Static | ZeroBOX

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
.text	0x00001000	0x00006897	0x00006a00	6.45839821493
.rdata	0x00008000	0x000014a6	0x00001600	5.02410928126
.data	0x0000a000	0x0002b018	0x00000600	4.15458210409
.ndata	0x00036000	0x00010000	0x00000000	0.0
.rsrc	0x00046000	0x0010c946	0x0010ca00	4.81516422097

Name	Offset	Size	Language	Sub-language	File type
RT_ICON	0x0004a7c8	0x00000330	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_ICON	0x0004a7c8	0x00000330	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_ICON	0x0004a7c8	0x00000330	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_ICON	0x0004a7c8	0x00000330	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_ICON	0x0004a7c8	0x00000330	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_ICON	0x0004a7c8	0x00000330	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_ICON	0x0004a7c8	0x00000330	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_ICON	0x0004a7c8	0x00000330	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_ICON	0x0004a7c8	0x00000330	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_ICON	0x0004a7c8	0x00000330	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_ICON	0x0004a7c8	0x00000330	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_ICON	0x0004a7c8	0x00000330	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_ICON	0x0004a7c8	0x00000330	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_ICON	0x0004a7c8	0x00000330	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_ICON	0x0004a7c8	0x00000330	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_DIALOG	0x0004ad14	0x00000060	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_DIALOG	0x0004ad14	0x00000060	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_DIALOG	0x0004ad14	0x00000060	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_STRING	0x0004b760	0x000000b0	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_STRING	0x0004b760	0x000000b0	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_STRING	0x0004b760	0x000000b0	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_STRING	0x0004b760	0x000000b0	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_STRING	0x0004b760	0x000000b0	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_STRING	0x0004b760	0x000000b0	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_RCDATA	0x00152210	0x0000002c	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_RCDATA	0x00152210	0x0000002c	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_GROUP_ICON	0x00152318	0x00000014	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_GROUP_ICON	0x00152318	0x00000014	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_GROUP_ICON	0x00152318	0x00000014	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_GROUP_ICON	0x00152318	0x00000014	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_VERSION	0x0015232c	0x000002dc	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_MANIFEST	0x00152608	0x0000033e	LANG_ENGLISH	SUBLANG_ENGLISH_US	XML 1.0 document, ASCII text, with very long lines, with no line terminators

!This program cannot be run in DOS mode.

`.rdata

@.data

.ndata

s495,OC

Y;=,OC

Instu`

softuW

NulluN

j@Vh OC

SVWj _3

Vj%SSS

D$$+D$

D$,+D$$P

WWWWjn

\u f9O

90u'AAf

HtVHtHH

UXTHEME

USERENV

SETUPAPI

APPHELP

PROPSYS

DWMAPI

CRYPTBASE

OLEACC

CLBCATQ

NTMARTA

RichEd32

RichEd20

RegEnumValueW

RegEnumKeyW

RegQueryValueExW

RegSetValueExW

RegCloseKey

RegDeleteValueW

RegDeleteKeyW

AdjustTokenPrivileges

LookupPrivilegeValueW

OpenProcessToken

SetFileSecurityW

RegOpenKeyExW

RegCreateKeyExW

ADVAPI32.dll

SHFileOperationW

SHGetFileInfoW

SHBrowseForFolderW

SHGetPathFromIDListW

ShellExecuteExW

SHGetSpecialFolderLocation

SHELL32.dll

CoTaskMemFree

IIDFromString

CoCreateInstance

OleUninitialize

OleInitialize

ole32.dll

ImageList_Destroy

ImageList_AddMasked

ImageList_Create

COMCTL32.dll

EndPaint

DrawTextW

FillRect

GetClientRect

BeginPaint

DefWindowProcW

SendMessageW

InvalidateRect

EnableWindow

ReleaseDC

LoadImageW

SetWindowLongW

GetDlgItem

IsWindow

FindWindowExW

SendMessageTimeoutW

wsprintfW

ShowWindow

SetForegroundWindow

PostQuitMessage

SetWindowTextW

SetTimer

CreateDialogParamW

DestroyWindow

ExitWindowsEx

CharNextW

DialogBoxParamW

GetClassInfoW

CreateWindowExW

SystemParametersInfoW

RegisterClassW

EndDialog

ScreenToClient

GetWindowRect

EnableMenuItem

GetSystemMenu

SetClassLongW

IsWindowEnabled

GetWindowLongW

SetWindowPos

GetSysColor

SetCursor

LoadCursorW

CheckDlgButton

GetMessagePos

CallWindowProcW

IsWindowVisible

CloseClipboard

SetClipboardData

EmptyClipboard

OpenClipboard

TrackPopupMenu

AppendMenuW

CreatePopupMenu

GetSystemMetrics

SetDlgItemTextW

GetDlgItemTextW

MessageBoxIndirectW

CharPrevW

CharNextA

wsprintfA

DispatchMessageW

PeekMessageW

USER32.dll

SelectObject

SetTextColor

SetBkMode

CreateFontIndirectW

CreateBrushIndirect

DeleteObject

GetDeviceCaps

SetBkColor

GDI32.dll

MulDiv

DeleteFileW

FindFirstFileW

FindNextFileW

FindClose

SetFilePointer

ReadFile

MultiByteToWideChar

lstrlenA

GetPrivateProfileStringW

WritePrivateProfileStringW

FreeLibrary

LoadLibraryExW

GetModuleHandleW

GlobalAlloc

GlobalFree

ExpandEnvironmentStringsW

lstrcmpW

lstrcmpiW

CloseHandle

SetFileTime

CompareFileTime

SearchPathW

GetShortPathNameW

GetFullPathNameW

MoveFileW

SetCurrentDirectoryW

GetFileAttributesW

SetFileAttributesW

GetTickCount

GetFileSize

GetModuleFileNameW

GetCurrentProcess

ExitProcess

CopyFileW

SetEnvironmentVariableW

GetWindowsDirectoryW

GetTempPathW

GetCommandLineW

GetVersionExW

SetErrorMode

lstrlenW

lstrcpynW

WideCharToMultiByte

GetDiskFreeSpaceW

GlobalUnlock

GlobalLock

CreateThread

GetLastError

CreateDirectoryW

CreateProcessW

RemoveDirectoryW

lstrcmpiA

CreateFileW

GetTempFileNameW

WriteFile

lstrcpyA

MoveFileExW

lstrcatW

GetSystemDirectoryW

GetProcAddress

GetModuleHandleA

GetExitCodeProcess

WaitForSingleObject

KERNEL32.dll

VerQueryValueW

GetFileVersionInfoW

GetFileVersionInfoSizeW

VERSION

SHGetFolderPathW

SHFOLDER

SHAutoComplete

SHLWAPI

SHGetKnownFolderPath

SHELL32

InitiateShutdownW

RegDeleteKeyExW

ADVAPI32

GetUserDefaultUILanguage

GetDiskFreeSpaceExW

SetDefaultDllDirectories

KERNEL32

[Rename]

%ls=%ls

wwwwwwwxp

wwwwwwww

JIDATx

gOmUx*

(--------

)---------

)))))))))

33333333+

wwwwwwwx

wwwwwx

wwwwwwwx

wwwwww

wwwwwp

DDDDDD

wwwwwwwwx

wwwwwwww

!This program cannot be run in DOS mode.

`.rdata

@.data

.pdata

@.didat

@.reloc

t$ UWAVH

fA9<@u

t$ UWAWH

fA9<@u

WAVAWH

fD9z*vh

s$fD;{*

A_A^_

R$fA;z*

fA9z*v$A

@SUVWATAVAWH

A_A^A\_^][

x UATAVH

@UATAUAVAWH

fD9&t-H

fD9$Bu

fD9$Au

A_A^A]A\]

uBf9ZHu

UVWAVAWH

fD;z0sVH

T$X92t)H

t$pfE;x$}`I

A_A^_^]

UVWATAUAVAWH

A_A^A]A\_^]

UVWATAUAVAWH

`A_A^A]A\_^]

WATAUAVAWH

0A_A^A]A\_

VWATAUAVAWH

N0I!~(

XA_A^A]A\_^

H!T$8H

WAVAWH

A_A^_

WAVAWH

A_A^_

x ATAVAWH

A_A^A\

WAVAWH

9A98u6A9x

0A_A^_

UATAUAVAWH

A_A^A]A\]

SUVWATAVAWH

A_A^A\_^][

@SUVWAVH

T$(D+D$$+T$

@A^_^][

x ATAVAWH

A_A^A\

@UAVAWH

fD9$pu

WAVAWH

0A_A^_

{ UAVAWH

E H9O0t+H

{ UAVAWH

E H9K@t3H

;SDuD9kDu

+T$DE3

D$H+D$@H

UVWATAUAVAWH

0A_A^A]A\_^]

8\$@tXH

+D$<D+

t$ WAVAWH

U?+U7H

USVWAVAWH

!]X!]8M

9EXu6H

8A_A^_^[]

x ATAVAWH

0A_A^A\

UAVAWH

0A_A^]

L$ SUVWH

USVWAVH

`A^_^[]

UVWATAUAVAWH

pA_A^A]A\_^]

USVWAVH

A^_^[]

UVWAVAWH

`A_A^_^]

USVWATAVAWH

tnfD9"th

A_A^A\_^[]

USVWATAUAVAWH

A_A^A]A\_^[]

UWAUAVAWH

A_A^A]_]

WAVAWH

A_A^_

s WAVAWH

A_A^_

@USVWATAUAVAWH

A_A^A]A\_^[]

UAVAWH

fD9$Gu

UAVAWH

fD9<Hu

UWATAVAWH

A_A^A\_]

WAVAWH

x ATAVAWH

L9#tIL

A_A^A\

WAVAWH

0A_A^_

SVWAVH

8A^_^[

u(H!G@H

D$0H9D$@u

SVWATAUAVAWH

x|L97twH

A_A^A]A\_^[

UATAVH

f9|$0u

@UWAVH

@USVWATAVAWH

A_A^A\_^[]

UVWATAUAVAWH

pA_A^A]A\_^]

l$ VWATAVAW

fD9<Pu

A_A^A\_^

UWAUAVAWH

A_A^A]_]

|$ UATAUAVAWH

fC9<Fu

A_A^A]A\]

WAVAWH

0A_A^_

VWATAVAWH

@A_A^A\_^

USVWAVH

A^_^[]

USVWAVH

A^_^[]

@USVWATAVAWH

D9d$`A

A_A^A\_^[]

UVWATAUAVAWH

A_A^A]A\_^]

tNH+E(H

UVWAVAWH

`A_A^_^]

x ATAVAWH

Lct$`M

A_A^A\

SVWAVH

8A^_^[

SVWAVH

8A^_^[

SVWAVH

8A^_^[

uH9}Pus

UVWATAUAVAWH

A_A^A]A\_^]

@SUVWATAVAWH

`A_A^A\_^][

SVWAVH

8A^_^[

USVWAVAWH

XA_A^_^[]

WAVAWH

fD9<yu

@A_A^_

VWATAVAWH

0A_A^A\_^

USVWATAVAWH

PA_A^A\_^[]

USVWAVH

`A^_^[]H

USVWAVH

`A^_^[]H

@UWAVH

tOH+E0H

H;Q(t_H

D$`u!H

UVWATAUAVAWH

0A_A^A]A\_^]

UVWATAUAVAWH

`A_A^A]A\_^]

VWATAVAWH

0A_A^A\_^

H;{(u

tEL;I u

[ H;^(u

B(I;@(u

A I;@(t

B(I;@(u

t$ UWATAVAWH

t&L9=EK

[HL9;u

t%L9;t

x,L9;t

t.L9;t)

A_A^A\_]

SVWATAVAWH

8A_A^A\_^[

SVWAVAWH

0A_A^_^[

SVWAVH

8A^_^[

Y@H9;u+L

UVWAVAWH

A_A^_^]

fD94Au

fD94Xu

SVWATAUAVAWH

`A_A^A]A\_^[

UVWATAUAVAWH

A_A^A]A\_^]

@SVWATAUAVAW

A_A^A]A\_^[

WAVAWH

fD;8uwH

7fD;>u

A_A^_

@USVWATAUAVAWH

uY9T$`vSL

A_A^A]A\_^[]

\$ UVWATAUAVAW

A_A^A]A\_^]

D$xH9D$pt

UVWAVAWH

A_A^_^]

L$ SVWH

\$ UVWAVAWH

L9{0t#H

A_A^_^]

\$ UVWH

K SVWH

WATAUAVAWH

A_A^A]A\_

@SUVWATAUAVAWH

td@8=HN

hA_A^A]A\_^][

UVWATAUAVAWH

A_A^A]A\_^]

UVWATAUAVAWH

F0D8#ubD8c

`A_A^A]A\_^]

WATAUAVAWH

t#E9V0t

A_A^A]A\_

UATAUAVAWH

fD90t,

A_A^A]A\]

UVWAVAWH

A_A^_^]

@SUVWATAVAWH

PA_A^A\_^][

VWATAVAWH

A_A^A\_^

WATAUAVAWH

fD9,Qu

H9{Hs|H

A_A^A]A\_

T$8H!\$8

h UAVAWH

WAVAWH

A_A^_

p WAVAWH

A_A^_

WAVAWH

rMfD9?w

C9fD9?u-

A_A^_

WATAUAVAWH

A_A^A]A\_

L$ UVWATAUAVAWH

>97t:A

pA_A^A]A\_^]

x UATAUAVAWH

C @8}Wu

A_A^A]A\]

@UVWATAUAVAWH

D9l$\v

A_A^A]A\_^]

WAVAWH

}0H+}(H

0A_A^_

WAVAWH

@A_A^_

WAVAWH

0A_A^_

@SUVWAVAWH

HA_A^_^][

[ UVWH

WAVAWH

0A_A^_

x UAVAWH

UAVAWH

UATAUAVAWH

fD9,Gu

fD9,Au

EPJ9<(t}L

L9mPtx

u#9L$pt

LcL$xH

L)d$xH

u"9U t

fD9,Hu

fD9,Ou

D$pD!|$hE

A_A^A]A\]

UVWAVAWH

A_A^_^]

UWATAUAWH

A_A]A\_]

UVWAVAWH

H!t$0H

A_A^_^]

H!_(H!_0H!_8H!_@I

WAVAWH

}@H!]@M

0A_A^_

UVWAVAWH

H!t$@H

A_A^_^]

H!\$0H

H!\$8H

t$ WAVAWH

A_A^_

WAVAWH

fD9<ru

A_A^_

WAVAWH

A_A^_

3D$H%x

3D$8%x

SVWAVAWH

`A_A^_^[

tAfA9(t;H

fA9,@u

UWATAVAWH

HcD$ H

Lct$$H

A_A^A\_]

UVWAVAWH

`A_A^_^]

UVWATAUAVAWH

L9d$@uBH

A_A^A]A\_^]

SUVWAVH

PA^_^][

UATAUAVAWH

A_A^A]A\]

t$ WATAUAVAWH

0A_A^A]A\_

@USVWATAUAVH

`A^A]A\_^[]

@USVWATAVAWH

@A_A^A\_^[]

UVWAVAWH

0A_A^_^]H

H!L$@H

uIH!L$HH

M89}@H

ATAVAWH

A_A^A\

UAVAWH

'D9{hH

x ATAVAWH

0A_A^A\

WAVAWH

A_A^_

H WAVAWH

@A_A^_

x ATAVAWH

A_A^A\

l$ VWAVH

0A^_^H

UWATAVAWH

A_A^A\_]

UATAUAVAWH

9}`uuA

0A_A^A]A\]

H9w@t*H

UWATAVAWH

A_A^A\_]

SUVWAVH

@A^_^][

D!t$pH

H9D$@t

UWAUAVAWH

A_A^A]_]

|$0H9y8t(H

\$0H9Y8t!H

WAVAWH

0A_A^_

@USVWAVH

!}8!}0L

A^_^[]

D$0!\$0D

@SVWAVH

8A^_^[

UAVAWH

USVWAVH

A^_^[]

SVWAVAWH

uI@8{8u

s@I;6t7I

@A_A^_^[

@USVWATAVAWH

A_A^A\_^[]

UVWATAUAVAWH

fE9$Fu

fE9<Fu

fD94Au

u)9D$xt

D$p+E@

fD9<Gu

D9eLu>

A_A^A]A\_^]

D9d$pvEM

D;L$ps

fD9$Bu

D9l$hu,D9T$pt

9D$hu&D9T$pt

9D$hu?L

9D$hu%9U

9D$hu#9U

9D$hu@

fD9$Hu

fD9$Ou

fD9$Gu

D;l$xr

x ATAVAWH

@A_A^A\

UAVAWH

L$ USWH

WAVAWH

fA94xu

A_A^_

UATAUAVAWH

A_A^A]A\]

SVWAVH

8A^_^[

@UAVAWH

CL;CHt

WAVAWH

0A_A^_

@UWAVH

uP9]8uK

WAVAWH

UVWATAUAVAWH

fD9$Cu

0A_A^A]A\_^]

UWATAVAWH

fE9$Au

fD9$Bu

A_A^A\_]

@USVWATAWH

~IfD9 uCA

HA_A\_^[]

UVWATAUAVAWH

fD9$Cu

fD9$Gu

fD9$Fu

fE9$Fu

A_A^A]A\_^]

UVWATAUAVAWH

~3H9_(

pA_A^A]A\_^]

SUVWAVH

0A^_^][

H SUVWAVH

A^_^][

u)H91t

UWATAVAWH

fD9#tyH

A_A^A\_]

C(H9D$0t

K UVWH

u59E(t0

@SUVWAVH

@A^_^][

VWATAVAWH

A_A^A\_^

I;uII

L$pL98t-I

VWATAVAWH

A_A^A\_^

I;uII

L$pL98t-I

H9Q r&H

D8X(u

t8I;1u$A

D8X(u

t8I;1u$A

SVWAVH

hA^_^[

@SUVWAVH

0A^_^][

UVWATAUAVAWH

@A_A^A]A\_^]

UAVAWH

USVWAVH

x D9u@A

0A^_^[]

u$L97t

SVWAVH

8A^_^[

WAVAWH

0A_A^_

u*9Q<|%

LcA<E3

u HcA<H

H3E H3E

string too long

invalid string position

Invalid parameter passed to C runtime function.

urlmon.dll

>`WININET.dll

UxTheme.dll

XmlLite.dll

bad allocation

EventWrite

EventRegister

EventUnregister

WinSqmAddToStream

afterBegin

DllGetClassObject

}LWinSqmEventEnabled

IWinSqmEventWrite

RegDeleteKeyExW

RegDeleteKeyW

Exception

ReturnHr

FailFast

RaiseFailFastException

RtlNtStatusToDosErrorNoTeb

RtlDllShutdownInProgress

RtlDisownModuleHeapAllocation

RtlQueryFeatureConfiguration

RtlRegisterFeatureConfigurationChangeNotification

RtlUnregisterFeatureConfigurationChangeNotification

RtlNotifyFeatureUsage

NtQueryWnfStateData

NtUpdateWnfStateData

RtlSubscribeWnfStateChangeNotification

RtlUnsubscribeWnfNotificationWaitForCompletion

onecore\internal\sdk\inc\wil\opensource\wil\resource.h

WilError_03

onecore\internal\sdk\inc\wil\Staging.h

WilStaging_02

mshelp:windows_help_oem_corporate

GetNetworkParams

atlthunk.dll

AtlThunk_AllocateData

AtlThunk_InitData

AtlThunk_DataToCode

AtlThunk_FreeData

map/set<T> too long

SetSecurityDescriptorControl

X\?E/5S

sQPI[5T

@W=7A=

d|BNeU

Eky;T

Vving1

gxI3!'

WAxK0i

FWph?r

7T})gW

hwp1p0

hgtlCm

^BNQ,^

z?801i:It6

1o?-XfF

]$(SQO

VG2/iI

w9X!P/

NtQuerySystemInformation

IsProcessDPIAware

333333

OpenedInEdge

MsHelpUrl

FeatureError

featureId

featureVersion

featureBaseVersion

featureStage

lineNumber

module

process

originFile

originLineNumber

originModule

originName

message

callerModule

callerReturnAddressOffset

originCallerModule

originCallerReturnAddressOffset

FeatureVariantUsage

featureId

featureVersion

featureBaseVersion

featureStage

enabled

variantKind

variant

addend

EnabledFeatureUsage

featureId

featureVersion

featureBaseVersion

featureStage

enabled

addend

FeatureUsage

featureId

featureVersion

featureBaseVersion

featureStage

enabled

addend

FallbackError

PartA_PrivTags

wilResult

hresult

fileName

lineNumber

module

failureType

message

threadId

callContext

originatingContextId

originatingContextName

originatingContextMessage

currentContextId

currentContextName

currentContextMessage

failureId

failureCount

function

FallbackError

PartA_PrivTags

wilResult

hresult

fileName

lineNumber

module

failureType

message

threadId

callContext

originatingContextId

originatingContextName

originatingContextMessage

currentContextId

currentContextName

currentContextMessage

Microsoft.Windows.Help

Microsoft.Windows.Wil.FeatureLogging

helppane.pdb

.text$di

.text$mn

.text$mn$00

.text$x

.text$yd

.rdata$brc

.rdata$T$brc

.idata$5

.00cfg

.CRT$XCA

.CRT$XCAA

.CRT$XCL

.CRT$XCU

.CRT$XCZ

.CRT$XIA

.CRT$XIAA

.CRT$XIY

.CRT$XIZ

.CRT$XLA

.CRT$XLZ

.gehcont

.gfids

.giats

.rdata

.rdata$r

.rdata$zETW0

.rdata$zETW1

.rdata$zETW2

.rdata$zETW9

.rdata$zzzdbg

.tls$ZZZ

.xdata

.xdata$x

ATL$__a

ATL$__m

ATL$__z

.didat$2

.didat$3

.didat$4

.didat$6

.didat$7

.idata$2

.idata$3

.idata$4

.idata$6

.data$brc

.data$r$brc

.pdata

.didat$5

.rsrc$01

.rsrc$02

CoInternetSetFeatureEnabled

CoInternetGetSession

InternetCanonicalizeUrlW

InternetCrackUrlW

CloseThemeData

OpenThemeData

CreateXmlReader

InternetCreateUrlW

RegisterTraceGuidsW

GetTraceEnableLevel

GetTraceEnableFlags

GetTraceLoggerHandle

TraceEvent

RegOpenKeyW

RegQueryValueExW

RegCloseKey

RegQueryInfoKeyW

RegEnumKeyExW

RegOpenKeyExW

RegSetValueExW

RegCreateKeyExW

RegDeleteValueW

UnregisterTraceGuids

EventUnregister

EventRegister

EventSetInformation

EventWriteTransfer

RegGetValueW

EqualSid

OpenThreadToken

OpenProcessToken

GetTokenInformation

GetSidLengthRequired

InitializeSid

IsValidSid

GetSidSubAuthority

GetLengthSid

CopySid

ADVAPI32.dll

GetVersionExW

GetProcAddress

GetModuleHandleW

EnterCriticalSection

LeaveCriticalSection

DeleteCriticalSection

SizeofResource

LockResource

LoadResource

FindResourceExW

ExpandEnvironmentStringsW

InitializeCriticalSection

GetModuleFileNameW

SetLastError

GetCurrentThreadId

RaiseException

FreeLibrary

LoadLibraryW

MultiByteToWideChar

FormatMessageW

LocalFree

CloseHandle

GetLastError

WaitForSingleObject

SetEvent

GetQueuedCompletionStatus

ResetEvent

PostQueuedCompletionStatus

GetSystemInfo

CreateIoCompletionPort

CreateEventW

ProcessIdToSessionId

GetCurrentProcessId

GetExitCodeThread

TerminateThread

LoadLibraryExW

lstrcmpiW

CreateMutexW

GetSystemDirectoryW

SetCurrentDirectoryW

HeapSetInformation

ReleaseMutex

HeapAlloc

GetProcessHeap

HeapFree

GetModuleHandleExW

GetModuleFileNameA

DebugBreak

IsDebuggerPresent

OutputDebugStringW

AcquireSRWLockExclusive

ReleaseSRWLockExclusive

AcquireSRWLockShared

ReleaseSRWLockShared

ReleaseSemaphore

SetThreadpoolTimer

WaitForThreadpoolTimerCallbacks

CloseThreadpoolTimer

WaitForSingleObjectEx

InitializeCriticalSectionEx

OpenSemaphoreW

CreateThreadpoolTimer

GetFileAttributesW

GetPackagesByPackageFamily

GetCurrentThread

CompareStringW

InitOnceBeginInitialize

InitOnceComplete

CreateMutexExW

CreateSemaphoreExW

CreateThread

ResumeThread

MulDiv

WaitForMultipleObjects

GetCurrentProcess

LocalAlloc

GlobalFree

GlobalAlloc

KERNEL32.dll

DeleteObject

SetBkMode

SetTextColor

GetObjectW

CreateFontIndirectW

GetStockObject

GetDeviceCaps

SelectObject

GetTextExtentPoint32W

GDI32.dll

GetClientRect

SendMessageW

GetSysColor

GetSysColorBrush

SetWindowPos

GetWindowLongW

GetMenu

AdjustWindowRectEx

MoveWindow

IsWindowEnabled

IsWindowVisible

SetFocus

CreateWindowExW

DefWindowProcW

GetClassInfoExW

RegisterClassExW

SetWindowLongPtrW

GetWindowLongPtrW

CallWindowProcW

GetSubMenu

LoadMenuW

GetParent

InvalidateRect

CheckMenuRadioItem

EnableMenuItem

ClientToScreen

TrackPopupMenuEx

DialogBoxParamW

DestroyMenu

SetWindowTextW

GetKeyState

SetActiveWindow

MessageBoxW

SetTimer

KillTimer

PostMessageW

CharNextW

LoadAcceleratorsW

GetMessageW

TranslateAcceleratorW

TranslateMessage

DispatchMessageW

DestroyIcon

SystemParametersInfoW

LoadCursorW

PostQuitMessage

LockWindowUpdate

SetCursor

IsZoomed

IsIconic

GetWindowPlacement

MonitorFromRect

GetMonitorInfoW

GetWindowRect

MonitorFromPoint

GetProcessDefaultLayout

ReleaseDC

ShowWindow

GetDlgItem

CheckDlgButton

IsDlgButtonChecked

EnableWindow

EndDialog

BringWindowToTop

SetDlgItemTextW

GetDlgItemTextW

USER32.dll

__CxxFrameHandler3

__C_specific_handler

_wcsnicmp

memcpy_s

memmove_s

_wcsicmp

iswspace

_purecall

_resetstkoflw

malloc

wcscpy_s

wcscat_s

_vsnwprintf

towupper

wcsstr

calloc

_beginthreadex

wcschr

wcsncpy_s

??0exception@@QEAA@AEBV0@@Z

?what@exception@@UEBAPEBDXZ

??1exception@@UEAA@XZ

??0exception@@QEAA@AEBQEBD@Z

??0exception@@QEAA@XZ

_vsnprintf_s

swprintf_s

_itow_s

??0exception@@QEAA@AEBQEBDH@Z

_callnewh

_CxxThrowException

_XcptFilter

_amsg_exit

__wgetmainargs

__set_app_type

_cexit

__setusermatherr

_initterm

_wcmdln

_fmode

_commode

msvcrt.dll

?terminate@@YAXXZ

??1type_info@@UEAA@XZ

_errno

realloc

_unlock

__dllonexit

_onexit

ImageList_Destroy

InitCommonControlsEx

ImageList_LoadImageW

COMCTL32.dll

CoGetMalloc

CoTaskMemAlloc

CoCreateInstance

CoUninitialize

CoInitialize

CoTaskMemFree

CoTaskMemRealloc

OleInitialize

CoInitializeSecurity

CoRegisterClassObject

CoResumeClassObjects

CoRevokeClassObject

OleUninitialize

CoImpersonateClient

CoRevertToSelf

PropVariantClear

ole32.dll

OLEAUT32.dll

ShellExecuteW

SHGetPropertyStoreForWindow

SHELL32.dll

SHGetValueW

SHRegGetValueW

SHStrDupW

SHLWAPI.dll

SLIsGenuineLocal

SLWGA.dll

RtlCaptureContext

RtlLookupFunctionEntry

RtlVirtualUnwind

NtOpenProcessToken

NtQueryInformationToken

NtClose

NtOpenThreadToken

ntdll.dll

PathCchAppend

api-ms-win-core-path-l1-1-0.dll

HeapSize

HeapReAlloc

HeapDestroy

VirtualFree

VirtualAlloc

LoadLibraryExA

EncodePointer

DecodePointer

FlushInstructionCache

InterlockedPushEntrySList

InterlockedPopEntrySList

GetStartupInfoW

UnhandledExceptionFilter

SetUnhandledExceptionFilter

TerminateProcess

WakeAllConditionVariable

SleepConditionVariableSRW

QueryPerformanceCounter

GetSystemTimeAsFileTime

GetTickCount

OutputDebugStringA

GetProductInfo

GetUserPreferredUILanguages

OpenEventW

GetProcessMitigationPolicy

InitializeSecurityDescriptor

FreeSid

SetEntriesInAclW

AllocateAndInitializeSid

SetSecurityDescriptorDacl

ResolveDelayLoadedAPI

DelayLoadFailureHook

UnregisterClassA

GetSystemMetrics

_wcslwr_s

_vscwprintf

vswprintf_s

UrlEscapeW

UrlUnescapeW

memcmp

memcpy

memset

wcscmp

.?AUIDispatch@@

.?AUIAction@@

.?AUIUnknown@@

.?AV?$CComObject@VCShortcutAction@@@ATL@@

.?AV?$CComObject@VCDataTag@@@ATL@@

.?AVCDataTag@@

.?AVIDataTag@@

.?AVCShortcutAction@@

.?AV_IDispEvent@ATL@@

.?AV?$IDispEventSimpleImpl@$00VCBrowserShortcutLinks@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@

.?AV?$_IDispEventLocator@$00$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@

.?AV?$IDispEventImpl@$00VCBrowserShortcutLinks@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B$1?LIBID_SHDocVw@@3U3@B$00$00VCComTypeInfoHolder@ATL@@@ATL@@

.?AVCComObjectRootBase@ATL@@

.?AV?$CComObjectRootEx@VCComMultiThreadModel@ATL@@@ATL@@

.?AVCBrowserShortcutLinks@@

.?AVCAtlException@ATL@@

.?AV?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@

.?AV?$CWindowImplRoot@VCWindow@ATL@@@ATL@@

.?AVCWindow@ATL@@

.?AVCMessageMap@ATL@@

.?AV?$CBaseTile@VCCancelTile@@@@

.?AV?$CWindowImpl@VCCancelTile@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@

.?AV?$CComObjectRootEx@VCComSingleThreadModel@ATL@@@ATL@@

.?AVCCancelTile@@

.?AV?$CBaseTile@VCConnectionTile@@@@

.?AV?$CWindowImpl@VCConnectionTile@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@

.?AVCConnectionTile@@

.?AVCHelpUrl@MsHelp@@

.?AVCContentCustomizer@@

.?AVCOnlineTemplate@@

.?AV?$CComObject@VCSecurityManager@@@ATL@@

.?AVCLostConnectionBanner@@

.?AV?$CComObject@VCLostConnectionBanner@@@ATL@@

.?AV?$CComObject@VCBrowserShortcutLinks@@@ATL@@

.?AV?$CComObject@VCProtocolClassFactory@@@ATL@@

.?AVCSecurityManager@@

.?AVCProtocol@@

.?AUIInternetProtocolInfo@@

.?AUIInternetProtocol@@

.?AUIInternetProtocolRoot@@

.?AV?$CComObject@VCProtocol@@@ATL@@

.?AVCProtocolClassFactory@@

.?AUIServiceProvider@@

.?AV?$IDispEventSimpleImpl@$00VCDHtmlTile@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@

.?AV?$IDispEventImpl@$00VCDHtmlTile@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B$1?LIBID_SHDocVw@@3U3@B$00$00VCComTypeInfoHolder@ATL@@@ATL@@

.?AUIDocHostUIHandler@@

.?AUIOleWindow@@

.?AUIOleInPlaceSite@@

.?AUIOleClientSite@@

.?AV?$CBaseTile@VCDHtmlTile@@@@

.?AV?$CWindowImpl@VCDHtmlTile@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@

.?AVCDHtmlTile@@

.?AUIOleCommandTarget@@

.?AUIInternetSecurityManager@@

.?AVCComClassFactory@ATL@@

.?AUIClassFactory@@

.?AV?$CComObject@VCScriptExternal@@@ATL@@

.?AVCScriptExternal@@

.?AV?$IDispatchImpl@UIScriptExternal@@$1?_GUID_5ace82d7_eeaf_4bdc_b2b8_3bb6b348d08e@@3U__s_GUID@@B$1?m_libid@CAtlModule@ATL@@2U_GUID@@A$00$0A@VCComTypeInfoHolder@ATL@@@ATL@@

.?AUIScriptExternal@@

.?AUIActionExecutor@@

.?AV?$CComObject@VCHelpEngineDataSource@@@ATL@@

.?AV?$CComObject@VCThreadPoolActionExecutor@@@ATL@@

.?AUIThreadPoolConfig@ATL@@

.?AV?$CThreadPool@VCThreadPoolWorker@@VCRTThreadTraits@ATL@@VWin32WaitTraits@3@@ATL@@

.?AVCThreadPoolActionExecutor@@

.?AVCHelpEngine@@

.?AVCHelpEngineDataSource@@

.?AUIDataSource@@

.?AVCUrlManager@@

.?AVCAllowedSites@MsHelp@@

.?AV?$CComContainedObject@VCHxHelpPaneServer@@@ATL@@

.?AV?$CComAggObject@VCHxHelpPaneServer@@@ATL@@

.?AVCHxHelpPaneServer@@

.?AUIHxHelpPaneServer@@

.?AV?$CComCoClass@VCHxHelpPaneServer@@$1?CLSID_HxHelpPaneServer@@3U_GUID@@B@ATL@@

.?AV?$CComObject@VCHxHelpPaneServer@@@ATL@@

.?AV?$CComObjectNoLock@VCComClassFactory@ATL@@@ATL@@

.?AVCComModule@ATL@@

.?AV?$CAtlModuleT@VCComModule@ATL@@@ATL@@

.?AVCAtlModule@ATL@@

.?AU_ATL_MODULE70@ATL@@

.?AVCRegObject@ATL@@

.?AUIRegistrarBase@@

.?AV?$__func@V<lambda_8db0ce862824541f40dfb767113f1e28>@@$$A6A_NPEAX_K01I@Z@__function@wistd@@

.?AVFeatureLogging@details@wil@@

.?AV?$__base@$$A6A_NPEAX_K01I@Z@__function@wistd@@

.?AVTraceLoggingProvider@wil@@

.?AUIFailureCallback@details@wil@@

.?AVResultException@wil@@

.?AVbad_alloc@std@@

.?AVexception@@

.?AV?$CComObject@VAPIRequest@@@ATL@@

.?AV?$CComObject@VCForegroundActionExecutor@@@ATL@@

.?AV?$CWindowImpl@VCMainWindow@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@

.?AVCMainWindow@@

.?AVAPIRequest@@

.?AVCForegroundActionExecutor@@

.?AV?$CBaseTile@VCNavigationBar@@@@

.?AV?$CWindowImpl@VCNavigationBar@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@

.?AVCNavigationBar@@

.?AVCRequest@@

.?AV?$CComObject@VCSearchCoordinator@@@ATL@@

.?AVCSearchCoordinator@@

.?AV?$CDialogImplBaseT@VCWindow@ATL@@@ATL@@

.?AV?$CDialogImpl@VCSettings@@VCWindow@ATL@@@ATL@@

.?AVCSettings@@

.?AVCStateMonitor@MsHelp@@

.?AVCRegistryLookupInfo@MsHelp@@

.?AVCFormatStringRegistryEvaluation@MsHelp@@

.?AVCCssColorStyleRegistryEvaluation@MsHelp@@

.?AVCBooleanRegistryEvaluation@MsHelp@@

.?AVCExistenceRegistryEvaluation@MsHelp@@

.?AVCRegistryEvaluation@MsHelp@@

.?AVCIEVersionFeature@MsHelp@@

.?AVCRegistryFeature@MsHelp@@

.?AVCSlapiFeature@MsHelp@@

.?AVCIsOemHomeTilePresent@MsHelp@@

.?AVCIsOemSearchContentPresentFeature@MsHelp@@

.?AVCIsOemTopicPresentFeature@MsHelp@@

.?AVCIsOemBrandFeature@MsHelp@@

.?AVCIsIEDefaultBrowserFeature@MsHelp@@

.?AVCIsWindowsGenuineFeature@MsHelp@@

.?AVCIsDisplayedInBrowserFeature@MsHelp@@

.?AVCIsMachineOnDomainFeature@MsHelp@@

.?AVCIsAdminFeature@MsHelp@@

.?AVCAdaptableFeature@MsHelp@@

.?AV?$CComObject@VCCancelTile@@@ATL@@

.?AV?$CComObject@VCDHtmlTile@@@ATL@@

.?AVCViewManager@@

.?AV?$CDialogImpl@VCZoomCustom@@VCWindow@ATL@@@ATL@@

.?AVCZoomCustom@@

.?AVAPException@@

.?AVCGroupPolicy@@

.?AVout_of_range@std@@

.?AVlength_error@std@@

.?AVlogic_error@std@@

ew|>&=4_

ffffffh

fffffflff

fhfflf

fflfff

vlffff

ffffff

lffffff

fffflf

fflfffflf

lfffff

lffffffffflfff

fffffffff

fflffffffflf

vfffffllfx

Flflfffff

fflffdfF

fffffffff

lffflfffff

lflflff

ffffff

lfflfffff

fflfdlff

ffffflfFfO

fffflfff

flfflfff

fffffdfflfg

fflflff

ffffff

llffff

ffflffff

fflfdlfff

lffffff

flfflh

fffvff

ffFffh

flffff

ffgffffff

ffllffflff

flfffflffffh

flffflg

lffflfflfg

ffflfh

ffffdf

ffffffF

lffffff

lffffh

flfffh

vflfffl

lffflh

lffllfo

ffffff

lfflfff

fflfflfh

flfflff

Ffffffff

lfffffff

fffflf

fflflg

lffhflffh

ffffff

vffFdf

NoRemove CLSID

ForceRemove {8cec58ae-07a1-11d9-b15e-000d56bfe6ee} = s 'AP Client HxHelpPaneServer Class'

ForceRemove 'Programmable'

LocalServer32 = s '%MODULE%'

'TypeLib' = s '{8cec5860-07a1-11d9-b15e-000d56bfe6ee}'

<?xml version='1.0' encoding='utf-8' standalone='yes'?>

<assembly

xmlns="urn:schemas-microsoft-com:asm.v1"

xmlns:asmv3="urn:schemas-microsoft-com:asm.v3"

manifestVersion="1.0"

<assemblyIdentity

name="Microsoft.Help"

processorArchitecture="*"

type="win32"

version="1.0.0.0"

<assemblyIdentity

language="*"

name="Microsoft.Windows.Common-Controls"

processorArchitecture="*"

publicKeyToken="6595b64144ccf1df"

type="win32"

version="6.0.0.0"

</dependentAssembly>

</dependency>

<requestedExecutionLevel

level="asInvoker"

uiAccess="false"

</requestedPrivileges>

</security>

</trustInfo>

<asmv3:application>

<asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">

</asmv3:windowsSettings>

</asmv3:application>

</assembly>

{APClientHelpPane

HxHelpPaneServerd

IHxHelpPaneServerWWW

IUnknown,

__MIDL___MIDL_itf_hxhelppaneserver_0006_0001_0001WWW

@1Data1WWW

A1Data2WWW

B1Data3WWW

C1Data4WWW

QueryInterfaceWW

ppvObjectWWW

AddRefWW

oaReleaseWd

{DisplayTaskW

bstrUrlWd

DisplayContentsWd

DisplaySearchResults

bstrSearchQueryWd

ExecuteW

pcUrlWWW

AP Client 1.0 Type Library

HelpPaneServer ClassWW

IHxHelpPaneServer InterfaceWWW

stdole2.tlbWWW4

IViewerWW

IScriptExternalW

nnNoImplicitFeedbackWW

NoExplicitFeedbackWW

5OemSearchEscalationUrlWW

pDoSearch

bstrQueryTypeWWW

bstrQueryWWW

bstrUrlW

RiPageNumberW

iPageSizeWWW

pCallbackWWW

SearchEventBegin

SearchEventEndWW

AsyncSearchEventBeginWWW

AsyncSearchEventEndW

S{OnScriptErrorWWW

(SetConnectedStateToOnlineWWW

EvaluateStateWWW

bstrStateNameWWW

pvarboolStateWWW

)TokenValueWW

bstrTokenNameWWW

pbstrTokenValueW

HelpPane.exe 1.0 Type LibraryW2

Interface exposed to scripts (via window.external)

rDlPtS

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="*" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v3.08</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/></application></compatibility></assembly>

NullsoftInst`+

Tz):|n

c8^S:`l:

$\cq+&

>-%r"k

H`w7|I

d][G!T

|zK]G]

#]"0tAg

vtpj_|

*m:%Zt

kgWafp]

jh#fe~

+U[2w]

L<BGg+

>/**^T

_)6:&9r

FPUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU

AUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU

UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU

TUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU

:MRkt9}/

lV(m'Qdg

1O5ry%

"m3H"e

bVggnv^7

u_{neY

t&_7\o\

"CGqi?

RJ#'4c

R23]6(3

4n#Q\f

Fw`tm%

.<~U9%

A}:"]}

S}'AMF{|)x

?3W^MmC

/Lb5PL

y[v)'o

[m<95PV)

%FB1v|G

"P]yR`

9zI$.n

AC=/mh

*d;pLO

tuPs`i

;4IjUt

8AoO~}<M]

V]gK6gb

\Cq.(#

viu&(p

.y/!-$

n({}QQ

TM=F-T

Gx,,s

kQa4_w

I]Hz@7SQ~

2vU5XO

3J% x?

$*q+|i

^ KRKW

k6aD[y/

yA7d6&

?BTWr*s1]

2e|8kS

ZB 4\p>

+/A|~8

N]an?-A[

yg5Q#t

`\ufz;b

UlF'I4

QO7A+m

\jj1[S

kc "J~U

%UV4"9

$(@:*N\n

hdVq*:xK

8H#C/z

E|/c 3

DRv6z"

@U^Sg

[|9H0

|'ao%D

AZx!u8

UIiTB_

Ab~{Aig

"93hir

l8r8<<

Z_><Ps

;MM9gH

*(J5a!

XQ>zhp

\_psa4sJV

e@+(dG=

oeSEAd

!..!"H<_6

{hrT1-

T*YNIB

?*Fq}"n[8

l8T%D

UDJr$;

<h_M= J

QamR_/

M-wH4{

i/Ir_I

!59jEA

f9j))1NH

---Ww

OPLZwIya

"0!3=d

%;dYy;>

EAvY)}

`b#o.N

5E&t.C

|9rm0m

L_Aa*5

5f(=(T

Y-[Yh4

wToZ2

q92o

2_V9Ap$

p[Ru?DL

.9^I3[

FFI*a

}jHoE2

[n3mM

$aGwlB

f{sZjI

_p:_(#

,|`o3gA

hRcZZ`sd|

S}Qt~

Q'Q*;l

l~|*+6

S_.wu]>q

l[J</0,

y`_g*2

W1LtjQZ

4d8,L'

G;fak0

QD3GS"A

uW5mm~

Vq&W_0

65k~u)(V4

tzI{?

T#{6UE

[*0h$o

'Ixr'N

/=[o:l

6Sx'$:

_%*?6{

I$D??$+

\F2|&M]1

)g[NFK

xYy\tZlH

cM;AJf

?xjk>

plo9VH?

#+^J9.

U^]e/<e

5;z=Ch

BG\M*]

eZuUjOS3&z[

M-369d

@%^D*;Z

]zwvvh

e JmA#

~c!nF+

AZvw8/

ngt{kNl

SY=LhY

%fKR=%D

+el[@j

A0M!7d

FCZy1$

HCi4z`w

=T,.eT+

7;lKJwq

hlm\}W

%xnkL

}*M`q.

!-W8E,

T:Fk1R

2y~vfr

<,TIr X

\64/b4MA}

We%_4-

fg?m`V

a_[CJ/

\&|`,4

bO|=W|`-

uxS)#6

HAoz{#

p\?#9K

_1Lf*a9

M^@h1"

r2huJS

u-*L -H

|q8*vK

^zz"k0

svXjeN

+xj7hkX

"Ksfg"

Y2v)KW

'tmM'Jg

'WE`np9

TBE,IW`r

-YhSpU

FVmx2I

-Wfo&oB

]:D"aU

HWB~c

x.j9Ky

$R[Em'

r-fzm^

3N'ALD)

dVJ@X'

c(Sg@"

W0/p79?

Gr{T!M

84Q)[wG

>3^LOnP

WY;jjM

{ xtw=

N2Qc D}

Iy!c#mq5

um9%)0W

;mxEU_

{J8YX;

=Y&cp6

6o{*yc!x

bMi_v<OLl5

Q{xps^

zX-]TtX

H[yP#i&

#oS)\&

_AY~+U

dt?Fp=

A(XiL_'p{

Z#0vlq

<8'BQt

?~i3TfD

~1,`|1

FF\_}X

PwNDr%

`{v/>e$

Rm{2|L

6.cA[3

zn:67k(

9Ey;f,

$U:]AF

3c_9d]

\p"\6i

_BGanE~

e).cR

UXvVjN

Mg-1^#ke

2.J&z#

zl/?gU

~yA'ka

~wYl?6j.

kI1E7x

t<q@,~

]+=);oS

|YCm;]

DC<60^

>BW`PFn

HPq&/

~"Igk&u

J$G&h:,

^;U_kI

RT!\r"]

2:J<;RUu

SuNQP^.r

#?Wmi(|

Q:j>%:

GK1L}OK@

+ezEq/

GU=5b0

9rk}ElL

_2NP)r

{sv<craD

3p$;V"k=

?1J*I~

k>Y}(

Jn.[ON

WR)B,"

c.INWv

^L=Ifp]

K&Q'{Z

y^ baZ

XTkhQJ

#(u7w"

puF7=_

Fa=uoP/r

5T|.]4

-ZDh51

<%[.z:

<eglz5\

JILhVP

#W68oJy

Om9f[<F

f6;ryZ

fX/l^R

5}-qb<

6mi:!u|Y

3Joxbz

Qw}{}u

RichEdit

RichEdit20W

.DEFAULT\Control Panel\International

Control Panel\Desktop\ResourceLocale

Software\Microsoft\Windows\CurrentVersion

\Microsoft\Internet Explorer\Quick Launch

#+3;CScs

verifying installer: %d%%

Installer integrity check has failed. Common causes include

incomplete download and damaged media. Contact the

installer's author to obtain a new copy.

More information at:

http://nsis.sf.net/NSIS_Error

Error launching installer

... %d%%

SeShutdownPrivilege

NSIS Error

Error writing temporary file. Make sure your temp folder is valid.

%u.%u%s%s

*?|<>/":

%s%S.dll

HELPPANE

RCDATA11111

ICONGROUP1

ICONGROUP103

ICONGROUP200(

MS Shell Dlg

msctls_progress32

SysListView32

MS Shell Dlg

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and timeInvalid argument to time encodeInvalid argument to date encode

Out of memory

I/O error %d

File not found

Invalid filename

Too many open files

File access denied

Read beyond end of file

Disk full

Invalid numeric input

Division by zero

Range check error

Integer overflow Invalid floating point operationFloating point division by zero

Floating point overflow

Floating point underflow

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Stack overflow

Control-C hit

Privileged instruction

Operation aborted%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'Invalid variant type conversion

Invalid variant operation"Variant method calls not supported

Write)Format result longer than 4096 characters

Format string too long

Error creating variant array

Variant is not an array!Variant array index out of bounds

External exception %x

January

February

August

September

October

November

December

Sunday

Monday

Tuesday

Wednesday

Thursday

Friday

Saturday

advapi32.dll

ForceRemove

NoRemove

Delete

(null)

api-ms-win-eventing-provider-l1-1-0.dll

DocumentTrustObj

LogoUrl

SOFTWARE\Microsoft\Windows\CurrentVersion\HelpAndSupport

NoActiveHelp

shortcut:

Static

Button

msctls_progress32

HelpPane.CancelTile.m_cancelButton

ReBarWindow32

ToolbarWindow32

HelpPane.Connection.Rebar

HelpPane.ConnectionTile.Toolbar

CONNECTION_BAR_HCBLACK

CONNECTION_BAR_HCWHITE

CONNECTION_BAR_ENABLED

CONNECTION_BAR_HOVER

Help::Rebar

WebOCZoomPercent

ZoomPercent

Ntdll.dll

JScript

HH_ContentCustomized

var hubPreloadScriptElement = document.head.children('idHubPreloadScript'); if (typeof (hubPreloadScriptElement) != 'object') { var HubPreloadScriptUrl = 'mshelp://Help/?id=Microsoft.Windows.Resources.Js.HubPreload'; var HubPreloadScript = document.createElement('script'); HubPreloadScript.src = HubPreloadScriptUrl; HubPreloadScript.type = 'text/javascript'; document.querySelector('head').appendChild(HubPreloadScript); }

var HubDebugMarkerScript = document.createElement('script'); var HubDebugMarkerText = '/*<![CDATA[Hub.Preload.Marker]]>*/'; HubDebugMarkerScript.type = 'text/javascript'; HubDebugMarkerScript.text = HubDebugMarkerText; if (document.body != null) { document.body.appendChild(HubDebugMarkerScript); } else if (document.head != null) { document.head.appendChild(HubDebugMarkerScript); }

var HubOfflineScriptSrc = 'mshelp://Help/?id=Microsoft.Windows.Resources.Js.HubOffline';

var PpeCssHref = 'mshelp://Help/?id=Microsoft.Windows.Resources.stylesheets.OemBaseAndNav';

var PpeCssHref = 'mshelp://Help/?id=Microsoft.Windows.Resources.stylesheets.ppe';

var HubOfflineScript = document.createElement('script'); HubOfflineScript.src = HubOfflineScriptSrc; HubOfflineScript.type = 'text/javascript'; var PpeCss = document.createElement('link'); PpeCss.href = PpeCssHref; PpeCss.rel = 'stylesheet'; PpeCss.type = 'text/css'; document.querySelector('head').appendChild(PpeCss); document.body.appendChild(HubOfflineScript);

div#ChromePanel

ChromePanel

afterBegin

div#SearchAndNavigationContainer

beforeEnd

span.condition

data-condition

span.tokenReplace

data-token

OEMHomeTile

FailedPostProcess = true; if (typeof(Hub) != 'undefined' && typeof(Hub.PostProcessData) == 'function') { Hub.PostProcessData(); FailedPostProcess = false; }

UpdateDebugHtml = function(event) { if (event.which == 112 /*F1 key*/ ) { debugHtmlContainer = document.querySelector('div.debugHtml'); if (debugHtmlContainer != null) { document.body.removeChild(debugHtmlContainer); } debugLinkContainer = document.createElement('div'); debugLinkContainer.className='debugHtml'; debugLinkContainer.style.margin='1cm'; document.body.appendChild(debugLinkContainer); contentDebugLink = document.createElement('a'); contentDebugLink.href = window.location; contentDebugLink.innerText = 'Content Url: ' + window.location; contentDebugLink.target = '_blank'; contentDebugLink.style.fontWeight='Bolder'; debugLinkContainer.appendChild(contentDebugLink); debugHtmlContainer = document.createElemen

DisplayDebugHtml

Software\Microsoft\Assistance\Client\1.0\Settings

Antivirus	Signature
Bkav	Clean
Lionic	Trojan.Win32.Agent.Y!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Nemesis.10729
ClamAV	Clean
CMC	Clean
CAT-QuickHeal	Clean
McAfee	Artemis!7B74E4FB9A95
Cylance	Unsafe
VIPRE	Gen:Variant.Nemesis.10729
Sangfor	Trojan.Win32.Agent.V1tr
K7AntiVirus	Clean
Alibaba	Clean
K7GW	Clean
Cybereason	Clean
Baidu	Clean
VirIT	Clean
Cyren	Clean
Symantec	Downloader
tehtris	Clean
ESET-NOD32	Clean
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan-Dropper.Win32.Agent.gen
BitDefender	Gen:Variant.Nemesis.10729
NANO-Antivirus	Clean
ViRobot	Clean
Rising	Trojan.Injector/NSIS!1.BFBB (CLASSIC)
Ad-Aware	Clean
Sophos	Clean
Comodo	Clean
F-Secure	Heuristic.HEUR/AGEN.1252584
DrWeb	Clean
Zillya	Clean
TrendMicro	Clean
McAfee-GW-Edition	BehavesLike.Win32.Generic.tm
Trapmine	Clean
FireEye	Gen:Variant.Nemesis.10729
Emsisoft	Gen:Variant.Nemesis.10729 (B)
SentinelOne	Clean
GData	Gen:Variant.Nemesis.10729
Jiangmin	Clean
Webroot	Clean
Avira	HEUR/AGEN.1252584
MAX	malware (ai score=88)
Antiy-AVL	Clean
Kingsoft	Clean
Gridinsoft	Clean
Arcabit	Trojan.Nemesis.D29E9
SUPERAntiSpyware	Clean
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Google	Clean
AhnLab-V3	Clean
Acronis	Clean
BitDefenderTheta	Clean
ALYac	Gen:Variant.Nemesis.10729
TACHYON	Clean
VBA32	Clean
Malwarebytes	Clean
Panda	Clean
Zoner	Clean
TrendMicro-HouseCall	TROJ_GEN.R002H07IN22
Tencent	Win32.Trojan-Dropper.Agent.Ddhl
Yandex	Clean
Ikarus	Clean
MaxSecure	Clean
Fortinet	NSIS/Injector.AOW!tr
AVG	FileRepMalware [Ransom]
Avast	FileRepMalware [Ransom]
CrowdStrike	win/malicious_confidence_60% (W)

Static Analysis

PE Compile Time

PE Imphash

Sections

Resources

Imports