804587cabf06f7670294d5913ab8837dd8c65adca719ea8bf8eea2f43775ac1c

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Aug-01 13:16:36
Detected languages English - United States

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Info Interesting strings found in the binary: Contains domain names:
  • http://127.0.0.1
  • http://www.marksimonson.com
  • http://www.marksimonson.comProxima
  • http://www.marksimonson.comhttp
  • https://www.vape.gg
  • https://www.vape.gg/app-auth/proceed/
  • https://www.vape.gg/support
  • marksimonson.com
  • www.marksimonson.com
Malicious The PE contains functions mostly used by malware. Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
 Code injection capabilities:
  • WriteProcessMemory
  • VirtualAllocEx
  • OpenProcess
  • CreateRemoteThread
 Code injection capabilities (mapping injection):
  • MapViewOfFile
  • CreateFileMappingW
  • CreateRemoteThread
 Possibly launches other programs:
  • ShellExecuteW
 Has Internet access capabilities:
  • WinHttpSendRequest
  • WinHttpOpenRequest
  • WinHttpSetTimeouts
  • WinHttpQueryDataAvailable
  • WinHttpReceiveResponse
  • WinHttpConnect
  • WinHttpCloseHandle
  • WinHttpOpen
  • WinHttpCrackUrl
  • WinHttpQueryHeaders
  • WinHttpReadData
 Leverages the raw socket API to access the Internet:
  • WS2_32.dll
 Functions related to the privilege level:
  • AdjustTokenPrivileges
  • OpenProcessToken
 Enumerates local disk drives:
  • GetVolumeInformationW
 Manipulates other processes:
  • WriteProcessMemory
  • OpenProcess
  • Process32NextW
  • Process32FirstW
 Can take screenshots:
  • CreateCompatibleDC
  • BitBlt
 Reads the contents of the clipboard:
  • GetClipboardData
Malicious VirusTotal score: 13/70 (Scanned on 2026-08-15 18:41:37) AVG: MalwareX-gen [Trj]
Avast: MalwareX-gen [Trj]
Avira: TR/W64.MalwareX
CrowdStrike: win/malicious_confidence_70% (W)
Cynet: Malicious (score: 99)
DeepInstinct: MALICIOUS
Elastic: malicious (moderate confidence)
F-Secure: Trojan.TR/W64.MalwareX
Malwarebytes: Malware.AI.722553585
Microsoft: Trojan:Win32/Wacatac.B!ml
SentinelOne: Static AI - Suspicious PE
Symantec: ML.Attribute.HighConfidence
TrendMicro-HouseCall: Trojan.Win64.Gen.TL0101H326Z1

Hashes

MD5 35074dd1f12902d905eb453a6a5f3633 🔍
SHA1 004302f9b2fa7ef8b43971a265efff0e2c7edd32 🔍
SHA256 804587cabf06f7670294d5913ab8837dd8c65adca719ea8bf8eea2f43775ac1c 🔍
SHA3 1ad7ab3e8df3d978e86bbe7da483aca6b9fdf850f152c6efae2eee844e35e7ed 🔍
SSDeep 6144:CqvqNRJsH0pAg2ke9JFvF4Bu+Um9aus8nIz91f36bGRwNt:/XBpJFSL9ps8nKv32Kw7 🔍
Imports Hash cad7c450f2ef34afd8ddfb6a58334b61 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Aug-01 13:16:36
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x16e00
SizeOfInitializedData 0x29200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000000166C0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x44000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 069a921ab8c40d325445c06a8a3ab4ec 🔍
SHA1 e9829fd5a266aac928c59c7e760eab5311094063 🔍
SHA256 7f34d1dd4271695a693611eff7a5f0178faec747a13aa1aa9e543c99775edd63 🔍
SHA3 01b8478db0a524e90b0162fcec4db5757b570a3b35a1071c70889fc1168d1340 🔍
VirtualSize 0x16c01
VirtualAddress 0x1000
SizeOfRawData 0x16e00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.30765

.rdata

MD5 73e9b783dc6a1313dda4c546dc449e1f 🔍
SHA1 1330b4d34abf559de7ee06f744d363ae71874077 🔍
SHA256 a66c37a71a110302efa015e532471a381fe81f578389f225487fb9323a3afb7d 🔍
SHA3 19ebef47e7266f2ab7b077852faaef4b1327ce217fcb188f4c53ded32aea6f87 🔍
VirtualSize 0xa0c4
VirtualAddress 0x18000
SizeOfRawData 0xa200
PointerToRawData 0x17200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.19616

.data

MD5 ecb307eeee0d12d4518027389077b8ad 🔍
SHA1 9bb45a4b488a64d6dada6964b6ad85432fa4c9f6 🔍
SHA256 7b867128850a51e072457beed816d678a00474df3045e58b52e4bf5a5206d962 🔍
SHA3 8e3c276a1a7995935d804e5bb6a25308101514accffb3f06b7a6c066a34553b8 🔍
VirtualSize 0x5a0
VirtualAddress 0x23000
SizeOfRawData 0x600
PointerToRawData 0x21400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.44631

.pdata

MD5 d01739b7304d6e2af1b6bd190fbbf3e2 🔍
SHA1 1a655518752f7cc61d52cf5ade8f4e037237d364 🔍
SHA256 1ae38043ba0b2758310a7d5ecee6a141468fa12642f748f4cf5767fe259055e7 🔍
SHA3 57ccdfe5fb8634fdfa2e52cdb43665fa6dfafaab07b812662836bd5a87b3d23c 🔍
VirtualSize 0xffc
VirtualAddress 0x24000
SizeOfRawData 0x1000
PointerToRawData 0x21a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.10911

.rsrc

MD5 cc31d27fde131895eb87ebb3092bc398 🔍
SHA1 03099fe375d2f280a48457c89688fe161168d18f 🔍
SHA256 b72cc98c6d26f20e3d63342d4c547e01af344bf2ef2f5d2e1413c91307a03367 🔍
SHA3 b1ee174384ded6ae9de4bde7057f85472664743684c2372ddbefd2c1c0b25d36 🔍
VirtualSize 0x1d6f0
VirtualAddress 0x25000
SizeOfRawData 0x1d800
PointerToRawData 0x22a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.04154

.reloc

MD5 fd5975e2e20e632ae4e7fcf3791b966d 🔍
SHA1 e46a5098d5c7f20f94ef53001ba05b351a7f5ca3 🔍
SHA256 e4e5a3e00bd718e311181aade08125582085ee5cb26966e55bfc58baf3075b2e 🔍
SHA3 0f7a490db4e4df5bf627adab39442323c540f5400488e497c8b50fc6419247f7 🔍
VirtualSize 0xd0
VirtualAddress 0x43000
SizeOfRawData 0x200
PointerToRawData 0x40200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 2.71041

Imports

gdiplus.dll GdipGetFontCollectionFamilyList
GdipGetGenericFontFamilySansSerif
GdipPrivateAddMemoryFont
GdipDrawString
GdipCreateStringFormat
GdipGetFamilyName
GdipDeleteFontFamily
GdipGetClip
GdipSetClipRegion
GdipSetClipPath
GdipDrawImageRectRect
GdipDrawImageRect
GdipFillPath
GdipFillRectangle
GdipDrawPath
GdipDeleteGraphics
GdipScaleWorldTransform
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipDeleteStringFormat
GdipSetStringFormatFlags
GdipCreateFont
GdipSetSmoothingMode
GdipCloneImage
GdipDisposeImage
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipCreateFromHDC
GdipDeletePrivateFontCollection
GdipNewPrivateFontCollection
GdipSetStringFormatAlign
GdipDeleteFont
GdipCloneFontFamily
GdipSetStringFormatLineAlign
GdipFree
GdipDrawLine
GdipLoadImageFromStream
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipDeleteRegion
GdipCreateRegion
GdipAddPathArc
GdipClosePathFigure
GdipDeletePath
GdipCreatePath
GdiplusShutdown
GdiplusStartup
GdipAlloc
WINHTTP.dll WinHttpSendRequest
WinHttpOpenRequest
WinHttpSetTimeouts
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpReadData
SHELL32.dll ShellExecuteW
SHLWAPI.dll #12
WS2_32.dll closesocket
WSACleanup
WSAStartup
accept
bind
socket
getsockname
htonl
listen
ntohs
recv
send
shutdown
KERNEL32.dll Sleep
GetCurrentThreadId
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
UnmapViewOfFile
VirtualFreeEx
MapViewOfFile
CreateFileMappingW
WriteProcessMemory
VirtualAllocEx
OpenProcess
CreateRemoteThread
GetCurrentProcess
CreateEventW
WaitForSingleObject
GetLastError
GetFileAttributesW
GetEnvironmentVariableA
MulDiv
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
FindResourceW
SizeofResource
LockResource
LoadResource
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WideCharToMultiByte
GetModuleFileNameW
CloseHandle
GetVolumeInformationW
CreateDirectoryW
GetEnvironmentVariableW
GetStartupInfoW
USER32.dll AdjustWindowRectExForDpi
GetWindowLongPtrW
SetWindowLongPtrW
LoadCursorW
LoadIconW
GetDpiForSystem
GetClientRect
KillTimer
SetTimer
GetKeyState
SetFocus
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
InvalidateRect
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
PostQuitMessage
DefWindowProcW
DispatchMessageW
TranslateMessage
GetMessageW
TrackMouseEvent
GetWindowThreadProcessId
EnumWindows
GetWindowTextLengthW
GetWindowTextW
IsWindowVisible
PostMessageW
EndPaint
BeginPaint
OpenClipboard
UpdateWindow
GDI32.dll SelectObject
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
ADVAPI32.dll LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
MSVCP140.dll ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??Bios_base@std@@QEBA_NXZ
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?_Id_cnt@id@locale@std@@0HA
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Mtx_unlock
_Mtx_lock
_Thrd_id
_Thrd_join
_Query_perf_frequency
_Query_perf_counter
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Xbad_alloc@std@@YAXXZ
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
VCRUNTIME140.dll __std_exception_destroy
_CxxThrowException
__current_exception
__C_specific_handler
memset
memmove
memcpy
memcmp
__std_exception_copy
__current_exception_context
VCRUNTIME140_1.dll __CxxFrameHandler4
api-ms-win-crt-string-l1-1-0.dll _wcsicmp
wcslen
strlen
api-ms-win-crt-stdio-l1-1-0.dll fputwc
ungetwc
__stdio_common_vswprintf_s
fclose
fflush
fgetc
fgetpos
fsetpos
_fseeki64
fwrite
setvbuf
ungetc
fgetwc
__p__commode
_set_fmode
api-ms-win-crt-filesystem-l1-1-0.dll _unlock_file
_lock_file
api-ms-win-crt-runtime-l1-1-0.dll _register_onexit_function
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_crt_atexit
_set_app_type
_seh_filter_exe
_exit
_beginthreadex
terminate
api-ms-win-crt-math-l1-1-0.dll ceilf
__setusermatherr
exp
api-ms-win-crt-convert-l1-1-0.dll strtoul
atoi
api-ms-win-crt-heap-l1-1-0.dll _set_new_mode
free
malloc
_callnewh
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale

Delayed Imports

101

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0xd2
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.24094
Detected Filetype PNG graphic file
MD5 201fc926fd6bee4e5614638fcbfd9807 🔍
SHA1 b4fad83fb01a654c5063b365026cbfc108c57271 🔍
SHA256 5041ef6f6b0bce2f4e4218dc793dd3889096cd049a179ce16cd6b0da6dd3c4a1 🔍
SHA3 c3f7948c5e1d6a83b17f72d24c0ac58c285e12d7086365af2f24461a51115375 🔍

102

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x75d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.85721
Detected Filetype PNG graphic file
MD5 180cf1da0373e16093c876cc7c8c242e 🔍
SHA1 79a12f101b2a34bdb247af4076234142da40b5b5 🔍
SHA256 838f41e2081733f644d998b610d67abbe03af2d4b4a82bb50b87b7761bb2922e 🔍
SHA3 da42d849a067f15c6d6ec761a7bd0e24b741c9df1ddfa7ee5e3df3cc8404756f 🔍

103

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x34d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.64172
Detected Filetype PNG graphic file
MD5 c9f3cf365bb308e613a387873e478f6d 🔍
SHA1 6ad025978c61ff5008e6ca8a055b01e197826a81 🔍
SHA256 abd5577042089d503cd917e553bb91fc77505dde2d635ce8576ee4e3a141c15f 🔍
SHA3 39096412976df195738cde5f8ffa061a5f77888e28c1f51e29cc1f2deeb8f12e 🔍

104

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0xbf1
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.83464
Detected Filetype PNG graphic file
MD5 3fde2fe13d7b18766deba38fb9374611 🔍
SHA1 f873413f221fca91882038f60c95b2c35c67500d 🔍
SHA256 e70e678d0c9a8deeca6759f419a28c1522e52c82b97dbc766da49abd8031a46e 🔍
SHA3 2a65208ce5be6e6b01e88148f0a73be8e9ce24a0db7843909f736fe382d65770 🔍

105

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x933
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.84893
Detected Filetype PNG graphic file
MD5 49df04214e3221402f25ee371e67bde6 🔍
SHA1 929b066edab91afdae9c1608a06997f851699482 🔍
SHA256 c489c0d8f05c34aacb88c28efd51ce9035cdd962c209790012c7cb7cae6975cf 🔍
SHA3 9215baf5300d69918f2f248d0341aa205af6da8f2c34e837b1397d05fda36575 🔍

106

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0xde2
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.6038
Detected Filetype PNG graphic file
MD5 7b6f694d55094f7e34c38f39291f6c01 🔍
SHA1 d0592a752159c32ee6788e3ec33124dd7b1a4733 🔍
SHA256 980603fd7e71be3e6b737890da51c15eea7cb5de5441613eb4b00885b990e691 🔍
SHA3 3ff84e54c1646d2362557b8f01ad18dda9aaf455a58c0c5438a4bc6018724787 🔍

107

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x62
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.8384
Detected Filetype PNG graphic file
MD5 676a2d34973d6ca1fe7d2e3302941e13 🔍
SHA1 0aaf283945930f495b24a624b53697a6ccd2d5c8 🔍
SHA256 6a62a85c4fd860ded7d9e9d9446b9cbc05e64eacbace6b2fd1e805ecd27e54ec 🔍
SHA3 aa74eff6175475a425bd6d3f54c25730d283b29c028f2e47dd91eb4cf339af74 🔍

108

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0xa8e6
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.56681
Detected Filetype TrueType font file
MD5 2a602802127b4beda08fe0f4ca61c64b 🔍
SHA1 7d18a3be360c668fce8ff180947aab175710da86 🔍
SHA256 4af19ad1ccc5405142c48e540a38976fd71d9a63d6433b4b770ea5782cc5def2 🔍
SHA3 cbbe776f73fc82cea09863abd69cdf0b8a064a740f914a6c27ae5a07d646e8f2 🔍

109

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0xf68a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.79929
MD5 94acf04db51d177e554f6279e4de7842 🔍
SHA1 f991dcc9382c02ed721309ed14ea6b94d7f143d6 🔍
SHA256 4f0f1d05d935a1f626a47267bf4e7f13b350263d0e03ee7768e31f32c20becda 🔍
SHA3 dd1f635579f73029bc4f7a095e3a367273feaee6e1fad33a434ce0485d8fe829 🔍

110

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x381
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.34253
Detected Filetype PNG graphic file
MD5 74afe23f69c33d92a396b9220e2bdf50 🔍
SHA1 7a47bfaab430321a20fd58df71661a9cc46beeb1 🔍
SHA256 cb99b5833d18d28e38a2230bf22bbce674468a4c972f9b72878d43d2931a9b03 🔍
SHA3 8de1127d5d69d184b3822e50faf2b6addd891bd34cf5d03cb00aadba4630081b 🔍

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x292
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.06426
MD5 91263efe765f5c64c42ce9a03ff4aa14 🔍
SHA1 b8f532a4da2833bfc2ff424fa4ad9ad07e226af5 🔍
SHA256 df702a2e5fafa5ef203dc6a8ff8968f481253725ec21f991b92ba380b1a12b64 🔍
SHA3 7ebf9777c78cfd6676dbfd017ec744019120bb31fd96f870fbe0547f2e6adeec 🔍

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Aug-01 13:16:36
Version 0.0
SizeofData 780
AddressOfRawData 0x1d590
PointerToRawData 0x1c790

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140023000

RICH Header

XOR Key 0x97d8fc06
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 16
ASM objects (35721) 4
C objects (35721) 10
C++ objects (35721) 33
Imports (35721) 6
Imports (33145) 19
Total imports 328
C++ objects (36248) 5
Resource objects (36248) 1
151 1
Linker (36248) 1

Errors

Leave a comment

No comments yet.