35c8f524e601f7cb3ded5d3db9c7514ccfea6b8bcfdf1e5a2c20d46038ec0498

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1992-Jun-19 22:22:17
Detected languages Chinese - Taiwan

Plugin Output

Info Matching compiler(s): Microsoft Visual Basic 5.0
Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual Basic v5.0 - v6.0
Microsoft Visual C++
Microsoft Visual C++ v6.0
Suspicious PEiD Signature: ASPack v2.12
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to system / monitoring tools:
  • Rundll32.exe
  • bcdedit.exe
  • regsvr32.exe
 Contains references to internet browsers:
  • chrome.exe
  • iexplore.exe
 May have dropper capabilities:
  • CurrentControlSet\Services
  • CurrentVersion\Run
  • Programs\Startup
 Contains another PE executable:
  • This program cannot be run in DOS mode.
 Miscellaneous malware strings:
  • cmd.exe
 Contains domain names:
  • AR.txtdisplaylanguagenames.es
  • BE.txtdisplaylanguagenames.nl.txtDisplayLanguageNames.nl
  • BG.txtdisplaylanguagenames.bg.txtDisplayLanguageNames.ca
  • BO.txtdisplaylanguagenames.es
  • CA.txtDisplayLanguageNames.fr
  • CH.txtDisplayLanguageNames.de
  • CH.txtdisplaylanguagenames.it.txtDisplayLanguageNames.it
  • CL.txtdisplaylanguagenames.es
  • CN.txtdisplaylanguagenames.uk
  • CO.txtdisplaylanguagenames.es
  • CR.txtdisplaylanguagenames.es
  • DE.tDisplayLanguageNames.de
  • DK.txtdisplaylanguagenames.da.txtDisplayLanguageNames.de
  • DO.txtdisplaylanguagenames.es
  • EC.txtdisplaylanguagenames.es
  • ES.tDisplayLanguageNames.es
  • ES.txtdisplaylanguagenames.ca.txtDisplayLanguageNames.ca
  • FR.tDisplayLanguageNames.fr
  • GT.txtdisplaylanguagenames.es
  • HN.txtdisplaylanguagenames.es
  • HU.txtdisplaylanguagenames.hu.txtDisplayLanguageNames.it
  • IT.tDisplayLanguageNames.it
  • JP.txtdisplaylanguagenames.it
  • MX.txtdisplaylanguagenames.es
  • NI.txtdisplaylanguagenames.es
  • NL.tDisplayLanguageNames.nl
  • PA.txtdisplaylanguagenames.es
  • PE.txtdisplaylanguagenames.es
  • PR.txtdisplaylanguagenames.es
  • PREEURO.txtdisplaylanguagenames.ca
  • PREEURO.txtdisplaylanguagenames.de
  • PREEURO.txtdisplaylanguagenames.es
  • PREEURO.txtdisplaylanguagenames.fi.txtDisplayLanguageNames.fr
  • PREEURO.txtdisplaylanguagenames.fr
  • PREEURO.txtdisplaylanguagenames.it
  • PREEURO.txtdisplaylanguagenames.nl
  • PY.txtdisplaylanguagenames.es
  • RO.txtdisplaylanguagenames.ro.txtDisplayLanguageNames.ru
  • RU.txtdisplaylanguagenames.ru.txtDisplayLanguageNames.ru
  • SV.txtdisplaylanguagenames.es
  • TR.txtdisplaylanguagenames.tr.txtDisplayLanguageNames.uk
  • TRADITIONAL.txtdisplaylanguagenames.es.txtDisplayLanguageNames.es
  • UA.txtdisplaylanguagenames.ru
  • UA.txtdisplaylanguagenames.uk
  • US.txtdisplaylanguagenames.es
  • UY.txtdisplaylanguagenames.es
  • VE.txtdisplaylanguagenames.es
  • adobe.com
  • aia.ws.symantec.com
  • ar.tDisplayLanguageNames.es
  • armmf.adobe.com
  • be.tDisplayLanguageNames.nl
  • bg.tDisplayLanguageNames.ca
  • bg.txtDisplayLanguageNames.ca
  • bo.tDisplayLanguageNames.es
  • ca.tDisplayLanguageNames.he.txtdisplaylanguagenames.fr
  • ca.txtDisplayLanguageNames.ca
  • ch.tDisplayLanguageNames.el.txtdisplaylanguagenames.de
  • cl.tDisplayLanguageNames.es
  • co.tDisplayLanguageNames.es
  • cr.tDisplayLanguageNames.es
  • crl.thawte.com
  • crl.verisign.com
  • crl.ws.symantec.com
  • cs.txtdisplaylanguagenames.ca
  • da.txtDisplayLanguageNames.de
  • dk.tDisplayLanguageNames.de
  • do.tDisplayLanguageNames.es
  • eDisplayLanguageNames.es
  • ec.tDisplayLanguageNames.es
  • el.txtdisplaylanguagenames.de
  • es.tDisplayLanguageNames.cs.txtdisplaylanguagenames.ca
  • es.txtDisplayLanguageNames.es
  • et.txtdisplaylanguagenames.es
  • evcs-aia.ws.symantec.com
  • evcs-crl.ws.symantec.com
  • fi.txtDisplayLanguageNames.fr
  • go.microsoft.com
  • gt.tDisplayLanguageNames.es
  • he.txtdisplaylanguagenames.fr
  • helpx.adobe.com
  • hn.tDisplayLanguageNames.es
  • http://crl.thawte.com
  • http://crl.thawte.com/ThawteTimestampingCA.crl0
  • http://crl.verisign.com
  • http://crl.verisign.com/pca3-g5.crl0
  • http://evcs-aia.ws.symantec.com
  • http://evcs-aia.ws.symantec.com/evcs.cer0
  • http://evcs-crl.ws.symantec.com
  • http://evcs-crl.ws.symantec.com/evcs.crl0
  • http://evcs-ocsp.ws.symantec.com04
  • http://go.microsoft.com
  • http://go.microsoft.com/fwlink/?LinkId
  • http://helpx.adobe.com
  • http://helpx.adobe.com/reader.htmlARPURLINFOABOUTAdobe
  • http://kb2.adobe.com
  • http://kb2.adobe.com/cps/404/kb404946.htmlKBDOCLINK_ERROR_INVDRIVEen_US,ca_ES,eu_ES,bg_BG,zh_CN,zh_TW,cs_CZ,da_DK,de_DE,es_ES,et_ET,fr_FR,hr_HR,hu_HU,it_IT,ja_JP,ko_KR,lt_LT,lv_LV,nl_NL,nb_NO,pl_PL,pt_BR,ro_RO,ru_RU,sk_SK,sl_SI,fi_FI,sv_SE,tr_TR,uk_UALANG_LISTLC_UNSUPPORTED_OSSetup
  • http://ocsp.thawte.com0
  • http://ocsp.verisign.com0
  • http://ts-aia.ws.symantec.com
  • http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
  • http://ts-crl.ws.symantec.com
  • http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
  • http://ts-ocsp.ws.symantec.com07
  • http://www.adobe.com
  • http://www.adobe.com/go/reader_system_reqs.Advertising
  • http://www.adobe.com/go/reader_system_reqs.LC_UNSUPPORTED_OS_1Adobe
  • http://www.adobe.com/support/main.htmlARPCONTACTCompleted
  • http://www.adobe.comADOBE_LINK72ARMCheckFrequencyhttps
  • http://www.symauth.com
  • http://www.symauth.com/cps0
  • http://www.symauth.com/cps09
  • http://www.symauth.com/rpa04
  • http://www.xcat-industries.com
  • http://www.xcat-industries.com/forum
  • https://armmf.adobe.com
  • https://armmf.adobe.com/arm-manifests/win/ArmManifest.msiManifestURL&Open,0,2ManufacturerOpen
  • https://armmf.adobe.com/arm-manifests/win/ReaderDCManifest.msiARMManifestLocationDISABLE_FIU_CHECK
  • https://armmf.adobe.com/arm-manifests/win/ServicesUpdater/DCRdrManifest.msiWebRcscManifestURL
  • https://armmf.adobe.com/arm-updates/win/ARM-NEXT/ARM_update/AdobeARM.msiARM_Update
  • hu.tDisplayLanguageNames.it.txtDisplayLanguageNames.it
  • hu.txtDisplayLanguageNames.it
  • industries.com
  • it.txtDisplayLanguageNames.it
  • kb2.adobe.com
  • microsoft.com
  • mx.tDisplayLanguageNames.es
  • ni.tDisplayLanguageNames.es
  • nl.txtDisplayLanguageNames.nl
  • no.tDisplayLanguageNames.nl
  • no.tDisplayLanguageNames.nl.txtDisplayLanguageNames.nl
  • pDisplayLanguageNames.es
  • pDisplayLanguageNames.es.txtDisplayLanguageNames.es
  • pDisplayLanguageNames.fr
  • pDisplayLanguageNames.pl.txtdisplaylanguagenames.nl
  • pa.tDisplayLanguageNames.es
  • pe.tDisplayLanguageNames.es
  • pl.txtdisplaylanguagenames.nl
  • pr.tDisplayLanguageNames.es
  • py.tDisplayLanguageNames.es
  • ro.tDisplayLanguageNames.ru
  • ro.txtDisplayLanguageNames.ru
  • ru.tDisplayLanguageNames.sk.txtdisplaylanguagenames.ru
  • ru.txtDisplayLanguageNames.ru
  • sk.txtdisplaylanguagenames.ru
  • sv.tDisplayLanguageNames.es
  • symantec.com
  • symauth.com
  • tDisplayLanguageNames.ca
  • tDisplayLanguageNames.cs.txtdisplaylanguagenames.ca
  • tDisplayLanguageNames.de
  • tDisplayLanguageNames.el.txtdisplaylanguagenames.de
  • tDisplayLanguageNames.es
  • tDisplayLanguageNames.et.txtdisplaylanguagenames.es
  • tDisplayLanguageNames.fr
  • tDisplayLanguageNames.he.txtdisplaylanguagenames.fr
  • tDisplayLanguageNames.it
  • tDisplayLanguageNames.it.txtDisplayLanguageNames.it
  • tDisplayLanguageNames.nl
  • tDisplayLanguageNames.nl.txtDisplayLanguageNames.nl
  • tDisplayLanguageNames.ru
  • tDisplayLanguageNames.sk.txtdisplaylanguagenames.ru
  • tDisplayLanguageNames.uk
  • thawte.com
  • tr.tDisplayLanguageNames.uk
  • tr.txtDisplayLanguageNames.uk
  • traDisplayLanguageNames.es
  • ts-aia.ws.symantec.com
  • ts-crl.ws.symantec.com
  • txtDisplayLanguageNames.ca
  • txtDisplayLanguageNames.de
  • txtDisplayLanguageNames.es
  • txtDisplayLanguageNames.fr
  • txtDisplayLanguageNames.it
  • txtDisplayLanguageNames.nl
  • txtDisplayLanguageNames.ru
  • txtDisplayLanguageNames.uk
  • txtdisplaylanguagenames.bg.txtDisplayLanguageNames.ca
  • txtdisplaylanguagenames.ca
  • txtdisplaylanguagenames.ca.txtDisplayLanguageNames.ca
  • txtdisplaylanguagenames.da.txtDisplayLanguageNames.de
  • txtdisplaylanguagenames.de
  • txtdisplaylanguagenames.es
  • txtdisplaylanguagenames.es.txtDisplayLanguageNames.es
  • txtdisplaylanguagenames.fi.txtDisplayLanguageNames.fr
  • txtdisplaylanguagenames.fr
  • txtdisplaylanguagenames.hu.txtDisplayLanguageNames.it
  • txtdisplaylanguagenames.it
  • txtdisplaylanguagenames.it.txtDisplayLanguageNames.it
  • txtdisplaylanguagenames.nl
  • txtdisplaylanguagenames.nl.txtDisplayLanguageNames.nl
  • txtdisplaylanguagenames.ro.txtDisplayLanguageNames.ru
  • txtdisplaylanguagenames.ru
  • txtdisplaylanguagenames.ru.txtDisplayLanguageNames.ru
  • txtdisplaylanguagenames.tr.txtDisplayLanguageNames.uk
  • txtdisplaylanguagenames.uk
  • us.tDisplayLanguageNames.es
  • uy.tDisplayLanguageNames.et.txtdisplaylanguagenames.es
  • verisign.com
  • ws.symantec.com
  • www.adobe.com
  • www.microsoft.com
  • www.symauth.com
  • www.xcat-industries.com
  • xcat-industries.com
Info Cryptographic algorithms detected in the binary: Uses constants related to SHA1
Suspicious The PE is packed with Aspack or Armadillo Unusual section name found: .aspack
Unusual section name found: .adata
Unusual section name found: .SCY
Section .SCY is both writable and executable.
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExA
  • GetProcAddress
  • LoadLibraryA
 Functions which can be used for anti-debugging purposes:
  • FindWindowA
 Code injection capabilities (PowerLoader):
  • GetWindowLongA
  • FindWindowA
 Can access the registry:
  • RegQueryValueExA
  • RegOpenKeyExA
  • RegCloseKey
  • RegSetValueExA
  • RegFlushKey
  • RegCreateKeyExA
 Possibly launches other programs:
  • WinExec
 Can create temporary files:
  • GetTempPathA
  • CreateFileA
 Uses functions commonly found in keyloggers:
  • MapVirtualKeyA
  • GetForegroundWindow
  • CallNextHookEx
 Enumerates local disk drives:
  • GetLogicalDriveStringsA
  • GetDriveTypeA
 Changes object ACLs:
  • SetSecurityInfo
 Can take screenshots:
  • CreateCompatibleDC
  • BitBlt
  • GetDCEx
  • GetDC
  • FindWindowA
 Reads the contents of the clipboard:
  • GetClipboardData
 Can shut the system down or lock the screen:
  • ExitWindowsEx
Suspicious The PE header may have been manually modified. The resource timestamps differ from the PE header:
  • 2008-Feb-12 15:37:30
Suspicious The file contains overlay data. 2569843 bytes of data starting at offset 0x6c800.
Overlay data amounts for 85.2562% of the executable.
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 936c33bee789ca4b4a23b4f61aee96ae 🔍
SHA1 a028af7126b98f822c7e7d25aa81109722dee3de 🔍
SHA256 35c8f524e601f7cb3ded5d3db9c7514ccfea6b8bcfdf1e5a2c20d46038ec0498 🔍
SHA3 a42778627eafe40bde68ee8c785787af3fa656fcef227aa1c7d90972fbe3e13b 🔍
SSDeep 12288:Xp4pNfz3ymJnJ8QCFkxCaQTOl3es5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MC2:5Etl9mRda1usX7hKB8NIyXbacAfB 🔍
Imports Hash edb0d8d367e3785b27f7a3628bbf9c0c 🔍

DOS Header

e_magic MZ
e_cblp 0x50
e_cp 0x2
e_crlc 0
e_cparhdr 0x4
e_minalloc 0xf
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0x1a
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 11
TimeDateStamp 1992-Jun-19 22:22:17
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 2.0
SizeOfCode 0x5c000
SizeOfInitializedData 0x11a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0005CF81 (Section: CODE)
BaseOfCode 0x1000
BaseOfData 0x5d000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x7b000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x4000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

CODE

MD5 60229906ef2855e9fa1c2f16ed3a92ee 🔍
SHA1 f423a9c2910aaabd27586d7b65d65fdf12241706 🔍
SHA256 25cd2e66f4065225a022d1b992bae72379532142e73f6868e6bc09d2206c8e6e 🔍
SHA3 f4d68163c6b3916b5afead7b979252f0cf4e413db1469b13cff52ab4357ea91f 🔍
VirtualSize 0x5c000
VirtualAddress 0x1000
SizeOfRawData 0x5c000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 6.51941

DATA

MD5 69beb81ab1156fc92a83ca2d17fa479a 🔍
SHA1 30273a1d7b5e9263cd960f429ec59d967da99cf0 🔍
SHA256 425867bc1b64458be058b882058a447c1111771e9cdb48c3c633ea70a5642967 🔍
SHA3 3487ff8c9df0ff3bb175617ea9c4e606064487c417c7f1d10abb54ed42263bf4 🔍
VirtualSize 0x2000
VirtualAddress 0x5d000
SizeOfRawData 0x1400
PointerToRawData 0x5c400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.05413

BSS

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x1000
VirtualAddress 0x5f000
SizeOfRawData 0
PointerToRawData 0x5d800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata

MD5 455caf4b81fe028a3a39509043761985 🔍
SHA1 f9f3350afa52f02bb26959b5a40f42e7ab2fa116 🔍
SHA256 9e66b8703250c7fa73b14616d19ead2ca99d2174c3eb0518ce659ddacbb635f6 🔍
SHA3 6ae6203400f2e9a3fd234160da83fdf1a29bafc4dff9e08a931a4ba2090d496c 🔍
VirtualSize 0x3000
VirtualAddress 0x60000
SizeOfRawData 0x2600
PointerToRawData 0x5d800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.28084

.tls

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x1000
VirtualAddress 0x63000
SizeOfRawData 0
PointerToRawData 0x5fe00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata

MD5 710ed322af38cc3cafbb0b107be04212 🔍
SHA1 93dcb5048660471a19b529089946fe3297eb5979 🔍
SHA256 bbeae3ed1c728c2c799403c623f78e926f8a5797ec2dc034c1e108361faa6a33 🔍
SHA3 7aac6ed0aaea5ca6834a1724d34834a6c02b2f156a7ab7f6dbea15bc4f8f3bd1 🔍
VirtualSize 0x1000
VirtualAddress 0x64000
SizeOfRawData 0x200
PointerToRawData 0x5fe00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.20692

.reloc

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x7000
VirtualAddress 0x65000
SizeOfRawData 0
PointerToRawData 0x60000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc

MD5 6106d30a01fb76e204dee96fb53d4a6c 🔍
SHA1 1a8e27b7cb80e4df1206116467204d382b0ddb1a 🔍
SHA256 1a4056204f221def0f69ff29c0059b94f09242a081c629a85678fd15eee3cfe6 🔍
SHA3 4ad1ac92863ce6aa37345a2a851a74a068a957f1a3117b7324fb461e2a7ccf23 🔍
VirtualSize 0x8000
VirtualAddress 0x6c000
SizeOfRawData 0x7200
PointerToRawData 0x60000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.38073

.aspack

MD5 dd153ef13ec18045ede483295a495e2b 🔍
SHA1 e27d5b1e2d6a8c816877b9e2071877c1ce4520a2 🔍
SHA256 2c0934de28907c227d840359d1690def61a2b6965c6a2bafc1331e07e37baf55 🔍
SHA3 6d9912bc35125816d4085443c9241ba58e267947bd6220a405ff37e62f97055f 🔍
VirtualSize 0x3000
VirtualAddress 0x74000
SizeOfRawData 0x3000
PointerToRawData 0x67200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.95205

.adata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x1000
VirtualAddress 0x77000
SizeOfRawData 0
PointerToRawData 0x6a200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SCY

MD5 55600674716e369a2c9a92535f91ca48 🔍
SHA1 05c41673692aef0a0f53b120ed131d46b02b4231 🔍
SHA256 cc7353b2d1bd01b66873f3cbbe8c5ebec163928576262ac9c585165fc540ac6e 🔍
SHA3 92e0ae2ff6ed67097588ddb8050016a0e0480826543c4a100925a8ff5d7fae9c 🔍
VirtualSize 0x3000
VirtualAddress 0x78000
SizeOfRawData 0x2600
PointerToRawData 0x6a200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.59048

Imports

kernel32.dll DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
user32.dll GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
advapi32.dll RegQueryValueExA
RegOpenKeyExA
RegCloseKey
oleaut32.dll SysFreeString
SysReAllocStringLen
SysAllocStringLen
kernel32.dll (#2) DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
advapi32.dll (#2) RegQueryValueExA
RegOpenKeyExA
RegCloseKey
kernel32.dll (#3) DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
version.dll VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
gdi32.dll UnrealizeObject
StretchBlt
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetEnhMetaFileBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
SaveDC
RestoreDC
Rectangle
RectVisible
RealizePalette
PlayEnhMetaFile
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsA
GetTextExtentPointA
GetTextExtentPoint32A
GetSystemPaletteEntries
GetStockObject
GetPixel
GetPaletteEntries
GetObjectA
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
ExcludeClipRect
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreatePenIndirect
CreatePalette
CreateHalftonePalette
CreateFontIndirectA
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileA
BitBlt
user32.dll (#2) GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
kernel32.dll (#4) DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
oleaut32.dll (#2) SysFreeString
SysReAllocStringLen
SysAllocStringLen
ole32.dll OleUninitialize
OleInitialize
CoCreateInstance
CoUninitialize
CoInitialize
oleaut32.dll (#3) SysFreeString
SysReAllocStringLen
SysAllocStringLen
comctl32.dll ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_SetDragCursorImage
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Remove
ImageList_DrawEx
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Add
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
shell32.dll SHGetSpecialFolderLocation
SHGetPathFromIDListA
advapi32.dll (#3) RegQueryValueExA
RegOpenKeyExA
RegCloseKey

Delayed Imports

1

Type RT_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 2.6633
MD5 ff4e5862f26ea666373e5fab2bddfb11 🔍
SHA1 cfa13c0ab30f1bbd566900dee3631902f9b6451c 🔍
SHA256 b8e6fc93d423931acbddae3c27dd3c4eb2a394005d746951a971cb700e0ee510 🔍
SHA3 91dae12a9f43c5443e0661091a336f882fa1482f75fa9a57c9298d1d70c8ae69 🔍

2

Type RT_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 2.80231
MD5 2e87b3c111e3073a841775c1f8ec5a90 🔍
SHA1 20292304fa2ef1bfdc4a1000e90a1c16d4765a96 🔍
SHA256 ce19ace18e87b572e6912306776226af5b8e63959c61cde70a8ff05b3bbdcc41 🔍
SHA3 9527f09e739c2064835800a7e5c317cb422bdd7237f00fca079a1c62f58a2612 🔍

3

Type RT_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 3.00046
MD5 a04c3c368cb37c07bd5f63e7e6841ebd 🔍
SHA1 699300bceaa1256818c43fecfc8cad93a59156b2 🔍
SHA256 ee1c9c194199c320c893b367602ccc7ee7270bd4395d029f727e097634f47f8c 🔍
SHA3 58722e3138aad1382e284c1605ecd665ced536de4906749ac8d6e11252cc9558 🔍

4

Type RT_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 2.56318
MD5 9929115b21c2c59348058d4190392e75 🔍
SHA1 626fba1825d572ea441d36363307c9935de3c565 🔍
SHA256 9d9edf87ca203ecc60b246cc783d54218dd0ce77d3a025d0bafc580995a4abd8 🔍
SHA3 fea156e872544252c625076a6bf3baa733ee5b3d5399716e156734af7a841369 🔍

5

Type RT_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 2.6949
MD5 f321ad13d1c3f35a05d67773b4bc27d6 🔍
SHA1 30aded8525417e2531d5eb88bf2f868172945baa 🔍
SHA256 99676c52310db365580965ea646ece86c62951bfd97ec0aae9f738a202a90593 🔍
SHA3 04c839da98a8c50a36697076af5bc6d527560a69153b2f718f065908fd4fe3ad 🔍

6

Type RT_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 2.62527
MD5 5ca217e52bdc6f23b43c7b6a23171e6e 🔍
SHA1 d99dc22ec1b655a42c475431cc3259742d0957a4 🔍
SHA256 11726dcf1eebe23a1df5eb0ee2af39196b702eddd69083d646e4475335130b28 🔍
SHA3 b358d8a5b0f400dd2671956ec45486ae1035556837b5289df5f418fe69348b3f 🔍

7

Type RT_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 2.91604
MD5 6be7031995bb891cb8a787b9052f6069 🔍
SHA1 487eb59fd083cf4df02ce59d9b079755077ba1b5 🔍
SHA256 6f938aab0a03120de4ef8b27aff6ba5146226c92a056a6f04e5ec8d513ce5f9d 🔍
SHA3 0f1c6c0378a3646c9fbf3678bbeeccf929d32192f02d1ea9d6ba0be5c769e6ab 🔍

BBABORT

Type RT_BITMAP
Language UNKNOWN
Codepage UNKNOWN
Size 0x1d0
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 2.92079
MD5 c987e709cafd3a191333610e4c44914d 🔍
SHA1 901e4db5d379a222dd416776633ca9738db32e14 🔍
SHA256 c0ede68a98bd2bc58c78564dfb42f1640dc29766d3ab2782ab8b5ed28c6fd414 🔍
SHA3 7b14efd89b642988834daf08c97db5bb847f941d75f44a3915e3e5dca2510c53 🔍
Preview

BBALL

Type RT_BITMAP
Language UNKNOWN
Codepage UNKNOWN
Size 0x1e4
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 3.16995
MD5 f8a9b4a8f4097cea6a482026484c4d12 🔍
SHA1 2057a63edce2cbb165512bfad326728cf1053d60 🔍
SHA256 46cfc44afa8ab31ae3da35fa8346e4c085c441659d9992b09fc8ad517f2b289a 🔍
SHA3 f3852a8bcb1b38f498231cca2b0427af6c4c52886f92f980968d40fd8e8c5337 🔍
Preview

BBCANCEL

Type RT_BITMAP
Language UNKNOWN
Codepage UNKNOWN
Size 0x1d0
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 2.92079
MD5 c987e709cafd3a191333610e4c44914d 🔍
SHA1 901e4db5d379a222dd416776633ca9738db32e14 🔍
SHA256 c0ede68a98bd2bc58c78564dfb42f1640dc29766d3ab2782ab8b5ed28c6fd414 🔍
SHA3 7b14efd89b642988834daf08c97db5bb847f941d75f44a3915e3e5dca2510c53 🔍
Preview

BBCLOSE

Type RT_BITMAP
Language UNKNOWN
Codepage UNKNOWN
Size 0x1d0
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 3.68492
MD5 6c2fba077bd332b3a48d6b5e43fe4a22 🔍
SHA1 e7d12e9fd5659881742773884db8ca537765dc81 🔍
SHA256 f8e1696801fe89b88936ac4226cea03bfa5aa345aa33ca982822ae7fbc6557e2 🔍
SHA3 39193ea4b2ffb32f16c75ca88ca20465a374cd928aac9b4b3ba5739bbb6222de 🔍
Preview

BBHELP

Type RT_BITMAP
Language UNKNOWN
Codepage UNKNOWN
Size 0x1d0
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 2.88085
MD5 1021657335ba4838db07f5231723df3b 🔍
SHA1 68f04f6ecbf628029e4e0061392029edec2b0e43 🔍
SHA256 cb7421b5c6af74c3159c361f3bb78bba8a488d8979d1250e106fa96cbf928789 🔍
SHA3 888ed4f8473561552d848c3d6624e2331c4ec7795bc5001237cb752b96e4929c 🔍
Preview

BBIGNORE

Type RT_BITMAP
Language UNKNOWN
Codepage UNKNOWN
Size 0x1d0
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 3.29718
MD5 098b5f6c87471f5a83a4e55a6a036d6c 🔍
SHA1 e16d9186ffa72cc3e373cdf8e40f9e570f0082e7 🔍
SHA256 41f05a4df5f42d92b879493d51941de342d36460fe15c0f3b63b2b706b928fef 🔍
SHA3 7939e94342a45e6742dbf7c93f5b42fb861ac81b1fe5e8e04e49c0421338b2cf 🔍
Preview

BBNO

Type RT_BITMAP
Language UNKNOWN
Codepage UNKNOWN
Size 0x1d0
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 3.58804
MD5 8832519641f28981f87e1b3006896eef 🔍
SHA1 916eaafcf9ffb12bfd6338419bdd22764778ebbd 🔍
SHA256 81265e63c89ee5c2e5126452e22f84e9be9452449f3e5959ab6d346cb58b2bde 🔍
SHA3 39743ce838b215420cbb732e107e4c45f63384dcdd5b830d15097fa06cf32cc2 🔍
Preview

BBOK

Type RT_BITMAP
Language UNKNOWN
Codepage UNKNOWN
Size 0x1d0
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 2.67459
MD5 4b349737af0b7e5a5308dff7b93b274b 🔍
SHA1 b3d36a94fa9a57ad7a68a3b30be92947e811e760 🔍
SHA256 6b97877cdd547e6ba6467f86055f1fc7b06660b034439f0da4c137538ef14a83 🔍
SHA3 b9e9646067eae58ad9aded92130651d090a92771bae94676003e9aba47f77cd6 🔍
Preview

BBRETRY

Type RT_BITMAP
Language UNKNOWN
Codepage UNKNOWN
Size 0x1d0
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 3.53344
MD5 7daf7522622a4fe823701fd2ff6f4996 🔍
SHA1 89f40bad3052afafbd71e80c07b928ec1aa7f4e5 🔍
SHA256 c925e4a8cbf6d42dbb1220a510614df725558f8d843338982bab8c4e020f6429 🔍
SHA3 95aa592de7b91edb5889cf5f9a7b042d3b6f6910bbd657ba85632f0d0ed557fb 🔍
Preview

BBYES

Type RT_BITMAP
Language UNKNOWN
Codepage UNKNOWN
Size 0x1d0
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 2.67459
MD5 4b349737af0b7e5a5308dff7b93b274b 🔍
SHA1 b3d36a94fa9a57ad7a68a3b30be92947e811e760 🔍
SHA256 6b97877cdd547e6ba6467f86055f1fc7b06660b034439f0da4c137538ef14a83 🔍
SHA3 b9e9646067eae58ad9aded92130651d090a92771bae94676003e9aba47f77cd6 🔍
Preview

PREVIEWGLYPH

Type RT_BITMAP
Language UNKNOWN
Codepage UNKNOWN
Size 0xe8
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 2.85172
MD5 48276e8432af5a23af78e1d23de8ef5a 🔍
SHA1 12fb57606d03e3fe28263e3e9e96b4eedc79aef7 🔍
SHA256 78507a772de646626b196a743cee75b298a68c33a0fd482842071519d59037b2 🔍
SHA3 1cf31d53c7ea5dbe90181cb2db39ce6cd21484f5495b0af59f5c6164d9b3d3d0 🔍
Preview

1 (#2)

Type RT_ICON
Language Chinese - Taiwan
Codepage UNKNOWN
Size 0x1ca8
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 3.83492
MD5 957d692b4419f713c9eedff5ca6caafc 🔍
SHA1 5960da4c47d3104f3a5cf1ba080323cd65a2d325 🔍
SHA256 6f6bedac6adc9ab7663f3720c8ffe6a6d9169087510ab9aa7cd963ebcd5fd93a 🔍
SHA3 8a8f34de6ab92f15a99d2c5d536b6eb57276c852273acc835519a0060a507985 🔍

DLGTEMPLATE

Type RT_DIALOG
Language UNKNOWN
Codepage UNKNOWN
Size 0x52
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 2.5627
MD5 db949b51eec31f37281a7fa424a3e158 🔍
SHA1 f61214ce31a91d174e77f12c90f18ddd4e265a1d 🔍
SHA256 771f64afb45a9edc8c4f6c5b2039f9b32623cea53bf0cab5bf1f371cc5d1abe4 🔍
SHA3 4a2bc09771734352d594a48fe2249ca0697c471d80a4001f60c6d86c46b6319e 🔍

4080

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x228
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 3.25226
MD5 b1bd86e353dc89cc3d42a6f2e9c06f2b 🔍
SHA1 525e030fc04bf31faff88c68f2ce6c382f789ddd 🔍
SHA256 1153ef4d2b6b2c3d472928a4b66aa9f94daab8daf404452af94ea7a4dc51deae 🔍
SHA3 ac410e4d6a20dc963f95651fe8b897b2ad345881c26669e455a048ddb63246bc 🔍

4081

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x1d0
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 3.23967
MD5 0b85a4752315da9aa81dcd6003a240a3 🔍
SHA1 58a4d8fe6f7d098749fc3ae2ed9c32604c2a4ff8 🔍
SHA256 b87d9e4ac3b1cc6dd6f560a7ebd6d88c0566b46280ed7139d62e4daf7420587c 🔍
SHA3 cb10d5742a110f93e368730fbf8e101dbc96f30383813c523dc670b1b59d7084 🔍

4082

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x16c
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 3.26382
MD5 d11277bf2bdc0dbf1c69f796ccc6efde 🔍
SHA1 ae6775367ec3deb15bceda12f638d0a01ca152da 🔍
SHA256 5e26d28ace953abeb69a73a7e2ecac51a6dee3f2155d675283e27fbf67c13621 🔍
SHA3 7b1a893c28b75a9857bbe28a789ff0405f94c41da1fa621bfbc41506428218c7 🔍

4083

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x1fc
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 3.2242
MD5 f3b82d64440413756b8096b50877d502 🔍
SHA1 d0513e81e1b5c21866a000426ae42adc7c33a8b1 🔍
SHA256 b71435271b267d91b64d729ccb984fb5c96adc252bd3d32b1438c704ec91890e 🔍
SHA3 3ef0bd04deb7a286f69da230a124af7597d61731c0224b539c6ebb3f942b2ac8 🔍

4084

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x214
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 3.26326
MD5 9411e668d34b50dc98479c182bde46df 🔍
SHA1 8d8d4cc8e2b02c247e35d3541dc8ea17f4881c04 🔍
SHA256 d4a3faae25152809c7934670f80b47105063d1ec3ad0bcb7d80a91b1a25aca85 🔍
SHA3 8bb143dfc931c1c11b56c180099ae55d74e626f50abedce4fc5c37c367f7a9a2 🔍

4085

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0xec
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 3.1103
MD5 bf2fff79658c0e0cf6b0f8d69454b141 🔍
SHA1 1d4f936e92513aeb6f98ce8b6f46754b259218a8 🔍
SHA256 6eb30fe1aef4c8288c7aaf6f119fd154acfef3646d1a6602a744047c97b17358 🔍
SHA3 0c4b3244053c1a4525bee4b10a11d8f856a1f7a7f3a4bf7e4a0ff1bc1feff883 🔍

4086

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x12c
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 3.16759
MD5 3bdada9a88cda96bf1b0d3403ceb54fc 🔍
SHA1 ba74c3f247ffbaf507add457ccadf93f172905be 🔍
SHA256 7d781c9be9556b69347ff390d222282f3f4073738ee503540896263fef3aec51 🔍
SHA3 4bd9c56df6bacde8ba18a7d5e8d1d47c49d6ac5c5f7001b9923a9bdb271f7640 🔍

4087

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x33c
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 3.26807
MD5 88fc83e088aa4f0686494238ceb9fee6 🔍
SHA1 d73dfb0faf60dec12969bde9704bf0ba32bfdc08 🔍
SHA256 24c0f3cf82beab613a11678f819ee355badd5935edd94025b4010b78eb9125c7 🔍
SHA3 89ac66c1decc60434644eb2a942ecc121e82a5e17123eb4145c133aff263d1e5 🔍

4088

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x3d8
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 3.1878
MD5 eafcbe82760832bf3871057be422f8b0 🔍
SHA1 34ecbe4eac41917ee9597322d88668fc699cbd54 🔍
SHA256 d54405375b0cbba3977775d9541368a6ea521e87f389fbb480a230e355241dd2 🔍
SHA3 fbf1987c55c60a9e8edae092d7f34161febe4bd23bd38a04836a0678f4612cc7 🔍

4089

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x398
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 3.20127
MD5 9278285253a00eccdc450b6a52e19307 🔍
SHA1 1075456ad6f69e6e356cae609273d425eff5bf54 🔍
SHA256 df727580431c1d7cad1a561441896cc449854940ed6439e8cdba665b7805d804 🔍
SHA3 e8b121d5f7a6e7c6e5dfc0cf404beaf6c3333de2f10dd6ac6a70b2317210cbc3 🔍

4090

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x418
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 3.24528
MD5 eb7f12bae2ae9f8479ce43e2c3a67b90 🔍
SHA1 e17672bdae551a5cb6aeff102ba79cc2aef746a8 🔍
SHA256 3467a7fdb3d89e138b4f05aec1dd3789ff0cc61b796b2d87715e148526fe3460 🔍
SHA3 aa07f58254a7bc58213870ea5221093af094565dacbaafc3b1cfed645a94e192 🔍

4091

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x114
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 3.03263
MD5 9627b82664b30972ad6c2b152cda4c5f 🔍
SHA1 601c8c46418e11f09e55725b3f8c473070f7d647 🔍
SHA256 b5a15e2ce58b6f93bd0260ed41d18fe9abdd6ade4ac3ff0374577c9436d731cc 🔍
SHA3 1adbf96bc611ae6717f534466139018fb5adf516a8a3f8e99e48de6fcb9bcb07 🔍

4092

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0xe4
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 2.99785
MD5 65b3a9f9ed7e68e403d141705bdd55e0 🔍
SHA1 502261a54bdcbc522e55d57040fdc35884861db1 🔍
SHA256 d1e4f67dfdac88a2667aef19c9e56fc6d0deaca637f10b941f1724a4466f9225 🔍
SHA3 eb75571e9fcd0bca2e4b6e55ec828d3db73d3da5d8118420670601e1acde9ba5 🔍

4093

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x24c
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 3.24849
MD5 c62ed53e214b728d6b55694e369db6c9 🔍
SHA1 d03a44dbf21489187c61a59ae71a7a65b19033f9 🔍
SHA256 f7e5ec6b2be4b3242c344fe5c72b3a101ff430390bba560c4cf6bdc236a8e66b 🔍
SHA3 58c8765ce70df1f46306cf51dd6ba70f65b4336f0334d7959dc2c717ad8de68d 🔍

4094

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x3d4
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 3.18166
MD5 2cdf2d524adfb5e39e0d21445e6db7c4 🔍
SHA1 709a5400445ff836603d2e416138c6950553e6f4 🔍
SHA256 9715b962a65a30a00bc5fbeb1476e08192bd4bb08b75482dbec706c2c37627bc 🔍
SHA3 9b090e5fe9101e617f6c69ae05b2ae1353c0028cca3e97bf1f4ebe4b1c687d09 🔍

4095

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x388
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 3.24617
MD5 0fe49b368b197339e03aac721983880d 🔍
SHA1 99c2f04fff9f214c417c4aa55a4a8f0fc25ad93d 🔍
SHA256 bb553454916808a6c2041b07e741907bd976759d008114ab1996493ed591f9d4 🔍
SHA3 82d3c3718915a012f022c67507dd553ff1e4b759453ecfc1957d3de704ef24e5 🔍

4096

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x2d8
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 3.16623
MD5 83569eb5d9a7ff5e0d861f24436e1b16 🔍
SHA1 9600fa3a6d42445ef1c619e8db486ab3c630e2b8 🔍
SHA256 e7c2a218d76fc656d37c31362a8a8bc9051b01bfb40d696ab0299dcd73cb5597 🔍
SHA3 4147baad8a9cd3582632116dfbf4477bc8c7a851c38054907a84e5eeb6fef281 🔍

DVCLAL

Type RT_RCDATA
Language UNKNOWN
Codepage UNKNOWN
Size 0x10
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 4
MD5 d8090aba7197fbf9c7e2631c750965a8 🔍
SHA1 04f73efb0801b18f6984b14cd057fb56519cd31b 🔍
SHA256 88d14cc6638af8a0836f6d868dfab60df92907a2d7becaefbbd7e007acb75610 🔍
SHA3 a5a67ad8166061d38fc75cfb2c227911de631166c6531a6664cd49cfb207e8bb 🔍

PACKAGEINFO

Type RT_RCDATA
Language UNKNOWN
Codepage UNKNOWN
Size 0x2a4
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 5.28841
MD5 3285858088f30ce088adb969e7e172fc 🔍
SHA1 897c6404cb90e0604b44f7508b80c994d30bfd51 🔍
SHA256 34ff04f28d91b0e65d4cc695e69613c6718ddea94e4818f592a0fd050a1ba005 🔍
SHA3 38cbffe671627293d21a79632cd25bfa9d43e7f9dca9fcc1abd1a4d8ea97d408 🔍

TFRM_MAIN

Type RT_RCDATA
Language UNKNOWN
Codepage UNKNOWN
Size 0x1c0
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 5.39228
MD5 84d3af7bb574563d008e7f9d9c1d62ce 🔍
SHA1 c38aa2fbbd5aa68bf393a30fc03f4d16e67f3ed2 🔍
SHA256 24729d3ca13796cc344f15b2d0edddca4c6b01155544c22ae143e3907c0c2f3f 🔍
SHA3 a069fffefd5940a6e6fd39621711708b5470cb5a31bffe89cb80e4bb03b77ef3 🔍

32761

Type RT_GROUP_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 1.83876
Detected Filetype Cursor file
MD5 a2baa01ccdea3190e4998a54dbc202a4 🔍
SHA1 e8217df98038141ab4e449cb979b1c3bbea12da3 🔍
SHA256 c53efa8085835ba129c1909beaff8a67b45f50837707f22dfff0f24d8cd26710 🔍
SHA3 8874564c406835306368adf5e869422e1bb97109b97c1499caa8af219990e8dc 🔍
Preview

32762

Type RT_GROUP_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 1.91924
Detected Filetype Cursor file
MD5 aff0f5e372bd49ceb9f615b9a04c97df 🔍
SHA1 e3205724d7ee695f027ab5ea8d8e1a453aaad0dd 🔍
SHA256 b07e022f8ef0a8e5fd3f56986b2e5bf06df07054e9ea9177996b0a6c27d74d7c 🔍
SHA3 9cb042121a5269b80d18c3c5a94c0e453890686aedade960097752377dfa9712 🔍
Preview

32763

Type RT_GROUP_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 2.01924
Detected Filetype Cursor file
MD5 48e064acaba0088aa097b52394887587 🔍
SHA1 310b283d52aa218e77c0c08db694c970378b481d 🔍
SHA256 43f40dd5140804309a4c901ec3c85b54481316e67a6fe18beb9d5c0ce3a42c3a 🔍
SHA3 38753084b0ada40269914e80dbacf7656dc94764048bd5dff649b08b700f3ed5 🔍
Preview

32764

Type RT_GROUP_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 2.01924
Detected Filetype Cursor file
MD5 1ae28d964ba1a2b1b73cd813a32d4b40 🔍
SHA1 8883cd93b8ef7c15928177de37711f95f9e4cd22 🔍
SHA256 ff47a48c11c234903a7d625cb8b62101909f735ad84266c98dd4834549452c39 🔍
SHA3 a85dadd416ce2d22aa291c0794c45766a0613b853c6e3b884a2b05fc791427b8 🔍
Preview

32765

Type RT_GROUP_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 2.01924
Detected Filetype Cursor file
MD5 0893f6ba80d82936ebe7a8216546cd9a 🔍
SHA1 0754cbdf56c53de9ed7fbd47859d20b788c6f056 🔍
SHA256 a0adcedb82b57089f64e2857f97cefd6cf25f4d27eefc6648bda83fd5fef66bb 🔍
SHA3 ce6148ade08ef9b829f83cb13b4c650d9d4a7012bfd1ab697a7870a05f4104f8 🔍
Preview

32766

Type RT_GROUP_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 2.01924
Detected Filetype Cursor file
MD5 dcaa3c032fe97281b125d0d8f677c219 🔍
SHA1 58fe36409f932549e2f101515abee7a40cf47b2c 🔍
SHA256 6e1e7738a1b6373d8829f817915822ef415a1727bb5bb7cfe809e31b3c143ac5 🔍
SHA3 02ef292e1b4a70e439e362af6b4fa213e3816ade45222b78dabab712b6afba54 🔍
Preview

32767

Type RT_GROUP_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 2.01924
Detected Filetype Cursor file
MD5 a95c7c78d0a0b30b87e3c4976e473508 🔍
SHA1 b19f3999f1b302a2d28977cb18a3416c918d486c 🔍
SHA256 326c048595bbc72e3f989cb3b95fbf09dc83739ced3cb13eb6f03336f95d74f1 🔍
SHA3 8157b4e6afa7ed2e2ffc174d655bec9fb81db609e4c5864faa5ead931ff60689 🔍
Preview

MAINICON

Type RT_GROUP_ICON
Language Chinese - Taiwan
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2008-Feb-12 15:37:30
Entropy 1.91924
Detected Filetype Icon file
MD5 ecb3fea9b8fba3816da208767162ebaf 🔍
SHA1 ddefd39f5270bb56f9de023bf02862982d3069ae 🔍
SHA256 1f08569caa4db78cd12752e0343cd4bfd02c5990676e45b472c5e0572a841b7c 🔍
SHA3 13025b2d842232c33f3c6cb9e7df07905c5c0c080f9706c2d98d97b4d86e085d 🔍

String Table contents

3D Dark Shadow
3D Light
Window Background
Window Frame
Window Text
No help keyword specified.
OLE error %.8x
Method '%s' not supported by automation object
Variant does not reference an automation object
Dispatch methods do not support more than 64 parameters
Button Shadow
Button Text
Caption Text
Default
Gray Text
Highlight Background
Highlight Text
Inactive Border
Inactive Caption
Inactive Caption Text
Info Background
Info Text
Menu Background
Menu Text
None
Scroll Bar
Lime
Yellow
Blue
Fuchsia
Aqua
White
Money Green
Sky Blue
Cream
Medium Gray
Active Border
Active Caption
Application Workspace
Background
Button Face
Button Highlight
- Dock zone not found
- Dock zone has no control
Unable to find a Table of Contents
No help found for %s
No context-sensitive help installed
No topic-based help system installed
Black
Maroon
Green
Olive
Navy
Purple
Teal
Gray
Silver
Red
Home
Left
Up
Right
Down
Ins
Del
Shift+
Ctrl+
Alt+
Clipboard does not support Icons
Cannot open clipboard
Text exceeds memo capacity
Menu '%s' is already being used by another form
Docked control must have a name
Error removing control from dock tree
Cancel
&Help
&Abort
&Retry
&Ignore
&All
N&o to All
Yes to &All
BkSp
Tab
Esc
Enter
Space
PgUp
PgDn
End
&Ignore
&Retry
Abort
&All
Cannot drag a form
Metafiles
Enhanced Metafiles
Icons
Bitmaps
Warning
Error
Information
Confirm
&Yes
&No
OK
Cannot hide an MDI Child Form
Cannot change Visible in OnShow or OnHide
Cannot make a visible window modal
Menu index out of range
Menu inserted twice
Sub-menu is not in menu
Not enough timers available
GroupIndex cannot be less than a previous menu item's GroupIndex
Cannot create form. No MDI forms are currently active
A control cannot have itself as its parent
OK
Cancel
&Yes
&No
&Help
&Close
Bitmap image is not valid
Icon image is not valid
Metafile is not valid
Cannot change the size of an icon
Unsupported clipboard format
Out of system resources
Canvas does not allow drawing
Invalid image size
Invalid ImageList
Invalid ImageList Index
Failed to read ImageList data from stream
Failed to write ImageList data to stream
Error creating window device context
Error creating window class
Cannot focus a disabled or invisible window
Control '%s' has no parent window
List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d)
Out of memory while expanding memory stream
Error reading %s%s%s: %s
Stream read error
Property is read-only
Failed to set data for '%s'
Resource %s not found
%s.Seek not implemented
Operation not allowed on sorted list
%s not in a class registration group
Property %s does not exist
Stream write error
Thread creation error: %s
Thread Error: %s (%d)
Cannot assign a %s to a %s
Bits index out of range
Can't write to a read-only resource stream
CheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
A class named %s already exists
List does not allow duplicates ($0%x)
A component named %s already exists
String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
Unable to write to %s
Invalid stream format
''%s'' is not a valid component name
Invalid property path
Invalid property value
December
Sun
Mon
Tue
Wed
Thu
Fri
Sat
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
Ancestor for '%s' not found
Aug
Sep
Oct
Nov
Dec
January
February
March
April
May
June
July
August
September
October
November
External exception %x
Assertion failed
Interface not supported
Exception in safecall method
%s (%s, line %d)
Abstract Error
Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
%s
A call to an OS function failed
Jan
Feb
Mar
Apr
May
Jun
Jul
Variant method calls not supported
Read
Write
Error creating variant or safe array
Variant or safe array index out of bounds
Variant or safe array is locked
Invalid variant type conversion
Invalid variant operation
Invalid variant operation (%s%.8x)
%s
Could not convert variant of type (%s) into type (%s)
Overflow while converting variant of type (%s) into type (%s)
Variant overflow
Invalid argument
Invalid variant type
Operation not supported
Unexpected variant error
Integer overflow
Invalid floating point operation
Floating point division by zero
Floating point overflow
Floating point underflow
Invalid pointer operation
Invalid class typecast
Access violation at address %p. %s of address %p
Access violation
Stack overflow
Control-C hit
Privileged instruction
Exception %s in module %s at %p.
%s%s
Application Error
Format '%s' invalid or incompatible with argument
No argument for format '%s'
'%s' is not a valid integer value
'%s' is not a valid floating point value
'%s' is not a valid date
'%s' is not a valid time
'%s' is not a valid date and time
Out of memory
I/O error %d
File not found
Invalid filename
Too many open files
File access denied
Read beyond end of file
Disk full
Invalid numeric input
Division by zero
Range check error

Version Info

TLS Callbacks

StartAddressOfRawData 0x463000
EndAddressOfRawData 0x463010
AddressOfIndex 0x45d09c
AddressOfCallbacks 0x464010
SizeOfZeroFill 0
Characteristics IMAGE_SCN_TYPE_REG
Callbacks (EMPTY)

Load Configuration

RICH Header

Errors

[*] Warning: Section BSS has a size of 0! [*] Warning: Section .tls has a size of 0! [*] Warning: Section .reloc has a size of 0! [*] Warning: Section .adata has a size of 0!
Leave a comment

No comments yet.