Static | ZeroBOX

PE Compile Time

2014-01-18 15:50:40

PE Imphash

fd2a350e6b9d34ec5cf88c61afb9d41f

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0008a624 0x0008b000 6.73996579166
.data 0x0008c000 0x00000b80 0x00001000 0.0
.rsrc 0x0008d000 0x00004562 0x00005000 4.61252743437

Resources

Name Offset Size Language Sub-language File type
DATA 0x0008da74 0x00003aee LANG_ENGLISH SUBLANG_ENGLISH_US MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
RT_ICON 0x0008d534 0x00000128 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0008d534 0x00000128 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0008d534 0x00000128 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_GROUP_ICON 0x0008d504 0x00000030 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_VERSION 0x0008d1a0 0x00000364 LANG_ENGLISH SUBLANG_ENGLISH_US data

Imports

Library MSVBVM60.DLL:
0x401000 None
0x401004 _CIcos
0x401008 _adj_fptan
0x40100c __vbaVarMove
0x401010 __vbaFreeVar
0x401014 __vbaStrVarMove
0x401018 __vbaFreeVarList
0x40101c None
0x401020 __vbaEnd
0x401024 _adj_fdiv_m64
0x401028 __vbaFreeObjList
0x40102c None
0x401030 _adj_fprem1
0x401034 __vbaRecAnsiToUni
0x401038 None
0x40103c __vbaStrCat
0x401040 __vbaSetSystemError
0x401048 None
0x40104c _adj_fdiv_m32
0x401050 None
0x401054 __vbaAryDestruct
0x401058 None
0x40105c None
0x401060 __vbaObjSet
0x401064 __vbaOnError
0x401068 None
0x40106c _adj_fdiv_m16i
0x401070 None
0x401074 __vbaObjSetAddref
0x401078 _adj_fdivr_m16i
0x40107c None
0x401080 None
0x401084 None
0x401088 _CIsin
0x40108c __vbaErase
0x401090 None
0x401094 __vbaChkstk
0x401098 None
0x40109c EVENT_SINK_AddRef
0x4010a0 None
0x4010a4 __vbaStrCmp
0x4010a8 __vbaVarTstEq
0x4010ac __vbaI2I4
0x4010b0 __vbaObjVar
0x4010b4 DllFunctionCall
0x4010b8 None
0x4010bc _adj_fpatan
0x4010c0 __vbaRedim
0x4010c4 __vbaRecUniToAnsi
0x4010c8 EVENT_SINK_Release
0x4010cc _CIsqrt
0x4010d4 __vbaExceptHandler
0x4010d8 None
0x4010dc _adj_fprem
0x4010e0 _adj_fdivr_m64
0x4010e4 None
0x4010e8 __vbaFPException
0x4010ec None
0x4010f0 __vbaDateVar
0x4010f4 None
0x4010f8 None
0x4010fc _CIlog
0x401100 None
0x401104 __vbaErrorOverflow
0x401108 __vbaFileOpen
0x40110c __vbaNew2
0x401110 None
0x401114 _adj_fdiv_m32i
0x401118 _adj_fdivr_m32i
0x40111c __vbaStrCopy
0x401120 __vbaI4Str
0x401124 __vbaFreeStrList
0x401128 __vbaDerefAry1
0x40112c _adj_fdivr_m32
0x401130 _adj_fdiv_r
0x401134 None
0x401138 None
0x40113c __vbaVarTstNe
0x401140 None
0x401144 __vbaLateMemCall
0x401148 __vbaStrToAnsi
0x40114c __vbaVarDup
0x401150 __vbaStrComp
0x401154 None
0x401158 None
0x40115c None
0x401160 __vbaVarCopy
0x401164 _CIatan
0x401168 __vbaStrMove
0x40116c None
0x401170 None
0x401174 _allmul
0x401178 None
0x40117c _CItan
0x401180 None
0x401184 _CIexp
0x401188 __vbaFreeObj
0x40118c __vbaFreeStr
0x401190 None

!This program cannot be run in DOS mode.
`.data
MSVBVM60.DLL
turkli
Strmpeso7
HScroll2
HScroll1
Combo1
Hypostern3
Timer1
Timer2
Granmas5
fremtid
yeguitaut
Gensta
BLINDSM
Signal8
Nonpoint
Marbling
FABRIKSFR
Bdekravad
Arettepo
tubulat
agendaenh
Scenefunk1
DIALOGIS
Outputfil
INODIATES
LIFTERABS
RHIZOT
hvislel
forest
Gerontolo7
wordpe
equalise
Bebyrde6
COPLOTHN
landsd
Agtpa1
grapta
Konfer
fedtle
Twatsopht8
MNIOIDBAK
Ilford
DISBURGE
Frame1
Skelet6
INTERMATT
8YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY
GGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG
e:1333333333333333333333333333333333333333333333
fCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
-----------------------------------------------
GGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG
}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}
pJd6=.
Msuy#=7P[
@=jtX6
@&h7"2
Pon3`K
zBC'J`
Jgp\r!
~Waw%JaZq
gT-?:R
\ch,/(
3Un9\K
wJ|'w7
m~kw@vJaW
=H*R@Jb|
7u6lna
oM?#nJy*Dw#
KCnm\Jk
j;rWTn
bXSSI X
KJ}!?3
J}dt/!
'/Jk\s6
OJ~6G~3
AaI)|h
B43erCD
vEb>Y?
KJdzX08
uDi1me
xU//'0
"wfyk6IM
|w-27
4Jkxh^
*ZJ|NG
hp3|7X
iyP)r_
*687~n[,
E|HPC85
&)rDPR
5W1w5]
z_8Fh{
Pm+0FY
Jrgsx-~
iH?$F<
ZuElaC+
Z*y!~QS
6Ps_fRW
+v6murV
q2h'39
s\8<D(
@*$pAVR
&HTnB#)
GZ-FG8
uYrDYY
{@2(@C/
N'V5kW
JWI2u;C
\SVWjD^V3
9{Lt:V
D$$PuI
L$(+\$
u 8_=t
Y<9X8t
P4+S4t
V,YYG;~
0WWWh(
PShxWF
u"VVVV
L$ Ph8
PPPh(YF
VjxVVh
L$$PWj
SVWj 3
SVWj@3
SVWj@3
YSSSSSSSj
SSShXZF
SSShdZF
SSShpZF
4SVWh([F
DSVWj,3
t SSSj
SSSSSS
tZ<*u=N
t$<.t:G
u2j$Xf
u2j$Xf
u j ^j
SVWjGZ
<0r"<9w
4V9~,
SVWj7^
SVWj7j
QQj7PQQ
QQj7PQQ
t;j hhTF
PWWj Sj
t]j@^+
N`j8[;
v4j@X+
9E$WWV
t,WW9}
jA[jZZ+
QQSVWd
j8hh~F
URPQQhpWC
;t$,v-
UQPXY]Y[
u0jAXf;
u0jAXf;
<xt"<Xt
v!j"X_^[
PVSQSWV
SVjA[jZ^+
jAZjZ^
Tt1jhZ;
^$+^8+
^$+^8+
t0jXXf
~$+~8+
F2jgYf;
t/j=[f;
QSSSSj
tyPVj@W
_tcPVj@
u#j,Xf;
f98t V
PPPPPPPP
QQQWPQ
SSPQSS
u kE$<
>:uBFV
mSjA[jZ^+
8jZZf;
PPPPPWS
PP9E u:PPVWP
Wj0XPV
<at<rt
>=umF8
D8(HXt:f
D8(Ht5F
WWWPWS
u-PWWS
SSVWh
f9:t!V
|VWj=S
}VWj=S
tl9tX
QQSWj0j@
<0|o<9
u^9^\t/
VX9^`tT
;N\u\W
u2Vj@hp
9C`u99C\t4
9C`u5Wj
SVWjA_jZ+
uBjAYjZ+
PPPPPPPP
InitializeConditionVariable
SleepConditionVariableCS
WakeAllConditionVariable
bad allocation
bad array new length
identifier removed
illegal byte sequence
inappropriate io control operation
interrupted
invalid argument
invalid seek
io error
is a directory
message size
network down
network reset
network unreachable
no buffer space
no child process
no link
no lock available
no message available
no message
no protocol option
no space on device
no stream resources
no such device or address
no such device
no such file or directory
no such process
not a directory
not a socket
not a stream
not connected
not enough memory
not supported
operation canceled
operation in progress
operation not permitted
operation not supported
operation would block
owner dead
permission denied
protocol error
protocol not supported
read only file system
resource deadlock would occur
resource unavailable try again
result out of range
state not recoverable
stream timeout
text file busy
timed out
too many files open in system
too many files open
too many links
too many symbolic link levels
value too large
wrong protocol type
address family not supported
address in use
address not available
already connected
argument list too long
argument out of domain
bad address
bad file descriptor
bad message
broken pipe
connection aborted
connection already in progress
connection refused
connection reset
cross device link
destination address required
device or resource busy
directory not empty
executable format error
file exists
file too large
filename too long
function not supported
host unreachable
unknown error
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
InitOnceExecuteOnce
CreateEventExW
CreateSemaphoreW
CreateSemaphoreExW
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
FlushProcessWriteBuffers
FreeLibraryWhenCallbackReturns
GetCurrentProcessorNumber
CreateSymbolicLinkW
GetCurrentPackageId
GetTickCount64
GetFileInformationByHandleEx
SetFileInformationByHandle
GetSystemTimePreciseAsFileTime
WakeConditionVariable
InitializeSRWLock
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
SleepConditionVariableSRW
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CompareStringEx
GetLocaleInfoEx
LCMapStringEx
0123456789abcdefghijklmnopqrstuvwxyz
0123456789abcdefghijklmnopqrstuvwxyz
bad exception
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
`h````
xpxxxx
(null)
CorExitProcess
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
[aOni*{
~ $s%r
@b;zO]
v2!L.2
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
AreFileApisANSI
EnumSystemLocalesEx
GetDateFormatEx
GetTimeFormatEx
GetUserDefaultLocaleName
IsValidLocaleName
LCIDToLocaleName
LocaleNameToLCID
NAN(SNAN)
nan(snan)
NAN(IND)
nan(ind)
UTF-16LEUNICODE
_hypot
_nextafter
1#QNAN
1#SNAN
]vQ<)8
|)P!?Ua0
Eb2]A=
u?^p?o4
y1~?|"
?x+s7
?5Od%
?|I7Z#
>,'1D=
?g)([|X>=
~U`?K
:h"?bC
@H#?43
Ax#?uN}*
r7Yr7=
F0$?3=1
H`$?h|
&?~YK|
sU0&?W
<8bunz8
?#%X.y
F||<##
<@En[vP
?5Wg4p
%S#[k=
"B <1=
%Y-%m-%d %H.%M
invalid vector<T> subscript
vector<T> too long
string too long
invalid string position
OpenCamera
CloseCamera
GetFrame
FreeFrame
Failed to initialize TLS
Failed to initialize TLS context
Failed to load TLS certificate
Failed to load TLS key
Failed to load peer certificate
TLS_AES_128_GCM_SHA256
Failed to set cipher list
TLS Handshake... |
TLS Error 1
TLS Error 2
TLS Authentication Failed
TLS Error 3
Connection Refused
Connection Failed:
Connection KeepAlive | Enabled | Timeout:
Connection KeepAlive | Disabled
Connection Timeout
DisplayMessage
GetMessage
CloseChat
cmd.exe
SystemDrive
mscfile\shell\open\command
origmsc
eventvwr.exe
Software\Classes\mscfile\shell\open\command
CurrentBuildNumber
SOFTWARE\Microsoft\Windows NT\CurrentVersion
Uploading file to Controller:
SetFilePointerEx error
ReadFile error
Browsing directory:
Executing file:
Uploaded file:
Failed to upload file:
Downloading file:
Downloaded file:
Failed to download file:
Deleted file:
Unable to delete:
Unable to rename file!
Offline Keylogger Started
Keylogger initialization failure: error
minutes }
{ User has been idle for
Online Keylogger Started
Online Keylogger Stopped
Offline Keylogger Stopped
[BckSp]
[Enter]
[Pause]
[PagUp]
[PagDw]
[Start]
[Left]
[Right]
[Down]
[Print]
[Menu]
[End of clipboard]
[Ctrl+V]
[Text pasted from clipboard]
[Ctrl+
[AltL]
[AltR]
[CtrlL]
[CtrlR]
[End of clipboard]
[Text copied to clipboard]
\AppData\Local\Google\Chrome\User Data\Default\Login Data
UserProfile
[Chrome StoredLogins not found]
[Chrome StoredLogins found, cleared!]
\AppData\Local\Google\Chrome\User Data\Default\Cookies
[Chrome Cookies not found]
[Chrome Cookies found, cleared!]
\AppData\Roaming\Mozilla\Firefox\Profiles\
[Firefox StoredLogins not found]
\logins.json
\key3.db
[Firefox StoredLogins Cleared!]
[Firefox Cookies not found]
\cookies.sqlite
[Firefox cookies found, cleared!]
Cookies
Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
[IE cookies not found]
[IE cookies cleared!]
[Cleared browsers logins and cookies.]
Cleared browsers logins and cookies.
FunFunc
exepath
Unknown exception
bad cast
bad locale name
generic
iostream
iostream stream error
ios_base::badbit set
ios_base::failbit set
ios_base::eofbit set
license_code.txt
Software\
Remcos_Mutex_Inj
ProductName
(64 bit)
(32 bit)
licence
Remcos Agent initialized
Access Level:
Administrator
GetModuleFileNameExA
Psapi.dll
Kernel32.dll
GetModuleFileNameExW
NtUnmapViewOfSection
ntdll.dll
GlobalMemoryStatusEx
kernel32.dll
IsWow64Process
kernel32
GetComputerNameExW
IsUserAnAdmin
Shell32
SetProcessDEPPolicy
EnumDisplayDevicesW
user32
EnumDisplayMonitors
GetMonitorInfoW
Shlwapi.dll
override
3.3.0 Pro
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
C:\Windows\System32\cmd.exe
StartForward
StartReverse
StopForward
StopReverse
GetDirectListeningPort
finished
s ap traffic
s hs traffic
TLS 1.3, client CertificateVerify
traffic upd
derived
tls13
c ap traffic
c hs traffic
TLS 1.3, server CertificateVerify
='9-6d
_jbF~T
11#?*0
,4$8_@
t\lHBW
QPeA~S
>4$8,@
p\lHtW
+HpXhE
T[$:.6
=j&&LZ66lA??~
}{))R>
f""D~**T
V22dN::t
o%%Jr..\$
&&Lj66lZ??~A
99rKJJ
==zGdd
""Df**T~
;22dV::tN
$$Hl\\
C77nYmm
%%Jo..\r
>!KK
55j_WW
&Lj&6lZ6?~A?
~=zG=d
"Df"*T~*
2dV2:tN:
x%Jo%.\r.
t>!K
a5j_5W
ggV}++
Lj&&lZ66~A??
bS11*?
Xt,,4.
RRvM;;
MMfU33
PPxD<<%
Bc!! 0
~~zG==
Df""T~**;
dV22tN::
xxJo%%\r..8$
tt>!
pp|B>>q
aaj_55
UUPx((
SHA256wECDSA
Unknown
?456789:;<=
 !"#$%&'()*+,-./0123
lzNg},8S*:#
)U[/t|
SECP112R1
DB7C2ABF62E35E668076BEAD208B
DB7C2ABF62E35E668076BEAD2088
659EF8BA043916EEDE8911702B22
DB7C2ABF62E35E7628DFAC6561C5
9487239995A5EE76B55F9C2F098
A89CE5AF8724C0A23E0E0FF77500
SECP128R1
FFFFFFFDFFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFDFFFFFFFFFFFFFFFFFFFFFFFC
E87579C11079F43DD824993C2CEE5ED3
FFFFFFFE0000000075A30D1B9038A115
161FF7528B899B2D0C28607CA52C5B86
CF5AC8395BAFEB13C02DA292DDED7A83
SECP160R1
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFC
1C97BEFC54BD7A8B65ACF89F81D4D4ADC565FA45
100000000000000000001F4C8F927AED3CA752257
4A96B5688EF573284664698968C38BB913CBFC82
23A628553168947D59DCC912042351377AC5FB32
SECP192R1
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC
64210519E59C80E70FA7E9AB72243049FEB8DEECC146B9B1
FFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831
188DA80EB03090F67CBF20EB43A18800F4FF0AFD82FF1012
7192B95FFC8DA78631011ED6B24CDD573F977A11E794811
SECP224R1
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000001
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE
B4050A850C04B3ABF54132565044B0B7D7BFD8BA270B39432355FFB4
FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D
B70E0CBD6BB4BF7F321390B94A03C1D356C21122343280D6115C1D21
BD376388B5F723FB4C22DFE6CD4375A05A07476444D5819985007E34
PRIME239V1
7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF
7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC
6B016C3BDCF18941D0D654921475CA71A9DB2FB27D1D37796185C2942C0A
7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF9E5E9A9F5D9071FBD1522688909D0B
0FFA963CDCA8816CCC33B8642BEDF905C3D358573D3F27FBBD3B3CB9AAAF
7DEBE8E4E90A5DAE6E4054CA530BA04654B36818CE226B39FCCB7B02F1AE
SECP256R1
FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC
5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B
FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551
6B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296
4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5
SECP384R1
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFC
B3312FA7E23EE7E4988E056BE3F82D19181D9C6EFE8141120314088F5013875AC656398D8A2ED19D2A85C8EDD3EC2AEF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973
AA87CA22BE8B05378EB1C71EF320AD746E1D3B628BA79B9859F741E082542A385502F25DBF55296C3A545E3872760AB7
3617DE4A96262C6F5D9E98BF9292DC29F8F41DBD289A147CE9DA3113B5F0B8C00A60B1CE1D7E819D7A431D7C90EA0E5F
SECP521R1
1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC
51953EB9618E1C9A1F929A21A0B68540EEA2DA725B99B315F3B8B489918EF109E156193951EC7E937B1652C0BD3BB1BF073573DF883D2C34F1EF451FD46B503F00
1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409
C6858E06B70404E9CD9E3ECB662395B4429C648139053FB521F828AF606B4D3DBAA14B5E77EFE75928FE1DC127A2FFA8DE3348B3C1856A429BF97E7E31C2E5BD66
11839296A789A3BC0045C8A5FB42C7D1BD998F54449579B446817AFBD17273E662C97EE72995EF42640C550B9013FAD0761353C7086A272C24088BE94769FD16650
Mutex_RemWatchdog
Remcos restarted by watchdog!
Watchdog module activated
Watchdog launch failed!
[regsplt]
SHDeleteKeyW
TLS On
TLS Off
Connecting |
Connected |
Disconnected
SetSuspendState
PowrProf.dll
SeShutdownPrivilege
GetCursorInfo
User32.dll
DISPLAY
alarm.wav
Alarm has been triggered!
[ALARM]
play audio
pause audio
resume audio
status audio mode
stopped
stop audio
close audio
GetLastInputInfo
SETTINGS
%02i:%02i:%02i:%03i
GetSystemTimes
abcdefghijklmnopqrstuvwxyz
Software\Microsoft\Windows\CurrentVersion\Uninstall
WallpaperStyle
Control Panel\Desktop
TileWallpaper
Remcos
GetConsoleWindow
MsgWindowClass
CONOUT$
--------------------------
* Remcos v
* BreakingSecurity.net
--------------------------
TLS13-AES128-GCM-SHA256
DEFAULT
/serialNumber=
/emailAddress=
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
-----BEGIN DH PARAMETERS-----
-----END DH PARAMETERS-----
-----BEGIN X509 CRL-----
-----END X509 CRL-----
-----BEGIN RSA PRIVATE KEY-----
-----END RSA PRIVATE KEY-----
-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----
-----BEGIN ENCRYPTED PRIVATE KEY-----
-----END ENCRYPTED PRIVATE KEY-----
-----BEGIN EC PRIVATE KEY-----
-----END EC PRIVATE KEY-----
-----BEGIN DSA PRIVATE KEY-----
-----END DSA PRIVATE KEY-----
-----BEGIN PUBLIC KEY-----
-----END PUBLIC KEY-----
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz+/
?UUUUUU
?UUUUUU
?333333
?Dj0Q:W$=
5s3R6=
.text$di
.text$mn
.text$x
.text$yd
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCC
.CRT$XCL
.CRT$XCU
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIC
.CRT$XIZ
.CRT$XLA
.CRT$XLZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$T
.rdata$r
.rdata$sxdata
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.data$r
.tls$ZZZ
.gfids$x
.gfids$y
.rsrc$01
.rsrc$02
CreateDirectoryW
WriteFile
CreateFileW
ExitThread
CloseHandle
GetModuleFileNameW
WaitForSingleObject
CreateEventW
SetEvent
CreateThread
GetLocalTime
CreateEventA
HeapCreate
HeapFree
ReadFile
TerminateProcess
CreatePipe
PeekNamedPipe
CreateProcessA
ExitProcess
FindFirstFileW
GetFileSizeEx
FindNextFileW
GetDriveTypeA
lstrlenA
GetFileAttributesW
DeleteFileW
GetLogicalDriveStringsA
SetFilePointerEx
MoveFileW
FindClose
RemoveDirectoryW
GetModuleHandleA
SetFileAttributesW
GetLastError
TerminateThread
GetFileSize
FindFirstFileA
FindNextFileA
ExpandEnvironmentStringsA
DeleteFileA
CopyFileW
CreateMutexA
GetLocaleInfoA
CreateToolhelp32Snapshot
OpenMutexA
Process32NextW
LoadLibraryA
Process32FirstW
GetProcAddress
VirtualProtect
SetLastError
VirtualFree
VirtualAlloc
GetNativeSystemInfo
HeapAlloc
GetProcessHeap
FreeLibrary
IsBadReadPtr
GetTempPathW
OpenProcess
lstrcatW
GetCurrentProcessId
GetTempFileNameW
GetCurrentProcess
GlobalAlloc
GlobalLock
GetTickCount
GlobalUnlock
WriteProcessMemory
ResumeThread
GetThreadContext
VirtualAllocEx
ReadProcessMemory
CreateProcessW
SetThreadContext
LocalAlloc
GlobalFree
MulDiv
SizeofResource
GetLongPathNameW
SetFilePointer
FindResourceA
LockResource
LoadResource
LocalFree
FormatMessageA
GetModuleFileNameA
lstrcpynA
AllocConsole
QueryPerformanceFrequency
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
KERNEL32.dll
TranslateMessage
DispatchMessageA
GetMessageA
GetWindowTextW
wsprintfW
GetClipboardData
UnhookWindowsHookEx
GetForegroundWindow
ToUnicodeEx
GetKeyboardLayout
SetWindowsHookExA
CloseClipboard
OpenClipboard
GetKeyboardState
CallNextHookEx
GetKeyboardLayoutNameA
GetKeyState
GetWindowTextLengthW
GetWindowThreadProcessId
SetForegroundWindow
SetClipboardData
EnumWindows
ExitWindowsEx
EmptyClipboard
ShowWindow
SetWindowTextW
MessageBoxW
IsWindowVisible
CloseWindow
SendInput
mouse_event
DrawIcon
GetSystemMetrics
GetIconInfo
SystemParametersInfoW
GetCursorPos
RegisterClassExA
AppendMenuA
CreateWindowExA
DefWindowProcA
TrackPopupMenu
CreatePopupMenu
USER32.dll
GetObjectA
CreateDCA
DeleteObject
DeleteDC
GetDIBits
StretchBlt
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
GDI32.dll
RegDeleteKeyA
RegQueryValueExW
RegEnumValueW
RegDeleteValueW
RegCreateKeyW
RegOpenKeyExW
RegOpenKeyExA
RegSetValueExA
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegQueryValueExA
RegQueryInfoKeyW
RegCloseKey
RegCreateKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
EnumServicesStatusW
OpenServiceW
ChangeServiceConfigW
QueryServiceConfigW
StartServiceW
ControlService
OpenSCManagerA
OpenSCManagerW
CloseServiceHandle
QueryServiceStatus
RegEnumKeyExA
GetUserNameW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
ADVAPI32.dll
ShellExecuteW
ShellExecuteExA
Shell_NotifyIconA
ExtractIconA
SHELL32.dll
StrToIntA
PathFileExistsW
PathFileExistsA
SHLWAPI.dll
waveInAddBuffer
waveInStart
waveInOpen
waveInUnprepareHeader
waveInPrepareHeader
waveInStop
waveInClose
mciSendStringW
mciSendStringA
PlaySoundW
WINMM.dll
WS2_32.dll
URLDownloadToFileW
URLOpenBlockingStreamW
urlmon.dll
GdipLoadImageFromStream
GdipSaveImageToFile
GdipSaveImageToStream
GdipGetImageEncodersSize
GdipFree
GdipDisposeImage
GdipAlloc
GdipCloneImage
GdipGetImageEncoders
GdiplusStartup
gdiplus.dll
ResetEvent
WaitForSingleObjectEx
GetModuleHandleW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
WideCharToMultiByte
EncodePointer
DecodePointer
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
LoadLibraryExW
RaiseException
RtlUnwind
MoveFileExW
GetModuleHandleExW
GetStdHandle
GetACP
HeapReAlloc
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadConsoleW
FindFirstFileExA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetStdHandle
WriteConsoleW
HeapSize
SetEndOfFile
Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVtype_info@@
.?AVbad_alloc@std@@
.?AVbad_array_new_length@std@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
.?AV_Facet_base@std@@
.?AV_Locimp@locale@std@@
.?AVfacet@locale@std@@
.?AU_Crt_new_delete@std@@
.?AVcodecvt_base@std@@
.?AUctype_base@std@@
.?AV?$ctype@D@std@@
.?AV?$codecvt@DDU_Mbstatet@@@std@@
.?AVbad_exception@std@@
.?AVfailure@ios_base@std@@
.?AVruntime_error@std@@
.?AVsystem_error@std@@
.?AVbad_cast@std@@
.?AV_System_error@std@@
.?AVexception@std@@
33333333tQQ
33333333
a-VEr;Vp
PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
0!0-070K0W0e0o0{0
1%161G1U1_1m1w1
2'232=2I2S2_2i2u2
3"3,3:3D3P3Z3h3r3
4%4/4;4E4S4]4i4n4t4{4
72797R7[7`7p7z7
8/858:8E8K8h8o8}8
:<:B:M:o:y:
< <8<H<M<W<a<j<o<u<{<
<&=N=f=
> >&>/>5>z>
0*0C0m0
1;2[2c5
66%616
67I7c7m7r7
9<9T9g9
9 :C:S:v:
;&;9;b;
>T?c?l?z?
1%141D1J1V1w1
1"212J2V2a2j2
6U7a7f7r7w7
8)858=8G8S8^8k8x8
9,919E9T9\9f9k9p9u9z9
:":3:9:\:b:
;I;O;T;h;n;{;
2#232R2Z2g2
787k7}7(8C8
;8;H;v;
0)1i1{1
1e203N3S3X3o3
4 4:4L4r4
:C:Y:p:
5 5*545>5H5R5^5d5i5n5
56$6,636P6j6
:,:7:O:
;;;;h;
=:=A=W=
=I>T>q>^?l?
3M3R3h3
5-595E5m5
7*7M7U7Z7
7\8k8z8
9"919@9O9^9m9|9
:":1:d:p:|:
;`;n;!<V<b<{<
=0=7=G=S=c=
=N>X>s>
0;0E0^0j0
5'5,5T5j5
666<6C6
7%797H7S7]7b7v7
8.8>8N8c8i8
9N9]9b9h9
:,:X:p:
;-<4<L<o<
>O>_>f>r>
?+?S?o?u?
+000j0x0
061C1H1Z1`1
2$252:2@2]2z2
333@3E3l3z3
374D4I4[4a4
5[5b5n5
5(6-6o6t6
657E7L7X7
9!:.:q:w:
0%141F1
4$595?5O5l5|5
6&6+656F6]6g6n6x6
797S7m7
9'9A9O9
:H:M:k:y:
:M;a;q;};
<(<@<I<t<
=.=?=Q=
=;>B>G>O>X>]>f>k>u>z>
?#?(?2?7?<?F?K?P?\?a?m?
B0O0T0
0(1:1\1e1t1
2>2t2~2
3*3\3b3
5a5f5l5u5
6!7(7Z8(9-9j9
;7<<<y<
0k0q0}0
0Q1]1b1n1s1
4#4]6/7J7c7
8'91989?9F9
<0<><M<W<d<{<
>$>7>=>k>s>
?9?b?m?t?z?
0(0-0:0s0{0
0$1)171q1w1
262H2d2v2
95:T:]:k:
<C<^<i<
=3=N=Y=w=
>&?U?^?|?
010K0f0
8'979b9
<)<4<;<S<\<
==H=X=]=
>">/>G>g>m>
2J4V4`4k4r4z4
6>7a7p7
:+:6:@:]:g:t:
:X;^;e;k;q;|;
>/>M>n>|>
?!?*?0?7?Y?
3S4g4o4u4
5&5r5v5z5~5
6"6&6*6.62666:6>6B6F6J6N6R6V6Z6^6b6f6j6n6r6v6z6~6
818G8L8S8
;";(<D>T>
>R?c?j?o?
3 3=3R3t3
4?4L4d4q4
5#6H6a6
757R7Z7j7p7
9$9495:L:
;;*;I;o;
5S6i6F7
<;<G<L<
=#=1=@=p=
2.2q2|2
585L5Y5d5m5
6$636>6R6a6j6
7%747=7l7
8#8,818E8M8Y8e8
9#9,919D9S9`9i9q9
;0<6<><J<Y<i<n<
=(=.=:=J=T=`=o=
>%>->B>S>g>y>
1^2s2{2
8F8Q8h8s8{8
:?;[;g;y;
;Q<d<m<
=@>S>h>}>
1,161;1Q1_1m1y1
1@2E2p2z2
20373>3k3
484A4^4
0/0N0i0s0
11)1/151;1H1P1X1^1c1j1s1
242O2x3
.363<3B3P3V3\3
1101F1J9
8:8Z8c8
9P9Y9i9t9z9
4g6k6o6s6w6{6
8X9b9n9x9
: :-:V:`:l:y:
;(;5;P;W;d;n;
<</<9<c<x<
=+=:=R=t=
=D>Y>j>~>
?*?@?N?[?
%040J0X0e0
1*1@1N1[1
2%2,2:2A2M2T2d2v2~2
3%3-343?3F3R3Y3
(191U1s1z1
2G2N2U2a2h2
3+3:3V3`3j3|3
<+<=<H<S<^<p<{=
1/:7:T:j:
5%5,515:5?5H5\5d5w5
6X6`6w6}6
7:8M8`8l8|8
;>;C;P;
=9=C=T=z=
>/>G>M>a>~>
>M?V?^?
0*0A0^0
0%1-1>1D1k1
2'2.2N2T2Z2`2f2l2s2z2
3"3U3[3a3g3m3s3z3
4:4W4r4
5*5C5K5[5v5
5,6A6Q6^6s6
617B7K7S7i7
>&>7>=>C>J>W>
1"1(1.13191?1E1J1P1V1\1a1g1m1s1x1~1
22%2+20262<2B2G2M2S2Y2^2d2j2p2u2{2
3"3(3-33393?3D3J3P3V3[3a3g3m3r3x3~3
4!4'4I4o4
8R<^<d<
?I?Y?p?x?
0#0J0S0X0]0
1>1F1K1[1e1
5%6=6B6
441464B4v5
6(626@6[6l6x6
7<7]7Y8x8}819
:,;1;8;\;};
<)<><U<x<
<3=G=P=
=0=R=d=
8"8H889
3(4K4)566
7-8*:?:
=,=P=k=v=
>(?X?g?}?
a0h0z0
5J5O5p5
959:9D9I9T9_9s9
="=X=]=j=v=
>!>,>2>@>I>N>[>`>m>{>
?%?6???
33.363>3
:P;j;)<
6"6-6;6B6H6c6j6"7'8
;M>W>a>
677=7O7[:
22T2e2
3&3H3Y3n3x3
4.454;4B4T4Y4
5)5@5H5o5
77$7)7D7N7j7u7z7
8!8&8+8I8S8o8z8
9*9?9[9f9k9p9
:!:,:1:6:T:f:
;1;M;X;];b;
;#<?<J<O<T<r<
='=6=Z=l=x=
?&?.?7?@?H?V?^?
0)0j0r0
1!1+1B1J1X1k1q1w1
4>4F4k4s4
0,1A1R1
1.2J2i2
2%3D3}3
;-<7<R<t<
=>>E>U>d>k>
252T2s2
8&8\8h8
9!9T9q9
4Q4X4_4f4
5P5k5}7
8A8V8d8m8
;.;P;c;
<!<a<l<y<
=#>5>I>V>
3a4h4o4v4
=#=5=G=Y=k=}=
=>'>q>{>
6)8c9~9
2<2E2P2
4"4i4u4
:+<X<`<m<n=
>5>I>T>
\0c0j0q0=1
:+:]:w:
/0m0x0
0$101<1O1n1
4=5W5d5
9A:M:a:m:y:
;/;?;K;Z;E<
6'6L6n6
8969>9e9n9
;;A;Q;];l;P<X<
= =>=J=`=i=r=
=!>[>o>
<0M0}0
131<1G1
8'848d8
:B:J:g:w:
:!;+;5;?;I;S;];g;q;{;
<3<N<X<b<l<v<
=&=0=:=D=N=X=b=l=v=
>%>/>9>C>M>W>a>k>u>
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5x5|5
5064686<6@6D6H6L6`6d6h6
7 7$7(7,7
>$>,>4><>D>L>T>\>d>l>t>|>
?$?,?4?<?D?L?T?\?d?l?t?|?
0$0,040<0D0L0T0\0d0l0t0|0
7$7,747<7D7L7T7\7d7l7t7|7
8$8,848<8D8L8T8\8d8l8t8|8
9$9,949<9D9L9T9\9d9l9t9|9
:$:,:4:<:D:L:T:\:d:l:t:|:
;$;,;4;<;D;L;T;\;d;l;t;|;
<$<,<4<<<D<L<T<\<d<l<t<|<
=$=,=4=<=D=L=T=\=d=l=t=|=
> >(>0>8>@>H>P>X>`>h>p>x>
? ?(?0?8?@?H?P?X?`?h?p?x?
0 0(00080@0H0P0X0`0h0p0x0
1 1(10181@1H1P1X1`1h1p1x1
2 2(20282@2H2P2X2`2h2p2x2
3 3(30383@3H3P3X3`3h3p3x3
4 4(40484@4H4P4X4`4h4p4x4
5 5(505
9 9$9(9,9094989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|9
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:
3$3,3034383<3@3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;h;l;p;t;x;|;
<$<0<<<H<T<`<l<x<
= =,=8=D=P=\=h=t=
>(>4>@>L>X>d>p>
?(?4?@?L?X?d?p?|?
d0l0t0|0
1$1,141<1D1
2T3\3d3l3t3|3
4$4,444<4D4L4T4\4d4l4t4|4
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6l6t6|6
7$7,747<7D7L7T7\7d7l7t7|7
8$8,848<8D8L8T8\8d8l8t8|8
9$9,949<9D9L9T9\9d9l9t9|9
:$:,:4:<:D:L:T:\:d:l:p:x:
; ;(;0;8;@;H;P;X;`;h;p;x;
< <(<0<8<@<H<P<X<`<h<p<x<
= =(=0=8=@=H=P=X=`=h=p=x=
> >(>0>8>@>H>P>X>`>h>p>x>
? ?(?0?8?@?H?P?X?`?h?p?x?
0 0(00080@0H0P0X0`0h0p0x0
1 1(10181@1H1P1X1`1h1p1x1
7 7$7(7,7074787<7@7D7H7L7P7T7X7\7`7d7h7l7p7t7x7|7
74888<8@8
<9@9D9H9h9l9
= =$=4=8=@=X=h=l=|=
> >(>@>P>T>d>h>l>p>x>
?,?<?@?P?T?\?t?
0 00040<0T0d0h0x0|0
1,1014181<1D1\1l1p1
2 2024282@2X2
7D7X7h7x7
8L8\8h8p8
9 9T9\9d9p9x9
: :(:\:l:x:
;(;0;d;t;
<$<0<8<l<|<
=,=4=H=P=X=`=d=h=p=
>$>X>`>d>
?<?@?H?P?X?\?d?x?
080D0`0
1 1@1`1
2(2H2h2
3(3H3h3
4(4H4h4
5(5H5h5
6(606D6L6P6X6\6`6d6h6p6x6
`1d1h1x1|1
2(282H2`2l2p2t2
:$:L:l:
;4;T;t;
<,<L<h<
um}> ^
ZlJrj>cQ
PPQh#M@
WWVhyR@
9>ubWW
SVWPPPP
VB5!6&*
Segreg3
opgang
turkli
turkli
Strmpeso7
Agtpa1
Konfer
tV1B=2I
C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Scenefunk1
LIFTERABS
Gensta
hvislel
FABRIKSFR
forest
DIALOGIS
Nonpoint
COPLOTHN
INTERMATT
Frame1
Ilford
Combo1
fremtid
equalise
HScroll1
Twatsopht8
HScroll2
tubulat
BLINDSM
Bebyrde6
kernel32
IsWow64Process
advapi32.dll
LookupAccountNameA
user32
SetSystemCursor
wininet.dll
FtpFindFirstFileA
FlashWindow
SendMessageA
winmm.dll
GetPrivateProfileStringA
shlwapi.dll
PathIsPrefixA
WritePrivateProfileStringA
CloseWindow
CreateThread
waveInPrepareHeader
GetPropA
QueryPerformanceFrequency
MODIFIABILITY
Sjlesrgerisk4
TERRITS
VBA6.DLL
__vbaVarTstEq
__vbaErase
__vbaVarCopy
__vbaLateMemCall
__vbaFreeObjList
__vbaObjVar
__vbaObjSetAddref
__vbaDateVar
__vbaFileOpen
__vbaErrorOverflow
__vbaAryDestruct
__vbaOnError
__vbaEnd
__vbaRecAnsiToUni
__vbaRecUniToAnsi
__vbaI2I4
__vbaObjSet
__vbaDerefAry1
__vbaRedim
__vbaStrComp
__vbaVarMove
__vbaI4Str
__vbaStrCmp
GetWindowTextA
__vbaFreeVarList
__vbaVarDup
__vbaVarTstNe
__vbaStrCat
__vbaNew2
user32
__vbaStrVarMove
__vbaStrCopy
__vbaFreeStr
__vbaFreeObj
__vbaHresultCheckObj
__vbaFreeVar
__vbaStrMove
__vbaFreeStrList
__vbaSetSystemError
__vbaStrToAnsi
GetWindowTextLengthA
VirtualProtect
WritePrivateProfileSectionA
WriteConsoleA
Myreflittiges9
shambolic
PSEUDOGYNE
Erstatningssag5
Snekdernes6
preventively
Fylogenesens
MELANOMA
Impregns
Internality
ORDSKIFTERS
UNCASES
STERILIZATION
jXhx\H
jLhX\H
jLhX\H
j`hx\H
jLhX\H
h /]1V
jLhX\H
jhhx\H
jxhx\H
jphx\H
jhhx\H
jphx\H
jxhx\H
j`hx\H
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaStrVarMove
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaRecAnsiToUni
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
EVENT_SINK_AddRef
__vbaStrCmp
__vbaVarTstEq
__vbaI2I4
__vbaObjVar
DllFunctionCall
_adj_fpatan
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
__vbaDateVar
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaLateMemCall
__vbaStrToAnsi
__vbaVarDup
__vbaStrComp
__vbaVarCopy
_CIatan
__vbaStrMove
_allmul
_CItan
_CIexp
__vbaFreeObj
__vbaFreeStr
kernel32.dll
zh-CHS
az-AZ-Latn
uz-UZ-Latn
kok-IN
syr-SY
div-MV
quz-BO
sr-SP-Latn
az-AZ-Cyrl
uz-UZ-Cyrl
quz-EC
sr-SP-Cyrl
quz-PE
smj-NO
bs-BA-Latn
smj-SE
sr-BA-Latn
sma-NO
sr-BA-Cyrl
sma-SE
sms-FI
smn-FI
zh-CHT
az-az-cyrl
az-az-latn
bs-ba-latn
div-mv
kok-in
quz-bo
quz-ec
quz-pe
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
syr-sy
uz-uz-cyrl
uz-uz-latn
zh-chs
zh-cht
Eadvapi32
api-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
kernel32
(null)
mscoree.dll
DLC_ALL
LC_COLLATE
LC_CTYPE
LC_MONETARY
LC_NUMERIC
LC_TIME
((((( H
(
((((( H
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
Eapi-ms-win-appmodel-runtime-l1-1-1
api-ms-win-core-datetime-l1-1-1
api-ms-win-core-file-l2-1-1
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-kernel32-package-current-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
user32
Eamerican
american english
american-english
australian
belgian
canadian
chinese
chinese-hongkong
chinese-simplified
chinese-singapore
chinese-traditional
dutch-belgian
english-american
english-aus
english-belize
english-can
english-caribbean
english-ire
english-jamaica
english-nz
english-south africa
english-trinidad y tobago
english-uk
english-us
english-usa
french-belgian
french-canadian
french-luxembourg
french-swiss
german-austrian
german-lichtenstein
german-luxembourg
german-swiss
irish-english
italian-swiss
norwegian
norwegian-bokmal
norwegian-nynorsk
portuguese-brazilian
spanish-argentina
spanish-bolivia
spanish-chile
spanish-colombia
spanish-costa rica
spanish-dominican republic
spanish-ecuador
spanish-el salvador
spanish-guatemala
spanish-honduras
spanish-mexican
spanish-modern
spanish-nicaragua
spanish-panama
spanish-paraguay
spanish-peru
spanish-puerto rico
spanish-uruguay
spanish-venezuela
swedish-finland
america
britain
england
great britain
holland
hong-kong
new-zealand
pr china
pr-china
puerto-rico
slovak
south africa
south korea
south-africa
south-korea
trinidad & tobago
united-kingdom
united-states
CONOUT$
/sort "Visit Time" /stext "
Software\Classes\mscfile\shell\open\command
[%04i/%02i/%02i %02i:%02i:%02i
Software\Microsoft\Windows\CurrentVersion\Run\
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
\install.vbs
WScript.Sleep 1000
Set fso = CreateObject("Scripting.FileSystemObject")
fso.DeleteFile
""", 0
CreateObject("WScript.Shell").Run "cmd /c ""
fso.DeleteFile(Wscript.ScriptFullName)
On Error Resume Next
while fso.FileExists("
fso.DeleteFile "
fso.DeleteFolder "
\update.vbs
CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
Program Files\
Program Files (x86)\
pth_unenc
H\system32
WinDir
\SysWOW64
\svchost.exe
!temp_
/stext "
cmd.exe
\sysinfo.txt
dxdiag
image/jpeg
image/png
wnd_%04i%02i%02i_%02i%02i%02i
time_%04i%02i%02i_%02i%02i%02i
alias audio
" type
open "
http\shell\open\command
lDisplayName
Publisher
DisplayVersion
InstallLocation
InstallDate
UninstallString
SystemDrive
ProgramFiles
AppData
UserProfile
SETTINGS
untimorouspligtigeslrk
Forwardudvalgsb6
daaseoplukkershalvhedens
Fleylandmogigraphiatrdokker5
fdevaremyndighedernevugge
Militariseredesynk
Gradometeruncumbrou
UNHEAVENLYSM
Debatfilme
terroriseringers
Pisgah
Flinthearted4
Orddelingers7
lseadgangs
anmeldereksemplars
Twentyeight8
Tepidly7
Undertitlerne7
prorebel
QUAALUDES
14:14:1
Unenviably9
Brancheorganisationsarbejdernes4
myrtekrans
Indskar8
saltvandsindsprjtningens
Tambouret
affyrings
duopol
STILANALYSERNE
Tjenestegringen
Brugerstatus4
udmundede
JURYMEN
impeevish
Siksakket
saunderswood
Absinten
elevatorskakter
POSTENDES
Choroid
Havesyg7
Katrineblommen3
Steenas8
Tilkastes
epizoarian
g7j6w5qWMha1SgBIYBW0v5wofq67MXqD3Q127
Novelette3
Out of stri
Substantivises
Abetted9
Toller
NEDSAENKET
Intervenerer8
PUNCTIFORM
DEGAUSSING
FREDERIKSBORGS
Tragikomediens
Kokotte
SAMKRSELENS
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
040904B0
Comments
CealNetworks, Inc.
CompanyName
CealNetworks, Inc.
FileDescription
CealNetworks, Inc.
LegalCopyright
CealNetworks, Inc.
LegalTrademarks
CealNetworks, Inc.
ProductName
CealNetworks, Inc.
FileVersion
ProductVersion
InternalName
Segreg3
OriginalFilename
Segreg3.exe
Antivirus Signature
Bkav W32.AIDetect.malware2
Lionic Clean
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Heur.PonyStealer.Km0@dS9JGwgi
FireEye Generic.mg.bf6bcbda23200e2b
CAT-QuickHeal Clean
McAfee Clean
Cylance Unsafe
VIPRE Clean
Sangfor Trojan.Win32.Save.a
CrowdStrike Clean
BitDefender Gen:Heur.PonyStealer.Km0@dS9JGwgi
K7GW Clean
K7AntiVirus Clean
BitDefenderTheta Gen:NN.ZevbaF.34218.Km0@aS9JGwgi
Cyren Clean
ESET-NOD32 Clean
Baidu Clean
APEX Malicious
Paloalto generic.ml
ClamAV Win.Trojan.Remcos-9753190-0
Kaspersky Clean
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Rising Backdoor.Remcos!1.B6A7 (CLASSIC)
Ad-Aware Gen:Heur.PonyStealer.Km0@dS9JGwgi
TACHYON Clean
Emsisoft Gen:Heur.PonyStealer.Km0@dS9JGwgi (B)
Comodo Clean
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Fareit.hh
CMC Clean
Sophos Clean
Ikarus Clean
GData Gen:Heur.PonyStealer.Km0@dS9JGwgi
Jiangmin Clean
eGambit Unsafe.AI_Score_100%
Avira Clean
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Arcabit Trojan.PonyStealer.E8C0FE
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Backdoor:Win32/Remcos.GA!MTB
Cynet Malicious (score: 100)
AhnLab-V3 Clean
Acronis Clean
VBA32 Clean
ALYac Gen:Heur.PonyStealer.Km0@dS9JGwgi
MAX malware (ai score=86)
Malwarebytes Malware.AI.327962661
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Clean
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Clean
Fortinet Clean
Webroot Clean
Avast Clean
No IRMA results available.