Static | ZeroBOX

PE Compile Time

2020-05-10 14:24:51

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x0000b024 0x0000b200 5.60893189489
.rsrc 0x0000e000 0x00047040 0x00047200 4.633386116
.reloc 0x00056000 0x0000000c 0x00000200 0.0815394123432

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00054204 0x00000468 LANG_NEUTRAL SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00054204 0x00000468 LANG_NEUTRAL SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00054204 0x00000468 LANG_NEUTRAL SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00054204 0x00000468 LANG_NEUTRAL SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00054204 0x00000468 LANG_NEUTRAL SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_GROUP_ICON 0x0005466c 0x0000004c LANG_NEUTRAL SUBLANG_DEFAULT data
RT_VERSION 0x000546b8 0x000004f4 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_MANIFEST 0x00054bac 0x00000493 LANG_NEUTRAL SUBLANG_NEUTRAL exported SGML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
v4.0.30319
#Strings
Action`10
IEnumerable`1
CallSite`1
List`1
Microsoft.Win32
ToUInt32
ToInt32
X509Certificate2
ToUInt64
ToInt64
ToUInt16
ToInt16
HMACSHA256
get_UTF8
<Module>
KPDrGKQSGTA
mghiTSHLrgXA
wXtVlsJJhaCFUtdA
yEFUGKzfLFeA
aYvBdwtCSIjA
OUzSThzMAfsA
FuxcbNsDfQpxA
ogtznWiwntJYOyMB
mJmdhBxmzdzSB
DyaNPnwKgTMuUB
bvcHmafOikgB
YkoyzRtuQBkB
zeiIwZCiOZuasC
UivgsKaqAGLtC
VptcWmRxCckJvC
ekZOrNcHlFRuzC
zKAHuzqWJRYWEhwFD
MapNameToOID
get_FormatID
EMUQNaqvHUD
ENBUIrVvziqvKdD
nmSoBSYShcdD
qoLqIlUXLHTDrD
ulCReglGYEOrD
aMwdDRgXrsD
BfFIqTwvpeKqmvD
kzCdePXoxD
SgRpTAwwOtlbsEE
aQKfjuVmQRKE
fFQmWTxKaPE
kBzcQJHUIcNljE
qiASqgxEmE
URvWcTuoDYvkIUmE
IjUfzNTyQBtlsE
IZDxNguprsE
AmuKnSieLGuE
TdpPrgXkvQuE
daBXMxUqFkJF
uevYsBDpLZVF
TFIauDkpiF
enWIpPrxPrsQckF
vKNjRRhSIetIRRqF
jmQaeDAnOlWDG
fHPUQHzhNdOZNkG
bGkUkSLFnG
oLGoaRBlPEH
OeGPBRjXZeNH
wCGBsioUTpNH
QHRScjIABqhLPH
iwwDyLaiQH
LlmVjbKnrmtTVH
QbEJecbXLehH
VmbLOxchdtWJwSqH
aUmJtFaxsH
tzoOkoKBcwCImtH
TpNqbPMUHfgBI
fqCLlDlVtdqDI
get_ASCII
PazlWAAitFhI
jcPnUEjmKcrI
IpVpkUIRmOJ
ObWBjuvrpRJ
afApcHwKSJ
LuPBjePlqhVJ
RCIBvXnjEQeJ
LcJiPenuXQaeJ
qjpRZNxlYvaZHkJ
jxStdejaRHLacgpJ
mlvUxRxBMsJ
qlxMEyJcRK
GFUzSWrQQUjK
DZjZlWyrZFJKL
llMBlembkXjQL
bNnmzgAykNsAxL
QrEXTGsiCGM
jUxuMSIpqpxDTM
CVWaIUcbfbM
IHLZkmzDYBNEWfM
efdngyGZSqqM
FrOAJtDXHMEwM
LvDklPUgLHDBN
yEJwpIfryoEKUhDN
uNmqgLPFHgN
QIjHVDnKjwHkN
gCwhmIPQZxwBO
bZpvimcGKHeACO
System.IO
hkuIrRwPilgiJO
QNszkrZcYGpEdNO
XtqfNrknrVOMyNjO
zXBGTePliYEOvO
ahfVUTfDHfsvO
BtsjkSYJVCP
wYuAPLaNeDP
IQojFWpQxJXbFP
uJDfdkakHuQHHP
GZtyXkjDrBLP
lVuvbOuXbLP
YMCodLbRSASdOP
lmUobhpEPCByeyrP
kunlfHuXPydpVJQ
EXMvRFGarfPQ
edIkmMhWLKXQ
uhHMAFVacGytQ
gNprsCGbiLDR
uucvToMuTjFPR
tpEAgWskNNThPR
UxBtmrAVBHjWjPR
acGJaHGIsxSR
FvfTggoETR
whvoDaWNMwgWaR
jDrMpNTFhxrdR
oyczImYeyaIIdFFS
sKtkdJagHBELT
axPKrijnUGpT
hyRGtwQhqAQpT
bvLrhxgIunqT
zlOlUvhzIHKCDAU
GLytXhjphHOHU
AycyfTiSvjuaRXU
TEEZfmbByzTycdU
KKVaVdpsfU
goSNBPtGqjtEiU
VWStgbkYzU
get_IV
set_IV
GenerateIV
coaXaMiGNJV
xYrnaxvUIGjyeKV
BhZNKcFXauV
FDIdKAunBW
pMwPqzCNEUNW
dtgfejnYqtPSSvaW
izUHsWvvSzaW
YaAVIFTeBdW
bnPWlapAGWydfsW
NyViJsatCETMX
vqTBzbWbBGQnX
uRvJHVWpLurX
jcbBTxnlAaBZIY
CTveVxkDyPSY
CAYNTcKzmlVY
lXwvLukpDXYY
hUoOxSsLPiY
lLyIAKOWrCkY
ECNCnbjbvY
HLkOHzIMPqyY
qGUBAXVqVhtGZ
WKQEzYHygesYNZ
UIaREfFYSitkSZ
WMofnKrejeZ
zMRjpcogusMlZ
izmUBpbHFKxlZ
IxljIdtRguxtZ
WgecUvGDRKVesuZ
EfXiRjJSxZ
value__
fWbGemZiwBa
JwNVdKXxFbjEa
ZEWRIkrlSNa
ppLeoCUygQsjZa
CgnJOPPkzqRfa
ldWZhCyameAma
AAltPwsgXqa
wjMgLpobEHGwVpAb
qdBumTewmkRCKb
tNnYTuJTzxMJEyLb
RmFRWRZXyBYASb
ajnYEeoLVoGcFZb
dpBQHZJzfb
voCjOQwCnftdLDYib
mscorlib
MPXceOlbMBtb
qVcsWSvrFSBKtb
FODsEaqHphdxb
XijdTDxSfOZzzb
KoilmqnubHdyYCc
DiFvtsOcMoDRDc
OXUwHeyyrJdQc
ofJDbxXskCOoUc
liDsNTMrkZlGac
mogwgwmqXRPRadc
System.Collections.Generic
Microsoft.VisualBasic
get_SendSync
zHGIRbirIsxOpc
CcBInSbBYfzwYrc
gGLJTkXIkDd
ZajFhkOcPNId
kOuhrFiCmdIQWNd
dLKBnPwnfxRPd
JJGHGkAIJBRwGJWd
HzwLNJAaoYd
EndRead
BeginRead
Thread
SHA256Managed
get_Connected
get_IsConnected
set_IsConnected
get_Guid
ISOdloRARzjd
<SendSync>k__BackingField
<IsConnected>k__BackingField
<KeepAlive>k__BackingField
<HeaderSize>k__BackingField
<Ping>k__BackingField
<ActivatePong>k__BackingField
<Interval>k__BackingField
<Buffer>k__BackingField
<Offset>k__BackingField
<SslClient>k__BackingField
<TcpClient>k__BackingField
Append
RegistryValueKind
ekGplsnrkQcud
yUqKBXogXpyd
DdzMVXUwBNchfkzd
OOdQYOFcqIEe
MnzNzKmQTIrfLe
RMvCZhkOFTe
enrAbNzDEnAbe
Replace
CreateInstance
set_Mode
FileMode
PaddingMode
EnterDebugMode
CryptoStreamMode
CompressionMode
CipherMode
SelectMode
jjWAMNcSSee
DeleteSubKeyTree
ROvuuCismLfe
get_Message
Invoke
IEnumerable
IDisposable
ToDouble
get_Handle
RuntimeFieldHandle
GetModuleHandle
RuntimeTypeHandle
GetTypeFromHandle
WaitHandle
ToSingle
IsInRole
WindowsBuiltInRole
get_MainModule
ProcessModule
set_WindowStyle
ProcessWindowStyle
get_Name
get_FileName
set_FileName
GetTempFileName
GetFileName
get_MachineName
get_OSFullName
get_FullName
get_UserName
CheckHostName
DateTime
get_LastWriteTime
ToUniversalTime
WriteLine
Combine
UriHostNameType
get_ValueType
ProtocolType
GetType
SocketType
FileShare
System.Core
Dispose
StrReverse
X509Certificate
Create
SetThreadExecutionState
Delete
CallSite
CompilerGeneratedAttribute
DebuggableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
DefaultMemberAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
set_UseShellExecute
ReadByte
WriteByte
DeleteValue
GetValue
SetValue
get_KeepAlive
set_KeepAlive
Remove
set_BlockSize
get_TotalSize
get_HeaderSize
set_HeaderSize
set_SendBufferSize
set_ReceiveBufferSize
set_KeySize
orJlQBKESzfTUf
LbqLColpRodf
NwFQmjmFgxtff
vvRSjmGJkf
aJgMRPxUZYpf
pcaQAjhojdyf
FxTbPcOlchwAg
oTscvloYqxecCg
MUBWazbdIDHGlFg
PTDhPCiqPGNLg
lHFVsnYRqnpOg
ofMLamGziSfjGRRg
moipRrgGUfeg
CryptoConfig
get_Ping
set_Ping
System.Threading
set_Padding
add_SessionEnding
UTF8Encoding
System.Drawing.Imaging
System.Runtime.Versioning
FromBase64String
ToBase64String
DownloadString
ToString
get_AsString
set_AsString
GetString
Substring
System.Drawing
get_ActivatePong
set_ActivatePong
set_ErrorDialog
VOZGMUEpCEVyg
YFfkLUxiEztAh
wgbHuPaUmDh
bMkODGEDPh
GsOBCitHaKzhQh
cELETvHhZHdeiTh
JbMubHzLZpTh
FhNQPLtAhgNah
SeuofYsSTUNsh
ComputeHash
VerifyHash
get_ExecutablePath
GetTempPath
get_Length
lgHRqgOPKRaAi
sYiLsSZeNi
XJxtKZICZJqElPi
vqjsZKBxaXZlPTi
UJDaxHjsmfi
OQZlNkQaVjvi
NnclMdwUcDj
PwBxMLZUfTmaj
kuESsgAQXufj
BuHwzCWnUvksj
EaogpBTegxFk
QHywOQmwcSrGk
AsyncCallback
RemoteCertificateValidationCallback
TimerCallback
RegistryKeyPermissionCheck
FlushFinalBlock
TWDDJtXWxfk
PpIpcCpcBCHZgk
gTNvnWQilBAl
yYQbgzwwTSgBCl
TSGaQqIJYBKl
zWYbJmsEpoRoOPl
hfWhbnqcHUl
RtlSetProcessIsCritical
NetworkCredential
System.Security.Principal
WindowsPrincipal
get_Interval
set_Interval
rNyeKefKDNcl
RrIIVaHjXIjl
kernel32.dll
user32.dll
ntdll.dll
nNOllIloJZJm
ceYuoUItFwJm
qCJftFFNEQJwdfMm
FileStream
NetworkStream
SslStream
CryptoStream
GZipStream
MemoryStream
oFxDsQcBem
QeJFVLTTHBkem
get_Item
get_Is64BitOperatingSystem
OSxdOtNmBHgm
SymmetricAlgorithm
AsymmetricAlgorithm
HashAlgorithm
iNxfxJGkbAPlm
MldmXXbPAQfULnm
Random
ICryptoTransform
HxjcEzAvym
rBWZuggZSFn
kfAFExOPsSgZRn
sjdpvuFyLmXn
ToBoolean
pnFToXDLAdn
X509Chain
AppDomain
get_CurrentDomain
GetFileNameWithoutExtension
get_OSVersion
System.IO.Compression
Application
System.Security.Authentication
System.Reflection
X509CertificateCollection
ManagementObjectCollection
set_Position
CryptographicException
ArgumentNullException
ArgumentException
IMIBegymMo
IgQViXDtHBebo
ImageCodecInfo
FileInfo
DriveInfo
FileSystemInfo
ComputerInfo
CSharpArgumentInfo
ProcessStartInfo
bZmUDZRtEzfo
vVclGIcNgbFso
JFeSgsXwVhPso
HcPVKBPeKQeFp
PXuuJzWbDTNJp
uXEJjAgOAYUUp
zopJaUzoWp
yrsceElgCejgdp
qwwuVZcqKlp
JQZAmULAjlp
vRpkakhktRqp
Microsoft.CSharp
PRqMdHUedYq
gIewbKJamadq
sAPZchDJDZjq
System.Linq
eKkLqnunEBxAoq
gELMnGniwJzyNr
QJPIHGPplWr
InvokeMember
MD5CryptoServiceProvider
RSACryptoServiceProvider
AesCryptoServiceProvider
StringBuilder
Microsoft.CSharp.RuntimeBinder
CallSiteBinder
get_Buffer
set_Buffer
get_AsInteger
set_AsInteger
ManagementObjectSearcher
SessionEndingEventHandler
ToUpper
CurrentUser
StreamWriter
TextWriter
BitConverter
ToLower
tnfxBgOIYyblr
IEnumerator
ManagementObjectEnumerator
System.Collections.IEnumerable.GetEnumerator
Activator
.cctor
Monitor
CreateDecryptor
CreateEncryptor
KrnUiZqyNjHqr
WdWzgKNzTsr
IntPtr
gSUrGmbnoxr
zQASzFAIzBs
NHHoghAmzOKs
System.Diagnostics
WfOrCyurcs
Microsoft.VisualBasic.Devices
System.Runtime.InteropServices
System.Runtime.CompilerServices
DebuggingModes
ExpandEnvironmentVariables
GetProcesses
GetHostAddresses
System.Security.Cryptography.X509Certificates
Rfc2898DeriveBytes
ReadAllBytes
GetBytes
aHUrDRHezfksXywfs
CSharpArgumentInfoFlags
CSharpBinderFlags
Strings
SessionEndingEventArgs
ICredentials
set_Credentials
Equals
SslProtocols
System.Windows.Forms
Contains
System.Collections
StringSplitOptions
pXLyqMhUVps
HBhzaoLHQDqs
GetImageDecoders
RuntimeHelpers
SslPolicyErrors
FileAccess
GetCurrentProcess
IPAddress
System.Net.Sockets
set_Arguments
SystemEvents
Exists
qmbyiuVLLt
tJzmemlaCTAxXQt
DpRRIqtZQABwXt
Concat
PmOfByIkkGiat
oggWiNcwwiat
jOkVTawGlat
ImageFormat
get_AsFloat
set_AsFloat
kbqqwawqHMbt
ManagementBaseObject
Collect
Connect
ByQbWKveqNdt
System.Net
Target
Socket
System.Collections.IEnumerator.Reset
get_Offset
set_Offset
IAsyncResult
ToUpperInvariant
WebClient
get_SslClient
set_SslClient
get_TcpClient
set_TcpClient
AuthenticateAsClient
System.Management
Environment
System.Collections.IEnumerator.get_Current
GetCurrent
CheckRemoteDebuggerPresent
get_RemoteEndPoint
get_Count
get_ProcessorCount
GetPathRoot
SfsMenFOKClqt
ParameterizedThreadStart
Convert
FailFast
ToList
oUsNOMgLDWtt
System.Collections.IEnumerator.MoveNext
System.Text
GetWindowText
njqyGdiqxt
PyyDciCpHyt
HQJdTpCxsVNu
xHHaTrlZhKscu
cmZlqMmWbJheu
hzIAwTYyku
ccnhBnVOfpu
IsIBURokLYru
oasrxeSWedLrru
hzmFVKEIkDv
iBUJQUYbcoEv
LeXvgeoUHiPUtMv
YGteWeyNIfv
PmBPJbXRGAeHhfv
mVHTEQGTIyyAuv
DvaTmstirzv
nFHcEdtVPmGw
grCXsGMkEHw
BPTRQXkrZTw
dqrbYKFzfzniCgw
JZSrZWnjfugEiw
sqIgOdyydiqehikw
GetForegroundWindow
set_CreateNoWindow
IFqzVVGVGwPvw
TsglEzLkuUvw
CEKHhYEiZpww
LDrBcdYZzUYDpeyw
eZrBZSOXzw
VKLidsuSRKdAx
sKjbrQACyMEx
tJWbKywOXvZdLx
YiDjtDApPx
lWgXskEtRImwlpx
GELjKNBLhbvx
dfumppoXxOy
ZSlJtLuwQy
ZslofGrAPUy
InitializeArray
ToArray
get_AsArray
XhAVnUYDKOwmeby
get_Key
set_Key
CreateSubKey
OpenSubKey
get_PublicKey
RegistryKey
System.Security.Cryptography
Assembly
AddressFamily
BlockCopy
ToBinary
get_SystemDirectory
Registry
WZXJQdPgty
op_Equality
op_Inequality
System.Net.Security
WindowsIdentity
IsNullOrEmpty
yrbxpNbrPgguy
sJozMVauUEdnuRxvDz
WkybOBNNyOlzFGz
HZPqgCQVyDZJz
rnUoUesbGcKz
AAsTMDhAbLz
NgSQCFyhekTz
PJOZGQcavbz
RWntGkdhWZXiz
mdaarPcIkIOCLlz
VOSxHZvezMlz
vdzbOEeCGuZcrz
WrapNonExceptionThrows
1.0.0.0
).NETFramework,Version=v4.0,Profile=Client
FrameworkDisplayName.NET Framework 4 Client Profile
_CorExeMain
mscoree.dll
sJ)pH mI
#rJ"&oH!'pD)h@
Z)|M!qD
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
</requestedPrivileges>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!-- Windows Vista -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<!-- Windows 7 -->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<!-- Windows 8 -->
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
<!-- Windows 8.1 -->
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
<!-- Windows 10 -->
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
</application>
</compatibility>
<asmv3:application xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" >
<asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">
<dpiAware>true</dpiAware>
</asmv3:windowsSettings>
</asmv3:application>
</assembly>PPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
Washington1
Redmond1
Microsoft Corporation1(0&
Microsoft Code Signing PCA 20110
210429191255Z
220428191255Z0r1
Washington1
Redmond1
Microsoft Corporation1
Skype Software Sarl0
E0C1)0'
Microsoft Operations Puerto Rico1
230254+4645620
Chttp://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a
Ehttp://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0
\?Gc|m
Washington1
Redmond1
Microsoft Corporation1200
)Microsoft Root Certificate Authority 20110
110708205909Z
260708210909Z0~1
Washington1
Redmond1
Microsoft Corporation1(0&
Microsoft Code Signing PCA 20110
Ihttp://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^
Bhttp://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0
3http://www.microsoft.com/pkiops/docs/primarycps.htm0@
*?*kXIc
QEX82q'
WqVNHE
Washington1
Redmond1
Microsoft Corporation1(0&
Microsoft Code Signing PCA 2011
http://www.microsoft.com0
20210810090515.669Z0
Washington1
Redmond1
Microsoft Corporation1-0+
$Microsoft Ireland Operations Limited1&0$
Thales TSS ESN:3BD4-4B80-69C31%0#
Microsoft Time-Stamp Service
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 20100
201015172822Z
220112172822Z0
Washington1
Redmond1
Microsoft Corporation1-0+
$Microsoft Ireland Operations Limited1&0$
Thales TSS ESN:3BD4-4B80-69C31%0#
Microsoft Time-Stamp Service0
Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z
>http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
Washington1
Redmond1
Microsoft Corporation1200
)Microsoft Root Certificate Authority 20100
100701213655Z
250701214655Z0|1
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 20100
$`2X`F
Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z
>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
1http://www.microsoft.com/PKI/docs/CPS/default.htm0@
oK0D$"<
r~akow
Washington1
Redmond1
Microsoft Corporation1-0+
$Microsoft Ireland Operations Limited1&0$
Thales TSS ESN:3BD4-4B80-69C31%0#
Microsoft Time-Stamp Service
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 20100
20210810110722Z
20210811110722Z0w0=
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 2010
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 2010
SHA256
5gLaDSq7ZS8Moztdc03rpxtiHmPD3bEg318UzlNV2mpiFyO8MX/iD6Rx8DzN0wIhzJRtiiBb5W1Oc1mjaTL6lA==
zLT9r0Oy+4VUgj8ups925Zr9Eb4oPR3vjRJgqHwsU+ecLqoobgYImDBSmUzkz1dVhGQWoHLPcfWPDddWWd7JgQ==
6wlt9OPDYBBK65V3YTKGaBTN7jsee+8ohN8gzX0R3/FZ5Q6sKqEKSdpCRdAcWDN29HXZnDWu67KJZZe9ajjzHQ==
maroL+XJvDPs9+LkZXdwR9jgMwR7fzRBOWChqWspXZLj9pVFvwwK7UNIyLfRspP16CJSKgIwWZMgTCmntKNp0g==
%AppData%
WindowsUpdateer.exe
YUxuVEtTcEh3a3NENDY4Z2l6RFlKanpLWllsQlZLRXU=
z1j5XTTIk7AyXw1McG5zrXzC8icFFnuD8kQSEMHF94lZJMV6d17J6+ArRwDNErPqFrOGo7H4iOHjmhfTprki3Q==
NSjEBoL4bA3A0JH4ouiBVNxODA+xcgokgj3SaG2h9ypPxljW1h8EaFEg9JLlYhmBKuhBozDXdFCQCnpYkAx1QYiDey9TtlPkj4Q98ZZI6nYPGV+857rMoKO3B62J7dsaRQKMhrJcdxpP3Q7dq+YEUnzoXUP6ebumuV5jC88xTrzAgHjBa39x+wltBFWKKC3DOfWVrhiGt2q+ebG9Pp7l4xjbj4MYl37Oqvh6hHzdamUbGxlqCaD5Ipgdo4APUbZ7CLNqUCnQSLY9VC0VVXuUq/Lj1rniTkC0RyOePHCI1Ik7iZpvKWRynWCd68o9a8QA6feh288xJMpW1jFCPhowyaIE3kW8TQS5wC7IA/oKeupl8ScW03aIiz6XqEJNQoCK73gicbFtkU6sFXpp4tYU6exply/RmAg+aqsUCkSb7kY8bHp9AsC1PX+tQwW/7jYwyDzUpLSCEu9Cc3ebg4UD8AVwn9ZM2FK8X0ClmSxj8uNAq4rypa0BFiJE5/mR7JLE7HwVLyLXfJLHSW/xsftffbLDxAVhESNSoMDnyWgDXqJJvZ2taWufQG5j0afk8Od+KJBvtbYN6SbzfhTKOYMaC1lXD5Vrec+elCtqZHvaVFhUGrl1hnSB3g4+A3oELjozj42HgUtD/zeUrbV3umARKurqonwU3alK8Eskf5tRWg8tsDpAZfw2qWTd0nvPvJAS+lLS03MfvS4fk7Y9lk+jshPuTS3rzfWVfrjSX92zuER/8Y1p8tRlP8kJt8MLk6Ieuw0gpCwebmYF3YsRznZWVJb0kkEibTOzACWsb085ypYLxRaD/hD0cEjOvcIG0qotMrsWM7zgvFI1W4kQUhb7iUnqvDCkctIzal1MDWZVZVB50f3/BTtvyULGPKnIKiHD1sQNh2alPuwZCI3WnnpFWciT0dlbDi22nv/6uXfI99LtADyCtrrjGYL8MbVHDsbEnDaOQxE3SO2qVI3hnZrLifz4wTsHgsRq9xHdpbF5nSlsTHdZU8fQZkp7vzKVnva8
sDYiMm0zb4WYtDjPJ8bRp40JX/0CiXpgweg4BZjXMGo55imPovtxj7RSlg/OpVJsvQkpo5CSc7PcQxB3Soc2b9KgOcZ3Sdd0iuZkhW0ckCXA1NSBaIO2+yogbBk2XZO4iwj51FkdPDPCBddTf7iIp+2/YvMYVNINEeBG9M2V+DFukite4mrjm8FAwVgyDP6SxHv7rIFhhtyZrDCAUu0bQ+8k3a9L3cce7wkcwO6r7pYFSYex/AK5tEOJl3un6xLBxFSxiE+v5u4SBdA6Xc0N4324S7dZmTjiu5+R2i6BRGcgrRwBKpuRYqgb+oselwZ8ppCJgZS2xPpm6xjGK6Iy4vYRmsjJwNnVi7edyFU9IRfZvTVaK4vm4fmjjfV/oCY48NKETMgH4SvsL1jwNgW8wB/MoUEOqxnho0jD2lQb1FlY6iBddSTZz2LMUnkDPNZw0RmsYyIx+nIrZHMo8t5T8+7HPyRgyvtavVFrWG7/HpTKi/p6A9jG6M+lzBO8YwoNXNV22hekuMIXJCPk/cjWG9WPxtQTowRiib7WzsSN2mMCCsU2Iby6os3V6dnTc3xx7VOWB00gKNdZzeBlwDjRffW+8X3b/w7Q8OOChOfvj79dtNPGtDbxEsSysMNJvaMPOyDdDMM/ACIMuNau6o1om16mgLk++XkYC0Pz3sF1q0MJELA3tcbEtkGZ5aGJSUqnPFn8+BI7S5Y+PwL0rByxKSXQ+KWnQh2CiNrKtiJ/qORg8LllOLDCYY7CQSnr4YQXKxTCPeWxtMscOodGc9cK1wpDc8w3zljT0tqRygMJe/7U7OXNTFS2xNPfCVTrsgwwzAMSchU/7nhlmhA8EFGmPDU57Iz2609lziBC+G/OYdcijrMfBwUmLjA/EDA78bxa5mkgjrH4LP0HrP0AiwPSOEV5C2xh7EGsC2O4HVvlwzEwE9DQcc0x5JVAkJKdPkSyWRHPdsQ6m8SxXV0I10OwVA==
Sx25tRdpeC7lcY8ktLeqyQ1IsZPUC2mwsRKBUNPCuPriMQE4t4qV0FzQrcqfW2GckLkVke6T/KWqKdIk6Wxmjw==
RVgJMZ82xiz2oAjBIVa98nuXLNDxQq+DnvR2kxwaCiluGI++u2+RDLp2GKGJN2jel0zlJ0uWmtahnO27VTPZ5Q==
2bmQIWsPxWygZhZNfPq5HTjdWw0xwjRj0OLB9lWdabbP8XiJNSV1z9iQicnBQU8/s85HRCsQ42mW63Csl25ucQ==
aRYCsTPSaLJJ8XXypjeP0LCrLf3wYCAxH/gGV6EGi6HRU8PMuXdhdLdOYV/df+QpUugETYxRndxBlATJi5/gog==
Packet
Message
/c schtasks /create /f /sc onlogon /rl highest /tn "
" /tr '"
"' & exit
\nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
@echo off
timeout 3 > NUL
START "" "
" /f /q
Select * from Win32_ComputerSystem
Manufacturer
microsoft corporation
VIRTUAL
vmware
VirtualBox
SbieDll.dll
Err HWID
ClientInfo
Microsoft
Version
Performance
Pastebin
Antivirus
Installed
\root\SecurityCenter2
Select * from AntivirusProduct
displayName
Software\
plugin
savePlugin
sendPlugin
Hashes
Plugin.Plugin
Msgpack
Received
masterKey can not be null or empty.
input can not be null.
Invalid message authentication code (MAC).
{0:D3}
{0:X2}
(never used) type $c1
(ext8,ext16,ex32) type $c7,$c8,$c9
MAINICON
VS_VERSION_INFO
StringFileInfo
040904e4
Comments
This installation was built with Inno Setup.
CompanyName
Skype Technologies S.A.
FileDescription
Skype Setup
FileVersion
8.75.0.140
LegalCopyright
(c) 2021 Skype and/or Microsoft
ProductName
ProductVersion
VarFileInfo
Translation
Legal_policy_statement
Microsof
Legal_Policy_Statement
Antivirus Signature
Bkav Clean
Lionic Clean
Elastic malicious (high confidence)
Cynet Malicious (score: 99)
FireEye Generic.mg.ef125f7a35d65a62
CAT-QuickHeal Backdoor.MsilFC.S13564499
McAfee Fareit-FZT!EF125F7A35D6
Cylance Clean
VIPRE Clean
Sangfor Trojan.Win32.Save.a
K7AntiVirus Clean
BitDefender IL:Trojan.MSILZilla.1627
K7GW Clean
Cybereason malicious.a35d65
Baidu Clean
Cyren Clean
ESET-NOD32 a variant of MSIL/Agent.CFQ
APEX Clean
Paloalto Clean
ClamAV Win.Packed.Razy-9625918-0
Kaspersky HEUR:Backdoor.MSIL.Crysan.gen
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan IL:Trojan.MSILZilla.1627
Rising Trojan.AntiVM!1.CF63 (CLASSIC)
Ad-Aware IL:Trojan.MSILZilla.1627
Sophos Mal/Agent-AVM
Comodo Clean
F-Secure Clean
DrWeb Trojan.Siggen9.56514
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition Fareit-FZT!EF125F7A35D6
CMC Clean
Emsisoft IL:Trojan.MSILZilla.1627 (B)
Ikarus Trojan.MSIL.Agent
GData MSIL.Trojan.PSE.1DQ5TRK
Jiangmin Backdoor.MSIL.cxnh
MaxSecure Clean
Avira HEUR/AGEN.1143588
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Backdoor:MSIL/AsyncRat.AD!MTB
TACHYON Clean
AhnLab-V3 Trojan/Win32.RL_Generic.C3546893
Acronis Clean
BitDefenderTheta Gen:NN.ZemsilF.34126.vm2@aaKuHrjO
ALYac IL:Trojan.MSILZilla.1627
MAX malware (ai score=80)
VBA32 Clean
Malwarebytes Generic.Trojan.Malicious.DDS
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Clean
Yandex Clean
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_92%
Fortinet MSIL/CoinMiner.CFQ!tr
Webroot Clean
AVG Win32:DropperX-gen [Drp]
Avast Win32:DropperX-gen [Drp]
CrowdStrike win/malicious_confidence_70% (D)
No IRMA results available.