Static | ZeroBOX

PE Compile Time

2022-12-07 01:44:14

PDB Path

C:\Boyequi\Fopay\ganod\Xim waho.pdb

PE Imphash

ea99070f73acd93ad4801f9c4cb273d7

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00135d03 0x00135e00 7.98820458775
.rdata 0x00137000 0x0000326a 0x00003400 4.8230577585
.data 0x0013b000 0x002c3760 0x00000e00 2.85851505671
.rsrc 0x003ff000 0x000230c4 0x00023200 6.87613396248
.reloc 0x00423000 0x00004a28 0x00004c00 3.05881003862

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00420f08 0x00000128 LANG_BULGARIAN SUBLANG_SYS_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00420f08 0x00000128 LANG_BULGARIAN SUBLANG_SYS_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00420f08 0x00000128 LANG_BULGARIAN SUBLANG_SYS_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00420f08 0x00000128 LANG_BULGARIAN SUBLANG_SYS_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00420f08 0x00000128 LANG_BULGARIAN SUBLANG_SYS_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00420f08 0x00000128 LANG_BULGARIAN SUBLANG_SYS_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00420f08 0x00000128 LANG_BULGARIAN SUBLANG_SYS_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00420f08 0x00000128 LANG_BULGARIAN SUBLANG_SYS_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00420f08 0x00000128 LANG_BULGARIAN SUBLANG_SYS_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00420f08 0x00000128 LANG_BULGARIAN SUBLANG_SYS_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00420f08 0x00000128 LANG_BULGARIAN SUBLANG_SYS_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00420f08 0x00000128 LANG_BULGARIAN SUBLANG_SYS_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00420f08 0x00000128 LANG_BULGARIAN SUBLANG_SYS_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00420f08 0x00000128 LANG_BULGARIAN SUBLANG_SYS_DEFAULT GLS_BINARY_LSB_FIRST
RT_DIALOG 0x00421120 0x00000174 LANG_BULGARIAN SUBLANG_SYS_DEFAULT data
RT_DIALOG 0x00421120 0x00000174 LANG_BULGARIAN SUBLANG_SYS_DEFAULT data
RT_STRING 0x00421c00 0x000003a0 LANG_BULGARIAN SUBLANG_SYS_DEFAULT data
RT_STRING 0x00421c00 0x000003a0 LANG_BULGARIAN SUBLANG_SYS_DEFAULT data
RT_STRING 0x00421c00 0x000003a0 LANG_BULGARIAN SUBLANG_SYS_DEFAULT data
RT_GROUP_ICON 0x00421fa0 0x000000ca LANG_BULGARIAN SUBLANG_SYS_DEFAULT data
RT_MANIFEST 0x0042206c 0x00000056 LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with CRLF line terminators

Imports

Library KERNEL32.dll:
0x537008 GetCommandLineW
0x53700c lstrcmpA
0x537010 TlsGetValue
0x537014 HeapAlloc
0x537018 ClearCommError
0x537020 GetCurrentProcess
0x537024 OutputDebugStringW
0x537028 IsBadReadPtr
0x537030 GetConsoleCP
0x537034 LoadLibraryW
0x537038 Sleep
0x53703c HeapCreate
0x537040 ExitProcess
0x537044 GetLastError
0x53704c SetLastError
0x537050 GetProcAddress
0x537054 IsValidCodePage
0x537058 FoldStringW
0x53705c RaiseException
0x537060 GetStringTypeW
0x537064 MultiByteToWideChar
0x537068 LCMapStringW
0x537070 GetACP
0x537078 HeapReAlloc
0x53707c HeapSize
0x537080 WideCharToMultiByte
0x537084 HeapSetInformation
0x537088 GetStartupInfoW
0x53708c TerminateProcess
0x537098 IsDebuggerPresent
0x53709c GetModuleHandleW
0x5370a0 DecodePointer
0x5370a4 WriteFile
0x5370a8 GetStdHandle
0x5370ac GetModuleFileNameW
0x5370b8 SetHandleCount
0x5370c0 GetFileType
0x5370c8 EncodePointer
0x5370cc TlsAlloc
0x5370d0 TlsSetValue
0x5370d4 TlsFree
0x5370d8 GetCurrentThreadId
0x5370e4 GetTickCount
0x5370e8 GetCurrentProcessId
0x5370f8 HeapFree
0x5370fc GetCPInfo
0x537100 GetOEMCP
0x537104 RtlUnwind
Library USER32.dll:
0x53710c IsWindowVisible
0x537110 EnumDisplayDevicesW
0x537114 GetParent
0x537118 GetForegroundWindow
0x53711c IsWindow
0x537120 MessageBoxW
Library GDI32.dll:
0x537000 GetEnhMetaFileBits
Library ole32.dll:
0x537128 CoInitialize
0x53712c CoUninitialize

!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
D$@0q|d
D$(+Vf
&x#(R
&x#?M
h*jR|RP
*V,1y#
V,1y#w
%v*:@MQ
VXbDgCGe
DgCGe%
`;Q6c6
X&V@5]
tQHt<Hu^
uhL{S
^SSSSS
QQSVWh
j@j ^V
URPQQh
t"SS9] u
;t$,v-
UQPXY]Y[
(leL$E
jd+%FN
?H]7*L
rfu~la
RmC(QP
4%VD^n
gbAG'}t
T:ao7
+W&/FB
NrI[)z[
]UH{+4
NV0JLr
^w'$U0"
7Ck%#q\
]4E3,A
=T1sqL
=+k`D,
A28%5r
1-4dv;8
ST9lp?
r8"fUL>
Ld`ErQB
;2&Gk[
;wV#BSY
6vk|'
)8OF/(
Y*'/S?
]T)U2b
v(Xb W@>r
`(RT{hj
61GOLS
z<?f!)
elp#I8
p=&rpr\
X:DLoLiQ
KW?r&q{2F
,' p6n
ZU&up-
zIG`f~
YnuUk2-
,a:)N<N
w5: $Q
xx^V"z
lwD *S
XLG\I=MmMk
_*ix0#a
cUdbFs
=-R7\B
.pbwfbq
(PPjR\[
=*PIP(}
W#9bQQF
P_J^V_
JtUqx7
qufA ~u{
h#hY1J
xKta%`V[?Q`
Fq]{zI1
QiPD(k
r:~vEWqx
dA,?h'k
-(ViiL
TGC/3H
4&gsOO%
m"m^<`
BjgwQ$5
i'|y8(-
5-bt;Cn
IFR<*w;
v))I3?
{|"BMDJ
qmq+A.`
d{d.E'Z{
MHk|>$O
YR?I~&9
4E5eQj
e&e`F,@
-[i/sVx
>.]HJ'
e/#d6*
8^/ >/
R|x,Se
9NlE$i
D[k)/EY
_IG6(e
3bWcs; heO
E(Tn%6
UU8WpZz
(9?'Yk
?b)&F"
+:IHqzA
p7,6}hA
K'%D'4
Re:Du&m
&Kpjh3W
sJfd1n
F&0Fc(p$,
P%!STl
H4KVk%
x;{pxT
osHV&X
LTLiuq
_>"6d%
{$VOr7
DZgg!)
'D!G<U
QEsX}$
~a|T9{
J7lG8!0
0GvWoi
&x[&(`
7H<h{V
r>$d9^
7vFcTU
N0"hN%
t0W$<R
`#3xeH
,JT4 G
SC0Ks@ R4
+<[bp
_'<N*=@
R Po$"
7,ZwDQp
BAb("IZ
&p:.MH
"tm0j#VPD
~;:qxS<
HOwg/xA2
tcmp'Y.
^R`NI/
RsXya|L
E^oE7]O
'?~3(W
>N{xCX
7"#2W>mX
PSqyYo
>Ke}qt
Me!Clm
~U4Kc,
dh)$uMN
v]ozS~
R&SIw4
).e~v=%d
:'5"mj,+
%}~IXPM
,h~<gp
|SPH3EGe
)kt\$j
&q1DAjp
u4O`QN
ZPCjK!3_v
W}j5cy
sdR-o_:
;ch}.+H
j0ZEW|
Af_6P^
yM85?0N6q
MOWR!&
r~dfR7%
0OKmI.
'ByZqQao
s?,_sd
>Qakpu
fSsa)T
LY#\,G6
mcH0{9]0z
A.Ygw2X?
M.r<T]`3V@%H
Hi7~s.
/j^Lk
)pIP1J0
-">[G#
n)Ey v
LNrzdW
(y>0V8
$WboEP
k?JgRy&)
r:iV8y
v8y$,|
4:`10"l
SmB[n=
1N3e'-
I_#'7[
p:@&b,K
'IeMUac+
kxU>ll
m.@dwh
36oC>#
UX&t5+
@)+HT
hT#:[!
2LcBZ7
&5QO=1D
8C0*_S
P@:k"?
LN,d]A
2st*Ve
M#1J%R<
&tFMG<
|#FcIJ
w)Gw5Q
S3D19!
;AX.;b
^lRp>G
+/z:_e
g%IL{woG
\:]LYs
EW/#w~
\A(2RC
:&4[P39
\ K}QG
8mjew(
{-o,ji9R
i08Q4s
2&~<_l
!|wHM}b
#{9qG{
I!{,f/
&Uq0aDD
S:X6+T
;mZ@2Acbb
6lT]oun
k&K9Md
}>`|,\
6T y5'
f@, DU
l)BFGmL
`n^LV<
H%{%hP
l'|h,$d
qap! I
:$!cOa
&k.@U*:
a <?61
H d,do
{S)q{%
l0S0fge
@0e5YG~v6=)j
%cwR$J
Z%|w #%
wntH`./01
l1i;KGP
n2l(U6
'X@v!u
}mxV)U
P/N?uk%
`xJ1T
#v")e|2
GXy2c$S
9&W+nI
DWU'0.
2>=iQ;
(7p*[Z
!|fbE@
8\X7:n
Iiw7Jx[
>|X9=*
sJ2%CX
S;a_t<
Q4VA+v(
%YVA5>
$hrHSG
<>\Cf=
GKS\yY
jIb\En
./Lq?
&sp;I?B
V|*+v
[$miok
dqc8M#|^
TP0I@.!
dC060;
QQ&yxE
v`%Yi/
(Bq,A5
[qX@V
EMY"dC
QmKJXEiz
2Wg_k}!
bFm*D
PK`0O'
mI*lq"
?5I'X3
H)kC{!R
AT,Rq!>SG
n7oQxC
6ye}rF{57Wk
_lcHvJ
Zyq!6Q2J
{0".c@
,|FQ!t/
.g,s%8
89"B)n
9wIMus
ZeMuE,
aa4wzC
_%xuc%
g9"1 ^
+,LNx\
"m8cqF%
FUGHD&
14dud2
NmEW-a
,u B.U6{
l*;|V>pH?Pa
_Xrx|8
HUhj-R?*9X*
w%c`W?
6OVP7:n
I .U:VB
l4y7U:Sb
924`=A&xSE
L-:KW,
Q$Css &
Rx(:Go
p\;y`c-
|[lg k
/7}u2{
TD4-YBo
[g2>"9Uj$
j%8:D3H
J,#f.;
l~_={~
i0]P O
`#{F;~
1FnTEP
2`Fo9=
-8%wsn$Ba
Jnwt,"
k>w#o8
&W{zvB;g
Ewn+m
_.l*6=
bp|w_yT
eY*>]a~
jk L?AHQ
LVSB&)
1`YynaE,
@;9 Tw,!
7^/FT)
>gKBqB+
Z&)}f[.<
)fq4I_
i$RYi2
lKw.uq
J)zQuzC
A{Wt(R
gGF*:?
9yew[D
:n,yai
nOq7y&&
{*-|zu
H3Xcu8
<J).Jj~
<-X9[x@3F<
*y"=DZ
ln,@s>6
iF*NcFo
:z@* #
p@Q\G]:
s1D3jXm]u
s6J3BB!
Ub^Bxn
~+FbOR
?;z$!9
O2Aw27#y
K9f^/iE
|SJv6X
:((S).
tpM&q9S
1d\6Z5
0K1HKb
;qnEaJ;
,05"D
>m+K=uNH
\P$EcFzW
AjQ4-E
4+Mj4'
e'6+do$
/$N;I*
`=QV0N
ok\p#r
T nys+
PP(j.K
Px.$OP
{6]~8j
!wQeP
<WW*Lt
OVgQ{S
DV|xp"c%
GB[%H?=
C-(UY
u\)9Ia
EX#~9Z
\$B9W+*d
%Ds*od
lA{W_d
F4XJPK\
WU"5/"W
O8az(c
;p`f&o
+oITv4
"Wv#xg
\M\'Y}
TzHE y
g*)qTn
9?H%c,^
F'OSGD
uSNut(xy
,*[^tT
(r_d.r
dqtFE_
x#%0l
uzk)sx
}KNLF?
]72g:]
u@,Y<(
wHAg'r
u@=Bt|
X^Yo-d
s_5~^ns
1Xp`L7
wvN!<T
_s0;yw
gqgI/]
2]MrF@
^U2Ex;
3\@ZH!P.
^/"^ax`>
MQ%{&>M5
@Uxlq<G
^~jQO!
W\z)k0g
vzA(g9'7k
qHi6`&
gRM-$T
V$3:0)
)4?'28[
B1[ZGL
kK"N.Q
~1;Qd@
H5,v:@$O
0}"Ew%U
{B,{D{
|KW*Cs<C
~vT#@9Tn
[xGAZ`
TUO!cZL
Ge{1% B
.:%X O
#)oM\/_
FQW J
p['f0,+
?lczJ6z/
e5yQtV#
#WRy^]
~s[>pF
ScBm'@7
jdp1u&
ce}?x\
LP;'P'
Ft`ZiP
;uD^;a
;7=U"X
YGwtVc
X!K<O5
?ri$D6
b./VLl
/gtAkC
Z\D,fq
~gb;|.
?(Jg8aeBC
(3P)[zl
K{,-;S
>z0s9-
KoN=@0
YL5JY
{,=pin
Q2X\L$
w`D^ D
;6U$O-i
^Zz~U"
8LDle<Pf
B b.;'
WMP$7\4w
t<pKxX
*_ f[h
qo<ggR'S
P2h{WB
[X!i?C
dx6cx=
=%2=rD
K'*|]C
~)uuI"I$
;YL%/a
jY!rXM
#k&l~`
6(D/k1E7
?Yr`PQ
I.:PF3
BINJ*6I
Y3`;Us
IOo@aR
X~z2bPxv
~<Gv?w
qE@`0xuE
}V.B7e8
+5CSf7
JKQU\s
e_&p~R
:R\H#A
&v~kID
;<zu7_
W;w'p3%
:R+PA*kvb
"3 (:TH
"G}e4%G
PXSRP
Gj<p`<0;
C=eENd
?sqLgN
x@U1D"Z
.xm1J4
b@8cli
3K]I|X~%
_]{rHU
X4uVn+
oEWBg"
glNS\.
C<RAQ~`
dA^5[T
2/=6Xd
:?xu*D
[4)/=Qk
7tjmAo
3pK4w*
w-F_[0
Ow-dyf4gyh
puwk!K
^xgK05
hF<qY&{
9lz7!p
b/fF0Eq
GW/haP
qk&JF
PWR#2h
N}4VoQ<
%m_9"W
GnyA06
p`1SX
8M$R;n
Uq#5ucY
$^!k39
iBjC}]k$
"9(XqL
k||;{H
DJU^(6
v=hN}
@Nq*p%
=P9{fC~
pjR/bf
";'Q`M
Z;J`H
>Sl_N%}
5Qyx:x
*N^Lvms
/T.~_Pm
']3Y^V
MY1D8{
ZkQ8A<
Q!J5Q-
Y!Y':]R?h
\\Im:=
g?70@2f
:+m4DY
,CWO`5Y(
Bk%yX}<2)
/"Y=Hu6
FY!^Hz}"
qsc8Ne'
?3B3U9
,_QS}$
@8lG+C
)0UQ$
Q/KC#_WA
\|_L JE
1-1`e
^PF?Mz
|2:>e
|Q"k{~j
'$yZo3(G
isB[?a
&r1I'mq
l*Vq)
.hrb~>
n!sEHG
zSWmz:8
T%:]0`
"JvTFf
dhB8*L
f(_]~
1 E?N4
|Aa0fm
,"&32/
o3J>pif
|\qOT#4
0=Y!Df_
\OI;ZRE
A~X(It
-f7-!jg\p-(G
>Bxa-`
s,&0/0
*NCRIb
jWP8z$I
nJY522-
*2?=PT
S@{+~+
_d ?F/[
ZCkE:V
S+B|Q7:
.nG-89
bwqbZ4
B4D%=i$ZD
m1E#%"
w)m(Q,
NJtOh<:]
X$wpfb
?=/01_
h(M[z\
7n,cY
_NTbO}
r2ZwC-
9%]G19
"$L1irE
IGw$m{(I=
diX&k&
{q V*h
/3#3nJ
{$ExP^"
440gw%
oT3pFE
_5[(P
>k'1]JlD
}8Bv"+
{kWKc}
sO3[PMG9
5aJQ8E
|~hbQtA
G91w|M
\8sw?l
ZA?:`<
%|1_Z-
5}(Uo"!!n
7Jzon
:=<K@%
$2s)pKJ
5=[B(='
Q)nyTa
9aKKi<
>o;(L!
nPTYcg
F+"r:)
X#kWv#Y
,Iq%p^
OSR'av]
Q4oav+
4GO!I0
?,/T;
4KAT9Q9
0_tzn$
#K&1U&
Pw?w9B
e"fs4aBiR`;
znl{w'
F+?(?"
l"&`~C~Hv
\p]BGh
?wkA>D
9@}-%p
j3fQ!s
C52/9l
?)oWC&W
QonKXC
9:BEJ&
'f~TM-
(rb}xo
ZEr@MVa{
[JDz["
g"=l7<[
&!_"ga
r]R@NAg
KQ93p=
GMaCIH
6-%v]'%Ew$
&}`j:(
ti,I$R1@
5[j3KR
.7~@\28\
!& w#!
G1z!t${:
aFd,"q>
EO<+xQ
Qjq<F7
OZg.J!1
S)ThQ)
te!F7#LjX3
/v&8*_
r3`kkat;
=YZu 7
uDa%;I
!]!xsf
CE%oud
J{p4Bw=W
%xi'\>4u!?
^9#u%1
nGH9[5
N`jB*
JSoSe*
?^0s@p
V<%9/_
eQm.04@
)WZP/_
f)b)!X
d/ 6U#i
!]`!n0wE
E!cPpH
@^9?qs
Rv(%J~
'|[0)[R
`y-^NU
Raj+Sc
tyQ3hE
-VvQrY5
1v6er}a
{1tK2I^
AB>|D0
7IQTQ^v
]<9f?J
='J&W^j
]dM&Wj
6AlM1K
l>NnCU
;"EE\(
"k+`iYi
mH'UZ*R
lX'oEM
5a63PN4
*DMGM
aZI^3M
)~VcK
eI{#NFuq
K{ae^(
yD|g5,
\{9IFu
BHc>Kx
(!DL3@
gf>X* '
9:#oy[x
M^}Y{N
`HQ]o;y
i0|w5q
Qvl-z,
9E&web|
PYAIO\
;9R :O
/|rPpt
mp[b<>
;+e_qM
)lN|4v[
.QHqhu
}T/}lr
=*p7f-
j5.dH>I0
8w)\8ot
KPzyQ:
)aU}7VWWL2;
nkpe=c
F#Uq.q
xDqFtS-
?HYv<[
#<H#3g
C_%N13
xsglvk
unGv]gO
6P`Q9".
&sLA:1
gge7)/V
}N&guZ
ao-V)A
I13VC?
LU*(}h
kOVW(twW
p\uLsjzlY
pz.AZp`
gXy6%ER
l.7)M5|
+S`LtJ
W(Yc<rwF
sBoc .
f.g=c@K
t]AGV4
I:/GNE
"05j0m
()d#3.
Lo>- $
?!t<t{
R) 5r
!{%5{P
UZqf=j
(M@)@c
th&jTTPOq
l2$*q3>
.jCG<p
LPbscH
riED]$u
U~ZzvQ
#=. @?
?QAjI(
(VH\+m
&65CdN2
Pu(#oG
"-3x6\
EWa=D-z#a
{E#rlxt
ZN4/!F
f2~p>I
xy-L`
l)X2yP
Lkx}'K
z_g~]<
2lOq%Uh;
VPzs7j(i|H
LqX)=MX
7WZBXkp
3 G1_?Sz
({ g~<
&Ir:V.
m'>iMOb
:\}iYe
UJ Y$e
f>s0|E
O2>\-p
b84v|el
e:jQUUz
u~Nq%g
L.bcb@
p^`l'!
w=Lik~
e<U21:S;S
TqbSGK
1&:K.&
4tXC(Km:K
?{2fBU
}QHFn.l
Bt^^b}D
E*V6KB
9a_|)!
K]{zk<
[`gzwa
Bl10i\f
n^tKO2
`tpVSl
7-.uH,v
OROe'm
JgKK4Q
L"SLcLt
"u9'3;f}I[
XBw /8
%_gR$SB
oc5&"i
=%3D0S
WA#{j=*
7v"2Xx9
2bdzg,
I<p/q.1
jt-{#:N
Gdv(*&FP
.Pb&s,Y7
%B=CYerp}
Ys"1Of
,V{0')
<,/jBb
)FvLDn&
PoX3#k
V;Zqw2
D(Yq%-
q:kvy[0
VtE\P^-
)h~TqU+
kW_hdx
UOKTr4Xa
>V?2'g
ePE*.je
fU-ya`r
t.2QPy
cJUe|+b
d9*|>)s
 g>::
<wU(p9]<H
A>,Q-12
wV11/z
CABc8ZX
kjS>S9
"i$F:s
J(t4y1t
VP8q`
KUlcIXli
RP"gff
~H>X'Z
Z;p&rk
aJQ.S=
'nD/-^1-
G><= t
1]Ejk@
Gr?u8y
C>+TVn
rkbq8-8
<h} <M>
Wui{z"
Lg(/-t0
mzY#s.
phi(Y'
:@?.'59
CM"Le=
9a5'}o
-BF;;4
5q_s}1
y-h`,6
%S+Bmq
_#e`JS
~wk4C_SoN
QJF;\0C
FYdgV
c0a(]G
[_3:|1
$<ZSb4
dCCD8;$
KF+`<k
6I]^op*
";+_?m;
e\3 <7
K/p;YW
$7]SdJ
<2]xc(
O=),0
tg4B(KT
H:P2fw6
LM+q9:
q$PCMW>4
`{!jw~vP
E|c;9#
KwKM lI
<_#|/`
,zfCi2FDN
fA#8^NvZ
Jl5Y-ZD
7=)?~j
?__HJ_
0$8<';B
$lj5wK
^hgzic8F
61L.Sb
j=AV#%Y
y[G0ua
vT7]M"z
B1-G=w
d U6~f
PZ2ch4
]#}"a(}"
_[rO%-V
h{]<>
q5#_M W
JoSx]6
$Mq"xv
X61LWb2=+
PyvN&I
}L:*\p#
Z1]f>V
]3oDl`
JWk}dgc,
|Z\Db\~g$R
ZLO;Ps
gcZ5e
DqjBzL8
EA~ HA}sH
egzO;u
9[S>U+
tT8 ]dL
B*GkK\
"4"rGW:
Bb<gt7
jnEj.t
c+'Qe`
u<>j,
VQ'Hq-Im
bwff&Ht}
P!vWC6(,
Y#RP"f=
t%sV0$
Am8Ok
=;VGf9
~v2c=#
-%AOgxF
x^nSapG
8EwF0A
7eq2lAv
Kg{|y
d_R8})|T
tVj]UE
^6L7Vg
Ph`Az\
Ih>&#1.
2T.\X2
w7x2@|
BFY+~/
"#VZi_!
}|PrTp
%/{[|mD'
'xXo(=q
bh*o%\
=IH2\.X(
L6#ey"1"
),T,<m
.[F>NZ$
^Rae+&
<AnO8[P
+IrRa;
z@=1*
23,LZ0
`xP"2qC
@iomFi
I}z9n4uc
,5T!`:`
q9T2M'
YWgfK9
wOC(e97
dhPfp
)o kBv
K)7GSC2
cN@JzKOh
>/)7,)
vIwW#Z
5sUA2''
Ms]Psx
'wbIVU
DoCcjW
W=5C5l
\a!}srcW
*NOQ7Hh
>mB&Tl+U
JoU%f}
Z+Zzl&
YUX9CfZG
wD\J1V
QWv]>*
@sn?\!
Li7((t
0>W'7,
$eo4@FD\Fz
p=lOxX
=xudL]
27ez)y
>irJPM?
=jE;tP-
Xnys_;
z3VlEs
&W<X`Q
Zo~Akv
g[C!%\
x.SB%I
@yG5Yf0O7u
U,Lkqi
L_dT6a6
,x!J=X
1T 6^)
Kej1#s
%sc1d'
Q`^rP3'
[c1d,a
>_WV m
(1hF2]
/Aoa>x
!-^! Rf
\+CNbG
}\Ca$K
1sVz4x
:JLkw`=
^Pf_Z8b
("WF#6FY
0n^}LB
(|#Q7
>^rW>**<
) yu!|
$7ZN+h
}T*!zy
>3~i4|/U
[bc?H?o
,d[Hxe
|5Um4>
o#zwC,
-B}gmt
,sbyhN
8#`}n_YtB
eW'wjGB
U`Ia3=
xJ}0kn1^
dhF(`XAC
+jY0>L
?jfuP?
sgSyW\
9t+>V89
j<jyur
qQ_"RYBM
#I:esJ
fauNW(
)A8U49
"d)%AD
7m*!6q
iiy).VZ
YRkAKM
Quws;S
iJfZ]~7a
Vb.0tn
pQcVD/
_"$#%?&
JNhTSv
*"wqT*
EMmy9)
:K{xOj
9WdCo]IQ
#9zF[O
|R4K#<
88zXLt
sy7{m9
!/Bm=|
S$NHj}ZL
o-U,hh
.{@il>$
k=gN0K
bcTTbV%
&{v5F3
*s-ZO*!
y#nnO,
piU;9|T$
BGy>B)Pw
A:Md*$
='!?Ms33L
}fh[x^~
hi3Zf*C
\VuW4/~
OFkaeL
?+v3EHW
:VD'df'
,^!`7H5F
GnQ5Y_
+$@{v5O
uz}_hEG
6<e/<Z
d*[9mT\
Yz'fr{
[o9rR-
1;8"i/YX
PJ7+vo
1iJE/L
0<tw}AUpA
+hMk;G
;vtVYC
mU5nqCeSe
}2sf:S
;#\#TX
50vT/^
z-!hb,
peUf*{o
K<WO_J
VN _5/_
t%{j^#
*G2h[u"
0<GbK\
Aa7J(*
KpfI]d
$RjTnh
X-e)J%
{Ac{nuX
:S,\iyl
r}/oo+
W_ZtJN
4bjL@`5
aMp{6
.WEC_
|rx&>^
zE[mLimCu^-
?t<4N"
i^wPae
` 2',LZ
)1x7>-
W4\^3^
th-RV
C%x.]4G`
KS@;nvb
cm.n<f
%%b"L8?,D
#H9qc-,
"?#_D/
G"BRD=
]B1yX>
{$NE:o
<uk/ H
zWenqP
ajo`W|
,'FExd
?$w\t$
E`f@%~
,&tX#9
`Gp% @
G\o)`y
)r}!;v!
G>>@SU
@1f65T
8L.ab>^s(
>L[7zC
fNTIb^
RITXy*
&K>]n?u
IJIZ{g(
yFNOC:
1%pB)nfS
;KASin
pv{V|@
83rIB|4
;5n5#Z
3EVrs +
q-EDjlJ[D
oqBrAm
_$r!%-
YWdc<"
6(vqy2
4I&o(tnr
HiNDSy-
s`K@U}Ql
{lhEu1
4C})BKP
Rle*G3,
Y.6"/5<
jHlu*3]
a../0G
Qj@AT{
L|xGv;.
O$$"jjp
(+V%O
P1A\k+F
!#]6{{1
+i1MB/
4K"j[Y
q$a2XA
y(WH4OT
+A3F!H
a3}lir
o3if'OcqR
8!qui
6!Z.A
{Y6FmS6e$
ENeqCv
cZQ[sb
'n'{>~!
]`VgN\
46lLz]
@D7WU2:9
G&03qP
6@~HG%
i JNb.l
S$GTz;<
tYhw5(
d[H\jb
{D{/V
L|jhE-
')?E6e+
5Rh53g8+|
$BkDG9j
{o|tuv
q60L g
B;R_TspN
W%lw?T
*yph3c
O(!4%k
w<pL4px7
T_#|R
v]vAj5
dhRJVS
T;loC4#ig
u6{%^gp
LaF8ke
(zx]UFE
Q,kQ^:6
C~\(v
{o$M[H
?`UZ_~
\%fdA7
!48F9R:
)`~hAP4L
e E#A#
-=0~6o
4P1Ip0U
jZV|De
p4x*a^
`*hHl=
+[=,Co
1T&U+ebz
b)y-@~M
"1%jLf
]f))jJv
bXacu1
2L%q&{X&
&"kXV0W
5;Y*+|A
W\kX@(
NB%+=z
&RY%jEt
3#P$DD
)RH#$x
*{5"q_
Dv(Z9J
;`:kgF
2^C0(v
>(&n'Y
/V{#.`-*
WFDo!\a
[Nk;,Ofq
g"YV3F
J?96(+
c"KEz]
;:4J(H
LQqEQ$
#yT2[.
oZA\]@
#d09E'=N
x?i7Mk
hoYq)y(
a0i-it
&*+Y@1.
Q9*`G,
E6?JG
Vm.N&h
jL(:)rrp
4-K"$s
3lkMpKP
SG3_O>&
2|6iml
w9)<kn
2'jHvd*a
ywAW?>,
sm0^f
PDxk4{Q#
hyt2?j ;
Gnl[c'
y?Sv]P
F<I6]U=
ji;\`k%o
U^'u<b
nr_W9j-
bNtE,3?
T{Y/x9=]
*M(:~?
H2vUk1
[!\oW_
=b"!BXT
Fp)Ova
[vz=%p"
,SC)aQ/
Q\n]-A
UGV`&nvOWJ:
CcsMZ>
5_U91w
ls;Fx"
r$\~eJ
JZ|xV:
x,WCTSB
Ises#r
"#8T}l
#0v+24_*
]Ot-\$
#ohoJpz
-mI\f`
m!Snh`
YY*~Dp
Xr5VRr0
23?#o)
ZbyDLt
LucBPY5
52[yIm'
T.XNt<pRc
xVz@,
Ga~&HC
uE`9.y
)O#Ea*Z-
KcL8y3
}g=Q#h
hZEJ,'
){/G.
N:<Dxj
{Cf6$LCe
HGRHW"h
z#22KQ
M ClU5
#te/.8
2&V6;7s
Gs?6i&
A$bn_']
L][tBD?_I
K-e{Db
C%Q->o
f%e%1Lo
tDKf\CJ
%S`8]P6
]r9<;g
Z_fLP.
"["=|?%
+^aD""f
s:f&4z
l.!Ym$
*O-3)s
`&h'83
V.,yfvK
xRQRT@
)W-LU7
y2Y{ni
(Z58{(
vy/rLs}
LLm4l$Z6
5|UF3X[
.];{v%3
iN~9tV
Y]]5r|
"Ifm~x@)D
f. Z%<
VvoC3w;
i_DPF)
O9{gaf8
z-mP/Su
m6WYxk
DJaR&
oUs<T'
$P=k6>
a|5?"a^
4-NE7
Pr2Mgka
n4K&k+\E^
]6)mRp
oc(8lm
d^OIE&
u<|[8B
7Kkes3
B6,BC
H'a3iN3
Wz3"&2(
lLyy3uT
Gy5TZ{HKm
,%mpS1
. l:pp0g
J%@*[m
UC%@A=
FzZbC0d
1y?/=\
(Y3`@=
U01LBM
e%Crs"
H}.f&*UPA
vw;[ky
1F_2bry
+E\)eLv
MN@Upa
0b8ghv('
g%E3{
}DT~/?
*G3Eo.
6PTgn1
~Kp7k]YK
OQ7.0nG
@AB2gS'
M_sWg0Q
XfD/JiB
o>B&8W
JaGC)
NZ:{H;]
WLxGz5
u#&?_bk
];KrIt
UBuCGb
!vyG\nE
6X0>ib}
z$)5ux[5
!!,0Cb(^"
<"D%Z^
Vj5R1ac
nI|{3Q
Xa}$3b?
D@m^%0
-|{!}X
Z01d.~
k\ZO[TQ
mGWuqP
yB|iRw
^:$%f-
x`{6\5_Lt
V["l7d^v
=>hW3Og
NM5&H
KDqczYLT
I<g)vP@
H_hL?O
XP8AZ`
|<0C>H75~zV
=9$xe/o
@CZ)Yc|
GFWRn0
%`*/5TMb
K+*g/%
QRD;}.%
\t|yW
}3apa~
WgJuO
x,K5'a_BPr
5=Pqd1
4m"|(v
Fu}jw"
>wZOV(51
QWsUZS
fH;}fk
Gc]0d\
cPTg|
W)IzoU)
{f"AYkr
IIM1Bh
-kA3p+-
DE_L#k
Zrdp$,
;ey%B*
\i"Ag?
4}UwA2KiN?/
eCy)|5
EUI[C#z
%4Xyn,-
{/o(>2
D1,(5ubJ
YbGOj5
nr^x]7
xM.&;Q
Dw#2hw
+~~~IB
8Lu_K~
D3HAQ0
Rg[CpG
Slwn<
@8I'^L
Rb+>NI
p$b'+~/c
^~xW52.;
+j}8!=
,is6QT
fpd?TO
'%;QGX
Roo>$?
jt!qz8/p
g>z$}LQ
6_cI=@
\-.Y
$vEq*nj
% PVsn
MnR0~E
l)j{0(
[uA<X[J
_|(x5&_
5K"V^j
};{'TW
<km9W,UNM
s3^^u_
JBRC,tVo0
d!f):St
UK[rs
K'^~s@`
`/L9e_
JMF!JtXvh[
\.Ss"!y_E
(g78.h,
9y:Uwl
R|E}X1
z8^)@\
m>@FnO
T^5x"C
M,H'qs
[q]"(B}
~kk-8w
[w?]p7
c24.I[Wi
0N!g$N'
t!brUXDX
(G#DYL
f6U5F
A7F] )@;
'#xoey@
!5{%<A
drM^X@y
"Z9^ag!l
4g+oeh8k
92]-3S}
gkHux{
%t_"6N
jO%f!/
Leat1|
B\<.},
3p}H7.<K
Zw5vk9
/gLvi@
aEYkf/y^
_W<SB7^
nU^?RQ
#lY0l
hBh*\0
00-5qLj
~n!51$
WXyZgb
-<pV8g
)-l:D#
4q`Uhf
rhOC/1z
W6GVl6j
h8eDT@t"
%PBgVlC
wSB{K%
U6@]FidO
/9\4V2
fTZNJ`
yKnq%z
+<eQ"2
F$r"*G
$73!Ku
lon1ON
\Uj1%GR
*S2?j>
qbL\o1{
IZm>b*
!4-7sW
n{+e=D{
Kn:soB
:*u(\ V
Y0-*^8
akVo@T>
uNkSi#
DLi9#((
H"{ay=
S;j+/kW
)I!@w
Kpb*j^E
>t%cS4
UFE$*s
Alv'])09
{hfJa.w
<|)%f
r-a>^j
J<c{&]M
8AVbjv
Hy?5Ku_i
Zv_E:0#
t8ShvY
f[Xy~*7S
[v(w6H
0d}o0
cfFrxI
Y3(R#q-
:cl/5D3D
'}oeLw
t<]So@=U
rHIOP/
IrPB4s
PB,RT`
`Gk[CS
rG:vh+
(olyeRy 4}D
JlYBArF
uZt`l^2px
^Hp7
}BMUbq
oHA;<;
Ia?j)=:
>zb$R2
XlK{?#J
,OGb^e
/Qg6"I
3w#XsG
n'm@Fi
TW37O=W
/>_"Je
rz](|5
fhX8,e
R2RMPY
\V(`nXR
L-J,mP
CQ@fer
`5[BK@i
{0_Idi8
Z~{eQg
&82Fkhd
S$mdGw
I0pM(G
x$Q3Ez
'm^^'x
`*ns>d
EOXeeo:
nW%b}6
gTUm7M
+@;{NSjn
I)#i2=
$lXE6~
@g11~C2
/,=:]5
)jV4^.
23Ue.z.
,P}j3g
_hX_f
;[nxsL
lQ=@y0
V6VRLk
Bs]Eq|Y
rrGVuP
zyB^bz
/K*'<{
i,bh+]I6d<sR`
m;!DO[
UOJyLD
zJm"+{
'x6^=1
eJt9:HTr
Dm#U`{
6w8kWv3,s
$6SRV
CJOJWfdK
5U&|nD
H7Zx7QN]
F#<h40
]Z6eO!
U1L-G}X
[U*NDb
~~y1]$]
oUI639
h*,K)`
-N1kyEQ
:xVYj
$#!@3 =pQ
1"l77s
qSp.xe
0)Oi=n
u*QB~#
^Aty+nx
crK4c)f
TrQ?5\
@_8QQ?:
7$5m=W
5X~hhc
1eBI1l
D:HS,z
s5mOB|
yp@3fEUJ
P]R0T0a
iMiZ[8T')a:
Wp =l&
A[,5)W
Ami"W)
-SY3`iK_F~
lukrEy
dJiCO
|%KGJ3s
@#M^E)
qxGAKQb
uf/{x
2:0w`a
e?V]Q
\FnX,v8
qIVNp
|@@+DQ
J6~~<5n
%hGgop
wR+,F{
^,.r#x*s"
T&1t_4
s{B*x-
?gNc;Nl
!.s[^MV,c~
-A]}CI
9?xAXQ
!juG"0
0x!EP#
wzv=Q
{u/K]b
pzLec9f
Sm*-OV
*(0G`@k
>nTtbq#
Qr{8e0
J(MSk<
Vrf).p
{,7zf
q;FA)/
[C2NFQ
-Nly$X
b6h}{(
ZXU-`}8
<Zb|AI.[
hbQ3f+
Qt#?)m
,xS2;(
@l9i:z
tt9)P]
*(d@PR:|
`4w8i3
F%&n3ap8
?M\K\X
5'v!kk9
9mE(>5
h=}tH5G
Ocirk-
qhm2T)i*
=M?}W+Y
w'8-[4
XC>SjR
4C6]m!n
"R[^hQH
CZ_.s9e
-aO/}$
-pGxzu
Cm,Sp<o,
H'i-;y
.&zB![
$wY&kI!
z^Wzra
^HZOQI9
gIS$#2
W<B -G
+6098b
:mlkST
i14pc6
Lg?s/6
@Fwrn&
%aE=0&
.$L>1+
'vveZ(G
AG2DR
A{Ib[q
bU:<jl
t)3Km}
[:'<:g
DSGv"$n
Bz0*=f
MaUu4]
tI&nVn
g2}~_pc}B
gld)_N
dC(om%T
R]ZLPF
QA/63N2
*Q?@^+
.0LM`\g
w)mY`"
2vV)gz
hKR)fX
q tJ,]~
6*4?(0|
ZxKC54q@s
Z-P!quN'
GVdmF*
s(ryX}?
#00nQw
D:xWe|
W,gnEQ
CtEC]`
2!.M*(
F$;}6{
1)D82'
_1z S0
.}nww8<N
4[75w<
3@Nx]D>Q
P,G=.o
wr)g#mw
`\ta_>U]
`E`o)*
xOo?q_A
VN=[pC`!
kjpv*m
gJc@s
vE9n8#
u-/LqDx
=)qYXd
]F~|"C
E1x+"gI.j
Pcl{KR.
$(TF$S
PE/:M"*
n'OUlaP
b!z@*@
j7YDp
iv<}S,
EQi8*)69
EzfkDJBn
ld9BCq
~)1m,Y
5R0C,5
Lc$VW@
C*$*5s
4f4L0
Q5fRd{
k;pqoD
F}*dEM/k
2%sJnr3!e
y~[A\\z'
;T@]69c|Nk
STK6B
67i4jL
h<%MDp
agh3A;
^*_H+(
Yd+GJR
;ffHTk
_Z~W%]
5J.Qto
_/w$rFP
^+js_.
{R;@u^
(q?",5_
qFpO`h
ggoui[
1KLKQK
86Bn-a`M
3}5Vg,
k}yblY
U*H~8R
<\a(;s3a
M7azkn
O)>pxH
.8:R~aj
(INJ34
5|U TbQ
Q< i:h#
ilk5]L
Sn:I`u
%|i;qa
K 84+R
g5<dSh
gt@n=$
7'bo39
f.IY$WH=
I= K^F
[$ 6gL
lcY|h>O
k*;rJU
[7)K5:*
J*~7HKu?
Ai~&B*Z
-) 6g)
*$C;x0
+a]*o~
o<,s#.
txGCJ;o
=X?Lk0
}Kq3p'F
Iy3c]y
STeex#
ergc|eC
$83O`
99*%)e
|W->G+
${SJ1J
K8S1Uu
8dUPSN
{Kr|~%
y?@LSY
n0mX%|
w1~a$:
BB{x^1
/mmb"&{
QQSVWd
t=MOC
HtHu4j
t*=RCC
;7|G;p
tR99u2
PPPPPPPP
PPPPPPPP
CorExitProcess
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
EventData
resource unavailab
CertFindCertificat
CorrelationID
GetCommandLineA
CStdStubBuffer_Inv
HeapAlloc
/common/sso/progre
Antivirus Signature
Bkav W32.AIDetect.malware2
Lionic Clean
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Fragtor.175196
ClamAV Clean
FireEye Generic.mg.ff8b52645b3eb0b8
CAT-QuickHeal Clean
ALYac Clean
Cylance Unsafe
VIPRE Gen:Variant.Fragtor.175196
Sangfor Trojan.Win32.Save.a
K7AntiVirus Clean
BitDefender Gen:Variant.Fragtor.175196
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Clean
Cyren Clean
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of Win32/GenCBL.DEE
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.Win32.Strab.gen
Alibaba Trojan:Win32/Strab.74ba260d
NANO-Antivirus Clean
ViRobot Clean
Rising Trojan.GenCBL!8.12138 (CLOUD)
Ad-Aware Gen:Variant.Fragtor.175196
TACHYON Clean
Sophos Mal/Generic-S
Comodo Clean
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition Artemis!Trojan
Trapmine Clean
CMC Clean
Emsisoft Clean
Ikarus Clean
GData Gen:Variant.Fragtor.175196
Jiangmin Clean
Webroot Clean
Avira Clean
Antiy-AVL Clean
Kingsoft Win32.Troj.Undef.(kcloud)
Gridinsoft Clean
Arcabit Trojan.Fragtor.D2AC5C
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Woreflint.A!cl
Google Clean
AhnLab-V3 Clean
Acronis Clean
McAfee Artemis!FF8B52645B3E
MAX malware (ai score=82)
VBA32 BScope.TrojanDownloader.Zlob
Malwarebytes Spyware.PasswordStealer.Generic
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Win32.Trojan.FalseSign.Oqil
Yandex Clean
SentinelOne Clean
MaxSecure Clean
Fortinet Clean
BitDefenderTheta Gen:NN.ZexaF.36106.yvX@aalQcffO
AVG TrojanX-gen [Trj]
Avast TrojanX-gen [Trj]
CrowdStrike win/malicious_confidence_70% (W)
No IRMA results available.