Static | ZeroBOX

PE Compile Time

2020-12-06 23:16:57

PE Imphash

2a908babc5cc3af850e078751d7de0e9

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x000854ec 0x00085600 6.72438124148
.rdata 0x00087000 0x0001a596 0x0001a600 5.59196479844
.data 0x000a2000 0x000042d4 0x00001a00 3.94590742753
.reloc 0x000a7000 0x0000680c 0x00006a00 6.62687320376

Imports

Library KERNEL32.dll:
0x487010 GetCurrentProcess
0x487014 WriteFile
0x48701c SetFilePointer
0x487024 UnmapViewOfFile
0x487028 GetModuleHandleA
0x48702c HeapSize
0x487030 MultiByteToWideChar
0x487038 CopyFileA
0x48703c GetLastError
0x487040 CreateFileA
0x487048 LoadLibraryA
0x48704c LockResource
0x487050 HeapReAlloc
0x487054 CloseHandle
0x487058 RaiseException
0x48705c FindResourceExW
0x487060 LoadResource
0x487064 FindResourceW
0x487068 HeapAlloc
0x48706c GetLocalTime
0x487070 DecodePointer
0x487074 HeapDestroy
0x487078 GetProcAddress
0x48707c CreateFileMappingA
0x487080 GetFileSize
0x487088 GetProcessHeap
0x487090 FreeLibrary
0x487094 HeapFree
0x487098 MapViewOfFile
0x48709c GetTickCount
0x4870a0 IsWow64Process
0x4870a4 AreFileApisANSI
0x4870a8 GetFullPathNameW
0x4870ac LockFile
0x4870b4 GetFullPathNameA
0x4870b8 SetEndOfFile
0x4870bc GetTempPathW
0x4870c0 CreateFileW
0x4870c4 GetFileAttributesW
0x4870c8 GetCurrentThreadId
0x4870cc Sleep
0x4870d0 GetTempPathA
0x4870d4 GetFileAttributesA
0x4870d8 GetVersionExA
0x4870dc DeleteFileA
0x4870e0 DeleteFileW
0x4870e4 LoadLibraryW
0x4870e8 UnlockFile
0x4870ec LockFileEx
0x4870f0 GetCurrentProcessId
0x4870f8 GetSystemTime
0x4870fc FormatMessageA
0x487104 FlushFileBuffers
0x487108 SetStdHandle
0x487118 GetOEMCP
0x48711c GetACP
0x487120 IsValidCodePage
0x487124 SizeofResource
0x487128 GetModuleFileNameA
0x48712c WideCharToMultiByte
0x487130 ReadFile
0x487134 ReadConsoleW
0x48713c GetFileType
0x487140 GetFileSizeEx
0x487144 GetConsoleMode
0x487148 GetConsoleCP
0x48714c EnumSystemLocalesW
0x487150 GetUserDefaultLCID
0x487154 IsValidLocale
0x487158 GetTimeFormatW
0x48715c GetDateFormatW
0x487160 WriteConsoleW
0x487164 GetCommandLineW
0x487168 GetCommandLineA
0x48716c GetStdHandle
0x487170 GetModuleFileNameW
0x487178 GetModuleHandleExW
0x48717c ExitProcess
0x487180 VirtualQuery
0x487184 VirtualProtect
0x487188 VirtualAlloc
0x48718c GetSystemInfo
0x487194 CreateDirectoryW
0x487198 FindClose
0x48719c FindFirstFileExW
0x4871a0 FindNextFileW
0x4871a8 RemoveDirectoryW
0x4871ac SetFilePointerEx
0x4871b0 SetLastError
0x4871b4 GetModuleHandleW
0x4871b8 CopyFileW
0x4871bc LocalFree
0x4871c0 GetStringTypeW
0x4871c4 EncodePointer
0x4871cc CreateEventW
0x4871d0 TlsAlloc
0x4871d4 TlsGetValue
0x4871d8 TlsSetValue
0x4871dc TlsFree
0x4871e0 CompareStringW
0x4871e4 LCMapStringW
0x4871e8 GetLocaleInfoW
0x4871ec GetCPInfo
0x4871f0 IsDebuggerPresent
0x4871f4 OutputDebugStringW
0x4871f8 SetEvent
0x4871fc ResetEvent
0x48720c GetStartupInfoW
0x487214 InitializeSListHead
0x487218 TerminateProcess
0x48721c RtlUnwind
0x487220 LoadLibraryExW
Library USER32.dll:
0x487234 GetDC
0x487238 GetSystemMetrics
0x48723c ReleaseDC
0x487240 GetDesktopWindow
Library GDI32.dll:
0x487000 DeleteObject
0x487004 GetObjectA
Library SHLWAPI.dll:
0x487228 PathFindExtensionW
0x48722c PathFindExtensionA
Library gdiplus.dll:
0x487268 GdipSaveImageToFile
0x487274 GdipDisposeImage
0x48727c GdiplusShutdown
0x487284 GdiplusStartup
Library WININET.dll:
0x487248 InternetWriteFile
0x48724c HttpEndRequestA
0x487250 HttpSendRequestExA
0x487254 InternetOpenA
0x487258 HttpOpenRequestA
0x48725c InternetConnectA
0x487260 InternetCloseHandle

!This program cannot be run in DOS mode.
`.rdata
@.data
.reloc
~,9~$t
j/Yj\Z
j/Yj\Z
t5SWj\_j/[
j.Zf9Q,u
j\Yj/Z
j\Yj/[
^8;NHt
F@;FDtV
~6htZJ
~>h<NJ
~:h\\J
uh9~ uc9~
7SWWh
Ft9Fpt
D$,f9D$N
D$HSPV
Yj8Yjx
Yu$VWj
~:h@XJ
~;h`SJ
Yu#VWj
~=hL\J
~:h0]J
~=h(TJ
~:h8RJ
~@hX`J
~@h8]J
~@h`\J
~>hHRJ
~9h8VJ
zKBKWF
~9h,RJ
~9h0RJ
Yu%VWj
~9hX^J
~:ht^J
~9h4RJ
~9hT\J
Yu$VWj
~Dh|[J
~=hLKJ
~<h VJ
~;h<OJ
~>h,TJ
~9h$SJ
~:h<]J
~9h`ZJ
QSSSSS
Yu$VWj
~9h|_J
~9hx[J
~:hTSJ
~6htQJ
~>hdPJ
~=h,VJ
~?h SJ
~=h0\J
~;hP\J
~?h<\J
~?h\XJ
~@hx^J
~9h0OJ
~:hH^J
~8hdXJ
~:hHNJ
Yu%VWj
~<hH]J
0Qh<yI
~;h0WJ
~9h bJ
~<hHOJ
~:h TJ
~>h$XJ
~9h\aJ
Yu%VWj
Yu%VWj
Yu#VWj
~>hpUJ
~<hDUJ
~9hHUJ
~=h4OJ
~<hl^J
Yu&VWj
~=h(UJ
~=h [J
~;h4\J
Yu#VWj
CE RWj
SSjPQP
Yu%VWj
Yu%VWj
tNSWjP
tdSWjh
tI97t+
L$LSRQVPO
>F;D$Pu
LSVWjH3
jeX_^[
jeX_^[
u>9~Hu9S
Kf9W"~
u8;~$r
SVWjdj
u:9~|t5
ND;NL|A9~|t<
9GTt";_(
tP;s(wK3
!W\_^[
NPY9^P
t;9s`u<
FP9HLt$
@L;BLt*
j@YjB_jP
W9^0t1
t$(9t$
RS9^tt
A9^tt<8
#Ft_^[
L$(;D$
t$(9D$$}
uG9_p}B3
Y9~@u,S
G4;F4t
t$kL;
NL9D$Tv(
\$,jH_
D$0}/k\;
Ah;FTu
Ah;FTu
L$4PR3
L$p9L$Tvq
L$p;L$Tr
D$|kD;
D$H+L$`
D$H;D$xwg
D$4jHY
D$4;D$xv
|$Xk\;
t$0PP3
\$D8Q
L$89T;
D$D;D$8s
L$H8AIu
D$`9L$T~H
D$8jHY
Fd;~h|"
OH9W<u!
Y9W@t#
L$p9A4
L$8kL;
|$8jHZ
 !"#$
%&'()*
+,-./012"3445
678888889::::;;;;;<=>?@ABCDEF
GHIJKLM)NOPQRScTUc
[\c]cccccccccccc^_`abU
G@YY@3
PPPj\Z
8?u>@P
tdjDWV
wHRRVj
nRPRjpZj.X
T$4SjHV
VVSjFW
t$@Vj=Z
RRRjeZ
PPPjZZ
PPPjZZ
<}tF<|tB
F$;G$u9
F(;G(u1
@$;F$u
@(;F(t4
PVVVVV
PPPj%Z
~dj0ZRY
t!9{D~
GY;{D|
PPPjuZ
@PVjjZ
@YPj.Z
SSSjZ
QQQjZ
t88^9t<9^@u.9^<u
f!HZ_^[
WPSjiZ
u08G4u
QQQjuZ
WWVjZ
WWPjZ
9N@u}8O
uxQQh,
t?9~@u:
u4WWh4
t@9~@u;
u5WWh<
RRRjZZ
f!GZ_^[
@PVjTZ
PPPPjkZ
PPWjwZ
PPPjZZ
qDVjnZ
,9w,tD
WPSjNZ
s 9{$~1
9_ t<9_(u3
L$ joZ
t$$joZ
t$xjoZ
D$,@PSj.Z
t$,Sj.Z
L$(SAQj
t$0jzZ
t$\Sj-Z
9\$x~5
t$<jTZ
t$pjgZ
t$0PjzZ
t$\Sj-Z
t$pjfZ
D$(9D$
PPPjZ
u-9H$u(
uGWj?WWj
VVPjsZ
t$Pf9D$p
#D$ #T$`
L$H9L$<
D$L!T$`
T$H9D$X
t$4jmZ
t$0jaZ
CHRPRj.Z
t$PRjcZ
L$<@PVWj$X
t$$j,Z
t$DQVPjkZ
t$$jtX
t$$jsZj2X
jfXj/Z
PVRj&Z
t$dVjAZ
L$@j:X
RPRjpZ
t$@j^X
t$dVjAZ
t$@j2X
9D$,t0
t$@jsZ
t$$jtX
jfXj/Y
RPRjpZ
t$@j'Z
t$@j:X
t$@j4Z
t$$jtX
PPPjkZ
PPPjkZ
PPPPPPP
PPPjnZ
PPPPPPP
QQQj>Z
PPPj0Z
!"#$%
)0)0))123
)"IJKL
)MNOLLL)2PQ
:RS)TUVVWXUUYZ[\]^_````````abab)
cdefghhij
lmnopqrs)
xyyLLLLL
Lz{|}{~~
9_\t h
Q8CYY;_T|
t#PPPh
Wu!WWW
tG9uCj
tC97u?j
tG9uCj
tG9uCj
tZ9uVj
WPh@vH
YYhPuH
tC97u?j4
tC97u?j4
t{9uwj
t{9uwj
tO9uKjD
tG9uCj
tG9uCj
tG9uCj
tG9uCj
tG9uCj
tG9uCj
tc9u_jX
td9u`jX
tc9u_jX
td9u`jX
tG9uCj
tG9uCj
tG9uCj
tG9uCj
tZ9uVj
tZ9uVj
tI97uEjD
tI97uEjD
tS9uOj
tS9uOj
PVh@uH
PVhHuH
PWh@uH
PWhHuH
M$+E4@Pj
M$+E4@Pj
<:t2<,t.</u2
<:t2<,t.</u2
<:t2<,t.</u2
<:t2<,t.</u2
WPh@vH
WPh@vH
t{9uwj
tG9uCj
tG9uCj
tG9uCj
tc9u_jX
td9u`jX
tI97uEjD
tS9uOj
M$+E4@Pj
<xt><Xu=
<xt <Xt
<xt"<Xu!
QQSVWd
URPQQh
;t$,v-
UQPXY]Y[
YYh4sH
F4_^[]
<ItC<Lt3<Tt#<h
A<lt'<tt
ARPRQh
PPPPPPPP
zSSSSj
35|BJ
SWt@jU
_tqPVj@
<at.<rt!<wt
<=upG8
PPPPPWS
PP9E u:PPVWP
Wj0XPV
SPjdVQ
f95DGJ
u kE$<
D8(Ht'
t4h_xG
f9:t!V
QQSVj8j@
tl=` J
NX9^`t1
;V\uYW
u2Vj@h
9C`u99C\t4
u29K\t-
PPPPPPPP
VC20XC00U
CreateSymbolicLinkW
GetFileInformationByHandleEx
SetFileInformationByHandle
bad allocation
0123456789-+Ee
0123456789ABCDEFabcdef-+Xx
0123456789ABCDEFabcdef-+XxPp
address family not supported
address in use
address not available
already connected
argument list too long
argument out of domain
bad address
bad file descriptor
bad message
broken pipe
connection aborted
connection already in progress
connection refused
connection reset
cross device link
destination address required
device or resource busy
directory not empty
executable format error
file exists
file too large
filename too long
function not supported
host unreachable
identifier removed
illegal byte sequence
inappropriate io control operation
interrupted
invalid argument
invalid seek
io error
is a directory
message size
network down
network reset
network unreachable
no buffer space
no child process
no link
no lock available
no message available
no message
no protocol option
no space on device
no stream resources
no such device or address
no such device
no such file or directory
no such process
not a directory
not a socket
not a stream
not connected
not enough memory
not supported
operation canceled
operation in progress
operation not permitted
operation not supported
operation would block
owner dead
permission denied
protocol error
protocol not supported
read only file system
resource deadlock would occur
resource unavailable try again
result out of range
state not recoverable
stream timeout
text file busy
timed out
too many files open in system
too many files open
too many links
too many symbolic link levels
value too large
wrong protocol type
unknown error
:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December
%b %d %H : %M : %S %Y
%m / %d / %y
:AM:am:PM:pm
%I : %M : %S %p
%H : %M
%H : %M : %S
%d / %m / %y
0123456789-
0123456789-
0123456789-
0123456789-+Ee
0123456789ABCDEFabcdef-+Xx
0123456789-
0123456789-+Ee
0123456789ABCDEFabcdef-+Xx
0123456789ABCDEFabcdef-+XxPp
0123456789ABCDEFabcdef-+XxPp
+v$x+v$xv$+xv+$xv$+x+$vx+$vx$v+x+$vx$+vx+v $+v $v $+v +$v $++$ v+$ v$ v++$ v$+ v+xv$+ v$v$ +v+ $v$ ++x$v+ $v$v ++ $v$ +v
raB3G$
0123456789-
0123456789-
0123456789abcdefghijklmnopqrstuvwxyz
0123456789abcdefghijklmnopqrstuvwxyz
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
InitOnceExecuteOnce
CreateEventExW
CreateSemaphoreW
CreateSemaphoreExW
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
FlushProcessWriteBuffers
FreeLibraryWhenCallbackReturns
GetCurrentProcessorNumber
GetCurrentPackageId
GetTickCount64
GetSystemTimePreciseAsFileTime
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
InitializeSRWLock
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
SleepConditionVariableSRW
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CompareStringEx
GetLocaleInfoEx
LCMapStringEx
bad exception
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__swift_1
__swift_2
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
operator co_await
operator<=>
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
`anonymous namespace'
CorExitProcess
`h````
xpxxxx
`h`hhh
xwpwpp
[aOni*{
~ $s%r
@b;zO]
v2!L.2
IND)ind)
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
AreFileApisANSI
EnumSystemLocalesEx
GetDateFormatEx
GetTimeFormatEx
GetUserDefaultLocaleName
IsValidLocaleName
LCIDToLocaleName
LocaleNameToLCID
AppPolicyGetProcessTerminationMethod
SetThreadStackGuarantee
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
UTF-16LEUNICODE
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
NAN(SNAN)
nan(snan)
NAN(IND)
nan(ind)
_hypot
_nextafter
1#QNAN
1#SNAN
]vQ<)8
|)P!?Ua0
Eb2]A=
u?^p?o4
y1~?|"
?x+s7
?5Od%
?|I7Z#
>,'1D=
?g)([|X>=
~U`?K
:h"?bC
@H#?43
Ax#?uN}*
r7Yr7=
F0$?3=1
H`$?h|
&?~YK|
sU0&?W
<8bunz8
?#%X.y
F||<##
<@En[vP
?5Wg4p
%S#[k=
"B <1=
Unknown exception
bad array new length
string too long
generic
system
bad cast
bad locale name
map/set too long
directory_entry::file_size
directory_entry::status
directory_iterator::directory_iterator
directory_iterator::operator++
recursive_directory_iterator::recursive_directory_iterator
recursive_directory_iterator::operator++
copy_file
exists
remove
status
create_directory
remove_all
current_path()
Delete
Qkkbal
pCh1(G
thstndrd
"I$_,Zm
o>i%qY*u
z.-fAt2YY
3js56(k
CREATE TEMP TABLE sqlite_temp_master(
type text,
name text,
tbl_name text,
rootpage integer,
sql text
onoffalseyestruefull
0123456789ABCDEF0123456789abcdef
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
JKLMNOPQRSTNO*+IJKLMNOPQRST
:<=>?@ABCDEFGH
JKLMNOPQRST
JKLMNOPQRST
.NOPQRSTXY|}~
<=>?@ABCDEFGH
JKLMNOPQRST*+,PQRST
<=>?@ABCDEFGH
JKLMNOPQRST
*+NOXY
{X4b6\
<=>?@ABCDEFGH
JKLMNOPQRST*+N
<=>?@ABCDEFGH
JKLMNOPQRST*+
<=>?@ABCDEFGH
JKLMNOPQRST
Z[\]^_`
g<=>?@ABCDEFGH
JKLMNOPQRST
[\]^_`Z
<=>?@ABCDEFGH
JKLMNOPQRST
1<=>?@ABCDEFGH
JKLMNOPQRST
<=>?@ABCDEFGH
JKLMNOPQRST
XYj\lm
<=>?@ABCDEFGH
JKLMNOPQRST*+P
<=>?@ABCDEFGHrJKLMNOPQRST*+
<=>?@ABCDEFGH
JKLMNOPQRST*+
=>?@ABCDEFGH
JKLMNOPQRST*+
>?@ABCDEFGH
JKLMNOPQRST
ppp\pk
SQLite format 3
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
CREATE TABLE sqlite_master(
type text,
name text,
tbl_name text,
rootpage integer,
sql text
,,,,,,,,,,
BEFOREIGNOREGEXPLAINSTEADDESCAPEACHECKEYCONSTRAINTERSECTABLEFTHENDATABASELECTRANSACTIONATURALTERAISELSEXCEPTRIGGEREFERENCESUNIQUERYATTACHAVINGROUPDATEMPORARYBEGINNEREINDEXCLUSIVEXISTSBETWEENOTNULLIKECASCADEFERRABLECASECOLLATECREATECURRENT_DATEDELETEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFINTOFFSETISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
basilev12.beget.tech
\Desktop
user.config
</value>
<value>
\tdata\
)\tdata\
APPDATA
\history
.history
\history\
Install Directory
is_secure
Mozilla
NULL,secure
secure
[+] data unpacked
] - [user:
[-] data unpacked failed
.sqlite
(size:
PlayerName
invalid string position
vector too long
unknown error
(NULL)
922337203685477580
Column
SetCookie
Sequence
MoveGt
RowKey
OpenWrite
VRowid
CollSeq
OpenRead
Expire
AutoCommit
IntegrityCk
Function
Return
NewRowid
Variable
String
RealAffinity
VRename
ParseSchema
CreateIndex
IsUnique
NotFound
MustBeInt
AddImm
Statement
RowData
MemMax
NotExists
Integer
VColumn
CreateTable
IncrVacuum
IdxRowid
ResetCount
FifoWrite
ContextPush
DropTrigger
DropIndex
IdxDelete
Vacuum
MoveLe
IsNull
NotNull
DropTable
BitAnd
ShiftLeft
ShiftRight
Subtract
Multiply
Divide
Remainder
Concat
MakeRecord
ResultRow
BitNot
String8
AggFinal
TableLock
FifoRead
MoveLt
VerifyCookie
AggStep
SetNumColumns
Transaction
VFilter
VDestroy
ContextPop
IdxInsert
Insert
Destroy
ReadCookie
ForceInt
LoadAnalysis
Explain
OpenPseudo
OpenEphemeral
Rewind
MoveGe
VBegin
VUpdate
IfZero
VCreate
NullRow
NotUsed_124
NotUsed_126
NotUsed_127
NotUsed_128
NotUsed_129
NotUsed_130
NotUsed_131
NotUsed_132
NotUsed_133
NotUsed_134
NotUsed_135
NotUsed_136
NotUsed_137
ToText
ToBlob
ToNumeric
ToReal
%s\etilqs_
:memory:
-journal
-stmtjrnl
Page %d:
On tree page %d cell %d:
Unable to acquire a read lock on the database
Main freelist:
List of tree roots:
%!.15g
keyinfo(%d
collseq(%.20s)
%s(%d)
vtab:%p:%p
%s-mj%08X
database schema has changed
sqlite_temp_master
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s
_ROWID_
%.*s%Q%s
sqlite_rename_table
sqlite_rename_trigger
name=%Q
%s OR name=%Q
tbl_name=%Q
sqlite_
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
sqlite_sequence
UPDATE %Q.sqlite_sequence set name = %Q WHERE name = %Q
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
UPDATE %Q.%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
sqlite_stat1
CREATE TABLE %Q.sqlite_stat1(tbl,idx,stat)
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
SELECT idx, stat FROM %Q.sqlite_stat1
sqlite_detach
sqlite_attach
INTEGER
CREATE TEMP TABLE
CREATE TABLE
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
CREATE TABLE %Q.sqlite_sequence(name,seq)
tbl_name='%q'
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
DELETE FROM %s.sqlite_sequence WHERE name=%Q
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
indexed columns are not unique
sqlite_autoindex_
UNIQUE
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
name='%q'
DELETE FROM %Q.%s WHERE name=%Q
COMMIT
ROLLBACK
automatic extension loading failed: %s
full_column_names
short_column_names
count_changes
empty_result_callbacks
legacy_file_format
fullfsync
ignore_check_constraints
writable_schema
omit_readlock
read_uncommitted
BINARY
SELECT name, rootpage, sql FROM '%q'.%s
database schema is locked: %s
detail
opcode
comment
column%d
sqlite_subquery_%p_
trigger
TABLE %s
%z AS %s
%z WITH INDEX %s
%z USING PRIMARY KEY
%z VIRTUAL TABLE INDEX %d:%s
%z ORDER BY
interrupt
(null)
NOCASE
PRAGMA encoding = 'UTF-16'
}kbkmz
FA]ZqEKW
K@MAJG@I
A]AHZs
uO[ZHs
uM\J]s
o@J\KO]
m\KOZKzAABFKB^
^BGMOZGA@
TG^#$#hGBKtg~lA[@JO\W#[@^OMEKJ
HOGBKJ$................xO[BZmBA]KxO[BZ.G@HA\COZGA@
ZVZ.}ZKOC
ZVZ.~e}j|qjKM\W^Z.ac
M\KJGZqMO\J].ZA\OIKrBKXKBJLr.yOBBKZ]ro\CA\Wr.
KV^G\K]q[ZM
@zKBKI\OCr]K]]GA@yOBBKZ]rbGZKMAG@yOBBKZ]rlWZKMAG@rhGBKtGBBOr\KMK@@OCK
HGBKzA{^BAr]ZKOCO^^]rMACCACA@ZF
KV^G\OZGAr}ahzyo|krbGZKMA
K@M\W^ZKJ~O]]YArkZFK\K[CrEKW]ZA}ahzyo|krcGM\A]A
O[ZAHGBBl\AY]K\ro[ZAhGBB[@GZW
^\AHGB~eqiKZg@ZK\@OB}kbkmz
XOBFZZ^
]ZKOCMACCrhGBKtGBBOr]GZKC@qWKO\
MO\Jq@[CyOBBKZ]rkZFK\K[CyOBBKZ]rkBKMZ\[Cr}ahzyo|krlGZMAGO]]YA\J
]K\GOBG]K\@OCK
]K\GOBGlm\W^Za^K@oBIA\G
|}z{xyvwtOLMJKHro^^jOZOr|AOCG@IO
LA[@JO\W
}K@Jl\AY]K\r~O]]YA\Jm\KOZKmAC^OZGLBKOB[K
MAAEGK
CATqMAAEGKG\W
XOB[KyOBBKZ]rjO]FmA\KR
uL\AY]K\
hG\K}kbkmz
@OCKqA@qM
K@M\W^ZKJ{]K\@O}ahzyo|krcATGBBOm\W^Z{@^\AZKMZjOxO[BZk@[CK\OZKxOOJ
HGBK@OCK
TrcATGBBO
hG\KHAVrcATGBBOrhG\KHAVl\AY]K\rmO\J]
ZVlm\W^ZiK@K\OZK}WAMOB
}ZA\OIKrBKXIFGDEBC@A^_\]Z[XOCK
K@M\W^ZKJqXr
^[\^BKrOMMA[@ZmA@ZK@Z
jG]^A]GZrkBKMZ\[CrYOBBKZ}KZm[\\K@ZjG\KMZBZG^O\Z
JOZ~eqo[ZFK@ZGMOZ}kbkmz
^OZlm\W^Z}KZ~\A^K\ZxO[BZk@[CK\OZKgZrOZACGMrbAMOB
A\GIG@q[\B
}K@JhGBKtg~lA[mA@ZK@Z
C[HZryG@JAY]
`zrm[R
uL\AY]K\
cGM\}kbkmz
OMZGA@q[\l\AY]K\rmAAAEGK]r~GJIG@roMMA[@Z]
[K\Wh[BB~\AMK]]]K\@OCKqXOB[K
^mA@ZK@Z
G]}KM[\K
KV^yOBBKZ]roZACGMrbro[ZFW
jK]EZA^rbs
mabbkmza|
~|ad#$#$
}K@JhGBKtg~|amk}}a|qgjk`zgr}ahzyo|krjO]Frjj
myOBBKZ]rlGZMAG@mO\J
KV^G\OZGA@q~|amk}}a|qo|mfgz
]KZZG@I
{LK\qK@M\W^ZKJ
h|O]]YA\JqXOB[K
h|rJG]MA\JrbAMOB
}rjAM[CK@Z]rizo
}}AHZYO\KrxOBXKr}
]KZZG@I
~olmjkhifgdebc`a~
.text$di
.text$mn
.text$x
.text$yd
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCC
.CRT$XCL
.CRT$XCU
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIC
.CRT$XIZ
.CRT$XLA
.CRT$XLZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$T
.rdata$r
.rdata$sxdata
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.tls$ZZZ
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.data$r
.data$rs
ReadFile
GetModuleFileNameA
SizeofResource
HeapFree
EnterCriticalSection
GetCurrentProcess
WriteFile
LeaveCriticalSection
SetFilePointer
InitializeCriticalSectionEx
UnmapViewOfFile
GetModuleHandleA
HeapSize
MultiByteToWideChar
GetFileInformationByHandle
CopyFileA
GetLastError
CreateFileA
FileTimeToSystemTime
LoadLibraryA
LockResource
HeapReAlloc
CloseHandle
RaiseException
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
GetLocalTime
DecodePointer
HeapDestroy
GetProcAddress
CreateFileMappingA
GetFileSize
DeleteCriticalSection
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
MapViewOfFile
GetTickCount
IsWow64Process
AreFileApisANSI
GetFullPathNameW
LockFile
InitializeCriticalSection
GetFullPathNameA
SetEndOfFile
GetTempPathW
CreateFileW
GetFileAttributesW
GetCurrentThreadId
GetTempPathA
GetFileAttributesA
GetVersionExA
DeleteFileA
DeleteFileW
LoadLibraryW
UnlockFile
LockFileEx
GetCurrentProcessId
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
QueryPerformanceCounter
FlushFileBuffers
KERNEL32.dll
ReleaseDC
GetDesktopWindow
GetSystemMetrics
USER32.dll
GetObjectA
DeleteObject
GDI32.dll
PathFindExtensionW
PathFindExtensionA
SHLWAPI.dll
GdipSaveImageToFile
GdipCreateBitmapFromScan0
GdipGetImageEncodersSize
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipGetImageEncoders
GdiplusShutdown
GdiplusStartup
gdiplus.dll
HttpOpenRequestA
InternetWriteFile
HttpEndRequestA
HttpSendRequestExA
InternetOpenA
InternetCloseHandle
InternetConnectA
WININET.dll
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
RemoveDirectoryW
SetFilePointerEx
SetLastError
GetModuleHandleW
CopyFileW
LocalFree
GetStringTypeW
EncodePointer
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
InitializeSListHead
TerminateProcess
RtlUnwind
LoadLibraryExW
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
ExitProcess
GetModuleHandleExW
QueryPerformanceFrequency
GetModuleFileNameW
GetStdHandle
GetCommandLineA
GetCommandLineW
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleCP
GetConsoleMode
GetFileSizeEx
GetFileType
GetTimeZoneInformation
ReadConsoleW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
WriteConsoleW
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
.?AVcodecvt_base@std@@
.?AV?$ctype@D@std@@
.?AV?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
.?AV?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
.?AV?$numpunct@D@std@@
.?AV?$codecvt@DDU_Mbstatet@@@std@@
.?AV_Locimp@locale@std@@
.?AV?$codecvt@_WDU_Mbstatet@@@std@@
.?AV?$codecvt@GDU_Mbstatet@@@std@@
.?AV?$ctype@G@std@@
.?AUmessages_base@std@@
.?AUmoney_base@std@@
.?AUtime_base@std@@
.?AV?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
.?AV?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
.?AV?$numpunct@_W@std@@
.?AV?$collate@_W@std@@
.?AV?$messages@_W@std@@
.?AV?$money_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
.?AV?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
.?AV?$moneypunct@_W$0A@@std@@
.?AV?$_Mpunct@_W@std@@
.?AV?$moneypunct@_W$00@std@@
.?AV?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
.?AV?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
.?AV?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@
.?AV?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@
.?AV?$numpunct@G@std@@
.?AV?$collate@G@std@@
.?AV?$messages@G@std@@
.?AV?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@
.?AV?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@
.?AV?$moneypunct@G$0A@@std@@
.?AV?$_Mpunct@G@std@@
.?AV?$moneypunct@G$00@std@@
.?AV?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@
.?AV?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@
.?AV?$collate@D@std@@
.?AV?$messages@D@std@@
.?AV?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
.?AV?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
.?AV?$moneypunct@D$0A@@std@@
.?AV?$_Mpunct@D@std@@
.?AV?$moneypunct@D$00@std@@
.?AV?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
.?AV?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
.?AVtype_info@@
.?AVbad_exception@std@@
.?AVexception@std@@
.?AVbad_array_new_length@std@@
.?AVruntime_error@std@@
.?AVbad_alloc@std@@
.?AVsystem_error@std@@
.?AVCAtlException@ATL@@
.?AVbad_cast@std@@
.?AVfilesystem_error@filesystem@std@@
.?AV_System_error@std@@
.?AUIAtlMemMgr@ATL@@
.?AV?$_Ref_count_obj2@U_Dir_enum_impl@filesystem@std@@@std@@
.?AVCImage@ATL@@
.?AVerror_category@std@@
.?AV_System_error_category@std@@
.?AV_Facet_base@std@@
.?AV_Generic_error_category@std@@
.?AU_Crt_new_delete@std@@
.?AUIAtlStringMgr@ATL@@
.?AUctype_base@std@@
.?AVCAtlStringMgr@ATL@@
.?AVfacet@locale@std@@
.?AV?$_Ref_count_obj2@U_Recursive_dir_enum_impl@filesystem@std@@@std@@
.?AV_Ref_count_base@std@@
.?AV?$ctype@_W@std@@
.?AVCWin32Heap@ATL@@
0(040@0L0Q0[0g0s0
1'111A1
2C2\2b2v2
3.4K4g4
5,5I5j5
536X6c6
2&3_3y3
384p4{4
4!5@5K5T5\5k5w5
6#6*646@6F6a6
7'73797>7b7i7p7
8&8.8>8M8W8c8i8n8
9%9,919W9b9k9s9
:-:9:M:s:
;!;5;[;g;l;
<7<L<X<]<}<
=%=O=]=i=t=|=
>%>*>P>\>p>
?*?6?A?I?b?
0 040o0
1%1O1a1m1x1
23)3M3X3f3
4+4`4m4y4
5"606<6I6N6S6X6^6h6|6
7&7:7B7
9\9g9l9
;-;:;Y;i;v;
> >N>t>
8s8;9z:
3&393L3_3u3
344E4V4g4x4
8&9`9s9
0!0)0H3
0?0E0K0U0_0
2%2,272B2T2`2q2x2
3(3<3K3P3l3x3
3"4'4P4
5\6i6u6
828=8F8N8^8m8x8
9@9M9Y9h9m9s9
11,181D1O1a1n1
2'282?2T2
343H3T3`3e3k3
444O4i4t4
5)555@5Y5t5
66*666;6A6N6Z6e6~6
7-787D7I7d7|7
9X:r:}:
;P<q<|<
1%1.161F1U1`1m1{1
2J2O2x2V3c3n3w3
515W5c5j5o5
66*626M6T6f6k6
7>7J7V7a7t7
9(979B9O9e9
:&:5:::@:S:^:k:
<*<6<E<J<P<c<n<{<
=>:>F>U>Z>`>s>~>
?%?2?C?
0*0E0Q0`0e0k0~0
1$161A1N1_1
2;2*3;3F3O3W3h3z3
5K5P5y5
6"646;6G6S6_6f6q6~6
:?:J:S:[:k:|:
="=.=9=F=
>#>.>:>F>Q>^>o>
2#202A2
5;5@5Q5]5i5t5
<?<P<W<M=a=f=~=
?0?;?D?L?]?l?w?
1G1S1_1j1}1
203@3K3T3\3l3{3
4$474B4Q4y4~4
717B7I7`8
8I9Y9d9m9u9
:*:::?:a:m:y:
<(<<<C<
>)>O>T>n>z>
3<3A3[3g3v3
8,8;8F8Z8j8o8
:*:5:H:S:b:g:r:
;H;M;v;
<"<(<;<F<R<s<
0>0C0l0
3#3/343E3
3*4>4R4W4m4y4
7.797B7M7^7m7x7
798h8s8|8
9&9/9:9J9Y9d9p9
>6>A>P>U>[>g>u>
A0T0`0i0q0
0S2i2t2}2
3;4U4`4l4u4{4
9)949@9[9f9u9z9
<)<5<@<S<]<i<n<1=O=w=
>%>6>E>P>]>
?6?[?f?o?w?
0-080A0I0Y0h0s0
1I1g1r1{1
2?2J2S2[2l2{2
3&333`3~3
6)6.646G6P6\6a6r6
9#959;9A9q9
:):G:m:x:
<-<4<L<
=*=2===I=h=s=|=
>%>1><>H>N>W>\>a>x>
?&?2?9?M?a?
1(141?1K1W1b1s1
2*252D2a2
2"3.3:3E3X3c3o3t3
6 6)646C6R6]6
7?7K7T7_7y7
8"8.838A8Y8~8
909[9z9
9$:):G:S:_:j:}:
;$;-;5;E;T;_;l;};
< <+<8<k<
=>7>C>N>V>q>|>
?*?6?A?T?^?j?v?~?
0'030<0D0^0i0u0
3%3-3=3Q3\3
4'4C4T4`4g4o4~4
5(555=5X5e5q5{5
6&6-686E6M6i6
7"7*7:7G7N7Y7f7n7
8)858B8G8M8Y8e8p8}8
949K9W9^9f9w9
: :-:I:`:l:s:{:
;;,;3;>;K;S;o;
<(</<7<H<U<\<g<t<|<
=+=<=H=O=W=f=s=z=
>0>K>X>e>j>p>
?%???a?m?t?|?
0)040d0
1'121E1P1\1
2 2)212A2P2[2g2
3'363;3A3T3_3k3
5!5M5z5
2%2e2y2
3/3K3W3k3
324J4V4a4i4
5!5(5-5?5[5g5{5
91:d:#<
>!>->8>E>p>
4+464K4V4q4
5(515<5K5`5k5x5
5-6N6Y6b6j6z6
71767K7_7k7z7
88R8]8l8w8
8)9Q9\9e9m9~9
:':3:>:
;+;6;?;G;W;c;n;};
;$<?<v<
>G>d>p>
?,?8?D?O?b?m?
0T0a0l0{0
4G4L4u4=5M5X5a5i5y5
6 626d6o6x6
7*757H7S7b7
9Z:j:u:~:
; ;/;:;^;};
< <,<7<F<X<o<
?%?,?>?O?a?m?~?
0=0P0U0`0r0~0
1/161K1R1
73738d8}8
9 9/949:9F9T9^9
=+>0>?>g>r>{>
2L3d3p3{3
4D4\4h4s4{4
5 5N5b5m5v5~5
6$6.6;6@6J6O6T6p6{6
77*747>7J7P7W7j7s7x7}7
8!818<8C8K8W8]8e8k8s8|8
9-949u9
:3:I:U:
>$>c>p>
?"?.???F?^?e?
1"2-262>2N2`2k2w2
3K3m3x3
4$4>4f4q4z4
545?5H5P5_5n5y5
6'6A6M6Y6b6h6{6
677K7_7d7
999C9q9x9
:):1:L:S:
<=<b<i<w<~<
?!?%?)?-?1?5?9?=?A?E?I?N?
2(242H2n2z2
4434K4c4
595D5M5U5e5w5
6-626Q6]6i6t6
7#7/7:7M7X7d7v7
848;8M8_8w8
9969=9b9
9+:1:V:n:
=+=9=E=P=X=p=
>'>2>:>U>w>
3G4&9,92999
=N=f>H?
2M2]2d2
565<5D5K5Q5W5^5
626=6C6I6S6
8M8Z8h8n8{8
;0I0d0
0o203:3?3
6"8_8t8x8|8
;%;0;=;E;K;T;Z;`;l;s;};
333>3`3f3
5666s6
=:>E>a?
080Z0p0
031<1u1
45R5}5o6w6
7#7*7C7J7Q7
7%8@8[8
9=9S9}9
:*:8:Z:{:
;3;>;R;a;i;o<
I2a2s2
3*5p5#6
3s4;6?6C6G6K6O6S6W6[6_6c6g6
=U>]>e>
4'7@7V7
6"6&6*6.62666:6>6B6F6J6N6R6V6Z6^6b6f6j6n6r6v6z6~6
7"7&7*7.72767:7>7B7F7J7N7R7V7Z7^7b7f7j7n7r7v7z7~7
9';[<y<I="?
1"2-292J2b2
9|:X=v=
5&6+6u6z6
7*8/848<8
9?9P9`9
:9;<<{<
3p3Q4m4
959N9a9
6=7B7I9
1w1=3U3
2(252]2
8j:K;n;
<-=1=5=9===A=E=I=
>2>=>h>
? ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
0 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
1 1$1(1,1014181<1@1D1H1L1P1
:+;,<8=
8!8)8A8I8a8j8
8j9{9N:
=!=1=E=^=y=
=E>q>}>
1E1R1l1y1
5$575I5Z5`5e5j5~5
5$686f6u6
7>8f8y8
9.949I9h9
:6:V:B;X<
?%?B?W?\?
E0O0l0
+000;0
;G;B<!>
30Z0n0
1&1I1l1
40$1;1
7 707O7
869>9D9S9p9
<H=m={=b?
=&>0>M>b>g>
>P?Z?w?
0!0&0z0
161K1P1
192C2`2u2z2
444494
4"5,5I5^5c5
5L6V6s6
828G8L8
859?9\9q9v9
=(=E=[=x=
1!101,2
46a6k6U7k9
>2?A?d?
;0J0m0
:.;3;>;#=
9>9E9P9/;
5i647}7
9w9t:^<[=E?`?
0$080k0
2&2Y2g2
4"565U5i5
7$7C7W7
7#8B8a8
263!8O8
8e90:+;V<
4"4&4*4.42464:4>4B4F4J4
:^:&;u;
627"898}8
;;0<m<
5'5D5Y5^5
5G6Q6n6
8-8B8G8
9 9.9=9~9
> >:>o>~>
95:?:V:
;";&;*;.;2;6;:;>;B;F;J;N;R;V;Z;^;b;f;j;n;
4@4Q4~4
<!<)<J<Z<`<g<n<
?$?)?/?5?:?@?F?K?Q?W?\?b?h?m?s?y?~?
0#0(0.04090?0E0J0P0V0[0a0g0l0r0x0}0
1"1'1-13181>1D1I1N1U1Z1h1}1
8J9g9v9
;(;/;<;L;S;Y;c;r;z;
<<-<2<8<A<H<S<Y<`<
0*1?1D1I1j1o1|1
3B3%5E5O5o5
6!6=6}6
667?7G7
868=8L8h8w8
8 9F9O9U9]9b9u9
: :':.:5:<:C:K:S:[:g:p:u:{:
;%;,;3;:;A;H;P;X;`;k;p;v;
9;:@:D:H:L:
0R;V;Z;^;b;f;j;n;r;v;z;~;
1&1B1L1V1d1
<&=0?5?`?e?
121@1G1M1o1
2+2F2K2P2k2x2
33)353:3?3`3p3
6)626?6N6c6m6
8^8d8x8h9
<(<@<I<O<Y<^<c<h<x<~<
=`?h?o?
8&8B8W8s8
0I0P0[0i0p0v0
0'1l1/2m3
<(>,>0>4>8><>@>D>H>L>d>L?P?T?X?\?`?d?h?l?p?
B5C7K7
3#3Z3a3k6"8*8U8\8
<3=Q=R>
7!838`8
33X3c3Q5[5t5~5
;_;c;k;w;
<"<@<Y<^<w<
;<d<t<M>
596f6o6
8#8)80858s8{8
9"9'979<9A9Q9V9[9k9p9u9
:$:::`:
<#<><H<X<]<b<}<
>">F>X>n>s>x>
50:0E0l0~0
151;1M1`1
5'5@5Y5w5
6!6J6_6q6~6
77%7+7R7~7
8"878N8q8
0;1E1`1
<"<D<e<
?-?`?}?
002;2Q2
4$4<5C5
7#7,7<7M7W7a7k7
9K9T9n9w9
:H<S<Z<`<o<z<
<[=f=s=|=
=0>:>P>a>
0a01;1g1t1
454v4*5G5
7)7N7o7
032N2d2z2
031;1l1u1
2!2-2C2L2U2
4.5?5o5w5
6(616<6
< =W=t=
0;1<2L2]2e2u2
4?5K5i5t5
5F6K6P6U6g6'7
>V?q?{?
1&131=1M1
3 4`4l4~4
5"5(5,565I5R5m5
9 9,9=9K9V9
?#?L?S?j?
0;0N0X0q0
122D2V2h2z2
9%9-959=9
0/1h1|1
1!2B2(3
3A4`4B5v7
;*;7;<;J;
6%7W7q7
8#979\9
;G;N;H>
96:6;_;^<i<o<x<
v0;1h1
;;>;D;
>%>.>T>
?!?)?1?9?W?_?
6!727C7m7
1>1R1y1
1L3T3h3p3F4K4]4
:*:C:g:
;<;];~;
"0C0o1
6U7o7F8
1%111J1
1O2[2t2
3>3J3k3
5(575E5R5f5q5
6 6*646>6H6R6\6f6p6~6
7#71787@7G7P7V7]7d7m7s7z7
8!80878?8R8]8d8l8z8
9 9,9=9M9^9k9y9
:':1:>:O:a:q:
;!;(;/;7;G;M;T;[;c;r;
<#<2<9<A<O<]<j<y<
=(=7=G=V=c=v=
> >1>@>G>O>\>j>p>w>
?'?6?C?P?W?_?m?z?
0%050C0P0]0h0w0
1+11181H1W1^1i1}1
22-242>2L2[2i2y2
3%343A3O3^3d3k3|3
4%4/4=4D4L4[4h4o4y4
3 3$3(3
5 5$5(5,5054585<5T5X5\5`5d5h5l5p5t5x5|5
6 6$6(6,6064686<6
6<9D9L9T9\9d9l9t9|9
:$:,:4:<:D:L:T:\:d:l:t:|:
;$;,;4;<;D;L;T;\;d;l;t;|;
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|5
6 6$6(6,6064686<6@6D6H6L6P6T6X6\6`6d6h6l6p6t6x6|6
7 7$7(7,7074787<7@7D7H7L7P7T7X7\7`7d7h7l7p7t7x7|7
8 8$8(8,8084888<8@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|8
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
< <$<(<,<0<4<8<<<@<
<0D0L0T0\0d0l0t0|0
1$1,141<1D1L1T1\1d1l1t1|1
2$2,242<2D2L2T2\2d2l2t2|2
3$3,343<3D3L3T3\3d3l3t3|3
4$4,444<4D4L4T4\4d4l4t4|4
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6l6t6|6
7$7,747<7D7L7T7X7`7h7p7x7
8 8(80888@8H8P8X8`8h8p8x8
9 9(90989@9H9P9X9`9h9p9x9
: :(:0:8:@:H:P:X:`:h:p:x:
; ;(;0;8;@;H;P;X;`;h;p;x;
< <(<0<8<@<H<P<X<`<h<p<x<
= =(=0=8=@=H=P=X=`=h=p=x=
> >(>0>8>@>H>P>X>`>h>p>
2 2(20282@2H2P2X2`2h2p2x2
3 3(30383@3H3P3X3`3h3p3x3
4 4(40484@4H4P4X4`4h4p4x4
5 5(50585@5H5P5X5`5h5p5x5
3 3$3(3,3034383<3D3H3L3P3T3X3\3`3l3t3|3
4 4$4(4,4044484<4@4D4H4L4P4T4
5 5$5(5,5054585<5@5D5H5L5
< <$<(<,<0<4<8<<<@<D<H<L<P<\<`<d<h<l<p<t<x<|<
`0d0h0l0p0t0x0|0
1$1,141<1D1L1T1\1d1l1t1|1
3t4x4|4
5$505<5H5T5`5l5x5
6 6,686D6P6\6h6t6
7(747@7L7X7d7p7|7
8(848@8L8X8d8p8|8
T2\2d2l2t2|2
3$3,343<3D3L3T3\3d3l3t3|3
4$4,444<4D4L4T4\4d4l4t4|4
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6l6t6|6
7$7,747<7D7L7T7\7d7l7t7|7
8$8,848<8D8L8T8\8d8l8t8|8
9$9,949<9D9L9T9\9d9l9p9x9
: :(:0:8:@:H:P:X:`:h:p:x:
; ;(;0;8;@;H;P;X;`;h;p;x;
< <(<0<8<@<H<P<X<`<h<p<x<
= =(=0=8=@=H=P=X=`=h=p=x=
> >(>0>8>@>H>P>X>`>h>p>x>
? ?(?0?8?@?H?P?X?`?h?p?x?
0 0(00080@0H0P0X0`0h0p0x0
85<5@5,<4<8<@<
5@8H8P8X8`8h8p8x8
: :$:(:,:0:<:@:D:H:L:P:T:h:l:p:t:x:|:
; ;$;(;,;0;4;8;<;@;D;H;L;P;X;\;`;d;h;l;p;t;x;|;
3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
: :$:(:,:0:4:8:<:@:D:H:L:P:d:h:l:p:t:x:|:
l3p3x3
4$4(484<4@4H4`4p4t4
5 5(5@5P5T5d5h5l5p5t5x5
6 6(6@6P6T6d6h6l6p6t6|6
7 7(7@7P7T7d7h7l7p7t7x7
8 8$8(808H8X8\8`8d8h8p8
9,9094989<9D9\9l9p9
:(:,:0:4:8:@:X:h:l:|:
;(;,;0;4;8;@;X;h;l;|;
< <$<(<,<0<4<<<T<d<h<x<|<
=$=(=8=<=@=D=H=P=h=x=|=
> >$>4>8><>@>D>L>d>t>x>
? ?$?4?8?<?@?D?L?d?t?x?
0(0,0004080<0@0H0`0p0t0
1 10141D1H1L1P1T1\1t1
2 20242D2H2L2P2T2\2t2
3$3(383<3@3D3H3L3P3X3p3
4,404@4D4T4X4`4x4
5$5(5@5D5H5\5`5p5t5x5|5
6 6$6,6D6H6L6P6T6\6t6x6|6
7(7,7074787<7D7\7`7x7
848D8T8X8\8t8
9(989H9L9P9X9p9
:(:8:<:L:\:`:d:|:
; ;$;(;0;H;L;d;h;p;
2H2h2p2x2
383D3d3p3
4 4,4L4X4x4
50585D5d5l5x5
6<6D6L6T6\6h6
7(7H7P7`7h7
8$8,848<8D8L8T8\8d8l8t8|8
9$9,949<9D9L9T9\9d9l9t9|9
:$:,:4:L:\:l:x:
;$;,;4;<;D;L;T;d;l;t;|;
<$<,<4<D<L<T<\<d<l<t<|<
=0=D=T=d=p=x=
>$>,>4>L>T>\>d>l>t>|>
? ?(?L?T?\?d?l?t?|?
0$0,0D0P0X0t0|0
1$1,141<1D1T1\1d1l1t1|1
2$2,242<2D2L2T2\2d2l2t2|2
3<3D3L3T3\3d3l3t3|3
4,484@4d4l4t4|4
5 5(5L5T5\5d5l5t5|5
6$6,6<6L6X6`6
7$747@7H7l7t7|7
8$8,848<8L8\8h8p8
9$9,949<9L9T9\9d9t9
:$:,:4:D:L:\:l:x:
;$;,;4;<;D;L;\;d;l;t;
<$<,<4<D<L<T<\<d<l<t<|<
=$=,=4=<=D=L=T=\=d=l=t=|=
>$>,>4><>D>L>T>\>d>l>t>|>
?$?,?4?<?T?\?d?l?t?|?
0 040H0\0l0|0
1$1,141L1T1\1d1l1t1|1
282T2d2p2x2
3,383@3`3h3
4 484H4d4t4
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6l6t6|6
7$7,747<7D7L7T7\7d7l7t7|7
8$8,848<8D8L8T8\8d8l8t8|8
9$9,949<9D9L9T9\9d9l9t9|9
:$:,:4:<:D:L:T:\:d:l:t:|:
;$;,;4;<;D;L;T;\;d;l;t;|;
<$<,<4<<<D<L<T<\<d<l<t<|<
=$=,=4=<=D=L=T=\=d=l=t=|=
> >(>L>T>\>d>l>t>|>
?$?,?4?<?D?L?T?d?l?t?|?
0$0,040<0D0L0T0\0d0l0t0|0
1$1,141<1D1T1\1d1l1t1|1
2$2,242<2T2\2d2l2t2|2
303D3T3d3t3
4$4,444<4D4L4T4\4l4t4|4
5$5,545<5D5L5T5\5d5l5t5|5
6$6,6D6P6p6x6
7 7D7T7\7d7l7t7|7
8 8(8L8\8d8l8t8|8
9,949@9H9|9
:$:,:4:<:D:L:T:`:
;$;4;P;d;t;
<<<H<h<p<|<
= =T=d=p=
>$>8>@>H>P>T>X>`>t>|>
?\?d?t?
0$0,040<0D0L0X0x0
1(1H1P1X1`1l1
20282@2H2T2t2|2
3 3,3P3
3 4(4H4`4l4
545<5D5L5T5\5d5p5
6 6,6L6T6\6d6p6
7<7H7h7t7
8$8,848<8D8L8T8`8
949<9D9L9X9x9
:8:D:d:p:
< <D<d<l<t<|<
=8=X=`=h=p=x=
>4>8>T>X>t>x>
?<?@?\?`?h?p?x?|?
080X0x0
181X1x1
282X2x2
383X3t3x3
4 4@4`4
5 5(50585L5T5h5p5x5
6$686@6H6P6T6X6\6d6x6
`0d0h0l0p0t0x0|0
282H2X2h2x2
; ;@;`;
=4=P=p=
0<1\1|1
6$6D6d6
687T7x7
848T8t8
Washington1
Redmond1
Microsoft Corporation1(0&
Microsoft Code Signing PCA 20110
200304183947Z
210303183947Z0t1
Washington1
Redmond1
Microsoft Corporation1
Microsoft Corporation0
E0C1)0'
Microsoft Operations Puerto Rico1
230012+4583850
Chttp://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a
Ehttp://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0
"oRTg
Washington1
Redmond1
Microsoft Corporation1200
)Microsoft Root Certificate Authority 20110
110708205909Z
260708210909Z0~1
Washington1
Redmond1
Microsoft Corporation1(0&
Microsoft Code Signing PCA 20110
Ihttp://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^
Bhttp://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0
3http://www.microsoft.com/pkiops/docs/primarycps.htm0@
*?*kXIc
QEX82q'
WqVNHE
Washington1
Redmond1
Microsoft Corporation1(0&
Microsoft Code Signing PCA 2011
http://www.microsoft.com0
3].-ig
20201111200603.618Z0
Washington1
Redmond1
Microsoft Corporation1)0'
Microsoft Operations Puerto Rico1&0$
Thales TSS ESN:D9DE-E39A-43FE1%0#
Microsoft Time-Stamp Service
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 20100
191219011504Z
210317011504Z0
Washington1
Redmond1
Microsoft Corporation1)0'
Microsoft Operations Puerto Rico1&0$
Thales TSS ESN:D9DE-E39A-43FE1%0#
Microsoft Time-Stamp Service0
Pi!ac<
Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z
>http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
B>2pb0
Washington1
Redmond1
Microsoft Corporation1200
)Microsoft Root Certificate Authority 20100
100701213655Z
250701214655Z0|1
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 20100
$`2X`F
Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z
>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
1http://www.microsoft.com/PKI/docs/CPS/default.htm0@
oK0D$"<
r~akow
Washington1
Redmond1
Microsoft Corporation1)0'
Microsoft Operations Puerto Rico1&0$
Thales TSS ESN:D9DE-E39A-43FE1%0#
Microsoft Time-Stamp Service
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 20100
20201111201033Z
20201112201033Z0w0=
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 2010
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 2010
Wkernel32.dll
:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December
:AM:am:PM:pm
zh-CHS
az-AZ-Latn
uz-UZ-Latn
kok-IN
syr-SY
div-MV
quz-BO
sr-SP-Latn
az-AZ-Cyrl
uz-UZ-Cyrl
quz-EC
sr-SP-Cyrl
quz-PE
smj-NO
bs-BA-Latn
smj-SE
sr-BA-Latn
sma-NO
sr-BA-Cyrl
sma-SE
sms-FI
smn-FI
zh-CHT
Antivirus Signature
Bkav Clean
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Stealer.7
FireEye Generic.mg.3484b25f2ba1dbb9
CAT-QuickHeal Clean
McAfee GenericRXMZ-DZ!3484B25F2BA1
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Trojan.Win32.StellarStealer.SBR
K7AntiVirus Spyware ( 005687121 )
BitDefender Gen:Variant.Stealer.7
K7GW Spyware ( 005687121 )
CrowdStrike win/malicious_confidence_80% (W)
Arcabit Clean
Baidu Clean
Cyren W32/Trojan2.QDAM
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Spy.Agent.PYU
APEX Malicious
Avast Win32:PWSX-gen [Trj]
ClamAV Win.Malware.Zusy-9812688-0
Kaspersky HEUR:Trojan-Spy.Win32.Bobik.gen
Alibaba TrojanSpy:Win32/StellarStealer.119494b0
NANO-Antivirus Trojan.Win32.Bobik.innsnn
ViRobot Trojan.Win32.S.Agent.698280
Tencent Malware.Win32.Gencirc.10ce2a40
Ad-Aware Gen:Variant.Stealer.7
Emsisoft Gen:Variant.Stealer.7 (B)
Comodo Clean
F-Secure Clean
DrWeb Trojan.PWS.Steam.18689
Zillya Trojan.Bobik.Win32.2070
TrendMicro Clean
McAfee-GW-Edition GenericRXMZ-DZ!3484B25F2BA1
CMC Clean
Sophos Mal/Generic-S
SentinelOne Clean
Jiangmin TrojanSpy.Bobik.mi
MaxSecure Clean
Avira HEUR/AGEN.1141176
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Spy.Win32.Keylogger.oa!s1
Microsoft Trojan:Win32/StellarStealer.SBR!MSR
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan-Spy.Win32.Bobik.gen
GData Win32.Trojan.PSE.3YNIAA
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.RL_Stealer.R355109
Acronis Clean
BitDefenderTheta Gen:NN.ZexaF.34662.QqY@aW0S6vo
ALYac Gen:Variant.Stealer.7
MAX malware (ai score=86)
VBA32 TrojanSpy.Bobik
Malwarebytes Generic.Trojan.Dropper.DDS
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002C0DD121
Rising Spyware.Agent!8.C6 (C64:YzY0OtP2hpfCUG2A)
Yandex Clean
TACHYON Clean
eGambit Clean
Fortinet W32/GenKryptik.EZNX!tr
Webroot Clean
AVG Win32:PWSX-gen [Trj]
Cybereason malicious.f2ba1d
Paloalto generic.ml
Qihoo-360 Win32/TrojanSpy.Bobik.HgIASR4A
No IRMA results available.