PE Compile Time

2012-04-16 15:50:09

PE Imphash

6a7b35a3103412e3d3aebb6448bd1f91

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0004210e 0x00042200 7.74603195767
.data 0x00044000 0x00002d84 0x00002e00 5.49332521956
.text5 0x00047000 0x000003e8 0x00000400 0.160328725899
.text6 0x00048000 0x000003e8 0x00000400 0.160328725899
.rsrc 0x00049000 0x00001bdc 0x00001c00 4.37623797529
.reloc 0x0004b000 0x000007d0 0x00000800 6.4003979645

Resources

Name Offset Size Language Sub-language File type
MUI 0x00049218 0x000000f8 LANG_ENGLISH SUBLANG_ENGLISH_US data
WEVT_TEMPLATE 0x00049310 0x00000c42 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_ICON 0x0004a07c 0x000002e8 LANG_ENGLISH SUBLANG_ENGLISH_US Device independent bitmap graphic, 32 x 64 x 4, image size 0
RT_ICON 0x0004a07c 0x000002e8 LANG_ENGLISH SUBLANG_ENGLISH_US Device independent bitmap graphic, 32 x 64 x 4, image size 0
RT_GROUP_ICON 0x0004a364 0x00000022 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_VERSION 0x0004a388 0x000003b0 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_MANIFEST 0x0004a738 0x000004a2 LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document, ASCII text, with CRLF line terminators

Imports

Library KERNEL32.dll:
0x4447bc VirtualAllocEx
0x4447c4 lstrcatA
0x4447c8 CreateFileA
Library USER32.dll:
0x4447d8 ReplyMessage
0x4447dc SetScrollRange
0x4447e0 MapVirtualKeyW
0x4447e4 CreateDesktopW
0x4447e8 FindWindowW
0x4447f0 SendNotifyMessageA
0x4447f4 GetMenuState
0x444804 ModifyMenuA
0x444808 OemToCharBuffA
0x44480c DdeGetData
0x444810 SetDlgItemTextA
0x444814 GetDlgCtrlID
0x44481c TrackPopupMenuEx
0x444820 DefDlgProcA
0x444828 ValidateRect
0x444830 DestroyCaret
0x444834 DdeQueryStringA
0x444838 EnableMenuItem
0x44483c BeginPaint
0x444840 DefMDIChildProcW
0x444844 GetWindowTextA
0x444848 UnregisterClassW
0x44484c LoadStringW
0x444850 GetWindowLongW
0x444854 CharPrevA
0x44485c wsprintfW
0x444860 CascadeWindows
0x444864 WinHelpW
0x444868 WaitMessage
0x444870 SetScrollInfo
0x444874 RealGetWindowClassW
0x444878 IsDialogMessageW
0x44487c LoadBitmapW
0x444880 SetWindowsHookA
0x444888 EndPaint
0x44488c ExcludeUpdateRgn
0x444890 CharPrevW
0x444898 DdeFreeStringHandle
0x4448a0 GetKeyState
0x4448a4 GetMenuItemID
0x4448a8 IMPQueryIMEW
0x4448ac EnumThreadWindows
0x4448b0 SetSystemCursor
0x4448b4 ToUnicode
0x4448b8 GetMenuItemInfoW
0x4448bc IsWindowEnabled
0x4448c0 keybd_event
0x4448cc ClipCursor
0x4448d0 EditWndProc
0x4448d4 GetScrollPos
0x4448dc MapDialogRect
0x4448e0 GetKeyNameTextW
0x4448e4 GetMenuStringW
0x4448e8 GetWindowPlacement
0x4448f0 DefDlgProcW
0x4448f8 GetUpdateRect
0x4448fc GetMessagePos
0x444900 UpdateLayeredWindow
0x444904 GetKBCodePage
0x444914 RemovePropW
0x444918 UnregisterClassA
0x44491c ChangeMenuA
0x444920 EnumDisplayDevicesA
0x444928 SwitchDesktop
0x44492c PostThreadMessageA
0x444934 OpenWindowStationW
0x444938 SetClipboardData
0x44493c SendMessageW
0x444940 EnumPropsA
0x444944 CharUpperW
0x444948 EnumDesktopsW
0x44494c DlgDirListComboBoxA
0x444950 IsHungAppWindow
0x44495c LoadIconA
0x444960 SetDebugErrorLevel
0x444964 DeferWindowPos
0x444968 SetDoubleClickTime
0x44496c GetDCEx
0x444970 CreateIconIndirect
0x444974 ScrollWindow
0x444978 DrawEdge
0x44497c AdjustWindowRect
0x444980 MapVirtualKeyExA
0x444984 GetMenuItemRect
0x444988 WINNLSGetIMEHotkey
0x44498c EnumWindowStationsW
0x444990 GetWindowRect
0x444998 DdeEnableCallback
0x4449a0 PaintDesktop
0x4449a4 CloseWindow
0x4449a8 DdeConnectList
0x4449ac EnumWindowStationsA
0x4449b0 OemToCharW
0x4449b4 InsertMenuW
0x4449b8 CheckMenuItem
0x4449bc HiliteMenuItem
0x4449c0 CopyImage
0x4449c4 DestroyWindow
0x4449c8 CallWindowProcW
0x4449cc DdeAccessData
0x4449d4 IsZoomed
0x4449d8 WaitForInputIdle
0x4449dc InSendMessageEx
0x4449e0 LoadKeyboardLayoutW
0x4449e4 OemToCharBuffW
0x4449e8 GetClassLongW
0x4449ec DestroyIcon
0x4449f0 InvalidateRect
0x4449f8 GetSystemMenu
0x444a00 GetCaretBlinkTime
0x444a04 InvertRect
0x444a08 DdeNameService
0x444a0c GetShellWindow
0x444a10 SetCursorPos
0x444a18 GetWindow
0x444a1c DdeAddData
0x444a20 WINNLSEnableIME
0x444a24 InvalidateRgn
0x444a2c GetIconInfo
0x444a30 IsCharLowerW
0x444a34 OpenWindowStationA
0x444a44 SetParent
0x444a48 GetMenuItemCount
0x444a4c IsCharAlphaNumericW
0x444a50 AppendMenuA
0x444a54 SetMenuItemInfoA
0x444a58 InsertMenuItemA
0x444a5c IMPGetIMEW
0x444a60 CharNextW
0x444a64 SetClassWord
0x444a68 FrameRect
0x444a6c DestroyMenu
0x444a70 GetClassInfoExA
0x444a74 IsCharLowerA
0x444a78 GetMenuBarInfo
0x444a7c IsCharUpperA
0x444a80 OpenInputDesktop
0x444a84 IsCharAlphaA
0x444a88 CloseWindowStation
0x444a8c DrawTextExA
0x444a90 SetClipboardViewer
0x444a94 SetDlgItemInt
0x444a98 DdeQueryConvInfo
0x444aa0 PostThreadMessageW
0x444aa4 TabbedTextOutA
0x444aa8 ClientToScreen
0x444aac SetWindowLongW
0x444ab0 RemovePropA
0x444ab4 IMPSetIMEA
0x444ab8 DefMDIChildProcA
0x444abc MapVirtualKeyA
0x444ac0 GetCursorInfo
0x444ac4 DdeDisconnect
0x444ac8 GetLastActivePopup
0x444acc SetCapture
0x444ad0 GetAltTabInfoW
0x444ad4 TileChildWindows
0x444ad8 GetKeyNameTextA
0x444adc CheckRadioButton
0x444ae0 GetDlgItem
0x444ae4 CascadeChildWindows
0x444ae8 VkKeyScanExW
0x444aec FreeDDElParam
0x444af0 UnpackDDElParam
0x444af4 CharLowerA
0x444af8 GetClassNameA
0x444afc EnumPropsExA
0x444b00 SetDlgItemTextW
0x444b04 RegisterClassA
0x444b08 GetSubMenu
0x444b0c GetSystemMetrics
0x444b10 SetThreadDesktop
0x444b14 GetWindowTextW
0x444b18 FlashWindow
0x444b1c LoadAcceleratorsA
0x444b20 DdeSetUserHandle
0x444b28 OffsetRect
0x444b2c InSendMessage
0x444b34 CharLowerBuffA
0x444b3c GetDlgItemTextA
0x444b40 GetGuiResources
0x444b48 GetNextDlgTabItem
0x444b4c SetFocus
0x444b50 GetInputDesktop
0x444b58 SetDeskWallpaper
0x444b60 GetClipCursor
0x444b64 MenuItemFromPoint
0x444b68 GetForegroundWindow
0x444b6c PeekMessageW
0x444b70 UpdateWindow
0x444b74 EnumPropsExW
0x444b78 LoadKeyboardLayoutA
0x444b7c SetClassLongW
0x444b84 CallMsgFilter
0x444b88 GetClassInfoA
0x444b90 SendIMEMessageExA
0x444b94 GetAsyncKeyState
0x444b98 WindowFromDC
0x444b9c OemToCharA
0x444ba0 CallMsgFilterA
0x444ba4 GetDlgItemTextW
0x444ba8 GetTitleBarInfo
Library msvcrt.dll:
0x444bb0 memcpy
Library ADVAPI32.dll:
0x444bb8 RegOpenKeyExW
Library SHLWAPI.dll:
0x444bc0 StrRetToBufW
0x444bc4 StrCSpnA
0x444bc8 SHSetValueA
0x444bcc SHAutoComplete
0x444bd4 StrStrA
0x444bd8 StrRChrIA
0x444bdc StrFormatKBSizeW
0x444be0 UrlUnescapeW
0x444be4 StrCpyNW
0x444be8 StrRChrA
0x444bec None
0x444bf0 SHRegDuplicateHKey
0x444bf8 PathSetDlgItemPathW
0x444bfc StrToIntW
0x444c00 PathBuildRootW
0x444c04 PathStripToRootW
0x444c0c SHRegEnumUSKeyW
0x444c10 UrlIsNoHistoryW
0x444c14 StrStrIA
0x444c18 PathFileExistsA
0x444c1c PathCanonicalizeW
0x444c24 SHRegEnumUSValueW
0x444c28 SHRegDeleteUSValueW
0x444c30 PathIsUNCServerW
0x444c34 SHOpenRegStreamW
0x444c38 StrCmpNIW
0x444c3c PathFindOnPathA
0x444c48 UrlCreateFromPathW
0x444c4c PathBuildRootA
0x444c50 AssocQueryStringA
0x444c54 PathStripPathW
0x444c58 UrlGetPartA
0x444c5c SHSetValueW
0x444c64 PathCompactPathA
0x444c68 SHEnumKeyExA
0x444c6c StrRChrIW
0x444c74 StrChrA
0x444c78 StrCatBuffW
0x444c7c PathCompactPathExW
0x444c80 SHStrDupA
0x444c84 PathIsRelativeW
0x444c88 PathAddBackslashW
0x444c8c SHRegEnumUSKeyA
0x444c90 PathSkipRootW
0x444c94 SHCopyKeyW
0x444c98 PathCompactPathExA
0x444ca0 StrRChrW
0x444ca4 PathUndecorateW
0x444ca8 StrRStrIW
0x444cac StrFormatKBSizeA
0x444cb0 SHEnumValueA
0x444cb4 PathGetArgsA
0x444cb8 PathUnquoteSpacesA
0x444cbc PathCommonPrefixW
0x444cc0 StrTrimA
0x444cc4 StrToIntExA
0x444cc8 SHGetThreadRef
0x444ccc UrlHashW
0x444cd0 UrlUnescapeA
0x444cd4 SHRegQueryUSValueA
0x444cd8 SHGetInverseCMAP
0x444cdc StrCatW
0x444ce4 SHRegEnumUSValueA
0x444ce8 StrPBrkW
0x444cec PathFindOnPathW
0x444cf0 StrRetToBufA
0x444cf4 ChrCmpIW
0x444cf8 IntlStrEqWorkerA
0x444cfc UrlCompareA
0x444d00 StrPBrkA
0x444d04 SHRegCloseUSKey
0x444d08 PathMakePrettyA
0x444d0c StrCmpW
0x444d10 SHRegDeleteUSValueA
0x444d14 PathIsContentTypeA
0x444d18 UrlIsOpaqueW
0x444d1c SHDeleteKeyW
0x444d20 PathIsDirectoryA
0x444d24 HashData
0x444d2c StrCmpNIA
0x444d30 PathIsUNCA
0x444d34 PathSetDlgItemPathA
0x444d38 StrRetToStrA
0x444d3c PathIsFileSpecW
0x444d40 SHQueryValueExA
0x444d48 PathIsPrefixW
0x444d4c SHRegQueryUSValueW
0x444d50 PathRemoveBlanksA
0x444d54 PathCommonPrefixA
0x444d5c ColorHLSToRGB
0x444d60 SHGetValueA
0x444d64 PathRemoveFileSpecW
0x444d68 PathIsPrefixA
0x444d6c PathAppendA
0x444d70 PathAddExtensionA
0x444d78 PathUndecorateA
0x444d7c wnsprintfA
0x444d80 SHRegGetUSValueA
0x444d84 PathFindExtensionA
0x444d8c PathCombineW
0x444d90 SHRegWriteUSValueA
0x444d94 PathRemoveBlanksW
0x444da0 PathRemoveArgsW
0x444da4 PathIsSameRootW
0x444da8 StrSpnW
0x444dac GetMenuPosFromID
0x444db0 PathIsSameRootA
0x444db4 SHRegSetUSValueA
0x444db8 SHRegOpenUSKeyA
0x444dbc UrlApplySchemeW
0x444dc0 StrCSpnW
0x444dc4 AssocQueryKeyA
0x444dc8 PathRelativePathToA
0x444dcc AssocCreate
0x444dd0 SHSkipJunction
0x444dd4 StrStrIW
0x444dd8 StrToIntExW
0x444ddc SHRegCreateUSKeyW
0x444de8 SHOpenRegStream2W
0x444df0 PathAddExtensionW
0x444df4 SHEnumKeyExW
0x444df8 PathIsRootW
0x444dfc PathStripPathA
0x444e04 PathIsNetworkPathA
0x444e0c PathIsFileSpecA
0x444e10 PathIsContentTypeW
0x444e14 PathSkipRootA
0x444e18 StrFormatByteSizeW
0x444e1c PathMatchSpecA
0x444e20 PathQuoteSpacesA
0x444e24 PathMatchSpecW
0x444e2c UrlCombineW
0x444e30 StrCSpnIW
0x444e34 SHDeleteEmptyKeyW
0x444e38 StrDupA
0x444e40 PathFindFileNameA

!This program cannot be run in DOS mode.
`.data
.text5
@.text6
@.rsrc
@.reloc
jp,{s6{%
C[X9ST
_r/W{kl
`J8eYx??
XdIrP}
G`LUN:
'b,{Vy=VR
H'5aS&
`(,Gw_)
2`('{h
n&KC9!{
]hU]bke
~cv<AZ
)1-?(o
{wzA{ezA{
39~K38vJ3;nM3
~C3pvB3snE3b
D3]~?3Tv>3OnA3F
@3)~;3(v:3+n=3
{ ~@{8
{d~@{f
{L~@{5
#]~.^s~
![~j,->0E]
A{GDA{ODA{bDA{9
A{gDA{
AA{U%A{W%A{D
8SO;AN}Y!
uo7#[`44{^$5]i;/?k'5"
rf2$za:&
mLUE^|bRY/
`u* tr
Nc393M=~
O'-7i)<
=P/;r\=
PN'*3S
84KpscVqw
{?we)GrvMNll{!ve
cB{"eB{p
"7kW5nn
,g{EkgG*c
n{|':D
D'KyFuR
{ZhXz"
`?_{b?W
i& fzB
F|1nFvb
< cHWwh
Tl:SCv3
)sd/ ]
&4j7yI#
|sSwZRr
gFtveM
{^Fs|}
}sq_}s
dnAi{${
~eW:YV
@a^dg|
E2I%7%lPD
86c{|?
xrtw)K
$ttk)L
:P9;;U8I
@JI&\=?
yavHzL
JLSne
"(t_Zs
n^bXTd
nTOcZp
@RwF$V
EVzj#{,!
Vb?ONr
@{9yCk
x}SbA~
4+4Kc#'
-LP\@W
/_3`SL&o?F
{0I$z!
\bC_W
O,3J0vA
j30zz+0yq
oZ%C[7
bwF$byF$jy
/+gB$S
{"8sR~
sh=tr-y
g^}yq]
.W&i@M
6#k6A-
e&GyOp
f6P$bNt
F9bOJ1
x][c4b
CGyE{x+
mbx9ER
sd;{/J
sLuF|l
`o/tsx
a?,K.|
Jl(zWuC
|pcG_d
|L4ztz
tfpAR>
{t/CKN/CG
Svp6Tv|>
ErB}M#
gp\"C%
W-~C_e
OYyyzd
K/u3Xp
RK4nEA
8Y}>89
7vBnop
ze(<!<
?[pf>{
@9'.p-
dOWk`0
GTE#IH
[n?o\8
N$~PE$v
a]$2Cm
{!|E50"
TE$6TL
] m`Z9
Gk7:ll/_
~)"y`jX
OatKM
2E$f8u$
*wHX$&
0YL*E^
W"/>r}
0Espvl
<69{;1
Q{)w;
a}{rvC_z
{-~}k`p*#
&bC{|v
mP' _
1+K.+R
~.Wlao
kF\:gR
^jW1jj
>U{46Y
.;AH.?AH
$H.IAu
;4<Z k
>2'S!"
SK{4|Es
{Y+IBH
*i "*o
{kK `$
?{\t<{
lpFDR}>$r
^>ytg|txe,
yGBVK"
{nEta-0
@{g>th
Tin$"U
t^e>,+
tcin$v
N0a?{5<78
{iEuA9
Zn$r>n$jZn$BcB
mZn$>>v$.Zn${
?{/>uo
{'>zc-@P
{W*]mC
wV=~E*M
@{Ez.
|&_qxVPr
NrT=Qr
9[oW9J~
Wy}FXo
v(6:`P
u*r A<a
{uDP4!
sjM?P*
;^{LHt
m*78Hk
]K1?2J
xI>^x@>Q
j2FQCw
9 WNt"Y
d|2S\t
7,,G$z
Bs[&C;
PcH?s?
7x*V8:
5({IwI
Ay-nIx
AyEnIx
q:'~)j%5)
{2SO(u'
Lb3)k5
d[WD{R
QStuWJuyu
xA'Z6S&C
Jt<R-l<O$
C{id@/i
]y?$kj
GV{.q>[4qD+
N>gkB4
;vCDPfb
{p>sFt
Ug\[+L
3)"e[05
yOs7yPs3
Xc9YU+t
~)DW9t
3)=MMb
|(>{=-g
MEGj"D
Nx,>{Ox
ln/?,#
W{QPMh
TPd:]R\
YVQ_:]
&Cyd-5OS*#>{
yOof,q
Aml?x`
,vIxh*o5+G
j{FL{
}(Sb>+
8b[)-"
b6oRr6sR>
)He%9^w
A~vk2GE
LDqa}V
}"]{d+3,
}zc$GB
[F$O53
AO/F:d
#rHpE}OZ
7N')EW!
Vy?QEn
YU|TM..
p=wm@qp=
b->;!C
" !^}Dv
dr%}'w
;7n$v2
*{58,@
{5}BXv
{5}BXu
&xLiH^
'%zLiGn
5~zeq|
~zmet.
]vwxms
J~VOt)NUjL2
iaRm]eM
Wa6~de
al:~jiXoV
RcK@_]
?iM>]x/"
Lyq]tK
ne{pkkT
kTS0k_"
bcHvPgU
]lGa]m7
Y]^uMHV
@VvCxb
Ut?tas
ct'ZTc
=s@tWt
tnWK]^o
jr7p^P`^Weab=d
UtnMwbgautRo
ki{P.m{V
0dLaNiH2
+cP_+mH
[gt.rdeCnIeA_Ug/
>r3^Ad=t
zm+t&$
Ey`+aR
:ciq2_Ha?
je>[Si|skw
Wq^Mwqq
Jinvne_jhu[cam
%inM7pqIFiiC
inM7pqS
mieVlds
NiKW.K^
Szq#t>
Y]pNtdD3hf
nr+qcS/hqr;[mD
hqrk[mD
XWr{Wnop
ac?X]t+^asAX]p
sdS3gf
IcBo6Q{n
Qc/Vl
2zm#t7
;_nH3\jDCkU
kdiLxGi6
'2lkfl
nnhUznD
fpeLjib
!jdC{O2J
/{TtSc*d9
V+k$z+>
ieuuSaSbjWe
mnF5w^e
kApcpW
zeA^ne
]nnUandNsvaE
Uc]F>\gh
flfefl>C
jsp}]nO`hAxR
!]aa&j>C
=3 1bl
^d0jgs{P
{yS?8V
`ar[Thf5
=nnpdn?[7o4uacN
JtnWKpouDe
Jt^[5d~
aq/ngt
nUd/YgA"
neu?XnA"
S%c(P5x:$
koIoaA"
gePMat
\lnARp4u
4marTYae
llnUaldEl\i
2sIW#_OX
v0iny/
?po=\wF4RtE
UQ^u^Eby1
O{2w@{cl
aZ?m5+
Eo?Gs
L&/}D6/
I-AJx-jK
@Gg3fI
)/4V)74VI4VI'4
gl1yOY1~G
;>|I[>kI
~#<%u-9
sj%-+j
-+jI-3jQ-;
j9-3JA-
7<DY7NL
DM.%Ch.qD
^<;KV_;dO-<
l%y~S$
3{iv3$H
,/I*0MI
3if$4Qnu0
66zT7ey
na%{eq$
'adj'-S
J.%kZ.@k@.\k
?.e|/Mt
utqU~Br
un!Bh{[
&{Pj{*~
hha}6
\system32\cabinet.dll
VirtualAllocEx
GetWindowsDirectoryA
lstrcatA
CreateFileA
FileTimeToDosDateTime
KERNEL32.dll
InternalGetWindowText
ReplyMessage
SetScrollRange
MapVirtualKeyW
CreateDesktopW
FindWindowW
CopyAcceleratorTableW
SendNotifyMessageA
GetMenuState
GetMenuContextHelpId
GetWindowTextLengthW
SendMessageCallbackA
ModifyMenuA
OemToCharBuffA
DdeGetData
SetDlgItemTextA
GetDlgCtrlID
GetTabbedTextExtentA
TrackPopupMenuEx
DefDlgProcA
MsgWaitForMultipleObjectsEx
ValidateRect
GetWindowContextHelpId
DestroyCaret
DdeQueryStringA
EnableMenuItem
BeginPaint
DefMDIChildProcW
GetWindowTextA
UnregisterClassW
LoadStringW
GetWindowLongW
CharPrevA
GetClipboardFormatNameA
wsprintfW
CascadeWindows
WinHelpW
WaitMessage
RegisterClipboardFormatW
SetScrollInfo
RealGetWindowClassW
IsDialogMessageW
LoadBitmapW
SetWindowsHookA
ChangeDisplaySettingsExW
EndPaint
ExcludeUpdateRgn
CharPrevW
WINNLSGetEnableStatus
DdeFreeStringHandle
CountClipboardFormats
GetKeyState
GetMenuItemID
IMPQueryIMEW
EnumThreadWindows
SetSystemCursor
ToUnicode
GetMenuItemInfoW
IsWindowEnabled
keybd_event
LookupIconIdFromDirectoryEx
GetUserObjectInformationA
ClipCursor
EditWndProc
GetScrollPos
ImpersonateDdeClientWindow
MapDialogRect
GetKeyNameTextW
GetMenuStringW
GetWindowPlacement
SetUserObjectInformationW
DefDlgProcW
GetProcessDefaultLayout
GetUpdateRect
GetMessagePos
UpdateLayeredWindow
GetKBCodePage
DdeImpersonateClient
ChangeDisplaySettingsExA
RegisterDeviceNotificationW
RemovePropW
UnregisterClassA
ChangeMenuA
EnumDisplayDevicesA
AllowSetForegroundWindow
SwitchDesktop
PostThreadMessageA
EnumClipboardFormats
OpenWindowStationW
SetClipboardData
SendMessageW
EnumPropsA
CharUpperW
EnumDesktopsW
DlgDirListComboBoxA
IsHungAppWindow
BroadcastSystemMessageA
GetOpenClipboardWindow
LoadIconA
SetDebugErrorLevel
DeferWindowPos
SetDoubleClickTime
GetDCEx
CreateIconIndirect
ScrollWindow
DrawEdge
AdjustWindowRect
MapVirtualKeyExA
GetMenuItemRect
WINNLSGetIMEHotkey
EnumWindowStationsW
GetWindowRect
DdeCreateStringHandleA
DdeEnableCallback
LookupIconIdFromDirectory
PaintDesktop
CloseWindow
DdeConnectList
EnumWindowStationsA
OemToCharW
InsertMenuW
CheckMenuItem
HiliteMenuItem
CopyImage
DestroyWindow
CallWindowProcW
DdeAccessData
GetWindowModuleFileNameA
IsZoomed
WaitForInputIdle
InSendMessageEx
LoadKeyboardLayoutW
OemToCharBuffW
GetClassLongW
DestroyIcon
InvalidateRect
SystemParametersInfoA
GetSystemMenu
DdeAbandonTransaction
GetCaretBlinkTime
InvertRect
DdeNameService
GetShellWindow
SetCursorPos
RegisterShellHookWindow
GetWindow
DdeAddData
WINNLSEnableIME
InvalidateRgn
CreateIconFromResource
GetIconInfo
IsCharLowerW
OpenWindowStationA
DdeCreateStringHandleW
GetUserObjectInformationW
GetUserObjectSecurity
SetParent
GetMenuItemCount
IsCharAlphaNumericW
AppendMenuA
SetMenuItemInfoA
InsertMenuItemA
IMPGetIMEW
CharNextW
SetClassWord
FrameRect
DestroyMenu
GetClassInfoExA
IsCharLowerA
GetMenuBarInfo
IsCharUpperA
OpenInputDesktop
IsCharAlphaA
CloseWindowStation
DrawTextExA
SetClipboardViewer
SetDlgItemInt
DdeQueryConvInfo
ChildWindowFromPointEx
PostThreadMessageW
TabbedTextOutA
ClientToScreen
SetWindowLongW
RemovePropA
IMPSetIMEA
DefMDIChildProcA
MapVirtualKeyA
GetCursorInfo
DdeDisconnect
GetLastActivePopup
SetCapture
GetAltTabInfoW
TileChildWindows
GetKeyNameTextA
CheckRadioButton
GetDlgItem
CascadeChildWindows
VkKeyScanExW
FreeDDElParam
UnpackDDElParam
CharLowerA
GetClassNameA
EnumPropsExA
SetDlgItemTextW
RegisterClassA
GetSubMenu
GetSystemMetrics
SetThreadDesktop
GetWindowTextW
FlashWindow
LoadAcceleratorsA
DdeSetUserHandle
DlgDirSelectComboBoxExA
OffsetRect
InSendMessage
ChangeDisplaySettingsW
CharLowerBuffA
EnumDisplaySettingsA
GetDlgItemTextA
GetGuiResources
EnumDisplaySettingsExA
GetNextDlgTabItem
SetFocus
GetInputDesktop
GetTabbedTextExtentW
SetDeskWallpaper
CreateAcceleratorTableW
GetClipCursor
MenuItemFromPoint
GetForegroundWindow
PeekMessageW
UpdateWindow
EnumPropsExW
LoadKeyboardLayoutA
SetClassLongW
SendMessageCallbackW
CallMsgFilter
GetClassInfoA
GetWindowModuleFileName
SendIMEMessageExA
GetAsyncKeyState
WindowFromDC
OemToCharA
CallMsgFilterA
GetDlgItemTextW
GetTitleBarInfo
USER32.dll
memcpy
msvcrt.dll
RegOpenKeyExW
ADVAPI32.dll
StrRetToBufW
StrCSpnA
SHSetValueA
SHAutoComplete
PathRenameExtensionW
StrStrA
StrRChrIA
StrFormatKBSizeW
UrlUnescapeW
StrCpyNW
StrRChrA
SHRegDuplicateHKey
SHRegDeleteEmptyUSKeyA
PathSetDlgItemPathW
StrToIntW
PathBuildRootW
PathStripToRootW
PathSearchAndQualifyA
SHRegEnumUSKeyW
UrlIsNoHistoryW
StrStrIA
PathFileExistsA
PathCanonicalizeW
PathMakeSystemFolderA
SHRegEnumUSValueW
SHRegDeleteUSValueW
PathRenameExtensionA
PathIsUNCServerW
SHOpenRegStreamW
StrCmpNIW
PathFindOnPathA
SHRegQueryInfoUSKeyW
PathFindNextComponentA
UrlCreateFromPathW
PathBuildRootA
AssocQueryStringA
PathStripPathW
UrlGetPartA
SHSetValueW
PathUnExpandEnvStringsA
PathCompactPathA
SHEnumKeyExA
StrRChrIW
PathRemoveExtensionA
StrChrA
StrCatBuffW
PathCompactPathExW
SHStrDupA
PathIsRelativeW
PathAddBackslashW
SHRegEnumUSKeyA
PathSkipRootW
SHCopyKeyW
PathCompactPathExA
PathRemoveBackslashW
StrRChrW
PathUndecorateW
StrRStrIW
StrFormatKBSizeA
SHEnumValueA
PathGetArgsA
PathUnquoteSpacesA
PathCommonPrefixW
StrTrimA
StrToIntExA
SHGetThreadRef
UrlHashW
UrlUnescapeA
SHRegQueryUSValueA
SHGetInverseCMAP
StrCatW
StrFromTimeIntervalA
SHRegEnumUSValueA
StrPBrkW
PathFindOnPathW
StrRetToBufA
ChrCmpIW
IntlStrEqWorkerA
UrlCompareA
StrPBrkA
SHRegCloseUSKey
PathMakePrettyA
StrCmpW
SHRegDeleteUSValueA
PathIsContentTypeA
UrlIsOpaqueW
SHDeleteKeyW
PathIsDirectoryA
HashData
SHRegGetBoolUSValueA
StrCmpNIA
PathIsUNCA
PathSetDlgItemPathA
StrRetToStrA
PathIsFileSpecW
SHQueryValueExA
PathUnmakeSystemFolderW
PathIsPrefixW
SHRegQueryUSValueW
PathRemoveBlanksA
PathCommonPrefixA
SHRegQueryInfoUSKeyA
ColorHLSToRGB
SHGetValueA
PathRemoveFileSpecW
PathIsPrefixA
PathAppendA
PathAddExtensionA
PathFindSuffixArrayW
PathUndecorateA
wnsprintfA
SHRegGetUSValueA
PathFindExtensionA
SHRegDeleteEmptyUSKeyW
PathCombineW
SHRegWriteUSValueA
PathRemoveBlanksW
PathParseIconLocationA
AssocQueryStringByKeyW
PathRemoveArgsW
PathIsSameRootW
StrSpnW
GetMenuPosFromID
PathIsSameRootA
SHRegSetUSValueA
SHRegOpenUSKeyA
UrlApplySchemeW
StrCSpnW
AssocQueryKeyA
PathRelativePathToA
AssocCreate
SHSkipJunction
StrStrIW
StrToIntExW
SHRegCreateUSKeyW
AssocQueryStringByKeyA
StrFormatByteSize64A
SHOpenRegStream2W
PathUnExpandEnvStringsW
PathAddExtensionW
SHEnumKeyExW
PathIsRootW
PathStripPathA
PathIsUNCServerShareW
PathIsNetworkPathA
PathUnmakeSystemFolderA
PathIsFileSpecA
PathIsContentTypeW
PathSkipRootA
StrFormatByteSizeW
PathMatchSpecA
PathQuoteSpacesA
PathMatchSpecW
SHCreateShellPalette
UrlCombineW
StrCSpnIW
SHDeleteEmptyKeyW
StrDupA
PathFindSuffixArrayA
PathFindFileNameA
SHLWAPI.dll
f6;*HR
33333333
3333333333
3333335UUUS3333333333UUUUUUU333333335\
UUS3333335
UUS33333\
UU3333<
33333<
333333<
33333333
3333333333<
333333
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!-- Copyright (c) Microsoft Corporation -->
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" manifestVersion="1.0">
<assemblyIdentity
name="Microsoft.Windows.Disk.Failure.Diagnostic.Wizard"
processorArchitecture="x86"
version="1.0.0.0"
type="win32"/>
<description>Windows Hard Disk Diagnosis Wizard</description>
<dependency>
<dependentAssembly>
<assemblyIdentity
type="win32"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
processorArchitecture="x86"
publicKeyToken="6595b64144ccf1df"
language="*"
</dependentAssembly>
</dependency>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel
level="asInvoker"
uiAccess="false"
</requestedPrivileges>
</security>
</trustInfo>
<asmv3:application>
<asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">
<dpiAware>true</dpiAware>
</asmv3:windowsSettings>
</asmv3:application>
</assembly>
:6>6B6F6J6N6R6V6Z6^6b6f6j6n6r6v6z6~6
7"7&7*7.72767:7>7B7F7J7N7R7V7Z7^7b7f7j7n7r7v7z7~7
8"8&8*8.82868:8>8B8F8J8N8R8V8Z8^8b8f8j8n8r8v8z8~8
9"9&9*9.92969:9>9B9F9J9N9R9V9Z9^9b9f9j9n9r9v9z9~9
:":&:*:.:2:6:::>:B:F:J:N:R:V:Z:^:b:f:j:n:r:v:z:~:
;";&;*;.;2;6;:;>;B;F;J;N;R;V;Z;^;b;f;j;n;r;v;z;~;
<"<&<*<.<2<6<:<><B<F<J<N<R<V<Z<^<b<f<j<n<r<v<z<~<
="=&=*=.=2=6=:=>=B=F=J=N=R=V=Z=^=b=f=j=n=r=v=z=~=
>">&>*>.>2>6>:>>>B>F>J>N>R>V>Z>^>b>f>j>n>r>v>z>~>
05191E1I1
2$2)2.242H2N2z2
2I3Y3d3
4,4S4X4p4
5r6D7[7a7g7m7s7y7
8!8'8-83898?8E8K8Q8W8]8c8i8o8u8{8
9#9)9/959;9A9G9M9S9Y9_9e9k9q9w9}9
::%:+:1:7:=:C:I:O:U:[:a:g:m:s:y:
;!;';-;3;9;?;E;K;Q;W;];c;i;o;u;{;
<#<)</<5<;<A<G<M<S<Y<_<e<k<q<w<}<
==%=+=1=7=>=D=J=P=V=\=b=h=n=t=z=
>">(>.>4>:>@>F>L>R>X>^>d>j>p>v>|>
?$?*?0?6?<?B?H?N?T?Z?`?f?l?r?x?~?
0 0&0,02080>0D0J0P0V0\0b0h0n0t0z0
w6OrxCSeukRIl2X0
120416053538Z
391231235959Z0
w6OrxCSeukRIl2X0
w6OrxCSeukRIl2X
syZds
w6OrxCSeukRIl2X
1OFTWARE
Classes\CLSID\{00C429C0-0BA9-11d2-A484-00C04F8EFB69}\ProgId
WEVT_TEMPLATE
WEVT_TEMPLATE
System
Microsoft-Windows-DiskDiagnostic/Operational
EventData
DiskFriendlyName
VolumeNames
HardwareID
DiskFriendlyName
VolumeNames
HardwareID
EventData
ErrorCode
ErrorCode
win:Critical
win:Error
win:Informational
Microsoft-Windows-DiskDiagnosticDataCollector/Operational
win:Informational
Microsoft-Windows-DiskDiagnosticResolver/Operational
EventData
ErrorCode
ErrorCode
win:Warning
win:Informational
VS_VERSION_INFO
StringFileInfo
040904B0
CompanyName
Microsoft Corporation
FileDescription
Windows Disk Diagnostic User Resolver
FileVersion
6.1.7600.16385 (win7_rtm.090713-1255)
InternalName
DFDWiz.exe
LegalCopyright
Microsoft Corporation. All rights reserved.
OriginalFilename
DFDWiz.exe
ProductName
Microsoft
Windows
Operating System
ProductVersion
6.1.7600.16385
VarFileInfo
Translation
<<<Obsolete>>
w6OrxCSeukRIl2
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Generic.lw2L
tehtris Generic.Malware
ClamAV Clean
CMC Clean
CAT-QuickHeal TrojanPWS.Zbot.Y
ALYac Gen:Variant.Barys.953
Cylance unsafe
Zillya Trojan.Kryptik.Win32.409128
Paloalto generic.ml
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 0040f02a1 )
Alibaba TrojanPSW:Win32/Kryptik.7c9d0127
K7GW Trojan ( 005a0f3d1 )
Cybereason malicious.c4a273
Baidu Win32.Adware.Kryptik.b
VirIT Trojan.Win32.Banker.HN
Cyren W32/Zbot.DQ.gen!Eldorado
Symantec Packed.Generic.459
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Kryptik.AEGF
APEX Malicious
Avast Win32:Karagany
Cynet Malicious (score: 100)
Kaspersky Packed.Win32.Krap.iu
BitDefender Gen:Variant.Barys.953
NANO-Antivirus Trojan.Win32.Krap.ckxapk
ViRobot Trojan.Win32.Z.Zbot.295976
MicroWorld-eScan Gen:Variant.Barys.953
Tencent Malware.Win32.Gencirc.10be6eab
TACHYON Clean
Sophos Troj/Agent-VSS
F-Secure Trojan.TR/Spy.Zbot.EB.42
DrWeb Trojan.PWS.Panda.4425
VIPRE Gen:Variant.Barys.953
TrendMicro Mal_Ransom-1
McAfee-GW-Edition BehavesLike.Win32.ZBot.dc
Trapmine malicious.high.ml.score
FireEye Generic.mg.fe3dffdc4a273c8d
Emsisoft Gen:Variant.Barys.953 (B)
SentinelOne Static AI - Malicious PE
GData Gen:Variant.Barys.953
Jiangmin Packed.Krap.eynh
Webroot W32.Malware.Gen
Avira TR/Spy.Zbot.EB.42
Antiy-AVL GrayWare/Win32.Kryptik.ehls
Gridinsoft Spy.Win32.Zbot.vl!i
Xcitium TrojWare.Win32.Kryptik.ADXK@4nyoqo
Arcabit Trojan.Barys.953
SUPERAntiSpyware Trojan.Agent/Gen-Zbot
ZoneAlarm Packed.Win32.Krap.iu
Microsoft PWS:Win32/Zbot.gen!AF
Google Detected
AhnLab-V3 Trojan/Win32.Zbot.R23747
Acronis Clean
McAfee PWS-Zbot.gen.bew
MAX malware (ai score=80)
VBA32 BScope.TrojanPSW
Malwarebytes Tracur.Trojan.Dropper.DDS
Panda Trj/Genetic.gen
Zoner Clean
TrendMicro-HouseCall Mal_Ransom-1
Rising Dropper.Win32.Uppepa.a (CLASSIC)
Yandex Trojan.GenAsa!Ie4KvgHjMBk
Ikarus Trojan.Win32.Crypt
MaxSecure Trojan.Packed.Krap.iu
Fortinet W32/Kryptik.AEFJ!tr
BitDefenderTheta Gen:NN.ZexaF.36196.sy1@aKiVWNoi
AVG Win32:Karagany
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (W)
IRMA Signature
Trend Micro SProtect (Linux) Mal_Ransom-1
Avast Core Security (Linux) Win32:Karagany
C4S ClamAV (Linux) Clean
Trellix (Linux) PWS-Zbot.gen.bew trojan
Sophos Anti-Virus (Linux) Troj/Agent-VSS
Bitdefender Antivirus (Linux) Gen:Variant.Barys.953
G Data Antivirus (Windows) Virus: Gen:Variant.Barys.953 (Engine A)
WithSecure (Linux) Trojan.TR/Spy.Zbot.EB.42
ESET Security (Windows) a variant of Win32/Kryptik.AEGF trojan
DrWeb Antivirus (Linux) Trojan.PWS.Panda.4425
ClamAV (Linux) Clean
eScan Antivirus (Linux) Gen:Variant.Barys.953(DB)
Kaspersky Standard (Windows) Packed.Win32.Krap.iu
Emsisoft Commandline Scanner (Windows) Gen:Variant.Barys.953 (B)
Cuckoo

We're processing your submission... This could take a few seconds.