| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Oct-18 07:13:48 |
| Detected languages |
English - United States
|
| TLS Callbacks | 2 callback(s) detected. |
| Debug artifacts |
Embedded COFF debugging symbols
|
| Suspicious | The PE is possibly packed. |
Unusual section name found: /4
Unusual section name found: /19 Unusual section name found: /31 Unusual section name found: /45 Unusual section name found: /57 Unusual section name found: /70 Unusual section name found: /81 Unusual section name found: /97 Unusual section name found: /113 |
| Suspicious | The file contains overlay data. | 31081 bytes of data starting at offset 0x15a00. |
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| MD5 | 269b5085923b231d2f103af0dd384c96 🔍 |
|---|---|
| SHA1 | 75d749b390e5c57efdea0949ae5c712fa7a2f993 🔍 |
| SHA256 | aa38c8693e8c3508618f70e64c732a698c589176f195f8853fcc087cfe164d27 🔍 |
| SHA3 | 3a79038ad273e7c6ee10d8cfbe43827e95e5a9d948b2c3eaea4a9091b11e31aa 🔍 |
| SSDeep | 1536:kLkOwyP1R4/SgigYHFPJcZWhpvffM5zxnSV+NRMOb+ubNKv5CU8Le1sQDu:kAOwq1R4/IYInk7xn+u85Tu 🔍 |
| Imports Hash | 2487dc78a16a7b98e8b2c731a26524a1 🔍 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 19 |
| TimeDateStamp | 2026-Oct-18 07:13:48 |
| PointerToSymbolTable | 0x15a00 |
| NumberOfSymbols | 1424 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0x1800 |
| SizeOfInitializedData | 0x1e00 |
| SizeOfUninitializedData | 0x200 |
| AddressOfEntryPoint | 0x00000000000013D0 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x22000 |
| SizeOfHeaders | 0x600 |
| Checksum | 0x1d3ac |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x200000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| MD5 | b843bf5eb1f98d204c6c07e757abf577 🔍 |
|---|---|
| SHA1 | a31b912dc71e0f7fa50ee04db79008070cb332aa 🔍 |
| SHA256 | 78b9a90f850570086f073fe6f63fe6cd51c4c430c909e771fe028d63204ab5f6 🔍 |
| SHA3 | 2cae0ab1c76fc7673d2d82ea31491333365c77f77aaae09336672ec93fe40beb 🔍 |
| VirtualSize | 0x17a0 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x1800 |
| PointerToRawData | 0x600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.98743 |
| MD5 | c054d24f9ff58132fa4c35e609ed32a3 🔍 |
|---|---|
| SHA1 | 71ffadb7dcafbc283133c26df86a9b9944241782 🔍 |
| SHA256 | 96c3e22154c10fd96a0027214c4f7609f938fdee3d4ae5602489442807f5aade 🔍 |
| SHA3 | ffbbc423048792d8edb6c5538126cdca67d50b74ed18c289f1f7b4c842f4ed25 🔍 |
| VirtualSize | 0x90 |
| VirtualAddress | 0x3000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x1e00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0.640398 |
| MD5 | f13ebfdd5d1b3e8bf7d8ca5fede3cd90 🔍 |
|---|---|
| SHA1 | 3fdb8b35e78cb64a049ada6f4ea1eec84d6bfc61 🔍 |
| SHA256 | 2354c43c54fb367fffd80408fec9e3e90dda608e277085e0163f6a5baafa8fae 🔍 |
| SHA3 | 047c2ed8e4f3fe86f5c6b98ff347d74c3adb41a6e277ad9350bc8e12945d39a2 🔍 |
| VirtualSize | 0x978 |
| VirtualAddress | 0x4000 |
| SizeOfRawData | 0xa00 |
| PointerToRawData | 0x2000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 3.95846 |
| MD5 | f4d3c30b2886e9a26a2dd6c625a7e78c 🔍 |
|---|---|
| SHA1 | a89646ef70898c863e634762926e33e0a0e23c2d 🔍 |
| SHA256 | 8fe2b25df85307ae6f55b0f2719023e5c24debf56203aa4fb7b1378878a569b2 🔍 |
| SHA3 | a4b167dae5da99bebf8d8fad404c9ae93a1fd046981a52acf8aa7456933878dc 🔍 |
| VirtualSize | 0x228 |
| VirtualAddress | 0x5000 |
| SizeOfRawData | 0x400 |
| PointerToRawData | 0x2a00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 2.37816 |
| MD5 | 068cef4c2cdaa6caa1bde93a778e8388 🔍 |
|---|---|
| SHA1 | 9dd9a32ba1b45115aa23bbb0bd54bc9aa767b366 🔍 |
| SHA256 | a81cefad62e94259a01dc40354f0a51e0b1b8c79f30d8eb33a66bbb8b50eb13b 🔍 |
| SHA3 | d87c32f795e05d7729507bdf67c511e6872efa0921302bf313719588653d7a75 🔍 |
| VirtualSize | 0x19c |
| VirtualAddress | 0x6000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x2e00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 3.18986 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x180 |
| VirtualAddress | 0x7000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| MD5 | 06e1650ab0052caa9c94ac6dc0c5349c 🔍 |
|---|---|
| SHA1 | 55d13f27e07604ff20d4e5a0b98b62a50699aa6e 🔍 |
| SHA256 | 46402d472110f8defed06a1ffc92afb61eaae0c11da7c32e33bb9433a62d7f51 🔍 |
| SHA3 | 202028548d7d6089dd99683d3fe90b96013a944afcc9e56e342c27472335669a 🔍 |
| VirtualSize | 0x574 |
| VirtualAddress | 0x8000 |
| SizeOfRawData | 0x600 |
| PointerToRawData | 0x3000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 3.60432 |
| MD5 | bf619eac0cdf3f68d496ea9344137e8b 🔍 |
|---|---|
| SHA1 | 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍 |
| SHA256 | 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍 |
| SHA3 | 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍 |
| VirtualSize | 0x10 |
| VirtualAddress | 0x9000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x3600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0 |
| MD5 | 88017fb17d6e2e234c5f83c7bff56f0d 🔍 |
|---|---|
| SHA1 | c3565ed974ea832cc820bdf2e1deb0fd9188c416 🔍 |
| SHA256 | 7a1217735b1e6edb705a1eb3cc2e4af5172ddc931d1a26f71f01d0362d7fd840 🔍 |
| SHA3 | 76bfdb785253669e509bd2e0daa89ea8535b504fa2b5cc3c14c09f8adea4ae3d 🔍 |
| VirtualSize | 0x158 |
| VirtualAddress | 0xa000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x3800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 3.51688 |
| MD5 | 4dfb9d3ab7b79b15c33ab65d9a60adff 🔍 |
|---|---|
| SHA1 | a082a4110fb7b88d4183f08543f97dcc5702a9db 🔍 |
| SHA256 | 8f744b2916f2ecf764a350eea37e9a10a31eaf7006da50ba0b8248ffbd1a71c8 🔍 |
| SHA3 | 00d41b0e7c743207d7a007555adcabe06a876381b05f98385a16a10d6172057c 🔍 |
| VirtualSize | 0x6c |
| VirtualAddress | 0xb000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x3a00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 1.406 |
| MD5 | b9afa4a85978ec0785cc80671d920d2a 🔍 |
|---|---|
| SHA1 | 3907dfdd9a622f155c3c6b807a3c334436e55380 🔍 |
| SHA256 | 50dbc6c6011cae9589f50c96413460e5000655f5663ca2cd895acad371eb3bba 🔍 |
| SHA3 | 0815054e5fd95c4d12dc69dd98120559bb6c30c3c13323217f95f16f8fbf8e05 🔍 |
| VirtualSize | 0x470 |
| VirtualAddress | 0xc000 |
| SizeOfRawData | 0x600 |
| PointerToRawData | 0x3c00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 1.33165 |
| MD5 | f65711527da6531a254c6635572985f5 🔍 |
|---|---|
| SHA1 | 1057a1716338dbe93a5fdb5ce441d3ffe0b722a3 🔍 |
| SHA256 | ac8199fe219ae5995ba19872ca86c766f4084e32af3845f50c5f70e79c5b7ed6 🔍 |
| SHA3 | 374e754453bd75b57b69a3f09418e3337dcd6b4d80a350402dbcf74848bd371e 🔍 |
| VirtualSize | 0xa407 |
| VirtualAddress | 0xd000 |
| SizeOfRawData | 0xa600 |
| PointerToRawData | 0x4200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.83735 |
| MD5 | c7510f2e305f34642a4af5af5a93632c 🔍 |
|---|---|
| SHA1 | 838ca8375866473cea695110d9bcc0463b15bc91 🔍 |
| SHA256 | c20ffe2736459da7341d440e9596b919438c4ef6c7d23904c36489ff3e6487d0 🔍 |
| SHA3 | 04e4611c999230aff9096ec3d9d610b03ea6dc6128c792a6d17f908ac4d361b4 🔍 |
| VirtualSize | 0x1e5a |
| VirtualAddress | 0x18000 |
| SizeOfRawData | 0x2000 |
| PointerToRawData | 0xe800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 4.70845 |
| MD5 | 80d3e06a58e5bc9a356501947c979783 🔍 |
|---|---|
| SHA1 | d7d0bfa249f553c90850f915c807df305a4bbda2 🔍 |
| SHA256 | 732d74a54f07486e5a4cd46875edc4cdbdff86f7504fba2c00feddd15b038a5c 🔍 |
| SHA3 | 8bb107b14841adc8d843a552ca47d7e041a7ce6af7c0ca68d101835d506a03b6 🔍 |
| VirtualSize | 0x1d1a |
| VirtualAddress | 0x1a000 |
| SizeOfRawData | 0x1e00 |
| PointerToRawData | 0x10800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 4.85031 |
| MD5 | ba03e6225bc21e38bb24daa8fd5e4484 🔍 |
|---|---|
| SHA1 | 8b5f3b778fc6b1e95963560cfc51bc4f35ec34e1 🔍 |
| SHA256 | 2db157dc5aedcd3accb1cc4e2e4bad079892e3d89e770c70ffce9c86a3a22136 🔍 |
| SHA3 | e14d975fc7ea4f5d97e09a88db35f1953daa006a04a425ee917e11dce36d6c4a 🔍 |
| VirtualSize | 0x878 |
| VirtualAddress | 0x1c000 |
| SizeOfRawData | 0xa00 |
| PointerToRawData | 0x12600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 3.65704 |
| MD5 | dbaa2adf62faa5fbe5d8255c67238d2b 🔍 |
|---|---|
| SHA1 | 162d6844baca5d3627f3e05d1360778c1a5a9d63 🔍 |
| SHA256 | e7ed657f9853e5719e382f90d61a35aac039e82e07e537edccf4df4d12511731 🔍 |
| SHA3 | 454af3aef462c72f06895a75b7959ea6a19924cab9c96c81d314a1e0808e86e5 🔍 |
| VirtualSize | 0x2c3 |
| VirtualAddress | 0x1d000 |
| SizeOfRawData | 0x400 |
| PointerToRawData | 0x13000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 3.99236 |
| MD5 | 12b9bb4d6264fc2339ed112a0c0710a0 🔍 |
|---|---|
| SHA1 | ff27765a0fcd0b5c0da4c01457e00eda2135c327 🔍 |
| SHA256 | b860389265fdcf44b174a8cbb5e1ac9bc55a2ccef87ec8c0eef74a86e25ca6f7 🔍 |
| SHA3 | d0fa7b4e480cb2f3b010c2a2a2d856664c132683e92b8fc18ba7a034dc4f0691 🔍 |
| VirtualSize | 0xf7d |
| VirtualAddress | 0x1e000 |
| SizeOfRawData | 0x1000 |
| PointerToRawData | 0x13400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 4.6424 |
| MD5 | e1ce13afd6aa23d0777b4d83ae5dfe20 🔍 |
|---|---|
| SHA1 | 6f8bf823c98b98e1b58b3229772e921ecce3dd2d 🔍 |
| SHA256 | f2b1f4ccd6c4d75eaf1044dde2be14f875172e2a2c4339d1c9ccaec1a8ffe8d1 🔍 |
| SHA3 | 7b8153c82d784ebb7fe765a5b6fd1346049e87d2d325f272127f1569adea36d0 🔍 |
| VirtualSize | 0x12bc |
| VirtualAddress | 0x1f000 |
| SizeOfRawData | 0x1400 |
| PointerToRawData | 0x14400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 4.90418 |
| MD5 | d6e6f95edd8e42840a232039ac7ae79a 🔍 |
|---|---|
| SHA1 | b5d9b8db977a8c69b2e6842ec9ce21e4c0f53298 🔍 |
| SHA256 | f548070b6b30e24b60688bfc89ae2177aa673b0fdf1216fe7434f7e5dfbc1d43 🔍 |
| SHA3 | 669e83523a987fc7619ebe94fa9951ffd06632682587f21cd0dd6e1f0b01012d 🔍 |
| VirtualSize | 0x1bd |
| VirtualAddress | 0x21000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x15800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 4.33608 |
| KERNEL32.dll |
DeleteCriticalSection
EnterCriticalSection GetLastError GetStartupInfoA InitializeCriticalSection LeaveCriticalSection SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery __C_specific_handler |
|---|---|
| msvcrt.dll |
__getmainargs
__initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _fmode _initterm _ismbblead _onexit abort calloc exit fprintf free fwrite malloc memcpy signal strlen strncmp vfprintf |
| Type |
RT_MANIFEST
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0xe2 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.64232 |
| MD5 | 5a33efae914fee7eb155de000f217eed 🔍 |
| SHA1 | 5e3aaecb498c1d2298ef57595753f08ec79017da 🔍 |
| SHA256 | f859cdb4a2ddb05c99dc39505953e07eb19ff111c27d035071b12f0deb2999d0 🔍 |
| SHA3 | 6da691db6fe3023d50a40627cb90606f8913657287d458dc9604e3be4e4354c2 🔍 |
| StartAddressOfRawData | 0x140009000 |
|---|---|
| EndAddressOfRawData | 0x140009008 |
| AddressOfIndex | 0x14000707c |
| AddressOfCallbacks | 0x140004950 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks |
0x00000001400015A0
0x0000000140001570 |
No comments yet.