Sample details: a985ac0cf374aeb0a22d137a9dd30595 --

Hashes
MD5: a985ac0cf374aeb0a22d137a9dd30595
SHA1: 4023228c3962fc9497088b4d5dbf5d35b2dcdc17
SHA256: 4f96f86168b2e63f0933f5b58c7bc0a8e9c8511dc0a136cf27b9720b3ff64b79
SSDEEP: 12288:6bLbZTifAIjNHupPFZ/RzvqLTZjyA39d+f:yLbZI1BHuzLzSnZeF
Details
File Type: PE32
Yara Hits
YRP/PackerUPX_CompresorGratuito_wwwupxsourceforgenet | YRP/UPX_wwwupxsourceforgenet_additional | YRP/yodas_Protector_v1033_dllocx_Ashkbiz_Danehkar_h | YRP/UPX_v0896_v102_v105_v124_Markus_Laszlo_overlay | YRP/UPX_v0896_v102_v105_v124_Markus_Laszlo_overlay_additional | YRP/UPX_wwwupxsourceforgenet | YRP/UPXv20MarkusLaszloReiser | YRP/UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/IsPacked | YRP/IsBeyondImageSize | YRP/domain | YRP/IP | YRP/contentis_base64 | YRP/UPX | YRP/suspicious_packer_section |
Sub Files
c85ac662cdae3de3250e4cfa7caa1ddc
Source
http://shzwnsarin.com/folder/linkcrypted.exe
Strings
		!This program cannot be run in DOS mode.
W;VS-Q(
F=1"x|
Vu->tc@
:p0`x4
h_C4vE
GVHWFV
#F\]IZ$
tJV1W=
~42uG<
^G%jy+
/2x@0y5
gTstvc=22
l!>>SW
\0j:>d8
wetg;G
'~S;1TM@
C 9o4~*
]j4;E4
f9j>u2
%\x4Mv
J:z"ER
0@%HhQ
X|<}TK
	WQK`3
4V'#P@C
k]~,%8
(Xr0XD]
o!5KPX(
aX0DQO
3uDSD^
V'DcQH
Vjm%cK
a	4HQUOl
8jt=!(VM 
hY7WW8
:AS5SU
>$t! ta
~WPW2v(
BY:AYt
C)Oh<7G
VjC4V\
=~zU3U1
h#h1X}=
E8~,u(
r7j~ z
B.KA0P
Rkqn.,t
HQ0.{K
9FQWc~m!
bj lz|
[80Y_o
6;,NhYHO
Zf`(x_
S`M,p}
{@G9hO
xDpdGuy
gNy4Vm
.xR-{(	
  [yaTC
Ll"wVV
'"}eP2
*%11,XI0hx
vqY@H>b
PjA3GF;
jzi%Hjh
QjtSm}Y @u
#vqu/p
@?&M,V=
^H@ <6
*pnCX^
:	UUj%m
~4VEp0)
LxbtFZ
p(LCf<
R8V6`D
Xmk4E#
9P4=1\
[+Fau)T
v r<~X
)*"-F-2
ntHq4z@:
H~	BqD
#O&RP)
0RWOCQ
3duWc~jG
E`8<F.
Er	,E4
T*GCGC
t^,`m	
&UD5Ulm|z$`%9 
E Pd`n[0
Bfw+@jb
o=&d]H
/$~Xds
rsA8]=I
^ujulg
(ubR11S
(`@\* 0El
+=X[K(=j
qEV.QA%
"RvSh450
i\EBL;z
 A95)l{
9!1[KC.
|8fmIpq
QP@WRPh
0(	K)`
h?d|97~*
EFS;7|
(L\A~B
sF[; t
fJ!`xhP
gpST&V
`,i	"Bh
\CD@aY
"^F5F>
ac ."Sh
kJX)|1DQ
H``P<X	w
c^WXAL
jJx(TF
}H;>#f
/Um&Mj$i{
@DOKg:7
P	['%;z
|Cf9D2
<1#UX,
^NDW;NL|K9^|tF8
XFzzuu
xVmF`&
1`VU"=
*P55cO
C9~|t>/0
CQzpu=Oy
n,Ic*`
?29O$}
;N$wR*
gBF#92Q
:&oQi;
[cu99F
!J btj *
8FTz8g<3
O-^CZ<
_24V&7
?2222uuuu
w;2uu,/0
t*2Ujr
K(F)M<
ueEnm(
rBIq,	
Iouh/C
 8V/,9i
2+lQj9
h0z0O,
ab|<TAh
sR>@	2ZYLt
FkACVX
@7,H vP
#A<-;$|
_<>3`P
_|#a"Q57
9H$u.=(Q
[v.Ix1
`t!M%F
wy3rbol`txetT/
&laeru
/YsWU:$
_	 l'$
Veti	B
1U(KIOz-z
jc,6Pf
YZJht/
8/XKBf
m3R3(Q
1VH|FX
Vu/Cm*
_"0l%|
pGP_]g
<lgEnDU 
-]I-E!
Jy-ONC
c_}h\X/
m^;B3P
BhWoAa
U%k4pQ
.o~:;N
_"yu(=!o
=&pM65
^nsa{V
w7@~mt
]_8l<[oS
1$#j9i
CH{CZM
N2hu>b
@Q\p,[>
^LtBE<
[Klz5L
*BtDXLqD
MEM-C,E
lMHI)6
j!VB0d
	hPAAQ
VUK/,bKW
xCZ%9 q
Vb	|0Q
 EFD^A
prr{*8
#=KtE_|
U[PQ.8
	',~s %
4g!.R8
iH[(&%o
j8[8^7
P ;S 0
W	,@<hN
sKx<l~7
[d-fX#I
{Rl(Q[
i+	x<,
EQMJDe
OZ\VU(
-JL iy50
}mF62(
h$&zCd
(d"72PX
Ut&HFI
4t`9yO
@fdF&!
+Qw$VH^S
7g%R9ddwwGw
$Tx@&}
?uErU#q
s7Po[=
jg<yYv
ac8U>Us
dC<+\/jc]
LmJJ%W
:uS8D>
-V{FJu
x9uF_>tH
Ia*GiGP
\XPUA|
$"iAIM
f	pZgT
+D&DD >
KBVMFA'C
=ubpp+
=(h((#
~RrHj	P
0TxY	u
`-lkJ}z
-0_JK$Y
%/OG]KQ
EEO >u
u@/tVi
!<!tnS
:nQWwiT
niQS.(d
0[RVa$
ZStQ0=:
-	gz7(
tRs15D
;[#o(wV
@9Q(|	
=S3Q4Zh
NlDn t
dR'&u`
a>SV"Ck
Q9p_*D
;NPvJP
	 St*(VJ/3
w,}S|-
'[(DLswk
i`0u0O
LU7[$2
BD*4nk
IdoSFw!$
$)fb$2
,k7M(3
G EUWh
1M~;Ww
]XV!2Q"
[U(!H<
hdn&Ykg
"A7yeU
0"<(#^
73"Z9C tg
ram8E"'
e`5&y	
J	u)\1
qPR|Hb
K`!4%z
#ROhFd$u
9F u+%M
"%$+	`
D0Yl~(
`<!H<j1L@g}
][_8 f
,.rlagu
 SB0Cxw
t5[0^1R1&@
KyZQ2$YC.8!
)%CEqdZ
Hl/|NZ3
968	h8
"7}/}nC
fdcAb^
r}0nTh(Y
F@F@zo
>,7ae-
^)I<pVP
7CnAn??#3D
/MZ,()`
u.<bu*W
lWYuQD
t5(<#!7X
[SM)|H
nNd<t.S
U-X0*at
-X,GA^
JtIIt@
Ab]?+i.
h;BTfWl
"Xl-CT
=_9Kr	
ws~i(bvKW<q
=U(@J,
./	*+|
8C"t@|h
'x%6a%
=<NLsJSu
-B(\OR
^TQKIo IVP
PrWu,RKYG
f,]d;sh
9)@Lvc
n	*{D+1h
rUF121L:ft
t+R:A	
 !"#$%&
'()*+,
-./01234$5567
_y<=>?@ABCDEFGH
IJeKLMN+
OPFTeUVeWX
7ld`/|E^
9ELWop
-xNta x M
 6~tu90daa
#QHSf;
{[,U#;
SF|I@&
)_IR[@.
vw^B<a)
HB>Ai8Wl
H\h}DU1
r<4mSC
p@HDIt
@v}*Xx
_C)[eh
/	D^Cv
)4F48/
t	5%uS
u8]#D#S
0&BvdB
Sz*R{jS
q\0;].C8
[xJI{!HZyR
<<((0B:
n7/Q@0
u.6qa] rVS2
p`psOV1
,9hfke4
JR!lnS
<8:)O@x
N<14Egyp
RPER&9
1q#ood&rn
)W_00.
ub,u] uX
_6SY)&
y|HZc`h
*^db.y
8"Hb1)
LD : 8ag
'hH_oN
\yEE U
i7M(NwW
HX$|:1
$%ll3Q
*+G,M(
GHI)0dJK
U)2VW>XY)v
fijklmnnop
rstuvwxy
S@!CB(
^cxGY]
0:*aFS
K< 9Cec
@.Sx a
<f9+t%
1|&JG$
LrH\XH
.Qvo#t
nI?w5>
h`{`*QrZ
'E8h\)
Px5}	)
Q 8kVc
ln5wT*K
-t\qL%
 LtU[`
tAllm{
#Ln%F'p
|nh+i(x7
/WcSG8'T
pHaO~X
CP-	x]
ja=BgH
\	FWO NR
KWWOG|
8@[#$_
xJ0Y,8eD
B?P{!V
XAB }5
j!Qh6]
 Fh, V
`-He:(*
%AOW0x
>&-@#"jP3'
Pq`bE5h
Mxuaj(
0\KG')d
rbLURO
ECj"{/
]m%,K0"
6ND]eToL
YXl`/c 
O{X/Nx
#IxR+K
/JV;,T[
-Vx1L5sVm'V0
3vp dw[P
<}MtUh!
V|-I\s
WPI/R8
taVS_G
Z%R_dk
MVi@a@
nA%dRQ
/"77PVV)5
#4%j)t
QSC@hh
&t>xjC
(LxPtb)
T4=W>(
	HP$`xa
|>/j,y
Mk7cWa)au
FZ9M<>
1DC;*a
)=uD-8
2 3+!8
iQ^m,N
=g]S`|3s
C'@GQ:M
t<&P+*
PwJ,ED
*uZf,gOA
jSPt	f
H!XcpY
}_BHKG,
t XwfG.
ES7K)/C
UfSi]4
,.p/9.
?\/(h;6\
x_9!=\
r/Gg%'
W 	)C@Q3B
T^{xV;~us
~,*h$^
#p#v}t
fo)XH5
8rO@PB
7%E<W\
;2X.UPE
hYaH!P~
4$fm-.I
H6KL-6
QS[ -V
-P0?%l
0vc`5u
Pel5wr?
srr (0
d"vFIs}1Kt	
hh><)00~
tFiNRE
ItXIu4Q
?h$kI2/g
	u-I(e
j!'G4*
?Sx/{O
Rf'*7P
@a|f1~
+MBH*+
<lQ8BN
;XZwS8$
A&t'Al7
XUlAOv*X~
GK*o*W
}>v`~p0g@
K	*Z`p
C7AbNd
Q^,[Ag3t8
m)nGs!
Wsmm0x
iA5 `[
sC9fv3
7vGe`c
_'xKiy
V'V;-u
20XC00KUAx
%J-qa(
aUxV1.g
4%Hf-00f=
`20}%- `
vL/:yu
j$P05Hm
e|/D.j
Y #N	G
E0^Fad`g@
@*<v5!
Genuu_
nteluM$_Y-
~8 q=F
Vt&4m 
ZFihrR
t#Ys[(
~td?W)p
~pjCXfH
s?@0XA
@uwCff
99y]6P
":z,98I6
(+]-V!'
	 0@P~
EtZ^5:
Cf=	uy
7|;VIX
FdE@JE
4#<=I&t~
3a67A|
c:m9-(0
-slERgF
Gt>|)M@JI
YY3-<4
[*jx[j
=t='$^mCgRl,>
{V!tDp
st$t5k
\c		?_
RtH\00
	"uIU@<
%^CghA
M`}f~%
d~~'kC*
5Bx"7W
L0PXm_V
L<	N2XMTY
`@j _W
\zXtSK@
0:GK 6l
fFAJ\t
$(9999,04
S[898<
DHNNNNLPTXNNNN\`dhNNNNlptx[
Mr1Rxn
3j9J]bB
8Bt G)
4u1,9l
8D)p#pr
';_t|%Q
Lr.m*G
+%`Obf%
VSKQl$
naNqEY*
[BQox/dp"
yPal'p
|B7N_Rh
}b!1 V@
PiRHF(B
h?dhN]
JJh(BHj
`=T\K*
eBkJ	=
1;C2I9H
zA hVR
b]uXVM
nMQ3I;
# B'b"
h	wXGM
{FC5QV
:tBWbB_
Qd.FBo$
vV@P-i
x7"~ =
\hlL+/
!AggStep
SetNumCol
action
Destroy
$xtPotN
oofokie&Force@gLo.
Analysi
Explai
rd/G2VBeg
d_126r
KN3012
rPu0v`
\6XnVp
0"VhFo
t&.-N#^w
`~Ttu[
FEFOREIGN
GEXPLAINSTEADDESCm
CHECKEYCO,R86RS
"TABLrT6NDA
mv>H`TIV(U
LVffogb4
SUNIQUYVT
EMPOr28
mTS2TWE
OTNULLI>;
T<OSS9p0033TL
GLOBYIF"
OFFtFS
Xr]/s)
5Slm_93
<F=ZFSA%0
6l fr"{
"I$_,Zm
o>i%qY*u
z.-fAt2YY
3js56(konof
falsey
V`?{|}~
thLndrd
SQLite form4
&I6*yf
wl].~*
VD":24r
HZo^t&t
Ax sql
  type ~,
!rootpagi
08@LT`y
,4<DHLy
yPTX\d
<@LXhp
<HT`lxy
/~short)
un&hangG
back0leg
fsyn&ign*e
7writabps<
adloX>
erB#aN
'bby#lA
xMji,a
aml^_i
6avg/F
hNKebSJp
rqFW>IIz
ekR W6Y
223372
685477580
lqs^:2
Y FA3>
!Lq) g
s|\sn 
LeM.|r
p(ts]G
CUohqu,
SVu >1
@ '%q'.
A+*","
nm|uof
' T+E-
yU_0||
J4BJax
@twE"Z
B?,V,Z
?(8,idx,
G]X#6C
}DIobj
L">x,eKa
E[:]qW3R
XWly][
FX(/da
G'@j`!/o
lfcr98^
=%r!? 
[by'VEb'
\F_8t[
bK*xBL
o.xfiC.
>999$89>@a
yTXdlx
oH~dws@
r%Csg'
vapi32.dW* 
$o $#G
4$H$T$l<
$|HKCRq
MD`lOT'
RjAoD>
	Vl2s{
2 '\\.\pipe\my
.xk7~0
y 0Z	=
ffsO0L 
1652 RVR
->DI+ 
1.3.6.
OmF_I@XI
upMsg?(\Cr
ZEM-'^
o~765@Z
D<xZu`\
^\sY0:Rp
?e')lW
c;`Cm<($F<}
|'^\%>
l,kg<i
d^@En[v
?5Wg4p
BC .0	
^%S#[k
#.X'HBO
m\N [gBmWB
cRekmb
g[-C6`q
gS3G7Vk
ey0zL0
w<YafwK
SCgddbH
PMM/dd/y
(,HH:mm:
/C}k#XG'
Z|rhVDN
pt*S'&
nkW/DR@
OC3z9Q
<C(D0F
JPKXN`<
<OhPpV
+<,H-`<
</l2x4
,E8FDGy
yPI\Jh
<P;hkt=w)
JSi<HHLT
pp_r/r
7Zo/D6
xw\E/-rR
'/P>gR
n/Ewt;
ire7gl
Mg/nwg8&X
P/fGC(8b
'B_Ogn5
U7/B_P
bnTo#/
vmu/vwt
p"GugP(
_c!_hypot
>P?fry0+&
a_>@'&
@DHLPg=
.>|WX|
</%g`<x&
v06`=?u
pyQ`udt
OH DeMZk
91#SNAN
BSd:O 
  {@dB 
Hw7'(v	
pMpBNp?$
t?n?oN
?O%ZK o
o\G'Lo
?/dBN5
,;HfN>
J"jJx'
VmA^[\
'Sm#*6
|xU=e/;
TiHnV8
X)+`SJ8
+P[2U6
.?AVo@k
Gs,?U_*_MODULE70
@WoFId
its@$0FGA
lpha_&*HKL
Dra<Up
CbHDlg
(0<D_L
=a0"gv
Xh$//BlQ
_of_T-#
mf	<O7@
%U9<A2
-jEvXz
_(0EbD
$f	;cvl
W!a+Il
1G+0P=
-}+u:%
9&fI7%w`
]we20O
OzX8b~
C}BqITu&n
Zo9Ngk
@Y`f%@`V
vS6jX&j
v_1T5c
y.(~yE
 +Z\JFA<
#;9P)I
>^jVNR5M
e*\g6L/
XgCRS.
U{|uPJ
gF~jKWNg
~Qd=\]
Ewhk^^
{xh$-+
v|b5V}
C!`J3o
kWB=9/
aITkEBM&
i8-Krt
-&"\Y'
aoVrv1
ME&0,P
;xzKb-
TQ0:O{b
M<lt7F]
s].xml 
k4p2UG
Rt&style
Egj&O:,j
e=layx
F/rmh; L
iotI^s{
97 }+z
~X/|3V
hDj	geg
zt!PCh_
G6IF 3
Xx&u%u
Y>HjAX
4w3Zv&
x Sx7"
De!\Xo
:Z	+hVL
2VAy>x
%J"+<Y
TPP_Oe
r%ijr 
"IsBaB
"OLRCvK
eV.L|c
s[3Ex5
}@SgzMW
XlP"hH
~0.UIWf
KXTPbsV2g
,J+SH?D
MO sO6
F=@DddUr7
DS{+#W{
+'$tQui
9lz?O<
mC{h	O
XPTPSW
#BHDYb
z2{-S"@
5'5bCC
-&kT.uO
|8TPO5
qg(]HW
0-\j3;
),f*#=O
s28UQ~
;sSN]b
1UHlKns
\AO0Z3C/
yW5JpK
BM|pqt
7x|d/:
G65h*i
t5qTc/(
%^' R_
kl%FzJI?
9`V?VBB
K?"G#O{
o8MW\I
a{=:^a
h[6~*:
:KPTvr
vqI8|hPr
eOVd#O
otm\wJ
Z"z7$aOn
0|Z<JX<
\V~^KJ
YK|K+;|
b"4q[Pz
z(8-U~R
2'LvxR
	)@K:0
gbKN%0C
C0R&CP
1TmSS	
O?(hJ^`
9>I\f'$
(	g!hei'
Mw.gc=
fse,gN
AaaD_Y
@@?-|Z
HP$N"3
rtrX_H!
n&Dlu,
&=f'"=
\+[	*Y
J^!#(Th
%5EpRs
vDDDDUUfff
TDDDDEUUffn
DDDEUUfff
DDDDUUVffn
DDDEUUfff
DDDDUUUff
DDDDEUUfff
DDDDUUVffn
DDDDUUVffn
DDDEUUVffn
DDDDUUUfff
DDDDEUUfff
DDDDUUVfff
DDDDUUUffn
DDDDUUfff
DDDDUUUfff
DDDDEUUfff
DDDDUUVffn
DDDDEUUfffn
DDDDUUVffn
DDDDUUUfff
DDDEUUVffn
lDDDDUUUfff
DDDDEUUfff
DDDDUUUfff
DDDUUUfff
JtDDEUUVffn
dDDEUUfff
DDEUUfffn
DDUUUfff
DEUUVffn
EUUVffn
EUUfffn
:uUUVfff
JuUVfff
wwwwz)
wwwwz9
wwwwwwA
wwwwwwda
Fzwwwww~
wwwwwdD
&DFwwww
wwwwuDDT
DDDNw~
fffUUU
wwww~DDDF!
fffUUUU
wwwwdDDDDQ
nfffUUUUT
wwwwvDDDDDS
FffeUUUUDD
334feUUUTDDC
C333333EUUUDDDDK
wwwwwt
33333335UTDDDDDB
wwwww\
L3333333
DDDDDDDA
wwwwww
S33333
DDDDDDDM
wwwwwu33333333<Q
4DDDDDD
wwwww|333333333K
DDDDDD
wwwwwc3333333335
wwwwwC333333333<=
Jwwwww
3333333333I
""""+DL
wwww333333333;
"""""""+
33333;
""""""""""
"""""""""""
""""""""""
B"""""""/
2"""""
"""""A
""""""""""
fffc""""""""""""#
fffd"""""""""""
"""""""/
UUUB"""""/
UUUS""/
#33333
#333333;
333333
PR[!OQZ!OQZ
OQZIOQZ
OQZIOQZ
OQZpPR[
OQZpOQZ
OQZFOQZ
OQZFOQZ
OQZLOQZ
OQZ,OQZ
PR[~PR[
PR[~PR[
OQZ?OQZ
OQZXOQZ
OQZcOQZ
OQZXOQZ
OQZ?OQZ
OQZ,PR[
OQZLOQZ
OQZFOQZ
OQZpOQZ
OQZIOQZ
PR[!PR[
OQZ!OQZ
OQZIOQZ
PR[pQS\
XZcFZ\d
_`iL`bj
efn,ghp
st{?uv}
PR[?PR[XPR[jPR[rPR[rPR[jPR[XPR[?PR[
PR[6PR[~PR[
PR[~PR[5PR[
PR[#PR[
PR[0PR[
PR[gPR[
PR['PR[
PR[6PR[
PR[6PR[
PR['PR[
PR[gPR[
PR[0PR[
PR[#PR[
PR[6PR[
PR[~PR[
PR[?PR[
PR[YPR[
PR[jPR[
PR[rPR[
PR[rPR[
PR[jPR[
PR[YPR[
PR[?PR[
PR[~PR[
PR[6PR[
VXa#XZc
]_h0_ai
ijrgklt
tu|'vw
OQZfOQZ
OQZfNPY
PR[ePR[
PR[eLNV
PR[pOQZ
PR[pKMU
OQZ:OQZ
PR[}QS\
PR[}HJS
PR[}VXb
OQZ:QS\
PR[pWZd
PR[eWYc
OQZfXZe
OQZfRT^
VXaeY[d
`ajpbdl
ijr:kmu
opx}qrz
IKSyXZd
JLTy016
:<C,]`j
:<C,cfq
IKSywz
KMUy[]g
ZZ`,yy
&'+4./5W.05W&',4
FHPxknz
&'+4nq~
0154./5Wkn{
ABGW.05Wdfr
IINW&',4[]h
PQXxghq
SSV4ggkWjjmWZZ]40/1
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
 <assemblyIdentity
    name="Readers"
    type="win32"
    version="2.0.0.0"/>
 <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
  <security>
   <requestedPrivileges>
    <requestedExecutionLevel
     level="AsInvoker"
     uiAccess="false"/>
   </requestedPrivileges>
  </security>
 </trustInfo>
 <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"> 
	<application> 
		<!--The ID below indicates app support for Windows Vista -->
		<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/> 
		<!--The ID below indicates app support for Windows 7 -->
		<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
		<!--The ID below indicates app support for Windows 8 -->
		<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
	</application> 
 </compatibility>
</assembly>
KERNEL32.DLL
ADVAPI32.dll
AUTHZ.dll
COMCTL32.dll
COMDLG32.dll
CRYPT32.dll
CRYPTUI.dll
GDI32.dll
gdiplus.dll
IMM32.dll
IPHLPAPI.DLL
MSACM32.dll
MSIMG32.dll
NETAPI32.dll
ole32.dll
OLEAUT32.dll
Secur32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
VERSION.dll
WINHTTP.dll
WININET.dll
WS2_32.dll
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
LsaClose
AuthzInitializeResourceManager
ChooseFontA
CertFindChainInStore
CryptUIWizImport
PatBlt
GdiplusStartup
ImmGetDefaultIMEWnd
GetAdaptersAddresses
acmDriverOpen
GradientFill
NetUserAdd
CoInitialize
FreeCredentialsHandle
SHParseDisplayName
VerQueryValueA
WinHttpReceiveResponse
InternetOpenUrlW