Manalyze report for d437fd760587d24e094864215b86a441cc64ab897cace2b2a21a46614b3f4e36

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	1970-Mar-05 10:37:52
Detected languages	English - United States
Debug artifacts	E:\workspace\metatrader5\Build\Installers\Distributive Core\Release64\core.pdb
Comments	https://www.metaquotes.net
CompanyName	MetaQuotes Ltd.
FileDescription	Setup
FileVersion	`5.0.0.4816`
InternalName	Setup
LegalCopyright	© 2000-2025, MetaQuotes Ltd.
LegalTrademarks	MetaTrader
OriginalFilename	Setup
ProductName	Setup
ProductVersion	`5.0.0.4816`

Plugin Output

Info	Interesting strings found in the binary:	`Contains domain names: https://www.metaquotes.net metaquotes.net www.metaquotes.net`
Malicious	The file headers were tampered with.	`Unusual section name found: .fptable` `Unusual section name found: .cod0` `Unusual section name found: .cod1` `Unusual section name found: .cod2` `The RICH header checksum is invalid.`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: LoadLibraryExA LoadLibraryExW GetProcAddress` `Functions which can be used for anti-debugging purposes: CreateToolhelp32Snapshot` `Can access the registry: RegDeleteValueW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW RegSetValueExW RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegCloseKey RegDeleteKeyExW RegEnumKeyW RegQueryValueW` `Possibly launches other programs: CreateProcessW ShellExecuteW` `Can create temporary files: CreateFileW GetTempPathW` `Memory manipulation functions often used by packers: VirtualProtect VirtualAlloc` `Leverages the raw socket API to access the Internet: WSAGetLastError InetPtonW inet_addr shutdown select ioctlsocket WSAConnect setsockopt bind WSASocketW htons WSARecv recv WSASend WSAStartup WSACleanup GetAddrInfoW closesocket FreeAddrInfoW send` `Functions related to the privilege level: OpenProcessToken` `Interacts with services: OpenSCManagerW EnumServicesStatusW OpenServiceW QueryServiceStatus ControlService QueryServiceConfigW` `Enumerates local disk drives: GetVolumeInformationW` `Manipulates other processes: ReadProcessMemory OpenProcess Process32FirstW Process32NextW` `Changes object ACLs: SetNamedSecurityInfoW` `Can take screenshots: GetDC CreateCompatibleDC BitBlt`
Info	The PE's resources present abnormal characteristics.	`Resource 131 is possibly compressed or encrypted.` `Resource 132 is possibly compressed or encrypted.` `Resource 133 is possibly compressed or encrypted.` `Resource 102 is possibly compressed or encrypted.` `Resource 104 is possibly compressed or encrypted.` `Resource 106 is possibly compressed or encrypted.` `Resource 111 is possibly compressed or encrypted.` `Resource 112 is possibly compressed or encrypted.` `Resource 113 is possibly compressed or encrypted.` `Resource 114 is possibly compressed or encrypted.` `Resource 1 is possibly compressed or encrypted.` `Resource 2 is possibly compressed or encrypted.` `Resource 47 is possibly compressed or encrypted.` `Resource 4 is possibly compressed or encrypted.` `Resource 5 is possibly compressed or encrypted.` `Resource 6 is possibly compressed or encrypted.` `Resource 7 is possibly compressed or encrypted.` `Resource 48 is possibly compressed or encrypted.` `Resource 1 is possibly compressed or encrypted.` `Resource 2 is possibly compressed or encrypted.` `Resource 3 is possibly compressed or encrypted.` `Resource 26 is possibly compressed or encrypted.` `Resource 58 is possibly compressed or encrypted.` `Resource 59 is possibly compressed or encrypted.` `Resource 60 is possibly compressed or encrypted.` `Resource 61 is possibly compressed or encrypted.` `Resource 62 is possibly compressed or encrypted.` `Resource 63 is possibly compressed or encrypted.` `Resource 64 is possibly compressed or encrypted.` `Resource 65 is possibly compressed or encrypted.` `Resource 66 is possibly compressed or encrypted.` `Resource 67 is possibly compressed or encrypted.` `Resource 68 is possibly compressed or encrypted.` `Resource 69 is possibly compressed or encrypted.` `Resource 70 is possibly compressed or encrypted.` `Resource 71 is possibly compressed or encrypted.` `Resource 72 is possibly compressed or encrypted.` `Resource 73 is possibly compressed or encrypted.` `Resource 74 is possibly compressed or encrypted.` `Resource 76 is possibly compressed or encrypted.` `Resource 77 is possibly compressed or encrypted.` `Resource 78 is possibly compressed or encrypted.` `Resource 79 is possibly compressed or encrypted.` `Resource 80 is possibly compressed or encrypted.` `Resource 81 is possibly compressed or encrypted.` `Resource 82 is possibly compressed or encrypted.` `Resource 83 is possibly compressed or encrypted.` `Resource 84 is possibly compressed or encrypted.` `Resource 85 is possibly compressed or encrypted.` `Resource 86 is possibly compressed or encrypted.` `Resource 87 is possibly compressed or encrypted.` `Resource 88 is possibly compressed or encrypted.` `Resource 89 is possibly compressed or encrypted.` `Resource 90 is possibly compressed or encrypted.` `Resource 91 is possibly compressed or encrypted.`
Suspicious	VirusTotal score: 2/72 (Scanned on 2025-03-14 09:19:26)	`Antiy-AVL: Trojan[Packed]/Win64.VMProtect` `Gridinsoft: Trojan.Heur!.02212123`

Hashes

MD5	`7dadafb0e31d5ff47b2c7d08a1ff070a`
SHA1	`a7cdd11b2da8974a69601a7f31c08de1a2affa03`
SHA256	`d437fd760587d24e094864215b86a441cc64ab897cace2b2a21a46614b3f4e36`
SHA3	`72f8c6b676b4dbc46a28d3bac4f2b7e0ec5a3936cd15141d8e061f6b0d412b4a`
SSDeep	`393216:lfhcU08/Tuc2Rbh2v1vma3QBkDrs7gAtITORtmVGqW6DajgVo2t96kf2/cwB+:1SYF+bh2tm0L/skAtrPmVGmU+o2H6Q2U`
Imports Hash	`c3307d4f3d6e54c9d0ad2078f2643587`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0x23b3`
e_oeminfo	`0x54`
e_lfanew	`0x128`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`10`
TimeDateStamp	1970-Mar-05 10:37:52
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x175c00`
SizeOfInitializedData	`0x267a00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000000000A138BC (Section: .cod2)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0xce2000`
SizeOfHeaders	`0x400`
Checksum	`0x16b3fd0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x10000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a`
VirtualSize	`0x175b40`
VirtualAddress	`0x1000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`

.rdata

MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a`
VirtualSize	`0xb86ac`
VirtualAddress	`0x177000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`

.data

MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a`
VirtualSize	`0x1b74cc`
VirtualAddress	`0x230000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.pdata

MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a`
VirtualSize	`0xf1c8`
VirtualAddress	`0x3e8000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`

.fptable

MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a`
VirtualSize	`0x100`
VirtualAddress	`0x3f8000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.cod0

MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a`
VirtualSize	`0x2370d9`
VirtualAddress	`0x3f9000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`

.cod1

MD5	`b5d19b34d38f4df66a5587019ba6ef79`
SHA1	`a0d5d986669a7e08cb4412dccc9e59d7329fc38e`
SHA256	`8ecaa6a264ecc16867a99e3ff849079b7033e6bee8c35f79a7a5787fca8ca47a`
SHA3	`6050c1391071d57fc7e43b4bdca2f0a02fc249c86341702c1849387dd9dc73b3`
VirtualSize	`0xc60`
VirtualAddress	`0x631000`
SizeOfRawData	`0xe00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`3.04771`

.cod2

MD5	`f2a9afa41f6eae5cafd60eaf655f60ea`
SHA1	`6f068828b215b36fd92f7d063321111bca900601`
SHA256	`3a7baf0e7b5d43521817ad4d5f5fc862ec76952468c0eae0bb047b7ab610f3ab`
SHA3	`08f5af72bc9d3087abeee60f28d150665dd2b39a4465bcadee23292eec9d760d`
VirtualSize	`0x512260`
VirtualAddress	`0x632000`
SizeOfRawData	`0x512400`
PointerToRawData	`0x1200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_NOT_PAGED` `IMAGE_SCN_MEM_READ`
Entropy	`7.88566`

.rsrc

MD5	`ccffae914c3eb5362c3377e4483b4bb5`
SHA1	`75210ee26956e0fbc4fa6a05fc6402add5f953e2`
SHA256	`8bee2b6cd2f65d17b17e9f968bbda547ef8502242826f5d97d674026be57f213`
SHA3	`ec0465e839be167f2dc80c04fff4cba9f975789c53e7e8caa5e27deba467a284`
VirtualSize	`0x19ba2e`
VirtualAddress	`0xb45000`
SizeOfRawData	`0x26c00`
PointerToRawData	`0x513600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.7097`

.reloc

MD5	`8e975fc5bbdefffe1f5c1e653006fe51`
SHA1	`0e87580c183a58efc88422ea074d666c4a3844ad`
SHA256	`e8ccd9088afcbd42713d26a5c8d001894b049dfdeb94eee8b4ce35ad6957bc26`
SHA3	`4fca98139705650765996b49fbf2707e1add84b2b147d1eb7482e27103ed661a`
VirtualSize	`0x50`
VirtualAddress	`0xce1000`
SizeOfRawData	`0x200`
PointerToRawData	`0x53a200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.892143`

Imports

WS2_32.dll	`WSAGetLastError` `InetPtonW` `inet_addr` `shutdown` `select` `ioctlsocket` `WSAConnect` `setsockopt` `bind` `WSASocketW` `htons` `WSARecv` `recv` `WSASend` `WSAStartup` `WSACleanup` `GetAddrInfoW` `closesocket` `FreeAddrInfoW` `send`
CRYPT32.dll	`CertGetNameStringW`
KERNEL32.dll	`FindFirstFileW` `FindClose` `FindNextFileW` `GetTimeZoneInformation` `SystemTimeToTzSpecificLocalTime` `FileTimeToDosDateTime` `lstrcmpiW` `SizeofResource` `LoadResource` `FindResourceW` `InitializeCriticalSectionEx` `RaiseException` `GetCurrentProcessId` `Thread32Next` `ReadProcessMemory` `ResumeThread` `GetThreadContext` `SuspendThread` `OpenThread` `Thread32First` `CreateToolhelp32Snapshot` `GetCurrentThread` `Module32NextW` `LockResource` `FindResourceExW` `Module32FirstW` `GetProcessHandleCount` `GetLogicalProcessorInformationEx` `GetLocalTime` `K32GetProcessMemoryInfo` `GetEnvironmentVariableW` `AddVectoredExceptionHandler` `SetUnhandledExceptionFilter` `LocalFree` `DecodePointer` `OpenProcess` `HeapSize` `GetProcessHeap` `CompareStringW` `lstrlenW` `GlobalFree` `GlobalUnlock` `GlobalLock` `GlobalAlloc` `IsValidCodePage` `EnumResourceNamesW` `CreateProcessW` `FileTimeToSystemTime` `GetFileSize` `CopyFileW` `SetLastError` `GetDiskFreeSpaceExW` `RemoveDirectoryW` `EnterCriticalSection` `TerminateThread` `Process32FirstW` `K32GetProcessImageFileNameW` `Process32NextW` `lstrcmpW` `HeapReAlloc` `IsProcessorFeaturePresent` `GetStartupInfoW` `UnhandledExceptionFilter` `RtlVirtualUnwind` `RtlLookupFunctionEntry` `RtlCaptureContext` `SleepConditionVariableSRW` `WakeAllConditionVariable` `VirtualQuery` `LoadLibraryExA` `FlushInstructionCache` `InterlockedPushEntrySList` `InterlockedPopEntrySList` `InitializeSListHead` `EncodePointer` `OutputDebugStringW` `IsDebuggerPresent` `TlsSetValue` `TlsFree` `CreateThread` `ExitThread` `FreeLibraryAndExitThread` `GetModuleHandleExW` `ExitProcess` `GetFileType` `GetStdHandle` `FlsAlloc` `FlsGetValue` `FlsSetValue` `FlsFree` `VirtualProtect` `MoveFileExW` `DosDateTimeToFileTime` `HeapFree` `HeapAlloc` `GetModuleHandleW` `GetCurrentProcess` `DeviceIoControl` `TlsGetValue` `LoadLibraryExW` `GetProcAddress` `FreeLibrary` `GetSystemDirectoryW` `GetVolumeInformationW` `GetSystemInfo` `GetVersionExW` `LCMapStringW` `GetLocaleInfoW` `IsValidLocale` `GetUserDefaultLCID` `EnumSystemLocalesW` `GetCPInfo` `GetStringTypeW` `GetACP` `GetOEMCP` `SetFilePointerEx` `GetConsoleMode` `ReadConsoleW` `GetSystemTimeAsFileTime` `GetUserDefaultUILanguage` `GlobalMemoryStatusEx` `GetModuleFileNameW` `WaitForSingleObject` `CloseHandle` `DeleteCriticalSection` `InitializeCriticalSection` `ReleaseSRWLockExclusive` `GetActiveProcessorCount` `GetTickCount64` `AcquireSRWLockExclusive` `GetFileAttributesExW` `HeapDestroy` `GetConsoleOutputCP` `FlushFileBuffers` `GetFileAttributesW` `CreateDirectoryW` `SetFileAttributesW` `HeapCreate` `WriteFile` `SetEndOfFile` `SetFilePointer` `QueryPerformanceCounter` `QueryPerformanceFrequency` `SystemTimeToFileTime` `WideCharToMultiByte` `GetCurrentThreadId` `SetThreadStackGuarantee` `DeleteFileW` `CreateFileW` `GetFileSizeEx` `ReadFile` `MultiByteToWideChar` `GetLastError` `VirtualAlloc` `VirtualFree` `Sleep` `LeaveCriticalSection` `TerminateProcess` `GetExitCodeThread` `SetStdHandle` `HeapQueryInformation` `FindFirstFileExW` `GetCommandLineA` `GetCommandLineW` `GetEnvironmentStringsW` `FreeEnvironmentStringsW` `SetEnvironmentVariableW` `WriteConsoleW` `RtlUnwindEx` `RtlPcToFileHeader` `InitializeCriticalSectionAndSpinCount` `TlsAlloc` `GetTempPathW`
USER32.dll	`SetForegroundWindow` `MessageBoxW` `ShowWindow` `BringWindowToTop` `GetWindowRect` `GetDlgItem` `SetClassLongPtrW` `PostQuitMessage` `MapWindowPoints` `GetMonitorInfoW` `MonitorFromWindow` `EnableWindow` `LoadIconW` `DialogBoxParamW` `SetWindowTextW` `RegisterClassExW` `MoveWindow` `GetClassInfoExW` `GetWindow` `LoadStringW` `PostMessageW` `IsWindowVisible` `LoadImageW` `SetTimer` `LoadBitmapW` `SetWindowLongW` `SetWindowPos` `LoadCursorW` `SystemParametersInfoW` `CreateWindowExW` `GetWindowTextLengthW` `GetWindowTextW` `BeginPaint` `EndPaint` `FillRect` `IsWindowEnabled` `GetFocus` `DrawFocusRect` `SetCursor` `TrackMouseEvent` `GetCapture` `ReleaseCapture` `GetCursorPos` `ScreenToClient` `UpdateWindow` `IsWindow` `GetDC` `ReleaseDC` `GetWindowLongW` `OffsetRect` `InvalidateRect` `CallWindowProcW` `GetWindowLongPtrW` `SetWindowLongPtrW` `DefWindowProcW` `DrawTextW` `SetRectEmpty` `GetSysColor` `PtInRect` `SetFocus` `SetCapture` `GetParent` `SendMessageW` `GetDlgCtrlID` `GetClientRect` `UnregisterClassW` `DestroyWindow` `GetActiveWindow` `CharLowerW` `CharNextW` `PostMessageA` `GetSystemMetrics` `MessageBeep` `EndDialog` `GetTopWindow` `GetWindowThreadProcessId` `KillTimer` `GetClassNameW`
GDI32.dll	`SetBkMode` `SetTextColor` `ExtTextOutW` `SetBkColor` `GetStockObject` `CreateFontIndirectW` `GetObjectW` `DeleteDC` `DeleteObject` `GetTextExtentPoint32W` `CreateSolidBrush` `CreateCompatibleDC` `CreateCompatibleBitmap` `GdiGradientFill` `BitBlt` `GetTextExtentPointW` `TextOutW` `RestoreDC` `SaveDC` `CreateFontW` `EnumFontFamiliesExW` `CreateDIBitmap` `SelectObject` `GetDIBits`
ADVAPI32.dll	`SetEntriesInAclW` `FreeSid` `OpenProcessToken` `GetTokenInformation` `GetFileSecurityW` `GetSecurityDescriptorDacl` `GetAclInformation` `GetAce` `EqualSid` `RegDeleteValueW` `RegEnumKeyExW` `RegQueryInfoKeyW` `RegDeleteKeyW` `RegSetValueExW` `RegCreateKeyExW` `RegOpenKeyExW` `RegQueryValueExW` `RegCloseKey` `AllocateAndInitializeSid` `RegDeleteKeyExW` `RegEnumKeyW` `OpenSCManagerW` `EnumServicesStatusW` `CloseServiceHandle` `OpenServiceW` `QueryServiceStatus` `ControlService` `QueryServiceConfigW` `RegQueryValueW` `SetNamedSecurityInfoW`
SHELL32.dll	`SHGetFileInfoW` `SHChangeNotify` `SHGetSpecialFolderPathW` `ShellExecuteW` `SHGetFolderPathW` `ShellExecuteExW` `SHBrowseForFolderW` `SHGetSpecialFolderLocation` `SHGetPathFromIDListW`
ole32.dll	`CreateStreamOnHGlobal` `CoUninitialize` `CoInitializeSecurity` `CoSetProxyBlanket` `CoTaskMemFree` `CoTaskMemRealloc` `CoTaskMemAlloc` `CoCreateInstance` `CoInitializeEx`
OLEAUT32.dll	`SysAllocString` `SysFreeString` `VariantClear` `VarUI4FromStr`
SHLWAPI.dll	`PathCanonicalizeW` `PathFindExtensionW`
COMCTL32.dll	`DestroyPropertySheetPage` `PropertySheetW` `ImageList_GetImageCount` `ImageList_GetImageInfo` `ImageList_Create` `ImageList_SetBkColor` `ImageList_AddMasked` `ImageList_Draw` `ImageList_Destroy` `InitCommonControlsEx` `CreatePropertySheetPageW`
IPHLPAPI.DLL	`SendARP` `GetAdaptersInfo`
gdiplus.dll	`GdipCreateBitmapFromStream` `GdipFree` `GdipCreateHBITMAPFromBitmap` `GdipCloneImage` `GdipAlloc` `GdipDisposeImage` `GdiplusStartup` `GdiplusShutdown`
WINTRUST.dll	`WTHelperGetProvSignerFromChain` `WTHelperGetProvCertFromChain` `WinVerifyTrust` `WTHelperProvDataFromStateData`

Delayed Imports

3

Type	`AFX_DIALOG_LAYOUT`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x2`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`0`
MD5	`c4103f122d27677c9db144cae1394a66`
SHA1	`1489f923c4dca729178b3e3233458550d8dddf29`
SHA256	`96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7`
SHA3	`762ba6a3d9312bf3e6dc71e74f34208e889fc44e6ff400724deecfeda7d5b3ce`

4

Type	`AFX_DIALOG_LAYOUT`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x2`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`0`
MD5	`c4103f122d27677c9db144cae1394a66`
SHA1	`1489f923c4dca729178b3e3233458550d8dddf29`
SHA256	`96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7`
SHA3	`762ba6a3d9312bf3e6dc71e74f34208e889fc44e6ff400724deecfeda7d5b3ce`

5

Type	`AFX_DIALOG_LAYOUT`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x2`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`0`
MD5	`c4103f122d27677c9db144cae1394a66`
SHA1	`1489f923c4dca729178b3e3233458550d8dddf29`
SHA256	`96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7`
SHA3	`762ba6a3d9312bf3e6dc71e74f34208e889fc44e6ff400724deecfeda7d5b3ce`

6

Type	`AFX_DIALOG_LAYOUT`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x2`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`0`
MD5	`c4103f122d27677c9db144cae1394a66`
SHA1	`1489f923c4dca729178b3e3233458550d8dddf29`
SHA256	`96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7`
SHA3	`762ba6a3d9312bf3e6dc71e74f34208e889fc44e6ff400724deecfeda7d5b3ce`

7

Type	`AFX_DIALOG_LAYOUT`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x2`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`0`
MD5	`c4103f122d27677c9db144cae1394a66`
SHA1	`1489f923c4dca729178b3e3233458550d8dddf29`
SHA256	`96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7`
SHA3	`762ba6a3d9312bf3e6dc71e74f34208e889fc44e6ff400724deecfeda7d5b3ce`

48

Type	`AFX_DIALOG_LAYOUT`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x2`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`0`
MD5	`c4103f122d27677c9db144cae1394a66`
SHA1	`1489f923c4dca729178b3e3233458550d8dddf29`
SHA256	`96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7`
SHA3	`762ba6a3d9312bf3e6dc71e74f34208e889fc44e6ff400724deecfeda7d5b3ce`

131

Type	`FILE`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x2fe15`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99471`
MD5	`a7b0c71ca30d905b4ec1d9b09db48da0`
SHA1	`5c145387ae4fef4cb42fa0fa738f0fcc322e6e4f`
SHA256	`f8e7054957c7db53e3260142ebaeb78b8449759ba262a915719d4700b011f6ed`
SHA3	`3c7441958ba516bacbf95d8f37b972b1502553b5826484b5e3c64b892fbb941c`

132

Type	`FILE`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x2f0f8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.9991`
MD5	`74cb0ac5c5448acd26b2f8bd708b223a`
SHA1	`e03a7fdcfe189eeff17cce94319e708e71a9621d`
SHA256	`3dbb196b756cde18d1a808d5532205ba5bfd2a131e3ec6f9b9b2f5dc65b35c0d`
SHA3	`5982ac92571a910f45425f350cad4fd3f1f8e34af17981c490aeace0bba07380`

133

Type	`FILE`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x31b12`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99913`
MD5	`4af481084e166ccab7517a36b6d7a8bc`
SHA1	`5e99179136371e5272edfefaa39680f17d9acf43`
SHA256	`fcc5b0044511611f82e519a2e189ce2db05d8ff77b0a2d9de3e42fe8858dcec4`
SHA3	`a722f63791273e769dcd92cd7e46a674efd7742b75426d1b74e8c0595ac941cd`

102

Type	`LNG`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x18cfe`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99835`
MD5	`221de167a843164aa3e100338499e232`
SHA1	`f1c54fdafa5d115b65e998ba72746dd6238f72fc`
SHA256	`2d3130bf37bd105e9e99f8c080bbe2885da6302176037f970566ad24725cdceb`
SHA3	`01c18abb63d887b2e6643966a58f00f315b313861767d1d3521e4f94ac5a9143`

104

Type	`LNG`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x1a2c8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99805`
MD5	`4b78edb35456db48b1c8441a10bf6602`
SHA1	`c3f15a1f39b3cd3ee840117e4ca8a46f6b3c1257`
SHA256	`cf3974dc0809bfe25de6cbe5d05deba331ef6f28387efb309ef02353b72a8545`
SHA3	`e7e85ebbcce43b1fb6f4cd7684bf4f5ca856af48ce58e4fbb1f941d0621231a4`

106

Type	`LNG`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x141f2`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99761`
MD5	`c6a78494434dff9b360c0e56433b8797`
SHA1	`0ceb7492b496ffeb3c920f1980f97d95e2ddced9`
SHA256	`d7a0c62b236f603b895897fdf3b8015c4c32b8776f0e262df09218c49e1d92a3`
SHA3	`51bd91ad3f38296976c99fcb3a30421d0f87d681be4b16818cc4ad4039ee8358`

111

Type	`LNG`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x151c2`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99755`
MD5	`bd01b8f5fd3e312057756949f4056d23`
SHA1	`a4f85fbbf087dcc14ca208f778ccaec78bb6cd46`
SHA256	`961355eb11ff6d13d97a56aad38d1de5720a9ff770155b333a3133d6513bd01e`
SHA3	`93e75ed021e7ef167e44a60e632b44f84c35c0023df49f6c6f69c480c572b9f5`

112

Type	`LNG`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x14f88`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99721`
MD5	`635f2f93c8ad26c512c61d75259e2b63`
SHA1	`ad99722f79dc869bb705c7486d387995e1ce2287`
SHA256	`e296d5c6b5e36774ae9458ae9bf86fca9cea20b152799604b39994d36a509b9c`
SHA3	`09362c81714e4d7a2e11488f5c543f37b8cf461a1bf34606887f149708faf4fb`

113

Type	`LNG`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x14fc4`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99816`
MD5	`91785a5fafd166319554d15354ca0245`
SHA1	`32810345392b82efb7125d5b34b3f97c03674ce1`
SHA256	`4accaad893e59d5820fffc3925f15844783be9abefd85b3c4fa45d8d051eb1b1`
SHA3	`22072f8317986c10e07b3c1984041bc34d6edfc192c15119f0a3cd7829591e17`

114

Type	`LNG`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x14f70`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99753`
MD5	`3acc4e8c8f5bc72cca25295494bfbc6f`
SHA1	`1eeda6619bedb614a947cfef5ea8bca2beb48b68`
SHA256	`80bffe3d3378a4d4ec40d51c4c096c72c3e8297706c6b8cf45e0b39e95d0b0e2`
SHA3	`9f09cb22e0d5dd2ed5bcf9540441f3c2124205dfaf5ea22d897cca5d30a88617`

1

Type	`RT_BITMAP`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x302a`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.98574`
MD5	`61cefcbb30132f1b65096e664b67b54d`
SHA1	`a64f18a1642b2c13249b97f2c3267e962296671f`
SHA256	`7ea330142809892280a00924312d7bc01728ec15ac1c79716c4c1c1a845d258f`
SHA3	`f4cbabfad14fa81d186552f89b058278b9c2f2b938a0dd67e879d09a9b19cc12`
Preview

2

Type	`RT_BITMAP`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x1d4ea`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99851`
MD5	`ff1402d553418bd1a3df3cdc804b13ff`
SHA1	`c68d50c9c824a2e58b75e30dc93ab903dee2352b`
SHA256	`ae754c2e2f8fd597fac3b3e2519fc0dd4e3d50551995a88d5820d9e23debc3ea`
SHA3	`9c7a45f5fe49b11b5e2729c6297a47879a2d9e427ca3b02710c9fbead8513996`
Preview

47

Type	`RT_BITMAP`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x242a`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.98154`
MD5	`dd9dc5c211b35a807a3dfa2fe6a8f1b0`
SHA1	`f20b71686fb93d7fc6d63269f6b6aef049fba172`
SHA256	`bfaa2b610616d13f16dad62dff1a007a157b52fba7f66f051b2f3094491792c8`
SHA3	`7ffa3425c279bd1b91a8bb6cc610430cd8e516cfd3bdc3f47b222a28c704b3ea`
Preview

1 (#2)

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x1628`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.67965`
MD5	`a4f9307f3709cc2de8bb7da42b511ea2`
SHA1	`b4b5aefe4114a8f810f9636e15713e5d083996b8`
SHA256	`ca1fb55951208df29ef5b54e58d99eb34797deaa3275acf90ca0e1e968ff8f84`
SHA3	`7fb7976d3979ec0ce61c292c914366769e46c5a470f701fb4de15bdd7f2d632c`

2 (#2)

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0xea8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.70616`
MD5	`d5c0d32c5e5b2f660c9066f428612f05`
SHA1	`d2c0eb8a97671e641145546548d2068da41b88a3`
SHA256	`f26d47f266a1a5fe7b8bfcc4d13f905394e7684ad77e069839d60e82b057c667`
SHA3	`ebb66294c0697e71c3a67d75b11fc8c7b099ba163de85a2bd28b510ac5ca5f11`

3 (#2)

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x8a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`6.12548`
MD5	`a979f000fbe23c5a39dfd92d4d8ffb99`
SHA1	`6258e8f0646e51290b2394a9b128a9a58f2da017`
SHA256	`d6de000a241575928e74ad3c77916f4e23d43250ec4af782e11cfffbc20e20ef`
SHA3	`8e68687a13eff30806088c85cf2a83ad886dc47fc651a721bfe352921f40b24e`

4 (#2)

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x6c8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`6.12894`
MD5	`95961a6b3d940c7d3095bcd76fb37ee7`
SHA1	`93d28dca865b064681fc51ba8545a3794308c01f`
SHA256	`ea68114c282c139a55453feb211ed1833b7c56328f4c200b7bcaed824b57864c`
SHA3	`2ebadc13152e4705eed24ed529ddaf5e10299145d7057f2aa69e205c8be70547`

5 (#2)

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x568`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.74424`
MD5	`a9fdba1a4d3dd204d2320ce2d9470830`
SHA1	`d180f74e2fdeb76d16632ca98afd5cdde638944a`
SHA256	`316490aa7a00de502f9e39b03ecf6e3883e91d025cafec84a8ec02c32c541b89`
SHA3	`a536897a09ce9f01ae0b8d9895dac4592abad414ae297eeaa7f4035cfddcc417`

6 (#2)

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x3228`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.80927`
MD5	`c23975c5015640f8a5e57524423b6bd7`
SHA1	`f3531dda0c3fa2ebc1f1d28c31f71fcade1e1395`
SHA256	`f157a6a0d86cf696e9ab9f5e677265eb552db1b63d871f0bcb3a8a861c34d17c`
SHA3	`4988ab5dc0cb70800170b596c4ec1bb44fd2e257f30a1d06f97582ddbcfe95cb`

7 (#2)

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x1ca8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.54659`
MD5	`0ac456b0d4caeefb3246c40cf0e20664`
SHA1	`9a66f4b155d9f63f7f9f6189eda52a80e39f1eab`
SHA256	`1d7f06e7cc304abfddefa1ed72082efb221c70438c787a2d5867c455d6bfc366`
SHA3	`76aad6e806ef3f88534f123ffa9514ae1e663d707370eb1204d32b665a1b031a`

8

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0xca8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.70265`
MD5	`a70d7a9f0b2cc8b9f93f535fcc4062b9`
SHA1	`97ba616b4764d5ad47a117cca630cc3d043fc000`
SHA256	`af8cf5e33410a630e8dfbe0daabc8eb3a5042b1918c73de08084cdf7b7fcc611`
SHA3	`36259a97ef936dcf446247954d070d4dcc717dba1693524c886890f8e28e4165`

9

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x748`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.58956`
MD5	`77e302425aac664551a3d8f7fdab8b7d`
SHA1	`1c09059984038fa63a2ee44e9025a90d9c3faa12`
SHA256	`66a41369f441aeeb69e8efcb1c82c5d4ed8d35d48b8c7b99d49998716279b3ae`
SHA3	`10d31164ec9e1ff34c7d15620585bd99282c7650d11505ffd73bcfb5fdd71633`

10

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x368`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.47855`
MD5	`dcb27e21cffd3df0c134615f0facb23b`
SHA1	`020befe514e42a772ae0df2108e79c47bf783613`
SHA256	`07169d9df457b96ab7277aff4eb92562163f57faf637e0d7fbe57032f36a78de`
SHA3	`1865df621590f01cb2a7a6a1d2244ad41a61faebf0aa80af014227a5a235b7f5`

11

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x4228`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.46652`
MD5	`49df28d87b0fdcc552f7b36e51f1ca74`
SHA1	`0a0b5dff47f5451d64936040208cc47141647f0c`
SHA256	`b7f623a5305d4379171eae942c7d24fb672e0ee6fb99c8d1ac4f7dc8250d44e9`
SHA3	`be58c08c21f6ba9d46227714cc7a91fcc5a44b3dee089fec56482ad3fd154cb8`

12

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x25a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.43957`
MD5	`6fc8741b8a04d4e348a0bec8d845df30`
SHA1	`166009e91c0911a53a9a7d323a7394d9fab6967c`
SHA256	`a2811df37a89166c87556a711fd452158b935c20c7b438f0e84ab24171babe9f`
SHA3	`b51afa2cc1b5ca696abe44b47ab19b9575904dea3020bb822d026584540fd257`

13

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x10a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.76677`
MD5	`d9df7be5dc510e1d1c2ab235e996fe3e`
SHA1	`ff507003a526a4abe11f82805b7086a6c932d71b`
SHA256	`a2a0e0f194c16432ca2996d5533cdfc5e2e5b2962ddca902bdc88a74fdd67950`
SHA3	`c3d9fee67895a87b03dc20bf11bb8627b38d059c80dd4ea5a5a0b5b52e18b751`

14

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x988`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.92429`
MD5	`42394c51d26f54ed2db5d9793462bf07`
SHA1	`40e9f9232655124955657209a64bb098e1146df7`
SHA256	`1592fa3f46ae81face8f9482667122b452b0ad8ab11c5e3f1d0ad619f69e8e1a`
SHA3	`c5084be5f18152618d0c0d5352793789574244743ed768c603238b8da8d0581b`

15

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x468`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.78284`
MD5	`2f77886d029150c765298c9effec4c70`
SHA1	`ca6bb837e94918a51ac8013d187fdabbfbeb9a00`
SHA256	`08e0c4a7f980fc7fcaacdaf462c7df3e298cc9a17ebd78d0eda8e56bd534a5f8`
SHA3	`bf3e8565f6f13ebf9cf06d18a64ccb97b38c92485841a9f88a7f488cc8e69971`

16

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x1628`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.73044`
MD5	`ec221a0971531681682d4715da1cb319`
SHA1	`5a5eea6c4f6f12bf85c1af2cc23f3abdd864cb2e`
SHA256	`b1c2f07eaa961f10a94ab5bcab2a3add6ecadba75543d592adbc025240114f79`
SHA3	`5d29caf186717034024710c1c7d4bf384fca4d095f769aa64610130711e9d3aa`

17

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0xea8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.77121`
MD5	`9ea8ec7ce4d380195038c816bdecbed2`
SHA1	`18b9f4fac4e9bd64ed7f933860b7cf4bd7160a9c`
SHA256	`02f2081bf138ed9b4bf05c6d53d908eb97257244b4bc4cd5d2eb72dd605b5cd2`
SHA3	`d2d0d71502263d0236e14f1abc54cf3d60ea846cf87db01d2c174e9e38fa13f0`

18

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x8a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`6.12278`
MD5	`456d15140b2eff19aca1fea296ea59a1`
SHA1	`5a2f35a595b9966d95060442c2240bc47f790983`
SHA256	`ed388af13dd808c5c81d8f09d2b7fb262c7b1f8b861ef23d36524b1c6ec69fb0`
SHA3	`5965f19c12d4a772482af382bcd96c8a679e4fa1b8dc953a81b7fa0ddd479830`

19

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x6c8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`6.20635`
MD5	`71815551e6d9883dcfe8e5c52ffb4ce9`
SHA1	`8467d2458da68b30d09c3882680ed0f92fd8c127`
SHA256	`b4339d71f050de5e5e45d6dd79864263a2763b798fcc80437df8e1205d5e3133`
SHA3	`f35d503dec20dfc79c1d2fe25e405dcc903631d5e6c2344664b8f6715a6051b9`

20

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x568`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.13468`
MD5	`1bdd8143e528e1fdf0290562e721b732`
SHA1	`107247c276c57de17042897a0b99b15cb419def4`
SHA256	`7908add7f34ced368e3151ab3274f85b7828a8b82d6717e1682aaf6b982a86a0`
SHA3	`844f225a0cc002892085a3d105faa8c35665c3de2cf8b3eb9707a47e61a0cca5`

21

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x3228`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.84962`
MD5	`d14caf3418475c2d7892ec31995ce89d`
SHA1	`e90d2c2d4bd5e1fcf07f639d883bb083d8c6b429`
SHA256	`c95af5b331280d5f4ad51ef3615e1900bb44f3067adffb4b19e6befa015dcf48`
SHA3	`c51a5c4c44ca7088ca501b5f241dc80ab0432ebe91fac638369fc28a7fef3f7b`

22

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x1ca8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.66289`
MD5	`e61db91f962d1bdad80778618d927669`
SHA1	`574c159d400e05300d75c25cd3e20f90985f8cbf`
SHA256	`c4bc42f05b212d1c9577f72154f309abfaec9a9b1fab8f442a53f16789933776`
SHA3	`6338e2b4aa1cc5fabc72f34b3fdc7391a45e4e23a678fc5b793d649e7262c1f5`

23

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0xca8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.65557`
MD5	`c5cc7f5f2740b6db733834807540a9fd`
SHA1	`59433bece0ace1b4a4cc6b793a81d07da7a83869`
SHA256	`24f5ce99fb0ae51f108104c9dd9f366d19d0b12b951b4c6e61a23e48fc0fd66a`
SHA3	`31b088a6a81617ad73234c9e1ae5278f4b34b23ae4f07cbcb9ecce246def0248`

24

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x748`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.6315`
MD5	`f5ab1eaed94056b793f60bbb035647f6`
SHA1	`0bfc522bbe16a5394f38b8375471fbff1b632f3f`
SHA256	`ec618294877d565ca6e14036d279acd731edbaddc49abfa8432e760346304c27`
SHA3	`ea6cb01b52e2b32f33d8dec4cc6c5111927d8d6512d5a82707f39e98cc296ccf`

25

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x368`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.00611`
MD5	`cfbdf0971fec80d74062961ff69846b9`
SHA1	`532d746af3f8e00b1c9ba605f28c78fd6de8fdd0`
SHA256	`3ef95a39fc1e7538543fa64a76336ae9f4e63f7d1dbe92783f4ceb298cba7514`
SHA3	`8146266ef85500bb410e2282d9b14c0618609d7915df96fa69675b39befc7d91`

26

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x4228`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.50486`
MD5	`7b236dd31255ea229f3f627003bf70cc`
SHA1	`8a756a22435ced141669b9e74b458bfdb1f37b19`
SHA256	`9007d991913ec8586670181dc130cc6ac32250e9c115c8f67725f35c97c1a91b`
SHA3	`08deb45d618f30ffc949c88a52649f916e024b1e8d63fbce92d31893afdb4ed0`

27

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x25a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.52207`
MD5	`5215cb23af8ff8fcfae66304b618332e`
SHA1	`60a824cfe807c52a99cd738da4d9ca525b65b5a9`
SHA256	`c636ec236d46aa6527a5e2ef237566323d86e0caac7f00327426cd91728bd4ce`
SHA3	`2ad53594da169fc8fcd4f1c0da7d209d98a6b0a452dae458cad37fd507233932`

28

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x10a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.71088`
MD5	`b95b7f9d33a20dca74d0ee1da3d20965`
SHA1	`a49cee8596affeeb0e0399c2fd673c70df60c35f`
SHA256	`65aad763fb43089a4690f8763a6331b1ab118ad969c53821aa26fce31f49ce1c`
SHA3	`7a304d6cae5d7e5c0ba90257b30781367f7f248c468aed43fce1863121d334d1`

29

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x988`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.95544`
MD5	`7b77958cf4939a4bb874dca483bcaade`
SHA1	`e2c6933338605538f0adf3addf817bb32518d750`
SHA256	`c04a91b82289d6f0cd45f7883d0effafab5409cf7d7b607ff52c02b826e618e3`
SHA3	`21621f562d6e78b8fba7675bbe04c2e4ca5f35ab2f1260dbb274b15177eb612b`

30

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x468`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.54941`
MD5	`1c54db6abc1f2b9588893c8afd50a720`
SHA1	`ccb1ec354badc60d6e02553580b7d5c3bba7699b`
SHA256	`7de670ef74e6aa318c7c2654a94d5b0233a5a87c62eb315c75946883c481d49b`
SHA3	`fc54da05365ee1f5946fa1d4761a972f117b47519a1dbd7c475859002f1d33e6`

3 (#3)

Type	`RT_DIALOG`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0xb8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`6.86707`
MD5	`8f3ca3e30697b76716e440588a361215`
SHA1	`21464a210db6d5e948fe238f3de6b97cb68b7412`
SHA256	`99e17773f2419903212f1cb15cde0d2ec483be9e32285c9c22d184caea07d31a`
SHA3	`9b61f84f2fba1ec072e696b46111471c6651567aacb0db38e5d8d9151273a527`

4 (#3)

Type	`RT_DIALOG`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x106`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.21969`
MD5	`39561af8053c0e374a4dec3346423590`
SHA1	`b0daaeb2889d14f6633156c2cec3e84370c4db3a`
SHA256	`da71226e6604031eee41eedaf00c6740da677d5b1172f1f55437cf033de6e5d2`
SHA3	`f7cc1d89cc9b3631b68a04e146abd2c979d219172c5a0f3e928d6039750c8a1d`

5 (#3)

Type	`RT_DIALOG`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x304`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.72119`
MD5	`0747f778511849a0a3b6005062ad73d7`
SHA1	`f031f599e5234d789df610c6cb834e07590721bf`
SHA256	`1be2953b8869726fc64fa16fa0b253ddd6521a32d004dec978a9f866a75eccb6`
SHA3	`7a415cb740c17f49a386a5e610a33b8de6d9d44dd4c7a8521889b87b48dd7285`

6 (#3)

Type	`RT_DIALOG`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x1a0`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.49951`
MD5	`8a7908f5057bf60ec9cb482009c53aef`
SHA1	`b3d211be16beef7058fda854e75326dfd75edff3`
SHA256	`ea797dc207adb6cf771e517a5ef7940fc39313ceda53bef974d3b563c3bb9404`
SHA3	`faaec55e2662c7e26bc9b1f74e3a6d3b5ca4665fe6d3543aa819d09211b57127`

7 (#3)

Type	`RT_DIALOG`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x376`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.76312`
MD5	`47dbf2b4e3dc34e4aeb1c9757dcf8571`
SHA1	`45dabed3cebfa4ad6859b560f23c2b7fc51fc7c9`
SHA256	`fd49ea6a0853f3443dc4836e913f668ff3939ef206068d6a29a30b92419b87ec`
SHA3	`e879a63a9af70381da24f0ad84c1a7fa35513188f63e8f59d9458b4428a22ff7`

48 (#2)

Type	`RT_DIALOG`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x260`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.66388`
MD5	`683ce6dcf250494a8bdf690b8b768515`
SHA1	`41c15036cc1cd0bec029d6da5c5d59fe156997c8`
SHA256	`923f472de587ede34601065b86549c778f1513f4478785934b4474cb5706965d`
SHA3	`17cbeeff10704a71e507bf256cab40c58c0d0b6bc3d43eab635ef527a1028d22`

1 (#3)

Type	`RT_STRING`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0xcc`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.02388`
MD5	`aa034ca4e1968161450fda0ed0f71b09`
SHA1	`2fe17fbf4fa7532c8e1f862c8b5ad563360ff948`
SHA256	`f3124b4333dfe07350063fa36a12a724a413d8633453d246ad11050ed9114e61`
SHA3	`79dc38fb84253e5ff9b992c30f62b907880797853fda7ddd6997d8e891bb1156`

2 (#3)

Type	`RT_STRING`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x272`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.68174`
MD5	`9dde906f94871f60cb2fd8f4c984179f`
SHA1	`f8f21ced5e09133783f309639a74de8c00d30d43`
SHA256	`9341550afa1d542e6a77682889f8b795cb3501301c5153ee9448c95b776db77a`
SHA3	`350665a6b057bfdf440427d55daf452c60bdd7f7cc1c7d07a17a8e7231d00f03`

3 (#4)

Type	`RT_STRING`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x1da`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.54709`
MD5	`8745fa8a5a8bb5efc8bfc00455796948`
SHA1	`a8e3ba719654e32dff2aa7873a8cfa81ec207317`
SHA256	`d847c7ea7594958a6b9010eabe2574bfa6edc898202839310961d12e9cccbc99`
SHA3	`bc0e59e0e2145fbb49f0a1b1b193d9a293f4291d3e1d91f9a4f56873dfc60262`

4 (#4)

Type	`RT_STRING`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0xca`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`6.99708`
MD5	`30a026dbce6c5012d5fb47576d6c68f2`
SHA1	`b2152f24b0cc5cfaad34c448f217ddab05e97a69`
SHA256	`8a80137f836681a6a84566530368ec830dd9882e70a892b63e5dc26aa54af92d`
SHA3	`64d9e91db61709997036cc403175c8665b6fe8973a23e027b35ecc82db692f6d`

26 (#2)

Type	`RT_STRING`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x130`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.34503`
MD5	`d5985ce34f9863e0ced18ccdc697d6d2`
SHA1	`447e856622678435179fb8bafad9645bbc0e9839`
SHA256	`603f29d2f2d7d5309451c1b5d0aef80cd25cbf4562a813c2e75792f94a736ea8`
SHA3	`313320ba52f8191062d3190a9e267a425bbc314fcce1141c212300aae0c31b7b`

24 (#2)

Type	`RT_ACCELERATOR`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x30`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.37663`
MD5	`4557c21bca921059b92531e44006d040`
SHA1	`fc93cf13a9c35bd9f235cffd52e5ca22cc24a137`
SHA256	`e4e436452d98067f9ac0e26fc1194b803a7517b8c7be643b9e2677fe4d99d169`
SHA3	`000a6f3809d4de956a79209d09ff128ea915fe56f7058b1bdaa576b2624dd69a`

58

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x114a`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.94628`
MD5	`ecd314fcb62fa2e47ee63d16f002435b`
SHA1	`69c46122ed6b57879eb50537303d33a973db721c`
SHA256	`757634159992059aa6e3a7b551f9fd01502a1ef76ab3c1e6439aa5f06a15031c`
SHA3	`651d881348e6aaca1be91eead474fe2b6b71fd758dedbe8d7eb5874054a8c803`

59

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0xa30`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.92743`
MD5	`5fbb2a717a04e2bbbfedfcc06f9e7c9e`
SHA1	`04db641ecad8fa8c88761ae1f417cad8925e9770`
SHA256	`88c985bd2e4a01754faa8f0b70e608972200083122257eeb0d4295d924391758`
SHA3	`86c034ef697b21395f968a5eb17ce4d88f0287a699a4b8400fca88d4742da281`

60

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x15d6`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96363`
MD5	`d53aea962087065a0c4c134816e2aaf3`
SHA1	`7ced994cddb1be8141e9f9d7df7b3ecf425e515c`
SHA256	`287a4dda2408e70cde61dd6f6b3326d384dcd54c608d25715a6ab29a6c9b3256`
SHA3	`5a703ed8cdc258dc51571e8579dd2772943f58149b2997a05388dd9ddfe8da99`

61

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x145e`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.95214`
MD5	`ac21126c294bc625d985ce655fdcec2d`
SHA1	`157bceb117813891ce6b48646f436bbcf810c790`
SHA256	`d2de8fa23868855c8d701ba376915f3930c38ccfeb86cb39bd0e7308308d5d81`
SHA3	`961bc08bdeceaf673bd8728d68092b858ef436b27576e499924e2de92ad3763b`

62

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x1380`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96656`
MD5	`5fd0acce94d45a542dbbd494e760cc07`
SHA1	`8551cc0e81d864fd4f5d3e88b9bef2e04676f450`
SHA256	`4846bf84a605bda628ded338adf5a38d42b052396e6d00a064a1ac7254876569`
SHA3	`343f3aad47ae96e7f58c99d6a1c741626c78c2d11c8f6b99d881fb277faca8d1`

63

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0xd5e`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.94199`
MD5	`ae526ba8d3183e0d815a0c87c66d553b`
SHA1	`ce7a172b0d884a5abcebd5364db2a5fa92688d7f`
SHA256	`bfcc05d7cedd3c1b816f65fc325e3561646890e912550f81e0914bf9e1528497`
SHA3	`04074fa35a3e22e91fdb6f0de6eca188fa8549bbc31c8f06ac3a504e936239c6`

64

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x135e`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96533`
MD5	`2a07578bc2c57e903a8e52dcc754908c`
SHA1	`fdd266c22d502e0c8a21b70349732ef96bc9ec62`
SHA256	`fc221f982ddd889bba7667c5415cf09c3e9ca09c9d919d4b1e3e2d9e4b4808c3`
SHA3	`f4297029fda772eb2a61fd33f24134931f84f26f148a7a27212c5996223bc9ae`

65

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x135e`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96169`
MD5	`b773c01de889c2486136a3518f7097a7`
SHA1	`58ebf4d183b4c7596a2c0cf50a013ae41281fc90`
SHA256	`c9e417b34dc766622a49b3c1825b53895b3afc30ff628c056a37c9888eb717ab`
SHA3	`2414f174a8d9407078e8082bb573b308e9c386fa10f9c005cf1efa9a3673444d`

66

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x12d0`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.9649`
MD5	`652e2244c4853b11c25ad0da696e4340`
SHA1	`bf66a3e1d2a18e63052fecde229a17148bf64dc4`
SHA256	`bce9ae63b48d07b11244240292f69bfb985c1a41bdd2ad197031ea78e8d3b0fa`
SHA3	`0613b586a0da990f2722a3e4bfcd946b7324060ce70ac31c0d629edba8af25d6`

67

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x13f8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96552`
MD5	`a4f2126d51e6d15a98cb58f254f4b3bd`
SHA1	`37197376119449aa8f1bf27e747e82e7fd8a6538`
SHA256	`418a342d02a60245606092d6d49a7ec28692c27ff126b6d24d1a1df058a81c9b`
SHA3	`a5d6e3a4c016dd38c1567fa805e461f44d72c0fef1f5e464837e57dd12b57852`

68

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x12a2`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96183`
MD5	`23ea5ecf00f87acd60d83445ffad9169`
SHA1	`342ef072b61904252b4dd57af9311dd36e3fd9be`
SHA256	`d2d13e8b196e5a132e7490c8bcc2b705a70f481f28ded697d249b85ed615d0fc`
SHA3	`a801100b4e220830e9be4317d2fecf5be22466a8d5e1ae90c1bb8354de41b1c1`

69

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x12dc`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.95797`
MD5	`985079f273de20b5d104f05243954c31`
SHA1	`ffbabfdd72c7ffbf451d9d26bf336c1bac9101b9`
SHA256	`816f25e1c9910d8593637d22c69c84a76ab3447dae87e170a273dff2ca8f2e47`
SHA3	`e3ccd6fbc0df96728858f526c91229f1c30a141e3eb51cf2036a000d10777c3f`

70

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x13ca`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96651`
MD5	`89839c1617595904908a41c9e0f1d948`
SHA1	`8e59566bae67e63c1c6e3b6a5ffe22ec3e285e38`
SHA256	`dad68328e494875763a349723be0dca0c4031aafe3cac6570bffa84cb2f919f8`
SHA3	`d729074bd89d7295db3707084dbad7c7b8139f9ae7d9d330ebc03c017591ab64`

71

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x12e6`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96024`
MD5	`54acc1869e6560564bf29ea8c1260b38`
SHA1	`7d859813da70eb49ea9a499806d3aa4f54998ca6`
SHA256	`7350414f48979fde96fa11746839cd4d85a8a5d0ef265223675279f6b0515786`
SHA3	`59057f002a50806ca3b20800399b11ca1e66945672e5695c21bc07d655a51782`

72

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0xa34`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.94017`
MD5	`419bd134e49a18714dd2af8e8395476c`
SHA1	`60493c4ad27a5dec5b4c15947e5aa4fd19cc20a0`
SHA256	`a45febde6a51ac19bdf0301cedcef268dbb6f431df3db239f2112d14fff303b0`
SHA3	`f8f82565d274e04ea9a3ada115ac9da6bbb96b1f4208a8ded9c325713c03fbc9`

73

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x1256`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.95873`
MD5	`1471f893be2cfe9e2cb656313cc23b62`
SHA1	`33f7ae9fca45bec69ec5209f6573c0269fe7537d`
SHA256	`cb417e2c1b6dd217ee696d1f2a2903b72db79b23759f9a7f4014d705e018e4ab`
SHA3	`7b85305cc24d3495f94c46be48454458e2bddd36bb4dbd8623e7aa338c109cd3`

74

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x1152`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96701`
MD5	`2d8fc9bde0ce73f977dd2957eb8e5102`
SHA1	`f2ed6bfe530d4b561309eee0c14d2d39c9150976`
SHA256	`b4d938e12a979f841e7a1038235bd939cd017e4bb0aca2df53f8d2f3da2271e9`
SHA3	`c48039e97b042f02121dabe08e7340440748fdfc4a752cb4868824673fe23290`

76

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x1246`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96053`
MD5	`5f19063376d086d29007594875213b35`
SHA1	`bfc47731160824c499b5f5c97a9459be077665cd`
SHA256	`5516a74cd2241c4068bf792a286dc6df5a2b882da09db23beb66e628d4d95ff8`
SHA3	`93090ea3e29adbc90bb56c0344a7e2f82ee81e0b3aa4b160a60686ccd296efab`

77

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x148a`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96502`
MD5	`652cc22ba7e62d6bc62241ca533b056d`
SHA1	`7b339fc54ff972da6b03e69e4cf87cfa16648ec0`
SHA256	`10dec36b12c650a73ffbf4d5fbdcfb9054597130a3fef39fa5a019f8c69fc7e0`
SHA3	`296be546264cc5375f47928ae58919a2cceb068a1bc0871a180e5dade4922b23`

78

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x12ee`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96596`
MD5	`51006f296e40a382ea7a2747e4486956`
SHA1	`b08d5178aa5bb621de833b8147d6a633df5a41e0`
SHA256	`ab8624d1a7dfcf23def6f12ac5031d9253b9b9b354f157345c27b27ec7425a45`
SHA3	`59bd99a09f3153a0369a16d302755a187232843e54bbce9eae15080d2ab6ef53`

79

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x1028`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.95239`
MD5	`c5bbcc87b033592ba1d4a920b58e30be`
SHA1	`301953a67d411aa819d5ff68a42f3ad8052a2b9e`
SHA256	`00d1b85e6a0e341625f4b2b5f406e82d87933e84ee26ba3397d110a34cff40fe`
SHA3	`52f68e97ed253a493efc9b09e98d11b9f35fa8f1a43c8b74ab09f62e9a553a01`

80

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x1104`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.95891`
MD5	`cd1f3760ecb65ad0824f0c7352e7b854`
SHA1	`ea3b4582f520c1b678ff6e4cff6301a1d5e8e92f`
SHA256	`beeb4ad60c1a97b793dcf372a259eaca081aa81b08acc2ea33973297c590b536`
SHA3	`9bdce2f9a8f200e3106cf8488492b14ace9aadef4444e02a00280a1fc20d3964`

81

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x1268`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96432`
MD5	`06824df7e185dbd76e861355f00c9358`
SHA1	`875fc3f82366dfeca9ce688afc9744ac5d67a559`
SHA256	`e25620b5ed5d9d1d662b733068c5f3474fe46aa949cf3e173e933742978952ef`
SHA3	`1627600eeb541bc0d6a8281cba96b9139647f924bda47c6918d7261d89013c7d`

82

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x12c6`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96663`
MD5	`502e0ad62ea0976b726cd7db0a9212f7`
SHA1	`bbebe8d969d8d1cfce67715c2e2028d9f08cbb0e`
SHA256	`4b5502ced0c7fea09bc92dd9b9fc091d6b51d983603b5785dd15b00b74a7eb40`
SHA3	`a5bf9080ed8f0aad415a861659f4a17a47391ad3498ff87eb729c201dcfa7450`

83

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x137a`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96037`
MD5	`ddf9a61572af5d9e5e8c14977a8c73f8`
SHA1	`c61736248a3d664a0b36642c85dc2327ec358986`
SHA256	`62af9805ceaf9ac3ac897cab3b555e2f7c3d08aea80794e525f41fa4f1cdca1f`
SHA3	`0c3722fa1af1af10fa6ac13fd091676c9e3c787daf5bb690c22cd75e87275d5f`

84

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0xc58`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.93999`
MD5	`2721935635350f377ed44da02ecbfec2`
SHA1	`b2f303bb31b11393e62af4d51304b7214f85b2cd`
SHA256	`55f5f28ca85b458d424d74eb7aa9375f8ca6a039709580bcd6475d5813b0c745`
SHA3	`7ddc67a01542ce13e90887960bfaa52403fccd274e3d64dd14e24813d5244847`

85

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x13ae`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.95948`
MD5	`11dd84a9ab02d7a0bf164473f40163a1`
SHA1	`2c50dc72633d85aac7c28632e1f9e3603cf810bb`
SHA256	`da16b1783156fcfa4aa925e5c318724aef73a56ebb1018e1b13615e4dab7fdde`
SHA3	`6f93f04ec21656e236b25cda93dbf8e93c0c6dfa7cee7c4d87603c7432d90262`

86

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x1326`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96193`
MD5	`e44786248450922b03db884a9e248415`
SHA1	`958e879a9688f670cd282360d0e9c2905d1fe845`
SHA256	`eb50020a3a65960fe6396a56c0c35e1e21beaec4798cdc27cfec492a0aa801ca`
SHA3	`1b2f4bb44cd6af9b79c81f3a5ae80de9a36b9134ed4f253e086d99ae4b190737`

87

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x12c4`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96153`
MD5	`f20c93b73a6c5853304f7eca555145d0`
SHA1	`87dd4731224b31349bde93baf47953aa310a3987`
SHA256	`75fe27a32a4b0afdc844f5efefada011a0d210e404a9e9f65c49f29bab33cc0c`
SHA3	`bdfd594f59c0c00f4bcdb10f380ebf53600141b34d4579825d5efd888a27b655`

88

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x13aa`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.95757`
MD5	`47b21f34751eae46338c08f5397962f8`
SHA1	`8a6a68f1fa4152dfd0fc1883f46e6511d587dea5`
SHA256	`42f2a1f09ea500260fc9fcb3be780c1fb25932cd425ee0358b6c766fbaab4a5a`
SHA3	`4e66a12a181d090538f886e358a8865d2ebe054a22174bccf6659695ac7c75c2`

89

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x1442`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96562`
MD5	`cbd09733c4afe70eb70c8e8099414583`
SHA1	`6491fbf943a0df824f9410f5a1376ceb0878d154`
SHA256	`4524eab8c61faa7d12e1ab66cdf22592f251daabca023197890a0662f42fb5b8`
SHA3	`ee101a5ea152c2e53577b51c0d96e4fde89d47a0c8b1d40161e19b15afb990b6`

90

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x136c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96927`
MD5	`9ef7089d922bddc732425e66399f207d`
SHA1	`7fa22f6b7566a91a3e99dbe9024afc59da86a203`
SHA256	`a7759b5adbe64e77c209dfa71215cb898ebb40feb9df3e4cf92542bb14cb1730`
SHA3	`61225f25e57e2414324a55c5c4f00ee74228963b53771f2c28c114a675c33288`

91

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x12f6`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.95772`
MD5	`d5b49ddefe9dc680f46884a115467ab8`
SHA1	`34a00e79699c3afe3cf4c4ac4b1b1193e17c972b`
SHA256	`ca55e9a044b198c637dbfee51b43bcd7aa1b1897e7c0efc8514340b05c271848`
SHA3	`ddaff9ee9b2213aede569b6cf0e38b821c1829f6035f53c6110e5f402aa75a61`

9 (#2)

Type	`RT_GROUP_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0xd8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.14068`
Detected Filetype	Icon file
MD5	`c36a0bbc1be2087583bfdb90c69451d9`
SHA1	`c3fd929ecde353dd12e558745f1381b50742292f`
SHA256	`8b12a6a7a6eef253de52acdd373a5823b9ebddcb832d4bc8a35e3808b267f66c`
SHA3	`a4e53019925398311911f8bc109b82bba8c5210e3e055840988fe922dee257ef`

33

Type	`RT_GROUP_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0xd8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.20695`
Detected Filetype	Icon file
MD5	`e8b731cea258391d6ed6064e0bde96c6`
SHA1	`520b5c9696debcd1b2730219efddcd20155a93b9`
SHA256	`9ec5cf812deb619ac67a7921c5fb0f620fd2efa6d8aa7300296d7033ff3e0e34`
SHA3	`c26add1c03d8621197c62b264c4be73545ce0561483f08a603186669c70809e1`

1 (#4)

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x378`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.24647`
MD5	`df6189a4983078c933c0668172870356`
SHA1	`e2a58658f851dd92c6895b9b6ac8a032ccd8f2c9`
SHA256	`ef9839f2b33ebe711ae5c311b31fc948fe2833bd7868882c2b648117adc54e36`
SHA3	`457004c6f6bafd0479c05430f618b33449191ec3c08d51b6619060ad2f9be53f`

1 (#5)

Type	`RT_MANIFEST`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x4fc`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.3011`
MD5	`d04b0b954936b246384ac0a9ee6b607b`
SHA1	`37db50364ec1791d63e7c905e534cec55c420245`
SHA256	`4bfdda7d559a4e828a647a42044a9dc11d7b485e2cefa94c1df923b5459631c7`
SHA3	`d45c80495162727a2ba84cd80d537217af7970ec5d98268d8b16e821f066f38c`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	5.0.0.4816
ProductVersion	5.0.0.4816
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_DLL`
Language	UNKNOWN
Comments	https://www.metaquotes.net
CompanyName	MetaQuotes Ltd.
FileDescription	Setup
FileVersion (#2)	5.0.0.4816
InternalName	Setup
LegalCopyright	© 2000-2025, MetaQuotes Ltd.
LegalTrademarks	MetaTrader
OriginalFilename	Setup
ProductName	Setup
ProductVersion (#2)	5.0.0.4816

Resource LangID	UNKNOWN

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2025-Jan-25 14:42:46
Version	`0.0`
SizeofData	`103`
AddressOfRawData	`0xb32220`
PointerToRawData	`0x501420`
Referenced File	E:\workspace\metatrader5\Build\Installers\Distributive Core\Release64\core.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics	`0`
TimeDateStamp	2025-Jan-25 14:42:46
Version	`0.0`
SizeofData	`20`
AddressOfRawData	`0xb32290`
PointerToRawData	`0x501490`

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2025-Jan-25 14:42:46
Version	`0.0`
SizeofData	`1064`
AddressOfRawData	`0xb322b0`
PointerToRawData	`0x5014b0`

TLS Callbacks

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0x800`
EditList	`0`
SecurityCookie	`0x1402300c0`

RICH Header

XOR Key	`0x9aff2967`
Unmarked objects	`0`
C++ objects (33138)	`192`
ASM objects (33138)	`11`
ASM objects (34321)	`9`
C objects (34321)	`19`
C objects (34433)	`36`
C objects (34435)	`12`
C++ objects (34435)	`1`
C++ objects (34321)	`59`
Imports (VS2015 UPD3.1 build 24215)	`2`
C objects (33138)	`21`
C objects (CVTCIL) (33138)	`1`
Total imports	`416`
Imports (33138)	`29`
C++ objects (LTCG) (34436)	`78`
Resource objects (34436)	`1`
151	`1`
Linker (34436)	`1`

Errors

[!] Error: Could not reach the TLS callback table.
[!] Error: Could not read a WIN_CERTIFICATE's data.
[*] Warning: Section .text has a size of 0!
[*] Warning: Section .rdata has a size of 0!
[*] Warning: Section .data has a size of 0!
[*] Warning: Section .pdata has a size of 0!
[*] Warning: Section .fptable has a size of 0!
[*] Warning: Section .cod0 has a size of 0!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!

Leave a comment

No comments yet.