe504b67c9732882722680a74372ed8d709519cc738d859eee2a99e 🔍

1 (#3)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x310
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.40722
MD5 1316bad1938d3f620ca5ee115922c690 🔍
SHA1 5f6c3439f2613f58a4e1a289dc96164d4bb575ee 🔍
SHA256 e0450be72773ddb4a27d651dadadadac1a736ce89ac7ddc3660c025db9c0e986 🔍
SHA3 3727ffb6279d30fef0be3c67c7bc295e74848cf05cb364e0d114f29307278664 🔍

1 (#4)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x231
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.06778
MD5 9f9fb0ac98e7da81a8a1b8f4ceac126d 🔍
SHA1 e42bcf82d89fc5fdaa4135ef8830896867b82337 🔍
SHA256 0a7587dfe5b2f00aee8329781a9e98d58c9e2fba558b2713cc2d59ec63d6671a 🔍
SHA3 c4faaa18ff744a656135fa4916501d282038351fe107581b015d149723909dcc 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.25.349.0
ProductVersion 1.25.349.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName PawWorks
FileDescription PawPaint 3D Painter
FileVersion (#2) 1.25.349
InternalName PawPaint
LegalCopyright Copyright © 2026 PawWorks. All rights reserved.
OriginalFilename PawPaint.exe
ProductName PawPaint 3D Painter
ProductVersion (#2) 1.25.349
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Nov-12 22:43:45
Version 0.0
SizeofData 37
AddressOfRawData 0x8964ac
PointerToRawData 0x8954ac
Referenced File PawPaint.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2026-Nov-12 22:43:45
Version 0.0
SizeofData 20
AddressOfRawData 0x8964d4
PointerToRawData 0x8954d4

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Nov-12 22:43:45
Version 0.0
SizeofData 1132
AddressOfRawData 0x8964e8
PointerToRawData 0x8954e8

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2026-Nov-12 22:43:45
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

StartAddressOfRawData 0x1408969b0
EndAddressOfRawData 0x140896b50
AddressOfIndex 0x14094bbe0
AddressOfCallbacks 0x140771020
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_16BYTES
Callbacks 0x0000000140594994
0x00000001405949FC

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x14091b300

RICH Header

XOR Key 0x8bd5978
Unmarked objects 0
C++ objects (33140) 232
ASM objects (33140) 35
253 (35207) 4
C objects (35207) 19
ASM objects (35207) 14
C++ objects (35207) 111
C objects (33140) 77
Imports (34444) 2
C objects (CVTCIL) (33140) 1
Imports (33140) 19
Total imports 366
C++ objects (35217) 118
C objects (35217) 157
C++ objects (LTCG) (35217) 162
Resource objects (35217) 1
151 1
Linker (35217) 1

Errors

Leave a comment

No comments yet.