Manalyze report for f608800ad6da6823bfcc78b423997beff77cb6eb7c4fe25df24bbd33dd9d95d0

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2096-Mar-21 08:09:35
Detected languages	English - United States

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`Miscellaneous malware strings: exploit` `Contains domain names: curl.haxx.se example.com github.com https://curl.haxx.se https://curl.haxx.se/docs/http-cookies.html https://fontawesome.comFont https://github.com https://scripts.sil.org https://scripts.sil.org/OFLJetBrains https://scripts.sil.org/OFLThis https://scripts.sil.org/OFLhttps https://scripts.sil.org/OFLwww.nan.xyzLuke https://www.jetbrains.comThis scripts.sil.org`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32` `Uses constants related to AES` `Uses constants related to RC5 or RC6` `Uses known Mersenne Twister constants` `Microsoft's Cryptography API`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryExW LoadLibraryExA LoadLibraryA` `Functions which can be used for anti-debugging purposes: CreateToolhelp32Snapshot CheckRemoteDebuggerPresent FindWindowA FindWindowW` `Code injection capabilities: WriteProcessMemory VirtualAllocEx VirtualAlloc OpenProcess CreateRemoteThreadEx CreateRemoteThread` `Code injection capabilities (process hollowing): ResumeThread SetThreadContext WriteProcessMemory` `Code injection capabilities (mapping injection): MapViewOfFile CreateFileMappingA CreateRemoteThreadEx CreateRemoteThread` `Can access the registry: RegGetValueA RegCloseKey RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW` `Possibly launches other programs: CreateProcessWithTokenW ShellExecuteA` `Uses Windows's Native API: ZwWriteVirtualMemory ZwReadVirtualMemory ntohl ntohs` `Uses Microsoft's cryptographic API: CryptAcquireContextA CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptStringToBinaryA CryptDecodeObjectEx CryptQueryObject` `Uses functions commonly found in keyloggers: MapVirtualKeyA AttachThreadInput MapVirtualKeyW GetForegroundWindow GetAsyncKeyState CallNextHookEx` `Memory manipulation functions often used by packers: VirtualProtectEx VirtualAllocEx VirtualProtect VirtualAlloc` `Leverages the raw socket API to access the Internet: WS2_32.dll` `Functions related to the privilege level: OpenProcessToken AdjustTokenPrivileges DuplicateTokenEx` `Enumerates local disk drives: GetDriveTypeW` `Manipulates other processes: Process32FirstW Process32NextW WriteProcessMemory ReadProcessMemory OpenProcess` `Can take screenshots: FindWindowA FindWindowW GetDC` `Reads the contents of the clipboard: GetClipboardData` `Interacts with the certificate store: CertOpenStore CertAddCertificateContextToStore`
Suspicious	No VirusTotal score.	`This file has never been scanned on VirusTotal.`

Hashes

MD5	`b646b44c39df6ab6bfcbf652188dc054` 🔍
SHA1	`ac856264bcfba097178ff29aa02a7af5215983d4` 🔍
SHA256	`f608800ad6da6823bfcc78b423997beff77cb6eb7c4fe25df24bbd33dd9d95d0` 🔍
SHA3	`80ee5d1bfd37b34e94e1a0b98f28bf015a80337c74c21c573c71cf4ea2b5e1e4` 🔍
SSDeep	`196608:fr/ciEhQkuRb5l3fUF5mVv/BhIrOiDMnUOnlRdy:fjKCXvl+5Gv/BOMUOnlRs` 🔍
Imports Hash	`cbafdffecf2ee25d58bbf1718655d198` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`8`
TimeDateStamp	2096-Mar-21 08:09:35
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0xaac400`
SizeOfInitializedData	`0x600000`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00000000009BE0F0 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x10b2000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x1000000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`7cffd7a9c193243abf5410b08001fc40 🔍`
SHA1	`e538b71f20709058d6fe0cfa0607aa1afd009e0a 🔍`
SHA256	`9c498441d6b07f58e49be00de630d0ba9d7f4ca32f2ce49271daa527c7ac80c1 🔍`
SHA3	`4f38ff58778cccf6989ddf8f4b952465d3114d80eace01c386b835a417e96480 🔍`
VirtualSize	`0xaac245`
VirtualAddress	`0x1000`
SizeOfRawData	`0xaac400`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.88299`

.rdata

MD5	`4991c4156aafe07295c2bf1ecb58bfa2 🔍`
SHA1	`efc473751f923b325130f2eea811198f08cca25f 🔍`
SHA256	`e199e6a7ea5d9c63bb1a3c319b506b27c701cc0c382f345b7da407c81b4b5f2b 🔍`
SHA3	`bf6b8c092efa1fd5fbda922f0480787b92649efa6fe4f52a002efd22c27e101a 🔍`
VirtualSize	`0x347b36`
VirtualAddress	`0xaae000`
SizeOfRawData	`0x347c00`
PointerToRawData	`0xaac800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.75475`

.data

MD5	`7e50a9c3f6b661fec525ad9326e2e518 🔍`
SHA1	`08262f9064340e81baf74c76117de9bafb3c5b66 🔍`
SHA256	`68394dbebfa5abaf4e2cec79a77f2dff5574cb686a2d4affd533a4baf3cd790f 🔍`
SHA3	`8d69ff92127a1d0846e6db3c9e4ca5e55e57139017042f153f0d93f28afb7a66 🔍`
VirtualSize	`0x1e7674`
VirtualAddress	`0xdf6000`
SizeOfRawData	`0x1c8200`
PointerToRawData	`0xdf4400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`7.36456`

.pdata

MD5	`5fde3d593e71b7e3e8198f4e7c3a4625 🔍`
SHA1	`f9872745db088079a28ddb43c20594283dd4b701 🔍`
SHA256	`c6103a21ef5e91946016767cf81262e875f855d9955f2e2bfb5cb53400ed9f4c 🔍`
SHA3	`9b6d6c2ad6e36072f9e22b5b9fbd7e0ea6b19f5bc7446f2241c5ca05d5a8bac2 🔍`
VirtualSize	`0xbbd34`
VirtualAddress	`0xfde000`
SizeOfRawData	`0xbbe00`
PointerToRawData	`0xfbc600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.22069`

_RDATA

MD5	`0759bfd2d8fc08631afc9bb77aa6bb4e 🔍`
SHA1	`752384a9dda29f7406913277c435a96f844f6003 🔍`
SHA256	`b72a5d8f4340f8e8d2e05d4cfac340787db60d3e48d13dd7b60db19b01227fcc 🔍`
SHA3	`36ef043cd201da28ab959b8a4016f07bfb8b35678a7480e317110cd43162c299 🔍`
VirtualSize	`0xf4`
VirtualAddress	`0x109a000`
SizeOfRawData	`0x200`
PointerToRawData	`0x1078400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`2.57722`

.fptable

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x100`
VirtualAddress	`0x109b000`
SizeOfRawData	`0x200`
PointerToRawData	`0x1078600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`daa7728df8e916ee31215732b1a05842 🔍`
SHA1	`deec532998e42b4ee6bdf4752ee4ef5dceb96690 🔍`
SHA256	`80bf1860c339dc2342d12d8ffc843d9e938f837647f8a399b190941df7893bd1 🔍`
SHA3	`de32ba5b165db90d6c2d634920b7ac2dee98135188dce4b8875dcec43d99e7d6 🔍`
VirtualSize	`0x1e0`
VirtualAddress	`0x109c000`
SizeOfRawData	`0x200`
PointerToRawData	`0x1078800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.72231`

.reloc

MD5	`63135006ae389b2066cf350074733123 🔍`
SHA1	`666f58f5396c62c17ca859ad2791e6d7f2a15713 🔍`
SHA256	`d31269b56d5a2cb0b7bb1bf06866cb3741e99305a3434191dd0a0e81efc793e2 🔍`
SHA3	`a862dd09066fc965fb92cfda39701795bd76245d26037288b5505120e544f08d 🔍`
VirtualSize	`0x147d0`
VirtualAddress	`0x109d000`
SizeOfRawData	`0x14800`
PointerToRawData	`0x1078a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.38871`

Imports

d3d11.dll	`D3D11CreateDeviceAndSwapChain`
D3DCOMPILER_47.dll	`D3DCompile`
KERNEL32.dll	`GetExitCodeProcess` `GetCurrentThreadId` `GetExitCodeThread` `SuspendThread` `ResumeThread` `GetThreadContext` `SetThreadContext` `FlushInstructionCache` `GetThreadTimes` `VirtualProtectEx` `VirtualQueryEx` `VirtualFreeEx` `GetModuleHandleW` `GetProcAddress` `K32EnumProcessModulesEx` `K32GetModuleBaseNameA` `K32GetModuleInformation` `CreateToolhelp32Snapshot` `Thread32First` `Thread32Next` `Module32FirstW` `Module32NextW` `FreeLibrary` `Process32FirstW` `Process32NextW` `K32EnumProcessModules` `K32GetModuleFileNameExW` `GetCurrentProcess` `GetModuleFileNameA` `GetModuleHandleA` `GetEnvironmentVariableA` `GetCurrentThread` `SetThreadPriority` `SetThreadAffinityMask` `QueryFullProcessImageNameA` `MultiByteToWideChar` `SetUnhandledExceptionFilter` `AddVectoredExceptionHandler` `RtlAddFunctionTable` `RtlDeleteFunctionTable` `GetCommandLineW` `SetEnvironmentVariableW` `GetProcessId` `GetSystemDirectoryW` `VirtualQuery` `DisableThreadLibraryCalls` `GetModuleFileNameW` `GetModuleHandleExW` `AllocConsole` `SetConsoleOutputCP` `SetConsoleTitleA` `CreateEventW` `VerSetConditionMask` `QueryPerformanceCounter` `QueryPerformanceFrequency` `GetLocaleInfoA` `GlobalAlloc` `GlobalUnlock` `GlobalLock` `GlobalFree` `HeapAlloc` `HeapReAlloc` `HeapFree` `GetProcessHeap` `MapViewOfFile` `UnmapViewOfFile` `CreateFileMappingA` `EnterCriticalSection` `LeaveCriticalSection` `InitializeCriticalSectionEx` `DeleteCriticalSection` `SleepEx` `GetSystemDirectoryA` `VerifyVersionInfoA` `MoveFileExA` `WaitForSingleObjectEx` `GetStdHandle` `GetFileType` `PeekNamedPipe` `WaitForMultipleObjects` `SetLastError` `FormatMessageA` `GetEnvironmentStringsW` `GetCommandLineA` `GetOEMCP` `GetACP` `IsValidCodePage` `FindNextFileW` `FindFirstFileExW` `FindClose` `SetEndOfFile` `DeleteFileW` `GetFullPathNameW` `GetCurrentDirectoryW` `QueueUserAPC` `SetStdHandle` `GetFileAttributesExW` `SetFilePointerEx` `FlushFileBuffers` `EnumSystemLocalesW` `GetUserDefaultLCID` `IsValidLocale` `GetLocaleInfoW` `LCMapStringW` `CompareStringW` `GetTimeFormatW` `GetDateFormatW` `GetTimeZoneInformation` `HeapQueryInformation` `OutputDebugStringW` `FileTimeToSystemTime` `SystemTimeToTzSpecificLocalTime` `GetFileInformationByHandle` `GetDriveTypeW` `GetConsoleOutputCP` `ReadConsoleW` `GetConsoleMode` `FreeLibraryAndExitThread` `ExitThread` `GetSystemInfo` `HeapValidate` `HeapSize` `WriteConsoleW` `TlsFree` `TlsSetValue` `TlsGetValue` `TlsAlloc` `RtlUnwind` `LoadLibraryExW` `RtlUnwindEx` `RtlPcToFileHeader` `InitializeSListHead` `GetStartupInfoW` `RaiseException` `IsProcessorFeaturePresent` `UnhandledExceptionFilter` `ResetEvent` `SetEvent` `InitializeCriticalSectionAndSpinCount` `GetCPInfo` `GetStringTypeW` `GetSystemTimeAsFileTime` `Sleep` `LoadLibraryExA` `WaitForSingleObject` `GetLastError` `OutputDebugStringA` `GetFileSizeEx` `CreateFileW` `WideCharToMultiByte` `GetComputerNameW` `GetNativeSystemInfo` `CloseHandle` `WriteFile` `ReadFile` `GetFileSize` `DeleteFileA` `CreateFileA` `CreateDirectoryA` `GetEnvironmentVariableW` `LoadLibraryA` `WriteProcessMemory` `ReadProcessMemory` `VirtualAllocEx` `VirtualProtect` `VirtualAlloc` `GetTickCount64` `GetTickCount` `OpenProcess` `CreateRemoteThreadEx` `OpenThread` `CreateRemoteThread` `FlsFree` `FlsSetValue` `FlsGetValue` `FlsAlloc` `CreateThread` `TerminateProcess` `ExitProcess` `LCMapStringEx` `DecodePointer` `EncodePointer` `AcquireSRWLockShared` `ReleaseSRWLockShared` `TryEnterCriticalSection` `AcquireSRWLockExclusive` `ReleaseSRWLockExclusive` `InitializeSRWLock` `GetCurrentProcessId` `CheckRemoteDebuggerPresent` `IsDebuggerPresent` `FreeEnvironmentStringsW`
USER32.dll	`GetWindowLongPtrW` `EnumWindows` `GetWindowThreadProcessId` `GetMonitorInfoW` `EnumDisplayMonitors` `GetKeyNameTextA` `MapVirtualKeyA` `mouse_event` `TranslateMessage` `DispatchMessageW` `PeekMessageW` `AttachThreadInput` `DefWindowProcW` `PostQuitMessage` `UnregisterClassW` `RegisterClassExW` `CreateWindowExW` `DestroyWindow` `ShowWindow` `SetLayeredWindowAttributes` `MoveWindow` `SetWindowDisplayAffinity` `IsIconic` `SetForegroundWindow` `SendInput` `MapVirtualKeyW` `MsgWaitForMultipleObjectsEx` `GetSystemMetrics` `GetWindowTextA` `UpdateWindow` `SetActiveWindow` `GetClientRect` `GetWindowRect` `ClientToScreen` `ClipCursor` `SetWindowLongPtrW` `GetClassNameA` `SetWindowsHookExW` `UnhookWindowsHookEx` `GetWindowTextLengthA` `FindWindowA` `FindWindowW` `SetWindowsHookW` `IsWindow` `SetWindowPos` `BringWindowToTop` `GetActiveWindow` `GetForegroundWindow` `AllowSetForegroundWindow` `IsWindowVisible` `GetAsyncKeyState` `SetFocus` `IsWindowUnicode` `CallNextHookEx` `EmptyClipboard` `GetClipboardData` `SetClipboardData` `CloseClipboard` `OpenClipboard` `LoadCursorW` `ScreenToClient` `GetCursorPos` `SetCursor` `SetCursorPos` `ReleaseDC` `GetDC` `MonitorFromPoint` `ReleaseCapture` `SetCapture` `GetCapture` `GetKeyState` `GetMessageExtraInfo` `TrackMouseEvent` `GetKeyboardLayout` `SetProcessDPIAware` `RegisterRawInputDevices` `GetRawInputData` `UnhookWinEvent` `SetWinEventHook` `MonitorFromWindow` `SwitchToThisWindow`
GDI32.dll	`DeleteObject` `GetDeviceCaps` `CreateRectRgn`
ADVAPI32.dll	`CryptAcquireContextA` `RegGetValueA` `LookupPrivilegeValueW` `RegCloseKey` `OpenProcessToken` `AdjustTokenPrivileges` `RegDeleteValueW` `RegOpenKeyExW` `RegQueryValueExW` `RegSetValueExW` `CryptEncrypt` `CryptImportKey` `CryptDestroyKey` `CryptDestroyHash` `CryptHashData` `CryptCreateHash` `CryptGenRandom` `CryptGetHashParam` `CryptReleaseContext` `DuplicateTokenEx` `CreateProcessWithTokenW` `SetTokenInformation` `GetSidSubAuthorityCount` `GetSidSubAuthority` `GetTokenInformation`
SHELL32.dll	`SHGetFolderPathA` `ShellExecuteExW` `ShellExecuteA` `SHQueryUserNotificationState`
ole32.dll	`OleUninitialize` `OleInitialize`
COMDLG32.dll	`GetSaveFileNameW` `GetOpenFileNameW`
ntdll.dll	`RtlVirtualUnwind` `ZwWriteVirtualMemory` `ZwReadVirtualMemory` `RtlCaptureContext` `RtlLookupFunctionEntry`
WINMM.dll	`timeEndPeriod` `timeBeginPeriod`
bcrypt.dll	`BCryptOpenAlgorithmProvider` `BCryptDestroyHash` `BCryptFinishHash` `BCryptHashData` `BCryptCreateHash` `BCryptCloseAlgorithmProvider`
dwmapi.dll	`DwmIsCompositionEnabled` `DwmExtendFrameIntoClientArea` `DwmGetColorizationColor` `DwmEnableBlurBehindWindow`
IMM32.dll	`ImmReleaseContext` `ImmSetCompositionWindow` `ImmSetCandidateWindow` `ImmGetContext`
WS2_32.dll	`closesocket` `recv` `send` `WSAGetLastError` `bind` `connect` `getpeername` `getsockname` `ntohl` `gethostname` `sendto` `recvfrom` `freeaddrinfo` `getaddrinfo` `select` `__WSAFDIsSet` `ioctlsocket` `listen` `htonl` `accept` `WSACleanup` `WSAStartup` `WSAIoctl` `WSASetLastError` `socket` `setsockopt` `ntohs` `htons` `getsockopt`
CRYPT32.dll (delay-loaded)	`CertOpenStore` `CertGetCertificateChain` `CertCloseStore` `CertEnumCertificatesInStore` `CertFindCertificateInStore` `CertFreeCertificateContext` `CryptStringToBinaryA` `PFXImportCertStore` `CryptDecodeObjectEx` `CertAddCertificateContextToStore` `CertFindExtension` `CertGetNameStringA` `CryptQueryObject` `CertCreateCertificateChainEngine` `CertFreeCertificateChainEngine` `CertFreeCertificateChain`

Delayed Imports

Attributes	`0x1`
Name	`CRYPT32.dll`
ModuleHandle	`0xfdb4e8`
DelayImportAddressTable	`0xfbe0c0`
DelayImportNameTable	`0xdf2fe0`
BoundDelayImportTable	`0xdf32c0`
UnloadDelayImportTable	`0`
TimeStamp	`1970-Jan-01 00:00:00`

ManualMapEntry

Ordinal	`1`
Address	`0x7b2e00`

1

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x17d`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.91161`
MD5	`1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍`
SHA1	`4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍`
SHA256	`4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍`
SHA3	`4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍`

Version Info

UNKNOWN

Characteristics	`0`
TimeDateStamp	2096-Mar-21 08:09:35
Version	`0.0`
SizeofData	`36`
AddressOfRawData	`0xda626c`
PointerToRawData	`0xda4a6c`

TLS Callbacks

StartAddressOfRawData	`0x140da62b0`
EndAddressOfRawData	`0x140da7158`
AddressOfIndex	`0x140fdbdc8`
AddressOfCallbacks	`0x140aaf348`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_16BYTES`
Callbacks	`(EMPTY)`

Load Configuration

Size	`0x138`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x140fbbef8`

RICH Header

Errors

Leave a comment

No comments yet.