Static | ZeroBOX

PE Compile Time

2021-08-17 07:28:01

PDB Path

C:\pccsw\eodkhe\bzxn\be5cd11a4adb46e5a54b6685a2f1993d\slnbjl\yrksqmdn\Release\yrksqmdn.pdb

PE Imphash

e9aef503b3e4a8eb831af674be5da9e3

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0002c1f0 0x0002c200 6.24220860161
.rdata 0x0002e000 0x0000a194 0x0000a200 5.42243376844
.data 0x00039000 0x00012740 0x00000a00 1.92423158984
.00cfg 0x0004c000 0x00000004 0x00000200 0.0611628522412
.voltbl 0x0004d000 0x00000061 0x00000200 1.77040933556
.rsrc 0x0004e000 0x000001a8 0x00000200 4.1796637014
.reloc 0x0004f000 0x0000239c 0x00002400 6.65728355061

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x0004e060 0x00000143 LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document, ASCII text

Imports

Library KERNEL32.dll:
0x4370d0 CloseHandle
0x4370d4 CompareStringW
0x4370d8 CopyFileW
0x4370dc CreateDirectoryW
0x4370e0 CreateFileW
0x4370e4 CreateHardLinkW
0x4370e8 CreateProcessW
0x4370ec CreateSymbolicLinkW
0x4370f0 DecodePointer
0x4370f8 DeleteFileW
0x4370fc DuplicateHandle
0x437104 ExitProcess
0x43711c FindClose
0x437120 FindFirstFileExW
0x437124 FindFirstFileW
0x437128 FindNextFileW
0x43712c FlushFileBuffers
0x437130 FormatMessageW
0x437138 FreeLibrary
0x43713c GetACP
0x437140 GetCPInfo
0x437144 GetCommandLineA
0x437148 GetCommandLineW
0x43714c GetConsoleCP
0x437150 GetConsoleMode
0x437154 GetConsoleOutputCP
0x437160 GetCurrentProcess
0x437164 GetCurrentProcessId
0x437168 GetCurrentThreadId
0x43716c GetDateFormatW
0x437170 GetDiskFreeSpaceExW
0x43717c GetExitCodeProcess
0x437184 GetFileAttributesW
0x43718c GetFileType
0x437190 GetFullPathNameW
0x437194 GetLastError
0x437198 GetLocalTime
0x43719c GetModuleFileNameW
0x4371a0 GetModuleHandleExW
0x4371a4 GetModuleHandleW
0x4371a8 GetOEMCP
0x4371ac GetProcAddress
0x4371b0 GetProcessHeap
0x4371b4 GetShortPathNameW
0x4371b8 GetStartupInfoW
0x4371bc GetStdHandle
0x4371c0 GetStringTypeW
0x4371c4 GetSystemDirectoryW
0x4371cc GetTempFileNameW
0x4371d0 GetTempPathW
0x4371d4 GetTimeFormatW
0x4371e0 HeapAlloc
0x4371e4 HeapFree
0x4371e8 HeapReAlloc
0x4371ec HeapSize
0x4371f4 InitializeSListHead
0x4371f8 IsDebuggerPresent
0x437200 IsValidCodePage
0x437204 LCMapStringW
0x43720c LoadLibraryExW
0x437210 LocalAlloc
0x437214 LocalFree
0x437218 MoveFileExW
0x43721c MoveFileW
0x437220 MultiByteToWideChar
0x437228 RaiseException
0x43722c ReadConsoleW
0x437230 ReadFile
0x437234 RemoveDirectoryW
0x437238 RtlUnwind
0x43723c SearchPathW
0x437244 SetConsoleMode
0x43724c SetConsoleTitleW
0x437258 SetFileAttributesW
0x43725c SetFilePointer
0x437260 SetFilePointerEx
0x437264 SetLastError
0x437268 SetStdHandle
0x437270 SetVolumeLabelW
0x437274 TerminateProcess
0x437278 TlsAlloc
0x43727c TlsFree
0x437280 TlsGetValue
0x437284 TlsSetValue
0x43728c WaitForSingleObject
0x437290 WideCharToMultiByte
0x437294 WriteConsoleW
0x437298 WriteFile
0x43729c lstrcatW
0x4372a0 lstrcmpW
0x4372a4 lstrcmpiW
0x4372a8 lstrcpyW
0x4372ac lstrcpynW
0x4372b0 lstrlenW
Library USER32.dll:
0x4372b8 CharNextExA
0x4372bc CharUpperBuffW
0x4372c0 GetDC
0x4372c4 GrayStringA
0x4372c8 IsCharAlphaNumericW
0x4372cc IsCharAlphaW
0x4372d0 LoadStringW
0x4372d4 MessageBoxA
0x4372d8 wsprintfW
Library SHELL32.dll:
0x4372e0 FindExecutableW
0x4372e4 SHFileOperationW
0x4372e8 SHGetFileInfoW
Library ADVAPI32.dll:
0x4372f0 GetFileSecurityW
0x4372f8 LookupAccountSidW
0x4372fc RegCloseKey
0x437300 RegCreateKeyExW
0x437304 RegDeleteKeyW
0x437308 RegEnumKeyExW
0x43730c RegOpenKeyExW
0x437310 RegQueryValueExW
0x437314 RegSetValueExW

!This program cannot be run in DOS mode.$
`.rdata
@.data
.00cfg
@.voltbl
@.reloc
D$\;D$d
<ItC<Lt3<Tt#<h
A<lt'<tt
Tt)jhZf;
Jjl^f;
V2jx_f;
F2jgYf;
F4_^[]
j"_f9y
URPQQh
u,PQRS
Wj0XPV
SPjdVQ
tlj*Yf
f9:t!V
QQSVj8j@
PPPPPWS
PP9E u:PPVWP
UQPXY]Y[
CY<u
PPPPPPPP
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
[aOni*{
~ $s%r
@b;zO]
v2!L.2
?5Wg4p
%S#[k=
"B <1=
GetConsoleWindow
VirtualProtect
%d.%d.%d
Destination supplied, processing to see if file or directory
out of memory
Out of memory
Copied successfully
Result: showattrs %x, bits %x
Request for all remaining tokens now
Read more input
Adding as first source part
No destination supplied, so need to calculate it
Searching %p as the set
Skipping %p which is part of the set
Need to read more data as outstanding brackets or carets
Skipping for loop commands due to no valid iterations
Found expression delimiter - reducing existing stacks
Found skip as %d lines
Looking for subdirectories
Finished adding all subdirectories
Skipping directories
%p %d %2.2d %p %s Redir:%s
Starting with root directory %s
Redirects now %s
Not a switch, but probably a filename/list %s
Processing qualifier at %s
Got directory %s as %s
Found as %s
Variable identified as %s
Parsed token %d(%d) as parameter %s
Parsed allremaining tokens (%d) as parameter %s
Processing FOR number %s
Set %s to %s
Resetting cwd to %s
Appending EOF to %s
Find next token after %d in %s
Input coming from %s
comparing found label %s
str before brk %s
Retrieving contents of %s
No special directory settings, using dir of %s
Using temporary file of %s
Assigning %s a value %s
Processing FOR filename %s
Calculated file name %s
Pushed variable %s
case insensitive answer-list: %s
Condition: %s
Moving to next directory to iterate: %s
detected console title: %s
p: %s, quals: %s, param1: %s, param2: %s, command: %s
Looking backwards for parameter id: %s
key not allowed: %s
param1: %s, param2: %s
Binary not found, dropping back to old behaviour
Found usebackq
Processing for set %p
Finished bracket @ %p, next command is %p
Looking for 'do ' in %p
Post-command, cmdEnd = %p
Batch completed, but was not 'called' so skipping outer batch too
Read nothing, so appending LF char and will try again
Skipping command %p due to stack depth
Found end of this nested IF statement, ending this if
Caret found at end of line
Parms supplied - working through each file
Label not found, trying from beginning of file
No parms - working probably in pipe mode
No operators for the reduce
Destination is a device
Source is a device
Could not allocate memory for extraSpace
Reached wrap point, label not found
Duplicate numbers found
Overflow detected in command
Not touching redirects for a FOR or IF command
HKCR Key '%s' deleted
Adding to source file list to be concatenated
Output needs to be piped
%d entries, maxwidth=%d, widest=%d
cols=%d, rows=%d
Unexpected failure writing to %s, rc=%d
Unexpected failure reading from %s, rc=%d
Delayed expansion now %d
Shifting variables, starting at %d
No next token found, previous was %d
Found next token after %d was %d
Popped number %d
Peeked number %d
Pushed number %d
FOR /L provided range from %d to %d step %d
Setting delayed expansion to %d
Resetting curdepth at end of line to %d
Expression resolved to %d
Envvar %s converted to %d
Found total tokens to be %d
Returning result %d, rc %d
answer: %d
p: %s, quals: %s, param1: %s, param2: %s, command: %s, if_condition_len: %d
Reducing the stacks - processing operator %c
Unrecognized operator %c
Unexpected operator %c
Popped operator %c
Pushed operator %c
Inside an IN
No operands left for the reduce?
Parsed line:
Finished all directories.
Juction links currently not supported.
Found eol as %c(%x)
del: Processing arg %s (quals:%s)
rd: Processing arg %s (quals:%s)
Processing subparm '%c' (in %s)
Processing arg '%c' (in %s)
Translate command:%s %d (at: %s)
Added to stack %s (%p->%p)
command on entry:%s (%p)
Redirect %d (%p) to %d (%p)
Redirect %d to '%s' (%p)
Found end of this IF statement (next = %p)
Skipping this command, as in not process mode (next = %p)
Manual Copying %s to %s (append?%d)
Found '(' conditions: curLen(%d), inQ(%d), onlyWS(%d), for(%d, In:%d, Do:%d), if(%d, else:%d, lwe:%d)
Flags: srcbinary(%d), dstbinary(%d), over(%d), prompt(%d)
Processing cmdList(%p) - delim(%d) bd(%d / %d) processThese(%d)
Writing trailer for '%s' gave %d(%d)
cmdList(%p), firstCmd(%s), doIt(%d), isIF(%d)
Failed to append EOF to %s (%d)
Failed to open %s (%d)
Running '%s' (%d)
Found operator %c precedence %d (head is %d)
Resolved destination is '%s' (calc later %d)
Copy source (calculated): path: '%s' (Concats: %d)
Expanding: %s (%c)
Path Parts: drive: '%s' dir: '%s' name: '%s' ext:'%s'
Looking for directory '%s'
Really changing to directory '%s'
Request change to directory '%s'
Directory, so full name is now '%s'
Recursive, Adding to search list '%s'
Issuing '%s' with redirs '%s'
First parameter is '%s'
Full dest name is '%s'
Full src name is '%s'
Found tokens as '%s'
Found delims as '%s'
Found on path as '%s'
Found file as '%s'
Recursive, looking for '%s'
Searching in '%s' for '%s'
Working on parameter '%s'
Looking for matches to '%s'
Move from '%s'('%s') to '%s'
Rename from '%s'('%s') to '%s'
set: Setting var '%s' to '%s'
set /p: Setting var '%s' to '%s'
Setting '%s' to '%s'
Using location '%s'
Handling expression '%s'
Found on path as '%s' with extension '%s'
Searching recursively in '%s'
Found parm '%s'
Reading input to parse from '%s'
Using path '%s'
mklink: Processing arg '%s'
more: Processing arg '%s'
type: Processing arg '%s'
Full commandline '%s'
set: Stripped command line '%s'
Full path name '%s'
Processing file '%s'
Source '%s'
Processing for item %d '%s'
Processing for filespec from item %d '%s'
FOR variable context: %c = '%s'
Unexpected data in optionsroot: '%s'
Parsing buffer into tokens: '%s'
Searching for: '%s'
Found 'FOR ', comparing next parm: '%s'
goto label: '%s'
/c command line: '%s'
Executing command: '%s'
Command: '%s'
Copying to : '%s'
Copying from : '%s'
Final resolved destination name : '%s'
Dest '%s'
Writing volume for '%c:'
Inserting default '*'
Found 'DO '
Found 'IN '
dddd, MMMM dd, yyyy
MM/dd/yy
February
January
Thursday
Tuesday
Wednesday
Saturday
Sunday
Monday
Friday
InitializeCriticalSectionEx
LCMapStringEx
CompareStringEx
August
_hypot
operator co_await
__restrict
CorExitProcess
HH:mm:ss
operator
_nextafter
October
November
September
December
__fastcall
__thiscall
__vectorcall
__clrcall
__stdcall
__cdecl
__pascal
__eabi
FlsSetValue
FlsGetValue
delete
FlsFree
AppPolicyGetProcessTerminationMethod
__unaligned
FlsAlloc
new[]
delete[]
1#SNAN
1#QNAN
LocaleNameToLCID
operator<=>
__ptr64
__swift_2
__swift_1
nan(snan)
(null)
nan(ind)
NAN(SNAN)
NAN(IND)
restrict(
__based(
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Type Descriptor'
`vector deleting destructor'
`scalar deleting destructor'
`vbase destructor'
`vector copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`eh vector vbase copy constructor iterator'
`vector constructor iterator'
`eh vector constructor iterator'
`managed vector constructor iterator'
`vector vbase constructor iterator'
`eh vector vbase constructor iterator'
`vector destructor iterator'
`eh vector destructor iterator'
`managed vector destructor iterator'
Complete Object Locator'
`virtual displacement map'
`vcall'
`string'
`udt returning'
`omni callsig'
`typeof'
`copy constructor closure'
`default constructor closure'
`local vftable constructor closure'
`placement delete closure'
`placement delete[] closure'
`vftable'
`local vftable'
`vbtable'
`anonymous namespace'
`local static thread guard'
`local static guard'
`dynamic atexit destructor for '
`dynamic initializer for '
operator ""
LLD PDB.
C:\pccsw\eodkhe\bzxn\be5cd11a4adb46e5a54b6685a2f1993d\slnbjl\yrksqmdn\Release\yrksqmdn.pdb
CloseHandle
CompareStringW
CopyFileW
CreateDirectoryW
CreateFileW
CreateHardLinkW
CreateProcessW
CreateSymbolicLinkW
DecodePointer
DeleteCriticalSection
DeleteFileW
DuplicateHandle
EnterCriticalSection
ExitProcess
ExpandEnvironmentStringsW
FileTimeToLocalFileTime
FileTimeToSystemTime
FillConsoleOutputAttribute
FillConsoleOutputCharacterW
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDateFormatW
GetDiskFreeSpaceExW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetShortPathNameW
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTempFileNameW
GetTempPathW
GetTimeFormatW
GetVolumeInformationW
GetWindowsDirectoryW
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExW
LocalAlloc
LocalFree
MoveFileExW
MoveFileW
MultiByteToWideChar
QueryPerformanceCounter
RaiseException
ReadConsoleW
ReadFile
RemoveDirectoryW
RtlUnwind
SearchPathW
SetConsoleCursorPosition
SetConsoleMode
SetConsoleTextAttribute
SetConsoleTitleW
SetCurrentDirectoryW
SetEnvironmentVariableW
SetFileAttributesW
SetFilePointer
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SetVolumeLabelW
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile
lstrcatW
lstrcmpW
lstrcmpiW
lstrcpyW
lstrcpynW
lstrlenW
CharNextExA
CharUpperBuffW
GrayStringA
IsCharAlphaNumericW
IsCharAlphaW
LoadStringW
MessageBoxA
wsprintfW
FindExecutableW
SHFileOperationW
SHGetFileInfoW
GetFileSecurityW
GetSecurityDescriptorOwner
LookupAccountSidW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
KERNEL32.dll
USER32.dll
SHELL32.dll
ADVAPI32.dll
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
_z&-Ol
+.")bf
8<KO_b7
<?xml version="1.0" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1"
manifestVersion="1.0">
<trustInfo>
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false'/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
0+1Q1d1u1
3+3=3M3
6(676L6h6
4)5>5a5z5
9#:E:\:
=8=J=^=
90n1w1
5Q5l5z5
5.6P6h6
627<7Z7d7
2"2S2g2
7!7+7Z7
9u:];C<(=
3+393d3u3
4,4=4[4w4
8 808R8w8
9':e:w:
1%1=1Q1c1w1
=@=R=b=*>
?$?t?~?
1/2a3}3
444F4P4r4
;5;>;H;Y;
<3<E<`<
>!?H?h?
0 020?0S0n0
464Q4h4
6G6P6f6u6
7#7N7T7d7
879A9]9
4-4R4w4
6K6]6m6
767R7[7
7=8G8q8{8
:%;D;i;r;
=&=5=T=z=
>1?S?u?
+050W0
0#1N1i1
222;2S2\2
3-383J3S3d3
737G7\7|7
9Z9l97:
1R1}2:3
:>:O:k:
;(;<;J;
>(>I>Y>s>
?>?P?`?
5#6L6b6
8_8l8z8
8+9;9_9y9
97:N:g:
<7>M>u>
?3?E?O?t?
718M8W8
949`9y9
:!:+:Z:
<-<E<_<x<
=T=b=r=
?A?K?r?|?
&0[0o0
22)232=2G2Q2[2e2o2y2
4"4>4O4Z4v4
5/5:5V5g5r5
8#8i8s8
:!:I:O:U:w:
;%;;;S;^;m;
=9=]=k=z=
>F?P?b?l?
2-2v2;3T3
5A5N5l5
5.6!7t7
73898[8h8
:8:N:s:
;);6;P;];i;
=&>4>f>
0B0p0*1T1a1
4?4Q4e4
6&6+676=6J6e6
7(8M8`8n8
9P:V:v:
;8;P;_;
;!<)<C<P<q<
=@=Q=]=z=
?A?I?R?y?
0$0O0i0
061D1|1
2 343f3
3@3L3Z3
1*1:1R1
1@2J2b2p2
45)5O5
576A6g6
8+9K9a9m9
9V:n:s:
>K>'?d?
0(0;0F0N0V0z0
3@3H3N3p3v3
4-4W4r4
:A:T:h:r:|:
3%3H3Y3y3
344A4e4
>C?Q?`?
0%0V0r0
5G5N5`5
6#6 7)7
4(5@5]5
6$6A6o6}6
="=@=\=
4 5%525l5d6v6
617g7z7
8!8'8-83898?8E8
99N9T9
<J<T<]<
=P=Z=c=l=
>$>=>K>Q>W>]>c>i>p>w>~>
??1?:?E?L?c?
1 243G3e3s3!5X5_5d5h5l5p5
=7>U>`>h>s>y>
?)?0?6?B?G?M?R?Z?n?}?
2<2@2D2H2L2h2
;);!?5?
4#4-464G4Y4
5(575L5V5i5p5|5
=>->8>=>G>L>W>b>p>
?[?e?~?
2#3.3[3x3
20D1a1
0$020M0^0w0
5=5O5[5
6.6=6H6M6R6m6|6
8'838G8]8
9&9+909@9E9J9Z9_9d9
:":):2:9:R:a:k:
;);6;O;h;
<0<Y<n<
=G=L=Q=V=
1.2H2M2
3*383D3P3^3n3
4&494r4
4c5@6G6z7
707B7T7f7x7
8)8;8M8
242;2W2^2r2{2
7$8)8.8I8V8_8d8i8
9>9N9f9z9
;"<7<H<
3.393G3
7-7:7?7M7
?8?C?P?r?
2{3J7Z7z7
99:A:I:Q:Y:w:
0;1<2L2]2e2u2
3A3P3\3k3~3
3,454>4G4r4
0 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
1 1$1(1,1014181<1@1D1H1L1P1T1X1\1`1d1h1l1p1t1x1|1
2 2$2(2,2024282<2@2D2H2L2P2T2X2\2`2d2h2l2p2t2x2|2
3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|5
6 6$6(6,6064686<6@6D6H6L6P6T6X6\6`6d6h6l6p6t6x6|6
7 7$7(7,7074787<7@7D7H7L7P7T7X7\7`7d7h7l7p7t7x7|7
8 8$8(8,8084888<8@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|8
9 9$9(9,9094989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|9
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
2`3d3h3l3p3x3
9 9(90989@9H9P9X9`9h9p9x9
: :(:0:8:@:H:P:X:`:h:p:x:
; ;(;0;8;@;H;P;X;`;h;p;x;
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<
= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\=`=l=p=t=x=|=
8$8,848<8D8L8T8\8d8l8t8|8
9$9,949<9D9L9T9\9d9l9t9|9
:$:,:4:<:D:L:T:\:d:l:t:|:
;$;,;4;<;D;L;T;\;d;l;t;|;
<$<,<4<<<D<L<T<\<d<l<t<|<
=$=,=4=<=D=L=T=\=d=l=t=|=
>$>,>4><>D>L>T>\>d>l>t>|>
?$?(?0?8?@?H?P?X?`?h?p?x?
0 0(00080@0H0P0X0`0h0p0x0
1 1(10181@1H1P1X1`1h1p1x1
2 2(20282@2H2P2X2`2h2p2x2
3 3(30383@3H3P3X3`3h3p3x3
4 4(40484@4H4P4X4`4h4p4x4
5 5(50585@5H5P5X5`5h5p5x5
6 6(60686@6
;$;,;4;<;D;L;T;\;d;l;t;|;
>,>0>L>P>p>
?0?P?p?
000P0p0
101L1P1p1
6 6,60646P6T6
7 7$7(7,7074787<7H7L7P7T7X7\7`7d7
c"y1x6
AZso_bc(>
C#Qovu
3a!7w
[3Rf`t!
]rHq|'1D-}dG]
M&4dIa
]7DTx\Y$
e#;5sNd
J}>b#\
CdW~Y
%dN!]C0ZA
pQf7eD
`mu1zf
L}h]\J
>cQH^K
sr'#?zV
!/P`QeM
t@(QQg
KW,o^l
)<qCMp
Ci1P|m
w}tt5cB
*|x1^M|7
\ZHT1I
rVL:A^
f M'[<C V
4e#=_4r
npe?pg
MV7rpi
'-<]C
7W'6^l
f(*tQ>
jtVN6&
"aI^`g
*27~eY
(<Q7s*&
baT<U&2
Sy3K)U
AA1B!H
z}D_?}
(RbtMx`6
k^Rt`Wu8
=_4r LC
,3Oug[
HLXI[%)
86}mtQ
-p0')?
cws9^)
5Hm/3t
^Gd93W2
x](q/I
 S<]C
7~ea{c
SxHKp
q*O}p@
ijwcGI
KrY6Hdr
[s9RR`
oEw}tt9
wA9,Ho=
gn[x\t
Y;b=IZA
7%(wbK
|oPg$|
=;EW%V
W+STI
cJ+g!Ruz
-?!RRO?
xoVGD
{$d/{d61Y
{y7@p&
T`tssE
Mv&{nHE
B5pCHK-
d&u-9;W;t
h5|!|g
}k>ZnF
j^t!?x$
(Sew}f
4*DRg[
}=IE\)p
.b9T/=Sj$j"
`dq7<Fh=
o*]cSj
*[`Qet
73+,Ylhpv
I*cjP+l
VGKxC<|%
}A#;#b
~L\RSF
0B:/g@
F/>Cx3
dp|]g[
RC8|#-
*}=R<:
0rwe(+
sQ?f%~
1$EKun
Z;=fYr]
m]7%0I
f7!Ymh
)<o$M8
S9o0~G
xBPW)l
q,|zni
UPnt-hr\
(w}p5;
H|>a<p
XwC-S7
y{TZV
nt(?x[;m
Z?E~Q<-
^*2(@n
17#&jP)
_IhE*[
a+c#{O
B%i,6P
WZ=ht;
7#7jP)l
ZqE~QB
;l8|%P
F7 uIKn
J.v(3U
<*"9>M
RCwE7C>
iB%bFp
`Yly}=
nttsuE
Sy9Jnc
.`R*2&
eB2LV\
TNC==<
A,!s\k
*M:.iyC
*~yCQy
P)[*"(
`CZg@,R
1PntVhcY
Kp6ZeC
_TqrrUG
VDGW}?
mH]~!y;
LWts^lVw
H:E3WM
YIR*0r-t
a:\<L]
2CN~?
:pal=x5
MJb>'E#
t<]/[>
RN`,e],
S4? fZo
nxdYI:
Rv`>e^,
nxnYH:
f1`S[?'f/o-
{1;St?
x+|4&C
R0`Xe],:
'26N+I
+K4@C,W
SW?cf6o
+24OCpWz
Rp`Se^,
%1"Sv?
+m4OC_W
-1aSt?'f
7+K4WC
\,q}t<
1"S4? fZo(
y,D})<
`}e_,f
S)?'f.o
i1VSt?.f
7R9`}e_,"
S*?ffDo
B1 S[?
,@}j<~
?~flo0
SW?cf6o
RR``e_,"
:iO+:B!.
S9'v1c
XwRfIQ
,9!&<)9P
`>f`[Vb
imw3Qn
S$g Wv
#>pt8I3
.q8;f?
;j8naG
FGT>LAx
<b[h]i
gh&;#l
*e;:=x
ZSYKl5`h
?/^p+O
*^VA'H
oiZmG(
m7WS(]]
<Uk|LE
q+ak=t"6
|/./R{
}%}%-0kkd
Zv}lnp
Y5u0hn
\KWgc-
]!>'6>
~'xu!<`
Y/J1L4
/C[D9s4
l}%)9c
X</N,!s
#H]knmI
:?w#BU
7"\c,_
.pee N
.KPan$
DrC~MXLV
Ks!-[##
f0Y8-R
S|wgRp!8^
vDp038
yX`|A6
^o<lFV
~xlv2@
.A|e,I
w<A"~T
RB5FQN
3,s&T3
fd @p&{8
!3xbhp
>@BcuM
`+9*=K
Wufo9C
F"( @1
X9UM/r1
G&:hv0
y,/3?`
kX[x,Sv
~Yc'K(
%gWU4a
`?6asYzL
\00EYZ
McHy3n
D9d?$~
\9U5H$q
ACL:[tB[
Z>P5$sQ7a
ExuU&|8
SM1IF7`
mjh9dw
fh"1/#
Pv:I@z
*HC]s%
n Q| _
4SI?zu
Sq|+kq
yldRX"
"sRPgSl
H;?,U~
qIz"MMj
EId;.-
MbM`HV
i r%(7%
ZnY5i&
9ihsU!V
Ni}c\;
!w,=6k
zz$=AjPPc
:ZsN6
|\jE"J
oKSJ-$
0\.J.L
#MA%MZ
-\*4 H
mt.Bg}
7S#DNg
R9R1Q-
{GpkE7
kfUYAdk
Ko%-zW
X$~a/z&
1?<,a2
AqX'Rr4O
:fHi<(
8 7{)y
/jyu$y
?v4{2qe
8 }?Q{
cVNgEf&#
g2NJ4-
iPa&8)
0ql"u+I>
w>iumN
-*'_g+
=h^#DJ
Wl&g%9
l)+!s,
Wd}m{
-8Hn~
-UARF$y
)<!n!,
V9c((r^q
&~YwqM
rOY6e%]
BI+pbKZ
sW\7xx
m$B9_Hy
[Tz0,zL
<q1"4#
4#h.i=
Z$fUju
Cg|!/P<\
$}f`l=
/Fm1;_;
$BDQ_X_H
<*RW7WRYc
eStFF3
w (L|yQ
",hf$y
4N,bJ6
USS:7O
xP8m>_
n@O.2<
_)LEJ+
y6E6D(`W'[
Zd a:}
yXTJ[<
aA2I]|fr0?
0)\j62
[RAy?:z
.e`&0n?
9?EI<j
WN<DV!
I_v=dl'
ZIe`6I
/{:G$B
|qrlR0
pO=JV%
++Fg"p
4Pn!auB
hlNB`*o
r_lEdj
o4O3$$
=..mK&+
i}w#QIP
~"S@cj
z7# g|
ONmHDF
mz88d>
`(d[(m
96+j8'v
Xh7e^Z
9:yrHP
ySB0@)
X@;Kj3
hKdG;q
?lYEM
RE!( 5"
qyaE,U
Q^E)og
b=YbL1
)z}O-ta
lNc46aZ+f
aLEM(A4
PROMPT
RENAME
VERIFY
ENDLOCAL
SETLOCAL
CHOICE
MKLINK
indoATTRIB
><|& :
~fdpnxsatz$
remforifelseecho.echo:echo/doin
Software\Microsoft\Command Processor
eol=skip=tokens=delims=usebackqelse
()!~-*/%+<>&^|=,
((((( H
((((( H
(
%1!8d! directories
%s%s%s
%s%c%s
CMD.EXE /C %s
%s > %s
DefaultColor
kernel32.dll
errorlevel
\command\start.exe
\cmd.exe
.bat;.com;.cmd;.exe
\Shell\Open\Command
defined
PATHEXT
PROMPT
DISABLEDELAYEDEXPANSION
ENABLEDELAYEDEXPANSION
RANDOM
ERRORLEVEL
COPYCMD
DIRCMD
COMSPEC
---------
CONIN$
%1!-23s!
%1!-13s!
%1!*s!
Failed!
%1!10s! %2!8s! %3!10s!
%1!8d! directory
%1!10s! %2!8s! <DIR>
Total files listed:
%1!8d! files%2!25s! bytes
1 file %1!25s! bytes
%1!8d! files %2!24s! bytes
%s (%2.2d%%) --
%1!8d! directories %2!18s! bytes free
%1!18s! bytes free
Directory of %1
dddd, MMMM dd, yyyy
MM/dd/yy
syr-sy
February
January
Thursday
Tuesday
Wednesday
Saturday
Sunday
Monday
Friday
div-mv
August
zh-cht
HH:mm:ss
zh-chs
October
November
September
December
smj-no
sma-no
quz-bo
uz-uz-latn
az-az-latn
sr-sp-latn
bs-ba-latn
sr-ba-latn
uz-UZ-Latn
az-AZ-Latn
sr-SP-Latn
bs-BA-Latn
sr-BA-Latn
kok-in
uz-uz-cyrl
az-az-cyrl
sr-sp-cyrl
sr-ba-cyrl
uz-UZ-Cyrl
az-AZ-Cyrl
sr-SP-Cyrl
sr-BA-Cyrl
mscoree.dll
sms-fi
smn-fi
smj-se
sma-se
quz-pe
quz-ec
syr-SY
div-MV
zh-CHT
zh-CHS
smj-NO
sma-NO
quz-BO
kok-IN
sms-FI
smn-FI
smj-SE
sma-SE
quz-PE
quz-EC
user32
kernel32
advapi32
api-ms-win-core-file-l1-2-2
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-string-l1-1-0
ext-ms-
api-ms-
(null)
CONOUT$
api-ms-win-core-processthreads-l1-1-2
api-ms-win-appmodel-runtime-l1-1-2
api-ms-win-core-localization-l1-2-1
api-ms-win-core-datetime-l1-1-1
api-ms-win-core-localization-obsolete-l1-2-0
ext-ms-win-ntuser-dialogbox-l1-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
*a/b%c+d-e&f^g|h<i>j
Antivirus Signature
Bkav Clean
Lionic Trojan.Multi.Generic.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Clean
FireEye Generic.mg.a5082cf7d178e6ec
CAT-QuickHeal Clean
McAfee Artemis!A5082CF7D178
Cylance Unsafe
VIPRE Clean
Sangfor Clean
K7AntiVirus Clean
BitDefender Clean
K7GW Clean
Cybereason Clean
Baidu Clean
Cyren Clean
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Generik.GMCYYCB
APEX Clean
Paloalto generic.ml
ClamAV Clean
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Rising Trojan.Kryptik!1.D84E (CLASSIC)
Ad-Aware Clean
Emsisoft Clean
Comodo Clean
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Dropper.gc
CMC Clean
Sophos Generic ML PUA (PUA)
Ikarus Clean
GData Win32.Trojan-Stealer.LokiBot.7ULAEM
Jiangmin Clean
Webroot Clean
Avira Clean
MAX Clean
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Woreflint.A!cl
Cynet Clean
AhnLab-V3 Clean
Acronis Clean
ALYac Clean
TACHYON Clean
VBA32 BScope.Trojan-Dropper.Injector
Malwarebytes Clean
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Clean
Yandex Clean
SentinelOne Clean
MaxSecure Clean
Fortinet Clean
BitDefenderTheta Gen:NN.ZexaF.34088.CCZ@aimNM0ki
AVG FileRepMalware
Avast FileRepMalware
CrowdStrike win/malicious_confidence_60% (W)
Qihoo-360 Win32/Heur.Generic.HwoCUXwA
No IRMA results available.