Static | ZeroBOX

PE Compile Time

2006-09-22 00:20:49

PE Imphash

90ed158733fbf50c643f5d1f7acc2500

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000c4e8 0x0000c600 6.47818999258
.rdata 0x0000e000 0x000044cc 0x00004600 5.3945610741
.data 0x00013000 0x00003708 0x00001200 2.41067164008
.rsrc 0x00017000 0x00000da8 0x00000e00 4.33161702278
.reloc 0x00018000 0x00000f10 0x00001000 6.58605792725

Resources

Name Offset Size Language Sub-language File type
RT_BITMAP 0x00017600 0x00000358 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_DIALOG 0x00017958 0x000000a8 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_DIALOG 0x00017958 0x000000a8 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_VERSION 0x00017a00 0x000002b8 LANG_ENGLISH SUBLANG_ENGLISH_US COM executable for DOS
RT_MANIFEST 0x00017180 0x0000047e LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document, ASCII text, with CRLF line terminators

Imports

Library ole32.dll:
0x40e300 CoInitialize
0x40e304 CoCreateInstance
0x40e308 OleInitialize
Library KERNEL32.dll:
0x40e078 CreateJobObjectW
0x40e07c SetFilePointer
0x40e080 LocalAlloc
0x40e088 ResumeThread
0x40e08c OpenProcess
0x40e094 Sleep
0x40e098 lstrcpyA
0x40e09c LocalFree
0x40e0a0 GetCurrentProcessId
0x40e0a4 CreateProcessW
0x40e0a8 lstrcpyW
0x40e0ac CreateProcessA
0x40e0b0 TerminateJobObject
0x40e0b4 GetTickCount
0x40e0b8 GetCurrentProcess
0x40e0bc CreateFileMappingA
0x40e0c0 ExitProcess
0x40e0c4 lstrcmpiW
0x40e0c8 SetErrorMode
0x40e0cc GetCommandLineA
0x40e0d4 FindFirstFileW
0x40e0d8 FindNextFileW
0x40e0dc FindClose
0x40e0e0 WaitForSingleObject
0x40e0e4 GetProcAddress
0x40e0e8 SetFileAttributesW
0x40e0f0 Process32NextW
0x40e0f4 TerminateThread
0x40e0f8 Process32FirstW
0x40e100 MoveFileW
0x40e104 GetCommandLineW
0x40e10c ExitThread
0x40e128 GetModuleFileNameW
0x40e12c Process32First
0x40e130 lstrcpynW
0x40e138 GetCurrentThreadId
0x40e140 Process32Next
0x40e148 lstrcpynA
0x40e14c lstrcmpW
0x40e154 CreateThread
0x40e158 CloseHandle
0x40e15c DeleteFileW
0x40e164 GlobalAlloc
0x40e168 lstrcatW
0x40e16c GetLastError
0x40e170 FormatMessageW
0x40e174 GetModuleHandleA
0x40e178 lstrcatA
0x40e17c GetFileAttributesW
0x40e180 CreateFileW
0x40e184 lstrlenA
0x40e188 GetTempPathW
0x40e18c VirtualAlloc
0x40e190 WriteFile
0x40e194 lstrlenW
0x40e198 VirtualFree
0x40e19c ReadFile
0x40e1a0 CreateDirectoryW
0x40e1a4 lstrcmpiA
0x40e1a8 LoadLibraryA
0x40e1ac GlobalUnlock
0x40e1b0 TerminateProcess
0x40e1b4 GetTempFileNameW
0x40e1b8 CopyFileW
0x40e1bc GetFileSize
0x40e1c0 GetVersionExW
0x40e1c4 GlobalLock
0x40e1c8 lstrcmpA
Library USER32.dll:
0x40e1dc WindowFromPoint
0x40e1e0 ScreenToClient
0x40e1e4 SendMessageTimeoutA
0x40e1e8 SendMessageTimeoutW
0x40e1ec GetWindowRect
0x40e1f0 PostMessageW
0x40e1fc GetDesktopWindow
0x40e204 EnumDisplayDevicesW
0x40e208 GetThreadDesktop
0x40e20c GetSystemMetrics
0x40e210 MonitorFromWindow
0x40e214 ToAscii
0x40e218 SetForegroundWindow
0x40e21c PtInRect
0x40e220 MenuItemFromPoint
0x40e224 HiliteMenuItem
0x40e22c PrintWindow
0x40e230 CreateDesktopA
0x40e234 GetClassNameW
0x40e238 BringWindowToTop
0x40e23c GetTopWindow
0x40e240 OpenDesktopA
0x40e244 VkKeyScanExA
0x40e248 GetKeyboardState
0x40e24c GetMenuItemCount
0x40e250 SetActiveWindow
0x40e254 SetWindowPos
0x40e258 GetDC
0x40e25c GetMenu
0x40e260 GetWindow
0x40e264 GetWindowPlacement
0x40e268 IsWindow
0x40e26c SetWindowLongA
0x40e270 GetKeyboardLayout
0x40e274 MoveWindow
0x40e278 SetFocus
0x40e27c LoadKeyboardLayoutA
0x40e284 GetParent
0x40e288 GetMessageW
0x40e28c DispatchMessageA
0x40e290 IsWindowVisible
0x40e294 SendMessageW
0x40e298 SetThreadDesktop
0x40e29c ShowWindow
0x40e2a0 GetWindowLongA
0x40e2a4 TranslateMessage
0x40e2a8 GetWindowTextW
0x40e2ac GetClassNameA
0x40e2b0 OemToCharA
0x40e2b4 GetDlgItem
0x40e2b8 SetWinEventHook
0x40e2bc CharLowerA
0x40e2c0 UnhookWinEvent
0x40e2c4 wsprintfA
0x40e2cc PostMessageA
0x40e2d0 FindWindowExA
0x40e2d4 EnumDesktopWindows
0x40e2d8 FindWindowA
0x40e2dc OpenClipboard
0x40e2e0 wvsprintfW
0x40e2e4 CloseClipboard
0x40e2e8 EmptyClipboard
0x40e2ec GetClipboardData
0x40e2f0 SetClipboardData
0x40e2f8 wvsprintfA
Library GDI32.dll:
0x40e04c SelectObject
0x40e054 DeleteDC
0x40e058 CreatePen
0x40e05c Rectangle
0x40e060 GetDIBits
0x40e064 BitBlt
0x40e068 DeleteObject
0x40e06c CreateSolidBrush
0x40e070 CreateCompatibleDC
Library COMDLG32.dll:
0x40e040 GetOpenFileNameW
0x40e044 GetSaveFileNameW
Library ADVAPI32.dll:
0x40e000 RegQueryValueExW
0x40e004 RegOpenKeyExW
0x40e008 RegOpenKeyExA
0x40e00c RegQueryValueExA
0x40e014 GetSidSubAuthority
0x40e018 RegCloseKey
0x40e01c RegSetValueExA
0x40e020 RegQueryValueA
0x40e024 RegSetValueA
0x40e028 RegEnumKeyA
0x40e02c RegDeleteValueA
0x40e030 RegSetValueExW
0x40e034 GetTokenInformation
0x40e038 OpenProcessToken
Library SHELL32.dll:
0x40e1d0 SHGetFolderPathW
0x40e1d4 ShellExecuteW

!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
D$,jdP3
D$0FPV
D$$GPW
SUVWPj
D$,PhxAA
VVhhHA
D$T@;@
D$ ionI
D$$nfor
D$(mati
D$,onW
WTSEPW
D$ Sess
D$$ions
WTSQPW
D$ Toke
GetCQP
D$ ameA
D$HxAA
t$,UPW
t$,UPW
D$8PUU
D$@tW
\$8PSS
SUVWQh
T$ RPQV
RWWWWWW
9|$ t
D$,PhvKA
uyhdeA
L$@j2QP
L$@j2QP
l$ PSUj
L$<+L$4QW
9^0tA9^8t<9^<t7
9Y tT9Y$tO
Wj*Xjq
F<)^h)^d)^TY
Gdf+Gh
Gl;OxwY
td;Wxs_
Gd+Gh[=
Gdf+G\fH
VWh@0A
S0;S(t
w(;G,u
W0;W(t
W0;W(t
jdjdlekblcleoajckfknkplekfoaidkpkolelckpkmoaoiiijgioidojoakdkmkjkfkoleoalekpoaldkflclgkflcoa
bfgghj
ddcidgcocdeadcafanapbeafeacdapaobebcapam
ejefdpckcchggcefdphoef
ikpmojoblfkb
daflenflenflenfl
jeppojppojpdojpd
glfdfnekfgfnfealakbgfmfefe
ohpdnbmapcnnninboannnjnb
phocmnmimbpamnmjmbpamlphnnnhnambmjpamnmjmb
bpaddmcjccakcfcacjabcndmdmcfccclan
ngmioepfndomoapcmkodmdomojoa
hbgfehfggoenebedeohgelepeh
ompgmmoinamiijilopmnnanmnkmmmm
injjllkkijlhlalklbkjknjklhkmlllnkklbkmkhij
declaiaeagalcgalalaiae
fjephchkglgegoepgehmgdhigfgeghgpgehofjhohigdgegnhjfn
flelhkgngjhmgnfihkghglgnhlhlfp
gahaebfgfcehfghjfmfbhmfbfjfgfaehge
lokmjojoieikidlnjpicioiijojoljickhicipkcipihiiiojj
agahdacgcadidaabdnchdadedb
hngnecebfnelggepeaekecel
eefighhchjehgfhihehcgege
ipjlljkijpldlbkmkjkiljkojclnlbljil
epephehphdgohjdchihaha
hogkeifjgjfneeglecfpgaecedeefjecfp
beaaccddbececgclccabcgceddcidfabcidfakcicjcoddcidf
mmmmpkolmponpapmpkomomnloppgnooipoonpkpbpkomom
meocoepcofkekfljpdplpl
hhgcenekeahdenekeaelfdgf
codlbebdbjckbebdbjbcakck
dmcjagabaldiagabalaabickbhco
njmnopponnodoeooofpnniopojpo
imjmlhlgldlliilglblllakijjknlalciplalglbkl
kmkmjkilkpinjajmjkimimllkplgloiijoinjk
apapdjciaidecodjdndibicmdfbncldncodjdcdjcpcpbpdddccidjceci
bmaickdlbkdmckdnabcoccckbi
beghgicdcccbcgdccldd
dgcbaaadaebaajbb
mjppocokpgpfoippoileppocpplkli
dcbgbcfddofcfdepafanan
hfhbhfghhffcehfefcfdfg
fafefaeceagpgggcgnhghd
khihjljhjpjbia
njojofoeoeopojpo
cdadbfbobe
hnfmelenfi
bjdjcpcgcpcjdo
ndoipeopoopd
ahdndkdbcaaldfdadacg
pgmmmlmanbpkmlnbmkme
dbafahbgakanbbbgaablamadapah
kkjkjfjgikjmikjgjkjcjmin
eaeeeafcfehgghfphcgaghfggbgbhmgb
bpblbpanbpcjdiaacndpdiajdodocddo
kjijjpioijjfjjjbjfikio
cgcccgdedmbkbgabbj
nkpkobpmpnonogpooh
gmfifkelepfkfkenfbfofcfk
enhjhlgkgnhbhnhfhahphdhl
fagcgagagghdhh
gmfnfgfbfl
ghfifneheafbfk
pfmhmcnamhngmpjfjeiimcmkmk
gegeeoeeedfcfkhbecfjfeedfofifjahaeab
ihiglbldjlkelblkjplbknjbkmjf
mbmaphpfmbphogmepdpoohphnd
oenandnoieifjjndnlnl
dhdhabbadhbabgabbaahamcgaibacjalaaab
gfggeefjfbflfhfi
jbjclaknkflakdkpocipkdkmkdkfkhla
lilikdkokhkhkpkhkhlekpioinlniciojm
nenepopemloopepdnbooocpalelf
doclacabajaibpdlaeaibk
dldlaaanaeaedhdmbkajbbdpagam
abaedlcbchdddobhdededhdbcgcb
mbmbpnpeogofpdoaphmonpplpboapnobpnpeogmomfplpmpgpnofobmonbohoaoaphpmogmephoaobplpnpmmonhokocpopnoaphoamondpgoepdpmpbphpg
npnionppohooonpomloaodobmaojpkojoa
ghghbjafbjafacbjamafanag
hdhmeffifaemepfceffcaoeffief
efgegdhihchkhkcfcedihdgohddggfhohdhkhkcfcedihchkhkdkdfcach
plplmhmonmnpmjnkmnpeofmbmlnkmhnlmhmonmpeppmbmgmmmhnpnlpeolnnnknkmnmgnmpomnnknlmbmhmgpeobmgnmmnnkmgmnnmiiplmnnmnmmbmgmpnlpepcmhmgmnnlpeinmm
dfedfgfcakdo
akakdgdpcncodicldmafbedadkcldgckdgdpcnafbadhcndmcldhdmcnhjbmcbcjdfdgcldmclafbedidadh
gghgeaehehfaflebhjfaedfafj
kplcjdkmiojdiijjjpiijjjilbjdjijjlojnjcjcjjio
kkkkjgjpiniojiiljmkflejajkiljgikjgjpinkflajhinjmiljhjminnjlmibijjfjgiljmilkfkkjmjkimiljainia
jkinkalkkiklkfkmjkkmkklmllkalnlajkkmlnlnkakhkolkikkbkmkkkc
cldmbbalbjbkbebndobbaaclbnblanakbbamabclbnamambbbgbpal
nlnlohoopmppojpkonnemfobolpkohplohoopmnenpobogomohppplnemlpnpkpkonogpmnoonpkplobohognembogpmonpkogonpmkinlonpmpmobogoppl
dmdiaobnabcaabcgabblbnaoabakbl
joipliljljkckd
jfjfijiajcjbihjeidjkilkpkflekjlfkjkalcjkiflelplglckjkblekhlgkolp
adbndbdddidjdodfbhcfdjde
ambmdhcndadcdkaabcdkcmcmdodidkaidgdbdldaci
gffafpfkfdefbgblbgbdfcdldm
hpamabamgdghcbcg
bagdgogdafccckcpcgcheoej
impnpppclblaljknlolclklclkknlilglblipppclblalhlolbliknlklmlakjlkknkgpppclblalclkknlilk
efhphdgogghkhjgehddihdgohd
ohjgjejlnhjejm
ddejeafoeaec
dlekeifkfgeofj
hlakcfccemeneeaiahgoaiahhjaianbicfcc
kfnijejhic
dkckabblagaeamdgdkbabkbnamaeceambkbkaiaoamdoaaahanagbo
bhhehehehehehahehn
dhcaanbgabahbadbcncmddckca
chdhbibnbbbkaafedhbfaeaabnblbk
bhbhanagagcfdgamcldhda
joijkilokgljkclnjnlpkckklpkmkaloiailji
boaaccdpcibndpccckdpcmcadobncmcdci
bpaicjdpchdicddmgmabcddocjgmbmdocdcldocncbdpgmbmcncccj
dlcgajafanblbiajalandmbkananclahagbmbkahae
gnbnanamajaiag
abbmdhcgahblbkafbmbg
jajbkgibkclbjekkknkhkmlepapb
hegkhehdegfeemhefahageelegfefe
fdenfdfegbhdglemgjhdhefhedgmgbhdhd
igigjmjhjpkalikfidlmlakc
mlnmmokknlphpgomokphpenapholom
cadhbgaabiahbmaddhbgaaahbkbnbcahbkbmbndpbkaaah
mcmcoiocmfodpepemhpipeogkckd
idpdodocohohoa
obphngnlmg
hkgkegeeelegglegfb
eafahmhohbhmfbhmglfgglcacb
gbhgghhlgeflfhefgffmfghbfofdebebhmfdfpfh
gbhefofnfdeghmfnegflfeelgbflfmfj
nlpnplonpknhpipkonookakkoeojpbonpkplkgojololonoeonpkojpmobohogkgomobplojokoeonom
bfdddfcddebjdgdecdcagogeckchdpcddedfgichcfcfcdckcddechdccpcjcigicccpdfchceckcdccgegkggdcdeddcdgggphn
namcpdpdmgpfogonphpanpnaoaologooogpa
minkololnoonpopfopoimhmipipdpopgpooimhnkololoimhlfnppopnpkoophop
nikfmfoeofoo
gpgabchpejeoeofjfcei
abaohmbgdhdeddchdocg
kkjhinjnjfjfnhjnjfjf
cocpajbbdkbiajclbiapaobebcbd
lbiplnjbjeib
kmnpnaimigim
ppppibjnibjjibjnje
fgfcgmglhghbgedffjebgagdgehagjhb
endleoemfbfjemfpfdfkfpekfpdlec
kknhjmibjm
gafmedfgfn
ciajaobfbpbhbheiejffboadboflfj
lgmhmjnf
lbopoiopoimhjbopoiopoikhjajainjamcmbmcmhigopoiopoimhncnkiojkol
pmkckfkckfpmnkmmmmmknmnmib
edfghbhjhmhfhedo
ececfofhefegfaedfeenfmhihcgdhogchohhgfeneghihphfhogggcdbfpefenfcgegdgdhehpgfehhegdgchihohpeneghihphnhohghohp
idjbkfkelpiclfkdkelbkckeidlilflmlm
njnjofompopnolpiopngmhodojpiofpjofompongnnodoeooofpnpjngmjpppipiopoeponmoppipjodofoengnippoe
dldlaaanaeaeeicnbabmanagblabahag
iljmleleiklnlplbklkmlnkkillnkkkolnkk
ofodnimendnfnjnbninpmmndncjgnfnjnlnlnhnincji
goamaeaobdamajaebdamafanbdapamap
jgpbpbpg
dkblagagbndfdkamakbmblaabnbackamahbnamblfl
gaebfmfmehgpgafgfaegebfkehekhafgfnehfgeb
mnmjmpnc
cgcgbabjbabgabfffpffddahbkbiffdeblabbmcdbmahaaagcfahbkbbaabgab
nfocoppfpgokohppmioholod
jhkhkmlgklkjkbokkblmkb
lfmemgmlmliiijmljfihiiicieijjomgmlmlihikikijjbmliiijmljfihiiicieijjomlimijiemgmlmljdjfidjemlicihjcihmlicipjenlme
cjcgcpajbpaifkdoblaobl
gdgmgaecfpfgfjfmffbaaa
kfkklbjjjjjbjkjdkklfjoiejjjljd
cnccdkblbibpalbcak
gpgahcfjeielfdeofh
feflelgigeggglchfehdgihfgggagc
lclnkiipifiejjieifkfkd
jcjnjckelclckikokpobjclfkoldkakgke
gkgfgkfmekekfafgfhek
dpdadpbiadboanalaj
lflklfjpiiifmgkcihjcih
ifjflokeljllldpgliljkcpglaljkdlilcpgljlipglflklpldlikcpi
ocnmmcnenfngnejpnemjne
knkcldjhjnimjbinjbjiikkclljkjjjl
ofjejgjljlninjjlmfnhnincnenjmojgjljlnhnknknjmbjlninjjlmfnhnincnenjmojlnmnjnejgjljlmdmfndmejlncnhmcnhjlncnpmeilje
nlmnomoponkiogohpmkiooohpnogomkiohogkioloeobonogpmkg
gmhjfgenfkfjfaehbpfbfaelbpfjfaekfbflbpfafbbpfmfdfgfkfbelbb
oconpmnomlninnnnnaonphnimdnenhnomjon
amcpcndadjdgdddkcmhbdgdbdg
djdkbiafamadagapbjef
gdhjedgcfffmfbeefjegff
fdfagbhegi
ikplpjpelhlgpekllmlelgknlmpjpekjkllglplalflmpjpl
boclcedpciclccdfgdcidfci
fieggehbgcghghgkeigegghlgehigchpgehjfmgcgfgpgehmeighgkhihi
eaepgaghhmgbhchehg
ebeohhgkgghhhmgbhlhnhmgb
nmmdoaomoeokol
dmddbpbnakajbmebafbm
fmelgkgjgohkgdhl
eeeefifbedeafgeffcelfkhohegfhigehihbgdeleahohjhdhigagedhfjedelfegcgfgfhchjgdebhcgfgehohihj
fjepgogdhogdgfgeedeo
nhmhmlmjnhnembmh
lomnmciomnjojjimjpjjmnmpmpmnmckakmlfmnmp
fmcnckhmcnckhmckhmckhmckhmcn
gjbpgkgihfhngihlhhhohlgohlbpggejfpeiemfdfjfpbefpecfp
chbhbjbafkbbambbfeflbhfefmaebnbkbdfeefegedfkeefkeefkeffnfefcfefmbabbbifefldcfeflcffefg
hgahamafadafanfgfbeefhfbafahahafah
hoapae
unknown compression method
invalid window size
incorrect header check
need dictionary
incorrect data check
invalid block type
invalid stored block lengths
too many length or distance symbols
invalid bit length repeat
oversubscribed dynamic bit lengths tree
incomplete dynamic bit lengths tree
oversubscribed literal/length tree
incomplete literal/length tree
oversubscribed distance tree
incomplete distance tree
empty distance tree with lengths
invalid literal/length code
invalid distance code
CoInitialize
CoCreateInstance
OleInitialize
ole32.dll
ReadFile
VirtualFree
lstrlenW
WriteFile
VirtualAlloc
GetTempPathW
lstrlenA
CreateFileW
GetFileAttributesW
lstrcatA
GetModuleHandleA
FormatMessageW
GetLastError
lstrcatW
GlobalAlloc
DeleteFileW
CloseHandle
CreateThread
GetProcAddress
GlobalLock
GetFileSize
CopyFileW
GetTempFileNameW
GlobalUnlock
LoadLibraryA
lstrcmpiA
CreateDirectoryW
WritePrivateProfileStringW
GetPrivateProfileIntW
AssignProcessToJobObject
TerminateProcess
CreateJobObjectW
SetFilePointer
LocalAlloc
GetPrivateProfileSectionNamesW
ResumeThread
OpenProcess
GetPrivateProfileStringW
lstrcpyA
LocalFree
GetCurrentProcessId
CreateProcessW
lstrcpyW
CreateProcessA
TerminateJobObject
GetTickCount
GetCurrentProcess
CreateFileMappingA
ExitProcess
lstrcmpiW
SetErrorMode
GetCommandLineA
SetUnhandledExceptionFilter
FindFirstFileW
FindNextFileW
FindClose
WaitForSingleObject
lstrcmpA
SetFileAttributesW
CreateToolhelp32Snapshot
Process32NextW
TerminateThread
Process32FirstW
GetWindowsDirectoryW
MoveFileW
GetCommandLineW
GetVersionExW
ExitThread
WaitForMultipleObjects
EnterCriticalSection
ExpandEnvironmentStringsW
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleFileNameW
Process32First
lstrcpynW
GetEnvironmentVariableW
GetCurrentThreadId
ProcessIdToSessionId
Process32Next
WTSGetActiveConsoleSessionId
lstrcpynA
lstrcmpW
KERNEL32.dll
IsClipboardFormatAvailable
SetClipboardData
GetClipboardData
wvsprintfA
EmptyClipboard
CloseClipboard
wvsprintfW
OpenClipboard
FindWindowA
EnumDesktopWindows
FindWindowExA
PostMessageA
GetWindowThreadProcessId
wsprintfA
UnhookWinEvent
CharLowerA
SetWinEventHook
GetDlgItem
OemToCharA
GetClassNameA
GetWindowTextW
TranslateMessage
GetWindowLongA
ShowWindow
SetThreadDesktop
SendMessageW
IsWindowVisible
DispatchMessageA
GetMessageW
GetParent
SystemParametersInfoA
LoadKeyboardLayoutA
SetFocus
MoveWindow
GetKeyboardLayout
SetWindowLongA
IsWindow
GetWindowPlacement
WindowFromPoint
ScreenToClient
SendMessageTimeoutA
SendMessageTimeoutW
GetWindowRect
PostMessageW
GetKeyboardLayoutList
GetProcessWindowStation
GetDesktopWindow
GetUserObjectInformationW
EnumDisplayDevicesW
GetThreadDesktop
GetSystemMetrics
MonitorFromWindow
ToAscii
SetForegroundWindow
PtInRect
MenuItemFromPoint
HiliteMenuItem
ActivateKeyboardLayout
PrintWindow
CreateDesktopA
GetClassNameW
BringWindowToTop
GetTopWindow
OpenDesktopA
VkKeyScanExA
GetKeyboardState
GetMenuItemCount
SetActiveWindow
SetWindowPos
GetMenu
GetWindow
USER32.dll
CreateSolidBrush
DeleteObject
Rectangle
CreatePen
DeleteDC
GetDIBits
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
GDI32.dll
GetSaveFileNameW
GetOpenFileNameW
COMDLG32.dll
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
RegQueryValueA
RegSetValueA
RegEnumKeyA
RegDeleteValueA
RegSetValueExW
GetTokenInformation
OpenProcessToken
GetSidSubAuthority
GetSidSubAuthorityCount
ADVAPI32.dll
SHGetFolderPathW
ShellExecuteW
SHELL32.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"
xmlns:asmv3="urn:schemas-microsoft-com:asm.v3">
<assemblyIdentity
name="JR.Inno.Setup"
processorArchitecture="x86"
version="1.0.0.0"
type="win32"/>
<description>Inno Setup</description>
<dependency>
<dependentAssembly>
<assemblyIdentity
type="win32"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
processorArchitecture="x86"
publicKeyToken="6595b64144ccf1df"
language="*"
/>
</dependentAssembly>
</dependency>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
<asmv3:application>
<asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">
<dpiAware>true</dpiAware>
</asmv3:windowsSettings>
</asmv3:application>
</assembly>
2'232_2
2Y3c3n3
4424E4X4k4~4
5(575K5U5
7=7J7m7|7
8$8D8O8h8r8y8
9"9'9B9R9
:(:3:9:@:F:Z:e:{:
</<B<i<
=9=C=T=z=
?:?A?P?~?
$070Y0m0x0
1"1*10151;1B1H1N1k1
2/2b2i2
2-3P3X3^3c3i3p3v3
5#5J5R5Y5_5f5p5
6#6(6/656;6S6X6_6e6k6
6"7(7F7Q7
8818H8_8g8
9.9;9A9F9^9c9
<!<(<.<5<;<G<_<
=+=3=9=>=D=K=Q=W=i=r=x=
?*?0?B?H?\?b?}?
212C2V2
2.3>3D3Y3g3q3x3
4"4,4=4a4x4
5%5G5 6D6d6v6
7#7)7~7
8"8M8W8
:%:;:L:_:k:
;/;v;|;
;'<8<H<S<]<
=+=3=H=\={=
>'><>J>`>o>
071c1k1}1
2!2)272?2M2U2c2k2y2
3%3-3;3C3Q3Y3g3o3}3
4N4e4k4
475I5h5{5
7/7B7R7`7
:@:L:]:y:
;!;;;D;O;T;g;x;
< <$<(<,<0<4<8<<<@<D<H<L<P<l<
==n=t=
>A>G>\>o>
?%?0?~?
)0/0v0
2202<2L2W2]2i2
3,3C3s3y3
434A4o4
5#5/5?5J5P5\5j5
6$6*60666<6B6H6N6`6j6u6
6!7)7.7<7\7v7
8 8/858;8A8h8~8
9$9.9@9R9
;'<1<:<@<^<
?5?[?l?p?t?x?|?
0 060<0B0L0]0d0q0x0}0
1(1-1B1G1V1f1l1q1v1|1
262>2J2k2t2~2
3"3'31363@3
555B5G5O5U5Z5`5g5
7D7J7P7V7b7i7o7x7}7
808<8A8I8N8T8[8a8i8t8
9"9)939=9H9O9V9\9c9m9w9
:&:?:J:]:h:
;:;?;L;S;^;k;p;x;};
<&<1<B<V<\<l<
<D=W=w=
>3>Q>v>
6C7`7y7
7)8F8_8|8
9*9K9t9
:M:`:g:s:
=D>Q>h>p>v>{>
2?2I2e2
3$3*31373N3c3s3}3
44&4F4R4^4p4{4
555O5U5g5m5{5
6#6+616A6G6N6r6
7*737>7D7P7V7s7
8#9+9W9_9
9/:7:c:t:z:
<0<T<h<t<
=+=5=L=V=k=
>9>@>L>W>c>}>
?+?2?9?@?G?P?\?a?h?
0 0'050C0R0^0k0q0
1!1'1-13191@1b1h1r1{1
21282?2H2d2k2q2w2
3 3)30373F3i3r3
3!4,414=4G4L4a4f4s4
.2D2O2
:&;4;B;P;^;
0"1&1*1.12161:1>1B1F1
`0d0h0l0p0t0x0|0
1 1$1(1,1014181<1@1D1H1L1P1T1X1\1`1d1h1l1p1t1x1|1
2 2$2(2,2024282<2@2D2H2L2P2T2X2\2`2d2h2l2p2t2x2|2
3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
jjjjjj
jjjjjj
jjjjjj
jjjjjj
jjjjjj
VS_VERSION_INFO
Sfdhdfhfg
Tahoma
fdgdfgdf
rgergerg
VS_VERSION_INFO
StringFileInfo
040004B0
CompanyName
FileDescription
Shell subsystem
FileVersion
2.1.1.4
InternalName
shssys.exe
LegalCopyright
Copyright (C) 2020
OriginalFilename
shssys.exe
ProductName
Shell subsystem
ProductVersion
2.1.1.4
VarFileInfo
Translation
IDD_DLG
MS Sans Serif
IDC_BTN
SysDateTimePick32
IDC_RBN
Antivirus Signature
Bkav Clean
Lionic Trojan.Win32.Fsysna.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Fragtor.142091
FireEye Gen:Variant.Fragtor.142091
CAT-QuickHeal Clean
ALYac Gen:Variant.Fragtor.142091
Cylance Unsafe
VIPRE Gen:Variant.Fragtor.142091
Sangfor Trojan.Win32.Agent.Vvjy
K7AntiVirus Trojan ( 0058ecdd1 )
BitDefender Gen:Variant.Fragtor.142091
K7GW Trojan ( 0058ecdd1 )
Cybereason Clean
BitDefenderTheta Gen:NN.ZexaF.36106.fu0@ayCZ@Pji
VirIT Clean
Cyren W32/ABTrojan.BLWN-8726
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of Win32/Agent.ADYK
Baidu Clean
APEX Malicious
Paloalto Clean
ClamAV Clean
Kaspersky Trojan.Win32.Fsysna.ihjv
Alibaba Trojan:Win32/Generic.6bbcbf4b
NANO-Antivirus Trojan.Win32.Fsysna.jsthyw
Cynet Malicious (score: 100)
ViRobot Clean
Rising Trojan.Agent!8.B1E (TFE:3:lVmKEGZ4QoP)
Ad-Aware Gen:Variant.Fragtor.142091
Sophos Mal/Generic-S
Comodo Clean
F-Secure Clean
DrWeb Trojan.MulDrop20.52562
Zillya Trojan.Agent.Win32.3013728
TrendMicro TROJ_GEN.R067C0PIB22
McAfee-GW-Edition BehavesLike.Win32.Dropper.mh
Trapmine Clean
CMC Clean
Emsisoft Gen:Variant.Fragtor.142091 (B)
Ikarus Trojan.Win32.Agent
GData Gen:Variant.Fragtor.142091
Jiangmin Trojan.Fsysna.ohp
Webroot W32.Trojan.Gen
Avira TR/Crypt.XPACK.Gen3
MAX malware (ai score=84)
Antiy-AVL Trojan/Win32.Fsysna
Kingsoft Win32.Troj.Generic_a.a.(kcloud)
Gridinsoft Clean
Arcabit Trojan.Fragtor.D22B0B
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Woreflint.A!cl
Google Detected
AhnLab-V3 Trojan/Win.Generic.C5235390
Acronis Clean
McAfee RDN/Generic.dx
TACHYON Clean
VBA32 Clean
Malwarebytes Clean
Panda Trj/Chgt.AD
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R067C0PIB22
Tencent Win32.Trojan.Fsysna.Ckjl
Yandex Clean
SentinelOne Clean
MaxSecure Trojan.Malware.188080196.susgen
Fortinet W32/PossibleThreat
AVG Win32:TrojanX-gen [Trj]
Avast Win32:TrojanX-gen [Trj]
No IRMA results available.