53322be2fdf24b09de1070a2713855ea3d01bbc895c6d24a2991d1e2139ca585

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2023-Oct-03 07:50:41
Detected languages English - United States
Debug artifacts D:\Projects\WinRAR\rarext\build\32\Release\rarext.pdb
ProductName WinRAR
CompanyName Alexander Roshal
FileDescription WinRAR shell extension
FileVersion 6.24.0
ProductVersion 6.24.0
InternalName WinRAR shell extension
LegalCopyright Copyright © Alexander Roshal 1993-2023
OriginalFilename RarExt.dll

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Suspicious Strings found in the binary may indicate undesirable behavior: Accesses the WMI:
  • ROOT\CIMV2
Info Cryptographic algorithms detected in the binary: Uses constants related to SHA256
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • LoadLibraryW
  • GetProcAddress
 Can access the registry:
  • RegDeleteValueW
  • RegOpenKeyExW
  • RegQueryValueExW
  • RegSetValueExW
  • RegEnumValueW
  • RegEnumKeyExW
  • RegCloseKey
  • RegDeleteKeyExW
  • RegDeleteKeyW
  • RegCreateKeyExW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Functions related to the privilege level:
  • CheckTokenMembership
 Enumerates local disk drives:
  • GetDriveTypeW
 Can take screenshots:
  • GetDC
  • CreateCompatibleDC
Info The PE is digitally signed. Signer: win.rar GmbH
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Safe VirusTotal score: 0/72 (Scanned on 2026-04-20 05:01:30) All the AVs think this file is safe.

Hashes

MD5 8510bea1dc5a2245a72dfe5ecd20cda6 🔍
SHA1 2a8446bdd4692096361e59f050d2f45bda089d88 🔍
SHA256 53322be2fdf24b09de1070a2713855ea3d01bbc895c6d24a2991d1e2139ca585 🔍
SHA3 a967bc719b2309afb148faf824c8bf46c4251612787b5205251b31de9830cf02 🔍
SSDeep 12288:x+7fEjWS7utn5YNdvkvDFyjQtnKjjDK7RCtyGpNYBd3X3u4gNm:x+7fEjetnOTvkvpydjjDqMtLABd3X31H 🔍
Imports Hash ea92b4bb5d9deec4628d0f78b0881df5 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x120

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2023-Oct-03 07:50:41
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0x5e000
SizeOfInitializedData 0x4ae00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00045490 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x5f000
ImageBase 0x10000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xab000
SizeOfHeaders 0x400
Checksum 0x9ac15
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 52085e9dc67f3fba05c79c8187f528fd 🔍
SHA1 814f8e36161e8108dbe7e9c13f7de724e8d22742 🔍
SHA256 2c37c03f0e097d48171f703425493470d1f819c3113c6c52f47094295081eddb 🔍
SHA3 2d7547ac074a5838e2367828f43ee3c115099c7cfd55531da7fd572ed7f9fd12 🔍
VirtualSize 0x5deec
VirtualAddress 0x1000
SizeOfRawData 0x5e000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.6389

.rdata

MD5 142054ae97078a4a49de1a8e1519d473 🔍
SHA1 d50b190f3d12b39229890e67925be416a90ccff1 🔍
SHA256 075fc34d7ede57cd9ad4666f43b8486a24c195c4629574f748b71d3018bd6e65 🔍
SHA3 3fec2f2dc445322ffa4c1e129fee61891fd5a88543ed5896db9c1e893186d9ef 🔍
VirtualSize 0xdee4
VirtualAddress 0x5f000
SizeOfRawData 0xe000
PointerToRawData 0x5e400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.15877

.data

MD5 db79a38b3be1404f5b47c42312bf0040 🔍
SHA1 dca4d608644136d984b75b53bca89655c9509eda 🔍
SHA256 61e1240125cfb6904f0029a7b8bbd420aa16c45da49b4910cb1f7ab3a882072a 🔍
SHA3 af0323b0adb4018e71918390cca6579d76f00b1d3ffcd9c91f3b050056947649 🔍
VirtualSize 0x1fdb4
VirtualAddress 0x6d000
SizeOfRawData 0x1a00
PointerToRawData 0x6c400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.63418

.rsrc

MD5 5db8bb00508598cab535a3cde87d5fdc 🔍
SHA1 0cf3af469ded53fb5db11aec700dfc3f80303124 🔍
SHA256 625137933d132a532ece475dd684c548293bea208563c1e0b132a413dea33b1a 🔍
SHA3 76c56a627c998fa0f16497d5a1f0185625c195a95c225220b343a5f3d892f5eb 🔍
VirtualSize 0x19d40
VirtualAddress 0x8d000
SizeOfRawData 0x19e00
PointerToRawData 0x6de00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.51274

.reloc

MD5 4fba4bb247562dc620842dd47a5c95d8 🔍
SHA1 361feb37da07ae40baddfa1a61a94c0724048b2f 🔍
SHA256 bc94f5c52d09aca90d1d089e6c82beb9cfb9efbfd9fd6a9db3513ff6b648d09f 🔍
SHA3 821bc01af4c1ec39926e1a265f6e57ae01279d04eeb6c6014925f7c531e2cb90 🔍
VirtualSize 0x3158
VirtualAddress 0xa7000
SizeOfRawData 0x3200
PointerToRawData 0x87c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.64147

Imports

KERNEL32.dll CompareStringA
Sleep
GetCurrentProcess
GetCurrentThread
SetThreadPriority
SetPriorityClass
GetSystemDirectoryW
SetThreadExecutionState
FileTimeToLocalFileTime
LocalFileTimeToFileTime
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
CompareStringW
MultiByteToWideChar
WideCharToMultiByte
GetCPInfo
IsDBCSLeadByte
GetModuleHandleExW
GetLocaleInfoW
GetNumberFormatW
GetLogicalDrives
GetTempPathW
SetCurrentDirectoryW
LockResource
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
GetDateFormatW
GetTimeFormatW
WaitForSingleObject
DecodePointer
WriteConsoleW
HeapSize
GetStringTypeW
SetStdHandle
GetProcessHeap
LCMapStringW
FindResourceW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetFileSizeEx
HeapAlloc
HeapReAlloc
HeapFree
ExitProcess
QueryPerformanceFrequency
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
InterlockedFlushSList
RtlUnwind
RaiseException
LocalFree
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
SizeofResource
LoadResource
FoldStringW
GetModuleFileNameW
GetFullPathNameW
CreateFileW
GetCurrentDirectoryW
GetVersionExW
FindNextFileW
FindFirstFileW
FindClose
ExpandEnvironmentStringsW
MoveFileW
GetCurrentProcessId
DeviceIoControl
SetFileAttributesW
RemoveDirectoryW
GetFileAttributesW
GetDriveTypeW
GetDiskFreeSpaceExW
LoadLibraryExW
DeleteFileW
CreateDirectoryW
GetFileTime
GetFileType
FlushFileBuffers
GetStdHandle
SetLastError
LoadLibraryW
GetProcAddress
FreeLibrary
GetLastError
CloseHandle
WriteFile
SetFileTime
SetFilePointer
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetEndOfFile
ReadFile
GetFileSize
FreeEnvironmentStringsW
USER32.dll GetParent
GetDC
GetDlgItem
SetWindowTextW
OemToCharA
InvalidateRect
ShowWindow
SendMessageW
wsprintfW
ReleaseDC
EnableWindow
SetWindowPos
GetMonitorInfoW
MonitorFromPoint
LoadImageW
EqualRect
GetSysColor
GetCursorPos
EndPaint
BeginPaint
InsertMenuItemW
AppendMenuW
CreatePopupMenu
SendDlgItemMessageW
DestroyWindow
EnumDisplayMonitors
CopyImage
MapWindowPoints
MessageBoxW
FlashWindowEx
CreateWindowExW
CreateIcon
LoadCursorW
SetCursor
GetWindowTextLengthW
GetWindowTextW
CharLowerW
CharUpperW
OemToCharBuffA
LoadStringW
GetWindow
GetClassNameW
SetWindowLongW
GetWindowLongW
GetWindowRect
GetClientRect
SetMenuItemInfoW
GetMenuItemInfoW
GetSystemMetrics
SetDlgItemTextW
GDI32.dll SetPixel
GetPixel
GetObjectW
CreateDIBSection
StretchBlt
GetDeviceCaps
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
GetTextExtentPoint32W
TextOutW
MoveToEx
SetTextColor
LineTo
CreatePen
GetTextFaceW
GetTextMetricsW
SelectObject
CreateFontW
DeleteObject
ADVAPI32.dll RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
AllocateAndInitializeSid
CheckTokenMembership
IsTextUnicode
RegSetValueExW
RegEnumValueW
RegEnumKeyExW
RegCloseKey
RegDeleteKeyExW
RegDeleteKeyW
RegCreateKeyExW
FreeSid
SHELL32.dll ShellExecuteExW
DragQueryFileW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ole32.dll CoSetProxyBlanket
CreateStreamOnHGlobal
ReleaseStgMedium
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoCreateInstance
OLEAUT32.dll SysFreeString
VariantChangeType
VariantCopy
VariantClear
SysAllocString
SHLWAPI.dll SHStrDupW
COMCTL32.dll #8
DestroyPropertySheetPage
CreatePropertySheetPageW
gdiplus.dll GdipAlloc
GdipFree
GdipCloneImage
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipDisposeImage
MSIMG32.dll GradientFill

Delayed Imports

DllCanUnloadNow

Ordinal 1
Address 0x3e930

DllGetClassObject

Ordinal 2
Address 0x3e8b0

4100

Type RT_BITMAP
Language English - United States
Codepage UNKNOWN
Size 0x4f8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.17838
MD5 990cf05a21e432bae34b63545975d2fb 🔍
SHA1 3e36f0f43215b550b3d561b4dff640ccb35c9742 🔍
SHA256 b7300581f55d8c6048cdca947eb1030be8e2a0b0cc126d4c28f8946817429b4f 🔍
SHA3 a714fab23bfea67bbee5b5f608616e7fec97b6abf94380b8f4f1dca67c86b9af 🔍
Preview

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.14887
MD5 0c2f5b9a49b3cc2d019959e7fb1a4e3d 🔍
SHA1 f8506b5a2af892eb9e37323fee0ad6d078850b5a 🔍
SHA256 8f73be662d8d9f3bc2bad316bf793887a9d2db135ed4fd4dde1fca81f56d02a9 🔍
SHA3 163878dbe35a34e1dbfd58b17c59e575021d68a7ec8e8982e7a4be103c46e060 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x608
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.17673
MD5 c77a89a6d5e8517fc75ee83d4b80e2ac 🔍
SHA1 1c6216cd3ac6b7532cd3cc282ee9628a988434e0 🔍
SHA256 90ee4f97df6d4f70b9a3c2c05a911b3d51b8df9aa64be53fa8b6ddf15dfd5d0d 🔍
SHA3 ace29454776384b8cdf39c4c3049f7e4be167fce6f3892689cf2828b61413a0b 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x6c8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.4162
MD5 0d0841809a2b1a91a0d8669155c099ba 🔍
SHA1 63b3dec892ea7675b3c5e68144363b36a51cf59d 🔍
SHA256 7a31bc5ffd0b5b631b838021a6d04162ecb931ace1da2820970bf8856fc0a1ed 🔍
SHA3 61de876aca01abc84fa046ee52225bada5ec4150d0fa21c147b9b7349fcdb805 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.34615
MD5 053df8076853f3081f7c3ea3c7e28313 🔍
SHA1 02210914bd1b2b68cf2f110204cd0bde175b8ef1 🔍
SHA256 5c05f26a9278c06aa4566f2bf86c9efc0f6d53b4e92e57c015c5c71c42324439 🔍
SHA3 015914fca292e1cbf1b56f4ab042044ee51bc756eeb5f3fd26521b641909891b 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.36933
MD5 e7aac7c334da0e24a8ffd2db90870fa0 🔍
SHA1 5f49e4d607c5b9b97019739846b261aa9e40e38e 🔍
SHA256 bc3967a22bee62e338afa19ce5ee174cc8a61c4fa127ce1f75ccdba87a27d047 🔍
SHA3 ba55e3a5f8c39427fc67ef10770556fbeee47726cfe0d8ef4f721697e004293c 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.53091
MD5 0f1d3041a377a4b11ad3e0152769b844 🔍
SHA1 bcb70bb742a2239316fbca5ff444be52b72ff23e 🔍
SHA256 6de6c189e110374f83d21afd6fec04d87e504628e1a161c7d6d6038b6a1cedf6 🔍
SHA3 1c1898c4af9b4a37cd20a94ef13bd0434d6b98f563e58f4416a431aae5d720e0 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x6b8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.2761
MD5 58a88961237d8d92837d38c3907641ee 🔍
SHA1 1ed16f93268bcb2cfe1d25190998d9821a300a1f 🔍
SHA256 89facc21db572cfaa945020c8db2308b1552a973932fdc64b8883da651c2b8a1 🔍
SHA3 c973396925ffd9dde85e69e1b06d50aca6a7df77609eb9c12c65c669f4133e0e 🔍

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.36984
MD5 77b29c34c6033ad4bb0f5818e3e41d99 🔍
SHA1 88bb2f6570bfb9a20a0e58675fbf804d5a085e66 🔍
SHA256 acf6bcc663060fffd77eaf640fbb505d235ecaf3d8a55d1c2cfcd14839529bc2 🔍
SHA3 0fb74b1cc4c6be8d1ee11cff581f9699c151700b86771083c14ef59016464c80 🔍

9

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.46401
MD5 1b365de9b319c64fa16723922584b206 🔍
SHA1 a44e054532ff701ed789a5ef5597d1f77bffa60f 🔍
SHA256 dcad1fa8ba6922b29c33b563c9266c7294567d3b7332a5bd24c6c6c5a57f77cc 🔍
SHA3 1b90d9add2f6c08603a6ca371cc9a84042c33516c29480193fe1f92bd5a45377 🔍

10

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.99073
MD5 2e1a15f823cc8f1970c91d39f6320940 🔍
SHA1 4f5257d219a191ff0a5c57a898f7e7f3bf39580b 🔍
SHA256 04e1aeae2e61d421c762a8ff5c5e09af75e97e7176ccbaa5c093baa5dde0a2bd 🔍
SHA3 9203fc42d3c9afde84713c6948a506cdfa60b860126d268d56743ed41c118708 🔍

11

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10d8b
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.99352
Detected Filetype PNG graphic file
MD5 b0568908ac8c5861e6f7df216a8b42a8 🔍
SHA1 f988edfa2e2298ca3b55d2cde5209552feadc608 🔍
SHA256 4d830c2921ca9d1408dd409571f74a072c9bfb473f7d03bfb1a83a79ec1d9a63 🔍
SHA3 697b696a72540c2412b0cdba93b497488df067a4c1ed8d1444f8ab277989772b 🔍

EXTARCINFODLG

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x620
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.045
MD5 4bf3114cc2fe7a0c05d9cfa9b1224ec2 🔍
SHA1 0879f713a2ffd864b5bd1091438b1e9a2db08470 🔍
SHA256 5a08b0d10b7d3225151f0e4b35bdc0a5ddeb71419724494d9e3d40ed38a148fd 🔍
SHA3 b19a3294e69c9c0d9024f42194f79bd88646258f570873e78a2cc0e23dd03734 🔍

EXTCMTARCINFODLG

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x64
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.66346
MD5 17f8a5ebf2217ddcb4bc32cde666ee89 🔍
SHA1 cbeec77ba6f42e3df2b879bc60adb3a6fa60ce12 🔍
SHA256 5f2de23875cc15bcd38913fc0d76914cc748381ef82ac3ad132d0a6136ca39ac 🔍
SHA3 75a8bec21b468c048adb1ecaf1c35879798246560bb30bbbdfcafb0eba7d7a98 🔍

257

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x2ec
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.14949
MD5 c73821f5431637a5ab6169dd13b0d731 🔍
SHA1 5661197bd03698d830730af9635b44a6133464fb 🔍
SHA256 6c4555dbd0ec73135426b6949319aeebd38bac8541750e13bdcdbfec22300969 🔍
SHA3 db29df68eaffc2f2b4a1d5f8bfb7f8dceb04991b575d4d0b40d42a43525246bd 🔍

258

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x1b0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.44269
MD5 fa2c03e0e069bf58c142badb8747d5b7 🔍
SHA1 91a842a350fe6af1d1c6ee1b9af394b294bf2ebf 🔍
SHA256 901dba329bc3646fe64394355a4b91509e0eeb8ddcaa663cccb681f39d581f76 🔍
SHA3 ed612c0bc118f6340a2ed46bb43f31559061fa6f0fd2e9333c5c1d1a8c48f608 🔍

259

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0xae
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.77674
MD5 81637713e4fe608ac1b162ae13bb68a5 🔍
SHA1 35cac450c88e3a849e09b87869f00c20ec420f1d 🔍
SHA256 3cb34eca12a7d6a9fe1e0a6c97cf56b3ee6470edbb2807dd75b9f0f97cee93f9 🔍
SHA3 8b83cf33f7f0f5711eef21405c1a35ebfbf6d07af59eaa49bba6d33e0cba2d37 🔍

260

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x3c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.03211
MD5 d79edc539167cce7d34d7070e0a52603 🔍
SHA1 3b88aa3d6524a6478b3a6fdfb821d9dca38ae0f0 🔍
SHA256 1f1597ae4926465f4e8a36d4a6431c2bb1ecfafb41d2cc4abed1e1a6e30c5e41 🔍
SHA3 b9ce46dddcbf7ddecb135e11dc310d8e6ddc353b430c7080e47e7cc0d85c8fa7 🔍

4100 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0xa0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.98786
Detected Filetype Icon file
MD5 7bde4e780664131ab332abe21a697e71 🔍
SHA1 7e479006b3644b48d45ef2ed9fe30a2e36348b1f 🔍
SHA256 71e1d3c639233b5c101f551a90c8932531fe2a1cac527c0777b29c5d37edf0f8 🔍
SHA3 c641e8934d9fc049d94138c05e2b84ef46992981d42c4936cf734bd157a02712 🔍

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x310
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.33687
MD5 0d881bc6d4a1ba5d45d15af076f74dd9 🔍
SHA1 67c6e2b0c00e4e2b5677d6dea3df14e5e1962abb 🔍
SHA256 d856ccd27eb88ae7829de882c6c2445850e12b250982bca3e633e366b391b6e9 🔍
SHA3 53d7a1f1bad0e43c8b1506c5b85aab03bd73f1c68cbd7fcea28a932ab03637f4 🔍

2 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

String Table contents

Extr&act files...
&Extract to %s
E&xtract Here
Extract each archive to &separate folder
Extract files. Additional options are allowed
Extract files to the specified folder
Extract files to the current folder
Extract each selected archive to a separate folder
&Add to archive...
Add files to an archive. Additional options are allowed
Add &to %s
Add files to the archive
Open with &WinRAR
Open archive in WinRAR
Archive
Comment
Unknown
solid
SFX
%s volume
%s archive
Present
Absent
Names and data
Compress to %s and email
Compress and email...
Test arch&ive
Check the archive for errors
Convert archive...
Add files to an archive using the compression profile
bytes
B
KB
MB
GB
TB

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 6.24.0.0
ProductVersion 6.24.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
ProductName WinRAR
CompanyName Alexander Roshal
FileDescription WinRAR shell extension
FileVersion (#2) 6.24.0
ProductVersion (#2) 6.24.0
InternalName WinRAR shell extension
LegalCopyright Copyright © Alexander Roshal 1993-2023
OriginalFilename RarExt.dll
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2023-Oct-03 07:50:41
Version 0.0
SizeofData 78
AddressOfRawData 0x6946c
PointerToRawData 0x6886c
Referenced File D:\Projects\WinRAR\rarext\build\32\Release\rarext.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2023-Oct-03 07:50:41
Version 0.0
SizeofData 20
AddressOfRawData 0x694bc
PointerToRawData 0x688bc

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2023-Oct-03 07:50:41
Version 0.0
SizeofData 896
AddressOfRawData 0x694d0
PointerToRawData 0x688d0

TLS Callbacks

StartAddressOfRawData 0x10069860
EndAddressOfRawData 0x10069868
AddressOfIndex 0x1008c6b0
AddressOfCallbacks 0x1005f450
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0xc0
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1006deb0
SEHandlerTable 0x1006917c
SEHandlerCount 115
GuardCFCheckFunctionPointer 268825584
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0xeb696a02
Unmarked objects 0
ASM objects (29395) 11
C++ objects (29395) 156
253 (VS2022 Update 3 (17.3.0) compiler 31616) 6
C objects (VS2022 Update 3 (17.3.0) compiler 31616) 17
ASM objects (VS2022 Update 3 (17.3.0) compiler 31616) 24
C++ objects (VS2022 Update 3 (17.3.0) compiler 31616) 47
C objects (29395) 28
C objects (CVTCIL) (29395) 1
Imports (29395) 23
Total imports 252
C++ objects (VS2022 Update 3 (17.3.4-6) compiler 31630) 63
Exports (VS2022 Update 3 (17.3.4-6) compiler 31630) 1
Resource objects (VS2022 Update 3 (17.3.4-6) compiler 31630) 1
151 1
Linker (VS2022 Update 3 (17.3.4-6) compiler 31630) 1

Errors

Leave a comment

No comments yet.