Static | ZeroBOX

PE Compile Time

2021-09-10 16:09:11

PE Imphash

5cc235dd606b429af749bcc4d7982503

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00005034 0x00000000 0.0
.rdata 0x00007000 0x000024a2 0x00000000 0.0
.data 0x0000a000 0x00001b20 0x00000000 0.0
.vmp0 0x0000c000 0x0031679e 0x00000000 0.0
.vmp1 0x00323000 0x0053c7c0 0x0053c800 7.95661936547
.reloc 0x00860000 0x000005d8 0x00000600 4.21887773204
.rsrc 0x00861000 0x000001b2 0x00000200 4.46745511419

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x00861058 0x0000015a LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with CRLF line terminators

Imports

Library KERNEL32.dll:
0x74f000 DeleteFileA
Library ADVAPI32.dll:
0x74f008 SetServiceStatus
Library ole32.dll:
0x74f010 CoUninitialize
Library USERENV.dll:
Library WTSAPI32.dll:
0x74f020 WTSQueryUserToken
Library WININET.dll:
0x74f028 DeleteUrlCacheEntry
Library urlmon.dll:
0x74f030 URLDownloadToFileA
Library PSAPI.DLL:
0x74f038 EnumProcesses
Library WTSAPI32.dll:
0x74f040 WTSSendMessageW
Library KERNEL32.dll:
0x74f048 VirtualQuery
Library USER32.dll:
Library KERNEL32.dll:
0x74f058 LocalAlloc
0x74f05c LocalFree
0x74f060 GetModuleFileNameW
0x74f070 Sleep
0x74f074 ExitProcess
0x74f078 FreeLibrary
0x74f07c LoadLibraryA
0x74f080 GetModuleHandleA
0x74f084 GetProcAddress
Library USER32.dll:

!This program cannot be run in DOS mode.
`.rdata
@.data
`.vmp1
`.reloc
@.rsrc
")j:x;Fazs
ib`+T3
ku/'z58K
~X*mH,C
m(a,G;1
.,G3*8
K9"[|iZ.O
UZ?'R-
KTNp{S9
ARAVUfA
J<:mm
s>1{r4
fn,7)F0
-as=kE~
wd_G5"
^tBVq
AkP@&=;
!#Qm&v
fmW3ox
0DC""x
4f%[)6f
cp5pSwB
i7xe8xm8
z8Pv$Y
D14$[@
5rm[H+
Me`3s2
kcwb;
sxxW3T
%/$I{!
_TSsw;O.
7y%^Ar
mt,xU"T`R/
&gh|`U
`u63mp
q|Yy7rh
]Ca]^0=
GrW1e,
zZ5q;.TY
5pxDrX
dSf@d)
GpFEwn
-qGrd2
{jUm"w
|XjWv,
r=7r;~
'sU{k/
EGzm`x-
Oz%wLG
z@HT4tnW
GetProcessWindowStation
rxS8#q
yyBHI~5
L14$[Hc
qywKf;
bRM(]V
rW[okr
3=rUG10R
M(X5r9
B|@MY3n
Tta7fN
e+7r,i
Nw40n =G
u{nF"G@H~
3qB>v{P
4_)i&!
c[I~4?
.#>Pb/N
p%[;r$
t)>"1f
vlK)w#
PS9Ffx
#a1qZh
@6v;m'
7r/+r{
zQ-fS;
MN\jyZ6
t-,hP-(Y"
ES|fr1
_V=lR?
YY7uA?i&
sijx|j
Kj7`$pL
s-g+vrR\
QgC'1B
V3T_R$W4,
ha7a3?
iYr1tR|
o-&1(u
tYrq$O|
~Dy#`r
,p@pM]b
c9rg"X
ne&$f;
_A]A[fE
gkQES)
.X~P\a
[YX^Z;
(3<[A:
5SD1,$
y 5lw
_w{L/
Q8S\%S
FrA.;c[
VgV*doo
dP+uf;
=E.2k3
M2$lAr
Ij<l%~G
X2gjD\
H$6s[
,a^,.{
P,lGYJL
7`H=E}<
WR[*qS
t"vMv#
GetUserObjectInformationW
vTH{ a7
~V9M 3
Er*_0`
?tX7'C
C5@\CM?Vw
h8,g5J
q@8,`s
%A]A[fE#
J<yTmM
t(bqtM
(d0YuW"Tt
H-B4rT
$VOyb>
d7"SR2-
m|e~'^C5
6Ws"LX
X%\bT
Xa0rhfG
`$=4gS
~+g4r"
RGiF79Jp\
J}@'C;o
yfe^{"
kWJI>(
!_[C-v
}z<9OO
4dp8\fM
Qh}xUa
W4H#~U
{M)T\}
k*Hp3l
Alv^ >
U3\\mR
tNy/<n
O] `2)b
l/7Tnd7
\0*jg
*(.k#UP
l@Z|J8
b!|kuS
{|8,xg
8/ZRl
Un,uei[
o8:9hO
M+YHmJ
)_WHmn
t[]Zt<
~IoOMW
^rk.({
9]+;>*
W8Idg?>
6TU*g]
jUAe;\
9y'Am[
X)$OvZ
=-|nF{
v=p@p(
SD14$fA
bi9V-4
'X(:@d'
o8n_o"e
UM$7ZkT
MNrTTRNzU
<m#vMzu
=Y7+N|
]A^AZZ_A]A
bAXA\AYH
xQfi9EP
-mpu{HV
Q=VRx )
)>o(K >
-Pj8gG
7I&8nZ
4d$YSQ
R6Bw!(
VwX3*Z
*q,"9j8
Z:![Dj
VmSm'
P/K(k+
AkK(k+u7
Z'xbdN
1z'5rd<
X-Qpm|
g~-(sRr
xN-eE:
rMH]BJ?
D!Q,t&&
Ec('2
+n5Cr_
qLiZAr
d.'F^32%
_jV/@"
rg^ZH(
W2dte?'
&ZH6.
p"W6SXu_
:<,>%q%
zQvj|G10
J!}xGp:
aHC\p$xSf
4#EUh(
C7 j1P
h5vxXTW
i.D"Y)3
_B]SoE*
4Bv]m3
/Qey~X
sPq6"Y
c9=DS>J
N=y7~:
UU$5eRS
T0z9SG
xQ`FHV
S1,$[H;
@rA7Nv
;!OCNP
z} ]Cq*d
\Mwm^@2
Vwcov
DeleteUrlCacheEntry
:?i77m
a!U92[
(W.y,YE
I6rUb?
>@^-+{
PYi@O
g5rY]9?hnI|
70G'RT
&11U'\
{u36Yk
m8J]rA
~M5+q~Mw*jn
(IFL$)a
{*0I[}
6.@B~C
edjf#?
]:<^+f
Fo#5oo
P1SA/B
I26 YKE
hGZM(K
c [4;
9_S!m~
c=f-%+
DqKS ?
=,(f'.
Lr3C{j
F0<\U}
3eN~4y
PCQUN=
Ndj,m
c`._2i
ha?/XfH
Ee{\ub
.K,Fa6!
t?u <%
BWY =y@
=)ZrDP'(
O4r,yi6
|9r2r(
eX>kq_]
|Y^]-P
A4V\q3!
wXO-G_8
xTS88EW
D1,$[fA
DLzTfqE}
>{.?p#
1]ry`T
m\f6<U
}5*DM2]
P1n7`6
KY35{^D
X'z'_P
f]wFVZ
3LHT@>
n>S;/|L%K
TPea{qH
=U":)"(
$#pJ!&JB
fSsBf;
Li<,@
5(0Q:U
@E)|x*
LOVv#c
.X\Rmi
:'}WhY
@:(KQ/
HQf<yZ
Pp`D`3
twt,?-S
+|adVe
eau!x
m|wS-b
s8xb{HI4
.f=Pl-
>xc@?*
OV0Tmm
t~6p3x
5&<aDH
x]{G=f
q\ry,Jy
b}aAAR
^K^~n!@n
-}\rt1Fy
e*ppm
*\c^m}
'L?bp3
)_ZJmF
%EK $|
N~L9g#
]q%Ci
(vF+t?t FBr
x-)NUd
q0GK^<
*R'3{[
vS3|'Z
?/2'8X
K>;}{9L
:\q>mU
MWN/cU
w/-$|D!
01 '"}
\rg"7y
P@2Q(bz
#jEJ~-
d<r4a_
4>Wy6.
yOa}D/
+WbisU
xTcU5OI
Y\xgr?
5)esZ
~3uiqFWRX>
qpg{'0
>H 9Et6
;Gu*Q+
n/o.6l
/Vqm]=
i>R8nI
ylnnIk
Jf=}$;
0JyViVP
!q2GyY
LPyfm*J
xqPf$E\
k>~xRI!
%~{1'hx
=JqiD7=
1;gYmN
GetProcAddress
%6->7P
2i2r&8u
BV$Se>U2X(
e*":1P
8R:;!n
r>usWJ5Nhb
GetModuleHandleA
(hT:+#
wb`qYBn@3
54:WPy
<9*c;$
w1'H%@
BFw4~B
NJ[h1@B
rx_!RF)
5aFutQ*UW
%z8'>?
/>t\H^,
wP`' H
)%_:xU
WTSQueryUserToken
W/3rv#
D2nKm#
<idxa;
Nq ~JDP
^5G)dx
Z}@>Bc)<
3~2S[(
0r)9.
2FkfV9k
<12|e2
GCW|lg$7r
B4:?mm8
.$Cg@>
nCfM{u/
2EiOOM
[QA[.2 S
8|U!G!4
xl4I!U
OI{gt
_PL>a;@
b7GMZ-
s1z&nn#
8#]~.=O
9_q_m~
0rYos.
=:u'>Q
b5vd#bq2
s.37]7
lSuY(J
~NHTa+
^=6uJgL$
$c_!If/
5$*d$K
a blZz
0MUbpP$
r*5%(
V)k~&r
g]_sDG
P2r}8k
[/F zP`}6
)s5RPv
_2\f;
*r;>Gk+/
_95Pmx
p73pDh
{?G\zr
];a#mJ
~2Nc,
Tbi**n
ld!!V5A
D/[%CX
()'Zy
)"eO.U
0<*lF9{]
|)v0rP
i5]]^u
1fBu+A
MBa<JDCCQ
Bda@rc
o`%3_gR
tR4qB~
]A^AZZ_A
QAXA\AY
o:5@r[
nk(fPr
7|yE2j
inWm3L
wfv)-|S
zubxS`
QV'X?e
IAN3R5
uco0&V
dP+uf;
DfFGaEv
r7Gr.z
)#Y^
t@=9}f
ALq+{U,
)2j& sls
jW2FD>
4#Gt@_l
qDYNvnNv
}[T=ip
&PePm!
T irgQ45
>4/K?
Rr}8+w
(-LSNa
KjHnNxq
_oRr.[Tw
.TSeW#
POIkhnE
b/g>za7
c_~G;y.
Tc**_Z
o|_{h
yO#.~8
D52v:2=
#k6m\Ev
7HhF_!
urlmon.dll
Fb)K;F#
JX;414
MHn$M.
~RViCn
S14$[Hc
M5EM@Yk
^;.lxp`/wp
${W?b;
;W1cLp
!y*m%1
1S\/e0*
3E=V[j
xMP|*ER
n1>cR!X
Ij(r)Z
hC2Z:rV
+fJa=c
JAe{v?
y;tG`4v
*i1RKwR
OB=r6sy
=$EYA1
~oNEYg/
WT*40+
PrLz`N
Nr U%k
4@OGD^ky
([q@}q*c
,a=;z:
qzi7>^
;qvu?:
/93YM I
jF}\x8
/wp>p
svdqCq
s4M2tC
,?Iuv!
~8lMFb
SD1,$[
\kQHXo
D1,$[Mc
:|UfD;
SD14$f
a;=rh-
#>bHky
9<$|}=
nQtPku]
p.[p{=
A4aOH1
Iu?pk<
SD1,$H
/#=r~K
%`L?ra
m3Sj@n
I{9ID:
ecnme-
UGl`2zr`@
GmYf3)}
jkzq]h+
.X/1mi
zw"sz[
"Rc2*=0
`3bWo%*
S5/[I/
X9Sr1t
{Wn-lM
iRh~YpRI
8+xqC:
ue[uhleV
VaN(35m0j
ol4X|/
kT-'[H75
;5mst-
s4J~Z\
J0g6MG
ZK$(jLS
;'8fj.
g&,)6/
wO`[GH
l'=Y\ J
A#y*q$
Si]id_D
t6Bj6X
e{?vrnl$
$0)'X!d
2ge[ZY
Mx|aRq
dD{myN
5\@"S:E
tB!eAS
%U0#Cr
[1SB"I
ol%$JK97
t:yj6d
q /46J
C2,B^B
!`0g,t"^
A^AZZ@
KsvU=a
)c@>um
-7me \%
z964ntI
U>+K04O9
Ssg".h
0%ya-{Ey+
^0oX"7
pMG6_=
WININET.dll
%{Rtr
~JQ3y=
3A=>Ls
@0!}NH{K
%pt>r9
``'PWu0(
VmU6L[
2Z-<o
Ix|)s(
;6*H&cN
PT;*wE
x`M-+EA
[jEN]RJ
^.EP w
Z[+{;s
udV /2
Fz6v$3
gL%u'}
k.11.R
fUG2VR0
P9^C`>)
^DxKnC
N-49$
c)pJ2
s@<8CGK
/A(wF_
h(a:X/
E,%Iu+R
j :z2d
Mw@/j<e
r)l-B.
b@ _3I
_-(^o*_
DEu\tB
iA1/YFF
=rFp?#
=<Xbt?
pg?97-
QeXWab/
ad\)r
$krH]s.
=t*v@Q5[d
!Wb2mn
^$BsDk
Md\!4j
[v>8<d>
QNj'T$
@bG5]Z
6UBkvAh
}`Ec q`
@N->nTB.
1yH5-|z
[+0ks<3
@7u0;G2
`\d<k
.&sifmB#
?j["rk
B\8#r[O
],l.Z[
oX|P__
#0$mr9
t0!RD7V
Y4e!i3
qdA]0r
zer52y
b{^.~a
we1#ON
l'ign9+rG;i
3bl\!
%Yh9@P
y29U}T
4B*]mc
Y_cG63G
|r_J"]
UR?r|9i
[r=`B*;
]ya9[x
07$c^+h`
GetModuleFileNameW
1q )/1,
\:,]mC
uW>z11
f8^c71
:9J,k0
[UVbkR!
TB-7S5
</,;h
)trH~=(
sIjYyFEJ
AXA\fA
JgMr;
Or|i_F
#E[mMa
r-(}F$4
a_r{m;
<p5K1H
0eX=rd
]d\>N%
F8k:~;
J{svG:
Gic|@e
q$:Mr}
5+GVeQ
~:AdLC
.l{\L>*
i0>a7'
4wMgh!
hMhjWp
qF,]A^f
A]A[fE
SYWqSfD
D1,$[Mc
=@2`*3
AgI%~gT
i.=8@/?X
"oc=hh1Y
UOzLeH
h"rM9+
xK>?HLI
c#c=S$
N''N~ P
`jw)Zz
y<D#rM
gm@\Wj7
(qjYj*/
&pa4$x
ddI=h=
xnk@'E
\uu{lr
L;u?sc
$"L3ms
g?b]jE
wK7-c;_
Jw#r+
Aw-Zyok
%p-3rY
S1,$[Hc
-7:w
LocalAlloc
S]y[cZ
5!fN<
n0qZ?9
~Y=(N^J
e1`*U6
H5$Yx2S
qY|A>r}(z
T@fQMQ
qbG.Mr
F$tNf
0U/<rl
?`EVjd
<[5]S2"y,Z
_b<#6r
d sRc[
!3cDBj3+
},)f5`
\ahlfh
j>rb'Q
1+kS1,$A:
[X<x_)0
a<xP|CIv
nBHf;
;>%YVo
bYQI5,Uc
?3uS)`
)|k<ru
(IcdJ{
k9}X[$
14$[fA
52v:23
G4>r~;
{y<9oB
rp-}"
u_<r4
B+XNf)x
G,l5lR
V"rb-P
JOX=Nc
Ysp1D{
%EtLcs
\`A57=xr1
C'79b_E
F's*)t=
V_p6dcV
qu3f |
-t')|}
Wpfegw
qywKf;
6(D}G4
a&dB96
$=>NEb
4hMl+0
SD1,$I
8CP][=
}*gwy1M
3lm~ .
,qgTLBf
63z;<P.
a5zN0G
/2LG=X
'u1}X/
F63$lr]
|hOW6*=
k6r.{P
n\+:ErJ
rkaq:%
wG@a+b
Eh3#f=
,K#M%*6
\;rXQ/
qk%+-4
QB59|C
6Qx!gX
jPln;Y
W=dog:
LU9m|RN
T-" SZ
!),;bE
O!i!Lu!<lp
D(/o{ w
3az|b2
K5>.h{
T[}bU6
1ZdGo'aqG
G US7Q
MD $}^{}
D1,$[Mc
,jzOH@
NqnO@:
/Y,[m@
bqyebA
PcOsg$"
CskD;@
tQ);rX
FFSE>9
1]pCAv
bw} dM
$8;cv[8
e|X:8P
-U>14yJ
x'oO)X
lN=IpM}
SYIKv=UF
c'r:9l!u,C
dK>UsonS
@;S|^i
?*eo~kT
SD1,$H
A@7;Dda
>Qo'u\
,=6^EQ=*
A-8$xx8
by@T3p
=-p+D-
-W-z`q
'-B R4
fYOQ `%Rej:6S%
iAilK/
SD1,$@
Lkt?vKi
\q&NnI
^'oCoo
w\r!=K
S14$[A
zmdf@i^
lr5&0*
wDM/~d#
SD1,$[Mc
9-6Qt/m
b7[5r>
Vi[ ER
Wd:M+:
!Uag :^
q\z=U?
w 7rn+
;-\mNo:
30E|=d
sb{Bw'
3>5j6J{
7?)%B?`q
|)gUr8
ibd]0xS{
v#na:
#gWrrG\r
.ua"|
pjAq`|
apBi,a
w7rt!L
4{:9`;
SW7DGj&%
Wro::r
L:&:Hs
&'?Jjwu
_!XP I
b;g~32
>:s1o3
?&2(8Q
D>2}t9E
gk_S6b
ljN#\m9
E|hrgEyM
R7r"gi
D557a&g
q:~Hsp8H
VR0F3g
^s@#v/a
ole32.dll
{VM\:1
n;BUrj
e^qLKq
z8r8mA
1q6.+:
NSvBnuO
B<52v:23
'xZAR@
/?Hr^XX
5i%izf
x0e)@c2
WkuG =
-r8rl9I
!)-wup
s>.l~}
q:pEX!
)OHZm&
z/xMte
5m{.}su
bm+PxkMMr
'Q|Zm
=a34mS
n2eSgp
dO^><'
X#JfmR
S1,$[Hc
$K>xM$R
t/xv|6
qLi78r
fly 2/?'e6
m!H'D6l
h(~p[_
H eS;UC
m&^~~mN@IO
/dB{$6
myAeyeI
|5&<aD
e.Da4'
9/P.h&
XCL`hD;
BX/4E/
SD14$[Mc
SD1,$f
c)Lo}>
O cfq
kQ'\[VP
{8k.*1
FUc/vR
<*b1;]
]=>-m:I
p9z^@>
I{9I@:
|OZ*s.
<G"HLH
Ki;Df3
zr_inC
SYWqfA
,[O=@x
(EmZ7j
nUWsd=]w
E`V&r9
[ycjhA
VRF]!3S)z
x/H=0m
wrietZ
xO?Dnr
LoadLibraryA
#F,Vrg
6e%n ]
x-e^*/
f=/zf;
1n\;_%
*c2<@3
5c.n,/
#4Q.@(k
QLb8+=
^Zw^#Pf
OdMt923xx
xb-%9T
j Kr;N
PuE['W
&;em[TNk
@{&ee\
SD1,$[fA;
6I,2.F
8ZX3XP
(&1# l
Q6+PF,
Bc7Rf:0E
hv7!'d
fi)y<-
OY$}*x
>_'298
Mq'Q9MT
![Mye.
<8gn]x
f5`f3
aE6N.xF
jD<yZ5
NE!KG
!uNJP0
QE88x.EV5
xjG(%EA
8GgbZl
+E^:}e
sj+{?T
%`(Ira
A'] <=
j:rBG>
cOHc@|
3uWYm,y
:0S$]}O
TQta%j.
EUrZ/~p
??^Yo
FBj<@9wf
5,5rD1
W2C7rk
&^Pp4e
IZySj/@
::>hy6*
Zed\Ee
xnqdyb~
jy"rv
5A*0(w)aa?n@+P
D1,$[f
`$E;0+@
.>[*FF
NTAGam
LT,oBT
$t7K,H
SsnzUDf
u`M.ET
-#z2-d
<Ut1Ru
yZ]7LR
u@Y=vg
Xu%bRmy
fk%g]oKJ}(a
sLiqr"
=@^pj$
Urm8<p
>*wc>Oeu
+0V;[5
|Ds+IH?
\GM+ys
S14$[D:
'q@+`c
Y6Q.]
/8{G-?
xrKRs,{
~#R5U1
OS=|&f
!lj$-C;
G*GfXM\3
5m@7Eq
rp)]Z&hID
E^hNL
~)B&N.5
eA$UFh
HE[WxB,
o#l,3w
M`<q6#
Ziq]b`
<!\O"rPm
Ur'#3
Qn>tBO
"z~%YX
)&jEV,
trJMXB
[`:rb'[
h.%l@s
?Sei@x
T.l7_)
G|Jrn[
:r/Z,
G}gQt+
m(D8r!
`wm@|?3
TMC^a}
:r(m8
JN%1%h,
1:`d!p
'rDrn9
v@)uwd
$R-%[I
L$C4j\G
cM}'NVA]
:LzXm5
xX3VMC~
|mMLj:
VmR<B?
7~"y?{=i^
tqh@l/
_lT0rK
-Zyok;
#P-5/
M7N%_}t
@@nbpG
!,r,p%
}-fc,$
[(3`k/D
)'/7.P
f/V|3?^D
V(f%b6
];9p?Y
]NfBId?t
hI-Z]#
NSW"I$
/#[V~*
x#^iH$)
hqzVM.
Z`zx.kU
&m'!EA
\=xUdd
r>`8P|
|$5$='`c}
zWb1V
^6?;[0Y
~l%|gi
/bh%swy
D`yOm(
S<H[j c
2[f3*rB
?BPt8<
G9@H:
L42l/=
H:l0kE8
orL*o(
gJ79@W
WQO8[;
7&H; `
.kMb=g
6@(=B6
F\gIz&
Zk5;_C
W(gAut
g+0lfc
tr[-Q3
8[LSpq
;4kEC)
|+w_77K6
D)ZKu-
)eNMt E
.U!$Nm
GQoIqk
%H$L%'
7RqrT1AG
$3TMM,W(
P$2)j"1
(8oCQ1
,]`N}T
`58sP2O
0hO!7
X5M:_B
{]eqKZ
G6^fE;
_?.[~f
O#'>|
-ldr9A
CreateEnvironmentBlock
IJ{Smw
9p@&@xn
2$TEey^I!
[E5 nM
QS]/ZU
Jq<,e5q
@W0@$
hZs\$wCOU
Bpo0TQ
89]8?3M
:FM3f{fc$
I}t`yz
`VK-1_
<W_bm^
];C,m<4
:Wc1=
kWZ][P-
nG!s$/Sk
3p^1jo
cwPU1,
J]*Cud
Snj\$
+wmr`^<:t
-v="p$
1mWa}h
(gR5CBw
rHN05l
4NDgQ^
ss$/sQ
H!L(=M
#GfzJu
dnrC%+)
P+xqYQ
i0kY7h
%XGVtQ
5OW(28
rXBiB_5
w=:#>85
ajJ+9
1-XpsU
'p{=?fnn
@i^v'LI
Tx.-KB+
'pM+/fn
qzniq{
QCR3YSZ
p#rstCu
eseCusw#x
OCTs`Sc
_3bScsd
j3kSlsm
C@#ecw
NcO3PsQ
-32S3S8
:#>3?#D
:c;c?3@
H#KsM#P
vcx3z#~
#s)#*c*
ICJCLCN
C/363;
D1,$fA
}KF{mv
}h{WfyY[;4dx
5H9=j'
++c.z"
w*wa&#
Q/"ba(U
.6-=)A
t;2SD#
-Zyokf
D1,$[Mc
I(p#kb^7w'l
#DrDhz
;Afx2?
Ne%o/f
o#q"<om
kQxIl.iwb
[^ur-[
8Yb''}
t_:=hn
v3\urm+
;,Tv*(
TvCf!E
7H#)Dz
7+Z&li
dq)>{DW{pt#
0Kr&yU
j(MR`wB
urn(02
1.KPp8
qr)OE6
M`rq4^V
`M5sen
ETKcE$To
G'2Hl]
<@p0[a_
'5^p8J
y.X.<rG
S14$[Hc
<)pn9
n9.9s`
+9qWmt
(q,JM;
~|9M&w
c4 T5|)
nB =?K
2C4rcJ
~+lON,
S/(<c(_
.<s?)K
HGu>x@
eC1MUDF
1Ef/%2
GJ)@W:
PL.7"?
6v^z!d
bkla[w
'pm;DfnP
Tm9,rv
<[pw{_i
kMx^.}
@N8Zckq4\
~Wfz*K[F!
Un+q_\N,s*R
\14$[A
*%rEvC
M1EnI]
Ip!cpH
.wYi.
"])pRY
n[{0r\
'p;m#fnf
QE^@4t~
'a@?%f]
SD1,$[Mc
U5)?X1?
udp220P
D1,$[Mc
x+=wQ|M
*_q}X7
dB88q3
t=FC)F
wmuL$)
ZRvnReO
YJ4HY?
O"Q?^L
1xI1dBk
A6Op{-
~%9x,|
e5W5@!
EI]AYQ
(0>]@Hr]
aT(<8p
1rfbYK
JF0qHm[
\`"v68
;wM<9{
[d#M9L
-R'14`
vr8NC1
Dq'&caQ
Oimd9
't%SC.
IS/w+R
gRJ.4|
3HMu 3b
I}!,&M
K&NC+P A
ujB-xj
ne&$f;
Ssu_^m
`g%H.N
tllex^
q\kk?i
r/. wa
V#<rr};s5
rrU#O5
vY7PUi
~.BKQR
Oxz)-A
ksC6_d
}P-[oQ
qlo,pE
vlr2D9+
vOmLNLf
5)u4|2E\
{}4|<b7
+wdfpJ>
O*GD;Z?
wsU`Gt"
Sklr%S$+
8;tKf#
'k}I]B
!WNWAdH
qAlqQA2
VirtualQuery
&p'qJgn*
x0Wxz<
FAN6A6
;+IOj"
l+Lp\,;
(e1?Hc
\Zo7)n^[
S,a<f9
Ky,s{~[
A}r0eRK
8lrZ,w+
Ey1/iwA
Q],!qC
i9 ;Y>W
yPlI(Y
D=dHt:
_U9JoRN
rQ}9BV
;NdI4zD
q1q_zl
vf];/Uk^'7
iWb?{!
t.)|yl
]Jfr&sYP
$y(++Qb
e!dUYM'
Iug12Q
rL%p(~
SF%p1W
D14$[Mc
MH#c{[
9^!i;r>
)wr:|f0
u"W6l|
LAOp==S
ADVAPI32.dll
(sr[]g4
r8\.w_
ew 7B4
e?*s[+=q
lWF72!
COtfkqf
-<lR}f
j\1qN
_\/VF}"
.5i'_h
O(fkP
!XKgfD;
Lqg^QU
h2%of
Dr// X
va8n$$
[u}OK`
NTj_i~~
}3!OXK
*J,%ids
FN.t2Z
|?ySmu.!
'!tZLL~P2
!p va`n
4Q9I)
=x`I.SH
gpkr1G?,
j\,=p6`
h=/*@6D
E3S&Op?s
rls]vW%Tm
Ww9V|Q
gD$U{!}
'3=3d e
Q6uo6E
`A]A[AXA\A
4'`5N=
)Sv)CT
`Fq E^Z0
*{1.-]
S@lSxJ
*SXq_oJ
zk$!U\U
=$%&%-
Nmh$wC
(=."kt=
A\AY[A
SD1,$A
'A^AZfA
A\AY[fD3
q]f-xnN
2v&TBt%
<9Yq{7
4krW!{,
dfsq/*
FVu {T
UpypB|
iu E;m
=f,NQ312L
rHa]m#F?
*rshIB*~
F4]w8(
#8}Qwc
r=EL^|Rwk
.hAWez
MPA=J'
]jtr+]%3
-er;n>S
Je=LDzXM2
^nB\pN
74p!RT
pr?IK7
ISY'L+
V+-tQ`
? ,_"F
?C\|n7
9er5p*S
/c#e#,
xaV2=j
"[7!8g
!^:ZC#J
4/G(F9
,bO$2%B9
Gkjj_
(>o9j}m
FLiI!R
4|?r^{
bix]'4
FJqw
qdG?|~-3
wk|VRc
S14$fA3
w{Pb,a
f=g+f;
2%#Tf;
=;;z(14
EBL>}box
s!~A7>
B]'l<'
dHm38.G6
" "p0v
0+=%bR
=pX~@|n
35=ZVy
MwK2}p<
v_}!q(
Zem}])
(dx|0Wd
RU<D|$$]
o1sB1P
Merbdy
xm7mag
5kkJe5
xy5Tc
;wi;a;
(Zb(IH
#>`G#eEs4
a6wuu^
A)J0 M
n+^|NA
(mH1!wicn
vsw:sq
vC63o'U
52v:2f
q{JzQr
I"k^iT
._=+qf
X|m^h{
y#Pob?
;r(De[N
y'#$<9
8Skq9dK
DT;P2`wU
*`9PS] T
vjrOI9-
1?{rJ,M
r')|h`
[OAXfD
}T3\b}
3eFb(i
v*N6z\_@
J$@^:{
Oqd$U
Po/&mg*b
#pIFbnJ
|$vPKq
~iO$twII^
6}Hpd"
sVKtY(
F'Ruv^
Z5MGtC
-!2GeR
#pY?bnl
D1,$[H
M8xWy^3o
"v9~W$
&;+}L)v
^!EG5/
"K2yn'
>*dq(C
=s(Exn
}{r(mnM
KgYg+j
v3q0,6prVq
mK|yc
k_UZxq
'jrQ7h-
jhIMI/
bdY#7;
?(9(|q}
ci4gB4
Jg (?147
4;fa4;vQD
af\$_9
{we$'d
k5.]eN
k/ bch
e+<)R
714p#s
@Fx7aW
5qr.Xz6
8!?KF6c
D1,$[Mc
TiDwdn3
hP88o'
\7'9ss(
9Spm[
/>U|*b
retI`t
vhW9:[<
uM2d^i
#n'Zg>
xAXA\E
gGu+O"5
;M2OCr
`Jf8b^
4@Y@38`
36`ExB$
tr~;3B
=vlxn
xDtQ%z1z
'uHX?IM
9_z61:Ww]B
q$vqrz<96
eXgQWU
|@Q7M/
y?DgmAR9r
DDPPu!C
drKIqd
/)"a;BX
V"vi#n9
SD1,$H
Rdr8mAR
tHXJC*Q
<Ti]XM
um7J_a
GetProcessAffinityMask
vIw'7}
D1,$[Mc
k^$*][b
31,$[Hc
8I5i>]
Jcr!)+U
k>J=eP
`7pqRd
ZBLV%$0
OBsN[Vb
(!p&C{
UCSWufZ
sERGt=
M_)Sc,
o?cpLf
FirL*4
_[Z#5^|k
-|hZx-X
'd"s!h
awH-p~
MA]A[D
oirF .
PpV`~Yq
RQ_N]s
4JO,pQ
vn!zhrf
qZV>s=
VS_xr(}LN
SD1,$[
>#n\o7
I~ZAyy-
oz>i]!*
)b&(f;
)bt"u9x
T[OYr]m
f{7uW/
Fz=yC"
URLDownloadToFileA
5'iNSD
N'"+[7)
V5PikD
=()?J4
yMfiB"
fcojYh
Qo!@[Bk@
Z"&ln
{$#!i'
,N6JN3
5sW\@{N6
4M\9)$$
,ktI~b
#%i(hW
$K*l,;
(cUvft
|7`k6r
p!4&E[
j0&SC)X
AAGP]'H
fDPf$e?T
$?;z~V
tjKcWFF
F,k&6V
s]X){;qj}H
Kcr4aXU
vtS!%j
~QU[Y1
D14$[A
pquN@v
]u1=mrF
t%r1sR
fl>SD:
5G15O4
I\ p{=
#CfKk<
!RNx*q
%SD1,$f
Sf=rEf;
B)5~!Wf0]
=0>kq2
k0cm*
?Y P%r
kdwii;
NYZGlL0N'
PSAPI.DLL
mpmV`b
DwWbDk
!sApz
vJB7q=
wro*A
_#(s&'
qf^p#e
!pR4q`n
1ypzHK
,Y1ZS6
qX[ky%
&0,0q!
9DbKR)
rBhKN?
j3*gZ4]
&[rZwR
^'Y0YP
q[weA\
0^w"eH
A]A[fD
?AXA\A
!p7qT`nj
zhr*L5/
=yr"w.O
`)E{?P
g#>p}+
glBQs%
a,R[0%
\AZZlF-
j-C+Z*4
r.Qd~Q^
=L|n86
$UyNC
f!zs8O
GZ75O:
{dO1<
V!Ya-*
4kbad(
6,!badLKSc
S14$[f;
NM28UMn
w_}nm_6
hNfB~3
1Frc0~3%
x-|nF{
`^nZIH
5tQW7u
d18hrg
eKI-UL>
S'P\c '
VpSRfw$
Qa?z;Q
LQzw_
LFIO;/
Xs>p:\
}Urqt
||A=-u
w}PMGz'
k+.pTp
[8eQ~f
E)FqGb4
*/UI.^
>khzuU
lms@hz
R5qx]O
KERNEL32.dll
/}x8~t
s|lw"u
Uy9te~N
Um"U9X
dCH_fS
Vvr`%E@
)g_|QSKv
Ki 1?n
/F|6`4
}?C{1h
yI>Cs8L
D1,$[fD
OOy@[t
S14$fD
(+)n9P=
hQmR"w
qR|,N1
:| *_h
feU9Vb"
|e7"#H
wrM;O0
B~%U5,"$q;
+$9m`T7
zD14$H
MJtGBM
5];u&S
#sF'AWd
GP5c E]
w"qYL]s
1l;-Y=
3FG2+L
c^Wga@
Gh]SO=3
&\AOkQ
r}/xD?
,iCgr'2
D14$fA
44::_m
xDQ;j2
A-exE%
K!~Uu(
!*Ona?
`gr2T/
^Py[nW
N95)0
c=qZ24
sT=(CSJ
/U)gR^
h<`*X;
E8$Yu?S
Gd&xa^
lW1uIC
V71p4R
M/u0D*
E Q=p^c
x>A4ui
>s=C#|
c^7#'|
G0MU"
{w=jM
Si/grK
;Upo"v
^iApd2
C9Qpi?
o)dnz
vXj'c5
$jdBT>
=V/ZM.{@Yl
h%zbk0M
)KbVZ@
e=lP h
[^f52X
nh[97q
N[oxOA
x ipI1
`:q_z}
AIlH4"
A'A[hj`
`P,"Dh
w~r5DO
)#uuGV#
f@VrQ#
9J,i{+
|r)_E;
Sa~%]"'i):9
pX{2HA)
SpwJqtYm
85w"6b
|re=cA
W@Ducw9
u_OX_o
E[q9dm
W|W6Ug
5(vh}x
1ph>Epn
&sG|r=[
xJ`=eMF@
f=E&f;
F(4BZ^
*hH]BP
N|ir5`o_
,yrl9?O
rGa8f#
/JTb_
*39tb1
>?7<x;
=vWwLp
gcY8PS
|o<Gf:ZgKG
tI;6X
lil<"#
%B^D'm
`s+ pr
fvfS14$D
,p|*zmn
Tz6AGe
Jil;M$
dG+LaT/
(%0:P5
{P-Zaa
HA20yy
aGuc&
J_wbp>
k>kfrp
,pf@Qmn
,Nqyuu'
Rz_^f;
=PSp%3
vuixv
~frY/1!
s5FJ^A
],uM`0W
ifrR$&!
Rsp^VDx
h{Js&_&Q
Wg/%<v
SD1,$[@
5Vzh14$@"
'_{T.bi
#rUQiQ
`Rm`PO
PlB!Ip
-cy/f6Y
Q5t}hn
mu^?]r)
@vO *i=x
Z.h2Va
T:F>d[
]Xu~7c:
d7vNRj
;/ bw2
|"jWSJ3{7.
!4RXu57
9?`a,+
k]P6l*
ZjIjm>
s'R-#H#
,skhRXv
tQqhWAt#
uYr$g>
cyrA7,>
py3eKj
%OA^A?
zFgt/=
^@lSJkLL
='Cr&
mX]_]_*
[4D.k33
5Pa72'
"/ng_
W#03?
Gw<+?:
FM;<FF
M"x~#I
Z`wsHv
vVBqhc
?%6ClS
T2_8f;
8b_eAl
*i?_%[
mF=?L9Yc
+g&&~X
!7r7VxZ
uy$nPk
f0J4xw
SP3NA2
'!xrl92N
0f{Rq.2
NQ,"tv
fk?G&$
ZsB%\:+
UP 54X
+cD EG
pTHrKyt_
dWk,U
AS+CbW
i_624k*8
ia<CM/r
HC 3W!(
2gTer9
Iz3po5i
l)^erG
YfF(!B
'UHD!d
6n~4`1ok|S@
^@>inGI
A*&2F]
/EnUB
c-6h2$
?,"'n%
E(cku/
|Omo0,
V(1rA2
KdY@%GD
m|\M?)
;}Q/*(
<bI{So
oerY/ "
qb~@j>`
/o\m/M
8$~g!6l
D7f5`f3
6B:.N@O8
Q_Js)//
kA3p1g
8xe&wt
/p%s8nnp
cb5J~A
Z_fZ_|
?g)S?s^XA
er-kN"
Ftru0UB
ta5X!Y
!!{/u{
vI:od
2atoPlJT
2i!2]c?
<\GLR+
,*J5,R9
9 WbJrW
0g4RR?:
yG(hT2'1
(]"er3
X\D/#od
/f4:H0
LY 1/Pf
!HDc8<
IW[9DHi~
32BG L
p&e5';F<
s{rz/`M
J%^_DS')_
WIZ>}Z?
saz[M:
Mo"8-M8uC6d
PdlFDi
:_p6DL
|^Au"z
~rw1C9
ia+e2
(mo=<Pq
D1!mPZig$
a3<kfo
-<lR}f
CR6kG+
V?7/1u
,wUT}~
{wPkKp'
ag5;|+
l9#3r%G&
x7`xil|
~ju_v$;
jsNfJ^q
aG-p/s
ONG5D,_
Antivirus Signature
Bkav W32.AIDetect.malware2
Lionic Clean
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Ransom.EasyRansom.1
FireEye Generic.mg.e277207bfd455a38
CAT-QuickHeal Clean
McAfee Artemis!E277207BFD45
Cylance Unsafe
VIPRE Clean
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Trojan ( 7000001c1 )
BitDefender Gen:Variant.Ransom.EasyRansom.1
K7GW Trojan ( 7000001c1 )
CrowdStrike win/malicious_confidence_80% (D)
BitDefenderTheta Gen:NN.ZexaF.34170.@FW@aCEvxlii
Cyren Clean
Symantec ML.Attribute.HighConfidence
ESET-NOD32 Clean
Baidu Clean
APEX Malicious
Paloalto Clean
ClamAV Win.Malware.Vmprotbad-9867392-0
Kaspersky Clean
Alibaba Trojan:Win32/VMProtBad.ee1b294c
NANO-Antivirus Clean
ViRobot Clean
Rising Trojan.Generic@ML.100 (RDML:547ujYJ3WIZLAnkiwiodgQ)
Ad-Aware Gen:Variant.Ransom.EasyRansom.1
Emsisoft Gen:Variant.Ransom.EasyRansom.1 (B)
Comodo Clean
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Generic.tc
CMC Clean
Sophos Mal/VMProtBad-A
Ikarus Trojan.Win32.Agent
GData Gen:Variant.Ransom.EasyRansom.1
Jiangmin Clean
Webroot Clean
Avira HEUR/AGEN.1144545
MAX malware (ai score=80)
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Tnega!ml
Cynet Malicious (score: 100)
AhnLab-V3 Malware/Win.AGEN.C4482320
Acronis Clean
VBA32 Clean
ALYac Gen:Variant.Ransom.EasyRansom.1
TACHYON Clean
Malwarebytes Trojan.MalPack.VMP
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Clean
Yandex Clean
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_99%
Fortinet W32/Agent.ADER!tr
AVG Win32:Malware-gen
Avast Win32:Malware-gen
MaxSecure Trojan.Malware.300983.susgen
No IRMA results available.