Static | ZeroBOX

PE Compile Time

2021-07-21 17:39:02

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
3=}OuEeU 0x00002000 0x00017434 0x00017600 7.99793106842
.text 0x0001a000 0x0000c098 0x0000c200 5.85564297601
.rsrc 0x00028000 0x00010ec8 0x00011000 3.6842547381
.reloc 0x0003a000 0x0000000c 0x00000200 0.0980041756627
0x0003c000 0x00000010 0x00000200 0.142635768149

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x000281a4 0x00010828 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_GROUP_ICON 0x000389cc 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_VERSION 0x000389e0 0x000002f8 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x00038cd8 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x43c000 _CorExeMain

!This program cannot be run in DOS mode.
3=}OuEeU4t
`.rsrc
@.reloc
LbEw"-k`
0;+"A\C
FMUkG$
D?c^UU
`y$"BZ
?qx=&_
bO.f2$
C?A?9}
T:g@w+
R81,E
IzUB3$[
266#j`
4i5y5{,
Y/Dz^@
Ei@2h;
]I#Fn~7p
h+@B\40
"6]M F
;OII?8
0XCY8.
A 9zj%!
0@#R\A
yy\@&
J/Jq;[
-7~K]B
mSF%"`R
7s')NI
)FbB>:
LX*+TIU
D2SEu%
GiOTz
,g#o*p
*[L:1[
XvJMCz
bLmxh&
P~VLyH
gsaGu0
:DN_$
:Ei W0
dRN]8O
Vq&vUg
CpprOf
G=Th5`
b$B(Gk
du;*u:
RHk$fS
6yXP=
CnS.(^VV
8KP$Yp
"o.a0$C
+ kG}H8
Vc_]l5/~
Jr)Ixa
yS?_u
L%G6Mn
eIW4{>
u))J:4G|
L,ayQ}
H8${iNa
[nbuYU
cqeN`.[
;kl5Am
JyDB'^
>k8kw8
MVQf<q>
&Y^a1C
IBf1MW
mA}p_S
)PEv`m
=gHg$v
ywYrVRyd
S!M6i`
!ghpPkWW
U=yWTr
@CZ{22)
TO1Q\W
z^s`D&
`dL>2!8
*1Y Gd
sF]G%5a
vqZG}=k
kt+<^#K0
q\z]d%
fTaQ0s
Bm8(I#
!vpZL4J
F|x.J+
yR%2wh
3dU\Ia
zpt?uq
St>i['
RgrY>e
#gDv<,`
BCxiC^
oL^-HY
2H 4O*1=
w)RvCy*
XS ->_
rcgw,;
{qmcVc
ntT3s<
Q=b.x">
6nEN:P
&&Pf-K
7Gi\:fw
?>#c<R-
@c8.uf
=4i8D_w.
Is"0f9$
~uOxR,bo
Le|4"A
o}!a#T
.29*h1\R
U_5Z?Dm
c+MYvP
9p>bE}
d;4u@`F2x
0g3+}b
b,~yt
K-k@|W%
Xs"gkt
F;&gz~&9D
2m\\L)
(5q:?b
gN|'EZ
aZ2CR5
{bO8sifS
h/C|Al
}l7aI<
d+RI>_
@vI|x?
Nv>:0*q=Rb
rZol~;
F$m&c9H
#N0tE
"*A-+$s
x7W88+
pFp i;
Eut#,7
PvD7rDG
h,{e,n
H k;QxTX
:a}"yjy
}AMT5
c]5u))lD
~mRXVd
V|UD0/g*
8z~f9`
_fv&p
.tD3DtM{
qkvdi9p/{
kK)S[D
]fcSmf
IsbTdQ
kz|Zsn
4N)/@
[5-Igx(
kSqDR/S
("q[1~(
2Xwa{w
#tH%\k
mnJO8
_ZKkYD
;)N?iR
?vz:xS
\z1gAo
HsT)sK
lRvG?F
J5)+nd
0lU{-\oT
zmTu4{Yl
Xp?_0Tx
>I6- "
cz:,YL`7
|1VDZY
1NxrR;*
40LU"US
`crD?da<0'oK
CrMFQu
0IK"vg6
7$vuHe
3=)L$~
IUxXP:
Ldc^UE
c4fd~.
AS*x-x#VM
RCOS%z
HL(3K@j
87%iZ)}r6
@Dntj)
Ge3ro
ft/q !
Z xf~na+
xOoa8i
Z %;:+a8
_CorExeMain
mscoree.dll
v4.0.30319
#Strings
#Strings
#Schema
asdads
mscorlib
SuppressIldasmAttribute
System.Runtime.CompilerServices
<Module>
AkGvCbXheAcpQVNNzAEDDvmKsBoeA4VX7sx[K4(Dd3LiX#C5=^NQ7"
ERFCnufbdBmJleUCZcDQHJMgTxxac>yp$Y?k;D|W;rzF@D`F@r;Uu#
UOexSZdSfRkujxGbKHlTBBhQIezVp>$o8,lI8aq1j j8'1hAl*#9%
BuCcmlwIxIzrmWJVuzHIwQAomYnuXY8"/w0*N](OPl1`tx9#K^oO"
rmeEOHlsMfHYUZsrpDikHNdfZsnvom?rFuzf_82<a A1iWt,W7*Y"
Assembly
System.Reflection
GNrUDmwiTegywMWXimYmPgpQqxTD-ECna;!fQ=w:uD{&;))a^W)<$
QHzGsfUOOGdkqgxmzrLebhilxyFiAZ&}Y=4X#-Iq[9=qHS-3i(m?%%
GCHandle
System.Runtime.InteropServices
buziCvENrtqwKdgEabGYvmEoczPssQw@g<0u cd4?'Y@6SuBKu-v#
KVxBMUDrGpMUaekGmglpQSJSkkVJDFkLbRLL3<y(s! 7}F]vFSrX!
ResolveEventArgs
System
gJDjYvVKFnKbgsafnIbwGbvpCtzSACFVRCpErYwSbk_(gu?&/9(PM#
.cctor
NPkmwodOtiaZLFCOjdWgyaymmgYiV\ = MLe/o|t}\[W,KhEuofk
RuHBiHnfixajHngWqOkXHOROYYCNF~~!p(6}MqDaVtg}BB+~@H#4!
meyPnfBPQAbHywwInbSKssfSRDaRc8geg"vZJ+QwC~}<bc*Qf#E("
VirtualProtect
kernel32.dll
yDBUZodrwQFeBSDbzAfAiTkeJoHi}sVxuG[wB%\F$A[4jC@moRpC!
TcwVFEJwnejUUVssWdPmjgGZyDuH~0_rp@(c?3x0GsH&E7w2lo I!
tQeuWGFbxbRiaUoSGunUSlphFtYE9#kivR)C50EJE~t]p@4Sm%'t!
RuntimeFieldHandle
KoNmNJWdcppIxeltwnPiWobNpjWITbj('r[:&$wK@;?]1"tA)A\!"
muUnKKfBvmqjccSMUbIhboPWjnsv],\6\%]qyYyuQl>xQBab:ybU$
Module
oDVJdFRBOYpctjnQGWUklvyeFkFec6j%j)p&tQ&{I)x8U_Qoot<Y
Encoding
System.Text
OKmpHodSLwOgdOLpZYpofyfSMeCCLw!IG"2Sy4&@tGR2e$:_h<2e
IeYGVWSBkiboHFRjpHaxQbDIBkndbV"|+\FWE{k@EboU5(@1X~ ]y#
AssemblyName
RqRsVTPrtCTKoBcuJTTERLoszkjtrb^!-)`(jr$E<u+ F4!,3&};I
bfbDdcrfpmfcGyIRdTBndUyuRELWaPMHA=\7is> [ZK4,\o3?T>d!
QriesDBlVAvSLfKzyOWiGDwydcVPA!yU$dKU@X60s~=[|&TFUOmZ-"
rAeoIijlkbErsuxXyYwjGPSHOsXe;/o=Ii)}A85"REg<*(DPRv/x$
DiJSjKIgdktRyKTAelLjAhbjgTQq~>>-Tf=yAm;-Cd]O(XDE$`3J$
akcHiIfuJtEJTBqGJaKftqHSWdCR")Yuh1XpmT!BL+blUNCp@*O'#
Stream
System.IO
pVhQvoRuYnjHMVOXwKbfVPhfyIqW,LO;"0>d;B%Fx>s_YY!Q3_0A/
OBrKfhOOhUIqwiMvbJbXeZTFUIWSb=QUk"'[d"W2c(wAR`*0bdX@'
EPaVdAnkYbkTLRzlfOsSiVYETjvql~IAR,$d,t(rp/Yk82_Z-GQ})
CvyWNGJKVlZOfbMLUWCvuQZooSUG+j #p6)@Slo?a<-HWOsh{aNs!
MemoryStream
ZUpwVahfDbvmFytXSJJPyphvYODJn'"IiY<z$OdC))hJBT"w}>/-%
nYgdduHOaWTGWPViWWVvkKaDmhyPA7",;Y]2GT-(nZ,N)Vs:SN5^W%
DJrYxjTXSvspChkldamZqjeWhTdwv6*5}NjBAu'+*_1q=xwu%\]A%
RuntimeTypeHandle
zJVvQARKhcOvdGUvYLaosGRetHQDA#H&p~%Yo\qLPzPfi"L61(FO!
sZBJusznLLXnrySdsSMftJJOenRbA?X'C3#c>Pa3GQ3[|Jis:~5r!#
MethodInfo
lItYkShWrnmkdTqpcHpRCGJUvNWBA{5/yvK,*Ya/oB* *a+H046D<2
aWlFZGqsDfbHGhLkUFdMNGvTFwrWAQ=;)lXYbQ@LP<"|]N+VQ:A1e'
MethodBase
hipLBmFdjqskHBBNDsdBsDJnKFBCiA)L:LA"ZS:T>RJa>,V-wf)R
pdSHXaMbGGUxTvwlwDDAxSilNQUTY!zj7B]D\;\aAYyX:yi"sHby!
ochmPyvDdUsJVFDoHybfRmnJGrNs [7Z==`=0^lU`C|iMBn]Z14r#
Thread
System.Threading
ParameterizedThreadStart
NbVTYUsaLfIVCJlIjTndTLRMrdBm~p~l>o'k1Pb^Bu?6/hFFdctY
NiVfdpimuvbGCpSkeHlkxlhLPBrXAh,zUsUW{5v#~dq?U;Dy9x0aE#
DXPIOAtyCsglVtOmZwGEFpkoginAAlU:rRED8K,4UcO>0)rz }wTm'
FiwXBvxuqCsWfSrWLAHMcOyzuMMu<5*#{EI3<\8cDR#'K+aiw]bP+
JHZUVloBLqAQKRacNBHUxEiyblCb:L(!jEDcD`#ra3%\\Of;KwgG
fGPIJTCPaRYVfHtjgcHORTppBtcM"C:HZxX[FB]42K;|,fzWwy)}"
gogbQrPYsVjGoaMXwElkEhNSkDlqA$S5f(`iG`Re1[PW{m/gx!XA,#
CcaEulTibEIKCBxGeLUIhBvLZRZSx'YvS<m$h@d'pdA:V15k0!+`$
FtTmSNfstVScWapFRDbEQxwfCKzDJ-xC<aeI~~7$/"B`pTR*g@WO!
DQyVpLIJqNeNqADToZgBxywnwmroAt _svF4kp2k'6xuSX6o_]4_5)
AgmezuewGDmBzdTGzETFYySWHbWSpfy",Sx~d|m=8%Obl<ZX4Cpb!
jopRblTPYkakztIBXDqdSVxcdRFIAcCiwO1<Pcu,PiDLy[iRU[8qt"
AytuESNroTYvbLQRPwIlUtHAVIZd)CKy~B(Nh6GbT>B,GX)YNf`k
HOXqLqxtILBHIeWjHPyxtIFuxmSkV>l_I}FPt:PYCA+~qX1T/md<"
zmNoUbIJGBjDHFDHYNalnvsQEeKKA&$Xnu04bF84AVT>"0EWK4S>x'
zMAaEvgdvRgFagTVdLMFjrRcXxVKb"5d>95,e|@Q[F!Ih:|uB|MJ|&
SjzHVbAolCGwSxisqVaNnMkZaYXK>((+ +<a~E5P"7aW-P1YBBf`&
UWfgyFXKKNgjvIujqgNiYcjjguzPAz=cQ+W\zP(!5q9gd1"cGYVE$+
RWVyJXTdsXEKutsMRsfCHzNASiNB#6X,fZsrP%6u/vbwS^"&Z-_R
zaoJqiyWLUoPmNHYpWRUxSHSYPgHu-cj9OX!x{(X$+ApveINr<[%"
gZXjRHwnOHSajDnmnFdHoUhOwvUx&X~N~sLTJkqNv[{WX(k*89@)$
rpMjUXxbTbCpdFZokhlekZXcNpwd9)jQZ$'GYl]!N!G}aOoB70c#"
AuVIMGQZJPrrkmsGeKHofDPWddrq#~F-@xX'2E5(C!$r;=O^N5`1'
EtkhnZZVtKsoCZhNLIwpbjggKzGRA'45_N|c(`g+dRp%(*?k?=$Bb$
dUTcyoDuSyFxdMQeFqWWRRQhzFSmY|X;m==#9?,Fp"`z5'R#3l"P%
HmrYnAsGzKXJIMHsTEnOWOmeryoB4K7bG7|4^8x')@<FS4jca*US
BSfZJfyluQLENxvQrnMzzgBSBIczn@{D,L_ejdhim^Ktoy,DR403#
TnPamddoCjEQYBdzSxfaaXiDGVbQbtW!33EePmF"8iw%&UQNi#lP1-
jOloUCsFASicCRedyOnIAmvnaPPSu6o_R_rNP$!&zwS{llf}I@+7!
VNrXpooqEWTlmQkyphHQCRVLELzVd; i9ES%#9[<>YKDKzXZfJN}'
iOlHPazPibVdNwozpfGkGrACcJen1/k0U 5a&C#5,QWNqm+ZjVD=&
MqWJnQVIDXItkEUVbcfykEytzyaybMR5%")'^$>Cpb_$%_h&QTiO'
ValueType
TtuOWQnHTdgGnPBXMIoYwulbBkQTb+;D`2M@=:10XHt 9zY5k3Br"
izGGseDCTybZzLsaHPbRPoddmpyFAK@<i aDz;hC}9qlq^TkK3 +G%
jYcBqaFzfXxygqTGCVegBVWlSkqMAEdEUAM{uTKAGv2|;>?@P?s-S'
bFwnnzWgEmdOJnpLzCzQbsGaDmqCG/`"w>Em_M|W3(/B|yJ "6mu
IWudNlmITPqnprkusCCfXpyOrHfSP\e`k[4)V&/QY7M!Y)'S6Zr7$
mLIbuneWEfGJwPijcpwyFgTGIyktA&V|wkClf7bk6_,O?4Gup!*"Y/
VHwllECQUBDWUiFJMMmJnPexsAWCRo'sS'D!lzjyj\8na$+)3YL0!
twjoIferNbwyPencyOXdwHDQtDtK*Gy=MW-dm[t/L(*JSGq`#U#q#
UQqoFwTRItvrxtBDBIXFhjdcuOnH%ASc*!)zeYsOQFLl%ity[Q5h
ZSuzozAxjpLywsVlTxsRjZQwINVCpgMw=Ni-ydgK-ZDE%G3%5jVV!
Object
zwzqLPQSVYJProwvCOJJIAsahUXX7Go_H<F@DV"$EYF^$^8]w%(J'
tBsCodvYAAdqHwoGyVkfzGQmiNFK{i?`I(`t-mDa/\A)&/mj}I::"
afVhSovKVLsOqThFuDlybKZnnwrBo'_m[]#4^kKH=% PWq8fsW*T
ezvCVPHpMsFLorRTumORZhuKOhtjbY"uz@U3vG!o2'bGZotqSli`9%
JMhJSTAOgjCizJIqpShvCkQFnXQrAhI3@j#+W(U?$`ow16g9J\<a''
EUXURbdNbczuIgJafhZWduNuGytgA@%T4kAk({*%Ss Yf8\9\?&-q%
EMtwqnGPgrthQZQQoJEFSVpCnuHI<<m$I:[ m!NPFU\\Mx]'"D5"
VWsvXVWLfHuOuvLJTLsDheEzpdexv'}6r>2kd% ?!x([J&8*[$]/
nffKoToArXshAaAzDfGIUtGYiyhj]XYZfw_1ZwPG#qd76\:<NoeZ!
ouZwhHSAQaaxDjHKUqewrBRGyRMX?~D&2<D0cY\o$vzCM?I0+p/N$
buNcwzbNYGoQUgmYgcLYrONfqcztB |La;;:\T<:bu4{PY%p45G;90
LLpbDdwcCkqZDBaCpgEzpEvbCMlfAFPGLA{j!;~jR<8E)IV9uwnYx!
zWqskjtCeeCRMlnUwYknBGrUiSVS9l;&A&s#O<Xi`H"6O7p %#+X$
WHlGSuGzLSNgKPXXAyPaWlAHTNKsAF,E@_dGTTa`\^L`L[];4-#8P-
qGyxGkpdFDlnLTEbdzvFwXgcCBWiY=&3I;=)2SL7!;;W-lOu3Pfo!
zxwwYagsOxUgfKKAgzZbxeFPbOajAS(1baMq)}WedB'$F{YYLvn/?#
busVgXNickPjrupzZkJSdPFVkfGba[<t]X1K"DGQah>92,L=R_$L
SAmuxuvhygBYRURIgqYozuieJgEMfQgEg2(?*h8"%4y|le_m9AK##
XFPJdufVXesiTGDRrRVHItdobZGq>BDKCSc2S{V`0jc>F'xi{#O6$
oGyLjMuGVNEnBKvBSDLauonYpZOiA}_$,|!qf6?BXi+xV,3k5|z48%
PIYpHKHIDlSzWUtLlJFfAJfjaKZIV\v7r6+Ii@R<_yk'(N"}_E-d
OQOgOFYaWQzQcVHSKGtEMcYygIFvLzlWXNQ<F3Ajl4npV%a~Gp~v
bTtFfycJaKaXbAqDetOjjJxnjNw7bK5?Z\AX)g]}x,0>q%WmXy!
yizVrbZrBBUuVSWJleTRBAHyroxwwv{]3/td-A"J<vo4}v\\$};i%
TYHTxHAMCQaAHYWOtUFNIknqhfnBA>l)EX3<>`BBrj)uVvdhoO;;/"
vAVcgxwrWGUdzpWvLgWPEhdqHaEuID^kSe$d\q"_ic!o<qf9&uFa!
LSDDdSMODNQFhMooEcyBeSbOuCOTAvt4 J-s#v@ANWM~edK:IxZ(B$
ZkzQgAjpZeiuaOfgKppifEWVsrbw\?s=n*QLS k@dsh9TmGzd[a"(
QnsKKTjfLPKhpbvudekOcpHNBDDX\vi|TAF:4?q:SQ9,f[(-%@E<$
OtxjOHUGIevIonnvSaOvMsXYsotN%Q}r@)K|G|{N*ItJKOdv# 3K$
mLYyDnIwtpAQsvjTFOysubZzKHBx=9d|m@'_3rIw*~>S7N,!CbBb#
zSPguvSccnBDFnlNRyKGUbMDVIRM_;xy]BiGw+H}x2F@XZ %`-~f!
aRiAxYhLHjJqSVwROaPWqyDWtlWNAK\GSBG+B]*-SQRN<GDo)+12%&
MEDxSUuKaGLKOenNCcwNHkvPFepnAlr0+p>"=VF^m9vVC@YmSb?8A%
ufCOgjDelsCuneqGPEdMmwYNqUusA5{2Qk 2,[;4Q*VT;(v{jRFz}*
sbTcCDAJwBLDCvlTdVuEeMgBQbBBAAgXd::'5b<r_;L}1?@N7x{q6#
OKuBcKZbSafcNdsjeOgblmnZAIxhbBO&9NH*`OI#S9OAq__Gk8'^,#
qoDqYqBBqQEZfBWYUmhkAwWWxttrAqCr\U()k'p3=b''mn"k6z5CW,
iEnKTVviHVAbXObETaBbbSqDccvZ}WI|ZI)XlNn#d\V-e:o{X;CS"
FsXhjKfTmJkcxGXiTvfwKUVigufT~2Pwl[W bEarPav7c-vT3"JA%
UJRlhCYeltaocjjTGisxdCsfzBTWbJcBm#+RG(uCF1H\s-/-aeVbX&
WVAJKHgUSdTerChZvkITmaDcNAXs~S%Z)Kb\KcuX6!*x0SWnw%O'$
skaPAQIlyVlamKQaqkqTRdGCYWpqc!{!X6@m@{9e4wuI7-:0+4lq)
KZUaMMKnEPaHLbkYzNXMWSWWwPPef5<w#X=+09LWmf/xTD>D@y|1!
gpIUNKxaPzoVmSNcHtxYKFOXcBvgUc`:TU<3?k7RCCXMb+n6FUKi
bRpCqXJkWibxMjErTuMOdydeRGcMA7y$yDGS!_Y`+-G`f;0;s]7~7'
dIhdFFGmOgjSAFyJEDYuIcDuZTkkb?oI0FF7>e02dsj>f 91|hKBu(
jpssSJigktSNoXpaspkKDaEkXBUUWa_Fd&71q|70'M(imF^65%Fj&
kZogzxGjuTdwIDivlqmIYlBCdwycb$AuSyV@?4$7rsUM*d>odx"dk%
IYXZgkOGgKDJyEFUUBJFUqIUZmbUADd\{/>fq%HgLJ|h'2%Ob#oZ1%
nvhFCvpkjcCkmTVkYmUboFIelgvOcwO@3C/;{5?F<7`L}NSxW$"s"
CusgjmxySPNfMwHmtqRZRnCmDevdA-5;qW1NRlop:3*I<5hd!A Kg*
AXpZdOEHigCDBOWyxcCjkRXUbiuab)cKu8>\["84})a 6KaR!HWdO#
rQDKsOFcpFkHhFYVWjZMzHCtVgCIKe`>\!G_z]K!+jL"n;*^OD+<!
qlFOtaQQMefyMtvfXVNsQTwBFyIKi"|Wm*@'UY7@1{+|(S)kH/eB&
cutmPZqEpEVRJiKrVICsUJLEidRt_nOZ@=a*b@nf{of\G+pZ0?9%%
WirEZTzIPesVgDieLFufmmBiiWvnRiY)0=~-7qsVz >s3"}6KdK_!
ZtIhGMeVdvULJCAxuGZZFQFaPqpE0&)oRglo*z>NIBOZ<8WXq\&,!
jniOUahbdxdEbczEkqbGClPZmexR75i`C1pIk#uO>jegn;4\RsCo!
hvtRVbxUNqQtNIqPXfPQeXAEtZSTGKq!M89bWSl}ZHl\ |uXPnpv"
vyXkufkKswDwRXtgzUOUpykcndTEY+^Q?W)N}`jz63U|NC933O>%"
WdiSZCgMxTOevIUfMHaLJyCbxZxMXT n+-y&@;Ibr3zsLrVv=F+/&
vQkmldtTDCLmINAzvyWxYoDGJEtc +&QK7Vlvt+FjC9_ZZs)`8-G
GSueoFyeAeFmtLiEOCFPLAiKELVSJgwMT;h6=Le!@'hj)%rSlNj!"
mdDmtOFmkOiuJrEnTEwuAuDToZPFb&\0,z6ZGXsdc=;R($1,vt6n#$
xNVODpDgYqTidFKdRjGGXDpjhmEl{f)dS!U,mR1t(6)a)(2gwgB5"
lrBRrhlcvfwwSRxtmVJHThMxhTMOyz'XA3i99O^>|Emt#,%2od`6"
DwpbFKKvFoxFUQPMsjvBHVUHOBImAPa*6)I'vKb#4LP[:wX<J L%@@
xUgjcTVDXPArvzYfupseuFLFGsQhA=bWIJ<U>X=?/A7U*SPM|te 2$
CULcJfGFtRcbVkjHzHhgklQpTRcQ\~\aQ`>iVWNCv\(c"%C>s6_8"
CSjyJxWDJiuQXAkltgCynwXgTnVIBg,]M'xoqEhrYVqwsSODI!V|
LhnsQmVBrTGUabzBtFEsXsKnHaidb!<;\m?l]Vds`{N,#'Gmp[m/U&
iqjLuetKeXllwQYIapTKihyHeJQoCjeSCiL_4{i*<J5c!im/f~+P!
IVEnbIkyIJtdnxIQcYDcHKkflQFRLp<,p',r^35`qX3VT[4,*vg-#
sznVlhsRPNgQjOcmMpTWPNpQfaiLGJW6a5E)ju]b&G+ePT23#i/>"
vYlKKqMKOyehLDTHvCoMhUfcnjBv;WE`s!%Fc&j\^H/y1@C"9gm4$
BUaUZXnOwFcywCoWhINciCtbGeehpauvhA<uv3W6M|S|A,i-(nas!
qBPipvJneZuSnRKKLnuKdFrMgIQqAECH(o_c?~Z}@dZN;-'t7)*-H+
SpbjgbKWRktEwsKgSFLCfkWqOLjTdLQkk8LZ$ZgV158d"'?Fo)8/(
bodDQqvbASjgGsRnACXmeSUTlCcAAco3pISs+-k+8(K'VY]t:0'0q$
NyjrQvLAuYgkDdnezgiHezzdvowhcrN(v;74/L['xs?e#1)Wc&I=qG
HmfWrPSgGubYrHEutIDrMPwpnTsP@u/b'jmPQv3HmeupK00?k8Kn
rOpWVexwIpCnLMItfQVyvMeMxkym{}qv 3E~a&pqDmAl]$kYXC8u"
YfjvlKFrfGWkGagTEAoWVDpEljKkH4O5hFDslZ!y/2#fNP(":[8l!
FvVUPGYDAfOjtQNZgBNnbNRNoFoAAv%PPt<Tr,(wu't9r0wjh\-0*%
hbHKZNdAgtGpeBUTXKLYiAMiSBOZ}<>^P("q1;";^HN`kfPhiP5!$
lrdLeKjJnyLTQZWVwecWdhuOUQvL*I&2x*(c3r+FTZSKT`I,>l) %
VxJgBJIUYvvIIbVsniWdRqisuUCmAR>llh[hF"2pv@W&HyHy"A\V|#
sABSupEZnsJdZRIjEGRjPqlcIlJAAeQrI1%-My/$xF pr`{:"*+$L*
QmfMfiEkpZaXMigLmbFZtHQhOvuI0_&@O@odJM>MEymu85JYyRkH
BWuSdvRynBMrAfgXmgzEVYLyDCvQ%dsf(!Z98:`<C-_K"\p6*6o(%
BlcDxIGsWMqnYGuYjaDEIIrHLFnl@WEP~B=BVyLFYL(Aj7zQjhQb!
pZEsKYhqUbASefKtmxVdSrOpCIYwUP)pz9WH&lGX{wWZ8_DvYNIl%
chjhcpBUbSiAzVxPDzIcSSqOSvZhEw;Gk%!Kf(=NbxdO_<@5tR^-"
IVtdrQVKxgJNyxBwfViOGTyCQyrPF[cgL#7Qu+K2oSS #0R]L};["
xGIoxpUEBlhNsckFgSaKKspDAZSJA-@I{F(6GvMYml"wNYrgfX=f"
GluEpmbrgiABYefIeBKmNZHHSiPKbx0CckPkM(vpdg#D:A]264'*V)
CChMOlPOWLgHKYBmQCqiWgmGceHv^U34;!HH'EjFg7!`U?fk+5nP"
lxJQcvVXqJxntHapsgYBFtXGIBPoAcMTsU-nqv{e@<OytLxKNFnZL&
VfXcOBjdycvdcvrMghgXHMLFRKHlbpk`2v@OgY*&J&J=whb\x6l%6'
gDHAxTiMoMRzKcAKhcGKEBrghlJd=Z\xfGjc0PPkt+A_+FUD/3Ps
tjBaRgrLuxtVjQQsoGgSNsznqJFX"1f#kc&_?|WW@gcO4vfE=+5@$
coRovIkhJmvJkEFXuUcDCbvVhtzJ, Rcjc6|w"SN/x?!p$6IpigA"
cAZfpeerbaOuYGlobjkVdDWefxHm{-F=Q?buah\D< g{-h;L"/hQ"
UrCSCgRhEhOCXDOPpKBOhCNjbQqe!#HzD:5"_ZJBtKM-lqRC/] A
pkizUXBegveGGjOSPUXzPwHdXVwTc7M0FP-"AT:L'Zx@w7f<&NFc%
PPmebLHSvCmHEkIjwwKOtFmYoiJRA@w]k'M0EVn:{ZI,0LXd VWLh$
FCuFeybmwOSysHBAdFmKUEUvzeBfNr&Xic*k<VEDwj;Lt|8F[9J!!
mUpXisPMnuGiCAbqLkXUQeAbkVAL=E&`(v<9I\~,2?2mxPp0gkPV$
hJfFGSDKrqzfPTicVlLkapDTAnAXqjK\>B@}w*!6|[0H"+?@<u|z!
sjeQmBzHHCIAMnyeABdddhntELjO1]WRVo0s6>+ [^LDC5^3C|iz
ZTTmrfgvZjNpkARiXSLQywzkElMWZnPg$ c`_$e?vqFddZ,&=_MD#
kLprCjVqgwiRZXexNBUeIddxhuLx{@5zK1t*=q-F~]L6R(!O3 Gl/
ZgzqKLpkDBijRiEJzlFuqVulkfdsA4;?Z+1u\<3!<bF9BD?j7C}#u'
NegFgKHEmEkjHywDozbXSxToocrwA@(1AF]'m'W,fA4q7;0}+$G*A0
muFjsYRkSiqvKoEEyUQcbKqhcZNcA*RZO8vN'GkhRI@[x#cYWkn#h&
wMdDGxfdrBNZLzqvoOYrvacNkhhZA/tu\*E$Mt)6xOuK'r&Y >L$o*
UJBaCKSLKCtfYcAeaWeWMafcjsHiAZ1fd0<!LtKzQ3$OA?^pK?QYn'
eDsDqMBzZWfdXSEAAonOZYfYptcW/dQe~4gL~A<Ba-#;xF!GJY2/#
MvHfAjYXAlheNyboWHrTRVOXGUBd:#S5^N^,8*j5iFJ@8D h2|F'!
lVLUrVEtDFwWahtoYxSpUPCsKdiJEF^+JTdPv{ik?KDk1Rj)(dGP!
RKolpMCLOyrSlOFQvErfSdCwDkke<$c3^dR8g],ZUvqtkz}cy!uq
IHcDxgErwzFsCDDNVQpQyacVcQAiA`h1?w>iEYE!&)bb*J$]_XDBz$
HQXBsVLEhXIIGjnbYADcPKGfpyAR'9TBxHq10BF*" VDUU^J"Y1##
kJsuKavEoJRnVELIACmWJtZHbIcSAQ[s`W4WId,!+PrJ$;8qV4--O<
jpDqlBWNEeEZZtmmuEEYVdAsqHiC()xsv003}%D(EiA%b@[UW&GZ
xnrGLoDpfHHkhlFRxFsBBqoIOTCx7=_L;rD(d-3/yf1&83~YTt/d#
gYKAHTdOKqmQbxbqxYZPGVXgcqnTA?dL)TE2|o+IT&O <EZ6D=5*$'
oCqvsAbrqdXKDBGHEqrgTdGgGLUZ[p5iT21a/fzh^VjIY{Hrux|`"
OpLZKntuxZebJWvIUIYsgGCDdFOX~YDpm:mqV/n~~Dt@!y*)8&)H0
kUKIjnKnQYeHkxTjBzhgFrrRqgChIFA6_+(@~]y=NT6cq6^QD*@r
dbfkDhASzKYOIFSHCwIEmcsAqrYfc9bu=|J|VN@vR"0_Xy3/%_-k
dEmKDMZIXiVxXVsHkgMpllRLInnPi@GfH'2fEW$):hY5#c]>>tY9)
lVCBIasBdYTalVaCUpJMpXHzUoiQK[bV;?jWf;wJ\2Vx@La`MI[0"
OBOYBCONJTgJgzvCZnvXokaSxFBX<-%):Ibp)j=]W'H}B0$q<>T|&
gqGBUdCPnwbzmdRFROuwEqoZPfTEb9UjNM!{e(G]p9th3(??{t?7!#
LJbSPGAIfGgUKGKbatvjIMNjpnyIX]&J+D!s!/0HvK7{"8FtyS"B!
lmaSqbvXSvNpMKFfzDjtigiEAHXzA=^oKa'm8(_f"~e?_GAKMd6%\*
IZusNuUojeWFvHjgRjmvMpLmTkmr2mcps%2IGx&ofO0CbW<JA((u*
AhjNbnxAFaDjZTgiXMEVNvGeOyHvtR(-3AbNqWTf4gr^26Z~*qvr!
CTZGuImNnFNBOKbRgvWCapsKcCSRX4~S!yOGX4P<4t[%v/$CT4DH#
BjFWsabGYNyKebtFSXfhLooaIybqTw^yy71>:b/G;rl8sCl[yMoU)
GtnutAwLsvfTOFjwkEHYVbKaxLaNAzeiQZ9}_yBnUQUqhh:12U~Vq"
PiDsADNSWfImsmemueWcpfdWBIZeA4='\%:hvoj]5gQG|Z?cw|+)z+
dcNbTJvIvzzAXVwQntpqTqpThGtdAcEDLzEvA_z)r8X*$[`2?vt89%
AeKurpBauLQfItGMkkkaSMnqkBFn:WnGC:eIRf-I2<S*I3`g;%#="
hjIynNzzjlppsfNoarnREWxFsoftI6D;LGo?CO{L=ck&B#lk|{\k$
oPZnxegxkelNLNzSITUFLMswHMciW\tc sB33(R8|~4@BZJYk#[K#
ZqHxInEeHqSmcuycjWBSubHVfwNGjd3}Ob"23h97O+Cn%QKNt&z^
vomhRKVjjKotCzqJZDNKoMMpIVDPu-94+`c?8g^A{<24)[=vEPIZ#
SnojuFGHIMeikatVZqOElgblMVhlAPJk]^tRv^;3J;>LN$ve5[>F{"
AldSBqsmASjotjdghbJnVUFuGjbab|\ubY(KVhWYB*ocnBmrf_e+m%
KDmdiUBlwdbBZCgSgEvYyrtrbDHzARGU_Br@]q|FB*pgy!){Sg |V'
XKjEpsICDgdXTsBBCngGjPUemDUlz^7X}LdGoQvQ3BbqB&1X/;Fe!
hZweuUaedogKkaDOuueThmYWfrAWAU|/]83-AujmWF2ug^jWZ`aRC"
qzonaEuptibUGGMsJzEspzerhliTOtOKf"g5Y%n}hez@iom c]E9"
qkuosfChunqEoPBUMNsnzBJBIkriA_!e*k/6U,Vi[XLbCB i~D(aM-
MupPmRvTkuGSlPpnAFIgcEmOSTEfA^,;Iv:=,5vc;dK!~Ks>wbvrJ$
fZoEhWkcKExqOGVaabbcCCvxCSaEby@738XC^0&ron1k{uANA[d%?%
GbqyTlIIjwgvxpRMyzeMcioZkRkTppi(s8AJSuQkns&CJIAy||aA
AgYveAoLxysHrIrjBrWAJMXnraXg8v0w:I*C/Ag+V7\_x:vZ7{`5"
qezhAfIXLcRoKxrwGuTvXCYAvPNNe"SFY)cx5MBMo/Ht(1p:h))j)
YVddDFSdVAcToXwAzwLcmkZLgAxyJcQ{r+Zn4\KV'l{h?VOLNlk3"
lFikOGFHbTcIYvxmvaCohnyBbQwC(g#?2\Rpkm!UkCA=ueA)^3q1
AssemblyTrademarkAttribute
AssemblyCopyrightAttribute
AssemblyProductAttribute
TargetFrameworkAttribute
System.Runtime.Versioning
AssemblyFileVersionAttribute
ComVisibleAttribute
AssemblyCompanyAttribute
DebuggableAttribute
System.Diagnostics
DebuggingModes
RuntimeCompatibilityAttribute
CompilationRelaxationsAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
AssemblyTitleAttribute
STAThreadAttribute
UInt32
GCHandleType
get_Target
LoadModule
ResolveSignature
AppDomain
get_CurrentDomain
ResolveEventHandler
add_AssemblyResolve
GetTypes
ResolveMethod
GetParameters
ParameterInfo
Invoke
Environment
String
IntPtr
op_Explicit
RuntimeHelpers
InitializeArray
GetExecutingAssembly
get_ManifestModule
get_UTF8
get_Name
get_FullName
ToUpperInvariant
GetBytes
Convert
ToBase64String
GetEntryAssembly
GetManifestResourceStream
get_Length
Buffer
BlockCopy
ReadByte
GetTypeFromHandle
GetMethod
Concat
Equals
FailFast
set_IsBackground
get_CurrentThread
Debugger
get_IsAttached
IsLogging
get_IsAlive
get_Module
Marshal
GetHINSTANCE
get_FullyQualifiedName
get_Chars
GetString
Intern
GetElementType
CreateInstance
op_Equality
.NETFramework,Version=v4.0
FrameworkDisplayName
.NET Framework 4
1.1.1.2
ppphhyf
WrapNonExceptionThrows
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
9ARCHIVES_DOCUMENTS_FILE_FOLDER_FOLDER_STORAGE_ICON_191100(
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
ppphhyf
CompanyName
ppphhyf
FileDescription
ppphhyf
FileVersion
1.1.1.2
InternalName
ppphhyf.exe
LegalCopyright
LegalTrademarks
OriginalFilename
ppphhyf.exe
ProductName
ProductVersion
1.1.1.2
Assembly Version
1.1.1.2
Antivirus Signature
Bkav Clean
Lionic Trojan.MSIL.Voda.a!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.37273060
FireEye Generic.mg.3f6b84ccd4292674
CAT-QuickHeal Clean
ALYac Clean
Cylance Unsafe
VIPRE Clean
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 005744781 )
BitDefender Clean
K7GW Trojan ( 005744781 )
Cybereason malicious.de13a3
Arcabit Clean
BitDefenderTheta Gen:NN.ZemsilF.34050.nu0@aqyBHul
Cyren W32/MSIL_Troj.AQW.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/GenKryptik.EWYW
Baidu Clean
APEX Malicious
Paloalto generic.ml
ClamAV Clean
Kaspersky HEUR:Trojan-Downloader.MSIL.Voda.gen
Alibaba TrojanDownloader:MSIL/GenKryptik.d822a422
NANO-Antivirus Clean
ViRobot Clean
Rising Clean
Ad-Aware Trojan.GenericKD.37273060
Emsisoft Trojan.GenericKD.37273060 (B)
Comodo TrojWare.Win32.Agent.wbtnw@0
F-Secure Clean
DrWeb Trojan.Siggen14.45341
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Generic.dh
CMC Clean
Sophos Mal/Generic-S
Ikarus Trojan-Spy.MSIL.Agent
Jiangmin Clean
MaxSecure Trojan.Malware.300983.susgen
Avira TR/Kryptik.vnhxg
MAX malware (ai score=99)
Antiy-AVL Clean
Gridinsoft Trojan.Heur!.030130A1
Microsoft Trojan:Win32/Wacatac.B!ml
SUPERAntiSpyware Clean
ZoneAlarm Clean
GData Win32.Trojan.Ilgergop.ZC7E5P
Cynet Malicious (score: 100)
AhnLab-V3 Clean
Acronis Clean
McAfee RDN/Generic Downloader.x
TACHYON Clean
VBA32 CIL.StupidPInvoker-1.Heur
Malwarebytes Spyware.ElysiumStealer
Panda Clean
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002H0DGL21
Tencent Msil.Trojan-downloader.Voda.Lmvb
Yandex Clean
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_99%
Fortinet W32/Voda.EWYW!tr.dldr
Webroot W32.Malware.Gen
AVG Win32:Trojan-gen
Avast Win32:Trojan-gen
CrowdStrike win/malicious_confidence_90% (W)
Qihoo-360 Win32/TrojanDownloader.Generic.HwMAun4A
No IRMA results available.