Static | ZeroBOX

PE Compile Time

2023-09-08 22:19:25

PE Imphash

a4516a6804cddd5e52a802d79bbd487b

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00028b4d 0x00000000 0.0
.rdata 0x0002a000 0x000087b2 0x00000000 0.0
.data 0x00033000 0x000024c0 0x00000000 0.0
.vmp0 0x00036000 0x00349fb6 0x00000000 0.0
.vmp1 0x00380000 0x00000554 0x00000600 4.30929250754
.vmp2 0x00381000 0x00639f00 0x0063a000 7.9667383578
.reloc 0x009bb000 0x000005e0 0x00000600 4.32842661706
.rsrc 0x009bc000 0x00012436 0x00002600 3.99885025218

Resources

Name Offset Size Language Sub-language File type
RT_CURSOR 0x009bef68 0x00000134 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_CURSOR 0x009bef68 0x00000134 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_CURSOR 0x009bef68 0x00000134 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_CURSOR 0x009bef68 0x00000134 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_CURSOR 0x009bef68 0x00000134 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_CURSOR 0x009bef68 0x00000134 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_CURSOR 0x009bef68 0x00000134 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_CURSOR 0x009bef68 0x00000134 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_CURSOR 0x009bef68 0x00000134 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_BITMAP 0x009c1d4c 0x000000e0 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_ICON 0x009bdb48 0x00000128 LANG_DUTCH SUBLANG_DUTCH GLS_BINARY_LSB_FIRST
RT_ICON 0x009bdb48 0x00000128 LANG_DUTCH SUBLANG_DUTCH GLS_BINARY_LSB_FIRST
RT_DIALOG 0x009c1e2c 0x00000052 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_STRING 0x009c5f18 0x000002d4 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_STRING 0x009c5f18 0x000002d4 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_STRING 0x009c5f18 0x000002d4 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_STRING 0x009c5f18 0x000002d4 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_STRING 0x009c5f18 0x000002d4 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_STRING 0x009c5f18 0x000002d4 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_STRING 0x009c5f18 0x000002d4 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_STRING 0x009c5f18 0x000002d4 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_STRING 0x009c5f18 0x000002d4 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_STRING 0x009c5f18 0x000002d4 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_STRING 0x009c5f18 0x000002d4 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_STRING 0x009c5f18 0x000002d4 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_STRING 0x009c5f18 0x000002d4 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_STRING 0x009c5f18 0x000002d4 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_STRING 0x009c5f18 0x000002d4 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_STRING 0x009c5f18 0x000002d4 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_STRING 0x009c5f18 0x000002d4 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_STRING 0x009c5f18 0x000002d4 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_STRING 0x009c5f18 0x000002d4 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_STRING 0x009c5f18 0x000002d4 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_STRING 0x009c5f18 0x000002d4 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_STRING 0x009c5f18 0x000002d4 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_STRING 0x009c5f18 0x000002d4 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_STRING 0x009c5f18 0x000002d4 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_RCDATA 0x009c8464 0x00005dc6 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_RCDATA 0x009c8464 0x00005dc6 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_RCDATA 0x009c8464 0x00005dc6 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_RCDATA 0x009c8464 0x00005dc6 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_RCDATA 0x009c8464 0x00005dc6 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_RCDATA 0x009c8464 0x00005dc6 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_RCDATA 0x009c8464 0x00005dc6 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_RCDATA 0x009c8464 0x00005dc6 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_RCDATA 0x009c8464 0x00005dc6 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_RCDATA 0x009c8464 0x00005dc6 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_RCDATA 0x009c8464 0x00005dc6 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_RCDATA 0x009c8464 0x00005dc6 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_RCDATA 0x009c8464 0x00005dc6 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_RCDATA 0x009c8464 0x00005dc6 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_RCDATA 0x009c8464 0x00005dc6 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_GROUP_CURSOR 0x009ce2cc 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_GROUP_CURSOR 0x009ce2cc 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_GROUP_CURSOR 0x009ce2cc 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_GROUP_CURSOR 0x009ce2cc 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_GROUP_CURSOR 0x009ce2cc 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_GROUP_CURSOR 0x009ce2cc 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_GROUP_CURSOR 0x009ce2cc 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_GROUP_CURSOR 0x009ce2cc 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_GROUP_CURSOR 0x009ce2cc 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL empty
RT_GROUP_ICON 0x009bdc70 0x00000022 LANG_DUTCH SUBLANG_DUTCH data
RT_VERSION 0x009bdc94 0x0000033c LANG_DUTCH SUBLANG_DUTCH data
RT_MANIFEST 0x009bdfd0 0x000005f7 LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with very long lines, with CRLF line terminators
None 0x009ce38c 0x000000aa LANG_JAPANESE SUBLANG_DEFAULT empty
None 0x009ce38c 0x000000aa LANG_JAPANESE SUBLANG_DEFAULT empty

Imports

Library KERNEL32.dll:
0x780000 CreateFileA
0x780004 CloseHandle
0x780008 GetSystemInfo
0x78000c CreateThread
0x780010 GetThreadContext
0x780014 GetProcAddress
0x780018 VirtualAllocEx
0x78001c RemoveDirectoryA
0x780020 GetFileAttributesA
0x780024 CreateProcessA
0x780028 CreateDirectoryA
0x78002c SetThreadContext
0x780030 WriteConsoleW
0x780034 ReadConsoleW
0x780038 SetEndOfFile
0x78003c HeapReAlloc
0x780040 HeapSize
0x780044 GetLastError
0x780048 CopyFileA
0x78004c GetTempPathA
0x780050 Sleep
0x780054 GetModuleHandleA
0x78005c ResumeThread
0x780060 GetComputerNameExW
0x780064 GetVersionExW
0x780068 CreateMutexA
0x78006c VirtualAlloc
0x780070 WriteFile
0x780074 VirtualFree
0x780078 WriteProcessMemory
0x78007c GetModuleFileNameA
0x780080 ReadProcessMemory
0x780084 ReadFile
0x780088 SetFilePointerEx
0x780090 GetConsoleMode
0x780094 GetConsoleCP
0x780098 FlushFileBuffers
0x78009c GetStringTypeW
0x7800a0 GetProcessHeap
0x7800b0 WideCharToMultiByte
0x7800b4 GetCPInfo
0x7800b8 GetOEMCP
0x7800bc GetACP
0x7800c0 IsValidCodePage
0x7800c4 FindNextFileW
0x7800c8 FindFirstFileExW
0x7800cc FindClose
0x7800d0 SetStdHandle
0x7800d4 GetFullPathNameW
0x7800dc DeleteFileW
0x7800f0 SetEvent
0x7800f4 ResetEvent
0x7800fc CreateEventW
0x780100 GetModuleHandleW
0x780104 IsDebuggerPresent
0x780110 GetStartupInfoW
0x78011c GetCurrentProcessId
0x780120 GetCurrentThreadId
0x780128 InitializeSListHead
0x78012c GetCurrentProcess
0x780130 TerminateProcess
0x780134 RaiseException
0x780138 SetLastError
0x78013c RtlUnwind
0x780140 TlsAlloc
0x780144 TlsGetValue
0x780148 TlsSetValue
0x78014c TlsFree
0x780150 FreeLibrary
0x780154 LoadLibraryExW
0x780158 ExitProcess
0x78015c GetModuleHandleExW
0x780160 CreateFileW
0x780164 GetDriveTypeW
0x78016c GetFileType
0x780170 PeekNamedPipe
0x78017c GetModuleFileNameW
0x780180 GetStdHandle
0x780184 GetCommandLineA
0x780188 GetCommandLineW
0x78018c HeapFree
0x780190 HeapAlloc
0x780194 MultiByteToWideChar
0x780198 CompareStringW
0x78019c LCMapStringW
0x7801a0 DecodePointer
Library ADVAPI32.dll:
0x7801a8 RegCloseKey
0x7801ac RegQueryValueExA
0x7801b4 GetSidSubAuthority
0x7801b8 GetUserNameA
0x7801bc LookupAccountNameA
0x7801c0 RegSetValueExA
0x7801c4 RegOpenKeyExA
Library SHELL32.dll:
0x7801d0 ShellExecuteA
0x7801d4 None
0x7801d8 SHGetFolderPathA
Library WININET.dll:
0x7801e0 HttpOpenRequestA
0x7801e4 InternetReadFile
0x7801e8 InternetConnectA
0x7801ec HttpSendRequestA
0x7801f0 InternetCloseHandle
0x7801f4 InternetOpenA
0x7801f8 InternetOpenW
0x7801fc InternetOpenUrlA
Library KERNEL32.dll:
0x780208 GetModuleHandleA
0x78020c CreateEventA
0x780210 GetModuleFileNameW
0x780214 TerminateProcess
0x780218 GetCurrentProcess
0x780220 Thread32First
0x780224 GetCurrentProcessId
0x780228 GetCurrentThreadId
0x78022c OpenThread
0x780230 Thread32Next
0x780234 CloseHandle
0x780238 SuspendThread
0x78023c ResumeThread
0x780240 WriteProcessMemory
0x780244 GetSystemInfo
0x780248 VirtualAlloc
0x78024c VirtualProtect
0x780250 VirtualFree
0x78025c GetCurrentThread
0x780264 Sleep
0x780268 LoadLibraryA
0x78026c FreeLibrary
0x780270 GetTickCount
0x78027c GlobalFree
0x780280 LocalAlloc
0x780284 LocalFree
0x780288 GetProcAddress
0x78028c ExitProcess
0x7802a0 GetModuleHandleW
0x7802a4 LoadResource
0x7802a8 MultiByteToWideChar
0x7802ac FindResourceExW
0x7802b0 FindResourceExA
0x7802b4 WideCharToMultiByte
0x7802b8 GetThreadLocale
0x7802bc GetUserDefaultLCID
0x7802c4 EnumResourceNamesA
0x7802c8 EnumResourceNamesW
0x7802d4 EnumResourceTypesA
0x7802d8 EnumResourceTypesW
0x7802dc CreateFileW
0x7802e0 LoadLibraryW
0x7802e4 GetLastError
0x7802e8 FlushFileBuffers
0x7802ec WriteConsoleW
0x7802f0 SetStdHandle
0x7802f8 DecodePointer
0x7802fc GetCommandLineA
0x780300 RaiseException
0x780304 HeapFree
0x780308 GetCPInfo
0x780314 GetACP
0x780318 GetOEMCP
0x78031c IsValidCodePage
0x780320 EncodePointer
0x780324 TlsAlloc
0x780328 TlsGetValue
0x78032c TlsSetValue
0x780330 TlsFree
0x780334 SetLastError
0x780340 IsDebuggerPresent
0x780344 HeapAlloc
0x780348 LCMapStringW
0x78034c GetStringTypeW
0x780350 SetHandleCount
0x780354 GetStdHandle
0x78035c GetFileType
0x780360 GetStartupInfoW
0x780364 GetModuleFileNameA
0x780370 HeapCreate
0x780374 HeapDestroy
0x78037c HeapSize
0x780380 WriteFile
0x780384 RtlUnwind
0x780388 SetFilePointer
0x78038c GetConsoleCP
0x780390 GetConsoleMode
0x780394 HeapReAlloc
0x780398 VirtualQuery
Library USER32.dll:
0x7803a0 CharUpperBuffW
Library KERNEL32.dll:
0x7803a8 LocalAlloc
0x7803ac LocalFree
0x7803b0 GetModuleFileNameW
0x7803b4 ExitProcess
0x7803b8 LoadLibraryA
0x7803bc GetModuleHandleA
0x7803c0 GetProcAddress

!This program cannot be run in DOS mode.
`.rdata
@.data
`.vmp1
`.reloc
@.rsrc
GetLastError
RegQueryValueExA
Q.9K,j
\/Q\Y!
l?eI*'
HeapFree
aZE'Q]2
W6\Vg1+
SK. h=
pypYuW
I#;HzA
dl{;R$
%}htWI
C5q~ir}
WR4X|lza
\B`2!"
"5`N%K
~:v>h"
:8jsdZ)
aBD`CA
hZ|`7~C
rl,8ZMy{
r[7@9d
,w0Vxe
\8K:Wi
j4q^!(4
q<t C,
<U|:~2
/4^.R$
z (T$0
:C)+yE
-iu~W} I&
{(#EJ$
9vrDf5
L]/x*6
f]X^RfH
{ QJZ#0o
d6i3M7{^
@uN*hf
HphgN=
EnumResourceNamesA
i`qw/y
m'Yz+/huU(
VAQfE#
JxfS<4M
6-73Qd9
aHKeKz
bCi2yk>
{JV9rI
j>? .d
_pv%C6Y<E
#5QlafK
!~,U]N
7ylrm%
:Sdh.UT%/cI
3kB?Ic
LGcK>
hxlGE.
6n>H`<
AR1,$AZ
GetFullPathNameW
;5#1tu3
aGmof.:
Pfu(Fg=
MoBP#g'
ntwN3<R
\4y1ke
,4Y+geq
RtlUnwind
S5g)EH
SIP'YV
!JCIRH
s<LYub
y}<tWv
D14$AZMc
3%Ssf;
;ZXHf;
_'\t_-
50Y:up
IZp5 3T
/&KKfj
wU b]7A
\$S[1j
["{k<@
O`"22k
~4ARfA
Iw@t131U
Ch^h6.
^'eJaF6
9Fsk*:
]PtWKvU
,XJa:(
#%: zX
xg7UlT
b0W;;7
[yrlKIl
XR>w_[
w8fBrk
.JMcI9F
5s|5$f;
~n;}4A}
f0h,_b
j"$ }#
D14$AZA
6"{ QGb
v.M<LJWH
O&.IM&@
]Br`7a
qoy'RU
LeaveCriticalSection
L@a1F@
v9~~MeP
N5>H[OHP
%SaM%b
kwNP2M
mNC4zC
w}^]87
9h{}Tx
T/.AZL;
~jvGd~
@mw,MP
A3,{cr
gvN8wA
+s7\Zz
%7I|~=
i4V`E_
ShlVP
CreateDirectoryA
yQ[2C=&[
A]?$S=
:u&{I@
&^bh~&
PX5;P
X]?SBH
L^Elj1
D1<$fD
A_AXA\
$"d_\!
%'vN0O
,XvNq~~
BPSKB_
wI'&hJ
}_2QXe
an.-S:
=xO(tM
-C$W4(
Lu:9!9
FvNB@`
jExyr>
)%}xmU
->$5"D
wMMKrh
GetThreadContext
M5z-(J
BzbgVB
| Q&.)Nq
qph|wH
SetThreadContext
|:xHC(
&/=S9W
e@GUFa
Ug=q0MQ
ARD14$A
EA 7uFW
@4x)GC
x,(6)%
$-<yu$
hEdDXB
s-9FC*N
^)}5n.
.~pQf;
RegSetValueExA
ARD1$$fA
Z!n!%(D
QNuFrHb
6R&3X
>"/eSL.
AR14$fA
iHCTI@w2
hHEF2?e
MJ4,6B
[5+McjvU
%fF`W*f%
kfRxfQhy
_dZw0=
h!|ksn
>_<dbh=
A+x{HL,u
PcNoGau
nbdOzS
Wr:gE"
r^;xv'
&}}q([
JD1$$fA
VirtualFree
AR1,$fD
chK\2a
hiZ,Xn-
%l*7Ba
2El"g;5
[=FDt?
[WAU<D}^J
&-"5&[
~^]huB>Y
<@AD7A
GetCommandLineA
GetModuleFileNameA
WriteProcessMemory
OP1l&D
a4&CJ1
RegCloseKey
5g)EHHf;
hFf-ZZ
r@&D*7
=_EE50\H
-]DvN
;;r~E
Ff)4IWM
WeR>IWl
VwN-?p
)r-8bDj
SHELL32.dll
ouNsaI
c5gYr_
}p 72<Z-
sUU"qS8&
Xw'dXdg ,
2 T`Yg
aKeuZc
<P*BPI
]@4g7[
:hR6A(
Few#O8P]o
Xqq|K
(~zKF
AR14$A
Qhifx2
u[v.6f
!Hh9>}
?<^Q0X
@cYGO,,?
,1ZvIP
;c@Ms
eoNbN6
{]oPQ{
XBu3DX
MultiByteToWideChar
k@di>`
`6D+D{
[0wN~!
e6;cJ_
Cu'!f$
DJmVb
u+:h]Sc
A_AXA\Hc
d=QBAQ
GetSystemTimeAsFileTime
JET)1`
OeguNh
'|UEb`
ARD1<$AZI;
GetProcessAffinityMask
1^A_AXA\fA
AYAZ]fD
ARD1<$A
hbY\Xe.
-Spk0`S
's=Px=
.h>k1h
_'z|r;
s[l553l
?5Sqtm
_G@k_r
B1y73%
SgNXaWn]R
iHa&l2
44:a\K
;9ve}w
Ks5rTSI;
I:x,9U_
!8Ee:
v$KTMm
(' |}9
D1<$Mc
,++~RfIo
?)M!z\
RADgb2W
;Xe8 R
GF&`iX
DeleteCriticalSection
-$m+DT
wjJ#N86{!
d?/b*Q7
V/JHz]bQ
%&;;r&
}"N)J1
m";;j^
39o<4N
P2- `5Z
1^1n`W
m_%!<V
}6iSM1
f^4QVYC
KZp"{]
3g#^b$V%
@7om1s
buNi+D
h/c$I4
M/B;;%
h'tWzmz
n#[K1>-r]J
E+2<p"
CE@vSCP
7}\I4
LSDrgC
SetFilePointer
ad\alR
o`G?;B
"Q5$9N
*&F 1uCG
h(NoN|,
,8xglx
pECZ0
FOpAcK
?X0G24
"]./QJlU
KQJlU\
@3mm3i
wb3UU,HB
?UtN2]s
A_AXA\_AYAZ]A
`~cDW?
14$AZHc
J78'*2.
Ivu1 r
Tq/I@4
D1$$fE3
EnumResourceLanguagesW
A[Ss!<
LoadLibraryW
)8[GyM%
'Pm$O^
)pls^kp
;6F";a
V^L=\m
^[?y`sg
_F=u.]:
S}y2w:
T7r [R|u
K^?O/Yx/
S,:6n_t
+|"cH,
5Jnq(Y
8#mfjE
8"+h~Z
V)2<;V2
OnV>SA
w&l,NJPu
Y@OMu
UQqT~4"
<!gcy4
CQY1K5
CreateEventW
0oK)Wq|
et1_Um~
^ W{H2
VrNIVp
j2>uLME
XrN#!~
D14$fD
WZS=6f
LocalAlloc
OfY14`
QjDi\gR
FindClose
A{VP4/#
%=-Ltn
h5j)22
>'uSd,
ARD14$A
SetStdHandle
z6uRf;
,mY\}d
{m\cKj+
VPZVc_#
n*w #,
(km%;mp
.Edb}"
41I(yF
MultiByteToWideChar
9jrNdkL
(AFuK"n9
'vsr"i
mGxKR=
#.\C(:"
HK:a{0:
$H!?k?
lH`.R9t
tp.%xMn
Baj2e>
B-r_&v
,NE*|-J
CloseHandle
$u}!)kU
3oQQ{x8
Y{gXhY
9,vgF/<s
;0?pe:
1#A|:s#&
%%DZ"Q@
G@BKwG5
z-JJ+$
q,[:A+,
\(Il/h
C{_,I#
inSKB]E
_WQ.aM
8jl!u?
w-15mZ<
s{yc0F
(FK?S)I
kL cw
@j6B_ye
[`bTC0
.Sa9XU
GP}`Yh
T!_]ym+
-=C"Svk
z?_'CO
uJz^gy
KdB|]p~
DR3Ble
K)R2-+
!o#q(
| {l-)
AMsmqJ
Z%.oj"Y
$: 6#M
v2ff`*
}t[E#@
Wo!n(vu
q0;M$K
VUckdV
S:gvgey-
=-s%A%M4v
GetOEMCP
ew>;tF$
K[}"OK
KpiuNKy
M"~7;X
>?a*&U|
K>vRTSV
+#,-QR
QzJ|f>
}$P8~+
W#QME;H?
kC@(oP)
;2,0H@_
=vI9{R
kG:2'a
r@Pr[r
^7;N!"i
$+y4g#
?Dm!6[a
SAeaE\
~dg~N,
^0q-~r4
n-sN+4
ShellExecuteA
ARD1<$fD
sLM7;{D1i
>Nrw].G
2,bO?g
\l!>1<3
{qZ$<3/
u*J6bq
rR4K4X1
T:td_x
hrxdZ;
E1C<}x
5W2/s{b
9\fi<(
w0,}Yit
'DAmeQ3
+F9V=x
|-,>!
v0fA0}bL
jXL;Z!
3.7+(o;X
{rYm7HG
Sw"s&r
#6fR#0
uARD1$$A
d4T%|f0
|Hyo>&X
VirtualQuery
Ow-}hNL
)G1D=(
3Pv[G<0\l
-rp>1mcm5
rGVTY<e
Yda7er
IsValidCodePage
6&9Man
GetOEMCP
AG3)_R
z'$<Zw$z
14$AZHc
AR1,$A
q_6q ns
k0f!bW|
be.aaq.
?=1;h<
14$AZHc
uk)F_
V;n/f;
9,xZ4i
9;f%
0;It>r;
M;cNw{
o+q4tO
,pcs5m
W_`7%+
3^iH^+L
aV8mU
y%J#EH
@?/_?f
|/HVHs7#
BMiED6^
B&u5esgs
rz@{mO
th\O0f
A#[dv)
a}@JNq
Ie|eM{m=
1p Df;
FindNextFileW
4'EDlcX
%hAR35
vd4<;&
w&M]w
C>6b0B[
sI?4G;%
D=vAR#]
97"'S_
+h04m0s
hNz/6J0
t:W#AZf
?0d4;"
LCMapStringW
z6B(ib~
Avo[fE
O:;-Bk
*[aCX;
K62f=cq
3VWM6rt
1m8x7UC
2{49Yz
<{p.ECXb
~Q+h5
Ph&V#o
ypM!2<
TpN?-r
@4#'Kj!
xt%F;r
,c>;{/Y
]?i k{j
:&jNC&
0!11eAM
X]8(*(O1
zS^2@A`^_
?~6sn4z
(@)SR7
u?bOex
p,qwxb]9c
ogh)KOd
f([8#|
5Zxm^|'
[iFlLR
wHFJ&A
J%NKz"9
|IW:LN
$|)w)@
f5Fdf3
b]"3hG
jMb<4n
tdPNWq
hDX81L
Q`ll#>TK
[d)S|AO)d#
vU_L)hzA
p4"cv%
&V4cE!
(7P+U-
9Q^Q7a
`I^8z`
9}@za}\
ARD14$
3!FY!t
RSiWbT
o>aV>7
W-$OPZ
d?p&T8
I;4Uy<C
9%p0Emp
EB9V[6sY
"{dRsr
~1Q4yF
u{amE|
[Rr% k%
<5?ZO"
[mKm=M
~d@6m~1
.~94al~
9+\G]P
8P}Bhv@
IZ{RYc
{f#R`wXDu
D1$$fA
S?6&TH
JR+yzU\
+>77z7
w?#x&6
Q:v{a=
!R)@B$
]Kgy{)
!#VP.,wk
">Jcv)
[7PE;^
5I-\;R(
,Y]@To+^f
)pn)tx
GetCPInfo
kf'|nw
/[@s-"\
gHD4=`
|W;o?I
D1<$fA
Q>SWF 0}
UCZkOL
%0IGRDHA
J!{6f;
A\_AYAZA
2hM%i
?=x%[|
D1$$AZMc
o=JQ@B
Z<V-! d
)Gl'6f
D$ [vr
D$ ML%
Ra"o0\h
|Z01yNm|6L{\
_fBKZ
s0:y&3
!89"nk
MM^s/r1
8:8$I
x==;/{
(,ZSJ
39EEhBl
%DoLg)
++:I@*.
iBX_&^
n/06*e*
SetUnhandledExceptionFilter
GetModuleHandleExW
c1%=;~:
vJ5w-#
btq452
VirtualProtect
4j~*g(p:5,
7Bz6n>
6{bqd3
DWndtP
%;r*t2
y:fe(3
_?3fo8D
>')39P
GPG._g
)]=VX4
D1$$fE
t5l%~*
p{*+{p?
Phv@L(mK
(?L>f;
vDr3;[
+_wS-+<
XrNhj~
pSc>'@Q)
m|G18=tK
@n^*Lx
AMzNL#k
!{}kX[Z
pM;;wCw
8mW<<Z
=-RQ+A
uG)#r
-pHd/fL
9GuygW
F+cd|C
7KlbO{
E8cC~z\
#sW2o}
n3$fE"
%xenru
]~NYK{
]~0Ax4
.,`PV$@
-t#Xljg
au{hy'A
NA}a#Ei
~dA|9=!
(pk,!y
*NxV94
%"Pq{"
FrTQvu#
d^U.*R$
1ZpN<S|
4BDNI,
P`5^.j
"PHW`d
#YvV'mX
5&O~g[
yLT*~;
|$/gLH
l+}jg*W
Qadd$kK
0LB"+Y
&j?UM*
=l#uA<
GetConsoleMode
ODPz26
ARD1<$A
&1<2'Z
D1<$E:
DeleteFileW
OeQ"w3
OTZ[tt
RaiseException
EncodePointer
<!.=1X
_ej*[pi
\D:3Hc
[EqPfz8
{uAAFS
ReadFile
D1$$AZMc
<2u?f;
L$nWx
yS^FgA
|w,iz?8:
#?H8<G
r1=BKu`M4
I0I0xX
=fMgsW
>LSC;p
_4a4w>
!3gWdu
F:S@}Pk&
$cf()0'*g
?xHu"Ue
N[iIlN
vrE6O-
>a6d?-D
<LI$a;
&VO{Df
!A\t/
'O5pn
$,;"@c3xy
T-<H=WxU
,]TI3?k
D1<$fA
_l0F4D
PLH-~%={
"vc^2hv\L
FreeEnvironmentStringsW
_1{oA\
}wsvZ|h
&K`(q
'tWv`,
u%G<,t
wR"=F%w
<;--(<}
l2Hus=
\Z(e?f
U&DE|Q8
[v^s}s
ilM^w4
LocalFree
%(InM^
]/},,$
L;xqa(
ResumeThread
%m+pZL
)})b[^f
otm[Em
Cr&uH0w&A
q@&!!~T&
K<r`N+
0Hnh2u
wgu]Vygv
d`:Ql>J
cSgiSI-CR/TH
x}v&=l
t'$6`H
:s,S[{m
_=!RHX[
$,;:rK
HpFFAg
"rHp[[x
fx <C-R^:
<)FZp2
sWB5''
KC^d,u
SJj>=8o.
2"R}v 4
c!M-bs#
;dm+In-
]f5;Hf
f5Fdf3
DecodePointer
!2`rf;
p>ba{2>_
B#:0Dr
XIn4znd
vQLeCY
R?sTf
14$AZHc
:]4bM]
C`YH?</
]8b's{
?P|WxP4FX
vBl]M. _
0M(.SL+5
3:!.XX
Fxpo5t
mS[0X;q
5h\uA/-
Sh@31M
Cq.rvP
r#_9MF
]IWFpY
D:S(<8
Tq0}{L0xBt
lq/-~LB
JVM>AX
wg5%Ru
k&. qN
1@@w$q
nr]C#q
EsDrOD
ResumeThread
,m,z#~
HeapAlloc
{ 8D%P
~G@v@`
=D$Lxz
'ozDAD
]Bg#'Xg+
3[wYsne
;(!PG-
qCNN0C
? >sn)
c!*<2(
sHfNCO
M6r2JA
^L"=nKU
N%nO,
h ;LX'L
3Hbg_5*
l3/<F"0
:'vYk.
vO.dFHY
m'sf]
"#Z,%T
u?B->@
PbC#.T
?^.<W6
IHAk6;
C2cqrQ0j9
9nZh|6
+ e>tkI
jHA8%i
iu|g&|
WriteFile
;VsBQi
Ia|r)R
s$}|Wi
SDwV7b
0_aoE7
?_P&TP
H9mc0nt
2&?c,x9
Xn9N/q)
%eQxm9W4(
NOnhLL[
fxN=Cj
<}va?C
4#]zp6
+R!.{0Q
IN,";
d4S7@L
M<_K/s.
3VUdDW0
9fy4 M
6i?aUPd
VI{S ;
[t,V-%
NXbm d
%ctNrt
,.~95N
C.<1[A
OBD~84
;nJVHn
j+s[u(C
;eAXHnD
A_AXfA
rPZ~aD
l=+B.j
rW4Fsc*Z
7 :CA.'
V-Dfd
ARD14$AZMc
qhYJf:
5><McW
SW?QCzA
85W&8i
?~k_=|I
KR}G$Ry
A+Udvj.O
TAHef;
AR1,$fE
;Q( D-l
*nLoo9B
!kF`f#
AR14$D#
=[pufA
60d:^?+
+rP gu
qQ;zfQ
`@j==/
Nc@-Wva
X^V|k
D1$$fE
Bf=[B3
BQJ*->/
P:2odB
OD1$$E
Fm./';
Pd"x.f&
nv=3Fj#$
8>v28]
d:,/xb
WININET.dll
Xfw&OT)
K<yik
";ei^q
~/@^Hh
hmUbBc
5<5xJ%
.yyaruLh
:bwldxbR
;vr|FnJ
>}>aA{
1IA{SE
~huxi
{UO@4K
zWc|Uv
%2QKnI
1sl8Ib
4LZ7\i
O}NR^e
@#.D6p
|P|#Wi
4qJ"bL
AR1,$A
TKsAZHc
OsGZjM]
yO6y2"
Vzc%-C
'I3LFyU
_{%o&y
P&@44y
1yZ/"nZ)k
j|BOC(|
HeapReAlloc
InterlockedDecrement
9iTJcoR
M6oFU0
~h,b=G
D3^1UF
%8imA~
KQ~K]Or
j9$Pf;
}D1$$@
Fk\&=o4D
B&#~@
=MJ<0!
yg*@~N
}Q?e*$
(:N?O[
CYop)C
jCPk'(C
8d(L#O
'sET/x>*
Y&/Xsjb
knN#MG
gRTNq~
LlK19&
;R[=Kn
VUhf<DV
M#mG{}
!hivOW
;y`XDnp
G#%Lw
^+S_Ox
P$Zw^/
#G|Bw_
D9xXdwP
}$92\1
H^BSp_
-&EtX{
B~i(F
_n6)2y
@bL#V|
8ddC<fOp[$<6
5hSN%wh
9veyce
;cZOM-
&^?,)d^
F%vc1^
9&UMUI)H
8rw"8E
X#[~~yn
eD6;b|
vz2A#Q
|fi~SY
2~K~d^
oZ5>+T
5NxW+h
S:r;g;
PM*j5OBGs&o
ovC3!
"Kt_E9a
a]*|2/
3I0c^#
jI742
Hs!wI[p
R41w6!L
<iF08R
$uIf-_Z
ycA#oE
Lg&Xce
>9^q}J
-Bdf:7?
RNqvj5\f
p\C]SI9
|@D}h@
;9p:Jn]
x^Us>l{J
0I1+KD
\GUjnc}Z@j
\hnk}{j
..,o_B
w'K/PK
)(}mfE
ER1,$D
y g0OF
q.uHv<.u
-;JoY*o
rhN7 b
^XK'Y/
*3PJ{:
}3UuM4"
keh2:l
7d|}fm
`dyBPc
a)~!f^
M`=1}gJ
D1$$fE
A#6,zq
"fM?so
~gYp/n
Mwy[;c
SlN-r#n
1kj.ARD
TlsGetValue
3bq@geE
:~78AC
0'azQ#
P:gW/[
6mW5w'
~B'`jqq
xF"r)Hh
,{i|Q;
<jhBFA
J=OJN.
3m>Boe
2]A#)d
]=_y\=
/P)B2/
7!zRmcEq
.c@+)#
X=E+ze`
S?w7Nu
/?B~hD
rT?deP
A:Dc//
C&^ERG
Oq+c?P
&"b;Wa
Q >6'v
"7U3$a#
?sG!cU
VVWd{Qr"
q#}c= gy
$Lin$+;
;b*+Wk
-rIS7!|N
/@Phq<T
HHUo_]
K#=Y2j^
x8WPb*
GA/kaW
0*~GV^}
"6sNYG
RV`K}u_|r
3wDv"]
$Ko/A@xw
.BAc-m
0gskmm
jS8FA;
[O+>`cN
lN=I+%
N&3w H<
Kz|(v/?
vzKd>=z
o_[5Ht
UU$qZ,
-#8`RRIR
FMz&nf;
FDbPl7
l9M!zJ
+N?9D$
uf!$A3
fl$yM_
fjDHyS
-P^0UX"Vw
0%h@[{TMt
GetSidSubAuthorityCount
D1<$AZ
lV*vlB
O@)n2fET0
;VbKEn:
Ci5uGSz
/I 7E.[~
o?@Co^o3
F?y-Kd
a=K=&'
cwlabz
SetUnhandledExceptionFilter
GetProcAddress
>'_[ot
rYP603
F*@wAI
VirtualAlloc
J81+KRW"%8
]# m#S
JpS!19
Hk725i?W=
3->x36/
(CG&)A
;(A6En
%;_4Jf
"F*{GV
xK1#zV.
ZH53T
E%I-\}'
K#,Vp{
GetFileType
v~4*j";
;2[OL-O
;Y (Mn%n
W[O+DW[
yt!.'Y
N:)C+
]&CV{`u
[ra2`t
(UuK=P
jXB9Rd
]PE%/
EnterCriticalSection
o6uV33
GetModuleHandleA
22 #w=O
&{^&OO
k}9OPk
<~=`2H
]~y3)h
WP<%xOC
;E=Cw9
=|D6;5ip
Xi[Mr+
xw<3HpK
Usx@et
^ro%0+.k
<6{D"z
L@B6Qn
/@%_yC
{{O{inn]`'
D1<$AZMc
5Qt>A3
VTEr>uf
[EpGTf
NCIco7
q-hC)]
*9:76D
S|,WrZ
CreateFileW
|%-<>>%
8q;-"C
gY`?#s
EVUSf+
~4@n{0
!k-y6]
Nhz:y@
k,F}UM
o/?iT|
A0iV*R
\Tj'wC
Ik((_6
F}gquX
Y:dqnO8m9
;T}_@n
Ta"$>uq
FU,%{g(B
%zYg44Is
*OZ,s<e
mmw6tM}xX
^wFW6=
mNIpf3
;}TIG-MlK
Jb 9N>'
;sj%Bn
'zSvN3
>I{&F?
`TIfA2
Qz"Vn
q<J5J^g
gK.,S)O
tx3bZu
G#Ka\w
6xQ`"d!
E^W;3~
*f vQ\
;<uNH-
*oQ~Ok
PLbnVU
v<*X&O
x}VNGlpA
ARD1<$fA
g~kG6w
A{>Dq|I
#}f "}{
Fdt,q
EtEh2G
.]9Cf=JN
G#Z#-1
D}wG5^
V)?Ev
0,wVR=-]
<Pv5x6
;-)>AnY
tAR14$AZ
AR14$AZHc
D1$$AZ
U}9YN(|*j
MnG&nUJ
8/83g?
+6zyF
WETQ'>
qe@LnV
RXC7&v
Ja7:Zz C:GR
%7ycqV
seold
mbyxuG
l1szNsp
?lKBCS
jJn_Be
#D%wMc
$%n-f;
TlsSetValue
tsTb}-
M,is:f
ARD1<$
5g)EHH:
mE^]H:SA
`>Nx~r
DmDH+R
;e!WBI
;[2xCn
<xdk?~xg
J?t23B
@!&vR=O
?mu3rO
TlsFree
L*R5Uw
jDU5U6
b=qR\e
aRonaqx
SetLastError
VirtualAllocEx
?A({&s
uBW9h
PmD>WX
GetTickCount
`_rUPw
zi3[hw
x"3>rMxEc~'
CjRQIbq
tH@-eTJ
;e!)Cn
qu/TEc
l#q=wh
}uik\p
QgmYcF%
*]O_{T
0G^'70
}]J`MZ=
vMtkvBz
i,OARE
CA.Y}Op
C(H&|h
-.[dp~
;W>UK-'
_FXEA[
:{drJN
d$@:{~
!;q:Z4
$@}47E
/&bO_]<{
ARD1<$M#
Y@NoXyeX#
%'M4jIZ
?Luo4z
LQAL|V6
q<IM 5
z=X=J:/
bZ0QC
=$NG\-
^E>Hb+@
`jA|&Q
R3k\F?
42z5DH
}t/G{t~`
SuspendThread
+tO%-L>
zZEc}\
1uG+nf
<j^"l'
eUf(xk
D#PZKt
;WOnKHab
;2VSOnF
P)`c~5
gR.3]'
)1UEag
{2T4tgD\I
0=|M|(G3nv
_w;9wU
8K(`1H
tD14$AZ
-/9FVK
0Fc!g3.4$
\8;k\k[
PQH#^D
x;0+zl
l"L}k v{
A^A]fA
ARD14$I
29$"f?
Ud"6R'~
mv@CA
@o,"VLJ
>D;jp]
cVsG~.
7'@v02
ARD1$$I
UnhandledExceptionFilter
j8"-z0
"ez@6t
+&jKgu
S.DB[K
D1<$AZ
yjb`IX
U^{F~
;kS32Rqc2
9~cJK}z
6Rm21_
%4F7Ay
AR14$A
28Hv@~z
r!jO3f
kc1pU[
qmkTe=P6
Y*yi5$#-
{&9PXy
D84;+?r
9NO1x'
#"bYrY
baO8YE
yotxZV
GetModuleHandleW
D1<$fA
p6)/f$
kbX>%?y
+h2\Sh,[
F[bE~f
>{-el{I
T+.mj
!X.ar^e(
yWf&DIm
4sFeFV
PjEe1
t].&":@
/tQ'5d
1_5D`5
""OE]g
;D>IqT
q"D12#
;:^&NnK
GetFileType
'W!`z3
D\6pBD\
+Ydd/$
SystemTimeToTzSpecificLocalTime
%|H$_ F
Q1O "Q
Df)QKf
?!)t&%
E#d>bu
{GJ+K@=
M+SZ},$
=\%GaLy$#
9w%u6!
'_e+4-
#]RmBC
Ve6Nc+{%F
O-7[\_dV
n@9]@N7
XxLY9>
0[2qZ(
r|hJ/W<
!vgpKO
=bG-<-`
?m|@f{9
3~`"r7
7w`Mn%
df;$dI
VFO-OnD
`$~r)5"
V-?+Pmy
I.OKz7bl
[pR$nKT
ZtiUfE
P&UI;6
MYq|Id
3l8RjZ:
biMp*#
BnKNFm
;'7S\l
3J-jF
'.K!>a
b!b|/c
a#`86a
I@cwyG
t-kv%$
R(>ub/I
)*:>.]
vBuR7%
CR4tu%n+E
PW)fU/~D
`/9i{iRW
8f=6,f
H6F-1P4
^AwPX#/
Gi6.g+
~$p}c,DK
Qy}^5^
D14$AZfA
0Z|O"rZ
9]> a-^@
l;%7yr
14$AZHc
~(%/D{
Ai^U}K
K*.4-?
Mt0$k#sp
4{WZxSyW
+^Zz~
bG(??
ekJ52(
KnGpH~
I%1` i
"szw0x)
}*>K*A
}Q<V/=
;# -b_<sr
zXC{t\
oP-iP;DOw
&*.G#I
4m~k\L6#w
*qvltXVH
OXF#ic
B#[Axr
xdIn5.
(KBJ|,
;<U9E-$U;
x\MBV8
yVQ{Q4
wEh-GV
OGr9c=Z6
~VIi^,
g4AYA{V
;x/"v<
c98hYuJ\
Jy.BWE
gx7=:,f
G0~$[=
f|FLra
;iE'd
Xw> q7
%5<C\?
FoKgV
7}mx[{r
SX;9;+k
zAn,2Ll
i;f*Nqx
bBJ[SV
~jPGS[
z=s5.4bL
lTPk*EMK&}
{ARD1<$AZA
V@m*9~
w)zjE
L?b3~N\
'%KDua
^A_AXfE
_AYAZ]A[f
wlN*mw
.wqj}lw
SwQ4%%6Ze
wB5 \i
^<{XVESR
SjPa#Y
BsX8'k+
|2PBmF
b?&6Pt
%Vp}qX8
8ZhG6"
Uou4qG
SetFilePointerEx
;*.VNn;P
fE/QGe
PGcw,t0
sOKE2c1
mPQG27i
q)}'b-2
a"Z.M_
]f%R)H
q5K#7}
1,bYRk
;VRyNnZ
9CR|pM
3e\tL9c
_D1(`:-+
W(1:cr
spt5.w
UxC8nj
o^I!q
,cw8;](`-
9B0,geX
b'4FJF
kt<x I-
Teiqdb
=+1^\f
.6.`2
!3njVY
yp[&{
j)V@WZ
G#Eoqw
;vmLn
KFK9Tr
SystemTimeToFileTime
GZkuJn$b,T
pETQrR
1~J%=+
G?u)Z,4|
'TjIz[Ll
- T:Sf
RGekuR
6Rhq<tR
qxFiiq
-^4R^v
/nV'sd-
GG%]M J
FwA8}$
1K[pu[{
1d#a-g
5BU`k
8l.?SX
W{Jm2:
v{J@J9
p{>e;V
aX{IP.ApG=
ld{ciU1
{<Yq'{>v
2oNg
n+Y$u
w9eDH+
{5JnAG
Ae:./1
+[s8F|
O2M)8Zn
oOu?z{
Cz]I-3r_
@n}S"m
v"X7=
M8ifN
3G0?R\
nIo9iI`
3GU}`ff
8UTTZh
AR1,$AZfE
0LaG#g
Iq <4
kiA-"ck
F#jpVv
*ruf9hr
a_Pah#__3
3mlBFt!lY
<N8yBI}
dTM5z-]
;~Wd@nG
LnNymT
(`:^u>p
IRcU >
'spDOA)
k~#7ZtHx
PtSXx]5Ez
m5!eXA-E5
U`M#+Q
D1$$fE
T)`??T
Xy-9:9s
LoadLibraryExW
9THX(c
YacAx'
SI)c{-5
7a.3QuakV N
S#x8TT
TR77dU@
yVsDIQ
5>+yd7
i??686
b>.FR9Y
L/9n7ZI
3i05?qya
}5Qd3*
@+*Fd@PZb
yR<G%5O
XOlt@r0
:`|@fA
I;T&OB
q({*dv
d5<&o>;
*PTv]=
E#lX;d^O
vH,0}"
U[bG0:E
/5K.?sh
;^7<On
U4ui/>
D[`x}}
E#IM,d^
}[?mfu
SjyU=l
B(iXx(
LGH#2H
SGd{O
LV~ie3|~
];~4JB
;f.K1fp3
mNR^.[
AnL-`1l
LcG:&L
UFBK-+
:JEALh
qAryQ:
(bFth*
9G~5)`o(r(
%&/t(
A`S3;
%ElI@'Z
K4C-&'
*]m&
H#oEUx
qWop{;
p!*1Z<!
#@|l-)b
g3s&~.
;JsVG-
}2(%~J
^p_05C
AXxY~cFe
aoE^Qh2
OpenThread
qCW$>(ll
g8cFCt
oJ-(6j0
RIP=dD
2bx%j1
KV=X>cE
]n;<9K
`|}/>f7u
+)"/\+.
;!@[=y!S
aa<%E#ak
n=9,wK^4=
{Jea.<
KdZ.sZ
_dO5g<
zxH%+q
&y\jwp
qyYUA~.
r$M3C?
^J?~#Q
_tF\yC
`Coia@`
GetProcessHeap
?ihSK7
p5g)EH
)zt}Ox
ResetEvent
AT[(CuT7
(pPT},
;GNACn[
;g-L.:
KoN#E_
FT}@S
PT\}/g
0fd@pc
GetUserDefaultLCID
;K"*I-.
x#>>.mt
TerminateProcess
-1E|Xl
aP^w^p
,7FnqVky%
)yCv:k
rgT"5(
LRZCqxw
`di]wv
*Algw2
l2).y|
#%P5%
gk)T|R_C~
JHQ+#Yh
@JI#V|
f8J} 8.4
q`aL/I
|%l[B|%
CaExGEJJ`RQ
,AE=u-
M=Y`b_j
AR1,$AZ
UnhandledExceptionFilter
*0zQEr
6 GC*"i
oGC^fD
c.1**w
qU0<'N
?bwvW2
X1I#v,
%&7%9*&
i&(1n+&
E#|vxu
z;<*+x
t]I1+.
z2=g".
G?(n|Gd
`Sf={y
ibOzYe8
gF(`h
FileTimeToSystemTime
ARD1$$D
F4G4AC
uCd{ED
9+<Fh"
n+9y^,N
.iE/)
N) ]zU
hP~XM-.}B
#?\}ky
PW)0G/f\
P.P9W/
&hxm,a
`w{$-$
9HlS#L
qLP/u$
@H(6I/2
3C-4e1
#s4Nw(
*K-()(
un6&:$S
ARD14$AZMc
[XW;B
vF0}9&v
Ofc~a`
Yc28+'
zLVTJK!
![j &,
L O%|'8
3R(#jB
=s\zb?'
|t3g:W
|S?m^u
a/{o;f
1&S@E~
5s|5$<
;v2}Bn
"(b0;
?JuXR>
#vH3ts
D1<$AZD:
{3>_vP
QeD%}m{
+h#6)B
s5!+A<
$:jafgi
uAAVEF6
C-X's*/
,Lh/+;
14$fE#
LoadLibraryA
CreateFileW
Y(`}&uu
=&}is^
|@ksIN
3.2Zn-
RemoveDirectoryA
$"br?H
$HZ<d3
bW0iwJ
k-Ki@t
\3k+[D
G]'$wZP
&1;jw8
z0/%+9
jYcWZ^
q1>UA6I
\5z&l2
-0Mj~3
GetModuleFileNameA
GetACP
GetModuleFileNameW
t~\Pf;
Hoh(n$c
i4PIma
k`+S\i
G37$Xo
F0KbJ][
15x6g~
su&&MJ
wH4>=n
xJ'r#N
WvD]LZ
IGB-$X
}o94QhN
nf8cXR
Pg: Tmd
0qO+b=7
AR14$AZ
o'mqPI%d9
<zgpp
I<I&NX
3X&.3BS
D"Knaj
GetFileAttributesA
xzYf)s
${M)ur
/z\Y}+
@Cf5Fdf3
5't@{m
hoUL+z
1b(y^y
GetCurrentThreadId
D1$$fE
xWB^HP5
:O`"=8
N;[/~<,
c?\S8h
<[`L2:
^D14$D
!OVdlM_
R]Qk(N)B
BUTi*C
GetStdHandle
~E* D)
5D{ao7<a
?srxoz
&(e8M0
JO*AT$^
,GNDM
Qm}AtQ
Tx`~w\
v44|\
PeekNamedPipe
"`cR~_
"UR9G.
|')#X{
e;<tB;
zO~iH>
mrYY;hk
l[|-pnr[
9IZ~wbS
7*PBLQK
fMHP*O
J/bnO]
t@Z>KR
D1$$D*
|*f=L-
lC*O=J
Q."Na)U
gB;?WEL
vJI@#4N
?>PU/$]
,`O@#FL
TlsAlloc
@^p/n@M
`"F*j=
6y7YPM
S%;dljXU
D14$fA
{#K+f;
-/Zl|U
<5B#z0
/+F>v^V(
CJ%If;
GetDriveTypeW
ARD1<$I
W|8;nI
D1<$fA
CopyFileA
XrWdj%
{!..0:W
GetSystemTimeAsFileTime
G%,Nug$
$3&HH
Pqj8Oi`
l*V.KaT
r]Au'xQ
pc^K3]2
ZN|k2.;
Is*gro%
GetTimeZoneInformation
~]bc\ K
n3ty26
!K2yf
3e7:bX
@l~b+a4
Stf.`T
z6FQY7
QGlqbOEe9
cbBI.2
>b}Ise
jVh3v?I
-*kb}3^N
,t'%kS
7f&ZXR"
A:D{&/'
7,BfC%z
i0_a[C
{U*$[XV
$"k|l
\T%'&HeY
s9.[d0"
Fd ;;$
lOJM1^0
Y/"sPX
mYC^jj
},\TpL)3
RFtcV'
"`lgD
#tf";>%
GetVersionExW
]G)#H=
0C'#Tp
4v]fx,
u}QDV^X
GetCPInfo
GetCurrentProcess
cm8hUc
vvz*f\
SKb-[B
^3.]q]
o[s/2R
!ZgKEJ
+} w#o{`
O\r_iX
oQ\-n[
dtA9a6
[M-z+
jtJY8<!
zd~8;n
3]@-J+_
7cp&Qn
6SHO24P
_f\9oa+
gHv3`?
_{3r#!7
sx|t04
&1<7X
U)yI|
No:!SF
'I553l
YO~9iH
tK:JDLM
8#bwi*
d"v85+
o#gH_$
B'#;r T
&7t.!@
=)sC$I\
U|~~)H
([7Z}"
MX,V.[
]uWs>tr
:EQFz2
q<N&l0,
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Stealer.12!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.69278639
ClamAV Clean
FireEye Generic.mg.7bf101b7b7b02288
CAT-QuickHeal Trojan.IGENERIC
McAfee Artemis!7BF101B7B7B0
Malwarebytes Trojan.Downloader
VIPRE Trojan.GenericKD.69278639
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan-Downloader ( 0057994f1 )
BitDefender Trojan.GenericKD.69278639
K7GW Trojan-Downloader ( 0057994f1 )
Cybereason malicious.7832ae
BitDefenderTheta Gen:NN.ZexaF.36722.@J0@a0KIqwoO
VirIT Clean
Cyren W32/DelfInject.A.gen!Eldorado
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of Win32/TrojanDownloader.Amadey.A
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 100)
Kaspersky Trojan-Spy.Win32.Stealer.eueg
Alibaba TrojanSpy:Win32/Stealer.613256b7
NANO-Antivirus Clean
ViRobot Trojan.Win.Z.Agent.6542848
Rising Stealer.Agent!8.C2 (TFE:5:ARQLZM72JmD)
TACHYON Clean
Sophos Mal/Generic-S
Baidu Clean
F-Secure Trojan.TR/Spy.Stealer.vvvpf
DrWeb Clean
Zillya Trojan.VMProtect.Win32.85462
TrendMicro Trojan.Win32.AMADEY.YXDINZ
McAfee-GW-Edition BehavesLike.Win32.Generic.vc
Trapmine malicious.high.ml.score
CMC Clean
Emsisoft Trojan.GenericKD.69278639 (B)
Ikarus Trojan-Downloader.Win32.Amadey
GData Trojan.GenericKD.69278639
Jiangmin TrojanSpy.Stealer.aiwa
Webroot W32.Stealer.eueg
Avira TR/Spy.Stealer.vvvpf
Antiy-AVL Trojan[Downloader]/Win32.Amadey
Gridinsoft Ransom.Win32.Sabsik.sa
Xcitium Malware@#2l7ysi2mzw41s
Arcabit Trojan.Generic.D4211BAF
SUPERAntiSpyware Clean
ZoneAlarm Trojan-Spy.Win32.Stealer.eueg
Microsoft Trojan:Win32/Amadey.AY!MTB
Google Detected
AhnLab-V3 Trojan/Win.Generic.C5378547
Acronis Clean
ALYac Trojan.GenericKD.69278639
MAX malware (ai score=85)
DeepInstinct MALICIOUS
VBA32 Clean
Cylance unsafe
Panda Trj/Chgt.AD
Zoner Clean
TrendMicro-HouseCall Trojan.Win32.AMADEY.YXDINZ
Tencent Malware.Win32.Gencirc.13ef65d3
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.1728101.susgen
Fortinet W32/Amadey.A!tr.dldr
AVG Win32:BotX-gen [Trj]
Avast Win32:BotX-gen [Trj]
CrowdStrike win/malicious_confidence_100% (W)
No IRMA results available.