Sample details: 094085260de7c41e49b6947fbeb1cb6a --

Hashes
MD5: 094085260de7c41e49b6947fbeb1cb6a
SHA1: 64b63602df835a5d7486c3f2dfcff084afb287fb
SHA256: 968d8fdfd8e4658fdedb91ad1f12b70078ac0813390c8d2775ee6459c94f5c25
SSDEEP: 49152:kuA27cHbL86vin+vWi+HhLUK+0VPBODb6k3lPOao1:kuA27Gbh8+vh+yZ0VP4DbT41
Details
File Type: PE32
Added: 2018-09-24 13:40:53
Yara Hits
CuckooSandbox/vmdetect | YRP/possible_includes_base64_packed_functions | YRP/Safeguard_103_Simonzh | YRP/Safengine_Shielden_v2160 | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/IsPacked | YRP/HasRichSignature | YRP/maldoc_find_kernel32_base_method_1 | YRP/maldoc_getEIP_method_1 | YRP/domain | YRP/IP | YRP/url | YRP/contentis_base64 | YRP/VirtualPC_Detection | YRP/DebuggerCheck__RemoteAPI | YRP/DebuggerHiding__Thread | YRP/ThreadControl__Context | YRP/vmdetect | YRP/anti_dbg | YRP/network_http | YRP/screenshot | YRP/keylogger | YRP/win_registry | YRP/win_private_profile | YRP/win_files_operation | YRP/win_hook | YRP/MD5_Constants | YRP/RijnDael_AES | YRP/Str_Win32_Winsock2_Library | YRP/Str_Win32_Wininet_Library | YRP/Str_Win32_Internet_API | YRP/Str_Win32_Http_API |
Source
http://dianxin8.52zsoft.com/douzhanshenfuzhu.exe
Strings
		!This program cannot be run in DOS mode.
.sedata
.idata
.sedata
N|F~bnmzd
|}.!grL
4EbzKi(
CxR_HnQU
^DqyPpNZD!
;pyJ;`
z]5qd+
j<Ah]s
VA_ni!
02Yc/On
/O$N.T
b4dM%gA`V
+Fs;KX
z2E>x)
Q"F_JM_
&osxH+
D;*>A	'
pxl"\Ej
J"MS+F
v]s4:cf
$lI>d*
xVM0cl
$5KfA(
Q:,h\N
)DsN|57W
/,x%d,]
]|A[,$
b\<2[X
)1a&&?
(L9;!5
OWnsjA4 
m1hk3}
wck}k&
zY]o }
&	<Vd$I
: ;9+?D
B"L(PH
wp`5$o
G YhQB?
>RMO1>
Gb'S._E
+$*:aM
(|.;@*
6kkvwo
Up4e-@`
`efrb&~
~t[z&xE
N{/._p\4
?!4YEf
@5uN~`qt
g_F"i>!k
U&*)809 
9.qPXI=
oB1d`J
Ro+<no7<
1^-~:c
d\*}P>
6&SmV*
uDM/"T$
ap_\T,
c{F3uGu
C	+3(Y
yOpp&M
]8o>`"j
 b<?!A
	}p	{3S
*WD#x.
,z]^Rv!
gc2c0k< 
E}\@trW3
_yvARAM
?ZrJ'Q0
^V/hCqG:R&]A
^PK%Y@
Ivu[$+
jxKAFc
,*[	$zr
Am~ !X|
,n{f:y
5S.mbem
YohC%U
Y]z$jb
=<Agb(
85[r=I`<
6ij+X5
	3kf/^
p4 E9g
>-}#F)
$nle8,0
-B$Xi&
b]rYxy
os6X*p
IJXe;D!
kbE7YT
iDBB!G
"rL<X4
I{zp)1
eNsudrO
8/#5!P
i,-lzG
W gW23
`;YbYA
xy>Qg\?
!{[j=J
/'l)md
dA{Odb
=20q~Sa
gh@51	A
1K@f7{
76_Ecl
'{BKhG[
.Bkj:E<lK
g+`TO]
}7.d-3.
%W!oGY
^KwtiB
<GS'4'A
)_ckz{fm
Omd+ZU
iI`.VK
{N 'O3I
%tSsN@
:G%4OH
?[vXZ&
$7?xb>
$LXr%\C
p:/{W]
COQ:RE?
R\|Jx|
}]@zm^
ZJw;m<S
 !n90[
G,ePMg[Q
@gnC_a!1fF
41`0hW5
2r(8LW
G A-iQ
B7btV_z
6l=A0fINZWK
c/NFF*
,^lk}>
Sw'~$%/O
$`5RyK
yU:lZh
 1s9!3
9,e %X
]YUL_U"0u
F\[ f9'
=	|oZz
f	mQ.:
q$:N?r_
|#^u";
t$M&ys	M
dVVN6{<&N
+^*;2TP7
o7A)IHL
iWp|7.
<}rak~
QJJ"	=*
f{/KioN?V
P&86K@
t'>.S@
mR,\t	
'H$&?4]0
o[xuOB
+8{_{k
W$5i\)k
*ko#e(
mEek{49
Tmc|17
R<0}2 
6'9PZ/J
 @QpRl:
6>0zZ*
pr}M\k
+;yg!3
pR5o+*
r/AMmh
A 38@x
1]*(d>h
Gl'-15
D.LDaB\N
PjK@;K
~]yKm28
`>3zV&
MRaNlP
N'YJOB
kU9*	X
kfL~!-
DP;C0T
|`+>)sB
POh;W?
DQ0uN!y
7olmrP
]htu+)h
cdES@[,
Y(Ii8J
YnAi2Sn
OmH~+)
!h0t7TU
waJ_U19E
oE9mFj
kdC0>+[
!S}W+/
c++v+k
 x5UH/C
:9ER\\
"XS]nK
\%=>YI
?19su{{
*Z0S&c
.,l	D 
uAgA-MbdV
VR,`C~
L%g}U/Y
#[@id	
0;Zy:T
q)H_$S
`4AnSs4
1jbU%yQJ
d$6AYW
B2p,]?
zg Z5S3
?nzD2;+9u
xVN4=c
fbH[KB
.s_X!Q
{YPpdS
]TZ]	%
Up5O2_
$`8':/IP
5'lM<<
G[Jq&b
iw0/b^
u#-v{@j
f"Joof6
-':O>O	d.
-hr})]
.GJtG@ i^Rx=
D{7=e<
]Mv'\[
.|Y_YB
4u<J".sc
H^.EJ.
<MeHO;
MqEi4-
<s%hz?
)ci<+[
X853OS
Rq-}<_
+lJ/5\U)<
aoa$WLP
*VVs7{
kKdIBg:
4KbZWv
NdmVIc
;f @BY
PLhW})
mR35G\
V^<h.(
tb8p[n
J&iu:,
&Awa,\
'#U-*t
]x5g6=
:OMlbR-
M<(-b>`k
nJ{-9[
V	,gvM
IRc<*Q
SaDT\@
\^kE^I
5-(Dx@
2N;}TQ
KJ3*|!~<MDg
A"3@3b
Qdr]P5
WLW;Ki
7p_cwS
/,TUs<
7Khv{g
/J%[/$
OZ%kmf
3u\g4_$
 };|fbf
Rfa/cD 
#oU.Sd0
cI!RcR
-S+_6v
'X5u$$
T]XK$4
e&(/Cv0
Bc,(oC*
xp}X'd
*6d<Q_
oVZa9c
:VrFzACB<
!Aca^)
4v$#C`DK>
diW	w$
c#<J&J
.$HVNQ
lGO3`p&
gW(s-q
{|/Cb|
Z/Okqvn
0M2AP)
f73'<7
]!tixT
ng/>XJ
g@FT%u}Z
IXkacz
Ep7o"o
_#VOQ-
>Q,\=^5
)G<dLPq^b%l
~3e8qq[dB
nPo*)yn
ZxDOA6
+AQDnXSYq
C9x-c.b
)bbtn.
=67Q.[
`x IG!c
F+lYUN[jS
"]%;5#
Y)Gp+7
"QATXF
;5x7m	
1~EI]Rsy
 "431R5
UnPAl(
T3*_13
q}k4"\
0&3uwv
6"Ge&y
X9*wU.
Hb+=Y,g
/Z3LrS
MT-(b_
P:B_} 
|l?o{c
+n@\=n
V<k{&^
%5.N)t&
&\#-(Ig
{XMMX*
8d7o*C
+jl f+K
7i}8Mp|O*
3wx\o-
@y.o?O
 Zl<yH
q$(U;OS
jrHjA?
=	i~s-
F7ws\u
G6KO$r
=<O0s}
i7w	cC
"/e}po
'Qb?#"
!M/}$A$!
,brRM7	Sr
	8i:is 
R<0US:
9bh=R1
rxXv"P
7"1H]p?
hOFhr50
F=~!8Z?
Qv1(|#
6N4T c(
eWz"B`:Ac%nFJ
e X?HR
(kD;#2
na"/cX
_ll3du
@H+zhy
"5|>"=
f%DAk8
X-7k3*
a/iQ$J
OP81LZ
H`OJ;wF
d)*v8Zf
PZY"	je
=%F'!J
mLZP\L6
T2y:1+7
;m;~Y)
sGLO8C#
L&6;ZvgSd
4L`,z\
2>!FC<
w#	Z#z
yl^58(}
Z+b29?
O~Fvw%
$<:$g8
x~lSIG
tLT;!,	
WxH.>*
tt%Y>@
dUw$Ug
;"bTH 
y<m7ZA
@8m%F!Q
r*~pIM
@[=B>?[
c!n#{$
!i>A9I
"X+|DS!7
qU[k,NYW-
	h4gS6
)Jpv3Q
|qE4[i
^a2/#l
w	|GB&
>=XAEv
~7f /Uf
&/g]ppo
,N[th=
Y$@9 k
vM1NjFXL
KLsJR	
ysxWS{
L!sIDL
qzj(OD
7e|4@a
Wr0Eg-
uEmb]4
&XR('O
Fy88ScHyte
2}Y4EH
hh'cN_
aoI1A8
4X_"gV
7ppD*h){
uTSpV0
^&7U[xo
9[6z,5
#keTnS
VWNWz6
Vw> 4K
p/p}C{8
-"$8_I
/A=pZ}.
ojS|q4
M@y@#,
}<=A9*
MKz.m3_
nhqx:5
#^yy+O
RG`%r{
{[QG,;
3@ ,w4-
@m`:f3
oD01<bN
9UZv\J
5 (8s>8C
 vQ5`	Q
}m"A'c<S
=!E6-Q
N)Z1pA
9o]].U
u!lktbK_
K&o87}
	Nz"rx
NT;SvV;s
XIt9Iqd
7h_	wp
95GhH:x
oTJ4*WX
hTuuu&
aN0xEo
rOi0He
?&V*+Z
\SpK$"
'5nA28
;Ki<51
ln*hfs
	Gyu`}N
MJ&VOX!
A,BPaa1
dc!7z0k
fpt#"r
Kyy Kc
'n5l4(
SOO)$A`
+h@0jH
5s{s>5
7H%{-9
Ldfp:,
bWQ|>5V
 cItPX
I=g71G
egz6>Xq
dUf$L1w
uD-+!D
=,3c)B
w)VZV!
0uH\D~
R}7Vb8
Hw4g.c:
~'Cb>[
h|Ld>M^$
^=&kdB
\M$)Xb
n	B;-"zJ+
^hz-	,
MF5!tk
+7f7[W
'.TUP-
2fS+Y*|
%>|Ee}
H 0zh>H+
a7};B?
[^U>Chx
p'2	Y7&
3ks8;t
A'K<eK
ZL&da{
(O}xKa
~KS*0B
diat{Zt
,##{J#
6|OC~mF 
#HXM*t
C!@PKEk
'tr7L@
5G|x%r)'
E=76P+
<+RPom:
X	2Z|&(gi
80f:33
],!'NF#
^<6J	{
OP"{Ra
?dQ%WG
a~%uSO
R%ky]Oz
Mb2:2c
Lud+G"N9jQ
JXQ]fh
kXS=JU]
rfG,0Q
#5*O}-#Y|
-JC%]y
,3()wh
Rsr?G!R\,
Kty`]f`Y
ye/M>%p
utq05o<`@
jK=<oj
VQno:=
\?W;hLK
bw6(pl
$	1Lh3& NN?
x<W>Y1
XI#-Bw8
-^8Zwh
l"cSim
!y{<E[
GtA5%\
8=L^}!
oZz=O\
ZKt#5K
(>Bx>{
 }rq|Y
OvABZv
~b(TWl}
5[$?1E
9XO^}m<
M0>q'HR+
}da*A%u
HW|M(G
j}c RbP
i3f4O@
gx^EmkyH^u
?DH:pVxvI:
y8%P.`
V!Z|C	
p_~$5C
~Sn'&Y
s5@&VV
/uL[3|
O>afW%7#
*&^/m\
Yo~HNl(
&^yY~Y-
oUAoX[
EML]R*
QvP-UP/.?)
>*AJ;B
gq4`bqC\>HB
65w<eW
8.l:NRly,G
cDDDeR
XikpTM
[@Zgpo
bJaDU_
M3U~}_
a+Ee#|
!R_ef>EG1e6
A@$'gvV"uc
R{QdW-_
4LC|.x
x~Q%Xn
;w>,Np2
[zdD2G
Sw?axf+
'*#(lB
Wohr,cP:dR
2a!wOa
\$KOtq
]kG3Cd;T
H.	.yv
	IMew,
:a|Lc|T
[M&.P%
9p\vQN
7XJ@[e"
ac-;v5J
'q$om'
=UX#$>
3<leE'
Jx3V:\Gf
	[Ie}z
o]P*#Y
,X8h\^
i(',?+i
8T;c,A_
pPYL_@P
TTY )u
+GI:Q4[
VZ6U1t]
$'5.sw
%e_g]&J
_xVC'B
Z\=J0"
E]+#bl
]7@E?NV4
{(M7kA
@;:nC'
X1n3LQ
-4;X:{
sU>@!51
1Si9mHOoJdUGk
0ex6Ox
PnB6nz
y]we (
[IGCH:
@aqR\a5Z
]:rVbQ
T}GayG
[WE5|;I
yA2"6>'
4Q/GR(u
nM0"=[Y
|7{kZV
b_GMzhl
?hv!E7
	'[*;F
T$5o?:
O>zk8p9
6Eml?L($
K'}Ggi
	KD/oIAF
JG?miF
p<}- R.I
1_|iT0
LSlvlC
p)CY&?
	oRFe&p
;3G-TI
X^\r{C~?
EMBe1G
U~WIj#Do
h*[<IW
abAI9~
1d)Z/?(
::13i.
`}Fq\Y
rhNijY
9%6z,Z
BDfVJp_
"wH$Ep(
PGz^U(
:\T<`?
R#$~;M
bu)Ji>
oIw,r7PH
]n6'3?Z
I8y^ok
Tz:^,H
<rV1r!8
mWsN0/
\tO/J>	
fe=ZHosremQ
('+ZqK
$Y5h%+
T591$^
u=oEW7
?f)hiB
g)p!z$
5eug~>jzL
IH=y{yX
hBY*o!
FrpSp!Q
.Or{dE
*>k61/@
uD}k&@
	/11pB
yuQ"iF
WC*$[.
sJD[)V
-@~s:b?	
mOWD 3A%5
>^FZ96s
_b/:b au
X1/eI1|B
AM<CVMN
47}HU.
ffA~=x
(m&Jzt
46 /{P
E2Kx/R?e
knKr#E
D6hA~"
1JQZ/>
g#p\g\
NDn.VL
fXE j5
e	T-K>
ZG q>LI&
;	?PE@&
Z8pU,}t^
u	C%>B3
urwa, 
KD/\Ou
	S.m_w
j%fKEg
 EsE#`
r%+{)C2
UmWQ|M
	#Vqmo
V2pj<[1
%xrQ[;?
'uK ;d
Ac9Y\$X?
Ly	=>!5
~J6rk>
J#NE9`
99~9~'|
FR7tA[
tuQ 7o
GdF(I_!
mD%_CD
1rwr^)
.Q8^Xf
w/<X^b
/+	sY_
mVcSa!F
numnEn
qD#1[=
tu:7cJ
 5	md:e]rr
3Yoya~
Ri"-87U
o<Rx/WRp
c)~E_)ne9
pF^$94PL
Oxe|It
jXc2bXFM
8rc:H0
"<ev*$
\r|6h(
p|I9B7
YD/i)_
,WyRk*}
yYg^TO
W%ChCL
3r%EVi
Is4IEk[TQR
~o9dfl
l*H~;9|
P1#pV1
m!P(f!
c8lm8`:
<'uFPpuyt
MpwFcMg
*?RZKw
[(H"h7
m\)Kke
:QK_Z}L{-
\qz?V1yB:r2GTM?
@h2JK-
AufS>^
9GI.Uv-N^
vjZaQj
t67n(61
RM?iVD
^vYD+Jr
z&_Pu!Q
sN=3SW
Hhb]#9
CDt(Pj>Mc
HetRLfW
!~DeR*AW
IB9jFm
DOP%T1|3
D$?a#)
v9{bF{
Q?_G	;i
{hr	C%
)VwG|Z
%lq5$\
i;4nv.
;qhs-{
BhPLC!
+b:O=E
6.SiR7
x|YBg^W
3.Z-I\aA
< A>y<
$b`%7r
oW"("ED
16RsB?
qd4uxwf
].CLxR
pZ8gL/
.9CB^\
}_4d7W
j)qiIK
]at	F'
1HH2[(
!KB`TP
sT< ]m
1yzNi?L
algN}	v
FdL,u\s
-Leh+e
wM7-1\
SFr5olF
e}7P f
X~wd>Y
(UC*)'
RL%x|u
|W7.D?
Qu@!Bh
SP+"6m
i=G~xc
nq'Y%tw
tCnv19g+
-6^uxKtK
l~bv*mW_
f	JicH
0Z!}uo
=`t~f;
/4.Z:W
9Cu0!*}
(:5ZMu
Y^@8-M
>n(45~
MiMD0OD
5Y/oNH
E"-r:7
?;?bx=
Zq(#B	
;&G]1R.H
3~"Ku:
W;':Nh
\.]Zc0
"O6k9Okr5
[9bcul 
h2!WH/
54AH*:
 MA|'|F
2u[_;j
yaXRpl
&6lI~1
=!M=)Hd[
9t$y$s
7J-F]w
X~!?J0
mpBv <^
y9RO_|
b+i	jA
U4b/[yHE~
VNd&8R
lsmv>A
3%.J4PS
Zj+%\rnF
b2cX~S
2l3||&G
}EztEm8
|g]=)FM
zi-pyA
 iJ	k'U
k?sSr9I	
jY,'C?G
jZG*:0
Z>%6Xw
PN_-:L1
2W_IyZn
2N<Ld%
-B{7A?
WS{&yhf
hGA|r-9j
i]IOoU
$}Z71O
103*f_
y.GA|X
7	fZ71A
_	bZ71,
l$T#l$
d$ fWf
N|/6!`
G Z71-
\Y71.i
Z710ok
Xh%=t:
K(Z71@
GA|(gG
r6Sp$Xu
4'NEzv9|D
-/6!`pB
b[urm|O
zIp:y*@w
/6!`hC:L
MUrm|O
)Rz,g5
Cy=8wH
>Y2Z71c">
pvp7s;D
#0D^]m
#Z:sO7|N	k
fqpsjfP
1M/$A~
Z71y8'
8#X[vY
c>H7L(
"c>HN$}
wXtb[B
Fk1y%&Q
8sP{BH
Z71.m	
<$`f_f
Zzz5?}'
"]@uGA|
-yu>H]
GA|>}y
`Q|&y|
;x>H7x~@a
wIQ6VM
Y71f!*
"hCHgJ
io>]	D
Nh/6!`G
bp9VE%
]lmETg
KV[w~I
bH}n#L_
nyXL#Zn,
huh7 "
>Yh)DL
hNFU[.`
q'Rt>a 
z`=-*1p/`
>y!u0U
/3J{Vu
@!`/w4%
ud|UY71
r: }{na;2
kf4lg"
GetModuleHandleA
GetProcessHeap
HeapCreate
ntdll.dll
RtlAllocateHeap
LoadLibraryExA
CreateFileW
GetFileSize
ReadFile
CloseHandle
VirtualProtect
GetTickCount
GetProcAddress
RtlFreeHeap
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DbgBreakPoint
DbgUserBreakPoint
DbgUiRemoteBreakin
kernel32.dll
NtQueryInformationThread
NtSetInformationThread
user32.dll
advapi32.dll
hid.dll
iphlpapi.dll
VirtualAlloc
VirtualFree
SetThreadAffinityMask
GetCurrentThread
ExitProcess
GetSystemDefaultLangID
GetSystemTime
SystemTimeToFileTime
WriteFile
GlobalAlloc
GlobalLock
GlobalUnlock
GetCurrentThreadId
GetExitCodeThread
OpenThread
TerminateThread
SuspendThread
MultiByteToWideChar
WideCharToMultiByte
IsWow64Process
GetStartupInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CheckRemoteDebuggerPresent
CreateThread
ResumeThread
GetThreadContext
SetThreadContext
mscoree.dll
mscorwks.dll
mscorsvr.dll
mscoreei.dll
clr.dll
diasymreader.dll
SECheckProtection
SEGetAppStatus
SESetAppStatus
SEGetLicenseUserInfoW
SEGetLicenseTrialInfo
SEGetNumExecUsed
SEGetNumExecLeft
SESetNumExecUsed
SEGetExecTimeUsed
SEGetExecTimeLeft
SESetExecTime
SEGetTotalExecTimeUsed
SEGetTotalExecTimeLeft
SESetTotalExecTime
SEGetNumDaysUsed
SEGetNumDaysLeft
SECheckHardwareID
SECheckExpDate
SECheckExecTime
SECheckTotalExecTime
SECheckCountryID
SEGetHardwareIDW
SECheckLicenseFileW
SEGetLicenseHash
SENotifyLicenseBanned
SEResetTrial
SEGetProtectionDate
SEAddMemoryGuard
SEDelMemoryGuard
CreateFileMappingW
MapViewOfFile
MapViewOfFileEx
UnmapViewOfFile
LoadLibraryExW
LoadLibraryA
=j&&LZ66lA??~
}{))R>
f""D~**T
V22dN::t
o%%Jr..\$
&&Lj66lZ??~A
99rKJJ
==zGdd
""Df**T~
;22dV::tN
$$Hl\\
C77nYmm
%%Jo..\r
55j_WW
&Lj&6lZ6?~A?
~=zG=d
"Df"*T~*
2dV2:tN:
x%Jo%.\r.
a5j_5W
ggV}++
Lj&&lZ66~A??
bS11*?
Xt,,4.
RRvM;;
MMfU33
PPxD<<%
Bc!! 0
~~zG==
Df""T~**;
dV22tN::
xxJo%%\r..8$
pp|B>>q
aaj_55
UUPx((
cccc||||wwww{{{{
kkkkoooo
gggg++++
YYYYGGGG
&&&&6666????
uuuu				
nnnnZZZZ
RRRR;;;;
[[[[jjjj
9999JJJJLLLLXXXX
CCCCMMMM3333
PPPP<<<<
~~~~====dddd]]]]
ssss````
""""****
2222::::
$$$$\\\\
7777mmmm
llllVVVV
eeeezzzz
xxxx%%%%....
pppp>>>>
ffffHHHH
aaaa5555WWWW
UUUU((((
BBBBhhhhAAAA
='9-6d
_jbF~T
11#?*0
,4$8_@
t\lHBW
QPeA~S
>4$8,@
p\lHtW
+HpXhE
T[$:.6
RRRR				jjjj
00006666
CCCCDDDD
TTTT{{{{
####====
ffff((((
vvvv[[[[
IIIImmmm
%%%%rrrr
]]]]eeee
llllppppHHHHPPPP
FFFFWWWW
kkkk::::
AAAAOOOOgggg
tttt""""
nnnnGGGG
VVVV>>>>KKKK
yyyy    
YYYY''''
____````QQQQ
;;;;MMMM
ccccUUUU!!!!
6bad allocation
_except_handler3
MSVCRT.dll
GetInterfaceInfo
IPHLPAPI.DLL
??3@YAXPAX@Z
strncpy
strchr
wcsrchr
??2@YAPAXI@Z
strncat
_wcsicmp
_wcsnicmp
__dllonexit
_onexit
_initterm
malloc
_adjust_fdiv
GetMappedFileNameW
PSAPI.DLL
DeviceIoControl
GetModuleFileNameW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleHandleExA
LoadLibraryExW
MapViewOfFileEx
GetLogicalDriveStringsW
QueryDosDeviceW
KERNEL32.dll
wsprintfW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
MessageBoxW
FindWindowA
GetDesktopWindow
GetClassNameA
GetWindow
USER32.dll
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
ADVAPI32.dll
SHGetFolderPathW
SHELL32.dll
%TfQfT
^oR{^om
2\oE:do
^o0X`o
`ozPco
coZ?_o
D^ot?\o
do9Uho
W\oN0boO
eo+Xfo
_oA-eo
\oZycoGhdo
_o0cfo
boY+_o
2\oqOao
1fogy[oykfo
[_oT&co
go9y^o3
go#Hgo
co,Neo
aao&rcoL
TcoMBdoS
io$Hco
Kco?0ho
l$PfRf
103*_f
T$ fVf
~$fSfR
MSVCRT.dll
??2@YAPAXI@Z
_except_handler3
MSVCRT.dll
IPHLPAPI.DLL
GetInterfaceInfo
strncpy
strchr
X-J$2B
MSVCRT.dll
_onexit
??3@YAXPAX@Z
wcsrchr
malloc
MSVCRT.dll
MSVCRT.dll
_initterm
MSVCRT.dll
strncat
MSVCRT.dll
_wcsicmp
__dllonexit
MSVCRT.dll
MSVCRT.dll
_adjust_fdiv
MSVCRT.dll
MSVCRT.dll
X-5gV~
MSVCRT.dll
MSVCRT.dll
??2@YAPAXI@Z
MSVCRT.dll
MSVCRT.dll
MSVCRT.dll
X-B^Z>
MSVCRT.dll
_wcsnicmp
MSVCRT.dll
__dllonexit
MSVCRT.dll
_initterm
PSAPI.DLL
GetMappedFileNameW
PSAPI.DLL
GetMappedFileNameW
KERNEL32.dll
GetLogicalDriveStringsW
_wcsnicmp
QueryDosDeviceW
KERNEL32.dll
MSVCRT.dll
GetWindow
GetModuleFileNameW
KERNEL32.dll
fX-2`^
USER32.dll
USER32.dll
UnmapViewOfFile
GetClassNameA
USER32.dll
OpenClipboard
USER32.dll
EmptyClipboard
KERNEL32.dll
USER32.dll
SetClipboardData
USER32.dll
CloseClipboard
MSVCRT.dll
??3@YAXPAX@Z
KERNEL32.dll
MapViewOfFileEx
strchr
KERNEL32.dll
MapViewOfFile
MSVCRT.dll
strncat
CreateFileMappingW
wsprintfW
wcsrchr
GetModuleHandleExA
KERNEL32.dll
MSVCRT.dll
USER32.dll
USER32.dll
MessageBoxW
{RX-mf4
MSVCRT.dll
MSVCRT.dll
KERNEL32.dll
wfSf[f
KERNEL32.dll
LoadLibraryExW
ADVAPI32.dll
RegDeleteKeyA
ADVAPI32.dll
RegCreateKeyExA
w-Ir~i
ADVAPI32.dll
RegSetValueExA
ADVAPI32.dll
RegCloseKey
ADVAPI32.dll
ADVAPI32.dll
RegOpenKeyExA
RegQueryValueExA
strncpy
KERNEL32.dll
DeviceIoControl
_wcsicmp
IPHLPAPI.DLL
GetInterfaceInfo
USER32.dll
wsprintfW
MSVCRT.dll
MessageBoxW
USER32.dll
SHELL32.dll
SHGetFolderPathW
MSVCRT.dll
USER32.dll
GetDesktopWindow
FindWindowA
USER32.dll
USER32.dll
FindWindowA
USER32.dll
FindWindowA
USER32.dll
FindWindowA
4$fPf^
6s<>w.
nyX6R&^
5vj [9]
d$ UfQ
d$ a`f
4$fVfUf
<6BfVf
d$ 9pT
4103*W
103*EQ
PfVfVf
vtiah[[
8yRZ71
Es'{&y
gY71)dD
z4{2ud
kfz&y}
<j*A8V
]rAkR(
Wt{&yG
J}R}ko
(@/J<[
yRB5)1
R|+V8E
9qrR'T
UmMrR~
orRh/q]
* #xzRI
$.]a,sR
,GxRUo
GCzRqS
v'@sR5!
e|qR3M
P	yRFA
yqRH<1
.+vRCyi
Y71j%]
#ZW4Z71O
 )hRo"5
YWIeGz
~ SdW|
#^pd00
Pz#`&5
P'TnfX
O:q+vsO
z%p|"X
9fJ0lJ
mW?6u<y
:Il;.Ey
Sh+CI;
x^TnQ@_
xN'B<_
x/jNcOhO
(Z71k&d
Y1z'[1 
p(/{HV1
M&h#!\1g
#X_1h	
F]^1)J
\1YW/xD
,}^1!E
;dC*S1
U 4\1vMd
6=7_V1
XAW1h1F:
h\QMS1
Q3LB^1$
8L\1BYq)
LR1"r7n?3
2W}2sny
t?gtj!^
Dr=x&s
fQ*9{Q
6uyf,k?
f}$	\w
fQ*9{)q
jm/|fJM
OQfByf3
mB4@[]T
	j|fz/
yXU|f,N
/zy|=3
TCc'Kc
TR8R*O
TAtZwd
X$k0-k&
H!!EuT 
j@U+y 
wir~I0
LlHO>x
#zjq5`
4QimQ1y
".?J4y
Y<a6f+
fJtHu+
OG@cUg
d)WpDu
p'bNL}
m,2z@;
*\	'2l
3103*E
4:9?/X
Z~;c.y/
>\?dI[U
MS~'D]
Y]uixL
c;%'2(Ih
N}7(2]
'Q'20}+
,2dbCD
ixI*2k
{-h-2t
-U,2CmG
cj-2Q02
02J#7oKm
of'2ha
]QC0+2
02J#7o
9	.2#%H0	?5
[OMx .2
M*2C-&
.2Y&7O
Crn)2f
(KfIw[
z83	5tk
 F|H63
~613YO
0';38/
cSS8mA
N7O+M*
igI&;3
`[ZWYT
6|T~<3
MA13JJ
_V%563
/w43*eP}
:3J#7o
(43/FZ
93Axca
?/==;3
OW83w	i
93mw0D
93K6u|0l
h_\939
13"TF_
_;3C';
.&b33J
Bpsjs7
z ]}cN
mk",ck
|Wa!7}
TR@ySo
6\|yz^2p
6Tf4m5Zd
=ttAPO
	R=kMB
6zKdxV
M(]q		
{&yO#Z
c*z%p|)
hT]Vt-
^*1AF`
3[*9%0
B=[L_*
!&Nb*J
c*{ x'ug
SH5[^*	
z"U^*^
YFeR\*
wrd*{&
Kf/[*C
n4}G\*GP
_]^*2h
T!4[*P
k3<I}-M
AvGA|L
{SC8gR
w'}9|D
Wrm|O2
FD{&yU
:)~&yX
2AvGA|
Zzi(|O
6(^pY7
:G'M\79
@IB:'66
CD{F[J
)4)9v_e
8IiC^)?n
I2s{cm
#Zcbfm
S;ez[yp
xSU4RT
]q{&yV[
fV[V5$W
}?E	g<
wAv)f2
t)u'pI@
)xJ:fB
8FqVT6
ytR0H,
u';d2C
qO93U;M
'Z71	H
wrP.F*z
RS71>}Y
 <Yk8\[r05
K6Yn8~
k8-P<|pc
'S(p8v1+
k8.8PT
9uYUs8
d<s8=>
2k8Snw!
F=!/Jm8
u8jDT=
n8Q6~yy0
hSk8ZJy
iS)Ys8Cg
p8ilQq
u8W CWK&
n8ZU}f
$Jik8"
n3S:'i8
	}/|J,r8
CL<t8^
K4/6!`
9%oHHE
=Y.@w"0
z&y4ud
r03*EyXxV
ny`9Z71r
n5}oU[
|"}+vZ
.fJ}=|
;GA|.i
[103*6
M~qpsjfX
kL67\p 
};$N,{
@`ckZg
BY;`]r^
;cr1k8
?0`rn$
J r'Ocr
>/crZU}fsS
P`rB	gB.
UBp{S:v
xSw{%!
Q]r|^768
crOG@cwm
vTlPQS
jTfuE_Q{
6U2&,-
D$ %8L
nti][=
m=mo&y
@wom|O
toM+C'
2w`I!y
.rm|Of
p'bNB|/
Y3| G(
(UfX[V
ov_<Z71[
hjepYmD
uD!Y71
fJw#vI
qDpB{+:
DtLZ8F
103*Q`
rm|5jIA|
2bN{&y
103P	HA|=
2-<	BHA|
Q?nIhA
Xrm|Ox
tZ71m,
hN8u]$5_
[&aHA|
Y714oqpsj
X\x!K<
+%TfCf
uoCc'Ko4
dyoZU}f !*
!^uyo`j
Fvson\
YM`[|[
7.h~oY
zotJt.
fU?xo.
m2V7S[
Ka,JCH
?t-e$FH6
Y71{:A
'FHIz(
g@03*E
}xV4L0
v-4CBrA
mctt4X
M*Ids8
Z'G@c7&
'gAFH(
d^K*h!OR
/6!`(m
@w@.sx
>%nni"
n#HA|T
+Z71+j'"
l103*E
yE8PXg
\Z71g"
=eYV/#
!ph9T(
GiIQ#A
#ahX90
P$`UgLs
F88z>*
ydxb@3
17{&y8
h~WZ71l+
HA|q,k
@wDm|O
Zz-lQy
eW=)PB;J
!u+3OC
	6fT,P
A{&ytsj
2@$c,*
$@|$}+
@wC03*E`
?(Sb|:
jN}%3bv
103*E|
;~6ed]
z6Kdj(
B.=rrv
z9=eW]pi
l8D:WC
i9Tzz,
ovi'T=
2+8HVQ
mW`&sC
9`{Ao	
Y71?~A
%^GA|"a
ovafQf
GeM$:.
m	Vk` 
LIvs;2
pvNN){+
94m>0z'
="h&Si
H='>Z*
?,ocqv
5nGA|Z
JJ7_d>;
Hhc,0w
w[X'5Z
@w$nyX
YC,pzD3;oo
Y71v1C
20iGA|
YQU\90
zWZ71s2
HP[1|O
e+FP[K
VDyGA|r
6!S"Zzj
vqO-E)
K0P[ED
Jg$nn:
!'|&y(
2NH=}s
Si?qeI
- cu4@
nd)p4CY
]&yYm}
&y3ova
E{&y.R
\h|&y]8
V$2dz6
@w)psj
k&DM7`
0~#oIn
03*Ed2
JPk{&yB
@wrm|O
l8pa)"
GA|,ke
|1 ]bkj
zm%`65
s?n(]w
vhkVw_
G!%@*]
V98~2K
cX2VD'
-)fi&yH
O(Z71]
O[;b@X<
E)=<*z{&y
^0vdz_
zW$dKr
xS2V+q
zMdhWY
'}ab#]
y5^.:\
	>GA|,
8Q*#U,o
kMs5G8
5{XZ71
^+kz?<9x
bZ71{:
dSca(X
Zz*iBT
/j2AG8
(-fOUf
qp?t/5KOG8XB,i
%>XvY#
<%6 Dsp
%WeTi:
%gB(rEa
%C#.p3O
tQ\,NG
DQ	x{u
N[WnyX
YH}	^"
 `?HH\
(Kn" >
j@fRfQ
Z71(gU
GA|u0nyX
Y71n)3*h
rM(F3Z5e.	d
>sGA|T
:aQ;5t
uSkO)y!
/6!`_<Y71
4N[+{R
L$,QfU
E~GA|n-
5$W>sGA|9
pIZ71r1P
8a>Z71u4
;;J#w4s
'wJOztP
`"w]ak
v[6.0F
f?(w_M
uT w)UZA
,F"U"w
lQfUfU
{z!\zRE
"_]!{;J
{M,)i;\
1U<,H;
fzz50L{
uPj!{<
~%Mm]{B
9@<n ?
z&y@%T
^Z71N	65
s/r-0|I
brm|Cx
Z71>}~
snL*B&
C"&z~G
uSkO)y
#Z6oFA|
Zze w9
,U.Y71
W4Z717r
C/,?zw
Iif{&yy
<$`fRf
{vT2J.
.|`:#}i
U03*Eh
K}2-<'hS
SH.Ha 
w#]W8>&ni
{XZ71h'
"<5-@wx
aW7w-{
o,fM[^2-<V
v	I+;(
8/[	I#
I $_`e
Ip'bN+
?;Oh8#9
_w[\^sa
vb&y7S
b3[#,om
r@A)~lt
1Qw"Nt
\BnLlUS
zl},&4
o"[R@|
^"]93/
t8Tnhi
"m1MgaA
b)^QA|
@wbqpsj
qNZ71v5i
S,Z71f
4'vqO-E)
N	{}o@
+03*EgE
Q:<7B+?
5nrI1V/9G~UA
i{&y>|O
#ZR+Z71@
rpE- G
^QA|~=.
MX,@wwf[
Eqpsj4
~k5]{&y
x"a1@q;
L[//6!`
:i9#,|NK
^#5w);O
gkc)Jb
dvI+m:L
hDXR&Ue
B[{je3
tg'`GA|P
~xP=*L
pj4=+K
Kq8!`r
5|UZ71w6
O93Ret
v:VpjW
j~s9nL[Y
!VIA|3n
	mJQ)Zf
N82Qds
unyhJxU
,?c3Ap
cviGve
vqO-E)
H,.f+v$
%@wT03*EW
|[a\6~
 $_`a(
`>x]:J
Wa@=/B
).'Z\w
AZ][|7
\A|m(uI
>FA|l+
5$!VGA|
htQZ71m
{0OA|F
V03*Ef
qps{0GA|U
LhO'C<
(ah{fM
=8k$_l
w[o1ql
rm|Om?
Gx|ap&L
{0	Z71
rm|OV&
'v5=6l
v w'yw[
GA|h'@|8V
5=u/BK nNH/
|wU3K/02
]GPqA[Mw
P	HA|E
qberNHbCU
rm|O%@
>fUL>KI
x[h>Ly_
mhF$< 
fq0qNH
X4o.fz
g\W/I_
V#"qV#
%*:}=:
pwEW(u
kh[ey_
|f2PlD
{&y{/6!`
%]9tiG)
GSJe.m
CzyI`Uiy
Ly#Wu<
}{&y`T
I4oabk
8qGA|I
k$GA|4sG
#|Z71R
GA|j)|O
@k;deO
'fZ;7R_
9HA||7
Scz&yPh
GA|v5u
8Jq{&y0O
Cm&GA|
iwk4u~9
z JHB'
Zz8wm)G
	cK:t/
h~?a&h
10xYUp/0
l=LKWoI
#bzf,T
MErm|O
z}g{f|
C{a6\-
u)~Ik?$.@w
G,U|df
pt H+2
q_k{&y
'yb+Bm
Jc<Z71
8mGA|;zw+
FAt-hu
zUsKmUH
mCm[?	
MzWY71[
p71>y{]t
@103*.p
Q6+&D_
Wf+(pd
Y]l}EH
kG;w3Q
1%vJH~
Do7}!A%bI!pH
ovahr3
/103*E
J[b4'N
qlJ(@$
GA|=|	
lLyX`]T[
*{e{(|
@tYJCa
UapUD(K
Aa+@w}
k103*4
h/?N-YH
T|\JH8
`M@@2l
q#=*10
=rEA|?
OAV@{4
}xV4L0
u^6D"0
HA|q07
 K,(CN
tU{1E/
)TbZ|6
mhF$< 
}C\|&y7e
GA|j%o
^a(Tk`
'`GA|#^H
JJ{&yWG
6Df6h{&y
}k}{&yfg
IHpQw-A+
AJA|q0
<J[!103*
kZq>zl
=iJFaT
{&yO~I
&=rGA|
y>u/6!`
|o#'be
DGA|#^103
z&yknyX
/6!fKf
F8mGA|b
103*fKf
fKsdrb!d
+qpsjf
nyXD!Z71%d
`\pX~!
D$ B5z_
;{&y>	
x@T]YV\
Ih<:z_
7=vn.XQ
o4CB65
qVH#Pk
@w:FF"
NS0i^i-
$0A7Cg
8/|&yN
GA|~9B
Zz $*E
'y73 A
]Lc0l^
Y71<w]
G)&ytl
C~Q71/
=JH&&>=
bL5t^H
~}0OO,
lhbez_
)Hh/zp
aPGuuA
}LXb2,{&yE
 /6!`l
Hgr_j8
XbIJH c
OGPM&<
CD{F	V
7B@cBi
86I[|<
~6I[n]
Qk103*v
103*i=
 KJc*j
}FygWAUQY
Y71g&z1
 cN'Z71U
tEkPH^
ID	-UH
v{&y?rm|O6
snL*B&
@k$GA|O
qF2"@(z
M;-|&yVB
a2|^,[
	DyHyHq
qlJ(@$
u	>|Gm
Ks03W;G
<0Y{&y
>rWHA_z
Y712mh
_K{	 z
;|&y^W
!1,-YTdrm
+B>sGA|
Fqpsjh
,~YHV]
2kU&SG
	Q6~$sZ
NyF\Do
_I|rkh
o{m${[
PY!-dk
XQ I\h
01LI~k
Tf4mt]*
1#i]6(QJj+
4"]*\hn
kdHRYp
cgQ[n\
y:HEC,
;MW!I\
0eb	J7
VZR2;z:U@
):A|v5
h5W<v8
qRx.|;
s_gDko
3D1#^`hD
rm|O[k-7
A<o(cp
oLZ71\
$HA|n)
g?H[X#
cGA|r1
izWZ71o*
D?r+fs
qpsL.w
rm|Oh]
[Eg7/Y
t3Z71"]
v3.H[e
bO&H[B:
.NxU	3
N3mA${&yk
^siq-<
Z71v12
Y>'Huk
;l!@w?
d_=B"7>
G[O103*7n
gz-l,G2
O\'9!P
)X;As?
H]U08e*=
=G<vEm
n}UcAO
?w)nyX
O'c~(d
upN,D(
,?Fc@8j2D
{vT2J. 
'f%};H|;
nyX4iGA|c
,?H}GA|S
=,bX+t
e!zY71S
%.)/&A
$X=2-Kf
a)z<Wq
Vtdvuu9
.Si8"Q
M\4B .
nyXh#\{_
9G)Ik{&y4 c
(!xCzhEb
p/q-gK
d$Luef
{vT2J/
%G$Y71
[(gHA|o
Y71UVd+
~=[71!`
AKH+"8
NwIKHi
 yZ71s
2['V[o
c{+g#A
bLn>2{&y
bMH?zm,
{&yB103*f
wGA|BE
yZ711l
/qpsj-}
T[F]<w
|wU3K/
JX{&yI
h/6!`E
T/,Ch40
Z71p/2
sRG[Iw^
#MEc{zR
2w}kw$h
R g5103*4
D1x7&A
z&y$'N
{&yo%T
yv}]$h|
,H#+Mq
s=6G[U
SHW+$)
+c:Ypb
i#'GZw
EKml_/
CadnPB
_Q	4UH
qE$m>7
,Lr)!2
R8]7QK5q
cAb!|k
$I#+Kna
<7j#^k
%T0IC]
@wAqM0LH
]J61LH
eg,XlE+
D14oqS
S,Z71]
7o3LH@
nbNTI=;
(],/XS
y(p]$h^
{RzYT"
^K8]?z
gbccZ>
A|5@_ %
KHu{k6
9103*k
HA|x7>
TA%.,"~
FJzG5$W
g{tKMQ
Zzr-Dq
e0Oj!v
BL|&yEnyX
mhF$< 
Zzo.1!
qeQWL@> g
@w*03*
|e=K)7
 :L|&y5k
L[KEQSL
[|W&\=|K
C6|&y]
ocOUJ><
{kuGAo
MR UbQ
L!B8b=
?G	+s@
ErEpg%
Zz7r$K 
sh\Z<X
	o~iva
kU13e8
(|}v;Z
nloE7S
uEnm<|
dEmw25
m.J}?v
t"tgBY
F,IW;X
YB:"]^-
^-;1J&t(
=V |O]
tK$_\V
*!i[aU
xsR"7Z
l5xTJ)
UH;)PN
F-.ff[
=I[M.z*y
=4d07y
ei}N%%
o8E>"]
&n*|#"
!V.Z@2
e"P|<o
Vq[![S0
KqA~f 
#[jty&
d[12	"
jWA{Eaidn
$eiMGsT
bT?J@YGmd
QkA#Nu
Md%Xa0
_wO6-8/-
`8h*%!
ngcTlJ
C*,`]W4
:z<qd.\
t/y!DM
Mpvmh[
X@4o;^
6,Hn>e5Y_
S]D+-$$
=Y40iB
=sC*v\rc
DtV[%jZn
9f&RN8
K`Y[h(
7t}EQWT
sy5But
w'eqHlo
UH Ew@`
cqp-jJ
ZH}X.`lm1
xf`]N4
gD2w*wE
{mT!T5
i=BAHD
ZWJ$q3
aV/*`4%
qH6#]W
*]Z6	p=
GI.	g!
/=hbMc
{1$xn,
3Z:UW!
QP/i2YR
*v!9xa
?HI@)L
v#BsKT
;m(o$F
"E.7D|
Mo?EL<
[/Yp1I
w\Xg1*
*Zs_$7
T\3y=V
z1Yh]Zn
ZuSiXHq
[B7Fs{
%W.fTI
mYY:)C
v?e]n\
ifv "{
^s((,a
&Yn<o6;Pv
(\fL9'Ii
?YWBsNO x
=p[%dc3io
!<g`H{1dA
6n0u`at
gE[F	W~
i+n';vn
3!*4H#
>}3B<5p
A:)(l]
+1-		9
c3c<IlL=
!cW-J*^
"'!%WN
c|S7'&nf
uZ^1(Q
|GL|x$
R@!rns
.bJKk3
Ou pqt
TfY2f;
2YXHRE
9&Q+76
#G9:_\
)_:YPY
zn6)"@p
-WF#	V
a"&5fv
>Tr;^+]+
%Vj6\%~2
iQw>lFo
.Egvr&
7VbtXZ
OeRuVcVF
(DcOlW5
g'~ ywr(
n`=uVF
KUZE4jb
Vfr[d7:i
m	48vu
b_`FYF
u,IP"6G
b5JM)9Y4
/ezBji d3t
Qh9:a2
5C:%%WBcS
dGSG_:
NT=ov|
[,sMfW6
M)){WW
Wb{Z3U
 QGigK
wJ:lkDD
w264v(
PYrB-I
?;q7A 
S^,l|D
}W>;b]
QVdF<a
< JTs<>
5S3]{3	
!^-b7-
/YsjyM!
SD\.pd]
\x?E"M/96
ChiZ0Cb
1zk@<Y
fXd@R]
cL;W^$
]'!EC9dO
t;PB$3$$
zIk eY
 ,^^|c&
^DtDO@
$HGvo8
Xnz?_M
R#vb#z
Ov``!U
Z&eK:[
X [e`x
G&C&|^.
L}9Dhy
:jk{Td
"OtJ)EI
,OQ/FP
>e;0<s1
)Y*esHW
kk(qVQ
0(:-U`r
GQ].FbM
A<K2X^
~{ "&p
{+#Q$#
E4V,y[
mgkn	03
	:5:T,9
y>vXIz;
v&OmEB
=9f'He$,8
gHeS{C:
m\@4't
a1WQ|P
LcG3l_
QN5-}ElZk
v=",e_,c
3YYSq4
FDp;@)W@V
TuS<p5\"dOG
:sFAh+
_VeD*f
3uhbi*>X&
2B+T[$
Ca)\"7
LU%We~
TSn)>2q
kE@{hx
]oUV&b
|)#GW>
=>X$;`
GLU"SHU
KAt1N6U
C8`@"Q[
uew+JZ
nq!&R*
F\G{2<U
+hbE	VY
j$ibT!:pC
)i]/(_,
$~4uF!
i3WL,;
I`/\dM<
M m{MQ%NmsK
j8e+:&a
qqBCs_
&r]GGfd
WF5rc-I
Sb;=3e
@@A*1RTQ
MR3k"y*/
X|~"`-
paM$R^
A#e}EpG
uLoJ X
Z_Dw?F
_4<rBB
zcoo4L
i\MXU_+
l<_bHA
hEP%j+
TyL4'	
={l#<q
b8cES>
)-ZuQ(
1iMdX1
QI[[=!
r/]#\[
bRf@`5
HR!<=n
 >(]mH}
[Mj(0d
(GDMB8
zm@:w!
O}g'LM
Y$Qu\V
r*>=7X
QM|MZZ
qvO.V	
v,ql\gzRw
	#W	d&s
Aq1V<h
4NSE*3*
zM[IQg
kO4L\(
v	Y,WF
n8Q![8
R^\JPh>
NGH(c.
in_cWb@0
^stN},q
SUGWqS 
v$k("K
h-Nw%y
S@ZU^c
~Y5y|Q
" uH8[
qbW!j@
]t9-cR
0f~LaU+
,k5(	*
Ow;1	A
D~.)_{kI/Dr==
	UC|H+YS
2p5,&U~
tXiMwR
yx(%\;X
;TC265
!lgI?3
laE<5uT'G+
LT2<dF
gJ9Y!:'
w<Qp*.
yioJBr
#RTq6D
@K!92I
ej0AOg
S"t	{_
0"	f*;
=.J3e)n
x0qOL@-S
'-y4|$
s%$W1{2
m5E82w9
y ?y8o
lC(F+ 
A/T|&Y
("*x	<QyX
4B{<sD
|0N+1M
X)3\BR
	h	q{n
[%3_G"]
o iSfu~
1X-`e,
a`.|5Y
;Dc9 $
l.G{)TAX{
N:3"Qnt
%XC/Jj
+#N-^]
.SU|LT
5~=A}&
QhEFUY
6Y"NR7
=]fVa":zV
b{/XpG.3
'^bX~v
l/-0cR
w;/b_|
pv[3Ed
xlu:I}
{ewa"+
eIQ=O<ht
d1W75u
Jx(MEr
Nn"E,r
0CQ#b7
zIeeFA
?X.D1t?
[`6'dl
NFN\sA
y";6Xtb
QCm-2G
4-j3)Gd$
5"U6A}
l1PRf7
taOs-Bb
:4GyQB
21X,{5
Y*Aah/Q5;
zy66&~3
3m0S^p
9wFI?o7x
qmDhs?&
<aJ/lI6e$
2qq&<C
q{pCY@z
U>[gPg
L-xh@R
u<!X:(t
YhiAT)
Y}X)ue2
7cC3$Ea!3
 1q*61
3*6b}*
wYimUV
ClRoII
57o$c<l
^F}'fZm
1J}GI>
=#Oz1&9
d-+U,"
 NC0f|
ES95|U
<Q(\]:i
=WjsOI
7 N	S&%o*
Oc#8GVr
="2~o	Z
dr4#Gd~VnA
EK	_.T
x8+")y
cz-7a}
?|skBt
X.ta@+\
t>Fk}:(c
'$f/c*s78
%>r41(
?WF$ktv
	#M5f 
d`0[BE
zD<9eAt
Y:kg\\a
-Kw|/!
_?hmY!
DY-*_2
a;HvsC
cl99:CxVTt
QH,WOYB|@[
i"lM-K
Fxa9!|
oaD~6d
U?y?{6_%
7`Bl  
u=)KCf
z%9V30
HyjQ[T
:hr&=D\M
	PZz#a
cK@Sr)
^<Vi90
B~nR'z~
-%+`;w
.61L4yv
1!%=yu7
0L>k*%
H|V0S;LB
jW|Tz0>
q:8\,A'rD
{`#F!V
2!#9RO
FAh"<mt,E
u<;;^6v
Ai.3]ow
bb|$a6V
H55GLK
+F82N"
g+Ve|]
0w@;tC
lC1|)6=
h+)5HR=CQ;eC
>xFq*F
+=NMRa
S#9}OY=
JyoGxe
~aCCsy
:l;NuZs
iO&<-M
}F Wja
fh/AFBmyI
_$TcCF
xEV b"
m'47..>4
8j(Qw6
?oy@K|
1TDA^rV
U373lJ
@y*:6j
S4oQtB
O3Ca-N$
A#nL& 9
psGb2aI
p|5o5t
G02m>XT
,E5Mx]_
S;}QH{a~
79u3c;
'DKFDq9
e9?BP%E
#a.HI1
`k!l'(
:Ya&gR
	Z<o-kKr
PkX7u|
mwx;;.=
U:<3Vx
O8%xDr
}-joOEYA
N1<t30
{zG:'4U
Ivwr"br
8l&5H@
	G*)^-
4]]]}c
hgiU2KOL
-2GO"As\\
"W]0L}3
a$:0AI3
KB#%	[
z!W@'q
?$D:^2
17T.dP
t  t8E
QWA%MY
DXP/>v
&M1,"M
tJ3|q0
rfelCY
?R}M1U]
G[m5m#D4
yvPfR2
Ge	3}:5
h)6o/Zn
UZEy0]
!svbs<
,2_]TJ
6b5al%
J~pgCN
nMNI	]
HEvgX;
o6$8)Q
/V;d goih
[}kL_:*A_|
54A*7.
rR,,<}
}x $I/
!{j)eyy
9I$AzB
2prt0E
9^{ cr=
{U }U/=$#
%ikp5z
z'	>mk
@qqO?J
>pHKh,
w^k[k/
=z)tXJ
}MJx=U
jHkZNc
Z<xg%_
8:%UOT
Pbu\F	
0D_[,<
<mF-xb
+mv1ITPc
u'?yZd
)@G?FS
kH=+l$Q
KGroBX
E#X9w-
Zs[LKk6
TU6CdlTf;
 vlX4:
b-ZG5t
ai6|(<
G?6PVu
Cw#@o*
}j9(*<
'D	t_C.[
FdvdA	
x~O2#1
|GSmA`9
`B	+gB
~+"<K#
l;g$N^V
L_t#(&VGU^
@yfc"$
M.05_5
*!3}3B[
r\77tR
XJlt@-
/u}W8K\
	6?FXC
`W^g{>{
O1<^($y
J4dhHEd
Z@Om^=m
+NqL>a
`_0	T+G
t4:!.gt
 UZbA27YX{
*]9q-;
an<l9:
7l7fn%C!
j[[xvro
SZVu]\
msP)R%
GetACP
.HeapSize
RASAPI32.dll
TlsFree
RasHangUpA
RasGetConnectStatusA
WINMM.dll
RtlUnwind
midiStreamOut
midiStreamOpen
FwaveOutOpen
umidiOutPrepareHeader
waveOutClose
midiStreamProperty
GetOEMCP
1WS2_32.dll
TlsAlloc
waveOutWrite
midiOutUnprepareHeader
waveOutPause
waveOutUnprepareHeader
GetVersion
waveOutGetNumDevs
midiStreamRestart
YwaveOutReset
waveOutPrepareHeader
MulDiv
midiOutReset
GetCPInfo
midiStreamClose
KERNEL32.dll
MultiByteToWideChar
VmidiStreamStop
SetUnhandledExceptionFilter
lstrcmpA
GetStringTypeA
IsBadWritePtr
GetStringTypeW
LCMapStringA
VirtualFree
lstrcmpiA
LCMapStringW
WinExec
VirtualAlloc
)HCompareStringA
HeapCreate
TerminateThread
HeapDestroy
GetEnvironmentStringsW
GetFileType
SetHandleCount
GetEnvironmentStrings
GetStdHandle
SetStdHandle
LocalAlloc
FreeEnvironmentStringsA
FreeEnvironmentStringsW
RaiseException
GetEnvironmentVariableA
GlobalFlags
GetFileTime
SetErrorMode
TlsGetValue
GetProcessVersion
LocalReAlloc
TlsSetValue
GetCurrentThread
GlobalHandle
GetStartupInfoA
GlobalFindAtomA
UnlockFile
;GlobalAddAtomA
SetEndOfFile
LockFile
GetThreadLocale
ovaGlobalDeleteAtom
FlushFileBuffers
GlobalGetAtomNameA
FileTimeToLocalFileTime
FormatMessageA
lstrcpynA
LocalFree
GetFileSize
udDuplicateHandle
GetSystemTime
WideCharToMultiByte
TerminateProcess
hGetLocalTime
SetLastError
FileTimeToSystemTime
SetFilePointer
"]GetCurrentProcess
GetTimeZoneInformation
InterlockedIncrement
ResumeThread
WriteFile
103*CreateSemaphoreA
EnterCriticalSection
ReleaseSemaphore
ReadFile
GetLastError
SetEvent
GetProfileStringA
2-<LeaveCriticalSection
GetMenu
InterlockedDecrement
LoadResource
LockResource
FindResourceA
ExitProcess
CreateFileA
GlobalSize
WaitForMultipleObjects
GetModuleFileNameA
lstrcatA
UnhandledExceptionFilter
InitializeCriticalSection
lstrcpyA
HeapFree
iDeleteCriticalSection
+GlobalFree
GetCurrentThreadId
HeapReAlloc
GetProcessHeap
GlobalReAlloc
{RFindNextFileA
GetUserDefaultLCID
FreeLibrary
HeapAlloc
SetEnvironmentVariableA
CreateEventA
FindClose
GetVersionExA
GlobalAlloc
GlobalLock
WritePrivateProfileStringA
SetMenu
lstrlenW
GetFileAttributesA
DeleteFileA
DrawEdge
FindFirstFileA
GetModuleHandleA
GlobalUnlock
GetVolumeInformationA
SetCurrentDirectoryA
lstrlenA
GetCommandLineA
qpsjGetProcAddress
GetTickCount
4LoadLibraryA
8GetFullPathNameA
CompareStringW
rCloseHandle
|WaitForSingleObject
IsBadReadPtr
ACreateProcessA
SetWindowTextA
LoadIconA
GetDesktopWindow
SystemParametersInfoA
IsZoomed
zGetClassNameA
wUSER32.dll
DrawFrameControl
TranslateMessage
WindowFromPoint
GetMessageA
DrawFocusRect
DispatchMessageA
%TInterlockedExchange
SetRectEmpty
nyIsBadCodePtr
CreateIconFromResourceEx
RegisterClipboardFormatA
$M7L^o
$McM^o\
$M.J^o\
$M=I^o
,}M.bM
,{M.<6
$M7(^o
KDm91L
$M>*^o
$M<)^o(
CreateMenu
GetSubMenu
ModifyMenuA
 cAppendMenuA
GetDlgCtrlID
CreatePopupMenu
EnableMenuItem
~CreateAcceleratorTableA
IDrawIconEx
ShowWindow
GetKeyState
LoadImageA
DeleteMenu
EnumDisplaySettingsA
,ClientToScreen
IsWindowEnabled
PostQuitMessage
CreateIconFromResource
CopyAcceleratorTableA
TranslateAcceleratorA
DefWindowProcA
GetClassInfoA
GetSystemMenu
GetMenuState
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
MoveWindow
'CharNextA
ScrollWindowEx
SetRect
IsDialogMessageA
CheckMenuItem
8SetWindowContextHelpId
IsIconic
SetFocus
rPeekMessageA
GetActiveWindow
mGetMenuItemID
GetWindow
Escape
GetMenuItemCount
SetWindowRgn
RegisterClassA
DestroyAcceleratorTable
GetMessagePos
GetScrollPos
ChildWindowFromPointEx
CopyRect
ScreenToClient
WinHelpA
KillTimer
LoadBitmapA
SetTimer
MapWindowPoints
ReleaseCapture
IsChild
SendDlgItemMessageA
SetScrollRange
SetScrollPos
GetROP2
GetScrollRange
PtInRect
OffsetRect
DestroyIcon
IntersectRect
IsWindowVisible
EnableWindow
InflateRect
FillRect
SetCapture
RedrawWindow
%GetCapture
GetWindowLongA
SetWindowLongA
MapDialogRect
SetActiveWindow
GetSysColor
SetCursorPos
LoadStringA
EqualRect
UpdateWindow
GetWindowRect
PatBlt
SetForegroundWindow
GetFocus
DestroyMenu
ValidateRect
EndDoc
ReleaseDC
GetTopWindow
PostMessageA
GetParent
IsWindow
GetClientRect
InvalidateRect
DestroyCursor
EndPaint
SetParent
,?IsRectEmpty
MessageBoxA
GetCursorPos
MessageBeep
GetSystemMetrics
EmptyClipboard
SetWindowPos
GetClipboardData
wsprintfA
OpenClipboard
CloseClipboard
GetDlgItem
SetClipboardData
FindWindowExA
CharUpperA
WaitForInputIdle
GetWindowDC
SendMessageA
UnregisterClassA
BeginPaint
@AdjustWindowRectEx
TabbedTextOutA
DrawTextA
GetWindowTextLengthA
GrayStringA
GetWindowTextA
EndDialog
RemovePropA
DestroyWindow
SetCursor
CreateDialogIndirectParamA
GetNextDlgTabItem
LoadCursorA
GetForegroundWindow
RegisterWindowMessageA
&GetWindowPlacement
GetLastActivePopup
BitBlt
GetSysColorBrush
UnhookWindowsHookEx
SetPropA
GDI32.dll
GetPropA
SetWindowsHookExA
CreateWindowExA
CallNextHookEx
GetClassLongA
GetMapMode
CallWindowProcA
ExtTextOutA
TextOutA
PtVisible
GetTextMetricsA
ExtSelectClipRgn
GetTextColor
FillRgn
GetViewportExtEx
GetBkMode
GetBkColor
CreateDCA
RectVisible
GetStretchBltMode
GetPolyFillMode
/6CreateRoundRectRgn
CreateBitmap
SelectObject
CreateEllipticRgn
CreateCompatibleBitmap
CreateSolidBrush
lCombineRgn
GetObjectA
EndPage
GetStockObject
CreateFontIndirectA
DeleteDC
CreateRectRgn
Ellipse
CreatePen
CreateCompatibleDC
StartPage
RoundRect
GetDeviceCaps
GetCurrentObject
LineTo
VDPtoLP
SetWindowExtEx
MoveToEx
GetTextExtentPoint32A
SetWindowOrgEx
SetMapMode
LPtoDP
Rectangle
SelectClipRgn
EndPath
SetViewportOrgEx
CDeleteObject
GetClipRgn
OffsetViewportOrgEx
CreateRectRgnIndirect
SetStretchBltMode
CreatePolygonRgn
BeginPath
GetDIBits
)HScaleWindowExtEx
StretchBlt
GetClipBox
GetViewportOrgEx
SetROP2
GetWindowOrgEx
ExcludeClipRect
SelectPalette
SaveDC
RealizePalette
GGetWindowExtEx
RestoreDC
CreateDIBitmap
SetBkMode
SetPolyFillMode
WINSPOOL.DRV
SetTextColor
OleRun
GetSystemPaletteEntries
ClosePrinter
vaCreatePalette
OpenPrinterA
ADVAPI32.dll
DocumentPropertiesA
RegCloseKey
SHELL32.dll
RegCreateKeyExA
PathToRegion
RegQueryValueA
ole32.dll
RegSetValueExA
RegOpenKeyExA
Shell_NotifyIconA
103ShellExecuteA
*SetBkColor
OleInitialize
SetViewportExtEx
CoFreeUnusedLibraries
ScaleViewportExtEx
StartDocA
CoRevokeClassObject
CoRegisterMessageFilter
PSAPI.DLL
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
CoGetClassObject
OleFlushClipboard
StgCreateDocfileOnILockBytes
CoCreateInstance
CLSIDFromProgID
+BGetMessageTime
COMCTL32.dll
oledlg.dll
OLEAUT32.dll
POleIsCurrentClipboard
CoTaskMemAlloc
ImageList_Destroy
.CoTaskMemFree
ImageList_SetBkColor
WININET.dll
\ImageList_Duplicate
InternetCrackUrlA
#ImageList_GetImageCount
ZImageList_Read
HttpOpenRequestA
MSVCRT.dll
InternetCanonicalizeUrlA
HttpSendRequestA
HttpQueryInfoA
OleUninitialize
InternetConnectA
InternetOpenA
InternetReadFile
InternetSetOptionA
CLSIDFromString
comdlg32.dll
qpsGetNextDlgGroupItem
IPHLPAPI.DLL
Safengine Shielden v2.1.9.0
GetOpenFileNameA
4$f^f^
xGetSaveFileNameA
@GetFileTitleA
ChooseColorA
InternetCloseHandle
qpPostThreadMessageA
RASAPI32.dll
WINMM.dll
WS2_32.dll
KERNEL32.dll
USER32.dll
GDI32.dll
WINSPOOL.DRV
ADVAPI32.dll
SHELL32.dll
ole32.dll
OLEAUT32.dll
COMCTL32.dll
oledlg.dll
WININET.dll
comdlg32.dll
MSVCRT.dll
IPHLPAPI.DLL
PSAPI.DLL
RasHangUpA
midiStreamOut
MultiByteToWideChar
GetClassNameA
CreateRoundRectRgn
ClosePrinter
RegCreateKeyExA
ShellExecuteA
StgCreateDocfileOnILockBytes
ImageList_Destroy
InternetCanonicalizeUrlA
ChooseColorA
strncpy
GetInterfaceInfo
GetMappedFileNameW
b^y4sY[
b^y4sY[