85dd61ec4125ba45a136a5b40b7250de

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1992-Jun-19 22:22:17

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Tries to detect virtualized environments:
  • Hardware\Description\System
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExA
  • GetProcAddress
  • LoadLibraryA
Functions which can be used for anti-debugging purposes:
  • SwitchToThread
  • FindWindowA
Code injection capabilities (PowerLoader):
  • GetWindowLongA
  • FindWindowA
Can access the registry:
  • RegQueryValueExA
  • RegOpenKeyExA
  • RegCloseKey
  • RegQueryValueExW
  • RegOpenKeyExW
Uses functions commonly found in keyloggers:
  • MapVirtualKeyA
  • GetForegroundWindow
  • CallNextHookEx
Memory manipulation functions often used by packers:
  • VirtualAlloc
  • VirtualProtect
Can take screenshots:
  • CreateCompatibleDC
  • BitBlt
  • GetDCEx
  • GetDC
  • FindWindowA
Suspicious The PE header may have been manually modified. The resource timestamps differ from the PE header:
  • 2023-Sep-05 20:58:14
Malicious VirusTotal score: 38/69 (Scanned on 2023-09-22 08:58:59) ALYac: Gen:Variant.Zusy.489786
AVG: Win32:MalwareX-gen [Trj]
AhnLab-V3: Trojan/Win.Generic.C5488559
Alibaba: Trojan:Win32/Redcap.69ddcf3c
Antiy-AVL: Trojan/Win32.Delf
Arcabit: Trojan.Zusy.D7793A
Avast: Win32:MalwareX-gen [Trj]
Avira: TR/Redcap.uuylg
BitDefender: Gen:Variant.Zusy.489786
Bkav: W32.Common.9710E649
CrowdStrike: win/grayware_confidence_70% (D)
Cynet: Malicious (score: 99)
DrWeb: Trojan.Siggen21.30405
ESET-NOD32: a variant of Win32/Delf.UZB
Emsisoft: Gen:Variant.Zusy.489786 (B)
F-Secure: Trojan.TR/Redcap.uuylg
FireEye: Gen:Variant.Zusy.489786
Fortinet: W32/Delf.UZB!tr
GData: Gen:Variant.Zusy.489786
Google: Detected
Ikarus: Trojan.DarkGate
Jiangmin: Trojan.Agent.eruq
K7AntiVirus: Trojan ( 005a5c941 )
K7GW: Trojan ( 005a5c941 )
Kaspersky: HEUR:Trojan.Win32.Agent.gen
MAX: malware (ai score=81)
Malwarebytes: Malware.AI.2643273264
MaxSecure: Trojan.Malware.300983.susgen
McAfee: GenericRXAA-AA!85DD61EC4125
MicroWorld-eScan: Gen:Variant.Zusy.489786
Microsoft: Trojan:Win32/Sabsik.TE.B!ml
NANO-Antivirus: Trojan.Win32.Delf.kavbgd
Panda: Trj/GdSda.A
Rising: Trojan.Delf!8.67 (TFE:5:6FY8tWTQ8aE)
TrendMicro: TROJ_GEN.R002C0XIL23
TrendMicro-HouseCall: TROJ_GEN.R002C0XIL23
VIPRE: Gen:Variant.Zusy.489786
ZoneAlarm: HEUR:Trojan.Win32.Agent.gen

Hashes

MD5 85dd61ec4125ba45a136a5b40b7250de
SHA1 11b62716042d0552cba90ec3b04845750ed83e06
SHA256 9a74f605370ec682ff056e54e5e514c23fe1d2ca41f697a36ab2456f424479c6
SHA3 7abebab92181b334e4214b363abd82d548191856ad643d6c47fb83f9272b22f7
SSDeep 12288:dXIGpvVXUjFrQXlkJeOi7kTDQcBLUBE8FV3:dX3nuFQMa72nBL8
Imports Hash 3d1b99f3ef229eaa41a8a0ba0305081a

DOS Header

e_magic MZ
e_cblp 0x50
e_cp 0x2
e_crlc 0
e_cparhdr 0x4
e_minalloc 0xf
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0x1a
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 7
TimeDateStamp 1992-Jun-19 22:22:17
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 2.0
SizeOfCode 0x75c00
SizeOfInitializedData 0xfe00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00076A90 (Section: CODE)
BaseOfCode 0x1000
BaseOfData 0x77000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x90000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_LIBRARY_PROCESS_INIT
SizeofStackReserve 0
SizeofStackCommit 0
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

CODE

MD5 4706506b0782234a2c3b75ead07650d3
SHA1 cd77251170adb9fbb8e7d26789676d678b20c5c6
SHA256 67ffcfbdf7fd6b7f55b623c4ac79c3e55e5eeb8e756a30c21a23152069491001
SHA3 cba31ce83b08a8225560c863a0ca25ef2c781003eb67545a9a25f8ea158f4018
VirtualSize 0x75ab8
VirtualAddress 0x1000
SizeOfRawData 0x75c00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.60525

DATA

MD5 43ca50c468f097342f6b83fb4a262fd3
SHA1 837eee4b0d62c45cddfe8308959b6b770a2f8698
SHA256 6024fde736aa0c95971c966abd13b02fadaa48aa556d60354fc3ff823019ac80
SHA3 daa8fe7f88769a3fafe63fc52f956a6ab793a33b089243902ebc068034fef169
VirtualSize 0x2224
VirtualAddress 0x77000
SizeOfRawData 0x2400
PointerToRawData 0x76000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.99497

BSS

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x56c1
VirtualAddress 0x7a000
SizeOfRawData 0
PointerToRawData 0x78400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata

MD5 05ff92461c0543914b3f63a59ae881ee
SHA1 2fa90d64c509973b68216d6d7e8b4b0ce0325a81
SHA256 d9dea4159fe3822a0c1c852982ff73fc12849ef392b6dc1075e8a2f9f356e9f9
SHA3 387164f6811d1c71b535351fae3eefba72fb940c849e1edf324ee64e0cf5b93a
VirtualSize 0x2462
VirtualAddress 0x80000
SizeOfRawData 0x2600
PointerToRawData 0x78400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.92908

.edata

MD5 05b1e9ce99f4f8e57d129bae0061e95e
SHA1 6c5cbef7f57d186ffd84880c724b60e8ab4b8b3d
SHA256 9d2e495edad0c8b28998e9caafab0e0804a93ab59a0a82d20bd93e540045bb77
SHA3 06215db3ed55a0d6514af8b7b1b38906ab99deee003ea3246cb317c8889e5216
VirtualSize 0x1c8
VirtualAddress 0x83000
SizeOfRawData 0x200
PointerToRawData 0x7aa00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED
Entropy 4.75492

.reloc

MD5 10ac16309fc8ac6047ed28f377c1e55a
SHA1 a4a9f1997d7e232f81f6f849ab2959172d99cd50
SHA256 5c5c8d24275c1b9b04b3a6277a126b2dd461f48957587ca9208128bc9ba50f2f
SHA3 ce5c3135c7c1f91ef7cc948eec065a3ed1e2d78a12df10caaaa7c3deecd89ac8
VirtualSize 0x7798
VirtualAddress 0x84000
SizeOfRawData 0x7800
PointerToRawData 0x7ac00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED
Entropy 6.69514

.rsrc

MD5 873fb6fb6172cb0770afa18288b9c4b3
SHA1 9a0b762f6469c048d88f7f4e7c8f14ad42243d97
SHA256 50526ec4d6ec6b077e8192d5fa40020bd23a624b1ec48a3d15622be83f58d193
SHA3 f8060e6312f349aa930be9900d5ffbf8ab9be6c67c6aff251e2dbe86f2a7de4d
VirtualSize 0x3a00
VirtualAddress 0x8c000
SizeOfRawData 0x3a00
PointerToRawData 0x82400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED
Entropy 3.70402

Imports

kernel32.dll DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
user32.dll GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
advapi32.dll RegQueryValueExA
RegOpenKeyExA
RegCloseKey
oleaut32.dll SysFreeString
SysReAllocStringLen
SysAllocStringLen
kernel32.dll (#2) DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
advapi32.dll (#2) RegQueryValueExA
RegOpenKeyExA
RegCloseKey
kernel32.dll (#3) DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
version.dll VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
gdi32.dll UnrealizeObject
StretchBlt
SetWindowOrgEx
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
SaveDC
RestoreDC
RectVisible
RealizePalette
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetTextMetricsA
GetTextExtentPoint32A
GetSystemPaletteEntries
GetStockObject
GetPixel
GetPaletteEntries
GetObjectA
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
ExcludeClipRect
DeleteObject
DeleteDC
CreateSolidBrush
CreatePenIndirect
CreatePalette
CreateHalftonePalette
CreateFontIndirectA
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
BitBlt
user32.dll (#2) GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
kernel32.dll (#4) DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
oleaut32.dll (#2) SysFreeString
SysReAllocStringLen
SysAllocStringLen
kernel32.dll (#5) DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
comctl32.dll ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_SetDragCursorImage
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Remove
ImageList_DrawEx
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Add
ImageList_SetImageCount
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create

Delayed Imports

DebugConnectWide

Ordinal 1
Address 0x763dc

DebugCreate

Ordinal 2
Address 0x763e0

KSInit

Ordinal 3
Address 0x763e8

KSUpdate

Ordinal 4
Address 0x76410

KSSetOption

Ordinal 5
Address 0x7640c

KSFFUninit

Ordinal 6
Address 0x76408

DllUnregisterServer

Ordinal 7
Address 0x76404

KSUninit

Ordinal 8
Address 0x76414

DllRegisterServer

Ordinal 9
Address 0x76400

DllGetClassObject

Ordinal 10
Address 0x763fc

DllCanUnloadNow

Ordinal 11
Address 0x763f8

KSSetKeyInfo

Ordinal 12
Address 0x763f4

KSPromptForKey

Ordinal 13
Address 0x763f0

KSOptions

Ordinal 14
Address 0x763ec

KSFFInit

Ordinal 15
Address 0x763e4

__stack_chk_guard

Ordinal 16
Address 0x76418

__stack_chk_fail

Ordinal 17
Address 0x7641c

1

Type RT_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 2.6633
MD5 ff4e5862f26ea666373e5fab2bddfb11
SHA1 cfa13c0ab30f1bbd566900dee3631902f9b6451c
SHA256 b8e6fc93d423931acbddae3c27dd3c4eb2a394005d746951a971cb700e0ee510
SHA3 91dae12a9f43c5443e0661091a336f882fa1482f75fa9a57c9298d1d70c8ae69

2

Type RT_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 2.80231
MD5 2e87b3c111e3073a841775c1f8ec5a90
SHA1 20292304fa2ef1bfdc4a1000e90a1c16d4765a96
SHA256 ce19ace18e87b572e6912306776226af5b8e63959c61cde70a8ff05b3bbdcc41
SHA3 9527f09e739c2064835800a7e5c317cb422bdd7237f00fca079a1c62f58a2612

3

Type RT_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 3.00046
MD5 a04c3c368cb37c07bd5f63e7e6841ebd
SHA1 699300bceaa1256818c43fecfc8cad93a59156b2
SHA256 ee1c9c194199c320c893b367602ccc7ee7270bd4395d029f727e097634f47f8c
SHA3 58722e3138aad1382e284c1605ecd665ced536de4906749ac8d6e11252cc9558

4

Type RT_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 2.56318
MD5 9929115b21c2c59348058d4190392e75
SHA1 626fba1825d572ea441d36363307c9935de3c565
SHA256 9d9edf87ca203ecc60b246cc783d54218dd0ce77d3a025d0bafc580995a4abd8
SHA3 fea156e872544252c625076a6bf3baa733ee5b3d5399716e156734af7a841369

5

Type RT_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 2.6949
MD5 f321ad13d1c3f35a05d67773b4bc27d6
SHA1 30aded8525417e2531d5eb88bf2f868172945baa
SHA256 99676c52310db365580965ea646ece86c62951bfd97ec0aae9f738a202a90593
SHA3 04c839da98a8c50a36697076af5bc6d527560a69153b2f718f065908fd4fe3ad

6

Type RT_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 2.62527
MD5 5ca217e52bdc6f23b43c7b6a23171e6e
SHA1 d99dc22ec1b655a42c475431cc3259742d0957a4
SHA256 11726dcf1eebe23a1df5eb0ee2af39196b702eddd69083d646e4475335130b28
SHA3 b358d8a5b0f400dd2671956ec45486ae1035556837b5289df5f418fe69348b3f

7

Type RT_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 2.91604
MD5 6be7031995bb891cb8a787b9052f6069
SHA1 487eb59fd083cf4df02ce59d9b079755077ba1b5
SHA256 6f938aab0a03120de4ef8b27aff6ba5146226c92a056a6f04e5ec8d513ce5f9d
SHA3 0f1c6c0378a3646c9fbf3678bbeeccf929d32192f02d1ea9d6ba0be5c769e6ab

4081

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0xac
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 2.84635
MD5 a50e83a907307a9cb649964f66100baf
SHA1 b9b39a6707efe35a26f684fcfa61be1bae6bf289
SHA256 2274812776627890bc9f9a12327170ba2fe0b718214601891e162009c7d77aff
SHA3 45e96a31a6778aa7a30df5cef591f902b62157a7a1feea1652da2a20393facf7

4082

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x1cc
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 3.28456
MD5 7f9e799ecfa68e3a636057a0493cd85c
SHA1 bcb341c425123a56ed2a82e5b9ad8728c65ac700
SHA256 3068bd9c5f37b83ad5f39962b04f439e6dd8393c5e907aa310eb0af70dce334a
SHA3 50ffd18c1d50d88c097c24d43d44963011480f22b31a5fac7ecc7887ed109b74

4083

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x188
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 3.25026
MD5 85716ca8894c10e17f08796e8bc87547
SHA1 186c577aa2802b2fa92721e06db2ef525aee4c7c
SHA256 859bc0d26ad5d6d50a69e22d552872c15f5b926a2db0f697f10c586c6cd6993d
SHA3 fe3a16983589828a173ba039c1ba98daab959b8b008711fc9b35e5d7d019cefc

4084

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x1b0
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 3.21127
MD5 05cd04c37dd937ce10c60d829c14148f
SHA1 fdb12dc69ef02cea95cdd140191dda3263accf76
SHA256 615e6db9af156fd94f47544a5280708e15ddbce74a0ea5dc7fbd93e6578cb407
SHA3 19fa87a0d9a39e90fd79e6b4ee06db23f89b726673a50933221e6ab13e086d0d

4085

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x218
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 3.24022
MD5 1bc7df7e77bab5ff2f7b5084d7d54588
SHA1 96ce6d633c6724a8a33d1bd3e4731db86d328708
SHA256 9fb7198119a7707a7f66653d6aa7290b5a00f2e76929508bacd12beecb47791b
SHA3 7ad84324d1711ce584f15598ef5cc69ee596b5a0b5b53f782f7b8a56b0facea1

4086

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0xec
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 3.1103
MD5 bf2fff79658c0e0cf6b0f8d69454b141
SHA1 1d4f936e92513aeb6f98ce8b6f46754b259218a8
SHA256 6eb30fe1aef4c8288c7aaf6f119fd154acfef3646d1a6602a744047c97b17358
SHA3 0c4b3244053c1a4525bee4b10a11d8f856a1f7a7f3a4bf7e4a0ff1bc1feff883

4087

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x2ec
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 3.24235
MD5 85f45080b8cf18ac4e40831f2e780106
SHA1 51287705f25c09502bb0cb48cfd96c76eab2c97d
SHA256 c736b054170178609791c689245784386b46d98fb55c565e5a0390229669ad5b
SHA3 48d2c23dec17c746f1a0d80c5b6f818277b5fd2cf97a66cb59d35d44d8165e58

4088

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x408
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 3.21484
MD5 1bcaf203eb41d83a5c0af2af80ac3490
SHA1 980a16361ce48eecec9b93c983ad0e7ac45c6b79
SHA256 1b18dee1114b001663bdf6f9104fc0cc8d87316f7e4850ec3b1964432e88f7f5
SHA3 e44117eb4cf385fa57ea9ea76bd924d0d6444e1e0cbb053b2efaa36ba0ef63b0

4089

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x390
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 3.20803
MD5 28e914207dc60acfdff74914f55a1ed1
SHA1 159da66943c558b55526c0984dcbdd4ff848ba09
SHA256 50e256ea0d5c6720a405763a3a2519df7a2a5c2c714d07ad5e6aba5c4df81fb9
SHA3 2966377ff283bd8cbf5f661358cae9c84a0669ef8a998933a5d536056a44ebf7

4090

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x3e8
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 3.24761
MD5 68c4dc231c3054f8e00675b1cc0a3db9
SHA1 8998dba654d302116f898f5d488b4be167431c4a
SHA256 f1c715c1f5d80e1f5466e0d2b8d8f5b2c6f76afa354f8fa09a695b5ac94c888f
SHA3 38704a732da8b90342b9ad12aad49d083b69d10cf40955b114c88400410be88e

4091

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0xf4
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 2.94341
MD5 aead513017e6566240e7ac86b5480759
SHA1 648ee52447fd9b798760ba8dc84fda558d30f287
SHA256 0bab6e5a1259540a8def510ea55891a64d06c7c40dbbe8eab251f5d60993aabe
SHA3 9e2d3b1ee751fdb86e8834cea1ccd92a2af585a66b9319c1fb664369f5ef8180

4092

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0xc4
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 2.8794
MD5 654a3b0e552431bce845d4873d01d0cf
SHA1 9b3d44f51cea9362bcf7c258974a4a767df915cf
SHA256 580d974dbf7953e0e47920170ddb9e8dba22e8f3561e059ce4f3774056c876a1
SHA3 40a1765801c78b03ba59f217f7767147f65598ecf74ebe7fb848546b5ce9ee6c

4093

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x2c0
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 3.24527
MD5 ec5ec390e6c3e6ac6ab08c101650d9a0
SHA1 98397a54552a64cd25f984b3bf392e7a508cd770
SHA256 5b93e2fc7eb445819cf543d22bfc292ecef52715a12027631ef5264d714d1634
SHA3 2ecb37ae5285e4e5f653e88bf963364c012310b3b9c25a56d8a2a4c6ee57bda9

4094

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x4ac
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 3.23659
MD5 d72fea4780245e880379181a375e69bb
SHA1 892d7f78e34bca835d2d48cf70dfff689d00d360
SHA256 76132c0ab70df8ffbf690f6856bd76184d9d06b1f40346b06934462d9e8c6cfe
SHA3 134ee2fcf4b7b996b56ba38ec505a6cf1aabdcfdeab3433bbd47f27283a7aa9d

4095

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x374
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 3.26889
MD5 b45887b8d9abf1a457d523629b25b22d
SHA1 31a34e8bc7558179b576152b70aa2d304459f984
SHA256 022bdaba31b6eb8d40747bde00bab8d56b229e491b2363494bc504252c2d4657
SHA3 36097509b936d98240c7af8c1e519f9d9a944332dbab640d5f6a77b6c0a1934b

4096

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x2c4
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 3.16875
MD5 157f87d5db4a374f2e2093affbffbb58
SHA1 c251ee03ddb5b18f2fe4b877699f940ec00b00c0
SHA256 86d431240ce976373228e9cb149ac93b1a3725c144ac504e36580aff617c4d86
SHA3 f9a669d47d99bbd3edf738fd0589769c1b986add971b2ee68cbe66d4a635c0e7

DVCLAL

Type RT_RCDATA
Language UNKNOWN
Codepage UNKNOWN
Size 0x10
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 4
MD5 d8090aba7197fbf9c7e2631c750965a8
SHA1 04f73efb0801b18f6984b14cd057fb56519cd31b
SHA256 88d14cc6638af8a0836f6d868dfab60df92907a2d7becaefbbd7e007acb75610
SHA3 a5a67ad8166061d38fc75cfb2c227911de631166c6531a6664cd49cfb207e8bb

PACKAGEINFO

Type RT_RCDATA
Language UNKNOWN
Codepage UNKNOWN
Size 0x224
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 5.23058
MD5 699fead6124cb8e97c5efac0d9cde11d
SHA1 7e18a506c7487b2f139053cf57580c5a133988b1
SHA256 49462886eeca838ed8f4f339ffe8ddcfd0008dda07fcab84d6bec8dc185ceed5
SHA3 c56a67059889ca15bf70558929a299269d0e8b4366b38b0d7e59895659e58ac2

32761

Type RT_GROUP_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 1.83876
Detected Filetype Cursor file
MD5 a2baa01ccdea3190e4998a54dbc202a4
SHA1 e8217df98038141ab4e449cb979b1c3bbea12da3
SHA256 c53efa8085835ba129c1909beaff8a67b45f50837707f22dfff0f24d8cd26710
SHA3 8874564c406835306368adf5e869422e1bb97109b97c1499caa8af219990e8dc
Preview

32762

Type RT_GROUP_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 1.91924
Detected Filetype Cursor file
MD5 aff0f5e372bd49ceb9f615b9a04c97df
SHA1 e3205724d7ee695f027ab5ea8d8e1a453aaad0dd
SHA256 b07e022f8ef0a8e5fd3f56986b2e5bf06df07054e9ea9177996b0a6c27d74d7c
SHA3 9cb042121a5269b80d18c3c5a94c0e453890686aedade960097752377dfa9712
Preview

32763

Type RT_GROUP_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 2.01924
Detected Filetype Cursor file
MD5 48e064acaba0088aa097b52394887587
SHA1 310b283d52aa218e77c0c08db694c970378b481d
SHA256 43f40dd5140804309a4c901ec3c85b54481316e67a6fe18beb9d5c0ce3a42c3a
SHA3 38753084b0ada40269914e80dbacf7656dc94764048bd5dff649b08b700f3ed5
Preview

32764

Type RT_GROUP_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 2.01924
Detected Filetype Cursor file
MD5 1ae28d964ba1a2b1b73cd813a32d4b40
SHA1 8883cd93b8ef7c15928177de37711f95f9e4cd22
SHA256 ff47a48c11c234903a7d625cb8b62101909f735ad84266c98dd4834549452c39
SHA3 a85dadd416ce2d22aa291c0794c45766a0613b853c6e3b884a2b05fc791427b8
Preview

32765

Type RT_GROUP_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 2.01924
Detected Filetype Cursor file
MD5 0893f6ba80d82936ebe7a8216546cd9a
SHA1 0754cbdf56c53de9ed7fbd47859d20b788c6f056
SHA256 a0adcedb82b57089f64e2857f97cefd6cf25f4d27eefc6648bda83fd5fef66bb
SHA3 ce6148ade08ef9b829f83cb13b4c650d9d4a7012bfd1ab697a7870a05f4104f8
Preview

32766

Type RT_GROUP_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 2.01924
Detected Filetype Cursor file
MD5 dcaa3c032fe97281b125d0d8f677c219
SHA1 58fe36409f932549e2f101515abee7a40cf47b2c
SHA256 6e1e7738a1b6373d8829f817915822ef415a1727bb5bb7cfe809e31b3c143ac5
SHA3 02ef292e1b4a70e439e362af6b4fa213e3816ade45222b78dabab712b6afba54
Preview

32767

Type RT_GROUP_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2023-Sep-05 20:58:14
Entropy 2.01924
Detected Filetype Cursor file
MD5 a95c7c78d0a0b30b87e3c4976e473508
SHA1 b19f3999f1b302a2d28977cb18a3416c918d486c
SHA256 326c048595bbc72e3f989cb3b95fbf09dc83739ced3cb13eb6f03336f95d74f1
SHA3 8157b4e6afa7ed2e2ffc174d655bec9fb81db609e4c5864faa5ead931ff60689
Preview

String Table contents

Window Background
Window Frame
Window Text
No help keyword specified.
Caption Text
Default
Gray Text
Highlight Background
Highlight Text
Inactive Border
Inactive Caption
Inactive Caption Text
Info Background
Info Text
Menu Background
Menu Text
None
Scroll Bar
3D Dark Shadow
3D Light
Blue
Fuchsia
Aqua
White
Money Green
Sky Blue
Cream
Medium Gray
Active Border
Active Caption
Application Workspace
Background
Button Face
Button Highlight
Button Shadow
Button Text
Unable to find a Table of Contents
No help found for %s
No context-sensitive help installed
No topic-based help system installed
Black
Maroon
Green
Olive
Navy
Purple
Teal
Gray
Silver
Red
Lime
Yellow
Home
Left
Up
Right
Down
Ins
Del
Shift+
Ctrl+
Alt+
Clipboard does not support Icons
Menu '%s' is already being used by another form
Docked control must have a name
Error removing control from dock tree
- Dock zone not found
- Dock zone has no control
Cancel
&Help
&Abort
&Retry
&Ignore
&All
N&o to All
Yes to &All
BkSp
Tab
Esc
Enter
Space
PgUp
PgDn
End
Cannot make a visible window modal
Menu index out of range
Menu inserted twice
Sub-menu is not in menu
Not enough timers available
GroupIndex cannot be less than a previous menu item's GroupIndex
Cannot create form. No MDI forms are currently active
A control cannot have itself as its parent
Cannot drag a form
Warning
Error
Information
Confirm
&Yes
&No
OK
Icon image is not valid
Cannot change the size of an icon
Unsupported clipboard format
Out of system resources
Canvas does not allow drawing
Invalid image size
Invalid ImageList
Invalid ImageList Index
Failed to read ImageList data from stream
Failed to write ImageList data to stream
Error creating window device context
Error creating window class
Cannot focus a disabled or invisible window
Control '%s' has no parent window
Cannot hide an MDI Child Form
Cannot change Visible in OnShow or OnHide
Invalid property path
Invalid property value
List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d)
Out of memory while expanding memory stream
Error reading %s%s%s: %s
Stream read error
Property is read-only
Resource %s not found
%s.Seek not implemented
Operation not allowed on sorted list
%s not in a class registration group
Property %s does not exist
Stream write error
Bitmap image is not valid
Friday
Saturday
Ancestor for '%s' not found
Cannot assign a %s to a %s
Bits index out of range
Can't write to a read-only resource stream
CheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
A class named %s already exists
List does not allow duplicates ($0%x)
A component named %s already exists
String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
Invalid stream format
''%s'' is not a valid component name
September
October
November
December
Sun
Mon
Tue
Wed
Thu
Fri
Sat
Sunday
Monday
Tuesday
Wednesday
Thursday
May
Jun
Jul
Aug
Sep
Oct
Nov
Dec
January
February
March
April
May
June
July
August
Invalid variant type
Operation not supported
Unexpected variant error
External exception %x
Assertion failed
Interface not supported
Exception in safecall method
%s (%s, line %d)
Abstract Error
Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
%s
A call to an OS function failed
Jan
Feb
Mar
Apr
Write
Error creating variant or safe array
Variant or safe array index out of bounds
Variant or safe array is locked
Invalid variant type conversion
Invalid variant operation
Invalid NULL variant operation
Invalid variant operation (%s%.8x)
%s
Custom variant type (%s%.4x) is out of range
Custom variant type (%s%.4x) already used by %s
Custom variant type (%s%.4x) is not usable
Too many custom variant types have been registered
Could not convert variant of type (%s) into type (%s)
Overflow while converting variant of type (%s) into type (%s)
Variant overflow
Invalid argument
Floating point division by zero
Floating point overflow
Floating point underflow
Invalid pointer operation
Invalid class typecast
Access violation at address %p. %s of address %p
Access violation
Stack overflow
Control-C hit
Privileged instruction
Exception %s in module %s at %p.
%s%s
Application Error
Format '%s' invalid or incompatible with argument
No argument for format '%s'
Variant method calls not supported
Read
'%s' is not a valid integer value
Invalid argument to time encode
Invalid argument to date encode
Out of memory
I/O error %d
File not found
Invalid filename
Too many open files
File access denied
Read beyond end of file
Disk full
Invalid numeric input
Division by zero
Range check error
Integer overflow
Invalid floating point operation

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

[*] Warning: Section BSS has a size of 0!
<-- -->