Edit tour

Windows Analysis Report
netscan.exe

Overview

General Information

Sample Name:	netscan.exe
Analysis ID:	1281785
MD5:	5db121b74aede2736366690c74b4a197
SHA1:	0f57df99a37b8c80b3fdf691a9fc50697c3ea26d
SHA256:	6321c3bdb6e8311c5e62da960a5289fe95604023883c0eb2167865a8ddb44bfa

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Sample file is different than original file name gathered from version info

PE file contains executable resources (Code or Archives)

Classification

Process Tree

System is w10x64

netscan.exe (PID: 5548 cmdline: C:\Users\user\Desktop\netscan.exe MD5: 5DB121B74AEDE2736366690C74B4A197)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: netscan.exe, 00000000.00000002.658173530.000000010081E000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: -----BEGIN RSA PUBLIC KEY-----

Source: netscan.exe	String found in binary or memory: http://nossl.softperfect.com/download/support/oui.txt
Source: netscan.exe	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: netscan.exe	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/transfer/Get
Source: netscan.exe	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/04/discovery/Probe
Source: netscan.exe	String found in binary or memory: http://v4.softperfect.com/scripts/netscanner/getinfo.php
Source: netscan.exe	String found in binary or memory: http://v6.softperfect.com/scripts/netscanner/getinfo.php
Source: netscan.exe, 00000000.00000002.659160200.0000000100CCB000.00000008.00000001.01000000.00000003.sdmp, netscan.exe, 00000000.00000000.376653064.0000000100CC7000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.gnu.org/licenses/.
Source: netscan.exe	String found in binary or memory: http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv
Source: netscan.exe	String found in binary or memory: http://www.softperfect.com/products/networkscanner/version.txt
Source: netscan.exe	String found in binary or memory: https://nmap.org
Source: netscan.exe	String found in binary or memory: https://www.softperfect.com
Source: netscan.exe	String found in binary or memory: https://www.softperfect.com/order/?sns
Source: netscan.exe	String found in binary or memory: https://www.softperfect.com/order/?sns&upgrade
Source: netscan.exe	String found in binary or memory: https://www.softperfect.com/products/networkscanner/?from=nver
Source: netscan.exe	String found in binary or memory: https://www.softperfect.com/products/networkscanner/manual/
Source: netscan.exe	String found in binary or memory: https://www.softperfect.com/support/

Source: netscan.exe, 00000000.00000002.659160200.0000000100CCB000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameD vs netscan.exe
Source: netscan.exe, 00000000.00000000.376653064.0000000100CC7000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameD vs netscan.exe

Source: netscan.exe

Static PE information: Resource name: RT_RCDATA type: PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows

Source: C:\Users\user\Desktop\netscan.exe

File read: C:\Users\user\Desktop\netscan.exe

Jump to behavior

Source: netscan.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\netscan.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: netscan.exe	String found in binary or memory: IN-ADDR.ARPA
Source: netscan.exe	String found in binary or memory: -oX - --script-help=all
Source: netscan.exe	String found in binary or memory: <soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:lms="http://schemas.microsoft.com/windows/lms/2007/08" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing">
Source: netscan.exe	String found in binary or memory: <wsa:Address>http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</wsa:Address>
Source: netscan.exe	String found in binary or memory: Z<wsa:Address>http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</wsa:Address>
Source: netscan.exe	String found in binary or memory: <soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:wsd="http://schemas.xmlsoap.org/ws/2005/04/discovery" xmlns:wsdp="http://schemas.xmlsoap.org/ws/2006/02/devprof">
Source: netscan.exe	String found in binary or memory: ip-address
Source: netscan.exe	String found in binary or memory: mac-address
Source: netscan.exe	String found in binary or memory: <!--StartFragment-->

Source: classification engine

Classification label: clean0.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\netscan.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4657278A-411B-11d2-839A-00C04FD918D0}\InProcServer32

Jump to behavior

Source: netscan.exe, 00000000.00000002.658173530.000000010081E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: netscan.exe, 00000000.00000002.658173530.000000010081E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);

Source: C:\Users\user\Desktop\netscan.exe	Automated click: OK
Source: C:\Users\user\Desktop\netscan.exe	Automated click: Continue

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: netscan.exe

Static file information: File size 16358912 > 1048576

Source: netscan.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: netscan.exe

Static PE information: Image base 0x100000000 > 0x60000000

Source: netscan.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x76a000
Source: netscan.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x40a000
Source: netscan.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x2f2800

Source: netscan.exe

Static PE information: More than 200 imports for user32.dll

Source: C:\Users\user\Desktop\netscan.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\netscan.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX			Jump to behavior

Source: netscan.exe, 00000000.00000002.642306860.000000000619F000.00000004.00000020.00020000.00000000.sdmp, netscan.exe, 00000000.00000003.381194566.0000000006199000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll](u

Source: netscan.exe, 00000000.00000002.658173530.000000010081E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: Shell_TrayWnd
Source: netscan.exe, 00000000.00000002.658173530.000000010081E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: ToolbarWindow32Shell_TrayWnd

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Command and Scripting Interpreter	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
netscan.exe	2%	ReversingLabs
netscan.exe	0%	Virustotal		Browse

Name	Source	Malicious	Reputation
https://www.softperfect.com/support/	netscan.exe	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	netscan.exe	false	high
http://v4.softperfect.com/scripts/netscanner/getinfo.php	netscan.exe	false	high
http://www.softperfect.com/products/networkscanner/version.txt	netscan.exe	false	high
https://nmap.org	netscan.exe	false	high
https://www.softperfect.com/products/networkscanner/manual/	netscan.exe	false	high
http://schemas.xmlsoap.org/ws/2005/04/discovery/Probe	netscan.exe	false	high
https://www.softperfect.com/order/?sns&upgrade	netscan.exe	false	high
http://v6.softperfect.com/scripts/netscanner/getinfo.php	netscan.exe	false	high
https://www.softperfect.com/order/?sns	netscan.exe	false	high
http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv	netscan.exe	false	high
http://www.gnu.org/licenses/.	netscan.exe, 00000000.00000002.659160200.0000000100CCB000.00000008.00000001.01000000.00000003.sdmp, netscan.exe, 00000000.00000000.376653064.0000000100CC7000.00000008.00000001.01000000.00000003.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/09/transfer/Get	netscan.exe	false	high
https://www.softperfect.com/products/networkscanner/?from=nver	netscan.exe	false	high
http://nossl.softperfect.com/download/support/oui.txt	netscan.exe	false	high
https://www.softperfect.com	netscan.exe	false	high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1281785
Start date and time:	2023-07-28 13:22:20 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	netscan.exe
Detection:	CLEAN
Classification:	clean0.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.375845914075556
TrID:	Visual Basic Script (13500/0) 45.69% Win64 Executable (generic) (12005/4) 40.63% Generic Win/DOS Executable (2004/3) 6.78% DOS Executable Generic (2002/1) 6.78% VXD Driver (31/22) 0.10%
File name:	netscan.exe
File size:	16'358'912 bytes
MD5:	5db121b74aede2736366690c74b4a197
SHA1:	0f57df99a37b8c80b3fdf691a9fc50697c3ea26d
SHA256:	6321c3bdb6e8311c5e62da960a5289fe95604023883c0eb2167865a8ddb44bfa
SHA512:	d1d6007ef788057292a3a1b8970262c0160545156a08e18d8f56259f83d1ca600d1b8264949fae2d39b61ae626457d42d516b3ad7340a089a1024b1e81c14d20
SSDEEP:	196608:txFbq99F4Z+OEhvXFGr8D8elzqHuBs+g:HFbq934YOEhvXFSk8I2Hw
TLSH:	D8F65BBBB532CA98C0CBC6F4148287A2DB317D1419B5134622C93F0F6E72F545E6E99E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./.....0.v.$/...@..@=.....................................................................................

File Icon


Icon Hash:	196566667ccc4d17

Static PE Info

General

Entrypoint:	0x100003d40
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x100000000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x3cc0, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	88349e111bd650ce90bc4f6c23f6aca3

Entrypoint Preview

Instruction
dec eax
lea esp, dword ptr [esp-28h]
mov byte ptr [00768574h], 00000000h
dec esp
lea eax, dword ptr [00CC22ADh]
dec eax
lea edx, dword ptr [00CC22AEh]
dec eax
lea ecx, dword ptr [0076730Fh]
call 00007F8A24CDB88Fh
call 00007F8A24CDB89Ah
dec eax
lea ecx, dword ptr [0076729Eh]
call 00007F8A24CF11AEh
nop
dec eax
lea esp, dword ptr [esp+28h]
ret
add byte ptr [eax], al
push ebp
dec eax
mov ebp, ecx
dec eax
lea esp, dword ptr [esp-20h]
dec eax
lea edx, dword ptr [0083F168h]
dec eax
lea ecx, dword ptr [ebp-50h]
call 00007F8A24CE74ECh
dec eax
lea ecx, dword ptr [ebp-48h]
call 00007F8A24CE2133h
dec eax
lea ecx, dword ptr [ebp-40h]
call 00007F8A24CE212Ah
dec eax
lea ecx, dword ptr [ebp-08h]
call 00007F8A24CE2121h
nop
dec eax
lea esp, dword ptr [esp+20h]
pop ebp
ret
add byte ptr [eax], al
add byte ptr [eax], al
push ebp
dec eax
mov ebp, esp
dec eax
lea esp, dword ptr [esp-80h]
dec eax
mov dword ptr [ebp-58h], ebx
call 00007F8A24CEAE33h
dec eax
mov dword ptr [ebp-50h], 00000000h
dec eax
mov dword ptr [ebp-48h], 00000000h
dec eax
mov dword ptr [ebp-40h], 00000000h
dec eax
mov dword ptr [ebp-08h], 00000000h
nop
dec eax
mov eax, dword ptr [00CA0DA6h]
cmp byte ptr [eax+08h], 00000000h
je 00007F8A24CDB9EEh
dec eax
lea eax, dword ptr [00000065h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xcc7000	0x21c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xcce000	0x2f265c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xc28000	0x78fa8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x76b070	0x28	.data
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xcc8bdc	0x19c0	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x769f30	0x76a000	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x76b000	0xb2f24	0xb3000	False	0.5266713403456704	DOS executable (block device driver)	6.3957588377157135	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x81e000	0x409e58	0x40a000	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0xc28000	0x78fa8	0x79000	False	0.5050482631714877	data	6.512143931698007	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0xca1000	0x240e0	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0xcc6000	0x18	0x200	False	0.03515625	data	0.06116285224115448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xcc7000	0x6e74	0x7000	False	0.25118582589285715	data	4.473242732391984	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xcce000	0x2f265c	0x2f2800	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
TYPELIB	0xcd3cf0	0x2264	data			0.3421172194457065
RT_CURSOR	0xcd5f54	0x134	data			0.12012987012987013
RT_CURSOR	0xcd6088	0x134	data			0.2305194805194805
RT_CURSOR	0xcd61bc	0x134	data			0.4935064935064935
RT_CURSOR	0xcd62f0	0x334	data			0.24634146341463414
RT_CURSOR	0xcd6624	0x434	data			0.24814126394052044
RT_CURSOR	0xcd6a58	0x134	Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001"			0.5
RT_CURSOR	0xcd6b8c	0x334	data			0.24634146341463414
RT_CURSOR	0xcd6ec0	0x434	Targa image data 128 x 65536 x 1 +64 "\001"			0.24349442379182157
RT_CURSOR	0xcd72f4	0x134	data			0.36688311688311687
RT_CURSOR	0xcd7428	0x334	data			0.2146341463414634
RT_CURSOR	0xcd775c	0x434	data			0.18680297397769516
RT_CURSOR	0xcd7b90	0x134	Targa image data 64 x 65536 x 1 +32 "\001"			0.36688311688311687
RT_CURSOR	0xcd7cc4	0x334	Targa image data - RLE 96 x 65536 x 1 +48 "\001"			0.20609756097560974
RT_CURSOR	0xcd7ff8	0x434	Targa image data - Color 128 x 65536 x 1 +64 "\001"			0.17657992565055763
RT_CURSOR	0xcd842c	0x134	data			0.5844155844155844
RT_CURSOR	0xcd8560	0x334	data			0.3
RT_CURSOR	0xcd8894	0x434	data			0.2983271375464684
RT_CURSOR	0xcd8cc8	0x134	Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001"			0.42857142857142855
RT_CURSOR	0xcd8dfc	0x334	data			0.2280487804878049
RT_CURSOR	0xcd9130	0x434	Targa image data 128 x 65536 x 1 +64 "\001"			0.23513011152416358
RT_CURSOR	0xcd9564	0x134	Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001"			0.5
RT_CURSOR	0xcd9698	0x334	data			0.24634146341463414
RT_CURSOR	0xcd99cc	0x434	Targa image data 128 x 65536 x 1 +64 "\001"			0.24349442379182157
RT_CURSOR	0xcd9e00	0x134	data			0.2662337662337662
RT_CURSOR	0xcd9f34	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"			0.38311688311688313
RT_CURSOR	0xcda068	0x134	data			0.3538961038961039
RT_CURSOR	0xcda19c	0x134	AmigaOS bitmap font "(", fc_YSize 4294967064, 3584 elements, 2nd "\377\270w\377\377\370\177\377\377\370\177\377\377\370\177\377\377\370\177\377\377\370\177\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd			0.3181818181818182
RT_CURSOR	0xcda2d0	0x134	Targa image data 64 x 65536 x 1 +32 "\001"			0.5194805194805194
RT_CURSOR	0xcda404	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"			0.1858288770053476
RT_CURSOR	0xcda6f0	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"			0.21256684491978609
RT_CURSOR	0xcda9dc	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"			0.1858288770053476
RT_CURSOR	0xcdacc8	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"			0.1925133689839572
RT_CURSOR	0xcdafb4	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"			0.20588235294117646
RT_CURSOR	0xcdb2a0	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"			0.18850267379679145
RT_CURSOR	0xcdb58c	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"			0.18181818181818182
RT_CURSOR	0xcdb878	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"			0.18449197860962566
RT_CURSOR	0xcdbb64	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"			0.19117647058823528
RT_CURSOR	0xcdbe50	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"			0.18983957219251338
RT_CURSOR	0xcdc13c	0x134	data			0.3538961038961039
RT_ICON	0xcdc270	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.6881663113006397
RT_ICON	0xcdd118	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.7847472924187726
RT_ICON	0xcdd9c0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0			0.7321428571428571
RT_ICON	0xcde088	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5036127167630058
RT_ICON	0xcde5f0	0x69b7	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9944943280493663
RT_ICON	0xce4fa8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 0			0.17091565124807762
RT_ICON	0xcf57d0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0			0.33354983467170524
RT_ICON	0xcf99f8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0			0.35560165975103736
RT_ICON	0xcfbfa0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0			0.4652908067542214
RT_ICON	0xcfd048	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0			0.5483606557377049
RT_ICON	0xcfd9d0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0			0.6090425531914894
RT_DIALOG	0xcfde38	0x32	data			0.76
RT_RCDATA	0xcfde6c	0x111	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0
RT_RCDATA	0xcfdf80	0x11f	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			0.9930313588850174
RT_RCDATA	0xcfe0a0	0x139	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			0.9904153354632588
RT_RCDATA	0xcfe1dc	0x163	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0225352112676056
RT_RCDATA	0xcfe340	0x1dc	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.023109243697479
RT_RCDATA	0xcfe51c	0x274	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.017515923566879
RT_RCDATA	0xcfe790	0x1ef	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0222222222222221
RT_RCDATA	0xcfe980	0x2ea	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0147453083109919
RT_RCDATA	0xcfec6c	0x377	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.012401352874859
RT_RCDATA	0xcfefe4	0x175	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0
RT_RCDATA	0xcff15c	0x173	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0080862533692723
RT_RCDATA	0xcff2d0	0x1f2	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0140562248995983
RT_RCDATA	0xcff4c4	0x194	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0222772277227723
RT_RCDATA	0xcff658	0x1d4	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0235042735042734
RT_RCDATA	0xcff82c	0x22c	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0197841726618706
RT_RCDATA	0xcffa58	0x2c8	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0154494382022472
RT_RCDATA	0xcffd20	0x41e	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0104364326375712
RT_RCDATA	0xd00140	0x528	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0083333333333333
RT_RCDATA	0xd00668	0x178	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0132978723404256
RT_RCDATA	0xd007e0	0x200	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.021484375
RT_RCDATA	0xd009e0	0x248	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.018835616438356
RT_RCDATA	0xd00c28	0x279	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0173775671406002
RT_RCDATA	0xd00ea4	0x346	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0131264916467781
RT_RCDATA	0xd011ec	0x36c	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0125570776255708
RT_RCDATA	0xd01558	0x1e9	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0224948875255624
RT_RCDATA	0xd01744	0x243	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0189982728842832
RT_RCDATA	0xd01988	0x315	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0139416983523448
RT_RCDATA	0xd01ca0	0x178	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0132978723404256
RT_RCDATA	0xd01e18	0x200	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.021484375
RT_RCDATA	0xd02018	0x248	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.018835616438356
RT_RCDATA	0xd02260	0x226	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.02
RT_RCDATA	0xd02488	0x2e9	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.014765100671141
RT_RCDATA	0xd02774	0x39d	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.011891891891892
RT_RCDATA	0xd02b14	0x2da	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.015068493150685
RT_RCDATA	0xd02df0	0x441	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0101010101010102
RT_RCDATA	0xd03234	0x599	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0076762037683182
RT_RCDATA	0xd037d0	0x264	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0179738562091503
RT_RCDATA	0xd03a34	0x361	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0127167630057803
RT_RCDATA	0xd03d98	0x4b2	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0091514143094842
RT_RCDATA	0xd0424c	0x26c	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.017741935483871
RT_RCDATA	0xd044b8	0x3c0	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0114583333333333
RT_RCDATA	0xd04878	0x52f	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.008289374529013
RT_RCDATA	0xd04da8	0x1cd	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.017353579175705
RT_RCDATA	0xd04f78	0x2ac	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0160818713450293
RT_RCDATA	0xd05224	0x324	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.013681592039801
RT_RCDATA	0xd05548	0x37d	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0123180291153415
RT_RCDATA	0xd058c8	0x554	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0080645161290323
RT_RCDATA	0xd05e1c	0x632	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0069356872635562
RT_RCDATA	0xd06450	0x1cd	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.017353579175705
RT_RCDATA	0xd06620	0x2ac	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0160818713450293
RT_RCDATA	0xd068cc	0x324	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.013681592039801
RT_RCDATA	0xd06bf0	0x3a9	SVG Scalable Vector Graphics image	English	Australia	0.48772678762006405
RT_RCDATA	0xd06f9c	0x560	SVG Scalable Vector Graphics image	English	Australia	0.4113372093023256
RT_RCDATA	0xd074fc	0x6be	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0063731170336037
RT_RCDATA	0xd07bbc	0xb7b	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0037427696495407
RT_RCDATA	0xd08738	0xf46	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced			1.0028132992327365
RT_RCDATA	0xd09680	0x523	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0083650190114068
RT_RCDATA	0xd09ba4	0x80c	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0053398058252427
RT_RCDATA	0xd0a3b0	0xb0b	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced			1.0038910505836576
RT_RCDATA	0xd0aebc	0x5cd	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0074074074074073
RT_RCDATA	0xd0b48c	0x997	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0044806517311609
RT_RCDATA	0xd0be24	0xca6	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced			1.003397158739963
RT_RCDATA	0xd0cacc	0x53c	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0082089552238807
RT_RCDATA	0xd0d008	0x7a4	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0056237218813906
RT_RCDATA	0xd0d7ac	0xa58	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced			1.0041540785498488
RT_RCDATA	0xd0e204	0x342	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.013189448441247
RT_RCDATA	0xd0e548	0x45d	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0098478066248882
RT_RCDATA	0xd0e9a8	0x607	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced			1.0071289695398573
RT_RCDATA	0xd0efb0	0xfdb89	Unicode text, UTF-8 (with BOM) text, with very long lines (453), with CRLF line terminators	English	United States	0.3159998498904489
RT_RCDATA	0xe0cb3c	0x878	PNG image data, 400 x 16, 8-bit/color RGBA, non-interlaced			1.0050738007380073
RT_RCDATA	0xe0d3b4	0xd32	PNG image data, 600 x 24, 8-bit/color RGBA, non-interlaced			0.9863824748371818
RT_RCDATA	0xe0e0e8	0xfd5	PNG image data, 800 x 32, 8-bit/color RGBA, non-interlaced			0.9518874907475944
RT_RCDATA	0xe0f0c0	0x7c8	PNG image data, 400 x 16, 8-bit/color RGBA, non-interlaced			1.0055220883534137
RT_RCDATA	0xe0f888	0xbb4	PNG image data, 600 x 24, 8-bit/color RGBA, non-interlaced			0.992656875834446
RT_RCDATA	0xe1043c	0xeab	PNG image data, 800 x 32, 8-bit/color RGBA, non-interlaced			0.9691078561917443
RT_RCDATA	0xe112e8	0x5b9	PNG image data, 400 x 16, 8-bit/color RGBA, non-interlaced			1.0075085324232083
RT_RCDATA	0xe118a4	0x8c5	PNG image data, 600 x 24, 8-bit/color RGBA, non-interlaced			0.9973273942093541
RT_RCDATA	0xe1216c	0xb9d	PNG image data, 800 x 32, 8-bit/color RGBA, non-interlaced			0.9606458123107972
RT_RCDATA	0xe12d0c	0x1c3	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.024390243902439
RT_RCDATA	0xe12ed0	0x29a	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0165165165165164
RT_RCDATA	0xe1316c	0x32e	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced			1.0135135135135136
RT_RCDATA	0xe1349c	0x196	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.022167487684729
RT_RCDATA	0xe13634	0x287	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.017001545595054
RT_RCDATA	0xe138bc	0x29b	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced			1.0059970014992503
RT_RCDATA	0xe13b58	0x1a0	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0216346153846154
RT_RCDATA	0xe13cf8	0x232	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.019572953736655
RT_RCDATA	0xe13f2c	0x277	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced			1.01743264659271
RT_RCDATA	0xe141a4	0x84d	PNG image data, 400 x 16, 8-bit/color RGBA, non-interlaced			1.0051764705882353
RT_RCDATA	0xe149f4	0xccd	PNG image data, 600 x 24, 8-bit/color RGBA, non-interlaced			0.9874885566066525
RT_RCDATA	0xe156c4	0xf14	PNG image data, 800 x 32, 8-bit/color RGBA, non-interlaced			0.9546632124352331
RT_RCDATA	0xe165d8	0x78f	PNG image data, 400 x 16, 8-bit/color RGBA, non-interlaced			1.0056847545219638
RT_RCDATA	0xe16d68	0xb37	PNG image data, 600 x 24, 8-bit/color RGBA, non-interlaced			0.9923371647509579
RT_RCDATA	0xe178a0	0xde3	PNG image data, 800 x 32, 8-bit/color RGBA, non-interlaced			0.9673699015471168
RT_RCDATA	0xe18684	0x539	PNG image data, 144 x 16, 8-bit/color RGBA, non-interlaced			1.0082273747195214
RT_RCDATA	0xe18bc0	0x891	PNG image data, 216 x 24, 8-bit/color RGBA, non-interlaced			1.005015959872321
RT_RCDATA	0xe19454	0xa3e	PNG image data, 288 x 32, 8-bit/color RGBA, non-interlaced			1.0041952707856598
RT_RCDATA	0xe19e94	0xfee	PNG image data, 400 x 16, 8-bit/color RGBA, non-interlaced			1.0026974006866112
RT_RCDATA	0xe1ae84	0x128	PNG image data, 9 x 9, 8-bit/color RGBA, non-interlaced			1.0
RT_RCDATA	0xe1afac	0x1c0	PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced			1.0245535714285714
RT_RCDATA	0xe1b16c	0x19e	PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced			1.0217391304347827
RT_RCDATA	0xe1b30c	0x14d	PNG image data, 9 x 9, 8-bit/color RGBA, non-interlaced			1.012012012012012
RT_RCDATA	0xe1b45c	0x1ee	PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced			1.0222672064777327
RT_RCDATA	0xe1b64c	0x1c7	PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced			1.024175824175824
RT_RCDATA	0xe1b814	0x1b93	PNG image data, 600 x 24, 8-bit/color RGBA, non-interlaced			1.0007083156254426
RT_RCDATA	0xe1d3a8	0x1fb3	PNG image data, 800 x 32, 8-bit/color RGBA, non-interlaced			0.9930991990141713
RT_RCDATA	0xe1f35c	0x9600	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows	English	Australia	0.471796875
RT_RCDATA	0xe2895c	0x964	Unicode text, UTF-8 (with BOM) text, with very long lines (578), with CRLF line terminators	English	United States	0.5016638935108153
RT_RCDATA	0xe292c0	0x2f6	SVG Scalable Vector Graphics image	English	Australia	0.45118733509234826
RT_RCDATA	0xe295b8	0x423	SVG Scalable Vector Graphics image	English	Australia	0.35694050991501414
RT_RCDATA	0xe299dc	0x16f	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0190735694822888
RT_RCDATA	0xe29b4c	0x194	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0198019801980198
RT_RCDATA	0xe29ce0	0x243	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0189982728842832
RT_RCDATA	0xe29f24	0x108	PNG image data, 8 x 8, 8-bit/color RGBA, non-interlaced			1.0
RT_RCDATA	0xe2a02c	0x162	PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced			1.0141242937853108
RT_RCDATA	0xe2a190	0x17d	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.020997375328084
RT_RCDATA	0xe2a310	0x1b1	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0184757505773672
RT_RCDATA	0xe2a4c4	0x23f	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0191304347826087
RT_RCDATA	0xe2a704	0x12d	PNG image data, 8 x 8, 8-bit/color RGBA, non-interlaced			1.0066445182724253
RT_RCDATA	0xe2a834	0x15d	PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced			1.0143266475644699
RT_RCDATA	0xe2a994	0x1cd	Delphi compiled form 'TCalendarPopupForm'			0.6355748373101953
RT_RCDATA	0xe2ab64	0x165a31	Delphi compiled form 'TDefaultDataModule'			0.9504413604736328
RT_RCDATA	0xf90598	0x7bc	Delphi compiled form 'TfmAbout'			0.4626262626262626
RT_RCDATA	0xf90d54	0x172	Delphi compiled form ''			0.7351351351351352
RT_RCDATA	0xf90ec8	0x353	Delphi compiled form 'TfmAuthInfo'			0.5029377203290247
RT_RCDATA	0xf9121c	0xfb	Delphi compiled form 'TfmBackColorPopup'			0.8087649402390438
RT_RCDATA	0xf91318	0x19a	Delphi compiled form 'TfmBaseDialog'			0.6609756097560976
RT_RCDATA	0xf914b4	0x1c1	Delphi compiled form '\027TfmBaseDialogRemoteEdit\026fmBaseDialogRemoteEdit\007Caption\006'			0.6057906458797327
RT_RCDATA	0xf91678	0x2c5	Delphi compiled form '\025TfmBaseDialogShutdown\024fmBaseDialogShutdown\006Height\003\265\001\005Width\003\264\001\014ClientHeight\003\265\001\013ClientWidth\003\264\001\010OnCreate\007'			0.5289139633286318
RT_RCDATA	0xf91940	0x897	Delphi compiled form '\023TfmBaseQueryBuilder\022fmBaseQueryBuilder\004Left\003\303\002\006Height\003D\002\003Top\0037\001\005Width\003.\003\014ClientHeight\003D\002\013ClientWidth\003.\003\010OnCreate\007'			0.4242837653478854
RT_RCDATA	0xf921d8	0x3a5	Delphi compiled form '\017TfmBookmarkEdit\016fmBookmarkEdit\004Left\003K\004\006Height\003\305\001\003Top\003\013\002\005Width\003\251\002\007Caption\006\021Add/Edit IP Range\014ClientHeight\003\305\001\013ClientWidth\003\251\002\010OnC'			0.5219721329046088
RT_RCDATA	0xf92580	0xa85	Delphi compiled form 'TfmBookmarkList'			0.39918306721128854
RT_RCDATA	0xf93008	0x8d2	Delphi compiled form '\027TfmColumnDisplayOptions\026fmColumnDisplayOptions\006Height\003\324\001\007Caption\006\007Display\014ClientHeight\003\324\001'			0.37156775907883083
RT_RCDATA	0xf938dc	0xaf2	Delphi compiled form 'TfmCompare'			0.3886509635974304
RT_RCDATA	0xf943d0	0x9f5	Delphi compiled form 'TfmCreateBatch'			0.4123185562965869
RT_RCDATA	0xf94dc8	0x2b2	Delphi compiled form '\013TfmCredEdit'			0.4855072463768116
RT_RCDATA	0xf9507c	0x595	Delphi compiled form 'TfmCredManager'			0.4268719384184745
RT_RCDATA	0xf95614	0x2ff	Delphi compiled form '\025TfmDeleteDevicePrompt\024fmDeleteDevicePrompt\006Height\003\225'			0.5397653194263363
RT_RCDATA	0xf95914	0x457	Delphi compiled form '\013TfmDetectIP'			0.5472547254725473
RT_RCDATA	0xf95d6c	0x375	Delphi compiled form 'TfmDHCPView'			0.5694915254237288
RT_RCDATA	0xf960e4	0x682	Delphi compiled form 'TfmDiscoveryView'			0.4411764705882353
RT_RCDATA	0xf96768	0x52b	Delphi compiled form 'TfmDuplicateIP'			0.528344671201814
RT_RCDATA	0xf96c94	0x4b2	Delphi compiled form ''			0.4841930116472546
RT_RCDATA	0xf97148	0x6f0	Delphi compiled form '\020TfmEmailSettings\017fmEmailSettings\006Height\003\200\001\005Width\003\264\001\007Caption\006\017E-mail settings\014ClientHeight\003\200\001\013ClientWidth\003\264\001\006OnShow\007\010FormShow'			0.44876126126126126
RT_RCDATA	0xf97838	0x374	Delphi compiled form '\017TfmFilterEditor\016fmFilterEditor\004Left\003@\003\006Height\003h\001\003Top\003\243\001\005Width\003X\002\007Caption\006\004Edit\014ClientHeight\003h\001\013ClientWidth\003X\002\010OnCreate\007'			0.5113122171945701
RT_RCDATA	0xf97bac	0x537	Delphi compiled form '\023TfmFilterManagement\022fmFilterManagement\004Left\003\331\004\006Height\003\240\001\003Top\003\300\001\005Width\003\023\002'			0.4756554307116105
RT_RCDATA	0xf980e4	0x244	Delphi compiled form '\020TfmFreeFormInput\017fmFreeFormInput\006Height\003\254'			0.5913793103448276
RT_RCDATA	0xf98328	0x2a1	Delphi compiled form '\023TfmFriendlyNameEdit\022fmFriendlyNameEdit\006Height\003\315'			0.5334323922734027
RT_RCDATA	0xf985cc	0xad4	Delphi compiled form 'TfmFriendlyNameList'			0.398989898989899
RT_RCDATA	0xf990a0	0x373	Delphi compiled form 'TfmHostProps'			0.5775764439411099
RT_RCDATA	0xf99414	0x27a	Delphi compiled form '\020TfmIgnoreAddress\017fmIgnoreAddress\004Left\003I\002\006Height\003\206\001\003Top\003.\001\005Width\003\364\001\007Caption\006\024Ignored IP Addresses\014ClientHeight\003\206\001\013ClientWidth\003\364'			0.5977917981072555
RT_RCDATA	0xf99690	0x5e1	Delphi compiled form ''			0.4850498338870432
RT_RCDATA	0xf99c74	0x588	Delphi compiled form 'TfmIPInput'			0.3983050847457627
RT_RCDATA	0xf9a1fc	0x75c	Delphi compiled form '\023TfmJsonQueryBuilder\022fmJsonQueryBuilder'			0.4140127388535032
RT_RCDATA	0xf9a958	0x6d3	Delphi compiled form '\017TfmKeyValEditor\016fmKeyValEditor\006Height\003p\001\005Width\003\344\001'			0.4585002862049227
RT_RCDATA	0xf9b02c	0x550	Delphi compiled form '\013TfmLdapEdit'			0.42205882352941176
RT_RCDATA	0xf9b57c	0x336	Delphi compiled form 'TfmLegend'			0.597323600973236
RT_RCDATA	0xf9b8b4	0x1df	Delphi compiled form '\017TfmLicenseInput\016fmLicenseInput\006Height\003\344'			0.5845511482254697
RT_RCDATA	0xf9ba94	0x372	Delphi compiled form '\030TfmLiveDisplayFileOutput\027fmLiveDisplayFileOutput\006Height\003\305'			0.5521541950113379
RT_RCDATA	0xf9be08	0x8a9	Delphi compiled form 'TfmLiveDisplayLog'			0.43346865133062695
RT_RCDATA	0xf9c6b4	0x829	Delphi compiled form '\034TfmLiveDisplayNotifySettings\033fmLiveDisplayNotifySettings\006Height\003\016\002\005Width\003\261\001\007Caption\006\030Notification Preferences\014ClientHeight\003\016\002\013'			0.38678793681187174
RT_RCDATA	0xf9cee0	0x612	Delphi compiled form '\016TfmLoadOptions'			0.3944658944658945
RT_RCDATA	0xf9d4f4	0x7dfe	Delphi compiled form 'TfmMainView'			0.2432876542444348
RT_RCDATA	0xfa52f4	0x1d3	Delphi compiled form '\016TfmMapShortCut'			0.6338329764453962
RT_RCDATA	0xfa54c8	0x4b8	Delphi compiled form ''			0.4991721854304636
RT_RCDATA	0xfa5980	0x397	Delphi compiled form '\014TfmNavigator\013fmNavigator\004Left\003\303\002\006Height\003\213\001\003Top\0037\001\005Width\003\322\001'			0.5397170837867247
RT_RCDATA	0xfa5d18	0x558	Delphi compiled form '\022TfmNmapIntegration\021fmNmapIntegration\004Left\003\026\003\003Top\003\365'			0.4656432748538012
RT_RCDATA	0xfa6270	0xe23	Delphi compiled form '\026TfmNmapIntegrationEdit\025fmNmapIntegrationEdit\006Height\003!\002\005Width\003\360\001\014ClientHeight\003!\002\013ClientWidth\003\360\001\010OnCreate\007'			0.40563691627521414
RT_RCDATA	0xfa7094	0x335	Delphi compiled form '\017TfmNmapSettings\016fmNmapSettings\004Left\003\303\002\006Height\003\363'			0.4701583434835566
RT_RCDATA	0xfa73cc	0x31e	Delphi compiled form 'TfmOfflineDialog'			0.5338345864661654
RT_RCDATA	0xfa76ec	0x56ed	Delphi compiled form 'TfmOptions'			0.2870174807891071
RT_RCDATA	0xfacddc	0x21e	Delphi compiled form 'TfmPassFrame'			0.6180811808118081
RT_RCDATA	0xfacffc	0x342	Delphi compiled form 'TfmPasteIP'			0.4784172661870504
RT_RCDATA	0xfad340	0x12d	Delphi compiled form '\021TfmPortListEditor\020fmPortListEditor\007Caption\006\017TCP Port Groups'			0.7475083056478405
RT_RCDATA	0xfad470	0x4d4	Delphi compiled form '\021TfmPoweroffParams\020fmPoweroffParams'			0.5137540453074434
RT_RCDATA	0xfad944	0x722	Delphi compiled form 'TfmPublicIP'			0.3729463307776561
RT_RCDATA	0xfae068	0x269	Delphi compiled form '\014TfmRearrange\013fmRearrange\007Caption\006\017Rearrange Items'			0.5850891410048622
RT_RCDATA	0xfae2d4	0xa4a	Delphi compiled form 'TfmRemoteCommon'			0.3800303720577069
RT_RCDATA	0xfaed20	0x1e3	Delphi compiled form ''			0.6231884057971014
RT_RCDATA	0xfaef04	0x40d	Delphi compiled form '\021TfmRemoteFileEdit\020fmRemoteFileEdit'			0.5188042430086789
RT_RCDATA	0xfaf314	0x1d8	Delphi compiled form '\017TfmRemoteGroups\016fmRemoteGroups\007Caption\006'			0.6292372881355932
RT_RCDATA	0xfaf4ec	0x5b0	Delphi compiled form '\023TfmRemoteGroupsEdit\022fmRemoteGroupsEdit\006Height\003~\001\014ClientHeight\003~\001'			0.48282967032967034
RT_RCDATA	0xfafa9c	0x339	Delphi compiled form ''			0.5393939393939394
RT_RCDATA	0xfafdd8	0x36f	Delphi compiled form '\021TfmRemoteHTTPEdit\020fmRemoteHTTPEdit\004Left\003\303\002\006Height\003i\001\003Top\0037\001\014ClientHeight\003i\001'			0.48350398179749715
RT_RCDATA	0xfb0148	0x1b5	Delphi compiled form ''			0.6453089244851259
RT_RCDATA	0xfb0300	0x407	Delphi compiled form '\021TfmRemoteJSONEdit\020fmRemoteJSONEdit\004Left\003\304\002\006Height\003\226\001\003Top\0038\001\014ClientHeight\003\226\001'			0.49466537342386036
RT_RCDATA	0xfb0708	0x2c0	Delphi compiled form '\021TfmRemotePerfEdit\020fmRemotePerfEdit'			0.5198863636363636
RT_RCDATA	0xfb09c8	0x191	Delphi compiled form '\024TfmRemotePerformance\023fmRemotePerformance\007Caption\006\022Remote Performance'			0.6334164588528678
RT_RCDATA	0xfb0b5c	0x4cb	Delphi compiled form '\023TfmRemotePowerShell\022fmRemotePowerShell\004Left\003\256\001\003Top\003\322'			0.5232273838630807
RT_RCDATA	0xfb1028	0x191	Delphi compiled form '\027TfmRemotePowerShellEdit\026fmRemotePowerShellEdit'			0.6134663341645885
RT_RCDATA	0xfb11bc	0x1fc	Delphi compiled form '\021TfmRemoteRegistry\020fmRemoteRegistry\007Caption\006\017Remote Registry\010OnCreate\007'			0.5826771653543307
RT_RCDATA	0xfb13b8	0x444	Delphi compiled form '\030TfmRemoteRegistryBrowser\027fmRemoteRegistryBrowser\006Height\003&\002\005Width\003 \003\007Caption\006\020Registry Browser\014ClientHeight\003&\002\013ClientWidth\003 \003\010O'			0.4734432234432234
RT_RCDATA	0xfb17fc	0x5a6	Delphi compiled form '\025TfmRemoteRegistryEdit\024fmRemoteRegistryEdit\006Height\003e\001\005Width\003\255\001\014ClientHeight\003e\001\013ClientWidth\003\255\001'			0.45643153526970953
RT_RCDATA	0xfb1da4	0x163	Delphi compiled form '\022TfmRemoteScripting\021fmRemoteScripting\004Left\003\256\001\003Top\003\322'			0.6873239436619718
RT_RCDATA	0xfb1f08	0x67f	Delphi compiled form '\026TfmRemoteScriptingEdit\025fmRemoteScriptingEdit\006Height\003\201\002\005Width\003\243\002\013BorderStyle\007'			0.46422128683102826
RT_RCDATA	0xfb2588	0x3ab	Delphi compiled form '\024TfmRemoteServiceEdit\023fmRemoteServiceEdit'			0.503727369542066
RT_RCDATA	0xfb2934	0x1f7	Delphi compiled form '\021TfmRemoteServices\020fmRemoteServices\004Left\003\260\001\003Top\003\355'			0.6242544731610338
RT_RCDATA	0xfb2b2c	0x1a3	Delphi compiled form ''			0.6897374701670644
RT_RCDATA	0xfb2cd0	0x87e	Delphi compiled form '\021TfmRemoteSNMPEdit\020fmRemoteSNMPEdit\006Height\003\332\001\005Width\003\255\001\014ClientHeight\003\332\001\013ClientWidth\003\255\001\010OnCreate\007'			0.43514259429622815
RT_RCDATA	0xfb3550	0x411	Delphi compiled form '\014TfmRemoteSSH\013fmRemoteSSH\004Left\003\256\001\003Top\003\322'			0.5504322766570605
RT_RCDATA	0xfb3964	0x19d	Delphi compiled form '\020TfmRemoteSSHEdit\017fmRemoteSSHEdit'			0.6174334140435835
RT_RCDATA	0xfb3b04	0x4c4	Delphi compiled form '\014TfmRemoteWMI\013fmRemoteWMI\004Left\003\220\002\006Height\003\372\001\003Top\003\361'			0.5377049180327869
RT_RCDATA	0xfb3fc8	0x638	Delphi compiled form '\020TfmRemoteWMIEdit\017fmRemoteWMIEdit\006Height\003\371\001\005Width\003P\002\007Caption\006\021WMI Query Builder\014ClientHeight\003\371\001\013ClientWidth\003P\002\010OnCreate\007'			0.47110552763819097
RT_RCDATA	0xfb4600	0x377	Delphi compiled form '\014TfmRemoteXML\013fmRemoteXML\007Caption\006'			0.5467869222096956
RT_RCDATA	0xfb4978	0x41b	Delphi compiled form '\020TfmRemoteXMLEdit\017fmRemoteXMLEdit'			0.5185537583254044
RT_RCDATA	0xfb4d94	0x32f	Delphi compiled form '\016TfmScriptInput'			0.5276073619631901
RT_RCDATA	0xfb50c4	0x41d	Delphi compiled form '\021TfmShutdownParams\020fmShutdownParams\007Caption\006\013Shutdown %s'			0.5223171889838556
RT_RCDATA	0xfb54e4	0x6d9	Delphi compiled form 'TfmSNMPv3Params'			0.3764974329720479
RT_RCDATA	0xfb5bc0	0x345	Delphi compiled form '\017TfmSNMPv3String\016fmSNMPv3String\006Height\003\230\001\005Width\003\011\002\007Caption\006\006SNMPv3\014ClientHeight\003\230\001\013ClientWidth\003\011\002'			0.43608124253285546
RT_RCDATA	0xfb5f08	0x34	Delphi compiled form '\013TfmSSDPView'			1.0
RT_RCDATA	0xfb5f3c	0x292	Delphi compiled form '\016TfmSSLCertInfo'			0.5820668693009119
RT_RCDATA	0xfb61d0	0x278	Delphi compiled form 'TfmStopScanDialog'			0.625
RT_RCDATA	0xfb6448	0x2ff	Delphi compiled form '\020TfmSubmitMessage\017fmSubmitMessage\006Height\003P\001\005Width\003\212\001'			0.5397653194263363
RT_RCDATA	0xfb6748	0x5a2	Delphi compiled form 'TfmTrialInfo'			0.521497919556172
RT_RCDATA	0xfb6cec	0x2f2	Delphi compiled form ''			0.5729442970822282
RT_RCDATA	0xfb6fe0	0x2c2	Delphi compiled form '\017TfmUserSettings\016fmUserSettings\006Height\003\357'			0.5736543909348442
RT_RCDATA	0xfb72a4	0x2e4a	Delphi compiled form 'TfmVBScriptEditor'			0.25468354430379747
RT_RCDATA	0xfba0f0	0x1a6	Delphi compiled form '\021TfmVirtualColumns\020fmVirtualColumns\004Left\003\260\001\003Top\003\355'			0.6184834123222749
RT_RCDATA	0xfba298	0x36a	Delphi compiled form '\025TfmVirtualColumnsEdit\024fmVirtualColumnsEdit\006Height\003e\001\005Width\003\256\001\014ClientHeight\003e\001\013ClientWidth\003\256\001'			0.4290617848970252
RT_RCDATA	0xfba604	0x1fe	Delphi compiled form '\021TfmVisibleColumns\020fmVisibleColumns\006Height\003Y\001\007Caption\006\017Visible Columns\014ClientHeight\003Y\001'			0.5705882352941176
RT_RCDATA	0xfba804	0x4cc	Delphi compiled form '\023TfmVisibleColumnsEx\022fmVisibleColumnsEx\006Height\003\232\001\005Width\003X\002\007Caption\006\017Visible Columns\014ClientHeight\003\232\001\013ClientWidth\003X\002\010OnCreate\007'			0.504885993485342
RT_RCDATA	0xfbacd0	0x38f	Delphi compiled form '\011TfmWOLAdd\010fmWOLAdd\005Width\003D\001'			0.5137211855104281
RT_RCDATA	0xfbb060	0xb36	Delphi compiled form 'TfmWOLManager'			0.38571428571428573
RT_RCDATA	0xfbbb98	0x404	Delphi compiled form '\016TfmWOLSettings'			0.4795719844357977
RT_RCDATA	0xfbbf9c	0x31	Delphi compiled form ''			0.9795918367346939
RT_RCDATA	0xfbbfd0	0x87f	Delphi compiled form '\022TfmXmlQueryBuilder\021fmXmlQueryBuilder\006Height\003@\002\005Width\0035\003\007Caption\006\023XPath Query Builder\014ClientHeight\003@\002\013ClientWidth\0035\003\006OnShow\007\010Fo'			0.37057471264367814
RT_RCDATA	0xfbc850	0x164	Delphi compiled form 'TModalControl'			0.5926966292134831
RT_RCDATA	0xfbc9b4	0x866	Delphi compiled form 'TTimePopupForm'			0.4441860465116279
RT_RCDATA	0xfbd21c	0x2a4	Delphi compiled form 'TWaitForm'			0.5636094674556213
RT_RCDATA	0xfbd4c0	0x72	ASCII text, with CRLF line terminators	English	United States	0.9649122807017544
RT_RCDATA	0xfbd534	0x15c	ASCII text, with CRLF line terminators	English	United States	0.6752873563218391
RT_RCDATA	0xfbd690	0x4de	ASCII text, with CRLF line terminators	English	United States	0.5112359550561798
RT_RCDATA	0xfbdb70	0x2ac	ASCII text, with CRLF line terminators	English	United States	0.5058479532163743
RT_RCDATA	0xfbde1c	0x402	ASCII text, with CRLF line terminators	English	United States	0.40253411306042886
RT_RCDATA	0xfbe220	0x180	ASCII text, with CRLF line terminators	English	United States	0.6875
RT_RCDATA	0xfbe3a0	0x657	ASCII text, with CRLF line terminators	English	United States	0.41897720271102895
RT_RCDATA	0xfbe9f8	0x2bb	ASCII text, with CRLF line terminators	English	United States	0.5078683834048641
RT_RCDATA	0xfbecb4	0x33b	ASCII text, with CRLF line terminators	English	United States	0.5392986698911729
RT_RCDATA	0xfbeff0	0x355	ASCII text, with CRLF line terminators	English	United States	0.5158264947245017
RT_RCDATA	0xfbf348	0x344	ASCII text, with CRLF line terminators	English	United States	0.4605263157894737
RT_RCDATA	0xfbf68c	0x231	ASCII text, with CRLF line terminators	English	United States	0.5846702317290553
RT_GROUP_CURSOR	0xfbf8c0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0xfbf8d4	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0xfbf8e8	0x30	Lotus unknown worksheet or configuration, revision 0x3			0.8958333333333334
RT_GROUP_CURSOR	0xfbf918	0x30	Lotus unknown worksheet or configuration, revision 0x3			0.9375
RT_GROUP_CURSOR	0xfbf948	0x30	Lotus unknown worksheet or configuration, revision 0x3			0.9375
RT_GROUP_CURSOR	0xfbf978	0x30	Lotus unknown worksheet or configuration, revision 0x3			0.9375
RT_GROUP_CURSOR	0xfbf9a8	0x30	Lotus unknown worksheet or configuration, revision 0x3			0.9375
RT_GROUP_CURSOR	0xfbf9d8	0x30	Lotus unknown worksheet or configuration, revision 0x3			0.9375
RT_GROUP_CURSOR	0xfbfa08	0x30	Lotus unknown worksheet or configuration, revision 0x3			0.9375
RT_GROUP_CURSOR	0xfbfa38	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xfbfa4c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xfbfa60	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xfbfa74	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xfbfa88	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xfbfa9c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xfbfab0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xfbfac4	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xfbfad8	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0xfbfaec	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xfbfb00	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xfbfb14	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xfbfb28	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xfbfb3c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xfbfb50	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xfbfb64	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0xfbfb78	0xa0	data			0.65625
RT_VERSION	0xfbfc18	0x328	data			0.46534653465346537
RT_MANIFEST	0xfbff40	0x71b	XML 1.0 document, ASCII text, with CRLF line terminators			0.4167124793842771

Imports

DLL	Import
kernel32.dll	GetStdHandle, GetConsoleMode, TlsGetValue, GetLastError, SetLastError, RaiseException, GetTickCount, ExitProcess, GetStartupInfoA, GetCommandLineA, GetCurrentProcessId, GetCurrentThreadId, GetCurrentProcess, ReadProcessMemory, GetModuleFileNameA, GetModuleHandleA, WriteFile, ReadFile, CloseHandle, SetFilePointer, GetFileSize, SetEndOfFile, GetSystemInfo, LoadLibraryW, LoadLibraryA, GetProcAddress, FreeLibrary, FormatMessageW, DeleteFileW, MoveFileW, CreateFileW, GetFileAttributesW, CreateDirectoryW, RemoveDirectoryW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, SetEnvironmentVariableW, GetConsoleOutputCP, GetOEMCP, GetProcessHeap, HeapAlloc, HeapFree, TlsAlloc, TlsSetValue, CreateThread, ExitThread, LocalAlloc, LocalFree, Sleep, SuspendThread, ResumeThread, TerminateThread, WaitForSingleObject, SetThreadPriority, GetThreadPriority, GetCurrentThread, OpenThread, IsDebuggerPresent, CreateEventA, ResetEvent, SetEvent, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, TryEnterCriticalSection, GetEnvironmentStringsW, FreeEnvironmentStringsW, MultiByteToWideChar, WideCharToMultiByte, GetACP, GetConsoleCP, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, RtlUnwindEx, EnumResourceTypesA, EnumResourceNamesA, EnumResourceLanguagesA, FindResourceA, FindResourceExA, LoadResource, SizeofResource, LockResource, FreeResource, AttachConsole, CancelSynchronousIo, GetEnvironmentStringsA, FreeEnvironmentStringsA, FormatMessageA, CreateFileMappingA, SetEnvironmentVariableA, GlobalAddAtomA, GetWindowsDirectoryA, CreateFileA, GetVolumeInformationA, GetVersionExA, CompareStringA, GetLocaleInfoA, GetDateFormatA, EnumCalendarInfoA, LoadLibraryExW, GetModuleFileNameW, GetCommandLineW, ExpandEnvironmentStringsW, GetSystemDirectoryW, GetFileAttributesExW, GetComputerNameW, CreateProcessW, FindFirstFileW, FindNextFileW, CompareStringW, GetLocaleInfoW, GetDateFormatW, FindFirstFileExW, GlobalAlloc, GlobalReAlloc, GlobalSize, GlobalLock, GlobalUnlock, GetProcessAffinityMask, GetExitCodeProcess, GetExitCodeThread, SetErrorMode, GlobalDeleteAtom, FlushFileBuffers, DeviceIoControl, FindClose, MulDiv, GetSystemTime, GetLocalTime, SystemTimeToTzSpecificLocalTime, GetTimeZoneInformation, FileTimeToLocalFileTime, FileTimeToSystemTime, FileTimeToDosDateTime, CreatePipe, PeekNamedPipe, MapViewOfFile, UnmapViewOfFile, QueryPerformanceCounter, QueryPerformanceFrequency, GetCPInfo, GetThreadLocale, SetThreadLocale, GetSystemDefaultLCID, GetUserDefaultLCID, FreeConsole, GetDiskFreeSpaceExW, SetFileInformationByHandle, SetDllDirectoryW
oleaut32.dll	SysAllocStringLen, SysFreeString, SysReAllocStringLen, VariantChangeTypeEx, VariantClear, VariantCopy, VariantInit, SafeArrayAccessData, SafeArrayCreate, SafeArrayGetElement, SafeArrayGetLBound, SafeArrayGetUBound, SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayRedim, SafeArrayUnaccessData, LoadTypeLib, RegisterTypeLib, UnRegisterTypeLib
user32.dll	MessageBoxA, CharUpperBuffW, CharLowerBuffW, GetUserObjectInformationA, RegisterWindowMessageA, PeekMessageA, SendMessageA, PostMessageA, PostThreadMessageA, DefWindowProcA, CallWindowProcA, RegisterClassA, UnregisterClassA, GetClassInfoA, RegisterClassExA, CreateWindowExA, SendDlgItemMessageA, RegisterClipboardFormatA, GetClipboardFormatNameA, CharToOemA, CharUpperA, CharUpperBuffA, CharLowerA, CharLowerBuffA, GetMenuItemInfoA, SetPropA, GetPropA, RemovePropA, EnumPropsA, GetWindowLongA, GetClassLongA, GetWindowLongPtrA, SetWindowLongPtrA, SetClassLongPtrA, FindWindowA, GetClassNameA, LoadBitmapA, LoadCursorA, LoadIconA, LoadImageA, SystemParametersInfoA, DispatchMessageW, PeekMessageW, SendMessageW, PostMessageW, DefWindowProcW, CallWindowProcW, RegisterClassW, UnregisterClassW, GetClassInfoW, CreateWindowExW, InsertMenuItemW, GetMenuItemInfoW, SetMenuItemInfoW, DrawTextW, DrawStateW, SetWindowTextW, GetWindowTextW, GetWindowTextLengthW, MessageBoxW, GetWindowLongPtrW, SetWindowLongPtrW, LoadStringW, DefFrameProcW, DefMDIChildProcW, GetKeyboardLayout, GetProcessWindowStation, TranslateMessage, PostQuitMessage, GetDoubleClickTime, IsWindow, IsMenu, DestroyWindow, ShowWindow, ShowWindowAsync, ShowOwnedPopups, MoveWindow, SetWindowPos, GetWindowPlacement, SetWindowPlacement, BeginDeferWindowPos, DeferWindowPos, EndDeferWindowPos, IsWindowVisible, IsIconic, BringWindowToTop, IsZoomed, OpenClipboard, CloseClipboard, SetClipboardData, GetClipboardData, CountClipboardFormats, EnumClipboardFormats, EmptyClipboard, IsClipboardFormatAvailable, SetFocus, GetActiveWindow, GetFocus, GetKeyState, GetKeyboardState, ToAscii, GetCapture, SetCapture, ReleaseCapture, MsgWaitForMultipleObjects, SetTimer, KillTimer, EnableWindow, IsWindowEnabled, GetSystemMetrics, GetMenu, SetMenu, DrawMenuBar, GetSystemMenu, CreateMenu, CreatePopupMenu, DestroyMenu, EnableMenuItem, GetSubMenu, GetMenuItemCount, RemoveMenu, DeleteMenu, GetMenuItemRect, UpdateWindow, SetActiveWindow, GetForegroundWindow, SetForegroundWindow, WindowFromDC, GetDC, GetDCEx, GetWindowDC, ReleaseDC, BeginPaint, EndPaint, GetUpdateRect, SetWindowRgn, InvalidateRect, InvalidateRgn, RedrawWindow, LockWindowUpdate, ScrollWindow, ScrollDC, ScrollWindowEx, ShowScrollBar, EnableScrollBar, GetClientRect, GetWindowRect, AdjustWindowRectEx, MessageBeep, SetCursorPos, SetCursor, GetCursorPos, CreateCaret, GetCaretBlinkTime, DestroyCaret, HideCaret, ShowCaret, SetCaretPos, GetCaretPos, ClientToScreen, ScreenToClient, MapWindowPoints, WindowFromPoint, GetSysColor, GetSysColorBrush, SetSysColors, DrawFocusRect, FillRect, FrameRect, SetRect, InflateRect, IntersectRect, UnionRect, SubtractRect, OffsetRect, IsRectEmpty, PtInRect, GetDesktopWindow, GetParent, SetParent, EnumChildWindows, EnumThreadWindows, GetTopWindow, GetWindowThreadProcessId, GetLastActivePopup, GetWindow, CallNextHookEx, DestroyCursor, DestroyIcon, CopyImage, CreateIconIndirect, GetIconInfo, SetScrollInfo, GetScrollInfo, TranslateMDISysAccel, DrawEdge, DrawFrameControl, TrackPopupMenuEx, ChildWindowFromPointEx, DrawIconEx, FlashWindowEx, GetComboBoxInfo, SetMenuInfo
ole32.dll	CoCreateGuid, CoRegisterClassObject, CoTaskMemFree, IsEqualGUID, OleInitialize, OleUninitialize, RegisterDragDrop, RevokeDragDrop, DoDragDrop, OleSetClipboard, OleGetClipboard, ReleaseStgMedium, CreateStreamOnHGlobal, CoInitializeEx, CoUninitialize, CoCreateInstance, CLSIDFromProgID, CoInitialize, CoRevokeClassObject, CoDisconnectObject, CoLockObjectExternal, CoTaskMemAlloc, CreateDataAdviseHolder, MkParseDisplayName, CreateBindCtx, SetErrorInfo, GetErrorInfo, CreateErrorInfo
dnsapi.dll	DnsQuery_W, DnsRecordListFree
iphlpapi.dll	GetIpNetTable2, FreeMibTable, GetAdaptersAddresses, IcmpCreateFile, Icmp6CreateFile, IcmpCloseHandle, IcmpSendEcho, Icmp6SendEcho2, Icmp6ParseReplies, GetIfEntry, GetAdaptersInfo, SendARP
netapi32.dll	NetShareEnum, NetServerGetInfo, NetWkstaUserEnum, NetWkstaGetInfo, NetRemoteTOD, NetServerDiskEnum, NetStatisticsGet, NetUserEnum, NetApiBufferFree, NetLocalGroupEnum, NetGroupEnum, NetLocalGroupGetMembers, NetGroupGetUsers, NetUserGetLocalGroups, NetUserGetGroups, NetGetDCName
wtsapi32.dll	WTSOpenServerW, WTSEnumerateSessionsW, WTSEnumerateSessionsExW, WTSSendMessageW, WTSFreeMemoryExW, WTSFreeMemory, WTSCloseServer
advapi32.dll	ConvertSidToStringSidW, RegCreateKeyExA, RegOpenKeyExA, RegQueryInfoKeyA, RegQueryValueExA, EnumServicesStatusA, OpenSCManagerA, OpenServiceA, QueryServiceConfigA, LookupAccountSidW, LookupAccountNameW, LookupPrivilegeValueW, GetUserNameW, RegSetValueExW, InitiateSystemShutdownW, RegQueryValueExW, RegConnectRegistryW, RegCreateKeyExW, RegDeleteKeyW, RegEnumKeyExW, RegEnumValueW, RegOpenKeyExW, CreateServiceW, OpenSCManagerW, StartServiceW, OpenProcessToken, AdjustTokenPrivileges, IsValidSid, EqualSid, AllocateAndInitializeSid, FreeSid, MapGenericMask, GetAclInformation, GetAce, IsValidSecurityDescriptor, RegCloseKey, RegFlushKey, CloseServiceHandle, QueryServiceStatus, GetNamedSecurityInfoW
Ws2_32.dll	GetNameInfoW
pdh.dll	PdhOpenQueryW, PdhAddCounterW, PdhCollectQueryData, PdhCloseQuery, PdhGetFormattedCounterValue, PdhBrowseCountersW, PdhExpandCounterPathW, PdhCloseLog, PdhBindInputDataSourceW
version.dll	GetFileVersionInfoSizeExW, GetFileVersionInfoExW, GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA, VerQueryValueW
shell32.dll	SHGetFolderLocation, DragQueryFileA, Shell_NotifyIconA, DragQueryFileW, ShellExecuteW, Shell_NotifyIconW, DragFinish, DragAcceptFiles, SHGetMalloc, SHGetDesktopFolder, SHGetPathFromIDListW, SHBrowseForFolderW, ILFree, ShellExecuteExW
gdi32.dll	CreateFontIndirectA, EnumFontFamiliesA, GetCharABCWidthsA, GetTextExtentPointA, GetTextMetricsA, GetObjectA, ExtTextOutA, CreateFontIndirectW, EnumFontFamiliesExW, GetCharABCWidthsW, GetTextExtentPointW, GetTextExtentPoint32W, GetTextExtentExPointW, GetObjectW, TextOutW, ExtTextOutW, GetRandomRgn, Arc, BitBlt, Chord, CombineRgn, CreateBitmap, CreateBrushIndirect, CreateCompatibleBitmap, CreateCompatibleDC, CreateDIBitmap, CreateEllipticRgn, CreatePen, CreatePenIndirect, CreatePatternBrush, CreateRectRgn, CreateRoundRectRgn, CreateSolidBrush, DeleteDC, DeleteObject, Ellipse, EqualRgn, ExcludeClipRect, ExtCreateRegion, ExtFloodFill, FillRgn, GetROP2, GetBkColor, GetBitmapBits, GetClipBox, GetClipRgn, GetCurrentObject, GetDeviceCaps, GetDIBits, GetMapMode, GetObjectType, GetPixel, GetRegionData, GetRgnBox, GetStockObject, GetTextAlign, GetTextColor, GetViewportExtEx, GetViewportOrgEx, GetWindowExtEx, GetWindowOrgEx, IntersectClipRect, LineTo, MaskBlt, OffsetRgn, PatBlt, Pie, PaintRgn, PtInRegion, RectInRegion, RectVisible, Rectangle, RestoreDC, RealizePalette, RoundRect, SaveDC, SelectClipRgn, ExtSelectClipRgn, SelectObject, SelectPalette, SetBkColor, SetBkMode, SetMapMode, SetPixel, SetPolyFillMode, StretchBlt, SetRectRgn, StretchDIBits, SetROP2, SetStretchBltMode, SetTextCharacterExtra, SetTextColor, SetTextAlign, CreateDIBSection, SetArcDirection, ExtCreatePen, MoveToEx, CreatePolygonRgn, DPtoLP, LPtoDP, Polygon, Polyline, PolyBezier, SetViewportExtEx, SetViewportOrgEx, SetWindowExtEx, SetWindowOrgEx, OffsetViewportOrgEx, SetBrushOrgEx, GetDCOrgEx, GdiFlush
mpr.dll	WNetCancelConnection2A, WNetAddConnection2W, WNetCancelConnection2W, WNetConnectionDialog1W, WNetDisconnectDialog
shlwapi.dll	AssocQueryStringW, StrCmpLogicalW, PathIsNetworkPathW, PathMatchSpecW
comctl32.dll	InitCommonControls, ImageList_Create, ImageList_Destroy, ImageList_GetImageCount, ImageList_SetImageCount, ImageList_Add, ImageList_Replace, ImageList_AddMasked, ImageList_DrawEx, ImageList_DrawIndirect, ImageList_Remove, ImageList_Copy, ImageList_BeginDrag, ImageList_EndDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_DragMove, ImageList_DragShowNolock, _TrackMouseEvent, SetWindowSubclass, RemoveWindowSubclass, DefSubclassProc
imm32.dll	ImmGetContext, ImmReleaseContext, ImmGetCompositionStringW, ImmNotifyIME
comdlg32.dll	ChooseColorA, CommDlgExtendedError, GetOpenFileNameW, GetSaveFileNameW, ChooseFontW
ws2_32.dll	accept, bind, closesocket, connect, ioctlsocket, getpeername, getsockopt, listen, recv, recvfrom, select, send, sendto, setsockopt, shutdown, socket, gethostbyaddr, gethostbyname, WSAStartup, WSACleanup, WSAGetLastError, __WSAFDIsSet, WSAIoctl, getaddrinfo, freeaddrinfo, getnameinfo, WSAPoll
wsock32.dll	__WSAFDIsSet, accept, bind, closesocket, connect, ioctlsocket, getsockopt, htons, inet_addr, listen, recv, select, send, setsockopt, shutdown, socket, gethostbyaddr, gethostbyname, gethostname, WSAStartup, WSACleanup, WSAGetLastError
winmm.dll	sndPlaySoundW, timeGetTime
aclui.dll	EditSecurity
urlmon.dll	URLOpenBlockingStreamA
KERNEL32.dll	AreFileApisANSI, CloseHandle, CreateFileA, CreateFileMappingA, CreateFileMappingW, CreateFileW, CreateMutexW, DeleteCriticalSection, DeleteFileA, DeleteFileW, EnterCriticalSection, FlushFileBuffers, FlushViewOfFile, FormatMessageA, FormatMessageW, FreeLibrary, GetCurrentProcessId, GetCurrentThreadId, GetDiskFreeSpaceA, GetDiskFreeSpaceW, GetFileAttributesA, GetFileAttributesExW, GetFileAttributesW, GetFileSize, GetFullPathNameA, GetFullPathNameW, GetLastError, GetProcAddress, GetProcessHeap, GetSystemInfo, GetSystemTime, GetSystemTimeAsFileTime, GetTempPathA, GetTempPathW, GetTickCount, GetVersionExA, GetVersionExW, HeapAlloc, HeapCompact, HeapCreate, HeapDestroy, HeapFree, HeapReAlloc, HeapSize, HeapValidate, InitializeCriticalSection, LeaveCriticalSection, LoadLibraryA, LoadLibraryW, LocalFree, LockFile, LockFileEx, MapViewOfFile, MultiByteToWideChar, OutputDebugStringA, OutputDebugStringW, QueryPerformanceCounter, ReadFile, SetEndOfFile, SetFilePointer, Sleep, SystemTimeToFileTime, TryEnterCriticalSection, UnlockFile, UnlockFileEx, UnmapViewOfFile, WaitForSingleObject, WaitForSingleObjectEx, WideCharToMultiByte, WriteFile
msvcrt.dll	_beginthreadex, _endthreadex, _localtime64, free, malloc, memcmp, memcpy, memmove, memset, realloc, strcmp, strcspn, strncmp, strrchr

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Australia
English	United States

• netscan.exe

Click to jump to process

Memory Usage

• netscan.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Target ID:	0
Start time:	13:23:11
Start date:	28/07/2023
Path:	C:\Users\user\Desktop\netscan.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\netscan.exe
Imagebase:	0x100000000
File size:	16'358'912 bytes
MD5 hash:	5DB121B74AEDE2736366690C74B4A197
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report netscan.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Cryptography

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: netscan.exePID: 5548, Parent PID: 3324

General

File Activities

File Opened

File Created

File Read

File Attributes Queried

Other File Operations

Volume Information Queried

Device IO

Section Activities

Sections loaded by Windows

Windows Analysis Report
netscan.exe