Manalyze report for c5acadbaf576eedf70ed79ba0dd727ae04e608d375e23a29462793450b9bdb8f

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	1996-Jul-06 05:52:43
Detected languages	English - United States
Debug artifacts	wab32.pdb
CompanyName	Microsoft Corporation
FileDescription	Microsoft (R) Contacts DLL
FileVersion	`10.0.26100.8972 (WinBuild.160101.0800)`
InternalName	WAB32.DLL
LegalCopyright	Â© Microsoft Corporation. All rights reserved.
OriginalFilename	WAB32.DLL
ProductName	MicrosoftÂ® WindowsÂ® Operating System
ProductVersion	`10.0.26100.8972`

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C++ 6.0 - 8.0`
Info	Interesting strings found in the binary:	`Contains domain names: compuserve.com http://schemas.microsoft.com http://schemas.microsoft.com/Contact http://schemas.microsoft.com/Contact' http://schemas.microsoft.com/Contact/Extended http://www.w3.org http://www.w3.org/2001/XMLSchema http://www.w3.org/2001/XMLSchema-instance microsoft.com schemas.microsoft.com umich.edu www.w3.org`
Info	Libraries used to perform cryptographic operations:	`Microsoft's Cryptography API`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: LoadLibraryExW LoadLibraryW GetProcAddress` `Functions which can be used for anti-debugging purposes: FindWindowW` `Code injection capabilities (PowerLoader): FindWindowW GetWindowLongW` `Can access the registry: SHRegEnumUSKeyW SHRegCloseUSKey SHRegEnumUSValueW SHRegQueryInfoUSKeyW SHRegOpenUSKeyW SHRegQueryUSValueW SHRegGetUSValueW SHRegSetUSValueW SHRegCreateUSKeyW SHRegWriteUSValueW SHRegGetValueW RegOpenKeyExW RegEnumValueW RegCloseKey RegGetValueW RegCreateKeyExW RegDeleteValueW RegSetValueExW RegQueryValueExW RegQueryValueW RegSetValueW RegEnumKeyExW` `Possibly launches other programs: ShellExecuteW` `Uses Microsoft's cryptographic API: CryptAcquireContextW CryptCreateHash CryptHashData CryptGetHashParam CryptDestroyHash CryptReleaseContext` `Can create temporary files: GetTempPathW CreateFileW` `Has Internet access capabilities: InternetCanonicalizeUrlW` `Can take screenshots: CreateCompatibleDC FindWindowW GetDC`
Safe	VirusTotal score: 0/71 (Scanned on 2026-08-08 22:23:08)	`All the AVs think this file is safe.`

Hashes

MD5	`eb2f1dc289446d3b32f9791a839212d2` 🔍
SHA1	`5f7f816db7a6f990de9bbec0717a2104de9a477a` 🔍
SHA256	`c5acadbaf576eedf70ed79ba0dd727ae04e608d375e23a29462793450b9bdb8f` 🔍
SHA3	`b96ad0e2a7f76c7b8e35dd7317145c30a09ac9a9832203a68d601282453eade0` 🔍
SSDeep	`12288:LBfREM6QhMZ/jvn052aycSEElMdd6TM4BEkCB5R+QB/HgTx5KRZxzo:BRxaxjvn02aoGigqCd+cp` 🔍
Imports Hash	`fbdccee824d0351b00b52f4f7b27c00f` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xf8`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`6`
TimeDateStamp	1996-Jul-06 05:52:43
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_DLL` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`14.0`
SizeOfCode	`0x8a600`
SizeOfInitializedData	`0x2fe00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00089A40 (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0x8c000`
ImageBase	`0x10000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`A.0`
ImageVersion	`A.0`
SubsystemVersion	`A.0`
Win32VersionValue	`0`
SizeOfImage	`0xbe000`
SizeOfHeaders	`0x400`
Checksum	`0xbac49`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_GUARD_CF` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT`
SizeofStackReserve	`0x40000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`b3b303b9ad540ff69ed0da5968694e9e 🔍`
SHA1	`8f61ad5b4ab682d7963be97856b5e66929602854 🔍`
SHA256	`af31cce06bc226602c424fbe5b47d503aaf4bfd78b0d590b4828f0c3712b9db6 🔍`
SHA3	`e29753ea02f2a7a4818ddefc38a5dfc4e43ab0f4a583d1c59e27785698b89f2c 🔍`
VirtualSize	`0x8a44f`
VirtualAddress	`0x1000`
SizeOfRawData	`0x8a600`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.4922`

.data

MD5	`c080e29efddc7fb5d8eccd68abd99a7e 🔍`
SHA1	`f6897ae324aadf8b65fcce2057f1eb4554ca638f 🔍`
SHA256	`959d215ba6baa97c8981df3b73f615826149ede0b4fa30191761d24b90851761 🔍`
SHA3	`51945dda87e0f61da65dadf169667273326b26b205520936b89943c617ead6cf 🔍`
VirtualSize	`0x2cc0`
VirtualAddress	`0x8c000`
SizeOfRawData	`0x1e00`
PointerToRawData	`0x8aa00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`5.61652`

.idata

MD5	`930b15ebb7b80543df9dbea386cf10ed 🔍`
SHA1	`fe061c9f63bc00c531ccc42d430e91b1cac4796f 🔍`
SHA256	`ae6695039d9d7dab4390284d1d5a3de37d4f2569f192d3674c364b30385140dc 🔍`
SHA3	`88f9ad4d72574b413581b183c1a41d94a4ad29d57adc9e2ba4f3aea10707f55f 🔍`
VirtualSize	`0x2d50`
VirtualAddress	`0x8f000`
SizeOfRawData	`0x2e00`
PointerToRawData	`0x8c800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.62724`

.didat

MD5	`2428478a8d80051876ba3061e74fa4be 🔍`
SHA1	`d13f5a293af313f0098da7e571fb005ea7d1f014 🔍`
SHA256	`b908de4f6801ebfa05337657e36b80495d010ccc51647fbd286b30de83afcdb3 🔍`
SHA3	`5ea5c41cb1387dfd34c2c94a33c99560fef670d0dae6aefd7ba2a6cce23213a3 🔍`
VirtualSize	`0xc0`
VirtualAddress	`0x92000`
SizeOfRawData	`0x200`
PointerToRawData	`0x8f600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`2.15622`

.rsrc

MD5	`74f42a2e17b157e2f1143d1f6b8bf8e9 🔍`
SHA1	`24d1c9323c3e19c48e6d0df9381834ee0ba21c1a 🔍`
SHA256	`cd5327b00193547bfc7f41057af7ae552154b1b3d6b4615705837e1b3340b23e 🔍`
SHA3	`1ba0c9960823c3fb21556ff4687a550bf44c813aff27869a0ba35a7faeb9aa83 🔍`
VirtualSize	`0x23950`
VirtualAddress	`0x93000`
SizeOfRawData	`0x23a00`
PointerToRawData	`0x8f800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.199`

.reloc

MD5	`5cb5dea2a2bbf35507a52cf185bf9360 🔍`
SHA1	`c6cc4c9a6c88ed5b45a6d06f02f3318419ac55bc 🔍`
SHA256	`906aadac58e1a3f8c0edc6d5abf6ba4c593e85ca31cf27cecfd5404f298c90ab 🔍`
SHA3	`2b5f9c0002d8493129991c458ad1e5f817a92ebe2e5bcfc001464a444aa2e0b8 🔍`
VirtualSize	`0x6418`
VirtualAddress	`0xb7000`
SizeOfRawData	`0x6600`
PointerToRawData	`0xb3200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`6.73255`

Imports

msvcrt.dll	`_wrename` `wcschr` `_wfullpath` `_purecall` `_vsnprintf` `memcpy_s` `memmove_s` `wcsnlen` `wcscpy_s` `wcscat_s` `free` `malloc` `_callnewh` `wcstok_s` `memcpy` `_XcptFilter` `rand` `srand` `_amsg_exit` `_initterm` `_lock` `_unlock` `__dllonexit` `_onexit` `__CxxFrameHandler3` `_except_handler4_common` `memmove` `_vsnwprintf` `memcmp` `swscanf_s` `memset`
CRYPTDLG.dll	`CertViewPropertiesA`
MSOERT2.dll	`HrCopyStream` `OpenFileStreamW` `OpenFileStreamShareW` `#44` `HrStreamToByte`
SHLWAPI.dll	`SHRegEnumUSKeyW` `SHRegCloseUSKey` `SHRegEnumUSValueW` `SHRegQueryInfoUSKeyW` `PathRenameExtensionW` `#153` `SHRegOpenUSKeyW` `SHRegQueryUSValueW` `#487` `StrChrW` `StrCSpnW` `#199` `PathAppendW` `SHRegGetUSValueW` `SHRegSetUSValueW` `StrToIntA` `PathGetDriveNumberW` `PathIsNetworkPathW` `PathCanonicalizeW` `#214` `PathRemoveFileSpecW` `StrStrIW` `PathAddBackslashW` `PathFindExtensionW` `#12` `StrCmpW` `StrCmpIW` `#219` `PathFindFileNameW` `StrCmpNIW` `SHRegCreateUSKeyW` `SHRegWriteUSValueW` `PathFileExistsW` `SHStrDupW` `UrlIsW` `UrlGetPartW` `#158` `PathAddExtensionW` `#154` `StrCmpNIA` `StrStrW` `SHRegGetValueW` `PathRemoveBlanksW` `PathCreateFromUrlW` `PathIsDirectoryW` `UrlCanonicalizeW` `#16` `PathCombineW` `#213` `PathRemoveBackslashW`
SHELL32.dll	`#51` `ShellExecuteExW` `SHGetKnownFolderIDList` `#940` `SHChangeNotify` `#262` `ShellExecuteW` `#155` `#18` `DragQueryFileW` `SHGetMalloc` `SHGetKnownFolderPath` `SHParseDisplayName` `SHGetFolderPathW`
UxTheme.dll	`EnableThemeDialogTexture`
ADVAPI32.dll	`CryptAcquireContextW` `CryptCreateHash` `CryptHashData` `CryptGetHashParam` `CryptDestroyHash` `RegOpenKeyExW` `RegEnumValueW` `RegCloseKey` `TraceEvent` `RegGetValueW` `RegCreateKeyExW` `RegDeleteValueW` `RegSetValueExW` `GetTraceLoggerHandle` `GetTraceEnableLevel` `GetTraceEnableFlags` `RegisterTraceGuidsW` `UnregisterTraceGuids` `RegQueryValueExW` `EventUnregister` `EventRegister` `EventSetInformation` `EventWriteTransfer` `GetUserNameW` `RegQueryValueW` `RegSetValueW` `RegEnumKeyExW` `CryptReleaseContext`
GDI32.dll	`DeleteObject` `CreateFontIndirectW` `GetDeviceCaps` `GetTextExtentPoint32W` `RectVisible` `CreateDIBSection` `CreateCompatibleDC` `SetBkColor` `ExtTextOutW` `DeleteDC` `CreateBrushIndirect` `PatBlt` `GetObjectW` `SetMapMode` `SetAbortProc` `StartDocW` `EndDoc` `GetTextExtentPointW` `AbortDoc` `EndPage` `StartPage` `SetBkMode` `GetStockObject` `TextOutW` `Rectangle` `MoveToEx` `SelectObject` `LineTo`
imagehlp.dll	`TouchFileTimes`
KERNEL32.dll	`WaitForSingleObjectEx` `CloseThreadpoolTimer` `WaitForThreadpoolTimerCallbacks` `SetThreadpoolTimer` `ReleaseSemaphore` `ReleaseSRWLockShared` `AcquireSRWLockShared` `ReleaseSRWLockExclusive` `AcquireSRWLockExclusive` `OutputDebugStringW` `IsDebuggerPresent` `DebugBreak` `GetModuleFileNameA` `GetModuleHandleExW` `GetModuleHandleW` `ReleaseMutex` `InitializeCriticalSectionEx` `CreateMutexW` `MoveFileW` `GlobalFree` `GlobalUnlock` `GlobalLock` `lstrcmpiA` `CompareStringA` `WaitForSingleObject` `SetEvent` `CreateThread` `CreateEventW` `FindNextChangeNotification` `WaitForMultipleObjects` `FindCloseChangeNotification` `FindFirstChangeNotificationW` `SetEndOfFile` `CopyFileW` `GetCurrentThreadId` `SetFilePointer` `GetTempFileNameW` `OpenSemaphoreW` `CreateThreadpoolTimer` `LCMapStringW` `SystemTimeToFileTime` `CreateMutexExW` `CreateSemaphoreExW` `GetShortPathNameW` `TlsSetValue` `GetLocaleInfoW` `GetProfileIntW` `HeapReAlloc` `FindResourceW` `LoadResource` `LockResource` `SizeofResource` `FreeResource` `MulDiv` `GetSystemTime` `GetModuleFileNameW` `SetFileAttributesW` `Sleep` `UnhandledExceptionFilter` `SetUnhandledExceptionFilter` `GetCurrentProcess` `TerminateProcess` `WakeAllConditionVariable` `SleepConditionVariableSRW` `QueryPerformanceCounter` `GetTickCount` `GetUserDefaultUILanguage` `GetModuleHandleA` `FreeLibraryAndExitThread` `IsDBCSLeadByte` `GetFileAttributesExW` `ActivateActCtx` `DeactivateActCtx` `CreateActCtxW` `ReleaseActCtx` `LoadLibraryExW` `DeleteTimerQueueTimer` `CreateTimerQueueTimer` `GetLongPathNameW` `GetCurrentDirectoryW` `UnregisterWaitEx` `GetOverlappedResult` `ReadDirectoryChangesW` `RegisterWaitForSingleObject` `DelayLoadFailureHook` `ResolveDelayLoadedAPI` `GetUserDefaultLCID` `GetCurrentProcessId` `GetTempPathW` `MoveFileExW` `lstrcmpiW` `LocalAlloc` `LocalFree` `GetLastError` `LoadLibraryW` `FreeLibrary` `FileTimeToSystemTime` `GetDateFormatW` `GetTimeFormatW` `GetProcessHeap` `HeapFree` `WideCharToMultiByte` `SetLastError` `lstrcmpA` `CreateFileW` `WriteFile` `CloseHandle` `GetSystemTimeAsFileTime` `GetFileSize` `ReadFile` `GetFileAttributesW` `CompareStringW` `InitializeCriticalSection` `DeleteCriticalSection` `EnterCriticalSection` `LeaveCriticalSection` `HeapAlloc` `DeleteFileW` `CompareFileTime` `FindFirstFileW` `FindClose` `GetVersion` `GetProcAddress` `FormatMessageW` `TlsAlloc` `TlsGetValue` `TlsFree` `MultiByteToWideChar` `RtlMoveMemory` `ExpandEnvironmentStringsW` `HeapCreate` `HeapDestroy` `lstrcmpW` `FindNextFileW`
MSIMG32.dll	`AlphaBlend`
ole32.dll	`CoWaitForMultipleHandles` `CoInitialize` `CoInitializeEx` `PropVariantCopy` `PropVariantClear` `ReleaseStgMedium` `CoGetMalloc` `StringFromCLSID` `CoTaskMemFree` `CreateBindCtx` `OleRun` `CoCreateInstance` `CLSIDFromString` `CoUninitialize`
OLEAUT32.dll	`VariantChangeType` `VarUdateFromDate` `SystemTimeToVariantTime` `SysAllocString` `SysFreeString` `SysAllocStringLen` `SysStringLen` `GetErrorInfo` `VariantClear` `VarDateFromUdate`
RPCRT4.dll	`RpcStringFreeW` `UuidCreate` `UuidFromStringW` `UuidToStringW`
USER32.dll	`GetCursorPos` `DialogBoxParamW` `PtInRect` `CreateDialogParamW` `EndPaint` `BeginPaint` `CharUpperA` `CharLowerA` `DrawTextW` `IsRectEmpty` `CreateWindowExW` `LoadCursorW` `CharNextA` `LoadStringW` `GetDesktopWindow` `CharNextW` `SendMessageW` `GetMenuItemCount` `DefWindowProcW` `MessageBoxW` `CheckRadioButton` `EnableWindow` `GetDlgItem` `UpdateWindow` `SetFocus` `IsWindowEnabled` `ReleaseCapture` `GetSysColorBrush` `RegisterClassExW` `UnregisterClassW` `FindWindowW` `SetWindowLongW` `GetWindowLongW` `GetWindowTextW` `SetWindowTextW` `GetMessageW` `IsDialogMessageW` `TranslateMessage` `DispatchMessageW` `GetParent` `SendDlgItemMessageW` `DestroyWindow` `EndDialog` `GetClientRect` `IsWindow` `RegisterClassW` `SetCursor` `RegisterWindowMessageW` `SystemParametersInfoW` `CharUpperW` `PostMessageW` `SetDlgItemTextW` `SetTimer` `ShowWindow` `KillTimer` `GetWindowRect` `SetWindowPos` `GetSystemMetrics` `GetDC` `ReleaseDC` `CharPrevW` `IsDlgButtonChecked` `GetClassInfoW` `DestroyAcceleratorTable` `IsChild` `GetFocus` `GetKeyState` `GetSysColor` `InsertMenuItemW` `LoadStringA` `CreatePopupMenu` `LoadIconW` `SetMenuInfo` `InsertMenuW` `DestroyMenu` `CharLowerW` `PeekMessageW` `EnableMenuItem` `GetSystemMenu` `GetDlgCtrlID` `MapWindowPoints` `MoveWindow` `IsWindowVisible` `CallWindowProcW` `GetDlgItemTextW` `LoadMenuW` `GetSubMenu` `TrackPopupMenu` `CheckDlgButton` `GetWindowTextLengthW` `LoadImageW` `BeginDeferWindowPos` `ScreenToClient` `EndDeferWindowPos` `SetForegroundWindow` `GetWindowPlacement` `RemoveMenu` `ModifyMenuW` `CheckMenuRadioItem` `OpenClipboard` `EmptyClipboard` `SetClipboardData` `CloseClipboard` `AllowSetForegroundWindow` `GetMenuItemInfoW` `OffsetRect` `InvalidateRect` `FillRect` `RedrawWindow` `SetCapture` `GetCapture`
WININET.dll	`InternetCanonicalizeUrlW`
ntdll.dll	`wcsncmp` `wcstoul` `strchr` `strstr` `WinSqmIncrementDWORD` `_wcsicmp` `wcsstr`
SspiCli.dll	`GetUserNameExW`
iertutil.dll	`#81` `#76` `#79` `#90` `#85` `#78` `#74`
MLANG.dll (delay-loaded)	`#113` `#112`

Delayed Imports

Attributes	`0x1`
Name	`MLANG.dll`
ModuleHandle	`0x8e110`
DelayImportAddressTable	`0x92048`
DelayImportNameTable	`0x8ac94`
BoundDelayImportTable	`0x8b0c8`
UnloadDelayImportTable	`0`
TimeStamp	`1970-Jan-01 00:00:00`

WABOpen

Ordinal	`2`
Address	`0x70010`

WABCreateIProp

Ordinal	`3`
Address	`0x22f20`

WABOpenEx

Ordinal	`4`
Address	`0x700d0`

Ordinal	`5`
Address	`0x31c60`

(#2)

Ordinal	`6`
Address	`0x31e30`

(#3)

Ordinal	`7`
Address	`0x28b60`

(#4)

Ordinal	`8`
Address	`0x10560`

(#5)

Ordinal	`9`
Address	`0x104c0`

(#6)

Ordinal	`10`
Address	`0x714d0`

(#7)

Ordinal	`11`
Address	`0x32ac0`

ShellUICommand_OnNewEmailW

Ordinal	`12`
Address	`0x40ae0`

ShellUICommand_OnNewContactW

Ordinal	`13`
Address	`0x40bd0`

ShellUICommand_OnNewGroupW

Ordinal	`14`
Address	`0x40d10`

ShellUICommand_OnEditW

Ordinal	`15`
Address	`0x40e10`

ShellUICommand_OnImportW

Ordinal	`16`
Address	`0x40f80`

ShellUICommand_OnExportW

Ordinal	`17`
Address	`0x40fb0`

DllCanUnloadNow

Ordinal	`18`
Address	`0xec50`

DllGetClassObject

Ordinal	`19`
Address	`0xec70`

(#8)

Ordinal	`22`
Address	`0x317d0`

(#9)

Ordinal	`23`
Address	`0x70280`

(#10)

Ordinal	`24`
Address	`0x6f090`

EMPTYCONTACT.XML

Type	`XML_FILE`
Language	English - United States
Codepage	UNKNOWN
Size	`0xfa`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.86641`
MD5	`b788f5aa09df90ba121dbee184632f99 🔍`
SHA1	`1dfcb04c962b05724a6edaa66461eac7a36d7086 🔍`
SHA256	`53e659b31ccbb68eb628ec2fe097c55352cf33b0ac4239814a94ff868ee96fdc 🔍`
SHA3	`85df27e90f456e206b01312915f19462dd17551270d9acd09e5642c0648ae47c 🔍`

MSVCARD.XSD

Type	`XML_FILE`
Language	English - United States
Codepage	UNKNOWN
Size	`0x8028`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.54869`
MD5	`2681479c97863494a58c2e5edff67f0b 🔍`
SHA1	`07cd200fd5cf25b2cabb32f25211881af76178f1 🔍`
SHA256	`0582c9da9b067bac803c85517f55daab2b32ac7f4b07de8f6aba6a233d8d8621 🔍`
SHA3	`e7f3752c76846bb92ebffae81a4b159b2fe66a9f8a384e711a7d24be9b1792b3 🔍`

1

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0xa68`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.7916`
MD5	`c48ac79bfe2c3d0c3491c017bd9c7566 🔍`
SHA1	`fc7a2c8f65f12ea6b0a727cddd9d9a14799e535c 🔍`
SHA256	`14520f3a541d38f652a513e69738d79d1b63366e2ab85e61724d69687f84cb10 🔍`
SHA3	`440bc6795e96ddd113e96b0c6030047f149e5a1f02de2efefea30df6c1a12aea 🔍`

2

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x668`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.88233`
MD5	`826ad41f8f282c88db34e14a354bddf1 🔍`
SHA1	`f33bd4fb07a1ed2e2f0573fb931840ebf57d8f27 🔍`
SHA256	`91096c2371c8097af84c259f829daa749bc292dc3b57a0367c44a68b7d63e941 🔍`
SHA3	`f551b8e0736c5ae555162ee68983eeea404f1e64a2447ddd6b997660056e72f6 🔍`

3

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x4c8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.77246`
MD5	`5d90d00ac4c7b156809e911a390a52b6 🔍`
SHA1	`4f98541aa57f7e32030d5edbc188f7cd93470d4b 🔍`
SHA256	`3f40dd55f1ae5fe735a04fe5e4588de552bebe647da5714c59903b6bcc1f3bf7 🔍`
SHA3	`c4b3b86da89cb1fb5eb648af6a12c2862e605aa91c7d04236d589154ceb706f3 🔍`

4

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x2e8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.43035`
MD5	`d28fedba8b50d6dd576222f8ced1eae4 🔍`
SHA1	`c1a8a730995570d0937a0e881861a90ec88dd253 🔍`
SHA256	`a513cf0c0a502d0a90ea610384320a56aaab683a94201b417c6e91debc2cba9a 🔍`
SHA3	`7fb360fd0dd1c8335a36ff2c5ec0ed3be43dacc6872bcb64e98d0b6d2e29e2d4 🔍`

5

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x1e8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.47417`
MD5	`7dc81aafd9591f2f4da89861e00d379c 🔍`
SHA1	`dafd66ed9088e1a4c920da7af24b127f209fa050 🔍`
SHA256	`cc94afd92029b4096e8c0bdbf606c50dfd84f73a9e0e1c6388d6e47e42507696 🔍`
SHA3	`bbfb0c87dfca09ea5fb857a471e2894951aaf905607713612b3ae08f54fa2d8a 🔍`

6

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x1c8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.08783`
MD5	`604cc85ead41031436d8d602e2c889a7 🔍`
SHA1	`a89f214adc30269c2b23954efd82cd99afaad9e0 🔍`
SHA256	`7de8bd26aa5973897f95417e451cd82900c75b7950bfed69d9fe64d6f6acd7c8 🔍`
SHA3	`2ae110a503fa4cc08e248a42b20ceb0c290faa25d9cfa79d1fa6537c428342e0 🔍`

7

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x128`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.52697`
MD5	`340e326bca0ddfdb0ff4594a9ed69b12 🔍`
SHA1	`49ea61fedbee8bad9511b08fb2f12351f1f2c1bb 🔍`
SHA256	`6ba6078c7071314c8b6ca5f47bdc5287657a985c8fb6aa4ea78592f3a27bc143 🔍`
SHA3	`a5607a1754a192a6991263ec5788bed84303cba72a7fd8d50742d979ac3fcfe7 🔍`

8

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x1628`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.31186`
MD5	`f5799b6443fc108b482fbcca70894b82 🔍`
SHA1	`58f6502e49608eabb0649a2e79a848b1c6b23126 🔍`
SHA256	`3ca3fafa72b7be2f7544f6eb0abf4a77969177af4fe301ba83304ea16e8451de 🔍`
SHA3	`e237b4447568f8a35e733236c07c91b1d921523e254983c902e3174b430d4671 🔍`

9

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0xea8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.76093`
MD5	`6e6802e4306546b87a655783deaf5912 🔍`
SHA1	`5c410040c15431a7e757547ce7cf6722b0e73e1b 🔍`
SHA256	`fb792eac02ed35dbd3f0d004f0e03e1106b372e9352a88658bbdddfbefedd88e 🔍`
SHA3	`0e2ab2b62f05dc50141d2864529685e687769881e255157689de91601de65dcc 🔍`

10

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0xba8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.84658`
MD5	`1cfbde3bf2247c7db5d0f16b4550155b 🔍`
SHA1	`257dbb5d887135f0c8df06378c9eb76b2f898d3e 🔍`
SHA256	`62b2e3be4cea94f2a56611a8945b14e937aed200863fce5b6776158e5fc67bd6 🔍`
SHA3	`72dc0abf0f9c899576bd11565d023d02dce1d4af153667d8eede5d279d756f4a 🔍`

11

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x8a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.61186`
MD5	`d91f3c903c739f2e56e6c3b17733d713 🔍`
SHA1	`891c94d58a290d9b845be50b3e85bad16d6b2cbd 🔍`
SHA256	`12f6407f8fe285e6afeac0a232b71794320df4d75a615dee1764eddd3f73e1f6 🔍`
SHA3	`878f845b896d8eb6ea7bbd472be9691c1d622f54f21fe3da5aabc23893fa17f0 🔍`

12

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x6c8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.47531`
MD5	`89e1f90d3b3f0ea72bfc640974880a17 🔍`
SHA1	`5bfdab1bb3c58ee40346fde52760dd81ad60c592 🔍`
SHA256	`bb574cfb17d941db4b220feaac2a5dab245c6ccd6802bb15437296d7dd9736d7 🔍`
SHA3	`ef92dc363c6668ac90da28a7a0c324a4c7c5cfb19e6196aa0ec7a154692b1c73 🔍`

13

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x690`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.7743`
MD5	`19d4ef4aa0150d64f438cc3ee00e1ce2 🔍`
SHA1	`e0f1b85764718e5322f7b69ef99083138506cf9e 🔍`
SHA256	`8ef21f92ceffee93e6ad9461f7902b7c91eaed6396d8e99c609945ae4e5f6d37 🔍`
SHA3	`b6f71374057c56326b665a25e5b268683d1682c45a5b3450eafa248653eb3374 🔍`

14

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x568`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.50266`
MD5	`a3f574769b2c77b746ffb29829c5ac96 🔍`
SHA1	`1a652034e4bbd3c6f808dd340472a8693a1bb5a2 🔍`
SHA256	`c6289a4f3d6109459f49843b70ea2427c5e752c8cdc63d591bead26a9303f77c 🔍`
SHA3	`a3aa1af507d1fcdd5f25a1b7884fef92a7d89c19bea330f5c051d17410900bbe 🔍`

15

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x9845`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.97425`
Detected Filetype	PNG graphic file
MD5	`c053176dfd5ab64624dc03001f869fa5 🔍`
SHA1	`f87b67b0502539204d3b1e0ba9501fafbcc50d11 🔍`
SHA256	`1fa25520d5bc61fe5ded994fc3f17773dcb4e0c9fc56cb95a5953824b79c8423 🔍`
SHA3	`9e382887173a2bc9fff8c20389e8ab62422b237ed9278bd531140bbcf698fa9c 🔍`

16

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x4228`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.75189`
MD5	`a27e3663c9d778e805b45a5b5e2b1389 🔍`
SHA1	`a83dfbea7c67ef55d03bb6e5b4ff4ae28f1313bf 🔍`
SHA256	`bb853f8aeb3c883ec79fbc97da053da6f337d7569d41c3d919bad928b8fa91a3 🔍`
SHA3	`8d103573d866acd28cbc538a04cc0a45183433c35c95f46ca75b0e7956f90a55 🔍`

17

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x25a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.16119`
MD5	`e38d0c2a83581d5ccdcd867c4b2be2ed 🔍`
SHA1	`fe4bddba5e07bb82c4ab0cc8320c5dfee2de7ed0 🔍`
SHA256	`6bae84aa9ef2508ae36833babb6490dbaa8d8a6c15c8ad344e670387514ee182 🔍`
SHA3	`74b43eca1d407a8bdfd3758762ba1ca0af0bec46b432c8e07c8b5eb63781301c 🔍`

18

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x1a68`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.9196`
MD5	`535212411c050ba4c20dc0dd4ac2a84d 🔍`
SHA1	`8609d19ddcdfb382a54fb1d08cbca571fc8741dc 🔍`
SHA256	`759e6ba8ea4809de9993cbbf619ff9fda9ca74d1dea1cb329422f843d4773bf4 🔍`
SHA3	`b413649a8bdcfd76c5543a45700ac5f239350f537394e51a5215a8a85850d479 🔍`

19

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x10a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.61388`
MD5	`d1e1f609b40a4936393fbc9ab247c3d4 🔍`
SHA1	`1e3965ea2eac542f6bf37d05523a7078008439aa 🔍`
SHA256	`5081587c7f3b07e5101b4764361929b877571486f0d56ad275f2a625a637650e 🔍`
SHA3	`566c169d1b448a464a90c70d8e6d2f933dc160934c02ec4eeca400d3dd27b104 🔍`

20

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x988`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.63644`
MD5	`86fc873e90319be9ec6377cf12b0db6b 🔍`
SHA1	`1fae697f4b4543fad8fc53524bc7bd68c01a97f6 🔍`
SHA256	`6df5668d92ab7c0215facda39b78c40d2bb68a92d8334860662f0c6080307b2e 🔍`
SHA3	`a8925da55401fa967ed116dfe31e2847e21d4cdfdf7f89269023ce555b20b433 🔍`

21

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x810`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.12812`
MD5	`013c821ec65ee808123691f8bb91626c 🔍`
SHA1	`b310af030fc4d56ffae0a6d0d0626f654f4aa4cc 🔍`
SHA256	`3a093681a04216668f7331c91790d8dcc9cbc6cc096a1c899c65c477b1528b49 🔍`
SHA3	`921e98185f54101e1a517aae376c1a20f7f44fcd5c1c8d1956c9bf1b9380fb44 🔍`

22

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x468`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.40987`
MD5	`894d9c996ed23ebfc0172d94f75b3888 🔍`
SHA1	`84fabff5c4987c5dbb456536ba523c00b8ae844f 🔍`
SHA256	`21bee3482cbb2cb4b19efe87e7e2db871a5e4cb645dd5851f8c00974784c9f12 🔍`
SHA3	`9b187b9ca0a7f5c02f1fdb010ab874493b45e34b75d519f809ecc31fbc04b252 🔍`

IDI_ICON_ABOOK

Type	`RT_GROUP_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x13a`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.2753`
Detected Filetype	Icon file
MD5	`c3d6071c5c74b7c8d1daa49e340f6a09 🔍`
SHA1	`4561d4aa5f489fb0575cd79dcfdd1464c4f91c8c 🔍`
SHA256	`4a0be49b1bfbc3ee7889a8cb6fa66afca4db68eae6a2b1a7badae279ba7402db 🔍`
SHA3	`68c12b7e02fabd4e779c033bba804fa7e11d88d7b171a36ecff3c93831645830 🔍`

1 (#2)

Type	`RT_VERSION`
Language	English - United States
Codepage	UNKNOWN
Size	`0x39c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.55163`
MD5	`238567d53d3f29b8e43c4c22023e2e62 🔍`
SHA1	`e009c931dc6fbe0f8d12fbadfa81f62c72f0b43a 🔍`
SHA256	`fe1f05efa720c33826fc3d07b6bdb0e101ce3887c2a62e90f2c86cf217a49e10 🔍`
SHA3	`792cdd4784516893543f61f26d1e1c2b0d147aa3c344fafe1f97fd716e6d1cb3 🔍`

123

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x2d4`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.98381`
MD5	`5acbb7b21b6459c2cffc45bd683494ac 🔍`
SHA1	`88e7ee9ca26d58714e31e1128fdb380719a9a500 🔍`
SHA256	`18d4cb1668f5ecb27c6fd6974c9efb58991e638d6b8574789814467406761fc0 🔍`
SHA3	`923915a504da67b13f127effd6d94c12cb69638eaac2c5ce9141156b9e70a02f 🔍`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	10.0.26100.8972
ProductVersion	10.0.26100.8972
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT` `VOS_NT_WINDOWS32` `VOS_WINCE` `VOS__WINDOWS32`
FileType	`VFT_DLL`
Language	English - United States
CompanyName	Microsoft Corporation
FileDescription	Microsoft (R) Contacts DLL
FileVersion (#2)	10.0.26100.8972 (WinBuild.160101.0800)
InternalName	WAB32.DLL
LegalCopyright	Â© Microsoft Corporation. All rights reserved.
OriginalFilename	WAB32.DLL
ProductName	MicrosoftÂ® WindowsÂ® Operating System
ProductVersion (#2)	10.0.26100.8972

Resource LangID	English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	1996-Jul-06 05:52:43
Version	`0.0`
SizeofData	`34`
AddressOfRawData	`0x9e4c`
PointerToRawData	`0x924c`
Referenced File	wab32.pdb

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	1996-Jul-06 05:52:43
Version	`0.0`
SizeofData	`932`
AddressOfRawData	`0x9e70`
PointerToRawData	`0x9270`

UNKNOWN

Characteristics	`0`
TimeDateStamp	1996-Jul-06 05:52:43
Version	`0.0`
SizeofData	`36`
AddressOfRawData	`0xa214`
PointerToRawData	`0x9614`

UNKNOWN (#2)

Characteristics	`0`
TimeDateStamp	1996-Jul-06 05:52:43
Version	`0.0`
SizeofData	`4`
AddressOfRawData	`0xa238`
PointerToRawData	`0x9638`

TLS Callbacks

StartAddressOfRawData	`0x1008aa6c`
EndAddressOfRawData	`0x1008aa74`
AddressOfIndex	`0x1008e10c`
AddressOfCallbacks	`0x10002abc`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_4BYTES`
Callbacks	`(EMPTY)`

Load Configuration

Size	`0xc4`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x1008d440`
SEHandlerTable	`0x10009b80`
SEHandlerCount	`2`
GuardCFCheckFunctionPointer	`269023056`
GuardCFDispatchFunctionPointer	`0`
GuardCFFunctionTable	`0`
GuardCFFunctionCount	`0`
GuardFlags	`(EMPTY)`
CodeIntegrity.Flags	`0`
CodeIntegrity.Catalog	`0`
CodeIntegrity.CatalogOffset	`0`
CodeIntegrity.Reserved	`0`
GuardAddressTakenIatEntryTable	`0`
GuardAddressTakenIatEntryCount	`0`
GuardLongJumpTargetTable	`0`
GuardLongJumpTargetCount	`0`

RICH Header

XOR Key	`0x83598acc`
Unmarked objects	`0`
ASM objects (33145)	`5`
C objects (33145)	`26`
Total imports	`525`
Imports (33145)	`39`
C++ objects (33145)	`5`
Exports (33145)	`1`
C objects (LTCG) (33145)	`117`
Resource objects (33145)	`1`
Linker (33145)	`1`

Errors

[*] Warning: 2 invalid export(s) not shown.

Leave a comment

No comments yet.