Static | ZeroBOX

PE Compile Time

2021-09-08 01:02:12

PE Imphash

cd827b8586176b67403fab26f5e0d605

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0006b143 0x00000000 0.0
.rdata 0x0006d000 0x00019b42 0x00000000 0.0
.data 0x00087000 0x00005498 0x00000000 0.0
Intel Co 0x0008d000 0x00000ef0 0x00000000 0.0
Intel Co 0x0008e000 0x0026de14 0x00000000 0.0
Intel Co 0x002fc000 0x00439e50 0x0043a000 7.92455726553
.reloc 0x00736000 0x000005ec 0x00000600 4.23599407768
.rsrc 0x00737000 0x00041f2b 0x00042000 5.53624937096

Resources

Name Offset Size Language Sub-language File type
MUI 0x00737464 0x00000118 LANG_GREEK SUBLANG_NEUTRAL data
TYPELIB 0x0074bdc0 0x00000c44 LANG_GREEK SUBLANG_NEUTRAL data
TYPELIB 0x0074bdc0 0x00000c44 LANG_GREEK SUBLANG_NEUTRAL data
TYPELIB 0x0074bdc0 0x00000c44 LANG_GREEK SUBLANG_NEUTRAL data
TYPELIB 0x0074bdc0 0x00000c44 LANG_GREEK SUBLANG_NEUTRAL data
RT_ICON 0x00764f0c 0x00008b7f LANG_NEUTRAL SUBLANG_NEUTRAL PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON 0x00764f0c 0x00008b7f LANG_NEUTRAL SUBLANG_NEUTRAL PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON 0x00764f0c 0x00008b7f LANG_NEUTRAL SUBLANG_NEUTRAL PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON 0x00764f0c 0x00008b7f LANG_NEUTRAL SUBLANG_NEUTRAL PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON 0x00764f0c 0x00008b7f LANG_NEUTRAL SUBLANG_NEUTRAL PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON 0x00764f0c 0x00008b7f LANG_NEUTRAL SUBLANG_NEUTRAL PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_GROUP_ICON 0x0076da8c 0x0000005a LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_VERSION 0x0076de50 0x000001b4 LANG_SANSKRIT SUBLANG_DEFAULT data
RT_VERSION 0x0076de50 0x000001b4 LANG_SANSKRIT SUBLANG_DEFAULT data
RT_VERSION 0x0076de50 0x000001b4 LANG_SANSKRIT SUBLANG_DEFAULT data
RT_HTML 0x0077423c 0x000033b7 LANG_GREEK SUBLANG_NEUTRAL HTML document, ASCII text, with very long lines, with CRLF line terminators
RT_HTML 0x0077423c 0x000033b7 LANG_GREEK SUBLANG_NEUTRAL HTML document, ASCII text, with very long lines, with CRLF line terminators
RT_HTML 0x0077423c 0x000033b7 LANG_GREEK SUBLANG_NEUTRAL HTML document, ASCII text, with very long lines, with CRLF line terminators
RT_MANIFEST 0x00778290 0x00000c9b LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document, UTF-8 Unicode (with BOM) text
RT_MANIFEST 0x00778290 0x00000c9b LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document, UTF-8 Unicode (with BOM) text

Imports

Library KERNEL32.dll:
0x88a000 WaitForSingleObject
0x88a004 GetModuleHandleA
0x88a008 GetLocaleInfoA
0x88a00c Sleep
0x88a014 GetUserDefaultLCID
0x88a018 CreateThread
0x88a01c GetLastError
0x88a020 DeleteFileA
0x88a024 HeapAlloc
0x88a028 lstrcpynA
0x88a02c lstrcmpiW
0x88a030 GetModuleFileNameA
0x88a034 GetCurrentProcess
0x88a03c CreateMutexA
0x88a040 OpenProcess
0x88a048 MultiByteToWideChar
0x88a054 OpenMutexA
0x88a058 Process32NextW
0x88a05c GlobalAlloc
0x88a064 Process32FirstW
0x88a068 GlobalFree
0x88a06c GetSystemInfo
0x88a078 WideCharToMultiByte
0x88a07c CreateProcessA
0x88a080 GetComputerNameA
0x88a084 UnmapViewOfFile
0x88a08c CloseHandle
0x88a090 GetLocalTime
0x88a094 CreateFileMappingA
0x88a098 MapViewOfFile
0x88a09c GetTickCount
0x88a0a0 SetStdHandle
0x88a0ac GetOEMCP
0x88a0b0 GetACP
0x88a0b4 IsValidCodePage
0x88a0b8 HeapReAlloc
0x88a0bc OutputDebugStringW
0x88a0c0 lstrlenA
0x88a0c4 GetFileSize
0x88a0c8 lstrcpyW
0x88a0cc lstrcatW
0x88a0d0 GetVersionExW
0x88a0d4 lstrlenW
0x88a0d8 CreateDirectoryA
0x88a0dc lstrcpyA
0x88a0e4 CreateFileA
0x88a0e8 GetFileAttributesA
0x88a0f8 SetFilePointer
0x88a0fc SetFileTime
0x88a100 WriteFile
0x88a104 ReadFile
0x88a108 FindClose
0x88a10c GetDriveTypeA
0x88a110 CopyFileTransactedA
0x88a114 FreeLibrary
0x88a118 GetProcessHeap
0x88a11c LocalFree
0x88a120 GetProcAddress
0x88a124 LoadLibraryA
0x88a128 LocalAlloc
0x88a134 ReadConsoleW
0x88a138 EnumSystemLocalesW
0x88a13c IsValidLocale
0x88a140 GetLocaleInfoW
0x88a144 LCMapStringW
0x88a148 CompareStringW
0x88a14c GetTimeFormatW
0x88a150 GetDateFormatW
0x88a154 GetConsoleMode
0x88a158 GetConsoleCP
0x88a15c FlushFileBuffers
0x88a160 GetFileSizeEx
0x88a164 HeapSize
0x88a168 GetCommandLineW
0x88a16c GetCommandLineA
0x88a170 WriteConsoleW
0x88a174 GetModuleFileNameW
0x88a178 GetFileType
0x88a17c GetStdHandle
0x88a180 GetModuleHandleExW
0x88a184 HeapFree
0x88a190 ExitProcess
0x88a194 LoadLibraryExW
0x88a198 TlsFree
0x88a19c TlsSetValue
0x88a1a0 TlsGetValue
0x88a1a4 TlsAlloc
0x88a1ac SetLastError
0x88a1b0 RaiseException
0x88a1b4 RtlUnwind
0x88a1b8 TerminateProcess
0x88a1bc InitializeSListHead
0x88a1c4 GetCurrentThreadId
0x88a1c8 GetCurrentProcessId
0x88a1d0 GetModuleHandleW
0x88a1d4 GetStartupInfoW
0x88a1e0 IsDebuggerPresent
0x88a1e8 GetCPInfo
0x88a1f0 CreateDirectoryW
0x88a1f4 CreateFileW
0x88a1f8 FindFirstFileExW
0x88a1fc FindNextFileW
0x88a204 SetEndOfFile
0x88a208 SetFilePointerEx
0x88a20c AreFileApisANSI
0x88a210 DeviceIoControl
0x88a214 CopyFileW
0x88a218 CreateHardLinkW
0x88a220 CreateSymbolicLinkW
0x88a224 FormatMessageA
0x88a238 EncodePointer
0x88a23c DecodePointer
0x88a240 LCMapStringEx
0x88a244 GetStringTypeW
Library USER32.dll:
0x88a24c wsprintfW
0x88a250 wsprintfA
0x88a254 GetWindowRect
0x88a258 GetSystemMetrics
0x88a25c GetWindowDC
0x88a260 EnumDisplayDevicesA
0x88a264 GetDesktopWindow
Library GDI32.dll:
0x88a26c BitBlt
0x88a270 SaveDC
0x88a274 SelectObject
0x88a278 CreateDIBSection
0x88a27c CreateCompatibleDC
0x88a280 GetDeviceCaps
0x88a284 DeleteDC
0x88a288 RestoreDC
0x88a28c DeleteObject
Library ADVAPI32.dll:
0x88a294 GetTokenInformation
0x88a298 CryptGetHashParam
0x88a29c CryptDestroyHash
0x88a2a0 RegQueryValueExA
0x88a2a4 GetUserNameA
0x88a2ac OpenProcessToken
0x88a2b0 RegOpenKeyExA
0x88a2b8 DuplicateTokenEx
0x88a2bc RegQueryValueExW
0x88a2c0 CryptReleaseContext
0x88a2c4 RegCloseKey
0x88a2c8 RegEnumKeyExW
0x88a2cc RegOpenKeyExW
0x88a2d4 CredEnumerateW
0x88a2d8 CredFree
0x88a2dc CryptCreateHash
0x88a2e0 CryptHashData
Library SHELL32.dll:
0x88a2e8 SHGetFolderPathA
0x88a2ec ShellExecuteA
Library ole32.dll:
0x88a2f8 CoInitialize
0x88a2fc CoUninitialize
0x88a300 CoTaskMemFree
0x88a304 CoCreateInstance
Library USERENV.dll:
Library ktmw32.dll:
0x88a314 CreateTransaction
0x88a318 RollbackTransaction
0x88a31c CommitTransaction
Library bcrypt.dll:
0x88a324 BCryptDecrypt
0x88a328 BCryptDestroyKey
0x88a338 BCryptSetProperty
Library CRYPT32.dll:
0x88a344 CryptUnprotectData
Library SHLWAPI.dll:
0x88a34c StrCmpNW
0x88a350 StrToIntA
0x88a354 StrStrIW
Library WINHTTP.dll:
0x88a35c WinHttpSendRequest
0x88a360 WinHttpConnect
0x88a368 WinHttpOpenRequest
0x88a36c WinHttpCloseHandle
0x88a370 WinHttpOpen
0x88a374 WinHttpSetOption
0x88a37c WinHttpReadData
Library gdiplus.dll:
0x88a384 GdiplusStartup
0x88a38c GdipFree
0x88a390 GdipDisposeImage
0x88a398 GdipAlloc
0x88a39c GdipCloneImage
0x88a3a4 GdiplusShutdown
0x88a3a8 GdipSaveImageToFile
Library WTSAPI32.dll:
0x88a3b0 WTSSendMessageW
Library KERNEL32.dll:
0x88a3b8 VirtualQuery
0x88a3c0 GetModuleHandleA
0x88a3c4 CreateEventA
0x88a3c8 GetModuleFileNameW
0x88a3cc LoadLibraryA
0x88a3d0 TerminateProcess
0x88a3d4 GetCurrentProcess
0x88a3dc Thread32First
0x88a3e0 GetCurrentProcessId
0x88a3e4 GetCurrentThreadId
0x88a3e8 OpenThread
0x88a3ec Thread32Next
0x88a3f0 CloseHandle
0x88a3f4 SuspendThread
0x88a3f8 ResumeThread
0x88a3fc WriteProcessMemory
0x88a400 GetSystemInfo
0x88a404 VirtualAlloc
0x88a408 VirtualProtect
0x88a40c VirtualFree
0x88a418 GetCurrentThread
0x88a420 Sleep
0x88a424 FreeLibrary
0x88a428 GetTickCount
0x88a434 GlobalFree
0x88a438 LocalAlloc
0x88a43c LocalFree
0x88a440 GetProcAddress
0x88a444 ExitProcess
0x88a458 GetModuleHandleW
0x88a45c LoadResource
0x88a460 MultiByteToWideChar
0x88a464 FindResourceExW
0x88a468 FindResourceExA
0x88a46c WideCharToMultiByte
0x88a470 GetThreadLocale
0x88a474 GetUserDefaultLCID
0x88a47c EnumResourceNamesA
0x88a480 EnumResourceNamesW
0x88a48c EnumResourceTypesA
0x88a490 EnumResourceTypesW
0x88a494 CreateFileW
0x88a498 LoadLibraryW
0x88a49c GetLastError
0x88a4a0 FlushFileBuffers
0x88a4a4 CreateFileA
0x88a4a8 WriteConsoleW
0x88a4ac GetConsoleOutputCP
0x88a4b0 WriteConsoleA
0x88a4b4 GetCommandLineA
0x88a4b8 RaiseException
0x88a4bc RtlUnwind
0x88a4c0 HeapFree
0x88a4c4 GetCPInfo
0x88a4d0 GetACP
0x88a4d4 GetOEMCP
0x88a4d8 IsValidCodePage
0x88a4dc TlsGetValue
0x88a4e0 TlsAlloc
0x88a4e4 TlsSetValue
0x88a4e8 TlsFree
0x88a4ec SetLastError
0x88a4f8 IsDebuggerPresent
0x88a4fc HeapAlloc
0x88a500 LCMapStringA
0x88a504 LCMapStringW
0x88a508 SetHandleCount
0x88a50c GetStdHandle
0x88a510 GetFileType
0x88a514 GetStartupInfoA
0x88a518 GetModuleFileNameA
0x88a52c HeapCreate
0x88a530 HeapDestroy
0x88a538 HeapReAlloc
0x88a53c GetStringTypeA
0x88a540 GetStringTypeW
0x88a544 GetLocaleInfoA
0x88a548 HeapSize
0x88a54c WriteFile
0x88a550 SetFilePointer
0x88a554 GetConsoleCP
0x88a558 GetConsoleMode
0x88a560 SetStdHandle
Library USER32.dll:
0x88a570 CharUpperBuffW
0x88a574 MessageBoxW
Library KERNEL32.dll:
0x88a57c LocalAlloc
0x88a580 LocalFree
0x88a584 GetModuleFileNameW
0x88a594 Sleep
0x88a598 ExitProcess
0x88a59c FreeLibrary
0x88a5a0 LoadLibraryA
0x88a5a4 GetModuleHandleA
0x88a5a8 GetProcAddress
Library USER32.dll:

!This program cannot be run in DOS mode.
`.rdata
@.data
Intel Co
`Intel Co
`Intel CoP
`.reloc
@.rsrc
1gsQ7Qx
b.qKnN
CompareStringW
n_Fe^X1
2K[45<
GetConsoleMode
ResumeThread
WD1<$@
[4!RD,h
"aD_Dr
%PrKnml
8fKnjM
uFs8Es
WriteConsoleW
.QtQ>q
1/3fsV
Kn"j'e
"sVN_r
SvMBuN
&qNk3
o4@eug
4:\3f8
(BrLi`~
1.HEMc
VCxa~[
`5svL"a
Br[~_~
&mNrOj
nTh`[`
)/Ds.D"Dq
_}X(Or1
BrGbG~
4{^`3fDa
IIgboQE
GetDeviceCaps
"oJALr
XDum.JDNi*
jO/2q=
au=DQrJ
Lqy7|v
"fCULr2
9=cF.m
Ez YB7Q!
'KbTX5
"CfjLr?
$foJ%Q
WD1<$@
;*Yhj#
g+M'6"
GQi6@&
ZFE&jA2
l*\W\-+
(fWr3]
4Pu%3f
4bG]'f
GetUserObjectInformationW
"CfuLr7
(fsV:]
p@rX}8|
(fPu?]
SO-F>>w
D1,$fD
KvFmWUk
~ -oQ4Q
mF}+M~J
U@fG(o
4E`S,frW
"E`?@r
JS8%KUk
z(aGJ/
6@9zgI
jA-5;H
-1{;*F
W,%4g+R
LDx6|C
a@<EQGK
7zuKD3
o9A5_>6
YUXDiR/
CredEnumerateW
BCryptDecrypt
.lI7(q
A9qjOm
GlobalFree
:ZN3
SRGgcU0
SS(?T$
n?Of?6
2>[)c7
)@jZRy:[8
CoUninitialize
3eSrBg-o
|Y}GD!
4_z#(f8
qc/<|t '
v~YB'w
yb$%Kn^
upu1Ew
Xt1BhsF
"Gb][r
4FcF,f
6,v472
;hU ja
giAo6`
lhP\o'
;rJEj{
wF-ph
lrOz\u8
-+6H5f
D1<$H#
ConvertSidToStringSidW
<Y!r(q
_HfjO:
b"-]f^|8
StrToIntA
Mr}XWq
7aD' q
&f_zXS
5'VU@3
GetEnvironmentStringsW
D1<$H3
4kN`:f
/\y25r
}aAxMf6
4|Yz:f
KD1,$@
d,,DJj
GetCurrentProcess
xt,msedMid
Pz*!gsv
zErOj2y
-fwR5X
D:@oG4M
O(HvJ3
GdipGetImageEncoders
"GboEr
"rWZAr
CreateFileW
"MhgEr
-fqT(X
Gy,dw~[
CharUpperBuffW
5]"qS3
SD2#QGD?
Ep?NK6
MAX;(
E(%JrFG
GetLocaleInfoA
I">eT)
!GCrhM
X2Y2=[x
"Tq5Ar
j8`]Hy
4SvQ+fDa
Ar}Xh}
4M-fVs
1RrLiyn
BWf=^*VSf
"kNnNr
>GI-m&
Rry\Mn
:fIlJO
=mq5G1
2fpUMG
!DkEw,D
EwUUSf
CredFree
^AYA]I
A$0KXd
TlsGetValue
@x{fE;
GetSystemMetrics
D1<$@2
sD1<$@
Jg9hf;
`0|!]Lxte
z-*'d]
P\gBn)s
{V`S.b
{cM,er
1gyW.c
>6P,e'
L&pTB*k
4lI>%fKn
CreateHardLinkW
yU3BuP
B03D^px
;Dwgb)D
78&f]x
v3q}XZ
SetHandleCount
GetStdHandle
D3qE`h
"NkCRr:
W<q:{
xZ\2Di
0Hdh2s
@w;DppL
"iL5@r
Da2y}Jo
oLQ}tQ
"Wr_Fr
ta=JDfJ
Yey9ib
IsValidCodePage
'K_ux5
'MKP[k
#9(< |
^{rJK=
TK$qH"
4 H.e1
fi]aX8
lj<^^?
%faDaP
4Hme9f
.x9fLi
-+6H53
bcrypt.dll
SelectObject
'KjX+5
PWD[K
.f:M[
(fX}M]
$b\Ya^
D1,$_fA
,*5QRi
N8qE`b
<@8qNkl
&Q0DRw;
tTTKNs
AKPMe8
Z hMKPC$
2|XBFc
k93DGQq
A?q`Em
VO-x.V
*%elf;
CryptAcquireContextA
5FrlI}z
1|.QUHr
TD@#WFD@
|BraD4~
WD1,$f
:8}oFs
"E`GFr
4|Y59f;
!P.fsV
*D/$w8DW
4Sv=.f
h|heX{
y8Y)~O
MultiByteToWideChar
9fgBqL
"@e'Br
P,1X`+F
mA9Y<H
}(u+M/
f@()VG_
KDlZ{C
xKMFhU
2tZv#ZQtF
DeleteObject
@D1<$f
Br_zX~
9f{^GL
{MrpU3q
6$vmA
BrnKH~
ShellExecuteA
gBQ%fx]
b-^D1t
PD")RBD9
f=+@H;
-5LM.k
GetTimeZoneInformation
W1,$fD
QrY|_m
]qTg>;
7Z%fmH
FlushFileBuffers
y1[2KY
9fY|(L
($wFciB
288_;:
k?q`EG
"FcmEr:%y
"kNfBr
8o.fz_
hYrhM e
4@e4*f
)q[~_)
GetDriveTypeA
ED\G:MD
SetEndOfFile
FdJ5D
4nK,(f
RW14$A
<o!^+~
g'x}4?
SvZ3q,
SetStdHandle
rWY?q-
X?qDat
HUbS'e:
KE`KCr
OrlIGs
/H>N}S4
A4C3Qv
i.K_<m3pc
NW14$f
G_T}wX#
^@2+Y7
z2\|+;
&3H3w:
4CfF0f<
a"EJaE@
E(=<fUz
^{u"&*v
6DUE">D
F"mH"Gr
Ar:U}
0A_A\H
FreeEnvironmentStringsW
gS8^"t
{GrE`3{
4Fcg8fqT
+f`Eq^
/fiLHZ
9^ 6>d
4Nkz,f
dczCDX
"sVlGr
0}a8[~
>5idVY*
"sVLOr
BnK5 D
GrjOP{
/fBgWZ
WD1,$fD
[s+n=w(
nkN!f;
=!oy@f
\M8P2{M
@8dNdd
nUg.Nk
"TqQOr0
D1<$A2
3l ${@
%<tD[3
4Pu<8fwR
-Il]*a9c
4IlU$f^{
sG=[~E
CreateDirectoryW
k4~Se
4`EQ)f/
D5ertB
GetLastError
x+voH,
4C.ReJ
.&S9)Q
cC+mSD\
#C7E-Kc
WD1<$fD
}RGdLN
ReadConsoleW
GdipDisposeImage
)lKa'-
vS1'Yct0
&BIl)Y|%IUn"
vRjkW)
BCryptDestroyKey
RegOpenKeyExA
U1q&ED
"aD`Cr-
vDrWr>x
]EM0t|sMx
:Mt%=~
BwK~C0dI_MLH
NX@e:2
phwA69
0%My@u#
<;*rFA
4uPh/frW
^6O)f;
D($qR&
GetCurrentProcessId
W1,$fD
H5]"qSf;
DeleteCriticalSection
4Qt)/f6
"Y|XPr%
;O/fy\
>Oo=Qt
c_\,E$
!?&p6
[;^jk<)
:J%7==
)`6v<EE
Csv.SW+
jmb8n0
WinHttpCloseHandle
(ffC}]
4QtW+f
[#%KY"
u#g#"@Fc
s6qOj_
4x]=#fOj
"}X.Hr
{^/>q4
{@rVs3|
+.WE~.?
~@rDa6|
(fDa1]
@5}cK+U
H$z@8%}
^w^8Gs
85*Rfw
MessageBoxW
#fdAxV
WrC/,G
&6D]hK;D
#DkzJ7DE=o
:Hr\yrt
flIuU
4DrfC|x
,f^{{Y
2biLGA
(f^{!]
TlsFree
4Yr'|4
(fpU9]
GetSystemTimeAsFileTime
KD#2n_DM
5zWO(J
wtimhv
${aELj!
[(D8\o/
GetTickCount
6le'#k
GetCommandLineW
CryptHashData
UhdOGi
E#M)eF^
Ext|tF
bHrgB*t
aDS%C;
(j9qjOF
"hM'@r
"Y|*@r
WD1,$fA
V&kOOVR
EnumResourceLanguagesA
=J/8DK
D1<$@"
6u8f*"
6@ZTB7
oFxCsi
"BaGZ$
f#Q%#7
4gB~ f
(09qz_
6\8wrR
&a_ha<xli
`EF#fOj
D1,$_Mc
?f}XEJ
v!V~J5j
9t}Oh}
q(L/v_
ntxp^s
_r^{Dc
7f^{CB
DNK>KlI
-tKrdA<w
GlobalAlloc
F2CRv54
{_KS*V
p^Z#@Y-
4rW" fmH
[D1<$f@
h@0I9I
x)|;H.
U-8He*O
NEeJ~B
cA!9SFV
A=8oOw
4[~=,f
gt|ucl
!F!FE:
-5LM.k
EnumResourceNamesW
gj(TK^
2-:#iK$J
D1,$_Mc
H8&Qqc
GetProcessWindowStation
D5(=kN
H.aFx)
uCiG$J
e*%5U-R
~Bx7NE
SF<DcAK
BCryptGenerateSymmetricKey
SHLWAPI.dll
$[AruP
y^D(ZT
k=O2?.
4CfR*f
"fe@SW
gSDd%@/
uBNMK"
GetModuleFileNameW
CreateDirectoryTransactedA
?FWD1<$_I
Fc@"ju
#X<|N6
66J-D~a
0N@D0
)fDaU\
jOq"vS
4qTf>f>
@A9`dS
oJ]e:w8
-fHmuX
%=jOa\
LCMapStringEx
5W:~ZA
Sv"7q,
4Svl"f
R<]xsA
po?O/h
AK^sa
6TkJK*;'
R+qhM~
BWD1,$
#*DALN'D
G#qtQk
D1,$I#
GetSystemWow64DirectoryW
9})j!m{
=6j{_b
=:6foJ
}IriL5u
!fiL2T
[Vc[n}
"y\+Ar
"foJ4W
GetProcessAffinityMask
UDMC3^D^
vh6fD)<u
4X}h!f
VD1,$f
1,$_Hc
^f%rUf
O,5ertBf
6ftQpC
Knz(k*
7=VrvSuj
DeleteCriticalSection
LoadLibraryA
H9b|fA
WD1,$D
JTDH7N
5W:~ZI
[75T'KoR
AreFileApisANSI
*fvSN_
EnumResourceNamesA
52b K,
Er:Jy
)aHN{zB
[~{V x
4[~j)f
4E`k/fRw
*fe@U_
&]47!*
['I{k >
GetLocalTime
8JMKZv
"SKwbn
FpY{rb*
T |{p?
`Czs+K4
0FMKxJ
A5.SKI^b
KNKX4-
9g)fcF
)f=$?f;
*3)>f5
GDI32.dll
aya>Q~
L}%M|zR
~nVW9E
FlushFileBuffers
GetUserObjectInformationW
En,6tFG
oFTEi
@kJ-)f]F
"iL@^r
-D6-x%DN3U#D,
4Da,)f
WinHttpSendRequest
wK>hl,V
VnUJfi"
wre|T2
^Sgi<[
emFAF^
r4q\y^
FindFirstFileExW
#]s`Ja
}b)j+#
>)DBIl
E32=D_
LeaveCriticalSection
"sV&Jr
"fOjiW
Dphg>3
3n20,
&sb5D?
EnumDisplayDevicesA
[-<Yg+
A=^uJN
5&Jv$]
jru";{
6samgz
v4n qC
Lw !|pW
asdRQt
);pmFXHDy
jZqOrn.
4hM|!f
&yYrgB1e
1fGb6D
"DaeDr0
A;qLim
~ALNgQ
f=gqf+
"RwoFr
4Jo.)f}X
\Ohrt8
\Dm=of)
/f<qMhJ
Cq?-\q
3AQ,c
Gg3QDg
"@e(Br
Ee9wP1
J$P6aG
f?:JKq[
:M]t;&V]
dx,h5q
8y8'ip
B}ykrz
GetStringTypeW
YnvXA:
WD1<$fA
~/]8/&
".Iws'
CBU9sE"
CAv/D6
u.LHE);
Y7Dyo4:D
4tQt.fkN
ZKT&D1
InterlockedIncrement
rPOCl9
JCnVKI
(\fG$K
4Qtp,f
'b;u]x
WnUxgd
5|A|J^
4wok;(x
dLy4W\
xIrCf0u
%Mh=[Fz
UrFcSi
=fvSTH
]rnKBa
5ffCE@
4uPw*fJo
lFIjhj
Ea.>xF
X}-!fgB
c4qGbO
h7qMhD
4hM&.f
hQMhLIgM(V
r;(MD\
WTSSendMessageW
D7[o=wR
3A=]x
_FcwIr
3C]rbG
"oJA]r
SetProcessAffinityMask
*a}k{h
v`i$'i
}axTMf
Pe<'`bK
d(h<c_
CoTaskMemFree
c15$NE
DK S[f'{e&
pADc+_6
v*E:4KgQ
qONWUci
*1E##(
sZzD+
I@DY.2|[
mj7GSn%
u-6jZk
8usRGLx^A
xo1{qi
S:N[(n
Cc"nD(
Phfve
-K<Jbw1z
>Ds|L`Ru>
!:%\V4
pT,4c$%
/HZ5L-
hSkTZB
c[sWpmVH8<
vyS8CVku$h3]
oz{l6S
akTen
dhm<OH
X6E+v;
KbrR6;
RUn2ve
NkYSwS1
F:7vthgu=BF'x]
zT"jo/j
*'adOuP
+9j`9HM
u4Zt@x
:Q0Xs
&x5V!N
)?5Dvp
);+DyN
\-X_.S
lZ'im*q#
|9<BFh
;Y[k.<)
]rx!8~
h@>uI<
J&||fN
x:kwbQp
R!O',L
/)hO`"QD
0Pklq[
lM;LCQG
am#N%>u
"g(F$(H
PLGrrp
AplzvY
tW'FK!
a{+&W!
rr2NUq|*F
1)*Db.
-c63_i
N-P\"}
`66lbC2
x+:WAA
bpuCK=
2+rKCD
|Rs'vM
}U.>b\$m\
+NkEn{+
r~(%U(
Y[8RmD
Mvk\C[
Pfy.&>I
lL(be7
{iRO#u
ua!hSH
%Y75l_
EiLOqk
/+7Iu}
}_b}'J
Bgu$MZz
hb_Dp4
JJq(;)
W1,$Ic
GetDateFormatW
65]vI3
L1JT|6=
q\BU U
z]S%JZ$
i?!`:z
f\rvS.`
WOJP^{
?|d)O
"y\D@r=
4^{D+f1
XDeu"PD
4^{ +fY|
UBgV+q
ND5DVZD
GlobalMemoryStatusEx
WD1<$@
TerminateProcess
5ertBf
7KNx%
IlV{iJ:
u9fCqXr
)LrAdap
D$ya)rW
KGbEAr
-aD}O6>
KQ/sCn
~Zcu=
WF='3q
`ySm3D
nwrekH
4,-6e2>
4:x;f@e
m"|QEi
JV|re1
"fBgJW
}CfvmrW|
e@pS\ab.
T#HD8Nk
ktmw32.dll
"TqEDr
u^<6[~e\
4Nke/f1
"`EmLr
.OP7\k
WD1<$_
SaveDC
EnumSystemLocalesW
4X}$'fOj
>9%W2x
OnAXK*
-K)FKq
YD\wYKD
v5qwRZ
4^{('f
EnterCriticalSection
;pk#1'
6.')}7
SetLastError
idl!Kh
-H`$j3
LoadLibraryExW
f5qkNJ
_]0?HE]
gjR/KzN
t>]$8}
CreateProcessWithTokenW
'fUpgR
'>HrnKvt
GetConsoleCP
-H`$j;
[l2(LKh
0b^NK"
^Wl-K[k
H+MSS@~
cf{>|C
xG^K43
N\eK,`9
D:@A=$
4iL~$ffC
HrjOHt
J=_zpv
[r[~Pg
3fSvWF
SrqTLo
H0<<fD
VD1<$@
QMmuxP6
Y|ISEVZ~!
tHrQt<t
xHr}X0t
WD1<$fA+
HF$BSM
d`AR\H@Z
StrStrIW
GetEnvironmentStrings
GetFileInformationByHandle
&k?0[K
ub[Np46
Pww{~OC
RA_-KIu
/JFB[B
4Pu^$fgB
"bGXHr
4~[($fiL
W9qY|{
9L1s|D
WF)!OG1
5'VU@3
CryptDestroyHash
?u$BV`
]m<^vqo
RtlUnwind
x40}]x
!fQtLT
eZNR4S
X7FSh01
n[_"^\(
P[k7\G
jsS$mC
SetFilePointerEx
*%%)($
&o=PO?
L2_zt6
$E=Y|l9
%fuP)P
cXrE`OWA]
G'qIlk
Do5,"~[
]BdAQ3
WAZDxW
_PK{oW<
Q_43V(
TlsAlloc
W4qe@{
|P$RDj
KD,boFD
AYA]fD
CreateTransaction
HApcK/!
g!b, f
8K|EJj
K"&^~+
vf'MEh
LoadResource
4kN+2fdA
Jo^,fUp
(M}Up|`EQ
"jOZMr
hI}d6jg%
Q<}Q ?fy
Yz2BHl]1t"
&fX}iS
}X|0q"
4uP2%f
'N#O:o
QY0yaKr
*+8q@e
4Gbe-f
yD/ywM
}<+rw!P
4nKB%fQt
(IrdA`u
U a:1
]DtTHUD$
[D/_7ID,C3
RrOjZn
"Y|jFr
=IwQbq
4uPJ-f
4@eK-f/
hM(tn#
2fx]GG
Process32FirstW
{,93|v
}:W-
4uPF-f
SvRkA1
j$*lmH3_(
"/}1:M!s
7+<M@my&
k_1ka9
nF2K5*
}'\NMU
9`ce!(
tIrLi<u
"kNhNr
k4q_zG
4X}%!fgB
@PguNm
}F>dWV
Fe)vF4
FP\svW+
QH<*V?
~(@GyKn
Mh:.fJo
mHt;q"
GetStringTypeW
3T,6Z%
4cF;#ftQ
RtlUnwind
-b;S}5q
v{E,KeS
*[4K.*
\h=lBk
jML8s7
G7RHKK\
m{=A6^
g>g.oR
<}rW,`
"f`EGW
&fvSwS
"{^:Hr
rPS4BW$
b9F30
D<JEt;=
HeapFree
wL%MDrM
OMLApJ]
jGVMX`
(0a*6u
WPzn^M? hw
Nbz,A2
Hr`ETt
0GE!D?rb*D
@8u|p?
!Ti2p]
}U}},\
[P(~kW_
Q<17VK
-fQt`X
GcGDbK
1)7!)s
4~[z%f
^D;ulSDY
[D1<$@
1,$_Hc
X[i`Eu
I)JCt<
55LM.k
"Il^Fr
]pUo%8B
-JoEDr
Ny,_T'
{:}TcH{
6NraD~r
;TfYD/
KWD1,$@
`Ek,q7
FQDo/c
4Vs[-fAd
~$qKnR
4lI01fkN
Rw|J)r
('S=RwH
eUpQt
"nKsJr
"fJo<W
a8d1,$_
!f='&3
pR\/w%
GetModuleHandleA
BCryptOpenAlgorithmProvider
uPpny
$QrIllm
4Jos.f
F"VG~x
,QrWrdm
kErqT#y
-faD$X
!}[~6&
1fpU@D
Qr^{Ym
9fvS^L
euIeg(
l#B-R@q
ReadFile
CryptGetHashParam
D1<$_Mc
,qkNZ#
5d$ViN\
AK+M|d
/VNZNzb
ji1s;`
6h%<ga
Lldp|k
uVn2|{+
d.UOOe
4VsT"f
MultiByteToWideChar
6q/O5n3
SystemTimeToFileTime
GetConsoleMode
-frWYX
*x;qpUT
%F7qWrj
"wRFMr
p~K7_Z
\86&LqK
p1 O@6W
<YxrmP
`Xl=1Q
]5d<m2
F]9>vZN
\-q*[Z
kY}M[^
H5]"qS
P<?-R]
OjU8q8
>}pUz
=}-A]f
&2]c>/
!8Y6f;
4bG]8f%
J-v]0N
4rW8,f
Ze\9jb+
dHv6c?
,GraDd{
Ad.,fNk
6-1qtQ
'fQt;R
SystemTimeToFileTime
cfH.d
G{A'ej
7CJee^
(8}*e)
"|Y}Or
D1<$_@:
B,Pn{y
U<~]DNs
<Z(7Mc
=IeNUb
-"rWIGr>
v+Y$1&
'f@e;R
vIrLi>u
nBqD0H
"LipOr
sIrfC;u
Ml9'RL
RCG}=M
E^`l`F
I%lq[
E 06~F
fO|LfE
zF0{jb
F6qwRj
nMD$'Di
>y6qtQU
xlJF;5
uL1wY
4_z $f(
"aDVOr
V1YtrO
WD1,$f
"|YzKr0
n-qPuB
4Wr 8f
WMR*xpM
|2qFcP
%LrMhmp
$fE`jQ
q2qWr]
4hM?'fOj
a5Cu%{
lstrcpyW
4}X%'fbG
.u,fdA
Cf;9q,
D1<$I3
"x]9Xr,
0fdAvE
3RhM`%4
dADz<CJD
_D/v/KD
5'VU@;
eb-VK@`
ll#KPR
M&F0'=
5'VU@f
;7f5Md
:DE`'
`Sv7r|
F(S(/m
LCMapStringA
pK_7Li7
5R=qT#y
wRO,fHm
-VhQD:
IsValidCodePage
LocalFree
WaitForSingleObject
D1<$Ic
=d}8d1
A-+6H5f
F_k,KiG
4skjez
csnUSt
Nw*&~p]
v>i"qI
wu\x~p
qPrFc9l
yKrrW1w
A0.e@W
0fNk.E
8flI0M
lstrlenA
Dre@Px
,fUpWY
1r~8bG
l.Oj^x
3+T1nd
D1,$_Mc
m.0:|l
yHP<IO'
z0s>>!a$
E`wYUu]
GetThreadLocale
UnmapViewOfFile
W1,$_fE
N]<3aT]
?oKl`Z
8*i=5".
!|eKqRN
V/VH}<
N4.z3W
dD1,$_E:
LdqR9E
)\yxsh
fBI eS
CloseHandle
{54RW@
=9>'Dq1
"AdbHr
GetComputerNameA
HraDBt
zX}t>J
X7[s*;8
dPZ}t,t
D1<$I3
;6R\j?
[Z]6\-
l6Wc\1
cmbV2l
E#&/uG^#
::<~t.
veCK89)
tCK@nj
DE{S3CC
63G/K-
WMKgoq
Fp']QV
.1]K:l
`"qpUL
u!^|zt
`EQ=uu@
v*qnKZ
az_@0s
j{N0Z|9
5W:~ZH;
zCD1,$@
HeapSize
WD1<$@
1LrBgyp
)_rNkac
7f~[fB
?fTqxJ
*grTKf
4Kn`(flI
',=qe@
,Kr~[dw
#fVscV
hRq@9[
x;=2H<J
U?yAe8
NW$C~PS
cS`0ST
q+\!\5
a5qe@M
4rW/ f-
I^DY$$SDX
RestoreDC
{tYrKs.
GetModuleHandleW
h|"fCS
WD1<$_Mc
jOVQia
+D52Dl
!D~["'D
<j fvS
buh+KsM
sVgFq*
&ZK|ij
XmKw!_
|85x-1
9!7q0
AU=yqRJ
T)6-S^
Z=`{j:
LocalFree
Wr,+f`E
/ IcD(
ZAMj(j
)M"6/{M
N7/L72
b*WD]gP
[~q=q,
nKJL?B
S&BMc!5
HNOxIh
eJ[<UM,
WD1<$H
CreateSymbolicLinkW
{M QOW
4^2TLM}
LMbL-fM
vJM{GW|MG
q;SM[s
zsbOJt
v2s;qE
Ww&<gpQ
+fmHx^
$qRw=E
'QS/Qb:
OpenThread
v~!jO<
d?q|YH
4Sv**flI
6n'Pf;
="_gL;
(IAn#h
E"U`u^KI
f=%Af#
)f^{H\
4z_G>fMh
GetUserDefaultLCID
VirtualQuery
4X}8*f/
Il9>|4Q
2AD2IFLD
FindNextFileW
UnhandledExceptionFilter
4|Ya"f
=$MrdAlq
RegEnumKeyExW
:}Gb!{#
2=Dqlz
"oJyIr#
!fcF6T
nafCV[
IrVsGu
!fnK@T
?]*)L%]
[1PAK}z
&$N[M4
FcBKDc
DeviceIoControl
^W=JoN;wV
4hM}*f
]sV$Xb_
!fdA%T
XCs hD
e.{!4'
9/onh&
uG7SE@@
n/jQ^(
*:m/-M
C+."s,Y
<n^DS#K
6WIrwRu
AjiDD<
N2H^Dj7oUD
M<k8};
,Pwv}Y
pQc9!X
`8/KP?X
{PrIKW
VT6:fSA
U"u:RU
5nSj_8
/^rAdgb
6fiL`C
":6Vr
4NaLiy
ck%`7}
/~3 .
1,$_Hc
D1<$_fD
/s^tS{
SetFilePointer
#~a|rw
t~dCDy
Yz 0i}W
D|gy.u
rDMNm1
"fwRGW
CryptCreateHash
GetUserDefaultLCID
\5Cftu
3d-'D|A
4D6j\?D
,<qVs3
i?qNkE
DuplicateTokenEx
Y[ -dN
GetEnvironmentVariableA
"Mhj^r
6faD%C
@\8D';,
D+F_}bG
H}x]m
4Gb")f`E
4Up"%f
][Zq&[K
'6c(Kb:
I]O@jS]
OpenProcess
f8Nk4*q
_xQD@u
#%bhd=
9~Bg6Je
GetSystemInfo
WD1,$_
]]DDX[
d][fS[
\UX6Ko
|Hd]{,
hLM#_IzM3
"Nk[^r
IlTE"%
}e@Z?/RpM
"LiIMr0
f}:wAzxE
EO`i~$]jvG
u(3xwM
"vq76'
1LraDyp
LLpx|K
- l6|)
q!xy (
W$-zg#Z
%95;"N
V]#Rz
==Jk0O-
+KeS89
mKUSz
5W:~ZL;
)fBgj\
"Pu$Br
h%\WD1<$@
vF4M82
";67wp
LocalFree
*fSvx_
nDl$CfD'
L{VU||!
"TqLBr
1Z(qsVv
+$<qiL
ccH:/]
y\rS)Y
4Ilb)f
|Y3\<,
"hMrLr
Pe_zW@
`[JB e<V
v>Av\.x
_uNSpY
,b@~A|
i3o5f;
hBroJ ~
V`4`Kk
)Rj*>v
;=jAUd
H%-z,u
'JrAdov
G!^h=G
4HmY)fOj
"QtuBr
1K!vf;
(7;0-x
CryptUnprotectData
~D1<$@
EVu*lFd3coF
5oN)/ mDf
4Gba&f
M_D/Z`YD5
4pUT"f
"MhRFr
4_zI$f`E
"Oj Nr#
s:\ugB:
PXLixA!V
4Qt!"fNk
FreeLibrary
dFRE7b
WpoJ.h
<plIy\{
t).Ojc
)\=}Bgoxaa
5fCfG@
DPxwd%,
GetModuleFileNameA
D1,$_f
dAr}X,}
)fmH+\
4Y|j$fvS
Z]IE`OX0
:D-&W2D
]rbGSa
"WruAr
)fsV:\
jP_U0%
!fwR,T
Qtm<q.
L|.D?Px
a?qgBM
4x]/*fOj
"X}qIr
S\?D[x#2D?
D1<$@2
HeapCreate
}?q:Q
4e@3*f2
ArdA]}
)ftQZ\
AZ<f@H%
@?q{^l
WD1<$H
GetStdHandle
mD1,$_
LDd12GD
^FD$4{
DeleteFileA
4rW-$f]x
BCryptSetProperty
SHELL32.dll
kN\c{Y
(fvSC]
HeapReAlloc
DeleteDC
D1<$_A
zi1TDov
4Hmu<f'
d'Y#5.
8&Mli/
YJQ"iM&
KEm5L2
o&HS_!?
'fNkkR
yKrsV1w
GetProcAddress
EDNijF
JTR9M#
4'\Se.
c'YlS .
C9TCK]B
QD1<$@
0 :Vf;
4_zv4f
4zMrmH2q
%fMh5P
sdZ?DL0
[M*D7A
N0D-j
-aE-H`$j3
,t6K>2
TerminateProcess
-+6H53
1,$_Hc
O)qx]c
C)q|Yo
aKr:)w
WD1,$H
{S,]Sv
4Nk&4f
FDFAe^D
"\yLKr
wsprintfW
WD1,$H
GetVersionExW
zi=^{!
OY?QDu
,Y%fNk
$,zbvS
WinHttpSetOption
"Gb#\r
=Try\uh
<fAdrI
M]OLrW]
^IX0KWa
#i%4{8
R-F>>w
OpenMutexA
Nn1}~iF
o%2"hR
"Oji@r
]dAGsd
Z6qHmv
uP<Eg;
OrtQ^s
f~[KU
{Z.?e@
7DS8~?D[&S9D
4NkD+f)
I&iJ9'
2a$HqC
/Edsf;
KERNEL32.dll
O,5ertB
KfR9~F'
A!6aN3
c=q[~O
"gBf\r
);}WrL
GetCPInfo
TrBg7h
&jG@'=
RaiseException
"x]tHr
fDa;U
v+Y0P;
:+r+]q
U=/`46
OD]su0aq(
S-:Ro
%|jEkrPwE}
L2q@e`
-&@rdAn|
JoZ=q-
GDYBEOD
:SD95>
Y|S>q>
Q2qx]}
=2Rh2H
]-f<!?
+;e/j
K7\AK 6j
;T*ddiE-&d
RaiseException
"+4xEx
u9ZmTt
D3n`EZ
$DOaX/D
5"DV)y
o<+Da'Q&D{
>D,UP*D)
URM Di
@|$DSLx
;,;^Dd$
bGW2}1
oJ2Dg+
DecodePointer
CreateToolhelp32Snapshot
\Jb*T]
)B5<&C
W(dRD@\
_3DFhx8D
^{B<}%
WHDd1zND=
gH_V6A
Z%WWj"
lIN&\N9
GetFileSizeEx
WinHttpReceiveResponse
*H^b{A
vIJ-'@
%Vc'"!
K$B,{#5
PL.`Kh
}H[]MO,
vVD%8z
{D=D5E
;D,L-$
n/DjdI$D
<DR{q(Dgn
84aODLx
KvZDGa>
MhN)F7
j\D:'"
TD X8FD;|<
M#1D#c
Hm 2}3
GetLogicalDriveStringsA
LCMapStringW
Z1,$L;
EOy8aj
lstrlenW
"jMa}
nZPeat
d9CSdl
ctep4Vrx
VC2Dq*
0|E/DdYb$D
5'VU@3
BD"9&JDz7
HeapFree
+I7}}X
?D6+<9DG1t
S]WrUC
+0g[D\6
8$D=]z
qTu7}2
U(%DJb
f\qA -
QueryPerformanceCounter
XH-Upu
Il[W4Sv
POV/Dgw
;D6DD#
EncodePointer
wd-~[N
p}9D.V
~>DD)6
zgw3DHY
oEDl`
Mh{ZA/
wRC%[]
!T Dy]
{wyOKp
Vs=<ftJ
r)s:u^
aDvg4?
\*,DG4"=D
#DJq9+D
jF7D*VJ5Df;
BU&w+J
:D~mFt
mBfC]=
LS?DRJ
!F!FM;
5&.7Dm
l-D?/I
AXA^Lc
KoQ1bJ
KhO"az
]*#pS[
=DDm^)D
Q4xQ9D
91D`}q
-5LM.k
<D2"x4DB
*D"b#8D
*D?gu"D$iX$D
=)D6qq
@?02Dg/
OpenProcessToken
*7[fhMg
0DV`%6D
Cu=D},
"&k-D-
;D^xf6D
'5D%8o
=DL/u/D?
GetSystemInfo
SetCurrentDirectoryW
;v=}e@
U5}]KD
EDeN"WD
Zf$DueC
,DkP`$D
*DpC8DC
o_NVDg
oo7JK!}PP
Esl'HW
WD1,$@
9D8xr1D{V_7D
72DyLZ?DcL
d&Do (
>D[*e*DV
,Y75P-
:F>}aD
I,Dj-M
<;4\D`
aND_QFED
mH=D<9H
JD~uoXD&Yk
RegQueryValueExW
nK([5-
)Dqz0!D9t
\D[`sTD
{B,c[b
-d3;2#
5ADxu}
4D=p}Pm
CloseHandle
p_O*WfA
tm\T:kF
-TT\Nph
St3Buz)
.[=0{9
:m$DV<
Pt6Y|#d
D:*Fq
8;5}Nk
;D;E!0D;
\3D{<X
GWD1<$fD
.+D'Bf
'spjQs
oF}Izw4{`
aR{d\lU9d
lstrcatW
ijYn(&
gPoAi:b
N]wRKL
VD'$&^D
YBDD3]
ZDr:(RD
\DqQWNDA
LoadLibraryW
]-6D~c
Tq\1}7
f.De{A%D
,(Dok`
0DXI-$Dv
KO$Zsim0
3>2%4I
I2*}y5]
(^63yW
t_"|%V
l!S(UO
E2q%DY
{G?]Vs
Ojr1}4
CTND{53
o]NDg+
"cvUkI0J
Rm0D6<
*Dab98D
=ZNIDB
kMx9D`
<KxYtXJGm
T*QD<Y
xa*7?Z-6
<fC#U4Da
%DoI-D
7sD=B.
84"}vS
k$''D_
z+!&dJM
;KaDt_J6h
?1<KsBJXJ
(xD<{6I1
(9KApS]J
X S7hT
6DP@y>D
5*RADH
njU(DBR
5>D!\X3DCT
8Dg)b5D
&3'[Q7
D*Aj90
K;D#el0D{5
GetCurrentDirectoryA
;xkD|4
=m8FA0
ePe9DL
WideCharToMultiByte
uTd)e|{
CreateFileA
SetStdHandle
~D1<$_
SHGetSpecialFolderPathW
SetThreadAffinityMask
=|dE2<
USERENV.dll
\J"ru]
[9J01;-
$FU{|~?
CopyFileTransactedA
,TEed,t
d/we{W\
;a/DY0
(D*Sp0DB
wtGbS|
-y>gwAi
C~~#Bf
%6nx9e
0D7dl8D4
akO*nL
#@rWD%
+-D=PF D?p
~K;D&n
5)6pX?DJ
R-%=Df
KLiNN4
P'DDJw,D
GetOEMCP
m[j&"2
EFfdxHA$d
<;la}p
N-D<A# D
8D1,$f
EQ!zN'
2=;;D%
%Dc:p1D
IV|&D~n
>Dbr\,D"
,DC@u>D
]VWYQ[f
KaCTgJ
}O;?\)D
<pw7Dk
'D}N@/DM`m)D
31DBy%x:w
"V5DN8
9vC]ofKQ]9
Kv ^gJT
RcXny<t
#D*Ej/D
!1b(Dl
deA&qc
-b;S}5q
teJRd&`
`7h*%?
WD1,$_Mc
,0JMh_
>v8Dr4>
2DNV> Dv
'e7D(J
;D$4<3D
@f=+y;
y%AG}(~:'
rAUDZ&
FindResourceExW
.KL@[*
`n41E8
'D!TY-
1DnNS#DMZW
CreateToolhelp32Snapshot
myW)"Dj
7D\%E#D
}k=DS%
HeapDestroy
TOfLzvm.
GetProcessWindowStation
gdiplus.dll
={^XgT
D!}k}rW
fCbxJ$V-
#DN+j.D4#&
=:#-Da
H5]"qS
f}>Ffg
}|<x5,wo
GetModuleHandleExW
5'VU@f
GD"@j0
4DijG<D
;Pi9De
KzW]~z
l` Y=i
JeuZzb
ga1)WfF
GetCommandLineA
,,{MD(
(GAWDOzf\D
_2A;D}<
GetModuleFileNameW
.!m97`
GEBX}`
`;z_zC
vSO7*U0/
5D9vz-D3
a.I7sO
;JP0_n
GdipGetImageEncodersSize
3z.~f;
R~J:u;
GetUserProfileDirectoryA
^AYA]I
;9z<^=[W
aD*W4Kn
"e!$D}U
}Xq_4wR
GetWindowRect
&00S>b
J&[,O<
R!JX[`
eJMHR,
ZJg="[
'6/2.p3{(]S
%3MS>i
4Dy1+<D
2\E9oG
fG+D&h
9^F1De
*!YD%k
lQ@$D-
VY)"DB
2DT*79DtZZ4D
2De#E#D
iL-DPp
A6D~pf=D
WD1<$f
HeapAlloc
8amf"2
iqxa6(
GetCommandLineA
{&?DwQn
t%DM:p
E>K_f>ZJ<z
@KfAk-J)
(svuDL-
\;KlI'_J
n4D. I?DM
:D4D82D
s'DxnT,D
T)196_
nhT,
UyJVNP
8D?J0DO
>DTt5,D
5)o=sf
Nkv3}5
QWEUCv
-D.r].Dk
1D4Qe<D
@e;@4Rw
0DDe"D
:j0)h:
_!Ab/ 2
0?DKG4
]MeYTE
@xx] `
8haJA
D1,$f;
rZ`KA;
s8D+]T3D
$ynX_zY
e D]*a
J_0V,D
"Dr!70D
;b7Wj
qUPSAhy/
v|"bd'ww
<6S^+x
H6xo0@
WD1<$A
?'4}Qt
3/BePF
Q;3DIt
ff_{Va(
nV%nAp
"D9Ri*D
Y9D5X44DT
pATAWAS
'Ja:7Q
&&a/e^
]KYI>}
XJ)slY
p9-(<Z
Antivirus Signature
Bkav W32.AIDetect.malware1
Lionic Clean
Elastic malicious (high confidence)
DrWeb Clean
ClamAV Clean
FireEye Generic.mg.82f7734fef8ee078
CAT-QuickHeal Clean
ALYac Clean
Cylance Unsafe
Zillya Clean
Sangfor Trojan.Win32.Save.a
K7AntiVirus Clean
BitDefender Clean
K7GW Clean
CrowdStrike Clean
BitDefenderTheta Gen:NN.ZexaF.34170.@J0@a8Tq9imO
Cyren Clean
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Spy.Raccoon.C
Zoner Clean
TrendMicro-HouseCall Clean
Paloalto Clean
Cynet Clean
Kaspersky Clean
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Clean
Rising Trojan.Generic@ML.88 (RDML:kTtX7Zdkgx89dASZ/T5Vig)
Ad-Aware Clean
Sophos Generic ML PUA (PUA)
Comodo Clean
F-Secure Clean
Baidu Clean
VIPRE Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Generic.rc
CMC Clean
Emsisoft Clean
Ikarus Clean
GData Clean
Jiangmin Clean
Webroot Clean
Avira Clean
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Trojan.Heur!.02214421
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Sabsik.FL.B!ml
TACHYON Clean
AhnLab-V3 Clean
Acronis Clean
McAfee Clean
MAX Clean
VBA32 Clean
Malwarebytes Clean
Panda Clean
APEX Malicious
Tencent Clean
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Clean
Fortinet Clean
Cybereason malicious.c72f88
Avast Clean
No IRMA results available.