625c4935a93508db8a8724e23a46be25cf4154e95252cfaa5332dc1ceee26c02

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Sep-20 09:42:11
Detected languages English - United States

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Suspicious Strings found in the binary may indicate undesirable behavior: Contains a XORed PE executable:
  • 08 34 35 2f 7c 2c 2e 33 3b 2e 3d 31 7c 3f 3d 32 32 33 28 7c ...
 Contains another PE executable:
  • This program cannot be run in DOS mode.
 Contains domain names:
  • aia.ws.symantec.com
  • crl.ws.symantec.com
  • fontello.com
  • http://fontello.com
  • http://ocsp.thawte.com0
  • http://scripts.sil.org
  • http://scripts.sil.org/OFLPT
  • http://t1.symcb.com
  • http://t1.symcb.com/ThawtePCA.crl0
  • http://t2.symcb.com0
  • http://tl.symcb.com
  • http://tl.symcb.com/tl.crl0
  • http://tl.symcb.com/tl.crt0
  • http://tl.symcd.com0
  • http://tl.symcd.com0&
  • http://ts-aia.ws.symantec.com
  • http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
  • http://ts-crl.ws.symantec.com
  • http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
  • http://ts-ocsp.ws.symantec.com07
  • http://www.paratype.com
  • http://www.paratype.com/help/designershttp
  • http://www.paratype.comhttp
  • http://www.styleseven.comFreeware
  • http://www.styleseven.comSmallest
  • https://www.thawte.com
  • https://www.thawte.com/cps0/
  • https://www.thawte.com/repository0W
  • paratype.com
  • scripts.sil.org
  • symantec.com
  • symcb.com
  • t1.symcb.com
  • thawte.com
  • tl.symcb.com
  • ts-aia.ws.symantec.com
  • ts-crl.ws.symantec.com
  • ws.symantec.com
  • www.paratype.com
  • www.thawte.com
Info Cryptographic algorithms detected in the binary: Uses constants related to MD5
Uses known Mersenne Twister constants
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryW
  • LoadLibraryA
 Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
 Can access the registry:
  • RegQueryValueExW
 Possibly launches other programs:
  • CreateProcessAsUserW
  • CreateProcessWithTokenW
  • ShellExecuteW
 Uses functions commonly found in keyloggers:
  • GetForegroundWindow
  • MapVirtualKeyA
  • GetAsyncKeyState
 Functions related to the privilege level:
  • DuplicateTokenEx
  • OpenProcessToken
  • AdjustTokenPrivileges
 Manipulates other processes:
  • WriteProcessMemory
  • Process32NextW
  • Process32FirstW
  • ReadProcessMemory
 Reads the contents of the clipboard:
  • GetClipboardData
Malicious VirusTotal score: 43/71 (Scanned on 2026-10-06 17:01:04) ALYac: Gen:Variant.Application.Barys.66703
APEX: Malicious
AVG: Win64:MalwareX-gen [Misc]
AhnLab-V3: Trojan/Win.Generic.R785791
Alibaba: Packed:Win32/VMProtect.86ed8a61
Antiy-AVL: Trojan[Packed]/Win32.VMProtect
Arcabit: Trojan.Application.Barys.D1048F
Avast: Win64:MalwareX-gen [Misc]
BitDefender: Gen:Variant.Application.Barys.66703
Bkav: W32.Malware.52101A6C
CTX: exe.trojan.vmprotect
CrowdStrike: win/malicious_confidence_90% (W)
Cylance: Unsafe
Cynet: Malicious (score: 100)
DeepInstinct: MALICIOUS
ESET-NOD32: Win32/Packed.VMProtect.ACT trojan
Elastic: malicious (high confidence)
Emsisoft: Gen:Variant.Application.Barys.66703 (B)
Fortinet: Riskware/Application
GData: Gen:Variant.Application.Barys.66703
Google: Detected
Ikarus: Trojan.Win64.Krypt
K7AntiVirus: Riskware ( 005cde091 )
K7GW: Riskware ( 005cde091 )
Lionic: Trojan.Win32.VMProtect.4!c
Malwarebytes: Generic.Trojan.Crypt.DDS
MaxSecure: Trojan.Malware.219104223.susgen
McAfeeD: ti!625C4935A935
MicroWorld-eScan: Gen:Variant.Application.Barys.66703
Microsoft: Trojan:Win32/Wacatac.B!ml
Paloalto: generic.ml
Rising: Trojan.Kryptik@AI.87 (RDML:F5grCYpsAxaErOma9SHHmQ)
Sangfor: Trojan.Win32.Save.a
SentinelOne: Static AI - Malicious PE
Sophos: Mal/Generic-S
Symantec: ML.Attribute.HighConfidence
TrellixENS: Artemis!F94ADFCE95E5
TrendMicro: Trojan.Win64.KRYPT.USBLIP26
TrendMicro-HouseCall: Trojan.Win64.KRYPT.USBLIP26
VIPRE: Gen:Variant.Application.Barys.66703
Varist: W64/ABApplication.YYNR-6534
VirIT: Trojan.Win64.Gen_Heur.C
alibabacloud: RiskWare:Win/HackTool.Akgpp_DArY

Hashes

MD5 f94adfce95e5974b3bda7856a93473cd 🔍
SHA1 e57b05702f34393f2fdbf898a562086f1dd6deba 🔍
SHA256 625c4935a93508db8a8724e23a46be25cf4154e95252cfaa5332dc1ceee26c02 🔍
SHA3 36f4dea22cba78c69713a90a796167a1bb7f855f2253301469eb074bc38d4e15 🔍
SSDeep 49152:ATo4ojziCSQilKPnsCw5gq1NTxoPCdIA1sITLl3oKJ6mEO2lfZmmPYEoRP/malS:pyQ2hXxof1YEOOalS0sTs 🔍
Imports Hash c461eb6d735b41f0b6c0475f553cfe66 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Sep-20 09:42:11
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xaf800
SizeOfInitializedData 0x2a3a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000000AA85C (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x358000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 12e38b4d1bb261abc3e3ec62a1c117a8 🔍
SHA1 e205baaf49986d537d139b8ff6efab54a43efeb4 🔍
SHA256 f98973a8d4544623fc8b5089a1dad7da444467606f0d8848c2d405d1e6c97e14 🔍
SHA3 de83c86543ad82a1a15522d4af4073ce9776f9d8b41979bf19d31009448cce27 🔍
VirtualSize 0xaf66b
VirtualAddress 0x1000
SizeOfRawData 0xaf800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.55169

.rdata

MD5 4a58716e993e1853847f74f0e0e7587e 🔍
SHA1 e059f6052a025060cb75d0e98526f114facd1ebb 🔍
SHA256 6dd2f3f76f3f35488094bcd46457ffbf5011034acd249f6d4ed3e7d9db568dfa 🔍
SHA3 2ab263a685900d1dd6fcaedbfaaaff198e2f625f9f79f121563ed9de6f67b16d 🔍
VirtualSize 0x1eaa0
VirtualAddress 0xb1000
SizeOfRawData 0x1ec00
PointerToRawData 0xafc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.89513

.data

MD5 327009f4c9f490eb07592823bf884f79 🔍
SHA1 2e6569764f885d30e372319e434ba39332211334 🔍
SHA256 05aadea004e5c7a75fbb3358c1c38bedd65ad614dfda2784c775c1a5a3019f5b 🔍
SHA3 ed7763c68073402029ed943da6871e8cdaea50899e152c15bf76de40866233e8 🔍
VirtualSize 0x27e138
VirtualAddress 0xd0000
SizeOfRawData 0x27d200
PointerToRawData 0xce800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.61109

.pdata

MD5 c2fe2248d78be24064ef0f6137b3f5e5 🔍
SHA1 7ee6214af205ad4ba648b36c64c5d770e99902f0 🔍
SHA256 3717c890150b3784732f5d5e7a9e369fe2a7219fcbb43d977cc70b58a04b7a99 🔍
SHA3 b799f4bd6e67aaae578ce9de69dc90a6a5c68341d1eb1d6508ea38bfecb25a1c 🔍
VirtualSize 0x66d8
VirtualAddress 0x34f000
SizeOfRawData 0x6800
PointerToRawData 0x34ba00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.94516

.rsrc

MD5 a0ec7dd4ced16e1148aaea66698a436b 🔍
SHA1 9551cba26f768f0ff0bfb7d21c8e279c93df8407 🔍
SHA256 a88cbed36eca085407ca984771791982b5ec747ba2578820a80d3c69069c08a4 🔍
SHA3 84feff158eb28c8813132169a5e923694f71febdc5f0d277e79f48a06eed3fce 🔍
VirtualSize 0x1e8
VirtualAddress 0x356000
SizeOfRawData 0x200
PointerToRawData 0x352200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.76813

.reloc

MD5 a7f0c6914d9a5af9331b06ab8d2af490 🔍
SHA1 7d6aeb782dfe732c8854dd9c5957274459dbdb68 🔍
SHA256 d881bca1c10587daa73781ccb1e2e511d0ef3377989463d635cfdc6d06cd3fe7 🔍
SHA3 423a35535478a55ef86e348c98106e6117fd933be31ad45c4ec4719221398647 🔍
VirtualSize 0x1f0
VirtualAddress 0x357000
SizeOfRawData 0x200
PointerToRawData 0x352400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.08038

Imports

dwmapi.dll DwmExtendFrameIntoClientArea
d3d9.dll Direct3DCreate9
ADVAPI32.dll SetThreadToken
CreateProcessAsUserW
DuplicateTokenEx
RevertToSelf
PrivilegeCheck
SetTokenInformation
OpenProcessToken
CreateProcessWithTokenW
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
RegQueryValueExW
d3dx9_43.dll D3DXCreateTextureFromFileInMemory
ntdll.dll RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
KERNEL32.dll GetFileAttributesExW
InitializeSListHead
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
AreFileApisANSI
FindFirstFileW
WriteProcessMemory
GetCurrentProcess
TerminateProcess
GetModuleFileNameW
CreateFileW
GetLocaleInfoEx
CreateToolhelp32Snapshot
MultiByteToWideChar
Sleep
GetLastError
Process32NextW
Process32FirstW
CloseHandle
GetProcAddress
LocalFree
ReadProcessMemory
GetModuleHandleW
WideCharToMultiByte
GetTickCount
VirtualQueryEx
WakeAllConditionVariable
GetCurrentProcessId
GetCurrentThreadId
LoadLibraryW
GlobalAlloc
GlobalLock
GlobalUnlock
K32GetModuleBaseNameA
K32GetModuleInformation
K32EnumProcessModules
ExitProcess
GlobalFree
GetModuleHandleA
GetLocaleInfoA
LoadLibraryA
QueryPerformanceFrequency
IsDBCSLeadByte
QueryPerformanceCounter
GetStartupInfoW
K32GetModuleBaseNameW
UnhandledExceptionFilter
GetFileInformationByHandleEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SleepConditionVariableSRW
SetUnhandledExceptionFilter
FindClose
FormatMessageA
USER32.dll GetWindow
GetClassNameA
FindWindowExA
EnumWindows
GetWindowLongW
GetWindowRect
MapWindowPoints
SetWindowDisplayAffinity
MoveWindow
GetWindowThreadProcessId
SetWindowLongW
SetForegroundWindow
DefWindowProcW
GetKeyState
GetMessageExtraInfo
ScreenToClient
GetCapture
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
LoadCursorW
SetCapture
SetCursor
GetClientRect
IsWindowUnicode
ReleaseCapture
SetCursorPos
PeekMessageW
GetCursorPos
GetForegroundWindow
GetKeyNameTextA
MapVirtualKeyA
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
GetAsyncKeyState
DispatchMessageW
TranslateMessage
SHELL32.dll ShellExecuteW
ole32.dll CoInitializeEx
MSVCP140.dll ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
_Mtx_unlock
_Mtx_lock
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Xbad_function_call@std@@YAXXZ
_Thrd_detach
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?uncaught_exceptions@std@@YAHXZ
_Query_perf_counter
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xbad_alloc@std@@YAXXZ
?_Id_cnt@id@locale@std@@0HA
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
_Query_perf_frequency
?_Throw_Cpp_error@std@@YAXH@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Random_device@std@@YAIXZ
_Cnd_do_broadcast_at_thread_exit
IMM32.dll ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
VCRUNTIME140_1.dll __CxxFrameHandler4
VCRUNTIME140.dll memmove
_CxxThrowException
__C_specific_handler
__current_exception_context
__current_exception
__std_exception_destroy
__std_exception_copy
strchr
strstr
memcmp
memchr
memcpy
memset
api-ms-win-crt-stdio-l1-1-0.dll __stdio_common_vsprintf
fgetc
__stdio_common_vsprintf_s
fwrite
__stdio_common_vsscanf
_wfopen
fputc
setvbuf
fseek
__p__commode
ungetc
fsetpos
_set_fmode
fread
ftell
fclose
fflush
_get_stream_buffer_pointers
fgetpos
_fseeki64
api-ms-win-crt-heap-l1-1-0.dll free
_callnewh
malloc
_set_new_mode
api-ms-win-crt-string-l1-1-0.dll tolower
wcscpy_s
strncpy
_wcsicmp
strcpy_s
isalnum
strncmp
_stricmp
api-ms-win-crt-runtime-l1-1-0.dll _invoke_watson
_beginthreadex
terminate
_register_thread_local_exe_atexit_callback
_c_exit
_exit
exit
_initterm_e
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
abort
_errno
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_initterm
api-ms-win-crt-utility-l1-1-0.dll qsort
rand
api-ms-win-crt-filesystem-l1-1-0.dll _lock_file
_unlock_file
api-ms-win-crt-convert-l1-1-0.dll strtol
atof
strtoull
strtoll
strtod
api-ms-win-crt-math-l1-1-0.dll logf
atan2f
acosf
ceilf
pow
__setusermatherr
_dsign
_fdclass
fmodf
powf
cosf
_dclass
sinf
log
sqrtf
api-ms-win-crt-locale-l1-1-0.dll localeconv
_configthreadlocale
___lc_codepage_func

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x188
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.89623
MD5 b8e76ddb52d0eb41e972599ff3ca431b 🔍
SHA1 fc12d7ad112ddabfcd8f82f290d84e637a4d62f8 🔍
SHA256 165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8 🔍
SHA3 37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd 🔍

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Sep-20 09:42:11
Version 0.0
SizeofData 912
AddressOfRawData 0xbe3f4
PointerToRawData 0xbcff4

TLS Callbacks

StartAddressOfRawData 0x1400be7b0
EndAddressOfRawData 0x1400be850
AddressOfIndex 0x14034d680
AddressOfCallbacks 0x1400b19f0
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_16BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1400d0040

RICH Header

XOR Key 0xf58005c
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 22
ASM objects (35207) 4
C objects (35207) 10
C++ objects (35207) 36
Imports (35207) 6
Imports (21202) 2
Imports (VS2012 build 50727 / VS2005 build 50727) 2
Imports (33145) 27
Total imports 488
C++ objects (LTCG) (35225) 30
Resource objects (35225) 1
Linker (35225) 1

Errors

Leave a comment

No comments yet.