Static | ZeroBOX

PE Compile Time

2021-03-17 20:31:18

PE Imphash

8acb34bed3caa60cae3f08f75d53f727

PEiD Signatures

BobSoft Mini Delphi -> BoB / BobSoft

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0002e0d4 0x0002e200 6.60846150454
.itext 0x00030000 0x00001f98 0x00002000 7.67753313507
.data 0x00032000 0x00001768 0x00001800 4.10960399265
.bss 0x00034000 0x00104d5c 0x00000000 0.0
.idata 0x00139000 0x000014e6 0x00001600 4.91272040398
.tls 0x0013b000 0x0000000c 0x00000000 0.0
.rdata 0x0013c000 0x00000018 0x00000200 0.210826267787
.reloc 0x0013d000 0x000029d8 0x00002a00 6.70612070101
.rsrc 0x00140000 0x00000000 0x00000200 0.0

Imports

Library oleaut32.dll:
0x539458 SysFreeString
0x53945c SysReAllocStringLen
0x539460 SysAllocStringLen
Library advapi32.dll:
0x539468 RegQueryValueExA
0x53946c RegOpenKeyExA
0x539470 RegCloseKey
Library user32.dll:
0x539478 GetKeyboardType
0x53947c DestroyWindow
0x539480 LoadStringA
0x539484 MessageBoxA
0x539488 CharNextA
Library kernel32.dll:
0x539490 GetACP
0x539494 Sleep
0x539498 VirtualFree
0x53949c VirtualAlloc
0x5394a0 GetTickCount
0x5394a8 GetCurrentThreadId
0x5394b4 VirtualQuery
0x5394b8 WideCharToMultiByte
0x5394bc MultiByteToWideChar
0x5394c0 lstrlenA
0x5394c4 lstrcpynA
0x5394c8 LoadLibraryExA
0x5394cc GetThreadLocale
0x5394d0 GetStartupInfoA
0x5394d4 GetProcAddress
0x5394d8 GetModuleHandleA
0x5394dc GetModuleFileNameA
0x5394e0 GetLocaleInfoA
0x5394e4 GetCommandLineA
0x5394e8 FreeLibrary
0x5394ec FindFirstFileA
0x5394f0 FindClose
0x5394f4 ExitProcess
0x5394f8 ExitThread
0x5394fc CreateThread
0x539500 WriteFile
0x539508 RtlUnwind
0x53950c RaiseException
0x539510 GetStdHandle
Library kernel32.dll:
0x539518 TlsSetValue
0x53951c TlsGetValue
0x539520 LocalAlloc
0x539524 GetModuleHandleA
Library user32.dll:
0x53952c TranslateMessage
0x539530 PeekMessageA
0x539538 MessageBoxA
0x53953c LoadStringA
0x539540 GetSystemMetrics
0x539544 DispatchMessageA
0x539548 CharNextW
0x53954c CharLowerBuffW
0x539550 CharNextA
0x539554 CharLowerBuffA
0x539558 CharLowerA
0x53955c CharUpperA
0x539560 CharToOemA
Library mpr.dll:
0x539568 WNetOpenEnumW
0x53956c WNetEnumResourceW
0x539570 WNetCloseEnum
Library kernel32.dll:
0x539578 WriteProcessMemory
0x53957c WriteFile
0x539580 WaitForSingleObject
0x539584 VirtualQuery
0x539588 VirtualAllocEx
0x53958c TerminateThread
0x539590 TerminateProcess
0x539594 SetLastError
0x539598 SetFileTime
0x53959c SetFilePointer
0x5395a0 SetFileAttributesW
0x5395a4 SetEvent
0x5395a8 SetEndOfFile
0x5395ac ResumeThread
0x5395b0 ResetEvent
0x5395b4 ReadFile
0x5395b8 OpenProcess
0x5395bc MoveFileW
0x5395c0 LoadLibraryA
0x5395cc GlobalUnlock
0x5395d0 GlobalReAlloc
0x5395d4 GlobalHandle
0x5395d8 GlobalLock
0x5395dc GlobalFree
0x5395e0 GlobalAlloc
0x5395e4 GetVersionExA
0x5395ec GetTickCount
0x5395f0 GetThreadLocale
0x5395f4 GetStdHandle
0x5395f8 GetProcAddress
0x5395fc GetModuleHandleA
0x539600 GetModuleFileNameW
0x539604 GetModuleFileNameA
0x539608 GetLocaleInfoA
0x53960c GetLocalTime
0x539610 GetLastError
0x539614 GetFullPathNameA
0x539618 GetFileAttributesW
0x53961c GetFileAttributesA
0x539620 GetExitCodeThread
0x53962c GetDriveTypeA
0x539630 GetDiskFreeSpaceA
0x539634 GetDateFormatA
0x539638 GetCurrentThreadId
0x53963c GetCurrentProcess
0x539640 GetCommandLineW
0x539644 GetCPInfo
0x53964c InterlockedExchange
0x539654 FreeLibrary
0x539658 FormatMessageA
0x53965c FindNextFileW
0x539660 FindFirstFileW
0x539664 FindClose
0x539670 ExitThread
0x539674 ExitProcess
0x539678 EnumCalendarInfoA
0x539680 DuplicateHandle
0x539684 DeleteFileW
0x53968c CreateThread
0x539690 CreateRemoteThread
0x539694 CreateProcessW
0x539698 CreateProcessA
0x53969c CreatePipe
0x5396a0 CreateFileW
0x5396a4 CreateFileA
0x5396a8 CreateEventA
0x5396ac CreateDirectoryW
0x5396b0 CopyFileW
0x5396b4 CompareStringW
0x5396b8 CompareStringA
0x5396bc CloseHandle
Library advapi32.dll:
0x5396c4 RegSetValueExW
0x5396c8 RegSetValueExA
0x5396cc RegQueryValueExW
0x5396d0 RegQueryValueExA
0x5396d4 RegOpenKeyExW
0x5396d8 RegOpenKeyExA
0x5396dc RegEnumKeyExA
0x5396e0 RegDeleteValueA
0x5396e4 RegDeleteKeyA
0x5396e8 RegCreateKeyExW
0x5396ec RegCreateKeyExA
0x5396f0 RegCloseKey
0x5396f4 OpenProcessToken
Library kernel32.dll:
0x539704 Sleep
Library wininet.dll:
0x53970c InternetReadFile
0x539710 InternetOpenUrlA
0x539714 InternetOpenA
0x539718 InternetConnectA
0x53971c InternetCloseHandle
0x539720 HttpSendRequestA
0x539724 HttpOpenRequestA
Library shell32.dll:
0x539730 ShellExecuteW
Library shell32.dll:
Library shell32.dll:
0x539744 SHGetMalloc
Library oleaut32.dll:
0x53974c SafeArrayPtrOfIndex
0x539750 SafeArrayGetUBound
0x539754 SafeArrayGetLBound
0x539758 SafeArrayCreate
0x53975c VariantChangeType
0x539760 VariantCopy
0x539764 VariantClear
0x539768 VariantInit

This program must be run under Win32
`.itext
`.data
.idata
.rdata
@.reloc
B.rsrc
Cardinal
stringX
WideString
TObject
TObject
System
IInterface
System
TInterfacedObject
FastMM Borland Edition
2004, 2005 Pierre le Riche / Professional Software Development
An unexpected memory leak has occurred.
The unexpected small block leaks are:
bytes:
Unknown
String
The sizes of unexpected leaked medium and large blocks are:
Unexpected Memory Leak
~KxI[)
SOFTWARE\Borland\Delphi\RTL
FPUMaskValue
_^[YY]
VWUUh|@@
ZTUWVSPRTj
YZ]_^[
tChp^@
kernel32.dll
GetLongPathNameA
Software\Borland\Locales
Software\Borland\Delphi\Locales
_^[YY]
TStream
THandleStream
TFileStreampo@
TCustomMemoryStream
TMemoryStream
Exception
EHeapException
EOutOfMemory
EInOutError
EExternal
EExternalException
EIntError
EDivByZero
ERangeError
EIntOverflow
EMathError
EInvalidOp
EZeroDivide<~@
EOverflow
EUnderflow
EInvalidPointerH
EInvalidCast
EConvertError
EAccessViolation
EPrivilege
EStackOverflow
EControlC
EVariantError
EAssertionFailed
EAbstractError
EIntfCastError
EOSError
ESafecallException
SysUtils
SysUtils
TThreadLocalCounter
$TMultiReadExclusiveWriteSynchronizer
-{{{{1
-ffff!
-{{{{1
-ffff!
-[[[[1
-ffff!
-[[[[1
-ffff!
_^[YY]
_^[YY]
<*t"<0r=<9w9i
INFNAN
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
_^[YY]
t%HtIHtm
$Z]_^[
QQQQQQSVW3
QQQQQSVW
_^[YY]
TErrorRec
TExceptRec
$YZ_^[
YZ]_^[
m/d/yy
mmmm d, yyyy
:mm:ss
TUnitHashArray
SysUtils
TModuleInfo
kernel32.dll
GetDiskFreeSpaceExA
(Z]_^[
YZ]_^[
TFileName
TSearchRecp
tUI|RVS
kernel32.dll
CreateToolhelp32Snapshot
Heap32ListFirst
Heap32ListNext
Heap32First
Heap32Next
Toolhelp32ReadProcessMemory
Process32First
Process32Next
Process32FirstW
Process32NextW
Thread32First
Thread32Next
Module32First
Module32Next
Module32FirstW
Module32NextW
Qkkbal
-Portions Copyright (c) 1999 by Hagen Reddmann
QQQQSV
QQQQQQQSVW
QQQQQS
YZ]_^[
_^[YY]
_^[YY]
TByteArray
_^[YY]
3/"s@
TFGInt
_^[YY]
0_^[YY]
_^[YY]
YZ]_^[
TDigits
DigitsLbA
TInteger
TIntegerLbA
Digits
Digits
YZ]_^[
$Z]_^[
_^[YY]
YZ]_^[
_^[YY]
TKeyObj
TZeppelinU
P.J9Uj
[D|i"vt
oleaut32.dll
VariantChangeTypeEx
VarNeg
VarNot
VarAdd
VarSub
VarMul
VarDiv
VarIdiv
VarMod
VarAnd
VarXor
VarCmp
VarI4FromStr
VarR4FromStr
VarR8FromStr
VarDateFromStr
VarCyFromStr
VarBoolFromStr
VarBstrFromCy
VarBstrFromDate
VarBstrFromBool
TCustomVariantType
TCustomVariantType
Variants
EVariantInvalidOpError
EVariantTypeCastError
EVariantOverflowError
EVariantInvalidArgError@
EVariantBadVarTypeError
EVariantBadIndexError
EVariantArrayLockedError
EVariantArrayCreateError
EVariantNotImplError
EVariantOutOfMemoryError
EVariantUnexpectedError
EVariantDispatchError
QQQQSV
Smallint
Integer
Single
Double
Currency
OleStr
Dispatch
Boolean
Variant
Unknown
Decimal
ShortInt
LongWord
String
Array
ByRef
Variants
_^[YY]
EStreamError
EFileStreamError
EFCreateError
EFOpenError\
EFilerError
EReadError
EWriteErrord
EListError
EStringListError
TThreadList
TPersistent
TPersistent
Classes
IStringsAdapter
Classes
TStrings
TStrings
Classes
TStringItem
TStringList
TStringList
Classes
TStreaml
THandleStream
TFileStream
TCustomMemoryStream
TMemoryStream
TStringStream
EThread@
TThread
TRegGroup
TRegGroups
Strings
S$_^[Y]
_^[YY]
Sd]_^[
$Z]_^[
_^[YY]
IWideStringsAdapter
WideStrings
TWideStrings
TWideStrings
WideStrings
TWideStringItem
TWideStringList
TWideStringList
WideStrings
QQQQQQSVW
Strings
_^[YY]
S$_^[Y]
Sh]_^[
$Z]_^[
C ;C$u
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_
TRegExpr
ERegExpr
^$.[()|?+*\{]}
No errors
TRegExpr(comp): Null Argument
TRegExpr(comp): Regexp Too Big
TRegExpr(comp): ParseReg Too Many ()
TRegExpr(comp): ParseReg Unmatched ()
TRegExpr(comp): ParseReg Junk On End
TRegExpr(comp): *+ Operand Could Be Empty
TRegExpr(comp): Nested *?+
TRegExpr(comp): Bad Hex Digit
TRegExpr(comp): Invalid [] Range
TRegExpr(comp): Parse Atom Trailing \
TRegExpr(comp): No Hex Code After \x
TRegExpr(comp): Hex Code After \x Is Too Big
TRegExpr(comp): Unmatched []
TRegExpr(comp): Internal Urp
TRegExpr(comp): ?+*{ Follows Nothing
TRegExpr(comp): Trailing \
TRegExpr(comp): RarseAtom Internal Disaster
TRegExpr(comp): BRACES Argument Too Big
TRegExpr(comp): BRACE Min Param Greater then Max
TRegExpr(comp): Unclosed (?#Comment)
TRegExpr(comp): If you want take part in beta-testing BRACES '{min,max}' and non-greedy ops '*?', '+?', '??' for complex cases - remove '.' from {.$DEFINE ComplexBraces}
TRegExpr(comp): Urecognized Modifier
TRegExpr(comp): LinePairedSeparator must countain two different chars or no chars at all
TRegExpr(exec): RegRepeat Called Inappropriately
TRegExpr(exec): MatchPrim Memory Corruption
TRegExpr(exec): MatchPrim Corrupted Pointers
TRegExpr(exec): Not Assigned Expression Property
TRegExpr(exec): Corrupted Program
TRegExpr(exec): No Input String Specified
TRegExpr(exec): Offset Must Be Greater Then 0
TRegExpr(exec): ExecNext Without Exec[Pos]
TRegExpr(exec): GetInputString Without InputString
TRegExpr(dump): Corrupted Opcode
TRegExpr(exec): Loop Stack Exceeded
TRegExpr(exec): Loop Without LoopEntry !
TRegExpr(misc): Bad p-code imported
Unknown error
0123456789
0123456789
QQQQSVW
(pos
07\6T:
QQQQQS
_^[YY]
TPresenceU
TExcludeFiles
TExcludeFoldersU
QQQQQQQSVW
TDrivesAndShares
9VN{iS
QQQQQQQS3
TReadme
QQQQQQSVW
TUnlockAndEncryptU
TSearcherU
TTaskKillerU
QQQQQQQQSVW
QQQQQSVW3
kernel32.dll
QQQQSVW
C.N')%
QQQQQQQQ3
QQQQQQ3
E=<_9a
SfkRhZ$
KvVuxd
!!! D !!!
vdHUi2MCW+XlAwpuESeU5AkUrxFXmJs7y2YfRuy/13MN680yE/B1QcOk371EDmjhmXRtOi0PegvX87K8qwCsnCDkP5/BApT9sb2Rhc6WHDxqaiFHPQExblQJRQehyudjD1L9zqRWA8TZF/S3ext7jnLKxg7cZACC7Z6CiIz/ILftHaIHoRnzJDOIiAJbOb41gJ9A7yJ3NhMmuXA7eVZf30SEO27X1uCnLoSkv6AGpiAO4L+S5xpH/vKIMdDDudCgZC30tGaNP5Yku+I6D7GA21A83hgQXvc/w7TeYt5MhRgS61mtQD+Aw7eag2SYVJBcms5UmALqOcyTzMvt1TrxZLpGataMs7zUkiY3pZoXRt990K+oNFO7GSzN0M378D/d0IkFqQi1M3B+4F/6Z4CrJWk=
izr6VUL869m21xd0FXTTa49zWoFvrMBEtXiwiKiHZ+f2KOkPT3XHCYQuQ33KVF9mSVDEFeo9Qs7wHBo9gZpHht9GR1S/6biIHh2JrE7XeGCb+agNdanRH0hcc+vJZrc7IVAArviXbUdeqSznYE8llndhvZ2XUHWOLZ4p6s5abHW1M+Duy5CLLlAsPWdOvtKcjeNSW/pYb6+t6uwaJsUsNYhESNAayT9fY8eLALbb/ag0xBCQuqSNQ/UK25lAmfb10PGzPyQoO+dP5cVYHQQm85ySDmX0e4jU4epB+Fz9+EbzTaB68c07ZqnT50IUd5FerCMJ9WpA6qFJrQSx6MYdIP3S7X5mgi0Jrv0HYsEp+tCxDNOZue6GrXD6xtWleoNzmKPmu7Z0Lv/YghRIE7EzCQkAlYh3Q8H8wl93hGmkJ4q06GduXRh64nyBXesqdeM+vVT2D7ytoGbU0OLUi0amda8kat/iprfsNNVP74BbtQVS4jlIpMsnNuW4bUemWqLdXcVn0uke/45S185pOu3lpvYIGBOBu+GKd7Rl/G8cFS4GW1RGMTSCm8rv5B+91eHbUQYPLS9UE+fXsev1s00e/Q2FWy5F22/QQyQ/ijzSMjit9sbFuptargqhDdv8wH19sYBiXkqPxxfo5YlnAM0fYzQOkANQnpNXw2N7fnkfwIM8BLOqrIiZv+VUA3tWzzTxEQRb3FvV7yTm/kn7JtwybEQlXhwjP7TqD5GqqbayJcvQpWRL5KtejADQ0ZIXo1tXHYyF633KoYl/+CiAg+YtYxVh2/vD2Sxs3IRr0ibCLjndEURTy5n1JMSjG/G3wVnAmjiqSePtSuRlq0ohoax7oNIBvDFVeYrvV/ylonX9oVZeqyp6PBPH1r4IhNayL41xi6gq/SLmFBl5FxSYXES2MjoTJKpQO+HJYvfdIFSDnJklXbn0K+pG62j3lJAmUGvSziN80EW4rk1Ya2VmcgLrOgOz1CdWtG87bF6V7rp90yh2MAfZXklYkKkD20Ubvsom
Rpx']
"V9I\sw1
H}F](8<
{XJ(w@Y
Runtime error at 00000000
0123456789ABCDEF
%.*d$x@
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=
?456789:;<=
 !"#$%&'()*+,-./0123
L&&jl66Z~??A
Oh44\Q
sb11S*
uB!!c
D""fT**~;
;d22Vt::N
J%%o\..r8
0123456789ABCDEFW
^$.[()|?+*\{
oleaut32.dll
SysFreeString
SysReAllocStringLen
SysAllocStringLen
advapi32.dll
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
user32.dll
GetKeyboardType
DestroyWindow
LoadStringA
MessageBoxA
CharNextA
kernel32.dll
GetACP
VirtualFree
VirtualAlloc
GetTickCount
QueryPerformanceCounter
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
kernel32.dll
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
user32.dll
TranslateMessage
PeekMessageA
MsgWaitForMultipleObjects
MessageBoxA
LoadStringA
GetSystemMetrics
DispatchMessageA
CharNextW
CharLowerBuffW
CharNextA
CharLowerBuffA
CharLowerA
CharUpperA
CharToOemA
mpr.dll
WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum
kernel32.dll
WriteProcessMemory
WriteFile
WaitForSingleObject
VirtualQuery
VirtualAllocEx
TerminateThread
TerminateProcess
SetLastError
SetFileTime
SetFilePointer
SetFileAttributesW
SetEvent
SetEndOfFile
ResumeThread
ResetEvent
ReadFile
OpenProcess
MoveFileW
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalReAlloc
GlobalHandle
GlobalLock
GlobalFree
GlobalAlloc
GetVersionExA
GetUserDefaultLangID
GetTickCount
GetThreadLocale
GetStdHandle
GetProcAddress
GetModuleHandleA
GetModuleFileNameW
GetModuleFileNameA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileAttributesW
GetFileAttributesA
GetExitCodeThread
GetEnvironmentVariableW
GetEnvironmentVariableA
GetDriveTypeA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentProcess
GetCommandLineW
GetCPInfo
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
FreeLibrary
FormatMessageA
FindNextFileW
FindFirstFileW
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
ExitThread
ExitProcess
EnumCalendarInfoA
EnterCriticalSection
DuplicateHandle
DeleteFileW
DeleteCriticalSection
CreateThread
CreateRemoteThread
CreateProcessW
CreateProcessA
CreatePipe
CreateFileW
CreateFileA
CreateEventA
CreateDirectoryW
CopyFileW
CompareStringW
CompareStringA
CloseHandle
advapi32.dll
RegSetValueExW
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegOpenKeyExA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExW
RegCreateKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
kernel32.dll
wininet.dll
InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetConnectA
InternetCloseHandle
HttpSendRequestA
HttpOpenRequestA
HttpAddRequestHeadersA
shell32.dll
ShellExecuteW
shell32.dll
SHGetSpecialFolderLocation
shell32.dll
SHGetPathFromIDListW
SHGetMalloc
oleaut32.dll
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
0,0H0T0d0
0)1-111I1X1\1x1
2"2*222:2B2J2R2Z2b2j2r2z2
3&3*5@5Q5t5
6E6M6R6w6
6 7&7,777
7F9U9\9
: :*:A:V:i:v:
;*;e;o;
< <5<A<^<g<
0_1o1"2+2=2I2T2
5)5<5W5]5u5
7-898x8
=!=%=5=:=_=
>2>N>o>
>&?;?H?h?
-0T0X0\0`0d0h0l0p0t0#2\2
263?3p3w3
>,>:>n>
>$?-?_?h?
3/393D3U3
5!5+53595G5b5w5
6M6V6[6}6
717<7y8
0R4[4b5k5o<
1,1<1C1
2&22292Z5
6b7o7{7
848B8G8`8p8
9 9*949>9H9R9\9f9p9z9
:&:.:6:>:F:N:V:^:f:n:v:~:
;&;.;6;>;F;N;V;^;f;n;v;~;
<&<.<6<><F<N<V<^<f<n<v<~<
=&=.=6=
> >$>(>,>8>X>`>d>h>l>p>t>x>|>
?$?D?L?P?T?X?\?`?d?h?l?p?t?x?|?
7$7,747<7D7L7T7\7d7l7t7|7
8$8,848<8D8L8T8\8d8l8t8|8
9$9,949<9D9L9T9`9t9|9
:8:@:D:H:L:P:T:X:\:`:t:
;$;D;L;P;T;X;\;`;d;h;l;
< <$<4<T<\<`<d<h<l<p<t<x<|<
= =$=(=,=0=@=`=h=l=p=t=x=|=
> >$>(>,>0>4>8>H>h>p>t>x>|>
?$?(?,?0?4?8?<?@?D?X?x?
040<0@0D0H0L0P0T0X0\0l0
1 1@1H1L1P1T1X1\1`1d1h1|1
2 2$282X2`2d2h2l2p2t2x2|2
3 3$3(3,30343L3Y3a3p3}3
3@4D4H4L4P4T4X4p4|4
>C?T?j?
3I5M5Q5U5Y5]5a5e5i5m5q5u5y5}5
5Y6`6"7
;N<c<n=
;";7;$<8<
=,=C=v=
= >4>E>U>h>t>
3H3M3[3
5N5f5x5
6)6@6R6
747F7]7o7
:*:W:\:v:
;7;S;r;
=Q=j=z=
>'?,?4?^?o?x?
3/373C3
6.7=7L7h7
8"8+878=8E8N8Z8_8h8q8z8
<'<K<]<
=*>j>o>}>
?7?E?`?i?
060N0W0k0y0
1/1>1N1V1k1s1
4G4N4]4d4
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
; ;(;,;4;8;@;D;L;P;X;\;d;h;p;t;|;
<$<(<0<4<<<@<H<L<T<X<`<d<l<p<x<|<
=%=/=9=C=M=W=a=k=u=
>'>1><>F>Q>c>t>
V0^0f0n0v0~0
1#10151B1G1T1Y1f1k1x1}1
133S3s3
3@3Z3l3
6-7:7p7|7j9+:{:
>#>[>c>
293E3R3Z3g3n3
6j7(8h8X9v9D:|:3;M;
</<7<M<k<p<
0$040H0T0h0
3I4W4e4s4
3*383F3T3b3o3}3
4 5.5<5J5W5e5
8)8@8{8
=">#?q?
1%2m2}2
3)4<4K4Z4
5%666G6X6
7!727l7}7
8F8W8h8y8
8 919B9S9
:-:g:x:
;A;R;c;t;
<,<=<N<
=(=b=s=
><>M>^>o>
?'?8?I?
0#0]0n0
071H1Y1j1
2%262G2
3'3d3u3
4D4U4f4w4
4$555F5W5
6&676t6
7T7e7v7
748E8V8g8
9%969G9
:':d:u:
;D;U;f;w;
;$<5<F<W<
=&=7=t=
2 2(2,2024282<2@2D2H2V2h2v2z2
2:3E3L3\3g3v3
4#4,43494O4j4y4~4
555F5]5
6*:c:k:|:
8Y9f9n9
;8;l;u;
4 444<4@4D4H4L4P4T4X4\4j4
5U5e5s5
:&:.:6:>:h:s:{:
<B=U=i=
;!<,<><#={=A>N>j>
626Z6b6j6r6
8.9H9}9
;;$;/;5;:;E;K;P;[;a;f;q;w;|;
<!<'<,<7<=<B<M<S<X<c<i<n<y<
<>+>8>j>n>r>
?4?L?P?d?
0,0L0T0X0\0`0d0h0l0p0t0
1 1$1(1,1014181<1X1x1
2$2D2L2P2T2X2\2`2d2h2l2
3 3$3(3,3034383X3x3
4)474F4]4
5'565M5
6&6=6j6
7!707G7V7m7|7
8"8T8c8z8
1I1b1y1
162R2V2Z2^2b2f2j2n2r2v2z2~2
5"5&5*5.5
7)8B8Y8
99U9q9u9y9}9
< <$<(<,<0<4<8<<<@<
00O0g0
2V3c3~3
535?5K5U5_5i5t5~5
6W6c6j6u6
7$7(7,7074787<7@7D7\7|7
80888<8@8D8H8L8P8T8X8h8
989@9D9H9L9P9T9X9\9`9p9
: :$:(:4:T:\:`:d:h:l:p:t:x:|:
;(;=;`;l;p;
< <$<(<6<><P<^<b<t<
= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\=`=d=h=l=p=t=x=
> >@>H>L>P>T>X>\>`>d>h>l>p>t>x>|>
? ?@?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
0$080@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
1 1$1(1,1014181<1@1D1P1p1x1|1
;*;W;t;
<,=D=0>i>
;';l;q;
4-474E4U4m4y4
5`5m5{5
5)6F6K6v6
9%929>9F9V9
9M:X:e:{:
=$=>=H=R=\=k=u=
=4>M>t>
? ?$?(?,?0?4?8?<?@?N?V?l?~?
0 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
3/4G4d4
5'6]6|6
<$<8<@<D<H<L<P<T<X<\<`<d<h<v<~<
?'?5?C?Q?_?m?{?
0#010?0M0[0i0w0
9!939>9T9
<+<P<u<
<2=6=:=>=B=F=J=N=
5E5^5k5w5!6
<&>->O>S>W>[>_>c>g>k>o>s>w>
1c1g1k1o1s1w1{1
> >$>(>,>0>4>R>V>Z>^>b>f>j>n>r>
7_7k7r7|7
:-;L;X;l;t;x;|;
=&=4=C=Q=
2(272E2
:~:];k;x;
031T1l132U2
3(343H3P3T3X3\3`3d3h3l3p3~3
848B8S8]8b8q8
949A9k9
;#;9;v;
<%=(>4>H>P>T>X>\>`>d>h>l>p>t>x>
>@?`?h?l?p?t?x?|?
8/9>9N9_9o9
>5?K?^?t?
4/4=4X4i4
5!6N6)7;7I7p7
8:8l8y8
;!;/;G;_;w;
;"<=<M>t>
0@0f0s1
2$2)2G2Q2V2b2x2
4"4,414=4G4L4X4b4g4s4}4
5,515?5Q5e5~5
6"6.6:6a6g6p6|6
7(7-777H7R7W7a7m7w7|7
7+848x8
9$989A9Q9a9j9
:I;P;V;_;j;u;|;
?"?4?K?^?p?|?
00%0)0/060:0T0]0f0r0|0
1 1%1/141>1C1M1R1\1a1k1p1z1
= =%=4=U=r=|=
>'>/>9>>>C>H>M>S>X>]>c>j>p>w>}>
?$?.?5???L?^?n?v?
1(1H1,7074787<7@7D8L8P8t8x8
9 9$9(9,909l9t9|9
044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|5
6 6$6(6,6064686<6@6D6H6L6P6T6X6\6`6d6h6l6p6t6x6|6
7 7$7(7,7074787<7@7D7H7L7P7T7X7\7`7d7
jjjjjjjj
jjjjjjjj
jjjjjjjj
Antivirus Signature
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
McAfee GenericRXKB-RP!75C1FF39AAC8
Cylance Unsafe
VIPRE Clean
AegisLab Trojan.Win32.Agent.4!c
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 0055c8001 )
BitDefender Generic.Ransom.Buhtrap.DD13C19F
K7GW Trojan ( 0055c8001 )
Cybereason malicious.9aac84
Baidu Clean
Cyren W32/Ransom.LV.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Filecoder.Buran.J
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.Win32.Agent.gen
Alibaba Ransom:Win32/generic.ali2000010
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Generic.Ransom.Buhtrap.DD13C19F
Rising Trojan.Filecoder!8.68 (CLOUD)
Ad-Aware Generic.Ransom.Buhtrap.DD13C19F
Sophos Mal/Generic-R + Mal/Behav-010
Comodo Clean
F-Secure Heuristic.HEUR/Malware
DrWeb DLOADER.Trojan
Zillya Clean
TrendMicro Ransom.Win32.ZEPPELIN.SMTH
McAfee-GW-Edition BehavesLike.Win32.Generic.dh
FireEye Generic.mg.75c1ff39aac84628
Emsisoft Generic.Ransom.Buhtrap.DD13C19F (B)
SentinelOne Static AI - Malicious PE
GData Win32.Trojan-Ransom.Zeppelin.E39JD1
Jiangmin Clean
Webroot Clean
Avira HEUR/Malware
eGambit Unsafe.AI_Score_99%
MAX malware (ai score=89)
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Ransom.Zeppelin.A.sd!yf
Arcabit Generic.Ransom.Buhtrap.DD13C19F
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.Win32.Agent.gen
Microsoft Ransom:Win32/Zeppelin.A!MSR
AhnLab-V3 Trojan/Win32.BuhTrap.R338445
Acronis Clean
VBA32 BScope.TrojanRansom.Crypmod
ALYac Trojan.Ransom.VegaLocker
TACHYON Clean
Malwarebytes Ransom.Zeppelin
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall Ransom.Win32.ZEPPELIN.SMTH
Tencent Win32.Trojan.Agent.Ajbt
Yandex Clean
Ikarus Trojan-Ransom.Buran
MaxSecure Trojan.Malware.121218.susgen
Fortinet W32/Buran.H!tr.ransom
BitDefenderTheta AI:Packer.CD0170E41E
AVG FileRepMalware
Avast FileRepMalware
CrowdStrike win/malicious_confidence_100% (W)
Qihoo-360 Win32/Ransom.Zeppelin.HwUBSaoA
No IRMA results available.