5f21fd414a3767df77f31be26352fc2fe63adbffc75ee48ae4ade06deef07b50

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2023-Oct-03 07:50:46
Detected languages English - United States
Debug artifacts D:\Projects\WinRAR\rarext\build\64\Release\rarext.pdb
ProductName WinRAR
CompanyName Alexander Roshal
FileDescription WinRAR shell extension
FileVersion 6.24.0
ProductVersion 6.24.0
InternalName WinRAR shell extension
LegalCopyright Copyright © Alexander Roshal 1993-2023
OriginalFilename RarExt.dll

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Accesses the WMI:
  • ROOT\CIMV2
Info Cryptographic algorithms detected in the binary: Uses constants related to SHA256
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • LoadLibraryW
  • GetProcAddress
 Can access the registry:
  • RegDeleteValueW
  • RegOpenKeyExW
  • RegQueryValueExW
  • RegSetValueExW
  • RegEnumValueW
  • RegEnumKeyExW
  • RegCloseKey
  • RegDeleteKeyExW
  • RegDeleteKeyW
  • RegCreateKeyExW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Functions related to the privilege level:
  • CheckTokenMembership
 Enumerates local disk drives:
  • GetDriveTypeW
 Can take screenshots:
  • GetDC
  • CreateCompatibleDC
Info The PE is digitally signed. Signer: win.rar GmbH
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Safe VirusTotal score: 0/69 (Scanned on 2026-06-23 05:01:40) All the AVs think this file is safe.

Hashes

MD5 d0f4632be7031cc372ffdd2d9063ffb2 🔍
SHA1 b99f58ae5b6d169be95785a9a25ef27582e194c9 🔍
SHA256 5f21fd414a3767df77f31be26352fc2fe63adbffc75ee48ae4ade06deef07b50 🔍
SHA3 52ca727f593df493a6275db975d38b0b3d7f398b00a71e07e6d9a2b02f8b0bcb 🔍
SSDeep 12288:dyIL0neePxyNZAcG5e7kv0E4doo6yPApu2Giw/iiiTQBd3X3uc:dwnVPxUKe7kMEieO/riTQBd3X3T 🔍
Imports Hash 8f6f025c725ec2aa8498b3040d0a763c 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x118

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2023-Oct-03 07:50:46
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x69a00
SizeOfInitializedData 0x57200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000004E260 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x180000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xc4000
SizeOfHeaders 0x400
Checksum 0xa8cc0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 60c4e31c9bafae851fafc6b19b1a3d14 🔍
SHA1 1a66a504f36701e1260f6df2bd4c7f917230a491 🔍
SHA256 42f303925e1c3599b375cde7f243dd5496807ae347ad714ec962c3ac5bff0d81 🔍
SHA3 dcb4a79cf398b4ef99d1596973b9605d41abf573e8c31fe7856ed1e109c6d5ee 🔍
VirtualSize 0x698fe
VirtualAddress 0x1000
SizeOfRawData 0x69a00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.42965

.rdata

MD5 b96ca421928cec82651b26b2a37e2ffb 🔍
SHA1 d0fbc4b221280f7f53d588e4824d8a255166d097 🔍
SHA256 66c5e94f993c433c5353118825258f9336b754406db9c55829f72b3f1039e0f2 🔍
SHA3 0299ee3764a0f26298972070e053f067a96dfaa05b0f815983003294586a7cb0 🔍
VirtualSize 0x168b8
VirtualAddress 0x6b000
SizeOfRawData 0x16a00
PointerToRawData 0x69e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.24158

.data

MD5 4b35ca96c14d1dff15fe8610a5c58073 🔍
SHA1 910f442743e62a4500b182b151704524063d678d 🔍
SHA256 0c99add0b85f59e03278fd4660cd8610f3f3b6bca9209a294323c916dc9b8796 🔍
SHA3 623e4d1810e7a74d3a846be393e3111cd449b117557e1dd1054e6f2461baad02 🔍
VirtualSize 0x20c0c
VirtualAddress 0x82000
SizeOfRawData 0x1e00
PointerToRawData 0x80800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.3637

.pdata

MD5 1f342b1f0c939176f12efcf09a66bde2 🔍
SHA1 676652bc52642a5092f888e67bbb00e70b6310ea 🔍
SHA256 464f25fc294d09f8d39714cc6a4038b89a6519f929bb80f09ddc0acb9d4ed81a 🔍
SHA3 507548b13a7c8efc178dd048e6b31abe98b0f548f0577df5de2b4f0c7497a99e 🔍
VirtualSize 0x4c08
VirtualAddress 0xa3000
SizeOfRawData 0x4e00
PointerToRawData 0x82600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.69425

_RDATA

MD5 e354c048797acfbe5f3068b395922efe 🔍
SHA1 e14c40952b72a84168a4eb7a0203507608cc7069 🔍
SHA256 ef2fdd6f175d4673b2ff6de296818e16c2cf0b4c2dbc9ae27ebd4cb2ca16794a 🔍
SHA3 560c2131703db338ba3759ceabe4dbd0f3bbf6a726a7398a7dd07a92abcf602b 🔍
VirtualSize 0x15c
VirtualAddress 0xa8000
SizeOfRawData 0x200
PointerToRawData 0x87400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.30453

.rsrc

MD5 29ff4397e7ac7ead415f2757e9263ae4 🔍
SHA1 72846cce07ca06fede43e7c4c99d3576724632de 🔍
SHA256 8129d25f1eb7d819356280b591f50ca9c7ed7047659b636e0cee5bf9f94e58cc 🔍
SHA3 f185188603d68843eca54d100265e353b9dde078a18817c4e541d12d73f79e50 🔍
VirtualSize 0x19d40
VirtualAddress 0xa9000
SizeOfRawData 0x19e00
PointerToRawData 0x87600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.51272

.reloc

MD5 8ff55e705a58a9d037055b38a99e11b5 🔍
SHA1 7b874a83d9bf4bf12febe592ee8d3bed827692c5 🔍
SHA256 a001ad6c7ee6ef61253f8ff6aed5f9b5d112587a302eccacbc3f8972241349d5 🔍
SHA3 584618c094a97c6a4bb4188c06d6e8e66153723786c57504bcd610e76df4bec4 🔍
VirtualSize 0xaf4
VirtualAddress 0xc3000
SizeOfRawData 0xc00
PointerToRawData 0xa1400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.25435

Imports

KERNEL32.dll CompareStringA
Sleep
GetCurrentProcess
GetCurrentThread
SetThreadPriority
SetPriorityClass
GetSystemDirectoryW
SetThreadExecutionState
FileTimeToLocalFileTime
LocalFileTimeToFileTime
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
CompareStringW
MultiByteToWideChar
WideCharToMultiByte
GetCPInfo
IsDBCSLeadByte
GetModuleHandleExW
GetLocaleInfoW
GetNumberFormatW
GetLogicalDrives
GetTempPathW
SetCurrentDirectoryW
LockResource
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
GetDateFormatW
GetTimeFormatW
WaitForSingleObject
RtlUnwind
WriteConsoleW
HeapSize
GetStringTypeW
SetStdHandle
GetProcessHeap
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
FindResourceW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetFileSizeEx
HeapAlloc
HeapReAlloc
HeapFree
ExitProcess
QueryPerformanceFrequency
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
InterlockedFlushSList
RtlUnwindEx
RaiseException
RtlPcToFileHeader
LocalFree
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
GetModuleHandleW
CreateEventW
SizeofResource
LoadResource
FoldStringW
GetModuleFileNameW
GetFullPathNameW
GetCurrentDirectoryW
GetVersionExW
FindNextFileW
CreateFileW
FindFirstFileW
FindClose
ExpandEnvironmentStringsW
MoveFileW
GetCurrentProcessId
DeviceIoControl
SetFileAttributesW
RemoveDirectoryW
GetFileAttributesW
GetDriveTypeW
GetDiskFreeSpaceExW
LoadLibraryExW
DeleteFileW
CreateDirectoryW
GetFileTime
GetFileType
FlushFileBuffers
GetStdHandle
SetLastError
LoadLibraryW
GetProcAddress
FreeLibrary
GetLastError
CloseHandle
WriteFile
SetFileTime
SetFilePointer
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SetEndOfFile
ReadFile
GetFileSize
FreeEnvironmentStringsW
USER32.dll InvalidateRect
SetWindowTextW
GetParent
ReleaseDC
OemToCharA
EnableWindow
GetDlgItem
ShowWindow
SendMessageW
wsprintfW
GetDC
SetWindowPos
GetMonitorInfoW
MonitorFromPoint
LoadImageW
SetWindowLongPtrW
EqualRect
GetSysColor
GetCursorPos
EndPaint
BeginPaint
InsertMenuItemW
AppendMenuW
CreatePopupMenu
SendDlgItemMessageW
DestroyWindow
EnumDisplayMonitors
CopyImage
MapWindowPoints
MessageBoxW
FlashWindowEx
CreateWindowExW
CreateIcon
LoadCursorW
SetCursor
GetWindowTextLengthW
GetWindowTextW
CharLowerW
CharUpperW
OemToCharBuffA
LoadStringW
GetWindow
GetClassNameW
GetWindowLongPtrW
SetWindowLongW
GetWindowLongW
GetWindowRect
GetClientRect
SetMenuItemInfoW
GetMenuItemInfoW
GetSystemMetrics
SetDlgItemTextW
GDI32.dll SetPixel
GetPixel
GetObjectW
CreateDIBSection
StretchBlt
GetDeviceCaps
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
GetTextExtentPoint32W
TextOutW
SetTextColor
LineTo
DeleteObject
CreatePen
GetTextFaceW
GetTextMetricsW
SelectObject
CreateFontW
MoveToEx
ADVAPI32.dll RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
AllocateAndInitializeSid
CheckTokenMembership
IsTextUnicode
RegSetValueExW
RegEnumValueW
RegEnumKeyExW
RegCloseKey
RegDeleteKeyExW
RegDeleteKeyW
RegCreateKeyExW
FreeSid
SHELL32.dll SHGetPathFromIDListW
ShellExecuteExW
SHGetMalloc
DragQueryFileW
SHGetSpecialFolderLocation
ole32.dll CoTaskMemFree
ReleaseStgMedium
CreateStreamOnHGlobal
CoCreateInstance
CoSetProxyBlanket
CoCreateFreeThreadedMarshaler
OLEAUT32.dll SysFreeString
VariantChangeType
VariantCopy
VariantClear
SysAllocString
SHLWAPI.dll SHStrDupW
COMCTL32.dll #8
DestroyPropertySheetPage
CreatePropertySheetPageW
gdiplus.dll GdipAlloc
GdipFree
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateHBITMAPFromBitmap
MSIMG32.dll GradientFill

Delayed Imports

DllCanUnloadNow

Ordinal 1
Address 0x46dc0

DllGetClassObject

Ordinal 2
Address 0x46ce0

4100

Type RT_BITMAP
Language English - United States
Codepage UNKNOWN
Size 0x4f8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.17838
MD5 990cf05a21e432bae34b63545975d2fb 🔍
SHA1 3e36f0f43215b550b3d561b4dff640ccb35c9742 🔍
SHA256 b7300581f55d8c6048cdca947eb1030be8e2a0b0cc126d4c28f8946817429b4f 🔍
SHA3 a714fab23bfea67bbee5b5f608616e7fec97b6abf94380b8f4f1dca67c86b9af 🔍
Preview

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.14887
MD5 0c2f5b9a49b3cc2d019959e7fb1a4e3d 🔍
SHA1 f8506b5a2af892eb9e37323fee0ad6d078850b5a 🔍
SHA256 8f73be662d8d9f3bc2bad316bf793887a9d2db135ed4fd4dde1fca81f56d02a9 🔍
SHA3 163878dbe35a34e1dbfd58b17c59e575021d68a7ec8e8982e7a4be103c46e060 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x608
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.17673
MD5 c77a89a6d5e8517fc75ee83d4b80e2ac 🔍
SHA1 1c6216cd3ac6b7532cd3cc282ee9628a988434e0 🔍
SHA256 90ee4f97df6d4f70b9a3c2c05a911b3d51b8df9aa64be53fa8b6ddf15dfd5d0d 🔍
SHA3 ace29454776384b8cdf39c4c3049f7e4be167fce6f3892689cf2828b61413a0b 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x6c8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.4162
MD5 0d0841809a2b1a91a0d8669155c099ba 🔍
SHA1 63b3dec892ea7675b3c5e68144363b36a51cf59d 🔍
SHA256 7a31bc5ffd0b5b631b838021a6d04162ecb931ace1da2820970bf8856fc0a1ed 🔍
SHA3 61de876aca01abc84fa046ee52225bada5ec4150d0fa21c147b9b7349fcdb805 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.34615
MD5 053df8076853f3081f7c3ea3c7e28313 🔍
SHA1 02210914bd1b2b68cf2f110204cd0bde175b8ef1 🔍
SHA256 5c05f26a9278c06aa4566f2bf86c9efc0f6d53b4e92e57c015c5c71c42324439 🔍
SHA3 015914fca292e1cbf1b56f4ab042044ee51bc756eeb5f3fd26521b641909891b 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.36933
MD5 e7aac7c334da0e24a8ffd2db90870fa0 🔍
SHA1 5f49e4d607c5b9b97019739846b261aa9e40e38e 🔍
SHA256 bc3967a22bee62e338afa19ce5ee174cc8a61c4fa127ce1f75ccdba87a27d047 🔍
SHA3 ba55e3a5f8c39427fc67ef10770556fbeee47726cfe0d8ef4f721697e004293c 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.53091
MD5 0f1d3041a377a4b11ad3e0152769b844 🔍
SHA1 bcb70bb742a2239316fbca5ff444be52b72ff23e 🔍
SHA256 6de6c189e110374f83d21afd6fec04d87e504628e1a161c7d6d6038b6a1cedf6 🔍
SHA3 1c1898c4af9b4a37cd20a94ef13bd0434d6b98f563e58f4416a431aae5d720e0 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x6b8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.2761
MD5 58a88961237d8d92837d38c3907641ee 🔍
SHA1 1ed16f93268bcb2cfe1d25190998d9821a300a1f 🔍
SHA256 89facc21db572cfaa945020c8db2308b1552a973932fdc64b8883da651c2b8a1 🔍
SHA3 c973396925ffd9dde85e69e1b06d50aca6a7df77609eb9c12c65c669f4133e0e 🔍

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.36984
MD5 77b29c34c6033ad4bb0f5818e3e41d99 🔍
SHA1 88bb2f6570bfb9a20a0e58675fbf804d5a085e66 🔍
SHA256 acf6bcc663060fffd77eaf640fbb505d235ecaf3d8a55d1c2cfcd14839529bc2 🔍
SHA3 0fb74b1cc4c6be8d1ee11cff581f9699c151700b86771083c14ef59016464c80 🔍

9

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.46401
MD5 1b365de9b319c64fa16723922584b206 🔍
SHA1 a44e054532ff701ed789a5ef5597d1f77bffa60f 🔍
SHA256 dcad1fa8ba6922b29c33b563c9266c7294567d3b7332a5bd24c6c6c5a57f77cc 🔍
SHA3 1b90d9add2f6c08603a6ca371cc9a84042c33516c29480193fe1f92bd5a45377 🔍

10

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.99073
MD5 2e1a15f823cc8f1970c91d39f6320940 🔍
SHA1 4f5257d219a191ff0a5c57a898f7e7f3bf39580b 🔍
SHA256 04e1aeae2e61d421c762a8ff5c5e09af75e97e7176ccbaa5c093baa5dde0a2bd 🔍
SHA3 9203fc42d3c9afde84713c6948a506cdfa60b860126d268d56743ed41c118708 🔍

11

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10d8b
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.99352
Detected Filetype PNG graphic file
MD5 b0568908ac8c5861e6f7df216a8b42a8 🔍
SHA1 f988edfa2e2298ca3b55d2cde5209552feadc608 🔍
SHA256 4d830c2921ca9d1408dd409571f74a072c9bfb473f7d03bfb1a83a79ec1d9a63 🔍
SHA3 697b696a72540c2412b0cdba93b497488df067a4c1ed8d1444f8ab277989772b 🔍

EXTARCINFODLG

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x620
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.045
MD5 4bf3114cc2fe7a0c05d9cfa9b1224ec2 🔍
SHA1 0879f713a2ffd864b5bd1091438b1e9a2db08470 🔍
SHA256 5a08b0d10b7d3225151f0e4b35bdc0a5ddeb71419724494d9e3d40ed38a148fd 🔍
SHA3 b19a3294e69c9c0d9024f42194f79bd88646258f570873e78a2cc0e23dd03734 🔍

EXTCMTARCINFODLG

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x64
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.66346
MD5 17f8a5ebf2217ddcb4bc32cde666ee89 🔍
SHA1 cbeec77ba6f42e3df2b879bc60adb3a6fa60ce12 🔍
SHA256 5f2de23875cc15bcd38913fc0d76914cc748381ef82ac3ad132d0a6136ca39ac 🔍
SHA3 75a8bec21b468c048adb1ecaf1c35879798246560bb30bbbdfcafb0eba7d7a98 🔍

257

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x2ec
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.14949
MD5 c73821f5431637a5ab6169dd13b0d731 🔍
SHA1 5661197bd03698d830730af9635b44a6133464fb 🔍
SHA256 6c4555dbd0ec73135426b6949319aeebd38bac8541750e13bdcdbfec22300969 🔍
SHA3 db29df68eaffc2f2b4a1d5f8bfb7f8dceb04991b575d4d0b40d42a43525246bd 🔍

258

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x1b0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.44269
MD5 fa2c03e0e069bf58c142badb8747d5b7 🔍
SHA1 91a842a350fe6af1d1c6ee1b9af394b294bf2ebf 🔍
SHA256 901dba329bc3646fe64394355a4b91509e0eeb8ddcaa663cccb681f39d581f76 🔍
SHA3 ed612c0bc118f6340a2ed46bb43f31559061fa6f0fd2e9333c5c1d1a8c48f608 🔍

259

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0xae
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.77674
MD5 81637713e4fe608ac1b162ae13bb68a5 🔍
SHA1 35cac450c88e3a849e09b87869f00c20ec420f1d 🔍
SHA256 3cb34eca12a7d6a9fe1e0a6c97cf56b3ee6470edbb2807dd75b9f0f97cee93f9 🔍
SHA3 8b83cf33f7f0f5711eef21405c1a35ebfbf6d07af59eaa49bba6d33e0cba2d37 🔍

260

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x3c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.03211
MD5 d79edc539167cce7d34d7070e0a52603 🔍
SHA1 3b88aa3d6524a6478b3a6fdfb821d9dca38ae0f0 🔍
SHA256 1f1597ae4926465f4e8a36d4a6431c2bb1ecfafb41d2cc4abed1e1a6e30c5e41 🔍
SHA3 b9ce46dddcbf7ddecb135e11dc310d8e6ddc353b430c7080e47e7cc0d85c8fa7 🔍

4100 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0xa0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.98786
Detected Filetype Icon file
MD5 7bde4e780664131ab332abe21a697e71 🔍
SHA1 7e479006b3644b48d45ef2ed9fe30a2e36348b1f 🔍
SHA256 71e1d3c639233b5c101f551a90c8932531fe2a1cac527c0777b29c5d37edf0f8 🔍
SHA3 c641e8934d9fc049d94138c05e2b84ef46992981d42c4936cf734bd157a02712 🔍

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x310
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.33687
MD5 0d881bc6d4a1ba5d45d15af076f74dd9 🔍
SHA1 67c6e2b0c00e4e2b5677d6dea3df14e5e1962abb 🔍
SHA256 d856ccd27eb88ae7829de882c6c2445850e12b250982bca3e633e366b391b6e9 🔍
SHA3 53d7a1f1bad0e43c8b1506c5b85aab03bd73f1c68cbd7fcea28a932ab03637f4 🔍

2 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

String Table contents

Extr&act files...
&Extract to %s
E&xtract Here
Extract each archive to &separate folder
Extract files. Additional options are allowed
Extract files to the specified folder
Extract files to the current folder
Extract each selected archive to a separate folder
&Add to archive...
Add files to an archive. Additional options are allowed
Add &to %s
Add files to the archive
Open with &WinRAR
Open archive in WinRAR
Archive
Comment
Unknown
solid
SFX
%s volume
%s archive
Present
Absent
Names and data
Compress to %s and email
Compress and email...
Test arch&ive
Check the archive for errors
Convert archive...
Add files to an archive using the compression profile
bytes
B
KB
MB
GB
TB

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 6.24.0.0
ProductVersion 6.24.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
ProductName WinRAR
CompanyName Alexander Roshal
FileDescription WinRAR shell extension
FileVersion (#2) 6.24.0
ProductVersion (#2) 6.24.0
InternalName WinRAR shell extension
LegalCopyright Copyright © Alexander Roshal 1993-2023
OriginalFilename RarExt.dll
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2023-Oct-03 07:50:46
Version 0.0
SizeofData 78
AddressOfRawData 0x78f24
PointerToRawData 0x77d24
Referenced File D:\Projects\WinRAR\rarext\build\64\Release\rarext.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2023-Oct-03 07:50:46
Version 0.0
SizeofData 20
AddressOfRawData 0x78f74
PointerToRawData 0x77d74

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2023-Oct-03 07:50:46
Version 0.0
SizeofData 940
AddressOfRawData 0x78f88
PointerToRawData 0x77d88

TLS Callbacks

StartAddressOfRawData 0x180079358
EndAddressOfRawData 0x180079360
AddressOfIndex 0x1800a2000
AddressOfCallbacks 0x18006b908
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1800830a8
GuardCFCheckFunctionPointer 6442891296
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0x9be058b1
Unmarked objects 0
C++ objects (29395) 153
253 (VS2022 Update 3 (17.3.0) compiler 31616) 6
C objects (VS2022 Update 3 (17.3.0) compiler 31616) 17
ASM objects (VS2022 Update 3 (17.3.0) compiler 31616) 8
C++ objects (VS2022 Update 3 (17.3.0) compiler 31616) 50
ASM objects (29395) 9
C objects (29395) 18
C objects (CVTCIL) (29395) 1
Imports (29395) 23
Total imports 262
C++ objects (VS2022 Update 3 (17.3.4-6) compiler 31630) 63
Exports (VS2022 Update 3 (17.3.4-6) compiler 31630) 1
Resource objects (VS2022 Update 3 (17.3.4-6) compiler 31630) 1
151 1
Linker (VS2022 Update 3 (17.3.4-6) compiler 31630) 1

Errors

Leave a comment

No comments yet.