7dfef150d8377d59bb9fbf511b2769e4ed496f9bdafedd9b5eb15caaa2288413

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2024-Apr-14 13:05:43
Comments
CompanyName crosire
FileDescription ReShade Setup
FileVersion 6.1.1.0
InternalName ReShade Setup.exe
LegalCopyright Copyright © 2014. All rights reserved.
OriginalFilename ReShade Setup.exe
ProductName ReShade
ProductVersion 6.1.1
Assembly Version 6.1.1.0

Plugin Output

Info Matching compiler(s): .NET executable -> Microsoft
Info Interesting strings found in the binary: Contains domain names:
  • github.com
  • githubusercontent.com
  • http://schemas.microsoft.com
  • http://schemas.microsoft.com/expression/blend/2008
  • http://schemas.microsoft.com/winfx/2006/xaml
  • http://schemas.microsoft.com/winfx/2006/xaml/presentation
  • http://schemas.openxmlformats.org
  • http://schemas.openxmlformats.org/markup-compatibility/2006
  • https://github.com
  • https://patreon.com
  • https://raw.githubusercontent.com
  • https://raw.githubusercontent.com.
  • https://raw.githubusercontent.com/crosire/reshade-shaders/list/Addons.ini
  • https://raw.githubusercontent.com/crosire/reshade-shaders/list/Compatibility.ini
  • https://raw.githubusercontent.com/crosire/reshade-shaders/list/EffectPackages.ini
  • https://reshade.me
  • https://www.pcgamingwiki.com
  • https://www.pcgamingwiki.com/?
  • microsoft.com
  • openxmlformats.org
  • patreon.com
  • pcgamingwiki.com
  • raw.githubusercontent.com
  • schemas.microsoft.com
  • schemas.openxmlformats.org
  • www.pcgamingwiki.com
Info The PE is digitally signed. Signer: ReShade
Issuer: ReShade
Malicious VirusTotal score: 4/70 (Scanned on 2026-09-16 15:01:29) DeepInstinct: MALICIOUS
Fortinet: Riskware/Application
MaxSecure: Trojan.Malware.241375262.susgen
Sophos: Generic Reputation PUA (PUA)

Hashes

MD5 66be9e4eed5cb2d1c66de1f4264ba23e 🔍
SHA1 db25de0f1ecfbd201768de67a63b61d4bb67a952 🔍
SHA256 7dfef150d8377d59bb9fbf511b2769e4ed496f9bdafedd9b5eb15caaa2288413 🔍
SHA3 adeaf7d2d53c350240345471ba712883ed6206bee72fd22fde2bc8e84f8b36f3 🔍
SSDeep 49152:GJ3bUDVjzGEOWTLBM6mYI5pOo11cz8Y+z1LJwzkXcO78v26twH8Fr8etqNqD4Sq:GiBjqiLBt7apOapYee26td8ea8q 🔍
Imports Hash f34d5f2d4577ed6d9ceec516c1f5a744 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2024-Apr-14 13:05:43
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32
LinkerVersion 48.0
SizeOfCode 0x1d200
SizeOfInitializedData 0x19600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0001F1F2 (Section: .text)
BaseOfCode 0x2000
BaseOfData 0x20000
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x3c000
SizeOfHeaders 0x200
Checksum 0x37d16f
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 bc04586a9beb0edb8afce28bc456c728 🔍
SHA1 722590d274ddbddb8e00c15ab604a5674d9f6b3e 🔍
SHA256 a9a7a272b3f99e6511691e5966d25f5f285c87feb935672036ae8b80f94db5e5 🔍
SHA3 2906d182d4ad7ee09acacc406c503eb9f01ef6499e17d804eec225a5e8f7b8da 🔍
VirtualSize 0x1d200
VirtualAddress 0x2000
SizeOfRawData 0x1d200
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.35392

.rsrc

MD5 b8a5dcf73447516a65ff79f7b788a6f0 🔍
SHA1 1b0b7ad643192f1a499d3d318104aac071850e0e 🔍
SHA256 0043d90aebc2846dcdd5c860ea6a25df58d17572c4bbe537ed47afec19bcbc9d 🔍
SHA3 b5c32dd2f938c283ad977a72a58f291a3313b3e646c093e70b6f88f701036ac3 🔍
VirtualSize 0x192f8
VirtualAddress 0x20000
SizeOfRawData 0x19400
PointerToRawData 0x1d400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.5741

.reloc

MD5 13d6a6a0afd5a2e75306668f6cdae632 🔍
SHA1 6ac699009dd4bede05a96aafa71ba016c0602381 🔍
SHA256 d3c31bea8bd85942954e5beac5d68e053b6023906e731482fbc6c1b2526a337e 🔍
SHA3 f4a0b8a1d26484018c466038be7cfd91f92ab5024eae49e658a71946f425a26c 🔍
VirtualSize 0xc
VirtualAddress 0x3a000
SizeOfRawData 0x200
PointerToRawData 0x36800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.10191

Imports

mscoree.dll _CorExeMain

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x472a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.88402
Detected Filetype PNG graphic file
MD5 90fbaf6fc08e774b3bcff8af9d3c7c1d 🔍
SHA1 227738771ebcc27f0eb0f8475a84970741947da9 🔍
SHA256 796776a5e8f5ed9dd392d834cbc7d85652e3dfc3e3c1fcec5484b73902e1bb40 🔍
SHA3 2514e970cdcf8517fe3c05773d315340aecbb8fb9a3cda630a49ce8bc21fffc5 🔍

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.27686
MD5 81b118e7d7641946d8628c96293007b8 🔍
SHA1 7f1a572c387804c91208ff662630c862f7be34db 🔍
SHA256 cd6b765f0faf1081ce4f741ef4c918cbe81cc044653867be4acac54181688e9d 🔍
SHA3 c128d3561a23d198b41e741b6bfa9394364452c820b57b879b4ab5fbfdbe7d77 🔍

3

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.59321
MD5 79ad57084ba0dddda614b7e89558a78f 🔍
SHA1 0760920e4057f3bf7d6b6b1f3f38e9710c3e6fd3 🔍
SHA256 d938e98cf586329a3494b44fdc2679c882baeb683286d2314c36f15b1d747e58 🔍
SHA3 ea0d3447331932f96eb002ded4cb1487068f5665fb4c6874769d40bccbef7f86 🔍

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.09193
MD5 0b5306d399dd36a2d2e60ca851c9976d 🔍
SHA1 3bf0a181bc205ce7670b032480601bf31b5f44a7 🔍
SHA256 2c56aaeae33406ee6b0b8b9cf5ab81cf62dfd1b16d9e1d45ee07262ef7f2fd00 🔍
SHA3 2cdd562a541fea821f34204f2f5c80643673ed52544d58148db6bf9f72030977 🔍

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.30947
MD5 e3b50c08eec40ab1732535ab82bdb68b 🔍
SHA1 761469161ed30dfc6fc98a21723be3cc04d176a5 🔍
SHA256 87c88453c97ec00c63b9cfa300fb82a37f8e81641bbc7272ded8cbd469b200c2 🔍
SHA3 e5f0305a54521631e9ecbb42207fe9b4d0f7d08a700d672477914cd74d067dc2 🔍

32512

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x4c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.67841
Detected Filetype Icon file
MD5 5e7cf32b038ef077bdd1c8258bc66899 🔍
SHA1 877bd65bc66256b60255f33b8fb386ca681db643 🔍
SHA256 45bd9f0cedea80e1f8ab536b7f606d296e813e0f68aa221ddd40aaba5666169e 🔍
SHA3 7cdedf7585731ae7150a686c58724e39c2d936bb0ac460bc0f9f38b7cfe519cf 🔍

1 (#2)

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x338
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.33019
MD5 e772a272cd4b5199fc7321e0126e5907 🔍
SHA1 ca18da0caacc94cb96e94f7cb23a19ee91599964 🔍
SHA256 acdec062be58d0445b15218998dbe93787c55c22da01553ae0e1e449f6d682bd 🔍
SHA3 275f421fe350aa287381ddd695ff647ba4589d6f89b15681f5f60a4a39f66e6f 🔍

1 (#3)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x374
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.20942
MD5 df0803539530b0f8f358785822a4ed56 🔍
SHA1 c3635273dbbc35be1d2ee338d9255e99d0ce24cc 🔍
SHA256 1a497aee65e471b0765be173933869430243015aed7683f5e74248a2d1682d25 🔍
SHA3 56ddef543d2cb32dc5935a1dc086e5d3bf9ab6cfe444ff083dee3c4c7df9cc33 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 6.1.1.0
ProductVersion 6.1.1.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
Comments
CompanyName crosire
FileDescription ReShade Setup
FileVersion (#2) 6.1.1.0
InternalName ReShade Setup.exe
LegalCopyright Copyright © 2014. All rights reserved.
OriginalFilename ReShade Setup.exe
ProductName ReShade
ProductVersion (#2) 6.1.1
Assembly Version 6.1.1.0
Resource LangID UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment
💵 New Message from Coinbase. READ → graph.org/YOU-HAVE-A-NEW-BIT 5 hours ago
💵 New Message from Coinbase. READ → graph.org/YOU-HAVE-A-NEW-BITCOIN-TRANSFER-FROM-COINBASE-08-27?hs=2c687fc3d744bd03dbbaf1f4b6373a36& #BB4263 💵