Static | ZeroBOX

PE Compile Time

2021-07-08 08:14:02

PE Imphash

f2b2e356d2d0eb1b0d5da0b0d4f5e934

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
code 0x00001000 0x00033f9c 0x00034000 6.61183174703
.idata 0x00035000 0x00001170 0x00001200 5.41424293419
data 0x00037000 0x000021f8 0x00001000 2.43161386563
.rsrc 0x0003a000 0x00000534 0x00000600 4.15429716905
.reloc 0x0003b000 0x000024f8 0x00002600 6.577649117

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x0003a0a0 0x00000400 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_MANIFEST 0x0003a4a0 0x00000091 LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x435050 Process32First
0x435054 TerminateProcess
0x435058 ReleaseMutex
0x43505c OpenProcess
0x435064 Process32Next
0x435068 GetModuleFileNameA
0x43506c MultiByteToWideChar
0x435074 WideCharToMultiByte
0x435078 GetSystemTime
0x43507c IsWow64Process
0x435080 SetEndOfFile
0x435084 HeapSize
0x435088 GetConsoleOutputCP
0x43508c FlushFileBuffers
0x435090 CreateFileW
0x435094 GetProcessHeap
0x435098 EnumSystemLocalesW
0x43509c GetUserDefaultLCID
0x4350a0 IsValidLocale
0x4350a4 SetStdHandle
0x4350b4 GetOEMCP
0x4350b8 GetACP
0x4350bc IsValidCodePage
0x4350c0 FindNextFileW
0x4350c4 FindFirstFileExW
0x4350c8 FindClose
0x4350cc HeapReAlloc
0x4350d0 GetFileType
0x4350d4 ReadConsoleW
0x4350d8 GetConsoleMode
0x4350dc GetComputerNameW
0x4350e0 CreateMutexA
0x4350e4 CreateDirectoryA
0x4350e8 CreateFileA
0x4350ec CopyFileA
0x4350f0 WriteFile
0x4350f4 GetProcAddress
0x4350fc GetVersionExA
0x435100 lstrcpyA
0x435104 GetModuleHandleA
0x435108 TerminateThread
0x43510c lstrcatA
0x435110 lstrcmpA
0x435114 WaitForSingleObject
0x435118 CloseHandle
0x43511c LoadLibraryA
0x435120 Sleep
0x435124 GetCurrentProcess
0x435128 SetFilePointerEx
0x43512c HeapAlloc
0x435134 CreateProcessW
0x435138 GetExitCodeProcess
0x43513c HeapFree
0x435140 GetCommandLineW
0x435144 GetCommandLineA
0x435148 GetModuleFileNameW
0x43514c GetStdHandle
0x435150 GetModuleHandleExW
0x435154 ExitProcess
0x435158 ReadFile
0x43515c WriteConsoleW
0x435160 LoadLibraryExW
0x435164 FreeLibrary
0x435168 RtlUnwind
0x43516c RaiseException
0x435170 GetCPInfo
0x435174 GetStringTypeW
0x435178 GetLocaleInfoW
0x43517c LCMapStringW
0x435180 CompareStringW
0x435184 DecodePointer
0x435188 EncodePointer
0x43519c GetCurrentProcessId
0x4351a0 GetCurrentThreadId
0x4351a8 InitializeSListHead
0x4351ac IsDebuggerPresent
0x4351b0 GetStartupInfoW
0x4351b4 GetModuleHandleW
0x4351b8 GetLastError
0x4351c8 SetLastError
0x4351d0 SwitchToThread
0x4351d4 TlsAlloc
0x4351d8 TlsGetValue
0x4351dc TlsSetValue
0x4351e0 TlsFree
Library USER32.dll:
0x435208 MoveWindow
0x43520c SendMessageA
0x435210 PrintWindow
0x435214 MenuItemFromPoint
0x435218 FindWindowA
0x43521c GetTopWindow
0x435220 GetWindowLongA
0x435224 CloseDesktop
0x435228 GetWindowPlacement
0x43522c WindowFromPoint
0x435230 ScreenToClient
0x435234 PostMessageA
0x435238 IsWindowVisible
0x43523c GetDC
0x435240 PtInRect
0x435248 ReleaseDC
0x43524c RealGetWindowClassA
0x435250 GetMenuItemID
0x435254 CharUpperBuffA
0x435258 wsprintfA
0x43525c MessageBoxA
0x435260 GetWindow
0x435264 GetWindowRect
Library GDI32.dll:
0x435028 BitBlt
0x435030 SelectObject
0x435034 CreateCompatibleDC
0x435038 StretchBlt
0x43503c GetDIBits
0x435040 DeleteDC
0x435044 SetStretchBltMode
0x435048 DeleteObject
Library COMDLG32.dll:
0x435020 GetOpenFileNameA
Library ADVAPI32.dll:
0x435000 RegSetValueExA
0x435004 RegEnumKeyA
0x435008 RegCloseKey
0x43500c RegOpenKeyA
0x435010 RegQueryValueExA
0x435014 RegOpenKeyExA
0x435018 GetUserNameW
Library SHELL32.dll:
0x4351e8 SHAppBarMessage
0x4351ec SHFileOperationA
0x4351f0 SHGetFolderPathA
Library WS2_32.dll:
0x435290 closesocket
0x435294 gethostbyname
0x435298 WSAStartup
0x43529c send
0x4352a0 socket
0x4352a4 connect
0x4352a8 recv
0x4352ac htons
Library SHLWAPI.dll:
0x4351f8 StrChrA
0x4351fc StrToIntA
0x435200 PathFileExistsA
Library WININET.dll:
0x43526c InternetOpenUrlA
0x435270 InternetReadFile
0x435274 InternetConnectA
0x435278 HttpSendRequestA
0x43527c InternetCloseHandle
0x435280 InternetOpenA
0x435284 HttpOpenRequestA
0x435288 HttpQueryInfoA

!This program cannot be run in DOS mode.
TRichg`
`.idata
@.reloc
bad allocation
bad array new length
unknown error
address family not supported
address in use
address not available
already connected
argument list too long
argument out of domain
bad address
bad file descriptor
bad message
broken pipe
connection aborted
connection already in progress
connection refused
connection reset
cross device link
destination address required
device or resource busy
directory not empty
executable format error
file exists
file too large
filename too long
function not supported
host unreachable
identifier removed
illegal byte sequence
inappropriate io control operation
interrupted
invalid argument
invalid seek
io error
is a directory
message size
network down
network reset
network unreachable
no buffer space
no child process
no link
no lock available
no message available
no message
no protocol option
no space on device
no stream resources
no such device or address
no such device
no such file or directory
no such process
not a directory
not a socket
not a stream
not connected
not enough memory
not supported
operation canceled
operation in progress
operation not permitted
operation not supported
operation would block
owner dead
permission denied
protocol error
protocol not supported
read only file system
resource deadlock would occur
resource unavailable try again
result out of range
state not recoverable
stream timeout
text file busy
timed out
too many files open in system
too many files open
too many links
too many symbolic link levels
value too large
wrong protocol type
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
InitOnceExecuteOnce
CreateEventExW
CreateSemaphoreW
CreateSemaphoreExW
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
FlushProcessWriteBuffers
FreeLibraryWhenCallbackReturns
GetCurrentProcessorNumber
CreateSymbolicLinkW
GetCurrentPackageId
GetTickCount64
GetFileInformationByHandleEx
SetFileInformationByHandle
GetSystemTimePreciseAsFileTime
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
InitializeSRWLock
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
SleepConditionVariableSRW
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CompareStringEx
GetLocaleInfoEx
LCMapStringEx
0123456789abcdefghijklmnopqrstuvwxyz
0123456789abcdefghijklmnopqrstuvwxyz
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__swift_1
__swift_2
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
operator co_await
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
bad exception
COMSPEC
cmd.exe
CorExitProcess
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
UTF-16LEUNICODE
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
AreFileApisANSI
EnumSystemLocalesEx
GetDateFormatEx
GetTimeFormatEx
GetUserDefaultLocaleName
IsValidLocaleName
LCIDToLocaleName
LocaleNameToLCID
AppPolicyGetProcessTerminationMethod
_hypot
_nextafter
]vQ<)8
|)P!?Ua0
Eb2]A=
u?^p?o4
y1~?|"
?x+s7
?5Od%
?|I7Z#
>,'1D=
?g)([|X>=
~U`?K
:h"?bC
@H#?43
Ax#?uN}*
r7Yr7=
F0$?3=1
H`$?h|
&?~YK|
sU0&?W
<8bunz8
?#%X.y
F||<##
<@En[vP
b<log10
?5Wg4p
%S#[k=
"B <1=
Unknown exception
bad cast
bad locale name
iostream
iostream stream error
ios_base::badbit set
ios_base::failbit set
ios_base::eofbit set
invalid map<K, T> key
string too long
invalid string position
map/set<T> too long
AVE_MARIA
zloy-1312
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
/17%)*
'*+?%"
&,&#7>(:,5'
o#2l#$2"f9";sh=
?4*6)4:)
p~66:,vu
*?)/gv
'/><-?+
.$73$4"
(%98.?>'
#(>"=
.$73$4"
#(>"= 4 .&
.8*()'h}gzkd
#)/6&#7'+
1.3b)"#
1(&$4
=)=9:6x3)9;1'1=><#x88u*;58?1'`l,,"7'*-$/9+$ (
)/;(6%
=;28/*z
+(65-:9
<=8".8:*o"b0'-2&;"9kc.<*bam**-#5!=+%/(t*`lo"())0e'%f?, +p~66:,vu
=7224-+)/$,8`";m-6n(1k+
%1%!".
\O:E8.-A<.2>*~>:4wut>2/<<34>% t
wiitkg}
-9-)*&
#9)+!7
ZCDOWIM\U57
!6-3'9
"")!8J41&6
65-/bi.?!86%
=;28/*
%%8(6;
2&*%/k
,7!7("<i
3<!!=z
#-'>"*$+=
$.&'1f!!%/k8"n=R[!^EXCZOCR)P/;>
/8'9!?
c",*";I`e)5+OZI0O6 'K:(F9(DLOM
C\`lo-+h5&&-($4mcb`l,&3h/);=+%/(nbp~66:,vur
wjqlso#4 }$'31=+?5?8-qp~66:,vu
zy}}3)77 *1)hd9ka9n~`q} 7u2615#{s9+
`n0*dtvgg:>k|}t
.CRT$XCA
.CRT$XCAA
.CRT$XCC
.CRT$XCL
.CRT$XCU
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIC
.CRT$XIZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$r
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.text$di
.text$mn
.text$x
.text$yd
.xdata$x
.idata$5
.00cfg
.idata$2
.idata$3
.idata$4
.idata$6
.data$r
.rsrc$01
.rsrc$02
~,9~$t
D$H.5&/
D$L(k"+f
D$T.5&/
D$X(k"+f
D$4VPW
D$8VPW
D$<VPW
D$@VPW
PSSSSSSV
PSSSSSSV
PSSSSSSV
VSSj&S
PSSSSSS
PPPPPPP
tFjD_W
D$lPSSSSSSSV
SSShM0A
D$Lcrpt3
D$T+t$
SVWj,3
WVWWWS
G@9w8u
WPPPPP
svlwPPj
/1'-SSSW
/1'-SSS
#,&mPPS
!+PSS
9E$WWV
t,WW9}
QQSVWd
URPQQh
tH9] uC
u PWQR
;t$,v-
UQPXY]Y[
t#Vh@L@
SWt@jU
_tqPVj@
u&hLN@
ARPRQh
PPPPPPPP
D8(Ht'
<at.<rt!<wt
<=upG8
PPPPPWS
PP9E u:PPVWP
zSSSSj
f9:t!V
QQSVj8j@
NX9^`t1
;V\uYW
u2Vj@hh]@
9C`u99C\t4
u29K\t-
WHPhx`@
HPhh]@
j$hpMC
ukhpt@
uG9]$t
PPPPPPPP
GetCurrentProcess
LoadLibraryA
CloseHandle
WaitForSingleObject
lstrcmpA
lstrcatA
GetModuleHandleA
TerminateThread
GetVersionExA
lstrcpyA
GetWindowsDirectoryA
GetProcAddress
WriteFile
CopyFileA
CreateFileA
CreateDirectoryA
CreateMutexA
GetComputerNameW
Process32First
TerminateProcess
ReleaseMutex
OpenProcess
CreateToolhelp32Snapshot
Process32Next
GetModuleFileNameA
MultiByteToWideChar
SystemTimeToFileTime
WideCharToMultiByte
GetSystemTime
IsWow64Process
KERNEL32.dll
ReleaseDC
ChildWindowFromPoint
PtInRect
FindWindowA
MenuItemFromPoint
RealGetWindowClassA
PrintWindow
SendMessageA
MoveWindow
GetTopWindow
GetWindowLongA
CloseDesktop
GetWindowPlacement
WindowFromPoint
ScreenToClient
PostMessageA
IsWindowVisible
GetMenuItemID
GetWindowRect
GetWindow
MessageBoxA
wsprintfA
CharUpperBuffA
USER32.dll
DeleteObject
SetStretchBltMode
DeleteDC
GetDIBits
StretchBlt
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
GDI32.dll
GetOpenFileNameA
COMDLG32.dll
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegCloseKey
RegEnumKeyA
RegSetValueExA
GetUserNameW
ADVAPI32.dll
SHGetFolderPathA
SHAppBarMessage
SHFileOperationA
SHELL32.dll
WS2_32.dll
PathFileExistsA
StrChrA
StrToIntA
SHLWAPI.dll
HttpQueryInfoA
HttpOpenRequestA
InternetOpenA
InternetCloseHandle
HttpSendRequestA
InternetConnectA
InternetReadFile
InternetOpenUrlA
WININET.dll
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RaiseException
RtlUnwind
FreeLibrary
LoadLibraryExW
ReadFile
ExitProcess
GetModuleHandleExW
GetStdHandle
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
HeapFree
GetExitCodeProcess
CreateProcessW
GetFileAttributesExW
HeapAlloc
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetFileType
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
CreateFileW
FlushFileBuffers
GetConsoleOutputCP
HeapSize
SetEndOfFile
WriteConsoleW
Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVtype_info@@
.?AVbad_alloc@std@@
.?AVbad_array_new_length@std@@
.?AV_Facet_base@std@@
.?AV_Locimp@locale@std@@
.?AVfacet@locale@std@@
.?AU_Crt_new_delete@std@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
.?AUctype_base@std@@
.?AV?$ctype@D@std@@
.?AVbad_exception@std@@
.?AVfailure@ios_base@std@@
.?AVruntime_error@std@@
.?AVsystem_error@std@@
.?AVbad_cast@std@@
.?AV_System_error@std@@
.?AVexception@std@@
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
</assembly>
PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
0 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
1 1$1(1,1014181<1@1D1H1L1P1T1X1\1`1d1h1l1p1t1x1|1
2 2,20242P2T2X2\2`2d2h2l2p2t2
3 3$3(3<3D3L3T3\3d3l3t3|3
4$4,444<4D4L4T4\4d4l4t4|4
5$5,545<5D5L5T5\5d5l5t5|5
3$3,343<3D3L3T3\3d3l3t3|3
4$4,444<4D4L4T4\4d4l4t4|4
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6l6t6|6
7$7,747<7D7L7T7\7d7l7t7|7
8$8,848<8D8L8T8\8d8l8t8|8
9$9,949<9D9L9T9\9d9l9t9|9
: :(:0:8:@:H:P:X:`:h:p:x:
; ;(;0;8;@;H;P;X;`;h;p;x;
< <(<0<8<@<H<P<X<`<h<p<x<
= =(=0=8=@=H=P=X=`=h=p=x=
> >(>0>8>@>H>P>X>`>h>p>x>
? ?(?0?8?@?H?P?X?`?h?p?x?
0 0(00080@0H0P0X0`0h0p0x0
3p4t4x4|4
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|5
<p=x=|=
=`>h>p>t>x>|>
9 9$9(9,9094989<9@9D9H9T9X9\9`9d9h9l9p9t9x9|9
:T=X=\=`=h=t=
>(>4>@>L>X>d>p>|>
?$?0?<?H?T?`?l?x?
0 0,080D0P0\0h0x0
1 1,181D1P1\1h1t1
10;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
1$1,141<1D1L1T1\1d1l1t1|1
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6l6t6|6
7$7,747<7D7L7T7\7d7l7t7|7
8$8,848<8D8L8T8\8d8l8t8|8
9$9,949<9D9L9T9\9d9l9t9|9
:$:,:4:<:D:L:T:\:d:l:t:|:
;$;,;4;<;D;L;T;\;d;l;t;|;
< <(<0<8<@<H<P<X<`<h<p<x<
= =(=0=8=@=H=P=X=`=h=p=x=
> >(>0>8>@>H>P>X>`>h>p>x>
? ?(?0?8?@?H?P?X?`?h?p?x?
0 0(00080@0H0P0X0`0h0p0x0
1 1(10181@1H1P1X1`1h1p1x1
2 2(20282@2H2P2X2`2h2p2x2
6 6$6(6,6064686<6@6L6P6T6X6\6`6d6h6l6p6t6x6|6
=$=(=8=<=D=\=l=p=
> >$>,>D>T>X>h>l>p>t>|>
?0?@?D?T?X?\?`?d?l?
0 0$04080<0D0\0l0p0
1 1$1(101H1X1\1`1d1h1p1
8/9A9M9
:^:p:|:
1%2B2V2
3N3U3k3
6(6O6T6
:&:=:R;|;
<#=I=]=
1D2L2Q2|2
334U4`4e4
<2<I<]<x<
=+=6=G=T=
>%>0>;>F>K>V>[>h>q>w>
?/?X?u?
0+050Z0q0y0
091f1o1
20272J2Y2
2#3)3P3
3;4L4`4q4|4
4-5U5r5
56L6d6u6
;+;H;];r;
<5=X=_=l=
>*>W>s>
?,?P?V?
2*262<2F2r2
2@3H3o3
3!414S4
5 5*5G5M5
6Q6u6 7O7^7
8$8)80888@8H8N8T8_8j8u8~8
9$9*90969<9B9H9N9
5X5!8C9
181D1V1n1}1
3!353<3M3e3
656H6O6
869E9S9\9h9
;,<Z<_<g<t<y<
>">)>W>
?'?.?Y?^?d?n?t?
0-0M0\0c0s0~0
172N2W2^2t2
2K4c4u4
5!585c5
6L7X7i7
: ;U;x;
;$<y<U=
1%1,1L1R1X1^1d1j1q1x1
2 2Q2W2]2c2i2o2v2}2
4C4i4x4
6,656B6X6
:":5:C:^:i:
;J;^;e;
;<8<@<P<k<
=7=L=\=i=~=
=:>K>R>Z>p>
> ?:?q?
0%0=0X0c0
5!5'5-52585>5D5I5O5U5[5`5f5l5r5w5}5
6$6*6/646;6A6F6L6R6X6]6c6i6o6t6z6
7!7'7,72787>7C7I7O7U7Z7`7f7l7q7w7}7
8$8)8/858;8@8F8L8R8W8]8c8i8n8|8
9#939C9P9e9m9s9
</<?<E<f<
= >(>:>G>i>
346G6e6s6!8X8_8d8h8l8p8
;!;%;);-;1;5;9;=;A;E;R;
7 7E7J7Z7{7
8!828C8M8[8v8
9*989D9P9d9z9
:3:8:=:X:e:n:s:x:
;";';,;M;];e;j;u;
4V4n4t4
9P:W:.;6<j=r=y=
001C1L1Y1h1}1
3)383x3~3
5%535:5B5Z5h5p5
; ;%;0;;;H;V;
=&=,=4=
358;8M8X8
9%9+969<9J9h9
8E:g;Z>`>r>
2"2-282J2U2g2r2
=6=Q=^=l=z=
6+6M6W6
89/9G9
:y;T<[<
='=@=^=
>1>F>X>e>~>
:@<J<m<w<
> >.?8?
5J7P7^7m7\8v8
8'9.9E9[9
:):3:L:
;#;^;e;
<#<5<G<Y<k<}<
9.:{:S;
2&373H3
4@5k5<6
:9;(<^<
0!0&0d0l0
1(1-121B1G1L1\1a1f1v1{1
2+2Q2}2
4/494I4N4S4n4}4
4#585\5n5
7 7G7Y7e7
9#9*919>9
:2:H:P:
4<4E4P4
6"6i6u6
<+>X>`>m>}?
'0D0X0c0
2&3F3V3
5-555E5V5
6D7r7n8z8
0@0`0k0y0
151T1f1p1
1 2F2m2
3/3V3u314a4{4
4e6p6v6
?7?D?t?
0*10151<1L1Z1k1
2!2)2G2O2
5&7+7=7[7o7u7
>">=>X>s>
?0?K?f?
0-070A0K0U0_0p0x0
1 1(1\1l1
1(282D2L2
203@3L3T3
484H4T4\4
5@5P5\5d5
6 6(60686<6@6H6\6
70787@7H7L7P7X7l7
8$8L8P8l8p8x8
9(9H9h9
:(:H:h:
;(;H;h;
<(<H<h<
=(=H=h=
>0>P>p>
?(?0?D?L?P?X?`?h?|?
3H3X3h3x3
<,<L<p<
=4=P=p=
Santa Clara1
Intel Corporation1%0#
Intel External Issuing CA 7B0
161108101340Z
181108101340Z0
Santa Clara1
Intel Corporation1
EIG1907
0Intel(R) Embedded Subsystems and IP Blocks Group0
&http://pki.intel.com/crl/IntelCA7B.crl0f
&http://pki.intel.com/crt/IntelCA7B.crt0"
http://OCSP.intel.com/0
Greater Manchester1
Salford1
COMODO CA Limited1+0)
"COMODO RSA Certification Authority0
151028000000Z
210617235959Z0s1
Santa Clara1
Intel Corporation1%0#
Intel External Issuing CA 7B0
f-j ~U0
;http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
/http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$
http://ocsp.comodoca.com05
intel.com0
intel.com0
3"|= :
L{pi:<
AddTrust AB1&0$
AddTrust External TTP Network1"0
AddTrust External CA Root0
000530104838Z
200530104838Z0
Greater Manchester1
Salford1
COMODO CA Limited1+0)
"COMODO RSA Certification Authority0
HCgNr*
3http://crl.usertrust.com/AddTrustExternalCARoot.crl05
http://ocsp.usertrust.com0
Washington1
Redmond1
Microsoft Corporation1)0'
Microsoft Code Verification Root0
130815202630Z
230815203630Z0o1
AddTrust AB1&0$
AddTrust External TTP Network1"0
AddTrust External CA Root0
mA_rZq
Dhttp://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0
O'y'=PsAL
Santa Clara1
Intel Corporation1%0#
Intel External Issuing CA 7B
iMgNoC
20180131163330.995Z0
Santa Clara1
Intel Corporation1&0$
Thales TSS ESN:E892-D055-162F1&0$
Thales TSS ESN:E892-D055-162F1
timestamp.intel.com
QuoVadis Limited1%0#
Root Certification Authority1.0,
%QuoVadis Root Certification Authority0
140530163555Z
210317183333Z0I1
QuoVadis Limited10
QuoVadis Issuing CA G40
SPq;=ERa
http://ocsp.quovadisglobal.com05
)http://trust.quovadisglobal.com/qvrca.crt0
'http://crl.quovadisglobal.com/qvrca.crl0
phDQcY
QuoVadis Limited10
QuoVadis Issuing CA G40
150424214443Z
180424214433Z0
Santa Clara1
Intel Corporation1&0$
Thales TSS ESN:E892-D055-162F1&0$
Thales TSS ESN:E892-D055-162F1
timestamp.intel.com0
http://ocsp.quovadisglobal.com07
+http://trust.quovadisglobal.com/qvicag4.crt0O
(http://www.quovadisglobal.com/repository0
)http://crl.quovadisglobal.com/qvicag4.crl0
&b= 3Im
QuoVadis Limited10
QuoVadis Issuing CA G4
QuoVadis Limited10
QuoVadis Issuing CA G4
ekernel32.dll
zh-CHS
az-AZ-Latn
uz-UZ-Latn
kok-IN
syr-SY
div-MV
quz-BO
sr-SP-Latn
az-AZ-Cyrl
uz-UZ-Cyrl
quz-EC
sr-SP-Cyrl
quz-PE
smj-NO
bs-BA-Latn
smj-SE
sr-BA-Latn
sma-NO
sr-BA-Cyrl
sma-SE
sms-FI
smn-FI
zh-CHT
az-az-cyrl
az-az-latn
bs-ba-latn
div-mv
kok-in
quz-bo
quz-ec
quz-pe
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
syr-sy
uz-uz-cyrl
uz-uz-latn
zh-chs
zh-cht
@api-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
kernel32
api-ms-
ext-ms-
mscoree.dll
BLC_ALL
LC_COLLATE
LC_CTYPE
LC_MONETARY
LC_NUMERIC
LC_TIME
((((( H
((((( H
(
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
american
american english
american-english
australian
belgian
canadian
chinese
chinese-hongkong
chinese-simplified
chinese-singapore
chinese-traditional
dutch-belgian
english-american
english-aus
english-belize
english-can
english-caribbean
english-ire
english-jamaica
english-nz
english-south africa
english-trinidad y tobago
english-uk
english-us
english-usa
french-belgian
french-canadian
french-luxembourg
french-swiss
german-austrian
german-lichtenstein
german-luxembourg
german-swiss
irish-english
italian-swiss
norwegian
norwegian-bokmal
norwegian-nynorsk
portuguese-brazilian
spanish-argentina
spanish-bolivia
spanish-chile
spanish-colombia
spanish-costa rica
spanish-dominican republic
spanish-ecuador
spanish-el salvador
spanish-guatemala
spanish-honduras
spanish-mexican
spanish-modern
spanish-nicaragua
spanish-panama
spanish-paraguay
spanish-peru
spanish-puerto rico
spanish-uruguay
spanish-venezuela
swedish-finland
america
britain
england
great britain
holland
hong-kong
new-zealand
pr china
pr-china
puerto-rico
slovak
south africa
south korea
south-africa
south-korea
trinidad & tobago
united-kingdom
united-states
@api-ms-win-core-datetime-l1-1-1
api-ms-win-core-file-l1-2-2
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
advapi32
api-ms-win-appmodel-runtime-l1-1-2
user32
CONOUT$
VS_VERSION_INFO
StringFileInfo
040904b0
CompanyName
Intel Corporation
FileDescription
Manageability Engine Firmware Dynamic Link Library
FileVersion
1805.12.0.1097
InternalName
IntelMEFWVer
LegalCopyright
Copyright
2010-2018, Intel Corporation. All rights reserved.
OriginalFilename
IntelMEFWVer.dll
ProductName
Manageability Engine Firmware Dynamic Link Library
ProductVersion
1805.12.0.1097
VarFileInfo
Translation
<<<Obsolete>>
Antivirus Signature
Bkav W32.SpyEyesaND.Trojan
Lionic Trojan.Win32.SpyEyes.l!c
Elastic malicious (high confidence)
DrWeb Clean
MicroWorld-eScan Trojan.GenericKD.37249392
FireEye Generic.mg.385eccb9e7113680
CAT-QuickHeal Clean
McAfee GenericRXMI-NY!385ECCB9E711
Cylance Unsafe
Zillya Trojan.SpyEyes.Win32.15359
Sangfor Clean
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Trojan.GenericKD.37249392
K7GW Trojan ( 0054f5af1 )
K7AntiVirus Trojan ( 0054f5af1 )
BitDefenderTheta Gen:NN.ZexaF.34126.ou2@aaJWp7hi
Cyren W32/Trojan.RTCJ-5872
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Agent.AARD
APEX Malicious
Paloalto generic.ml
ClamAV Win.Malware.TinyNuke-9863711-1
Kaspersky HEUR:Trojan-Spy.Win32.SpyEyes.gen
Alibaba TrojanSpy:Win32/SpyEyes.26aa6225
NANO-Antivirus Clean
ViRobot Clean
Rising Clean
Ad-Aware Trojan.GenericKD.37249392
Emsisoft Trojan.GenericKD.37249392 (B)
Comodo Clean
F-Secure Clean
Baidu Clean
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R002C0PGB21
McAfee-GW-Edition GenericRXMI-NY!385ECCB9E711
CMC Clean
Sophos Mal/Generic-S
SentinelOne Static AI - Suspicious PE
GData Trojan.GenericKD.37249392
Jiangmin TrojanSpy.SpyEyes.ppa
Webroot Clean
Avira TR/Agent.ouzrw
MAX malware (ai score=81)
Antiy-AVL Trojan/Generic.ASMalwS.33E8AE7
Gridinsoft Trojan.Win32.Agent.vb
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan-Spy.Win32.SpyEyes.gen
Microsoft Trojan:Win32/Mamson.A!ac
Cynet Malicious (score: 99)
AhnLab-V3 Clean
Acronis suspicious
ALYac Trojan.GenericKD.37249392
TACHYON Clean
VBA32 BScope.Trojan.Fuerboos
Malwarebytes Malware.AI.4123601789
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002C0PGB21
Tencent Clean
Yandex Trojan.Agent!XUAvosWD/oY
Ikarus Trojan.Win32.Agent
eGambit PE.Heur.InvalidSig
Fortinet W32/Agent.AARD!tr
AVG Win32:Trojan-gen
Avast Win32:Trojan-gen
MaxSecure Clean
No IRMA results available.