{ "474a431cac552c61e9990dcadc4c079df0e23afe39d84d5ec4a683995540ae6e": { "DOS Header": { "e_magic": "MZ", "e_cblp": 144, "e_cp": 3, "e_crlc": 0, "e_cparhdr": 4, "e_minalloc": 0, "e_maxalloc": 65535, "e_ss": 0, "e_sp": 184, "e_csum": 0, "e_ip": 0, "e_cs": 0, "e_ovno": 0, "e_oemid": 0, "e_oeminfo": 0, "e_lfanew": 320 }, "Debug Info": { "IMAGE_DEBUG_TYPE_CODEVIEW": { "Characteristics": 0, "TimeDateStamp": "2018-Feb-24 10:01:43", "Version": "0.0", "SizeofData": 129, "AddressOfRawData": 7043580, "PointerToRawData": 7037436, "Referenced File": "C:\\Users\\Admin\\Documents\\Visual Studio 2017\\Projects\\Koinonein\\Build x64\\Koinonein BitTorrent Client.pdb" }, "IMAGE_DEBUG_TYPE_VC_FEATURE": { "Characteristics": 0, "TimeDateStamp": "2018-Feb-24 10:01:43", "Version": "0.0", "SizeofData": 20, "AddressOfRawData": 7043712, "PointerToRawData": 7037568 }, "IMAGE_DEBUG_TYPE_POGO": { "Characteristics": 0, "TimeDateStamp": "2018-Feb-24 10:01:43", "Version": "0.0", "SizeofData": 1088, "AddressOfRawData": 7043732, "PointerToRawData": 7037588 }, "IMAGE_DEBUG_TYPE_ILTCG": { "Characteristics": 0, "TimeDateStamp": "2018-Feb-24 10:01:43", "Version": "0.0", "SizeofData": 0, "AddressOfRawData": 0, "PointerToRawData": 0 } }, "Delayed Imports": { "Attributes": 1, "Name": "USER32.dll", "ModuleHandle": 8051568, "DelayImportAddressTable": 8007656, "DelayImportNameTable": 7817520, "BoundDelayImportTable": 7818824, "UnloadDelayImportTable": 0, "TimeStamp": "1970-Jan-01 00:00:00" }, "Hashes": { "MD5": "14f7fba279e4040cd28ee35b7caefdb2", "SHA1": "bb7466eb0e23cbc306595834f10ad3b65d06da25", "SHA256": "474a431cac552c61e9990dcadc4c079df0e23afe39d84d5ec4a683995540ae6e", "SHA3": "92f73faa7fae9ae8e36cea86d210affe244561c3952a59b494e5b1ac9f1d65e4", "SSDeep": "98304:m6JCFl1jVOLFuEvg4wb7bP3SWzZLDEYq+r:m6Js1jVOLFEbP3zNu+r", "Imports Hash": "96f079e82ec1bc1c5b3c390e2639b4e0" }, "Image Optional Header": { "Magic": "PE32+", "LinkerVersion": "14.0", "SizeOfCode": 4903936, "SizeOfInitializedData": 3728384, "SizeOfUninitializedData": 0, "AddressOfEntryPoint": "0x00000000003E90E0 (Section: .text)", "BaseOfCode": 4096, "ImageBase": 5368709120, "SectionAlignment": 4096, "FileAlignment": 512, "OperatingSystemVersion": "6.0", "ImageVersion": "0.0", "SubsystemVersion": "6.0", "Win32VersionValue": 0, "SizeOfImage": 8646656, "SizeOfHeaders": 1024, "Checksum": 0, "Subsystem": "IMAGE_SUBSYSTEM_WINDOWS_GUI", "DllCharacteristics": [ "IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE", "IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA", "IMAGE_DLLCHARACTERISTICS_NX_COMPAT", "IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE" ], "SizeofStackReserve": 1048576, "SizeofStackCommit": 4096, "SizeofHeapReserve": 1048576, "SizeofHeapCommit": 4096, "LoaderFlags": 0, "NumberOfRvaAndSizes": 16 }, "Imports": { "CRYPT32.dll": [ "CertDuplicateCertificateContext", "CertFindCertificateInStore", "CertEnumCertificatesInStore", "CertCloseStore", "CertFreeCertificateContext", "CertGetCertificateContextProperty", "CertOpenStore" ], "WSOCK32.dll": [ "#6", "#12", "#111", "#14", "#8", "#7", "#115", "#15", "#16", "#19", "#116", "#1", "#2", "#3", "#4", "#13", "#21", "#23", "#151", "#18", "#1141", "#1142", "#5", "#9", "#112" ], "WINMM.dll": [ "PlaySoundW" ], "IPHLPAPI.DLL": [ "NotifyAddrChange", "CancelIPChangeNotify", "GetAdaptersAddresses" ], "dbghelp.dll": [ "SymInitialize", "SymFromAddr", "SymRefreshModuleList", "StackWalk64", "SymFunctionTableAccess64", "SymGetLineFromAddr64", "SymGetModuleBase64", "UnDecorateSymbolName" ], "ADVAPI32.dll": [ "CryptSetHashParam", "RegCreateKeyExW", "RegSetValueExW", "RegCloseKey", "RegQueryValueExW", "OpenProcessToken", "LookupPrivilegeValueW", "CryptGenRandom", "CryptEnumProvidersW", "CryptSignHashW", "CryptDestroyHash", "CryptCreateHash", "CryptDecrypt", "CryptExportKey", "CryptGetUserKey", "CryptGetProvParam", "RegOpenKeyExW", "CryptDestroyKey", "CryptReleaseContext", "CryptAcquireContextW", "ReportEventW", "RegisterEventSourceW", "DeregisterEventSource", "RegDeleteValueW", "RegGetValueW", "AdjustTokenPrivileges" ], "ole32.dll": [ "PropVariantClear", "OleRun", "OleInitialize", "CoTaskMemAlloc", "OleUninitialize", "StringFromGUID2", "CoTaskMemFree", "CoCreateInstance" ], "KERNEL32.dll": [ "GetTimeFormatW", "EnumSystemLocalesW", "GetDateFormatW", "GetConsoleCP", "GetACP", "ExitThread", "SetConsoleCtrlHandler", "RtlUnwindEx", "GetTimeZoneInformation", "FlushFileBuffers", "GetExitCodeProcess", "CreateProcessA", "IsValidLocale", "SetStdHandle", "FindFirstFileExW", "IsValidCodePage", "GetOEMCP", "GetCommandLineA", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "SetEnvironmentVariableA", "WriteConsoleW", "GetSystemTime", "SystemTimeToFileTime", "VirtualQuery", "LoadLibraryExA", "PeekNamedPipe", "SystemTimeToTzSpecificLocalTime", "GetUserDefaultLCID", "QueryDepthSList", "InterlockedFlushSList", "InterlockedPushEntrySList", "InterlockedPopEntrySList", "ReleaseSemaphore", "VirtualFree", "VirtualProtect", "VirtualAlloc", "GetVersionExW", "LoadLibraryExW", "FreeLibraryAndExitThread", "UnregisterWait", "SetThreadAffinityMask", "GetProcessAffinityMask", "GetNumaHighestNodeNumber", "DeleteTimerQueueTimer", "GetModuleFileNameW", "GetLastError", "TlsAlloc", "GetFileAttributesA", "GetDynamicTimeZoneInformation", "GetCurrentThreadId", "WideCharToMultiByte", "MultiByteToWideChar", "GetProcAddress", "FreeLibrary", "LoadLibraryW", "DeleteFileW", "SetThreadExecutionState", "TlsFree", "GetModuleHandleW", "InitializeCriticalSection", "DeleteCriticalSection", "SizeofResource", "LockResource", "LoadResource", "FindResourceW", "EnterCriticalSection", "LeaveCriticalSection", "OutputDebugStringW", "VerifyVersionInfoW", "VerSetConditionMask", "DeleteTimerQueueEx", "ExitProcess", "CreateTimerQueue", "CreateTimerQueueTimer", "GetTempPathW", "HeapDestroy", "HeapSize", "HeapReAlloc", "HeapFree", "HeapAlloc", "GetProcessHeap", "FindResourceExW", "AllocConsole", "GetStdHandle", "SetConsoleCursorInfo", "SetConsoleTextAttribute", "SetConsoleTitleW", "FormatMessageW", "LocalFree", "GetModuleHandleExW", "K32GetModuleInformation", "GetCurrentProcess", "K32GetModuleFileNameExA", "GetBinaryTypeW", "GetModuleFileNameA", "GetVolumeInformationW", "CreateDirectoryW", "CreateDirectoryA", "GetLogicalDrives", "GetCommandLineW", "CreateEventW", "CloseHandle", "AddVectoredExceptionHandler", "SetUnhandledExceptionFilter", "OutputDebugStringA", "CreateMutexW", "SetEvent", "InitializeCriticalSectionEx", "RaiseException", "DecodePointer", "FormatMessageA", "CreateFileA", "GetFileSize", "MapViewOfFile", "UnmapViewOfFile", "CreateFileMappingA", "SetLastError", "QueryPerformanceCounter", "QueryPerformanceFrequency", "GetCurrentThread", "GetThreadTimes", "GetFileType", "WriteFile", "SwitchToFiber", "DeleteFiber", "CreateFiber", "GetSystemTimeAsFileTime", "ConvertFiberToThread", "ConvertThreadToFiber", "GetCurrentProcessId", "GetTickCount", "GlobalMemoryStatus", "GetEnvironmentVariableW", "GetConsoleMode", "ReadConsoleA", "ReadConsoleW", "SetConsoleMode", "RtlCaptureContext", "CreateIoCompletionPort", "GetQueuedCompletionStatus", "PostQueuedCompletionStatus", "InitializeCriticalSectionAndSpinCount", "WaitForSingleObject", "SetWaitableTimer", "WaitForMultipleObjects", "QueueUserAPC", "TerminateThread", "TlsGetValue", "TlsSetValue", "VerifyVersionInfoA", "GetFileAttributesExW", "SleepEx", "CreateWaitableTimerA", "Sleep", "GetDriveTypeW", "CreateFileW", "GetFileInformationByHandle", "RemoveDirectoryW", "CopyFileW", "CreateHardLinkW", "FindClose", "FindFirstFileW", "FindNextFileW", "GetFileSizeEx", "ReadFile", "SetEndOfFile", "SetFilePointerEx", "DeviceIoControl", "GetOverlappedResult", "CreateEventA", "LoadLibraryA", "CancelIo", "ReleaseMutex", "GetModuleHandleA", "UnregisterWaitEx", "RegisterWaitForSingleObject", "GlobalMemoryStatusEx", "GetSystemInfo", "TryEnterCriticalSection", "DuplicateHandle", "WaitForSingleObjectEx", "GetExitCodeThread", "GetStringTypeW", "RtlPcToFileHeader", "EncodePointer", "CompareStringW", "LCMapStringW", "GetLocaleInfoW", "GetCPInfo", "GetCurrentDirectoryW", "GetFileAttributesW", "GetFullPathNameW", "MoveFileExW", "AreFileApisANSI", "IsDebuggerPresent", "ChangeTimerQueueTimer", "GetLogicalProcessorInformation", "GetThreadPriority", "SetThreadPriority", "CreateThread", "SwitchToThread", "SignalObjectAndWait", "GetStartupInfoW", "IsProcessorFeaturePresent", "TerminateProcess", "UnhandledExceptionFilter", "RtlVirtualUnwind", "RtlLookupFunctionEntry", "ResetEvent", "InitializeSListHead", "FileTimeToSystemTime" ], "WS2_32.dll": [ "WSARecvFrom", "WSASocketW", "WSASend", "WSARecv", "WSACreateEvent", "freeaddrinfo", "getaddrinfo", "WSAStringToAddressW", "WSAAddressToStringW", "WSASendTo", "WSAIoctl" ], "wlanapi.dll": [ "WlanEnumInterfaces", "WlanFreeMemory", "WlanQueryInterface", "WlanOpenHandle" ], "USER32.dll (delay-loaded)": [ "SetWindowTextW", "IsWindowVisible", "GetWindowPlacement", "SetWindowPlacement", "SetWindowPos", "IsZoomed", "FindWindowW", "MessageBoxW", "ExitWindowsEx", "wsprintfA", "SendMessageW", "IsIconic", "SetWindowsHookExW", "UnhookWindowsHookEx", "IsWindow", "GetMessageW", "TranslateMessage", "DispatchMessageW", "GetPhysicalCursorPos", "RegisterClassExA", "CreateWindowExA", "DestroyIcon", "GetProcessWindowStation", "GetUserObjectInformationW", "GetWindowTextW", "DefWindowProcW", "ChangeWindowMessageFilterEx", "RegisterWindowMessageW", "GetWindowLongPtrW", "ShowWindow", "UpdateWindow", "SetWindowLongPtrW", "CreateWindowExW", "PostMessageW", "RegisterClassExW", "LoadCursorW", "SetForegroundWindow", "CallNextHookEx", "LoadIconW" ] }, "Load Configuration": { "Size": 256, "TimeDateStamp": "1970-Jan-01 00:00:00", "Version": "0.0", "GlobalFlagsClear": [], "GlobalFlagsSet": [], "CriticalSectionDefaultTimeout": 0, "DeCommitFreeBlockThreshold": 0, "DeCommitTotalFreeThreshold": 0, "LockPrefixTable": 0, "MaximumAllocationSize": 0, "VirtualMemoryThreshold": 0, "ProcessAffinityMask": 0, "ProcessHeapFlags": [], "CSDVersion": 0, "Reserved1": 0, "EditList": 0, "SecurityCookie": 5376580696 }, "PE Header": { "Signature": "PE", "Machine": "IMAGE_FILE_MACHINE_AMD64", "NumberofSections": 6, "TimeDateStamp": "2018-Feb-24 10:01:43", "PointerToSymbolTable": 0, "NumberOfSymbols": 0, "SizeOfOptionalHeader": 240, "Characteristics": [ "IMAGE_FILE_EXECUTABLE_IMAGE", "IMAGE_FILE_LARGE_ADDRESS_AWARE" ] }, "Plugins": { "strings": { "level": 2, "plugin_output": { "May have dropper capabilities": [ "CurrentVersion\\Run" ], "Miscellaneous malware strings": [ "cmd.exe", "exploit", "virus" ] }, "summary": "Strings found in the binary may indicate undesirable behavior:" }, "findcrypt": { "level": 1, "plugin_output": { "info_0": "Uses constants related to MD5", "info_1": "Uses constants related to SHA1", "info_2": "Uses constants related to SHA256", "info_3": "Uses constants related to SHA512", "info_4": "Uses constants related to AES", "info_5": "Uses constants related to Blowfish", "info_6": "Uses known Diffie-Helman primes", "info_7": "Microsoft's Cryptography API" }, "summary": "Cryptographic algorithms detected in the binary:" }, "imports": { "level": 3, "plugin_output": { "[!] The program may be hiding some of its imports": [ "LoadLibraryExA", "LoadLibraryExW", "GetProcAddress", "LoadLibraryW", "LoadLibraryA" ], "Functions which can be used for anti-debugging purposes": [ "SwitchToThread", "FindWindowW" ], "Can access the registry": [ "RegCreateKeyExW", "RegSetValueExW", "RegCloseKey", "RegQueryValueExW", "RegOpenKeyExW", "RegDeleteValueW", "RegGetValueW" ], "Possibly launches other programs": [ "CreateProcessA" ], "Uses Microsoft's cryptographic API": [ "CryptSetHashParam", "CryptGenRandom", "CryptEnumProvidersW", "CryptSignHashW", "CryptDestroyHash", "CryptCreateHash", "CryptDecrypt", "CryptExportKey", "CryptGetUserKey", "CryptGetProvParam", "CryptDestroyKey", "CryptReleaseContext", "CryptAcquireContextW" ], "Can create temporary files": [ "GetTempPathW", "CreateFileA", "CreateFileW" ], "Memory manipulation functions often used by packers": [ "VirtualProtect", "VirtualAlloc" ], "Leverages the raw socket API to access the Internet": [ "WSARecvFrom", "WSASocketW", "WSASend", "WSARecv", "WSACreateEvent", "freeaddrinfo", "getaddrinfo", "WSAStringToAddressW", "WSAAddressToStringW", "WSASendTo", "WSAIoctl" ], "Functions related to the privilege level": [ "OpenProcessToken", "AdjustTokenPrivileges" ], "Enumerates local disk drives": [ "GetVolumeInformationW", "GetDriveTypeW" ], "Interacts with the certificate store": [ "CertOpenStore" ], "Can shut the system down or lock the screen": [ "ExitWindowsEx" ] }, "summary": "The PE contains functions mostly used by malware." }, "virustotal": { "level": 2, "plugin_output": { "info_0": "This file has never been scanned on VirusTotal." }, "summary": "No VirusTotal score." } }, "RICH Header": { "XOR Key": 3699240884, "Unmarked objects": 0, "C objects (VS2017 v15.?.? build 25203)": 28, "ASM objects (VS2017 v15.?.? build 25203)": 14, "C++ objects (VS2017 v15.?.? build 25203)": 203, "199 (41118)": 1, "ASM objects (VS2015/2017 runtime 25810)": 12, "263 (VS2017 v15.?.? build 25203)": 1, "262 (VS2017 v15.?.? build 25203)": 2, "C objects (VS2015/2017 runtime 25810)": 42, "C++ objects (VS2015/2017 runtime 25810)": 137, "Imports (VS2017 v15.?.? build 25203)": 25, "Total imports": 392, "C++ objects (VS2017 v15.5.5 build 25835)": 150, "C++ objects (VS2017 v15.2 compiler 25019)": 31, "ASM objects (VS2017 v15.2 compiler 25019)": 1, "C objects (VS2017 v15.2 compiler 25019)": 520, "C++ objects (25508)": 8, "265 (VS2017 v15.5.5 build 25835)": 9, "Resource objects (VS2017 v15.5.5 build 25835)": 1, "151": 1, "Linker (VS2017 v15.5.5 build 25835)": 1 }, "Resources": { "1": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 4264, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 4.04057, "MD5": "970c5e5a399627b8a170243f4d75bd49", "SHA1": "69edcf33d18dc5110b583510d6e64685d6140df4", "SHA256": "cd78a171612d4d759262be90870e0743e645d3f8b33da74e84e0120ec4775ed4", "SHA3": "ee9e290726e0369e04112c9d567b5e295a333d3dd2dcc29fea5f4b4ee58ee69d" }, "2": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 744, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 3.25397, "MD5": "dcdd9d14f719fc283fdce2de1afc2427", "SHA1": "d1686d3debe1cb45bf3405c8221d5d80d17ce18f", "SHA256": "9cecc7799a252d0f631f93184928b84f77ec8e25cca8428aad4fb77b71a20bc6", "SHA3": "a0155eb55ee8e2b9ae4f3c4dface2af00af0fe0245b844e07872e4c00ef8131c" }, "3": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 296, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 4.00668, "MD5": "1382baca2d082bf3d44192b9749c0a4c", "SHA1": "af041213a8160dca4a49bf53bbb66f1a77c1a7f3", "SHA256": "2f617cc59bc5e99cb9baa6839a88b01db8a8925f71e31cccfddefc540e2ba4e9", "SHA3": "8fd714b0b259c19d2147ff70d238842aadf2c19bd8ddd6cd8f80f0aadb31dff7" }, "4": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 3752, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 3.75213, "MD5": "3472da7080499f045ae7eba84c5c88b2", "SHA1": "774d88bafb2d26fc052c6558e7fbf6fa2c250ac3", "SHA256": "31cfc1fc694fdb4ad12cb15110a2a9d0ef8f8fe099dfe2f07727c8c9a21218e9", "SHA3": "c5813845d3d360f54a83f29e6608df8004b9c9d206fac8df9b3d7a3a65e56f87" }, "5": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 2216, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 4.45202, "MD5": "0863dd58028a391478282f311ccba38c", "SHA1": "06596d5138503aa542f451b89e1d720fa97fbe95", "SHA256": "a449b2c56347bd0f4c3ca4769157901da0222e99cc27069ee39cd3ddad369b88", "SHA3": "7be730a906b38977251a2a3adf01fed2732ec39b74aed9436607145511392ae6" }, "6": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 1384, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 4.71401, "MD5": "606fd9c60b41c879ea65edfc283e4eb7", "SHA1": "60264bee7dc70ce990ce5e6f741a6f8e92fb3161", "SHA256": "9e3c29c999d1a7e183513ffc39c1057fa566cf44a6189eef392753d8c5ef5e05", "SHA3": "64f9172241817e3c6aa28ccb1949b6102fe9a0ffb665e766574ae889f704e9f0" }, "7": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 15332, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 7.84392, "Detected Filetype": "PNG graphic file", "MD5": "df92f359717f308a416508b25324e3a6", "SHA1": "d37b19f7dd8c3a245d84b68b04552e67d9fc39b9", "SHA256": "bc7a9f5af4d787fbff6cef32b4093d802d6fd8bef488d51933f022f90d6abfe8", "SHA3": "02e13f14a3e5fe3964b9729697ac826f200f62bec60ce48f67f15319b6fc1dba" }, "8": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 9640, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 3.54196, "MD5": "408f79a1280f107c915ae7b1851ec71f", "SHA1": "ddd03f2587eab417c019c3bc94e197dc77ca1b09", "SHA256": "2f8b19a0322ff63e1dd59d23de768258117883c93703b95af267935f409dfb45", "SHA3": "01fe34cebc270aff3e1c4729940398260914c30e18b6125982a300733469c1ed" }, "9": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 4264, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 3.55748, "MD5": "1b9f15a0f39d81a15029b35f4f4b0843", "SHA1": "f960c3f17820572c910c97e1ce8c08305a62a38d", "SHA256": "a0963dbaf3607cff9a24936da2ac650d85d1c98dc29e73f2e42e50cfc0468bca", "SHA3": "e3e10545205f99b00d0da5b0229e144c3a1d1611527c70af45b190b305ee972e" }, "10": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 1128, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 4.00347, "MD5": "2502d8e53097ec7431e72677d284c929", "SHA1": "0d677844be3fef10b48dd140bb82477433adab70", "SHA256": "500859ccdc5e32587afa2c083e8871344267a306f860a02d2cb2f84403c3d5af", "SHA3": "b4a2f9ffa137b91c6aeaf217ee6819672b8b082c5aa6f30984806e366595e87f" }, "11": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 744, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 3.09866, "MD5": "3ff4e06dacccf832d0252cb605fd25f9", "SHA1": "ee6e7e4bf7f75698456d626abdac0ed07a9be5d2", "SHA256": "2ed380ad24db76d8315ea1b645aec77db3de81b6e7df610fdb7bfc76e9f9415b", "SHA3": "052746c1f0aa27170ea84e1a9b19810638b83bb4b6fcce27bdb5d727ef185fe5" }, "12": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 296, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 4.09738, "MD5": "feb9df2c1bd973d4c241731ba8ecb4c6", "SHA1": "fe1f4bd30d52862311e14f2c1231670f5f8f71ea", "SHA256": "2a5a5228b47c99b929271ef664bf3acc4ff983d860426b867a451f7cd9afa711", "SHA3": "7bbe1b42ff84b9d36e5bcd768a1c4117a34f95f53dec8ef2922618feeff9630a" }, "13": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 3752, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 4.58906, "MD5": "a3a89ee1793e8e85eeae0b5a41441ef0", "SHA1": "9c9eee280a4bf5e897f31db69ccc570e8ea3bf9f", "SHA256": "f3b15f8bc7b6c145d77ef791cb1d96e459e5791b04c1af654b73f841cd65be20", "SHA3": "fa12aaf3ed78fb385f3b1a6ca6d78171b6a6672fe2b3eab5d595632aed1d427e" }, "14": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 2216, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 4.62229, "MD5": "5766207e97aac6fe22f5b36d31d88899", "SHA1": "8b8d64f590bd9a9d6abc66c0631909149e4a639c", "SHA256": "1f9c6480354f7c8869adb12d00f98f9076350fb2343d273684bd31c0eda10d0c", "SHA3": "5babe95a064c9b69bf622a9baa0f779f4f69418ae702b8f2ddfc2b07782463ed" }, "15": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 1384, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 4.66086, "MD5": "48b8e1b9eac4ef9bb1c78f20a4abeeab", "SHA1": "6664d7a929931ef4ea3b587ecb95b4d95a312d53", "SHA256": "fd3f7e84cdce9ce24709a7f8bd505140223c209a8c487bd5a45cbcf9ac7653d9", "SHA3": "5dd7341876fe0ba1fa037a6f5158b9a42514e2d541a8e9578d8dbb9a1dc62755" }, "16": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 16526, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 7.87954, "Detected Filetype": "PNG graphic file", "MD5": "29d9c6194f2731b720791771b22ee0ba", "SHA1": "6fc32730540ddc39fade2b43f1fe6cee5b05e647", "SHA256": "3b484dc8d5b7cd5b2d0ade431b36b5ccb9f114b57dfd1675c1104fcf4707dc86", "SHA3": "69d94f94cbd2bee894398698a8a0fd0d7361af26b560e459486ee98abe4bcc7f" }, "17": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 9640, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 3.16547, "MD5": "2a1f8f5557de13b58a19768911615973", "SHA1": "17f843756cfe0da635d4367c5fceb4a958e3127d", "SHA256": "987b4e04bb17ae34516de30e5823c0da905c9995a980a4935b303e759d741e40", "SHA3": "e06ce164c7e619cc629dbb9b203bf4b6dbaf2262207ff7ef14eb20c11989ecef" }, "18": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 4264, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 3.22196, "MD5": "815fb6d71739faf241aacc077e913a21", "SHA1": "69152a5a1a0efcc992ac27a05718096af5a1e84f", "SHA256": "12b8c8dd89f621b58184f0fd074378609fe0573e2dccbf97852c8f9634b394bf", "SHA3": "31241fd5714ee0a270e4804001995f3504cd1fb64a8e8289b7d4f2150e0aef0f" }, "19": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 1128, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 3.61626, "MD5": "2e2074b3eadaca5ba119048b4aaede81", "SHA1": "8dc3d3d431ad9b41f18df0cec06804c59449202d", "SHA256": "2d54a23b3eac7bbfa4b23e747a1ea063f56edad8d7744d3d634ad90b704d3f7f", "SHA3": "36cf5a135ebc3a38df01f835da7b4deabf41a02326e5fe274a19503ee9a6bdee" }, "20": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 744, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 3.53252, "MD5": "385c8ac8e267204c6c5cb0f5ba507de2", "SHA1": "093ef1031bb158bba1d6f45504b7a3f01ba33c36", "SHA256": "77c45670f07558d6625caf750e8d3c4fe9dfef1d9917ee69ba5a9e5c3216c0ad", "SHA3": "29da41f75e556411bc48b57d0058efa1de050877cc05020fdf217d7a4eeb14f7" }, "21": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 296, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 4.19701, "MD5": "e34368e2dcd4ca7c8485116eb49077fb", "SHA1": "5fe25e0f6168176d748f827d5edb5847dcb2ef88", "SHA256": "40089cf6ad2a0f9d3fe8778e3817384b5dca9e109056a3cd208685bf15f7bfbe", "SHA3": "b4d70e82ba131be4b951deac49d22ed2e8373b3bac86fb6dbc166fdef1049e3d" }, "22": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 3752, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 4.02064, "MD5": "670d8a4e35ba5f458083406ce219a4b6", "SHA1": "af4eb3792ba68ef9c5960da629e1fd1c22e8a479", "SHA256": "eb15ecab638e947c9490fbbbff3330f3a09784c4ffdc6d4b6b7a8a2316efd418", "SHA3": "a3212d9957fd2b91fb0ae0f89e890d96706e8f9a139bd2216bc7955325c249fc" }, "23": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 2216, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 4.51818, "MD5": "008c9c5f07c32319cf9a907e2afa8c15", "SHA1": "a88e08fa759d62c4115d0d12db7e4849c6c5492c", "SHA256": "587a72bfbb52a7a59029a2d5d9e3e4f4ed9c8ff1124d757d2edfcc43367a81a8", "SHA3": "1e604242468b6245f4c38c9a1858994442f69f2e91f1b51a6e8f2cc94456f411" }, "24": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 1384, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 4.82315, "MD5": "b1007a3f344ea9f190f20c9178da3aa5", "SHA1": "1caa1229f3fe06bdfd67c3cd68d800624b820638", "SHA256": "da95b055a22e053d65ed5b169ff4665924cdee26298b7b0e7e5466d733d2ce51", "SHA3": "96ad320211218bff44430f1af863ac11c21f675b03717d0056819f051ee5f6f7" }, "25": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 22082, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 7.89194, "Detected Filetype": "PNG graphic file", "MD5": "648a2c016ef854de19cb84f6b96e98f0", "SHA1": "463bce16d780b8b72a0746e8d955fb8684da9cff", "SHA256": "bd4779a93ea08cd4fc2d569c14aed3f5f142d3801c5a102c8d5ad0d57abe0527", "SHA3": "613028ba152dfb99c7eb4d577ede79797be55e97ceadb0d21e4d8625a65f6f11" }, "26": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 9640, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 3.82225, "MD5": "b1bc4bec7246c3ac3866a6111a706879", "SHA1": "33fd1e45483eff2ee40e594416dbed01ab6f161c", "SHA256": "369b2a8e8753fffa2699093626e8f5b128a8ee4aa2c910063cb904fb989e9751", "SHA3": "4e40a7649f1238749ac38de94423622e9999a3b3968da4e54646cc4f83ab965b" }, "27": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 4264, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 3.93097, "MD5": "1cd5c977db4a2ff49bfb615103bc03d1", "SHA1": "b548c3fbc38a94ba7b4a794541bbb9b618dc0243", "SHA256": "ca579cb5dfdbde2d0a3cc99c47b9c6b9775ef26341bde183f910481f5aebca1e", "SHA3": "f6835266c195cd611f0178ac1ada49f9332ee7eb67755038e345bd0360a40013" }, "28": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 1128, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 4.25048, "MD5": "0cd01c54153f84fdb7939b11f75f094f", "SHA1": "8181c0bfc03fbf032adb4877906d7afe3bb4f721", "SHA256": "216fb8b3ddce334480bbddd133d9ced46ea302932165684ace45fdf870c2c1e3", "SHA3": "bf11c6c022721442bb53ac8efdd10c1157c39f14fdd40a2d554d2d34223211bc" }, "29": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 744, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 3.22209, "MD5": "a633ba6af346446646002040ad6bf04f", "SHA1": "984eeb7c8ba1f7bc3a16f7646235a3b48ec6da17", "SHA256": "0d74c2e1fff9c711767fc32aceea5543b670ef6fcacde30c98d148a86d067931", "SHA3": "cef838f0f3533559f6c21c3f109a070231984a08aa73fcb8a18435ccfd086637" }, "30": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 296, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 3.99018, "MD5": "b24c67145482272c4b09cc1347f57809", "SHA1": "192dcf7f51db7767c0030dc5270b384b0c18e0fb", "SHA256": "f3e09e9201ab42a63f4c10a3a94d81adee98328c1946ec5113a1ed8435a1d1f8", "SHA3": "5be78f6f023ad8f5be3cbca47a6be2820b8008ba7141c141757576ab5a98f7c2" }, "31": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 3752, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 3.79935, "MD5": "30119231b31808667c148245b4b72c93", "SHA1": "99e8253bee111412073f7f33c8ad1986f76e8ab8", "SHA256": "6178fa3ce7cc9c072bf84abb0de71764ce676eddedd8df67b5d9cc381574297b", "SHA3": "0a5e3214b8c27e42c0e2e0ec2e1fd3463c2d424f9fb674434574379055bedb23" }, "32": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 2216, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 4.40439, "MD5": "bde29136513900173404544e90616e32", "SHA1": "d2ceda37d0cdde6818553e5f4179f0dc1749416a", "SHA256": "1d17a86540b3ff7fe00384813a98c104306935a47f8caa45ee910499c6d6b0b7", "SHA3": "a6f090f8c3810e48598d289a25d6bf6b63647d8d1d12fdca48f239415b02a9ff" }, "33": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 1384, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 4.71659, "MD5": "990a5a1186e57f1bae6a2ef2125dbd13", "SHA1": "5157fcdb5c6d7ebe382ef64048dba10bcb56574b", "SHA256": "17acd540b752d485c234f7c636fdd2f18777058f648dd841e69dcbe64f903047", "SHA3": "8161048d677726a27cf9a0bde2ba63c48ac30c7ab7b86d5cda6ce810a7a3d96a" }, "34": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 17227, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 7.81281, "Detected Filetype": "PNG graphic file", "MD5": "38a7b30ae66821b260f26ec4c7b6b458", "SHA1": "973af63f6e64f36f19c3bd50690d8e178b7094b5", "SHA256": "b6178e38422b4d222814b69f2b2ba3cc74054590c2c65f39e2725c80a335d86c", "SHA3": "e83e0906444ade9e5f3cf2112e2f45c845a92beb8269c5290b86546fc3933ccd" }, "35": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 9640, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 3.64367, "MD5": "7c05cc50d6a403330bac64c8c2710b08", "SHA1": "cf88a9ddbb33f4fdcb2ab12837dd67cb64225db0", "SHA256": "69e942dc6ac6e36f3c69358383e0be74ff08886333438dc8aee45088ac1dbee2", "SHA3": "182d2455de1456828ba3801d27077f643a47f9be8fbee53a0903c575bb75fbc2" }, "36": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 4264, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 3.63365, "MD5": "36ec395b04a43028c481189e8b710a41", "SHA1": "33ba0e90076b4019d295debeabc97136c38ae526", "SHA256": "688971691755a90583d9e6d415fc93d9779b32956358945476cf1e57f7e97791", "SHA3": "33a1a01c56aa38918e70d0048ded131870d0daa0bb44bff2a1583de8e906cd4d" }, "37": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 1128, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 3.93134, "MD5": "57fa9fc9a6d108a77294afa249ea9f1c", "SHA1": "5d68f1450e7e3ee6a30a02dede408697dfc02778", "SHA256": "a2ebe91d0a6f26aa4db93139a3b05f2dbb467ec868d8e58eabef11d09fc59831", "SHA3": "53f28d73ea9c534ecf78eb9c6eecc5d173a5bdf74f66d6396a333f07f54585d5" }, "38": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 744, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 3.12524, "MD5": "a6c9af48a06dea7f289920df62814c2f", "SHA1": "b7299efc2b3236a7f1b5cad0e01492e827fce026", "SHA256": "c8bac06e289a19bfdaf5814ae5d33577ef3c92d8f2a614a78460dee9a78a2bdc", "SHA3": "1f2bf14adcba9ea7d0d546c168d47ff3a3e613011ca0ebe4022885e203a3f1c5" }, "39": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 296, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 3.96698, "MD5": "c5134333cbc11900f54d592d8d8d48e6", "SHA1": "dc320779845ef23b4255bf85fe2f30334c1b591a", "SHA256": "8af62a2b22ce54a6aabd08c5826b91d397d2b5e51cbb673eb6cccc6490492c5c", "SHA3": "4c42e39346567d046a10137c2c8fc58c78fb6573cc676b6251bfe3906330fd86" }, "40": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 3752, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 3.95114, "MD5": "708e20ba932b106bc8f38d06114c8cf2", "SHA1": "65a369875389ff46888f384b4e2c7bb968e52919", "SHA256": "019f1f1737753cc3e23b453f30b2581a3de1871523007d92e897508043f9a8e6", "SHA3": "3444fdc74495e9819c17726936e92fa174118d0c58cdcbcd789093cbdd1b52f2" }, "41": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 2216, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 4.52235, "MD5": "5f033202ceec66143343eef4e4d6c66a", "SHA1": "1291f1bef051c21ae5f76d320b5c80534327471a", "SHA256": "088a2ebfcdd3f080c8e6094330ffb1604369ee1438f38e302ff425ef393466d8", "SHA3": "b473368b864203a35f7d1d400eb9cb2d5eccadbcf2e03c0057d845b041420607" }, "42": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 1384, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 4.83366, "MD5": "7816af772ca825660b9f79fe8be87f79", "SHA1": "2c30f268cfb2f2e87a23604c09bfc9864531ca0b", "SHA256": "040cb542be467a29cb3883af3c17cc9f6829b56bdd639afc828f467f04c23535", "SHA3": "d9d3b9a755a566676d5e7d5c75f527c911f456e1132831089f76d0893b1dfcfb" }, "43": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 21076, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 7.87496, "Detected Filetype": "PNG graphic file", "MD5": "a7ee8018251c3d7f168b45172307c5be", "SHA1": "3a7f60714f406c8c5e7cbdeab7eab73650397c36", "SHA256": "0f6b40ca00ecdb1f0ce8783b71eff99c2c27a16a5547a66b835747d26bf5e037", "SHA3": "8daa4f5dfeed81c0317e5fcab0bed7541b01414d7d0463d373bc2cde41985651" }, "44": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 9640, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 3.74027, "MD5": "0ea617ede0736292fbffb079754f1437", "SHA1": "4172d6f0fd5776643b4dc7775fa7b532faedb8d6", "SHA256": "6c339413807aea364d6f48c0759e5a9c3a54d08e108da55e7e30382e69adcba9", "SHA3": "7172e796acd0a36f70c02ef564844c45458a35559a0cd05840378dcde1301342" }, "45": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 4264, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 3.73088, "MD5": "0bc48643e48c5adc9b342b96b0f57415", "SHA1": "604ea9264a17e7dedd0132efb2d5f92b3ecbb473", "SHA256": "02e56cdd947d32d8f26b6d741e74bbf9b92f34f40052ea2faf45c10bf1d32ae1", "SHA3": "91ec44df70d39c0aa78f74ec3a3b1f4e098e4bbf80dc94724d8500f579f33e1d" }, "46": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 1128, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 3.9914, "MD5": "c6ef052c456e73a616697f4efbc9516d", "SHA1": "48d0bf9541caf91f513a33ca2d467afd16ef921f", "SHA256": "1782c17c4452bb5b21ee66c66723d69a4ea94fe602b4369ac41a5c012a98d7da", "SHA3": "c83aef62551e0b7e6362639ca00781fdfe8d46da9d95a50d437dfe5503ef0c1a" }, "47": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 744, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 4.21107, "MD5": "153500becfdead8aa1601ef7c8493e1d", "SHA1": "0fb5f8b8980fe96b989484628f105cf89ae641b2", "SHA256": "bfe5031738689dab64789be68a5ede50233655da21ccb840eb99076944c7b753", "SHA3": "e1ed89e0d790241ee00109c720448d16cc91c4e71cf893da2dd0bcd44d80d810" }, "48": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 296, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 4.51872, "MD5": "d9121d89c00046518b5fceb970613b15", "SHA1": "26cb1ebca2203b453ae336d6fb3b6dda2421a1f0", "SHA256": "f31881c4e2f3fde23f1a63b4d3169bd177d6c3126476f1664ff7db6e06e845c7", "SHA3": "a10b371c4c3ddbadd5481cd728bd0fef26a1698b2c763509b59c827bc40c7cea" }, "49": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 3752, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 5.31412, "MD5": "b94cd97c409463cabca65c1c0ff5f5ea", "SHA1": "af53edd5cc6c263ae7084bf956449706e0d4ad12", "SHA256": "64e07cbe799f0026e7170e3e3a0c81483026a002e75904cb9f10fe472e1a3b1a", "SHA3": "52cbee9198dcdceb4b45154d7bd6e2717a9a1c2931de6f5038fd5a484ec85080" }, "50": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 2216, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 5.83747, "MD5": "60f0b4e90f6203f2efce0fda4e84e86b", "SHA1": "774668a7cccb87fafef49cc92a2eb5f4758307fd", "SHA256": "d3322eafbc0b9c0d5362389258e8767e909625a2c49c5ae58c8e6c3e7f3cafdd", "SHA3": "7f0884933c1987d0fdf666b20a4b9ed9ee1ea8242fe46aadf7935731684eb98c" }, "51": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 1384, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 5.36615, "MD5": "23e4a795817e3bc84abe0aafaf63aed0", "SHA1": "3a714fc8e1071ef5505c4f27eef09e5074e6e64a", "SHA256": "98af02c8b3f305c8e2c3b8cd7537fd23eb59ea81087a4f1fcf36f6eb4cf92de8", "SHA3": "69657d86f7e4d58234894648b56d1b6455d7c882e47ce77f3e5a46c4d15e4d3f" }, "52": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 63090, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 7.97558, "Detected Filetype": "PNG graphic file", "MD5": "151fa02256ae76a0c96fd0ad2cfaf615", "SHA1": "0312af0a8ecd5aac134cc9fd25f1abb28a674971", "SHA256": "6327df84d039705236fc10816158a9dba13311c37d1e7a12ebcfca4c4b05e7fa", "SHA3": "871e9a4691262ba6415bee30dd3f2ecc6df1ce0dd770ed23e39fece7974ecc6d" }, "53": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 9640, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 5.11998, "MD5": "53a04b987ea8e74ac31aed9c299c2963", "SHA1": "dedfdadf769ae87d1d48b30cb2c81f9c6e7dc9fc", "SHA256": "29353d8d16a76050e41110490ebda43d2ed58b1e0f08385d11e68477c314544e", "SHA3": "9281c9f10d4cce1d8162f6aeba0aaa924b17c3080182d2b8e08694932d84e62e" }, "54": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 4264, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 5.31008, "MD5": "7abc9ce7c94d1848df4f3c461dd036a3", "SHA1": "1f660efdeb2b91df47519f710898fceb552e8957", "SHA256": "ac6d951dd10c25b30ac34b8744de72c3675026b98260caf64cb6027c2081c188", "SHA3": "7ce3c20695d6e8892db8a3ec916cd65ec5e612ed1aa70fa584e0d69364fb57e2" }, "55": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 1128, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 5.66478, "MD5": "e36fc72077cd9b77fabc4a9f9f2ca8d0", "SHA1": "3ba0fa21da552a084de6d1b2413a31bff72f5d40", "SHA256": "360bc89561267623e0d6feed8ea6287c89f619f86d1ad7630ffc7ff5b1e0412f", "SHA3": "492925eed70e0542733e374a60675f935204333d7127764f39b720f99ae13606" }, "56": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 1128, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 4.73269, "MD5": "d993fa2598af9203656d88cfdd6d8063", "SHA1": "1b757f9f03224760f4b51d6de29a9fa55ccd7b3f", "SHA256": "1c6ff2fbf25b831e4bb60bc09cabc417c245b49b25238b9ce20786664e68eb28", "SHA3": "22924673e4e028f6fcd0807f864647bc2731be3c7e062c992c376d1909d4b3f6" }, "57": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 1128, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 4.39529, "MD5": "baa4e050de2c9bf9911fa11334a536c6", "SHA1": "ca31b5b0f3ca027c063d9a45aa70cf498cd86fd3", "SHA256": "f45c3c2199a6c959d28f5af7f6bf1b64794bc7d012ca288ee447df121aa1d459", "SHA3": "26c5cb2bbe6143343730e5b042e03965c75e6b2603fd83caba7037c5f37b1465" }, "58": { "Type": "RT_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 1128, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 5.38461, "MD5": "d31c76e24d7602265b0ac540be04f0b5", "SHA1": "cc2a72a3f360b3b7838c0721bae692f3f8eaeb0e", "SHA256": "8d64fcb9f6f935178da22e8438dc116c1606b830802175fbd6d2d0114ef2d7fe", "SHA3": "08a3f5b8baac00de6cd9b4eb1b50475cad11d0e2ba8b72a5b99f592e6b9ad3f5" }, "1 (#2)": { "Type": "RT_GROUP_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 20, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 1.7815, "Detected Filetype": "Icon file", "MD5": "3c68f77c35c26ff079a1c410ee44fa62", "SHA1": "0b40150c95fc2c6414c90d44ee78b8d8814b3393", "SHA256": "a14e70ed824f3f17d3a51136aa08839954d6d3ccadaa067415c7bfc08e6636b0", "SHA3": "590dcbf2ec3f485a6c24e3e627f383ee7588eb49978321f12c07d8190a6c1396" }, "2 (#2)": { "Type": "RT_GROUP_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 132, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 2.87894, "Detected Filetype": "Icon file", "MD5": "f1e4bcceac166b25ed23a015381e1680", "SHA1": "7a0f0a311fb4d5011e6bc317c875c6e56fa6a53f", "SHA256": "1ba48238291a565c1c1f65588ff04e4ed460889d13649d5cd8c2ae36a1e95cf7", "SHA3": "be9e26b73ad17f30afefa67d22bf8ad476e28dd9a23424734e910724dc129a06" }, "3 (#2)": { "Type": "RT_GROUP_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 132, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 2.92564, "Detected Filetype": "Icon file", "MD5": "4b43a0256ca6b0fdd20d3134e5627b68", "SHA1": "e3c7378742752b0e81a022642407ef2f4a9b3faf", "SHA256": "decc3cfa8be4ca6a9467dc62e296c455f3967def228a5ce3ae9dd1a69efab36d", "SHA3": "fba819c7a0fe8ed0b33cabc471e13cacfd98d138d405bd068f0e1b387b4685a3" }, "4 (#2)": { "Type": "RT_GROUP_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 132, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 2.97632, "Detected Filetype": "Icon file", "MD5": "cc34415b003cbd502f183a00933db512", "SHA1": "ee7501d02c358815d65cccb607783914fd42c8d3", "SHA256": "d5afee51d9faff75f672af450d9c652ee4b45708888bd100f4a6bf42a2b34fae", "SHA3": "d16e729992c6812112a0e672bf41251425a7122b87b52bb562956936775f5475" }, "5 (#2)": { "Type": "RT_GROUP_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 132, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 2.92455, "Detected Filetype": "Icon file", "MD5": "254084b518ab079192dda486b1db603d", "SHA1": "8d91a6212a30da0c710f67552bf589b0cf12fdd0", "SHA256": "4325eb3bea13dd7cb50d0f0bc788a0a80ee0d627c506972a36ef8330309aa5c2", "SHA3": "72539667b7a3d08b716f6d5d88d8e7b9ccceb1c3a639858218722c2b09b322a5" }, "6 (#2)": { "Type": "RT_GROUP_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 132, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 2.96117, "Detected Filetype": "Icon file", "MD5": "7fffce310ba77259c536b855649ba84e", "SHA1": "9b94438a8fd2f852bba64072a78fa349a75dad0d", "SHA256": "92faa7c00012cf530d943fb83edce0c4471d9658e42a38d28c2c95b5c5547fb7", "SHA3": "7bf67ebdde9807fe494f25e8ae069007720c465cc97ace8f3c336c333a9c083a" }, "7 (#2)": { "Type": "RT_GROUP_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 132, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 2.94898, "Detected Filetype": "Icon file", "MD5": "d95f504aa563c0f207cc5fb72c5813f9", "SHA1": "f4e139c21534c2a1d9d4b79bd9c3b17f95bf1d13", "SHA256": "3352aa6c058f716c1134151b0bd7676503c156d2e6bf4f4b5beb14a039f819ec", "SHA3": "1fc2a2c35d9b5865bbd44185572d604ac9681d6357927dd4336d104421b179d7" }, "8 (#2)": { "Type": "RT_GROUP_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 20, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 2.0815, "Detected Filetype": "Icon file", "MD5": "ad2d68c87f37f9147a6583a1d34ecba7", "SHA1": "420d858ec1371ae4b8f9134b9800fea71101a820", "SHA256": "704da4c232c9a991fe2f044383a22daa1e5bb36c2b439498d20966844c26ae74", "SHA3": "b79001ac9fac65f63a3d58ca6bff23575e2084696a1814fee0e396c6f6c27c15" }, "9 (#2)": { "Type": "RT_GROUP_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 20, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 2.0815, "Detected Filetype": "Icon file", "MD5": "b7b31b38d409a82ceaca448d7a810321", "SHA1": "a3090bb6ac0fef7aea86e0e56040f399e7f3c752", "SHA256": "ea33ebe43c2fa8cd36be2e9337ecb4fbbe834474ed4b8f982ee9f904939b67c0", "SHA3": "9894457a9e637022c1e501c7acc5628e30c4a7c23e408e3da484ebb2f44afb4e" }, "10 (#2)": { "Type": "RT_GROUP_ICON", "Language": "English - United Kingdom", "Codepage": "UNKNOWN", "Size": 20, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 2.0815, "Detected Filetype": "Icon file", "MD5": "f26edc21fd82b21b67a1d9a5df9fe70d", "SHA1": "b5e743e6892c4ef0494fa9a44969e4e93278d495", "SHA256": "e47217736ce9d3d4fc390187b6a5c5f3ac0c8019df9922bb925e0acb96603c46", "SHA3": "98b1a2b082d4bde992677fccc02f4ef0cf0fac80a24ad1c43578625c3d120f08" }, "1 (#3)": { "Type": "RT_VERSION", "Language": "UNKNOWN", "Codepage": "UNKNOWN", "Size": 920, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 3.35286, "MD5": "fb420f36a2ccbee63863c0d3989c59d7", "SHA1": "80558175af8dfb6bc6dd60a3c1e7fb6b056380ea", "SHA256": "cf997cdc9a8f1541bf7659928232a725b020e43ee6c59d92c0a1ef16bc7b0e4b", "SHA3": "a4f7d997f028bc2af25b042baa8bfaf02405528e3f59a3c973bd3b4c921e1694" }, "1 (#4)": { "Type": "RT_MANIFEST", "Language": "English - United States", "Codepage": "UNKNOWN", "Size": 2005, "TimeDateStamp": "1980-Jan-01 00:00:00", "Entropy": 5.1743, "MD5": "2f42c9d8b4e345f2661b622884dbb1c2", "SHA1": "ff3f972fa29f32e731cd821b2f651ce7261ddba7", "SHA256": "55ffeee7916173bd219dbf371c8346d77898e212acd70e17c5917a9c95fc07a4", "SHA3": "06595c1428b469538c56b004f9d8d030283a5a1661013ec0f50dd48b12278e0a" } }, "Sections": { ".text": { "MD5": "b601d33f2022269e2a6d3475d95bd064", "SHA1": "dbc17a569eb37c690223c0567bdd5650ed64fe4f", "SHA256": "d55d7037a41509be53c8cee89a4b29698325fa46742ecccfb1ae2fada4873595", "SHA3": "f74e957a8a4949d097db3e21de7ad43167a5e343315e7c5b7c7e0e73d738db9f", "VirtualSize": 4903572, "VirtualAddress": 4096, "SizeOfRawData": 4903936, "PointerToRawData": 1024, "PointerToRelocations": 0, "PointerToLineNumbers": 0, "NumberOfLineNumbers": 0, "NumberOfRelocations": 0, "Characteristics": [ "IMAGE_SCN_CNT_CODE", "IMAGE_SCN_MEM_EXECUTE", "IMAGE_SCN_MEM_READ" ], "Entropy": 6.42451 }, ".rdata": { "MD5": "c6afd224723581a41d91c1b828520916", "SHA1": "c4145a927f9416c0d9b69ad789c6fb2c35ed48ac", "SHA256": "3b5d9aa2865c4dfe136a98b89c36c2ff28a2a98ce7ef161919a089885e69e8ac", "SHA3": "46d7920d5492e5058d2a133be7be9da0f85f3ef4dc883ce7ef0a4148342a1971", "VirtualSize": 2916536, "VirtualAddress": 4911104, "SizeOfRawData": 2916864, "PointerToRawData": 4904960, "PointerToRelocations": 0, "PointerToLineNumbers": 0, "NumberOfLineNumbers": 0, "NumberOfRelocations": 0, "Characteristics": [ "IMAGE_SCN_CNT_INITIALIZED_DATA", "IMAGE_SCN_MEM_READ" ], "Entropy": 6.11934 }, ".data": { "MD5": "54b40a1321fa1e5a4df929f5b44474a0", "SHA1": "06877b829b46e0c26c2eea41202b87d9539a1e25", "SHA256": "25c74621540f4031692dbd9cefb0aac7a79c7fc8478465e0a3b2313b7ec05e82", "SHA3": "8d170d71e355fca9d00b1b9dd59e3d2cccd37d787bd85b3cc6fd7dd69f024b20", "VirtualSize": 230652, "VirtualAddress": 7831552, "SizeOfRawData": 176640, "PointerToRawData": 7821824, "PointerToRelocations": 0, "PointerToLineNumbers": 0, "NumberOfLineNumbers": 0, "NumberOfRelocations": 0, "Characteristics": [ "IMAGE_SCN_CNT_INITIALIZED_DATA", "IMAGE_SCN_MEM_READ", "IMAGE_SCN_MEM_WRITE" ], "Entropy": 4.78878 }, ".pdata": { "MD5": "be7977e406b9d27b689e24ae952753aa", "SHA1": "155ac305789946e09e667b3a7cf515d4ab8fa5de", "SHA256": "25e90b1a0e99b269e6d14d37c5aeef86ef026adc118ccb13e3f05122c3baf133", "SHA3": "e8a5f6f3cf314b74786866a02d9bcdd23b66a74043379b7f62445825578ef60c", "VirtualSize": 228912, "VirtualAddress": 8065024, "SizeOfRawData": 229376, "PointerToRawData": 7998464, "PointerToRelocations": 0, "PointerToLineNumbers": 0, "NumberOfLineNumbers": 0, "NumberOfRelocations": 0, "Characteristics": [ "IMAGE_SCN_CNT_INITIALIZED_DATA", "IMAGE_SCN_MEM_READ" ], "Entropy": 6.44703 }, ".rsrc": { "MD5": "ec47fdbb568fc3bf8a52a730c4029149", "SHA1": "3c4cfb394c5ff8b01ca4fbd42e21a5a31471c7f0", "SHA256": "9eaaf2eb887b9f8355c784ac48f2e9e95868b23f645ecfacae3a66c76d8c7a86", "SHA3": "0b14d41456d8c9ed3aafc8ca3d123ce12266648024976b4118e7854df0bce379", "VirtualSize": 310864, "VirtualAddress": 8294400, "SizeOfRawData": 311296, "PointerToRawData": 8227840, "PointerToRelocations": 0, "PointerToLineNumbers": 0, "NumberOfLineNumbers": 0, "NumberOfRelocations": 0, "Characteristics": [ "IMAGE_SCN_CNT_INITIALIZED_DATA", "IMAGE_SCN_MEM_READ" ], "Entropy": 7.13867 }, ".reloc": { "MD5": "8b9bfcb7ae42457c52a7c08282de841a", "SHA1": "44eeadc0da675e9c6b28c68db73b67c61699680e", "SHA256": "d1725acbf3aa5b4a847bcee7abdb17244da72fdc63cc776882ab3f36c4974a4a", "SHA3": "644823c55bc22438b0dcbd76dac3896bb26be122535eb3273b95684da7cbdab4", "VirtualSize": 39568, "VirtualAddress": 8605696, "SizeOfRawData": 39936, "PointerToRawData": 8539136, "PointerToRelocations": 0, "PointerToLineNumbers": 0, "NumberOfLineNumbers": 0, "NumberOfRelocations": 0, "Characteristics": [ "IMAGE_SCN_CNT_INITIALIZED_DATA", "IMAGE_SCN_MEM_DISCARDABLE", "IMAGE_SCN_MEM_READ" ], "Entropy": 5.46027 } }, "Summary": { "Architecture": "IMAGE_FILE_MACHINE_AMD64", "Subsystem": "IMAGE_SUBSYSTEM_WINDOWS_GUI", "Compilation Date": "2018-Feb-24 10:01:43", "Detected languages": [ "English - United Kingdom", "English - United States" ], "Debug artifacts": [ "C:\\Users\\Admin\\Documents\\Visual Studio 2017\\Projects\\Koinonein\\Build x64\\Koinonein BitTorrent Client.pdb" ], "CompanyName": "Koinonein Ltd", "FileDescription": "Koinonein BitTorrent Client (64 Bit)", "FileVersion": "2.5.1.0", "InternalName": "Koinonein BitTorrent Client (64 Bit)", "LegalCopyright": "\u00a9 2015 - 2018 Koinonein Ltd", "OriginalFilename": "Koinonein BitTorrent Client (64 Bit)", "ProductName": "Koinonein BitTorrent Client (64 Bit)", "ProductVersion": "2.5.1.0" }, "TLS Callbacks": { "StartAddressOfRawData": 5375753976, "EndAddressOfRawData": 5375754000, "AddressOfIndex": 5376762384, "AddressOfCallbacks": 5373627408, "SizeOfZeroFill": 0, "Characteristics": "IMAGE_SCN_ALIGN_8BYTES", "Callbacks": [] }, "Version Info": { "Resource LangID": "UNKNOWN", "VS_VERSION_INFO": { "Signature": 4277077181, "StructVersion": 65536, "FileVersion": "2.5.1.0", "ProductVersion": "2.5.1.0", "FileFlags": [], "FileOs": [ "VOS_DOS_WINDOWS32", "VOS_NT", "VOS_NT_WINDOWS32", "VOS_WINCE", "VOS__WINDOWS32" ], "FileType": "VFT_APP", "Language": "UNKNOWN", "CompanyName": "Koinonein Ltd", "FileDescription": "Koinonein BitTorrent Client (64 Bit)", "FileVersion (#2)": "2.5.1.0", "InternalName": "Koinonein BitTorrent Client (64 Bit)", "LegalCopyright": "\u00a9 2015 - 2018 Koinonein Ltd", "OriginalFilename": "Koinonein BitTorrent Client (64 Bit)", "ProductName": "Koinonein BitTorrent Client (64 Bit)", "ProductVersion (#2)": "2.5.1.0" } } } }