Manalyze report for 9d3d8ee8a07c6d471dd15c4ef5cb2e3f09d486131b31855006da78d5b41df611

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Sep-21 14:14:54
Detected languages	English - United States Russian - Russia
Comments	Mediaget installer
CompanyName	Global Microtrading PTE. LTD
FileDescription	Mediaget installer
FileVersion	`500.0`
InternalName	MediaGet.exe
LegalCopyright	Copyright 2026 Global Microtrading PTE. LTD
OriginalFilename	mediaget.exe
ProductName	Mediaget
ProductVersion	`500.0`

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C++ 6.0 - 8.0`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`Contains references to internet browsers: chrome.exe firefox.exe iexplore.exe` `May have dropper capabilities: CurrentVersion\Run` `Contains domain names: clients2.google.com example.com google.com http://mediaget.com https://clients2.google.com https://clients2.google.com/service/update2/crx https://curl.se mediaget.com openssl.org`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32` `Uses constants related to MD5` `Uses constants related to SHA1` `Uses constants related to SHA256` `Uses constants related to SHA512` `Uses constants related to AES` `Uses constants related to Blowfish` `Uses known Diffie-Helman primes` `Microsoft's Cryptography API`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: LoadLibraryExA GetProcAddress LoadLibraryExW LoadLibraryW LoadLibraryA` `Functions which can be used for anti-debugging purposes: FindWindowW` `Code injection capabilities (PowerLoader): GetWindowLongW FindWindowW` `Can access the registry: RegDeleteKeyW RegOpenKeyExW RegQueryValueExW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegEnumKeyW` `Possibly launches other programs: CreateProcessW ShellExecuteW` `Uses Microsoft's cryptographic API: CryptAcquireContextW CryptCreateHash CryptReleaseContext CryptDestroyHash CryptGetProvParam CryptSignHashW CryptSetHashParam CryptExportKey CryptDecrypt CryptEnumProvidersW CryptGetUserKey CryptDestroyKey` `Can create temporary files: CreateFileW GetTempPathW` `Has Internet access capabilities: InternetSetOptionW` `Leverages the raw socket API to access the Internet: WS2_32.dll` `Interacts with services: OpenSCManagerW OpenServiceW QueryServiceStatusEx` `Enumerates local disk drives: GetDriveTypeW` `Manipulates other processes: OpenProcess` `Can take screenshots: GetDC FindWindowW CreateCompatibleDC BitBlt` `Interacts with the certificate store: CertOpenSystemStoreW CertOpenStore`
Info	The PE is digitally signed.	`Signer: Global Microtrading PTE. LTD` `Issuer: GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1`
Malicious	VirusTotal score: 32/71 (Scanned on 2026-10-14 19:16:43)	`ALYac: Application.Bundler.513` `Alibaba: Downloader:Win32/MediaGet.22e30d2a` `Arcabit: Application.Bundler.513` `BitDefender: Application.Bundler.513` `CTX: exe.downloader.mediaget` `CrowdStrike: win/grayware_confidence_60% (D)` `DeepInstinct: MALICIOUS` `DrWeb: Program.MediaGet.168` `Elastic: malicious (moderate confidence)` `Emsisoft: Application.Bundler.513 (B)` `GData: Application.Bundler.513` `Google: Detected` `Gridinsoft: PUP.Win32.MediaGet.sd!c` `K7AntiVirus: Trojan-Downloader ( 005d539c1 )` `K7GW: Trojan-Downloader ( 005d539c1 )` `Kaspersky: not-a-virus:Downloader.Win32.MediaGet.fkc` `Lionic: Riskware.Win32.MediaGet.1!c` `Malwarebytes: PUP.Optional.MediaGet` `MaxSecure: Trojan.Malware.644750110.susgen` `MicroWorld-eScan: Application.Bundler.513` `Microsoft: PUABundler:Win32/MediaGet` `Paloalto: generic.ml` `Rising: Downloader.MediaGet!8.13A69 (CLOUD)` `Sophos: Generic Reputation PUA (PUA)` `Symantec: ML.Attribute.HighConfidence` `TrellixENS: Artemis!DD4C83DF8E1F` `VBA32: Downloader.MediaGet` `VIPRE: Application.Bundler.513` `Varist: W32/ABApplication.FDEY-6400` `ViRobot: PUP.MediaGet.3240160` `Xcitium: ApplicUnwnt@#22orw15makak2` `alibabacloud: Trojan[downloader]:Win/MediaGet.gyf`

Hashes

MD5	`dd4c83df8e1f05cb6181d73df5cd2ef6` 🔍
SHA1	`1bbcec6a48a7390abe94fe0549dee13d5f345b5d` 🔍
SHA256	`9d3d8ee8a07c6d471dd15c4ef5cb2e3f09d486131b31855006da78d5b41df611` 🔍
SHA3	`6fbcd9c0dc0e0541cfa69808562499c82a5e936e722a17521209a46beb11b203` 🔍
SSDeep	`98304:4RTdnshzqy0/HSgunmtMk2ylaskrOgruJA:43shzqy0/ygsmmk2NXrue` 🔍
Imports Hash	`33b63ecbdd83c08bc7077d0521cbb82d` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x120`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`5`
TimeDateStamp	2026-Sep-21 14:14:54
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`14.0`
SizeOfCode	`0x247400`
SizeOfInitializedData	`0xd1000`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x001CD954 (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0x249000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x31c000`
SizeOfHeaders	`0x400`
Checksum	`0x320e60`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`d83e8789852267c369f5c6ee1adcf068 🔍`
SHA1	`ef679f7e774b0f4c8cad835de6115b1d547ccc45 🔍`
SHA256	`11211dd305a10505398eae2e4f4205aa3a0cd35184bf71f32a482ca77de54473 🔍`
SHA3	`0e44f89103d479a0405f5792ff659f49811b3f517bb16c5fba38840f68c3d070 🔍`
VirtualSize	`0x247372`
VirtualAddress	`0x1000`
SizeOfRawData	`0x247400`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.8196`

.rdata

MD5	`258e5aab7a94e7b3d2f349c7416c7374 🔍`
SHA1	`46394720fb098d8865993cb2f6a5d5fd02be5bcf 🔍`
SHA256	`baf51911165fbe8f8d601f61631e207245ab2db61a37717030e5ca99feda1e5d 🔍`
SHA3	`9244e961774b5a4195618af39a265998174c9ab0addfebcd7db7a3a540faeff0 🔍`
VirtualSize	`0xa572e`
VirtualAddress	`0x249000`
SizeOfRawData	`0xa5800`
PointerToRawData	`0x247800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.17666`

.data

MD5	`162bd17aab92388ea04cb140d93afbbb 🔍`
SHA1	`1a0845b2037eeb4da985b1c59193873d0660bb4a 🔍`
SHA256	`28312944e49c9c214bc22e1c031c324ec60f05ff33832000e4df71e9647138e5 🔍`
SHA3	`e49f07d57d3ed1a5612de0044884d78c17714698c70a9538f3b17a734984d8f4 🔍`
VirtualSize	`0xc7e0`
VirtualAddress	`0x2ef000`
SizeOfRawData	`0x6000`
PointerToRawData	`0x2ed000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.01477`

.rsrc

MD5	`27cbd5ba468ece1fe5b410150976ee80 🔍`
SHA1	`7903945e47edf101ec9df9772c2ae345151e8d58 🔍`
SHA256	`8accb5bb7af883252e7a92dfb084d85944ec8ee72946bb15fe5b732fe433cfdf 🔍`
SHA3	`4ab455b5c5cab2443d7a9e31f767e76e65044cfe5576110e37669d69e76db1e9 🔍`
VirtualSize	`0x8a10`
VirtualAddress	`0x2fc000`
SizeOfRawData	`0x8c00`
PointerToRawData	`0x2f3000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.26501`

.reloc

MD5	`2ca806a31fec221c08c0d9176e4d3d56 🔍`
SHA1	`746a0c5a46b9bd012e6341c50e80819721fb9881 🔍`
SHA256	`271ea3225ee23b391bdd6cdbaaf4fb2d332fa292ae67fdb2ec2719cd9c7c3f09 🔍`
SHA3	`075f1a3acc47e8bf56b5791d9cc954a3f671aed642e5d21f81f1bf8ce0174393 🔍`
VirtualSize	`0x1620c`
VirtualAddress	`0x305000`
SizeOfRawData	`0x16400`
PointerToRawData	`0x2fbc00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`6.61434`

Imports

WS2_32.dll	`getsockname` `getsockopt` `getnameinfo` `getpeername` `connect` `bind` `recv` `WSAGetLastError` `closesocket` `WSAWaitForMultipleEvents` `WSAResetEvent` `WSAEventSelect` `WSAEnumNetworkEvents` `WSACreateEvent` `WSACloseEvent` `send` `shutdown` `htons` `gethostname` `ioctlsocket` `sendto` `recvfrom` `freeaddrinfo` `getaddrinfo` `listen` `htonl` `accept` `select` `__WSAFDIsSet` `WSACleanup` `WSAStartup` `WSAIoctl` `WSASetLastError` `socket` `setsockopt` `ntohs`
CRYPT32.dll	`CertFindCertificateInStore` `CertDuplicateCertificateContext` `CertCloseStore` `CertEnumCertificatesInStore` `CertFreeCertificateContext` `CertGetEnhancedKeyUsage` `CertGetIntendedKeyUsage` `CertOpenSystemStoreW` `CertOpenStore` `CertGetCertificateContextProperty`
WLDAP32.dll	`#14` `#216` `#208` `#41` `#46` `#26` `#27` `#127` `#167` `#142` `#79` `#117` `#219` `#133` `#147` `#301` `#145`
KERNEL32.dll	`EncodePointer` `OutputDebugStringW` `InterlockedPushEntrySList` `FlushInstructionCache` `TerminateThread` `CreateThread` `FindResourceW` `SizeofResource` `LoadResource` `LockResource` `SetFileAttributesW` `Sleep` `GetLastError` `HeapSize` `HeapReAlloc` `HeapFree` `HeapAlloc` `GetProcessHeap` `HeapDestroy` `WaitForSingleObject` `GetExitCodeProcess` `DeleteCriticalSection` `InitializeCriticalSectionAndSpinCount` `RaiseException` `CloseHandle` `MultiByteToWideChar` `WideCharToMultiByte` `DeleteFileW` `GetFileAttributesW` `FindFirstFileW` `FindNextFileW` `FindClose` `RemoveDirectoryW` `FormatMessageW` `LocalFree` `CreateFileW` `ReadFile` `WriteFile` `OpenProcess` `TerminateProcess` `CreateProcessW` `SetErrorMode` `CreateDirectoryW` `GetTempPathW` `GetModuleFileNameW` `GetFileSizeEx` `CreateEventW` `CreateMutexW` `IsWow64Process` `GetCurrentProcess` `GetVersionExW` `GetTickCount` `GetDiskFreeSpaceExW` `ExpandEnvironmentStringsW` `GetCommandLineW` `GetLocaleInfoW` `LoadLibraryExA` `IsBadWritePtr` `GetSystemTime` `GetSystemDefaultUILanguage` `MulDiv` `SetLastError` `LeaveCriticalSection` `EnterCriticalSection` `GlobalAlloc` `GlobalLock` `GlobalUnlock` `lstrcmpW` `FindResourceExW` `lstrcmpiW` `GetProcAddress` `GetModuleHandleW` `FreeLibrary` `LoadLibraryExW` `DecodePointer` `GlobalHandle` `GlobalFree` `VirtualFree` `VirtualAlloc` `SetFilePointer` `SetEvent` `ResetEvent` `WaitForSingleObjectEx` `UnhandledExceptionFilter` `SetUnhandledExceptionFilter` `IsProcessorFeaturePresent` `IsDebuggerPresent` `GetStartupInfoW` `QueryPerformanceCounter` `GetCurrentProcessId` `GetSystemTimeAsFileTime` `InitializeSListHead` `ReleaseSRWLockExclusive` `AcquireSRWLockExclusive` `InitializeCriticalSectionEx` `SleepEx` `QueryPerformanceFrequency` `GetSystemDirectoryW` `LoadLibraryW` `MoveFileExW` `CompareFileTime` `GetEnvironmentVariableA` `GetStdHandle` `GetFileType` `PeekNamedPipe` `WaitForMultipleObjects` `GetModuleHandleA` `VerifyVersionInfoW` `SetConsoleMode` `GetEnvironmentVariableW` `ReadConsoleA` `GetConsoleMode` `ReadConsoleW` `TlsSetValue` `TlsAlloc` `TlsGetValue` `TlsFree` `GetModuleHandleExW` `DeleteFiber` `SwitchToFiber` `CreateFiber` `ConvertFiberToThread` `ConvertThreadToFiber` `LoadLibraryA` `SystemTimeToFileTime` `LCMapStringEx` `GetStringTypeW` `InterlockedPopEntrySList` `GetCPInfo` `RtlUnwind` `ExitProcess` `GetFileAttributesExW` `GetDriveTypeW` `GetFileInformationByHandle` `SystemTimeToTzSpecificLocalTime` `FileTimeToSystemTime` `ExitThread` `FreeLibraryAndExitThread` `SetFilePointerEx` `SetConsoleCtrlHandler` `GetConsoleOutputCP` `GetDateFormatW` `GetTimeFormatW` `CompareStringW` `LCMapStringW` `IsValidLocale` `GetUserDefaultLCID` `EnumSystemLocalesW` `FindFirstFileExW` `IsValidCodePage` `GetACP` `GetOEMCP` `GetCommandLineA` `GetEnvironmentStringsW` `FreeEnvironmentStringsW` `SetEnvironmentVariableW` `SetStdHandle` `FlushFileBuffers` `SetEndOfFile` `GetCurrentDirectoryW` `GetFullPathNameW` `GetTimeZoneInformation` `WriteConsoleW` `GetCurrentThreadId` `VerSetConditionMask`
USER32.dll	`GetFocus` `SetFocus` `IsWindow` `GetClassNameW` `GetSysColor` `RedrawWindow` `GetClassInfoExW` `CreateWindowExW` `CreateAcceleratorTableW` `ClientToScreen` `ScreenToClient` `MoveWindow` `SetCapture` `ReleaseCapture` `FillRect` `InvalidateRgn` `CallWindowProcW` `DestroyAcceleratorTable` `DefWindowProcW` `LoadCursorW` `RegisterClassExW` `LoadBitmapW` `DestroyWindow` `SetWindowContextHelpId` `GetWindowTextW` `AppendMenuW` `KillTimer` `InvalidateRect` `EndPaint` `BeginPaint` `PostQuitMessage` `SetWindowTextW` `GetWindow` `MonitorFromWindow` `GetMonitorInfoW` `GetWindowRect` `GetParent` `MapWindowPoints` `ReleaseDC` `GetDC` `MessageBoxW` `GetDlgItem` `SetWindowLongW` `GetWindowLongW` `IsDialogMessageW` `GetWindowTextLengthW` `UnregisterClassW` `GetUserObjectInformationW` `GetProcessWindowStation` `CreateDialogIndirectParamW` `GetMessageW` `TranslateMessage` `DispatchMessageW` `EndDialog` `MapDialogRect` `CharNextW` `AllowSetForegroundWindow` `PeekMessageW` `PostThreadMessageW` `IsChild` `DestroyMenu` `CreatePopupMenu` `RegisterWindowMessageW` `SendMessageW` `SetForegroundWindow` `ShowWindow` `SetWindowPos` `GetDesktopWindow` `GetClientRect` `GetWindowThreadProcessId` `FindWindowW` `LoadImageW`
GDI32.dll	`GetDeviceCaps` `GetStockObject` `GetObjectW` `CreateSolidBrush` `CreateCompatibleDC` `CreateCompatibleBitmap` `SelectObject` `BitBlt` `DeleteObject` `CreateFontW` `DeleteDC`
ADVAPI32.dll	`RegDeleteKeyW` `RegOpenKeyExW` `RegQueryValueExW` `RegCloseKey` `RegCreateKeyExW` `RegSetValueExW` `OpenSCManagerW` `OpenServiceW` `CloseServiceHandle` `QueryServiceStatusEx` `StartServiceW` `CryptAcquireContextW` `CryptCreateHash` `CryptReleaseContext` `CryptDestroyHash` `RegQueryInfoKeyW` `RegEnumKeyExW` `ReportEventW` `RegisterEventSourceW` `DeregisterEventSource` `CryptGetProvParam` `CryptSignHashW` `CryptSetHashParam` `CryptExportKey` `CryptDecrypt` `CryptEnumProvidersW` `CryptGetUserKey` `CryptDestroyKey` `RegDeleteValueW` `RegEnumKeyW`
SHELL32.dll	`ShellExecuteW` `ShellExecuteExW` `Shell_NotifyIconW` `CommandLineToArgvW` `SHBrowseForFolderW` `SHGetSpecialFolderLocation` `SHGetPathFromIDListW` `SHGetSpecialFolderPathW`
ole32.dll	`CoCreateInstance` `CoInitialize` `CoTaskMemFree` `CLSIDFromString` `CLSIDFromProgID` `OleRun` `CoUninitialize` `CreateStreamOnHGlobal` `OleUninitialize` `CoTaskMemAlloc` `StringFromGUID2` `OleLockRunning` `CoGetClassObject` `OleInitialize` `CoTaskMemRealloc`
OLEAUT32.dll	`OleCreateFontIndirect` `LoadTypeLib` `LoadRegTypeLib` `SysStringLen` `DispCallFunc` `VariantClear` `SysFreeString` `SysAllocString` `SysAllocStringLen` `VariantChangeType` `VariantInit` `GetErrorInfo` `SysAllocStringByteLen` `SysStringByteLen` `VarUI4FromStr`
SHLWAPI.dll	`AssocQueryStringW`
COMCTL32.dll	`InitCommonControlsEx`
WININET.dll	`InternetSetOptionW`
bcrypt.dll	`BCryptGenRandom`

Delayed Imports

PRELOADER_IMG

Type	`JPEG`
Language	Russian - Russia
Codepage	UNKNOWN
Size	`0x3981`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.52517`
Detected Filetype	JPEG graphic file
MD5	`2a3e6fe436421c222561b076033847d0 🔍`
SHA1	`8b5eebceaaff315f899859d6582fc213e87aca8e 🔍`
SHA256	`a885583e65c215880f4448e853b1c966d8cb96e619c26daf095ba3d0789128cd 🔍`
SHA3	`ee34fa167d94122d3b1fed97b00006f280d9f61e5d4bf524e8fefdc3e3f013b4 🔍`

1

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x25a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.95548`
MD5	`0391899fff52c23cbf226ea473cfb620 🔍`
SHA1	`c230baaf0c35dc6d546e021edbb5a5b13e6fe290 🔍`
SHA256	`663ba2a76dd6bd107e20f87a3d0d04c85b2cebcd5324e1acb30df201be1c9f29 🔍`
SHA3	`19fe466f8230f3540a770d557edee8a91f0df583ea77ecd97fafb4f6a092ddcb 🔍`

2

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x10a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.18073`
MD5	`38ee163b193d8b3dbaed29c3edd9332e 🔍`
SHA1	`9a525f5792bf2f01088ced0c4fb346ca820af546 🔍`
SHA256	`b48c12b91b9f2a2371f3c5602b6e531dbce77662068bd737415de2f0931fa8c7 🔍`
SHA3	`d870e4cb414c3e405e1d76b87a6650a5c9c3141eda1eda207034bb6304404fe6 🔍`

3

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x988`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.05232`
MD5	`efd7367e0c935fff330ce2b27e4e10a0 🔍`
SHA1	`e41f3a6aa937efc73ae0e30c6751f5e09c661d52 🔍`
SHA256	`b6c6f66305362100c89d129d32b2d5fa069fd0da7ed5725197444ffa23566cbe 🔍`
SHA3	`56bb969b6526793710f7b3b18cc4862d34240f8b633730ba6b7e191e97baae5c 🔍`

4

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x468`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.75162`
MD5	`f68a43230d48bb24badeb9062cb73f48 🔍`
SHA1	`68fdb46a34869ea1f58283262958782cbc637181 🔍`
SHA256	`2b4fd6d5f97086f9963fe9f6fb51085979a0cea3767f76ef5396b221d5a4ae9e 🔍`
SHA3	`e7f49be1d3176a745a5ae53558a096486ef1beaafac1cf82247a1aea2867c4d7 🔍`

129

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0x110`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.01562`
MD5	`c41825d2b553ffcd715506cc596465e1 🔍`
SHA1	`a539b1aa751b67b9cc11311e3cc5a1c6c43fb993 🔍`
SHA256	`9f2ef1b5c936189c6d778503006d47492f179f24f3941a280c7494e3992df274 🔍`
SHA3	`d3124e5a4c77aba5fd398400c84aa65177d44f765c8e0b9e76215c4f56634781 🔍`

128

Type	`RT_ACCELERATOR`
Language	English - United States
Codepage	UNKNOWN
Size	`0x70`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.94747`
MD5	`0b4f5e6c2b2423486088a8e08e184edb 🔍`
SHA1	`2cec5761667eb71ef78d1ab3704fe09235ee54f4 🔍`
SHA256	`6913343cd8c147d53027bf3e8693e6553c4eab0e623a65e0b96e7c2179558f9a 🔍`
SHA3	`a6cbca1b1b0d1a4d4c7a97a099b6a7fc381f4e432d441296e7930a70dd816dba 🔍`

128 (#2)

Type	`RT_GROUP_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x3e`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.62308`
Detected Filetype	Icon file
MD5	`5c84b5099ac46312565be1aa2e21eff0 🔍`
SHA1	`25f00759b0e6641f9b423e6a52556c2e4e2796c3 🔍`
SHA256	`816cc8c77a0adb35a7432b2bac047e9834bfd21b0ef96c612e5f8bc4f0986620 🔍`
SHA3	`17e6deff600599725f4cf3c95b7472cf6ca993cdc40907ae04b6209f5619547f 🔍`

1 (#2)

Type	`RT_VERSION`
Language	English - United States
Codepage	UNKNOWN
Size	`0x354`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.35337`
MD5	`93f84e62f9b6cb2122bd2a34a668a05e 🔍`
SHA1	`4406560a395873fe05de61b5f4fd5eecc9a59917 🔍`
SHA256	`18769db1bfb53a10b505899851ad93ab33cc56d511f19596ced4a7e6994892bf 🔍`
SHA3	`46bfeaca824ba47937bccc9147ea2b7ed30fa871e5654cea87b2ae7b3d7b40dc 🔍`

1 (#3)

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x370`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.31374`
MD5	`3713145de3a2efb374e8fbde40300967 🔍`
SHA1	`c32deab66dc85e7223d18794fbb2892c46c79aab 🔍`
SHA256	`363c2312ba972542cf6186e18d2031c6da407e35b9b2c771925a7dce4990824e 🔍`
SHA3	`29132fc3cb642b0756d15699923abc10e8983fae3368dfaf99f63c5a30845e82 🔍`

129 (#2)

Type	`UNKNOWN`
Language	English - United States
Codepage	UNKNOWN
Size	`0xaa`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`1.67172`
MD5	`52bf0e8c43148f3df010e95a494bd97a 🔍`
SHA1	`76582ed3417324ca07b9db939f5e2904874ad495 🔍`
SHA256	`1b6edcd57618eb02e4745bf15bfce478d2d421c0ef7f69224604bad50bc204d8 🔍`
SHA3	`c5d2859e77d36edd2ff61bb9355b885e89eb8e21a1712f76fdaa75b072fb2b71 🔍`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	500.0.0.0
ProductVersion	500.0.0.1
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	English - United States
Comments	Mediaget installer
CompanyName	Global Microtrading PTE. LTD
FileDescription	Mediaget installer
FileVersion (#2)	500.0
InternalName	MediaGet.exe
LegalCopyright	Copyright 2026 Global Microtrading PTE. LTD
OriginalFilename	mediaget.exe
ProductName	Mediaget
ProductVersion (#2)	500.0

Resource LangID	English - United States

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2026-Sep-21 14:14:54
Version	`0.0`
SizeofData	`1012`
AddressOfRawData	`0x2e657c`
PointerToRawData	`0x2e4d7c`

TLS Callbacks

StartAddressOfRawData	`0x6e6980`
EndAddressOfRawData	`0x6e6988`
AddressOfIndex	`0x6f5214`
AddressOfCallbacks	`0x6496b4`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_4BYTES`
Callbacks	`(EMPTY)`

Load Configuration

Size	`0xbc`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x6ef014`
SEHandlerTable	`0x6e5ae4`
SEHandlerCount	`251`

RICH Header

XOR Key	`0xab963f62`
Unmarked objects	`0`
ASM objects (30795)	`17`
C++ objects (30795)	`204`
253 (28518)	`7`
C objects (30795)	`29`
C objects (CVTCIL) (30795)	`1`
Unmarked objects (#2)	`21`
C objects (VS 2015/2017/2019 runtime 29913)	`107`
C++ objects (30034)	`94`
C objects (30034)	`20`
ASM objects (30034)	`27`
Imports (30795)	`31`
Total imports	`414`
C++ objects (LTCG) (VS2019 Update 11 (16.11.16-17) compiler 30146)	`625`
Resource objects (VS2019 Update 11 (16.11.16-17) compiler 30146)	`1`
151	`1`
Linker (VS2019 Update 11 (16.11.16-17) compiler 30146)	`1`

Errors

Leave a comment

No comments yet.