| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Jul-13 08:14:12 |
| Detected languages |
Dutch - Belgium
English - United States |
| FileVersion | 26.1.0.0 |
| ProductVersion | 26.1.0.0 |
| LegalCopyright | Copyright © G.D.G. Software 2012-2026. All rights reserved. |
| LegalTrademarks | XLS Padlock, https://www.xlspadlock.com |
| InternalName | XLS Padlock |
| Comments | http://www.xlspadlock.com |
| FileDescription | XLS Padlock Manager |
| OriginalFilename | XLSPadlockManager.exe |
| ProductName | XLS Padlock |
| CompanyName | G.D.G. Software |
| ProgramID | com.embarcadero.XLSPadLockReg |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Suspicious | The PE is possibly packed. |
Unusual section name found: .pexe
Section .data is both writable and executable. The PE only has 4 import(s). |
| Info | The PE contains common functions which appear in legitimate applications. |
Can access the registry:
|
| Info | The PE's resources present abnormal characteristics. |
Resource 150 is possibly compressed or encrypted.
Resource 151 is possibly compressed or encrypted. Resource 152 is possibly compressed or encrypted. Resource 160 is possibly compressed or encrypted. Resource 161 is possibly compressed or encrypted. Resource 162 is possibly compressed or encrypted. Resource 163 is possibly compressed or encrypted. Resource 164 is possibly compressed or encrypted. Resource CASE is possibly compressed or encrypted. Resource CATEGORIES is possibly compressed or encrypted. Resource COMBINING is possibly compressed or encrypted. Resource COMPOSITION is possibly compressed or encrypted. Resource DECOMPOSITION is possibly compressed or encrypted. Resource NUMBERS is possibly compressed or encrypted. Resource 1 is possibly compressed or encrypted. Resource 2 is possibly compressed or encrypted. Resource 3 is possibly compressed or encrypted. Resource 4 is possibly compressed or encrypted. Resource 5 is possibly compressed or encrypted. Resource 6 is possibly compressed or encrypted. Resource 7 is possibly compressed or encrypted. Resource 8 is possibly compressed or encrypted. Resource 9 is possibly compressed or encrypted. Resource CLOSEDFOLDER is possibly compressed or encrypted. Resource CURRENTFOLDER is possibly compressed or encrypted. Resource EXECUTABLE is possibly compressed or encrypted. Resource KNOWNFILE is possibly compressed or encrypted. Resource OPENFOLDER is possibly compressed or encrypted. Resource PREVIEWGLYPH is possibly compressed or encrypted. Resource TADVINPUTTASKDIALOG is possibly compressed or encrypted. Resource TADVTASKDIALOG is possibly compressed or encrypted. Resource TD_ARW is possibly compressed or encrypted. Resource TD_ARWDIS is possibly compressed or encrypted. Resource TD_ARWDOWN is possibly compressed or encrypted. Resource TD_ARWHOT is possibly compressed or encrypted. Resource TD_COLP is possibly compressed or encrypted. Resource TD_COLPDOWN is possibly compressed or encrypted. Resource TD_COLPHOT is possibly compressed or encrypted. Resource TD_EXP is possibly compressed or encrypted. Resource TD_EXPDOWN is possibly compressed or encrypted. Resource TD_EXPHOT is possibly compressed or encrypted. Resource TD_SHIELD is possibly compressed or encrypted. Resource UNKNOWNFILE is possibly compressed or encrypted. Resource 4036 is possibly compressed or encrypted. Resource 4037 is possibly compressed or encrypted. Resource 4038 is possibly compressed or encrypted. Resource 4039 is possibly compressed or encrypted. Resource 4040 is possibly compressed or encrypted. Resource 4041 is possibly compressed or encrypted. Resource 4042 is possibly compressed or encrypted. Resource 4043 is possibly compressed or encrypted. Resource 4044 is possibly compressed or encrypted. Resource 4045 is possibly compressed or encrypted. Resource 4046 is possibly compressed or encrypted. Resource 4047 is possibly compressed or encrypted. Resource 4048 is possibly compressed or encrypted. Resource 4049 is possibly compressed or encrypted. Resource 4050 is possibly compressed or encrypted. Resource 4051 is possibly compressed or encrypted. Resource 4052 is possibly compressed or encrypted. Resource 4053 is possibly compressed or encrypted. Resource 4054 is possibly compressed or encrypted. Resource 4055 is possibly compressed or encrypted. Resource 4056 is possibly compressed or encrypted. Resource 4057 is possibly compressed or encrypted. Resource 4058 is possibly compressed or encrypted. Resource 4059 is possibly compressed or encrypted. Resource 4060 is possibly compressed or encrypted. Resource 4061 is possibly compressed or encrypted. Resource 4062 is possibly compressed or encrypted. Resource 4063 is possibly compressed or encrypted. Resource 4064 is possibly compressed or encrypted. Resource 4065 is possibly compressed or encrypted. Resource 4066 is possibly compressed or encrypted. Resource 4067 is possibly compressed or encrypted. Resource 4068 is possibly compressed or encrypted. Resource 4069 is possibly compressed or encrypted. Resource 4070 is possibly compressed or encrypted. Resource 4071 is possibly compressed or encrypted. Resource 4072 is possibly compressed or encrypted. Resource 4073 is possibly compressed or encrypted. Resource 4074 is possibly compressed or encrypted. Resource 4075 is possibly compressed or encrypted. Resource 4076 is possibly compressed or encrypted. Resource 4077 is possibly compressed or encrypted. Resource 4078 is possibly compressed or encrypted. Resource 4079 is possibly compressed or encrypted. Resource 4080 is possibly compressed or encrypted. Resource 4081 is possibly compressed or encrypted. Resource 4082 is possibly compressed or encrypted. Resource 4083 is possibly compressed or encrypted. Resource 4084 is possibly compressed or encrypted. Resource 4085 is possibly compressed or encrypted. Resource 4086 is possibly compressed or encrypted. Resource 4087 is possibly compressed or encrypted. Resource 4088 is possibly compressed or encrypted. Resource 4089 is possibly compressed or encrypted. Resource 4092 is possibly compressed or encrypted. Resource 4093 is possibly compressed or encrypted. Resource 4094 is possibly compressed or encrypted. Resource 4095 is possibly compressed or encrypted. Resource 4096 is possibly compressed or encrypted. Resource ADVGRAPHICSCLOSE is possibly compressed or encrypted. Resource ADVGRAPHICSCLOSELARGE is possibly compressed or encrypted. Resource ADVGRAPHICSCLOSESVG is possibly compressed or encrypted. Resource ADVGRAPHICSDOWN2 is possibly compressed or encrypted. Resource ADVGRAPHICSDOWN2LARGE is possibly compressed or encrypted. Resource ADVGRAPHICSDOWNLARGE is possibly compressed or encrypted. Resource ADVGRAPHICSDOWNSVG is possibly compressed or encrypted. Resource ADVGRAPHICSEXPANDLARGE is possibly compressed or encrypted. Resource ADVGRAPHICSEXPANDSVG is possibly compressed or encrypted. Resource ADVGRAPHICSLEFTLARGE is possibly compressed or encrypted. Resource ADVGRAPHICSLEFTSVG is possibly compressed or encrypted. Resource ADVGRAPHICSPIN is possibly compressed or encrypted. Resource ADVGRAPHICSPIN2 is possibly compressed or encrypted. Resource ADVGRAPHICSPIN2LARGE is possibly compressed or encrypted. Resource ADVGRAPHICSPINLARGE is possibly compressed or encrypted. Resource ADVGRAPHICSRIGHTLARGE is possibly compressed or encrypted. Resource ADVGRAPHICSRIGHTSVG is possibly compressed or encrypted. Resource ADVGRAPHICSUP2 is possibly compressed or encrypted. Resource ADVGRAPHICSUP2LARGE is possibly compressed or encrypted. Resource ADVGRAPHICSUPLARGE is possibly compressed or encrypted. Resource ADVGRAPHICSUPSVG is possibly compressed or encrypted. Resource BBABORT is possibly compressed or encrypted. Resource BBABORT_DISABLED is possibly compressed or encrypted. Resource BBALL is possibly compressed or encrypted. Resource BBALL_DISABLED is possibly compressed or encrypted. Resource BBCANCEL is possibly compressed or encrypted. Resource BBCANCEL_DISABLED is possibly compressed or encrypted. Resource BBCLOSE is possibly compressed or encrypted. Resource BBCLOSE_DISABLED is possibly compressed or encrypted. Resource BBHELP is possibly compressed or encrypted. Resource BBHELP_DISABLED is possibly compressed or encrypted. Resource BBIGNORE is possibly compressed or encrypted. Resource BBIGNORE_DISABLED is possibly compressed or encrypted. Resource BBNO is possibly compressed or encrypted. Resource BBNO_DISABLED is possibly compressed or encrypted. Resource BBOK is possibly compressed or encrypted. Resource BBOK_DISABLED is possibly compressed or encrypted. Resource BBRETRY is possibly compressed or encrypted. Resource BBRETRY_DISABLED is possibly compressed or encrypted. Resource BBYES is possibly compressed or encrypted. Resource BBYES_DISABLED is possibly compressed or encrypted. Resource LOCALE_AR_DEFAULT is possibly compressed or encrypted. Resource LOCALE_DE_DEFAULT is possibly compressed or encrypted. Resource LOCALE_EN_DEFAULT is possibly compressed or encrypted. Resource LOCALE_ES_DEFAULT is possibly compressed or encrypted. Resource LOCALE_FR_DEFAULT is possibly compressed or encrypted. Resource LOCALE_IT_DEFAULT is possibly compressed or encrypted. Resource LOCALE_NL_DEFAULT is possibly compressed or encrypted. Resource LOCALE_PT_DEFAULT is possibly compressed or encrypted. Resource LOCALE_ZH_CN_DEFAULT is possibly compressed or encrypted. Resource LOCALE_ZH_TW_DEFAULT is possibly compressed or encrypted. Resource MSG_ERROR is possibly compressed or encrypted. Resource MSG_INFO is possibly compressed or encrypted. Resource MSG_WARNING is possibly compressed or encrypted. Resource STUB_LOCALE_AR_DEFAULT is possibly compressed or encrypted. Resource STUB_LOCALE_DE_DEFAULT is possibly compressed or encrypted. Resource STUB_LOCALE_EN_DEFAULT is possibly compressed or encrypted. Resource STUB_LOCALE_ES_DEFAULT is possibly compressed or encrypted. Resource STUB_LOCALE_FR_DEFAULT is possibly compressed or encrypted. Resource STUB_LOCALE_IT_DEFAULT is possibly compressed or encrypted. Resource STUB_LOCALE_NL_DEFAULT is possibly compressed or encrypted. Resource STUB_LOCALE_PT_DEFAULT is possibly compressed or encrypted. Resource STUB_LOCALE_ZH_CN_DEFAULT is possibly compressed or encrypted. Resource STUB_LOCALE_ZH_TW_DEFAULT is possibly compressed or encrypted. Resource TFLICENT is possibly compressed or encrypted. Resource TLANGUAGESELECTIONFORM is possibly compressed or encrypted. Resource TMS_GL_ACCEPT is possibly compressed or encrypted. Resource TMS_GL_CHECK is possibly compressed or encrypted. Resource TMS_GL_CLOSE is possibly compressed or encrypted. Resource TMS_GL_DENY is possibly compressed or encrypted. Resource TMS_GL_EDIT is possibly compressed or encrypted. Resource TMS_GL_NEXT is possibly compressed or encrypted. Resource TMS_GL_PREV is possibly compressed or encrypted. Resource TMS_GL_SEARCH is possibly compressed or encrypted. Resource TMS_GL_UNDO is possibly compressed or encrypted. Resource 30352 is possibly compressed or encrypted. The binary may have been compiled on a machine in the UTC+2 timezone. |
| Info | The PE is digitally signed. |
Signer: G.D.G. Software
Issuer: Sectigo Public Code Signing CA EV R36 |
| Suspicious | VirusTotal score: 1/69 (Scanned on 2026-08-05 02:15:57) | Gridinsoft: Trojan.Heur!.012500A3 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x2951 |
| e_cp | 0x79f |
| e_crlc | 0xbe88 |
| e_cparhdr | 0x3835 |
| e_minalloc | 0x8547 |
| e_maxalloc | 0x1a9d |
| e_ss | 0xa851 |
| e_sp | 0x5453 |
| e_csum | 0xcaa8 |
| e_ip | 0xe985 |
| e_cs | 0xc19e |
| e_ovno | 0xebab |
| e_oemid | 0xf199 |
| e_oeminfo | 0xe86f |
| e_lfanew | 0x100 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 11 |
| TimeDateStamp | 2026-Jul-13 08:14:12 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 8.0 |
| SizeOfCode | 0x78f3ec |
| SizeOfInitializedData | 0x3e2a91 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000B8D4C0 (Section: .data) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xbda000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x474f39 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x4000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x2000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| advapi32.dll |
RegOpenKeyExA
|
|---|---|
| kernel32.dll |
GetModuleHandleA
|
| shell32.dll |
SHChangeNotifyRegister
|
| user32.dll |
UpdateWindow
|
| Ordinal | 1 |
|---|---|
| Address | 0x7e92b0 |
| Ordinal | 2 |
|---|---|
| Address | 0x1dfb0 |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 26.1.0.0 |
| ProductVersion | 26.1.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| FileVersion (#2) | 26.1.0.0 |
| ProductVersion (#2) | 26.1.0.0 |
| LegalCopyright | Copyright © G.D.G. Software 2012-2026. All rights reserved. |
| LegalTrademarks | XLS Padlock, https://www.xlspadlock.com |
| InternalName | XLS Padlock |
| Comments | http://www.xlspadlock.com |
| FileDescription | XLS Padlock Manager |
| OriginalFilename | XLSPadlockManager.exe |
| ProductName | XLS Padlock |
| CompanyName | G.D.G. Software |
| ProgramID | com.embarcadero.XLSPadLockReg |
| Resource LangID | English - United States |
|---|
No comments yet.