2b8ad09d1a1ec76623751a0669192443

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2017-Oct-31 08:38:17
Detected languages English - United States
CompanyName Cloud Installer
FileDescription IESettings
FileVersion 4, 2, 0, 6
InternalName IESettings
LegalCopyright Copyright (C) 2017 Cloud Installer
OriginalFilename IESettings
ProductName IESettings
ProductVersion 4, 2, 0, 6

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Info Cryptographic algorithms detected in the binary: Uses constants related to SHA1
Microsoft's Cryptography API
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
  • LoadLibraryExA
Possibly launches other programs:
  • ShellExecuteW
Uses Microsoft's cryptographic API:
  • CryptCreateHash
  • CryptAcquireContextW
  • CryptHashData
  • CryptDestroyHash
  • CryptGetHashParam
  • CryptReleaseContext
Memory manipulation functions often used by packers:
  • VirtualProtect
  • VirtualAlloc
Has Internet access capabilities:
  • InternetCloseHandle
  • InternetCrackUrlW
  • InternetOpenW
  • InternetConnectW
Can take screenshots:
  • GetDC
  • CreateCompatibleDC
  • BitBlt
Malicious The PE is possibly a dropper. Resource 130 detected as a PE Executable.
Info The PE is digitally signed. Signer: Cloud Installer.
Issuer: GlobalSign CodeSigning CA - SHA256 - G3.
Malicious VirusTotal score: 32/66 (Scanned on 2017-11-05 18:55:57) MicroWorld-eScan: Gen:Variant.Zusy.260852
McAfee: StartPage-FAM
Cylance: Unsafe
K7GW: Adware ( 00516a1f1 )
K7AntiVirus: Adware ( 00516a1f1 )
Arcabit: Trojan.Zusy.D3FAF4
GData: Gen:Variant.Zusy.260852
Kaspersky: HEUR:Trojan.Win32.StartPage
BitDefender: Gen:Variant.Zusy.260852
NANO-Antivirus: Trojan.Win32.StartPage.esqohz
Rising: Adware.Agent!1.ADA9 (CLASSIC)
Ad-Aware: Gen:Variant.Zusy.260852
Emsisoft: Application.AdSearch (A)
F-Secure: Gen:Variant.Zusy.260852
DrWeb: Adware.Downware.18374
VIPRE: Trojan.Win32.Generic!BT
Invincea: heuristic
McAfee-GW-Edition: StartPage-FAM
Ikarus: PUA.Agent
Jiangmin: Trojan.StartPage.cop
Avira: TR/Dropper.onxnv
Endgame: malicious (high confidence)
ZoneAlarm: HEUR:Trojan.Win32.StartPage
AhnLab-V3: PUP/Win32.StartPage.R211933
ALYac: Gen:Variant.Zusy.260852
AVware: Trojan.Win32.Generic!BT
MAX: malware (ai score=85)
ESET-NOD32: a variant of Win32/Adware.Agent.NSS
Yandex: PUA.Downware!
SentinelOne: static engine - malicious
Cybereason: malicious.1b8fb7
CrowdStrike: malicious_confidence_90% (D)

Hashes

MD5 2b8ad09d1a1ec76623751a0669192443
SHA1 a6bc2045041bbc8ede0550905a841bef6e44347a
SHA256 514bd237e7a9ae8da02df218b9b093f001d314e9e9bc2bf610302f4c35e611af
SHA3 084426d9103be42a29e72aaa9dcbf817b7cfb437632025dad6f3007ce72dd1cb
SSDeep 12288:VixBNzULnRq4s2v/gvi2nBtZnfVq4cz165pPKpx4CQH2m:237vM/gq2nBLfVqx1eApCt2m
Imports Hash 8ba3e30652a2906ffd8ae3e937221272

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2017-Oct-31 08:38:17
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0x3fc00
SizeOfInitializedData 0xc9400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x20362 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x41000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.1
ImageVersion 0.0
SubsystemVersion 5.1
Win32VersionValue 0
SizeOfImage 0x10b000
SizeOfHeaders 0x400
Checksum 0x10c27e
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 458f1c1fc21de0d5409d9045327de201
SHA1 2afb9a1cccbdcb6a213d3edbb7fb92317c541733
SHA256 022f8a780a85b8cc3d4602193907078cf54d8e454e5ec115cc7c65d5f337abde
SHA3 2e4fdb8b877290cd37170b817e7e1871013b67441bc723db70e5ca6114ad99a7
VirtualSize 0x3fbf7
VirtualAddress 0x1000
SizeOfRawData 0x3fc00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.64129

.rdata

MD5 f5c619f171110c2b1799b7042f541bff
SHA1 75469fda8a9a2bdf204060e9ba9d0174b7ab0357
SHA256 97957f5079440dc5216600c194f2a7072a75f3d3a5988a56f97a78572cdeea5a
SHA3 2b025e5a349ca501abe533d06cbea31d1a70dc6bcc2535c11fb371c007e28db8
VirtualSize 0x15c7e
VirtualAddress 0x41000
SizeOfRawData 0x15e00
PointerToRawData 0x40000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.29602

.data

MD5 f3e901c25679fd6a78cbe1c7fa1cfea4
SHA1 0781eaf6b06aae2c19ed195c317815bb941a7a49
SHA256 cf30d41dc51ad97aa0616aeaf3987da01cc7f33c1d427c5900bb2696af04fcd8
SHA3 b8868e33557da60e96506fa388ff14e6156b7b88de9a429679631bcd26a6dbae
VirtualSize 0x2c8c
VirtualAddress 0x57000
SizeOfRawData 0x1e00
PointerToRawData 0x55e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.08121

.rsrc

MD5 7860165961dc0a55fd975796d1ceadff
SHA1 f7cf162ba49dfe94bf7aa5716fda4a47ed2447d4
SHA256 c685fb4ea9df95a7dfed9916b8d6eec404ce4939df2c2405d1df13b089ecef38
SHA3 b7b77f48c4ce59f6a0b24c593063502d10df66f5c0fcce0fa9a8e81e5d62610f
VirtualSize 0xac980
VirtualAddress 0x5a000
SizeOfRawData 0xaca00
PointerToRawData 0x57c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.57296

.reloc

MD5 db8d0a17c6f484e61b2674cc26b2c25d
SHA1 61762d04c956a9f1c89671280e3197e3d5825844
SHA256 938490961d7711690ffb4ad77b416b8c5b8065d7538dc4128176533702867ed2
SHA3 92cff8f0f2f23e12dca642d19fcdf3c3428865e7a8b0a8a866941560e0288c4a
VirtualSize 0x3c3c
VirtualAddress 0x107000
SizeOfRawData 0x3e00
PointerToRawData 0x104600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.54049

Imports

OLEACC.dll AccessibleObjectFromWindow
KERNEL32.dll InterlockedIncrement
lstrcmpiW
LoadLibraryExW
TlsSetValue
LeaveCriticalSection
InterlockedDecrement
EnterCriticalSection
WideCharToMultiByte
GetCurrentProcessId
CreateThread
MultiByteToWideChar
SetFileAttributesW
GetFileAttributesW
GetProcessId
GetModuleFileNameW
CreateDirectoryW
MulDiv
GetModuleHandleW
FindResourceW
ReadConsoleW
SetEndOfFile
WriteConsoleW
SetFilePointerEx
FlushFileBuffers
SetStdHandle
FreeLibrary
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetConsoleMode
GetConsoleCP
EnumSystemLocalesW
LoadResource
FindResourceExW
LockResource
Sleep
SizeofResource
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionAndSpinCount
HeapFree
GetProcAddress
GetUserDefaultLCID
IsValidLocale
GetFileType
GetACP
WriteFile
GetStdHandle
GetModuleHandleExW
ExitProcess
VirtualQuery
VirtualProtect
GetSystemInfo
RtlUnwind
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
SetEvent
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
GetSystemTimeAsFileTime
ReadFile
SetFilePointer
CreateFileW
CloseHandle
GetFileSize
SetLastError
GetCurrentThreadId
GlobalAlloc
GlobalLock
GlobalUnlock
lstrcmpW
GetCurrentProcess
GetEnvironmentVariableW
TlsGetValue
FormatMessageW
LocalFree
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
GetStringTypeW
CreateEventW
TlsAlloc
TlsFree
USER32.dll UpdateWindow
GetDesktopWindow
BeginPaint
UnregisterClassW
EndPaint
KillTimer
CallWindowProcW
PostMessageW
CharNextW
MessageBoxW
ShowWindow
InvalidateRect
GetWindowLongW
GetWindowThreadProcessId
GetMessageW
DefWindowProcW
GetWindowRect
DestroyWindow
GetDC
IsWindowVisible
SetWindowPos
EqualRect
EnumChildWindows
CreateWindowExW
GetSystemMetrics
RegisterClassExW
IsWindow
DispatchMessageW
SetTimer
PeekMessageW
GetWindowTextW
GetCursorPos
ReleaseDC
SetForegroundWindow
ReleaseCapture
RegisterWindowMessageW
GetParent
GetClassInfoExW
GetDlgItem
GetClientRect
SetCapture
SetFocus
CreateAcceleratorTableW
GetSysColor
IsChild
DestroyAcceleratorTable
ClientToScreen
RedrawWindow
InvalidateRgn
SetWindowTextW
SendMessageW
ScreenToClient
FillRect
GetFocus
GetWindow
GetWindowTextLengthW
MoveWindow
EnumWindows
LoadBitmapW
SetLayeredWindowAttributes
TranslateMessage
LoadCursorW
GetClassNameW
SetWindowLongW
DrawTextW
GDI32.dll GetObjectW
DeleteDC
GetStockObject
CreateCompatibleBitmap
CreateSolidBrush
CreateFontIndirectW
SetBkMode
SetTextColor
GetDeviceCaps
CreateCompatibleDC
SelectObject
BitBlt
DeleteObject
GetDIBits
ADVAPI32.dll CryptCreateHash
CryptAcquireContextW
RegQueryInfoKeyW
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
RegEnumKeyW
RegQueryValueExW
SHELL32.dll SHGetFolderPathW
ShellExecuteW
ShellExecuteExW
ole32.dll OleLockRunning
CoGetClassObject
OleUninitialize
StringFromGUID2
CoTaskMemRealloc
CreateStreamOnHGlobal
OleInitialize
CLSIDFromString
CLSIDFromProgID
CoCreateGuid
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
CoUninitialize
CoInitialize
OLEAUT32.dll #161
#420
#313
#7
#4
#162
#9
#314
#2
#6
#8
#277
SHLWAPI.dll UrlEscapeW
PathAppendW
PathAddBackslashW
UrlUnescapeW
WININET.dll InternetCloseHandle
HttpSendRequestW
InternetCrackUrlW
InternetOpenW
HttpOpenRequestW
InternetConnectW

Delayed Imports

STYLES.CSS

Type CSS
Language English - United States
Codepage UNKNOWN
Size 0xc7c
Entropy 5.10055
MD5 dd87afa2834dc77457e66767d66c5fe6
SHA1 8ee92cd85115d08a7839da3367d60e76ef9f436d
SHA256 3ce0d6b1c8cdaff66d39a63bfdd851467b688dcb5634c59f2277dbb0af37c447
SHA3 a60187f8a68f3f1e783f475fa38648e2b1686f8e5ef3af0b49634d22b31e5bf4

130

Type FILES
Language English - United States
Codepage UNKNOWN
Size 0x4f438
Entropy 6.3821
Detected Filetype PE Executable
MD5 1357c3a30fba77aee1849c87b317aecf
SHA1 aa8f32f26137fe724f2de6409e51f0dd94bbb5a4
SHA256 c93916f95d71ed5c2ee1c64607cd23cd7ddc54b57b10604f9a826c422ebcc1cc
SHA3 5ddaf5e1e9eef9f24ae4872ebc2b82622badf120b7807cf7891ab1447722a1ac

GREEN-BTN.PNG

Type IMG
Language English - United States
Codepage UNKNOWN
Size 0x460
Entropy 6.27294
Detected Filetype PNG graphic file
MD5 128f37218d3a0cde6c6e3289e3d649ba
SHA1 f4ddee164ce9dba0c15794f8936e4b3fbbf7da87
SHA256 7370e527fc206d3d5ebd56eb6b15d91a96459eebcddffd488935d31402e7d329
SHA3 65f46dcfe5a69e0b83cde8c6da56fa95055bd0d2a25aa480eb707a35a0c1cadd

GREY-BTN.PNG

Type IMG
Language English - United States
Codepage UNKNOWN
Size 0x458
Entropy 6.20807
Detected Filetype PNG graphic file
MD5 ec801557dff8b503b9338fe9b6bd61a4
SHA1 07b3af73c0f3b11535c618dbd6b1a89f5c7cb789
SHA256 06e6259b95a8854987189b3a082f390d29a9053f07909f9c82b9f8926b56dfaa
SHA3 b90491c3714024b2536a3a7b017107dbab3596ffb5361b7d0e0b1d3a03d31b39

IE.PNG

Type IMG
Language English - United States
Codepage UNKNOWN
Size 0x906
Entropy 7.54478
Detected Filetype PNG graphic file
MD5 1d31771c35e9c075c7a3c0e87686a925
SHA1 be17d61d9e0fe0054812443ea7ac3f411648e973
SHA256 db0722e0b77342b96e8a7cd734192455e82e0717bcfe98520e085aac48895fae
SHA3 61ce7a2f897ee0f3ed3110d64b4737ef9b6b8930f3935a47f14ffb1edb04e798

DBG.JS

Type JS
Language English - United States
Codepage UNKNOWN
Size 0x19c
Entropy 4.37209
MD5 04be6b6b29ddc67de95f160d8398d521
SHA1 098b05e2bf08d3b6b2a3d94ea00025092824857a
SHA256 fc7c8b68e63efe64d422d410b1e234c7eaa21085d12288c93ec85121a3dbedc6
SHA3 a5fa7837c7016295ceb66f8bdf9fe5729222ce01dbd954b582684412ec280181

SCRIPT.JS

Type JS
Language English - United States
Codepage UNKNOWN
Size 0x55c
Entropy 5.15525
MD5 9842fa10cbb9b16afb2dc0401bd4ea25
SHA1 45bfe0e096ce420e586d1ae177ad609587c94982
SHA256 6a2e67b64fbeb7d26dd4c4040fd3ae6029ca22de89dcd42735c4a9efe02dc681
SHA3 0cb5dc3b44495c6acbf05606ee36b1f367f50f8204b6a76c3dfd7cf7b2c043e7

132

Type RT_BITMAP
Language English - United States
Codepage UNKNOWN
Size 0x2118a
Entropy 1.3097
MD5 ea4d02f77714dd3615f23957e614e953
SHA1 1f7128e0e19076d222706733dc501d5ade4b88cd
SHA256 abc59fee7f3ef29490bb13a6a69f7c2a305815946029149f1aad57413cd6cae8
SHA3 508e4acb23519db321d0f83cf736742b9780cb7f7d471c92c53d2ef6cddeea26
Preview

133

Type RT_BITMAP
Language English - United States
Codepage UNKNOWN
Size 0x267ba
Entropy 3.18501
MD5 cee1f3e8173b436660cc761871b632ca
SHA1 5169c6020f40b7281fd95edea75aac75adfc318b
SHA256 e0279de88dc4c9a4ba0e6aa0471215b7aea9939e58dc541558dc35dc2d4eb3c8
SHA3 31c540b73b670a980509d5e925a79067cde3c8d61aae6a5b93710c809bd90370
Preview

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2e8
Entropy 2.89005
MD5 6084b8ad73747b299699eb3eec45e7dc
SHA1 2c9ce3ea9a49025409f4fbe0fbaa8d505c07a378
SHA256 b4b2f722234d9e7f31ff4facd631adcc0482b81c4ad1eb1458fc822175277c21
SHA3 601f73a411a4173161b443e41812a6640a402878b80d2b9d7ff31566ed8ddb62

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x128
Entropy 2.54353
MD5 e8658c45887b965ef05fc75aa46500e3
SHA1 0091c56d319743f075ce4d7af0ef65b896a02041
SHA256 803572ed52c34a6b6c2efa70c0f7a5279e21bad55a4d5d18744b270937404fe2
SHA3 364363b38f791b5ebf2083e2378d835f272cd950a1da59af40cd2cfc13b773e6

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xea8
Entropy 4.35478
MD5 d042f1c698b7e67ab19323c03defcfaa
SHA1 a7f6b7f33babceb621f66db8e4932e4668ad916d
SHA256 0a4938500c6f3d33430c7fed3c2271a78b34ee727a78475eb6d1a435f4a00bdb
SHA3 2cd49871a4d3f06e6bf994e41d9318e7a26ce2368bdcc5981c76cd1f9de7ca49

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8a8
Entropy 5.17501
MD5 43553baed02ba66915b18d4e17cfce16
SHA1 f00698b999f0887c350c61e4aa083d79bea26cb7
SHA256 2ae3c5d4d767d49adf27595ac6e6c282cba327b4cdb89f9dc2a735c314eb7d18
SHA3 3ab201fffc8fe69ed6b610a04a7a6533cdb3f6f1444b8a6abdd7bad0ccd41f12

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x568
Entropy 3.47748
MD5 4ac79bef346bca3604bba0e200cbda0b
SHA1 f45f4f77b61adba0151d1942c978689e41e28dae
SHA256 b1f2927559496473b1bd7ca8d8cb21b67e56eefa87fc06945eba67c71d268645
SHA3 d8674c6e83fdb5c70b6d94514fffe3f570c721277abcc0559add9124f5191a62

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
Entropy 2.83156
MD5 4786e9acb4ceb2b23d50e0dabb6cecd5
SHA1 164fadfaa648ed5c8adb7dd14b494b3501ed77de
SHA256 10f2dfcb31c0f0816447923633e79ef4ff7ca1bf89d5f6984e4cce62615ea729
SHA3 e9ca5049693ed2b528b2e8a54aa83193ee6ae813a206a3b53068c22a43a2a25e

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
Entropy 3.44197
MD5 4f6369dca29c639671dd504fa585b183
SHA1 09b1ab98de685f3f09d47b93f6186963c03b7946
SHA256 aec3c266b0f119a982069893611ffd2cdd271fdbcf915b17fdf9b00d445676c9
SHA3 fc9001b031f80ed7154f95fe297acde7746a37d34bab003254875a450da99959

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
Entropy 4.05874
MD5 d10df39d7ee26d29c547f5df1da71fa1
SHA1 dcbba9f2f7c3c5f6e884d4ed8b36f6cb6055317c
SHA256 7ad7dd241cc84dad41c3f1ee55c9272bd835e6172e6144423af4be38ce3fe2a1
SHA3 f34f44601af306ede93165a9111ca87db8f82f107a6f7f75866818d5fe815a69

9

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2e8
Entropy 2.89005
MD5 6084b8ad73747b299699eb3eec45e7dc
SHA1 2c9ce3ea9a49025409f4fbe0fbaa8d505c07a378
SHA256 b4b2f722234d9e7f31ff4facd631adcc0482b81c4ad1eb1458fc822175277c21
SHA3 601f73a411a4173161b443e41812a6640a402878b80d2b9d7ff31566ed8ddb62

10

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x128
Entropy 2.54353
MD5 e8658c45887b965ef05fc75aa46500e3
SHA1 0091c56d319743f075ce4d7af0ef65b896a02041
SHA256 803572ed52c34a6b6c2efa70c0f7a5279e21bad55a4d5d18744b270937404fe2
SHA3 364363b38f791b5ebf2083e2378d835f272cd950a1da59af40cd2cfc13b773e6

11

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xea8
Entropy 4.35478
MD5 d042f1c698b7e67ab19323c03defcfaa
SHA1 a7f6b7f33babceb621f66db8e4932e4668ad916d
SHA256 0a4938500c6f3d33430c7fed3c2271a78b34ee727a78475eb6d1a435f4a00bdb
SHA3 2cd49871a4d3f06e6bf994e41d9318e7a26ce2368bdcc5981c76cd1f9de7ca49

12

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8a8
Entropy 5.17501
MD5 43553baed02ba66915b18d4e17cfce16
SHA1 f00698b999f0887c350c61e4aa083d79bea26cb7
SHA256 2ae3c5d4d767d49adf27595ac6e6c282cba327b4cdb89f9dc2a735c314eb7d18
SHA3 3ab201fffc8fe69ed6b610a04a7a6533cdb3f6f1444b8a6abdd7bad0ccd41f12

13

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x568
Entropy 3.47748
MD5 4ac79bef346bca3604bba0e200cbda0b
SHA1 f45f4f77b61adba0151d1942c978689e41e28dae
SHA256 b1f2927559496473b1bd7ca8d8cb21b67e56eefa87fc06945eba67c71d268645
SHA3 d8674c6e83fdb5c70b6d94514fffe3f570c721277abcc0559add9124f5191a62

14

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
Entropy 2.83156
MD5 4786e9acb4ceb2b23d50e0dabb6cecd5
SHA1 164fadfaa648ed5c8adb7dd14b494b3501ed77de
SHA256 10f2dfcb31c0f0816447923633e79ef4ff7ca1bf89d5f6984e4cce62615ea729
SHA3 e9ca5049693ed2b528b2e8a54aa83193ee6ae813a206a3b53068c22a43a2a25e

15

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
Entropy 3.44197
MD5 4f6369dca29c639671dd504fa585b183
SHA1 09b1ab98de685f3f09d47b93f6186963c03b7946
SHA256 aec3c266b0f119a982069893611ffd2cdd271fdbcf915b17fdf9b00d445676c9
SHA3 fc9001b031f80ed7154f95fe297acde7746a37d34bab003254875a450da99959

16

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
Entropy 4.05874
MD5 d10df39d7ee26d29c547f5df1da71fa1
SHA1 dcbba9f2f7c3c5f6e884d4ed8b36f6cb6055317c
SHA256 7ad7dd241cc84dad41c3f1ee55c9272bd835e6172e6144423af4be38ce3fe2a1
SHA3 f34f44601af306ede93165a9111ca87db8f82f107a6f7f75866818d5fe815a69

107

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x76
Entropy 2.81158
Detected Filetype Icon file
MD5 c0b3e66fcb80cecddabf09088b3e8188
SHA1 f112cc8039776eaebae28f9be81059bbdda5f357
SHA256 0f8e66b41e930335fa661b03299b12d6e7d8f04e7e35a117cb6966b9d1258497
SHA3 83b9309059c6a623cf79395eb4c917fac16050cb98b74458fb51313ddc305030

108

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x76
Entropy 2.89031
Detected Filetype Icon file
MD5 bec90fe8c2831d7b1f8c707f812be04c
SHA1 8645ad55a70014fc9cf51a362e9ccdb672f7c5fa
SHA256 a12825f060d10af25681c04a123353e9574a65314b0ae748c59f82b70992fde8
SHA3 25df1abff69d40da1ad393327d7e6fa56d6fb8e58e23466955e3c5dda2cd65aa

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x2ec
Entropy 3.34889
MD5 6aa272224c948e3355a17266c6033441
SHA1 a439350f6db89dc3f542341a2772c616e52e67db
SHA256 31483a3c1082b8e9eb2b00ecfe625002f11c5646a90c387f4a8b0dec85c86768
SHA3 a1022e1c7b85fe20e83d1f8998e66f71e7afd65bab24845389d194cc6c69eb0c

MAIN.HTML

Type RT_HTML
Language English - United States
Codepage UNKNOWN
Size 0x713d
Entropy 4.97357
MD5 bc4bac22d9d0c1c7e9a5f1455ef2288d
SHA1 e6abf681a3c6858ce2000c7cab234e32358085df
SHA256 e331706cc3a1b6ae216c1026a5ea4d81643aaaba384e2a131a68a253ed48e096
SHA3 2ba0bc9dff1953807a0e71f17e34b776ccbbbcbd332c52425151f674fbe115ce

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x336
Entropy 5.3298
MD5 73faacbcdc7822a038c4e3786814611d
SHA1 287208b33c407a0b361d0ce2767111875e20a9f3
SHA256 411d4b3df3807e19bca735fd7415be9bbbfa9a87293a2d16bc53dda75845e50f
SHA3 4b998721ad4f0c839c6c1aea8748abdc0300b33ebaa4aa75d6d4234bc6a5ca44

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 4.2.0.6
ProductVersion 4.2.0.6
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_UNKNOWN
Language English - United States
CompanyName Cloud Installer
FileDescription IESettings
FileVersion (#2) 4, 2, 0, 6
InternalName IESettings
LegalCopyright Copyright (C) 2017 Cloud Installer
OriginalFilename IESettings
ProductName IESettings
ProductVersion (#2) 4, 2, 0, 6
Resource LangID English - United States

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2017-Oct-31 08:38:17
Version 0.0
SizeofData 952
AddressOfRawData 0x527a4
PointerToRawData 0x517a4

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2017-Oct-31 08:38:17
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

StartAddressOfRawData 0x452b6c
EndAddressOfRawData 0x452b74
AddressOfIndex 0x459318
AddressOfCallbacks 0x441470
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x98
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x45706c
SEHandlerTable 0x452560
SEHandlerCount 145

Errors