Manalyze report for df149fc6402899f9cf7dd54c3b9b24485be97994c76a237eba1db8b516d01e28

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2022-Dec-05 02:03:23
Debug artifacts	x:\Development Released\ViceVersa Pro (5.0.0.0) Released (Build 5004)\x64\Release\ViceVersa.pdb

Plugin Output

Info	Matching compiler(s):	`MASM/TASM - sig1(h)`
Suspicious	PEiD Signature:	`UPolyX V0.1 -> Delikon`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`Contains references to system / monitoring tools: Regedit.exe regedit.exe` `Contains references to security software: rshell.exe` `May have dropper capabilities: CurrentVersion\Run` `Miscellaneous malware strings: cmd.exe virus` Contains domain names: compareandmerge.com cpsc.ucalgary.ca cs.strath.ac.uk cs.wisc.edu example.com google.com http://schemas.microsoft.com http://schemas.microsoft.com/SMI/2005/WindowsSettings http://schemas.microsoft.com/SMI/2016/WindowsSettings http://www.compareandmerge.com http://www.compareandmerge.com/vvpro2.htm http://www.google.com http://www.google.com/search?hl http://www.tgrmn.com http://www.tgrmn.com' http://www.tgrmn.com/web/kb/item14.htm?from http://www.tgrmn.com/web/vvengine/vvengine.htm https://curl.se https://www.tgrmn.com https://www.tgrmn.com/?from https://www.tgrmn.com/web/entry/regerr https://www.tgrmn.com/web/entry/thankyou https://www.tgrmn.com/web/forum/?from https://www.tgrmn.com/web/kb/?from https://www.tgrmn.com/web/kb/item115.htm https://www.tgrmn.com/web/popup/expl.htm#serverlicense incaf.net menuicon.info microsoft.com ntp.cpsc.ucalgary.ca ntp.cs.strath.ac.uk ntp.incaf.net ntp1.cs.wisc.edu ntp2.tuxfamily.net ntp3.cs.wisc.edu schemas.microsoft.com strath.ac.uk tgrmn.com time.nist.gov time.windows.com tuxfamily.net ucalgary.ca windows.com www.compareandmerge.com www.google.com www.tgrmn.com
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32` `Uses constants related to MD5` `Uses constants related to SHA1` `Uses constants related to SHA256` `Uses constants related to SHA512` `Uses constants related to AES` `Uses constants related to Blowfish` `Uses known Diffie-Helman primes` `Microsoft's Cryptography API`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: LoadLibraryW GetProcAddress LoadLibraryA` `Functions which can be used for anti-debugging purposes: CreateToolhelp32Snapshot FindWindowW` `Code injection capabilities (PowerLoader): FindWindowW GetWindowLongW` `Can access the registry: RegCloseKey RegOpenKeyExW RegQueryValueExW RegSetValueExW RegEnumKeyExW RegDeleteKeyW RegCreateKeyExW RegQueryValueW RegEnumValueW RegEnumKeyW RegOpenKeyW RegOpenKeyExA RegQueryValueExA RegDeleteValueW` `Possibly launches other programs: WinExec CreateProcessW ShellExecuteW` `Uses Windows's Native API: ntohl ntohs` `Uses Microsoft's cryptographic API: CryptEnumProvidersA CryptDecrypt CryptCreateHash CryptSetHashParam CryptSignHashW CryptDestroyHash CryptExportKey CryptGetUserKey CryptGetProvParam CryptDestroyKey CryptEnumProvidersW CryptAcquireContextW CryptGenRandom CryptReleaseContext CryptAcquireContextA` `Can create temporary files: CreateFileA CreateFileW GetTempPathW` `Uses functions commonly found in keyloggers: CallNextHookEx GetAsyncKeyState GetForegroundWindow` `Memory manipulation functions often used by packers: VirtualProtect VirtualAlloc` `Has Internet access capabilities: InternetConnectW InternetGetConnectedState InternetQueryDataAvailable InternetCloseHandle InternetGetLastResponseInfoW InternetOpenW InternetSetStatusCallbackW InternetSetFilePointer InternetWriteFile InternetReadFile` `Leverages the raw socket API to access the Internet: WS2_32.dll` `Functions related to the privilege level: OpenProcessToken AdjustTokenPrivileges` `Enumerates local disk drives: GetDriveTypeA GetDriveTypeW GetVolumeInformationW GetLogicalDriveStringsW` `Manipulates other processes: Process32FirstW Process32NextW` `Changes object ACLs: SetSecurityInfo SetNamedSecurityInfoW` `Can take screenshots: GetDCEx FindWindowW GetDC CreateCompatibleDC BitBlt` `Interacts with the certificate store: CertOpenStore CertOpenSystemStoreW CertOpenSystemStoreA`
Info	The PE is digitally signed.	`Signer: TGRMN Software` `Issuer: Sectigo RSA Code Signing CA`
Safe	VirusTotal score: 0/71 (Scanned on 2026-05-26 22:43:14)	`All the AVs think this file is safe.`

Hashes

MD5	`3a36584ab1dd176f1d0006bf3384b69d` 🔍
SHA1	`0a0ae6fc36e2b321a35f8aa31cc7bacbbab3713c` 🔍
SHA256	`df149fc6402899f9cf7dd54c3b9b24485be97994c76a237eba1db8b516d01e28` 🔍
SHA3	`ba49d913f83daa8f5de0994c8bde71d250c3553249e3532295427ac84867ddd1` 🔍
SSDeep	`196608:LJEXoFl3EoqagON1ojpCM7upqTk3YPObB1PQ7BiQXO/tTQaV1mGUeE:LyDoqag5pO/1bnmGi` 🔍
Imports Hash	`dd4d145798324175087719b7645280ab` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xf8`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`5`
TimeDateStamp	2022-Dec-05 02:03:23
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE` `IMAGE_FILE_RELOCS_STRIPPED`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`8.0`
SizeOfCode	`0x77b800`
SizeOfInitializedData	`0x87e600`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00000000006AFE30 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`5.2`
Win32VersionValue	`0`
SizeOfImage	`0xffe000`
SizeOfHeaders	`0x400`
Checksum	`0xfcb6ec`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`c0a0dc30ad1490d1e72d12a0c88cb329 🔍`
SHA1	`426070d89df2d0d12ee8dc8d3cf0504f845fe859 🔍`
SHA256	`b0ed50498d5b31e40e7a8c8626ed4ed0fc81d2608d80384ad6fbb5cbb195cf7a 🔍`
SHA3	`e86012d767a831755018ce3084dc7be852e222ab13880336faf7ab1fac284aa2 🔍`
VirtualSize	`0x77b78e`
VirtualAddress	`0x1000`
SizeOfRawData	`0x77b800`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.31639`

.rdata

MD5	`8d48db1e644023b39d15caa5c045d9b1 🔍`
SHA1	`cd0f6dcbc49cf0f4eac0a831744f862ce81b8338 🔍`
SHA256	`0eab0bdd5f13ca5a7c9b052783412787639b185d88ca5f0aa091cb5c227b6224 🔍`
SHA3	`851fdad09c0ca3df42e95cd8a3ace6700714f310d010adbec26bf28957cd6371 🔍`
VirtualSize	`0x255030`
VirtualAddress	`0x77d000`
SizeOfRawData	`0x255200`
PointerToRawData	`0x77bc00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.07294`

.data

MD5	`e7c9b86bf54de36d419a0d46655c2c36 🔍`
SHA1	`9db33337bf72fbef76b0b564f4b5efcc20346c96 🔍`
SHA256	`e2fb7e98175edaf1e7175b158a385db2a16117c3d5ca66b38e8d1659c972a242 🔍`
SHA3	`c934e9cef2e29263d60331d4bfeee6a827c919c18ae084a7dc0edc3feb435a65 🔍`
VirtualSize	`0x4b3f0`
VirtualAddress	`0x9d3000`
SizeOfRawData	`0x1a400`
PointerToRawData	`0x9d0e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.84229`

.pdata

MD5	`ec477bd1d38acda15fa624fc1a663b6f 🔍`
SHA1	`401c41f62db5349366a294832702c6b7328fa9ee 🔍`
SHA256	`a86ae6c5fcc1eddca79def818d0feaa7e99ed1b05f87ffebf2f97b9a5a0075af 🔍`
SHA3	`d640a9d6e8bf8aebf82da6f8e6d5d1a7e74622bd0741bf3db7f4b7361beefcdf 🔍`
VirtualSize	`0x7c92c`
VirtualAddress	`0xa1f000`
SizeOfRawData	`0x7ca00`
PointerToRawData	`0x9eb200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.20977`

.rsrc

MD5	`d9201bd192b0dd7c5be8a80bf97c4e9d 🔍`
SHA1	`6a6a72acc55c7a4de86d77855f68fc5e328bbf64 🔍`
SHA256	`1c23dea57b5ca5cacb774040bd62bc457c2e61aab7ba620678f5141fae7f2a75 🔍`
SHA3	`4cdb328a09ad5d8ac6a0d61e264cf843f3d22d82c7e11b31530af410a5e3eb97 🔍`
VirtualSize	`0x561458`
VirtualAddress	`0xa9c000`
SizeOfRawData	`0x561600`
PointerToRawData	`0xa67c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.06499`

Imports

MPR.dll	`WNetGetLastErrorW` `WNetAddConnection2W` `WNetGetUniversalNameW` `WNetCancelConnection2W`
KERNEL32.dll	`GetEnvironmentStringsW` `GetCommandLineA` `SetHandleCount` `GetStartupInfoA` `FlsGetValue` `FlsSetValue` `FlsFree` `FlsAlloc` `HeapSetInformation` `HeapCreate` `RtlVirtualUnwind` `GetOEMCP` `IsValidCodePage` `LCMapStringA` `LCMapStringW` `GetStringTypeA` `GetStringTypeW` `GetConsoleCP` `GetFullPathNameA` `GetCurrentDirectoryA` `GetLocaleInfoA` `EnumSystemLocalesA` `IsValidLocale` `SetEnvironmentVariableA` `WriteConsoleA` `GetConsoleOutputCP` `SizeofResource` `LockResource` `FreeEnvironmentStringsW` `DeleteFileA` `FormatMessageA` `TryEnterCriticalSection` `GetExitCodeThread` `GetComputerNameA` `GetEnvironmentStrings` `FreeEnvironmentStringsA` `GetModuleFileNameA` `HeapSize` `RtlUnwindEx` `RtlLookupFunctionEntry` `SetConsoleCtrlHandler` `GetFileAttributesA` `FindFirstFileA` `GetDriveTypeA` `CreateFileA` `ExitThread` `RtlPcToFileHeader` `GetTimeFormatA` `GetDateFormatA` `HeapReAlloc` `ExitProcess` `SetStdHandle` `RtlCaptureContext` `IsDebuggerPresent` `UnhandledExceptionFilter` `GetStartupInfoW` `LoadResource` `FindResourceW` `MultiByteToWideChar` `CloseHandle` `CreateFileW` `GetFileSize` `GetLastError` `FindFirstFileW` `FileTimeToSystemTime` `FileTimeToLocalFileTime` `GetTempPathW` `FindNextFileW` `FindClose` `lstrcpyW` `EnterCriticalSection` `LeaveCriticalSection` `ResetEvent` `GetCurrentThreadId` `GetTickCount` `WideCharToMultiByte` `Sleep` `GetModuleFileNameW` `GlobalAlloc` `GlobalLock` `SetLastError` `LoadLibraryW` `GetModuleHandleW` `GetProcAddress` `SetEvent` `InitializeCriticalSection` `DeleteCriticalSection` `FreeLibrary` `GetFileAttributesW` `CreateMutexW` `WaitForSingleObject` `ReleaseMutex` `FreeResource` `GlobalUnlock` `GetDriveTypeW` `GetTempFileNameW` `TerminateProcess` `GetExitCodeProcess` `GetWindowsDirectoryW` `GetVolumeInformationW` `lstrlenW` `SetErrorMode` `WritePrivateProfileStringW` `GetPrivateProfileIntW` `GlobalFlags` `LocalReAlloc` `GlobalHandle` `GlobalGetAtomNameW` `VirtualProtect` `LocalFileTimeToFileTime` `ConvertDefaultLocale` `EnumResourceLanguagesW` `CompareStringA` `ReleaseSemaphore` `CreateSemaphoreW` `UnlockFile` `LockFile` `GetThreadLocale` `GetStringTypeExW` `GetProfileIntW` `CreateEventW` `SuspendThread` `ResumeThread` `lstrcmpA` `CopyFileW` `GlobalAddAtomW` `GlobalFindAtomW` `GlobalDeleteAtom` `CompareStringW` `lstrcmpW` `VirtualFree` `VirtualAlloc` `GetFileInformationByHandle` `GetVolumePathNameW` `GetVolumeNameForVolumeMountPointW` `ConvertThreadToFiber` `ConvertFiberToThread` `CreateFiber` `SwitchToFiber` `DeleteFiber` `GetModuleHandleExW` `TlsFree` `TlsSetValue` `TlsGetValue` `TlsAlloc` `InitializeCriticalSectionAndSpinCount` `ReadConsoleW` `ReadConsoleA` `SetConsoleMode` `GetConsoleMode` `MoveFileExA` `GetFileType` `PeekNamedPipe` `GetEnvironmentVariableA` `GetSystemTimeAsFileTime` `CompareFileTime` `GetVersionExA` `SleepEx` `GetModuleHandleA` `LoadLibraryA` `GetSystemDirectoryA` `Process32FirstW` `CreateToolhelp32Snapshot` `Process32NextW` `GetSystemPowerStatus` `GetFileAttributesExW` `GlobalSize` `GlobalReAlloc` `GetACP` `GetUserDefaultLCID` `FlushViewOfFile` `HeapAlloc` `GetProcessHeap` `HeapFree` `UnmapViewOfFile` `MapViewOfFile` `CreateFileMappingW` `WinExec` `Beep` `SetUnhandledExceptionFilter` `VirtualQuery` `SetEnvironmentVariableW` `DuplicateHandle` `DeviceIoControl` `SetEndOfFile` `FlushFileBuffers` `BackupWrite` `BackupSeek` `BackupRead` `MoveFileW` `GetFileTime` `GetPrivateProfileStringW` `LocalUnlock` `LocalLock` `SetSystemTime` `GetCPInfo` `lstrlenA` `OpenThread` `MulDiv` `RaiseException` `GetFullPathNameW` `QueryPerformanceCounter` `QueryPerformanceFrequency` `SetThreadPriority` `GetCurrentThread` `RemoveDirectoryW` `LocalAlloc` `GetCurrentProcess` `GetSystemInfo` `GetVersion` `GetLocalTime` `ReadFile` `GetCurrentProcessId` `ReadConsoleInputW` `FlushConsoleInputBuffer` `WriteConsoleInputW` `WriteConsoleW` `SetConsoleScreenBufferSize` `GetStdHandle` `GetConsoleScreenBufferInfo` `AllocConsole` `FreeConsole` `GetVersionExW` `GetEnvironmentVariableW` `GetComputerNameW` `DeleteFileW` `SetThreadExecutionState` `GetCommandLineW` `FindFirstFileExW` `SetFilePointer` `WaitForMultipleObjects` `CreateThread` `WriteFile` `GlobalFree` `GetCurrentDirectoryW` `GetLocaleInfoW` `lstrcmpiW` `GetTimeZoneInformation` `GetSystemTime` `SystemTimeToFileTime` `TzSpecificLocalTimeToSystemTime` `SystemTimeToTzSpecificLocalTime` `LocalFree` `FormatMessageW` `SetFileAttributesW` `SetFileTime` `CreateDirectoryW` `lstrcpynW` `CreateProcessW` `lstrcatW` `GetDiskFreeSpaceW` `GetDiskFreeSpaceExW` `GetLogicalDriveStringsW` `GetTimeFormatW` `GetDateFormatW` `GetNumberFormatW`
USER32.dll	`SendDlgItemMessageA` `SendDlgItemMessageW` `SetWindowsHookExW` `CallNextHookEx` `GetClassLongPtrW` `SetPropW` `GetPropW` `RemovePropW` `GetTopWindow` `UnhookWindowsHookEx` `GetMessageTime` `SetScrollRange` `GetScrollRange` `GetScrollPos` `GetClassInfoExW` `GetScrollInfo` `SystemParametersInfoA` `GetWindowPlacement` `GetProcessWindowStation` `InvertRect` `IsClipboardFormatAvailable` `CreateWindowExW` `ScrollWindow` `ShowScrollBar` `SetScrollPos` `SetScrollInfo` `CharNextW` `AdjustWindowRectEx` `MoveWindow` `CheckDlgButton` `BeginPaint` `MessageBoxW` `GetLastActivePopup` `DestroyWindow` `GetDlgItem` `GetDialogBaseUnits` `DialogBoxIndirectParamW` `WinHelpW` `EndDialog` `SetWindowTextW` `EndPaint` `MessageBeep` `SetMenuDefaultItem` `SetWindowPos` `EnableWindow` `GetDesktopWindow` `SendMessageW` `UnregisterClassA` `ClientToScreen` `IsWindow` `EnableMenuItem` `RegisterWindowMessageW` `GetMenuItemID` `GetDCEx` `RegisterClassW` `DeleteMenu` `ModifyMenuW` `InsertMenuW` `GetMenuState` `CallWindowProcW` `GetKeyboardState` `CreateIconIndirect` `FindWindowW` `ChildWindowFromPointEx` `SystemParametersInfoW` `IsChild` `CloseClipboard` `SetClipboardData` `EmptyClipboard` `OpenClipboard` `LoadMenuW` `GetNextDlgGroupItem` `wvsprintfW` `GetDoubleClickTime` `UnregisterClassW` `GetKeyState` `SetWindowRgn` `ClipCursor` `GetClipCursor` `UnionRect` `GetWindowLongPtrW` `GetComboBoxInfo` `GetSysColorBrush` `FindWindowExW` `ScreenToClient` `GetMessagePos` `DrawEdge` `DrawFrameControl` `GetCapture` `GetIconInfo` `DestroyCursor` `DrawStateW` `GrayStringW` `ReleaseCapture` `DrawTextW` `WindowFromPoint` `SetCapture` `TabbedTextOutW` `SetCursor` `DrawFocusRect` `GetWindowDC` `MapWindowPoints` `GetMenuItemInfoW` `GetMenuBarInfo` `GetDlgCtrlID` `EnumChildWindows` `DrawMenuBar` `GetMessageW` `SetWindowPlacement` `SetRect` `MonitorFromWindow` `GetMonitorInfoW` `MonitorFromRect` `LoadStringW` `FillRect` `DestroyMenu` `TrackPopupMenu` `CreatePopupMenu` `GetCursorPos` `RemoveMenu` `DispatchMessageW` `LoadBitmapW` `GetSystemMenu` `EqualRect` `TranslateMessage` `EndDeferWindowPos` `IsDialogMessageW` `GetNextDlgTabItem` `CreateDialogIndirectParamW` `SetMenuItemBitmaps` `GetMenuStringW` `ValidateRect` `CharUpperW` `ShowOwnedPopups` `SetWindowContextHelpId` `DeferWindowPos` `GetWindowTextW` `GetWindowTextLengthW` `GetWindowThreadProcessId` `BringWindowToTop` `InsertMenuItemW` `ReuseDDElParam` `UnpackDDElParam` `CopyAcceleratorTableW` `GetAsyncKeyState` `InvalidateRgn` `GetWindowRect` `RedrawWindow` `GetFocus` `InvalidateRect` `UpdateWindow` `PostMessageW` `SetTimer` `KillTimer` `GetClassNameW` `GetParent` `EnumThreadWindows` `IsWindowVisible` `IntersectRect` `DestroyAcceleratorTable` `SubtractRect` `GetMenuCheckMarkDimensions` `TranslateAcceleratorW` `IsRectEmpty` `CopyRect` `OffsetRect` `LockWindowUpdate` `IsMenu` `LoadAcceleratorsW` `SetWindowLongPtrW` `LoadIconW` `GetWindowLongW` `SetLayeredWindowAttributes` `GetUserObjectInformationW` `SetRectEmpty` `GetWindow` `SetParent` `DrawIconEx` `GetSubMenu` `LoadImageW` `GetActiveWindow` `SetForegroundWindow` `FrameRect` `SetActiveWindow` `GetDC` `PostQuitMessage` `SetWindowLongW` `ReleaseDC` `GetClientRect` `BeginDeferWindowPos` `MapDialogRect` `IsZoomed` `SetClassLongPtrW` `SetFocus` `DrawIcon` `GetForegroundWindow` `GetMenuItemCount` `RegisterClipboardFormatW` `GetSystemMetrics` `DestroyIcon` `LoadCursorW` `DefWindowProcW` `GetClassInfoW` `SendMessageTimeoutW` `PostThreadMessageW` `ShowWindow` `PeekMessageW` `InflateRect` `IsWindowEnabled` `AppendMenuW` `PtInRect` `DrawTextExW` `GetSysColor` `SetMenu` `CheckMenuItem` `WindowFromDC` `CreateMenu` `GetMenu` `IsIconic`
GDI32.dll	`SetViewportExtEx` `ScaleViewportExtEx` `SetWindowOrgEx` `OffsetWindowOrgEx` `SetWindowExtEx` `ScaleWindowExtEx` `GetCurrentPositionEx` `PolyBezierTo` `ExtSelectClipRgn` `OffsetViewportOrgEx` `SelectPalette` `CopyMetaFileW` `GetCharWidthW` `CreateEllipticRgn` `SetRectRgn` `GetRgnBox` `SetViewportOrgEx` `GetWindowExtEx` `GetViewportExtEx` `IntersectClipRect` `ExcludeClipRect` `SetMapMode` `SetStretchBltMode` `SetROP2` `RestoreDC` `SaveDC` `GetClipBox` `SetTextJustification` `SetTextAlign` `GetTextExtentPointW` `DPtoLP` `LPtoDP` `PathToRegion` `StrokeAndFillPath` `EndPath` `BeginPath` `GetBkColor` `GetPixel` `GetBkMode` `PatBlt` `Ellipse` `GetTextExtentExPointW` `LineTo` `MoveToEx` `GetObjectW` `CreateFontIndirectW` `DeleteObject` `CreatePen` `GetTextExtentPoint32W` `CreateSolidBrush` `Rectangle` `GetStockObject` `SetBkColor` `ExtTextOutW` `CreateCompatibleDC` `CreateCompatibleBitmap` `GetDeviceCaps` `BitBlt` `GetViewportOrgEx` `CreateBrushIndirect` `GetCurrentObject` `GetDIBits` `CreateRectRgnIndirect` `RoundRect` `CreateRoundRectRgn` `SetPixel` `Escape` `PtVisible` `RectVisible` `TextOutW` `SelectObject` `DeleteDC` `CreateDIBSection` `GetTextMetricsW` `SelectClipRgn` `Polygon` `SetBkMode` `SetTextColor` `CreatePolygonRgn` `CreateRectRgn` `CombineRgn` `RealizePalette` `GetDIBColorTable` `CreatePalette` `CreateHalftonePalette` `EnumFontFamiliesExW` `StretchDIBits` `SetDIBitsToDevice` `GetTextColor` `OffsetRgn` `FillRgn` `FrameRgn` `CreateFontW` `CreateDCW` `StretchBlt` `SetDIBits` `CreateBitmap` `GetMapMode` `CreatePatternBrush`
comdlg32.dll	`GetFileTitleW` `CommDlgExtendedError`
WINSPOOL.DRV	`OpenPrinterW` `DocumentPropertiesW` `ClosePrinter`
ADVAPI32.dll	`CryptEnumProvidersA` `RegCloseKey` `RegOpenKeyExW` `RegQueryValueExW` `RegSetValueExW` `RegEnumKeyExW` `RegDeleteKeyW` `RegCreateKeyExW` `RegQueryValueW` `RegEnumValueW` `GetUserNameW` `OpenProcessToken` `GetTokenInformation` `GetSidSubAuthority` `GetSidSubAuthorityCount` `RegEnumKeyW` `LookupPrivilegeValueW` `AdjustTokenPrivileges` `GetSecurityInfo` `GetSecurityDescriptorControl` `SetSecurityInfo` `OpenThreadToken` `EncryptFileW` `RegOpenKeyW` `RegOpenKeyExA` `RegQueryValueExA` `CryptDecrypt` `CryptCreateHash` `CryptSetHashParam` `CryptSignHashW` `CryptDestroyHash` `CryptExportKey` `CryptGetUserKey` `CryptGetProvParam` `CryptDestroyKey` `CryptEnumProvidersW` `RegisterEventSourceW` `ReportEventW` `DeregisterEventSource` `CryptAcquireContextW` `CryptGenRandom` `CryptReleaseContext` `CryptAcquireContextA` `FreeSid` `SetSecurityDescriptorDacl` `InitializeSecurityDescriptor` `LookupPrivilegeDisplayNameW` `LookupPrivilegeNameW` `SetNamedSecurityInfoW` `InitializeAcl` `ConvertSecurityDescriptorToStringSecurityDescriptorW` `SetSecurityDescriptorControl` `GetNamedSecurityInfoW` `DeleteAce` `GetAce` `GetAclInformation` `RegDeleteValueW`
SHELL32.dll	`Shell_NotifyIconW` `ShellExecuteExW` `SHAppBarMessage` `SHGetFileInfoW` `SHBrowseForFolderW` `SHGetPathFromIDListW` `SHGetMalloc` `DragFinish` `SHFileOperationW` `ShellExecuteW` `SHGetSpecialFolderLocation` `DragQueryFileW`
COMCTL32.dll	`_TrackMouseEvent` `ImageList_GetIconSize`
SHLWAPI.dll	`PathFindExtensionW` `PathStripToRootW` `PathIsUNCW` `PathFindFileNameW`
oledlg.dll	`OleUIBusyW`
ole32.dll	`CoInitialize` `CoInitializeSecurity` `CoCreateInstance` `CreateStreamOnHGlobal` `CreateILockBytesOnHGlobal` `StgCreateDocfileOnILockBytes` `CoTaskMemFree` `ReleaseStgMedium` `CoTaskMemAlloc` `OleDuplicateData` `OleSetClipboard` `OleIsCurrentClipboard` `DoDragDrop` `RegisterDragDrop` `CoLockObjectExternal` `RevokeDragDrop` `OleGetClipboard` `OleUninitialize` `CoFreeUnusedLibraries` `OleInitialize` `CLSIDFromProgID` `CLSIDFromString` `CoUninitialize` `CoGetClassObject` `StgOpenStorageOnILockBytes` `CoRevokeClassObject` `CoRegisterMessageFilter` `OleFlushClipboard`
OLEAUT32.dll	`VarDateFromStr` `SysAllocStringLen` `VariantClear` `SysAllocString` `SysStringLen` `VarUdateFromDate` `VariantChangeType` `VariantInit` `SafeArrayUnaccessData` `SafeArrayAccessData` `SafeArrayGetUBound` `SafeArrayGetLBound` `SafeArrayGetElemsize` `SafeArrayGetDim` `SafeArrayCreate` `VariantCopy` `SysFreeString` `SafeArrayDestroy` `OleCreateFontIndirect` `SystemTimeToVariantTime` `VarBstrFromDate` `VariantTimeToSystemTime`
WS2_32.dll	`WSAEnumNetworkEvents` `WSAEventSelect` `WSACloseEvent` `WSAIoctl` `getpeername` `WSASetLastError` `getservbyname` `getservbyport` `__WSAFDIsSet` `freeaddrinfo` `getnameinfo` `getaddrinfo` `WSAResetEvent` `WSACreateEvent` `shutdown` `gethostname` `ioctlsocket` `gethostbyaddr` `setsockopt` `ntohl` `recvfrom` `sendto` `inet_ntoa` `accept` `WSAGetLastError` `listen` `getsockopt` `bind` `getsockname` `ntohs` `WSACleanup` `WSAStartup` `select` `closesocket` `recv` `send` `connect` `gethostbyname` `inet_addr` `htons` `socket` `htonl` `WSAWaitForMultipleEvents`
PSAPI.DLL	`GetProcessMemoryInfo`
VERSION.dll	`VerQueryValueW` `GetFileVersionInfoSizeW` `GetFileVersionInfoW`
CRYPT32.dll	`CertFreeCertificateContext` `CertCloseStore` `CertOpenStore` `CertEnumCertificatesInStore` `CertFindCertificateInStore` `CertVerifyTimeValidity` `CertGetNameStringW` `CertDuplicateCertificateContext` `CertGetIntendedKeyUsage` `CertOpenSystemStoreW` `CertFindChainInStore` `CertGetCertificateChain` `CertVerifyCertificateChainPolicy` `CertOpenSystemStoreA` `CertGetCertificateContextProperty` `CertGetEnhancedKeyUsage`
iphlpapi.dll	`GetAdaptersInfo`
WININET.dll	`HttpOpenRequestW` `InternetConnectW` `InternetGetConnectedState` `InternetQueryDataAvailable` `HttpQueryInfoW` `InternetCloseHandle` `InternetGetLastResponseInfoW` `InternetOpenW` `InternetSetStatusCallbackW` `InternetSetFilePointer` `InternetWriteFile` `InternetReadFile` `HttpSendRequestW`
OLEACC.dll (delay-loaded)	`AccessibleObjectFromWindow` `LresultFromObject` `CreateStdAccessibleObject`

Delayed Imports

Attributes	`0x1`
Name	`OLEACC.dll`
ModuleHandle	`0x9f5bb8`
DelayImportAddressTable	`0x9ed228`
DelayImportNameTable	`0x9ccfa0`
BoundDelayImportTable	`0x9cd010`
UnloadDelayImportTable	`0`
TimeStamp	`1970-Jan-01 00:00:00`

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2022-Dec-05 02:03:23
Version	`0.0`
SizeofData	`120`
AddressOfRawData	`0x8dcb58`
PointerToRawData	`0x8db758`
Referenced File	x:\Development Released\ViceVersa Pro (5.0.0.0) Released (Build 5004)\x64\Release\ViceVersa.pdb

TLS Callbacks

Load Configuration

RICH Header

XOR Key	`0x14e94c51`
Unmarked objects	`0`
C objects (40310)	`15`
126 (50327)	`122`
Imports (40310)	`39`
Total imports	`953`
C++ objects (40310)	`2`
C++ objects (VS2012 build 50727 / VS2005 build 50727)	`275`
C objects (VS2012 build 50727 / VS2005 build 50727)	`980`
ASM objects (VS2012 build 50727 / VS2005 build 50727)	`17`
114 (VS2012 build 50727 / VS2005 build 50727)	`416`
Resource objects (VS2012 build 50727 / VS2005 build 50727)	`1`
Linker (VS2012 build 50727 / VS2005 build 50727)	`1`

Errors

[!] Error: The PE's resource section exceeds the parsing limits. Resources will not be parsed.

Leave a comment

No comments yet.