4cfc231a44e1d837534e1e0d90b7b6cb

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2020-Dec-01 18:00:55
Detected languages English - United States
Debug artifacts D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Info Cryptographic algorithms detected in the binary: Uses constants related to SHA1
Uses constants related to SHA256
Suspicious The PE is possibly packed. Unusual section name found: .didat
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryW
  • LoadLibraryExA
  • LoadLibraryExW
Can create temporary files:
  • CreateFileW
  • GetTempPathW
Suspicious The file contains overlay data. 2250497 bytes of data starting at offset 0x4d400.
The overlay data has an entropy of 7.99988 and is possibly compressed or encrypted.
Overlay data amounts for 87.6733% of the executable.
Malicious VirusTotal score: 45/67 (Scanned on 2021-11-08 08:10:18) Lionic: Trojan.Win32.Makop.trQA
Elastic: malicious (high confidence)
MicroWorld-eScan: Trojan.GenericKD.37967968
FireEye: Generic.mg.4cfc231a44e1d837
CAT-QuickHeal: TrojanDownloader.MSIL
ALYac: Trojan.GenericKD.37967968
Cylance: Unsafe
K7AntiVirus: Trojan-Downloader ( 0058a0961 )
Alibaba: TrojanDownloader:MSIL/Injuke.31f776eb
K7GW: Trojan-Downloader ( 0058a0961 )
Cybereason: malicious.a44e1d
Cyren: W32/MSIL_Kryptik.FSG.gen!Eldorado
Symantec: Trojan.Gen.MBT
ESET-NOD32: multiple detections
APEX: Malicious
Paloalto: generic.ml
Kaspersky: UDS:Trojan-Downloader.MSIL.Seraph.gen
BitDefender: Trojan.GenericKD.37967968
Avast: Win32:CrypterX-gen [Trj]
Ad-Aware: Trojan.GenericKD.37967968
Emsisoft: Trojan.GenericKD.37967968 (B)
Comodo: .UnclassifiedMalware@0
F-Secure: Trojan.TR/Dldr.Agent.sfqvf
DrWeb: Trojan.Inject4.18335
TrendMicro: TROJ_FRS.0NA103K821
McAfee-GW-Edition: BehavesLike.Win32.Generic.vc
Sophos: Mal/Generic-S
SentinelOne: Static AI - Malicious SFX
GData: Win32.Malware.Injector.8AP8SJ
Avira: TR/Dldr.Agent.sfqvf
Antiy-AVL: Trojan/MSIL.Injuke
Gridinsoft: Ransom.Win32.Sabsik.sa
Arcabit: Trojan.Generic.D2435860
Microsoft: Trojan:Win32/Sabsik.FL.B!ml
Cynet: Malicious (score: 100)
McAfee: Artemis!4CFC231A44E1
MAX: malware (ai score=82)
Malwarebytes: Malware.AI.4288710836
TrendMicro-HouseCall: TROJ_FRS.0NA103K821
Yandex: Trojan.Injuke!udIFvsF0Jxk
Ikarus: Trojan-Downloader.MSIL.Agent
Fortinet: MSIL/Kryptik.ADJY!tr
BitDefenderTheta: Gen:NN.ZemsilF.34266.lm0@auhxFTp
AVG: Win32:CrypterX-gen [Trj]
Panda: Trj/CI.A

Hashes

MD5 4cfc231a44e1d837534e1e0d90b7b6cb
SHA1 7b32a86c3acec02c24c3db935bca966645ef3190
SHA256 67eb33781c6b44a53d41ed8e33244cdbc36da452f7cfb3b96f7843efe26e81f6
SHA3 b43ceea431a50ed15322113392de725782aa2ed3b802df15a349c3a01c4450ce
SSDeep 49152:UbA304qctOhJ0tZDDW3Xp1QhgfqeuC3QxNHt5+rwpN0PeAAXn+J:Ub8mhCjyohgfjaNN5+rQ+PjAXn+J
Imports Hash d9c7fe34007b0a8d96909f8101072f46

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x118

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 6
TimeDateStamp 2020-Dec-01 18:00:55
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0x31200
SizeOfInitializedData 0x3e600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0001EC40 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x33000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.1
ImageVersion 0.0
SubsystemVersion 5.1
Win32VersionValue 0
SizeOfImage 0x74000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 c5bf61bbedb6ad471e9dc6266398e965
SHA1 85ba0e85c3b341d29903bac4cc9748b86b5aec59
SHA256 3a2ff9b9a2c548b4856e32d6fb99df0a6465ee7986dc550d067fca7fb0a4aa42
SHA3 7787fa09c0b6129fd9ff1632f670debf88b31c20a97df4405ed168b157a562d6
VirtualSize 0x310ea
VirtualAddress 0x1000
SizeOfRawData 0x31200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.70808

.rdata

MD5 7980b588d5b28128a2f3c36cabe2ce98
SHA1 d1c65ab34aba92c118fabac07f130027d9afd450
SHA256 d739978cbddded21b2f865dc6ec6b845b4f01cf26f697d96ab24227d949e307c
SHA3 3d57e3f168dcb26b251f834ba030fa2af208658c2fb57d0d257b9fe8dfbeb457
VirtualSize 0xa612
VirtualAddress 0x33000
SizeOfRawData 0xa800
PointerToRawData 0x31600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.22174

.data

MD5 201530c9e56f172adf2473053298d48f
SHA1 6b160855a24650fb6df8fda051e6a773aefbb0ae
SHA256 1c4f76453eb9c9c3d1d1393f8d3e040adaa312e787da2cb9bfb141c84fa6223c
SHA3 a573d63ed6b08dae2d342140b728396cd57b7b1a9fc424af5459ec8338336acf
VirtualSize 0x23728
VirtualAddress 0x3e000
SizeOfRawData 0x1000
PointerToRawData 0x3be00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.70882

.didat

MD5 c5d41d8f254f69e567595ab94266cfdc
SHA1 a82f4d348f331c812feea68e9dd6ac1b771f1e66
SHA256 645bde0bbb07ec2fe8fa92b42e990539e695239a2f56abe7bcb89d2a0584e778
SHA3 3d0027fe11ce3e3a33d834a835723988c701066262d467b92c35d83722dc99d5
VirtualSize 0x188
VirtualAddress 0x62000
SizeOfRawData 0x200
PointerToRawData 0x3ce00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.29825

.rsrc

MD5 f6c0f34fae6331b50a7ad2efc4bfefdb
SHA1 7aa38184413693ee0eb9c0e0bd3ddfaf7dbbc74e
SHA256 58c5b0ebfa1a380fb20fc52e8d06f2e9dee645ea0357fb7a4925045ad15d83e3
SHA3 a6173ce29884ff4324dda3b6243acf1cf14fd3c317cd8f5c9e689f2dea5664cb
VirtualSize 0xdfd0
VirtualAddress 0x63000
SizeOfRawData 0xe000
PointerToRawData 0x3d000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.63675

.reloc

MD5 c7a942b723cb29d9c02f7c611b544b50
SHA1 35955d28bc54fd26de6997c8b4b80a3cb02dda5c
SHA256 d2f7854a7534a82677499e709a62c71225a8f83bae2020be1acd2549ba85e627
SHA3 19475bfc65c2ef55f63108ce9ad33b8690cedf0c126d5f0a2d29bdb95e02f26d
VirtualSize 0x2268
VirtualAddress 0x71000
SizeOfRawData 0x2400
PointerToRawData 0x4b000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.55486

Imports

KERNEL32.dll GetLastError
SetLastError
FormatMessageW
GetCurrentProcess
DeviceIoControl
SetFileTime
CloseHandle
CreateDirectoryW
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
GetFileType
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
FindNextFileW
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FreeLibrary
GetProcAddress
GetCurrentProcessId
ExitProcess
SetThreadExecutionState
Sleep
LoadLibraryW
GetSystemDirectoryW
CompareStringW
AllocConsole
FreeConsole
AttachConsole
WriteConsoleW
GetProcessAffinityMask
CreateThread
SetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
LockResource
GlobalLock
GlobalUnlock
GlobalFree
LoadResource
SizeofResource
SetCurrentDirectoryW
GetExitCodeProcess
GetLocalTime
GetTickCount
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCommandLineW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
MoveFileExW
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
SetStdHandle
GetProcessHeap
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
RtlUnwind
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
QueryPerformanceFrequency
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapFree
HeapAlloc
HeapReAlloc
GetStringTypeW
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
DecodePointer
gdiplus.dll GdiplusShutdown
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc
USER32.dll (delay-loaded) PeekMessageW
PostMessageW
WaitForInputIdle
IsWindowVisible
DialogBoxParamW
EndDialog
GetDlgItemTextW
DispatchMessageW
SetFocus
SetForegroundWindow
GetSysColor
LoadBitmapW
LoadIconW
DestroyIcon
IsDialogMessageW
TranslateMessage
GetMessageW
wvsprintfW
GetClassNameW
FindWindowExW
MessageBoxW
ReleaseDC
GetDC
SendMessageW
LoadCursorW
CopyRect
MapWindowPoints
UpdateWindow
DestroyWindow
IsWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
CharUpperW
OemToCharBuffA
LoadStringW
GetWindow
SetProcessDefaultLayout
SetWindowLongW
GetWindowLongW
GetWindowRect
GetClientRect
GetSystemMetrics
SetDlgItemTextW
SetWindowPos
GetParent
SetWindowTextW
EnableWindow
GetDlgItem
SendDlgItemMessageW
ShowWindow

Delayed Imports

Attributes 0x1
Name USER32.dll
ModuleHandle 0x60cb8
DelayImportAddressTable 0x620a0
DelayImportNameTable 0x3bf84
BoundDelayImportTable 0x3c690
UnloadDelayImportTable 0
TimeStamp 1970-Jan-01 00:00:00

101

Type PNG
Language English - United States
Codepage UNKNOWN
Size 0xb45
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.87356
Detected Filetype PNG graphic file
MD5 63486a769bbe3f49d5848b9c69734a25
SHA1 e48bd36c2f23c238206bdddf3ebb6d6862905710
SHA256 a91f4373ceebadfc70b3bd0758848918f928c3c76562e3d9d531574796fd9e9c
SHA3 7e9dc73ef6ee0ce127eee80c5daf334bd98ed2d2f262376ed7760866816d815b

102

Type PNG
Language English - United States
Codepage UNKNOWN
Size 0x15a9
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.80129
Detected Filetype PNG graphic file
MD5 e6ccfb6d9ffd4e1a907a47761c64bd79
SHA1 d6a2994dedae3527a878140aa60dcaa087b90445
SHA256 27d3a1a2da49dc535cc10806abaae9dfa49e4f5f44a40540ead50e065b99ca68
SHA3 11423dcd0ab4c11695ad71f56e4fcdfc4b20a38cc6ac653ab7575f7dd024d0e5

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.97409
MD5 c357a2678e5234d9d0d93b80fff556eb
SHA1 f575af42db3045470df63787d678b61b3f696637
SHA256 573c9bd29dea90ed994bad702ec79c41e98e1c8fb54b7964ec05ed1e64efefd1
SHA3 74ecef77dbd4ce361c6226d842d49a2c28a318af22f9dc81baa2524ab14bdda9

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.10026
MD5 e55630d67fb64ba59f51d8266d31ff01
SHA1 b7b5b8c32742d7c3e2ef39fd5432eb22fd378048
SHA256 85fe3ae58f9c30ca21251517164585fbb10f8490f0790dd15859438c1ca59729
SHA3 9282845cf7d52c29ac721534751a56a1fcb3e2c625c186a4934cd6956ba317a7

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.25868
MD5 73a958fb4dece366b7cf2f80de03528f
SHA1 f091434598195479caeb051cd932b64076d7840e
SHA256 32bd1078137a5367d204b941cf6d970abbe1a520ac9e54b63d56f7e2f8a326ae
SHA3 932882004db4780e9e260450182e91296e4ade6d07f3e1a3382f5d80b2b7b86e

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.02609
MD5 e768244eed218cd473905b37afb09cce
SHA1 340c145b2b5a4393aa4b09bbdda14a84259b6c7b
SHA256 6e296a4f88254d5c4e4f1871f425e8d9c5ca08846d5c90cb3bc9ceee89c91ae3
SHA3 f0a0dda5ab093a3211b8d4608dec0f9fd7ebcad96d357a449ae4b74d12051f4b

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.18109
MD5 45fbeb8fc40ffa66db2f901c50a7ab8a
SHA1 d302538cba2599add5c8d0070cd2c5b3f077cf6a
SHA256 574ed44e93b206d0b5b4354fba244af5a573796db738e34ca37a6e061b0fed3f
SHA3 da977a245bb5f556f77ef1ddb5b59f96e6fc9225db7d2048eadc5441a692ae48

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.04307
MD5 da87510c3aabe7851c7c5d0493dbb14a
SHA1 4c59f617d7cebc871df1417f61c64a98556eda99
SHA256 91b392c6bd14fa9d9bcab2afc2b37825779abae8b32443ce0a5ee0d9793f8fe2
SHA3 582d345c2dd3b6dfa7daef53c039faa49be1b9cc8f749b08ca35fe6493b3bb46

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x3d71
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.94547
Detected Filetype PNG graphic file
MD5 7b678b6cb96c363d9e0adc3a1b3b4893
SHA1 c7e817672b686eb66bf5907da1efaef1dec8e06e
SHA256 6f86849b026f0c45c0c8a1145048960bbdefdaea3beac030f114b1ff16057994
SHA3 350e01112644403dd6d571343e7b00aa3d24e1b6fac796956f564355dde57fa9

ASKNEXTVOL

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x286
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.419
MD5 8edc9d9954c16d9083b44657a62c353e
SHA1 bb567f7e6b33d5d976abe26b9da4e403c3182dc4
SHA256 8f25d7b09ecff6d3389a7742dc2a9e3187bdf010877d5512b7bab24566c3fca9
SHA3 140be6b67eed1b2eba6651eb7fb1ed127c202df3b0cbe5ef1d2a3299fbb2c3fb

GETPASSWORD1

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x13a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.33594
MD5 846493df763dc8986b2a7a908694aa5c
SHA1 7113017d3f8ab15f721836f8cac36a3dde424962
SHA256 a6cb648be2175544ba05cd1c0d9f5b45b1d344915c503f01495f744708ebf6fc
SHA3 c524ff060d297a1a5d5a072ad50e5440ed3119f05de91aaf5f372a6d6a5e642b

LICENSEDLG

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xec
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.16133
MD5 4da01a070e57545f97e0d84bcf1524e5
SHA1 eeeadb106e138aa26b66d276f84c8d076a31142e
SHA256 44e6a8daef1ac762f8016fc4c8aec52bad42f589b6d8a25d430a619610dd0028
SHA3 a018ce14f68b06cbed4adb1bf6714f3b6c1aa64fa2afa2215e037aa654f9fcee

RENAMEDLG

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x12e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.09135
MD5 43b0cc5d14bc75c453a11cb013864a38
SHA1 6990aed36ba67f0d6d34a63c3d9fd9dc2487db01
SHA256 237fb4fcfacd77cffde8221c92f0726c849afc96cd0bfd833f50b78552f7b22b
SHA3 a5ace4978d8258be5a68d7db48bc472ffa5cb949b4bb7c64f35348b5b34bb9e2

REPLACEFILEDLG

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x338
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.31634
MD5 59053a2d4069a360fc73761849e1318c
SHA1 541edef52f27a7178cac477eb3803cb4820d31ae
SHA256 19561beb5029c85d95648f15c598b028a4f8a00bc36f452c5428308693ed748e
SHA3 a1fea8b8bfc45c410ebcfcc73afd1716c6c2abb2889e8a170e221a7ac702bb59

STARTDLG

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x252
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.51642
MD5 8f7f380b1a69743aac7181d97f60324b
SHA1 e6a444d1fb41f3a3bfec6dee720ee63e2337fcfe
SHA256 ad7a2ec8f4ae2bad71bc363e13eb5a809b2936f010f453b986ea04a5605c630a
SHA3 313019b4cd37222ade46ea6cfb35e136befe0a6e755a2d02590745173e2199d6

7 (#2)

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x1e2
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.1586
MD5 2ee005bf14efd62d866ca276e73b47aa
SHA1 e098ed7de14a3221722e8c25ada1cb901ce85978
SHA256 450b4d82a86dba50acea995d6356e0174a242081f2c2438f6f88c29038f7097d
SHA3 3bd4b237507bdbc645d985837c718b5df99fa6c91e862fe59f7295cd82c7d0b0

8

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x1cc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.11685
MD5 91984a8521454b1758674f2f0765e695
SHA1 f48b0e0ca433d99226abe5cb9f1421b5dc204d31
SHA256 89051dca472bd5ebb7b344c05150755b6e3d32cb0dffea086c04186820b188d2
SHA3 c7c2157fcb23e3b9253e37f60afe11361c625e3d5e0535bbbf988387d2cd517c

9

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x1b8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.11236
MD5 de2fde7dcddbe30df25bfcf234a301c3
SHA1 749b1a50cbed02bb7fd1fd277333340996b22c6f
SHA256 dd64405d95bedf0c5a998dba963360b3b9dd01d1482179c2b1d33ddb465841eb
SHA3 18b764b7d6b4bd748a55e961d11738a5fc2eb831e2be55cb21dd535e29ca9aeb

10

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x146
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.99727
MD5 06aeb5ae44f152010b502d79d78da978
SHA1 765389e59fc961fb9782413bccd6218c0ed29c95
SHA256 1e87eca343221966ecd9472109f3baf9081c821e3f4e905aa34eb8bce73af4e7
SHA3 dda651f9f04eded147d6b4d66801eb000f7f83f5e6161c919beca8e51e7b6f8a

11

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x446
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.2036
MD5 50607cbf5fa33da61e8d119c4a2c0c9b
SHA1 d38285a743fe1ebf62ecb612d62336060c865bc7
SHA256 06b2bd666ed1afbbfc9914b94d703087c18248c5fe28dead42e42f22c3984c5e
SHA3 9bc82cef576158d1c1bf6c60e77dae43a3c3ef80d1373ceafa46da206fd67cfe

12

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x166
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.12889
MD5 70f271b2edd6a05942b95abced225c10
SHA1 dd3de2dc38efaf506c8c902edc3c6639651babbf
SHA256 d5755fffe2a9a4baf3593b8fba9a029b23bcc08e77c8d98e07b93baee6b9e6de
SHA3 99f9038fe42c25749482786e85b1f0ee5dda044080bf4ea4b311b333a3098c63

13

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x152
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.01704
MD5 f82916fbe2aea69eafe68b9796d66a02
SHA1 0163aae109725b0ddb7740b3f648da2777463e55
SHA256 abbb67522b7822276112f9a351d05701b2b62f2317592dd8ac7c921809de2ccc
SHA3 bb63fc32a6057e9ffc74dc8c5276a24af66b86604daede76ce69550e41999599

14

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x10a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.94627
MD5 30e6552170bc691f678f7acef9e80e0c
SHA1 8b2d788087dcb89391aca01e923a041f91bbb58b
SHA256 9259a6b6d2959b4dc26b0563c2e15fca703e6bf343e2016ed314a992617f1904
SHA3 c36395577d2aeb1248c26a8b5a5db48646b2ca0c999cc6e8bdba8678cefc97d7

15

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0xbc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.83619
MD5 09b30c86fe6cd7c8fe6d5d5fdd8b0a3e
SHA1 ba24c6e94ca7607f3fa91f71142d64d2e2938152
SHA256 f63fabe3ed749afb7b1719755170afe965f37e216834adf90dec051811afe657
SHA3 f4baf857de57ba1229f413a1165ec8e17dfa3e973f315fda2a082f79a3f64948

16

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0xd6
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.80514
MD5 3a1b603eaeaa7aca84afab706054807b
SHA1 577ba4baf69c0cc5867167174746fc35fb11e8fd
SHA256 cfa68e1c4fe3e613725ec1c45a80c2e4855c07e2d4587c8cf46fac05a78c0145
SHA3 dc50fd5dad67b49d6067255f83399ab84ccc7adc2476f3b4db2c652fa24c5169

100

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71858
Detected Filetype Icon file
MD5 216b6c99a73c9bdc965962e9c7ced2ec
SHA1 3432d1355ff9f39aa7c8832ef6e37ff118bce043
SHA256 4fd3c618bd4aea3ab42334f2e9375a22a7ef5e7ebf6da9f69c2249d6b6584ffe
SHA3 015714e195a897ffdf3e2b709ed0d7e6c07d80c9624587ab4e16effef840af5d

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x753
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.25329
MD5 8ddcbbd6b8c80eef68bf9305e59fa1f3
SHA1 014923abccec57fa3ad16f65feb0de2b8cbc8408
SHA256 1b7b67e5d8927449d8f7be80a0e5ba5f03d25670035027c0cb71abce27da6810
SHA3 e5c4bfc7e92f1b945363bb9ad2aabbe4324074ac295d08722e743d6e7c524b69

String Table contents

Select destination folder
Extracting %s
Skipping %s
Unexpected end of archive
The file "%s" header is corrupt
Corrupt header is found
Main archive header is corrupt
The archive comment header is corrupt
The archive comment is corrupt
Not enough memory
Unknown method in %s
Cannot open %s
Cannot create %s
Cannot create folder %s
Checksum error in the encrypted file %s. Corrupt file or wrong password.
Checksum error in %s
Packed data checksum error in %s
Write error in the file %s
Read error in the file %s
File close error
The required volume is absent
The archive is either in unknown format or damaged
Extracting from %s
Next volume
The archive header is corrupt
Close
Error
Errors encountered while performing the operation
Look at the information window for more details
bytes
modified on
folder is not accessible
Some files could not be created.
Please close all applications, reboot Windows and restart this installation
Some installation files are corrupt.
Please download a fresh copy and retry the installation
All files
<ul><li>Press <b>Install</b> button to start extraction.</li><br><br>
<ul><li>Press <b>Extract</b> button to start extraction.</li><br><br>
<li>Use <b>Browse</b> button to select the destination
folder from the folders tree. It can be also entered
manually.</li><br><br>
<li>If the destination folder does not exist, it will be
created automatically before extraction.</li></ul>
The archive is corrupt
Extracting files to %s folder
Extracting files to temporary folder
Extract
Extraction progress
Total path and file name length must not exceed %d characters
Unknown encryption method in %s
The specified password is incorrect.
Incorrect password for %s
Cannot copy %s to %s.
Cannot create symbolic link %s
Cannot create hard link %s
You need to unpack the link target first
You may need to run this self-extracting archive as administrator
Pause
Continue
Security warning
Please remove %s from folder %s. It is unsecure to run %s until it is done.

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2020-Dec-01 18:00:55
Version 0.0
SizeofData 81
AddressOfRawData 0x3ad24
PointerToRawData 0x39324
Referenced File D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2020-Dec-01 18:00:55
Version 0.0
SizeofData 20
AddressOfRawData 0x3ad78
PointerToRawData 0x39378

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2020-Dec-01 18:00:55
Version 0.0
SizeofData 924
AddressOfRawData 0x3ad8c
PointerToRawData 0x3938c

TLS Callbacks

Load Configuration

Size 0x5c
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x43e668
SEHandlerTable 0x43ac90
SEHandlerCount 37
GuardCFCheckFunctionPointer 4403808
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0xb0990126
Unmarked objects 0
241 (40116) 13
243 (40116) 141
242 (40116) 24
199 (41118) 2
ASM objects (VS2015 UPD3 build 24123) 22
C objects (VS2015 UPD3 build 24123) 19
C++ objects (VS2015 UPD3 build 24123) 44
C objects (VS2008 SP1 build 30729) 10
Imports (VS2008 SP1 build 30729) 5
Total imports 268
C++ objects (VS2015 UPD3.1 build 24215) 49
Exports (VS2015 UPD3.1 build 24215) 1
Resource objects (VS2015 UPD3 build 24210) 1
Linker (VS2015 UPD3.1 build 24215) 1

Errors

<-- -->