Static | ZeroBOX

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
.text	0x00002000	0x0004c104	0x0004c200	5.14133038445
.rsrc	0x00050000	0x0000bfe8	0x0000c000	4.025828119
.reloc	0x0005c000	0x0000000c	0x00000200	0.0815394123432

Name	Offset	Size	Language	Sub-language	File type
RT_ICON	0x0005b48c	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	GLS_BINARY_LSB_FIRST
RT_ICON	0x0005b48c	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	GLS_BINARY_LSB_FIRST
RT_ICON	0x0005b48c	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	GLS_BINARY_LSB_FIRST
RT_ICON	0x0005b48c	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	GLS_BINARY_LSB_FIRST
RT_ICON	0x0005b48c	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	GLS_BINARY_LSB_FIRST
RT_ICON	0x0005b48c	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	GLS_BINARY_LSB_FIRST
RT_ICON	0x0005b48c	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	GLS_BINARY_LSB_FIRST
RT_ICON	0x0005b48c	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x0005b8f4	0x00000076	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_VERSION	0x0005b96c	0x00000490	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_MANIFEST	0x0005bdfc	0x000001ea	LANG_NEUTRAL	SUBLANG_NEUTRAL	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

!This program cannot be run in DOS mode.

`.rsrc

@.reloc

@Y@[e(

W@[^(

Z#333333

L@[9(

Z#333333

L@[9(>

Z#333333

G@[/(~

@^@[y(

I@[2(

Z#333333

H@[1(

Z#333333

Y@[g(

Z#333333

Z@[h(

Z#333333

@X@[a(

U@[T(

Z#333333

B@[$(

Z#333333

@Q@[E(

Z#333333

T@[P()

Z#333333

[@[n(E

@P@[A(G

Z#333333

L@[8(H

Z#333333

^@[{(N

Z#333333

]@[t(}

Z#333333

W@[_(

9rF>BP

9rF>;u

q,aWB"

q,aW;

Z#333333

X@[`(

Z#333333

W@[_(

Z#333333

@@[!(

Z#333333

Z@[j(

Z#333333

@]@[u(

lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

PADPADP

v4.0.30319

#Strings

<>9__20_10

<HookCallback>b__20_10

<>9__4_10

<Create>b__4_10

<>9__6_10

<ProcessCommand>b__6_10

<ProcessCommand>b__10

<Send>b__10

__StaticArrayInitTypeSize=20

<>9__6_20

<ProcessCommand>b__6_20

<HookCallback>b__20

<ProcessCommand>b__30

<>9__10_0

<StartService>b__10_0

<InstallTor>b__10_0

<>c__DisplayClass10_0

<>9__20_0

<HookCallback>b__20_0

<>c__DisplayClass20_0

<>9__0_0

<IsMatch>b__0_0

<ProcessUrls>b__0_0

<Recovery>b__0_0

<>c__DisplayClass0_0

<>9__11_0

<StopTorService>b__11_0

<>9__21_0

<__Active_Window_Process_Name__>b__21_0

<KeyboardLayout>b__21_0

<>c__DisplayClass21_0

<>c__DisplayClass1_0

<>9__12_0

<StartTorService>b__12_0

<>9__2_0

<SelfDestructInit>b__2_0

<>c__DisplayClass13_0

<>c__DisplayClass23_0

<>c__DisplayClass3_0

<>9__4_0

<Create>b__4_0

<Main>b__4_0

<get_ResourceManager>b__4_0

<EnumerateCredentials>b__4_0

<>c__DisplayClass4_0

<>9__5_0

<ProcessCommands>b__5_0

<Decrypt>b__5_0

<>c__DisplayClass5_0

<>9__6_0

<ProcessCommand>b__6_0

<ReadFileBytes>b__6_0

<>c__DisplayClass6_0

<>9__17_0

<_xfa1PgEsqd2XQ>b__17_0

<Start>b__17_0

<>c__DisplayClass17_0

<>9__7_0

<set_Culture>b__7_0

<SearchFiles>b__7_0

<>c__DisplayClass7_0

<>c__DisplayClass18_0

<>9__8_0

<sad>b__8_0

<StartServer>b__8_0

<>c__DisplayClass8_0

<>9__19_0

<_JfwKTyXd3Hefz>b__19_0

<>9__9_0

<WaitForOnion>b__9_0

<IPAddress>b__9_0

<DownloadBundle>b__0

<DiskSize>b__0

<ProcessUrl>b__0

<InstallStartup>b__0

<LoadCommands>b__0

<Compress>b__0

<_Fjcs3Gvz8DJYt>b__0

<PerformSelfDestruct>b__0

<>9__20_11

<HookCallback>b__20_11

<>9__6_11

<ProcessCommand>b__6_11

<Send>b__11

<Create>b__11

<Main>b__11

<>9__6_21

<ProcessCommand>b__6_21

<HookCallback>b__21

<ProcessCommand>b__31

<>9__10_1

<StartService>b__10_1

<ScreenResolution>b__10_1

<InstallTor>b__10_1

<>c__DisplayClass10_1

<>9__20_1

<HookCallback>b__20_1

<>c__DisplayClass20_1

<>9__0_1

<IsMatch>b__0_1

<Recovery>b__0_1

<>9__11_1

<StopTorService>b__11_1

<>9__21_1

<__Active_Window_Process_Name__>b__21_1

<>c__DisplayClass21_1

<>9__12_1

<StartTorService>b__12_1

<>9__2_1

<SelfDestructInit>b__2_1

<>9__23_1

<_86mnTNfLUZcya>b__23_1

<>c__DisplayClass23_1

<>9__3_1

<InstallStartup>b__3_1

<>c__DisplayClass3_1

<>9__14_1

<RAMAmount>b__14_1

<>9__4_1

<Create>b__4_1

<get_ResourceManager>b__4_1

<LoadCommands>b__4_1

<EnumerateCredentials>b__4_1

<>c__DisplayClass4_1

<>9__5_1

<ProcessCommands>b__5_1

<>9__6_1

<ProcessCommand>b__6_1

<ReadFileBytes>b__6_1

<>c__DisplayClass6_1

<>9__17_1

<_xfa1PgEsqd2XQ>b__17_1

<>9__7_1

<DownloadBundle>b__7_1

<SearchFiles>b__7_1

<>c__DisplayClass7_1

<>9__8_1

<sad>b__8_1

<set_Culture>b__1

<ProcessUrls>b__1

<Decrypt>b__1

<ProcessRequest>b__1

IEnumerable`1

List`1

<>9__20_12

<HookCallback>b__20_12

<>9__6_12

<ProcessCommand>b__6_12

<Send>b__12

<Main>b__12

<>9__6_22

<ProcessCommand>b__6_22

<ProcessCommand>b__22

<HookCallback>b__22

Microsoft.Win32

user32

ReadInt32

ToInt32

dsZu72

ASDHJKASBHJASD2

<>9__10_2

<ScreenResolution>b__10_2

<>c__DisplayClass10_2

<>9__20_2

<HookCallback>b__20_2

<>c__DisplayClass20_2

<>9__0_2

<Recovery>b__0_2

<>9__11_2

<StopTorService>b__11_2

<>9__21_2

<__Active_Window_Process_Name__>b__21_2

<KeyboardLayout>b__21_2

<>9__1_2

<ProcessUrl>b__1_2

<>9__12_2

<StartTorService>b__12_2

<>c__DisplayClass23_2

<>9__3_2

<Send>b__3_2

<InstallStartup>b__3_2

<>c__DisplayClass3_2

<>9__14_2

<RAMAmount>b__14_2

<>9__4_2

<Main>b__4_2

<LoadCommands>b__4_2

<>c__DisplayClass4_2

<>c__DisplayClass6_2

<>9__7_2

<ProcessRequest>b__7_2

<>c__DisplayClass7_2

<>9__18_2

<Stop>b__18_2

<_xfa1PgEsqd2XQ>b__2

<SearchFiles>b__2

<Start>b__2

Dictionary`2

hj1vt2

<>9__6_13

<ProcessCommand>b__6_13

<ProcessCommand>b__13

<Main>b__13

<>9__6_23

<ProcessCommand>b__6_23

<ProcessCommand>b__23

<HookCallback>b__23

get__ptZnAGCgeAYF3

set__ptZnAGCgeAYF3

<>9__10_3

<ScreenResolution>b__10_3

<InstallTor>b__10_3

<>c__DisplayClass10_3

<>9__20_3

<HookCallback>b__20_3

<>c__DisplayClass20_3

<>9__21_3

<__Active_Window_Process_Name__>b__21_3

<KeyboardLayout>b__21_3

<>9__1_3

<ProcessUrl>b__1_3

<>9__2_3

<SelfDestructInit>b__2_3

<>9__23_3

<_86mnTNfLUZcya>b__23_3

<>c__DisplayClass23_3

<>c__DisplayClass3_3

<>9__4_3

<Create>b__4_3

<Main>b__4_3

<>c__DisplayClass4_3

<>c__DisplayClass6_3

<>9__7_3

<ProcessRequest>b__7_3

<>c__DisplayClass7_3

<>9__18_3

<Stop>b__18_3

<>9__8_3

<sad>b__8_3

<ProcessCommand>b__3

<Send>b__3

<StartService>b__3

<LoadCommands>b__3

<EnumerateCredentials>b__3

<>9__20_14

<HookCallback>b__20_14

<>9__3_14

<Send>b__3_14

<>9__6_14

<ProcessCommand>b__6_14

<ProcessCommand>b__24

set_ContentLength64

<>c__DisplayClass20_4

<>9__2_4

<SelfDestructInit>b__2_4

<>9__23_4

<_86mnTNfLUZcya>b__23_4

<>9__3_4

<Send>b__3_4

<>c__DisplayClass3_4

<>9__4_4

<Create>b__4_4

<Main>b__4_4

<>c__DisplayClass4_4

<>c__DisplayClass6_4

<>9__7_4

<SearchFiles>b__7_4

<>9__18_4

<Stop>b__18_4

<sad>b__4

<ProcessCommand>b__4

<StartService>b__4

<ScreenResolution>b__4

<InstallStartup>b__4

<InstallTor>b__4

<EnumerateCredentials>b__4

<ProcessRequest>b__4

<KeyboardLayout>b__4

<>9__20_15

<HookCallback>b__20_15

<>9__6_15

<ProcessCommand>b__6_15

<Send>b__15

<>9__6_25

<ProcessCommand>b__6_25

<>9__20_5

<HookCallback>b__20_5

<>c__DisplayClass20_5

<>9__4_5

<Create>b__4_5

<>9__6_5

<ProcessCommand>b__6_5

<>c__DisplayClass6_5

<_86mnTNfLUZcya>b__5

<ProcessCommand>b__5

<StartService>b__5

<Main>b__5

<InstallStartup>b__5

<ProcessRequest>b__5

<KeyboardLayout>b__5

<>9__20_16

<HookCallback>b__20_16

<>9__6_26

<ProcessCommand>b__6_26

<>9__3_6

<Send>b__3_6

<InstallStartup>b__3_6

<>c__DisplayClass6_6

<_86mnTNfLUZcya>b__6

<ProcessCommand>b__6

<StartService>b__6

<Create>b__6

<HookCallback>b__6

<Main>b__6

<ProcessRequest>b__6

ujmMe6

<>9__6_17

<ProcessCommand>b__6_17

get__aCtY3jcyR9C37

set__aCtY3jcyR9C37

<>9__3_7

<Send>b__3_7

<>9__4_7

<Main>b__4_7

<>c__DisplayClass6_7

<>9__7_7

<ProcessRequest>b__7_7

<_86mnTNfLUZcya>b__7

<HookCallback>b__7

<ProcessCommand>b__18

<>9__6_28

<ProcessCommand>b__6_28

get__Q9JpwCgxXE598

set__Q9JpwCgxXE598

get_UTF8

yOjpY8

<>9__20_8

<HookCallback>b__20_8

<>9__3_8

<Send>b__3_8

<>9__4_8

<Main>b__4_8

<>9__6_8

<ProcessCommand>b__6_8

<>c__DisplayClass6_8

<_86mnTNfLUZcya>b__8

<Create>b__8

<>9__6_19

<ProcessCommand>b__6_19

<ProcessCommand>b__19

<>9__3_9

<Send>b__3_9

<>9__4_9

<Main>b__4_9

<>9__6_9

<ProcessCommand>b__6_9

<Create>b__9

qqWWr9

wCzyr9

capCreateCaptureWindowA

lje_5B

ySBaqB

ez9SnE

b9xO9F

oG7whG

g8kHaH

get_ASCII

fZ7QtI

get__5hkTJx5cnuG8K

set__5hkTJx5cnuG8K

y015FK

rPUjFK

zhuPjK

_vpm4jFKvnyMGM

xDOx_M

qicUeM

get__OsJTR2NHwS2AO

set__OsJTR2NHwS2AO

System.IO

_S0P3vCPTPuJNO

get__NBiXtBYABBNzO

set__NBiXtBYABBNzO

ze1OKP

get__eyZNwa9Cr2ULP

set__eyZNwa9Cr2ULP

get__b4VXHvlOteMNQ

set__b4VXHvlOteMNQ

e5U3cQ

nwAQAR

get__eHMQrIAH8iyiS

set__eHMQrIAH8iyiS

_CJKvembBmEyuS

ffsK1T

pkVGET

dFl3bT

kS1jFV

_owW6APENbp9SV

nbnCoV

tYvbCW

jDi0NW

g2oXoX

zmgEzX

bXfB6Y

a87rFY

get__EbmEboCsiCCMY

set__EbmEboCsiCCMY

hnIKPY

p550qZ

_y6Bhr2CNVdmuZ

wfVru_

leqRQa

get_Data

cbData

pbData

DownloadData

UploadData

CryptUnprotectData

GetData

_icwahAjD8WKva

s8pKza

uWIcXb

hVt4Zb

mscorlib

zNpujb

DataBlob

dbhCLc

System.Collections.Generic

LowLevelKeyboardProc

dwThreadId

GetWindowThreadProcessId

GetProcessById

idThread

add_DomainUnload

e_NDdd

add_ErrorDataReceived

add_OutputDataReceived

pReserved

Synchronized

get__QJvIqlIRLKogd

set__QJvIqlIRLKogd

ReadToEnd

Append

get_HttpMethod

method

get__QMqx1aAUtErod

set__QMqx1aAUtErod

Clipboard

Replace

get_beaconService

set_beaconService

wScanCode

get_ExitCode

keyCode

CompressionMode

FromImage

get_Message

SendMessage

AddRange

EndInvoke

BeginInvoke

IDisposable

ToDouble

RuntimeFieldHandle

GetModuleHandle

RuntimeTypeHandle

GetTypeFromHandle

Rectangle

DownloadFile

IsInRole

WindowsBuiltInRole

Console

get_MainModule

ProcessModule

dwStyle

set_WindowStyle

ProcessWindowStyle

get_Name

get_FileName

set_FileName

GetTempFileName

GetFileName

get_ModuleName

lpModuleName

get_MachineName

get_FullName

get_UserName

get_ProcessName

lpszWindowName

DateTime

get_LastWriteTime

get_CreationTime

BeginErrorReadLine

BeginOutputReadLine

AppendLine

WriteLine

get_NewLine

Combine

Escape

ValueType

SecurityProtocolType

uMapType

get_Culture

set_Culture

Capture

ReadOnlyCollectionBase

ApplicationSettingsBase

get_Response

HttpListenerResponse

response

Dispose

TryParse

MulticastDelegate

GetKeyboardState

DebuggerBrowsableState

EditorBrowsableState

SetApartmentState

lpKeyState

GetKeyState

Delete

STAThreadAttribute

CompilerGeneratedAttribute

GuidAttribute

GeneratedCodeAttribute

DebuggerNonUserCodeAttribute

DebuggableAttribute

DebuggerBrowsableAttribute

EditorBrowsableAttribute

ComVisibleAttribute

AssemblyTitleAttribute

XmlTypeAttribute

XmlAttributeAttribute

AssemblyTrademarkAttribute

TargetFrameworkAttribute

XmlEnumAttribute

AssemblyFileVersionAttribute

AssemblyConfigurationAttribute

AssemblyDescriptionAttribute

CompilationRelaxationsAttribute

AssemblyProductAttribute

AssemblyCopyrightAttribute

XmlRootAttribute

XmlArrayAttribute

AssemblyCompanyAttribute

RuntimeCompatibilityAttribute

set_UseShellExecute

ToByte

get_Value

GetValue

Remove

get_Size

cbSize

Serialize

Deserialize

wF5w2f

oRzv8f

SizeOf

uU2aRf

cchBuff

pwszBuff

Isalzgityljuukxuegsqpf

sfDlIg

get_Jpeg

get_Png

System.Threading

Encoding

System.Drawing.Imaging

Ceiling

get_IsListening

System.Runtime.Versioning

FromBase64String

ToBase64String

DownloadString

FromXmlString

ToString

GetString

System.Drawing

IsMatch

thsjrh

get_LocalPath

GetTempPath

GetFolderPath

get_Width

nWidth

get_Length

GetWindowTextLength

EndsWith

StartsWith

ykwl4i

vo7zBi

vmcrYj

AsyncCallback

callback

idHook

kutExk

AllocHGlobal

FreeHGlobal

Marshal

System.Security.Principal

WindowsPrincipal

System.ComponentModel

tjOhgl

kernel32.dll

avicap32.dll

user32.dll

crypt32.dll

System.Xml

set_SecurityProtocol

_5sdb22PFuWvpl

GZipStream

get_InputStream

get_OutputStream

MemoryStream

lParam

wParam

get_Item

set_Item

OperatingSystem

AsymmetricAlgorithm

j5gAnm

Random

TimeSpan

CopyFromScreen

AppDomain

get_CurrentDomain

GetFileNameWithoutExtension

get_OSVersion

System.IO.Compression

Application

get_Location

System.Configuration

System.Globalization

System.Xml.Serialization

op_Subtraction

System.Reflection

ProcessModuleCollection

MatchCollection

GroupCollection

ManagementObjectCollection

HttpListenerPrefixCollection

KeyCollection

op_Addition

IOException

WebException

pszDescription

CopyTo

FileInfo

CultureInfo

FileSystemInfo

set_StartInfo

ProcessStartInfo

DirectoryInfo

Bitmap

j5pUbp

hwndApp

qQmEyp

get__3dkUvMzCwfo1q

set__3dkUvMzCwfo1q

ToChar

StringReader

StreamReader

TextReader

RSACryptoServiceProvider

RNGCryptoServiceProvider

StringBuilder

SpecialFolder

IEEERemainder

Buffer

get_ResourceManager

ServicePointManager

ManagementObjectSearcher

DataReceivedEventHandler

System.CodeDom.Compiler

HttpListener

ToUpper

CurrentUser

StringWriter

TextWriter

ToLower

XmlSerializer

set_RedirectStandardError

IEnumerator

ManagementObjectEnumerator

GetEnumerator

RandomNumberGenerator

.cctor

IntPtr

eXzMWs

Graphics

System.Diagnostics

get_TotalSeconds

GetBounds

System.Runtime.InteropServices

System.Runtime.CompilerServices

System.Resources

_gfcOKHoWIeNFe.Properties.Resources.resources

DebuggingModes

Matches

GetDirectories

ExpandEnvironmentVariables

GetFiles

get_Modules

GetSubKeyNames

GetProcesses

ReadAllBytes

WriteAllBytes

GetBytes

NextBytes

get_Prefixes

dwPromptFlags

dwFlags

DataReceivedEventArgs

System.Windows.Forms

Contains

System.Text.RegularExpressions

System.Collections

RegexOptions

get_Groups

get_Chars

RuntimeHelpers

get_Success

GetCurrentProcess

DataFormats

set_Arguments

get_Exists

get_Keys

get__NCxMRlZZDCW0t

set__NCxMRlZZDCW0t

Concat

AppendFormat

ImageFormat

Subtract

IDataObject

GetDataObject

ManagementBaseObject

ManagementObject

object

Collect

CryptprotectPromptstruct

System.Net

get_Height

nHeight

op_Explicit

WaitForExit

add_ProcessExit

get_Default

IAsyncResult

result

WebClient

System.Management

Environment

hwndParent

get_Current

GetCurrent

get_Count

GetPathRoot

pPrompt

szPrompt

Encrypt

ThreadStart

Convert

get_Request

HttpListenerRequest

GetKeyboardLayout

set_RedirectStandardOutput

MoveNext

System.Text

ReadAllText

WriteAllText

pPlainText

pCipherText

GetWindowText

HttpListenerContext

GetContext

z1gR2w

get_Now

get_UtcNow

GetForegroundWindow

set_CreateNoWindow

ToUnicodeEx

UnhookWindowsHookEx

SetWindowsHookEx

CallNextHookEx

InitializeArray

ToArray

ToCharArray

OpenSubKey

MapVirtualKey

ContainsKey

wVirtKey

RegistryKey

System.Security.Cryptography

get_Assembly

GetExecutingAssembly

GetEntryAssembly

set_IsReadOnly

BlockCopy

pEntropy

CreateDirectory

get_SystemDirectory

GetCurrentDirectory

SetCurrentDirectory

Registry

get_Capacity

op_Equality

op_Inequality

WindowsIdentity

IsNullOrEmpty

jfrZgz

WrapNonExceptionThrows

ASDDAS

sdfsdfsdf

23weraweaw

asdfdadwa4

waeawdasda

$6560fc7d-6c30-43f2-80af-1037266931c2

231.121.62.374

.NETFramework,Version=v4.7.2

FrameworkDisplayName

.NET Framework 4.7.2

3System.Resources.Tools.StronglyTypedResourceBuilder

17.0.0.0

KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator

17.5.0.0

command

Commands

commands

filename

filedata

filesize

createdDate

modifiedDate

information

report

_CorExeMain

mscoree.dll

oecyxd

Q6}H`{{d

2V~.Ih

4P&py

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

</requestedPrivileges>

</security>

</trustInfo>

</assembly>PAPADDINGXXPADDINGPADDINGX

#"$"%"&"'"(")"*"+"-,.,/,0,1,2,3,4,5,6,8797:7;7<7=7>7?7@7BADCECFCGCIHJHKHLHMHNHOHPHQHRHSHUTVTWTYXZX[X\X]X^X_X`XaXbXcXdXeXfXgXhXiXjXlkmknkokqp

H^pU\YHcCL

LYZrK\FXkTLNNe!)$Hj#LG;eJ=HG

WV|yAF

H6&Mz.

9rGj1

BG7B:+

q}6Tz*b

http://google.com/c7FEhnp6ri?q=85

http://google.com/h3Ho95MNj1?q=2

http://blockchain.com/FZMmAPTus9?q=47

http://blockchain.com/1Zh1oOj1W0?q=128

http://eset.com/ESM18wzxCV?q=90

_hIcKzPHipWC9s

_60a3NUkW1tJeW

_jfKcQqjGmqnE7

_zqh5LZqMYXsXJ

@^iYGT@uVZOAhPDLK~TDJ^

SyI0T6|

%IA+99

+zGOT5\

4FG,lD1;(b4

o($.3x>

Q@';T4e

0^Zc(4;W

/:/[20C

8!5o /4VG

\t 7.^

_s`mL_pkmNS

4!/)/"

EpXg`Cw]mg

http://youtube.com/e7e8n7k60x?q=201

http://blockchain.com/KEpLvNM1UD?q=2

9.<WMTC

http://google.com/3N5J2dNxpf?q=0

http://github.com/8UWnmSMzHl?q=1

_xsV5VGfoivVaT

-G&XE.a

)2- Q*

http://youtube.com/MmPyLjXbxn?q=1

http://google.com/kGUPZUmfoJ?q=1

http://github.com/d9mKjn2A5m?q=1

http://pornhub.com/Dhys0Bvcub?q=0

http://youtube.com/jtmnrWG151?q=126

http://google.com/cYlQbInuYb?q=94

_kekylTmo17uHP

_5jgi920MOjP4J

_1N7A0SFAKrEZp

_qkqwwYdWIC8fY

_ONoPpyEeM8xFe

http://youtube.com/EjdfXsH1U2?q=0

http://telegram.org/bCIIY4ZhC6?q=47

http://blockchain.com/iPBJ9DboIj?q=77

_CRz1JAsPKAoOh

&86ueN-p@d4&4

<@P=D?fv

6 '9k5

?+-R6S

OD$9L1

%EU^h&csaiB

;,Q"3 =MdVip

http://eset.com/wLIdPRS656?q=2

http://google.com/IJlaLnnFF9?q=2

http://blockchain.com/5RjGBbUfuX?q=0

http://pornhub.com/Wmu0WG6fWG?q=2

http://telegram.org/92JeI90x2b?q=1

http://blockchain.com/VUvdAA38uG?q=0

http://eset.com/8tnVyW0oZ2?q=2

http://github.com/488xx7xICU?q=113

http://blockchain.com/6ctRDB82FH?q=0

http://github.com/tUK9KKWdjQ?q=0

http://telegram.org/BrxsDk4645?q=2

http://pornhub.com/dJNhmbeRih?q=192

http://telegram.org/WxDcnf37Pa?q=0

http://youtube.com/zrQsBzBJ3S?q=25

http://eset.com/vEDOsbs7NI?q=91

http://openai.com/4JNNMwWJ7r?q=1

http://github.com/cYqmaQyWMT?q=193

http://pornhub.com/ttZuuWfCkT?q=0

http://google.com/GvQcOhAbIB?q=67

http://eset.com/rlK1t5Hlqg?q=129

_uFT4J3sUNAw8N

_k5kc4CeEspUqP

_JjYEsSf6nqvti

_enQGyimfSTrgu

_EWU4WKbCM48R8

_QMnwA6K6dfmxD

_3EZtLwI6twZOn

_Kx86AC6FcJFgK

i.8?.hJJ

b<-5]/

KX#!:4

p7f1"qS

?3/*f,

Z3]"}p

]/Q<[L=_K

^JL;MDJ

C4_RA[oE

(<[KC9?

M'R=[H

'9M[L`

=(]^U&|

5<HNF("

*~ZV52Uv* yPc

$6nu #

http://google.com/9xOzIhxe1h?q=147

http://pornhub.com/y3zseiW5ct?q=168

http://google.com/rG9TQx4OXx?q=0

http://pornhub.com/YfPizJlNeg?q=193

http://telegram.org/wBz3OJ7tv2?q=169

http://blockchain.com/r1nR2ylCiW?q=2

http://openai.com/tDz4VtyO7L?q=23

http://github.com/aM9CGCFgpE?q=63

http://google.com/bqfjjiys0h?q=1

http://eset.com/9fDr7qGsl4?q=201

http://google.com/jM1R68MyUv?q=102

http://github.com/n5wYaIF1rc?q=0

http://openai.com/TkfQCgYF5x?q=1

_eYtoSmnJ2tsYo

_7tP14nMjNzS2D

_vSpQCG7cyvkFE

_Sru4HT0zgohVP

_6L1x2mwklnP6d

_1yTDfMVARtvCR

_kMk5psfGIe8cR

_Q8eGilnPOV9YW

_lA7mi1NuC2uFP

!8:WS+

5&x]](&o

kM*\2u>

1zso&6-$_30'5B3%$B

42')23WAL758&L&

W<$452K(

2!,OkW$*

+,x"%,I

G *&yG1

F/!q5#XAd)6;

AX&fG669w

*:&4">-2

#CZ^w e|avD

%Wh|Q8

http://blockchain.com/pSkEqSYsKy?q=45

http://github.com/47A2pRyQZx?q=20

http://youtube.com/Cgb4YRPhlb?q=0

http://blockchain.com/YQmBf0iFNg?q=0

http://youtube.com/svD55hjSif?q=1

http://youtube.com/E0O9M55Ngq?q=128

http://openai.com/FfYyZTazjy?q=212

http://youtube.com/ModYoQR0JX?q=155

http://google.com/qsurvG1BXJ?q=128

http://telegram.org/kCrDSiLLZN?q=148

http://blockchain.com/SxFjQyS7Ib?q=196

http://telegram.org/XVYweGYdWF?q=218

http://eset.com/oJmwB8xgYA?q=2

http://openai.com/WfamtY1oBU?q=1

http://youtube.com/ggJ8tnd1IY?q=0

http://openai.com/9w0qGFc0ym?q=0

_Isd71O51k2HJD

_azQ8ZHAtZ1yvQ

_3lhMbuceadvKk

_FLxTWZalCCsIc

_4uGprZftJKyYB

_SqSd9MqD4Z19Y

_dwB5ig58WNMYD

_Msg21LlwNQGyk

W(H=;q

http://github.com/vXtLOcGegO?q=57

http://eset.com/G9vKeJ0EdH?q=52

http://blockchain.com/FMMhRabYo6?q=6

8nesS'

tRUdguW

|^%gfuVP

7vq8!%.

o5K!A"B

q"jY|

p"W=0'

9~$`B:R

r<S:7

?|tvS?

http://openai.com/aLkxuMhFAu?q=2

http://google.com/m2GeVre0IF?q=0

http://eset.com/wM6ZezOi58?q=2

_f3hX16tFJiYnL

_9Fr6Rsd3npbry

_NootdfU3Z9gw5

x=.PEw

m6=t#lRO

R1& 6SUT

J8+I:{7

6G?E

TT5TcP2

5=..H6

"9cbz_

$f=syY^Z!I

"@4_p!f

+">J4A

'k/.39*sZ

h);f-U_!

EJNrbHUrI9

http://openai.com/IgLyAUqjzp?q=76

http://github.com/hUTaET2sxD?q=2

http://github.com/ecJPfGvZpc?q=91

http://youtube.com/FHXp0api6l?q=55

http://github.com/4wKOPr8dni?q=50

http://google.com/JK2VpYSDGJ?q=2

http://github.com/N9weaLexAA?q=1

http://openai.com/sgVblqQVRy?q=160

http://openai.com/FpsNaie6ew?q=1

http://github.com/vmAyC1HC0z?q=0

http://youtube.com/K2rHjYNaX1?q=1

http://google.com/gBdp63IQhH?q=1

http://youtube.com/xW1aZDz8JQ?q=152

http://openai.com/9Px1YkKwzE?q=172

http://telegram.org/K1yLOXtOpS?q=90

http://eset.com/McJFW0dXbq?q=36

http://pornhub.com/px8uRmIxNU?q=182

http://pornhub.com/MPaGVWun0s?q=130

_sw0u5oeNPMe0A

_H5Id9PYH9I4Vu

_n53gwIdkT4IY1

_dLWNYULHdib6k

_kADqEQ9FKrdVp

_zGdVZPqxWvAUD

_6xnxcZFPFHR3U

_dcAnnBUAAVCo5

_Y8SiAql65JU25

ZB05<eCTG

H6)*!IR[

$p"2[/e

-!9q[v

\+Z 6K

"zFu(XE

http://telegram.org/KlERNCYDsX?q=0

http://google.com/yYjosyZzsX?q=96

http://telegram.org/tXKldtP9mS?q=1

cYdpQcOUnT

_tL1xdiBLKQlFx

\X&f-cYB

6?0v(,

:;G4|2.Z0&4

31&<x0

#t;u81^

Z4:p$Z(Z

P5P 1%

>A<3l=g

Sq6;QW=--

$l4?S$K

+e<6~O

D1%),EUW

2+l7H21*1

&e?,H21$3Hoke

Jk1t2w;@v

V;U,9]

y;[\d

r] &*a

7rQ1P 'V,

vl,;Vmf

c/$p%bKV

2/I#a?=w?\

YCB;/

a,g1'`H

http://youtube.com/1rjBkFlcML?q=1

http://telegram.org/Q5xkLJTW4K?q=0

http://blockchain.com/kZpNGacEcN?q=0

http://youtube.com/G0hTFC7hmJ?q=95

http://blockchain.com/lzshMYihuG?q=1

http://blockchain.com/5cPaWby5Pd?q=119

http://google.com/Ycjg08MUxR?q=74

http://youtube.com/79aXDaOfEP?q=67

http://openai.com/4pBJUk9E59?q=0

http://openai.com/2KYjhzeLmC?q=152

http://telegram.org/YQhU0BLqVh?q=2

http://youtube.com/tiIHu1kOak?q=48

http://openai.com/HK28VzTyDI?q=197

http://google.com/6MT6Si5xE8?q=1

http://eset.com/5ApX9IY8Cs?q=62

http://github.com/vhliQ8CuAB?q=125

http://pornhub.com/ughFeLfQ4s?q=160

http://github.com/MBoX4pDZNZ?q=224

http://blockchain.com/yVw8benS6U?q=1

_RD2qVNhdvrClg

_5hZgI0ASisiRK

_avc3TSoMpL22s

_xhRQMFtoqw9i8

_uf7TJhbmRbhM4

_AbT7z36rlwghB

_rWdcs0yl4BBhC

_3C1pNHiECrNep

_2k9Cn9N2DAh80

_4iSDxaoIcDMsi

_jTXhQKP9QHbdU

_snoj43ZB6SQiQ

_IIvCcV8LTIrIE

_wrY9Ay2gJe7HJ

_wvPjAgIOOkNM1

_4ghuV1ESsozEu

>-<>[

yILr&b

d)WSMx

[R40$dSPB

C*h)(*+2

"!_#,Q

0XU`

http://openai.com/FAShCfmLEb?q=17

http://eset.com/m5YVw1c3yb?q=0

http://pornhub.com/0drgq4AUrK?q=1

http://telegram.org/cVQdaIInKC?q=1

http://eset.com/qQIl4yoNlB?q=162

http://google.com/ga6kESvgK8?q=14

http://telegram.org/fzvcSsUMWF?q=49

http://google.com/VyJk6nl09K?q=2

http://openai.com/HMKI6LGp0u?q=1

http://telegram.org/nrfQN9QqTW?q=176

http://youtube.com/gPPgSw15gD?q=76

http://google.com/5IGEGcqvt3?q=2

http://openai.com/eEpcOFC06j?q=227

_2aFVuc1w6S9D9

_hLR9jn8TfZH73

_v8lzst8ZpZ1ek

Unknown

9375CFF0413111d3B88A00104B2A6676

VS_VERSION_INFO

VarFileInfo

Translation

StringFileInfo

000004b0

Comments

k1961efa55dde155c88edb2d4ad5c4ff9a489

CompanyName

R854c293dc98b3835b1bb

FileDescription

db4dc0bd4ee7adbd050c9

FileVersion

34.2.28.9

InternalName

z914201cbd6483b44d2d0eb50.exe

LegalCopyright

C9d104c3a10813a9b1bf7c5a285

LegalTrademarks

fd2c69aa38881ce7ae53c21eb792170

OriginalFilename

Xb3f446e5a5b22ad9b82040e31ee64666c2.exe

ProductName

e06df41cbdadfacca8ef405f5d6e1d3a118

ProductVersion

3.84.33.70

Assembly Version

33.84.55.38

Antivirus	Signature
Bkav	Clean
Lionic	Clean
tehtris	Clean
DrWeb	Clean
MicroWorld-eScan	Gen:Trojan.Mardom.ON.24
CMC	Clean
CAT-QuickHeal	Clean
ALYac	Gen:Trojan.Mardom.ON.24
Malwarebytes	Clean
VIPRE	Gen:Trojan.Mardom.ON.24
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Clean
Alibaba	Clean
K7GW	Spyware ( 005a49ea1 )
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZemsilF.36164.wm0@aithZCb
VirIT	Trojan.Win32.MSIL_Heur.B
Cyren	Clean
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Spy.WhiteSnake.D
APEX	Malicious
Paloalto	generic.ml
ClamAV	Clean
Kaspersky	HEUR:Trojan-PSW.MSIL.Stealer.gen
BitDefender	Gen:Trojan.Mardom.ON.24
NANO-Antivirus	Clean
SUPERAntiSpyware	Clean
Tencent	Msil.Trojan-QQPass.QQRob.Psmw
Sophos	Mal/Generic-S
F-Secure	Heuristic.HEUR/AGEN.1307381
Baidu	Clean
Zillya	Clean
TrendMicro	Trojan.Win32.SMOKELOADER.YXDEAZ
McAfee-GW-Edition	Artemis!Trojan
Trapmine	Clean
FireEye	Generic.mg.3121ecc67e64fdf6
Emsisoft	Gen:Trojan.Mardom.ON.24 (B)
SentinelOne	Static AI - Malicious PE
Jiangmin	Clean
Webroot	W32.Malware.Gen
Google	Detected
Avira	HEUR/AGEN.1307381
MAX	malware (ai score=82)
Antiy-AVL	Trojan[PSW]/MSIL.Stealer
Microsoft	Trojan:MSIL/Vigorf.A
Gridinsoft	Ransom.Win32.Sabsik.sa
Xcitium	Clean
Arcabit	Trojan.Mardom.ON.24
ViRobot	Clean
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Stealer.gen
GData	Gen:Trojan.Mardom.ON.24
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Mardom.C5420930
Acronis	suspicious
McAfee	Artemis!3121ECC67E64
TACHYON	Clean
DeepInstinct	MALICIOUS
VBA32	Clean
Cylance	unsafe
Panda	Trj/Chgt.AD
Zoner	Clean
TrendMicro-HouseCall	Trojan.Win32.SMOKELOADER.YXDEAZ
Rising	Stealer.WhiteSnake!1.E53A (CLASSIC)
Yandex	Clean
Ikarus	Win32.Outbreak
MaxSecure	Clean
Fortinet	Clean
AVG	Win32:SpywareX-gen [Trj]
Cybereason	Clean
Avast	Win32:SpywareX-gen [Trj]

Static Analysis

PE Compile Time

PE Imphash

Sections

Resources

Imports