Manalyze report for 75994590e995683197d728f2b45d415ca2a603bb203b716674ff6e4c16acfd46

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Oct-01 02:32:39
Detected languages	English - United States
TLS Callbacks	2 callback(s) detected.
Debug artifacts	CsCheatCheck.pdb
CompanyName	CS Cheat Check
FileDescription	CS Cheat Check Application
FileVersion	`2.8.3.0`
InternalName	CsCheatCheck
LegalCopyright	Copyright (C) 2024-2026 CS Cheat Check
OriginalFilename	CsCheatCheck.exe
ProductName	CS Cheat Check
ProductVersion	`2.8.3.0`

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`Looks for Qemu presence: QemU` `May have dropper capabilities: CurrentControlSet\Services` `Miscellaneous malware strings: Backdoor Exploit Virus` `References the BITS service` `Contains domain names: microsoft.net`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to RC5 or RC6` `Uses known Mersenne Twister constants`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: LoadLibraryW GetProcAddress LoadLibraryA LoadLibraryExW` `Functions which can be used for anti-debugging purposes: FindWindowA FindWindowW CreateToolhelp32Snapshot` `Can access the registry: RegGetValueW RegEnumKeyExA RegEnumKeyW RegQueryInfoKeyW RegQueryValueExW RegOpenKeyExW RegCloseKey RegEnumValueW RegEnumValueA RegOpenKeyExA RegLoadKeyW RegUnLoadKeyW RegEnumKeyExW RegQueryValueExA` `Possibly launches other programs: CreateProcessW CreateProcessA ShellExecuteA ShellExecuteW` `Can create temporary files: GetTempPathW GetTempPathA CreateFileA CreateFileW` `Uses functions commonly found in keyloggers: MapVirtualKeyW GetForegroundWindow` `Functions related to the privilege level: AdjustTokenPrivileges OpenProcessToken` `Interacts with services: QueryServiceStatus OpenServiceA ControlService OpenSCManagerA` `Enumerates local disk drives: GetVolumeInformationW GetDriveTypeW GetLogicalDriveStringsW GetDriveTypeA GetVolumeInformationA` `Can take screenshots: FindWindowA FindWindowW GetDC CreateCompatibleDC`
Info	The PE is digitally signed.	`Signer: CS Cheat Check (self-signed)` `Issuer: CS Cheat Check (self-signed)`
Malicious	VirusTotal score: 11/71 (Scanned on 2026-10-08 11:21:24)	`AVG: Win64:MalwareX-gen [Trj]` `Avast: Win64:MalwareX-gen [Trj]` `Avira: TR/W64.MalwareX` `ESET-NOD32: Generik.HQONKVG trojan` `F-Secure: Trojan.TR/W64.MalwareX` `Kaspersky: Trojan.Win64.Agent.smhnrr` `McAfeeD: ti!75994590E995` `Rising: Trojan.Agent!8.B1E (CLOUD)` `Sophos: Mal/Generic-S` `TrellixENS: Artemis!A0E2F4E3D2A2` `huorong: Trojan/Agent.azs`

Hashes

MD5	`a0e2f4e3d2a27683d89d1fea5cce7cd0` 🔍
SHA1	`5225c4f07664ee7cb7d5f68827ba26928735659c` 🔍
SHA256	`75994590e995683197d728f2b45d415ca2a603bb203b716674ff6e4c16acfd46` 🔍
SHA3	`cee1fa9e111108ca4e37ab6a6d90a596368d51699f1ce38a63e0927ccc50a61f` 🔍
SSDeep	`49152:cSuofC3PBO1IbGwUPWw1owaSwuS8Zmx3A+pjE6Of2BYtGTfUPANk0id9Q+X1K+/4:o68wdcOxTXyKyAxCvL30j4TQaLX` 🔍
Imports Hash	`6382669effda0f1ba5c8b67a0cf43115` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x118`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`7`
TimeDateStamp	2026-Oct-01 02:32:39
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x8b2c00`
SizeOfInitializedData	`0x5dc800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00000000007EFC10 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0xe9a000`
SizeOfHeaders	`0x400`
Checksum	`0xe9c4ac`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_GUARD_CF` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`6a79bfac2d365a9dc796fea289c83865 🔍`
SHA1	`a5aa25d976c8d4eb44e4b1855f4cc734267a513e 🔍`
SHA256	`1a066eed16eee9779206cb0aeef491956c61e031041ace32c77ce2fe72008347 🔍`
SHA3	`f453433b639643f88f4726c614022276c00e92402487c501cb0f6dbefddc056c 🔍`
VirtualSize	`0x8b2adc`
VirtualAddress	`0x1000`
SizeOfRawData	`0x8b2c00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.55681`

.rdata

MD5	`a1e4ab19bbc0b36776948f296b8312bd 🔍`
SHA1	`f8a4454d970d955a48e476f1b25ec6a3e81b11a5 🔍`
SHA256	`ebbe86c9a746e463c5113d157f245030ef6edac167202abf0c2f0094e7afdce5 🔍`
SHA3	`4a99c6ce8c4ce2b018f84b92fed4dd086964e2c52261588c0d51cbd7b2b43b97 🔍`
VirtualSize	`0x59630e`
VirtualAddress	`0x8b4000`
SizeOfRawData	`0x596400`
PointerToRawData	`0x8b3000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.33561`

.data

MD5	`d817faf792014822dcda25cf7b8d1600 🔍`
SHA1	`09b2e7a34cf4fbb2fe44056c668f3be5cc3a7cd5 🔍`
SHA256	`5db075c77deadf0e0e63d675a1cee4ac2146d6c3609156ca532b19609cfe08f0 🔍`
SHA3	`7cd1b4f70629dec2fc669f790dc23fb9d33c5f3059195d423961b5c52ee3e0be 🔍`
VirtualSize	`0xd214`
VirtualAddress	`0xe4b000`
SizeOfRawData	`0x8000`
PointerToRawData	`0xe49400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`3.85249`

.pdata

MD5	`f868690bc84475bcc7619d8c69033824 🔍`
SHA1	`8935ec65f11497b1a76ae023504e6d4f44ec43f1 🔍`
SHA256	`a27de83702c96b45d6160d1acb2fe18313de6617db0772af1a5ebb9b3c3e5164 🔍`
SHA3	`f8751c509a42bcb8e956bdbacfe87a7afde24b59f5d6ebfd6decba3e47b42ca1 🔍`
VirtualSize	`0x3b4fc`
VirtualAddress	`0xe59000`
SizeOfRawData	`0x3b600`
PointerToRawData	`0xe51400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.08457`

.fptable

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x100`
VirtualAddress	`0xe95000`
SizeOfRawData	`0x200`
PointerToRawData	`0xe8ca00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`e009b8bf735e00debfec0fd16614c95c 🔍`
SHA1	`aa489960aa5a2d76ad5a83d6392f94ea01c605ba 🔍`
SHA256	`beee30fd5ba409a16f247a80a33ebfde906665618034e50c400389b2a337bf7d 🔍`
SHA3	`7c27e73331edb431d9f61013a223bc544d7996accb1f4fb9398b9369eec380db 🔍`
VirtualSize	`0x9b0`
VirtualAddress	`0xe96000`
SizeOfRawData	`0xa00`
PointerToRawData	`0xe8cc00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.10889`

.reloc

MD5	`5fb59e98bfd3d82ed63453fe14d90aba 🔍`
SHA1	`62ad89f45bd51a156574d02d2a4942afa93350d5 🔍`
SHA256	`703342cfe1a6e21ca35cc25ab38daaf5338250aa4c691eb788bc93f01076f677 🔍`
SHA3	`f8b97218e06585dca37634815a9c199763fd07342d6cf66b7332f34713ea893a 🔍`
VirtualSize	`0x2110`
VirtualAddress	`0xe97000`
SizeOfRawData	`0x2200`
PointerToRawData	`0xe8d600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.41535`

Imports

SETUPAPI.dll	`SetupDiEnumDeviceInfo` `SetupDiGetDeviceInstanceIdW` `SetupDiGetDevicePropertyW` `CM_Get_DevNode_Status` `SetupDiEnumDeviceInterfaces` `SetupDiOpenDevRegKey` `SetupDiGetDeviceInterfaceDetailW` `SetupDiGetClassDevsA` `SetupDiGetClassDevsW` `SetupDiGetDeviceRegistryPropertyA` `SetupDiDestroyDeviceInfoList`
SHLWAPI.dll	`#12`
ADVAPI32.dll	`RegGetValueW` `EventWriteTransfer` `EventSetInformation` `EventRegister` `EventUnregister` `GetUserNameA` `ConvertStringSecurityDescriptorToSecurityDescriptorW` `GetUserNameW` `RegEnumKeyExA` `AdjustTokenPrivileges` `RegEnumKeyW` `RegQueryInfoKeyW` `QueryServiceStatus` `CloseServiceHandle` `RegQueryValueExW` `RegOpenKeyExW` `RegCloseKey` `GetTokenInformation` `OpenServiceA` `RegEnumValueW` `LookupAccountSidW` `RegEnumValueA` `ConvertSidToStringSidW` `RegOpenKeyExA` `RegLoadKeyW` `RegUnLoadKeyW` `OpenEventLogW` `OpenProcessToken` `StartServiceA` `RegEnumKeyExW` `ControlService` `ConvertStringSidToSidW` `ReadEventLogW` `CloseEventLog` `OpenSCManagerA` `LookupPrivilegeValueA` `RegQueryValueExA`
USER32.dll	`PostMessageW` `MapVirtualKeyW` `ScreenToClient` `GetCursorPos` `GetIconInfo` `wsprintfA` `EnumDisplayMonitors` `QueryDisplayConfig` `GetDisplayConfigBufferSizes` `DestroyIcon` `DrawIconEx` `DisplayConfigGetDeviceInfo` `FillRect` `IsWindow` `GetForegroundWindow` `SetLayeredWindowAttributes` `BringWindowToTop` `ReleaseDC` `wsprintfW` `DefWindowProcW` `GetMessageA` `LoadImageA` `DispatchMessageA` `LoadCursorA` `RegisterClassExW` `DefWindowProcA` `LoadIconA` `GetClientRect` `KillTimer` `PostQuitMessage` `GetWindowThreadProcessId` `IsWindowVisible` `MonitorFromWindow` `PostMessageA` `GetRawInputDeviceInfoW` `ClientToScreen` `GetWindowTextA` `GetMonitorInfoA` `EnumWindows` `FindWindowA` `GetRawInputDeviceList` `DestroyWindow` `CreateWindowExW` `SendMessageW` `GetSystemMetrics` `DispatchMessageW` `PeekMessageW` `TranslateMessage` `SystemParametersInfoW` `UpdateWindow` `GetWindowRect` `SetWindowPos` `MessageBoxW` `SetWindowRgn` `ShowWindow` `MessageBoxA` `FindWindowW` `SendMessageA` `GetWindowLongPtrA` `SetWindowLongPtrA` `ReleaseCapture` `SetForegroundWindow` `IsIconic` `GetDC`
GDI32.dll	`GetDIBits` `GetObjectA` `CreateDIBSection` `CreateCompatibleDC` `DeleteDC` `SelectObject` `CreateFontW` `GetStockObject` `TextOutW` `GetTextExtentPoint32W` `SetTextColor` `SetBkMode` `CreatePen` `Rectangle` `CreateSolidBrush` `DeleteObject` `CreateFontIndirectW` `CreateRoundRectRgn`
KERNEL32.dll	`FlsGetValue` `FlsAlloc` `GetStdHandle` `FreeLibraryAndExitThread` `ExitThread` `CreateThread` `GetModuleHandleExW` `ExitProcess` `TlsFree` `TlsSetValue` `TlsGetValue` `TlsAlloc` `InitializeCriticalSectionAndSpinCount` `SetLastError` `RtlPcToFileHeader` `RtlUnwindEx` `GetStartupInfoW` `IsDebuggerPresent` `InitializeSListHead` `IsProcessorFeaturePresent` `UnhandledExceptionFilter` `RtlVirtualUnwind` `FlsSetValue` `RtlCaptureContext` `GetStringTypeW` `GetCPInfo` `CompareStringEx` `LCMapStringEx` `DecodePointer` `EncodePointer` `InitializeCriticalSectionEx` `GetNativeSystemInfo` `GetExitCodeThread` `AcquireSRWLockShared` `ReleaseSRWLockShared` `TryAcquireSRWLockExclusive` `AcquireSRWLockExclusive` `FlsFree` `VirtualProtect` `GetDateFormatW` `GetTimeFormatW` `CompareStringW` `LCMapStringW` `GetLocaleInfoW` `IsValidLocale` `GetUserDefaultLCID` `EnumSystemLocalesW` `GetFileType` `GetConsoleOutputCP` `GetACP` `GetEnvironmentStringsW` `GetCommandLineW` `GetCommandLineA` `RtlLookupFunctionEntry` `GetOEMCP` `SetDefaultDllDirectories` `GetCurrentProcess` `GetUserDefaultUILanguage` `CreateMutexW` `Sleep` `GetLastError` `CloseHandle` `QueryPerformanceCounter` `MulDiv` `SetUnhandledExceptionFilter` `CreateDirectoryW` `SizeofResource` `FindFirstFileW` `FindNextFileW` `WriteFile` `ExpandEnvironmentStringsW` `RemoveDirectoryW` `GetModuleFileNameW` `GetEnvironmentVariableW` `GetTempPathW` `IsValidCodePage` `WaitForSingleObject` `FreeEnvironmentStringsW` `GetFileAttributesW` `GetFileAttributesExW` `LockResource` `DeleteFileW` `LoadLibraryW` `LoadResource` `FindResourceW` `GetLocalTime` `GetProcAddress` `GetCurrentProcessId` `CreateProcessW` `WideCharToMultiByte` `GetTickCount` `GetExitCodeProcess` `OutputDebugStringA` `GetTickCount64` `GetFileAttributesA` `FreeLibrary` `GetCurrentThreadId` `MultiByteToWideChar` `GetTempPathA` `ReadFile` `GetVolumeInformationW` `GetLogicalDrives` `FindFirstFileA` `FindNextFileA` `FileTimeToSystemTime` `GetWindowsDirectoryA` `GetFileSize` `GlobalMemoryStatusEx` `GetDriveTypeW` `SystemTimeToTzSpecificLocalTime` `QueryDosDeviceW` `CompareFileTime` `MoveFileA` `GetFileSizeEx` `HeapFree` `GetLongPathNameW` `DeviceIoControl` `TerminateProcess` `ExpandEnvironmentStringsA` `GetSystemDirectoryW` `GetCurrentDirectoryA` `GetLogicalDriveStringsW` `CopyFileA` `MoveFileExA` `CreateFileA` `GetSystemDirectoryA` `LoadLibraryA` `DeleteFileA` `HeapAlloc` `GetWindowsDirectoryW` `SetFilePointerEx` `LocalFree` `RemoveDirectoryA` `FindFirstStreamW` `GetProcessHeap` `SystemTimeToFileTime` `CopyFileW` `CreateProcessA` `GetSystemTimeAsFileTime` `CreateDirectoryA` `FindNextStreamW` `CompareStringOrdinal` `RtlUnwind` `GetCurrentThread` `SetThreadPriority` `SetThreadPriorityBoost` `WaitForThreadpoolTimerCallbacks` `lstrcatA` `CancelWaitableTimer` `CloseThreadpoolTimer` `lstrcpyA` `SetThreadpoolTimer` `CreateThreadpoolTimer` `GetDriveTypeA` `GetVolumeInformationA` `GetDiskFreeSpaceExA` `SetProcessMitigationPolicy` `GetFileAttributesExA` `GetFileInformationByHandleEx` `MoveFileExW` `FlushFileBuffers` `Thread32Next` `Thread32First` `SuspendThread` `ResumeThread` `CreateToolhelp32Snapshot` `GetThreadContext` `PurgeComm` `GetCommState` `SetCommTimeouts` `SetCommState` `GetComputerNameW` `QueryFullProcessImageNameW` `CreateEventW` `CancelIoEx` `GetOverlappedResult` `FindFirstFileExW` `GetSystemInfo` `GetProcessWorkingSetSize` `SetProcessWorkingSetSize` `QueryPerformanceFrequency` `ReleaseSRWLockExclusive` `GetTimeZoneInformation` `ReadConsoleW` `FindClose` `GetConsoleMode` `GetLocaleInfoEx` `SleepConditionVariableSRW` `WakeAllConditionVariable` `WakeConditionVariable` `InitOnceBeginInitialize` `InitOnceComplete` `MapViewOfFile` `CreateFileMappingW` `FormatMessageA` `GetSystemTime` `DeleteCriticalSection` `LockFileEx` `UnlockFile` `HeapDestroy` `HeapCompact` `RaiseException` `HeapReAlloc` `WaitForSingleObjectEx` `FlushViewOfFile` `GetDiskFreeSpaceA` `FormatMessageW` `HeapSize` `HeapValidate` `UnmapViewOfFile` `UnlockFileEx` `SetEndOfFile` `GetFullPathNameA` `SetFilePointer` `InitializeCriticalSection` `SetEnvironmentVariableW` `SetStdHandle` `WriteConsoleW` `CreateFileW` `GetEnvironmentVariableA` `OutputDebugStringW` `GetModuleHandleW` `LoadLibraryExW` `AreFileApisANSI` `TryEnterCriticalSection` `HeapCreate` `EnterCriticalSection` `GetFullPathNameW` `GetDiskFreeSpaceW` `LockFile` `LeaveCriticalSection`
dwmapi.dll	`DwmSetWindowAttribute` `DwmExtendFrameIntoClientArea`
COMCTL32.dll	`InitCommonControlsEx`
CRYPT32.dll	`CertGetCertificateContextProperty`
ole32.dll	`CoInitializeSecurity` `CoTaskMemAlloc` `StgOpenStorage` `CoSetProxyBlanket` `CoTaskMemFree` `CoUninitialize` `CoCreateInstance` `CoInitializeEx`
OLEAUT32.dll	`VariantTimeToSystemTime` `SysFreeString` `SysAllocString` `VariantClear` `VariantInit`
SHELL32.dll	`#680` `SHOpenFolderAndSelectItems` `ShellExecuteA` `SHGetFolderPathA` `SHParseDisplayName` `SHFileOperationW` `SHGetKnownFolderPath` `SHGetNameFromIDList` `SHGetFolderPathW` `#18` `SHGetPathFromIDListW` `#25` `SHGetFileInfoW` `ExtractIconExW` `ShellExecuteW`
VERSION.dll	`VerQueryValueA` `GetFileVersionInfoSizeA` `GetFileVersionInfoA`

Delayed Imports

1

Type	`RT_VERSION`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x31c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.39736`
MD5	`70a5065b5dfeee3bcb30b73e93b80a2e 🔍`
SHA1	`4b719c8dcd87433e635d5d9e7711430de52f6e20 🔍`
SHA256	`62163e33081f5f201696d947eb22e9610dfd64b71abe6b2412386fc35b05c706 🔍`
SHA3	`fd9d28b3d58eafb6a2f63954b044215db784b3d1ff674f15c969a111babed91a 🔍`

1 (#2)

Type	`RT_MANIFEST`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x5f3`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.15876`
MD5	`d156619f56c9bd6ef772fa4f23341379 🔍`
SHA1	`b06865d9d3d0a12ce29d8041c46c1f8b906a61fa 🔍`
SHA256	`1b4e267c86c0ae47025906188241b43401634e0a15bba5a7d5c17e8aa6fc7fce 🔍`
SHA3	`9f4d9494c4cdd685e9f6f188ee70f78f18df5c5f408358226121fc208b449d64 🔍`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	2.8.3.0
ProductVersion	2.8.3.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT` `VOS_NT_WINDOWS32` `VOS_WINCE` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	English - United States
CompanyName	CS Cheat Check
FileDescription	CS Cheat Check Application
FileVersion (#2)	2.8.3.0
InternalName	CsCheatCheck
LegalCopyright	Copyright (C) 2024-2026 CS Cheat Check
OriginalFilename	CsCheatCheck.exe
ProductName	CS Cheat Check
ProductVersion (#2)	2.8.3.0

Resource LangID	English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2026-Oct-01 02:32:39
Version	`0.0`
SizeofData	`41`
AddressOfRawData	`0xdd0074`
PointerToRawData	`0xdcf074`
Referenced File	CsCheatCheck.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics	`0`
TimeDateStamp	2026-Oct-01 02:32:39
Version	`0.0`
SizeofData	`20`
AddressOfRawData	`0xdd00a0`
PointerToRawData	`0xdcf0a0`

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2026-Oct-01 02:32:39
Version	`0.0`
SizeofData	`1276`
AddressOfRawData	`0xdd00b4`
PointerToRawData	`0xdcf0b4`

UNKNOWN

Characteristics	`0`
TimeDateStamp	2026-Oct-01 02:32:39
Version	`0.0`
SizeofData	`4`
AddressOfRawData	`0xdd05d8`
PointerToRawData	`0xdcf5d8`

TLS Callbacks

StartAddressOfRawData	`0x140dd0600`
EndAddressOfRawData	`0x140dec876`
AddressOfIndex	`0x140e53c08`
AddressOfCallbacks	`0x1408b4e10`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_16BYTES`
Callbacks	`0x00000001407EFE80` `0x00000001407EFEF0`

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x140e4b180`
GuardCFCheckFunctionPointer	`5377838288`
GuardCFDispatchFunctionPointer	`0`
GuardCFFunctionTable	`0`
GuardCFFunctionCount	`0`
GuardFlags	`(EMPTY)`
CodeIntegrity.Flags	`0`
CodeIntegrity.Catalog	`0`
CodeIntegrity.CatalogOffset	`0`
CodeIntegrity.Reserved	`0`
GuardAddressTakenIatEntryTable	`0`
GuardAddressTakenIatEntryCount	`0`
GuardLongJumpTargetTable	`0`
GuardLongJumpTargetCount	`0`

RICH Header

XOR Key	`0xc554276d`
Unmarked objects	`0`
ASM objects (33145)	`8`
C objects (35207)	`19`
ASM objects (35207)	`12`
C++ objects (35207)	`104`
C objects (CVTCIL) (33145)	`1`
C objects (33145)	`23`
Unmarked objects (#2)	`6`
C++ objects (33145)	`189`
Imports (33145)	`27`
Total imports	`433`
C++ objects (LTCG) (35228)	`65`
Resource objects (35228)	`1`
151	`2`
Linker (35228)	`1`

Errors

Leave a comment

No comments yet.