1c0d70b2c78c2849f46e20246d95e797

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2018-Dec-15 22:24:27
Detected languages English - United States

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • http://nsis.sf.net
  • http://nsis.sf.net/NSIS_Error
  • nsis.sf.net
Suspicious The PE is an NSIS installer Unusual section name found: .ndata
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
Can access the registry:
  • RegCreateKeyExW
  • RegOpenKeyExW
  • RegEnumValueW
  • RegDeleteKeyW
  • RegDeleteValueW
  • RegCloseKey
  • RegSetValueExW
  • RegQueryValueExW
  • RegEnumKeyW
Possibly launches other programs:
  • CreateProcessW
Can create temporary files:
  • GetTempPathW
  • CreateFileW
Functions related to the privilege level:
  • AdjustTokenPrivileges
  • OpenProcessToken
Changes object ACLs:
  • SetFileSecurityW
Can shut the system down or lock the screen:
  • ExitWindowsEx
Info The PE is digitally signed. Signer: Canonical Group Ltd
Issuer: DigiCert SHA2 Assured ID Code Signing CA
Safe VirusTotal score: 0/68 (Scanned on 2020-10-06 23:32:14) All the AVs think this file is safe.

Hashes

MD5 1c0d70b2c78c2849f46e20246d95e797
SHA1 0accef792e339c313fd6ba3edcf52731b5e01a63
SHA256 e2081358cc39c162638f2bbce13d6112be7c2a30fa4929957a7926c562f2bc43
SHA3 55b7c8d110f498bcdd825991e95f8a1dfe856d92b9435f79b9a0ab686f71708f
SSDeep 393216:VrZ3xBSOTSWBxhVtVjGOc9KqgwL75eNQI1CNxzA/HKAboNA:VrZL1WstVyNKza75eN+xzAPA
Imports Hash 36956b8afe29f2a3ab8da477ffc90ff1

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xd8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2018-Dec-15 22:24:27
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x6400
SizeOfInitializedData 0x22a00
SizeOfUninitializedData 0x800
AddressOfEntryPoint 0x00003359 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x8000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 6.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0xb4000
SizeOfHeaders 0x400
Checksum 0x1453dfa
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 5814efda24a547f46f687d77de540309
SHA1 c3dfb339a6dffa3166d5fbb679d9767000d00579
SHA256 8fa91df538a5ccd46a98daea6a6ee64a1bc3869836e28010029fde9a16ee498b
SHA3 a3c7a38a106241093bb0e358ff0a672c2555d81049b2a50bd84fa9226c9f04f5
VirtualSize 0x62a5
VirtualAddress 0x1000
SizeOfRawData 0x6400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.43142

.rdata

MD5 ef1be07ca8b096915258569fb3718a3c
SHA1 b3f5a61ee3b0ff0039fa67b0859b610767bb6d6c
SHA256 940a0f8f96a018e30a7059880f0a735a95b74e9e0a9bf8d8dcb861243995b564
SHA3 3a278746278d598dc2797deafd84160417c78189461aa0f86c82204c275ee1a5
VirtualSize 0x1396
VirtualAddress 0x8000
SizeOfRawData 0x1400
PointerToRawData 0x6800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.15971

.data

MD5 7d0d44c89e64b001096d8f9c60b1ac1b
SHA1 e4d30d7d64c9ca7ad7bafa8c83b036e1974033cb
SHA256 d0ed4ce58577fa0e4cedcc2ff6e01a47d867b30f1126247ff386b07b2053220f
SHA3 99469d80f8803218405023cc68dfe62050f39eca864545f8915aa9d810093e37
VirtualSize 0x20318
VirtualAddress 0xa000
SizeOfRawData 0x600
PointerToRawData 0x7c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.90464

.ndata

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x20000
VirtualAddress 0x2b000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc

MD5 46e3705020d610deefa3dffafb9ec563
SHA1 233cdc8bec1e53d4c5c895c2c276939477f8e1c3
SHA256 f11def716049e47712a24919d018ba56cc8c2a629e113ee276c8d07d5d619160
SHA3 5f1043d3a9dc7f48fd3da9a9fa9ced1112503612cc0dd2690c80b83c483173a6
VirtualSize 0x68ab0
VirtualAddress 0x4b000
SizeOfRawData 0x68c00
PointerToRawData 0x8200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.81141

Imports

KERNEL32.dll SetEnvironmentVariableW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
SetCurrentDirectoryW
GetFileAttributesW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
ExitProcess
GetShortPathNameW
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
WriteFile
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiW
MoveFileW
GetFullPathNameW
SetFileTime
SearchPathW
CompareFileTime
lstrcmpW
CloseHandle
ExpandEnvironmentStringsW
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
lstrlenA
MulDiv
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
USER32.dll GetSystemMenu
SetClassLongW
EnableMenuItem
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ScreenToClient
GetWindowRect
GetDlgItem
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
GetDC
SetTimer
SetWindowTextW
LoadImageW
SetForegroundWindow
ShowWindow
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
EndPaint
CreateDialogParamW
SendMessageTimeoutW
wsprintfW
PostQuitMessage
GDI32.dll SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
SHELL32.dll SHGetSpecialFolderLocation
ShellExecuteExW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
ADVAPI32.dll AdjustTokenPrivileges
RegCreateKeyExW
RegOpenKeyExW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
COMCTL32.dll ImageList_Create
ImageList_AddMasked
ImageList_Destroy
#17
ole32.dll OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Delayed Imports

110

Type RT_BITMAP
Language English - United States
Codepage UNKNOWN
Size 0x666
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.82633
MD5 b6bf70baab40fe438feff063bfb9ff6f
SHA1 7d4659d43e08d368ddacd31945872461c0b06253
SHA256 0e90a9e4b8f3a5bf990e8aadfd8096ad7aeaf1a4e032ac7b6395ce191d61c142
SHA3 cab98fabaf20118d9a8a4d2bcff4383a7291a0e04ff11a8690e71eed619c75e7
Preview

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x42028
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.52785
MD5 5f83293a4895117aaa1d6b5b2979c066
SHA1 a436036a7c7f1d053fd94420f2e964e58244997c
SHA256 39e3450f5e2b4433b69f196a437e6d7414123ad992a3cdf8a84d89eebb8df765
SHA3 c0f05843b2837058be5ef8a67f0ca811ca69e5b2d92a4e82edb5c479758cc5fd

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.69931
MD5 5468ddc274511e4f6ed5a23dbc72dfca
SHA1 0465a3022d6c259d5a15ac91ace6ebae3551975b
SHA256 50d55cb9643bc0155151b2b5469f96c4af378f7596876adc194b43a943465375
SHA3 9044621215f2dbfd750ccbc8a29472a70f122a4231afee33172960fac1ab33c7

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.91626
MD5 b3659208924781372dffe6d51fc663b3
SHA1 168ee2bbb8ba782c2ee8dd98bbfe06b6422055cb
SHA256 7e8d7a4f67119e8e940b96db664aa7c8d0ee1aa858115d862b1dbc380b33d6d8
SHA3 c3c02cb6dd53d1ff7e82b2acbf5211dfc7b6b88e5c9ac2b7deb033a825494e46

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.99439
MD5 fb63d06b2d53ed19d07b6b10ac2b8db6
SHA1 420cf9ade673c59a1ea3ccfc12f15159cda38354
SHA256 c384f457b1c169c33748b8c3c1eff56f98de46ee23c0bb58cf170f20dfbd6240
SHA3 1e9ab2ce9ba947ab3cf263e9c2d5238bdd640ea810e6c122bbd327c9764be1b2

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x1ca8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.20961
MD5 e40e5e4fb4a312f020f041363f5d410e
SHA1 9915b1ee9505940c99b8e7a5971a3cff9cf0cb85
SHA256 ba70d16573a9294ce948193b06e9e585f4d943d343c5a7b7e3798fcf6e87ab0d
SHA3 f971246b45bbafa8ec67d0c429dfb93ccb8fe65fabbee4272de5ce0d8b3eb238

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xca8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.56336
MD5 b9784b166406343d12e57a63c406b028
SHA1 959532a482dd3f9ca3dbc8a6db2991c2f98c723e
SHA256 2d334d62c98ba596d2330b7263b67a163a28d4055da22b30f0976f024c30503d
SHA3 00adb9834490fcfee5e69c7c45aefa8aa1f67732cc73be63fd3761c056c1b0c7

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.75251
MD5 e6bff8049248d4f552170aee94d310f0
SHA1 c5b76a1ef39bff69dd8c5ae7bc14cac8a96d5c6e
SHA256 d491c32a603216ff09596907c73fc06772e7db94c9c7646b36a383cbef100b85
SHA3 142989293dcfdbc15cf37343c1ef405d1d693bc313f5045eb479ae03160b4a57

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.95725
MD5 78377aeb067c7dcf7f56642a4a52e1da
SHA1 5be12a0de25152926d87b7a1d38216d2fd20a386
SHA256 d3d6c3c0e43d99c65e1c1f9f4b85bdfa904014f594a0d5b3e50d6571eeda2145
SHA3 3bfbebe4243edd8d00e6455dfa0507d35b0f10aa4f696c95a9107c19bc4ce28b

102

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xb4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71813
MD5 a69caf66f3f899403f8b25b02dc61908
SHA1 3e5db9186cf0f75be24676462d88170e5950d9c8
SHA256 7854e8d67a11148566ad37c5d23e1534e0990fe31a160e0e7da3ca751830bb50
SHA3 1eea945e3712b317143e07560f54b0b9a13b1fd6c2b57cab9176181a9aaf4f79

103

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x120
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.56193
MD5 db6dd0434da4d7cac564518725167e09
SHA1 a65a1367d7cd96450f089a8f8108239bbcea9f5b
SHA256 c50631fc1f8425a95fd1edcc8e730d339e193a38f18d42372c32847a5ad2c016
SHA3 4e3be5455c51e1cb04836e318cb69ecdffd2deadd0f338d4bc985d8f5ca653ff

104

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x158
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.70411
MD5 9bf5ce4f6c93b09e4f5659e204c7ef69
SHA1 70260f4f07476e289d4f0da08f6ea81edf377c05
SHA256 4978808cfa3a9f541262585edca9b87268d2025e637f7254b269cef216b39a79
SHA3 006381732c2dfc87ce25f0b93f7446bbeb1549e901e375f8a720af89e0ef211a

105

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x200
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.67385
MD5 d1a92272fbd597e1aa19021483110d5a
SHA1 9f75072682b37c6c52361d8c988ebd06dd003f63
SHA256 15663576584c947d634dab9848defcc7d8f05eb0b7e7c6d52d81eca695fc7a6e
SHA3 704756797695ae34f6fae500852bca70e5066a1d1993348fe40ccf626235d0d6

106

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xf8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.91148
MD5 fa83652660409e90e0db9731ad2adb17
SHA1 0a8f0af67723c87fe26ccf676b8e19ec6357b4dc
SHA256 4a55bd714f5d50cd8eabba10e57f0618f1842717dcfa582d73a917b1933cd1d4
SHA3 5b3e1cb25be7a2dbae4f08f0d4794ed23dbd6ea37a3f9702be12dba588f42a7b

107

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xa0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.52183
MD5 6ffba239dcfcab2080195f23947b70aa
SHA1 bcda1ca8ee9bb9878bde83aa06c670bb5a4d5843
SHA256 a7e5ea849cb343e9b58de221aeb25c9dd4a3748070bfba879a30c4265fc39023
SHA3 a75544b4c3fcbcb32fe4e02d1a631e045b2e58516aa1065bb96cce681aea7030

111

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xee
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.89887
MD5 663040d6315b1d6ce8c0334d182ed8fc
SHA1 ebcfff801a12fb8ad1200a4526fca8bd2c3e96cf
SHA256 cb3c86cbcb579244a6f819f9c1807a7e89b6e600982ec6ea0841fcdcb16a9efd
SHA3 6a25a2cb16aeb17693f10e8aaa0245c701701db571b458fde7830291a4a01cfc

202

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xb4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.9709
MD5 574849c09594bf406fe5f0b24d9080b8
SHA1 38608268473fb2fcd3e0f2315a492c737546c946
SHA256 2bf6e20d1b7aac0364482a6e48f6429cf48b8c0f744d6ff1cecbb3297416c893
SHA3 e07659d8daf9e860f9bac52009287326aad72cc5806cf3825d64dc1fbb699ff9

203

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x120
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.84487
MD5 12402b54eddc39fa3dae283957b4eb4c
SHA1 beccbeac143c7c78d7271c20c73df7e797c6224b
SHA256 4017b96a65ef43c2d6781adc75b048ed8568f3068b81ee971154b90886766250
SHA3 d1f0eb13adc7d47e9aa7da0e3a996fd742075668a840e149a5f391955e438793

204

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x158
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.05809
MD5 c183d60d1f20e41782cbdcf22e840c6a
SHA1 ca0296653b0bf2a251436597af18c1b278dbd708
SHA256 4962260f0b1b83e8110ac3c5094212453992b5edbfd9f08aeefa807ef3478326
SHA3 f66e46e857e5371ea28bc60116fd9168d549f4fa4d8e59b6135b4ccc4bad2711

205

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x200
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.97219
MD5 8862e4aa98b1d5fc07fe6502e91d06d2
SHA1 729d8fc72945f0303e81dd04914b2721e90a035a
SHA256 ce653ba55bd5aaf5ac9e0929603095b8794a10190fa9ac917f204ae6fd697f95
SHA3 a95410994a75373358a9a7e88988f1d6b7585e93ea0b5deda9459bf0ecfed454

206

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xf8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.10966
MD5 1ffe62afd7fe045c34a23ea5c9c7eb22
SHA1 ac211007f1f7a65d868d6e9e658d5ff26dec9c8e
SHA256 184073a317c843cbe92b68cfacebcf5d73dedb538b3f79c048090f3ee5b614ff
SHA3 f34fe335d0a39aedd236cfe40879f6624bc468df8195f5360c1d7267f2bd0113

207

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xa0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.79455
MD5 f487ea2664475901e7728e27028f78e1
SHA1 05a70c71e7e06c712ca99e8ce88bf6dd5779bdf2
SHA256 e705e251daa451ade5cc3f36278401ce4eb8b3e32ca0a7d5b7e03f525934d770
SHA3 33f0ad42457a216bac4cb66e6209ff5ba1aa1b9895f7e906a6d70fb58c9ed675

211

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xee
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.06584
MD5 7ce8a17102daebb8d864cd1063e987d1
SHA1 072345a235d4947d36b53fd47da68e7e6a93fe62
SHA256 0fd40b240b9df8f2dece8947dabbebce898f12becca8e196136e4231efba2dc1
SHA3 59c7281c1d6dca36fed8a44ee5b408f11090812626d5c5fe1da3d72b526208ab

302

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xb4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.9709
MD5 574849c09594bf406fe5f0b24d9080b8
SHA1 38608268473fb2fcd3e0f2315a492c737546c946
SHA256 2bf6e20d1b7aac0364482a6e48f6429cf48b8c0f744d6ff1cecbb3297416c893
SHA3 e07659d8daf9e860f9bac52009287326aad72cc5806cf3825d64dc1fbb699ff9

303

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x120
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.84487
MD5 12402b54eddc39fa3dae283957b4eb4c
SHA1 beccbeac143c7c78d7271c20c73df7e797c6224b
SHA256 4017b96a65ef43c2d6781adc75b048ed8568f3068b81ee971154b90886766250
SHA3 d1f0eb13adc7d47e9aa7da0e3a996fd742075668a840e149a5f391955e438793

304

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x158
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.05809
MD5 c183d60d1f20e41782cbdcf22e840c6a
SHA1 ca0296653b0bf2a251436597af18c1b278dbd708
SHA256 4962260f0b1b83e8110ac3c5094212453992b5edbfd9f08aeefa807ef3478326
SHA3 f66e46e857e5371ea28bc60116fd9168d549f4fa4d8e59b6135b4ccc4bad2711

305

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x200
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.97219
MD5 8862e4aa98b1d5fc07fe6502e91d06d2
SHA1 729d8fc72945f0303e81dd04914b2721e90a035a
SHA256 ce653ba55bd5aaf5ac9e0929603095b8794a10190fa9ac917f204ae6fd697f95
SHA3 a95410994a75373358a9a7e88988f1d6b7585e93ea0b5deda9459bf0ecfed454

306

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xf8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.10966
MD5 1ffe62afd7fe045c34a23ea5c9c7eb22
SHA1 ac211007f1f7a65d868d6e9e658d5ff26dec9c8e
SHA256 184073a317c843cbe92b68cfacebcf5d73dedb538b3f79c048090f3ee5b614ff
SHA3 f34fe335d0a39aedd236cfe40879f6624bc468df8195f5360c1d7267f2bd0113

307

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xa0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.79455
MD5 f487ea2664475901e7728e27028f78e1
SHA1 05a70c71e7e06c712ca99e8ce88bf6dd5779bdf2
SHA256 e705e251daa451ade5cc3f36278401ce4eb8b3e32ca0a7d5b7e03f525934d770
SHA3 33f0ad42457a216bac4cb66e6209ff5ba1aa1b9895f7e906a6d70fb58c9ed675

311

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xee
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.06584
MD5 7ce8a17102daebb8d864cd1063e987d1
SHA1 072345a235d4947d36b53fd47da68e7e6a93fe62
SHA256 0fd40b240b9df8f2dece8947dabbebce898f12becca8e196136e4231efba2dc1
SHA3 59c7281c1d6dca36fed8a44ee5b408f11090812626d5c5fe1da3d72b526208ab

402

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xb4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.9709
MD5 574849c09594bf406fe5f0b24d9080b8
SHA1 38608268473fb2fcd3e0f2315a492c737546c946
SHA256 2bf6e20d1b7aac0364482a6e48f6429cf48b8c0f744d6ff1cecbb3297416c893
SHA3 e07659d8daf9e860f9bac52009287326aad72cc5806cf3825d64dc1fbb699ff9

403

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x120
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.84487
MD5 12402b54eddc39fa3dae283957b4eb4c
SHA1 beccbeac143c7c78d7271c20c73df7e797c6224b
SHA256 4017b96a65ef43c2d6781adc75b048ed8568f3068b81ee971154b90886766250
SHA3 d1f0eb13adc7d47e9aa7da0e3a996fd742075668a840e149a5f391955e438793

404

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x158
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.05809
MD5 c183d60d1f20e41782cbdcf22e840c6a
SHA1 ca0296653b0bf2a251436597af18c1b278dbd708
SHA256 4962260f0b1b83e8110ac3c5094212453992b5edbfd9f08aeefa807ef3478326
SHA3 f66e46e857e5371ea28bc60116fd9168d549f4fa4d8e59b6135b4ccc4bad2711

405

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x200
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.97219
MD5 8862e4aa98b1d5fc07fe6502e91d06d2
SHA1 729d8fc72945f0303e81dd04914b2721e90a035a
SHA256 ce653ba55bd5aaf5ac9e0929603095b8794a10190fa9ac917f204ae6fd697f95
SHA3 a95410994a75373358a9a7e88988f1d6b7585e93ea0b5deda9459bf0ecfed454

406

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xf8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.10966
MD5 1ffe62afd7fe045c34a23ea5c9c7eb22
SHA1 ac211007f1f7a65d868d6e9e658d5ff26dec9c8e
SHA256 184073a317c843cbe92b68cfacebcf5d73dedb538b3f79c048090f3ee5b614ff
SHA3 f34fe335d0a39aedd236cfe40879f6624bc468df8195f5360c1d7267f2bd0113

407

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xa0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.79455
MD5 f487ea2664475901e7728e27028f78e1
SHA1 05a70c71e7e06c712ca99e8ce88bf6dd5779bdf2
SHA256 e705e251daa451ade5cc3f36278401ce4eb8b3e32ca0a7d5b7e03f525934d770
SHA3 33f0ad42457a216bac4cb66e6209ff5ba1aa1b9895f7e906a6d70fb58c9ed675

411

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xee
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.06584
MD5 7ce8a17102daebb8d864cd1063e987d1
SHA1 072345a235d4947d36b53fd47da68e7e6a93fe62
SHA256 0fd40b240b9df8f2dece8947dabbebce898f12becca8e196136e4231efba2dc1
SHA3 59c7281c1d6dca36fed8a44ee5b408f11090812626d5c5fe1da3d72b526208ab

502

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xac
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.85266
MD5 b4a711ea331ef37edbdcfba3261c7d6f
SHA1 e0637b9d34f0f7e6062d57c16b4966b82992c017
SHA256 a840add98ce3e545a78516701570cc7f667edceafb59fdd5067fcf5f7f1a1f50
SHA3 1dd7bb05d075b71ea1a2a58dc99c4a011966c0dadf66d50d7f92671018a15f7f

503

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x118
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.64541
MD5 44c009c9e1abc2355198b432965c61ef
SHA1 4c090f75f279e474a9ca4a07ac84935aa769b0dd
SHA256 85f659842e9aa525dc22d0ff4e18e14d4e4ccfc924d1fdfa03d50a0410e6c0d6
SHA3 f829f224ca0ee8e4f9b0c51c79cc819098ab16c3d55912e0c1aade1677d1a921

504

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x150
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.79084
MD5 b710f88bd3f73d1b4e049f56aed8ec03
SHA1 3c5993f9d9bb2e4eecae4fe17717e887c58e32e6
SHA256 71def7189fc52d18edf23b50f54dd9649e7f8d0af8cb3e473c0e7ae69e520701
SHA3 14a5d3131bc90e633e9894bb59cb5abe1e9034ba1e3e24c81bd31ba2afc9c2e6

505

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x1f8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71643
MD5 cae4b9e0d6b26cd47ff08bf9caa17328
SHA1 9ac464bef48ffaa183c841c233b5191355cc0172
SHA256 cb1fbea7e1572cf89436c06cc6f9a8a80b2d373ab34168f507caf6096439059b
SHA3 617c1131b8dc21344105aea8affaa21aec2972b56b8aa95075595d8a95bc8a83

506

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xf0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.04696
MD5 c7239ce55362dabbe3887e5fc4bdf5fe
SHA1 a2908207ffb889a12da3cbdbe7446e04b254e7ed
SHA256 012557f58e68234d4a88df0b713c59800f798ecce19dfd589d326b458dddcbd8
SHA3 34f4adf15b3169820de0c298735a1ea7bc4e5c9737c5baac458a5fbfb356b1f6

507

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x98
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.67356
MD5 20fb1c16c2fb378f7898586b5fead1f1
SHA1 422ebb7d48e88efe0018bab324b8d22daf843913
SHA256 fac1657ebf59503492e63acd008993e2f4e99eeea783438c2bc439d5ec61d061
SHA3 108352320e2fcffcb3038a953d93e57625136e0d5fec98ea3d32dd26c05f5758

511

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xe6
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.09674
MD5 30dab3583979c2008e8de9295ab7c36b
SHA1 186cd9560b358bbf8b523d1050573f22bb00264d
SHA256 8c64a2341dc473a7d8ab4956af589e9a7257c4f05a8dc229f862c16d49ba37e5
SHA3 4449f57b4725dc59d7d66dc9b817250112828d0f5d6b31cba247cd36ff544268

602

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xa0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.62197
MD5 1ed2fb1101579baf34b084389badb21d
SHA1 1fd06fc03e8ce1d2a1fa3d2aaa75859b92e96a94
SHA256 7fbf793fc596333bb6b11552851aa26641d5a314d225807679428703e29e8e3c
SHA3 b66674c6ca649a2b29fd887414284ea545014b728ddf144f4f2ee6942d3ada45

603

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x10c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.484
MD5 b21b5bb94f7cb7111620ebfb32534430
SHA1 d4fa9452937d98ccb59bdc96660d588a5183bba9
SHA256 eb6f4dac693c6249bb157ef5cfe6057af4088d7bacfce7089e13a85f0661389a
SHA3 08dbbf11ee68c7b878492fecb06c7ac64f494ec1cde2b58149e4a6b1af9f3913

604

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x144
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.65364
MD5 f3db4d90959d196eb0090d357bd0ece2
SHA1 28619143fa9f6aff96810fa1affeef35d14b42fc
SHA256 103f4fea853885d6397c9a935554982d546849ec9a53430357c484c77e3edc5e
SHA3 bd07fdcc70c9e8416eee0a40eb2b632942bdf8cac8bbac1642021a6f7bb78831

605

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x1ec
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.61
MD5 6ce2e4ec1c8fd96d2c66f197c0734558
SHA1 709ce74d2bf4eec6a2c2010d8e5599ee481e4d3e
SHA256 a1082eddd56f0def44e4ce3c82b0a9a09cee9dbcb3097ab31d49ff98bcd6681c
SHA3 03ad5128d8a033a66344e19fc7594ff2503089df916d71240295ed66cd032ec3

606

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xe4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.86295
MD5 cc0021533c65b44747600689ff5fbd43
SHA1 b1d1e4594f5ad7b08d56a25cdbe6d9b9378e482b
SHA256 ab1e3ad5b5d87630cb0f6a6671c10fe49d9c33839be0d5daeba89ec053dda92c
SHA3 84d6def5cee15efe0091dd2b0c1f1293ccd14684a0736bd33e1c5aa70c3471f7

607

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x8c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.4032
MD5 f18e5bc6afd9a34529db189b07c43af9
SHA1 7cee0818fb1ce1230b47efa7bbc2b2798da71974
SHA256 4d809a7f62bab96e41b9d541bf9326843e646b24d3d6dd621e2f543d79b6db0b
SHA3 c854006aa1dbd4f7fe6de00f4abe8688c4373e8ac1597e6b6a56587f8061936b

611

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xda
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.92694
MD5 408a7443d8f432b28a248059d8669d1c
SHA1 c199828e8051a2825b1d5e216360eb57cd0b37f7
SHA256 4677979c1665998318fcb65b9a0c0b3dd9204c12dbddbd5e76df8822ed6e347a
SHA3 a3fbf76ef107912c1222e3203143386903416d7d7c171d53f3e0988bea2e4923

702

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xa0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.63447
MD5 fab97a8381f73abc22dadd71f1e3ddc6
SHA1 1b7b6407f406adeb2d987f1e56bf4c253f39a239
SHA256 532e2112c57a72219970c759f62865067d6d31b4e1acf97280cd8e9aaee2b59f
SHA3 a0a71bed82f24790856fa562cfdfbc200a2caaaa8b595251b244661ce7897b28

703

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x10c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.47654
MD5 888fbcc92ebd6174786b32d45350005a
SHA1 ba4959d06247a07012fbca926691e2e709c7aa8f
SHA256 b98ac97ffc283bc465d34958c79f8a31480c0f98eb44c5e23977bee9ba52b703
SHA3 1ec3fb0c9114bc10f7c71e9bf1d15c48a5e39fd99193dfce3db02c097cbb626c

704

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x144
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.64746
MD5 88ebed77ddfce87be86192767bf34d54
SHA1 470b7bce5430a9706aadc148f40360cf8b25397e
SHA256 0a6825e4badb916099bd01d7a90ff7be147f91406ca6c77d5bcd486a4ba32350
SHA3 fa3ee8f26ea3aa8f390f9bff69726bee5cac9dd76cb7e8313ed16691b63b463b

705

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x1ec
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.6156
MD5 928bbd8e7e4f5c1aebcc8d7aea0126f4
SHA1 254ea8c62c604bcf3be54284a1ee6b8d35864efd
SHA256 f77c0b2757f974432c964c850a53a5b98db6d90ce3862e167793811eed0d1347
SHA3 a27d85d5aa2a3cecbf2a5d9084ed440678e5689b85e4bb385aa74fdc8ec96ff9

706

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xe4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.86626
MD5 8c69d2c81dd2d9050d0fa94df90ff16b
SHA1 cd71d904da747d7141e5abdde9363f7e240b26bd
SHA256 1a39a3aabdee2aa68c507c55ff37c38722b05b7f8bde66185a2462792381d8cd
SHA3 b80b33ab6bf40b07bc32c7a6a11831084f7c97a27dff86d576769d0aab14b979

707

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x8c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.4032
MD5 9b3723824cb53db37937eae597b204e4
SHA1 4c8e5e1eb9c1ac7330ed5b1a86b7017659f2ddcf
SHA256 8ec647f9650b79179d5afc3e2bd8ecaa4b4617ada8c69c22382321a16f2153e0
SHA3 adae96de10c1b72db08f70fe15ca3214c3f374b2af3305eef7d58ba569766e0e

711

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xda
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.9304
MD5 2497a44fff8b76b5129662b60a617c85
SHA1 f73bd7c9caa4c1f7a0e4840d69b0accdc6d167a0
SHA256 a10617b39293152a65ad5c91ca4f35135845c7b785e3a582e58f6c8229045b85
SHA3 aaf1dc708c305944a11a7180ef5ee2c8f722c3dd6d4bf91e0ae0f6c2b1a331ca

802

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xa4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.77222
MD5 ac4c0f9289476de2ac0063307fdb2b5d
SHA1 c7ba5d223d0dec4e73bad3b6c259a41c9ce3bb21
SHA256 41e897b69ea656aada8496cd365ce0a68e8cac392fa204d05decbc8e5ceb5fb4
SHA3 5ecbed8eedefa8abfec5d36a2cf6c49a7b1ef789b478f6be6173123bc539fd6e

803

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x110
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.58011
MD5 088199de88ee4293982cec0b65748394
SHA1 ccce70fc022137c746dfb6bf52cd785b8675768d
SHA256 583b62d87b496612f7e10bf1da5113b8a4c83f0a2155184d03c0b2ec14fb5ed1
SHA3 855ba3bd893d691d7c7f704da34c23efd96142d6deefc65d3bdb0e2968f97d95

804

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x148
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.72239
MD5 b3fc5403fc07177c0a6f5e700b96f3a8
SHA1 4a92b6e01f9a0802776bb5cc529a36662621c240
SHA256 dc13910e381eb2cd6204ffc0f9da62e8d97a9a2ca6774ebd9ae04385df76d0f0
SHA3 5eebaf1f5aabab72f2762ecc1b6af8c81abcbdd99f75c32500022777b2bdf768

805

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x1f0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.66995
MD5 327c4c7d72cfccbc825db2223fff0194
SHA1 ac964308ef6baa20aa381b269ecad756e98f5109
SHA256 c8908172569e23a001394e98e4dea3f5e1c57e8cb6f1703ec1c9983adbff35d0
SHA3 bd235e490c85fd86b25086046a00ea0d514984003ce377e6978dd87c040a780b

806

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xe8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.96511
MD5 c33758ab32a791644973dfd60cbf6034
SHA1 ee7eb0a27279d39a959f5d35b6dfd4c18c7123fa
SHA256 6e7bca0054a1785929747807906d8527c2c2a231ca5975d8ebb3a3f98353f129
SHA3 8883e9e9fe2e8e33f0c0a0dcb5c13456e825a62100aa3e10099e225770ecc9ff

807

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x90
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.57512
MD5 08b86cd771567bfb5592cee9a624f8db
SHA1 c6ad899a33a52c7aaaa2413bba825f00a80f0c58
SHA256 35a4541f6a8d718c035768b617d0f2f59e7b57653058ad2cc0e7ddb77d9513e6
SHA3 59c16e6302f73e702aa57c613ca8a6831f081642b82011aa81f85fa54eb2ae31

811

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xde
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.03655
MD5 2802ee53bc08ac9a2cfaed81b3d79d05
SHA1 b7faac6a14545ea9c03651f69ae27cce0e62b010
SHA256 65fb71b054977a55435f45bbcddddedaa1e1cf43fdd9fc230938d625c3f7edcd
SHA3 1b03466617102ef078d2690bf5a361563eae8b960554205937f87a6c81d328c5

103 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x76
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.00115
Detected Filetype Icon file
MD5 d47f50a8bc1eab800f46cc68adcfc37c
SHA1 8b9bff5461224050dd71b4aeaaa2b6cf48a57a0b
SHA256 098fd15344904ac1466dae371744a9c7ae3685392dea9bed2fdb630add1dbc7c
SHA3 2d1fa24654d60b132211bf93ee986d91a82c5c5fdbeb3c81aadcd34fdfc35139

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x42e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.28794
MD5 71e6dc0a76c021a9fc19781a35d5955e
SHA1 504c882d8797328943082182fe6aa74530977fcf
SHA256 97d9168ab7ed15bc99cd4a0a3ef30197cc1c0d2613f2c8bb136aa0ac6e266270
SHA3 73c322cbeb6a910464789ba45ab36d7ebf367f08e182a7378aed32a363e71f7b

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xd26650e9
Unmarked objects 0
C objects (VS2003 (.NET) build 4035) 2
Total imports 165
Imports (VS2003 (.NET) build 4035) 15
48 (9044) 10
Resource objects (VS98 SP6 cvtres build 1736) 1

Errors

[*] Warning: Section .ndata has a size of 0!