Static | ZeroBOX

PE Compile Time

2068-05-10 11:34:08

PE Imphash

4328f7206db519cd4e82283211d98e83

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x00026000 0x00025c00 6.25183661346
.sdata 0x00028000 0x0000102a 0x00001200 4.00401642118
.rsrc 0x0002a000 0x0002e9f8 0x0002ea00 5.25629457933
.reloc 0x0005a000 0x0000000c 0x00000200 0.101910425663
.idata 0x0005c000 0x00002000 0x00000200 1.14864242974
.themida 0x0005e000 0x00514000 0x00000000 0.0
.boot 0x00572000 0x0031ce00 0x0031ce00 7.94814048463

Resources

Name Offset Size Language Sub-language File type
RT_CURSOR 0x0002b3d8 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_CURSOR 0x0002b3d8 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_CURSOR 0x0002b3d8 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_CURSOR 0x0002b3d8 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_CURSOR 0x0002b3d8 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_CURSOR 0x0002b3d8 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_CURSOR 0x0002b3d8 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_BITMAP 0x0002b9f4 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_BITMAP 0x0002b9f4 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_BITMAP 0x0002b9f4 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x00031214 0x00010828 LANG_ENGLISH SUBLANG_ENGLISH_US dBase III DBT, version number 0, next free block index 40
RT_ICON 0x00031214 0x00010828 LANG_ENGLISH SUBLANG_ENGLISH_US dBase III DBT, version number 0, next free block index 40
RT_ICON 0x00031214 0x00010828 LANG_ENGLISH SUBLANG_ENGLISH_US dBase III DBT, version number 0, next free block index 40
RT_ICON 0x00031214 0x00010828 LANG_ENGLISH SUBLANG_ENGLISH_US dBase III DBT, version number 0, next free block index 40
RT_STRING 0x000443a4 0x000002a0 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_STRING 0x000443a4 0x000002a0 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_STRING 0x000443a4 0x000002a0 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_STRING 0x000443a4 0x000002a0 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_STRING 0x000443a4 0x000002a0 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_STRING 0x000443a4 0x000002a0 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_STRING 0x000443a4 0x000002a0 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_STRING 0x000443a4 0x000002a0 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_STRING 0x000443a4 0x000002a0 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_STRING 0x000443a4 0x000002a0 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_STRING 0x000443a4 0x000002a0 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_STRING 0x000443a4 0x000002a0 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_STRING 0x000443a4 0x000002a0 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_STRING 0x000443a4 0x000002a0 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_STRING 0x000443a4 0x000002a0 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_STRING 0x000443a4 0x000002a0 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_STRING 0x000443a4 0x000002a0 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_RCDATA 0x00055828 0x00002092 LANG_NEUTRAL SUBLANG_NEUTRAL Delphi compiled form 'TWizardForm'
RT_RCDATA 0x00055828 0x00002092 LANG_NEUTRAL SUBLANG_NEUTRAL Delphi compiled form 'TWizardForm'
RT_RCDATA 0x00055828 0x00002092 LANG_NEUTRAL SUBLANG_NEUTRAL Delphi compiled form 'TWizardForm'
RT_RCDATA 0x00055828 0x00002092 LANG_NEUTRAL SUBLANG_NEUTRAL Delphi compiled form 'TWizardForm'
RT_RCDATA 0x00055828 0x00002092 LANG_NEUTRAL SUBLANG_NEUTRAL Delphi compiled form 'TWizardForm'
RT_RCDATA 0x00055828 0x00002092 LANG_NEUTRAL SUBLANG_NEUTRAL Delphi compiled form 'TWizardForm'
RT_RCDATA 0x00055828 0x00002092 LANG_NEUTRAL SUBLANG_NEUTRAL Delphi compiled form 'TWizardForm'
RT_RCDATA 0x00055828 0x00002092 LANG_NEUTRAL SUBLANG_NEUTRAL Delphi compiled form 'TWizardForm'
RT_RCDATA 0x00055828 0x00002092 LANG_NEUTRAL SUBLANG_NEUTRAL Delphi compiled form 'TWizardForm'
RT_RCDATA 0x00055828 0x00002092 LANG_NEUTRAL SUBLANG_NEUTRAL Delphi compiled form 'TWizardForm'
RT_RCDATA 0x00055828 0x00002092 LANG_NEUTRAL SUBLANG_NEUTRAL Delphi compiled form 'TWizardForm'
RT_RCDATA 0x00055828 0x00002092 LANG_NEUTRAL SUBLANG_NEUTRAL Delphi compiled form 'TWizardForm'
RT_GROUP_CURSOR 0x00057934 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR 0x00057934 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR 0x00057934 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR 0x00057934 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR 0x00057934 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR 0x00057934 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR 0x00057934 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_ICON 0x00057948 0x0000003e LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_VERSION 0x00057988 0x000003d4 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_MANIFEST 0x00057d5c 0x00000c9b LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document, UTF-8 Unicode (with BOM) text

Imports

Library kernel32.dll:
0x45c078 GetModuleHandleA
Library mscoree.dll:
0x45c080 _CorExeMain

!This program cannot be run in DOS mode.
`.sdata
@.reloc
B.idata
.themida
KDBM(l
Y_c
Y_c
Z?_d
_b`*
v4.0.30319
#Strings
Cooperings
ExtensionAttribute
System.Runtime.CompilerServices
System.Core
System
mscorlib
CompilationRelaxationsAttribute
Boolean
RuntimeCompatibilityAttribute
DebuggableAttribute
System.Diagnostics
DebuggingModes
String
TargetFrameworkAttribute
System.Runtime.Versioning
Cooperings.exe
<Module>
piJ91Iw5x3U8hTF1yZ
vJlLwkbFBHgKpmrcKR
Object
Chr_0_M_e
uHtsRvyOVrdc2xWqjL
fgfWx1QMnbFoupYE8D
FileZilla
E0Bucb0cqX2MZoG18G
NordApp
CryptoProvider
CryptoHelper
StringDecrypt
EndpointConnection
Program
pLJaT7rTKH4GadnHa9
EntryPoint
FileScanner
RecoursiveFileGrabber
AllWalletsRule
ArmoryRule
AtomicRule
BinanceRule
LM6xVydvg1L3FmDOxv
CoinomiRule
DesktopMessangerRule
DiscordRule
<GetTokens>d__2
ElectrumRule
EthRule
E_x0_d_u_S
GameLauncherRule
GuardaRule
mYDict
OpenVPNRule
ProtonVPNRule
ResultFactory
ParsingStep
MulticastDelegate
hf3GpiZRXTjJE3yxjl
QoF6bAW8YqjhjiYFqj
DataBaseConnection
CommandLineUpdate
DownloadAndExecuteUpdate
DownloadUpdate
ITaskProcessor
OpenUpdate
TaskResolver
susVlTEqJZ66uvP53F
Extensions
XmaGBrpRKPb27r9U3v`2
dLr2hi5BtoF969wPET
GdiHelper
DeviceCap
xjM1iwGkJfGTZDxuhW
GeoHelper
NativeHelper
a8P5ZjvMoRwTAtbXf9
zwseXqCZSBQIEOZf5F
SystemInfoHelper
o9ns2kjT8pw2ZwnBPl
FileCopier
FileScannerArg
FileScannerRule
IRemoteEndpoint
RecordHeaderField
ValueType
SqliteMasterEntry
TableEntry
Autofill
ScannedBrowser
ScannedCookie
Account
BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO
BCRYPT_KEY_LENGTHS_STRUCT
BCRYPT_OAEP_PADDING_INFO
BCRYPT_PSS_PADDING_INFO
HardwareType
UpdateAction
ScanningArgs
ScanDetails
SystemHardware
BrowserVersion
ScannedFile
UpdateTask
ScanResult
GeoInfo
GeoPlugin
LocalState
OsCrypt
<PrivateImplementationDetails>
__StaticArrayInitTypeSize=6
__StaticArrayInitTypeSize=10
__StaticArrayInitTypeSize=12
__StaticArrayInitTypeSize=14
__StaticArrayInitTypeSize=16
__StaticArrayInitTypeSize=18
__StaticArrayInitTypeSize=20
__StaticArrayInitTypeSize=22
__StaticArrayInitTypeSize=24
__StaticArrayInitTypeSize=28
__StaticArrayInitTypeSize=30
__StaticArrayInitTypeSize=32
__StaticArrayInitTypeSize=38
__StaticArrayInitTypeSize=40
__StaticArrayInitTypeSize=42
__StaticArrayInitTypeSize=44
__StaticArrayInitTypeSize=46
__StaticArrayInitTypeSize=48
__StaticArrayInitTypeSize=52
__StaticArrayInitTypeSize=58
__StaticArrayInitTypeSize=62
__StaticArrayInitTypeSize=72
__StaticArrayInitTypeSize=76
__StaticArrayInitTypeSize=78
__StaticArrayInitTypeSize=88
__StaticArrayInitTypeSize=90
__StaticArrayInitTypeSize=102
__StaticArrayInitTypeSize=114
__StaticArrayInitTypeSize=124
__StaticArrayInitTypeSize=144
__StaticArrayInitTypeSize=152
__StaticArrayInitTypeSize=154
__StaticArrayInitTypeSize=176
<Module>{8917F802-07E9-4358-80F6-610EACC5BB82}
KbRTBTcasIYJ256uoh
GA9fcVkL5QwN7eKG5r
j03hhFa3NfQo8EOYoD
UjL63XmLktg6rOiSRB
rGhUSL7h03PiJZWexa
zowFIqqNOTHxm3ycmW
Attribute
g1HZgbte1gdXcI8ueJ`1
no1YTfAyjbhvnrfhBC
agLPZGHgjwFdrIc99E
HeM7fVedW48Ef5GTK4
SLtoaclYpYq6jMHRyV
gRxFfG64BacamnCebY
Wae6ry39Dg4Crn9nGo
jX6hllXIdSK2HHSBZy
hOIKBu9i7DdKuNnAZT
z3e1pL8NnRPTgEfEhG
Fktl9XD2WDvLcYT2pN
JWmMCdi6kgvpC42BW3
<PrivateImplementationDetails>{8B82441A-BCB1-49F8-91E7-4A86C621F931}
__StaticArrayInitTypeSize=256
__StaticArrayInitTypeSize=64
List`1
System.Collections.Generic
IList`1
profiles
IEnumerator`1
Enumerator
Func`2
IntPtr
Enumerable
System.Linq
Select
IEnumerable`1
GetEnumerator
get_Current
RuntimeHelpers
InitializeArray
RuntimeFieldHandle
FileInfo
System.IO
get_Directory
DirectoryInfo
FileSystemInfo
get_FullName
Contains
IsNullOrEmpty
get_Chars
ToString
ToUpper
Remove
Concat
Func`1
MoveNext
IDisposable
Dispose
IEnumerator
System.Collections
Exception
piJw91I5x
Combine
Exists
IsNullOrWhiteSpace
op_Inequality
BU8bhTF1y
DateTime
StartsWith
Convert
ToInt64
get_Now
AddMonths
get_Ticks
hqJJlLwkF
MHgyKpmrc
Replace
ToInt32
LRDQNgLc9
FromBase64String
MakeTries
success
Invoke
KCk0OriQG
StringSplitOptions
ToArray
ReadAllText
MN2bUlcR0p
mDWblZAxLq
WAGb6YNjZt
qg4b3r3YEI
MowbXKiMkN
dUvb29QEK8
ckGbs4f4aS
Ae4bgMUtsx
oZvbLpxyJQ
qpRbK6TRCu
oR5bBGm69a
.cctor
UYvbNRk6wS
Environment
ExpandEnvironmentVariables
FAob9Nqnek
get_Count
X02b8hulVn
sggbDQinh9
O0wbijs2Bg
GetFolderPath
SpecialFolder
Format
AddRange
C9RrqHtsR
XmlTextReader
System.Xml
XmlDocument
XmlReader
get_DocumentElement
XmlElement
XmlNode
get_ChildNodes
XmlNodeList
get_ItemOf
oOVdrdc2x
get_Name
op_Equality
get_InnerText
Encoding
System.Text
get_UTF8
GetString
iqjZLrgfW
GeckoRoamingName
profilesDirectory
GeckoLocalName
nugbVHv5TQ
GcGbMdmhd2
G68bf5N5lL
get_Exists
GetDirectories
SelectSingleNode
BCryptOpenAlgorithmProvider
UInt32
phAlgorithm
pszAlgId
pszImplementation
dwFlags
bcrypt.dll
BCryptCloseAlgorithmProvider
hAlgorithm
BCryptGetProperty
hObject
pszProperty
pbOutput
cbOutput
pcbResult
Y1MWnbFou
BCryptSetProperty
BCryptImportKey
hImportKey
pszBlobType
pbKeyObject
cbKeyObject
pbInput
cbInput
BCryptDestroyKey
BCryptDecrypt
pPaddingInfo
Decrypt
bMasterKey
chiperText
GetEncoding
GetBytes
kYEE8DN0B
acbpcqX2M
CryptographicException
System.Security.Cryptography
Marshal
System.Runtime.InteropServices
FreeHGlobal
ioGR18GCL
BitConverter
caTo7TKH4
get_Unicode
nad5nHa9L
AllocHGlobal
P6xGVyvg1
arrays
Buffer
BlockCopy
DecryptBlob
EncryptedData
DataProtectionScope
System.Security
dataProtectionScope
entropy
ProtectedData
Unprotect
GetMd5Hash
source
MD5CryptoServiceProvider
get_ASCII
HashAlgorithm
ComputeHash
K3FvmDOxv
get_Item
CultureInfo
System.Globalization
get_InvariantCulture
IFormatProvider
ICollection`1
hf3CGpiRX
StringBuilder
get_Length
Append
QjJjE3yxj
A1ocF6bA8
stringKey
RqjkhjiYF
RequestConnection
address
ChannelFactory`1
System.ServiceModel
EndpointAddress
Binding
System.ServiceModel.Channels
CreateChannel
TryGetConnection
TryGetArgs
TryVerify
result
TryGetTasks
remoteTasks
TryCompleteTask
taskId
SuppressFinalize
managed
IClientChannel
ICommunicationObject
vjkausVlT
Execute
ThreadStart
System.Threading
Thread
set_IsBackground
SeenBefore
Directory
CreateDirectory
G0NbTuau2b
Bfhb1rlYuF
MessageBox
System.Windows.Forms
DialogResult
MessageBoxButtons
MessageBoxIcon
Message
scannerRules
GetFiles
SearchOption
FindPaths
baseDirectory
maxLevel
patterns
TryParse
GetLogicalDrives
rootPath
searchOption
searchPatterns
EnumerateDirectories
GetFolder
scannerArg
filePath
GetScanArgs
vJZm66uvP
n3F7PmaGB
KeyValuePair`2
browserPaths
get_NewLine
get_Key
get_Value
boHbOs2Zu6
VQBbSAkLMM
fgJbnQ1vPT
VXSbYaEIm7
bkebI01MIS
gRKqPb27r
get_PassedPaths
set_PassedPaths
fileInfo
PassedPaths
GetTokens
<>1__state
<>2__current
<>l__initialThreadId
get_CurrentThread
get_ManagedThreadId
System.IDisposable.Dispose
System.Text.RegularExpressions
Matches
MatchCollection
AppendLine
System.Collections.Generic.IEnumerator<ScannedFile>.get_Current
System.Collections.IEnumerator.Reset
NotSupportedException
System.Collections.IEnumerator.get_Current
System.Collections.Generic.IEnumerable<ScannedFile>.GetEnumerator
System.Collections.IEnumerable.GetEnumerator
IEnumerable
System.Collections.Generic.IEnumerator<ScannedFile>.Current
System.Collections.IEnumerator.Current
RegistryKey
Microsoft.Win32
Registry
CurrentUser
OpenSubKey
GetValue
Reverse
FU3tvmT1I
Random
OrderBy
IOrderedEnumerable`1
sl9HSDF234
settings
AKSFD8H23
asdkadu8
get_UserDomainName
get_UserName
sdfo8n234
Assembly
System.Reflection
GetExecutingAssembly
get_Location
sdfi35sdf
InputLanguage
get_CurrentInputLanguage
get_Culture
get_EnglishName
asd44123
GetTypeFromHandle
RuntimeTypeHandle
Binder
Microsoft.CSharp.RuntimeBinder
Microsoft.CSharp
CallSiteBinder
CSharpBinderFlags
CallSite`1
Func`3
CallSite
Create
Target
CSharpArgumentInfo
CSharpArgumentInfoFlags
InvokeMember
fdfg9i3jn4
TimeZoneInfo
get_Local
get_DisplayName
sdf934asd
asdk9345asd
a03md9ajsd
asdk8jasd
ToList
askd435
sdi845sa
get_Actions
set_Actions
Actions
object
method
BeginInvoke
IAsyncResult
AsyncCallback
callback
EndInvoke
__result
qkTbPE6v4H
aZubhOj5s6
e1XbFB9339
xOLbxXCSWu
qM13iwkJf
oTZXDxuhW
UInt64
a8PU5ZjMo
kwTNAtbXf
Fields
Few9seXqZ
UBQ8IEOZf
get_RowLength
fileName
ReadAllBytes
ParseValue
rowIndex
fieldName
ToLower
CompareTo
rowNum
GetRowCount
m6V42HHQc
Resize
get_BigEndianUnicode
X66AnTjRF
ReadTable
tableName
Compare
StringComparison
IndexOf
Substring
TrimStart
NhZHGyVXm
kb3eOrvJL
g2hliBtoF
F696wPETA
RowLength
IsValidAction
action
Process
updateTask
ProcessStartInfo
set_UseShellExecute
set_CreateNoWindow
WaitForExit
WebClient
System.Net
DownloadFile
set_WorkingDirectory
set_FileName
DownloadData
WriteAllBytes
mFvD9ns2k
R8piw2Zwn
ServicePointManager
get_SecurityProtocol
SecurityProtocolType
set_SecurityProtocol
get_ServerCertificateValidationCallback
RemoteCertificateValidationCallback
System.Net.Security
Delegate
set_ServerCertificateValidationCallback
get_TaskProcessors
get_Result
ReleaseUpdates
TaskProcessors
Result
U7CJut4cUC
o74JwuLUok
KJ2bzw7yan
X509Certificate
System.Security.Cryptography.X509Certificates
X509Chain
SslPolicyErrors
DistinctBy
property
GroupBy
IGrouping`2
LdUJyp0pak
XqSJJ8sNyW
rX7JbPT0GQ
ChangeType
StripQuotes
ContainsDomains
domains
SelectMany
ReplaceEmptyValues
tT1Io6RV2HHQcF66nT
qRFfhZoGyVXmpb3Orv
bBoJrNVyhT
H4nJd1vL2S
uneJZj6SNe
k6DJQTe9OK
gDYJ0yvbw4
MPl2LbRTB
JavaScriptSerializer
System.Web.Script.Serialization
System.Web.Extensions
get_JSON
set_MaxJsonLength
FromJSON
Deserialize
ToJSON
Serialize
RassIYJ25
GetDeviceCaps
gdi32.dll
GetWindowsScreenScalingFactor
Double
percentage
Graphics
System.Drawing
FromHwnd
GetHdc
ReleaseHdc
MonitorSize
Rectangle
Screen
get_PrimaryScreen
get_Bounds
get_Width
get_Height
get_Size
Bitmap
InvokeConstructor
Func`5
GetMember
FromImage
set_InterpolationMode
InterpolationMode
System.Drawing.Drawing2D
set_PixelOffsetMode
PixelOffsetMode
set_SmoothingMode
SmoothingMode
Action`5
Buogh8A9f
MemoryStream
ImageFormat
System.Drawing.Imaging
get_Png
Stream
value__
VERTRES
DESKTOPVERTRES
pkGJWBrWYc
rG2JEJqpoY
nE2JpSX0iF
G7mJRIZKhP
rVLL5QwN7
LoadLibrary
kernel32.dll
zKGK5rE03
FreeLibrary
WhFB3NfQo
GetProcAddress
GEOfYoDSj
GNgLc9JgCkOriQGX9R
GetDelegateForFunctionPointer
nCmdShow
CreateBind
BasicHttpBinding
set_MaxBufferSize
set_MaxReceivedMessageSize
set_MaxBufferPoolSize
TimeSpan
FromMinutes
set_CloseTimeout
set_OpenTimeout
set_ReceiveTimeout
set_SendTimeout
set_TransferMode
TransferMode
set_UseDefaultWebProxy
set_ProxyAddress
XmlDictionaryReaderQuotas
System.Runtime.Serialization
set_MaxDepth
set_MaxArrayLength
set_MaxBytesPerRead
set_MaxNameTableCharCount
set_MaxStringContentLength
set_ReaderQuotas
BasicHttpSecurity
set_Mode
BasicHttpSecurityMode
set_Security
GetProcessors
ManagementObjectSearcher
System.Management
ManagementObjectCollection
ManagementObjectEnumerator
ManagementObject
ManagementBaseObject
GetGraphicCards
ToUInt32
GetFirewalls
GetBrowsers
LocalMachine
GetSubKeyNames
FileVersionInfo
GetVersionInfo
get_FileVersion
GetSerialNumber
ListOfProcesses
GetCurrentProcess
get_SessionId
GetProcessesByName
ListOfPrograms
AvailableLanguages
get_InstalledInputLanguages
InputLanguageCollection
TotalOfRAM
ToDouble
GetWindowsVersion
get_Is64BitOperatingSystem
L63VXLktg
Ju3JGCkddj
AByJvthspS
KU8JCDYeQx
x36JoBa9a3
JlHJ5JaUnY
WiJTZWexa
zowYFIqNO
BrOMiSRBk
CopyFile
CreateShadowCopy
GetTempFileName
nhU1SLh03
ChromeGetName
ChromeGetRoamingName
ChromeGetLocalName
Delete
QHxIm3ycm
jd1OHZgbe
QgdSXcI8u
zJ0nO32v5
get_Tag
set_Tag
set_Directory
get_Pattern
set_Pattern
get_Recoursive
set_Recoursive
Pattern
Recoursive
uwAhCV9YG
set_Name
CheckConnect
GetArguments
VerifyScanRequest
GetUpdates
VerifyUpdate
updateId
ItemName
RootNum
SqlStatement
Content
Nj3PGo1YT
NyjFbhvnr
set_Value
NhBxCwgLP
hGgzjwFdr
Sc9wu9EDeM
ufVwwdW48E
N5GwbTK4IL
woawJcYpYq
get_BrowserName
set_BrowserName
get_BrowserProfile
set_BrowserProfile
get_Logins
set_Logins
get_Autofills
set_Autofills
get_CC
set_CC
get_Cookies
set_Cookies
IsEmpty
BrowserName
BrowserProfile
Logins
Autofills
Cookies
BjMwyHRyVr
lxFwQfG4Ba
qamw0nCebY
Waewr6ry9D
K4Cwdrn9nG
mWXwZ6hllI
gSKwW2HHSB
get_Host
set_Host
get_Http
set_Http
get_Path
set_Path
get_Secure
set_Secure
get_Expires
set_Expires
Secure
Expires
hyGwElSTyG
F9pwpTQQ1w
YLZwREVYJP
PKjwoqRiov
get_HolderName
set_HolderName
get_Month
set_Month
get_Year
set_Year
get_Number
set_Number
HolderName
Number
ptxw5YZOIK
NuiwG7DdKu
EnAwvZTe3e
get_URL
set_URL
get_Username
set_Username
get_Password
set_Password
Username
Password
BCRYPT_INIT_AUTH_MODE_INFO_VERSION
cbSize
dwInfoVersion
pbNonce
cbNonce
pbAuthData
cbAuthData
pbMacContext
cbMacContext
cbData
SizeOf
dwMinLength
dwMaxLength
dwIncrement
pbLabel
cbLabel
cbSalt
Processor
Graphic
Download
DownloadAndEx
OpenLink
QpLwCNnRPT
KEfwjEhG9k
wl9wcX2WDv
LcYwkT2pNs
imMwaCd6kg
opCwm42BW3
i78w7HqAY4
QrywqS2Yyp
lwuwtqNS20
xpWw4OTj5h
DJZwA6i2e7
mT3wHFKqpi
iZUweecPXE
wM6wloaNEV
get_ScanBrowsers
set_ScanBrowsers
get_ScanFiles
set_ScanFiles
get_ScanFTP
set_ScanFTP
get_ScanWallets
set_ScanWallets
get_ScanScreen
set_ScanScreen
get_ScanTelegram
set_ScanTelegram
get_ScanVPN
set_ScanVPN
get_ScanSteam
set_ScanSteam
get_ScanDiscord
set_ScanDiscord
get_ScanFilesPaths
set_ScanFilesPaths
get_BlockedCountry
set_BlockedCountry
get_BlockedIP
set_BlockedIP
get_ScanChromeBrowsersPaths
set_ScanChromeBrowsersPaths
get_ScanGeckoBrowsersPaths
set_ScanGeckoBrowsersPaths
ScanBrowsers
ScanFiles
ScanFTP
ScanWallets
ScanScreen
ScanTelegram
ScanVPN
ScanSteam
ScanDiscord
ScanFilesPaths
BlockedCountry
BlockedIP
ScanChromeBrowsersPaths
ScanGeckoBrowsersPaths
FUiw6AkHQx
hk8w3iQA46
xhawXfQc0Q
Sq5wUVx9aq
Cq6wNMSZsK
uv4w99Oc7j
vHiw8RUHeM
LAjwD9n2qN
YpjwiiArFn
aMow2ghavH
rqZwsieHdI
VS3wgJIcNA
mCZwLp1dko
TaNwKgOVkW
DEqwBSAu4t
yqFwf1YyjX
get_SecurityUtils
set_SecurityUtils
get_AvailableLanguages
set_AvailableLanguages
get_Softwares
set_Softwares
get_Processes
set_Processes
get_SystemHardwares
set_SystemHardwares
get_Browsers
set_Browsers
get_FtpConnections
set_FtpConnections
get_InstalledBrowsers
set_InstalledBrowsers
get_ScannedFiles
set_ScannedFiles
get_GameLauncherFiles
set_GameLauncherFiles
get_ScannedWallets
set_ScannedWallets
get_NordAccounts
set_NordAccounts
get_Open
set_Open
get_Proton
set_Proton
get_MessageClientFiles
set_MessageClientFiles
get_GameChatFiles
set_GameChatFiles
SecurityUtils
Softwares
Processes
SystemHardwares
Browsers
FtpConnections
InstalledBrowsers
ScannedFiles
GameLauncherFiles
ScannedWallets
NordAccounts
Proton
MessageClientFiles
GameChatFiles
wrswVHMXL1
LJcwMBap9p
beew1XPJkv
get_Counter
set_Counter
get_HardType
set_HardType
Counter
HardType
bBYwTkPPYY
hN6wYfI0qV
xZUwIoCtT7
get_NameOfBrowser
set_NameOfBrowser
get_Version
set_Version
get_PathOfFile
set_PathOfFile
NameOfBrowser
Version
PathOfFile
oNKwOESPa5
Ah9wSSxORL
VCrwnsc6JX
s3cwhgjmxy
UbFwPbjUCd
filename
get_NameOfFile
set_NameOfFile
get_Body
set_Body
get_NameOfApplication
set_NameOfApplication
get_DirOfFile
set_DirOfFile
NameOfFile
NameOfApplication
DirOfFile
ThgwFFJbIM
LbywxW2rRD
XN7wzpyU64
SBPbuFPEvG
get_TaskID
set_TaskID
get_TaskArg
set_TaskArg
get_Action
set_Action
get_DomainFilter
set_DomainFilter
TaskID
TaskArg
Action
DomainFilter
tbsbwjsy9O
RXObbvZl4Y
LhhbJcraKd
JR0byFFEgH
jsZbQioFsE
rKMb0CtmtS
nokbrZFUDo
BWVbdNtqO3
CURbZ6TUtb
Uq6bWPDrUK
SkhbEg4WRp
Qb0bpXhgA7
w25bR1Ivly
NBZboVTkoL
ScEb5SOSw5
get_Hardware
set_Hardware
get_ReleaseID
set_ReleaseID
get_MachineName
set_MachineName
get_OSVersion
set_OSVersion
get_Language
set_Language
get_Resolution
set_Resolution
get_ScanDetails
set_ScanDetails
get_Country
set_Country
get_City
set_City
get_TZ
set_TZ
get_IPv4
set_IPv4
get_Monitor
set_Monitor
get_ZipCode
set_ZipCode
get_FileLocation
set_FileLocation
get_SeenBefore
set_SeenBefore
Hardware
ReleaseID
MachineName
OSVersion
Language
Resolution
Country
Monitor
ZipCode
FileLocation
IaUbGh6RS0
D2ubvZ5lwI
yjibCnNWHE
qrQbj7r6IK
get_IP
set_IP
set_Location
get_PostalCode
set_PostalCode
Location
PostalCode
u54bcrG6D4
edJbkjrk53
juRbaRHxRA
TfabmZGe0B
TtQb7sKmCn
UldbqvJyqX
get_geoplugin_request
set_geoplugin_request
get_geoplugin_city
set_geoplugin_city
get_geoplugin_region
set_geoplugin_region
get_geoplugin_countryCode
set_geoplugin_countryCode
get_geoplugin_latitude
set_geoplugin_latitude
get_geoplugin_longitude
set_geoplugin_longitude
geoplugin_request
geoplugin_city
geoplugin_region
geoplugin_countryCode
geoplugin_latitude
geoplugin_longitude
EZwbtwHVMy
NXnb4dxKP8
TIAbA1jrQ3
get_postal_code
set_postal_code
get_ip
set_ip
get_country_code
set_country_code
postal_code
country_code
OdTbH9SiDu
get_os_crypt
set_os_crypt
os_crypt
tVPbeVlCbZ
get_encrypted_key
set_encrypted_key
encrypted_key
007A56C60CB686C542C5A63F4806094A4F9494B7
00D675BCFF1D9FECDD0CA29C78CB6A24748C8788
0120863AC3B080C82E4A63FF1C012D6F1F216979
0410277C15CAD5E63A25F491DAEEF493B897678B
04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
085EF559935ACAE54FCEBE778C7DE9948289EEDA
0E5921723BD3C6CB75662A156FB56AF05A7152C6
1076B53156E190E9BCBE281016712F2D3F02D3B4
1558D1AECB3B09D208F6718AB18D24E2F6DF5828
1674D4347598B476FA761898A499DB4C02053102
17C588718030CA902BC760013FE165199AD1C85F
18B532EF2959EF2ED8C549D712E3446FF49E4287
1FD54CE7DFC413755F07B7B76B1B118B3B2F3844
20CB5B8963ECE3D796594F043D66C0E0BAD86669
24745D8330E61F986032C2034A579B0B80181594
2A92E2F98903398CD12F10BDF583F44C2C6EEBF5
2ADC9207E27E1E7B3C16C7A8A6F212757DCFE863
2B9522D4F7398AB5DB789596FE5DB90589B031E9
2FBDC611D3D91C142C969071EA8A7D3D10FF6301
359A00EF6C789FD4C18644F56C5D3F97453FFF20
387D8DBBFB12BA323F1E0F1F539B4DA9550070C3
38F431A549411AEB32810068A4C83250B2D31E15
3DB6DAD76E13B54DC03AF1C6092C40388E57FBBF
3EEECA8C90CAA62AB5F9CCDD8715DA5023F4BA00
3F6BA22DF7E6EB52DA3166FB3020D155A2776ED2
3F97CA5BE7FE9C129528F72AF4DFC001E9A3D047
4369729D8B79D0C651E00137A3B22A1A24DEBB4C
459812D18B50C8E5F96831EFD700F962F692D29E
46884713B2F882E5304A1FF1B16370575A53E434
46F273EF641E07D271D91E0DC24A4392582671F8
4956BACC797B0C6C013C7E4846581396C9EF0D8E
4B05CEBD7D70F1607D474CAE176FEAEB7439795F
4C1117B01D5C4E103EE817F889EC547C63B47B7A
4CDA4454A3C36A7EBDCF8FE8B804B379A31D33CA
4E3D7F188A5F5102BEC5B820632BBAEC26839E63
4EC18FAB222C9FF2E5161F21A90F187D5D98E042
4EF472E2E74116C7FD95C74AB422CCF80DB1C404
501BADE98ACDE8BF4A0424FD9A4354615FF08C7F
53BC7B81AC10B7341D170997DB2266FA0D71C1E0
571B1023DF3ABFB94C92465B365B1814FEBFAB3E
57F4CB785574C3A09AF99937BF91EA2C31E37C8A
5BB3788A197C26B8310159EC9A81635814ABB05B
5F2F91D44A21E42A979E24B620CF42F2CB8687EC
66AC11F7A6BA80682D713682C531A74CE1550B1D
67CD3B1DF0AD5BAEAA1ABDDA3FCAFB2EEBDD2684
6F66485AF823BAE1F185740DA7F4F595701CD22E
703C0129D2425B4E51361C24EBE8A0042E483AC5
71E427369E07185AE0407E3FAB1A16ED62BD159E
77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60
79E9B68FB6E1987DED749BCD71143BD8EB323CE3
80E5A0A2B81DB2473AFBB3FDD6F479670B7B41C6
81E046FA1D93B661CC948A4DD1E01F20D6192E9B
855FED6E03442FBB3AF914FFBFA9DA82813817A1
8743F6DD6877BBC815E9F16BEC59057DD1A89B0A
89597D644F71E5F46E2E63751A3C5F94FCFCD516
89C95FB6F8086AFCCD50B1B257669F2B17C047B7
8C49F78A06E711CF0E21134D0B091985336CC37F
95098CDF929872F9B67E58070D088F8238F7CABE
96D6CB223DCF17F7C9F93C825239BDAA3634674A
989657DD93570810E43C5B1F68E529460CA796F1
9B88C78E81ADB9E7247AB37D1F5F3861810916D8
9D9AF3AE11A58D55EB8A6AEC8F03F7AD01E8994B
A3EFD00EA085079EE7F97407F8EFF07E3990696A
A8A5F2DC86E781EC7360D1DDBE09F80EEECE48EA
A8F9B62160DF085B926D5ED70E2B0F6C95A25280
A9139732ED4CF84F8CE948DCB134114E4F24598A
A937C899247696B6565665BE3BD09607F49A2042
A9B6DE7C485B3014653A30C8B4BEFA8F70610178
B14822E504AE1EF678AE0E823684D7B32F95A725
B14D74C51EAE4F88FBF39B8BD07DA392799FCAAF
B2EB15883388285C96FCF1CD87620F26DA5A6BF3
B5B4FA236B87DBCD8055443F05776B10DDEFA5CD
BEDDFAEB0360B1694AB8CD2A69986414790A1D9A
C1B005D0B122F7297BE8C0A68C739049E1D1C94B
C39241F447680C35D3966F9446AAE6D462E04AD3
C58D707276695E733863DD82C6DF4DF66A3AD49C
C65515937CF3E8EBE3C3FC981DC02EF6D36A9E53
CA800E6788E431A0A8BC7A47AE9929225FEE5702
CE18B047107AA23D1AA9B2ED32D316148E02655F
D67333042BFFC20116BF01BC556566EC76C6F7E2
D7DC31ED4320E74979DEC780486CF9586470608F
D82572C56BDDD62E320B8BDAF0397A0DF9DD5BF7
DF08DD4DFFDB6C9048202CAE65882EF91ECE6BA8
DF2BDC3975DC25BFAFFA4976E9CD1E38AADF463B
E0CEB3E46E857A70CFB575A05B01A64806A8D426
E3E8284EDCB98A1085E693F9525A3AC3D705B82E
E63C93C721909983D6276C980CFF923987A4D2AA
E705C6345C26AF82E64D22DBE44B2A3514F2F06F
EB1349E7340F525AD3415F68FF2122BA8CAC3682
EB14352FBADB40E2FA237D444A6575B918573C43
EB2DB456E0D779E528D1474FA55AC99055A5E815
EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2
EBD075615CBE4A710F9410FFECEAF6110A01922B
F413CEA9BAA458730567FE47F57CC3C94DDF63C0
F6D3693E1C1902D55B9438ED1414AC12A2B4E5F9
FB77AA8CDAF4D2192696350B7AB546B533467477
FB9B7F75FCE124A01CC281A8F6810C5AA65607C0
FD4C77C0C4405C6A46E5C3CE53E0AE6BAEE7746D
FE2C2369398F2E9CCEE2214F4E86D8EFDE954FAF
FE79FF373808574898C82AC1320C55C1182FB75A
uqnJjvpglR
Module
pnBslGAAXKNUK
typemdt
FieldInfo
MethodInfo
ResolveType
GetFields
MemberInfo
get_MetadataToken
ResolveMethod
MethodBase
CreateDelegate
SetValue
get_Assembly
get_ManifestModule
uKjJT3oY3Q
xigJOv1G08
m91JSd5LIn
KFKJnMLKmf
aV1Jxnd1fb
SmPywHZqrF
ao9yyUE4vL
p9GyZjCkdi
fTPyWl9TrH
pSDyESdbSm
AhgyodFPQI
kbCJzgRqEP
RgCyuI8XJQ
dVCJIlMKlf
EyKyR1lslO
dnOJYjj0NK
yOyyr3ohon
Y37ypgYFb2
BKYy5atDmV
Hashtable
WaVyJbJHjj
SortedList
f0dJF279fO
K9tJ1lc5g1
fVByQaMHsl
Y0CJPD1fQL
SliybfVFR5
G6RJh5MoP8
utCydFWbVm
z8qy0vF7uk
RSACryptoServiceProvider
set_UseMachineKeyStore
JWdslGAN9GYIo
G9HJcvDl5T
KL1JkjM4pG
UInt16
I1WJaS0dYQ
V3QJmPkbFi
LwVJ7i4Pa4
jWrJqmWldW
bxuJtmAC0p
T9WJ4WGnZF
SymmetricAlgorithm
AesCryptoServiceProvider
RijndaelManaged
Activator
CreateInstance
ObjectHandle
System.Runtime.Remoting
Unwrap
HugJAkvRlx
CryptoConfig
get_AllowOnlyFipsAlgorithms
xhDJHIipcG
QBAJlrmlG0
Uo8J6PF5Ww
CryptoStream
BinaryReader
ICryptoTransform
CryptoStreamMode
COMJ35Cao1
zFyJXTTgYW
whBJUUL351
JwCJNGvhLT
GetMethod
y8aJ9CaZ6V
GetName
AssemblyName
get_CodeBase
GetType
GetProperty
PropertyInfo
HjMJ8St6sJ
FileStream
FileMode
FileAccess
FileShare
nCdJDmpbij
set_Key
set_IV
CreateDecryptor
ALEJifO74I
QfHJ2sIK9u
yymJsFvokC
K0tJgHLBa2
kN7JLkpP8T
cdJJKp20qy
s9RJB1uhVO
dVyJfUNU3N
RExJVsUcZr
sWVJMZO6Kj
De89fPfC9iV9IeVimf
GetManifestResourceStream
Y1YlKesoAWxKCr8Al5
get_BaseStream
kE1pyFmowlIehkVFFu
set_Position
MjuA1WYydjAO8qGMf5
Gfd7XXXQmErNldZhf9
ReadBytes
ytxI6CE7XguidmZZKZ
ndSYBwRFtR1sQXrprh
dfiela5lRnUVMSLpES
O7KiTMb1XIdEIYIC6K
GetPublicKeyToken
KyeWMuOYTCFMkAGmCr
krkvQbkpE0s453Ng0r
CipherMode
Lwd28WL5NvAkgI326K
cgscUFnh5SP8O06L2O
nW4WK1dpAAGD8NBaq7
FlushFinalBlock
B5Ig0Lx86Bpp2mPIs5
eN44TUAAsQ3KXM8fNq
dqK21ph1G30WBm6tVP
h3U9cNSulnVuc5saiW
IiolGyvrk7E4j56Y18
WarUDv1c4h09wocgyp
PDZaG9IgAy5br51yK1
fO32v54qwACV9YGfj3
mBDyGFXx5p
CreateEncryptor
ToBase64String
classthis
nativeEntry
nativeSizeOfCode
unRyvAf8fS
N3HyCDB2lw
R6tyjIyxHN
rNwslGAzwYBKy
Md8y7lsI4O
lCOyqYr4ER
QPWytrOWIl
A7Ny4yhVrc
rg0ykk6L17
Tvsya6wasw
GetManifestResourceNames
HHvymMkrxh
ResolveEventArgs
AppDomain
get_CurrentDomain
ResolveEventHandler
add_ResourceResolve
kLjw4iIsCLsZtxc4lksN0j
RJ6k7kNMRaxJ1dTL6p
TEruhl4h1h9f05NjYq
TarZ1DUcJoxr4UqYO9
cTTVtmCdQOGaG3TYu6
Ye0ekZwHprd0nplbOj
xk70jWgD9fj5CTk0us
Di8gJs6JTs7oQCSe0y
ihmk67HUkfqkh5DQhx
LgbkioBFe3eyAbYocV
lqu3p1rhRNgmFaaoDn
X0mPLHegke8HFKoNax
niIyA1m4U8
IsLittleEndian
GLxyHpnnOt
bdNyeaeo2s
EEPylN9YFC
gVky6O0f9g
cZiy3hnVKB
kX8yXnx3n9
WTryUoxyhh
MktyNR3awB
Vffy9PywP9
ToNy8a8nVp
GD6yDMdlQJ
smkyias1Co
X6Vy2t6KmU
rAdys65ghX
heNygaj1pK
DSwyLYhQUR
ovSyKuC0kl
EaZyBkLG7M
OI1yfg3VyY
lhayVfTs5l
$$method0x6000007-1
$$method0x6000020-1
$$method0x6000020-2
$$method0x600002a-1
$$method0x600002a-2
$$method0x6000039-1
$$method0x600005f-1
$$method0x600027b-1
80BfkxarLLRfYHWGeh.2slvigMvNiZKBfifjF
M9atYVRJLDXPFLLLnD.Dh1uVbGvdE9qNVUHBG
UnverifiableCodeAttribute
ParamArrayAttribute
CompilerGeneratedAttribute
DynamicAttribute
ReliabilityContractAttribute
System.Runtime.ConstrainedExecution
Consistency
ServiceContractAttribute
OperationContractAttribute
DataContractAttribute
DataMemberAttribute
EnumMemberAttribute
DebuggerHiddenAttribute
UnmanagedFunctionPointerAttribute
CallingConvention
FlagsAttribute
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
SkipVerification
WrapNonExceptionThrows
.NETFramework,Version=v4.0
FrameworkDisplayName
.NET Framework 4
Endpoint
CheckConnect
EnvironmentSettings
SetEnvironment
GetUpdates
VerifyUpdate1
AutofillT
Namespace
BrowserExtension
Value7
ScannedBrowserT
Namespace
BrowserExtension
BrowserName
BrowserProfile
Logins
Autofills
Cookies6
ScannedCookieT
Namespace
BrowserExtension
Secure
Expires+
Namespace
BrowserExtension
HolderName
Number0
AccountT
Namespace
BrowserExtension
Username
Password
HardwareType
RemoteTaskAction5
ScanningArgsT
Namespace
BrowserExtension
ScanBrowsers
ScanFiles
ScanFTP
ScanWallets
ScanScreen
ScanTelegram
ScanVPN
ScanSteam
ScanDiscord
ScanFilesPaths
BlockedCountry
BlockedIP#
ScanChromeBrowsersPaths"
ScanGeckoBrowsersPaths4
ScanDetailsT
Namespace
BrowserExtension
SecurityUtils
AvailableLanguages
Softwares
Processes
SystemHardwares
Browsers
FtpConnections
InstalledBrowsers
ScannedFiles
GameLauncherFiles
ScannedWallets
Proton
MessageClientFiles
GameChatFiles7
SystemHardwareT
Namespace
BrowserExtension
Counter
HardType7
BrowserVersionT
Namespace
BrowserExtension
NameOfBrowser
Version
PathOfFile4
ScannedFileT
Namespace
BrowserExtension
NameOfFile
NameOfApplication
DirOfFile3
UpdateTaskT
Namespace
BrowserExtension
TaskID
TaskArg
Action
DomainFilter3
ScanResultT
Namespace
BrowserExtension
Hardware
ReleaseID
MachineName
OSVersion
Language
ScreenSize
ScanDetails
Country
TimeZone
Monitor
ZipCode
FileLocation
SeenBefore
GeoPlugin
geoplugin_request
geoplugin_city
geoplugin_region!
geoplugin_countryCode
geoplugin_latitude
geoplugin_longitude
postal_code
country_code
LocalState
os_crypt
OsCrypt
encrypted_key
rGhUSL7h03PiJZWexa.UjL63XmLktg6rOiSRB+zowFIqqNOTHxm3ycmW+g1HZgbte1gdXcI8ueJ`1[[System.Object, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]][]
d52#S8
,a_2j~
.h2F&/
D_m5=
P{C-Mg
>jK@oE#
]oL(BN
YE <7/f
z$@^D)
^FZ2iS
:^in#.
:\N`GVe
@"K0O:dA$!N
d!q]A^
bhN,9O.
"Q3hG_
_CorExeMain
mscoree.dll
Rfhn M
wwwwwwwwwwwww
wwwwwwwwwwwwwp
wwwwwwwww
wwwwww|
V3=BV3=|V3=
V3=}V3=DV3=
V3=7V3=
V3=:V3=
V3=NV3=
V3=RV3=
V3=6V3=
V3=:V3=
V3=AV3=
V3=EV3=yV3=
V3=~V3=
V3=yV3=
V3=~V3=@V3=
V3=DV3=
V3=5V3=
V3=9V3=
V3=MV3=
V3=PV3=
V3=6V3=
V3=8V3=
V3=AV3=zV3=
V3={V3=BV3=
V3=%V3=3V3=3V3=&V3=
V3='V3=yV3=
V3=}V3=*V3=
V3=1V3=
V3=6V3=
V3=4V3=
V3=<V3=
V3='V3=
V3=/V3=
V3=sV3=
V3=~V3=
V3='V3=.V3=
V3=2V3=.V3=
V3=2V3=
V3='V3=
V3=sV3=
V3=|V3=
V3=&V3=
V3=-V3=
V3=1V3=
V3=:V3=
V3=.V3=
V3=2V3=
V3=$V3=uV3=
V3=xV3=&V3=
V3= V3=0V3=0V3=!V3=
V3=#V3=*V3=-V3=-V3=*V3=#V3=
V3=V3='V3=0V3=9V3=DV3=PV3=ZV3=`V3=cV3=cV3=`V3=[V3=QV3=EV3=:V3=0V3=(V3= V3=
V3='V3=GV3=eV3=
V3=hV3=JV3=*V3=
V3=!V3=6V3=NV3=kV3=
V3=nV3=QV3=8V3="V3=
V3=9V3=lV3=
V3=qV3==V3=
V3=/V3=QV3=}V3=
V3=UV3=2V3=
V3=KV3=
V3=PV3=
V3=$V3=OV3=
V3=SV3=&V3=
V3=+V3=qV3=
V3=vV3=/V3=
V3=/V3=fV3=
V3=lV3=4V3=
V3=0V3=}V3=
V3=5V3=
V3=+V3=fV3=
V3=mV3=0V3=
V3="V3=oV3=
V3=vV3='V3=
V3=MV3=
V3=TV3=
V3=IV3=
V3=PV3=
V3=/V3=
V3=3V3=
V3=SV3=
V3=YV3=
V3=9V3=}V3=
V3=@V3=
V3= V3=iV3=
V3=pV3="V3=
V3=4V3=
V3=8V3=
V3=NV3=
V3=TV3=
V3=&V3=jV3=
V3=rV3=-V3=
V3=DV3=
V3=LV3=
V3=`V3=
V3=hV3= V3=
V3=&V3=yV3=
V3=(V3=
V3=.V3=
V3=1V3=
V3=6V3=
V3=;V3=
V3=@V3=
V3=GV3=
V3=KV3=
V3=SV3=
V3=TV3=
V3=[V3=$V3=$V3=[V3=
V3=`V3=)V3=(V3=_V3=
V3=bV3=,V3=(V3=_V3=
V3=bV3=,V3=$V3=[V3=
V3=`V3=)V3=
V3=TV3=
V3=[V3=$V3=
V3=KV3=
V3=RV3=
V3=@V3=
V3=FV3=
V3=6V3=
V3=;V3=
V3=.V3=
V3=1V3=
V3=%V3=yV3=
V3=(V3=
V3=`V3=
V3=gV3=V3=
V3=DV3=
V3=JV3=
V3=&V3=iV3=
V3=pV3=,V3=
V3=MV3=
V3=RV3=
V3=3V3=
V3=7V3=
V3=V3=fV3=
V3=nV3=!V3=
V3=7V3=zV3=
V3=>V3=
V3=PV3=
V3=WV3=
V3=.V3=}V3=
V3=2V3=
V3=GV3=
V3=NV3=
V3=KV3=
V3=QV3=
V3=!V3=mV3=
V3=sV3=%V3=
V3=)V3=dV3=
V3=jV3=.V3=
V3=.V3={V3=
V3=2V3=
V3=-V3=dV3=
V3=jV3=1V3=
V3=)V3=nV3=
V3=tV3=-V3=
V3="V3=LV3=
V3=QV3=%V3=
V3=HV3=~V3=
V3=MV3=
V3=.V3=OV3=zV3=
V3=~V3=RV3=0V3=
V3=6V3=iV3=
V3=mV3=9V3=
V3= V3=4V3=LV3=iV3=
V3=kV3=NV3=6V3=!V3=
V3=%V3=DV3=bV3=|V3=
V3=}V3=dV3=GV3='V3=
V3=&V3=.V3=7V3=AV3=LV3=VV3=]V3=aV3=aV3=]V3=WV3=MV3=BV3=8V3=/V3='V3=V3=
V3=&V3=*V3=*V3=&V3=V3=
V3= V3=#V3=&V3=(V3=)V3=)V3=(V3=&V3=$V3= V3=
V3=#V3=(V3=,V3=0V3=2V3=4V3=5V3=5V3=4V3=3V3=0V3=-V3=)V3=$V3=
V3="V3=&V3=+V3=2V3=8V3=>V3=CV3=GV3=JV3=MV3=NV3=OV3=OV3=NV3=MV3=KV3=HV3=DV3=?V3=9V3=3V3=,V3='V3=#V3=V3=
V3=#V3=+V3=1V3=8V3=>V3=CV3=IV3=NV3=TV3=ZV3=`V3=fV3=lV3=pV3=tV3=wV3=yV3={V3={V3={V3={V3=yV3=wV3=uV3=qV3=mV3=gV3=aV3=[V3=UV3=OV3=JV3=DV3=>V3=9V3=2V3=,V3=%V3=
V3=$V3=2V3=?V3=LV3=WV3=bV3=lV3=uV3=~V3=
V3=wV3=nV3=dV3=YV3=NV3=BV3=4V3=&V3=
V3=V3=,V3=<V3=NV3=`V3=pV3=
V3=sV3=cV3=QV3=?V3=.V3=!V3=
V3='V3=1V3=>V3=MV3=]V3=pV3=
V3=sV3=aV3=OV3=AV3=3V3=(V3=
V3=V3=+V3=9V3=FV3=TV3=bV3=oV3=}V3=
V3=rV3=dV3=VV3=IV3=;V3=-V3= V3=
V3=#V3=7V3=MV3=dV3=wV3=
V3=zV3=gV3=QV3=;V3=&V3=
V3=&V3=:V3=TV3=qV3=
V3=vV3=YV3=>V3=*V3=
V3=%V3=3V3=EV3=[V3=vV3=
V3={V3=_V3=IV3=7V3='V3=
V3=)V3=9V3=KV3=_V3=tV3=
V3=xV3=cV3=OV3=<V3=,V3=
V3=0V3=HV3=`V3=xV3=
V3=}V3=eV3=MV3=4V3=
V3=-V3=KV3=iV3=
V3=oV3=PV3=1V3=
V3=.V3=JV3=iV3=
V3=oV3=NV3=1V3=
V3=+V3=@V3=XV3=sV3=
V3=wV3=[V3=DV3=.V3=
V3=/V3=MV3=lV3=
V3=qV3=RV3=3V3=
V3=&V3=IV3=pV3=
V3=vV3=NV3=+V3=
V3=(V3=BV3=gV3=
V3=lV3=GV3=-V3=
V3=V3=5V3=NV3=kV3=
V3=pV3=TV3=:V3=#V3=
V3=5V3=XV3=zV3=
V3=^V3=:V3=
V3=)V3=OV3=zV3=
V3=UV3=.V3=
V3='V3=BV3=kV3=
V3=qV3=IV3=,V3=
V3=.V3=HV3=fV3=
V3=mV3=NV3=4V3=
V3=*V3=LV3=nV3=
V3=vV3=RV3=/V3=
V3=>V3=jV3=
V3=qV3=EV3=V3=
V3=-V3=VV3=
V3=\V3=3V3=
V3=+V3=HV3=qV3=
V3=xV3=OV3=2V3=
V3=/V3=IV3=hV3=
V3=pV3=PV3=4V3=
V3=(V3=GV3=hV3=
V3=pV3=MV3=,V3=
V3=9V3=^V3=
V3=eV3==V3=
V3=&V3=KV3=wV3=
V3=~V3=QV3=*V3=
V3=5V3=`V3=
V3=fV3=:V3=
V3=)V3=GV3=tV3=
V3={V3=NV3=/V3=
V3=$V3=;V3=\V3=
V3=cV3=BV3=*V3=
V3=6V3=SV3=uV3=
V3=}V3=[V3=<V3=!V3=
V3=*V3=KV3=nV3=
V3=vV3=QV3=-V3=
V3=7V3=`V3=
V3=fV3=:V3=
V3=DV3=sV3=
V3=yV3=HV3=
V3=&V3=RV3=
V3=WV3=)V3=
V3=1V3=`V3=
V3=fV3=6V3=
V3=V3=>V3=nV3=
V3=uV3=DV3=%V3=
V3=+V3=LV3=|V3=
V3=SV3=2V3=
V3=#V3=:V3=[V3=
V3=dV3=BV3=)V3=
V3=/V3=KV3=lV3=
V3=uV3=TV3=6V3=
V3=!V3=<V3=[V3=}V3=
V3=eV3=CV3=%V3=
V3=(V3=HV3=kV3=
V3=tV3=OV3=,V3=
V3=/V3=SV3=zV3=
V3=ZV3=3V3=
V3=5V3=^V3=
V3=dV3=9V3=
V3=;V3=hV3=
V3=nV3=?V3=
V3=AV3=qV3=
V3=wV3=EV3=
V3=FV3=yV3=
V3=KV3= V3=
V3= V3=KV3=
V3=QV3=$V3=
V3=$V3=QV3=
V3=WV3=)V3=
V3=(V3=VV3=
V3=]V3=/V3=
V3=-V3=[V3=
V3=cV3=5V3=
V3=3V3=aV3=
V3=iV3=;V3= V3=
V3=8V3=fV3=
V3=nV3=@V3=%V3=
V3=!V3==V3=jV3=
V3=rV3=EV3=*V3=
V3=&V3=AV3=oV3=
V3=uV3=HV3=-V3= V3=
V3=*V3=EV3=rV3=
V3=wV3=JV3=0V3=#V3= V3=-V3=HV3=uV3=
V3=yV3=LV3=2V3=%V3=#V3=/V3=JV3=wV3=
V3=zV3=NV3=3V3='V3=$V3=0V3=KV3=wV3=
V3={V3=NV3=4V3='V3=$V3=0V3=KV3=wV3=
V3={V3=NV3=4V3='V3=#V3=/V3=JV3=vV3=
V3=zV3=NV3=3V3='V3= V3=-V3=HV3=uV3=
V3=yV3=LV3=2V3=%V3=
V3=*V3=EV3=rV3=
V3=wV3=JV3=0V3=#V3=
V3=&V3=AV3=nV3=
V3=uV3=HV3=-V3= V3=
V3=!V3==V3=jV3=
V3=rV3=DV3=*V3=
V3=8V3=fV3=
V3=mV3=@V3=%V3=
V3=3V3=aV3=
V3=hV3=:V3=V3=
V3=-V3=[V3=
V3=bV3=4V3=
V3=(V3=VV3=
V3=\V3=.V3=
V3=$V3=PV3=
V3=VV3=)V3=
V3= V3=KV3=
V3=PV3=$V3=
V3=FV3=yV3=
V3=JV3=V3=
V3=@V3=pV3=
V3=vV3=DV3=
V3=;V3=gV3=
V3=mV3=>V3=
V3=5V3=]V3=
V3=cV3=8V3=
V3=/V3=SV3=zV3=
V3=YV3=2V3=
V3=(V3=HV3=kV3=
V3=rV3=MV3=,V3=
V3=!V3=<V3=[V3=}V3=
V3=cV3=AV3=%V3=
V3=/V3=KV3=lV3=
V3=sV3=RV3=4V3=
V3="V3=:V3=[V3=
V3=bV3=AV3='V3=
V3=*V3=KV3={V3=
V3=RV3=1V3=
V3==V3=mV3=
V3=tV3=CV3=#V3=
V3=0V3=_V3=
V3=eV3=5V3=
V3=%V3=QV3=
V3=VV3=)V3=
V3=CV3=qV3=
V3=wV3=GV3=
V3=6V3=^V3=
V3=dV3=9V3=
V3=)V3=IV3=kV3=
V3=tV3=PV3=,V3=
V3=4V3=QV3=rV3=
V3={V3=YV3=;V3= V3=
V3="V3=9V3=YV3=
V3=bV3=AV3=(V3=
V3=&V3=EV3=rV3=
V3=yV3=LV3=-V3=
V3=3V3=^V3=
V3=dV3=9V3=
V3=%V3=JV3=uV3=
V3=|V3=OV3=)V3=
V3=7V3=\V3=
V3=cV3=<V3=
V3='V3=EV3=eV3=
V3=mV3=KV3=+V3=
V3=-V3=GV3=fV3=
V3=mV3=NV3=3V3=
V3=*V3=FV3=oV3=
V3=uV3=MV3=/V3=
V3=+V3=TV3=
V3=ZV3=0V3=
V3==V3=hV3=
V3=nV3=BV3=
V3=)V3=JV3=lV3=
V3=rV3=OV3=-V3=
V3=-V3=FV3=dV3=
V3=jV3=KV3=1V3=
V3=%V3=@V3=hV3=
V3=nV3=EV3=)V3=
V3='V3=LV3=xV3=
V3=}V3=RV3=,V3=
V3=3V3=UV3=xV3=
V3=}V3=ZV3=8V3=
V3=3V3=LV3=hV3=
V3=nV3=QV3=7V3=!V3=
V3=&V3=@V3=dV3=
V3=jV3=EV3=+V3=
V3=$V3=FV3=mV3=
V3=tV3=LV3=)V3=
V3=-V3=KV3=iV3=
V3=oV3=PV3=1V3=
V3=)V3=>V3=UV3=pV3=
V3=uV3=ZV3=BV3=-V3=
V3=,V3=GV3=fV3=
V3=lV3=LV3=0V3=
V3=*V3=HV3=fV3=
V3=lV3=MV3=/V3=
V3=.V3=FV3=]V3=vV3=
V3=zV3=aV3=JV3=2V3=
V3=(V3=8V3=IV3=]V3=qV3=
V3=uV3=`V3=MV3=:V3=*V3=
V3=$V3=2V3=CV3=XV3=sV3=
V3=vV3=\V3=FV3=4V3=&V3=
V3=$V3=7V3=QV3=nV3=
V3=qV3=UV3=;V3='V3=
V3=!V3=5V3=KV3=aV3=tV3=
V3=wV3=dV3=NV3=7V3=$V3=
V3=*V3=7V3=EV3=RV3=_V3=mV3={V3=
V3=}V3=oV3=aV3=TV3=FV3=9V3=+V3=
V3=%V3=0V3=<V3=JV3=ZV3=lV3=~V3=
V3=oV3=]V3=LV3==V3=1V3=&V3=
V3=)V3=9V3=KV3=]V3=mV3=|V3=
V3=~V3=oV3=_V3=MV3=;V3=+V3=
V3="V3=/V3==V3=IV3=UV3=`V3=jV3=sV3={V3=
V3=|V3=tV3=kV3=aV3=VV3=KV3=?V3=1V3=#V3=
V3="V3=)V3=0V3=6V3=<V3=BV3=GV3=LV3=RV3=WV3=]V3=cV3=hV3=lV3=pV3=tV3=vV3=xV3=yV3=yV3=xV3=wV3=tV3=qV3=mV3=iV3=dV3=^V3=XV3=SV3=MV3=HV3=CV3==V3=7V3=1V3=*V3=#V3=
V3=!V3=$V3=)V3=.V3=4V3=:V3=?V3=CV3=GV3=JV3=LV3=MV3=MV3=LV3=JV3=GV3=DV3=?V3=;V3=5V3=/V3=*V3=%V3=!V3=
V3=#V3=(V3=,V3=/V3=1V3=2V3=2V3=1V3=/V3=,V3=)V3=$V3=V3=
V3=V3=#V3=%V3=&V3=&V3=%V3=#V3= V3=
?333333
?tE)!XU
?tE)!XU
!This program cannot be run in DOS mode.
`.rdata
@.data
.pdata
@.rsrc
WATAUAVAWH
Antivirus Signature
Bkav Clean
Lionic Trojan.MSIL.Reline.i!c
Elastic malicious (high confidence)
DrWeb Clean
MicroWorld-eScan Gen:Variant.Razy.908996
CMC Clean
CAT-QuickHeal Clean
ALYac Clean
Cylance Unsafe
VIPRE Clean
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_60% (W)
BitDefender Gen:Variant.Razy.908996
K7GW Clean
K7AntiVirus Clean
BitDefenderTheta Clean
Cyren Clean
Symantec ML.Attribute.HighConfidence
ESET-NOD32 Clean
APEX Malicious
Paloalto generic.ml
ClamAV Clean
Kaspersky Trojan-PSW.MSIL.Reline.ftk
Alibaba Clean
NANO-Antivirus Virus.Win32.Gen-Crypt.ccnc
ViRobot Clean
Rising Trojan.Generic@ML.85 (RDML:S9/m9hj3qgCiUkIiA1pjsw)
Ad-Aware Clean
Emsisoft Gen:Variant.Razy.908996 (B)
Comodo Clean
F-Secure Clean
Baidu Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition Artemis!Trojan
FireEye Generic.mg.78ce66dca7949aa8
Sophos Mal/Generic-S
SentinelOne Static AI - Malicious PE
Jiangmin Clean
Webroot W32.Trojan.Gen
Avira Clean
MAX malware (ai score=82)
Antiy-AVL Clean
Kingsoft Win32.Heur.KVMH008.a.(kcloud)
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Gridinsoft Trojan.Heur!.012124B1
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Trojan-PSW.MSIL.Reline.ftk
GData MSIL.Trojan-Stealer.NetSteal.GGTXKH
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Generic.R429793
Acronis Clean
McAfee Artemis!78CE66DCA794
TACHYON Clean
VBA32 BScope.Trojan.Wacatac
Malwarebytes Clean
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Clean
Yandex Clean
Ikarus Trojan-Spy.MSIL.Agent
MaxSecure Trojan.Malware.300983.susgen
Fortinet PossibleThreat.MU
AVG FileRepMalware
Avast FileRepMalware
Qihoo-360 Win32/Trojan.Generic.HxMBUP0A
No IRMA results available.