b846719e234b5697da4bf0f0e2ac632d

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2021-Mar-20 21:43:08
Detected languages English - United Kingdom

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Is an AutoIT compiled script:
  • AutoIt Error
  • reserved for AutoIt internal use
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
  • LoadLibraryExW
  • LoadLibraryW
Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
  • FindWindowW
Code injection capabilities:
  • OpenProcess
  • VirtualAllocEx
  • WriteProcessMemory
  • VirtualAlloc
Code injection capabilities (PowerLoader):
  • GetWindowLongW
  • FindWindowW
Can access the registry:
  • RegisterHotKey
  • RegEnumValueW
  • RegDeleteValueW
  • RegDeleteKeyW
  • RegEnumKeyExW
  • RegSetValueExW
  • RegOpenKeyExW
  • RegCloseKey
  • RegQueryValueExW
  • RegCreateKeyExW
Possibly launches other programs:
  • CreateProcessW
  • CreateProcessAsUserW
  • CreateProcessWithLogonW
  • ShellExecuteW
Can create temporary files:
  • CreateFileW
  • GetTempPathW
Uses functions commonly found in keyloggers:
  • GetAsyncKeyState
  • AttachThreadInput
  • MapVirtualKeyW
  • GetForegroundWindow
Has Internet access capabilities:
  • InternetQueryDataAvailable
  • InternetCloseHandle
  • InternetOpenW
  • InternetSetOptionW
  • InternetCrackUrlW
  • InternetQueryOptionW
  • InternetOpenUrlW
  • InternetReadFile
  • InternetConnectW
Functions related to the privilege level:
  • AdjustTokenPrivileges
  • OpenProcessToken
  • DuplicateTokenEx
  • CheckTokenMembership
Enumerates local disk drives:
  • GetDriveTypeW
  • GetVolumeInformationW
Manipulates other processes:
  • OpenProcess
  • WriteProcessMemory
  • ReadProcessMemory
  • Process32FirstW
  • Process32NextW
Can take screenshots:
  • GetDC
  • FindWindowW
  • CreateCompatibleDC
Reads the contents of the clipboard:
  • GetClipboardData
Can shut the system down or lock the screen:
  • ExitWindowsEx
  • InitiateSystemShutdownExW
Info The PE's resources present abnormal characteristics. Resource SCRIPT is possibly compressed or encrypted.
Malicious VirusTotal score: 29/71 (Scanned on 2021-03-22 03:50:03) MicroWorld-eScan: AIT.Heur.Acapulco.11.10213072.Gen
McAfee: Artemis!B846719E234B
Cylance: Unsafe
Alibaba: Trojan:AutoIt/Acapulco.e33de978
Cybereason: malicious.e234b5
Avast: FileRepMalware
Kaspersky: HEUR:Trojan.Win32.AutoIt.gen
BitDefender: AIT.Heur.Acapulco.11.10213072.Gen
Ad-Aware: AIT.Heur.Acapulco.11.10213072.Gen
Sophos: Generic Reputation PUA (PUA)
McAfee-GW-Edition: BehavesLike.Win64.TrojanAitInject.th
FireEye: AIT.Heur.Acapulco.11.10213072.Gen
Emsisoft: AIT.Heur.Acapulco.11.10213072.Gen (B)
GData: AIT.Heur.Acapulco.11.10213072.Gen
Avira: TR/AutoIt.vwixb
Gridinsoft: Trojan.Win64.Downloader.sa
Arcabit: AIT.Heur.Acapulco.11.10213072.Gen
AegisLab: Trojan.Win32.AutoIt.4!c
Microsoft: Trojan:Win32/Wacatac.B!ml
Cynet: Malicious (score: 90)
ALYac: AIT.Heur.Acapulco.11.10213072.Gen
MAX: malware (ai score=88)
TrendMicro-HouseCall: TROJ_GEN.R002H09CK21
Ikarus: Trojan.AutoIt.Acapulco
MaxSecure: Trojan.Malware.300983.susgen
Fortinet: W32/AutoIt!tr
AVG: FileRepMalware
CrowdStrike: win/malicious_confidence_60% (W)
Qihoo-360: Win64/Worm.AutoIt.H8oAChsA

Hashes

MD5 b846719e234b5697da4bf0f0e2ac632d
SHA1 209d9c97f894504ed30e9405c4f557b444258822
SHA256 1679b1c83a99fb76b6c5f0afa25104506ea00be5bb551449d46579467bcc6d53
SHA3 f3554ae696cc99241efb1a76a3921af5644883fa75674b1a54a0ce84e07d63b4
SSDeep 24576:xRaZROMOm8FN7TjsPnzt2heeRhQbJEOeamgHLmeuZdwYkU:rkxOm+7TjsPnztyDMmabrmhH
Imports Hash 161c85364c462057ba28801ac1ad5404

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x110

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2021-Mar-20 21:43:08
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 12.0
SizeOfCode 0xa8400
SizeOfInitializedData 0x7f800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000002FB2C (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.2
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x131000
SizeOfHeaders 0x400
Checksum 0x135e1f
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x400000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x400000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d22c47808f41c214f3a2f4857b850834
SHA1 d4dd0ca9042e7a767a53c5a692d9778ffe0abbce
SHA256 52bcb8d13a9eeee6874b2a44138cbb1ee59279b72058256887cb6a7056a3e310
SHA3 4df4cd318977459afbc988a80b6cc6c1991cb1458f70d7061c9c1e060c612a32
VirtualSize 0xa8285
VirtualAddress 0x1000
SizeOfRawData 0xa8400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.51159

.rdata

MD5 949f2633dfa964890f744be0550025fc
SHA1 ad0ef3a6989a2d160bc3da1ed5ba15d68cd32515
SHA256 22e958fa463a7c3c0eea60cfa025bfa0fdfad5b0d88d54357687dabf83652419
SHA3 e68776e45ea99abf43eec8330602cf58a1281382839a785e88ed1cef143b505c
VirtualSize 0x31808
VirtualAddress 0xaa000
SizeOfRawData 0x31a00
PointerToRawData 0xa8800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.29127

.data

MD5 eb799336609d36706092ae6ef79815ab
SHA1 345bd308814bf98f58b5f75ada21e364123f6d7b
SHA256 b1489f60c63851b4fd06fe6b955daa3416362c26b318f5f3118412f8d6c4eea6
SHA3 4e36306ca514089f7cd1e9e191530ad07536e4a020e66cdeed9c96293319ea01
VirtualSize 0xb230
VirtualAddress 0xdc000
SizeOfRawData 0x5e00
PointerToRawData 0xda200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.15892

.pdata

MD5 3230a8be94db766f0360be9d58c01b2d
SHA1 5394f0b95722a7cd63cf049e21597971263fbde7
SHA256 726db1e6fad3f3bd43ee158321ec28ae2191b8de9c221bc5b752348a3e6fbe36
SHA3 eca31203fc495908beb497c8d18da37c38101b582724fc5ac791267fbac44bbb
VirtualSize 0x699c
VirtualAddress 0xe8000
SizeOfRawData 0x6a00
PointerToRawData 0xe0000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.87141

.rsrc

MD5 85caa6d4c6409ee12c9908dd11e25f88
SHA1 52d7a0ba049a8856543659c9e475a242670f99ce
SHA256 9716c680c338ba91e26316b0758661bc2e06d7385ddb4e8f548c1401e7bd2c36
SHA3 d92cb1c1c53abc26c204ae5660519f878ccead30685647ff3dd6ef65b6259942
VirtualSize 0x40828
VirtualAddress 0xef000
SizeOfRawData 0x40a00
PointerToRawData 0xe6a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.83051

.reloc

MD5 8a11d2cb46b101de2b0fbec089ffa515
SHA1 c448a8c01f0ea824a8657f7f8a8e8b014f782820
SHA256 d5b2a05bba3dd2c031aa99a49392397819a4f8d39c22b95894d9a38fe7d56a36
SHA3 a12388553ddf589fec77bbd8c70ccb5d00c0fbf254301155f4a4de56ae956c46
VirtualSize 0xa7c
VirtualAddress 0x130000
SizeOfRawData 0xc00
PointerToRawData 0x127400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.15455

Imports

WSOCK32.dll WSACleanup
socket
inet_ntoa
setsockopt
ntohs
recvfrom
ioctlsocket
htons
WSAStartup
__WSAFDIsSet
select
accept
listen
bind
closesocket
WSAGetLastError
recv
sendto
send
inet_addr
gethostbyname
gethostname
connect
VERSION.dll GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
WINMM.dll timeGetTime
waveOutSetVolume
mciSendStringW
COMCTL32.dll ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
InitCommonControlsEx
ImageList_Create
MPR.dll WNetUseConnectionW
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
WININET.dll InternetQueryDataAvailable
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetQueryOptionW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetReadFile
InternetConnectW
PSAPI.DLL GetProcessMemoryInfo
IPHLPAPI.DLL IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho
USERENV.dll DestroyEnvironmentBlock
UnloadUserProfile
CreateEnvironmentBlock
LoadUserProfileW
UxTheme.dll IsThemeActive
KERNEL32.dll WaitForSingleObject
HeapAlloc
GetProcessHeap
HeapFree
Sleep
GetCurrentThreadId
MultiByteToWideChar
MulDiv
GetVersionExW
IsWow64Process
GetSystemInfo
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
lstrlenW
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
SetEndOfFile
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
FindClose
GetLongPathNameW
GetShortPathNameW
CloseHandle
FindNextFileW
CopyFileExW
MoveFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
EnumResourceNamesW
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
GetLocalTime
CompareStringW
CreateThread
LeaveCriticalSection
GetStdHandle
CreatePipe
TerminateThread
LoadLibraryExW
FindResourceExW
CopyFileW
VirtualFree
FormatMessageW
GetExitCodeProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetSystemDirectoryW
HeapReAlloc
HeapSize
GetComputerNameW
GetWindowsDirectoryW
GetCurrentProcessId
GetProcessIoCounters
CreateProcessW
GetProcessId
SetPriorityClass
LoadLibraryW
VirtualAlloc
GetFullPathNameW
SetCurrentDirectoryW
IsDebuggerPresent
GetCurrentDirectoryW
lstrcmpiW
DecodePointer
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EncodePointer
DuplicateHandle
GetCurrentProcess
EnterCriticalSection
GetCurrentThread
ExitProcess
GetModuleHandleExW
ExitThread
GetSystemTimeAsFileTime
ResumeThread
GetCommandLineW
IsProcessorFeaturePresent
RtlPcToFileHeader
RtlUnwindEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetStringTypeW
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
ReadConsoleW
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
DeleteFileW
SetEnvironmentVariableA
USER32.dll RegisterHotKey
ClientToScreen
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
GetWindowLongW
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongPtrW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
SetWindowLongPtrW
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DrawMenuBar
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
CallWindowProcW
ReleaseCapture
SetCapture
UnregisterHotKey
CharLowerBuffW
MonitorFromRect
LoadImageW
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
GetCursorInfo
GetCursorPos
DeleteMenu
CheckMenuRadioItem
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
TranslateMessage
SystemParametersInfoW
keybd_event
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowLongPtrW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetWindowTextW
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
SetWindowPos
CopyImage
AdjustWindowRectEx
SetRect
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
GetMessageW
LockWindowUpdate
TrackPopupMenuEx
DispatchMessageW
OpenWindowStationW
GetUserObjectSecurity
MessageBoxW
DefWindowProcW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
FindWindowW
PeekMessageW
ScreenToClient
GDI32.dll StrokePath
DeleteObject
GetTextExtentPoint32W
ExtCreatePen
GetDeviceCaps
EndPath
SetPixel
CloseFigure
LineTo
AngleArc
MoveToEx
CreateCompatibleBitmap
CreateCompatibleDC
Ellipse
PolyDraw
BeginPath
Rectangle
SetViewportOrgEx
SelectObject
StretchBlt
GetDIBits
DeleteDC
GetPixel
CreateDCW
GetObjectW
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
SetTextColor
CreateFontW
GetTextFaceW
GetStockObject
StrokeAndFillPath
COMDLG32.dll GetOpenFileNameW
GetSaveFileNameW
ADVAPI32.dll GetAce
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegConnectRegistryW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
RegCreateKeyExW
FreeSid
GetTokenInformation
GetSecurityDescriptorDacl
GetAclInformation
AddAce
SetSecurityDescriptorDacl
GetUserNameW
InitiateSystemShutdownExW
SHELL32.dll DragQueryPoint
ShellExecuteExW
DragQueryFileW
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateShellItem
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish
ole32.dll CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoCreateInstance
IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoInitialize
CoUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CoGetObject
CoInitializeSecurity
CoCreateInstanceEx
CoSetProxyBlanket
OLEAUT32.dll UnRegisterTypeLib
UnRegisterTypeLibForUser
RegisterTypeLibForUser
RegisterTypeLib
LoadTypeLibEx
VariantCopyInd
SysReAllocString
SysFreeString
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayUnaccessData
CreateDispTypeInfo
SafeArrayAllocData
SafeArrayAllocDescriptorEx
SafeArrayCreateVector
SysAllocString
VariantTimeToSystemTime
VarR8FromDec
SafeArrayGetVartype
OleLoadPicture
QueryPathOfRegTypeLib
VariantCopy
VariantClear
CreateStdDispatch
DispCallFunc
VariantChangeType
SysStringLen
SafeArrayAccessData
VariantInit

Delayed Imports

1

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.25499
MD5 ad424f5f5d5ff4460343686c61e4f75e
SHA1 29a1f0faadc42f1b9f9767d8c724fdc58dd165c8
SHA256 245fc49e4e955e1db3975b826dcf27ad2eb32a6831caa4cb6b501a3914bcfaa9
SHA3 4f3a627ee7d533397f7f5c70bb2dafa8857150e674cb31edd96949c7905de509

2

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.65355
MD5 60719bac037d0712f35c5c90be495c9d
SHA1 a3041d7ee6ba7615452806f77a1c943595c21191
SHA256 30d1e986d0b31def6f13e53ff02c031bfbefcf963d61d5ad650b172ad7e860c7
SHA3 20b10baff88665c15ede11f5f30b5422805da2105be8358b0a1b3a41e89b13c6

3

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.43704
MD5 982c00bdd1b0ecc4c6ae5e68d8f1b87a
SHA1 489bbfba215b27140f141a2f394b0e65062cf357
SHA256 4035501adf394316fef967f0a20eedbf34126242bbeb9cbaad501af59aebd797
SHA3 84b3279e6fdd3055caf0f08cad67c578b24c6efc055823442d2d8a2f4a3cf547

4

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.16139
MD5 9366bb6f5fa80ec08957cad372d3facc
SHA1 16ceb7528f7b4306ecc56beb210331e415759c79
SHA256 7b310c0be8d06ce48affcc4f9aed1c0d788031b2a2f4ae57b69b66234a20d812
SHA3 471da3b7ffcb18564e3e4540ccbf2367ea343c40f28eab72e41caa70f1cd8871

5

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.07494
MD5 82837923a319386e182d74bceffdcd9a
SHA1 23bef5e2545d16d60bd84c8dc592698c6d6e9ca5
SHA256 34b88a55636fba814081ad56bda0f029a6a48647de3c0aa7c01ed483e8829832
SHA3 082d792ee6346e3ba3fcbc617a8365f6f5a4a32d518afee86445eef4fdfb5eca

6

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.18302
MD5 68d9845aa5d81b5ec9af61f410e35b16
SHA1 792b2a2e934bea082f9fa18aecc9cf7c56fec0cb
SHA256 e3462f80eb7b3b4010ea0ab4fb82033a565632230555ec565e1ee7ae8c01c04f
SHA3 3fbf18c6eae48b380506d26d691dd958d8d6c215e0c66402ea65e822fafc4da1

7

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.52312
MD5 2a1613d0845d00b916aa58adf0d41788
SHA1 9b80e5a340e2b46e6c1d1f5cdc71f70987a6362e
SHA256 c3a9d3b89fe9d0197f5d20a9a00f2e69c9218c57b95f21bd16d193d264725d1d
SHA3 6be13a8f2c46fc7d016e5e1338619a9c6aab8a2538fb392ad95ca1860d53663d

8

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.65168
MD5 9ea19e6905b73670bf173b6ed270f52d
SHA1 0990bc33abfc67bf30fa225c39caac330248ce4e
SHA256 1d07a182ee09e1ae5120d258c03c8cdd17797e00bca1e3c4d923b03c37c7cf1a
SHA3 6f95f1bd2ea42683b37b905d1215789ccae50a552cdf454d0f859234f5789216

9

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.39178
MD5 37ead5d2c4490f465242d3a884f19c37
SHA1 144dbce865b6cfccb00c3a1f2767639b166d90c7
SHA256 e11a688c6e3fecdb7bcdccaa350aa6fb9bffa50e81751ce4c38b6a26db692634
SHA3 97917334c00067d77ca349a361aeb6c9408e4dfda72615f0735be852c777ccf0

1000

Type RT_DIALOG
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0xfc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.03986
MD5 08e5fdcbcb2ab21352c8fc0e05b07ddb
SHA1 25d4fcfaba7226a6b786bba3bcbad3ed7391b385
SHA256 7de7438fb4425f608109111fdce25be7d2381938f6c5984bcfb14b3b88e9c883
SHA3 90c82ad0c9f2d048ecb9664bee1556cb41f42f160749e3dec0bcdd28d05a8a5d

7 (#2)

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x594
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.34702
MD5 d1f824f98742295a66a25225701dd6d8
SHA1 5b2075b778387182bf97314b593e73f30853435d
SHA256 4fe35e21717d34ceb4717f9e9de8fde1b3de80d76a59bb87405910c2f1d6284b
SHA3 294fc9961bf6eddc1dc7c5b525832f8aa8d3e90dac608e6421398510ab9c15b1

8 (#2)

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x68a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.2817
MD5 5beaeebda5346956e395fad21661f382
SHA1 201f2f699e6917e953821d64105b226fdd8b5528
SHA256 9306910d4bb273465765832df77fb1fd78bd6e0bcbf9908636e323c34c92b613
SHA3 d6430a84edfc22e41b15dd4f7cfc2d249bf5a637189d9284f062644b1503f9ee

9 (#2)

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x490
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.28849
MD5 6b12d17c7622d8215889a2288098fa15
SHA1 a511bf459e5043fcb234829bf66a99565c244652
SHA256 e47fa3aec12353f6370b941bc5855e5551530c7b26f925b5a2e2692a0201450c
SHA3 8e3541de418e1046806ffb977c8babecd093b9816c92883261b074d1c47d96fb

10

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x5fc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.28373
MD5 949955dbda367f0c790615f7817e7886
SHA1 ee0370fb4ad59a4cebc3dbfc83bb437343fb803b
SHA256 4854e5abce2237256df24b69c9759fc1e8caa423a54bfe661ba7031afd8375eb
SHA3 5e36df684c6f2c4058d1a2507989eb5fc3c873159d006088d40f4da3804f56f2

11

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x65c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.26322
MD5 9bc568a6176f738ffb3109e53235b579
SHA1 b97786555bfa05f958f174e294080e235d91b571
SHA256 d38369002e36f73866a0d40b13e069b9ffdbda50957f4c88d52a72fecb9b4e45
SHA3 94318c553eb0928412a92e8cf9913ca5c35a03aa8c24bf151a6764793b2f6f90

12

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x466
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.25812
MD5 899b8766aea5f88410c721620925754b
SHA1 53ba98192d7ea4fa9051ac220ed18960ab0507a6
SHA256 58ea125e6b5fa2cbc5a8ed819c7f50c9bca1cfe55f94c7cff3feb60f25ac6073
SHA3 7ad4457a556ba648b1d46e62549fdc4c7d093bbad286f9123daf6a94f0e5af62

313

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x158
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.08572
MD5 193a9143563395ad14c6dac83d32e2ad
SHA1 87ca08eb609f9ceabbd8ea7a64263de9a05bbb22
SHA256 b3711acbe8e01fee7fd362112b4e42da05c728e98b85c0a3b4cb075977849cee
SHA3 7634b4daca191c6fa53de1d5964fa47f382afccebf5744e70a702fd179fad715

SCRIPT

Type RT_RCDATA
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x37d6e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.99915
MD5 ea34c7b7a7dc1b23f8b94e21b93e5a0a
SHA1 b7d63e61dc5693f59f8319f31c75ad48bc9a7cc9
SHA256 e2b3119dd2cba963edf20ca57ad979dc63a58a7895d18152f1c831f073778ee6
SHA3 88d2006dc6f7eeba2f69be55dd943f64891a1a72ec4aa17c8e4b053a7699a03e

99

Type RT_GROUP_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x76
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.85255
Detected Filetype Icon file
MD5 7fd86e1ef40a59043395816bf4dc5b3d
SHA1 473cc9d1c0be043c717dd32a4d2b2a06f11e3d0d
SHA256 348205d48d2d52de412742e01091cbee6259da841a58676000eb10cb17948603
SHA3 ae28a0810b905f65c5e1025b6440ce7934f73e4cafa1a993c48c7eca3614bc3c

169

Type RT_GROUP_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.84274
Detected Filetype Icon file
MD5 f64c60b749269fcf6659c450dda98486
SHA1 42945c3496bc4e1943a1a05926a9b5ee31d3e450
SHA256 ae172a9a2fd008910b537c92a95b38bfba0e5bbdaaca719bf686e6415a7a2ba1
SHA3 443830acdeb37f2b7f844756492b2b11f9fb93e9171617d8c799cebfd05cb37f

1 (#2)

Type RT_VERSION
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0xdc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.77862
MD5 410f594f3ad95b1dd20e08e299b97c51
SHA1 523aa56f00d4d21ffcbd0f82cda655d88349a740
SHA256 ebfbc032f504c40d9098735ecfd8c80d996de100b07130e2855b9125e1f57fe5
SHA3 e785abf691c076cc1fc9cd02b8b7cc3ea433971151b12bd00999ac83071094c5

1 (#3)

Type RT_MANIFEST
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x3fa
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.39264
MD5 79ff2b6cfbaed20d0761e88f8b47dc80
SHA1 7ef2897a5a54be6eb3e82c3a936d070dc001e537
SHA256 2fb51dac382441e19215b5016eddd256a4fdf99d325fe691d77a6e450988ecbe
SHA3 02bda12ac26ccf7986d96ff43cdceb70ea576bb4a29fba484a5200fb71103412

String Table contents

(Paused)
AutoIt Error
AutoIt has detected the stack has become corrupt.
Stack corruption typically occurs when either the wrong calling convention is used or when the function is called with the wrong number of arguments.
AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.
"EndWith" missing "With".
Badly formatted "Func" statement.
"With" missing "EndWith".
Missing right bracket ')' in expression.
Missing operator in expression.
Unbalanced brackets in expression.
Error in expression.
Error parsing function call.
Incorrect number of parameters in function call.
"ReDim" used without an array variable.
Illegal text at the end of statement (one statement per line).
"If" statement has no matching "EndIf" statement.
"Else" statement with no matching "If" statement.
"EndIf" statement with no matching "If" statement.
Too many "Else" statements for matching "If" statement.
"While" statement has no matching "Wend" statement.
"Wend" statement with no matching "While" statement.
Variable used without being declared.
Array variable has incorrect number of subscripts or subscript dimension range exceeded.
Variable subscript badly formatted.
Subscript used on non-accessible variable.
Too many subscripts used for an array.
Missing subscript dimensions in "Dim" statement.
No variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.
Expected a "=" operator in assignment statement.
Invalid keyword at the start of this line.
Array maximum size exceeded.
"Func" statement has no matching "EndFunc".
Duplicate function name.
Unknown function name.
Unknown macro.
Unable to get a list of running processes.
Invalid element in a DllStruct.
Unknown option or bad parameter specified.
Unable to load the internet libraries.
"Struct" statement has no matching "EndStruct".
Unable to open file, the maximum number of open files has been exceeded.
"ContinueLoop" statement with no matching "While", "Do" or "For" statement.
Invalid file filter given.
Expected a variable in user function call.
"Do" statement has no matching "Until" statement.
"Until" statement with no matching "Do" statement.
"For" statement is badly formatted.
"Next" statement with no matching "For" statement.
"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.
"For" statement has no matching "Next" statement.
"Case" statement with no matching "Select"or "Switch" statement.
"EndSelect" statement with no matching "Select" statement.
Recursion level has been exceeded - AutoIt will quit to prevent stack overflow.
Cannot make existing variables static.
Cannot make static variables into regular variables.
Badly formated Enum statement
This keyword cannot be used after a "Then" keyword.
"Select" statement is missing "EndSelect" or "Case" statement.
"If" statements must have a "Then" keyword.
Badly formated Struct statement.
Cannot assign values to constants.
Cannot make existing variables into constants.
Only Object-type variables allowed in a "With" statement.
"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.
Object referenced outside a "With" statement.
Nested "With" statements are not allowed.
Variable must be of type "Object".
The requested action with this object has failed.
Variable appears more than once in function declaration.
ReDim array can not be initialized in this manner.
An array variable can not be used in this manner.
Can not redeclare a constant.
Can not redeclare a parameter inside a user function.
Can pass constants by reference only to parameters with "Const" keyword.
Can not initialize a variable with itself.
Incorrect way to use this parameter.
"EndSwitch" statement with no matching "Switch" statement.
"Switch" statement is missing "EndSwitch" or "Case" statement.
"ContinueCase" statement with no matching "Select"or "Switch" statement.
Assert Failed!
Obsolete function/parameter.
Invalid Exitcode (reserved for AutoIt internal use).
Variable cannot be accessed in this manner.
Func reassign not allowed.
Func reassign on global level not allowed.
Unable to parse line.
Unable to open the script file.
String missing closing quote.
Badly formated variable or macro.
Missing separator character after keyword.

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 0.0.0.0
ProductVersion 0.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United Kingdom
Resource LangID English - United Kingdom

IMAGE_DEBUG_TYPE_RESERVED

Characteristics 0
TimeDateStamp 2018-Mar-15 13:15:00
Version 0.0
SizeofData 4
AddressOfRawData 0xccc38
PointerToRawData 0xcb438

TLS Callbacks

Load Configuration

Size 0x70
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1400dd1a0

RICH Header

XOR Key 0x3a0cc232
Unmarked objects 0
199 (41118) 1
C objects (20806) 178
ASM objects (20806) 25
C++ objects (20806) 55
C objects (VS2008 SP1 build 30729) 8
135 (VS2008 SP1 build 30729) 1
Imports (VS2008 SP1 build 30729) 37
Total imports 547
234 (VS2013 UPD5 build 40629) 80
ASM objects (VS2013 UPD5 build 40629) 1
Resource objects (VS2013 build 21005) 1
151 1
Linker (VS2013 UPD5 build 40629) 1

Errors

<-- -->