aa50c08930fd50e524acadf23a4ec682

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2021-Feb-09 10:31:17
Detected languages English - United Kingdom
FileVersion 3.3.14.5
Comments http://www.autoitscript.com/autoit3/
FileDescription On Terminal, please type : callmeplease
ProductVersion 3.3.14.5
LegalCopyright ©1999-2018 Jonathan Bennett & AutoIt Team

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Suspicious Strings found in the binary may indicate undesirable behavior: Is an AutoIT compiled script:
  • AutoIt Error
  • reserved for AutoIt internal use
Contains domain names:
  • autoitscript.com
  • http://www.autoitscript.com
  • http://www.autoitscript.com/autoit3/
  • www.autoitscript.com
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses known Mersenne Twister constants
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
  • LoadLibraryExW
  • LoadLibraryW
Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
  • FindWindowW
Code injection capabilities:
  • OpenProcess
  • VirtualAllocEx
  • WriteProcessMemory
  • VirtualAlloc
Code injection capabilities (PowerLoader):
  • FindWindowW
  • GetWindowLongW
Can access the registry:
  • RegisterHotKey
  • RegEnumValueW
  • RegDeleteValueW
  • RegDeleteKeyW
  • RegEnumKeyExW
  • RegSetValueExW
  • RegOpenKeyExW
  • RegCloseKey
  • RegQueryValueExW
  • RegCreateKeyExW
Possibly launches other programs:
  • CreateProcessW
  • CreateProcessAsUserW
  • CreateProcessWithLogonW
  • ShellExecuteW
Can create temporary files:
  • CreateFileW
  • GetTempPathW
Uses functions commonly found in keyloggers:
  • GetAsyncKeyState
  • AttachThreadInput
  • MapVirtualKeyW
  • GetForegroundWindow
Has Internet access capabilities:
  • InternetQueryDataAvailable
  • InternetCloseHandle
  • InternetOpenW
  • InternetSetOptionW
  • InternetCrackUrlW
  • InternetQueryOptionW
  • InternetOpenUrlW
  • InternetReadFile
  • InternetConnectW
Functions related to the privilege level:
  • AdjustTokenPrivileges
  • OpenProcessToken
  • DuplicateTokenEx
  • CheckTokenMembership
Enumerates local disk drives:
  • GetDriveTypeW
  • GetVolumeInformationW
Manipulates other processes:
  • OpenProcess
  • WriteProcessMemory
  • ReadProcessMemory
  • Process32FirstW
  • Process32NextW
Can take screenshots:
  • FindWindowW
  • GetDC
  • CreateCompatibleDC
Reads the contents of the clipboard:
  • GetClipboardData
Can shut the system down or lock the screen:
  • ExitWindowsEx
  • InitiateSystemShutdownExW
Info The PE's resources present abnormal characteristics. Resource SCRIPT is possibly compressed or encrypted.
Malicious VirusTotal score: 8/64 (Scanned on 2022-06-20 10:38:20) Bkav: W32.AIDetect.malware2
VirIT: Trojan.Win32.Genus.CUHH
Elastic: malicious (moderate confidence)
Kaspersky: Trojan.Win32.Agent.xaluvl
McAfee-GW-Edition: BehavesLike.Win32.Injector.ch
Kingsoft: Win32.Troj.Undef.(kcloud)
McAfee: Artemis!AA50C08930FD
VBA32: Backdoor.Wemosis

Hashes

MD5 aa50c08930fd50e524acadf23a4ec682
SHA1 4dc0faf1a675a8fbb083ab8fc232b3701f4b3b58
SHA256 1170894a6eb3c54880555638c6d7f1129ad18207fbdc5e32b2a8a2b3e5982809
SHA3 ea77b07faa8aec2fb0ee6ca03460047b702020243bdf628eea195d48c875d0bc
SSDeep 24576:jAHnh+eWsN3skA4RV1Hom2KXMmHaDNkb5:uh+ZkldoPK8YaDe
Imports Hash afcdf79be1557326c854b6e20cb900a7

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x110

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2021-Feb-09 10:31:17
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32
LinkerVersion 12.0
SizeOfCode 0x8e000
SizeOfInitializedData 0x4ac00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0002800A (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x8f000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.1
ImageVersion 0.0
SubsystemVersion 5.1
Win32VersionValue 0
SizeOfImage 0xdf000
SizeOfHeaders 0x400
Checksum 0xde747
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x400000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x400000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 310e36668512d53489c005622bb1b4a9
SHA1 8fb8e840c9e17486aac8a936bb9f4b4e97968eba
SHA256 3978cc62b69ced82d20d17cf1a21f3df483172b58e56d5fbd2bc9ea2a2d5d881
SHA3 b1e5f92eaba5ddd0b4b6af72ed26401b9b0935f9aa02f5474cc23639fe9e7bac
VirtualSize 0x8dfdd
VirtualAddress 0x1000
SizeOfRawData 0x8e000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.67525

.rdata

MD5 748cf1ab2605ce1fd72d53d912abb68f
SHA1 b14ea463e0ffca634d7b7ce1f680dcc6cd161f68
SHA256 1c69247833efc222dcaa09342032656ef5b89d7157746ad35a807c8c52eb2799
SHA3 d5369fc84ea2e78a22d37820d1baece6975ea27e02e1e848c8b165a8a86f91ae
VirtualSize 0x2fd8e
VirtualAddress 0x8f000
SizeOfRawData 0x2fe00
PointerToRawData 0x8e400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.76324

.data

MD5 aae9601d920f07080bdfadf43dfeff12
SHA1 3f68d00ffdc01d075cc78b7b0456ef541378b876
SHA256 905f5100fff55d7bc415d0c25c20c531b9ac9ff81d42768131fa05bdc9c43d9b
SHA3 c62d4b67634f28c8f9920beab4377a4aee75951c01df130df7b76ea9931b728d
VirtualSize 0x8f74
VirtualAddress 0xbf000
SizeOfRawData 0x5200
PointerToRawData 0xbe200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.19638

.rsrc

MD5 9d24fec401fcdb77bb6dbd01c21c81ac
SHA1 fa67bccdf083e49f5dc5ae41c05d07089c826e13
SHA256 8aee4ca48083fda03e27fff1c3fe27d6e8003341334243f3769ddb1d40f9e63c
SHA3 c6e695aa132306c16edc6ad3d7093d0bab5303e14b126290f70606f10a2dd15b
VirtualSize 0xe8c4
VirtualAddress 0xc8000
SizeOfRawData 0xea00
PointerToRawData 0xc3400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.4918

.reloc

MD5 f04128ad0f87f42830e4a6cdbc38c719
SHA1 fba981637586f66a796fa0725a0a530f39ed875a
SHA256 e3f17f85d044b0544b8d3a536010d95d6d4e26759b2c706ce416fa6250fd8dbd
SHA3 9f7f2d280f703a8d6e9821660783261c959dc443898f90d169a9bcaebd34e9ea
VirtualSize 0x7134
VirtualAddress 0xd7000
SizeOfRawData 0x7200
PointerToRawData 0xd1e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.78396

Imports

WSOCK32.dll WSACleanup
socket
inet_ntoa
setsockopt
ntohs
recvfrom
ioctlsocket
htons
WSAStartup
__WSAFDIsSet
select
accept
listen
bind
closesocket
WSAGetLastError
recv
sendto
send
inet_addr
gethostbyname
gethostname
connect
VERSION.dll GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
WINMM.dll timeGetTime
waveOutSetVolume
mciSendStringW
COMCTL32.dll ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
InitCommonControlsEx
ImageList_Create
MPR.dll WNetUseConnectionW
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
WININET.dll InternetQueryDataAvailable
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetQueryOptionW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetReadFile
InternetConnectW
PSAPI.DLL GetProcessMemoryInfo
IPHLPAPI.DLL IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho
USERENV.dll DestroyEnvironmentBlock
UnloadUserProfile
CreateEnvironmentBlock
LoadUserProfileW
UxTheme.dll IsThemeActive
KERNEL32.dll DuplicateHandle
CreateThread
WaitForSingleObject
HeapAlloc
GetProcessHeap
HeapFree
Sleep
GetCurrentThreadId
MultiByteToWideChar
MulDiv
GetVersionExW
IsWow64Process
GetSystemInfo
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
lstrlenW
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
SetEndOfFile
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
SetCurrentDirectoryW
GetLongPathNameW
GetShortPathNameW
DeleteFileW
FindNextFileW
CopyFileExW
MoveFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
EnumResourceNamesW
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
GetLocalTime
CompareStringW
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
LoadLibraryExW
FindResourceExW
CopyFileW
VirtualFree
FormatMessageW
GetExitCodeProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetSystemDirectoryW
HeapReAlloc
HeapSize
GetComputerNameW
GetWindowsDirectoryW
GetCurrentProcessId
GetProcessIoCounters
CreateProcessW
GetProcessId
SetPriorityClass
LoadLibraryW
VirtualAlloc
IsDebuggerPresent
GetCurrentDirectoryW
lstrcmpiW
DecodePointer
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
GetCurrentThread
CloseHandle
GetFullPathNameW
EncodePointer
ExitProcess
GetModuleHandleExW
ExitThread
GetSystemTimeAsFileTime
ResumeThread
GetCommandLineW
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetStringTypeW
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
RtlUnwind
ReadConsoleW
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
FindClose
SetEnvironmentVariableA
USER32.dll AdjustWindowRectEx
CopyImage
SetWindowPos
GetCursorInfo
RegisterHotKey
ClientToScreen
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DrawMenuBar
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
CallWindowProcW
ReleaseCapture
SetCapture
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
TrackPopupMenuEx
GetCursorPos
DeleteMenu
SetRect
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
MonitorFromRect
keybd_event
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowLongW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetWindowTextW
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
GetUserObjectSecurity
MessageBoxW
DefWindowProcW
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
GetMessageW
LockWindowUpdate
DispatchMessageW
TranslateMessage
PeekMessageW
UnregisterHotKey
CheckMenuRadioItem
CharLowerBuffW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
SystemParametersInfoW
LoadImageW
GetClassNameW
GDI32.dll StrokePath
DeleteObject
GetTextExtentPoint32W
ExtCreatePen
GetDeviceCaps
EndPath
SetPixel
CloseFigure
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
StretchBlt
GetDIBits
LineTo
AngleArc
MoveToEx
Ellipse
DeleteDC
GetPixel
CreateDCW
GetStockObject
GetTextFaceW
CreateFontW
SetTextColor
PolyDraw
BeginPath
Rectangle
SetViewportOrgEx
GetObjectW
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
StrokeAndFillPath
COMDLG32.dll GetOpenFileNameW
GetSaveFileNameW
ADVAPI32.dll GetAce
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegConnectRegistryW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
RegCreateKeyExW
FreeSid
GetTokenInformation
GetSecurityDescriptorDacl
GetAclInformation
AddAce
SetSecurityDescriptorDacl
GetUserNameW
InitiateSystemShutdownExW
SHELL32.dll DragQueryPoint
ShellExecuteExW
DragQueryFileW
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateShellItem
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish
ole32.dll CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoCreateInstance
IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoInitialize
CoUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CoGetObject
CoSetProxyBlanket
CoCreateInstanceEx
CoInitializeSecurity
OLEAUT32.dll LoadTypeLibEx
VariantCopyInd
SysReAllocString
SysFreeString
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayAllocData
SafeArrayAllocDescriptorEx
SafeArrayCreateVector
RegisterTypeLib
CreateStdDispatch
DispCallFunc
VariantChangeType
SysStringLen
VariantTimeToSystemTime
VarR8FromDec
SafeArrayGetVartype
VariantCopy
VariantClear
OleLoadPicture
QueryPathOfRegTypeLib
RegisterTypeLibForUser
UnRegisterTypeLibForUser
UnRegisterTypeLib
CreateDispTypeInfo
SysAllocString
VariantInit

Delayed Imports

1

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.66371
MD5 d6f27bf763eb666af934477958acf362
SHA1 f724ee386cda31b32b5c88e08b9abf562c016a57
SHA256 62ba0b2575098d4428c9a99bd060ef7572071698bf9d03b4bd430f5f691378e5
SHA3 6f4a250c7a91ddfcc872e14b8ed1e4aa33a5ebb3280f7d021b47aa46edfb9586

2

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.05883
MD5 78f30e363a0499f530d057b4d639d36e
SHA1 360bd6476101b0cddc23d2c7eade326c1b16ceaf
SHA256 08bcba5aa989c988ea18f8101c84daaee58d4f0b584535a85186c8b98b66147e
SHA3 001ac9f6e8e52f9c3eb7101189fb953e2f4babfdea5b6e26b23b99173af38de4

3

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.25499
MD5 ad424f5f5d5ff4460343686c61e4f75e
SHA1 29a1f0faadc42f1b9f9767d8c724fdc58dd165c8
SHA256 245fc49e4e955e1db3975b826dcf27ad2eb32a6831caa4cb6b501a3914bcfaa9
SHA3 4f3a627ee7d533397f7f5c70bb2dafa8857150e674cb31edd96949c7905de509

4

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.65355
MD5 60719bac037d0712f35c5c90be495c9d
SHA1 a3041d7ee6ba7615452806f77a1c943595c21191
SHA256 30d1e986d0b31def6f13e53ff02c031bfbefcf963d61d5ad650b172ad7e860c7
SHA3 20b10baff88665c15ede11f5f30b5422805da2105be8358b0a1b3a41e89b13c6

5

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.43704
MD5 982c00bdd1b0ecc4c6ae5e68d8f1b87a
SHA1 489bbfba215b27140f141a2f394b0e65062cf357
SHA256 4035501adf394316fef967f0a20eedbf34126242bbeb9cbaad501af59aebd797
SHA3 84b3279e6fdd3055caf0f08cad67c578b24c6efc055823442d2d8a2f4a3cf547

6

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.16139
MD5 9366bb6f5fa80ec08957cad372d3facc
SHA1 16ceb7528f7b4306ecc56beb210331e415759c79
SHA256 7b310c0be8d06ce48affcc4f9aed1c0d788031b2a2f4ae57b69b66234a20d812
SHA3 471da3b7ffcb18564e3e4540ccbf2367ea343c40f28eab72e41caa70f1cd8871

7

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.07494
MD5 82837923a319386e182d74bceffdcd9a
SHA1 23bef5e2545d16d60bd84c8dc592698c6d6e9ca5
SHA256 34b88a55636fba814081ad56bda0f029a6a48647de3c0aa7c01ed483e8829832
SHA3 082d792ee6346e3ba3fcbc617a8365f6f5a4a32d518afee86445eef4fdfb5eca

8

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.18302
MD5 68d9845aa5d81b5ec9af61f410e35b16
SHA1 792b2a2e934bea082f9fa18aecc9cf7c56fec0cb
SHA256 e3462f80eb7b3b4010ea0ab4fb82033a565632230555ec565e1ee7ae8c01c04f
SHA3 3fbf18c6eae48b380506d26d691dd958d8d6c215e0c66402ea65e822fafc4da1

9

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.52312
MD5 2a1613d0845d00b916aa58adf0d41788
SHA1 9b80e5a340e2b46e6c1d1f5cdc71f70987a6362e
SHA256 c3a9d3b89fe9d0197f5d20a9a00f2e69c9218c57b95f21bd16d193d264725d1d
SHA3 6be13a8f2c46fc7d016e5e1338619a9c6aab8a2538fb392ad95ca1860d53663d

10

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.65168
MD5 9ea19e6905b73670bf173b6ed270f52d
SHA1 0990bc33abfc67bf30fa225c39caac330248ce4e
SHA256 1d07a182ee09e1ae5120d258c03c8cdd17797e00bca1e3c4d923b03c37c7cf1a
SHA3 6f95f1bd2ea42683b37b905d1215789ccae50a552cdf454d0f859234f5789216

11

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.39178
MD5 37ead5d2c4490f465242d3a884f19c37
SHA1 144dbce865b6cfccb00c3a1f2767639b166d90c7
SHA256 e11a688c6e3fecdb7bcdccaa350aa6fb9bffa50e81751ce4c38b6a26db692634
SHA3 97917334c00067d77ca349a361aeb6c9408e4dfda72615f0735be852c777ccf0

166

Type RT_MENU
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x50
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.68292
MD5 8140596ab00b98a11c13e6977d2d0977
SHA1 58abc231c2b5ac778a543a5dffcfabe867a6758d
SHA256 54f5e2ecbfc4f87380ca7466337676b99d0c4a21f806cf83f69fd48934c857ab
SHA3 7ccd3005ef4a3eccdb793d3b975a2f09338df5922357428238910610c0c59b70

7 (#2)

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x594
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.34702
MD5 d1f824f98742295a66a25225701dd6d8
SHA1 5b2075b778387182bf97314b593e73f30853435d
SHA256 4fe35e21717d34ceb4717f9e9de8fde1b3de80d76a59bb87405910c2f1d6284b
SHA3 294fc9961bf6eddc1dc7c5b525832f8aa8d3e90dac608e6421398510ab9c15b1

8 (#2)

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x68a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.2817
MD5 5beaeebda5346956e395fad21661f382
SHA1 201f2f699e6917e953821d64105b226fdd8b5528
SHA256 9306910d4bb273465765832df77fb1fd78bd6e0bcbf9908636e323c34c92b613
SHA3 d6430a84edfc22e41b15dd4f7cfc2d249bf5a637189d9284f062644b1503f9ee

9 (#2)

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x490
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.28849
MD5 6b12d17c7622d8215889a2288098fa15
SHA1 a511bf459e5043fcb234829bf66a99565c244652
SHA256 e47fa3aec12353f6370b941bc5855e5551530c7b26f925b5a2e2692a0201450c
SHA3 8e3541de418e1046806ffb977c8babecd093b9816c92883261b074d1c47d96fb

10 (#2)

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x5fc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.28373
MD5 949955dbda367f0c790615f7817e7886
SHA1 ee0370fb4ad59a4cebc3dbfc83bb437343fb803b
SHA256 4854e5abce2237256df24b69c9759fc1e8caa423a54bfe661ba7031afd8375eb
SHA3 5e36df684c6f2c4058d1a2507989eb5fc3c873159d006088d40f4da3804f56f2

11 (#2)

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x65c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.26322
MD5 9bc568a6176f738ffb3109e53235b579
SHA1 b97786555bfa05f958f174e294080e235d91b571
SHA256 d38369002e36f73866a0d40b13e069b9ffdbda50957f4c88d52a72fecb9b4e45
SHA3 94318c553eb0928412a92e8cf9913ca5c35a03aa8c24bf151a6764793b2f6f90

12

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x466
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.25812
MD5 899b8766aea5f88410c721620925754b
SHA1 53ba98192d7ea4fa9051ac220ed18960ab0507a6
SHA256 58ea125e6b5fa2cbc5a8ed819c7f50c9bca1cfe55f94c7cff3feb60f25ac6073
SHA3 7ad4457a556ba648b1d46e62549fdc4c7d093bbad286f9123daf6a94f0e5af62

313

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x158
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.08572
MD5 193a9143563395ad14c6dac83d32e2ad
SHA1 87ca08eb609f9ceabbd8ea7a64263de9a05bbb22
SHA256 b3711acbe8e01fee7fd362112b4e42da05c728e98b85c0a3b4cb075977849cee
SHA3 7634b4daca191c6fa53de1d5964fa47f382afccebf5744e70a702fd179fad715

SCRIPT

Type RT_RCDATA
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x59cc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.99324
MD5 84b7af9f042c4100f3a7ce2a67a9a76e
SHA1 7f1091479b4896d015b531cefb4f808d149b9d48
SHA256 8ececa014b68306581f6cef1d6ae306306c4fd47c75a42be06eb8e85e759d2f8
SHA3 5ac0b8584f630dae10db49675e43d413c78ca3ab55ad08f455c43717bd6a3177

99

Type RT_GROUP_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x76
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.8695
Detected Filetype Icon file
MD5 c88fc27c85891ac172b4d141b24c12ad
SHA1 342ea9dc007660254454fef30878c99bb3f9b525
SHA256 d886ef46aff4ad878304045ca0de6c140dac34f39440a4fa421968522ec6398b
SHA3 8b6669089819d1c4a15a968c334b83ee57e42664e4d850e8a37e958e1deeb036

162

Type RT_GROUP_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.02322
Detected Filetype Icon file
MD5 7a9605cb416b1a091d889b9d9f37ec66
SHA1 866c01641d672b6cd69901c1e055f174f47b35bb
SHA256 6bcce1250099cc08d574211b3debabb0244cd2641f6d960538e7ddc97d319164
SHA3 af43e622bf6c842d1ada2985f8e68920ff7b22d8a0b1a12871968c23b5065651

164

Type RT_GROUP_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.84274
Detected Filetype Icon file
MD5 f64c60b749269fcf6659c450dda98486
SHA1 42945c3496bc4e1943a1a05926a9b5ee31d3e450
SHA256 ae172a9a2fd008910b537c92a95b38bfba0e5bbdaaca719bf686e6415a7a2ba1
SHA3 443830acdeb37f2b7f844756492b2b11f9fb93e9171617d8c799cebfd05cb37f

169

Type RT_GROUP_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.02322
Detected Filetype Icon file
MD5 60f05e3b8ea9e18928923bdbcc112277
SHA1 d97726a6e9c326a37507f879feca7e152157839c
SHA256 7698ef362b288a7e3b96304ca50814b42518cba38598db9dbb36d8b90212d76a
SHA3 390fd88c6012552aecc7f109e733a1bf00339b8b3758127752832484c9f13ce6

1 (#2)

Type RT_VERSION
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x29c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.48651
MD5 4629be0df0f7c02fa254e8b0320753d4
SHA1 83a8d925d034727819a0249cae826101ea760f62
SHA256 56b8579363d305f23793d8040d164fd599d5a72e3a27274754f49157aa20768d
SHA3 a848ea93fa11a9836e33b38cf3aac02ce7b5d72f6f6e9dae767915ac2c8ae58c

1 (#3)

Type RT_MANIFEST
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x3ef
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.40026
MD5 a8983985aa631a15210e820fc8e1e52e
SHA1 fed4e5d714e5b12f8a61604ba61eaf6e2bee2fbd
SHA256 1bd8139910a81485aadb0bb28586e233768486de8c09f6a565ae457805702d39
SHA3 8582ac809cc76ad6f98d859f53bd4eed751c5aeb31783f353e10875eae68ce64

String Table contents

(Paused)
AutoIt Error
AutoIt has detected the stack has become corrupt.
Stack corruption typically occurs when either the wrong calling convention is used or when the function is called with the wrong number of arguments.
AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.
"EndWith" missing "With".
Badly formatted "Func" statement.
"With" missing "EndWith".
Missing right bracket ')' in expression.
Missing operator in expression.
Unbalanced brackets in expression.
Error in expression.
Error parsing function call.
Incorrect number of parameters in function call.
"ReDim" used without an array variable.
Illegal text at the end of statement (one statement per line).
"If" statement has no matching "EndIf" statement.
"Else" statement with no matching "If" statement.
"EndIf" statement with no matching "If" statement.
Too many "Else" statements for matching "If" statement.
"While" statement has no matching "Wend" statement.
"Wend" statement with no matching "While" statement.
Variable used without being declared.
Array variable has incorrect number of subscripts or subscript dimension range exceeded.
Variable subscript badly formatted.
Subscript used on non-accessible variable.
Too many subscripts used for an array.
Missing subscript dimensions in "Dim" statement.
No variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.
Expected a "=" operator in assignment statement.
Invalid keyword at the start of this line.
Array maximum size exceeded.
"Func" statement has no matching "EndFunc".
Duplicate function name.
Unknown function name.
Unknown macro.
Unable to get a list of running processes.
Invalid element in a DllStruct.
Unknown option or bad parameter specified.
Unable to load the internet libraries.
"Struct" statement has no matching "EndStruct".
Unable to open file, the maximum number of open files has been exceeded.
"ContinueLoop" statement with no matching "While", "Do" or "For" statement.
Invalid file filter given.
Expected a variable in user function call.
"Do" statement has no matching "Until" statement.
"Until" statement with no matching "Do" statement.
"For" statement is badly formatted.
"Next" statement with no matching "For" statement.
"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.
"For" statement has no matching "Next" statement.
"Case" statement with no matching "Select"or "Switch" statement.
"EndSelect" statement with no matching "Select" statement.
Recursion level has been exceeded - AutoIt will quit to prevent stack overflow.
Cannot make existing variables static.
Cannot make static variables into regular variables.
Badly formated Enum statement
This keyword cannot be used after a "Then" keyword.
"Select" statement is missing "EndSelect" or "Case" statement.
"If" statements must have a "Then" keyword.
Badly formated Struct statement.
Cannot assign values to constants.
Cannot make existing variables into constants.
Only Object-type variables allowed in a "With" statement.
"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.
Object referenced outside a "With" statement.
Nested "With" statements are not allowed.
Variable must be of type "Object".
The requested action with this object has failed.
Variable appears more than once in function declaration.
ReDim array can not be initialized in this manner.
An array variable can not be used in this manner.
Can not redeclare a constant.
Can not redeclare a parameter inside a user function.
Can pass constants by reference only to parameters with "Const" keyword.
Can not initialize a variable with itself.
Incorrect way to use this parameter.
"EndSwitch" statement with no matching "Switch" statement.
"Switch" statement is missing "EndSwitch" or "Case" statement.
"ContinueCase" statement with no matching "Select"or "Switch" statement.
Assert Failed!
Obsolete function/parameter.
Invalid Exitcode (reserved for AutoIt internal use).
Variable cannot be accessed in this manner.
Func reassign not allowed.
Func reassign on global level not allowed.
Unable to parse line.
Unable to open the script file.
String missing closing quote.
Badly formated variable or macro.
Missing separator character after keyword.

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 3.3.14.5
ProductVersion 3.3.14.5
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_UNKNOWN
Language English - United Kingdom
FileVersion (#2) 3.3.14.5
Comments http://www.autoitscript.com/autoit3/
FileDescription On Terminal, please type : callmeplease
ProductVersion (#2) 3.3.14.5
LegalCopyright ©1999-2018 Jonathan Bennett & AutoIt Team
Resource LangID English - United Kingdom

IMAGE_DEBUG_TYPE_RESERVED

Characteristics 0
TimeDateStamp 2018-Mar-15 13:14:39
Version 0.0
SizeofData 4
AddressOfRawData 0xb6f18
PointerToRawData 0xb6318

TLS Callbacks

Load Configuration

Size 0x48
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x4bfd50
SEHandlerTable 0
SEHandlerCount 0

RICH Header

XOR Key 0xc1fc1252
Unmarked objects 0
C++ objects (20806) 2
199 (41118) 1
ASM objects (VS2013 build 21005) 51
C objects (VS2013 build 21005) 177
C++ objects (VS2013 build 21005) 53
C objects (VS2008 SP1 build 30729) 9
Imports (VS2008 SP1 build 30729) 37
Total imports 544
234 (VS2013 UPD5 build 40629) 80
ASM objects (VS2013 UPD5 build 40629) 1
Resource objects (VS2013 build 21005) 1
151 1
Linker (VS2013 UPD5 build 40629) 1

Errors

<-- -->