| File Path | Type and Hashes |
|---|---|
|
C:\Users\user\AppData\Local\Temp\is-B1JA9.tmp\9ea7d8ba25a4bad3016c138b414c5613d1b9df79.tmp |
Type : PE32 executable (GUI) Intel 80386, for MS Windows MD5 : 99a2c64db21979483ac66bba0883978b SHA-1 : be654b319dd9d9759c0366126db46d95218ed1ac SHA-256 : 2f9347250bb61c8026d8460ccc8f5e103d6030586a134d9d2d93ea6e176ec824 SHA-512 : 583fb26bb5e6f997a3ac0dfdc2d8b1416989cab9485096e0bd3d45f441934ad2f695bcba5d337d6e177c3876fdb70aa889224fa98a873caec51accc2e86eea2e Size : 792.064 Kilobytes. |
|
C:\Users\user\AppData\Local\Temp\is-4B3OL.tmp\idp.dll |
Type : PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 : b37377d34c8262a90ff95a9a92b65ed8 SHA-1 : faeef415bd0bc2a08cf9fe1e987007bf28e7218d SHA-256 : e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f SHA-512 : 69d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc Size : 221.184 Kilobytes. |
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1E698CCB2C296D265AC1A253974E09FD_A2E7FF7CFBC6B9BF06CE29B23F0D7A5A |
Type : data MD5 : 149b2ff950fc9d13073323594b217d57 SHA-1 : d43ece70d21a2ce7e9c62363bb76b920dfc3c426 SHA-256 : 6859fc345ec7c954881e2b69c61864019f7597aa4d1204f86a6b3445c3fa663f SHA-512 : 2203e664e3e448ae57e23d8e636604fa6848b11b8a27b4d4afbea22dd006f3dca0f346b78f9e3add5fdb6f053b81ddb77f7d395ff7140b94a297e84520c1071f Size : 0.434 Kilobytes. |
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1E698CCB2C296D265AC1A253974E09FD_A2E7FF7CFBC6B9BF06CE29B23F0D7A5A |
Type : data MD5 : dd9d1264a431cd97b8fe60efbed079ac SHA-1 : dbf144490cbb25f5bcc3606709920ecb1d094397 SHA-256 : 34f1fc1ec3bd4479e7909608bb7c8069620bf09b63e654421403fa9fc4cc200e SHA-512 : e0b2162215fa403e0582aae3a9c99d54aefb2ce1813a04c9e3b1618dbd743861f3287089e42e6b28f3d55de47b7eda2ada802d3c9bf6f9b8d58c8073af07252c Size : 0.471 Kilobytes. |
|
C:\Users\user\AppData\Local\Temp\is-VQ6UB.tmp\DRDRE.exe.config C:\Program Files (x86)\trs\6894647.exe.config |
Type : XML document text MD5 : deb1b377008e7c7a9bc805b740245d6b SHA-1 : 0fdb500ae344c4271a97c96c100a8ce1795abf3b SHA-256 : 54ef8c6bf905be93b7d4c031d7f26ac62f324f7d3780cca2bf7949152cf883ba SHA-512 : 03f744551109ebd908dfe7f2a6755049e6b870893294e8d497fc016c98e3f473421c7ad9a184aacd8a0b81d3721d05d3ecb77d6f2ba47188016130c5ee9c4c55 Size : 1.86 Kilobytes. |
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 |
Type : Microsoft Cabinet archive data, 6509 bytes, 1 file MD5 : 33b39e2a516ef730a8fa922894f0fbd5 SHA-1 : 03d455583dda59215d945af76af6293b202f586f SHA-256 : 9446e8f2056fea3ac1365a809ada04602606242c396f72ffe42fd1b781c24cba SHA-512 : 75763aa13b43eb96294b0f84e13106611198872e06fb79f4af4f35d020ed0add9d8d1b42fe7ec2c6340ac8e08b182f83469d813087c321c878f96970c8112267 Size : 6.509 Kilobytes. |
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D57B3BFF6E0B79FBD8CB6482C7775D35 |
Type : data MD5 : 1231ef327e3fb8d6a93bc964906af3e5 SHA-1 : 84f7071e434c0818489cc724703878385cf12460 SHA-256 : 83f0f8df4661a607a7a4ec80d5e885de35f8897191dc26a8d1709a2b2c1ebffe SHA-512 : 44c1e904a1a2a398b44a75fe2e8fb1812d3ed4110cb92da424f5c7aaebc5fdeec0d2f1a85b1af6df88826ecde38d835e9289b8af222049aa7a89cbb076e2b1aa Size : 0.248 Kilobytes. |
|
C:\Windows\sysnative\drivers\etc\hosts |
Type : ASCII text, with CRLF line terminators MD5 : dcda9146bd9250cc91168c3f77306a2e SHA-1 : af494df3d1bad30488d5bf3d2fb5b63489d68eb3 SHA-256 : 838dc012916563896951a35577d0101ea5145d3b0ea33684ad8c730fc0fa120b SHA-512 : 078e7e10ec90d7dfd6232f7033582f7ed76b86335f2a26234f0b3fa50c6a6ed5a52e3c93e98595c80650a68e1d4998e1c1133ee36101f00497c80fdfa8346771 Size : 1.399 Kilobytes. |
|
C:\Users\user\AppData\Local\Temp\is-1A7UH.tmp\setup.tmp |
Type : PE32 executable (GUI) Intel 80386, for MS Windows MD5 : 832dab307e54aa08f4b6cdd9b9720361 SHA-1 : ebd007fb7482040ecf34339e4bf917209c1018df SHA-256 : cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3 SHA-512 : 358d43522fd460eb1511708e4df22ea454a95e5bc3c4841931027b5fa3fb1dda05d496d8ad0a8b9279b99e6be74220fe243db8f08ef49845e9fb35c350ef4b49 Size : 713.728 Kilobytes. |
|
C:\Users\user\AppData\Local\Temp\is-4B3OL.tmp\_isetup\_setup64.tmp C:\Users\user\AppData\Local\Temp\is-VQ6UB.tmp\_isetup\_setup64.tmp |
Type : PE32+ executable (console) x86-64, for MS Windows MD5 : e4211d6d009757c078a9fac7ff4f03d4 SHA-1 : 019cd56ba687d39d12d4b13991c9a42ea6ba03da SHA-256 : 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95 SHA-512 : 17257f15d843e88bb78adcfb48184b8ce22109cc2c99e709432728a392afae7b808ed32289ba397207172de990a354f15c2459b6797317da8ea18b040c85787e Size : 6.144 Kilobytes. |
|
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\security.config.cch C:\Users\user\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\64bit\security.config.cch C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\enterprisesec.config.cch |
Type : data MD5 : 21c8a7044feda44334c6f25cbe2c917b SHA-1 : a08c94aad2962168bf54ccbcd7801daf3575852d SHA-256 : 1ec19ae1d03c03015cedb095baf67192356cf5e8b30ef9197f561778a7efed10 SHA-512 : b15858f78599a8f992eebe056457d6002984d2413bfe77a2873dac7885100a69214986debcb0cc0e515bb3a6ffac746a510f6bdd1af61cd5ac955ef67b451010 Size : 1.212 Kilobytes. |
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C07822D66105396A1B8E01486E66C5F3 |
Type : data MD5 : ae776cc08c6bfe4e05f3e9dcb6c2b5fd SHA-1 : f8502e01d429f7a16707ad68de91979c0feba6ae SHA-256 : e86aecfea259be2acbef5bda8b7f87a45ba9e602f55f854d18b6951d1c5a3efd SHA-512 : e709c5ffd1413c50ec2129f5e4c76d9e0ac2d5463d61a74879d4c4f39901b021e905ab86e000cbb79267cbafa24bcae8d4daba66450f1d94979b58160274a2b4 Size : 0.222 Kilobytes. |
|
C:\Users\user\AppData\Local\Temp\is-4B3OL.tmp\setup.exe.config |
Type : XML document text MD5 : 85ff7012c2e71989252d52213bb9ab5d SHA-1 : e52d18847fe27ad9c8b5554de28251cf53b6db21 SHA-256 : c21bc30ca71308946b5a0bfaf4435dcea3d47d1b3ecbb78123099cab6c31e093 SHA-512 : ba5c5efe43a4300800c74e9e828a796e716b5e2b2079df5a8e0736b576b36c718f14813b3d5e210e4843451066af43d8fb3e740b66980b173adc5fdf5431a420 Size : 1.862 Kilobytes. |
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 |
Type : data MD5 : eb05e12f3dbe0834ed6c903752b7f6a3 SHA-1 : 43441b64f85dc2616f40cdbaa7e2d8e2015d1851 SHA-256 : b9e0698e7288c4d802a465b879a7287d6e483f56d9c0e6bcebba6780969e95d3 SHA-512 : 42429693aa2760dbe0475a52db3441ca0cd90b1cb187d9842796f2e39f0589b2145d16b9cbccd6f4dd34999f0336d816a6a5ca07feab7fc8941aa5206c7f9ba9 Size : 0.342 Kilobytes. |
|
C:\Users\user\AppData\Local\Temp\is-VQ6UB.tmp\DRDRE.exe C:\Program Files (x86)\trs\6894647.exe |
Type : PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows MD5 : f2661647d6579b96159f9df4be9a0a54 SHA-1 : 9f7cbd1443d5bf7ea29de643fd4b1150c23403d8 SHA-256 : e09a4df7c00dc7d8058fdca67db2598634d41df1423600f9412982d0e0382275 SHA-512 : 4bf569eaeabc098b338160905d85449fba84383d451570e775282308f870c622a9c51acbadd696b27bc52a78c5609ca0faa0f353953b98a2ee7e747022c4c011 Size : 670.208 Kilobytes. |
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C07822D66105396A1B8E01486E66C5F3 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D57B3BFF6E0B79FBD8CB6482C7775D35 |
Type : data MD5 : c9fffae33637feb9275fcb554f1f44c7 SHA-1 : 5df728de2dbd208d7e3352b238dcedb10d46964a SHA-256 : a6822392d7234ebc2698bb1415aede4e27dd8c81ceaf163c3a7b562a38bb74ba SHA-512 : 7b625aad45eff49f17851ccc15bcf5b376a08fd4548a57e7ef34b392df8354d19ea3c849680c365c403b567d16c7eae23bfbe70837b7de39f50586d75ef18d24 Size : 72.276 Kilobytes. |
|
C:\Users\user\AppData\Local\Temp\is-4B3OL.tmp\BonjourEi.exe.config |
Type : XML document text MD5 : 3f1498c07d8713fe5c315db15a2a2cf3 SHA-1 : ef5f42fd21f6e72bdc74794f2496884d9c40bbfb SHA-256 : 52ca39624f8fd70bc441d055712f115856bc67b37efb860d654e4a8909106dc0 SHA-512 : cb32ce5ef72548d1b0d27f3f254f4b67b23a0b662d0ef7ae12f9e3ef1b0a917b098368b434caf54751c02c0f930e92cffd384f105d8d79ee725df4d97a559a3d Size : 1.86 Kilobytes. |
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_EE9DB89C3D6A328B5FEAFF0ED3C77874 |
Type : data MD5 : 2c1d64f416e15ee9061961126c868c9b SHA-1 : 103262e82827ec57241be3402acb3cf6f5fba0b8 SHA-256 : 048865e5ba2d3635c8af2a74a74c2f9f14784b5492da59b658e5a146a63fdc9b SHA-512 : ba1add04c1fb99c568f284106c39249aaa04ef2c45054008d90a1dbab6b7432f95b7f5bcf4c026ae01987ce4cfbfeed328a3afb9e5b5f6db282d5d64725e258b Size : 0.438 Kilobytes. |
|
C:\Users\user\AppData\Local\Temp\is-4B3OL.tmp\setup.exe |
Type : PE32 executable (GUI) Intel 80386, for MS Windows MD5 : 862dc00824907569471ebf85634d5ff9 SHA-1 : 354eff08c51bb21e4bbff602d7885f448a2599c0 SHA-256 : 323186c8a74461e33010c6a2b75a9cd2fafd265d79631301c8b6a2b5db9aa315 SHA-512 : dfde0facb7b6c5a04a43a4ff990a1a16ebbf17f639fc7ca7f65c94b9fea9a3f39b4fb084e97bd6b1f2c210f570bbe12d6472e1820c269e7ce3b0f1cf193975dc Size : 676.87 Kilobytes. |
|
C:\Users\user\AppData\Local\Temp\is-4B3OL.tmp\BonjourEi.exe |
Type : PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows MD5 : 3b3f9556fbd3dbb7986ae1ccf5ac41e4 SHA-1 : 557b649a76d9ea0a7f8dddca80b5b8ebee22bdc4 SHA-256 : 136699494da819541826d2d96548f7876a3764710217bbc469ec5ea34cfd56c2 SHA-512 : ee895e63f9bb0b7d62ce6caaf17c26ba22de49f019135980ab0f5770d27d0c030e58d9f8bfa6de8ec40be025815d5dd65ea975e3873b015f7b061e49f71f01ac Size : 19.968 Kilobytes. |
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_EE9DB89C3D6A328B5FEAFF0ED3C77874 |
Type : data MD5 : 58053ece2ea6051309cab216d7de87be SHA-1 : 1728285384a90fb90f5071ee9e4cb7ca91387e5c SHA-256 : 69c5f8a8fb3f2299c289c37e11b454dafc66cb70793e519bd23de19cbae958fe SHA-512 : 0c32db6977d41b08035b19e076982fbb491e28ae52913341a18f27f7d1934fd2f59fba7877f1f2ff4e10b73cb8bd04da7096a1f0e3d29433c4f1da40d9c3ddd1 Size : 0.471 Kilobytes. |
|
C:\Users\user\AppData\Local\Temp\is-4B3OL.tmp\itdownload.dll |
Type : PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 : d82a429efd885ca0f324dd92afb6b7b8 SHA-1 : 86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea SHA-256 : b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3 SHA-512 : 5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df Size : 205.312 Kilobytes. |
| Match Rules |
|---|
| File Name: | 9ea7d8ba25a4bad3016c138b414c5613d1b9df79 |
| File Type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| SHA1: | 9ea7d8ba25a4bad3016c138b414c5613d1b9df79 |
| MD5: | 5b1a0d21643c69a853ebdad223d6bbc0 |
| First Seen Date: | 2018-05-23 10:02:41.207138 ( ) |
| Number of Clients Seen: | 2 |
| Last Analysis Date: | 2018-05-23 10:02:41.207138 ( ) |
| Human Expert Analysis Result: | No human expert analysis verdict given to this sample yet. |
| Property | Value |
|---|---|
| magic literal enum | 3 |
| file type enum | 6 |
| debug artifacts | [] |
| number of sections | 8 |
| trid | [[81.5, u'Inno Setup installer'], [10.5, u'Win32 Executable Delphi generic'], [3.3, u'Win32 Executable (generic)'], [1.5, u'Win16/32 Executable Delphi generic'], [1.4, u'Generic Win/DOS Executable']] |
| compilation time stamp | 0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC] [SUSPICIOUS] |
| LegalCopyright | |
| FileVersion | |
| CompanyName | |
| Comments | This installation was built with Inno Setup. |
| ProductName | Move |
| ProductVersion | 9.6.8 |
| FileDescription | Move Setup |
| Translation | 0x0000 0x04b0 |
| entry point | 0x40aa98 (CODE) |
| machine type | Intel 386 or later - 32Bit |
| file size | 583077 |
| ssdeep | 12288:77blM3BoO16DOpXz+4Bxmuc/braYNS72Lim:77blA31jpK4BMH6YAO |
| sha256 | a2ab46dfeb0ca42b5c648bc94c5005d7b7c9dc7fa2d44f50d4da11f7a949fefd |
| exifinfo | [{u'EXE:FileSubtype': 0, u'File:FilePermissions': u'rw-r--r--', u'SourceFile': u'/nfs/fvs/valkyrie_shared/core/valkyrie_files/9/e/a/7/9ea7d8ba25a4bad3016c138b414c5613d1b9df79', u'EXE:ProductName': u'Move ', u'File:MIMEType': u'application/octet-stream', u'File:FileAccessDate': u'2018:05:23 10:02:10+00:00', u'EXE:InitializedDataSize': 93696, u'File:FileModifyDate': u'2018:05:23 10:02:09+00:00', u'EXE:FileVersionNumber': u'0.0.0.0', u'EXE:FileVersion': u' ', u'File:FileSize': u'569 kB', u'EXE:CharacterSet': u'Unicode', u'EXE:MachineType': u'Intel 386 or later, and compatibles', u'EXE:FileOS': u'Win32', u'EXE:ProductVersion': u'9.6.8 ', u'EXE:ObjectFileType': u'Executable application', u'File:FileType': u'Win32 EXE', u'EXE:CompanyName': u' ', u'File:FileName': u'9ea7d8ba25a4bad3016c138b414c5613d1b9df79', u'EXE:ImageVersion': 6.0, u'File:FileTypeExtension': u'exe', u'EXE:OSVersion': 1.0, u'EXE:PEType': u'PE32', u'EXE:TimeStamp': u'1992:06:19 22:22:17+00:00', u'EXE:FileFlagsMask': u'0x003f', u'EXE:LegalCopyright': u' ', u'EXE:LinkerVersion': 2.25, u'EXE:FileFlags': u'(none)', u'EXE:Subsystem': u'Windows GUI', u'File:Directory': u'/nfs/fvs/valkyrie_shared/core/valkyrie_files/9/e/a/7', u'EXE:FileDescription': u'Move Setup ', u'EXE:EntryPoint': u'0xaa98', u'EXE:SubsystemVersion': 4.0, u'EXE:CodeSize': 41472, u'EXE:Comments': u'This installation was built with Inno Setup.', u'File:FileInodeChangeDate': u'2018:05:23 10:02:10+00:00', u'EXE:UninitializedDataSize': 0, u'EXE:LanguageCode': u'Neutral', u'ExifTool:ExifToolVersion': 10.1, u'EXE:ProductVersionNumber': u'0.0.0.0'}] |
| mime type | application/x-dosexec |
| imphash | 2fb819a19fe4dee5c03e8c6a79342f79 |
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | MD5 |
|---|---|---|---|---|---|
| CODE | 0x1000 | 0xa1d0 | 0xa200 | 6.64374902859 | b7ea439d9c6d5ec722056c9243fb3054 |
| DATA | 0xc000 | 0x250 | 0x400 | 2.74012451302 | 9b2268ed5360951559d8041925d025fb |
| BSS | 0xd000 | 0xe94 | 0x0 | 0.0 | d41d8cd98f00b204e9800998ecf8427e |
| .idata | 0xe000 | 0x97c | 0xa00 | 4.48607624623 | df5f31e62e05c787fd29eed7071bf556 |
| .tls | 0xf000 | 0x8 | 0x0 | 0.0 | d41d8cd98f00b204e9800998ecf8427e |
| .rdata | 0x10000 | 0x18 | 0x200 | 0.190488766435 | 14dfa4128117e7f94fe2f8d7dea374a0 |
| .reloc | 0x11000 | 0x91c | 0x0 | 0.0 | d41d8cd98f00b204e9800998ecf8427e |
| .rsrc | 0x12000 | 0x15c5c | 0x15e00 | 4.55397374136 | c4ab1fc247159cd7fd9db7b3c58baa2e |
-
kernel32.dll
- DeleteCriticalSection
- LeaveCriticalSection
- EnterCriticalSection
- InitializeCriticalSection
- VirtualFree
- VirtualAlloc
- LocalFree
- LocalAlloc
- WideCharToMultiByte
- TlsSetValue
- TlsGetValue
- MultiByteToWideChar
- GetModuleHandleA
- GetLastError
- GetCommandLineA
- WriteFile
- SetFilePointer
- SetEndOfFile
- RtlUnwind
- ReadFile
- RaiseException
- GetStdHandle
- GetFileSize
- GetSystemTime
- GetFileType
- ExitProcess
- CreateFileA
- CloseHandle
-
user32.dll
- MessageBoxA
-
oleaut32.dll
- VariantChangeTypeEx
- VariantCopyInd
- VariantClear
- SysStringLen
- SysAllocStringLen
-
advapi32.dll
- RegQueryValueExA
- RegOpenKeyExA
- RegCloseKey
- OpenProcessToken
- LookupPrivilegeValueA
-
kernel32.dll
- WriteFile
- VirtualQuery
- VirtualProtect
- VirtualFree
- VirtualAlloc
- Sleep
- SizeofResource
- SetLastError
- SetFilePointer
- SetErrorMode
- SetEndOfFile
- RemoveDirectoryA
- ReadFile
- LockResource
- LoadResource
- LoadLibraryA
- IsDBCSLeadByte
- GetWindowsDirectoryA
- GetVersionExA
- GetVersion
- GetUserDefaultLangID
- GetSystemInfo
- GetSystemDirectoryA
- GetSystemDefaultLCID
- GetProcAddress
- GetModuleHandleA
- GetModuleFileNameA
- GetLocaleInfoA
- GetLastError
- GetFullPathNameA
- GetFileSize
- GetFileAttributesA
- GetExitCodeProcess
- GetEnvironmentVariableA
- GetCurrentProcess
- GetCommandLineA
- GetACP
- InterlockedExchange
- FormatMessageA
- FindResourceA
- DeleteFileA
- CreateProcessA
- CreateFileA
- CreateDirectoryA
- CloseHandle
-
user32.dll
- TranslateMessage
- SetWindowLongA
- PeekMessageA
- MsgWaitForMultipleObjects
- MessageBoxA
- LoadStringA
- ExitWindowsEx
- DispatchMessageA
- DestroyWindow
- CreateWindowExA
- CallWindowProcA
- CharPrevA
-
comctl32.dll
- InitCommonControls
-
advapi32.dll
- AdjustTokenPrivileges
{u'lang': u'LANG_ENGLISH', u'name': u'RT_ICON', u'offset': 74580, u'sha256': u'54b2728de98f6355d30a067365a0dfdd86c34baddb5d4aedb79ad81bb08375f5', u'type': u'dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0', u'size': 9640}
{u'lang': u'LANG_ENGLISH', u'name': u'RT_ICON', u'offset': 84220, u'sha256': u'5d47e9f3be453f075d500fc4d3b9d40cec41be4151a11366aa720948e7445267', u'type': u'GLS_BINARY_LSB_FIRST', u'size': 1128}
{u'lang': u'LANG_ENGLISH', u'name': u'RT_ICON', u'offset': 85348, u'sha256': u'a4ddcad253a20b0f51ad1c580a56d7e943fd444d3417e19d1eba2748cb978928', u'type': u'dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 0, next used block 0', u'size': 4264}
{u'lang': u'LANG_ENGLISH', u'name': u'RT_ICON', u'offset': 89612, u'sha256': u'65e61d4a135007f40215bda147122d818d53dd7c3b4a32a39719f6e93710875d', u'type': u'dBase III DBT, version number 0, next free block index 40', u'size': 67624}
{u'lang': u'LANG_NEUTRAL', u'name': u'RT_STRING', u'offset': 157236, u'sha256': u'2c0d32398e3c95657a577c044cc32fe24fa058d0c32e13099b26fd678de8354f', u'type': u'data', u'size': 754}
{u'lang': u'LANG_NEUTRAL', u'name': u'RT_STRING', u'offset': 157992, u'sha256': u'840989e0a92f2746ae60b8e3efc1a39bcca17e82df3634c1643d76141fc75bb3', u'type': u'data', u'size': 780}
{u'lang': u'LANG_NEUTRAL', u'name': u'RT_STRING', u'offset': 158772, u'sha256': u'26bda4da3649a575157a6466468a0a86944756643855954120fd715f3c9c7f78', u'type': u'data', u'size': 718}
{u'lang': u'LANG_NEUTRAL', u'name': u'RT_STRING', u'offset': 159492, u'sha256': u'd786490af7fe66042fb4a7d52023f5a1442f9b5e65d067b9093d1a128a6af34c', u'type': u'data', u'size': 104}
{u'lang': u'LANG_NEUTRAL', u'name': u'RT_STRING', u'offset': 159596, u'sha256': u'00a0794f0a493c167f64ed8b119d49bdc59f76bb35e5c295dc047095958ee2fd', u'type': u'data', u'size': 180}
{u'lang': u'LANG_NEUTRAL', u'name': u'RT_STRING', u'offset': 159776, u'sha256': u'34973a8a33b90ec734bd328198311f579666d5aeb04c94f469ebb822689de3c3', u'type': u'data', u'size': 174}
{u'lang': u'LANG_NEUTRAL', u'name': u'RT_RCDATA', u'offset': 159952, u'sha256': u'd6ed4ce193b2bf3f187138c156a233d36485f3baf7486bd351affb30cb56045b', u'type': u'data', u'size': 44}
{u'lang': u'LANG_ENGLISH', u'name': u'RT_GROUP_ICON', u'offset': 159996, u'sha256': u'76012ecb462f6375340bcf39935ccc054b7a4f6b9e433d0ea0a4fc0b66d55be9', u'type': u'MS Windows icon resource - 4 icons, 48x48', u'size': 62}
{u'lang': u'LANG_ENGLISH', u'name': u'RT_VERSION', u'offset': 160060, u'sha256': u'598775258c2ee00128d0b0d9716417121f04f6141a865a7b21236a0651251f7e', u'type': u'data', u'size': 1268}
{u'lang': u'LANG_ENGLISH', u'name': u'RT_MANIFEST', u'offset': 161328, u'sha256': u'356ca8abf11d97bf9dcbff47c04bf1ddcb8685ef84d38e6850ec6c28a37655b9', u'type': u'XML 1.0 document, ASCII text, with CRLF line terminators', u'size': 1580}