Manalyze report for 9993eb0a4b4ede1b909801ab82985618

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2016-Apr-02 03:20:09
Detected languages	English - United States
FileDescription	NVDA launcher file
LegalCopyright	Copyright (C) 2006-2018 NVDA Contributors
ProductName	NVDA
ProductVersion	`2018.1.1`

Plugin Output

Suspicious	The PE is an NSIS installer	`Unusual section name found: .ndata`
Suspicious	The PE contains functions most legitimate programs don't use.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryExA` `Can access the registry: RegDeleteValueA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA` `Possibly launches other programs: CreateProcessA ShellExecuteA` `Can create temporary files: CreateFileA GetTempPathA` `Changes object ACLs: SetFileSecurityA` `Can shut the system down or lock the screen: ExitWindowsEx`
Info	The PE is digitally signed.	`Signer: NV Access Limited` `Issuer: DigiCert SHA2 Assured ID Code Signing CA`

Hashes

MD5	`9993eb0a4b4ede1b909801ab82985618`
SHA1	`bd96685fd0ae47fd89f1db525f2a803e1fa90856`
SHA256	`7dfed4f34c1b5d9e539151d90393cc2cb183b63928d3f691a475d14c597f9a30`
SHA3	`fda2356f5fa0fc1a63d0cb34fcb64960779ff25c99472a0f7506ab6397f3cc64`
SSDeep	`393216:a2W9hQkmzziulJsr2/+3IV0oRmn0r/Vppd0IG8S6UvD5ACDcB+ZPKwctHtCkhOb:AQjzikOx4BRv/Vppd0IGn6Uvyf+ZSFtQ`
Imports Hash	`607dd75f08961cd12b1f6ac7fd260c59`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xc8`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`5`
TimeDateStamp	2016-Apr-02 03:20:09
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED` `IMAGE_FILE_RELOCS_STRIPPED`

Image Optional Header

Magic	`PE32`
LinkerVersion	`6.0`
SizeOfCode	`0x5e00`
SizeOfInitializedData	`0x1d600`
SizeOfUninitializedData	`0x400`
AddressOfEntryPoint	`0x0000326C (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0x7000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`6.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x36000`
SizeOfHeaders	`0x400`
Checksum	`0x1498aa3`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`51e2544a6971f687f7a1241f613014c1`
SHA1	`1dc9b7d6bb158fee5b9f3b28181b389987a1c350`
SHA256	`3f5f7b309092988af8c9e92567926a5e523cad3af0051c20bdf29aad00a33510`
SHA3	`ead501114661f03aac31abc76b71034653f300508cc4ce3d8a5490f65fbe4151`
VirtualSize	`0x5c74`
VirtualAddress	`0x1000`
SizeOfRawData	`0x5e00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.41039`

.rdata

MD5	`4c84e530bf8db37146334e6c487170bf`
SHA1	`076dcc532f1c101e21550e104a20a7f8e4c30781`
SHA256	`3575075347d3cfff06e9f5c296d8c71c30f2fbcc62228eef437e236010397471`
SHA3	`0eec1a1d948468a2f710745acc56943954e864ce6901ed769f2e04c3dbddd8ea`
VirtualSize	`0x1196`
VirtualAddress	`0x7000`
SizeOfRawData	`0x1200`
PointerToRawData	`0x6200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.20374`

.data

MD5	`75d996f724e5e900c022f56b3df3ae1b`
SHA1	`7b247661a46a3527556a9637ece6c600bf6777ec`
SHA256	`4a63c7ca63538039a0213c12377fc6b0d36530bb0eecc9d4d24728c851334352`
SHA3	`9e187facab9fe47c274f1195debae1114b0f20015ddbfe91134d735bc745713a`
VirtualSize	`0x1b058`
VirtualAddress	`0x9000`
SizeOfRawData	`0x600`
PointerToRawData	`0x7400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.13053`

.ndata

MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a`
VirtualSize	`0xb000`
VirtualAddress	`0x25000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.rsrc

MD5	`8f632b56d6d70f727818a55445f02dbe`
SHA1	`a93e31d7d7b740c380533929a70143b90b59ea3b`
SHA256	`443944010900d867e844a7e6e3a9ee9b1db555fc45d4d3bd628a75e9878719f5`
SHA3	`ff993b2669e96f49aa12f47e4b5a19e52b84b6f997089362d2154314623b7311`
VirtualSize	`0x5468`
VirtualAddress	`0x30000`
SizeOfRawData	`0x5600`
PointerToRawData	`0x7a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.48113`

Imports

KERNEL32.dll	`GetTickCount` `GetShortPathNameA` `GetFullPathNameA` `MoveFileA` `SetCurrentDirectoryA` `GetFileAttributesA` `SetFileAttributesA` `CompareFileTime` `SearchPathA` `CreateFileA` `GetFileSize` `GetModuleFileNameA` `GetCurrentProcess` `CopyFileA` `ExitProcess` `GetWindowsDirectoryA` `Sleep` `lstrcmpiA` `lstrlenA` `GetVersion` `SetErrorMode` `lstrcpynA` `GetDiskFreeSpaceA` `GlobalUnlock` `GlobalLock` `CreateThread` `GetLastError` `CreateDirectoryA` `CreateProcessA` `RemoveDirectoryA` `GetTempFileNameA` `lstrcatA` `GetSystemDirectoryA` `WaitForSingleObject` `SetFileTime` `CloseHandle` `GlobalFree` `lstrcmpA` `ExpandEnvironmentStringsA` `GetExitCodeProcess` `GlobalAlloc` `GetCommandLineA` `GetTempPathA` `GetProcAddress` `FindFirstFileA` `FindNextFileA` `DeleteFileA` `SetFilePointer` `ReadFile` `FindClose` `GetPrivateProfileStringA` `WritePrivateProfileStringA` `WriteFile` `MulDiv` `MultiByteToWideChar` `LoadLibraryExA` `GetModuleHandleA` `FreeLibrary`
USER32.dll	`SetCursor` `GetWindowRect` `EnableMenuItem` `GetSystemMenu` `SetClassLongA` `IsWindowEnabled` `SetWindowPos` `GetSysColor` `EndDialog` `ScreenToClient` `LoadCursorA` `CheckDlgButton` `GetMessagePos` `LoadBitmapA` `CallWindowProcA` `IsWindowVisible` `CloseClipboard` `SetForegroundWindow` `GetWindowLongA` `RegisterClassA` `TrackPopupMenu` `AppendMenuA` `CreatePopupMenu` `GetSystemMetrics` `SetDlgItemTextA` `GetDlgItemTextA` `MessageBoxIndirectA` `CharPrevA` `DispatchMessageA` `PeekMessageA` `GetDC` `EnableWindow` `InvalidateRect` `SendMessageA` `DefWindowProcA` `BeginPaint` `GetClientRect` `FillRect` `DrawTextA` `SystemParametersInfoA` `CreateWindowExA` `GetClassInfoA` `DialogBoxParamA` `CharNextA` `ExitWindowsEx` `SetTimer` `PostQuitMessage` `SetWindowLongA` `SendMessageTimeoutA` `LoadImageA` `wsprintfA` `GetDlgItem` `FindWindowExA` `IsWindow` `SetClipboardData` `EmptyClipboard` `OpenClipboard` `EndPaint` `CreateDialogParamA` `DestroyWindow` `ShowWindow` `SetWindowTextA`
GDI32.dll	`SelectObject` `SetBkMode` `CreateFontIndirectA` `SetTextColor` `DeleteObject` `GetDeviceCaps` `CreateBrushIndirect` `SetBkColor`
SHELL32.dll	`SHGetSpecialFolderLocation` `SHGetPathFromIDListA` `SHBrowseForFolderA` `SHGetFileInfoA` `SHFileOperationA` `ShellExecuteA`
ADVAPI32.dll	`RegDeleteValueA` `SetFileSecurityA` `RegOpenKeyExA` `RegDeleteKeyA` `RegEnumValueA` `RegCloseKey` `RegCreateKeyExA` `RegSetValueExA` `RegQueryValueExA` `RegEnumKeyA`
COMCTL32.dll	`ImageList_AddMasked` `ImageList_Destroy` `ImageList_Create` `#17`
ole32.dll	`OleUninitialize` `OleInitialize` `CoTaskMemFree` `CoCreateInstance`

Delayed Imports

1

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x10a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`6.26612`
MD5	`0ec0a0948a526b9c7eebe39bb02b6b0b`
SHA1	`867b304f20fd74abeb5c30515837f1c41cd3bf8f`
SHA256	`d442adb90ba296c7e617d2f58d6fa6f308bcd8ef65e5e9c66db4dd27f93fcfbe`
SHA3	`5bc458755a2ca5c7475620389d9b6b67952973c4366c6777d45c969b8bc67cd4`

2

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0xea8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.9993`
MD5	`6b224e01af48ec8e4c17a59d9534e885`
SHA1	`de787d2a1e840618ba2c7eb69d28f6966c404d1d`
SHA256	`50279c9885b490e74b49ac0273940b6e0891b62fc9ffb5c52e35422a694f248b`
SHA3	`71b543301bccda64ba61a27873c952890233e0cbec10e0b59245fc303bcfadbc`

3

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x8a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`6.24459`
MD5	`ca82d899b1d402941b5c92ed9028cd95`
SHA1	`fb329ec4455d5caf1753305debcc14ab6ebb9015`
SHA256	`9da1013c864092e49c2676b3ba68a0d4513457d77d251730ed73cc5f4a4813b1`
SHA3	`768277223731ffdcb799e50961d0afccf23bbae54118d53b834617ccbd0c5cd9`

4

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x568`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.01502`
MD5	`05e60fd47096a729dda2aaa4ab05ebc7`
SHA1	`de8ec9b484fa4f565b14f55503c9cd95231b633b`
SHA256	`61f762babde9942f43ee97154b8734efeed0632a6ea778dc395793ae3e3e7507`
SHA3	`f8ba0d4a91389414904cc66226099f27f482055e90ba449e2396193f139713d8`

5

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x468`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`6.16057`
MD5	`d9ee3a2962251a241bce41b0524cfc0e`
SHA1	`2ba919aaa7237367a158e4b95385ab1ee07643d8`
SHA256	`69e6579a37fcaec037634e7fecbfc6a26093ea81dc4bd555d8a12187d2cd0866`
SHA3	`a1699668464f7edf9a748dfc264f9d30e3c69a228be0a18cade30c14aa6c77ba`

6

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x2e8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.34146`
MD5	`53482d364aa2d4ae7ca05199dad7651a`
SHA1	`ccb213408acc7f5ddb94753e6410be23aab5cedd`
SHA256	`ff06189b43a5c1d6cc5d1b7cbf6ab56b1157ec52807945d652274a211462cba5`
SHA3	`60659e39ef3f267c267093f8bc4c87ed61eea4ef96ac0f583184f580844573e5`

7

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x128`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.04232`
MD5	`636ad42555a835e3a94209043df4a45a`
SHA1	`c878613bda5cba6cb5769846e60229890c5df248`
SHA256	`491e52ded039ec6684277e6f1f820e288763ae6d20e682bcfffb6cee4518ac23`
SHA3	`4b79e60727e0f7be7495c59fb949e22bd753cff6e145e4694257a21a7b5dba8c`

105

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0x202`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.73893`
MD5	`386770584473e271f23dced36427f4ff`
SHA1	`d14ce95f784b35e4e3ebee535476ebcd3e380c19`
SHA256	`425b8270f7ca42a927eae6bea468acf414a3e4b58b5ba2c56aaae4d1b2c11014`
SHA3	`db13e5969376b27e8443eebff685230e2b74685aeb2fba73973f06e5cddc8662`

106

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0xf8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.89384`
MD5	`3f145145da21614de72c0da073529fb6`
SHA1	`824b69a49adb1c6105446ed2d4fdf482d6a497ca`
SHA256	`2291b810e47f055ab2ff100618a8a9966f1fbf5fc0cb58e9f8fbb36ac7c983fa`
SHA3	`999c540cbf8b2538317695989c1e3c2913db9113267473fc49c24cac4119d558`

111

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0xee`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.92787`
MD5	`5dfa289639a3bcc0497da8db163f01fe`
SHA1	`6e2c6ea1e2594b66f563fb589276642c127e875f`
SHA256	`18466509968c3c0bf92ba410fea075def2b257a5a799a113cbc60f13e75f4b01`
SHA3	`85abdc8c431d91c72f3595a39881c96637ead09a0278d3cec0c1c9a8d873f031`

205

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0x1ee`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.68733`
MD5	`c0c4f9be63c9d286b8d1265977ac9d86`
SHA1	`f9c0d915ded3ea188f342d0e5341e67701eed813`
SHA256	`349420ba5b5de0b0081e96a686c826e0f409f2f3413f2e9fb7e6f71cb544c325`
SHA3	`dce55e6d53e014b0786bba9e4f6c7d81ed0c04fde8279c3b54f7c2f5a9fe121a`

206

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0xe4`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.84758`
MD5	`020919d85c431e79ad2e793848c07916`
SHA1	`29f3928b0f1d6f74e173a985492c39a62282f2d1`
SHA256	`4d63e28b1c215b5115efcf9ccb1f71b682ab1d0a485da44fd10cf65c72002515`
SHA3	`c4b5e250767ce9e7581e7dd1dc2e08b17820ef8298cfe40f4b18d17d1b350fea`

211

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0xda`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.9304`
MD5	`2497a44fff8b76b5129662b60a617c85`
SHA1	`f73bd7c9caa4c1f7a0e4840d69b0accdc6d167a0`
SHA256	`a10617b39293152a65ad5c91ca4f35135845c7b785e3a582e58f6c8229045b85`
SHA3	`aaf1dc708c305944a11a7180ef5ee2c8f722c3dd6d4bf91e0ae0f6c2b1a331ca`

305

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0x1f2`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.74143`
MD5	`0af4d59488d775d20c2e6725f3ed95a9`
SHA1	`f7c55407fa28f7d3eb8f6a4d4b988947f57c4c4a`
SHA256	`ab979c8f6052af662e37a55c3aa42a884f0ce537317ce85f25d6c2307eb198f5`
SHA3	`cbd4ee359d3f62e7dfb156ecd5dcd05351e2728ee88efb928161a5f2b62fd5c3`

306

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0xe8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.94675`
MD5	`14166a0be7fcfb56fa217bcb7df0877a`
SHA1	`f87292d312c8b9af84deaef0a1bde48e2c11a581`
SHA256	`a17970aa1fbc5c2e34c2beb4c7bb07774f361884597a1d239b85d68b04465be2`
SHA3	`871f7509a85b535fc79f8a9bc1d610d1d035bef260732870c4e711585b41310e`

311

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0xde`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.03655`
MD5	`2802ee53bc08ac9a2cfaed81b3d79d05`
SHA1	`b7faac6a14545ea9c03651f69ae27cce0e62b010`
SHA256	`65fb71b054977a55435f45bbcddddedaa1e1cf43fdd9fc230938d625c3f7edcd`
SHA3	`1b03466617102ef078d2690bf5a361563eae8b960554205937f87a6c81d328c5`

405

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0x1fa`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.78574`
MD5	`2c1f44c0a248a53a50a661eb9a65cdcf`
SHA1	`69a0418cac4aaa30203faa1f0bdbe74fe1cc29c6`
SHA256	`1382f1e9260b7e203ceafc6936ef1dae48898fcf8fb04a446cd27a4384bc40c3`
SHA3	`2391f29b4bbdb35210160bdff0e5454a66809bd69915f6c5af5ec10cbbf057aa`

406

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0xf0`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.02918`
MD5	`a364144b05237bef8a098361270651c7`
SHA1	`bc6f439ad956d67ce6f5614545db20fa90b9771a`
SHA256	`a38fe6199b9c05d8f7b4b574305070d5b70c5f419667ba3b1ea6b256782ed397`
SHA3	`a31a6c5032365bf669508614296b7f2bd2f3da09205fd41acc0ea7638ef29fbe`

411

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0xe6`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.09674`
MD5	`30dab3583979c2008e8de9295ab7c36b`
SHA1	`186cd9560b358bbf8b523d1050573f22bb00264d`
SHA256	`8c64a2341dc473a7d8ab4956af589e9a7257c4f05a8dc229f862c16d49ba37e5`
SHA3	`4449f57b4725dc59d7d66dc9b817250112828d0f5d6b31cba247cd36ff544268`

505

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0x202`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.03251`
MD5	`16e4e392aaffaa0ee7e77b5be867e10f`
SHA1	`f7f681d8ec7c8a1aaa98b7a1d6bf14cfe730bbec`
SHA256	`699e0b19b7a5592c6cd94847130b28d57bf86ea61019043b9a6a3c88e6debc3d`
SHA3	`e91dc6b4bb438e908867a57a350a8f08d1116bc10d1694ba284a5a44360277b3`

506

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0xf8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.09145`
MD5	`6430a75b69158e6b5890246d8ac0edf6`
SHA1	`4f5353305dd677f43a3462c25cf99297bece29d8`
SHA256	`ba0c4c14006f63e456fd88d3abad2f6ae9e4de2968f272f97c7c563f85802c20`
SHA3	`749fb97d10b20596b5202124a14db6483c6af7e72a599022ba049417b6d4f38c`

511

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0xee`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.06584`
MD5	`7ce8a17102daebb8d864cd1063e987d1`
SHA1	`072345a235d4947d36b53fd47da68e7e6a93fe62`
SHA256	`0fd40b240b9df8f2dece8947dabbebce898f12becca8e196136e4231efba2dc1`
SHA3	`59c7281c1d6dca36fed8a44ee5b408f11090812626d5c5fe1da3d72b526208ab`

103

Type	`RT_GROUP_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x68`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.6691`
Detected Filetype	Icon file
MD5	`e624f041c921d299a6da3a8c5f48f989`
SHA1	`ffa07c86ac3dac45398ee07b26610dfb5c99d8ea`
SHA256	`fed46e06346fb8f64b14c18408a82caf955929ac0e65151630539dc5bd194584`
SHA3	`b51d47dbe9cbe18b1f520275504256022a827f919672b081943ae45cd4ff44c9`

1 (#2)

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x208`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.38435`
MD5	`b9609a09500e46f0274a3f8ea2ef45c4`
SHA1	`4c7123a9a51eafc6ff74cc1c8523b10116a22579`
SHA256	`9a2cb08baea6fb276ce22742c059472dc2948ea50340adc0c01be36479d46c80`
SHA3	`0624a74f89385bf32d6e2bb42df065e28764dca245d0061a733caa02b57afb67`

1 (#3)

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x3b3`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.22372`
MD5	`7361e0330f9aaeda7d1b4724045b10a3`
SHA1	`5af2e9d5794e69a1d668e71fa122ba50c205dfee`
SHA256	`51dc8c0ea444578b21f438a2a25d90d8a637a942fa2da333b9f99ecb8cf3c1e9`
SHA3	`be05a6d32fae15d1d033a52c2fa682edc2bdf8f4fa6760932481af6cc216fe55`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0`
FileVersion	2018.1.1.14969
ProductVersion	2018.1.1.14969
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
FileDescription	NVDA launcher file
LegalCopyright	Copyright (C) 2006-2018 NVDA Contributors
ProductName	NVDA
ProductVersion (#2)	2018.1.1

Resource LangID	UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

XOR Key	`0xd24651e9`
Unmarked objects	`0`
C objects (VS2003 (.NET) build 4035)	`2`
Total imports	`152`
Imports (VS2003 (.NET) build 4035)	`15`
48 (9044)	`10`
Resource objects (VS98 SP6 cvtres build 1736)	`1`

Errors

[*] Warning: Section .ndata has a size of 0!