Static | ZeroBOX

PE Compile Time

2024-06-06 15:57:58

PE Imphash

73f1fe0218fd69cb0bf74a3f77c6db00

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0006f156 0x0006f200 6.30278584435
.rdata 0x00071000 0x0000c148 0x0000c200 5.72677365785
.data 0x0007e000 0x000dc55c 0x000bcc00 7.44683836819
.reloc 0x0015b000 0x00008120 0x00008200 4.19954266732
.rsrc 0x00164000 0x00018558 0x00018600 7.98574773462

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00164444 0x00017f5b LANG_NEUTRAL SUBLANG_NEUTRAL PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON 0x00164444 0x00017f5b LANG_NEUTRAL SUBLANG_NEUTRAL PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON 0x00164444 0x00017f5b LANG_NEUTRAL SUBLANG_NEUTRAL PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON 0x00164444 0x00017f5b LANG_NEUTRAL SUBLANG_NEUTRAL PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON 0x00164444 0x00017f5b LANG_NEUTRAL SUBLANG_NEUTRAL PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON 0x00164444 0x00017f5b LANG_NEUTRAL SUBLANG_NEUTRAL PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON 0x00164444 0x00017f5b LANG_NEUTRAL SUBLANG_NEUTRAL PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON 0x00164444 0x00017f5b LANG_NEUTRAL SUBLANG_NEUTRAL PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_GROUP_ICON 0x0017c3a0 0x00000076 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_VERSION 0x0017c418 0x00000140 LANG_ENGLISH SUBLANG_ENGLISH_US MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79

Imports

Library KERNEL32.dll:
0x4710d0 LCMapStringA
0x4710d4 GetCommandLineA
0x4710d8 GetTickCount
0x4710e0 GetLocalTime
0x4710ec FindClose
0x4710f0 FindFirstFileA
0x4710f4 FindNextFileA
0x4710f8 GetDiskFreeSpaceExA
0x4710fc GetDiskFreeSpaceA
0x471100 MulDiv
0x471110 GlobalAlloc
0x471114 GlobalLock
0x471118 GlobalUnlock
0x47111c GlobalFree
0x471120 GetUserDefaultLCID
0x471124 GetStartupInfoA
0x471128 CreateProcessA
0x47112c ExitProcess
0x471130 CancelWaitableTimer
0x471134 VirtualAlloc
0x471138 VirtualFree
0x471140 CreateEventA
0x471148 SetEvent
0x47114c HeapReAlloc
0x471150 HeapDestroy
0x471158 FreeLibrary
0x471160 HeapCreate
0x471164 lstrcpyn
0x471168 RtlMoveMemory
0x471170 GetProcessId
0x471174 GetTimeFormatA
0x471178 GetDateFormatA
0x47117c GetLocaleInfoA
0x471180 GetComputerNameA
0x471184 MoveFileA
0x471188 ReadFile
0x47118c GetFileSizeEx
0x471190 WriteFile
0x471194 SetEndOfFile
0x471198 SetFilePointerEx
0x47119c CreateFileA
0x4711a0 CreateFileW
0x4711a4 TlsSetValue
0x4711a8 IsBadReadPtr
0x4711ac TlsGetValue
0x4711b0 DeleteFileA
0x4711b4 GetTempPathW
0x4711b8 lstrlenW
0x4711bc SetFileAttributesA
0x4711c0 GetFileAttributesA
0x4711c4 GetLongPathNameA
0x4711c8 GetTempPathA
0x4711cc GetSystemDirectoryA
0x4711d4 CreateFileMappingA
0x4711d8 Process32Next
0x4711dc Process32First
0x4711e4 OpenProcess
0x4711e8 UnmapViewOfFile
0x4711ec MapViewOfFile
0x4711f0 OpenFileMappingA
0x4711f4 WideCharToMultiByte
0x4711f8 MultiByteToWideChar
0x4711fc GetModuleFileNameA
0x471200 HeapSize
0x471204 TerminateProcess
0x47120c HeapFree
0x471210 InterlockedExchange
0x471218 WaitForSingleObject
0x47121c SetWaitableTimer
0x471224 SwitchToThread
0x471230 CloseHandle
0x471234 CreateThread
0x471238 SetProcessDEPPolicy
0x47123c HeapAlloc
0x471240 GetProcessHeap
0x471248 GetCurrentProcessId
0x47124c GetCurrentThreadId
0x471250 GetProcAddress
0x471254 LoadLibraryA
0x471258 GetModuleHandleA
0x47125c IsWow64Process
0x471260 GetCurrentProcess
0x471264 GetSystemInfo
0x471268 GetProcessVersion
0x47126c GlobalGetAtomNameA
0x471270 GlobalAddAtomA
0x471274 GlobalFindAtomA
0x471278 SetFilePointer
0x47127c GetLastError
0x471280 GetDriveTypeA
0x471284 Sleep
0x471288 lstrcpyA
0x47128c lstrlenA
0x471290 SetLastError
0x471294 lstrcatA
0x47129c GetVersion
0x4712a0 HeapSetInformation
0x4712a4 GetStartupInfoW
0x4712a8 EncodePointer
0x4712ac DecodePointer
0x4712b0 RtlUnwind
0x4712b4 RaiseException
0x4712bc GetModuleHandleW
0x4712c0 GetStdHandle
0x4712c4 GetModuleFileNameW
0x4712d0 SetHandleCount
0x4712d4 GetFileType
0x4712d8 TlsAlloc
0x4712dc TlsFree
0x4712f0 IsDebuggerPresent
0x4712f8 GetConsoleCP
0x4712fc GetConsoleMode
0x471300 GetCPInfo
0x471304 GetACP
0x471308 GetOEMCP
0x47130c IsValidCodePage
0x471310 LCMapStringW
0x471314 VirtualQuery
0x471318 GetStringTypeW
0x47131c LoadLibraryW
0x471320 GetLocaleInfoW
0x471324 SetStdHandle
0x471328 FlushFileBuffers
0x47132c WriteConsoleW
0x471330 EnumSystemLocalesA
0x471334 IsValidLocale
0x471338 lstrcmpiA
0x47133c lstrcmpA
0x471340 GlobalDeleteAtom
0x471344 LocalFree
0x471348 lstrcpynA
0x47134c LocalAlloc
0x471354 GlobalHandle
0x471358 GlobalReAlloc
0x47135c LocalReAlloc
0x471360 GlobalFlags
Library USER32.dll:
0x4713c4 CallNextHookEx
0x4713c8 GetKeyState
0x4713cc GetNextDlgTabItem
0x4713d0 GetFocus
0x4713d4 EnableMenuItem
0x4713d8 CheckMenuItem
0x4713dc SetMenuItemBitmaps
0x4713e0 ModifyMenuA
0x4713e4 GetMenuState
0x4713e8 LoadBitmapA
0x4713f0 TabbedTextOutA
0x4713f4 DrawTextA
0x4713f8 GrayStringA
0x4713fc UnhookWindowsHookEx
0x471400 DestroyWindow
0x471404 GetDlgCtrlID
0x471408 SetWindowTextA
0x47140c GetMenuItemCount
0x471410 GetWindowPlacement
0x471418 GetMessagePos
0x47141c GetMessageTime
0x471420 DefWindowProcA
0x471424 RemovePropA
0x471428 CallWindowProcA
0x47142c GetPropA
0x471430 SetPropA
0x471434 GetClassLongA
0x471438 CreateWindowExA
0x47143c GetMenuItemID
0x471440 GetSubMenu
0x471444 GetMenu
0x471448 RegisterClassA
0x47144c GetClassInfoA
0x471450 WinHelpA
0x471454 SetWindowsHookExA
0x471458 GetTopWindow
0x47145c CopyRect
0x471460 AdjustWindowRectEx
0x471464 GetSysColor
0x471468 MapWindowPoints
0x47146c LoadIconA
0x471470 LoadCursorA
0x471474 GetSysColorBrush
0x471478 LoadStringA
0x47147c DestroyMenu
0x471480 SetActiveWindow
0x471484 GetLastActivePopup
0x471488 IsWindowEnabled
0x47148c EnableWindow
0x471490 SetForegroundWindow
0x471494 SetFocus
0x47149c ShowWindowAsync
0x4714a0 PostMessageA
0x4714a4 PostQuitMessage
0x4714ac IsWindow
0x4714b0 FindWindowExA
0x4714b4 DestroyIcon
0x4714b8 GetForegroundWindow
0x4714bc GetDC
0x4714c0 FillRect
0x4714c4 DrawIconEx
0x4714c8 ReleaseDC
0x4714cc SendInput
0x4714d0 GetSystemMetrics
0x4714d4 MapVirtualKeyA
0x4714d8 GetLastInputInfo
0x4714dc LoadImageA
0x4714e4 IsIconic
0x4714e8 IsWindowVisible
0x4714ec GetWindowRect
0x4714f0 GetClientRect
0x4714f4 ClientToScreen
0x4714f8 OpenClipboard
0x4714fc GetClipboardData
0x471500 GetAncestor
0x471504 CloseClipboard
0x471508 EmptyClipboard
0x47150c SetClipboardData
0x471510 MessageBoxA
0x471514 wsprintfA
0x471518 DispatchMessageA
0x47151c TranslateMessage
0x471520 GetMessageA
0x471524 PeekMessageA
0x471528 GetParent
0x47152c GetWindow
0x471530 PtInRect
0x471534 GetWindowLongA
0x471538 GetWindowTextA
0x47153c SetWindowPos
0x471540 AttachThreadInput
0x471544 SetWindowLongA
0x471548 GetDlgItem
0x471550 GetClassNameA
0x471554 SendMessageA
0x471558 GetCapture
0x47155c BringWindowToTop
Library OLEAUT32.dll:
0x471368 SafeArrayDestroy
0x47136c VariantClear
0x471370 SysAllocString
0x471374 SafeArrayCreate
0x471378 VariantCopy
0x47137c RegisterTypeLib
0x471380 LHashValOfNameSys
0x471384 LoadTypeLib
0x47138c OleLoadPicture
0x471390 VarR8FromCy
0x471394 VarR8FromBool
Library SHLWAPI.dll:
0x4713b8 PathFindExtensionA
0x4713bc PathFindFileNameA
Library GDI32.dll:
0x471040 GetClipBox
0x471044 ScaleWindowExtEx
0x471048 SetWindowExtEx
0x47104c ScaleViewportExtEx
0x471050 SetViewportExtEx
0x471054 OffsetViewportOrgEx
0x471058 SetViewportOrgEx
0x47105c SetMapMode
0x471060 GetStockObject
0x471064 GetDeviceCaps
0x471068 SetDIBitsToDevice
0x47106c GetDIBits
0x471070 SetPixelV
0x471074 GetPixel
0x471078 GdiFlush
0x47107c BitBlt
0x471080 GetObjectA
0x471084 CreateDIBSection
0x471088 SetTextColor
0x47108c DeleteDC
0x471090 CreateSolidBrush
0x471094 SelectObject
0x47109c CreateCompatibleDC
0x4710a0 PtVisible
0x4710a4 RectVisible
0x4710a8 TextOutA
0x4710ac ExtTextOutA
0x4710b0 Escape
0x4710b4 SetBkColor
0x4710b8 RestoreDC
0x4710bc SaveDC
0x4710c0 CreateBitmap
0x4710c4 DeleteObject
Library ADVAPI32.dll:
0x47100c CryptCreateHash
0x471010 CryptReleaseContext
0x471014 CryptHashData
0x471018 CryptDestroyHash
0x47101c CryptGetHashParam
0x471020 RegOpenKeyA
0x471024 RegCloseKey
0x471028 OpenProcessToken
0x47102c GetTokenInformation
0x471030 RegQueryValueExA
Library SHELL32.dll:
0x4713a0 ShellExecuteExA
0x4713a4 SHGetFileInfoA
0x4713a8 ShellExecuteA
Library ole32.dll:
0x4715cc CoInitializeEx
0x4715d0 CoUninitialize
0x4715d4 CoCreateGuid
0x4715d8 CoInitialize
0x4715dc OleRun
0x4715e0 CoCreateInstance
0x4715e4 CLSIDFromString
0x4715e8 CLSIDFromProgID
Library kernel32.dll:
0x471574 GetModuleHandleA
0x471578 GetProcessHeap
0x47157c HeapAlloc
0x471580 HeapFree
0x471584 RtlMoveMemory
0x471588 GetProcAddress
0x47158c FreeLibrary
0x471590 LoadLibraryA
0x471594 VirtualProtectEx
0x471598 LCMapStringA
0x47159c IsBadReadPtr
0x4715a4 ExitProcess
Library msvcrt.dll:
0x4715ac sprintf
0x4715b0 atoi
0x4715b4 _ftol
0x4715b8 strchr
0x4715bc free
0x4715c0 malloc
0x4715c4 strstr
Library user32.dll:
0x4715fc MessageBoxA
0x471600 wsprintfA
Library oleaut32.dll:
Library WINSPOOL.DRV:
0x471564 OpenPrinterA
0x471568 ClosePrinter
0x47156c DocumentPropertiesA
Library COMCTL32.dll:
0x471038 None

!This program cannot be run in DOS mode.
`.rdata
@.data
.reloc
B.rsrc
uRFGHt
D$\vT2
pH9|$X
000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF
0123456789ABCDEF0123456789ABCDEF
000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff
0123456789abcdef0123456789abcdef
0@P`p
D$8Load
D$<Libr
D$@aryA
D$8Free
D$<Libr
D$@ary
D$8GetP
D$<rocA
D$@ddref
D$8GetM
D$<odul
D$@eHan
D$DdleA
SVWSQRV3
rocA9F
VWQPh$
L$4;MLv
T$`;1u
|$8;7u
L$@;,9u
;D$ls%
D$D;ELv
L$4;MLv
T$`;1u
|$8;7u
L$@;,9u
L$4;MLv
T$`;1u
|$8;7u
L$@;,9u
\$8;:u
D$l;D$,rB
D$l;D$
T$<;ULv
T$p;;u
D$D;4(u
|$@;1u
|$Pcuf
L$,;|$@
L$,;T$<
L$4;|$D
L$4;T$@
M;t$pr
T$$G;|$
D$0Virt
D$4ualA
D$8lloc
D$$Virt
D$(ualF
D$,ree
D$`GetM
D$dodul
D$heHan
D$ldleA
D$@Load
D$DLibr
D$HaryEf
D$ ary
D$PGetP
D$TrocA
D$Xddref
p;D$ v
p;D$ v
D$,GetM
D$0odul
D$4eHan
D$8dleA
D$ Virt
D$$ualF
D$(ree
p;D$ v
RPh({S
RPWWWj
t'9|$pt
f9Z,v@
T$\PShP
l$ UPVQ
D$Tj\P
L$$Ph`
D$$SWVURP
D$ RPj
t8j\hx
t@_^]3
D$0hT{S
QSVWVWS
QQSVWd
;t$,v-
UQPXY]Y[
VC20XC00U
PPPPPPPP
^SSSSS
j@j ^V
t hLdG
HHtXHHt
?If90t
tWItHIt9It
URPQQh
t"SS9] u
.t|PVj@
uMhDdG
t=MOC
HtHu4j
t*=RCC
;7|G;p
tR99u2
tRHtCHt4Ht%HtFHHt
F Pj*S
F$Pj+Sj
F(Pj,S
F,Pj-S
F0Pj.S
F4Pj/S
F8PjDS
F<PjES
F@PjFS
FDPjGS
FHPjHS
FLPjIS
FPPjJS
FTPjKS
FXPjLS
F\PjMS
F`PjNS
FdPjOS
FhPj8S
FlPj9S
FpPj:S
FtPj;S
FxPj<S
F|Pj=S
C PjPV
C$PjQV
C*PjTV
C+PjUV
C,PjVV
C-PjWV
C.PjRV
C/PjSV
CHPjPV
CLPjQV
PPPPPPPP
t VV9u
<+t"<-t
+t HHt
F$@;F(v
F$@@;F(v
HtHHtk2
SVWj>3
PPPPPPPP
nt2Ht#Ht
(wqt\HHtS
t>Ht Ht
hWj@_;
^$_^[]
F(_+F$^[;E
<A|2<Z
<A|@<Z
bad allocation
CorExitProcess
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
(null)
`h````
xpxxxx
Unknown exception
]vQ<)8
|)P!?Ua0
Eb2]A=
u?^p?o4
y1~?|"
?x+s7
?5Od%
?|I7Z#
>,'1D=
?g)([|X>=
~U`?K
:h"?bC
@H#?43
Ax#?uN}*
r7Yr7=
F0$?3=1
H`$?h|
&?~YK|
sU0&?W
<8bunz8
?#%X.y
F||<##
<@En[vP
UTF-16LE
UNICODE
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
LC_TIME
LC_NUMERIC
LC_MONETARY
LC_CTYPE
LC_COLLATE
LC_ALL
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
bad exception
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
`h`hhh
xppwpp
_nextafter
_hypot
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
united-states
united-kingdom
trinidad & tobago
south-korea
south-africa
south korea
south africa
slovak
puerto-rico
pr-china
pr china
new-zealand
hong-kong
holland
great britain
england
britain
america
swedish-finland
spanish-venezuela
spanish-uruguay
spanish-puerto rico
spanish-peru
spanish-paraguay
spanish-panama
spanish-nicaragua
spanish-modern
spanish-mexican
spanish-honduras
spanish-guatemala
spanish-el salvador
spanish-ecuador
spanish-dominican republic
spanish-costa rica
spanish-colombia
spanish-chile
spanish-bolivia
spanish-argentina
portuguese-brazilian
norwegian-nynorsk
norwegian-bokmal
norwegian
italian-swiss
irish-english
german-swiss
german-luxembourg
german-lichtenstein
german-austrian
french-swiss
french-luxembourg
french-canadian
french-belgian
english-usa
english-us
english-uk
english-trinidad y tobago
english-south africa
english-nz
english-jamaica
english-ire
english-caribbean
english-can
english-belize
english-aus
english-american
dutch-belgian
chinese-traditional
chinese-singapore
chinese-simplified
chinese-hongkong
chinese
canadian
belgian
australian
american-english
american english
american
Norwegian-Nynorsk
Complete Object Locator'
Class Hierarchy Descriptor'
Base Class Array'
Base Class Descriptor at (
Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
delete[]
new[]
`local vftable constructor closure'
`local vftable'
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
delete
__unaligned
__restrict
__ptr64
__eabi
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
1#QNAN
1#SNAN
CCmdTarget
CTempGdiObject
CTempDC
CGdiObject
CUserException
CResourceException
CObject
CStringArray
CArchiveException
CNotSupportedException
CMemoryException
CException
combobox
CTempWnd
AfxOldWndProc423
AfxWnd42s
AfxControlBar42s
AfxMDIFrame42s
AfxFrameOrView42s
AfxOleControl42s
GetMonitorInfoA
EnumDisplayMonitors
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
GetSystemMetrics
USER32
DISPLAY
commctrl_DragListMsg
InitCommonControlsEx
COMCTL32.DLL
CMapPtrToPtr
CTempMenu
string too long
ios_base::eofbit set
ios_base::failbit set
ios_base::badbit set
bad locale name
bad cast
invalid string position
generic
iostream
system
iostream stream error
FVisual C++ CRT: Not enough memory to complete call to strerror.
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
Illegal byte sequence
Directory not empty
Function not implemented
No locks available
Filename too long
Resource deadlock avoided
Result too large
Domain error
Broken pipe
Too many links
Read-only file system
Invalid seek
No space left on device
File too large
Inappropriate I/O control operation
Too many open files
Too many open files in system
Invalid argument
Is a directory
Not a directory
No such device
Improper link
File exists
Resource device
Unknown error
Bad address
Permission denied
Not enough space
Resource temporarily unavailable
No child processes
Bad file descriptor
Exec format error
Arg list too long
No such device or address
Input/output error
Interrupted function call
No such process
No such file or directory
Operation not permitted
No error
GetSystemInfo
GetCurrentProcess
IsWow64Process
GetModuleHandleA
LoadLibraryA
GetProcAddress
GetCurrentThreadId
GetCurrentProcessId
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapAlloc
SetProcessDEPPolicy
CreateThread
CloseHandle
EnterCriticalSection
InterlockedCompareExchange
SwitchToThread
CreateWaitableTimerA
SetWaitableTimer
WaitForSingleObject
LeaveCriticalSection
InterlockedExchange
HeapFree
SetThreadAffinityMask
TerminateProcess
HeapSize
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
OpenProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateFileMappingA
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
GetLongPathNameA
GetFileAttributesA
SetFileAttributesA
lstrlenW
GetTempPathW
DeleteFileA
TlsGetValue
IsBadReadPtr
TlsSetValue
CreateFileW
CreateFileA
SetFilePointerEx
SetEndOfFile
WriteFile
GetFileSizeEx
ReadFile
MoveFileA
GetComputerNameA
GetLocaleInfoA
GetDateFormatA
GetTimeFormatA
GetProcessId
GlobalMemoryStatusEx
RtlMoveMemory
lstrcpyn
HeapCreate
SetCriticalSectionSpinCount
FreeLibrary
DeleteCriticalSection
HeapDestroy
HeapReAlloc
SetEvent
WaitForMultipleObjects
CreateEventA
TryEnterCriticalSection
VirtualFree
VirtualAlloc
CancelWaitableTimer
ExitProcess
CreateProcessA
GetStartupInfoA
GetUserDefaultLCID
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetPrivateProfileStringA
GetVolumeInformationA
GetCurrentDirectoryA
MulDiv
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetLocalTime
WritePrivateProfileStringA
GetTickCount
GetCommandLineA
LCMapStringA
KERNEL32.dll
MsgWaitForMultipleObjects
IsWindow
GetForegroundWindow
GetAncestor
SetWindowPos
AttachThreadInput
BringWindowToTop
SetActiveWindow
SetForegroundWindow
SetFocus
GetWindowThreadProcessId
ShowWindowAsync
FindWindowExA
DestroyIcon
FillRect
DrawIconEx
ReleaseDC
SendInput
GetSystemMetrics
MapVirtualKeyA
GetLastInputInfo
LoadImageA
EnumDisplaySettingsA
IsIconic
IsWindowVisible
GetWindowRect
GetClientRect
ClientToScreen
OpenClipboard
GetClipboardData
CloseClipboard
EmptyClipboard
SetClipboardData
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
USER32.dll
OLEAUT32.dll
PathFindFileNameA
PathFindExtensionA
SHLWAPI.dll
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
CreateSolidBrush
DeleteDC
DeleteObject
CreateDIBSection
GetObjectA
BitBlt
GdiFlush
GetPixel
SetPixelV
GetDIBits
SetDIBitsToDevice
GetDeviceCaps
GetStockObject
GDI32.dll
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
CryptAcquireContextA
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptGetHashParam
RegOpenKeyA
RegCloseKey
OpenProcessToken
GetTokenInformation
RegQueryValueExA
ADVAPI32.dll
SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
ShellExecuteA
SHGetFileInfoA
ShellExecuteExA
SHELL32.dll
CoInitializeEx
CoUninitialize
CoCreateGuid
CoInitialize
OleRun
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CreateStreamOnHGlobal
ole32.dll
GetEnvironmentVariableA
VirtualProtectEx
RtlMoveMemory
GetModuleHandleA
GetProcessHeap
ExitProcess
HeapAlloc
HeapFree
IsBadReadPtr
GetProcAddress
FreeLibrary
LoadLibraryA
LCMapStringA
sprintf
strchr
malloc
strstr
wsprintfA
MessageBoxA
kernel32.dll
msvcrt.dll
user32.dll
oleaut32.dll
SetFilePointer
GetLastError
GetDriveTypeA
lstrcpyA
lstrlenA
SetLastError
lstrcatA
QueryPerformanceCounter
GetVersion
HeapSetInformation
GetStartupInfoW
EncodePointer
DecodePointer
RtlUnwind
RaiseException
SetUnhandledExceptionFilter
GetModuleHandleW
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsAlloc
TlsFree
InterlockedIncrement
InterlockedDecrement
GetSystemTimeAsFileTime
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
VirtualQuery
GetStringTypeW
LoadLibraryW
GetLocaleInfoW
SetStdHandle
FlushFileBuffers
WriteConsoleW
EnumSystemLocalesA
IsValidLocale
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
LocalFree
lstrcpynA
LocalAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
LocalReAlloc
GlobalFlags
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
SendMessageA
GetClassNameA
SystemParametersInfoA
GetDlgItem
SetWindowLongA
GetWindowTextA
GetWindowLongA
PtInRect
GetWindow
GetParent
PostQuitMessage
PostMessageA
EnableWindow
IsWindowEnabled
GetLastActivePopup
SetWindowsHookExA
CallNextHookEx
GetKeyState
GetNextDlgTabItem
GetFocus
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
TabbedTextOutA
DrawTextA
GrayStringA
UnhookWindowsHookEx
DestroyWindow
GetDlgCtrlID
SetWindowTextA
GetMenuItemCount
GetWindowPlacement
RegisterWindowMessageA
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
DestroyMenu
CreateBitmap
SaveDC
RestoreDC
SetBkColor
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
ClosePrinter
OpenPrinterA
DocumentPropertiesA
WINSPOOL.DRV
COMCTL32.dll
HeapQueryInformation
IsWow64Process
kernel32.dll
10299083D67D73B1710D26AD51CE866385870A75D4BBFA2CABC61D550E21
Qkkbal
[-&LMb#{'
w+OQvr
INSKyu
)\ZEo^m/
H*0"ZOW
W/q#IX
Dx,2$E
Ho*[8'
4JpI?=
=dn"M,
AA40J6
Jjw[Sc
s1Y3JrMH]
vARr5U)e
~Yf,=M
K=#R2&
UNhkk%
o~,|zE
k*WBjL
.DZP(7'
%-y5DQ
f#.~ISo
+#G%L
MessageBoxA
user32.dll
Global\
Windows
A07950C3FD29D8B1194F75CD0198FD2369DE3120E5EE676C329F7621646653609740
l(.lsg
n=KQ@.|ib0?
iKef9$
8-jz#N
;h:t31
I6e>G&
]._'%q
'EIR4i
xxS&B
J.O[BiB
y|pUo^@
ov26~7
}-wUDLu
p_Q#L@
"e1==9
r[.{l$
+UQCP|
AQK~[(
+*U~(I
D'2q?A
]u5H.#
jU4|C!
xMw`Mv
3HG0"PT
se}6hJ
9aQ*h
*~M^a5
PO;sl0
06_?6&
|1 fI/Pb
?dtkCbp
IYzxM3~
)+XB -
|s7j'gx
G7[FN*@d
+{olUG@
S~$L6$Q"
H9gcN=n
CW4GxE;
7.\l*[l
|E4DVh
e'J:jp
Mhg;t%
8I(xW6
7}GNDF
!TV}ur
nX:9o/
fc#na_^
.cVh(-
+IDsdQ
k4A>;`
wP3]9
NAi1;%
&eeB=l
=ta3P
:ncRi(9
T4J.vT3
n<ogx6
U1Tu_+\
@+0K{@4
n0IWcIF
4+SSy%
8:7' n&
F*_23,
?cd{0$lF
vtx;]f
Z LCrZ
f1Hvw<
G>^?tk
}!=v5m+T
Z\u>nF
w&qw )`
:hjpFTBo
m-iH(b
Nk)n2e
PCOc.)
.|DMx'
~]c5|@
g#07@S
X +O`"
+G)8Ub
xGKeX;
ZJn;iQ
$#;\a'
n-Y7c=
<@1xGO
<lBv.w
No7PKQ0
-BJ]H*
)Ax|~t
I?$w;S
U2q'f r
"q:!N/
mBJ+WMn
=7AIUR
/Nuj-P
Vx_H5&_A
S:Vg+P1
4t_JpM
PtZ\/):
xSZ Y_|X_
ov%hQt
m=4O)j
He\"'y2<It0IEx
X(6LWR
NU(&OV
o[YVXZtU
9@WP\j
Atl4[$Ea
f3h`P`
:|?z-s
JLWN^P
s.\nGq
XcI4*1j,1
eXbB8!?%
(1~^/yw*
3K'Mt/
tD>Yf<
7*op?L
RLO8?,
o^X+^j
rg0;Hu
K^raA{2
4~o5r;'-~guF#
/)+)2I_
6I+JUV
zeAezi
H!-Pjuz
u!kR>W8,
>xwSyM
"^++QL*
4)1913.6g
*eRCARc
f&|7v;&
?|.l#
=,.&3'%*9.'%53'>udJl
58'g,o
}dY^p~iI
kZ>OJ;"
w@>Xn>Xn>Xn>
EX#Bx]
`_o[g]K
c@',c};<W
"a/(*6+*-
,rt;Vs
ZT^]%
^pd~'E
\4-DU
t%=I_2
_#5tSG/
r~i}q1X
!This program cannot be run in DOS mode.
h.rdata
H.data
.pdata
D$XH+D$`H
fffffff
fffffff
c:\winddk\7600.16385.1\wincor\wnbios1.2.0.0\amd64\wnBios.pdb
IoDeleteSymbolicLink
ZwMapViewOfSection
RtlInitUnicodeString
IoDeleteDevice
MmFreeContiguousMemory
MmFreeNonCachedMemory
MmGetPhysicalAddress
ZwUnmapViewOfSection
ZwClose
IofCompleteRequest
ObReferenceObjectByHandle
IoCreateSymbolicLink
ObfDereferenceObject
MmAllocateNonCachedMemory
IoCreateDevice
ZwOpenSection
MmAllocateContiguousMemory
KeBugCheckEx
ntoskrnl.exe
HalTranslateBusAddress
HAL.dll
Western Cape1
Durbanville1
Thawte1
Thawte Certification10
Thawte Timestamping CA0
121221000000Z
201230235959Z0^1
Symantec Corporation100.
'Symantec Time Stamping Services CA - G20
http://ocsp.thawte.com0
.http://crl.thawte.com/ThawteTimestampingCA.crl0
TimeStamp-2048-10
Symantec Corporation100.
'Symantec Time Stamping Services CA - G20
121018000000Z
201229235959Z0b1
Symantec Corporation1402
+Symantec Time Stamping Services Signer - G40
http://ts-ocsp.ws.symantec.com07
+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<
+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
TimeStamp-2048-20
VeriSign, Inc.10
VeriSign Trust Network1;09
2Terms of use at https://www.verisign.com/rpa (c)101.0,
%VeriSign Class 3 Code Signing 2010 CA0
140825000000Z
150924235959Z0
Germany1
Paderborn1*0(
!Wincor Nixdorf International GmbH1*0(
!Wincor Nixdorf International GmbH0
http://sf.symcb.com/sf.crl0f
https://d.symcb.com/cps0%
https://d.symcb.com/rpa0
http://sf.symcd.com0&
http://sf.symcb.com/sf.crt0
VeriSign, Inc.10
VeriSign Trust Network1:08
1(c) 2006 VeriSign, Inc. - For authorized use only1E0C
<VeriSign Class 3 Public Primary Certification Authority - G50
100208000000Z
200207235959Z0
VeriSign, Inc.10
VeriSign Trust Network1;09
2Terms of use at https://www.verisign.com/rpa (c)101.0,
%VeriSign Class 3 Code Signing 2010 CA0
https://www.verisign.com/cps0*
https://www.verisign.com/rpa0
[0Y0W0U
image/gif0!00
#http://logo.verisign.com/vslogo.gif04
#http://crl.verisign.com/pca3-g5.crl04
http://ocsp.verisign.com0
VeriSignMPKI-2-80
VeriSign, Inc.10
VeriSign Trust Network1;09
2Terms of use at https://www.verisign.com/rpa (c)101.0,
%VeriSign Class 3 Code Signing 2010 CA
Symantec Corporation100.
'Symantec Time Stamping Services CA - G2
150603130307Z0#
R%psn8n
Washington1
Redmond1
Microsoft Corporation1806
/Microsoft Windows Third Party Component CA 20120
141219192734Z
160319192734Z0
Washington1
Redmond1
Microsoft Corporation1
MOPR1;09
2Microsoft Windows Hardware Compatibility Publisher0
|:fu2B
MOPR1301
*32207+849925f8-3ebf-4cb7-acda-b06564fae7fb0
chttp://www.microsoft.com/pkiops/crl/Microsoft%20Windows%20Third%20Party%20Component%20CA%202012.crl0
ehttp://www.microsoft.com/pkiops/certs/Microsoft%20Windows%20Third%20Party%20Component%20CA%202012.crt0
Washington1
Redmond1
Microsoft Corporation1200
)Microsoft Root Certificate Authority 20100
120418234838Z
270418235838Z0
Washington1
Redmond1
Microsoft Corporation1806
/Microsoft Windows Third Party Component CA 20120
-g<'<V
}PH.=C
Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z
>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
p%|Yi1$
Washington1
Redmond1
Microsoft Corporation1806
/Microsoft Windows Third Party Component CA 2012
.http://www.microsoft.com/whdc/hcl/default.mspx0
20150608092229.914Z0
Washington1
Redmond1
Microsoft Corporation1
MOPR1'0%
nCipher DSE ESN:BBEC-30CA-2DBE1%0#
Microsoft Time-Stamp Service
Washington1
Redmond1
Microsoft Corporation1200
)Microsoft Root Certificate Authority 20100
100701213655Z
250701214655Z0|1
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 20100
$`2X`F
Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z
>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
1http://www.microsoft.com/PKI/docs/CPS/default.htm0@
oK0D$"<
r~akow
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 20100
150320173228Z
160620173228Z0
Washington1
Redmond1
Microsoft Corporation1
MOPR1'0%
nCipher DSE ESN:BBEC-30CA-2DBE1%0#
Microsoft Time-Stamp Service0
Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z
>http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
cBHb}I
Yia56*
Washington1
Redmond1
Microsoft Corporation1
MOPR1'0%
nCipher DSE ESN:BBEC-30CA-2DBE1%0#
Microsoft Time-Stamp Service
Washington1
Redmond1
Microsoft Corporation1
MOPR1'0%
nCipher NTS ESN:57F6-C1E0-554C1+0)
"Microsoft Time Source Master Clock0
20150608002638Z
20150609002638Z0t0:
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 2010
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 2010
x3P1A>|
C:\g.sys
C:\all.exe
C96EBADAF82972F34D59D3B494CCF06DECCCC43F7BFA862CD29745397F29514BD23A675C6702F6DB6DCEA7A8B247A5D5B1DB7F0AE7792924BA8F4E4518C0526BAC0EE37C
www.1027663760.com
z>232620646271693E7568756C23262063743E7568756C22232425437176754366733E7568756C78796063646271693E7568756C616160736264603E7568756C7B6875646271693E756875A23489CE3
WPS.lnk
"@0123456789ABCDEF
wshom.ocx
WshShell
CreateShortcut
TargetPath
Arguments
IconLocation
WorkingDirectory
!This program cannot be run in DOS mode.
|]M OX
GVMat32 optimised as
mbly code writDn 1996
Gilles Vo
)from B.;0
Ra3er,<8Oo
dB;@(5.
?&?D^n
&|u]j-
Xjnlzd20
!|1HX#
{kFp92
t[9H n
O(UQZV
gN+np~l(ly~E
Gk/*t1
J@o<ZgZ`
897F[_
#LzHPW
@< I%!N
lX)MJV
=,sVQC
'{?((u
d{.f6X
6 VQDR[Lmv
TS4U\C
ErBH.J
(JOq0E
Z58q,O
tRlhd/b
t\&Ynw
QRp!!x
~F~(9~FXa
vS_5R9x
j=BW C
0)lS{+
,bsoX Y
dhlptx
(56atg
{`Iu$qEu
LB,*#bd
sP&w!r
-pE>9O
m-\KIQ
Su8IZO!
qL~7f+
X0pt QCI
a.JRoT'[
/tDg?x
q;|iz<j
NlR`lD[
_[1u'W
RD#BO=
_;V\O,%
LN`$dse
YkNn*^
9\`l_!dJDo`
Aq+4t7
dddd $(,dddd048<
0J2u %
FPXbx!;M
deflate Copyright
5-2002 Jean-loup
<fd:%d>
invalid bi
too my
cRsymbols
ee4ctionary/
izWunkn
ndmp2ssZ
%;Zs?inM
3;CScM
subsc9b
r+rbo#Jx+g
[WSOK<
@ unzip 0.18
}!f -
tp://w
image.
 kbuff;
UA]@?s
GlobalAlloc
vsp%ntf
flushs3
putmmaufQ
5_fdope
XPTPSW
CRTDLL.dll
KERNEL32.DLL
GetProcAddress
LoadLibraryA
VirtualProtect
zlib.dll
adler32
compress
compress2
deflate
deflateCopy
deflateEnd
deflateInit2_
deflateInit_
deflateParams
deflateReset
deflateSetDictionary
get_crc_table
gzclose
gzdopen
gzerror
gzflush
gzgetc
gzgets
gzopen
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzsetparams
gztell
gzwrite
inflate
inflateEnd
inflateInit2_
inflateInit_
inflateReset
inflateSetDictionary
inflateSync
inflateSyncPoint
uncompress
unzClose
unzCloseCurrentFile
unzGetCurrentFileInfo
unzGetGlobalComment
unzGetGlobalInfo
unzGetLocalExtrafield
unzGoToFirstFile
unzGoToNextFile
unzLocateFile
unzOpen
unzOpen2
unzOpenCurrentFile
unzOpenCurrentFile2
unzReadCurrentFile
unzStringFileNameCompare
unzeof
unztell
zError
zipClose
zipCloseFileInZip
zipCloseFileInZipRaw
zipOpen
zipOpenNewFileInZip
zipOpenNewFileInZip2
zipWriteInFileInZip
zlibVersion
conf.ini
asdf$^(*dkiDA
DelFile
ReFileName
CreFolder
Xvid_C.Init
GetSoft
@SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
\DisplayIcon
\UninstallString
\DisplayName
\Publisher
SoftList
yyyy-MM-dd
yyyy/MM/dd
yyyyMMdd
hh:mm:ss
hh/mm/ss
hhmmss
Windows XP
Windows 2000
Windows Vista
Windows 7
Windows 8
Windows 8.1
Windows 10
Windows 11
Server 2003
Server 2008
Server 2012
Server 2016
Server 2019
Server 2022
@LogonUI.exe
Io|WIsH!
^TsP'U
6Y5J#]S
b{Dl.-
b{Xl1b
HD6F#b+
zvuJtd
esvd|'8
G>83IO
1/59,iFX
$[^jfX
IEiUei
=|v~0-
/OdKhL>
rG!4>F
O2\Ek+
V-}VLn
!93u93
33,gfx
]jP1z}
eii"MO
^v;URa
/z4S({
1IK.#9-
Ib\>A,/?E
GgsF4&
11YG%K
u.A,r9
6tX)2:M.ak
:F"tzc
KZi*-c
2l"IL
iK9YoA
37E-S5
?GC9?4
pvN2v*
yFRR#R
W01a}U
3zZ 0w
%<f9tjJ
^MC)4T
Z^5V<H
Ob^InS
c[x2#`(
\W\`?t
`%m&+)~
oU|6Wh
[-+%[x4
x!CWu@
,&W4+M.%y
.s9:@+
[Zd_[\
Y`;LGo/S"=6
sFh74t)
w`0AD(C
qXsd*
7x:cg
7kQKf{
9`%Jrt"
J*Qoyl
eaI8#o
,6_.6q:{
Yx2{t?
f~"3U(PE
CiBG2v
B-r\9a
t$NT7P
Pe*t[*
v)ICn\
Nxqu"i
QAF+};
X_x7n_
wS"0!.
}(<bzMwh
^=+4iV
fJ;'UzBdZ
mUx(pO
C7~qz@]
J']ASz
"VNOf>
,.7tT-
7]wr"yG*
E//8&o
(BR-bD
r?J;fS?
^10U7.p
[u&Uo[
R7gi./
WIi"AH
KMJ09)2
" <KfPmq@[a
&SAc4*
G/G/t
rbl{v:
vRHzBn9\
<{d_/^^
?Y/E+t
B(g| dJ
=?}(@[z
c}8i}X4
iP.?<o
%PrJi;
j"h|+j
(1PyT8
(=,P]!ZD
\5+6 T
$P^&/Y
2ap}!H
1V~=|~2
N.<Yo4
=0|s^
~GK$1
ffN63chf^
U(Y0#1
Uh;EhKO
~'(>(An
LD.qDV
hN2xf!Z
*g*Q9C
=6;9Yi'
fg^k
*>OVq+
0[ NT#
a0K&kO
2Gew27G
Fsu`4g
O=1jyq
$,=,G$s,
NU8Ya{
<d!dV d
b+2[m=
aP?^:a
d;f+lD
"~:U"0Y
s%{e8P;W
?a?@nC
4^lz;R
@W8SGW0z\
_0z]tJ
XnV$fQ
qq/N#m
Poo^E
2@{y+.
AS4]69
F!C}*C[<
f:#Vw2
3=H, 8
)!v^"Kg
hdy?9S
#SV<gF
\e(FFJ
>fNhWt
hLd1be3<
,V'HtH::
Y'7ijQ
_s/ /~
I1}IJtq
M)s_F4
Rt,~if*
F$E#2V#
1%e~L7
X)0mz)$
<gMvDJp
Gvftpl
#vSFcvSF
7x`Tjv
YP`d4o)
\,ZOi]
BK9 ]0
UHG<CJ
^BtEe'.
X4+V+Z
'9]6XLw
*D_!Nn
/Bj:T#B
M~c_fgJ
Z&Q6W7
o<4Lu`V@h
B<vy:[
y0FHC4
k$Xj%z5%
+9xP92q
&CKAzS
"<$cF:
wU?5u6
,Z2mZT
4h`VWX
rQ#x-(
P%@!C(
'fe~0++'e
=+'?r/+
/oBC]cy
k#}rdFV
)L,]db
7=!$y)
[b-[1o
4nL^"J0
^:~@[S
5!zU2
#6&ud}%yz
HT"Fa(
L+:b:'
gxsI6Gf.
Hl.G,^<w
JBCS0[
~(;V!iC
:n7B/2
@5Fp@>
SO75e
)TIkS4
A)w2:)
\Rb;2O
]_-PL{E
dcjLal
SPnLAif
nO&w^&w
S9uv^d
;{ew/,xd
F&4%x.
k}Fz5F
xbD[]LW)
&ExOXR
*hJr d
-p0t^
BRx$?a
t67)EI
iJIgRP~
6[`zN+i
m9h$`g
}k N&*
9x<]@9
^D"BJs
j;&q"r
,-2|ad
\~@A9't.
Sb<-q#
w?AAs0]
:qFP)>
!~DaxgC
"z4Ez4
p1{U+B
8)uiPU
NOSZ!$
G]/*Y~
@3dM9
v^k=e8
?_AZ0/F
T/vdEL
Gb:U%
` bdyI
w1[?a"
Am#~aL
uxDc~_
r.B|s
1_tObA
}Uq"}q4
eyUC<%
~Pee~W
:Ey"*A3Z
\cx8Nx
A3%ya/
&2%T+
G4z(s
O~>;6i
QL=1,GW
4h{??rV*
DRPOYh7:)
Y{JaW54O+
?,W]mn}B
irpQBL
H#N#~H
g#q8eh
|\%g$f
=q;tBp
HU_fERU_J
cQr'b)
-XXodB
$y #^0
$A'paJ
xS1:@8
pcS~B N
yROOba
0F>>/2
j~l@!kFe
=x97 g
6O&Jq?*
&,){s%
&N.:*7
-0"qb61
q{$@9<
y=mOzb
iCO|G|+v
=J+o,Y
lo=Nc`
Ienbne
'?f=3?
DDEEED
_3vFvAvEvC
@.@.D.B>
#7!?@nFnAV ?DnE~
_q)wYJl
qw`j;v
me+&tM
(-LFit
zl<]o/;
T`.f4T
~OL:]Jh
&n)3l%
{`->{a
lNEV)t
?&??_*
@z/K#
,`$p!P
B~`s`$
B-C5N&
pOz2Xg
iuk}oX
Wm([Vv
X~fyK
EQhs9r
[=^=I=O
V5U)Tw
*_5^5[
741t6h
>Zb\b\i\k|
7L3<jx
aPQAf
SUsJo1P
')Aj0(
+KO>+
TMe)O=
QF;e&H
oT!?2>
G$+odr
5RG?o
$Q5W)j(
T9P*UO
guW=Py
8U^URL=
t:8)N
_XvidEncOpen@20
_XvidEncEncode@12
_XvidEncClose@0
@RO1FwFyMUtx0iuyg0H8u
Kernel32.dll
SetEnvironmentVariableA
Ling_testdata1
Ling_testdata2
@@ntdll.dll
RtlAllocateHeap
RtlReAllocateHeap
RtlFreeHeap
GetProcessHeap
!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
Od;O<r
Wd;W<sM
Gd;G<s
Nd;N<sH
C@9CDv
+^tx<=X
+S(xM@
S4;V|r
T$8PQPR
L$\QRPV
T$tPQPR
~^=@KL
F93|/VP
tAHt#Hu
ub9G<t
t,HtV
9t$ t!
OLQVWh j
D$HSVW
D$$VRQ
~j=@KL
ub9G@t
t,HtV
D$HSVW
D$$VRQ
9^$uh
9^$u/h
u<;^ u0
u=;~ u1
9^$uh
9^$u/h
NDQWVh
f;WLu{
f;NLt"h?'
~d=@KL
9~0veS
t*HtV
t VFVS
9\$ t!
uTVWh9
^SSSSS
HHt$HHt
?If90t
j@j ^V
HHt$HHt
URPQQh
t"SS9] u
PPPPPPPP
PPPPPPPP
;t$,v-
UQPXY]Y[
QQSVWd
t=MOC
HtHu4j
t*=RCC
;7|G;p
tR99u2
<+t"<-t
+t HHt
Unknown exception
CorExitProcess
(null)
`h````
xpxxxx
Illegal byte sequence
Directory not empty
Function not implemented
No locks available
Filename too long
Resource deadlock avoided
Result too large
Domain error
Broken pipe
Too many links
Read-only file system
Invalid seek
No space left on device
File too large
Inappropriate I/O control operation
Too many open files
Too many open files in system
Invalid argument
Is a directory
Not a directory
No such device
Improper link
File exists
Resource device
Unknown error
Bad address
Permission denied
Not enough space
Resource temporarily unavailable
No child processes
Bad file descriptor
Exec format error
Arg list too long
No such device or address
Input/output error
Interrupted function call
No such process
No such file or directory
Operation not permitted
No error
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
`h`hhh
xppwpp
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
Complete Object Locator'
Class Hierarchy Descriptor'
Base Class Array'
Base Class Descriptor at (
Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
delete[]
new[]
`local vftable constructor closure'
`local vftable'
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
delete
__unaligned
__restrict
__ptr64
__eabi
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
ection
loseeep-alive
pgrade
chunked
ent-length
roxy-connection
ransfer-encodingpgrade
TSP/NOUNCE
ECKOUT
NECTETE
LUSHET
PARAMETER
SEARCH
CTIVITY
LENDAR
PTIONS
ATCHGE
PARAMETER
URCEBSCRIBE
ARDOWN
UBSCRIBEHTTP/
vector<T> too long
list<T> too long
[RO] %ld bytes
recv sn=%lu
[RI] %d bytes
input ack: sn=%lu rtt=%ld rto=%ld
input psh: sn=%lu ts=%lu
input probe
input wins: %lu
CTcpPackServerT<class CTcpServer>::CheckParams
CTcpPackAgentT<class CTcpAgent>::CheckParams
CTcpPackClientT<class CTcpClient>::CheckParams
`bad allocation
Fhp-pool-
%d.%d.%d.%d%c
SUCCESS
Illegal State
Invalid Parameter
Create SOCKET Fail
Bind SOCKET Fail
Prepare SOCKET Fail
Listen SOCKET Fail
Create IOCP Fail
Create Worker Thread Fail
Create Detector Thread Fail
Attach SOCKET to IOCP Fail
Connect to Server Fail
Network Error
Process Data Error
Send Data Fail
SSL environment not ready
UNKNOWN ERROR
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
?456789:;<=
 !"#$%&'()*+,-./0123
kernel32.dll
CreateFileTransactedA
CTcpAgent::CheckParams
CTcpAgent::CheckStarting
CTcpAgent::CheckStoping
0.0.0.0
CTcpAgent::ParseBindAddress
CTcpAgent::CreateCompletePort
CTcpAgent::CreateWorkerThreads
CTcpClient::Start
CTcpClient::CheckParams
CTcpClient::CheckStarting
CTcpClient::CheckStoping
CTcpServer::CheckParams
CTcpServer::CheckStarting
CTcpServer::CheckStoping
CTcpServer::CreateListenSocket
CTcpServer::CreateCompletePort
CTcpServer::CreateWorkerThreads
CTcpServer::StartAccept
CUdpCast::Start
CUdpCast::CheckParams
CUdpCast::CheckStarting
CUdpCast::CheckStoping
255.255.255.255
CUdpClient::Start
CUdpClient::CheckParams
CUdpClient::CheckStarting
CUdpClient::CheckStoping
CUdpNode::CheckParams
CUdpNode::CheckStarting
CUdpNode::ParseBindAddr
CUdpNode::CreateListenSocket
CUdpNode::CreateCompletePort
CUdpNode::CreateWorkerThreads
CUdpNode::StartAccept
CUdpNode::CheckStoping
CUdpServer::CheckParams
CUdpServer::CheckStarting
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.BlackMoon.4!c
tehtris Generic.Malware
ClamAV Win.Dropper.Tiggre-9845940-0
CMC Clean
CAT-QuickHeal Clean
Skyhigh Clean
ALYac Gen:Variant.Jaik.226535
Cylance Unsafe
Zillya Trojan.Zenpak.Win32.23853
Sangfor Trojan.Win32.Save.BlackMoon
K7AntiVirus Clean
Alibaba Clean
K7GW Trojan ( 005931081 )
Cybereason malicious.df48bd
Baidu Clean
VirIT Trojan.Win32.GenusT.DXGH
Paloalto Clean
Symantec Clean
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Packed.BlackMoon.A suspicious
APEX Malicious
Avast Win32:TrojanX-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.Win32.Zenpak.gen
BitDefender Gen:Variant.Jaik.226535
NANO-Antivirus Trojan.Win32.BlackMoon.kokgmk
ViRobot Clean
MicroWorld-eScan Gen:Variant.Jaik.226535
Tencent Clean
TACHYON Clean
Sophos Clean
F-Secure Clean
DrWeb Trojan.MulDrop27.43603
VIPRE Gen:Variant.Jaik.226535
TrendMicro Clean
McAfeeD Real Protect-LS!60697ECDF48B
Trapmine malicious.high.ml.score
FireEye Generic.mg.60697ecdf48bd911
Emsisoft Gen:Variant.Jaik.226535 (B)
SentinelOne Static AI - Malicious PE
GData Win32.Trojan.PSE.1DPEYYJ
Jiangmin Clean
Webroot Clean
Varist Clean
Avira Clean
Antiy-AVL Trojan/Win32.Blamon.a
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Trojan.Jaik.D374E7
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.Win32.Zenpak.gen
Microsoft Trojan:Win32/BlackMoon.Z!MTB
Google Detected
AhnLab-V3 Trojan/Win.BlackMoon.R652645
Acronis Clean
McAfee Clean
MAX malware (ai score=87)
VBA32 BScope.Trojan.Downloader
Malwarebytes Generic.Malware.AI.DDS
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall Clean
Rising Trojan.BlackMoon!8.1980E (TFE:5:W2Bdxtm86PF)
Yandex Clean
Ikarus Trojan.Crypt
MaxSecure Clean
Fortinet W32/Agent.WP!tr
BitDefenderTheta Gen:NN.ZexaF.36806.wv2@aKGAqydi
AVG Win32:TrojanX-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_90% (D)
alibabacloud Clean
No IRMA results available.