Manalyze report for f76829b2fa09222fd88c589b03f127f7f9e52e02c50358571a28bc19a2732a49

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Oct-17 15:34:51
Detected languages	English - United States
Debug artifacts	C:\Users\Grandpa\Documents\VexOS\VexOS-Loaders\Loader\x64\Release\VexOS-Loader.pdb

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`Contains references to system / monitoring tools: Wireshark.exe dumpcap.exe schtask` `Contains references to debugging or reversing tools: ida.exe ida64.exe ollydbg.exe windbg.exe x32dbg.exe x64dbg.exe` `Contains references to security software: rshell.exe` `Accesses the WMI: ROOT\CIMV2 ROOT\Microsoft root\wmi` `Miscellaneous malware strings: cmd.exe` Contains domain names: aMotion.xyz aSeed.xyz c2pa.ssl.com crt-c2pa.ssl.com cv.iptc.org discord.com dl.dlnode.net dlnode.net github.com http://crt-c2pa.ssl.com http://crt-c2pa.ssl.com/SSL.com-C2PA-I-R1.cer0$ http://crt-c2pa.ssl.com/SSL.com-C2PA-Root-2025-RSA.cer0 http://cv.iptc.org http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia http://ocsp-c2pa.ssl.com0 http://ocsp-c2pa.ssl.com0B http://scripts.sil.org http://scripts.sil.org/OFL http://www.w3.org http://www.w3.org/2000/svg https://ca.trufo.ai https://ca.trufo.ai/c2pa-ca.crt03 https://ca.trufo.ai/root-ca.crt0 https://discord.com https://dl.dlnode.net https://dl.dlnode.net/ https://github.com https://launcher.vexos.invalid https://launcher.vexos.invalid/index.html https://ocsp.trufo.ai0 https://ocsp.trufo.ai0+ https://scripts.sil.org https://scripts.sil.org/OFL https://trufo.ai https://vexos.store https://www.vexos.store iCentre.xyz p-aMotion.xyz scripts.sil.org www.w3.org
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to SHA256` `Microsoft's Cryptography API`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryExW LoadLibraryW` `Functions which can be used for anti-debugging purposes: CreateToolhelp32Snapshot FindWindowW` `Can access the registry: RegQueryInfoKeyW RegEnumKeyExW RegEnumValueW RegCloseKey RegCreateKeyExW RegQueryValueExW RegGetValueW RegOpenKeyExW RegSetValueExW` `Possibly launches other programs: ShellExecuteW ShellExecuteA CreateProcessW` `Uses Microsoft's cryptographic API: CryptMsgClose CryptQueryObject CryptMsgGetParam CryptUnprotectData CryptProtectData CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash` `Can create temporary files: GetTempPathW CreateFileW` `Uses functions commonly found in keyloggers: GetAsyncKeyState AttachThreadInput GetForegroundWindow` `Has Internet access capabilities: WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpConnect WinHttpSetStatusCallback WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpReceiveResponse WinHttpOpen InternetConnectA InternetCrackUrlA InternetSetOptionA InternetReadFile InternetOpenA InternetCloseHandle` `Leverages the raw socket API to access the Internet: WS2_32.dll` `Functions related to the privilege level: AdjustTokenPrivileges OpenProcessToken` `Interacts with services: DeleteService OpenSCManagerW ControlService OpenServiceW QueryServiceConfigW EnumServicesStatusExW` `Enumerates local disk drives: GetVolumeInformationW` `Manipulates other processes: OpenProcess Process32NextW Process32FirstW` `Can take screenshots: GetDC FindWindowW BitBlt CreateCompatibleDC` `Can shut the system down or lock the screen: ExitWindowsEx`
Suspicious	The PE is possibly a dropper.	`Resource 330 is possibly compressed or encrypted.` `Resource 331 is possibly compressed or encrypted.` `Resources amount for 92.0365% of the executable.`
Suspicious	No VirusTotal score.	`This file has never been scanned on VirusTotal.`

Hashes

MD5	`0eb9545565201b62029d157e7b6a7a61` 🔍
SHA1	`78623e366cc088125ba33773d8cb1345f4dcb128` 🔍
SHA256	`f76829b2fa09222fd88c589b03f127f7f9e52e02c50358571a28bc19a2732a49` 🔍
SHA3	`f2a9e6d5a03f1a994a5675ef7ea99aeeb9e3900c5b2c25f554cc55d8a2e806ae` 🔍
SSDeep	`393216:h9rMUy+N+qwUYnySfxccj3VQjoazEH9x7h01DY2:gUy4wU7a3VQjzzW9xAl` 🔍
Imports Hash	`eeea0121029cc092a70ece2abbb990f0` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x120`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`7`
TimeDateStamp	2026-Oct-17 15:34:51
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x13c200`
SizeOfInitializedData	`0x136c400`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00000000000F9960 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x14ae000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`709bcab31297ed9906061f2b61d4d485 🔍`
SHA1	`77e702b8f5a011be5cc3cdd4b38578c87df61da2 🔍`
SHA256	`1a8d8806519d734e43d7f07db9a9364ba562c30daa8702e51ef9be5bca302181 🔍`
SHA3	`ebf90257b48cc524f4e54b92de72cf949afaf06e2983ff5b6cf9d1f51b1ad899 🔍`
VirtualSize	`0x13c07c`
VirtualAddress	`0x1000`
SizeOfRawData	`0x13c200`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.44207`

.rdata

MD5	`93484ac557068584c7843a1e7590e8c7 🔍`
SHA1	`f3b027a13581415a6a8a19f89438273654d4039b 🔍`
SHA256	`2c9117377a292592fda060aa5075f694f026329d8ea848b69473783b95bb6768 🔍`
SHA3	`10dd6842162dd9a7b7fd33b5976db19142323431c9cea4199e8e4639241df125 🔍`
VirtualSize	`0x51a32`
VirtualAddress	`0x13e000`
SizeOfRawData	`0x51c00`
PointerToRawData	`0x13c600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.18272`

.data

MD5	`8de5399b789ce7c3c02daa6d7a55365a 🔍`
SHA1	`3fcadd0f41bfcb44b89e4b08164cf6db1daa7046 🔍`
SHA256	`d8a45955b379ced3cf437e2c7e4f8fd72ce90dd4288d431fce1b21ee0eca9fa4 🔍`
SHA3	`3a38b86fd7deb967dbc5d7458a030620d77fd4ad20627ffbe4764294d84b971d 🔍`
VirtualSize	`0xc1fc`
VirtualAddress	`0x190000`
SizeOfRawData	`0xa000`
PointerToRawData	`0x18e200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.47456`

.pdata

MD5	`23512af11b50b4fe072c678098deee64 🔍`
SHA1	`8dc495632df7d673dc32f6e8a0f2e9a530afed8e 🔍`
SHA256	`6d517bf1092524f499b35cc983e567612bccc1b0bd9d0f302a9ec5584b891d0f 🔍`
SHA3	`564866c817527fdb201b6e463e08405d98ab10cb9d14a5687bc6102da7370d71 🔍`
VirtualSize	`0xab6c`
VirtualAddress	`0x19d000`
SizeOfRawData	`0xac00`
PointerToRawData	`0x198200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.06793`

.fptable

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x100`
VirtualAddress	`0x1a8000`
SizeOfRawData	`0x200`
PointerToRawData	`0x1a2e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`42b121fb9b3ce9d25f97afb74b2bd056 🔍`
SHA1	`c4882add723014612601759bea9c2c03a48f5d06 🔍`
SHA256	`8619da6cd3ba06106d1b334a4c6b363e419864136206d81ee504b5a656087435 🔍`
SHA3	`6fb857dc2b6c48fee60f1e408c3cdb8d1603fc42a9667afec245112208b42f23 🔍`
VirtualSize	`0x1302260`
VirtualAddress	`0x1a9000`
SizeOfRawData	`0x1302400`
PointerToRawData	`0x1a3000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.98644`

.reloc

MD5	`2d7eea74bf73841ffbc06cf84588ebe0 🔍`
SHA1	`6782dc3a50fc9cbc87ed29530402f6cf759e3d97 🔍`
SHA256	`4fe9e576fdd40860282677a231fe0d651bc9ffd25a52abcf0ff9e60d2cb6ce1b 🔍`
SHA3	`d5ce46915a3a1a90525c8990e0007d4a645761fc5c4cac775dee1e17015e0b05 🔍`
VirtualSize	`0x12a0`
VirtualAddress	`0x14ac000`
SizeOfRawData	`0x1400`
PointerToRawData	`0x14a5400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.3264`

Imports

VERSION.dll	`VerQueryValueW` `GetFileVersionInfoW` `GetFileVersionInfoSizeW`
WINHTTP.dll	`WinHttpQueryHeaders` `WinHttpQueryDataAvailable` `WinHttpCrackUrl` `WinHttpConnect` `WinHttpSetStatusCallback` `WinHttpSetTimeouts` `WinHttpSendRequest` `WinHttpCloseHandle` `WinHttpSetOption` `WinHttpOpenRequest` `WinHttpReadData` `WinHttpReceiveResponse` `WinHttpOpen`
WININET.dll	`HttpOpenRequestA` `HttpQueryInfoA` `InternetConnectA` `InternetCrackUrlA` `InternetSetOptionA` `InternetReadFile` `InternetOpenA` `InternetCloseHandle` `HttpSendRequestA`
SHELL32.dll	`SHGetFolderPathW` `CommandLineToArgvW` `ShellExecuteW` `Shell_NotifyIconW` `SHCreateDirectoryExW` `ShellExecuteA` `ShellExecuteExW` `SHGetKnownFolderPath` `SHGetSpecialFolderPathW`
CRYPT32.dll	`CryptMsgClose` `CertFreeCertificateContext` `CryptQueryObject` `CertCloseStore` `CryptMsgGetParam` `CertFindCertificateInStore` `CertGetNameStringW` `CryptUnprotectData` `CryptProtectData`
gdiplus.dll	`GdipSetClipPath` `GdipCreateLineBrush` `GdipCreatePath` `GdipSetStringFormatLineAlign` `GdipFillPolygon` `GdipCreateFont` `GdipSetInterpolationMode` `GdipDrawImagePoints` `GdipSetPenLineCap197819` `GdipCreateSolidFill` `GdipDrawBezier` `GdipSetStringFormatTrimming` `GdipFillPath` `GdipGraphicsClear` `GdipDrawLine` `GdipAddPathBeziers` `GdipDrawRectangle` `GdipSetPixelOffsetMode` `GdipFillRectangle` `GdipAddPathEllipse` `GdipClosePathFigure` `GdipFree` `GdipDrawPath` `GdipDrawString` `GdipSetPenLineJoin` `GdipDeletePath` `GdipFillEllipse` `GdipSetPenEndCap` `GdipSetTextRenderingHint` `GdipRestoreGraphics` `GdipCloneBrush` `GdipMeasureString` `GdipSetSmoothingMode` `GdipGetPathGradientPointCount` `GdipFillRectangleI` `GdipAddPathArc` `GdipCreatePen2` `GdipGetImageEncodersSize` `GdipDeleteGraphics` `GdipDrawArc` `GdipDeleteStringFormat` `GdipSetCompositingMode` `GdipDeleteFont` `GdipDrawLines` `GdipGetImageWidth` `GdipSaveImageToStream` `GdipDeletePen` `GdipCreateBitmapFromScan0` `GdipDrawImageI` `GdipCreatePen1` `GdipDrawPolygon` `GdipSetStringFormatAlign` `GdipSetPathGradientSurroundColorsWithCount` `GdipLoadImageFromStream` `GdiplusStartup` `GdiplusShutdown` `GdipAddPathLine` `GdipCreateStringFormat` `GdipDeleteFontFamily` `GdipSetCompositingQuality` `GdipGetImageEncoders` `GdipResetClip` `GdipCreateFontFamilyFromName` `GdipSaveGraphics` `GdipAddPathBezier` `GdipCreateBitmapFromHBITMAP` `GdipFlush` `GdipCreatePathGradientFromPath` `GdipDisposeImage` `GdipGetImageGraphicsContext` `GdipSetPathGradientCenterColor` `GdipDrawImageRectI` `GdipAlloc` `GdipDeleteBrush` `GdipSetPenStartCap` `GdipCloneImage` `GdipSetClipRect` `GdipDrawImageRect` `GdipCreateFromHDC`
d2d1.dll	`#1`
DWrite.dll	`DWriteCreateFactory`
ole32.dll	`CLSIDFromString` `CreateStreamOnHGlobal` `CoTaskMemFree` `CoInitializeEx` `CoUninitialize` `StringFromGUID2` `GetHGlobalFromStream` `CoTaskMemAlloc` `CoCreateInstance` `CoInitializeSecurity` `CoSetProxyBlanket`
OLEAUT32.dll	`VariantInit` `SysFreeString` `SysAllocString` `SysAllocStringLen` `VariantClear`
CFGMGR32.dll	`CM_Locate_DevNodeW` `CM_Get_DevNode_Status`
IPHLPAPI.DLL	`GetAdaptersInfo` `GetNetworkParams` `SendARP` `InitializeIpInterfaceEntry` `GetAdaptersAddresses` `GetIpInterfaceEntry` `FreeMibTable` `GetIpNetTable2` `GetIfEntry2` `GetIpForwardTable2`
SETUPAPI.dll	`SetupDiGetClassDevsW` `SetupDiGetDeviceRegistryPropertyW` `SetupDiEnumDeviceInfo` `SetupDiGetDeviceInstanceIdW` `SetupDiGetDevicePropertyW` `SetupDiGetDeviceInterfaceDetailW` `SetupDiEnumDeviceInterfaces` `SetupDiDestroyDeviceInfoList`
KERNEL32.dll	`LCMapStringEx` `InitOnceBeginInitialize` `InitOnceComplete` `GetExitCodeThread` `WaitForSingleObjectEx` `GetStringTypeW` `GetSystemTimePreciseAsFileTime` `QueryPerformanceFrequency` `QueryPerformanceCounter` `SleepConditionVariableSRW` `WakeAllConditionVariable` `AcquireSRWLockExclusive` `ReleaseSRWLockExclusive` `GetLocaleInfoEx` `FormatMessageA` `GetFileInformationByHandleEx` `CopyFile2` `AreFileApisANSI` `CreateFile2` `SetFileInformationByHandle` `GetFullPathNameW` `GetFinalPathNameByHandleW` `FindFirstFileExW` `CreateDirectoryW` `InitializeSListHead` `RtlLookupFunctionEntry` `RtlUnwindEx` `EnterCriticalSection` `RtlPcToFileHeader` `RaiseException` `FlsAlloc` `FlsGetValue` `FlsSetValue` `FlsFree` `CreateThread` `ExitThread` `FreeLibraryAndExitThread` `GetModuleHandleExW` `IsProcessorFeaturePresent` `GetStdHandle` `RtlCaptureContext` `RtlVirtualUnwind` `IsDebuggerPresent` `UnhandledExceptionFilter` `GetFileSizeEx` `SetFilePointerEx` `GetFileType` `HeapAlloc` `GetConsoleOutputCP` `GetConsoleMode` `VirtualProtect` `GetDateFormatW` `GetTimeFormatW` `CompareStringW` `LCMapStringW` `GetLocaleInfoW` `IsValidLocale` `LeaveCriticalSection` `GetUserDefaultLCID` `EnumSystemLocalesW` `HeapReAlloc` `ReadConsoleW` `GetTimeZoneInformation` `InitializeCriticalSectionEx` `DeleteCriticalSection` `EncodePointer` `DecodePointer` `CompareStringEx` `GetCPInfo` `GetSystemTimeAsFileTime` `SetUnhandledExceptionFilter` `GetStartupInfoW` `IsValidCodePage` `GetACP` `GetOEMCP` `GetCommandLineA` `GetEnvironmentStringsW` `FreeEnvironmentStringsW` `SetEnvironmentVariableW` `SetStdHandle` `SizeofResource` `GetVolumeInformationW` `SetLastError` `GetCommandLineW` `GetCurrentProcess` `WriteFile` `ExpandEnvironmentStringsW` `TerminateProcess` `GetModuleFileNameW` `GetProcessId` `GetTempPathW` `CreateMutexW` `WaitForSingleObject` `CreateFileW` `GetFileAttributesW` `GetCurrentThreadId` `ReleaseMutex` `OpenProcess` `SetFileAttributesW` `CreateToolhelp32Snapshot` `CreateEventW` `MultiByteToWideChar` `Sleep` `GetFileInformationByHandle` `GetTickCount64` `GetLastError` `GetFileAttributesExW` `Process32NextW` `SetEvent` `LockResource` `GlobalAlloc` `DeleteFileW` `Process32FirstW` `GlobalFree` `CloseHandle` `ResetEvent` `LoadResource` `FindResourceW` `GetLocalTime` `GetWindowsDirectoryW` `GlobalLock` `LocalFree` `MoveFileExW` `ExitProcess` `GetCurrentProcessId` `CreateProcessW` `GetModuleHandleW` `CopyFileW` `WideCharToMultiByte` `QueryFullProcessImageNameW` `SetProcessWorkingSetSize` `GlobalUnlock` `MoveFileW` `FlushFileBuffers` `GetExitCodeProcess` `GetSystemFirmwareTable` `ReadFile` `SetHandleInformation` `DeviceIoControl` `CreatePipe` `PeekNamedPipe` `GetSystemDirectoryW` `FileTimeToSystemTime` `GetProcAddress` `GetFileSize` `GetComputerNameW` `GetFileTime` `OutputDebugStringA` `OutputDebugStringW` `RtlUnwind` `HeapFree` `LoadLibraryExW` `FindFirstFileW` `FindNextFileW` `FindClose` `LocalAlloc` `LoadLibraryW` `FreeLibrary` `GetEnvironmentVariableW` `HeapSize` `WriteConsoleW` `SetEndOfFile` `GetProcessHeap`
USER32.dll	`TrackMouseEvent` `PeekMessageW` `ExitWindowsEx` `EmptyClipboard` `CloseClipboard` `GetMonitorInfoW` `IsHungAppWindow` `RedrawWindow` `SetTimer` `DispatchMessageW` `GetCapture` `OpenClipboard` `GetAsyncKeyState` `IsWindow` `ShowWindow` `RegisterClassExW` `GetWindowLongPtrW` `MsgWaitForMultipleObjects` `GetSystemMetrics` `AttachThreadInput` `CreateWindowExW` `FillRect` `SetWindowLongPtrW` `MessageBoxW` `SetWindowPos` `IsWindowVisible` `GetDC` `DestroyWindow` `SendMessageTimeoutW` `GetWindowRect` `SetProcessDpiAwarenessContext` `MonitorFromPoint` `PostMessageW` `AllowSetForegroundWindow` `DefWindowProcW` `GetMessageW` `GetWindowThreadProcessId` `GetForegroundWindow` `BeginPaint` `EndPaint` `EnableWindow` `IsWindowEnabled` `SetFocus` `BringWindowToTop` `TranslateMessage` `LoadIconW` `FindWindowW` `ChangeWindowMessageFilterEx` `LoadCursorW` `SetClipboardData` `GetClientRect` `DrawTextW` `CharUpperBuffW` `KillTimer` `PostQuitMessage` `SystemParametersInfoW` `RegisterWindowMessageW` `PtInRect` `UpdateWindow` `SetForegroundWindow` `LoadImageW` `InvalidateRect` `IsIconic` `ReleaseDC` `ScreenToClient` `GetCursorPos`
GDI32.dll	`BitBlt` `CreateCompatibleBitmap` `SelectObject` `CreateCompatibleDC` `CreateFontW` `GetStockObject` `DeleteDC` `SetTextColor` `SetBkMode` `LineTo` `CreatePen` `MoveToEx` `DeleteObject` `CreateSolidBrush` `RoundRect`
ADVAPI32.dll	`DeleteService` `GetSidSubAuthority` `GetSidSubAuthorityCount` `EventUnregister` `EventWriteTransfer` `EventSetInformation` `EventRegister` `RegQueryInfoKeyW` `RegEnumKeyExW` `RegEnumValueW` `LookupPrivilegeValueW` `AdjustTokenPrivileges` `RegCloseKey` `CryptAcquireContextW` `CloseServiceHandle` `OpenSCManagerW` `RegCreateKeyExW` `ControlService` `GetTokenInformation` `CryptReleaseContext` `RegQueryValueExW` `LookupAccountSidW` `CryptGetHashParam` `OpenServiceW` `QueryServiceConfigW` `RegGetValueW` `RegOpenKeyExW` `EnumServicesStatusExW` `OpenProcessToken` `CryptDestroyHash` `RegSetValueExW` `RegDeleteTreeW` `CryptHashData` `CryptCreateHash`
WINTRUST.dll	`WinVerifyTrust`
dwmapi.dll	`DwmSetWindowAttribute`
WS2_32.dll	`inet_pton` `inet_ntop` `ntohl`
dxgi.dll	`CreateDXGIFactory1`
api-ms-win-core-synch-l1-2-0.dll	`WakeByAddressAll` `WaitOnAddress`

Delayed Imports

1

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x3f6`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.724`
Detected Filetype	PNG graphic file
MD5	`577a036df2fc7ab096769508117d6396 🔍`
SHA1	`f64c1ff6c8b2d68a9e6e4cd58983f90193f80310 🔍`
SHA256	`27c7edec2e5f8459b27cb160e5d47c33f40112eb32b804d1b87ddd48a30ee269 🔍`
SHA3	`a39fffb56c30beb6f084353127bac164b7e599c7d334873b57c5cefcf4001499 🔍`

2

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x7f6`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.8605`
Detected Filetype	PNG graphic file
MD5	`22256577bd3744bd80b71f9c39d204fc 🔍`
SHA1	`bc3ae98f5fca018e7a68f135ffe29056119dfb8c 🔍`
SHA256	`d14cfe165d7bd59cb324e9ecf9312b5caa0d0fe0c456a6c4dc5329d2fe57ba2a 🔍`
SHA3	`b07f95c54e73d1ae5d54c0a3c2fd398e98cf1b324751b4d607fbe9a222a3f520 🔍`

3

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0xd79`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.9214`
Detected Filetype	PNG graphic file
MD5	`4a61430b323dd8206dd8c2b3e9bb7f0e 🔍`
SHA1	`f60c44261b1ee5cddf6f93ce9fe72e5bc9bf6660 🔍`
SHA256	`19db0933bddf0227acacce546fd67a4c6842610d5d33db9ff0d1569dee1ed109 🔍`
SHA3	`24d993d707901c011bd148e0bb642bdf6eecc1505d77dbf4ece399b81a2e0ab7 🔍`

4

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x1caf`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.95664`
Detected Filetype	PNG graphic file
MD5	`8e29c05e76b6291ef610e436313312a2 🔍`
SHA1	`3a3cb91bf01cc0ac5af0f24ef5fe5cd451389271 🔍`
SHA256	`8ed1d2d4c84549b37bbcce684b3cae04126eec3e4d2737ccf9dcf28bab900ab3 🔍`
SHA3	`442c854b7a2966715908e48cdcfa37f0d95aa4606afd10ab6c3b549daaf82be4 🔍`

5

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x30fb`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.97466`
Detected Filetype	PNG graphic file
MD5	`595bb78579b49f6e046244b3964e66ab 🔍`
SHA1	`005abd9f07f8bea137ab4790d4b3eebc540582bb 🔍`
SHA256	`c2fa43ffbca670836c03ead29f4f3f0c655c85c9fde637005bc25dff1cfd18c8 🔍`
SHA3	`26b4bc6396bb0645e058051e5ba497030cb7ef3a2c7bdb365c6d59ef68d72c41 🔍`

6

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0xb2d5`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.9882`
Detected Filetype	PNG graphic file
MD5	`8a05b9c9ffed59f35041513c089e8a32 🔍`
SHA1	`03f1c8d4216b873dd7dbb3878120a3f6c048295c 🔍`
SHA256	`fd72f1ce50016e162312c0ac96e60a8025df2fb58d0ca1f9a3cfd40aea33f2a9 🔍`
SHA3	`d4ff87f5f4ad4f4508cf2ba1dc351743d2547ae005691e34b20fa7e731221aca 🔍`

7

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x2938e`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.98081`
Detected Filetype	PNG graphic file
MD5	`cc8a1b3888700f7924d307f585ca619b 🔍`
SHA1	`4ff9c2b4ebdcb5486e2abbe84315d2321e77465d 🔍`
SHA256	`92bac01ebd76a40a4bf4a6e9d837d4d2f25b52da24dabd4bf5dbc66411c8a011 🔍`
SHA3	`4bc78ad5b98b6c4a86e37fd6e3acde213718e8765a9e99150cbd9c55e3146264 🔍`

101

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x2404fc`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99119`
Detected Filetype	PNG graphic file
MD5	`674d13b58a8400f83577db5f92d6fabc 🔍`
SHA1	`8e623a3c469b60c833153317cb4d02cbf2f4e857 🔍`
SHA256	`04c6e073ddb1b7526dc71214fa6fdfbe8fdd1254b552cd5d63a6b77332e453e3 🔍`
SHA3	`3666e0851b75f8bfc7945f5884322be48c254052a44cf24ade5da9147bce49dc 🔍`

102

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x32730`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.97732`
Detected Filetype	JPEG graphic file
MD5	`5105d4a20dac004af7f1effa39ede1b6 🔍`
SHA1	`498ac5264838983e7ab4fc3c0ca73cb94516a9ca 🔍`
SHA256	`77575e30e2c84704564c7d5dde184dc30444a0818a2084855051bc6f1c1211db 🔍`
SHA3	`84e3ad5997c402d8b8a06f3217d0f181091705ad091c96c083177b0c2bb1ff60 🔍`

103

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x2f48d`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.97584`
Detected Filetype	JPEG graphic file
MD5	`666982443fdf84a84dc91718c28ae2e4 🔍`
SHA1	`90a25464f129c5bfbce9d97a7c30a6cadfe944cb 🔍`
SHA256	`f018a89d3768a9e8ec9f112d2a9cdcd8fc905da9ff58e0c91c229acb229bb8a1 🔍`
SHA3	`52d55176caf1ed6be9759b999d651d157628b54eccc3212317923ecbf6690a60 🔍`

104

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x253d91`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96242`
Detected Filetype	PNG graphic file
MD5	`2241c6056a54eb0edbefc7739ea3a59f 🔍`
SHA1	`65f42aea30dd08584be6af1cc423bcc853939aef 🔍`
SHA256	`5e2fa3fea36bdaa9372fd984bbbd319fcc5bb402aecdeaa3819d6f565c10de43 🔍`
SHA3	`cb6e78a14401cec5550de5c364678259afe3606b0d03e9e09b04d9ad69538f0d 🔍`

105

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x3fc6e`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.97111`
Detected Filetype	JPEG graphic file
MD5	`378982490844820fb0d836492beb10a1 🔍`
SHA1	`bdae9a341e0ae8acb5d83ebfec022af657eaf3c0 🔍`
SHA256	`44c5a970e4bad05ebfc6663dd2139fa6739283ed0e89bd83185b9c3db2f313c5 🔍`
SHA3	`333a1e16da8b37933d48b6f15864c8b408526105fb4ea35bf053e79300d37876 🔍`

106

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x2e415`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.9728`
Detected Filetype	JPEG graphic file
MD5	`c2f62df926d0d80cffc65c8aa16ee6a5 🔍`
SHA1	`99b8fc2cdb7f667a48d5e5dfcf2b627227dc65b5 🔍`
SHA256	`6bffcd3df1f30cacb8da7a022d4f1484571c81932f98d2ab0040d230c5287dbe 🔍`
SHA3	`fa713f89f0d8d02c20be9c3cafdfc87d91a3c79f46395942319c786524ea6c0d 🔍`

107

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x28b77a`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.97248`
Detected Filetype	PNG graphic file
MD5	`7a6aad2ebbc9691dcb46cd757bbf3c6e 🔍`
SHA1	`cfdeed34706b75b238b8f49ea8c1fcea012c0d2a 🔍`
SHA256	`75d9fc2401918efaf38c92b6c7c5ea2ed3c3a283544b1ca4a765e6ed26acb260 🔍`
SHA3	`96bb8e64d6c11dc64cc8e2ac3ad13d37e34d3cdc025e8452e90800b6d94f4b90 🔍`

108

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x1aca61`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99335`
Detected Filetype	PNG graphic file
MD5	`a7233e750193b63d23cfe572bccfd9dc 🔍`
SHA1	`d6498a4195474183598d1bdc3bf0c1ff131975c8 🔍`
SHA256	`5d8137136df1a04874b19a574f40163f6455c607787b875c2d6516e9beb2ddeb 🔍`
SHA3	`6a73bbdfa639b3f135af559a67a36ff88f10cc496b0ceda4cc741a76ba50c5af 🔍`

109

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x4c62`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.82149`
Detected Filetype	PNG graphic file
MD5	`78c67376c30994c7dd6ecebbc18f66ac 🔍`
SHA1	`3f24528ef1c919b534fd412bc3eec7eae94c57b0 🔍`
SHA256	`59d540dbb337d642eb7157132da588b8eb9dc09c9ab2ece12c59c6a62b80cf05 🔍`
SHA3	`1599f3a9bb0f54f114ebb14e910526cf72e6d17adbfea3b022cee7d0a6c851b4 🔍`

110

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x20ccb7`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99153`
Detected Filetype	PNG graphic file
MD5	`2d685bb3f41b29900447c32f53c6142c 🔍`
SHA1	`3ca327b59f2394b1a3d0a01af1d35e0e75fc4129 🔍`
SHA256	`1641ccb22af514baf9fcf8313de4db36d9861536b4a91234ccbbcd7789c458b3 🔍`
SHA3	`e8ba6d9000b8784e3565e952a11bf8e059c4d593839b51cb0cc6e3d394400fd4 🔍`

111

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x1ef668`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99196`
Detected Filetype	PNG graphic file
MD5	`b7c6f5a9f1ce1c4f724be772afc25330 🔍`
SHA1	`6e2f8488ab640a1fab67adeab6a3918ec939adcb 🔍`
SHA256	`3c06cde20fa8ad0bc9ae617057978e69e1d1989320c151fd546e65e4a8751869 🔍`
SHA3	`215f8ceb303c0adfa2ab5e14f392b5f3f4f66ca39f4f60d6330753ec1b4d0e42 🔍`

112

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x42237`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.97149`
Detected Filetype	JPEG graphic file
MD5	`f4c996e809af5dafc48a4142b4540fee 🔍`
SHA1	`5c92c7af2c0bb9925059f03644c450bff6e9712e 🔍`
SHA256	`db0bedccfe38e3ce8add7ee2cdd58fe1ea75f3149df2d9cdc5e29396b22043fb 🔍`
SHA3	`57b5ca9fd811eccc2d373157e014337a47c3887f0e8d7cd7750452128ac42499 🔍`

113

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x4124e`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.85702`
Detected Filetype	JPEG graphic file
MD5	`2f628a0c4a99bc38c24e19338c3e4368 🔍`
SHA1	`a972dcae5d54fef002709d54fd23f11f86b5bef3 🔍`
SHA256	`820446b79d2fb0abd1488627dc503283325d749e14e8f26bf14f031f86b8b859 🔍`
SHA3	`24d990b5b67ec1e0ed6af9543e5b272f2b6925471fdf3ade91c65188d5dbb966 🔍`

114

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x2012e8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.9951`
Detected Filetype	PNG graphic file
MD5	`0352258a9c12859cf032b6d666a2326a 🔍`
SHA1	`38acd3eaedd9c72da806170ba020d051276185b1 🔍`
SHA256	`1095b86adefadf52d39557200aedda987af1b4706d97941535ebd90b387b9f91 🔍`
SHA3	`f7c5e86cd40a079bf525063b8be278a135e92c1892271d2faa36632d77241677 🔍`

301

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x5b8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.78992`
MD5	`f2dfc7d7fecf574b12e819046b85fb81 🔍`
SHA1	`5e9d4bde9d4970b36bd87ecccc4c4684d7871142 🔍`
SHA256	`3d1e292171594cbd140998f774cd4aec7253826dec00a6ff8f2c0a4c18a90aa4 🔍`
SHA3	`063e796361c9b566f8625fa03554c1597c2dd34ed2ca049491b7d84e00a5accd 🔍`

302

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x7134`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.05483`
MD5	`d5aa824fe0e53ddf6d8607287f561f5d 🔍`
SHA1	`3843fdfbb764618f7d83a868ba310cedd66ca35c 🔍`
SHA256	`2403762e722790db7d6f343f81a2cd48aff08c894c708958926d76f4db6e9d44 🔍`
SHA3	`d03495bcc33e0a696bbca88f81158b21e114e76cb255c82862f04eac250531d2 🔍`

303

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x95fa`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.85911`
MD5	`598056340b332ed9ecacc27712be88f7 🔍`
SHA1	`5a0a4791d8bea8f1d3540d9a509ac3ea15af84c2 🔍`
SHA256	`cb82333aec088cb5f7796a2842bca9637e722c47e56857aad425484a9d36c7f8 🔍`
SHA3	`ebe745114f229690461a06dd229c7bd1bcf2fc4896ae30e41538d44cf99ef4fd 🔍`

304

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0xc164`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.10315`
MD5	`7ffce42d2a6e92b3b79a960f4cff26b5 🔍`
SHA1	`94f95174cde5201b772108b857eefcab50fac6bd 🔍`
SHA256	`92c7200eb0fdef4b9fece650dd6ac0034ffae8700bc44663c5af8a52109dc99d 🔍`
SHA3	`aee84fb0c0d0b6a565c4c2339098f23280f2304540d21923c5fdf1d34a06e449 🔍`

305

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0xcb3a`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.24569`
MD5	`2ee7584da4d0bae8f2e12154addf1e34 🔍`
SHA1	`22ae454643f2b5920e5c450762cc0d293c1dbb0a 🔍`
SHA256	`e2b2cf56686a5972939aceeedfa4b8944863dc0e70ae2ee052bc6386497cc4e0 🔍`
SHA3	`835d6c5feb941ca549e65bfd963b7175e0671393084136d07aafcfb4d45e8629 🔍`

306

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x71f0`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.7835`
MD5	`be3a484570ca072538e1385f907e619f 🔍`
SHA1	`600ac107004c0af6d56c67bc4fa099c5178c8c35 🔍`
SHA256	`ea76085ca52069c4ec79965c73cae0a8aa94c0d4d07b63d53d27b557cb84d13c 🔍`
SHA3	`99e396e96b4253a6f8a979c69ba2148bf56db9fa9eac28e11baa796aa6a6d85a 🔍`

307

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0xd97e`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.40685`
MD5	`f2f967c47b276c8e7f6728406cea0a64 🔍`
SHA1	`51a6240d10635a81d11106a06fbef572e7342167 🔍`
SHA256	`80b5445657c1f34d1ab595702307e443ccbcc65606e2fe216297f3a5640b2840 🔍`
SHA3	`8ca56934817833786601eb22bb07ffc59fd72e48364c1acbd52e26380186cc85 🔍`

308

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x4a35`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.48123`
MD5	`76f7eea9675f330df63641eb1e429f67 🔍`
SHA1	`5aa1b60f89acf51f401d8def0e5a7252183d1d91 🔍`
SHA256	`b84170e163e5869c5a4844745ebd6ab3ef0cd89402b7c7ce1d8a30c460e3e7bc 🔍`
SHA3	`107673bc69d32c5b6f149466ee083074f13bfb0a06141a3baca57e2c20cb4c9c 🔍`

309

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x1fef3a`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.85413`
Detected Filetype	MP3 file with ID3 identity tag
MD5	`12e70eb76290ccec446f208fd774d38a 🔍`
SHA1	`dba8f679be234933248da0897a1a0e587751d2ba 🔍`
SHA256	`d031ff8e4f59bcced6bfc04b30ec4be20cdb1c14ae9ae039126f05cef91edf5b 🔍`
SHA3	`1c3bfa14c98a2598e291b3fdecdec5a0f4b026e912c41ce8be655857e9475088 🔍`

310

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x57a5`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.95431`
Detected Filetype	JPEG graphic file
MD5	`0a5660a5004c06eb97c78f1060edae3c 🔍`
SHA1	`6d68469e0bd2b6369ea9fa8dc7370b1eeec98dd3 🔍`
SHA256	`8e8533ce0176fe87ed89e85ea2e5375443313b72e844a85c5283230fe893e955 🔍`
SHA3	`3440af33e1905d2e95eda292451ce4df12272e0883c7146eeb1a9f76031eddc5 🔍`

311

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x4571`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.97058`
Detected Filetype	JPEG graphic file
MD5	`0ae07a21e5af21c844eb0a60ec7468f2 🔍`
SHA1	`6464b551c0d9206a7c753ea05767a1b33f00281c 🔍`
SHA256	`bf34104e9ed65dff542c1c2b282e02f7a46c44692e961376ac3084418cd7d665 🔍`
SHA3	`47ab1bcc73cdd9133e461a690d0d0e198e53e3554a1b7d54fb01eff1e3f2d5bc 🔍`

312

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x5471`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.97296`
Detected Filetype	JPEG graphic file
MD5	`226d3bb4fa8a1abf9152ab3c39d8d32b 🔍`
SHA1	`ef61d118a140c1fc8615b119b2ee7232150e42ff 🔍`
SHA256	`b4a7220bdbe80568c17812683b8adb134c932b792b49030c2dad0e955846f38d 🔍`
SHA3	`3851315da5cca961fd8ea49940ce9c701ad00f55412ae3e3fa605aad679cf0c2 🔍`

313

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x6441`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96859`
Detected Filetype	JPEG graphic file
MD5	`60fa1ce7be22120abe2fdd07639e8761 🔍`
SHA1	`1cc985ddf16ad4d8cea68bff8dd0de7547aa5a05 🔍`
SHA256	`2af21a988f2ff76cc9dce341eba9fd74824dc9c1a5bc38627d489638ce64da1d 🔍`
SHA3	`fc965420eade5822c00aec84d9893d75489708d9a3ebdb3791694b7207cefc6b 🔍`

314

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x666f`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96338`
Detected Filetype	JPEG graphic file
MD5	`e48ae61a88151cb9e6e3ad7254d30e6d 🔍`
SHA1	`085a0367fb0df3b5b9c510610d5a69cedbe850e3 🔍`
SHA256	`c8b4aa553c900fb36d9ef9ae42a4c8834f62acb6b7dfab7c0ca36416aad6f5f5 🔍`
SHA3	`1f4711a0035b739d33c4502017c74e83146921d0cbdb2c855c9a301387db282b 🔍`

315

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x4085`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96585`
Detected Filetype	JPEG graphic file
MD5	`8e4c4624c19f56dda7776e06419fa2af 🔍`
SHA1	`a5cf6ad30e56ca5fe1c49e007536227be8814240 🔍`
SHA256	`1e9b93cc17aefda5197eee4be68af81a8b68ed1cb83306ee8e22623af5850a79 🔍`
SHA3	`fecd8c9b7b076d620cfa384a502a4db57c713688f3217c3ff9902c8acbfb0a0e 🔍`

316

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x526c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.97079`
Detected Filetype	JPEG graphic file
MD5	`572b81565ed6bbe9ed7b6baabcb9710a 🔍`
SHA1	`4f31245e83f7998e6f296dea3f9787df0268f39f 🔍`
SHA256	`e869977f6250032d852060f314bef60dd06793f998370f0902b00969143a2f08 🔍`
SHA3	`c240d20c54e99e733787c264d4ae2403610abac4a4b83f98ad5b0daab21dd097 🔍`

317

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x54aa`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96866`
Detected Filetype	JPEG graphic file
MD5	`58c1e25e2185def9b9906a55b8a88647 🔍`
SHA1	`749b7f928d1dfd0262d34d0075bf3eaf5a5f4bb5 🔍`
SHA256	`2e252f923944ac2f65b87327487d61d858f132b322f818bfc822d46bf37e7fbd 🔍`
SHA3	`4cdaf0071ffc2c75661cf3c933de751c2c8b6dd09c4c45404027c41facbe4e30 🔍`

318

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x667f`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96539`
Detected Filetype	JPEG graphic file
MD5	`075678a3704576da7c0a737e98279358 🔍`
SHA1	`a40de7b7897b0bf42978b3ab439a4488bd4fc8a9 🔍`
SHA256	`3542e80bab17dbb353082612995f592b9aa98ae33e7e2eca86a1673b9bcbc076 🔍`
SHA3	`6cdef7eed47a9954105ce418eff80eb279d5c630495ff2ab07eda4236a8735fa 🔍`

319

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x5a18`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96346`
Detected Filetype	JPEG graphic file
MD5	`4008329d7de7684f91773b245c7d55c5 🔍`
SHA1	`5e1324421f1a189a8540303a94ccc6be7bf65868 🔍`
SHA256	`565be31837731e0787aa46d808e29f65f74a1f7bea6c171bd2ba6fbaf836d260 🔍`
SHA3	`014b5b473aa6d0946d11e45b51dac4946df056306a464e0e5bd1a872d99df3a7 🔍`

320

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x5563`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.97257`
Detected Filetype	JPEG graphic file
MD5	`c46f2223aeab76f4bd4e2453db9e1e23 🔍`
SHA1	`02ff44edf70e87783fc961ada4d03024aa918bfb 🔍`
SHA256	`363fde38c2ba3f0c4b52fafee42e5d6d32292e23a334573f00790b24371f60ce 🔍`
SHA3	`b907f1a897ad3dab93170252879c8de5bfb90ad6122ad0d8895fcf54e53f4ca1 🔍`

321

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x418f`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.97022`
Detected Filetype	JPEG graphic file
MD5	`39adcbcba9357ab0ebe34f0d21e10ca5 🔍`
SHA1	`f7fc6b64bf7d8c49ac8e4bb0dbf8316f3679b649 🔍`
SHA256	`c4326b2fba19f3ee3a3376f9c1aea2a614fd03bc0e6053066ead58859d634ea2 🔍`
SHA3	`8a06c107e457e96a6c69a88381e406c9ca865f626f9fa0cc2476350c78c39821 🔍`

322

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x4e53`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96914`
Detected Filetype	JPEG graphic file
MD5	`bd2be40cf5ba4ed915c87ec8f5a63dcb 🔍`
SHA1	`b1c4e0831f40bc3f5c5dd8b4180bd8b12b8c0036 🔍`
SHA256	`17de59c2c685eb9ce38e2528402649c60338c2df75137cd7e179fed90727ca86 🔍`
SHA3	`4d2a9d2b86abb82e1214e59f3a5e1c4a192eb2cb2afbe7e2c71c08791ef8e8c5 🔍`

330

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x15ff8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99722`
MD5	`de2f1fe81758075f50ed6ce1e8e238ed 🔍`
SHA1	`258a93fe93ae4cd277dde1da554e5cc2c7728f2c 🔍`
SHA256	`e3a28eade21a900c7155a247757f4b2834c07bb7ef07ad7efa55cebaac1e8f5e 🔍`
SHA3	`1c8307a1b892a22fca185c25c56b73529f0a7683256037f31b0c3e69a5caca48 🔍`

331

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x66e0`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.9909`
MD5	`4cd478824d6eb7ebc1772ec8fb75208f 🔍`
SHA1	`052bc39584418be2fc07f184aa18cc753eede8b4 🔍`
SHA256	`c00775f8ecb034b6c193c7b253d698cfe882a1d6c0df67299a3d5382c2e82216 🔍`
SHA3	`b8a1ac127e52ffd479319d4916bd14817bf6ace4551f6eeee67c563b81815c1c 🔍`

332

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x1124`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.9736`
MD5	`f77a6739188f623654c0a7ad6c11f82b 🔍`
SHA1	`35d54efe9577f2057e8bdb5f77ec50e21fd0c09c 🔍`
SHA256	`108b4e57c9c796d3d38d0428ca7ee39de47ad93187302718d9b2d8864b9b716b 🔍`
SHA3	`4e26618da6f621850336f7b96a47f2490061cd61ab7e9635faeca37c12b40540 🔍`

333

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x1121`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.97446`
MD5	`9e202679ebd39badca87c6a6a33cbfc6 🔍`
SHA1	`e11c3296d042082f50f107ddc3b766695194051f 🔍`
SHA256	`c9b69fa18c372df2b187b49efc57b1ea643b86a938e5af32f6b5a7af1017c891 🔍`
SHA3	`cc563a9682e47fd7697e0dc9230de1f0cfdf8405ac4f5309ad3aa20e64043c6d 🔍`

201

Type	`RT_GROUP_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x68`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.93763`
Detected Filetype	Icon file
MD5	`e26852566a8453c68efef03343dd81da 🔍`
SHA1	`833e3ef6079a710ee7b79c947853bb3a74854ef6 🔍`
SHA256	`491ecdb89791ed45f324dd39c3e7a59fe7a49e94a015ee6706a2467cf3bfcb3b 🔍`
SHA3	`4e5e910070bc1720271e51bb882d89bbd97baf38d0c32aaf445bb87efd56a8db 🔍`

1 (#2)

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x188`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.89623`
MD5	`b8e76ddb52d0eb41e972599ff3ca431b 🔍`
SHA1	`fc12d7ad112ddabfcd8f82f290d84e637a4d62f8 🔍`
SHA256	`165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8 🔍`
SHA3	`37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd 🔍`

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2026-Oct-17 15:34:51
Version	`0.0`
SizeofData	`107`
AddressOfRawData	`0x172f64`
PointerToRawData	`0x171564`
Referenced File	C:\Users\Grandpa\Documents\VexOS\VexOS-Loaders\Loader\x64\Release\VexOS-Loader.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics	`0`
TimeDateStamp	2026-Oct-17 15:34:51
Version	`0.0`
SizeofData	`20`
AddressOfRawData	`0x172fd0`
PointerToRawData	`0x1715d0`

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2026-Oct-17 15:34:51
Version	`0.0`
SizeofData	`1164`
AddressOfRawData	`0x172fe4`
PointerToRawData	`0x1715e4`

IMAGE_DEBUG_TYPE_ILTCG

Characteristics	`0`
TimeDateStamp	2026-Oct-17 15:34:51
Version	`0.0`
SizeofData	`0`
AddressOfRawData	`0`
PointerToRawData	`0`

TLS Callbacks

StartAddressOfRawData	`0x1401734b8`
EndAddressOfRawData	`0x1401734c0`
AddressOfIndex	`0x14019a788`
AddressOfCallbacks	`0x14013f118`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_4BYTES`
Callbacks	`(EMPTY)`

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x140190140`

RICH Header

XOR Key	`0xdd841d4e`
Unmarked objects	`0`
C++ objects (33145)	`181`
Imports (VS2008 SP1 build 30729)	`2`
C objects (35721)	`16`
ASM objects (35721)	`10`
C++ objects (35721)	`100`
ASM objects (33145)	`20`
C objects (33145)	`27`
C objects (CVTCIL) (33145)	`2`
Imports (33145)	`43`
Total imports	`465`
Unmarked objects (#2)	`7`
C++ objects (LTCG) (36260)	`7`
Resource objects (36260)	`1`
151	`1`
Linker (36260)	`1`

Errors

Leave a comment

No comments yet.