161f759eec677ae0be1bf9a08446371b

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2015-Mar-12 10:42:33
Detected languages English - United Kingdom

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Suspicious Strings found in the binary may indicate undesirable behavior: Is an AutoIT compiled script:
  • AutoIt Error
  • reserved for AutoIt internal use
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
  • LoadLibraryExW
  • LoadLibraryW
Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
  • FindWindowW
Code injection capabilities:
  • OpenProcess
  • VirtualAllocEx
  • WriteProcessMemory
  • VirtualAlloc
Code injection capabilities (PowerLoader):
  • FindWindowW
  • GetWindowLongW
Can access the registry:
  • RegisterHotKey
  • RegEnumValueW
  • RegDeleteValueW
  • RegDeleteKeyW
  • RegEnumKeyExW
  • RegSetValueExW
  • RegCreateKeyExW
  • RegOpenKeyExW
  • RegCloseKey
  • RegQueryValueExW
Possibly launches other programs:
  • CreateProcessW
  • CreateProcessAsUserW
  • CreateProcessWithLogonW
  • ShellExecuteW
Can create temporary files:
  • CreateFileW
  • GetTempPathW
Uses functions commonly found in keyloggers:
  • GetAsyncKeyState
  • AttachThreadInput
  • MapVirtualKeyW
  • GetForegroundWindow
Has Internet access capabilities:
  • InternetReadFile
  • InternetCloseHandle
  • InternetOpenW
  • InternetSetOptionW
  • InternetCrackUrlW
  • InternetQueryOptionW
  • InternetOpenUrlW
  • InternetConnectW
  • InternetQueryDataAvailable
Functions related to the privilege level:
  • AdjustTokenPrivileges
  • OpenProcessToken
  • DuplicateTokenEx
  • CheckTokenMembership
Enumerates local disk drives:
  • GetDriveTypeW
  • GetVolumeInformationW
Manipulates other processes:
  • OpenProcess
  • WriteProcessMemory
  • ReadProcessMemory
  • Process32FirstW
  • Process32NextW
Can take screenshots:
  • FindWindowW
  • GetDC
  • CreateCompatibleDC
Reads the contents of the clipboard:
  • GetClipboardData
Can shut the system down or lock the screen:
  • ExitWindowsEx
  • InitiateSystemShutdownExW
Info The PE's resources present abnormal characteristics. Resource SCRIPT is possibly compressed or encrypted.
Malicious VirusTotal score: 5/67 (Scanned on 2021-10-14 09:37:08) APEX: Malicious
McAfee-GW-Edition: BehavesLike.Win32.DownloaderAutoIt.ch
AhnLab-V3: Trojan/Win32.Banload.C810749
Rising: Trojan.DL.Win32.Banloaden.le (CLASSIC)
Yandex: Trojan.Agent.Gen.TS

Hashes

MD5 161f759eec677ae0be1bf9a08446371b
SHA1 9277c84dbe81dd975d6ab0c39254a0fd11ada84f
SHA256 98c13fcc1a1be36a87cf44cb7e7aab05f051d3d3e588f88534d6115b20e8f234
SHA3 c48be5f8eb4a313ab3c6253279c8b6f4fbec1005b7f790d24f94103427fa1dea
SSDeep 12288:Dtb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSga2TOQ6A:Dtb20pkaCqT5TBWgNQ7aOOQ6A
Imports Hash 3d95adbf13bbe79dc24dccb401c12091

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2015-Mar-12 10:42:33
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32
LinkerVersion 11.0
SizeOfCode 0x8b600
SizeOfInitializedData 0x46c00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00025F74 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x8d000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.1
ImageVersion 0.0
SubsystemVersion 5.1
Win32VersionValue 0
SizeOfImage 0xd9000
SizeOfHeaders 0x400
Checksum 0xde741
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x400000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x400000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 f437a6545e938612764dbb0a314376fc
SHA1 620b6e2d5af28a5fc3ad116b122012982576f7ee
SHA256 de7fbfcd793d226da0b3f99b8226e79cdfacca998089acbddee7806f58dd04db
SHA3 52dc5c8394f4328543a03e1e32d46ae057b061b01b2429531e07cb817cc24e53
VirtualSize 0x8b54f
VirtualAddress 0x1000
SizeOfRawData 0x8b600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.68041

.rdata

MD5 827ffd24759e8e420890ecf164be989e
SHA1 fd8701b41679d79ea98327a273da2bbc640e217b
SHA256 4275d419c50458ca55f9b7744e4dabd84131d49dc96878c105b6417fd5510b18
SHA3 d6a51cf0f76f34eac8363515efde9c8692eec821af451aef7f3fb03b160acd32
VirtualSize 0x2cc42
VirtualAddress 0x8d000
SizeOfRawData 0x2ce00
PointerToRawData 0x8ba00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.77019

.data

MD5 e0a519f8e3a35fae0d9c2cfd5a4bacfc
SHA1 c9b48726b2484779b6f0ffc6fdc2d426a9d2196c
SHA256 d2c58ff49551036872ea9549af806f4b5622bcb9ea7edb12b8b3a617e964bcde
SHA3 7e8a6ce0fc7cb7b09ad0998b04c68e0a21717636b83ab9ba5235e0f9af3b7ea0
VirtualSize 0x9d54
VirtualAddress 0xba000
SizeOfRawData 0x6200
PointerToRawData 0xb8800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.00269

.rsrc

MD5 63dcc3b48a8c0a0eca8bb45e47543c14
SHA1 bec4c09cab894d2029dabe0d5892d51878ad425b
SHA256 30f581422e7f266e10d45ccdb79189df29c23ff56cb65dc75f9c1be8bb9a0de3
SHA3 4026287d2bc32a98176b8fa7b81dbde17a05816057e2eccfea5095ed4014e221
VirtualSize 0x944c
VirtualAddress 0xc4000
SizeOfRawData 0x9600
PointerToRawData 0xbea00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.16035

.reloc

MD5 0bc98f8631ef0bde830a7f83bb06ff08
SHA1 d04eb5e0e06ff36d39c2605f4fc745bcb1b0feab
SHA256 4a1de58906741aeb8b87a68043ee7c41643bdd50346ddf3e3396c08d45dce8c6
SHA3 c8f3974e5646935cb796330ba047e7d4f12b85838c8984a1fb76f4e8975126b4
VirtualSize 0xa474
VirtualAddress 0xce000
SizeOfRawData 0xa600
PointerToRawData 0xc8000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.24543

Imports

WSOCK32.dll __WSAFDIsSet
recv
send
setsockopt
ntohs
recvfrom
select
WSAStartup
htons
accept
listen
bind
closesocket
connect
WSACleanup
ioctlsocket
sendto
WSAGetLastError
inet_addr
gethostbyname
gethostname
socket
VERSION.dll GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
WINMM.dll timeGetTime
waveOutSetVolume
mciSendStringW
COMCTL32.dll ImageList_Destroy
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
ImageList_Create
InitCommonControlsEx
ImageList_ReplaceIcon
MPR.dll WNetUseConnectionW
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
WININET.dll InternetReadFile
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetQueryOptionW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetConnectW
InternetQueryDataAvailable
PSAPI.DLL GetProcessMemoryInfo
IPHLPAPI.DLL IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho
USERENV.dll UnloadUserProfile
DestroyEnvironmentBlock
CreateEnvironmentBlock
LoadUserProfileW
UxTheme.dll IsThemeActive
KERNEL32.dll HeapAlloc
GetProcessHeap
HeapFree
Sleep
GetCurrentThreadId
MultiByteToWideChar
MulDiv
GetVersionExW
GetSystemInfo
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
lstrlenW
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
FindClose
GetLongPathNameW
GetCurrentThread
FindNextFileW
MoveFileW
CopyFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
EnumResourceNamesW
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
GetLocalTime
CompareStringW
DeleteCriticalSection
WaitForSingleObject
LeaveCriticalSection
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
LoadLibraryExW
FindResourceExW
VirtualFree
FormatMessageW
GetExitCodeProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
GetShortPathNameW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetSystemDirectoryW
GetComputerNameW
GetWindowsDirectoryW
GetCurrentProcessId
GetProcessIoCounters
CreateProcessW
SetPriorityClass
LoadLibraryW
VirtualAlloc
CloseHandle
GetLastError
GetFullPathNameW
SetCurrentDirectoryW
IsDebuggerPresent
GetCurrentDirectoryW
lstrcmpiW
RaiseException
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
CreateThread
DuplicateHandle
EnterCriticalSection
GetCurrentProcess
ExitProcess
GetModuleHandleExW
ExitThread
GetSystemTimeAsFileTime
ResumeThread
GetCommandLineW
IsProcessorFeaturePresent
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetStringTypeW
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
RtlUnwind
ReadConsoleW
SetFilePointer
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
WriteConsoleW
SetEndOfFile
DeleteFileW
SetEnvironmentVariableA
USER32.dll SetWindowPos
GetCursorInfo
RegisterHotKey
ClientToScreen
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
DrawMenuBar
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
CallWindowProcW
ReleaseCapture
SetCapture
MonitorFromRect
LoadImageW
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
TrackPopupMenuEx
GetCursorPos
CopyImage
CheckMenuRadioItem
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
UnregisterHotKey
keybd_event
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowLongW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
GetUserObjectSecurity
AdjustWindowRectEx
SetRect
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
GetMessageW
LockWindowUpdate
DispatchMessageW
TranslateMessage
DeleteMenu
PeekMessageW
MessageBoxW
DefWindowProcW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
SystemParametersInfoW
CharLowerBuffW
GetWindowTextW
GDI32.dll SetPixel
DeleteObject
GetTextExtentPoint32W
ExtCreatePen
StrokeAndFillPath
StrokePath
GetDeviceCaps
CloseFigure
LineTo
AngleArc
CreateCompatibleBitmap
CreateCompatibleDC
MoveToEx
Ellipse
PolyDraw
BeginPath
SelectObject
StretchBlt
GetDIBits
DeleteDC
GetPixel
CreateDCW
GetStockObject
Rectangle
SetViewportOrgEx
GetObjectW
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
SetTextColor
CreateFontW
GetTextFaceW
EndPath
COMDLG32.dll GetSaveFileNameW
GetOpenFileNameW
ADVAPI32.dll GetAclInformation
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
GetUserNameW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegConnectRegistryW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
InitiateSystemShutdownExW
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetTokenInformation
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
AddAce
GetAce
SHELL32.dll DragQueryPoint
ShellExecuteExW
DragQueryFileW
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateShellItem
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish
ole32.dll CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoCreateInstance
IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CoGetObject
CoInitializeSecurity
CoCreateInstanceEx
CoSetProxyBlanket
OLEAUT32.dll RegisterTypeLib
LoadTypeLibEx
VariantCopyInd
SysReAllocString
SysFreeString
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayAllocData
UnRegisterTypeLib
SafeArrayCreateVector
SysAllocString
SysStringLen
VariantTimeToSystemTime
VarR8FromDec
SafeArrayGetVartype
OleLoadPicture
QueryPathOfRegTypeLib
VariantCopy
VariantClear
CreateDispTypeInfo
CreateStdDispatch
DispCallFunc
VariantChangeType
SafeArrayAllocDescriptorEx
VariantInit

Delayed Imports

1

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.66371
MD5 d6f27bf763eb666af934477958acf362
SHA1 f724ee386cda31b32b5c88e08b9abf562c016a57
SHA256 62ba0b2575098d4428c9a99bd060ef7572071698bf9d03b4bd430f5f691378e5
SHA3 6f4a250c7a91ddfcc872e14b8ed1e4aa33a5ebb3280f7d021b47aa46edfb9586

2

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.05883
MD5 78f30e363a0499f530d057b4d639d36e
SHA1 360bd6476101b0cddc23d2c7eade326c1b16ceaf
SHA256 08bcba5aa989c988ea18f8101c84daaee58d4f0b584535a85186c8b98b66147e
SHA3 001ac9f6e8e52f9c3eb7101189fb953e2f4babfdea5b6e26b23b99173af38de4

3

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.25499
MD5 ad424f5f5d5ff4460343686c61e4f75e
SHA1 29a1f0faadc42f1b9f9767d8c724fdc58dd165c8
SHA256 245fc49e4e955e1db3975b826dcf27ad2eb32a6831caa4cb6b501a3914bcfaa9
SHA3 4f3a627ee7d533397f7f5c70bb2dafa8857150e674cb31edd96949c7905de509

4

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.65355
MD5 60719bac037d0712f35c5c90be495c9d
SHA1 a3041d7ee6ba7615452806f77a1c943595c21191
SHA256 30d1e986d0b31def6f13e53ff02c031bfbefcf963d61d5ad650b172ad7e860c7
SHA3 20b10baff88665c15ede11f5f30b5422805da2105be8358b0a1b3a41e89b13c6

5

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.43704
MD5 982c00bdd1b0ecc4c6ae5e68d8f1b87a
SHA1 489bbfba215b27140f141a2f394b0e65062cf357
SHA256 4035501adf394316fef967f0a20eedbf34126242bbeb9cbaad501af59aebd797
SHA3 84b3279e6fdd3055caf0f08cad67c578b24c6efc055823442d2d8a2f4a3cf547

6

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.16139
MD5 9366bb6f5fa80ec08957cad372d3facc
SHA1 16ceb7528f7b4306ecc56beb210331e415759c79
SHA256 7b310c0be8d06ce48affcc4f9aed1c0d788031b2a2f4ae57b69b66234a20d812
SHA3 471da3b7ffcb18564e3e4540ccbf2367ea343c40f28eab72e41caa70f1cd8871

7

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.07494
MD5 82837923a319386e182d74bceffdcd9a
SHA1 23bef5e2545d16d60bd84c8dc592698c6d6e9ca5
SHA256 34b88a55636fba814081ad56bda0f029a6a48647de3c0aa7c01ed483e8829832
SHA3 082d792ee6346e3ba3fcbc617a8365f6f5a4a32d518afee86445eef4fdfb5eca

8

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.18302
MD5 68d9845aa5d81b5ec9af61f410e35b16
SHA1 792b2a2e934bea082f9fa18aecc9cf7c56fec0cb
SHA256 e3462f80eb7b3b4010ea0ab4fb82033a565632230555ec565e1ee7ae8c01c04f
SHA3 3fbf18c6eae48b380506d26d691dd958d8d6c215e0c66402ea65e822fafc4da1

9

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.52312
MD5 2a1613d0845d00b916aa58adf0d41788
SHA1 9b80e5a340e2b46e6c1d1f5cdc71f70987a6362e
SHA256 c3a9d3b89fe9d0197f5d20a9a00f2e69c9218c57b95f21bd16d193d264725d1d
SHA3 6be13a8f2c46fc7d016e5e1338619a9c6aab8a2538fb392ad95ca1860d53663d

10

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.65168
MD5 9ea19e6905b73670bf173b6ed270f52d
SHA1 0990bc33abfc67bf30fa225c39caac330248ce4e
SHA256 1d07a182ee09e1ae5120d258c03c8cdd17797e00bca1e3c4d923b03c37c7cf1a
SHA3 6f95f1bd2ea42683b37b905d1215789ccae50a552cdf454d0f859234f5789216

11

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.39178
MD5 37ead5d2c4490f465242d3a884f19c37
SHA1 144dbce865b6cfccb00c3a1f2767639b166d90c7
SHA256 e11a688c6e3fecdb7bcdccaa350aa6fb9bffa50e81751ce4c38b6a26db692634
SHA3 97917334c00067d77ca349a361aeb6c9408e4dfda72615f0735be852c777ccf0

166

Type RT_MENU
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x50
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.68292
MD5 8140596ab00b98a11c13e6977d2d0977
SHA1 58abc231c2b5ac778a543a5dffcfabe867a6758d
SHA256 54f5e2ecbfc4f87380ca7466337676b99d0c4a21f806cf83f69fd48934c857ab
SHA3 7ccd3005ef4a3eccdb793d3b975a2f09338df5922357428238910610c0c59b70

7 (#2)

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x594
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.34702
MD5 d1f824f98742295a66a25225701dd6d8
SHA1 5b2075b778387182bf97314b593e73f30853435d
SHA256 4fe35e21717d34ceb4717f9e9de8fde1b3de80d76a59bb87405910c2f1d6284b
SHA3 294fc9961bf6eddc1dc7c5b525832f8aa8d3e90dac608e6421398510ab9c15b1

8 (#2)

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x68a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.2817
MD5 5beaeebda5346956e395fad21661f382
SHA1 201f2f699e6917e953821d64105b226fdd8b5528
SHA256 9306910d4bb273465765832df77fb1fd78bd6e0bcbf9908636e323c34c92b613
SHA3 d6430a84edfc22e41b15dd4f7cfc2d249bf5a637189d9284f062644b1503f9ee

9 (#2)

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x490
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.28849
MD5 6b12d17c7622d8215889a2288098fa15
SHA1 a511bf459e5043fcb234829bf66a99565c244652
SHA256 e47fa3aec12353f6370b941bc5855e5551530c7b26f925b5a2e2692a0201450c
SHA3 8e3541de418e1046806ffb977c8babecd093b9816c92883261b074d1c47d96fb

10 (#2)

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x5fc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.28373
MD5 949955dbda367f0c790615f7817e7886
SHA1 ee0370fb4ad59a4cebc3dbfc83bb437343fb803b
SHA256 4854e5abce2237256df24b69c9759fc1e8caa423a54bfe661ba7031afd8375eb
SHA3 5e36df684c6f2c4058d1a2507989eb5fc3c873159d006088d40f4da3804f56f2

11 (#2)

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x65c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.26322
MD5 9bc568a6176f738ffb3109e53235b579
SHA1 b97786555bfa05f958f174e294080e235d91b571
SHA256 d38369002e36f73866a0d40b13e069b9ffdbda50957f4c88d52a72fecb9b4e45
SHA3 94318c553eb0928412a92e8cf9913ca5c35a03aa8c24bf151a6764793b2f6f90

12

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x466
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.25812
MD5 899b8766aea5f88410c721620925754b
SHA1 53ba98192d7ea4fa9051ac220ed18960ab0507a6
SHA256 58ea125e6b5fa2cbc5a8ed819c7f50c9bca1cfe55f94c7cff3feb60f25ac6073
SHA3 7ad4457a556ba648b1d46e62549fdc4c7d093bbad286f9123daf6a94f0e5af62

313

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x158
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.08572
MD5 193a9143563395ad14c6dac83d32e2ad
SHA1 87ca08eb609f9ceabbd8ea7a64263de9a05bbb22
SHA256 b3711acbe8e01fee7fd362112b4e42da05c728e98b85c0a3b4cb075977849cee
SHA3 7634b4daca191c6fa53de1d5964fa47f382afccebf5744e70a702fd179fad715

SCRIPT

Type RT_RCDATA
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x754
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.88556
MD5 6fb361c45341adc87f10d01f38e31dd0
SHA1 2b70842f3771f3732ef32c1a61aab3a10171f513
SHA256 7efca1415a34c71b28230315d0af577af40ebb4abd9de510dbde41e2b9a6d8a1
SHA3 cc4d7adf7125057822fa195afee8041bd331138df54ceb625e0c3be8125734f3

99

Type RT_GROUP_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x76
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.8695
Detected Filetype Icon file
MD5 c88fc27c85891ac172b4d141b24c12ad
SHA1 342ea9dc007660254454fef30878c99bb3f9b525
SHA256 d886ef46aff4ad878304045ca0de6c140dac34f39440a4fa421968522ec6398b
SHA3 8b6669089819d1c4a15a968c334b83ee57e42664e4d850e8a37e958e1deeb036

162

Type RT_GROUP_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.02322
Detected Filetype Icon file
MD5 7a9605cb416b1a091d889b9d9f37ec66
SHA1 866c01641d672b6cd69901c1e055f174f47b35bb
SHA256 6bcce1250099cc08d574211b3debabb0244cd2641f6d960538e7ddc97d319164
SHA3 af43e622bf6c842d1ada2985f8e68920ff7b22d8a0b1a12871968c23b5065651

164

Type RT_GROUP_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.84274
Detected Filetype Icon file
MD5 f64c60b749269fcf6659c450dda98486
SHA1 42945c3496bc4e1943a1a05926a9b5ee31d3e450
SHA256 ae172a9a2fd008910b537c92a95b38bfba0e5bbdaaca719bf686e6415a7a2ba1
SHA3 443830acdeb37f2b7f844756492b2b11f9fb93e9171617d8c799cebfd05cb37f

169

Type RT_GROUP_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.02322
Detected Filetype Icon file
MD5 60f05e3b8ea9e18928923bdbcc112277
SHA1 d97726a6e9c326a37507f879feca7e152157839c
SHA256 7698ef362b288a7e3b96304ca50814b42518cba38598db9dbb36d8b90212d76a
SHA3 390fd88c6012552aecc7f109e733a1bf00339b8b3758127752832484c9f13ce6

1 (#2)

Type RT_VERSION
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0xdc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.77862
MD5 410f594f3ad95b1dd20e08e299b97c51
SHA1 523aa56f00d4d21ffcbd0f82cda655d88349a740
SHA256 ebfbc032f504c40d9098735ecfd8c80d996de100b07130e2855b9125e1f57fe5
SHA3 e785abf691c076cc1fc9cd02b8b7cc3ea433971151b12bd00999ac83071094c5

1 (#3)

Type RT_MANIFEST
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x3b0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.38312
MD5 2b71f29584c60b1b3af72f0a2d1eb914
SHA1 e218d720360d198c0b89cd4a03adf449ad2421c3
SHA256 c05698e03020c9d6a92408a69515367457b96ddf1c5697f630c230687bb9ecb6
SHA3 e7e2ca890a43c79c37153176606b6dca058e0c33c171012e73b492fd47bff822

String Table contents

(Paused)
AutoIt Error
AutoIt has detected the stack has become corrupt.
Stack corruption typically occurs when either the wrong calling convention is used or when the function is called with the wrong number of arguments.
AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.
"EndWith" missing "With".
Badly formatted "Func" statement.
"With" missing "EndWith".
Missing right bracket ')' in expression.
Missing operator in expression.
Unbalanced brackets in expression.
Error in expression.
Error parsing function call.
Incorrect number of parameters in function call.
"ReDim" used without an array variable.
Illegal text at the end of statement (one statement per line).
"If" statement has no matching "EndIf" statement.
"Else" statement with no matching "If" statement.
"EndIf" statement with no matching "If" statement.
Too many "Else" statements for matching "If" statement.
"While" statement has no matching "Wend" statement.
"Wend" statement with no matching "While" statement.
Variable used without being declared.
Array variable has incorrect number of subscripts or subscript dimension range exceeded.
Variable subscript badly formatted.
Subscript used on non-accessible variable.
Too many subscripts used for an array.
Missing subscript dimensions in "Dim" statement.
No variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.
Expected a "=" operator in assignment statement.
Invalid keyword at the start of this line.
Array maximum size exceeded.
"Func" statement has no matching "EndFunc".
Duplicate function name.
Unknown function name.
Unknown macro.
Unable to get a list of running processes.
Invalid element in a DllStruct.
Unknown option or bad parameter specified.
Unable to load the internet libraries.
"Struct" statement has no matching "EndStruct".
Unable to open file, the maximum number of open files has been exceeded.
"ContinueLoop" statement with no matching "While", "Do" or "For" statement.
Invalid file filter given.
Expected a variable in user function call.
"Do" statement has no matching "Until" statement.
"Until" statement with no matching "Do" statement.
"For" statement is badly formatted.
"Next" statement with no matching "For" statement.
"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.
"For" statement has no matching "Next" statement.
"Case" statement with no matching "Select"or "Switch" statement.
"EndSelect" statement with no matching "Select" statement.
Recursion level has been exceeded - AutoIt will quit to prevent stack overflow.
Cannot make existing variables static.
Cannot make static variables into regular variables.
Badly formated Enum statement
This keyword cannot be used after a "Then" keyword.
"Select" statement is missing "EndSelect" or "Case" statement.
"If" statements must have a "Then" keyword.
Badly formated Struct statement.
Cannot assign values to constants.
Cannot make existing variables into constants.
Only Object-type variables allowed in a "With" statement.
"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.
Object referenced outside a "With" statement.
Nested "With" statements are not allowed.
Variable must be of type "Object".
The requested action with this object has failed.
Variable appears more than once in function declaration.
ReDim array can not be initialized in this manner.
An array variable can not be used in this manner.
Can not redeclare a constant.
Can not redeclare a parameter inside a user function.
Can pass constants by reference only to parameters with "Const" keyword.
Can not initialize a variable with itself.
Incorrect way to use this parameter.
"EndSwitch" statement with no matching "Switch" statement.
"Switch" statement is missing "EndSwitch" or "Case" statement.
"ContinueCase" statement with no matching "Select"or "Switch" statement.
Assert Failed!
Obsolete function/parameter.
Invalid Exitcode (reserved for AutoIt internal use).
Variable cannot be accessed in this manner.
Func reassign not allowed.
Func reassign on global level not allowed.
Unable to parse line.
Unable to open the script file.
String missing closing quote.
Badly formated variable or macro.
Missing separator character after keyword.

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 0.0.0.0
ProductVersion 0.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United Kingdom
Resource LangID English - United Kingdom

IMAGE_DEBUG_TYPE_RESERVED

Characteristics 0
TimeDateStamp 2014-Jun-01 17:44:52
Version 0.0
SizeofData 4
AddressOfRawData 0xb2778
PointerToRawData 0xb1178

TLS Callbacks

Load Configuration

Size 0x48
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x4badc0
SEHandlerTable 0
SEHandlerCount 0

RICH Header

XOR Key 0xcda605b9
Unmarked objects 0
199 (41118) 1
ASM objects (50929) 51
C objects (50929) 174
C++ objects (50929) 50
C objects (VS2008 SP1 build 30729) 9
Imports (VS2008 SP1 build 30729) 37
Total imports 532
216 (VS2012 UPD4 build 61030) 77
ASM objects (VS2012 UPD4 build 61030) 2
Resource objects (VS2012 UPD4 build 61030) 1
151 1
Linker (VS2012 UPD4 build 61030) 1

Errors

<-- -->