Static | ZeroBOX

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
.text	0x00001000	0x0000e5e4	0x0000e600	7.0558710581
.data	0x00010000	0x0006fd88	0x0006fe00	7.99406082258
.rdata	0x00080000	0x000004a8	0x00000600	4.40157942191
.bss	0x00081000	0x000000a4	0x00000000	0.0
.idata	0x00082000	0x00000478	0x00000600	4.03374374121
.CRT	0x00083000	0x00000034	0x00000200	0.261827388354
.tls	0x00084000	0x00000008	0x00000200	0.0
.rsrc	0x00085000	0x00074488	0x00074600	5.40000220579
.reloc	0x000fa000	0x00000270	0x00000400	4.44569351636

Name	Offset	Size	Language	Sub-language	File type
MUI	0x000857b0	0x000000f8	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_BITMAP	0x000e1d20	0x00002448	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_RCDATA	0x000e5520	0x00000480	LANG_ENGLISH	SUBLANG_ENGLISH_US	Microsoft DirectDraw Surface (DDS), 16 x 16,
RT_RCDATA	0x000e5520	0x00000480	LANG_ENGLISH	SUBLANG_ENGLISH_US	Microsoft DirectDraw Surface (DDS), 16 x 16,
RT_VERSION	0x000e59a0	0x0000038c	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_ANICURSOR	0x000e5d2c	0x00012e80	LANG_ENGLISH	SUBLANG_ENGLISH_US	RIFF (little-endian) data, animated cursor
RT_MANIFEST	0x000f903c	0x0000044c	LANG_ENGLISH	SUBLANG_ENGLISH_US	XML 1.0 document, ASCII text, with CRLF line terminators
RT_MANIFEST	0x000f903c	0x0000044c	LANG_ENGLISH	SUBLANG_ENGLISH_US	XML 1.0 document, ASCII text, with CRLF line terminators

!This program cannot be run in DOS mode.

P`.data

.rdata

0@.bss

.idata

.reloc

2%z}Ep3OS

z3DC_>

RPXQYP

F"6EB0

ZQQPRZ

,N?@rS

3T0:u{

QYZRZR

yc N2(^

K7%NCPQ

`CJVYX

(ngFXv*:

B>AD&m

w$8'+k

RZPXYP

@sWH ft

uJ(T=^

CqPgjk

yTHuQPX

X=}J:#$

YZXXRP

c!RZPQYXRRZZ

'.p1%}

XPXRPX

Nwc\7n

6OLRZRZ

PXQYZUR

6,5>EV

ls0Q!ZQ

wGnz}J

\+3P>DH

S)=mv1.Q"

:Ghw\v

~$uo\!

[NRl,Q

)XX?k.

`>|*b!

D/CgHh

^JTnyZ

QYRZYP

XXRRZP

X8#W$<

uJat{s

4QRZRZRZ

=3;PXP

QQPXQY

6uYQYPXRRZ

.#bbR{

XPXPPX

&pJaRQ

6P?#ul

`a8gQ$

XZRPXZ

LbSbsN

XPPXQP

*^XRRQY

RZQYQY

RZPRZXPX

PQPXRZ

a;y@ER

MDH+tYR

B0?69G

ZYQYRR

ek#OQR

`RZYPQ

kPXXQYZ

@1ZBeW

f4651P

p57746513957746513957746513957746513957746513957746513957746513957746513957746513957746513957746513957746513957746513957746513957746513957746513957746513957746513957746513957746513957746513957746513957746513957746513957746513957746513957746513957746

<"U4u4

!` W=(BA

P.[H'O

(m{U(N

;w3^f'

#}I.P`W9

V)YBv}h

Oo@,Ls

6bJfw'

O7Lc+'

w<("c6

<}Lg{)

\6P3.l[)er

(PJ]A%7

V>Wq3D

x~s>6\nxGS

epo;y4

vsCik\

"j5GWY

AoPpto

gqd8L

!PV6t*

O1&e`9"a

'j#r3O

B*z]E%

/h/TSR

z&FDoe

;(PHS+

Jc?]qA

#n:6M#

8U1Vj/

>_<@_L

r#uKF f\

}fkBz.O53

.0i;p9`|f

Yn0_1^%

!pQoB%

h-wN!/@

^`e/+-

aq2>8up

w{IKtG

I}wf3L

+m3(>lMN

#_&-)

5D0b@'

E93*2Bx

OEF?7cfi

*LhLue

p70v({i

_1qvRI

bM#?]mi

&1dNek

q3Y,D_

9y<tQO

Qjp/Z5

>D~s"*

~wy-,'

qr/wk

RTz$a9

`zyVii?

lGq$-Xf

L6wCr(J*F

ZWY9%Tgv

Du[`SN

o6m6H

ud7x;#

1hOwJH

nkSgKP

7OM.2k@j

mw):%c

4uu=iR

,TS{nd*Qfk7

#yJ5)6@

mNL#B;E

|EKq.i

oVKk.U(

(p|W7

v)jPq6

Tm _D-

)Q> ^\

@"793Xs

?,5um`

R|-Y+^

t&4IU)iG

m9?Tsq

eDBtZ]

9>@C?c

StA)6b#

V_a2rU

}^u~cf

pJ@`"o

/K}%E~P

T~q=f2

[GmeCM

XHC{=D

Av~)2?

kqX.qS;?

w8O{'&

E(84kg6

82g"kTO2

Za'W9

( dL7C

pfP3B~

0v\AM3v

9,{x"a

VZ.*W;

Ph<I/k

6[R5/

<U0fT'gs

M{EUn(`

E%m<?6

B]x\yC

n Ng\x8

M*mB,@ N

@Vu3@

;otm$Q(N

Y('?7=$

K"1UG5

:jWNz)

h;}J*@J

,EwNG;f[

<JwRc3P

[ vIlv

?3J%R[

6MOCP6#7

-r:5,S]

%qU WQ

^WFN;]6

rO3d!2

^t=LG^

0>]Ed*

Bt2}y7

<!_(a/}w

I^]Pk^

vvod2 nW

5,HYROZ

j]fL"G

#<h"4_

HIPJ{pq

]M9Cf.

`;KC#$K

vi 2|cB

aVg{&^

zy3gS+

mW*A>E

dn5wku

A}&0u:

eUfmA$

"qBg5x

["By"#

YBeyV

}~NLA$

Mtt_p-

h$;Y2?ci

Wv3Pz3

jDVJvq

Pl.;*-

'VLP62%##f:

y9j_=

W.|'IQc

Zme\-i[

72q)#(

#q^W-=t

*m<_b?,

D=RJN%

OV;+g4%O

hgk\<Ur

V/,+6_

{pZ4<O-

:7wH|5

i7nk+i

)eZ[t`

CfSQ4$

$iNno-

`.Q)V0N

\b<R8;

Ea6wkwj

%{/3A.v

K5-@*'

:2r]K_:8

,yYTU(

S8KWsKX

|B&@`Y

~$o<LT

{^#B"r

BLy?|<x

k~?9q

Etw4C4

*\7nfH

hn{wF{

[nm-n>

]%[5^J

^VYz~:

=U~`|.h

dXCNv,

p6B{j"

?GrR`cl

!l+r[C

Ze<!>y

94%[o;e

5&cg@Z

L{AyDj

:OX<9l

$J[_8Fl

pd vu&

NTO5=p|

d@rl0

0`[[!-~G

6=BFR #

;I]JvTa

86`Rtw

Ab.MGs}

jWa|vv

nalzc~J

X;MAR%

6{% ,h

[A\zlh

F2F"e)

{`>Mwq

d:j; 4

/_kr^\}"a

04g".<

*v8lyz

i-\0H

UVb"b)

J1!+)7

B]7P!0

#1h"~0\[

AW +ad=

aKA)8*

GhcC0#a

{%@"8i>

4Tf$Ka

[xh!@9

B?*YQ3

$x{k?/e

PiS83k

$mtD+r

.1<y#z

;'x0xv

*pxzTK

U>0^jrj

P,_rKYS

l V4c9

'M\y>+i

@ENM;b-%

^]Xid'%y

m%ej_q

_B>6cr

\kf,de

K.-p#r

CL>zhn

mT;~V~

q,y|};

|$iAUk)

!e)rp

c_DILK

BRbb{

R[G$d7

f',7@J`r@

2k_QfD

FA%R:xDqN

F{=[wz

$7ph18

Cn)=c[

_D]0rv

06vzl[

R$<$qY

-,[a04KX

u+99fW

[_&Y <{

4BeN\>

pf~7B)i& ?

;]eewI

MvuVN0<

xf7%M)

`7qTzt

P!Z"7]yng

t(,=+*

;2zSbR

(ETBEx

bA@m/LR

i[M0.a

LCC4VS

)zsepS

5x84Tx,

|^y I+

zD3{"[

=;.?FPc~

9Mi8H5?

]iU+D

;T~cFC

v'g;;]5-

iwwQR%m

_J|!f

[FO((v

aW:7Y

MN&vrY

Ee4}Cr

-H<#qF

*#W8O{

9S9%>.

7r9n9`Q

g<OyXu$

>}B+>k

|)5}Z

LFj-^d

$0_g~5

$>DkYe

"y2 BZ

gtE'K-

)+Whks

7E7dxU

AqP`\r

},j!Q~S

qL<Pxr^

T7K;LyB

GypMBk

$OT0/Ef

,7Nt?xa

?Uk7>>

~yiq7b

{3GT!:

3B_DT3

*<k*N&

v[C6{)

8&F(U\

'Q<t1!$

79 U08{}X9

hk<f6.

s,]_Cj

a4>a37

OK{S/JG

Z8H|lO

hD!h=+

q,j#=K

f#*aFp

Jz2p?Pbc

mZN7LK/

FOo=2.

O*41O&

h#0p}E)

mqf1z

7+oNvH:

\gG<X@

B%83vl+

AG,=$tZ

J4DEXg

_E>Zu/#

Dp{O5Q

CpN<F^O

xIzC)@

k[h3&p

$kcSq8~Z

0'%K,-

kzp&;%n

J]!O^H+D

eY6z}k

L:9jK/

uA-L{^

JESieO

)[y^K+t

]7hMHx

*+&suKw

',<+Y_{G7

Gc_FB0

Jl{"Vm

gu{4%!

.gKfnn

X%|1Fq

>*m8wmyhl

YVOS~V

e0tqu5

%%lkjPt8

mj77?0%

BKe8dl_

en@Y\Y

8v.;..

"'L%SE

y^:89U

bmh@kan

#5?,<h?

SkP-w{'sh

F4)_<H1a

(""oA2

/+=!dL

!2g''

<Rq:rS

6N)f&(

U~ODSQ0!+

'4PI`T1

R&z~h`

dWF:VW

S.v.%#

+c6Rv1

x{GV,:

TC`[ls

)?E~lc2

=Axa^ Q

V`b^0n

]#]HEW

)#8<Sp

QGob@U

C>$Z 4

zO#H uJ)b

>cXY%Dg

:sI:9A

,"T~m|8

&<N+/=

=6lht6

m #S$$

_q8`qH

oXCN6]

tABPK0V

N?=:WI}

0 dgk&K

K^&>Zo

cm1P=3~@d

0XNMcf

5mCG]lc

_8x.R

w**u)O3

:msz].

izIaIU

U|D>:}

fp{}D2

jb[&4rQ

@5(n6y

-qlAyw6&

Ha.eJ.j

`8:1H^

L=`%m

m_o]5~

t$eZRD

+EJQd|Y

;&/s1Tr

hFE;Yl

"kSdsF

`(]sPa

SJG3bL

We_8[F

'A&K}1

jg0hP@

FYc-MI

qbqq~7

=uAj(F

:U`9T_

_=*~E0Ci

\E4;Y'\~

wOZ9#Ct

vr_.7Ik

1R%N][

GAyt)P

STsD;T

cAsUtc

e`}N+5^m

2!Q3zIJ

{F F^Dz

?/7Tk]

z G]h6

bLzDD

R|;}Hx

.vkG%0Fk

s;4Zjks

4Ov{)R

vu!a7m

yHYghW

0b%ZPl

!0_{![

TL(\D1

xS`2idfB

& ^m)R

7RmuiDT

V\h^uMx

Q|=-);

fE]*Zm5

!DJM]k

T)V-M*

[LcV^Y

?P]-Wo

0-lL5q|

^;iZ8u

bGHWa@

E'?Y()

gxpU_

td`ed7

@@)2F*

g:pgqA

VzQd/

lQgDJz^

|u* ZI

6PbUJG

AJp6g!A

rNVe5i

JL3>:rH$

%(jmzd

@O}Av?

gG_E@R

3BYi>j6

-Nj]av{z

J/1G}5

H$rmhqW

>q9`1/

0*6BSU

[;FEt5

)79\#H

}kUG>e*m!z)

F@z`,c

92KRS1

8~>WKj

vGW=OY

*>?U#c

:|1qt\/'

m,2{"n

)Z@qntc

8m-S7g

gr?ef:

O;-u4z

87)f{]

~jhi1ps]

,qAI#^

ZHbQ"

&\8.v

aV8H '_

l-h})7

3f[|*O

>D^]51

5rjd-"

o'*'C_T

yA?Et<s

DVK6zi5i

.B+xz*

O&ZH=A

Ai/>['

(p5FuB

9JGsN=O

RlSN]M

%agG"d

P6*,ki

"yQ%%AYS

/hnh37

u\e|)7

/AQSCob

+l3=tV

OR]tURuU

%^-1]0t

==(bOO

s3jXkz

;kL+4(

O];O06

zVEPNk;tj

aH8[.UFr

%x2~_8

i|q$y2

CcJt=H

DzT]tL#x3

us]iOP

Ac:#`76

fCuPQ8

e16,!y`

0$q@GGU

H#XOsqH

*VHXb&

=M[lfH

Pwask2

>{ ^}*

cbP{0{@

b1G%k7

b,`%rq

(?uE1u&

LGkOxKOz

WV~g#$}

G43zf|A/

80k`#A[

aU\e=8

P-59cn

ZPb-5T,

O15'2'

o3y>UA

:f3wEW

P8QNmOmt

05nW?*

{tPb~d

K\3:):

yi#=o=

Gd&9~:O

9_\PK(

X&[F][

qvj?eK

M%X-@kPf4T

M@+gL'

8vX(DS

jGHSxA

@-BWF9

*c7yTLO3

TgZ~X0@8?

e}pp9}|

*gR(N1o

<$|]EZ

a=7&_.

>~`Rf2

gWd_bY

![8\>:

;^gjEIg

Shz^AKTOj}@

k[7$QyR

UZw?aqj

>F\1 ?

RDCs_vB

~0:2su

{,S@b\

If@-LG

#D'V^*

TorTCqm

2!N^\+

jmB.Px

1>?}'U

N'VmSo

KF[Z6RF

T}ZWGT$

ClYUV$

3QCv<D

>/7"&t%

Yf-'MZ9

5a6R4<

:B2VP@

--nKh{"

l8L<5S

njx\bT

xSX/"G

Ke]RTm

[>'/vrb

d~Ic+>x

[jNO=V

q*SF;H

m5f>H?

Q6JIl_

%7@Jf)

bu*0:

BJ3X;k

3iU!Vl

PC>(,_QC

wJP!!kt

/0tSF\

i?Af~0!

8=!<+x

"If&Kh*

Zo%_sF

])XLjv~

B6nK@ZX

928R\o

n,t{K6

*@\\)/

.)*l/f

[`I+rF

Y_4tVpM

7(/]#<

<v\-V]:wj

Ry+'?C

:C%%bj

abU?WX

p?Yejwii

C=a_+!M

1WO*}h

Dw=]1'

p@}Ew`zQ

7*YXk5 pe

ufY*Mc

(qKegHe;

^}XbVB

g![D#^KVE

]Z"~'g

=yh fj

4s)!]G

4h6z[g

1?HZ+3

WCjFi$9

\6Wqe:

JXXY`(m

O#N]Gb#

otd|hAb

a2tqn%

kh^dA

@Zp?7Xx

r 3Pmc

j10)(~

Ru5H*y]

aO@gR

shpdT

i(uVE%6/I

wsimjG

8g#6Pp

o>ekHH

vNaSnm`

nNE +<Hh

l:aR#

ggAS_p

[xn@yW

<>@ZRbe{

a[%^")/W

|&k*3`

SS9 `f

LYCzcC

L%%3B(

g6Q`I.

!'Noy&

!ej}(;

#}O6/<

8\MVU}~

<'Wh]r

|Rn=|@&

LcL!m0XBS

IaeXbD_

Ne|vdW

:)B~*U,f'

GwHs~S

05TM)$

~g2[WE

_s_6S

l>gqvJC

j]#Iz9

W>WGR

,sW#K{

4^`8LX

?C{'c7

/kHt.B

a=hTn>RC

(OO_).

O|wDa

S3jcpF

lh;{bU

TWJw#f

T&#aoF

t}<ts/N

& GZz

z<N|k1

Xu,26Rl

O$j-&

vwU4)x

/{W}>D

|eE{(c

J_,1S/

!_7h39

<eL5F t

B/L$$

>7^lRi8;

3:/5nTCSXf}Yo

5?<'w`?

n4,(9M

1%B!Y$]

{>3esm<

lz=9=O

MH+Maxp

KC_)(dk=G

:YU,dq%

!`;[t`

C9BP>X

nb\oUN

Rok4\y

j"cn5l

tMP070

U;_;6O

c97c"])i<

z$%1qZ*!

!T|[|Di

L=(>`.

31!|<|

BUQ1G6

b5L)C.FC0A

}4{>57

|1513957

5746513

K5465139

C6651395

L4513;U

751[957

5651295

$4513857

A5746A;

_5465D9

G;577@>t

V7139:

n7139:

M7774Bz

a3391774

7770651

5746513q

6659395

w3651395

7139577|

H45136

w546A6

s%y6q277|

w<6513

s)5774

7/.465y

7465139}

6513957

s%1395

q.5139}

577|3}639}

|-7746}

5774C?

7746513q

5139577

6513M/

y295lj

u/7465y

u'7465y

y=7746}

>4139577|

!2957746

r >413

vy477|

q~413q

|e674~

V413q0

/565y6!,77|

6413q4

=03958

4774651

>413q4

?565y2

1477|7

=039}6

|751;q

>413q4

?565y2

>413q4

?565y2

=674~4

$75136

=039}6

<751{8

?5651G

q&}4{>57

0395774~

!_413q

!>613q

!?613q

!8613q

!"713q

y=7746}

&d677|

&D677|

&?177|

0395774~

4139@=

4774C?

4774651

6465139

G565y2

F413q4

6746513

G646}0

_5651G

6746513q

4774B;y

5139nij

57746513

39577465kbk

>;57]0^5

:013S7l

q0956C

y677@Nc

u474BP

w365[3i

-g]ta`

.e[sn`

k765a`

-aYybb

J613if

-g]ta`

l451`ob]

eY395'a

646cgY:ca]dn:t

957bbecge

%174fd

4&51G!_3

46e[,l

465geocb

%7957g

746@le

%7957g

u639f_246

; 57B8

=*95B3

751`lc

s Q]_9w4

3^6_1Y

-cS4]&

&,13O(

z113ib`

8351G;

465[2S5];

0>51bS=

3?46CR

<2?<652

S4f]<

M[gb^:

5;957Ad

00??466

4651{8

395?646

g 572,/510

339c]w

fykhjo

651fob

7|7774fb

)*95f`c

251cS6`

>bfdnbbg

1t1957gcc

gvjonb

}074B7

5v;577dc

-(39dbb

065aY8`

3q4513i`d

cwhjkn

m957]$

51395774651395

395774651

Unknown error

_matherr(): %s in %s(%g, %g) (retval=%g)

Argument domain error (DOMAIN)

Argument singularity (SIGN)

Overflow range error (OVERFLOW)

The result is too small to be represented (UNDERFLOW)

Total loss of significance (TLOSS)

Partial loss of significance (PLOSS)

Mingw-w64 runtime failure:

Address %p has no image-section

VirtualQuery failed for %d bytes at address %p

VirtualProtect failed with code 0x%x

Unknown pseudo relocation protocol version %d.

Unknown pseudo relocation bit size %d.

GCC: (GNU) 10.3.0

GCC: (tdm64-1) 10.3.0

GCC: (GNU) 10.3.0

GCC: (tdm64-1) 10.3.0

GCC: (GNU) 10.3.0

GCC: (tdm64-1) 10.3.0

CreateThread

DeleteCriticalSection

EnterCriticalSection

GetCurrentProcessId

GetLastError

GetStartupInfoA

InitializeCriticalSection

LeaveCriticalSection

SetUnhandledExceptionFilter

TlsGetValue

VirtualAlloc

VirtualProtect

VirtualQuery

__getmainargs

__initenv

__lconv_init

__p__acmdln

__p__commode

__p__fmode

__set_app_type

__setusermatherr

_amsg_exit

_cexit

_initterm

_onexit

calloc

fprintf

fwrite

malloc

memcpy

signal

strlen

strncmp

vfprintf

KERNEL32.dll

msvcrt.dll

MIHMIHMIH

MIHMIH

]TR]TR

m^[m^[

m^[m^[m^[m^[m^[m^[m^[m^[

m^[m^[

~he~he

}yx}yx}yx

|xw|xw|xw

}yx}yx}yx}yx}yx}yx

~~~?zzzxiiih

Khhhgzzzxzzz?

~~~?zzzxiiih

Khhhgzzzxzzz?

~~~?zzzxiiih

Khhhg{{{y

~~~?zzzxiiih

Khhhg{{{y

tttYhhhxXXXczzzE

>|||FVVVbgggxtttY

tttYhhhxXXXczzzE

>|||FVVVbgggxtttY

tttYhhhxXXXczzzE

>|||FVVVbgggx

tttYhhhxXXXczzzE

>|||FVVVbgggx

gggfWWWy>>>kSSSMttt7ttt7ttt7ttt7ttt7ttt7ttt7ttt7vvv8vvv8ttt7ttt7ttt7vvv8ttt7hhh@[[[FWWWIQQQOPPPPPPPSPPPPRRRN\\\H```Eiii=vvv8ttt7ttt7ttt7ttt7ttt7ttt7ttt7vvv8ttt7ttt7ttt7ttt7vvv8ttt7SSSM>>>kWWWyfffeuuu

gggfWWWy>>>kSSSMttt7ttt7ttt7ttt7ttt7ttt7ttt7ttt7vvv8vvv8ttt7ttt7ttt7vvv8ttt7hhh@[[[FWWWIQQQOPPPPPPPSPPPPRRRN\\\H```Eiii=vvv8ttt7ttt7ttt7ttt7ttt7ttt7ttt7vvv8ttt7ttt7ttt7ttt7vvv8ttt7SSSM>>>kXXXz

XXXWNNN

;;;v...^???ISSS4ZZZ0^^^1^^^1^^^1^^^1ZZZ0^^^1LLL9CCCE999Q222\***h777nDDDtHHHvLLLyLLL{QQQ}LLL{KKKyDDDuAAAr777m+++f333Z:::O@@@DLLL9^^^1ZZZ0ZZZ0ZZZ0ZZZ0^^^1^^^1SSS4???I000_888uNNN

[[[WIII

XXXWNNN

;;;v...^???ISSS4ZZZ0^^^1^^^1^^^1^^^1ZZZ0^^^1LLL9CCCE999Q222\***h777nDDDtHHHvLLLyLLL{QQQ}LLL{KKKyDDDuAAAr777m+++f333Z:::O@@@DLLL9^^^1ZZZ0ZZZ0ZZZ0ZZZ0^^^1^^^1SSS4???I000_888uNNN

[[[WIII

XXXWNNN

;;;v...^???ISSS4ZZZ0^^^1^^^1^^^1^^^1ZZZ0^^^1LLL9CCCE999Q222\***h777nDDDtHHHvLLLyLLL{QQQ}LLL{KKKyDDDuAAAr777m+++f333Z:::O@@@DLLL9^^^1ZZZ0ZZZ0ZZZ0ZZZ0^^^1^^^1SSS4???I000_888uggg

XXXWNNN

;;;v...^???ISSS4ZZZ0^^^1^^^1^^^1^^^1ZZZ0^^^1LLL9CCCE999Q222\***h777nDDDtHHHvLLLyLLL{QQQ}LLL{KKKyDDDuAAAr777m+++f333Z:::O@@@DLLL9^^^1ZZZ0ZZZ0ZZZ0ZZZ0^^^1^^^1SSS4???I000_888u][Y

III/NNN|@@@

d W!!!U!!!T!!!U

m'''u444{???

OOOtNNN[LLLSIII?III?FFF3III?LLLCLLL\MMMcPPPyRRR

444z'''u

a!!!U!!!T!!!T W

u,,,{@@@

NNN|III/

III/NNN|@@@

d W!!!U!!!T!!!U

m'''u444{???

OOOtNNN[LLLSIII?III?FFF3III?LLLCLLL\MMMcPPPyRRR

444z'''u

a!!!U!!!T!!!T W

u,,,{@@@

NNN|III/

III/NNN|@@@

d W!!!U!!!T!!!U

m'''u444{???

OOOtNNN[LLLSIII?III?FFF3III?LLLCLLL\MMMcPPPyRRR

444z'''u

a!!!U!!!T!!!T W

u,,,{JHH

III/NNN|@@@

d W!!!U!!!T!!!U

m'''u444{???

OOOtNNN[LLLSIII?III?FFF3III?LLLCLLL\MMMcPPPyRRR

444z'''u

a!!!U!!!T!!!T W

u,,,{ECB

BBB9DDDjFFF

FFFxDDD\BBB>???

???#@@@CCCC]FFFzEEE

DDDjBBB9

BBB9DDDjFFF

FFFxDDD\BBB>???

???#@@@CCCC]FFFzEEE

DDDjBBB9

BBB9DDDjFFF

FFFxDDD\BBB>???

???#@@@CCCC]FFFzEEE

DDDjBBB9

BBB9DDDjFFF

FFFxDDD\BBB>???

???#@@@CCCC]FFFzEEE

DDDjBBB9

777"999>:::B:::B999>777"&&&

aFFFE:::B:::B:::B:::B:::B:::B:::B:::B:::B:::B:::B:::B:::B:::B:::BZZZD

N>>>T:::B:::B:::B:::B:::B:::B:::B:::B:::B:::B:::B:::B:::B:::B:::B:::BZZZD

777y777y777y777y777y777y777y777y777y777y777y777y777y777y

;;;t<<<s<<<s<<<s<<<s<<<s<<<s<<<s<<<s<<<s<<<s<<<s<<<s<<<s

BBBmBBBmBBBmBBBmBBBmBBBmBBBmBBBmBBBmBBBmBBBmBBBmBBBm

XXXt999

GGGhGGGhGGGhGGGhGGGhGGGhGGGhGGGhGGGhGGGhGGGhGGGhGGGh

vvv:999

MMMcMMMcMMMcMMMcGGGhGGGhGGGhGGGhGGGhMMMcMMMcMMMcMMMc

QQQbTTT^TTT^MMMcMMMcV1

MMMcMMMcTTT^TTT^TTT^

NNNj\\\YTTT^TTT^X2

TTT^TTT^\\\Y\\\Y

KKKn\\\Y[QIhZ3

\XV^\\\YcccU

|r!A>9

KKKo_I9y[3

_I9yiiiP

}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!}vl!

PPPj\3

qqqM

xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!xrh!

ZZZbY)

yyyJ!!!

mf] tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!tmc!mf]

mmmQ^6

~~~G!!!

oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!oi_!XSK

~~~G~~~D~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~E~~~G!!!

jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!jdZ!1.*

!!!X777

~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G!!!

e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!e_V!

JJJr~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G!!!

#63-"a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!a[Q!2/*!

sssM~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G!!!

%\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!\VM!

~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G!!!

&WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!WQH!

mmmQ~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G!!!

/41+$QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!QLD!63-$

~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~GOOOa'''

1=:3#LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!LH@!=:3#

vvvK~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~G~~~GMMMc,,,

:::[ZZZD

50-(%GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!GC;!,)$'

,B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!73.#0-($(%!&!

'0-($0-($B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!

,B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!73.#0-($(%!&!

'0-($0-($B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!

,B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!73.#0-($(%!&!

'0-($0-($B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!

BY999C:::B:::B:::B:::B:::B:::B:::B:::B:::B:::B:::B:::B:::B:::B:::B:::B^^^D

,B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!73.#0-($(%!&!

'0-($0-($B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!B>7!

P999C:::B:::B:::B:::B:::B:::B:::B:::B:::B:::B:::B:::B:::B:::B:::B:::B^^^D

*=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!,*%%

(/,($=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!

*=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!,*%%

(/,($=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!

*=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!,*%%

(/,($=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!

*=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!,*%%

(/,($=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!=93!

0-*%%95/!95/!95/!95/!95/!95/!95/!-*%%

+.+&$95/!95/!95/!95/!95/!95/!95/!+($%

0-*%%95/!95/!95/!95/!95/!95/!95/!-*%%

+.+&$95/!95/!95/!95/!95/!95/!95/!+($%

0-*%%95/!95/!95/!95/!95/!95/!95/!-*%%

+.+&$95/!95/!95/!95/!95/!95/!95/!+($%

0-*%%95/!95/!95/!95/!95/!95/!95/!-*%%

+.+&$95/!95/!95/!95/!95/!95/!95/!+($%

M1MSCCT

UzzzmzzzVzzz1zzz

zzz.zzzUzzzmzzzvzzzvzzzvzzzvzzzvzzzvzzzvzzzvzzzvzzzmzzzVzzz1zzz

zzz.zzzUzzzl

UzzzmzzzVzzz1zzz

zzz.zzzUzzzmzzzvzzzvzzzvzzzvzzzvzzzvzzzvzzzvzzzvzzzmzzzVzzz1zzz

zzz.zzzUzzzl

UzzzmzzzVzzz1zzz

zzz.zzzUzzzmzzzvzzzvzzzvzzzvzzzvzzzvzzzvzzzvzzzvzzzmzzzVzzz1zzz

zzz.zzzUzzzl

UzzzmzzzVzzz1zzz

zzz.zzzUzzzmzzzvzzzvzzzvzzzvzzzvzzzvzzzvzzzvzzzvzzzmzzzVzzz1zzz

zzz.zzzUzzzl

>ssspqqqcqqqMqqq1qqq

qqq/qqqLqqqcqqqsqqqvqqqvqqqvqqqvqqqvqqqvqqqvqqqvqqqvqqqvqqqvqqqsqqqcqqqMqqq1qqq

qqq/qqqLqqqcuuuo

>ssspqqqcqqqMqqq1qqq

qqq/qqqLqqqcqqqsqqqvqqqvqqqvqqqvqqqvqqqvqqqvqqqvqqqvqqqvqqqvqqqsqqqcqqqMqqq1qqq

qqq/qqqLqqqcuuuo

>ssspqqqcqqqMqqq1qqq

qqq/qqqLqqqcqqqsqqqvqqqvqqqvqqqvqqqvqqqvqqqvqqqvqqqvqqqvqqqvqqqsqqqcqqqMqqq1qqq

qqq/qqqLqqqcuuul

>ssspqqqcqqqMqqq1qqq

qqq/qqqLqqqcqqqsqqqvqqqvqqqvqqqvqqqvqqqvqqqvqqqvqqqvqqqvqqqvqqqsqqqcqqqMqqq1qqq

qqq/qqqLqqqcuuul

[lllqkkkgkkk[kkkMkkkBkkk:kkk:kkk:kkkAkkkLkkkZkkkglllqzzzh

`uuumkkkrkkkgkkk[kkkMkkkBkkk:kkk:kkk:kkkAkkkLkkkZkkkgooop

[lllqkkkgkkk[kkkMkkkBkkk:kkk:kkk:kkkAkkkLkkkZkkkglllqzzzh

`uuumkkkrkkkgkkk[kkkMkkkBkkk:kkk:kkk:kkkAkkkLkkkZkkkgooop

[lllqkkkgkkk[kkkMkkkBkkk:kkk:kkk:kkkAkkkLkkkZkkkglllqzzzh

`uuumkkkrkkkgkkk[kkkMkkkBkkk:kkk:kkk:kkkAkkkLkkkZkkkgooop

[lllqkkkgkkk[kkkMkkkBkkk:kkk:kkk:kkkAkkkLkkkZkkkglllqzzzh

`uuumkkkrkkkgkkk[kkkMkkkBkkk:kkk:kkk:kkkAkkkLkkkZkkkgooop

>zzzatttigggtdddvgggstttittth

Ytttitttidddvdddvjjjsttti}}}]

>zzzatttigggtdddvgggstttittth

Ytttitttidddvdddvjjjsttti}}}]

>zzzatttigggtdddvgggstttittth

Ytttitttidddvdddvjjjsttti}}}]

M1MSCCT

>zzzatttigggtdddvgggstttittth

Ytttitttidddvdddvjjjsttti}}}]

M1MSCCT

xh`V)e^S*

kcY(c]R+

yl$vqj9

{@}tg%

|n%{vm:

:[SI*[SI*ZRI*ZRI*ZRI*bZP$

g_T#ZRI*ZRI*ZRI*[SI*[SI*}wp2

j\INXJ7

eWD?qcRXuhV`qcRXdWD>YK8

%%%T===

'''?HHH

BBBE[[[

III]ggg

OOOajjj

TTTEhhh

uuu&ttt

xxxe}}}

{{{q}}}

}}}<|||

ZVRHkfb

[VRICA@

ZVRHkfb

[VRICA@

`\Ydrmi

a]Ye>=<

`\Ydrmi

a]Ye>=<

JGE)mhe

gYA?xoc

JGE)mhe

gYA?xoc

MJH8smh

EBA)mgb

^M:ipid

EBA)mgb

^M:ipid

umb%wl]

OLJcdYN

fsrpJuiW

OLJcdYN

f}|{Pi^O

G6!^\VS

HEDF\RI

JGEHHEDF\RI

bsnf0|mZ

K]WN&oh_(lf])mf])mf])oh^&l_M

#F5!gSOL

oh^&mf])mf])lf])oh_(]WN&

#F5!gSOL

YUD0$7

_L4OR>%1<$

R=%0_M4NNIE

_L4OR>%1<$

ijc]E;$

R=%0_M4NNIE

WROhUPNe

IDA%HC@#

GB>9kfc

GB?;LGD

GB>9kfc

GB?;LGD

FA="PKHac]Z

QKHbFA=#JEB

FA="PKHac]Z

QKHbFA=#JEB

>,)qZL

;- @jUI

7.":D7,

6."A;1%

5.#!5.#

4/#V4/#

4/#j4/#

4/#V4/#

4/#j4/#

3/#D3/#

3/#[3/#

3/#D3/#

3/#[3/#

3/#+3/#N3/#V3/#V3/#V3/#-3/#

|IDATx

FFp.\@

9j7nD]

Q)(LM2z

VFk, ?2

#G0JA&

b*eMwua

{75SS$

S566<

)ES2Inr

z!>r+X:8t

HkXx-_

H$Bee%n:

15>>oq

555TTT

RIFFx.

ACONanih$

framicon

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

</requestedPrivileges>

</security>

</trustInfo>

</application>

</compatibility>

</assembly>

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<assembly

xmlns="urn:schemas-microsoft-com:asm.v1"

manifestVersion="1.0"

<assemblyIdentity

processorArchitecture="amd64"

name="Microsoft.Windows.PrintScan.XpsRchvw"

version="5.1.0.0"

type="win32"

<description>XPS Viewer</description>

<requestedExecutionLevel

level="asInvoker"

uiAccess="false"

</requestedPrivileges>

</security>

</trustInfo>

<assemblyIdentity

language="*"

name="Microsoft.Windows.Common-Controls"

processorArchitecture="amd64"

publicKeyToken="6595b64144ccf1df"

type="win32"

version="6.0.0.0"

</dependentAssembly>

</dependency>

</assembly>

0 0*040>0J0P0Z0a0f0

041<1A1F1N1Z1a1

2D2J2R2Y2i2m2

3f3p3v3

4-4E4^4t4{4

9%92999X9j9~9

:/:U:f:l:r:

;A;G;b;h;u;{;

> >&>3>9>h>n>

?#?)?.?c?i?

0#0-080>0c0i0

1'101;1

22%232>2Z2d2j2t2

3$3.3C3O3b3

5&5.565I5Q5f5

0D1H1L1P1T1X1

www.esteemed.com0

221026183918Z

231026185918Z0

www.esteemed.com0

New Jersey1

Jersey City1

The USERTRUST Network1.0,

%USERTrust RSA Certification Authority0

190502000000Z

380118235959Z0}1

Greater Manchester1

Salford1

Sectigo Limited1%0#

Sectigo RSA Time Stamping CA0

?http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v

3http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%

http://ocsp.usertrust.com0

rRj;B7|

[C]e=P

Greater Manchester1

Salford1

Sectigo Limited1%0#

Sectigo RSA Time Stamping CA0

220511000000Z

330810235959Z0j1

Manchester1

Sectigo Limited1,0*

#Sectigo RSA Time Stamping Signer #30

/l}.aQ

https://sectigo.com/CPS0

3http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t

3http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#

http://ocsp.sectigo.com0

www.esteemed.com

L`t%2H

Greater Manchester1

Salford1

Sectigo Limited1%0#

Sectigo RSA Time Stamping CA

221026184920Z0?

VS_VERSION_INFO

StringFileInfo

040904B0

CompanyName

Microsoft Corporation

FileDescription

XPS Viewer

FileVersion

10.0.17763.1 (WinBuild.160101.0800)

InternalName

xpsrchvw.exe

LegalCopyright

OriginalFilename

xpsrchvw.exe

ProductName

Microsoft

Windows

Operating System

ProductVersion

10.0.17763.1

VarFileInfo

Translation

Antivirus	Signature
Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.HTA.tsnj
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.67584453
ClamAV	Clean
FireEye	Generic.mg.0a37c2dbf12101e1
CAT-QuickHeal	Clean
ALYac	Trojan.GenericKD.67584453
Cylance	unsafe
Zillya	Trojan.HTA.Win32.157
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005a6c471 )
BitDefender	Trojan.GenericKD.67584453
K7GW	Trojan ( 005a6c471 )
Cybereason	malicious.67f80b
Baidu	Clean
VirIT	Clean
Cyren	W32/ABRisk.JDYE-6828
Symantec	ML.Attribute.HighConfidence
tehtris	Clean
ESET-NOD32	a variant of Win32/GenKryptik_AGen.ACV
APEX	Malicious
Paloalto	Clean
Cynet	Malicious (score: 100)
Kaspersky	Trojan.Win32.HTA.tl
Alibaba	Trojan:Win32/GenKryptik.9fde0e05
NANO-Antivirus	Trojan.Win32.HTA.jwlzcw
ViRobot	Clean
Rising	Trojan.HTA!8.11E8A (TFE:5:N4c784Php0B)
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/AD.Nekark.ldyqm
DrWeb	Trojan.Siggen20.64563
VIPRE	Trojan.GenericKD.67584453
TrendMicro	TROJ_GEN.R002C0PFK23
McAfee-GW-Edition	RDN/Generic PWS.y
Trapmine	malicious.moderate.ml.score
CMC	Clean
Emsisoft	Trojan.GenericKD.67584453 (B)
Ikarus	Trojan.Win32.Krypt
GData	Win32.Trojan.Agent.GZHHU5
Jiangmin	Trojan.PSW.Stealer.cca
Webroot	Clean
Avira	TR/AD.Nekark.ldyqm
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Win32.GenKryptik
Gridinsoft	Ransom.Win32.Wacatac.cl
Xcitium	Clean
Arcabit	Trojan.Generic.D40741C5
SUPERAntiSpyware	Clean
ZoneAlarm	Trojan.Win32.HTA.tl
Microsoft	Trojan:Win32/Wacatac.B!ml
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R587297
Acronis	Clean
McAfee	RDN/Generic PWS.y
TACHYON	Clean
DeepInstinct	MALICIOUS
VBA32	Clean
Malwarebytes	Generic.Crypt.Trojan.DDS
Panda	Trj/Chgt.AD
Zoner	Clean
TrendMicro-HouseCall	TROJ_GEN.R002C0PFK23
Tencent	Malware.Win32.Gencirc.10bef843
Yandex	Trojan.GenKryptik_AGen!p9Ocdg5jnyI
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.210026518.susgen
Fortinet	W32/GenKryptik_AGen.ACV!tr
BitDefenderTheta	Gen:NN.ZexaF.36250.9K1@aCT!f0hi
AVG	Win32:Evo-gen [Trj]
Avast	Win32:Evo-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (W)

Static Analysis

PE Compile Time

PE Imphash

Sections

Resources

Imports