| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 1970-Jan-01 00:00:00 |
| Detected languages |
English - United States
|
| TLS Callbacks | 2 callback(s) detected. |
| CompanyName | Steam Tools |
| FileDescription | Steam Account Switcher |
| FileVersion | 1.0.0.0 |
| InternalName | SteamAccountSwitcher |
| LegalCopyright | Copyright (C) 2026 |
| OriginalFilename | SteamAccountSwitcher.exe |
| ProductName | Steam Account Switcher |
| ProductVersion | 1.0.0.0 |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Libraries used to perform cryptographic operations: | Microsoft's Cryptography API |
| Suspicious | The PE is possibly packed. | Unusual section name found: .xdata |
| Suspicious | The PE contains functions most legitimate programs don't use. |
Can access the registry:
|
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 11 |
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0x10600 |
| SizeOfInitializedData | 0x17000 |
| SizeOfUninitializedData | 0xee00 |
| AddressOfEntryPoint | 0x00000000000013E0 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x2d000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x17aed |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x200000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| ADVAPI32.dll |
RegCloseKey
RegCreateKeyExA RegFlushKey RegOpenKeyExA RegQueryValueExA RegSetValueExA |
|---|---|
| COMCTL32.dll |
InitCommonControls
|
| CRYPT32.dll |
CryptProtectData
|
| GDI32.dll |
BitBlt
CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreateFontA CreatePen CreateSolidBrush DeleteDC DeleteObject GetStockObject GetTextExtentPoint32A LineTo MoveToEx SelectObject SetBkColor SetBkMode SetTextColor TextOutA |
| KERNEL32.dll |
CloseHandle
CreateDirectoryA DeleteCriticalSection DeleteFileA DeleteFileW EnterCriticalSection ExitProcess FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW GetFileAttributesW GetLastError GetModuleFileNameA GetModuleHandleA GetStartupInfoA GlobalAlloc GlobalLock GlobalUnlock InitializeCriticalSection IsDBCSLeadByteEx K32EnumProcesses LeaveCriticalSection LocalFree MultiByteToWideChar OpenProcess QueryFullProcessImageNameA RemoveDirectoryA RemoveDirectoryW SetFileAttributesW SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue VirtualProtect VirtualQuery WideCharToMultiByte |
| msvcrt.dll |
__C_specific_handler
___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _errno fwprintf _fmode _initterm _ismbblead _lock _onexit _time64 _unlock _wfopen abort calloc exit fclose fflush fgets fopen fprintf fputc fputs fputwc fread free fseek ftell fwrite localeconv malloc memcpy memmove memset signal strcat strchr strcmp strcpy strerror strlen strncmp strncpy strrchr strstr tolower vfprintf wcscat wcscmp wcslen _strlwr _atoi64 |
| ole32.dll |
CoCreateInstance
CoInitialize CoUninitialize OleInitialize OleUninitialize |
| SHELL32.dll |
IsUserAnAdmin
SHFileOperationA SHGetFolderPathW ShellExecuteA |
| SHLWAPI.dll |
PathFileExistsA
PathFileExistsW |
| USER32.dll |
AppendMenuA
BeginPaint ClientToScreen CloseClipboard CreatePopupMenu CreateWindowExA DefWindowProcA DestroyMenu DestroyWindow DispatchMessageA DrawEdge DrawTextA DrawTextW EmptyClipboard EnableWindow EndPaint FillRect GetClassNameA GetClientRect GetCursorPos GetDC GetDesktopWindow GetMessageA GetScrollInfo GetWindowRect GetWindowTextA InvalidateRect IsDialogMessageA LoadCursorA MessageBoxA MessageBoxW OpenClipboard PostQuitMessage PtInRect RegisterClassA RegisterClassExA ReleaseDC ScreenToClient SendMessageA SetClipboardData SetCursor SetFocus SetScrollInfo ShowWindow TrackPopupMenu TranslateMessage UnregisterClassA UpdateWindow |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | Steam Tools |
| FileDescription | Steam Account Switcher |
| FileVersion (#2) | 1.0.0.0 |
| InternalName | SteamAccountSwitcher |
| LegalCopyright | Copyright (C) 2026 |
| OriginalFilename | SteamAccountSwitcher.exe |
| ProductName | Steam Account Switcher |
| ProductVersion (#2) | 1.0.0.0 |
| Resource LangID | English - United States |
|---|
| StartAddressOfRawData | 0x14002a000 |
|---|---|
| EndAddressOfRawData | 0x14002a008 |
| AddressOfIndex | 0x1400262ec |
| AddressOfCallbacks | 0x140029038 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks |
0x0000000140008540
0x0000000140008510 |
No comments yet.