a3c4ab085415ac8e04ae786cbe8734ef

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2018-Nov-16 23:19:59
Detected languages English - United States
Debug artifacts C:\agent\_work\68\s\exe\Release\procexp.pdb
CompanyName Sysinternals - www.sysinternals.com
FileDescription Sysinternals Process Explorer
FileVersion 16.22
InternalName Process Explorer
LegalCopyright Copyright © 1998-2018 Mark Russinovich
LegalTrademarks Copyright (C) 1998-2018 Mark Russinovich
OriginalFilename Procexp.exe
ProductName Process Explorer
ProductVersion 16.22

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
MASM/TASM - sig1(h)
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to system / monitoring tools:
  • Procexp.exe
  • regedit.exe
  • rundll32.exe
  • taskmgr.exe
Contains references to internet browsers:
  • iexplore.exe
May have dropper capabilities:
  • %TEMP%
  • CurrentControlSet\Services
  • CurrentVersion\Run
Accesses the WMI:
  • ROOT\subscription
  • root\wmi
Miscellaneous malware strings:
  • Virus
Info Cryptographic algorithms detected in the binary: Uses constants related to SHA1
Uses constants related to SHA256
Microsoft's Cryptography API
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • LoadLibraryExW
  • LoadLibraryW
  • GetProcAddress
Functions which can be used for anti-debugging purposes:
  • NtQuerySystemInformation
  • NtQueryInformationProcess
  • CreateToolhelp32Snapshot
  • FindWindowW
Code injection capabilities (PowerLoader):
  • GetWindowLongW
  • FindWindowW
Can access the registry:
  • RegOpenKeyExA
  • RegQueryValueExA
  • RegCreateKeyExW
  • RegDeleteKeyW
  • RegEnumKeyW
  • RegEnumValueW
  • RegLoadKeyW
  • RegOpenKeyW
  • RegOpenKeyExW
  • RegQueryInfoKeyW
  • RegQueryValueExW
  • RegSetValueExW
  • RegUnLoadKeyW
  • RegQueryValueW
  • RegCloseKey
  • RegDeleteValueW
  • RegCreateKeyW
Possibly launches other programs:
  • CreateProcessW
  • CreateProcessAsUserW
  • ShellExecuteW
Uses Windows's Native API:
  • NtQueryObject
  • NtOpenSymbolicLinkObject
  • NtQuerySystemInformation
  • NtSetInformationProcess
  • NtQuerySymbolicLinkObject
  • NtCreateKey
  • NtOpenKey
  • NtResumeProcess
  • NtOpenThread
  • NtQuerySemaphore
  • NtQueryEvent
  • NtSuspendProcess
  • NtQueryInformationProcess
  • NtQueryInformationThread
  • NtResumeThread
  • NtSuspendThread
  • NtLoadDriver
  • NtQueryMutant
  • NtQuerySection
Uses Microsoft's cryptographic API:
  • CryptAcquireContextW
  • CryptReleaseContext
  • CryptGetHashParam
  • CryptCreateHash
  • CryptHashData
  • CryptDestroyHash
Has Internet access capabilities:
  • WinHttpReadData
  • WinHttpGetProxyForUrl
  • WinHttpQueryHeaders
  • WinHttpReceiveResponse
  • WinHttpSendRequest
  • WinHttpOpenRequest
  • WinHttpOpen
  • WinHttpCloseHandle
  • WinHttpConnect
  • WinHttpWriteData
  • WinHttpQueryDataAvailable
  • WinHttpSetOption
Leverages the raw socket API to access the Internet:
  • #15
  • #115
  • #8
  • #9
  • #51
  • #14
  • #56
Functions related to the privilege level:
  • OpenProcessToken
  • AdjustTokenPrivileges
  • DuplicateTokenEx
Interacts with services:
  • EnumServicesStatusExW
  • QueryServiceConfigW
  • QueryServiceObjectSecurity
  • OpenSCManagerW
  • OpenServiceW
  • QueryServiceConfig2W
  • ControlService
  • QueryServiceStatus
Enumerates local disk drives:
  • GetDriveTypeW
Manipulates other processes:
  • ReadProcessMemory
  • Process32NextW
  • Process32FirstW
  • OpenProcess
Changes object ACLs:
  • SetKernelObjectSecurity
  • SetSecurityInfo
Can take screenshots:
  • GetDC
  • FindWindowW
  • CreateCompatibleDC
  • BitBlt
Can shut the system down or lock the screen:
  • LockWorkStation
  • ExitWindowsEx
Malicious The PE is possibly a dropper. Resource 150 detected as a PE Executable.
Resource 152 detected as a PE Executable.
Info The PE is digitally signed. Signer: Microsoft Corporation
Issuer: Microsoft Code Signing PCA
Suspicious VirusTotal score: 1/69 (Scanned on 2019-04-11 13:21:20) Yandex: Trojan.Shelma!

Hashes

MD5 a3c4ab085415ac8e04ae786cbe8734ef
SHA1 554b642e8dee95010d2501d8b527bbefceff3831
SHA256 51c3bed87b9f8187da6a3752c7eba8766a0b7ecab0e321bf2a6ad77ecc6a21d3
SHA3 c0d66ce4a55076b63bcd90523ad164b8059675731da4faa524fa09d3351bbc20
SSDeep 24576:p0GFGKkcetCKwKCeWmPzGtj4fYnln66SNQiB/ZiOKPWadgWwUwAFoSR8eMlRrtb4:92htllWE5YnlnqBBZqRJoA2zZbWNp
Imports Hash c7632b27e745c8bbae94fb8c7d4091b9

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x128

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2018-Nov-16 23:19:59
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 12.0
SizeOfCode 0xba000
SizeOfInitializedData 0x1f9000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0009B33C (Section: .text)
BaseOfCode 0x1000
BaseOfData 0xbb000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.1
ImageVersion 0.0
SubsystemVersion 5.1
Win32VersionValue 0
SizeOfImage 0x2b5000
SizeOfHeaders 0x400
Checksum 0x294e51
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d36f3374853e87569e82a51a6b6de0f7
SHA1 21bf0f66afbbb874aea83ec2b919db269dfdcf16
SHA256 7f6d5701f81b32bfd861b68d78ebe7fb08f3ab3dd34fb87a74d479d791496a28
SHA3 30828e6a6f8d1e710e6732ca73fca35bceea855a684ac87dd32eaea0a49767aa
VirtualSize 0xb9f58
VirtualAddress 0x1000
SizeOfRawData 0xba000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.47251

.rdata

MD5 8a7989ac23f2cb47524f40d71c385bba
SHA1 f58b5f953ec5cd706af7682014734692f0cb7f76
SHA256 747f73cad4161938b2c1f9e881a1b2f73380f8fe8ce8c4eedb3c389576712496
SHA3 dc83b8345432b48abd74c142e20b43cf0352448e0f4a60f6b5d677ecbfa180de
VirtualSize 0x2cc50
VirtualAddress 0xbb000
SizeOfRawData 0x2ce00
PointerToRawData 0xba400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.48404

.data

MD5 3dad4bdacf5c5b4c6d1f3b2e5f890d0b
SHA1 98c2127395ce797a56020d1b5e74cc65d55c8c0f
SHA256 d2a8a649a1e659b63b600f2bf5360ebb656d4c6068eb99e5e35674589b77d621
SHA3 a4367e6a3e453bc7b52f6b5d457c16bd86ec20714da299ca18ca7982ddb83c4c
VirtualSize 0x2c468
VirtualAddress 0xe8000
SizeOfRawData 0x9200
PointerToRawData 0xe7200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.6866

.rsrc

MD5 6c77676bd22bf7f8a9e241bbc68d2bec
SHA1 27ca8eb8db9dad66f703556c346c048539a7034a
SHA256 4750a6556cb9b2c6674dd5840239fd27d88ea44d89c2b97a43de3305de2e2ec8
SHA3 8f716976837f96d41d5e464c04ce456a2ca6fbe749786a5d5169760bac657eb8
VirtualSize 0x193b20
VirtualAddress 0x115000
SizeOfRawData 0x193c00
PointerToRawData 0xf0400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.02204

.reloc

MD5 54b598a61871f7baffb91137c02b9eb4
SHA1 a85d6c3d75941f4b21692b3c1a0e0dbcfa644b0e
SHA256 c9c84a83868610c58f5859c5abd1eb1b2e9525a68d4752e2b36009c5db5a5744
SHA3 7adaf313c09314fbe95c1889758ce738bcbf43652799680605785d319ba363c6
VirtualSize 0xbe48
VirtualAddress 0x2a9000
SizeOfRawData 0xc000
PointerToRawData 0x284000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.75269

Imports

SHLWAPI.dll SHAutoComplete
ColorHLSToRGB
ColorRGBToHLS
#176
UrlUnescapeW
IPHLPAPI.DLL GetExtendedTcpTable
GetExtendedUdpTable
WS2_32.dll #15
#115
#8
#9
#51
#14
#56
MPR.dll WNetGetConnectionW
COMCTL32.dll CreatePropertySheetPageW
#413
#410
CreateStatusWindowW
ImageList_Create
PropertySheetW
#17
ImageList_DrawEx
ImageList_ReplaceIcon
ImageList_Add
InitCommonControlsEx
ImageList_Destroy
VERSION.dll VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
credui.dll CredUIPromptForCredentialsW
SETUPAPI.dll SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
CRYPT32.dll CertGetNameStringW
CertDuplicateCertificateContext
ACLUI.dll #1
POWRPROF.dll SetSuspendState
IsPwrHibernateAllowed
IsPwrSuspendAllowed
WTSAPI32.dll WTSEnumerateSessionsW
WTSQuerySessionInformationW
WTSSendMessageW
WTSDisconnectSession
WTSLogoffSession
WTSFreeMemory
UxTheme.dll EnableThemeDialogTexture
ntdll.dll NtQueryObject
NtOpenSymbolicLinkObject
NtQuerySystemInformation
NtSetInformationProcess
NtQuerySymbolicLinkObject
NtCreateKey
NtOpenKey
NtResumeProcess
NtOpenThread
NtQuerySemaphore
NtQueryEvent
NtSuspendProcess
NtQueryInformationProcess
NtQueryInformationThread
NtResumeThread
NtSuspendThread
RtlCreateQueryDebugBuffer
RtlQueryProcessDebugInformation
NtLoadDriver
RtlUnwind
RtlDestroyQueryDebugBuffer
NtQueryMutant
NtQuerySection
KERNEL32.dll CreateEventW
CreateThread
GetExitCodeThread
GetFileSizeEx
MulDiv
GetTickCount
GlobalAddAtomW
FormatMessageW
LocalAlloc
GetFileType
GetCommandLineW
LockResource
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
LoadResource
EnterCriticalSection
FindResourceW
FindResourceExW
GlobalAlloc
GlobalReAlloc
GlobalLock
GlobalUnlock
TerminateThread
Module32FirstW
Module32NextW
DeleteCriticalSection
GetSystemTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
IsBadStringPtrW
SetLastError
OpenEventW
ReadProcessMemory
lstrcmpiW
GetEnvironmentVariableW
VirtualQueryEx
GetCurrentProcessId
SetFilePointer
IsProcessorFeaturePresent
GetSystemDirectoryW
DeleteFileW
SearchPathW
OpenThread
GetThreadContext
SuspendThread
ResumeThread
Thread32First
Thread32Next
ResetEvent
QueryPerformanceCounter
QueryPerformanceFrequency
IsBadReadPtr
GlobalFree
GlobalMemoryStatusEx
SetProcessWorkingSetSize
TerminateProcess
GetProcessId
PulseEvent
SetPriorityClass
GetComputerNameW
ProcessIdToSessionId
WTSGetActiveConsoleSessionId
GetLogicalProcessorInformation
GlobalMemoryStatus
VirtualAlloc
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetProcessWorkingSetSize
DeviceIoControl
DuplicateHandle
OutputDebugStringW
GetDriveTypeW
GetCurrentDirectoryW
CreateJobObjectW
QueryInformationJobObject
IsProcessInJob
WideCharToMultiByte
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
GetNativeSystemInfo
ExpandEnvironmentStringsA
LoadLibraryA
GetCurrentThread
LeaveCriticalSection
FindNextFileW
FindClose
WaitForMultipleObjects
ReadFile
LoadLibraryExW
FreeLibrary
GetPrivateProfileStringW
FindFirstFileW
GetFileAttributesW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetNumberFormatW
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
IsWow64Process
CreateFileW
GetFullPathNameW
GetSystemWow64DirectoryW
GetSystemWindowsDirectoryW
ExpandEnvironmentStringsW
SetEnvironmentVariableW
CreateProcessW
GetModuleHandleW
GetModuleFileNameW
LoadLibraryW
CreateFileMappingW
TlsSetValue
TlsAlloc
lstrlenW
UnmapViewOfFile
MapViewOfFile
FormatMessageA
FileTimeToSystemTime
FileTimeToLocalFileTime
CloseHandle
GetFileTime
WriteFile
GetStdHandle
GetFileSize
Sleep
InitializeCriticalSection
SetErrorMode
GetLastError
ExitThread
GetCurrentProcess
OpenProcess
GetLongPathNameW
LocalFree
GetVersion
GetProcAddress
InterlockedDecrement
InterlockedIncrement
TlsGetValue
lstrlenA
GetStringTypeW
EncodePointer
IsDebuggerPresent
GetCurrentThreadId
ExitProcess
GetModuleHandleExW
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsFree
GetStartupInfoW
CompareStringW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
FlushFileBuffers
GetConsoleCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
SetFilePointerEx
SetStdHandle
WriteConsoleW
SetEndOfFile
ReadConsoleW
SetEnvironmentVariableA
WaitForSingleObject
MultiByteToWideChar
SetEvent
SizeofResource
USER32.dll GetWindow
GetGuiResources
LoadBitmapW
CopyImage
GetDesktopWindow
KillTimer
MsgWaitForMultipleObjects
GetDlgCtrlID
CheckRadioButton
SendMessageTimeoutW
PeekMessageW
IsHungAppWindow
LockWorkStation
IsDialogMessageW
DrawIconEx
CheckMenuRadioItem
WindowFromPoint
RedrawWindow
EndMenu
SetMenuInfo
GetMenuInfo
TrackPopupMenu
RemoveMenu
CreateMenu
DrawMenuBar
LoadMenuW
TranslateAcceleratorW
LoadAcceleratorsW
IsWindowEnabled
GetDlgItemTextW
CreateDialogParamW
SetLayeredWindowAttributes
IsWindow
PostQuitMessage
ExitWindowsEx
DispatchMessageW
TranslateMessage
GetMessageW
DrawEdge
RegisterWindowMessageW
EndTask
GetWindowDC
SetMenuItemInfoW
IsIconic
ShowWindowAsync
GetMonitorInfoW
MonitorFromPoint
EnumWindows
SetClassLongW
ClientToScreen
GetWindowTextW
InvalidateRgn
TrackPopupMenuEx
ModifyMenuW
AppendMenuW
GetMenuItemCount
GetMenuItemID
EnableMenuItem
CreatePopupMenu
EnableWindow
IsDlgButtonChecked
CheckDlgButton
GetWindowPlacement
LoadIconW
SetWindowPlacement
DefMDIChildProcW
DefFrameProcW
DefDlgProcW
CreateIconIndirect
FrameRect
IsWindowVisible
DestroyWindow
GetClassNameW
EnumChildWindows
PtInRect
UnionRect
CopyRect
ScreenToClient
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
IsZoomed
DeferWindowPos
BeginDeferWindowPos
DrawFrameControl
ChildWindowFromPoint
SetDlgItemTextW
DialogBoxParamW
MoveWindow
SetWindowTextW
GetDlgItem
EndDialog
DialogBoxIndirectParamW
GetScrollInfo
SetScrollInfo
GetParent
GetClassLongW
SetWindowLongW
GetWindowLongW
OffsetRect
IntersectRect
InflateRect
FillRect
GetSysColorBrush
GetSysColor
MapWindowPoints
GetCursorPos
GetWindowRect
GetClientRect
GetPropW
SetPropW
ScrollWindowEx
ValidateRect
InvalidateRect
GetUpdateRgn
GetUpdateRect
EndPaint
BeginPaint
UpdateWindow
DrawTextW
SetTimer
ReleaseCapture
SetCapture
GetCapture
GetKeyState
GetFocus
SetWindowPos
CreateWindowExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
PostMessageW
LoadStringW
ReleaseDC
GetDC
EnumDisplaySettingsW
LoadImageW
DestroyIcon
LoadCursorW
GetWindowThreadProcessId
FindWindowExW
FindWindowW
SendMessageW
WaitForInputIdle
ShowWindow
SetFocus
GetSystemMetrics
GetMenu
CheckMenuItem
GetSubMenu
InsertMenuW
SetCursor
MessageBoxW
SetForegroundWindow
DeleteMenu
EndDeferWindowPos
GDI32.dll GetBkColor
CreateRectRgnIndirect
CreateSolidBrush
DeleteDC
GetBkMode
GetDeviceCaps
GetStockObject
RectInRegion
StartDocW
CreateRectRgn
CreatePen
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteObject
GetObjectW
CreateDIBSection
SetMapMode
Polyline
GetTextMetricsW
SetTextColor
SetBkMode
SetBkColor
SelectObject
SelectClipRgn
CreateBitmap
MoveToEx
SetROP2
SaveDC
RestoreDC
Rectangle
LineTo
ExtTextOutW
SetTextAlign
GetTextExtentPoint32W
CreateFontIndirectW
EndPage
StartPage
EndDoc
COMDLG32.dll FindTextW
ChooseColorW
GetSaveFileNameW
GetOpenFileNameW
PrintDlgW
CommDlgExtendedError
ChooseFontW
ADVAPI32.dll RegOpenKeyExA
RegQueryValueExA
EnumServicesStatusExW
LookupPrivilegeNameW
OpenProcessToken
GetTokenInformation
AdjustTokenPrivileges
SetKernelObjectSecurity
GetKernelObjectSecurity
EqualSid
AllocateAndInitializeSid
FreeSid
LookupAccountSidW
LookupAccountNameW
LookupPrivilegeValueW
CreateProcessAsUserW
RegConnectRegistryW
FlushTraceW
ConvertSidToStringSidW
LsaEnumerateAccountRights
LsaOpenPolicy
LsaClose
LsaFreeMemory
GetSecurityInfo
CreateRestrictedToken
AddAccessAllowedAce
GetAce
AddAce
InitializeAcl
ImpersonateLoggedOnUser
DuplicateTokenEx
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyW
RegEnumValueW
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
IsValidSid
SetTokenInformation
QueryServiceConfigW
CopySid
GetLengthSid
CloseTrace
ProcessTrace
OpenTraceW
ControlTraceW
SetSecurityInfo
RevertToSelf
RegLoadKeyW
StartTraceW
SetServiceObjectSecurity
QueryServiceObjectSecurity
MapGenericMask
RegOpenKeyW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
RegUnLoadKeyW
RegQueryValueW
CryptAcquireContextW
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
RegCloseKey
CryptDestroyHash
RegDeleteValueW
CloseServiceHandle
GetServiceDisplayNameW
OpenSCManagerW
OpenServiceW
QueryServiceConfig2W
ControlService
QueryServiceStatus
StartServiceW
RegCreateKeyW
SHELL32.dll SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHBrowseForFolderW
Shell_NotifyIconW
ShellExecuteExW
SHGetFolderPathW
SHGetFileInfoW
ShellExecuteW
ole32.dll CoInitializeEx
CoCreateInstance
CoUninitialize
CoTaskMemFree
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoInitialize
CoSetProxyBlanket
OLEAUT32.dll #10
#4
#25
#24
#23
#20
#2
#6
#7
#150
#8
#9
#12
#16
#19
WINHTTP.dll WinHttpReadData
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpWriteData
WinHttpQueryDataAvailable
WinHttpSetOption
PSAPI.DLL GetMappedFileNameW
QueryWorkingSet
GetModuleFileNameExW

Delayed Imports

150

Type BINRES
Language English - United States
Codepage UNKNOWN
Size 0x8ec8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.79917
Detected Filetype PE Executable
MD5 628c82bd0e82ae8c38c00bae6729d68a
SHA1 02d4fdbf55a37316b2884851a448e46e1808f078
SHA256 61c662a699d18cb46c74151ac4f32e04dba7a9bb0c706a61e62866aac4e2a3ad
SHA3 27984b7fceb477d67d9ffbdabf60d831a34e65f3fe819aeb1fef55b30f72a810

152

Type BINRES
Language English - United States
Codepage UNKNOWN
Size 0x161c30
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.08106
Detected Filetype PE Executable
MD5 9437013309a88b6cf857e9bcd37a237e
SHA1 dcc36fee51754f3171a161e5d66c7f2120a9d4c1
SHA256 c16dd2fb64f586a49ec58ce499c3c050c443a08e7282102dc7399c84c7b12e3b
SHA3 9b61d68dc787b30f6fda997ae2b3b626279cf5818a5a3dfbdf585e18b9cab033

1

Type RT_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x134
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.73768
MD5 e656a13345ed2bd9970aa817fa987203
SHA1 0949d36c6351750cbbc64dd855179173a2cb6a10
SHA256 b9502efe5dc8f0dfcadd5c28806a2b1c7265935c6f266c2480038c5d325f4ec0
SHA3 f9aa7a95b8cc2c75bf594185728dab66abf4e8f90317b1060fee50c7910edb7e

2

Type RT_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x134
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.50239
MD5 c1a71508ea5dfa8bf41118f0c8617d28
SHA1 abae5839ca58e292d153375a11eb3da5505dda0d
SHA256 64971246532dee4afcae138bdc239c42c20d9eeebcf26512a76b2bd14d323bae
SHA3 bbb05c79a8070bca607a7d21cb2affefa49319c24ca9a809260f579725e949c3

3

Type RT_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x134
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.37949
MD5 9ace272b939fc4d314332baffa3f2e69
SHA1 99bc223d3c01e2bd8e57318df0a4d2b57c762b64
SHA256 0c609ee60044104f38c4ee5ce795b36a2654f1fd93b57b0733494dce6f5a90ed
SHA3 64ac06f2b95e6b1af574daa7a32e645fa57eee1738c52b788e30aaa7d5490314

4

Type RT_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x134
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.62344
MD5 61f0c9e781c2d61cb18343b265cbf2dd
SHA1 2f05818896e1bfd79a2a86dad2cd32ca77a506e8
SHA256 4c65155182ea488f493ab650a918c3f0a637fe6d35cb682500bd1d400c7039a2
SHA3 0827c0d7de6fca3e1d61e0eba203e35e22f80d40b3c3ec7b4aa8f87716559f11

108

Type RT_BITMAP
Language English - United States
Codepage UNKNOWN
Size 0x1228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.34185
MD5 788783f8d15740536d3ca95369dc3c68
SHA1 2006a0aae3ad55b288cb228754ecb307c914ac96
SHA256 dc1eef053086718324291063540dbce911f5401f2c34d668e19a6a600d3da96a
SHA3 eefbef14d4b957dba8cb20cfc678d904eb79eee30bb383210ac1fc5d50f2099a
Preview

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.33181
MD5 d15f3ab6307b00b16a901cd1cddb79e1
SHA1 b48d356d14009d69e21261cc5fd9df19991c2a4c
SHA256 9e4372979b69241ac2fbb56857b18b1e23b4b14b30b11142d955e0ed839dfeb1
SHA3 4ab995636650e80db56bd7d3c30cd50b65295411668859136b7fb30f993a16e3

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.37984
MD5 73e41278c4bbba3b306c7eb63cdec358
SHA1 c2fe0b25186d6cd19d000c4d08cfc1f1e5897e7e
SHA256 c4810ca3c47864ee1afe2945c1ceb8d8bfa089076c1482af684dee2f4fa9e262
SHA3 a5f3db78d93522b4a6fb70efe1bcff767842020601eb3bd4db02502ab633c7b2

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.94402
MD5 1e94ba78a024e8899c819b99b0d4cc2c
SHA1 2bc749e6f46fd79a6bac01cd71fa06d802439f51
SHA256 f0094827dd717591eefeeb08722538ca2a9e86191293a8e448775d65c48bbf50
SHA3 53f1a090857bfaafd1fd6f70906cfcd59bb73831d347a9ad4b8f0e5e440238e2

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.59771
MD5 65f2b0a5d69167e2e8eb76cdcfcc9bc9
SHA1 2b0799d6db9b5378f44d05b7cfa9367d16ab022e
SHA256 e989801b583b43457ba9460c4eeef23937627a90d9069b93792d93c9bce9fdca
SHA3 92c4c1e308f979818c405f8212360045d0849990f216a094434d17c64a1e9470

9

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.4153
MD5 b65944552f5ca6302ab035db1b24a771
SHA1 1ba47bf246a06838e380a055f06b002761d15217
SHA256 e9b8d2a7f9f8fc64d9d63e524fdfaf97daec3de967a9174cb28c9863b5e286b7
SHA3 ff7d4ac5e48b6686fe052a02aaff9aacaabbf355a8b10c289fc04693e6d20a2f

10

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.39993
MD5 adacc3dc9471484536aa1b262f72efa0
SHA1 e300f31042e144d49e85b46f737cd33b5da12152
SHA256 a31a9c1f63e16faaf2de4bd8e018ee8bb8fd310540500f993fff1ff9ddcead07
SHA3 b5f26fd536b260285bc2ac41a789f6afb393caef9432a192151f8d6a7f71f2c1
Preview

11

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.66049
MD5 115036422924e56bb48717c0809d36c1
SHA1 f53eef8f74c49e47ca283ba02df5146204302e77
SHA256 d14d199451a598bb54344ae96a5c4c9e7fd5df9933867ac92fdfef2d69d8617a
SHA3 ad08768bba690b948babe2e3658094c8e1b521b297bbf55bce52ad575dd4e828

12

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.67323
MD5 9f33207dc6a6efa2bfc193c03c1623f3
SHA1 86884d5f584080619cd19adefd657bda331d47fa
SHA256 cb66a58494780e2d1b37a824fbf213e055d1ba71fbed9dec6310237f5381c432
SHA3 d9f7808a60aeff043af8c2fa7292dfaef85262aff32b7b64face86e86566f199

13

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x668
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.84445
MD5 e4d85675ac1d6d5e718e5fd0ef8171f9
SHA1 ff7ced73bf265b1bc5afc81f983f189b2549fd3c
SHA256 edbcf39278577e7cb35f13044e4a4d0b8eb620dc3a951ce5b7f5aa0edb03005c
SHA3 0d4b91253a59b7fe21f9a0355fb1e209c0bb1ffdd06993d4e15407283c7aaaf5

14

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.19896
MD5 e2a2febd2a6653f3909e5a2060bd069f
SHA1 df82b8070744403059010d424239a07f3ff28952
SHA256 cbccc5dd9328c517a489976ace7df7081fa0a692c39f855032ef3754d2baa624
SHA3 440f4e59e9f90351ebfdfbaca779616c9085c907b0c710f480ed48de513785d4

15

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.17617
MD5 18fc88ba4a766f24d5b44ad56a22954c
SHA1 e9bd68a1868d6a7d55d7f55c06135ac3c113d0a6
SHA256 62b294420b0d1e13e3a86be63c86af973e8e1bee061c15d2ce18464b0190f8ba
SHA3 b92182b45e8600ee06447d16c0ec982d068012ccb3a4295ea1778e4cbab0a110

16

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.12781
MD5 10d1f1de08938ad327b96466ab418209
SHA1 127d040f844b43a596ee172fc029f8ed181fb8ce
SHA256 f740f49f6475729309b9ba9049c7e47e7bfad2f43c38a683447795df69fa709b
SHA3 5f4f4cdac5180b3dbdc49d91a38e056afe4e5e8feb877484e16aaf11da4ba876

17

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.99772
MD5 4cf71272fd36072fd4ae130e2e61ef20
SHA1 f865881a46f0282d2bd36b65383d740a84816c95
SHA256 05fbc6c8fb354811ff8e7eab4fae8ce6391ae9c2f83355186a63319177682653
SHA3 f53af91f08506e70255b43c0c96b4844ebefffa3ada86f96a63313d4705e5018

18

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x6c8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.64706
MD5 9ad7b95ed6004210b3079afae1435757
SHA1 b831c56bf1329f284bbd73cd97f5f212fe0a9af3
SHA256 5ca4a75a3bdf70ccca96fae02fcfc1ebf5d87af359bfdf0c60bb2bc16dc7ec61
SHA3 ff4dbfe3f28d6fc1a61ba19aa3c77285bcf4b245783e81abeaec8f47b2ffa57f

19

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.47918
MD5 0fa49dfb132efc77a85f71abe4f4b6a1
SHA1 c943628d2bc672404fc28f079b87eceb1969a560
SHA256 cf1de875dbe83b4f8ce52b8434b7cd36bd94b41ad0825b4bddb7ec5db08be182
SHA3 1900d1398c8d16a2f03270dc7cced78eeecc33558dae9cb5c3cd2779a20a410d

20

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.65183
MD5 d0e7b1b33e2be98c287bea29b286619f
SHA1 4dfa630e5a96241518bf4566e0899ecaf33f5234
SHA256 e42618215d9207d9e4f57a5c20aba3145cf2a1429da37b0bf5294cf5b619b579
SHA3 c2227db41227d5b6f786350d2d85b86cc92c12219f14ec14a9a6cdcdabdd0c3f

21

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.13496
MD5 78804d93f31508c7c17bb8a65ed6daeb
SHA1 7e645100b2e56d50d95dbc87881cd085b15c91ee
SHA256 8f8ef838ffe256cb446077895c499aa903c3475a0f0646bce5834f43dd00aefe
SHA3 d23f1e1074c36f4ee714328ce0ce403ea91f33ce39a7b5918864fca00e5c29cf

22

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.55486
MD5 bcc1db27f44c3680ef26c887e7e3b71e
SHA1 7a038c888d8054b77bbe4fc3456bc80f989840a7
SHA256 34fffdf2f7c87ed47474f224473297c7fc51dccdf88f921ab670876fa9a88673
SHA3 30ab6d64e264194ac45cdee0f5538f840272d1756ed360cc7c6fb8fed849bb85

23

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.90529
MD5 2d9ff5cc87accc2c358723c7754261a6
SHA1 e44bb4d037cd64663e14382f887c7907f715fa88
SHA256 95b3491969f7e0b417beb85c4ab9928aa3bfdc080fdad7928804f967c242dd30
SHA3 34b7bd1713894f5c85911c15e032be9af661551085c40d5579028d923ad862dc

24

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.04126
MD5 eceb76c7089de4108f0bce2e37b661f9
SHA1 866cbae8ec4037ef9915946236fa903601903b03
SHA256 9bc3b7eb9c114777cbffa3989630353bd13ba895187f68d29c883817c719bc8f
SHA3 68b3987ef4eaca1d60c08ec4b65a7fe221b5fe4135865af3dabb2150e579fc13

25

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.77095
MD5 31572ae3b003d5540ce665b36009e037
SHA1 aeb6318ffefd4ecc3f88155acb2bd5548eddc765
SHA256 200487ad8f155d1b966c297d691bb21941a0383405c922f66ac1ea84a9f5543a
SHA3 f2066f3e3599026e9ae528c123156cd371faf02290d822c7cd9555eb229221d2

26

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.28238
MD5 e1b601160d1f519743584d94338282b9
SHA1 f4ebc40a00c388fee1f3f9fe40d3352ce8d5e587
SHA256 f23d452fc2e257bde612ec6c6cb1c5100c8c033883aaf666d12a902b7d499211
SHA3 c4ed917ac1c187424c0c86c75e18c0056e3284106f83d7127158c2b76b0f66ae

27

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x668
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.98004
MD5 960ffe88236799ef1be0d84a21572742
SHA1 6f05ca41aace2b256c48caf01be42010aa5ca3ce
SHA256 2550041cd9c6db51dc0146a4f304e239adbe6007ff4201a93bf0eec1215bbdb6
SHA3 e9d5f195dca06ba222da6215cfc00865b659efdc8a4a7a2b34de2a4df9eea58c

28

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.38012
MD5 0d136bc871dea06e849142f3103479e9
SHA1 77bffe33eb06f0470c45e88aa9dafb8ef6ac3001
SHA256 8718a6962adbfbda22cc9b7104211f0850a9cdb1a133775e8432900121ffa321
SHA3 4746463759dade5a3a92817d167f9e07d0ff00ca68986af9f24aa7e1049f7a76

29

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.47884
MD5 b72cfaaea84ff041c8bfe5f041106868
SHA1 aeeb3a14728ccc5cdf7f4f9cf59edd4e8954d83f
SHA256 0b125eaf7d3059729133620de4fa99e3423f351cf23f38d1ed3547c3028d21b3
SHA3 0175f2a25791589ddbef84cb373d505a8f69cd005ca171961a3c91d08d0a87bf

30

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.65048
MD5 28e28ca80718a519b1261df5e490a7da
SHA1 7972446021ee547de5fb078810d97bfd3dae3ed8
SHA256 2312bf5182261c22fce5fc18e98e840c038071f3f863631a7dbbbfaa92c0af20
SHA3 5709ebc0afe0f289b76ec5e9a49a4bf7d3835cbd8a80c925db41eecab33d3053

31

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.05506
MD5 7714f740fdf47234d8ec4f11ee617e7e
SHA1 542502be45fc0015dea33d64f313ee353dd1a1fa
SHA256 13f1f53bd2d43a8a5ee5fd9e17734db5628cc232d1b471f5819e86f7a3c201e8
SHA3 ca00664b4a15815891787561cc6d91cb384c278597ac8fd85cce000303d23891

32

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.44185
MD5 6e1b4167ca9c0cb64e63f765ec953913
SHA1 79380b7cbb9eb2523c9fa42e3c4aefd5d63d4b2f
SHA256 fa960f7a1c941c443b14b949171b7d637ac1bf0a11bbfba0047ac9aa226af95c
SHA3 9810de2dcc42add239a7ccb3c14cb56919bdcf9c586af140fdf02ff53a3058d6

33

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.05247
MD5 13ccae106e736e918a60a2415a7c3e57
SHA1 6df7b8e340105f6378e5001c7ad1c5cda9315662
SHA256 cee0895ff13170acec8a23cc32ab9448b7757b1b70e203520f3e782b7f9d0c78
SHA3 926e2340485eefff24e59afc913fac0493a1084b0b2258671c9c374846989edb

34

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.26674
MD5 bdc1534a6f5ee02a48ea4ec07073c4e2
SHA1 292300408710d8e67a1f12b73c04e058e805e00c
SHA256 d8f9718bf04ff3cb5712929a465b08e49664d1a190e2c511be237bf147f23bea
SHA3 1f0129513463a3c8458a79252e28f28ffdca0ad5afe5e73e9c23dd6a7103c4aa

35

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.50639
MD5 5f2676baf4eb2ca5b0cf1b5c67f8d8a5
SHA1 c2fdb76f6697ff390ff29fcaaf4c29c013ff2588
SHA256 8e7743b5d2c0ac3e7049f915124c8fb4e437d7e3fb23fecaccc6220dd6a04419
SHA3 608c222c205c6c246cb61730ffb88a255ea41ef2c5b81aaee77bbdab56ea51a2

DLLMENU

Type RT_MENU
Language English - United States
Codepage UNKNOWN
Size 0x8c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.23714
MD5 58543d17cdefc8a335dc888c949eb1a2
SHA1 1cddb40abea6f936c54eaea9afd656c087e021e9
SHA256 ae08329c9e755a1af99aa945fbb02886bc25ab35dc4dafd432f4c401d73e62d4
SHA3 07f8f71626d4a33e24891991fffa56639402efd0884b43a070b671fd10867d61

HANDLEMENU

Type RT_MENU
Language English - United States
Codepage UNKNOWN
Size 0x46
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.8752
MD5 70a30f346b7a4e550d5070a0eab391e9
SHA1 1e5a1e9e4726dbdfa4956461d0aa32580c0d77ce
SHA256 ab34596f8893f352dafa71240c1bc9b2380fb7dc12baf3ae8676ce5b30760d34
SHA3 5bba098cae34e36b3b1d1c151a4a1852069d88113f3d6b9b9ad88c207909770f

OPACITY

Type RT_MENU
Language English - United States
Codepage UNKNOWN
Size 0x96
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.72111
MD5 fc821d73cf822279ad22626f3b2c0d8b
SHA1 7dcf24fac95f31279349aacb28746a11555f3c81
SHA256 2d96ae63448182f31f99728a824482221161e6127c5c8524a905ab0552a69544
SHA3 3e022e796a1b576121fe4cb3cd7d9b9f99a538ec2e6a6dc69450bcbaab3fda22

PRIORITY

Type RT_MENU
Language English - United States
Codepage UNKNOWN
Size 0x6c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.0828
MD5 0a16ee87c5b4f59bd7aa1eeb9e723e13
SHA1 753e8a96f3283028409f4fda4caf6c59f9153beb
SHA256 d373d633df8d7d67ff35c480b71ec3dd7a8bc41a2b9cfb1b1d1da50064c321b8
SHA3 4c6347df43a34c949ae68d47b1374aef7924674b43046781729494590591ca4e

PROCESSOR

Type RT_MENU
Language English - United States
Codepage UNKNOWN
Size 0x5c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.97035
MD5 26cc5f6563868e188ef9fa8229acae39
SHA1 bfa34876537d0a1d9b5c453e2ceeb798f0947993
SHA256 a5f461e3bb14cbd6d3287110211bc47efaf073a8842201a50964af50100c9c0e
SHA3 d540acbd89aa2cb12a73f85bd8dbbc43779b8440653d3cfc2387caa477fadd4d

PROCEXPLORER

Type RT_MENU
Language English - United States
Codepage UNKNOWN
Size 0xaec
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.4769
MD5 7e48877b6567c9e4619fa911de1fd91e
SHA1 a0c1e265929db2b37988233af7bbef0479d4deb6
SHA256 704e8c8037db7fa7b91b180044b1695f34c7caf6a9f2091e0c3e3b5c7b99cb53
SHA3 5c77d9d2fbe4a3d05881db5c978399d72a283a32b93b66598ac0ba8f69ff57d9

TRAYMENU

Type RT_MENU
Language English - United States
Codepage UNKNOWN
Size 0xae
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.13566
MD5 635e1a8fab60e3f641abb90580b52117
SHA1 9e24ffef6f1d2f375833b2b6fe910023c2e87ad4
SHA256 9a52afaaa992ad15e676282551942074c3850d4c78f4d4f53dcca1e80e2706ca
SHA3 4d5542e674bbca6fceacb7536979c2c31c8262970a7d85d2a9f35f123e924273

USERS

Type RT_MENU
Language English - United States
Codepage UNKNOWN
Size 0xe6
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.10198
MD5 e059d158dc1a662371bc462658750efb
SHA1 7a6d94ea50d2cbc2a75d7612d5fba335a74a19a9
SHA256 31dfcaa21410724bf3ccad366ed737529d2d8a55d6b14441d41a311b70417984
SHA3 89b91fd5cf28b19c6fdcad07a2327e84a6b0c9ebac5347af80fe24f016416a31

ABOUTBOX

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x1be
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.21566
MD5 7cf4214ea6973383d723564687a5a839
SHA1 4487b355bae8f91f7a274e78d602baffecacd25e
SHA256 d3d8be1b548b628b457dd5cf9a6d44afe25b83135265bb6131e765de06014521
SHA3 35da9ae75bdab08d0b255f1d9345956bb78599e09c569db4da5efd43146ec25c

CHOOSECOLORS

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x8da
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.16943
MD5 1bd9b87a9c5d20a663db95e6a210c832
SHA1 36e9e89b1aee3fc2529f283850f152e845319a35
SHA256 2737ac0585f77dcb6c8b2120a1bcfcdbc02503a8a8ab660af03db072f581a868
SHA3 7f2ca6f23b7b04fbde021ae300d1944e660b45cbe2b3e368fb4935801f63d063

CPUAFFINITY

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x70e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.17579
MD5 b3e481356e7858f784b46478b46b5d19
SHA1 77c41675c04281c768ef3d7ed8b295a5f571a30d
SHA256 226d6ecdc06182bf72eebb9ae6bbd714ad4091f3f0640863fcd9a378024a6296
SHA3 2db22b7c8f308a7978b35a581d8eba5d8fcf1c19ee9035b8abc9ae203553ecfd

CPUAFFINITY64

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xc90
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.15957
MD5 2cf28c55b75b4de2c77aa0f0cda6103e
SHA1 c38c58139bdbcd27590517506ac49801ca6317f3
SHA256 ca596a11a7eee9bdd924a9f217ec3fbcaa6fdf9199f41cf9d6f56c34d1a7411e
SHA3 1e5a9d3863976345c4037f8c4e46a9f3e7acd6cda2552e52ad5685de0e651cc5

DIFFDURATION

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x1c8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.28549
MD5 4edf66628a0a4123a2559f660848b189
SHA1 8b036c3a109352ddfcb94fb8e17d2b5bc9fabc47
SHA256 0dfed009efc794166d05f75f45fcbee8d77dfe2e18be687fc95a19055cd24374
SHA3 29f832482f36b0bed08d381491c227508ab7807cbb010937544cbb40b11ad374

DLLCOLUMNS

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x598
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.39372
MD5 2ba14933f29aea575014d19d76d11b60
SHA1 2db8c339b96fe0f57d82035fc9e3bda48ff2eae7
SHA256 805b0562f5a4ef989bf1731ebef6470b0d6c67552d4a686a92ac595d218747c1
SHA3 b82deacde54e3c3c26cce3cbcce936d9ab21396b4c5d6cadf5f8bc49f4db446b

DLLINFO

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x4f0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.2369
MD5 3fe031e4e6f9c468fb8c0975a2bb3b66
SHA1 5a7e65ca17eb4692c181f8819e12bef7e6f9f47d
SHA256 4932d1ef64fcfbc8d02d0c50850d2eff2d6c170d7151f9a65aa318f0fffa89cb
SHA3 28e074ea16769a1011f040a9bcf0a5ecb86dc18b5484dece741e71d8c7424843

DLLSTRINGS

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x1de
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.28713
MD5 92147f8fa224c02b18444d553c8a256f
SHA1 0df93ee59a0f29db182eef1a5a857d1367184cc7
SHA256 fd0b904297f4e247c3ce5a574e2416f0b3592dca61453f1053053f40412f08a8
SHA3 04f1ef63da4b43603e0c5774d00b6f7f4ea93c9ea2ae6a5c61c360ae266b86a5

FINDDIALOG

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x18c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.29147
MD5 6eeed91f9be3a2547a17e3430be41dde
SHA1 72461c1e7a028ce2b531cc1c52d2fd99e4e075fa
SHA256 893b1604eb54c972d83fdc72ee6a3c4351675fd553d00e31c729348f245b8db0
SHA3 5ac67332ed55a067ca67fd342f2758514b986dbbcaf2646609d0ed6010fe4434

HANDLECOLUMNS

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x286
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.29015
MD5 70fa7743fd7da2c4380f0ba887efdee9
SHA1 07dc85a2163ce9d7af62706f486c0a32841467dd
SHA256 958a6472623821f731ae6277df1bfb004b3c9e69bbf9cf1024ec499615a54801
SHA3 c4b20c9dd8f3174ba035bdb8eb194492e2c6efa5e4c0a4ba44c92096bd37dc36

HANDLEINFO

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x47c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.21705
MD5 cd077cbb299e0c9eac1451ff22ecdc23
SHA1 710ea6dec033c09aec6df24183a89b67113ecb91
SHA256 b0bb35bd849a6403ce9d3301737c7ad6902e19787fb0a4ec826168f2321a7054
SHA3 e6ef6d38c053e01a4f23ce7fe6d9bca2f861847b8126d61b6336b42b3d6d439a

MEMSCANPROGRESS

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x120
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.1749
MD5 8b2e0b6cccf865894e5fe140a65aa214
SHA1 827a33001b900e7c3f0dc4fd28548293819cf720
SHA256 f66cfafc5d38a89a744982add53eb1e4873c825b60112040bc27c4fabf08c11c
SHA3 de6f2cd7237b6d2ca2b4b46945ff84b0790475773581e474ec26fda98cd82716

NETCOLUMNS

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x68a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.32705
MD5 35741dbb7de9216517d78da820fcda37
SHA1 a2887ee8e0d3a64d70b194875c279b67ec9804da
SHA256 b85a69f922a068568f917417bd202af2549ba8e13ee03014540b05d537a163e6
SHA3 c7c3289d324412948cfceda6cbdd84472a3fafba4d0293273672fe21e2cddc28

PROCCOLUMNS

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x734
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.37306
MD5 0a77e7be6882595789ea0c480ed93fed
SHA1 4f4744bc8db0c0ffc04e739d0ea32c15bc66c341
SHA256 a0980d29457481b886084f28fc05ec933f70f2b58b672c6046d958f462224a84
SHA3 9abd53a7d97b8e05edddaa0790244abdedd556cf35566432e136e16f6feb8854

PROCDISKCOLUMNS

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x3e0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.19899
MD5 5a1e62c3d371d385e674d9ed62cf7092
SHA1 75dac414b573289c057a813f1ec4acab4fb7b3d4
SHA256 007a811e3cde87a1e8de4323f3c8a5bde03f920a995a73103c09afe4c81a5f1c
SHA3 61474a287903b406a477c65a850b008a6edc4e9021998f0c22a5a522ca3ed409

PROCGPUCOLUMNS

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x208
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.25714
MD5 482a6aae3cf1298eef555bb1bb8de422
SHA1 6e2eebc6bccf0103497db9bc39bfe5465bef0a2e
SHA256 3afc756afa2c405913458a537b650241db0bb9a79d164607006a8f9a4173772d
SHA3 f19d7c14d3d5a5f838999bcabdd7c2b4fe8192746ec77b122f7c770a6d07a9af

PROCIOCOLUMNS

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x440
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.2078
MD5 f0a3b3abb3cda0d813403087aab30ef3
SHA1 ae73f7faec0b39a843af2d0c8b01ccf2754cd4dc
SHA256 7a47f6635ba1d7034d52faccb3593741b90b278f7960ad7293d121ff46bd02b0
SHA3 5287fde91533e2b9f9a2081d5672a3b5a2e9c57a5f97b7f1e766305b73b82edb

PROCMEMCOLUMNS

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x626
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.3539
MD5 eecd2d441918a35783fdade41a437e79
SHA1 0c8f3a9d852cf7248b86fe2839ab59eb38db2011
SHA256 7672262a1544ee9491c0b9ee37f6e8b491e3311bedf66b294b79f81692100932
SHA3 237fa0389dc2a539cf415f651498b7f0e37d50cc5b0b5986f86ec5efb476a71b

PROCNETWORKCOLUMNS

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x3f0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.19385
MD5 df74b2ba943785ce6e6c00c0cad522c0
SHA1 993298fba5f49db317f80b2e67f3a5f1c9a7a010
SHA256 2313c328ee6801b074fec8091ef6b9f9a887c3a239f5bfbda365868605ffc74e
SHA3 720b5ea654238db630dd712a95593287027ff3eb3b7ecd64e05403756c3ae455

PROCPERFCOLUMNS

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x3f0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.27292
MD5 b1e6ab2630485ce9fdd84aef26b69f7a
SHA1 fda2c3b243d885abd80834969f911e2a7fb64bf0
SHA256 15dad56ba784ad3755f22af89f08d6acfb010ac6606c620ad82dd0f78c1d1bb6
SHA3 c4045dd0e105f2c7d4f8ea8406a18d3a11d8587c8126abc5319426b3c3f76424

PROCPROPSHEET

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xe6
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.144
MD5 e5f3bf96bc077214b77562f9cf80190e
SHA1 421953a7b14b077e076c38b6e386117bf8eec8bc
SHA256 08c1c010df69002c0de68b81f4b6b2e9e0e3cc80b1d2ddf2e1a68b797146464d
SHA3 188070369b37c7675f67ab15a6b31d568501b114ef6de4621ef21707e537e70a

RUNDLG

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x1bc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.23817
MD5 04072f8bbc56d19225743a11f7d283f8
SHA1 772b4477273481ab270b426b04c097cffed81c2d
SHA256 5f61040c387b76a32a4b00314aa7dc3b1e1e387be4be86701349d5f2f4c94d69
SHA3 516b7e767c1ee95006cb226207dd0d96fcb8a3270180a629c87133042c4c7471

SENDMESSAGE

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x154
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.0276
MD5 b113c2f88bdcf37cf2db86257ab92007
SHA1 d9a6f48cd32b8de799b2067b952c762e1ab37165
SHA256 1aa38eb868103555f5dd55f655df9627c8f13181f33bf0261cc8c845119be9b0
SHA3 a249890231ddb93e9142be601e6ca10fb961e010339dc86ce0ab98924e3b6f2f

SERVICECONTROL

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x180
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.20161
MD5 d8f456d1b28f6817e559ae4ef887bd8a
SHA1 a28983447bb70d5bc982282d6c16bce7358ff507
SHA256 576ff668d488f2099991f514dea5bcd13a76b81844077575d69ac23106098b1f
SHA3 e7bb6bb1de33ed977c7814aef2d0db88fc2305620c2a85e047b01b4eb5cd0a6e

STATUSBARCOLUMNS

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x516
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.34368
MD5 fed3c9a663fff4b1c3b78ecd764427a9
SHA1 c1ee2bbc1419ec0a4da0a57f98606c1f0210924e
SHA256 6b08b36c4843159e8d146eb0d690d10a6fcfd0133db723a6c6a7adde6791546e
SHA3 dbb3e6ce15d53f160e821b8dd4cb9bcabc01b6a78047430daf128e8fc3c8f3a8

SYMBOLCONFIG

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x3f8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.37634
MD5 683b371d68c18fb70b21b87e8bdb50df
SHA1 ff9b434d7696deb27657169c91c513d19f046fff
SHA256 b5ef6554821c52d6085bf39b24de865af2dd6ec8075792b8f905202d89a6e9d0
SHA3 6dd0caa6821898c3ac23544040590eb13ef33292c0f924d29bd359a4e9efe7b0

SYMBOLCONFIGWARNING

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x2c0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.35145
MD5 d158cb5971c2b3cd3c54625437bff306
SHA1 63c4d354424d5e346029e04d103a166d4e873592
SHA256 930b8b7108d0176aa72036cd1365e90cf92ecbf2969080d509e0d0ed910fdb94
SHA3 2e5186b0ec423977105b71a718a0774c425e6db279b002165d9b6488a21ff52c

SYMBOLDBGHELPGWARNING

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x3ac
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.37708
MD5 a7e7fe752491d98d10dd79760b01d58e
SHA1 09a089c2dd027e371a6063328c3f5bc9a3678a79
SHA256 b301bbaacd6b4330bb74878987a0f798723373d06eca4d50572cea501a51c5cd
SHA3 7b5d05a948a71b9992dbe50b0e411354131cffc90091343e18efc4a9062bf450

SYSINFOPROPSHEET

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xce
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.36249
MD5 d97a46037fced13e1c84ddaba3bc96a4
SHA1 1779402d5be37546c6ff01865133f7822882c02e
SHA256 d231c928399a8ccb22efdb7fdbe88b5967b552561985ef4593a94d277192f49f
SHA3 0da0eef103c323cd0dc80535ba22b3d162d4d4ebc52be939aa1191c033d908aa

SYSTEMINFOCPU

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x488
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.16987
MD5 f36131c9184d93463f4760d14b0e6730
SHA1 0a841bdad7f2715c13ccc7fee34d9335032114ed
SHA256 dbbca3b14d2120bfd59caedb15b6c555fcafc6c92537e84a9e3334fabdac4e3c
SHA3 0bff36c4ade9394783a73b0068c6c750fb11100634a7be8ca515e58b7dc6318e

SYSTEMINFOGPU

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x4be
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.33868
MD5 f374aa5d93456ca7e9788e2ef8122d36
SHA1 b858775364d3e6511204b7bb7513e205e0f19cdb
SHA256 527354f4556deae8238c6417bf01d20a6caf16a93771ec957d177d58741c2ff8
SHA3 b3da0f84bf61862f022f10132f47957bf53e1aa2dada2732167e85f3532823bf

SYSTEMINFOGPUNODES

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x12a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.31594
MD5 2f522f20fc6495545e204e69d8b95dc8
SHA1 78cd4ca491094b42edef68c0b16c36c3b4514fa7
SHA256 9c5611036afb4d48ce9d92d175285e6bbcbdaad3a3cc229522951fbd2104b9c7
SHA3 01de2836989671f6790bdf8e437407905f072e9106621a7a20809234f57dc00c

SYSTEMINFOIO

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x382
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.14723
MD5 5cc57a501788eb28dd43087b4b8251d2
SHA1 b0972826685a5c47b30ae50f0ad1d36e94a27fef
SHA256 4e0cd72c6a6178c7b1354ebdf30884fd6cc70c233ca98d77fa6f9d3007261294
SHA3 8cf7b83260b4d2e326642059229463fdfa9b0c6f1b467599055fa71af8b609d9

SYSTEMINFOIOETW

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xa24
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.18862
MD5 104925e2089c5738c02183a96c33d805
SHA1 6f5c569cf74d075155ea3b44bcc942ecc5e6cde5
SHA256 73dc7d7196628079156f4ac16f58d088ee3f02fe0f2701e6e4588118fe33b624
SHA3 0b0ffc2ce639e633b3e73dddcc35638bec245f49bb607f04bd697f119a2dbeb1

SYSTEMINFOMEM

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xf64
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.24853
MD5 42378bf274171635586559454cceb119
SHA1 504d74952d29d013c8542375431084a0995c1026
SHA256 704a6de397106138a7ae7e4346eccba98ab986e66da431bce4c71aeb712e96cd
SHA3 8dbe41c41406f3d4dd7f5024d91a2ca229d74b3b0fb23ab1d0bd09f7fcfecf97

SYSTEMINFOMEMXP

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x92e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.23864
MD5 5d937c1026dc8ef7cc5db9dd8a4ee742
SHA1 396d53ef3878cba27fcd4fed5079c6fedc25f466
SHA256 4d99ae769d612f0c81542dda98a3d29ea58bd00262777a02c254391bedc9c5d7
SHA3 176b2f5d92cca3e9c4c70308fd35faa813728cf333491690a9a8b124ecce2348

SYSTEMINFOSUM

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x20a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.02122
MD5 cac1ec262ba8c0dba489b06d55505c9b
SHA1 fb3a7a8f3b0fb9639b7a894a2971919e92349014
SHA256 156b8a9d19e222c6f1eb492dddee15b0feaf9dfcdabe901488ec260b24d64dd0
SHA3 fb8f6fe9477399e74228065cd4ec05797e721a426c5c07b2c3316cd22662f4f0

SYSTEMINFOSUMETW

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x2f0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.06331
MD5 90771deb7437aadda139709bd99fddc6
SHA1 9a34aafab864482e72e2cf95c29f79e5e9fe577f
SHA256 2dd5787c1ecbc9e96fa129f4da9a0d6e93521faf09dba42949e0557eb077ad87
SHA3 cea4385bc3ba5cf6082e37ad90945c63e5d289846f2ecb567b9213925bdd685b

THREADSTACK

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x180
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.21713
MD5 0f562f4dd80ce240a63bbc2beffa664f
SHA1 b2703ed53b2bc9dfaab1d93d2d2beedb4a8b042c
SHA256 0d0b5afca34d157c8de19a825c048efc4fa35b924b76e0fb181916e94a7b50da
SHA3 2bcfefb738f4a26a834ed7fa1cc88ecaf9f73904b3a90c906cfc0dd4b20b1403

TSINFO

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x2de
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.95297
MD5 bc88105ea067038b6796c34fd68412bb
SHA1 f5718d9b8d9fd37eb36a23224f9da5e91428754b
SHA256 4feba0798e2f4e4d6a5b01d49a0e523520aeb4f49fe1de53d26650c8c784f884
SHA3 f997154f3c0a38da7863307aa4b02156cfbaa0676cc563b31c5baeaecac79c88

161

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x6b0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.19772
MD5 75913aeb2f0c5018b5ac27efe98d7e89
SHA1 295930be998c89758805944c1bc8c40750a63b6a
SHA256 a1ab002de3387aa7b80576690d81ccd7566c0a45000a67a313eab6f446c6ba77
SHA3 bf7082d61330b71017e12d83b8e701c2f062ea7c46a37cb6f08c3c1174475858

162

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xc6e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.16568
MD5 65af745bdf554d43138fd07604b8599c
SHA1 23822d74b4927a5568b2b768ab40566f68412c32
SHA256 07620c0f294ced1b721dc51dfe6082633e03b433334e84192acd8ab83baf834d
SHA3 52ba6db7e6fb07024f6a77f8e69fc3fc7913932a8501ad096e8e1bb52eb8bf4e

163

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x122
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.93015
MD5 c097216f801c44b785dba683a48ed465
SHA1 90e0dee218a13c39efca2112586d631d9bc37e06
SHA256 732c442ddc576694f45e7bc092e77f2d132e3e6221da6393380bb0c8a3345ac1
SHA3 1fbfd85109bcbe67fac210b1da90a4925cc3f3b4c82036603b5320a49b171d9b

164

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x196
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.94701
MD5 f92bb85ad14c67da9769fe0e531c6083
SHA1 a4e3ee34839684f6fee29fa7685124192023680a
SHA256 e6a3433fa46a740cf504aa4831b6f8d878642c01b054b24d86df48f0495305fb
SHA3 89f10d3734df4bced9707e488ece639016ce7234b8bac1d2363b3f80f6c3b8e7

165

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xa1e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.03253
MD5 69b724fe52f444360fffda5f8ebd7b89
SHA1 4b7a4a7a85811759145360c64ad25ed940647452
SHA256 c63a5a96695479c76f08873fae0671f468601c002021bf8b0e754303fa8bc207
SHA3 5d924185dae3d23837a987ec99ff74772b6da87b73ad20ee714fb49eb63e0c01

166

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x248
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.05417
MD5 8dd2ceb42785f34ab7170a55deabb74f
SHA1 a1c390272662929c6af28a55ada671242dfb6b95
SHA256 b70252856b8d8c5368c8647239371d20229fa713cc69dae2016bf205d37e26e7
SHA3 c6f37ec520079c1f6fed503df9af6c719686364c140705c6acfb155e7bd8b842

167

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x224
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.21335
MD5 1017984e117737edf9d935a9eb76fe8d
SHA1 9f89732553215a07382666bb3375e7255f96e24d
SHA256 68ce57be64ea648fc2d9ff64874770b150821c0675023895ac0f7a900ebc8209
SHA3 e7dac372684046de73050f75d97cd0fbba74c845e5c858cc9c610b262459c899

168

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x8a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.11477
MD5 1055509b3b580523ab51336fd9e9079f
SHA1 669d5ed1d57e85aeb388ee2e2e6a534cc22f1253
SHA256 2c378a35d9f3dd44bed6e161c343f7ba67c92fb9c9c890395d70e4a036424369
SHA3 ce5d21d24dd4cf9c9c96fffc6655fce7a680f7f4c47bb7e1ceb3f0a79541dbf8

169

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x164
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.2923
MD5 d68ddf9b064840ecc7d0784271cd836a
SHA1 a09d7e4858b840e69fae3d704b0f93370a5534fe
SHA256 9fa330281aa84bdbc3ec96f440d1d583c643d9c1be96b5a05f3a566985ac6bff
SHA3 6c3d00fb208db5fb3e9f9ac349cd6e1f8c8af6ce65af420dac37a51cbd8266a5

170

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xd0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.2167
MD5 e392cff82e6ca8ed9ae8e7cbc2df7eb5
SHA1 089788ae2449eb5eda24917d4362946bf8c93768
SHA256 c50281df32fd3abdc85e15d14ff7bb1de1c482c201648f920f21b2bd326a43cf
SHA3 a8fe3b4de5b1f98677da33877e86ee7d24825b28539caa36bc864ed1a39bc001

171

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x390
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.25563
MD5 fcb8e4ed4b8872572904305100ae615f
SHA1 a8d357153a66d393d4ea33c3d580aee70b7509ff
SHA256 0df45102587ab15551621c3bb1fb636cebc702270c36c98940f43c38c2f8fd8e
SHA3 770ebd46a963b86a0f17bb373db21b08e8b0a16468516c9a075f508a2742fcfd

172

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x8a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.06227
MD5 fdc9f13438a4da786010a13b931d898e
SHA1 c2229eebeb5fc4ce60b7213d80a5c0698d20a4a1
SHA256 7df63f0af2b93b1ed2c00570cd31a98d68d4c5fc3893ea88720f587c427a4391
SHA3 34520e244c6b65c2b31d607144709b6da95cd889725e596d851a94b825ee88b4

173

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x19e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.19671
MD5 fdbbfd0bc773fbb6c842c2e9381dc949
SHA1 ae672048c3dc3e2a087103411e4389f594cabfd5
SHA256 0cb602cb22b82d1063cc5247ba9f22b30881c02bfed451ff8dcd8fb54397472e
SHA3 4cb38087bb92412d646325e19318efd3c0c40a2129c02c5daa6192879b58f9a1

174

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xf2
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.27782
MD5 a9e479e5dc41fbf810bdd669ade0a674
SHA1 db6813c38de71297e6f8ef0ad2817344f1cd7168
SHA256 40d0600b5e2a97e0ec5ff03d8ddc691bd3770d629a87fe4c31414f0b246bb20b
SHA3 ca5165f6e2d9506b0525023c452f133676258c98b0cf8b9174fcec7f71e80055

175

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x164
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.30311
MD5 f04c8948ce66feb63c8c08004ea58806
SHA1 37ab9c6366644d08865f6888b16b2918e384537e
SHA256 0937ed37feb8c7852db358320affc7402a7b066d5758ebc74cc057d89fc735d3
SHA3 88560a0728487ead9f2ca88f65841ae1a56e6470f70877116f903b1b9148b22f

176

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x19e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.24904
MD5 230078d99f755e55db5212db883353da
SHA1 682a24f6cc6f2522ea1f406aa1e9aae914d9fe90
SHA256 887a2cb600c6793104b4be2e9dfcb6c4370f61e2ea9ab6fec02d837173ba5fb5
SHA3 c11fc54f1bb2a6b861a2b9d5e25999aef146b5d4923bb8cd2055d335f143bc4e

177

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x800
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.33609
MD5 ab7acfe3a5fbf8d8e80e24ac6215864a
SHA1 636695daf928a4e4394d89b4b88bae0a4cc4f1d3
SHA256 033defd3d7b911ba2da745fb6cdcac1fa451f9731e6ac9f532c80ca816f070c1
SHA3 fb4a6821a820e71f539ed214b2dbf0309371ddbd44e32e5c6733f82f41a237d4

178

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x130
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.12855
MD5 e3683faf793246443bc5ef588edaa3c2
SHA1 27ccf70d3d39d3ef18e52c0179a1058aeaf0aac1
SHA256 004876973ff207a09220558e5e9236921ed9d4c3d9ee8efa24e3d218609d173c
SHA3 f293a1af9667dfb65d681aef90ee8d8e8ed6e92d836a8e13e61d2b305119c6d6

179

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x1cc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.19367
MD5 3ae3ec21c2e231ca7cfecc30e0dbafba
SHA1 e9078ceb507f3cfd26db1219829f8503dc27e1f6
SHA256 cd125d61d919e9baa1862d20e6f1df79363c1c64d1bea8785527a1e64ae8f4ef
SHA3 fb55caef0006046836813744fe31904d1b60c9fdbd8e5742b4b4a95e02a939ac

1 (#2)

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x304
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.4194
MD5 2077e067557ccf921a3461730befd7b3
SHA1 5a3b11b15d64d93218ddeda15738e4eb7d4d3175
SHA256 439ccc6c0756d59615ea7703bf506fe3f482f96a4024834b9e77b977003df2d0
SHA3 c2cb81cb55f010af004b36db8b48f2c7a92df44c70a2ab4c6a1775b0cbad13af

2 (#2)

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x14c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.46162
MD5 dc8a9af26da30a317687023f3fe087ac
SHA1 aea39422f2d27d25646a02190815e3e6f36ca4e4
SHA256 cf6886a8c62dfad38664889c2e1e7db02f8afd8a22475ea9c313fb5384dca908
SHA3 eb028cd89eb213b46ae514c3e0e2fa1a084f73b57cab047e464741715b6bfcd4

3 (#2)

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x140
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.40776
MD5 7d5be1d8326733bf7625fb673c9a318a
SHA1 a390f0ae4dd556dd958e99c5bfafba1e3bab4b1c
SHA256 21f68e5ab2468ececa93be69f79c8d64281ce8a42e018c727e778e398ee39129
SHA3 a2506ba0164978271c4a1a688b3c5d7b83a41d447a999ac2958d2f4eefcf6d93

65

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.56232
MD5 fe9f54ac14d37c36270747a4244c4d44
SHA1 b8a9140ef547dae061c2eb22c6d42c11f3916e0c
SHA256 b292f51f5e9083a917f6628bb9ad83da5dbff2c8bef723960eee6ea385922d6d
SHA3 cd0ba966c0bef3c3f1b6b3f70dbe8d1daea2d2fb0d37befec01e1140f3822bf1

66

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0xcc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.29275
MD5 03a40688c8d29712a5ee8a67b037120b
SHA1 c49be7495513531947707ab0e8ed5e07c5421989
SHA256 5193116b1257096963f39a7cf475f26a705fbca2df3f72bb95aa6faf3d8f6e7f
SHA3 9fbb8094366ddf6477a5e2dce171fbdd6b94323ad4441be505eed1d02fb3de53

67

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x176
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.47415
MD5 aeaee30f3971f98a788b23867fc2048e
SHA1 cf4d97e0095fcf46fd7bd7e291601dbc03a114a9
SHA256 9d555867732921e81eabd2f68a2e2f24c9e168b4db3528f88a8973e6fbf26f21
SHA3 916e78c22fc81afef7e44f561e61b8920ebfd6b7932d905865abacf9f4dc3479

68

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0xea
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.27421
MD5 458c35b7f214c3a12401a2633f50456c
SHA1 777355b5b20ff3e6bc06ba95f9c3d3714f7240f6
SHA256 f05edc1e2d014d9eb9a792adedfb67904fa7deb72d5fb92501fe7f92d20b399e
SHA3 739ee118fdeb9ef8f9c9494f3d77947a99ae855b2ad89cec59112236647a7f6b

69

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x226
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.42955
MD5 822281dd325807cbcc4f0e9c83595269
SHA1 f7a3aa3e5817da579adf44ffbe8c665f02fcc93c
SHA256 070a199e1aa16c6cae294cfe34b4e382e4bc514c1d6be71f4bcef2702dfd2817
SHA3 cebec4d3b8f92bdc4df09d8bef87ef3e1864737bbec2ba4c7506bf6dc575190b

70

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x1a6
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.4346
MD5 649b03e4a2e7f29da81d3ca094e0b9e3
SHA1 d9ba1e353ae1ef8e7c260d71ced058f8b2bee894
SHA256 08e00de964f56d3ae69759ad9657ca4a199b38a5e5877dbcf76e6c2438953946
SHA3 a99323eaa27e555411fd5d074b483c62de98d5eb8b3cda5ec9e1f4cbe05fbb60

74

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x76
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.76695
MD5 61362e3727caafd2cfbed0f6c5b78699
SHA1 9020cafe47c0a76e1e364fb0f168e49ef2508846
SHA256 bf88581069171ab54bc5011c6fc6d0e45a28b157b18c42db242906bf3ce440eb
SHA3 363693081bee18bba06c6820063718ef7b74261937546d704c049b4f820718dc

75

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x1f0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.51292
MD5 cd11f91182522b2b52e7ddf8e8c021ea
SHA1 d7a7d49ec18ebe463b58e2dfb75ea19e45beb4a1
SHA256 119060851f96ffdcb785255858ebd622d6c1dad43ab4350f06a9981c682f4153
SHA3 3f93db7eb67ca1d0b1b273422770392d67d389175a0aad3a2ebd47c85352a0a6

76

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x38
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.56933
MD5 91d3b36f7de9aa055dc053c0eda36d78
SHA1 f69817c9e148cd7f714c10c1f1c228d3dbac9ee9
SHA256 65f15a49d21ca7fca3c7c3cc8e0f9739936bcc0b789c73d758200a55e064ea4a
SHA3 3d0c9233b0009336eb2cd02bf8a2f0409acc812a4e00e1113922fbbf4e9f760e

82

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x3c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.56284
MD5 c086273f8908d189efa69d9841d3d2fc
SHA1 56d1c6dccbc4f72dd7e26e5fdecfc1b8a2430d41
SHA256 7f455fe6b3ee76661f758f6aad09bf09f127ab336371fe06d44e03fa0911f251
SHA3 50f14de06170e1d5e9107ca82465aae2f6903f87d632c2fba63acba61adf9eda

83

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x7e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.60408
MD5 6a35a26ec55d36a142413887dbe504a5
SHA1 95fc59217b2622479f1925290c76dad67aa2af83
SHA256 026e7ed0a1a629a41668f8e0091f21addcfa91867a6df2ac5ec14e665f28e43b
SHA3 bdec3f871661328188eeb47e64b2ecf0424d0c1682fb83e40528275ea5efe140

84

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x1a2
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.34332
MD5 8234b1ee22cb2ced3ee74a9d72f4bfd5
SHA1 7bc97af5559591597217a0b07e22cbbb39071493
SHA256 fe855601527076a0fae614a64de094c9780a49a53b5633ec3f725a5db7699ddd
SHA3 7b4600968bad27710908cdaf90b9365ba4d1aac3f551022e9420d368b7ea3d7c

101

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x10c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.99024
MD5 e2944da0f2a0726a00d91ff35de0c481
SHA1 9bdb530bedceb5e6c66d029d75daa96b378b5269
SHA256 c335c8e612fe0b2f87f34be35470cf85f2eab4f2289016b1beca7099ecd46e6b
SHA3 e6129d7c0c65d2d21cbf24c7677a57bc0547a7168dbfbcd6f0beff1ba350d309

102

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x260
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.19253
MD5 8df2f7b1622b40f115e3d39491212a90
SHA1 f81be800ac999b20b7d210503ab43e995806b977
SHA256 fb793d1a2d6e2ca6265094554d2dcf7c3d0571dc76ed6e649ad60864f7c6c877
SHA3 138b3de81bfb0c001a3c351aa4d33042dbfb9c650b1d136aa1e32494c179f38c

103

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x112
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.95285
MD5 0602fab9d204418d59983e8ea856c8e3
SHA1 bdd9a1cec1a37704798490721a33d23e08e58976
SHA256 ee17987783f94ecdc0ac2de7ef0ac9e4d746a00b78f5a03dc5522032eb494c7a
SHA3 4aac015a373685652c5e787f98db0a805df209c721d414146b4572ca4e8f740f

104

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0xee
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.10233
MD5 6c1aa6d4132dd1c26dbdf31b5acab2b4
SHA1 5e047035ae55d0e205fbc16485148d7404d5236d
SHA256 4c21dceacb4317737f16ed6eb7cfacd16710e69cc9ae6e68110aa150f73779b2
SHA3 2657e36187352b9550cac770699d126069632e3a9c1f28d259ba68681b06d732

105

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x74
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.68833
MD5 9841c3a8949b40f85d72e60f6524f90a
SHA1 7d183221fc37c4cc11f513379f313c9247bc2c19
SHA256 88b06e691690208c881dfabf121951b43ddb110a4bd0c9d8209122d132e0a6d7
SHA3 c7ee43d9d2d3ae10fe93573183eff193079ce38983db5770942bcf7190ce1d19
Preview

2548

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0xbe
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.07497
MD5 22dbeaef151ba6764e1e985124b9b404
SHA1 e9b145be4936a84a2815dc142e88b8acec80b71e
SHA256 6a294c1e07a3cbafb988cedf20b4309f80207e7da16d6a75c0a11f1307b73577
SHA3 7334b78dd03e04e4bde029b1851370b89a8f3d119a04e3f1195737a8cbedd348

DLLPROPERTIES

Type RT_ACCELERATOR
Language English - United States
Codepage UNKNOWN
Size 0x40
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.98407
MD5 dfc5f58c267eaebeedf1350074f84b8c
SHA1 a68174e18e7e4c52c62682e75293f0fbd801f394
SHA256 f5314c863c679a22af0d34982419709a57016cf80b5b2dd9b957816ea9bb542d
SHA3 886a15bbb69d7561ff8c69954a2a5afd40c4f79d6d7323918eae69eca74cf1a6

PROCEXPLORER (#2)

Type RT_ACCELERATOR
Language English - United States
Codepage UNKNOWN
Size 0x120
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.48622
MD5 f3df0a33af60ce7e8932dda0ca560372
SHA1 51ac0d853535ffdeadddc2806520ccb5cd73c881
SHA256 47ec7cdce358309360272fdde22e1325a4a59430c74093afa9065f0425d026c0
SHA3 c38baac9aabb853a7d41deacf1c0310a5f12d27a198fc8e044c97f8328a788ab

PROCPROPERTIES

Type RT_ACCELERATOR
Language English - United States
Codepage UNKNOWN
Size 0x70
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.16243
MD5 c40207097aab50200e36ee3f65c7ae7b
SHA1 f42efe11bd07f952ecc5e65d3c57ea5fb61f5d5a
SHA256 85951eeb99de72cb500d3a68a4ba2ed668df8c25a175f7660a5e66c7eb23acb0
SHA3 91edfd7d0190f05507af845aabe70aa1d26fb64201d7dfde7350861df4a5195c

HAND

Type RT_GROUP_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.01924
Detected Filetype Cursor file
MD5 1ae28d964ba1a2b1b73cd813a32d4b40
SHA1 8883cd93b8ef7c15928177de37711f95f9e4cd22
SHA256 ff47a48c11c234903a7d625cb8b62101909f735ad84266c98dd4834549452c39
SHA3 a85dadd416ce2d22aa291c0794c45766a0613b853c6e3b884a2b05fc791427b8
Preview

10 (#2)

Type RT_GROUP_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.01924
Detected Filetype Cursor file
MD5 48e064acaba0088aa097b52394887587
SHA1 310b283d52aa218e77c0c08db694c970378b481d
SHA256 43f40dd5140804309a4c901ec3c85b54481316e67a6fe18beb9d5c0ce3a42c3a
SHA3 38753084b0ada40269914e80dbacf7656dc94764048bd5dff649b08b700f3ed5

105 (#2)

Type RT_GROUP_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.91924
Detected Filetype Cursor file
MD5 aff0f5e372bd49ceb9f615b9a04c97df
SHA1 e3205724d7ee695f027ab5ea8d8e1a453aaad0dd
SHA256 b07e022f8ef0a8e5fd3f56986b2e5bf06df07054e9ea9177996b0a6c27d74d7c
SHA3 9cb042121a5269b80d18c3c5a94c0e453890686aedade960097752377dfa9712

106

Type RT_GROUP_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.83876
Detected Filetype Cursor file
MD5 a2baa01ccdea3190e4998a54dbc202a4
SHA1 e8217df98038141ab4e449cb979b1c3bbea12da3
SHA256 c53efa8085835ba129c1909beaff8a67b45f50837707f22dfff0f24d8cd26710
SHA3 8874564c406835306368adf5e869422e1bb97109b97c1499caa8af219990e8dc
Preview

101 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.72956
Detected Filetype Icon file
MD5 3837a9bb359de64e9d91b868200e4284
SHA1 58e39005137a40c56ecc736ec6ada8781efdb9f6
SHA256 780ad462072338895296d91ecae6c6db1980b2631d38cfc512fedcd62cbb2faf
SHA3 dbd9cdf75bea132fa938773ed248cee3c530d94480f704a56c433ec38bf5e029

110

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.32322
Detected Filetype Icon file
MD5 ae3c746814eab4a62d540a3352d76ef5
SHA1 47866acc7952d96aed994ab3da69c383c2317134
SHA256 e1296c55f8620d1404258cd580c00e81723563b843bc5e267d69c391c068f1fc
SHA3 452fd9dcc19a8a2a51a021de7e2755976097ffa2c0e84b34e88f50342f826f70

111

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.32322
Detected Filetype Icon file
MD5 5adce4c7ff83665b50c84c0745a51de9
SHA1 1e8df11e00bb21d62c736bf8aa28d490f20cf044
SHA256 808e3d73fef49a24442d61074f79ed2ae9060addd79014a221168e7a9bbb2183
SHA3 9cc3ae32e5a020fe836666407440fa37a9e4081dcf5afe50b43b250662e4fb1f

112

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.32322
Detected Filetype Icon file
MD5 a738f04a158489eb08f7076b171d83e3
SHA1 3a895635a92fb625d952cc581088984ca21d3bc3
SHA256 09c57da0ef77215a397e30ad586ae557bede7fe62e64d185dbeec541ea1e2f2c
SHA3 2089f21b09bd51fdbac7304cfc19b9940f4d47693dee6c1705126831e4b7cc35

147

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0xa0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.13746
Detected Filetype Icon file
MD5 cc8567ab9e9aef8ca033f90830848454
SHA1 f91b84ae0d07850a44e3867bf5992e63044eeb2f
SHA256 342fafbfbb1b6cdc85504b35d52a84c35263aadceea39b7b8b2bdb55b05fe9ed
SHA3 60a004d9d721df81198739ac55ddd13493359501b0dd5474d6b0c358d3b16cda

154

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x84
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.00836
Detected Filetype Icon file
MD5 6771a37e612cab992b4c2791bd08576f
SHA1 dcdcc9126ddf5bd4df535c460632db19eb699f67
SHA256 24ce16759e5587b87979c42a25fd7d8d54511864f78e03eeecb77f73f79e8a53
SHA3 1ed3ba474eb9521d6be53e8dbea94c693702e5623ca34c9610b2b9db1d5a1b09

235

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.55805
Detected Filetype Icon file
MD5 8ca8a31e5c4362b3d293fb036640c239
SHA1 0d81a6ef859724e3180b65eb97623459ab9b8873
SHA256 c43a8099c2a399bdeabf85e367e1da389c984b2067df919f0d2e0630834e499d
SHA3 7c3d1daca7b748b04a4f5d99d3af64c9a10b868c152ba5efc1f2c8ca94367bff

1 (#3)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x3bc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.48011
MD5 9eb473c3b9aa7495b1b7f1f6f43b1576
SHA1 7369a35b0989fd807f3ec998c19b993d30b71724
SHA256 6a64d023c23dcb88a3dd62cf00a1cf02483c88c40b0b08d49ad498a27f1d783c
SHA3 e4aba697005cdbf5203da27d9c230e718822bc4e35e79765237deb9e6abd6254

1 (#4)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x83c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.17407
MD5 9120768b29d2246a655abcd5ae053cd0
SHA1 9e8946ad67aa93c578ba52e3f48b138c8050cb45
SHA256 7534c1b53ace8119800b808931c5526e66f573acd401a677c239058b7845bb4b
SHA3 e076beb360f01bdb159a43c050587e0b8b51bdf51618457cf6314c317880b25c

String Table contents

Process
PID
Priority
Threads
Cycle CPU Usage
Paged Pool
Nonpaged Pool
Programs (*.exe, *.com, *.bat, *.pif)|*.exe;*.com;*.bat|Executables (*.exe)|*.exe|Command Files (*.com)|*.com|Batch Files (*.bat)|*.bat|Pif Files (*.pif)|*.pif|
There is insufficent memory to run the program
The file is not a valid executable format
Cannot find the specified file
Cannot find the specified path
Refresh process list
Handles
User Name
Handle
Type
Name
Base
Size
Version
Name
Show Unnamed Objects (Ctrl+U)
Find (Ctrl+F)
View Handles (Ctrl+H)
Time
Save (Ctrl+S)
View DLLs (Ctrl+D)
References
Parent
Window Title
Kill Process/Close Handle
Properties
Description
Access
Mapping
Refresh Now (F5)
Description
Frame
Address
Command Line
Company Name
Share
Service
Description
Display Name
Group
Privilege
Flags
Flags
Handle
Handle or DLL
Show Process Tree
CPU
Session
Variable
Value
Page Faults
Private Bytes
Path
Peak Private Bytes
Working Set
Peak Working Set
Threads
GDI Objects
USER Objects
I/O Reads
I/O Read Bytes
I/O Writes
I/O Write Bytes
I/O Other
I/O Other Bytes
Image Base
Limit
TID
Start Address
Function
User Time
Kernel Time
Start Time
CPU Time
Show Lower Pane (Ctrl+L)
Hide Lower Pane (Ctrl+L)
Show Processes From &All Users
Context Switches
CSwitch Delta
Counter
Methods Jitted
% Time in JIT
AppDomains
Assemblies
Classes Loaded
Total AppDomains
Total Assemblies
Total Classes Loaded
Total Lock Contentions
Heap Bytes
Gen 0 Collections
Gen 1 Collections
Gen 2 Collections
% Time in GC
Allocated Bytes/s
Runtime Checks
Contentions
Path
Find Handle (Ctrl+F)
Find Handle or DLL (Ctrl+F)
Virtual Size
WS Total
WS Private
WS Shared
PF Delta
Comment
PROCEXPLORER
Process Explorer
Local Address
Object Address
Remote Address
Verified Signer
State
Protocol
Image Type
CPU History
Private Delta Bytes
Private Bytes History
Share Flags
Cycles
Window Status
Find &Window's Process (drag over window)
System Information (Ctrl+I)
DEP
Cycles Delta
Decoded Access
WS Shareable
I/O Delta Reads
I/O Delta Read Bytes
I/O Delta Writes
I/O Delta Write Bytes
I/O History
I/O Delta Other Bytes
I/O Delta Total Bytes
I/O Delta Other
Integrity
Virtualized
ASLR
Memory Priority
I/O Priority
Min Working Set
Max Working Set
Service
Network Receives
Network Delta Receives
Network Sends
Network Delta Sends
Network Other
Network Delta Others
Network History
Network Delta Receive Bytes
Network Receive Bytes
Network Send Bytes
Network Delta Send Bytes
Network Other Bytes
Network Delta Other Bytes
Network Delta Total Bytes
Disk Reads
Disk Delta Reads
Disk Writes
Disk Delta Writes
Disk Other
Disk Delta Others
Disk History
Disk Read Bytes
Disk Delta Read Bytes
Disk Write Bytes
Disk Delta Write Bytes
Disk Other Bytes
Disk Delta Other Bytes
Disk Delta Total Bytes
Tree CPU Usage
Processor
GPU
GPU System Bytes
GPU Dedicated Bytes
GPU Committed Bytes
Package Name
Process Timeline
Autostart Location
DPI Awareness
VirusTotal
Protection
UI Access
Provider Name
Namespace
DLL Path
Control Flow Guard
Suspend Count
Enterprise Context

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 16.22.0.0
ProductVersion 16.22.0.0
FileFlags VS_FF_PRIVATEBUILD
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName Sysinternals - www.sysinternals.com
FileDescription Sysinternals Process Explorer
FileVersion (#2) 16.22
InternalName Process Explorer
LegalCopyright Copyright © 1998-2018 Mark Russinovich
LegalTrademarks Copyright (C) 1998-2018 Mark Russinovich
OriginalFilename Procexp.exe
ProductName Process Explorer
ProductVersion (#2) 16.22
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2018-Nov-16 23:19:59
Version 0.0
SizeofData 68
AddressOfRawData 0xdc608
PointerToRawData 0xdba08
Referenced File C:\agent\_work\68\s\exe\Release\procexp.pdb

TLS Callbacks

Load Configuration

Size 0x48
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x4ef5a0
SEHandlerTable 0x4dd790
SEHandlerCount 204

RICH Header

XOR Key 0xc30cd78c
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 2
ASM objects (VS2013 build 21005) 30
C++ objects (VS2013 build 21005) 78
C objects (VS2013 build 21005) 222
C++ objects (20806) 7
C objects (VS2012 build 50727 / VS2005 build 50727) 9
C objects (VS2008 SP1 build 30729) 1
C++ objects (VS2012 build 50727 / VS2005 build 50727) 1
Imports (VS2012 build 50727 / VS2005 build 50727) 49
Total imports 615
C objects (VS2013 UPD5 build 40629) 2
C++ objects (VS2013 UPD5 build 40629) 63
Resource objects (VS2013 build 21005) 1
151 1
Linker (VS2013 UPD5 build 40629) 1

Errors