9eeb6c08d235d41f18a2d37a305cbb3513e6974765a84669f093b8b45cee6b71

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2024-Sep-29 11:56:20
Detected languages Dutch - Belgium
English - United States
CompanyName Image-Line
FileDescription FL Studio
FileVersion 24.1.2.4394
InternalName FL
LegalCopyright Copyright © 2012-2024 by Image-Line. All rights reserved.
OriginalFilename FL.exe
ProductName FL Studio
ProductVersion 24.1.2.4394

Plugin Output

Suspicious PEiD Signature: Crunch/PE v5.0
Info Libraries used to perform cryptographic operations: Microsoft's Cryptography API
Suspicious The PE is possibly packed. Unusual section name found: .Yr|
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryW
  • LoadLibraryExW
 Can access the registry:
  • RegCloseKey
  • RegQueryValueExW
  • RegOpenKeyExW
 Uses Microsoft's cryptographic API:
  • CryptMsgClose
  • CryptQueryObject
  • CryptMsgGetParam
  • CryptDecodeObject
 Enumerates local disk drives:
  • GetDriveTypeW
Info The PE is digitally signed. Signer: Image Line
Issuer: Image Line
Safe VirusTotal score: 0/71 (Scanned on 2026-08-10 11:31:36) All the AVs think this file is safe.

Hashes

MD5 e1aac20518dbb1dedd71339640e6206c
SHA1 90ee232a5999ba5dd3a5dcacbb149b149a045374
SHA256 9eeb6c08d235d41f18a2d37a305cbb3513e6974765a84669f093b8b45cee6b71
SHA3 cfd1e3f0531d38dd161c94c47b8174725067cf49a79c4bb3c51e80448082c5a4
SSDeep 49152:LbWBimayHzXF9tJcztfrrsliM2NtSUnyz8hD3xoAn0zUrr6ZnuCS8QtC8UY7NAD:GBayzT6f8lGyAoWJWFJ4pO
Imports Hash f798f483adcaf2207365657e7ddb20c2

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 8
TimeDateStamp 2024-Sep-29 11:56:20
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x58000
SizeOfInitializedData 0x48200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000000309C4 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x33f000
SizeOfHeaders 0x400
Checksum 0x3336a8
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 04a642f91b0cdcd1482656f9dff87b16
SHA1 c7f86c6e27f4b8eb42dd226761c0fc9e8d9a6915
SHA256 e8f38b6569377e825791ddc8b078b64bc26e41f01dc3d7d67161cc2099f2cb14
SHA3 98c8a7bfc882ffefed483d708515262c668eac52bbe2a20c90f209747a2bf60d
VirtualSize 0x57e90
VirtualAddress 0x1000
SizeOfRawData 0x58000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.5137

.rdata

MD5 ca530b2acbb565ada87796f204414d35
SHA1 d4c17508c47b39d6ae8465581a2669afc09c2659
SHA256 f1debd98c127ff3bc9e12c8fe995b96a77873572ff55d930948e4dfafccf4f8d
SHA3 ab29121d91755afef04e324043076bcb3a6d4c70c80bfbb1653bdde2f8e8969a
VirtualSize 0x1728e
VirtualAddress 0x59000
SizeOfRawData 0x17400
PointerToRawData 0x58400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.19266

.data

MD5 f52196e09b02761cd4ef7e17a986c567
SHA1 93d9ce20f327dfb130077b52b440d12cc596ba69
SHA256 d859f2d508cea59fa8cda3fc93558c55225ff9823753032f42267f437ed91f7d
SHA3 69bfc107b5e33290df495543c19cbb314d23e0358b0d9e8a74544c390ff09bd4
VirtualSize 0x13304
VirtualAddress 0x71000
SizeOfRawData 0x1c00
PointerToRawData 0x6f800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.60845

.pdata

MD5 019c0c106f907a9e8cf29f840ee22acb
SHA1 d6a32ef5f9e8b9fcf1d5f2fe3ef5ee9976f21eee
SHA256 2407c4096b54320ac6b908eca041128c0847e86b9a2b028245d468cfc56e5aaf
SHA3 9c1095dcacbdab3fee5804af4f44d788352417d7424a09605c31c06b121c9f16
VirtualSize 0x3474
VirtualAddress 0x85000
SizeOfRawData 0x3600
PointerToRawData 0x71400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.83921

_RDATA

MD5 7ccd223146a11ae9e3ce507d6c254e2e
SHA1 dcffd28a480237a6a88cdeb6f03809515a0260ce
SHA256 d95a2e5bdcccb4294a0086782dc79dc86adec6608233376a7400c3ddb7177ad7
SHA3 f6786f1ed6126bbb6a86f3e9bc2b4dbb793bafba9dbccba7a544e33bb4f591e1
VirtualSize 0xf4
VirtualAddress 0x89000
SizeOfRawData 0x200
PointerToRawData 0x74a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.446

.Yr|

MD5 38ce64a1f2eb3eb8a198305a55fcefec
SHA1 b0eb30647995297b8bc45d1cc841f277ca78d0d5
SHA256 554ebd89552380aae1e9b35ad25c1b165535a2f3ae7a6578811d734f02cc4870
SHA3 bfc3221c9d318281d232afb1f125b5bbd8f84e0630880c22849e8002a90e6e54
VirtualSize 0x299150
VirtualAddress 0x8a000
SizeOfRawData 0x299200
PointerToRawData 0x74c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
Entropy 7.28414

.rsrc

MD5 05817317c70518d58a26f1cacbc575fa
SHA1 3cbd1ec25cb72b5f799c01ca4adfad764cae0346
SHA256 dff9b6437df25d5ba23349854859eade3f4fa8f25fa87d0eecdfa809dcf1df35
SHA3 fa6202def581479a9b6fc50508565f05f4feffb2824b981ef74139c37894d8ea
VirtualSize 0x1930b
VirtualAddress 0x324000
SizeOfRawData 0x19400
PointerToRawData 0x30de00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.12811

.reloc

MD5 bb072be569fff76e543f9a641c4391f7
SHA1 7bd283eaa344c6b38016b8320b7dd63e23384bd9
SHA256 db179c4e3ca4d140cb253ab2b770e7f9071c3cfac36b3e16c4f29de7a98096a4
SHA3 6f8b6d5c609e8ce8cf0113684de161d923fe91209efc2aa4784e3fe2f9be1666
VirtualSize 0xd84
VirtualAddress 0x33e000
SizeOfRawData 0xe00
PointerToRawData 0x327200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.44693

Imports

KERNEL32.dll GetProcAddress
FreeLibrary
SetCurrentDirectoryW
GetModuleHandleW
LocalAlloc
lstrcmpA
LocalFree
LoadLibraryW
HeapSize
WideCharToMultiByte
MultiByteToWideChar
CloseHandle
GetLastError
GetFileAttributesW
GetConsoleOutputCP
FlushFileBuffers
GetProcessHeap
SetEnvironmentVariableW
FindClose
GetModuleFileNameW
FindNextFileW
WriteConsoleW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetCurrentDirectoryW
HeapFree
HeapAlloc
GetFullPathNameW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
SetFilePointerEx
GetConsoleMode
HeapReAlloc
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
USER32.dll MessageBoxA
ADVAPI32.dll RegCloseKey
RegQueryValueExW
RegOpenKeyExW
WINTRUST.dll WinVerifyTrust
CRYPT32.dll CryptMsgClose
CertFreeCertificateContext
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringW
CryptDecodeObject

Delayed Imports

1

Type RT_ICON
Language Dutch - Belgium
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.83396
MD5 b107141cdc0859607cc514e8b208c356
SHA1 e27bb0e3a87f714d446dd6dc79bd30569d172ebb
SHA256 9c96112d9b436627bf20915782706d481e5cd126e7f77a6666f6c80e875863ef
SHA3 3516ee4e2ebdc4c64d91eebd464bf745e0566aca61453958264d3db85b3a0db3

2

Type RT_ICON
Language Dutch - Belgium
Codepage UNKNOWN
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.92422
MD5 2621f637c6c7d0db8be0f69b563ef5dd
SHA1 ed475266e4db6dec5875133c99f0111deb04bceb
SHA256 16f12d2959fb3a02b8312fb7cd936df48feb5abce7a9fd35c17cbb2a28fd78a7
SHA3 08df889b2c7ebffb12ff0a9181022a2bbd43fa937024c242cb6b75c7753288be

3

Type RT_ICON
Language Dutch - Belgium
Codepage UNKNOWN
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.89934
MD5 12bdcee5f0cfe1f8ffa9e2c0a1adeaba
SHA1 6bf2e26f8a0ad541e15d8edf2054cc73e80fba4f
SHA256 ec589108c42affb2db8dbfbf0db3effa6efcf9b4ea834a6d0e5396e15c3db35a
SHA3 a2bc7e13313f7aa6c2a623626025da071ae008692bdd591c77c3c8538d7767db

4

Type RT_ICON
Language Dutch - Belgium
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.27241
MD5 50b99b94a377a591f430e82790b9b033
SHA1 b2448a7e594efa6e1bd2b7f489ebc9f5f8c058b5
SHA256 c9b2f06a01be81320a68e8799fb513a9607c7755ff0f8a1cb43a70f2cd158dd2
SHA3 a955bf24223c22c8d3fa59488948ecee734fc7a08d84a9b1243e88c287cc8904

5

Type RT_ICON
Language Dutch - Belgium
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.83024
MD5 a6f033789027461f3a5a336c283526b4
SHA1 6d8cac98e418b0a174ab0e28babe88cddd3c5b31
SHA256 020cb115105db53d9ad24c38b458f95b142f41a97a29471e9e5e9ebbd9d8d259
SHA3 fc445bc4d35dcd9bb631d00f748f1649335b85d6ef6e7417489d1a5a680343a1

6

Type RT_ICON
Language Dutch - Belgium
Codepage UNKNOWN
Size 0xbe87
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.92352
Detected Filetype PNG graphic file
MD5 4995ff1475023a731f41bbdaf9b472c5
SHA1 5aa323494b6a70e6c288ed5775b5f341cae0c953
SHA256 33bb59435d329b932e692090741162d919d9fdb5ac6f0d06fbfee1e1af13ab09
SHA3 2710ca1e48ae6fda01ef509b05b38c543cf52087cc08411672c3c7a5d076746f

7

Type RT_ICON
Language Dutch - Belgium
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.49085
MD5 f56909ebdcbdb63d88688844c60bbf0c
SHA1 2b9e9989321adced9ba8a77bc9bf50aced2d1877
SHA256 90af34728784180417581a8bdd86913ea42771a849d86729869f619f52e59217
SHA3 b70a22f8be680f0eabc850694f78c04688dc69ce86674de97f796e57801a91b5

8

Type RT_ICON
Language Dutch - Belgium
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.5967
MD5 6133469538aa207b64dcdc6e63af4cd3
SHA1 e15e66e2752e6b7586aae992807990a910d05faa
SHA256 bca66c7bbaf55700b0158182e17375f304f07920c67e6440978db7abf88ba67c
SHA3 5acb917ded135098b8ac52852e3b8faf1d6ad12420d6d16f9d8c9eb81754bffc

9

Type RT_ICON
Language Dutch - Belgium
Codepage UNKNOWN
Size 0x1a68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.68084
MD5 a63e2a0adb3d78bc0b2a8afd89b8396b
SHA1 610ad2cf2f91ae230681abcdc2e727a4c961312c
SHA256 986ee4cdb71a7c30dab1c0ddcbded2dc02c0938354c2f5d36c9af10889392d1d
SHA3 dd0bdd6affe58c076d11d5b8a9e01a6ec93747047335aaf7cedd2890bed46fdc

10

Type RT_ICON
Language Dutch - Belgium
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.83905
MD5 314d258975d4463a1ac36eaa3e78d571
SHA1 e5dfdded8657854dad59f7b4c09d42c081760c55
SHA256 ff4edc0d28d124e0d3f4778e831d39cddf816176f8999a6d25a1b215eeea1bb3
SHA3 2535709be9faac49fcdbf694cac7b4c8ac3de9b43d8a822ca7c702ce5ba6209a

11

Type RT_ICON
Language Dutch - Belgium
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.98311
MD5 ce9414b98effb0c84b244872d19b3191
SHA1 4be9911a3bdc6c89676df0f1e6e6adf919a4a103
SHA256 5fb67afaf69a7c826cb7b14cc6821fa50d490ada4f9dcf1c371709b374f3fef7
SHA3 ae56c5823905b2e5397e4ebfadd91b5b51cfe89f451bc7e15bfc1dfed0f5237f

12

Type RT_ICON
Language Dutch - Belgium
Codepage UNKNOWN
Size 0x6b8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.05319
MD5 cdffcaa6e595ab719b17a35fba08a3c0
SHA1 5ab314bd948619951ce808df0a73566f364724dc
SHA256 07b5b764ac2c556f7017cdad54f6c25aa8fe8b4558a54a9f6cdd8f2aa174c9f8
SHA3 33b29c3d4f03ca76eaf3772d2c9a7e4117745ea097d2f0f2da0ef2ba22cc994b

13

Type RT_ICON
Language Dutch - Belgium
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.09598
MD5 740cc6c8ed4dbc339efa9365b2d0aa1d
SHA1 aa1dc62da50556d8b2ab86db1bcdc9a1f0a5f692
SHA256 7c403df78d591cf46186c6274dbfb5b217af7c552a20f4da22c17f79718cedf0
SHA3 56735178752515dae848cb12718a9dd0136de6df6b82297b2c324f048617d81a

102

Type RT_GROUP_ICON
Language Dutch - Belgium
Codepage UNKNOWN
Size 0xbc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.11665
Detected Filetype Icon file
MD5 cabf6239529d8843852c8637e06cca1c
SHA1 18d1662b29bd2f5eb2b78261cc0b1405519a02e8
SHA256 25152b5bb426e945f6f2ab14584bc5e10328b3e7ee6fe1d141bf7af4ce861c95
SHA3 a5f2f9f6f264d09ee28f798a44f27b3dafd11dc065ab9d07ad7d232eed45c207

1 (#2)

Type RT_VERSION
Language Dutch - Belgium
Codepage UNKNOWN
Size 0x2f0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.46989
MD5 7f3c0a765c212b65fc2933cf22763de2
SHA1 debdec0a187fdfd4371f52bd5d753bbf6aa776c4
SHA256 f560a2c31e5f6b12948e578ef4b64171349ad581b0db2eafa6e1c94e98769b8b
SHA3 1e4fb2782996373387a8a02780633e201b104e3d4b38d4eb85ac205c059123a2

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x513
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.35119
MD5 cffbb05dc009f43abdaa9abbd030a442
SHA1 59ffa7281ce4c16fd3d557ab2bd94ee011f7177b
SHA256 0efa5eb7c2b0322b2afaad0e4e2102c409cb6fb302f4cc5c9a62bc58dce76111
SHA3 ff6af46e3c49ea0894e471e10246feeae308b71301ab0fe37b43b1844b6afe6c

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 24.1.2.4394
ProductVersion 24.1.2.4394
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
CompanyName Image-Line
FileDescription FL Studio
FileVersion (#2) 24.1.2.4394
InternalName FL
LegalCopyright Copyright © 2012-2024 by Image-Line. All rights reserved.
OriginalFilename FL.exe
ProductName FL Studio
ProductVersion (#2) 24.1.2.4394
Resource LangID Dutch - Belgium

TLS Callbacks

Load Configuration

Size 0x138
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140071020

RICH Header

Errors

Leave a comment

No comments yet.