Manalyze report for 38b7b4f719ae09fd7b55d6ee29183d590e70a0c013ba8ef3437ce889aa98b28f

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2021-Dec-14 19:43:27
Detected languages	English - United States Spanish - Spain (Traditional sort)
Debug artifacts	C:\CodeBases\isdev\redist\language independent\i386\SetupSuite.pdb
CompanyName	Flexera
FileDescription	Setup Suite Launcher Unicode
FileVersion	`27.0.122`
InternalName	SetupSuite
LegalCopyright	Copyright (c) 2021 Flexera. All Rights Reserved.
OriginalFilename	InstallShield SetupSuite.exe
ProductName	InstallShield
ProductVersion	`27.0`
Internal Build Number	203988
ISInternalVersion	27.0.122
ISInternalDescription	Setup Suite Launcher Unicode

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C++ 6.0 - 8.0`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`May have dropper capabilities: CurrentVersion\Run` `Miscellaneous malware strings: cmd.exe`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32` `Uses constants related to MD5`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: LoadLibraryW LoadLibraryA GetProcAddress LoadLibraryExA LoadLibraryExW` `Can access the registry: RegOpenKeyW RegOverridePredefKey RegEnumValueW RegDeleteValueW RegQueryInfoKeyW RegEnumKeyExW RegDeleteKeyW RegSetValueExW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey` `Possibly launches other programs: CreateProcessW` `Can create temporary files: GetTempPathW CreateFileW` `Memory manipulation functions often used by packers: VirtualAlloc VirtualProtect` `Functions related to the privilege level: AdjustTokenPrivileges OpenProcessToken` `Enumerates local disk drives: GetDriveTypeW` `Manipulates other processes: OpenProcess` `Can shut the system down or lock the screen: ExitWindowsEx`
Info	The PE is digitally signed.	`Signer: Fabrica Nacional de Moneda y Timbre-Real Casa de la Moneda` `Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1`
Suspicious	VirusTotal score: 1/71 (Scanned on 2026-10-06 15:20:29)	`Zillya: Trojan.Povertel.Win32.80`

Hashes

MD5	`fe2e2a116b0a77a81d53f556ae6a283d` 🔍
SHA1	`654cc3a7b91329ae6a12a2223458177c40267cd6` 🔍
SHA256	`38b7b4f719ae09fd7b55d6ee29183d590e70a0c013ba8ef3437ce889aa98b28f` 🔍
SHA3	`8afbfaa8ed54757cc561ae37320c09c7b80417cad222c96a466281a0d1c019cc` 🔍
SSDeep	`393216:RPI3z79DupjgEWnSOIwUkAM4bRjlDFKYN8i+e:RP+D6WP3UJXbRjlDB` 🔍
Imports Hash	`739d30e42859caddae6d7ccc9e44472d` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x120`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`8`
TimeDateStamp	2021-Dec-14 19:43:27
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`14.0`
SizeOfCode	`0xdac00`
SizeOfInitializedData	`0xc1800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x000A1959 (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0xdd000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`5.1`
ImageVersion	`0.0`
SubsystemVersion	`5.1`
Win32VersionValue	`0`
SizeOfImage	`0x1a4000`
SizeOfHeaders	`0x400`
Checksum	`0x10ae2b1`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`0438b958348b7ae2c19220b584bf9cb6 🔍`
SHA1	`595f72c2fed8ca774a0f09475cdac1ed35f6dcc6 🔍`
SHA256	`8bd1012c7b69bd5a44292378c95bcd2f4f7e04c6e186cbef699ca4bb45d7e222 🔍`
SHA3	`6d529424a5b6a364cc6d1564be59423bb4a100ab21fa780ee20b64ae8ae5b086 🔍`
VirtualSize	`0xda89e`
VirtualAddress	`0x1000`
SizeOfRawData	`0xdaa00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.43117`

.orpc

MD5	`072dff8ce40914d75a2e84bedc12f020 🔍`
SHA1	`235e9916a4e6947a15f1844a0716694412218abc 🔍`
SHA256	`65e6106a003963cfdbfa7fa2b6100a52ef15935284f7258f65e333ae7cb9e407 🔍`
SHA3	`779860e5a3da080963f2b9c14fb0875630e12d4ae80534a6d751da7a31919d75 🔍`
VirtualSize	`0x1a2`
VirtualAddress	`0xdc000`
SizeOfRawData	`0x200`
PointerToRawData	`0xdae00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`4.78303`

.rdata

MD5	`8b3a1f918a22eaf06d48ab0699babee3 🔍`
SHA1	`6fc97dce963f6f44bbf3eb0b1724869476847052 🔍`
SHA256	`9ddff6826d0521de74f9e5ec53851f108e6ae2f2b40d12672b1c366886ac3500 🔍`
SHA3	`51a7f3f821f4a15e7cc919e65457b803bfca1586653bae6b7dc2f92726065f71 🔍`
VirtualSize	`0x4c09e`
VirtualAddress	`0xdd000`
SizeOfRawData	`0x4c200`
PointerToRawData	`0xdb000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.47859`

.data

MD5	`2914f18b3934ef93684fa68a8bd736a8 🔍`
SHA1	`7ccbd0fad12eec70ac72be812a4d632d56ef7e07 🔍`
SHA256	`5c3b49fb5713015fa83189679d948c69c94dfe7dd58f2f676c68bbfe5d58e814 🔍`
SHA3	`96fd8064e014fa2f004e563069b89cc3a5c3796c24e729bd0a38efa9087d04cf 🔍`
VirtualSize	`0x6724`
VirtualAddress	`0x12a000`
SizeOfRawData	`0x5a00`
PointerToRawData	`0x127200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.75659`

.gfids

MD5	`7ea8bc710ce22beab72287ed06948489 🔍`
SHA1	`57b30356be9c75ffaf08e6e6f79807c5bfb50a3c 🔍`
SHA256	`cbc1caead789250daa94bb6477f2929c0d3b917f2d7d5dbbc3de13eb4d5cd4af 🔍`
SHA3	`d4e836c659fa8834668cf3a21a35fa7535812eca66c8e082e557c21abc406b56 🔍`
VirtualSize	`0x134`
VirtualAddress	`0x131000`
SizeOfRawData	`0x200`
PointerToRawData	`0x12cc00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`2.52062`

.tls

MD5	`1f354d76203061bfdd5a53dae48d5435 🔍`
SHA1	`aa0d33a0c854e073439067876e932688b65cb6a9 🔍`
SHA256	`4c6474903705cb450bb6434c29e8854f17d8324efca1fdb9ee9008599060883a 🔍`
SHA3	`991fbbd46bbd69198269fe6c247d440e0f8a7d38259b7a1e04b74790301d1d2b 🔍`
VirtualSize	`0x9`
VirtualAddress	`0x132000`
SizeOfRawData	`0x200`
PointerToRawData	`0x12ce00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.0203931`

.rsrc

MD5	`c510da7d2c94499a2b7fa798092209b7 🔍`
SHA1	`f5a6cc8cf912163ef44899655b9b0745c8d58799 🔍`
SHA256	`110e1ff6352ba942a5fad4021cb2d71aa4671fae1a27c5dee713aa262f738c05 🔍`
SHA3	`7130fd5a9b10536fd2832dbb059cb76689fccd8d3ebb01477b4b71d528e68773 🔍`
VirtualSize	`0x5e130`
VirtualAddress	`0x133000`
SizeOfRawData	`0x5e200`
PointerToRawData	`0x12d000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.51802`

.reloc

MD5	`3c9784226537ce2b227379b7124723a3 🔍`
SHA1	`cc7324517c16680416e61e6e9fead2407f18383f 🔍`
SHA256	`6d1e75ba9e669d9497450eda0ac4c5f5d6d88e6d5c42d18c4a5bef1f96a37066 🔍`
SHA3	`a209f902f4780ae63b6571e9de70fe787201e28c99e52368e623d9cf807e7290 🔍`
VirtualSize	`0x115ec`
VirtualAddress	`0x192000`
SizeOfRawData	`0x11600`
PointerToRawData	`0x18b200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`6.57236`

Imports

KERNEL32.dll	`WaitForSingleObject` `GetExitCodeThread` `MoveFileExW` `CreateNamedPipeW` `GetDriveTypeW` `SetEvent` `EnterCriticalSection` `LeaveCriticalSection` `CopyFileW` `GetUserDefaultLangID` `OpenEventW` `DeleteCriticalSection` `RaiseException` `DecodePointer` `GetCurrentThreadId` `InitializeCriticalSectionEx` `HeapFree` `HeapSize` `HeapReAlloc` `HeapAlloc` `GetProcessHeap` `CreateMutexW` `VirtualQuery` `GetSystemInfo` `IsBadReadPtr` `GetFileTime` `WriteFile` `GetFileAttributesW` `SetFileAttributesW` `FlushFileBuffers` `GetUserDefaultLCID` `GetSystemDefaultLCID` `GetSystemDefaultUILanguage` `GetACP` `GetSystemDefaultLangID` `LoadLibraryW` `GetModuleHandleExW` `ConnectNamedPipe` `GetCurrentProcessId` `GetStringTypeW` `GetStdHandle` `ReleaseMutex` `GetTempPathW` `GetVersionExW` `FileTimeToLocalFileTime` `SystemTimeToFileTime` `SetFilePointer` `CreateEventW` `QueryPerformanceFrequency` `FindFirstFileW` `FindClose` `ReadFile` `FileTimeToSystemTime` `FreeLibrary` `GetEnvironmentVariableW` `CreateProcessW` `GetWindowsDirectoryW` `GetSystemDirectoryW` `LocalFree` `GetModuleFileNameW` `RemoveDirectoryW` `DeleteFileW` `CloseHandle` `UnmapViewOfFile` `WideCharToMultiByte` `MapViewOfFile` `CreateFileMappingW` `GetFileSize` `CreateFileW` `lstrlenA` `FormatMessageW` `MultiByteToWideChar` `SetLastError` `GetLastError` `LoadLibraryA` `GetSystemDirectoryA` `GetProcAddress` `CompareStringA` `GetModuleHandleW` `WriteConsoleW` `SetFilePointerEx` `GetConsoleMode` `GetConsoleCP` `ExitProcess` `VirtualAlloc` `GetFullPathNameW` `FreeLibraryAndExitThread` `ExitThread` `CreateThread` `TlsFree` `TlsSetValue` `TlsGetValue` `TlsAlloc` `RtlUnwind` `EncodePointer` `InitializeSListHead` `GetSystemTimeAsFileTime` `GetStartupInfoW` `IsProcessorFeaturePresent` `SetUnhandledExceptionFilter` `UnhandledExceptionFilter` `WaitForSingleObjectEx` `LocalAlloc` `GetCurrentThread` `QueryPerformanceCounter` `lstrlenW` `lstrcatW` `lstrcpyW` `lstrcpynW` `lstrcmpiW` `GetTickCount` `SetStdHandle` `SetEnvironmentVariableW` `FreeEnvironmentStringsW` `GetEnvironmentStringsW` `GetCommandLineW` `GetCommandLineA` `FindNextFileW` `FindFirstFileExW` `GetOEMCP` `IsValidCodePage` `GetCPInfo` `LCMapStringW` `CompareStringW` `VirtualProtect` `LoadLibraryExA` `IsDebuggerPresent` `OutputDebugStringW` `InitializeCriticalSectionAndSpinCount` `GetTimeFormatW` `GetDateFormatW` `InterlockedDecrement` `GetVersion` `GetProcessTimes` `OpenProcess` `GetCurrentProcess` `TerminateProcess` `GetExitCodeProcess` `SetFileTime` `CompareFileTime` `LoadLibraryExW` `GetTempFileNameW` `GetCurrentDirectoryW` `ResetEvent` `GetFileType`
USER32.dll	`CharUpperW` `wsprintfW` `GetDesktopWindow` `PostThreadMessageW` `DispatchMessageA` `DispatchMessageW` `TranslateMessage` `GetMessageA` `GetMessageW` `IsWindowUnicode` `PeekMessageW` `MsgWaitForMultipleObjectsEx` `MessageBoxW` `GetGUIThreadInfo` `WaitForInputIdle` `ExitWindowsEx` `CharLowerW` `MsgWaitForMultipleObjects`
ADVAPI32.dll	`RegOpenKeyW` `AdjustTokenPrivileges` `AllocateAndInitializeSid` `FreeSid` `InitializeSecurityDescriptor` `SetSecurityDescriptorDacl` `LookupPrivilegeValueW` `RegOverridePredefKey` `RegEnumValueW` `SetEntriesInAclW` `OpenThreadToken` `GetTokenInformation` `EqualSid` `RegDeleteValueW` `RegQueryInfoKeyW` `RegEnumKeyExW` `RegDeleteKeyW` `RegSetValueExW` `RegCreateKeyExW` `RegQueryValueExW` `RegOpenKeyExW` `RegCloseKey` `OpenProcessToken`
SHELL32.dll	`SHGetFolderPathW` `ShellExecuteExW` `SHGetSpecialFolderPathW`
ole32.dll	`CoMarshalInterThreadInterfaceInStream` `CoInitializeEx` `CoUninitialize` `CoRegisterPSClsid` `CoRegisterClassObject` `CoRevokeClassObject` `CoGetInterfaceAndReleaseStream` `CLSIDFromProgID` `CoAddRefServerProcess` `CoMarshalInterface` `CreateStreamOnHGlobal` `CoUnmarshalInterface` `CoCreateInstance` `CoReleaseMarshalData` `CoCreateGuid` `CoReleaseServerProcess`
OLEAUT32.dll	`SafeArrayCreate` `SafeArrayGetUBound` `SafeArrayGetLBound` `SafeArrayGetDim` `SafeArrayDestroy` `SafeArrayGetElement` `SafeArrayPutElement` `VariantTimeToSystemTime` `VariantChangeTypeEx` `GetErrorInfo` `LoadTypeLib` `LoadRegTypeLib` `VarBstrCat` `SysAllocStringByteLen` `SysStringByteLen` `SystemTimeToVariantTime` `VariantChangeType` `BSTR_UserMarshal` `VARIANT_UserMarshal` `BSTR_UserUnmarshal` `VARIANT_UserSize` `VARIANT_UserUnmarshal` `VARIANT_UserFree` `BSTR_UserFree` `BSTR_UserSize` `SysAllocString` `VariantCopy` `VariantClear` `VariantInit` `SysStringLen` `SysReAllocStringLen` `SysAllocStringLen` `SysFreeString` `RegisterTypeLib` `UnRegisterTypeLib`
SHLWAPI.dll	`PathFindFileNameW` `PathFileExistsW` `SHCreateStreamOnFileW`
RPCRT4.dll	`UuidToStringW` `UuidCreate` `RpcStringFreeW` `IUnknown_QueryInterface_Proxy` `NdrDllGetClassObject` `NdrOleAllocate` `IUnknown_Release_Proxy` `NdrOleFree` `NdrCStdStubBuffer2_Release` `IUnknown_AddRef_Proxy` `NdrStubCall2` `NdrStubForwardingFunction`
msi.dll (delay-loaded)	`#111` `#286` `#285` `#195` `#287` `#171` `#115` `#125` `#118` `#175` `#190` `#88` `#169` `#141` `#205` `#179` `#70`

Delayed Imports

Attributes	`0x1`
Name	`msi.dll`
ModuleHandle	`0x12f850`
DelayImportAddressTable	`0x12f804`
DelayImportNameTable	`0x1276a4`
BoundDelayImportTable	`0x1279fc`
UnloadDelayImportTable	`0`
TimeStamp	`1970-Jan-01 00:00:00`

1

Type	`TYPELIB`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x6850`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.58437`
MD5	`a8360595b88b76844c65bfa071f0a994 🔍`
SHA1	`51b4f4f16ee526bd2de2f7092ce7e84d6db2e7d6 🔍`
SHA256	`40782de2c0627224ababe12603559f37508318d8aca51570d54deb6d2f465b5e 🔍`
SHA3	`e5764c1aba3a1c277e7e44171897645d5365bf631dc8187da9bc544547b8404c 🔍`

1 (#2)

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x2e8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.45004`
MD5	`0994a9ba3e6ac0827b4b4263d88e6c57 🔍`
SHA1	`f9f432ed33f30e89849a7873042fd62a5f4cfa09 🔍`
SHA256	`afeee894bce9bab2ad9efd9d070969205f949b8216bfee04953e1d0b7ee3501a 🔍`
SHA3	`9cf35eee6be589e633abc56e62c7d3b5096a9f423e064476d4d0bf9d289dfbac 🔍`

1 (#3)

Type	`RT_ICON`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x468`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.67732`
MD5	`07dbf03fcd263378ff834b33a124713a 🔍`
SHA1	`35b63af4195ee25daf709d949b7a1a3aa5604f0f 🔍`
SHA256	`2c0dac40992d77fca9b9fada755b2a5de1afd689fcca63ce43563d7575ef7177 🔍`
SHA3	`575692dfb14708f926808ce904f3a8592e36cdae4d586e7b33fccf49561ac24d 🔍`

2

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x128`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.69064`
MD5	`c5973022f5925bc8dee2aa76db5b9fb7 🔍`
SHA1	`278cf82fa0b3fe669a6f4d262b6ebf0f8201fa39 🔍`
SHA256	`4f3c76c07529855cef7fc25175f01db1ca2e4b2f68faaaf620fc1454824b68f2 🔍`
SHA3	`107c7e8ccfe8269e99ce219d132ef5fc0bb3abe6ffd00b427a46aaf5122ba905 🔍`

2 (#2)

Type	`RT_ICON`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x10a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.31163`
MD5	`2c4c2ace15b7bbede07ec64626ec9b5a 🔍`
SHA1	`ef68430a8d6ec04c23edea5b07bc591ed7653823 🔍`
SHA256	`3ff598246933facbf5c36c5ba94ee549d2572a919344e98fb7fe65699640effb 🔍`
SHA3	`2cfbef476caf56238808ac3bd3323e22b8b07861a34a0c825433611dd2a751d3 🔍`

3

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0xea8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.92888`
MD5	`1f2e362220376f44903264f7a6bc2cb5 🔍`
SHA1	`aaeff01be07abd2f63aa0d34a9e948ffe6cef7f6 🔍`
SHA256	`8b6ec0a6e18318c0348ab87238b438a0113870e27bc131d921a631f80e97deae 🔍`
SHA3	`98b9abe79a9b6bc5e307d28d0d98d2c7d725fd238a24b166a190c67d5ab06b58 🔍`

3 (#2)

Type	`RT_ICON`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x25a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.94006`
MD5	`6fc66216b68b96ae8c964b7a9b6aae2d 🔍`
SHA1	`9d73658fae8afd0b67ad1d6e9a93b8f08d3a5472 🔍`
SHA256	`9a86ae28f0d2b3564c103e8655df2213e4762c0e89af9e62b4aff53a770df91c 🔍`
SHA3	`60b9789fdd486ed9281a2fbc1cce94534ee0aebe7223654576a266ebd1eeeef0 🔍`

4

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x8a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.26581`
MD5	`0ed35451bdd4639ca845d3c4e3ead391 🔍`
SHA1	`748d5c8de46f4dd55c1030c02a1cd1cbcec7d7d8 🔍`
SHA256	`6a0468bcb225075d79e6824eb8f8dd708d527395fa8592d6a16892a156822f25 🔍`
SHA3	`fe3e0f37fab37b697e726ddf142b1456c8b3eeaae756e39ff115470111c11bb5 🔍`

5

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x568`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.23565`
MD5	`d44cf285dfa5022d279ef0ac57280500 🔍`
SHA1	`f59656658123d8a44019934c35b66a2e9bb55891 🔍`
SHA256	`27facc0b856f1670cbe0018b9aeae367c1874c2bce7da361dccdb948b3fa6102 🔍`
SHA3	`10364f906ff2309a1e39e8e40096253261c92b237583b9db631c64f2af808f9d 🔍`

6

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0xbf79`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99292`
Detected Filetype	PNG graphic file
MD5	`b5dea88d72b98ffa4fe86a49438a4ba5 🔍`
SHA1	`edcc3cbc9a73d5b4b12fa9c203a121f7726ca7ad 🔍`
SHA256	`93668c3d90ce1cc060c945a273febb0c1eb586c1a15ca8f4297dbf003fe98211 🔍`
SHA3	`8dd006911aff423611f06dc759308110e951a08dc06876b4605588fccdd9e3f9 🔍`

7

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x4228`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.93268`
MD5	`26b5abefac15bed630cad7da1fbeab89 🔍`
SHA1	`a88ba273a1d3a0fbb523a62f1660caf9023114e3 🔍`
SHA256	`4ed817d17940222b34e72e0d163ba119c02f60ca00f4d9290b697ae4d10a3659 🔍`
SHA3	`0a9e245d35d82ded42e15ffbede0092fadfd93425de48b9296259477b0739dad 🔍`

8

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x25a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.95908`
MD5	`94d457bc434632a5b20dcdb57510f3a6 🔍`
SHA1	`b48e47e4624ae71a49b9e308cb863e97a90396a9 🔍`
SHA256	`890c6d3ccc7934c9e5782694d3d64c1739090d174b8e96025406d44bc2bc086c 🔍`
SHA3	`c1e0a083be9fa61c76f36c4533469c57db625039be03efcd0c8cbd6d50840a01 🔍`

9

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x1a68`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.06798`
MD5	`6fe1b3997d7f9eee752ee71cb42a501c 🔍`
SHA1	`69610818e64c63cc6e7ab6d5c206cbee6f6939bf 🔍`
SHA256	`32b7fdaeee0b51d2e47832fc5e0fc089b27a897147daa52c0614f6906894d887 🔍`
SHA3	`03745d91dbebc23e670812630ffe8345bd1151ac2957077baf2bbe22660d536d 🔍`

10

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x10a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.10665`
MD5	`9106941a884d75f6da511a42adb1b891 🔍`
SHA1	`1eb2be757ae68cede0542bc6b060283642bf911d 🔍`
SHA256	`28738f32ff4087c4c51ff81d0d6c36d269916a373fa52c616ca7b9b24063b811 🔍`
SHA3	`fe3d1771c411478d229dc6f6cd47a8b412801947c2081aed365707b9bfe1e2b2 🔍`

11

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x988`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.10917`
MD5	`1e13733efb573b44379188e801e3bc56 🔍`
SHA1	`df5b5db1aff8ae7c9ae154fe4f916fedc3bef368 🔍`
SHA256	`fb2524b25ae77bdb89e83957c30bd27983b2a8145a806e76aba2af013c90d9f5 🔍`
SHA3	`01c40f173bf118e3551a55bdbbd53f7e6c0d32c17830764ca4666ff590299038 🔍`

12

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x6b8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.16442`
MD5	`7ac712c48b90ea801bcb3b0aee79e1bc 🔍`
SHA1	`536d462420c24a6314f9b8dc6ba8451cac827b59 🔍`
SHA256	`1959adb4cc34ea9744a4e48a36e88f41f710768df9a38c69d27df6825644bbe1 🔍`
SHA3	`7b76167745f3ea20ba253aaaa98607170c9e813b45a2b73c22aa4d9c89c464ad 🔍`

13

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x468`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.04901`
MD5	`aeb881347fb566db27f779e6fc1857cb 🔍`
SHA1	`c55b6c3b4e3e06bc4e501e7cbcbaa113edea178a 🔍`
SHA256	`c49f94382a01091725ef5fbd258a24fd7303ae39e6ef3557246a728b3e6d31ef 🔍`
SHA3	`e247d4f9297002c5573387b96a902f604400e89aa686d7a46fae5f6fc9e3a9d6 🔍`

7 (#2)

Type	`RT_STRING`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x48`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`1.94502`
MD5	`796e8ab5af9ee5c296c5afc082f2a424 🔍`
SHA1	`beae470d4f10a0d87a626fcbebebac191b4f20aa 🔍`
SHA256	`7afa8de1da2c68014757338c69ea92faa18c1785b650b6d97c9a405045091fa7 🔍`
SHA3	`701ba3165dbfc7ab30832c45b4fa89bec9c44ae19d4f2a8b1df30310b129aac5 🔍`

101

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x13532`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.98527`
Detected Filetype	PNG graphic file
MD5	`522718d12652244d74246e8d197232f4 🔍`
SHA1	`47437da131b6c910d5f4de499e6bc813b58dc8ec 🔍`
SHA256	`49931791362310d38320536f8fb4dcc5aa1e599140c1f1c1d524863d61f4fcff 🔍`
SHA3	`ab8c3da1992b75187cbdca5540a3ef8a3064a8bcdb18d907ade4577c11e4a62c 🔍`

151

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x13532`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.98527`
Detected Filetype	PNG graphic file
MD5	`522718d12652244d74246e8d197232f4 🔍`
SHA1	`47437da131b6c910d5f4de499e6bc813b58dc8ec 🔍`
SHA256	`49931791362310d38320536f8fb4dcc5aa1e599140c1f1c1d524863d61f4fcff 🔍`
SHA3	`ab8c3da1992b75187cbdca5540a3ef8a3064a8bcdb18d907ade4577c11e4a62c 🔍`

201

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x13532`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.98527`
Detected Filetype	PNG graphic file
MD5	`522718d12652244d74246e8d197232f4 🔍`
SHA1	`47437da131b6c910d5f4de499e6bc813b58dc8ec 🔍`
SHA256	`49931791362310d38320536f8fb4dcc5aa1e599140c1f1c1d524863d61f4fcff 🔍`
SHA3	`ab8c3da1992b75187cbdca5540a3ef8a3064a8bcdb18d907ade4577c11e4a62c 🔍`

100

Type	`RT_GROUP_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0xbc`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.11665`
Detected Filetype	Icon file
MD5	`32aa8c34fc2864f72195e55d3a927c99 🔍`
SHA1	`e07e4f4802e2887b15ef0850ef5a2d6f381e2f88 🔍`
SHA256	`24dd159fa2f2aa53f21eb0f4bfd57ad911391f3720804738432a290d4953d064 🔍`
SHA3	`68427ee8d69dd0d02092c6f6becd5557ac57751951e9caf2078be202fce50e36 🔍`

100 (#2)

Type	`RT_GROUP_ICON`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x30`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.45849`
Detected Filetype	Icon file
MD5	`409e1724611e0bc39356e2f58888db55 🔍`
SHA1	`c06c0e66cc2f7956256e2f018aa0294bfa914960 🔍`
SHA256	`6ab18c3b81a5d30c5a190a4504cae807d73b1a4d02d56ffddf641abbb62b7210 🔍`
SHA3	`315b2ad40793f4ef885ff4c878169b02c62f619b57780a98a76c8538cd0ee5c9 🔍`

1 (#4)

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x468`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.3985`
MD5	`cfee56d23988c65afc54ebbd3ceeb5e2 🔍`
SHA1	`3be926e25ca3a8585a72ba81230b2c54b8c0a1e1 🔍`
SHA256	`6571d05d0c40e0e10547199b5ba32ba98aba50fa746297f847c25c9373f43ce5 🔍`
SHA3	`7cac8b14aa1716a8d55c5a644276e032bec6e67349b110d059661c201d924bfb 🔍`

1 (#5)

Type	`RT_VERSION`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x428`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.36089`
MD5	`c32b5fc76d8df5b80c62c1d123945280 🔍`
SHA1	`f0251a258fafe989cb51aa11fe7bf03ec3013251 🔍`
SHA256	`fb6cc376a71ca256278b72e6a43618629fdeec862f05a561829105067e301132 🔍`
SHA3	`1c64fad76434689db0d3d56267f84d6975467705b921e78b21df4f48b1a1f30b 🔍`

1 (#6)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x533`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.2661`
MD5	`20913020057f4bb577b5568818e9d77b 🔍`
SHA1	`3a9b4b890038a59065bc212fd22d066fb244f5da 🔍`
SHA256	`89e95cc25c8fed8da5475afe2eb0cd7060be823e5cceb827e7e6830f4869eeed 🔍`
SHA3	`2419474912c4ae9677993648588e1292439a4e033fd560117e0a89caff96a199 🔍`

1 (#7)

Type	`RT_MANIFEST`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x280`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.07176`
MD5	`0f3b71d0fa474d73aff7de9cdf842732 🔍`
SHA1	`7990f81c60b8ab722c5ad7367f69c85106be5ed5 🔍`
SHA256	`5055de34114f55b1bfafbbbda68ec60c4291109780b9c197557b7c222c9a4e09 🔍`
SHA3	`c819cff55bde393211a32de2e92c070f295200f1b580ba63c6d18be15e762375 🔍`

String Table contents

SetupSuite
SETUPSUITE

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2021-Dec-14 19:43:27
Version	`0.0`
SizeofData	`91`
AddressOfRawData	`0x103bf4`
PointerToRawData	`0x101bf4`
Referenced File	C:\CodeBases\isdev\redist\language independent\i386\SetupSuite.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics	`0`
TimeDateStamp	2021-Dec-14 19:43:27
Version	`0.0`
SizeofData	`20`
AddressOfRawData	`0x103c50`
PointerToRawData	`0x101c50`

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2021-Dec-14 19:43:27
Version	`0.0`
SizeofData	`1108`
AddressOfRawData	`0x103c64`
PointerToRawData	`0x101c64`

IMAGE_DEBUG_TYPE_ILTCG

Characteristics	`0`
TimeDateStamp	2021-Dec-14 19:43:27
Version	`0.0`
SizeofData	`0`
AddressOfRawData	`0`
PointerToRawData	`0`

TLS Callbacks

StartAddressOfRawData	`0x532000`
EndAddressOfRawData	`0x532008`
AddressOfIndex	`0x52fd50`
AddressOfCallbacks	`0x4dd548`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_4BYTES`
Callbacks	`(EMPTY)`

Load Configuration

Size	`0x5c`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x52a0b0`
SEHandlerTable	`0x502950`
SEHandlerCount	`1193`

RICH Header

XOR Key	`0x7dffcd71`
Unmarked objects	`0`
241 (40116)	`12`
243 (40116)	`139`
242 (40116)	`24`
ASM objects (VS2015 UPD3 build 24123)	`22`
C objects (VS2015 UPD3 build 24123)	`19`
C objects (VS2015 UPD3.1 build 24215)	`1`
C++ objects (VS2015 UPD3.1 build 24215)	`12`
C++ objects (23013)	`2`
C++ objects (VS2015 UPD3 build 24123)	`56`
244 (40116)	`4`
239 (40116)	`17`
Total imports	`382`
C++ objects (LTCG) (VS2015 UPD3.1 build 24215)	`74`
Resource objects (VS2015 UPD3 build 24210)	`1`
151	`1`
Linker (VS2015 UPD3.1 build 24215)	`1`

Errors

[*] Warning: Multiple nodes using the name Version Info in a dictionary.

Leave a comment

No comments yet.