Static | ZeroBOX

PE Compile Time

2023-05-20 11:42:18

PE Imphash

9f8af27f520ea359d999bd8cba16dec6

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000df9c 0x0000e000 6.6918235761
.rdata 0x0000f000 0x0056ec80 0x0056f000 7.9546966932
.data 0x0057e000 0x0007a7a0 0x00079000 3.88603246734
.rsrc 0x005f9000 0x00000258 0x00001000 3.65047152905

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x005f9058 0x00000200 LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with very long lines, with CRLF line terminators

Imports

Library KERNEL32.dll:
0x40f03c CreateProcessA
0x40f040 MultiByteToWideChar
0x40f044 GetProcAddress
0x40f048 LoadLibraryA
0x40f04c GetModuleFileNameA
0x40f050 WinExec
0x40f054 CloseHandle
0x40f058 WideCharToMultiByte
0x40f05c WriteFile
0x40f060 GetSystemTime
0x40f064 ReadFile
0x40f068 FlushFileBuffers
0x40f06c GetFileTime
0x40f070 GetLastError
0x40f078 CreateFileA
0x40f07c GetTempPathA
0x40f080 Sleep
0x40f084 CreateMutexA
0x40f088 ExitProcess
0x40f08c GetLocaleInfoA
0x40f090 GetStringTypeW
0x40f094 GetStringTypeA
0x40f098 LCMapStringW
0x40f09c LCMapStringA
0x40f0a0 WriteConsoleW
0x40f0a4 GetConsoleOutputCP
0x40f0a8 WriteConsoleA
0x40f0ac SetStdHandle
0x40f0b4 HeapFree
0x40f0b8 HeapAlloc
0x40f0bc TerminateProcess
0x40f0c0 GetCurrentProcess
0x40f0cc IsDebuggerPresent
0x40f0d0 GetCommandLineA
0x40f0d4 GetVersionExA
0x40f0d8 GetProcessHeap
0x40f0dc GetStartupInfoA
0x40f0e0 RaiseException
0x40f0e4 RtlUnwind
0x40f0e8 HeapDestroy
0x40f0ec HeapCreate
0x40f0f0 VirtualFree
0x40f100 VirtualAlloc
0x40f104 HeapReAlloc
0x40f108 GetModuleHandleA
0x40f10c GetStdHandle
0x40f110 TlsGetValue
0x40f114 TlsAlloc
0x40f118 TlsSetValue
0x40f11c TlsFree
0x40f124 SetLastError
0x40f128 GetCurrentThreadId
0x40f140 SetHandleCount
0x40f144 GetFileType
0x40f14c GetTickCount
0x40f150 GetCurrentProcessId
0x40f158 HeapSize
0x40f15c SetFilePointer
0x40f160 GetConsoleCP
0x40f164 GetConsoleMode
0x40f168 GetCPInfo
0x40f16c GetACP
0x40f170 GetOEMCP
Library ADVAPI32.dll:
0x40f000 RegCloseKey
0x40f004 RegOpenKeyExA
0x40f008 RegQueryValueExA
0x40f014 RegCreateKeyExA
Library SHELL32.dll:
Library SHLWAPI.dll:
0x40f180 PathFileExistsA
Library CRYPT32.dll:
0x40f020 CertOpenStore
0x40f02c CertCloseStore
Library WINHTTP.dll:
0x40f188 WinHttpQueryHeaders
0x40f18c WinHttpCloseHandle
0x40f190 WinHttpConnect
0x40f198 WinHttpOpenRequest
0x40f19c WinHttpSetTimeouts
0x40f1a4 WinHttpQueryOption
0x40f1a8 WinHttpOpen
0x40f1b0 WinHttpSetOption
0x40f1b4 WinHttpReadData
0x40f1b8 WinHttpSendRequest

!This program cannot be run in DOS mode.
5RichL
`.rdata
@.data
D$ PUUUhH
L$ QVUUhH
|$$QVW
D$DvT2
XVWjD3
XVWj@3
D$@PjXU
T$$RjW
D$$PjW
L$$QRUW
0WWWWW
0SSSSS
0WWWWW
0SSSSS
0WWWWW
BBFFf;
QQSVWd
HHt@HHt
2If90t
YYuTVWh
tehTy@
jF<-uH
>=Yt/j
t#SSUP
t$$VSS
_^][YY
j(j ^V
HtHu4j
s[S;7|G;w
tR99u2
YYu-9D$
0A@@Ju
t^9(uZ
tD9(u@
^SSSSS
j"^SSSSS
URPQQh4
tm95hu
0SSSSS
;t$,v-
UQPXY]Y[
uL9=ts
PPPPPPPP
PPPPPPPP
t+WWVPV
string too long
invalid string position
Unknown exception
(null)
`h````
xpxxxx
CorExitProcess
mscoree.dll
runtime error
TLOSS error
SING error
DOMAIN error
An application has made an attempt to load the C runtime library incorrectly.
Please contact the application's support team for more information.
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
- not enough space for locale information
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
- CRT not initialized
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
- not enough space for environment
- not enough space for arguments
- floating point not loaded
Microsoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program:
EncodePointer
KERNEL32.DLL
DecodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
bad exception
Complete Object Locator'
Class Hierarchy Descriptor'
Base Class Array'
Base Class Descriptor at (
Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
delete[]
new[]
`local vftable constructor closure'
`local vftable'
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
delete
__unaligned
__restrict
__ptr64
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
`h`hhh
xppwpp
InitializeCriticalSectionAndSpinCount
kernel32.dll
GetProcessWindowStation
GetUserObjectInformationA
GetLastActivePopup
GetActiveWindow
MessageBoxA
USER32.DLL
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
CONOUT$
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
bad allocation
?456789:;<=
 !"#$%&'()*+,-./0123
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
!This program cannot be run in DOS mode.
`.algo
`.rdata
@.data
`.vmp1
`.rsrc
</]2%+_
ap,6!UC
w>L">W1YxZa
7L*32}
B/`FTMF1
tF}%O
B^1>E)
RCJ~bD=
-.eG:f;
H5I@s;
R[`=0y
;P-Wpf
2^k+cW
S2wec5
Z/XNS
HZ*gx]]
[>($\I
SxG(EF
L$oN[D
2[Gi0(
lD1,$A
b}eY9}
i..8sV
GetProcessWindowStation
@WD1,$_
\gj8ZTg
qZ239Z
GgB+*V
R9c[/Q
v'1eKo
kj^GFcv
iL!vTaYD
WAd05+.e
qtp-#3[
=9aiM4
GaYFRd
mLH^#eY
Z$S^){d
k/.~!H
1$^|&KL
p%\rc^)
;h92q
a3?[^]
;g>kVV'
@gL4+H
qaYP%R
K#y(~;
=WTo-t
j7\g=V
;p-n'9
PjJT>t
1H2dY(
5,1@OWfA
p3TPq2
@]Tuw8
#E7W(h
\8NZ_6w
SP+FJ4%x
1>(TA
f=IEff
j;zzf=@!uf
#a*f2 xd
$~09PJ
[`t~kg
AZYAY^f;
]h1Z=}"
YG%C>h
C=>l3lV
=Y^E<B
z&@TaZ
q|q Nq
zp[s>z_)'
6h"DPeK
LEMNY
A]A[fA
gF2.A\Z
@ar,;Ha
{$~N'W
jN5vN}N
| 7K_S
6qr_Hc
YXFP{^
&Po+|{
fH$Tme=
DfY_kg
=&C'EV
,V]L7P
n.N8ON
t_zPc3
!$L*}43
w%+e+l
ZvVG;&
u\e!rs
`,&XBf`
^r7_KiE
S\ep`~
&i"eFO
YxlBm"
DPzH)B
=>0C-f;
iz&'T2u&
2i"it[
Y}6Vm"B
@v;(2s^
{qe3Kv
Vu!@frV
uA6NQzA\
%{K*S+s
1// zG
CJ4c(+
!;odXm
<7ss_1
I(.d%(=M
(6fAS`3
x(v2iy
$)VIezK
g'WkW
JZU=M-
8D14$_Mc
LocalAlloc
>/-R=@
h|ocaBq@
hC1NSz
42x!\<2
%ujol;@
`yp;5D
U~kq8q
P@`Tlt
5ilEC't
>1d)|8g
yJOAKx5
4Ol1C<O
+WPOXg
oYyL<
"X\1f;
1t}ueN
Q<K:?W
$3^Z0BS
*!]h>Iv
Xy\Ye3
!/ V-S
wMymm0
v*"l.,
bWv~~i
jg'/K=
/Ow.R'O
%L?huQ~
Ak@+U{
naZ4C
5!s2gf
W=?'PJ
KV)p{Q^
*:5>{3
v;!q'2
P>tr`9
*D1<$H
uE<#ks
t0=qI9s
!D<I=zK<
?zkgU[g
DA\AK2E
^lM_(4
@f+?AS'
=pc^KB
QQ)m\s
P*Tdsj
\(:'fD
4Y(LuJ
WD1$$f=;)D;
$Xl$`b
rSO@~O}j
oLY1SgY
<,UKFg#U
,`V2KM
Y=6MzB=S
]aIc({
f+{-\f
zRX.Fry
_vM@P `
>!mp`-+
01""/1u
4mw>f`
.)=U &
H#ZS6fD
k'!~x-
@Jp_SB3l
9u]FVh
z]y0wJ
,~FS;?]S
Fr;a4V
do~Z5f
ono*_i
Bj+Yrm\
)]@%OI
zPPW+Y
G=XVw:/
qQA'AV6
(d9rvI
Y|?t66
fBhWKIK
6n{hgg
joo';f
an~WQi
Lj:$|mM
k.k lY
!_Q]pV
2Y\,5.
v_TbFX#
'XC3|oK
3|HLJn:?L"B
5;4|7~0g
mUN/<\
1TZ``]
P8F.`?1
9Ra<>%
fT__VS(
Cw7J13
"` V'X
[8QT#p
\c9yy==
E:opj1
N|UUYk6
P=\#]}
k6h6[~
NuccA:
#)J0O,)0
,^b`}
N|EOTO
PCQq)U
@~Jz{\1
WD1$$A
x/637K
75]+@+
5'r'n`
763NIl.
9NV@t:
pU-CT'
]>k@d
kkJ:b
7j^Pfc
`j[oPm,
1-HNGR
I%9 CAg
p@zIVq
l/jdH1
0wks3)1
DT^/MhK
<BTT9
S.D14$_fD;
M>"M}9U
`:f>P=
pS*L!Z
{R;<KUL
=W~+#sG
l#Vm\$!
N[S6I,
!kF",[uF
CSO8Rs
~f}MV:
yiS|xqiE+<
HG[iNf
`z}7xIO
PaHaZXa
t|bFzZ
qWPaAP'
:]_+=*
9xb`.
-o;5I;
.TcoJD
Nu@]2
5,1@OWfA
y4]0;T
D1$$_Mc
0*YH4*
e%nw/y
Oe98;j
@"/nQ[
I%_o*{
#mZd^b1
hX%x-!j
1OB@}`M
Vitpfr`
0{0TC(*
hU+ITNEz
26J45A
9_>KhV
u7fvE0
n_;t^XL
ZkH/]
;lZPf;
_gjwq^h
LB[7 A
PFgjXw
Idr-"K&j
iSe>RUw
v:* fc
hGyGEt
d?-SC=[
@Y;!?@
7Vi!f+
]_YX_
=0T(Bl
v<#9bM[
%uqJ*k
U1j\X3
3d4Ad
tQ2*ar
_[]A_H
1u%.5
~Zd-u'
%~bQ_~qb
~ITS'/
qLHrU'f
`UNK2wg
bb)\3k
ic8,YdO
Dg|_t`
;STt^j
AkdCG./
3.ez2b
IXWTRY
z8k(v+
k?5bf;
05n;-,
>+c~2A
Gm{Ww0
Tr!:"F
3cR9e.}
l0Z=Tj`
694,{(#
}D14$A*
@D>?_@
,>5:^BY
AbU{qe"
cA4-d6
_ir@f;
=iD)/FC
\~gvVC
vVkk5#
%`JFd2
<*a_<v
~4;sXfq7
>yV]At
dWe&nQ
nf%K\f
ay:o0h
8Gc]Q5
FQsSp\
+wYoG}iW
z%`;G
$XM,t.L
X`@~`e
'EG/7a
Zg}^$f
q\|Tuw
>vK{VHx#
=C*0d^
l'#'BN
1!aCBeh
r^X_bn$
}w`(:pT
*;B:5'
2Z!0lb
uTA,Za
1\}+17+
pEJTB(
F|7T5^-
S4CA\?a
),!J7$(
Tx<S\M7
WD1<$_Mc
'\YJ[X
Hz<"SNL
h{yUA7
0W&gn8]>`
#+Dv2(
noQ37\
&b,iR/
&eW[z$
EwX+Rs
R+DQaR
$vH"ev
S/coB(#
~JZ8'bXE?
(UmJT7
oS(evp
mUI<]R>
[9PMk>'
=|&Mm0V
kO3,l8
@j[|pm,
}GMqc7r
y`Q&'j
gT+3]y
(7rN@*t
Hq~dT5C
-%siuf
SJP8d"i9
B]|W9w$2
r\Z"w2
Sm'y!L
!U}N82[
D1<$_D
*;B:5'
UY^1R.
<8Q_m1
k8T`[?#
tm6wjM
lSwE
GI5EsB
gQjnp-v`
B].w<8
kkvpV!
^9LarS:5
bgDKMw
+Ck%,4
I*W$y-
(FKjyO
tG_%%N
FNUOA9
8g|*N8
X:>a"q
LhXBY{
"R!]]9(
'^sMpm6
Y]x=LK
eVufm
LGVd_`X
E;zwkD
.BZ?"u
^)wo2
/op|dt
HFaKNR
D\XO)T[u
m-8\'
} l>gTG
jt'z$Rr
ZzccV%
rj-L@P
M[lcbK
TbD'>]
bX#(WZ<_
&_3Zl5
C.KY:T<]
ed4ghb
M]N&b>z
YS}@t}
ad"tp,
"Z{C:Y
@\T2lWh?
bza!yRK
5eEiP
OfNJq]l
;We*Y/7p
:<Mo/[i
L!BEgx
!z[7/%G
dhh&EE
z]~$sd
IzurTd
}x{6+D
GjpP(c1
O\umD1*
>!7nF#
N4:K!9
)D5$O>v
v_#'.b
7/Od
+T)>/{X_
=-w3J3F
o~T\-}
@:)o/lc3D#Q
yw2$_`
x4v72G
Lzt5C5
]"byjH
8yx>{m
j@^aR(
WTSSendMessageW
RimsS|
J^s%9e
l{5?Rc{
&t{}NwD^p0a
W#C(g$4
"Wg;%
jNK);G
6O_fgF
aOZYQH-
3UTg3b
FtQ>hU
(7B~5(x#
@<80XH
Y!]'%+K
5T_"WS
7i?Mb$
SQX/SR
-SWx{f
GetProcessAffinityMask
X1P>=!|
]=`:sU=P
m+Sj-<e`
b;lF{]
w-@0B'2
^Os=w|
@<DM%C
+4/.Ho
IJxR[8
`P/0(-
1~SU(N
IQw\9C^
WD14$_D
Gr?dtOrO#0
}YwVv||0
sk(A}>k
qh`BAb{
js`0-
*;B:5'
@h;05R
WD1,$Hc
WeM>wi
v>\ _&+
-QTV"|
6f`1y#
*cO=Lv
+rA`f;
T^:ddVPJ
:5C|=,>
Ltn&Ip
2iH7k_
Oagpn
jB-Dr.N
'Va?v_
{Wup*^
F:}qv=
]R smUW
S4<1TC
n=[_Mf
vE:pt/l
g7{fuR
sC\G.:
Dc^mhy
az@LUw
8UYf~UJa
B"1t{."
L$fY+B~??
0<X08>
+d{:":;
Pu,B>
K$;d(C$O#l
wBr+"+
WD1$$A3
D14$_A
vi(xUs
5wY~Q[x
"X,a@kcI$
j buik
\e,plb[
d8?0cO
_@xh2H
\&NeI$
}npn7w
v/xb!@D+37S
3 S].G
Mf:T'm7
WD1<$_Mc
\ieW.\_
!!4U!y
-%siuf
wZV-d[
Ii+oB)
@]Wz_@
WD1<$@
0&RrC)
R]JXME
epxmpd
amUO-Mx
2EY5#
GQqHPb+
=XMx>\Ht
]6;&m1L
7/i10X
`[3'1R
<Z'hmS
kZ"W[]U
F^f$vY
V<Z$O^
">z.R1
$;LLBt7:
?1&]*U
' _vy
@0z~W@
FX[6x|
QW/ZHq
W^VxcWe?
vZ3"#%/
q^&GE`
a:GI@:5G
q`yU-^E3
nu.tofu{
{;8t$|
O$,~AG
jkx"C~
iVa!r4NE
o!7cKx
[f=~3X
<#GYE$-
wppkFo
$hi@f7
M}4=-.
Hp9hI=%
QzaQa}
|~%"LyR
gwV"Wp!
<D1$$@
A%8T|3
Yh]iTb+
w0M+iH/
9]1=tp`
2abufE
CwY-_]
x\ge3U
N-W%Tu
4uwLWI
i+P-Of+?
E5,1@OfA
1[$JNu_
smj7=?
4Or#FJF
OC@qs#
(\@U/H
iQ*"\.
*;B:5'
N& 1,=
PN)+h{
~rk@2{Ks]P
y'Cdd"
1~o3l9~
2jsc#BC
dc'}6O
.y2y0#
SdwqA*
=W%!&Q_21
l$_j/v#
`[QFzh
c ?Hx-J
ntdll.dll
e1B+57
C%E'6f
X~@:7
s;B">c
vAUgET
QP& 1,?'
& 1,V_
R=(=oiKb
D1,$_Mc
IjtW||T7
g9mq*o
E*\LND
DuhjC!
D1,$_Mc
^R\o\^
M2#+(=\
D.0k`Sx
<[7TI
y0(2!Ag
Hf=Nlf
D14$fA+
WD1$$f
F:a{Jpd
u]>qj\
uWr'7
w3W_G`
dl"&h7
`77t<n
N D.Hd.
em^MD8
JGU#wz
-5ZML~
/1YT|T$
\U#!yQYAq
dTWoZ_
,f2tr^
RZ%jtH
QjRC*Su
:h/U>22
KWW-BXo
Ctd0Li
'oi Md
mZ1InX
*I~2^+
N|t_9Y
EC9fV]A@
U8#wZI
n/.|y#
>O]]ny
/pZr/sV%
x^266]
ix`*?|>G,
yY$ua;Z\
4&@y/+
<D^0vK
R(r%hC
IuZ^(t
y4\hSv8e
A_S5\G
SnlKrA
/]MnA`
.,|#,G
>8m()
T6t.,3
?G@].2
w*jE<{
z0Ya+X3f'
CW`{{*
_s2|P)?l
/hs?F;
,n4E]lRb
9^HB1==
v[3}RK
|4V[;=
O~U2jN
KSE?2Uu
F=h"j@c
6]_H:E
mh\P56
/YK6MF
xkeiW%4
1q0hgR
_Q&YLT
b9FWRl
CRZ#46
/$7o*(\
P8elB9
hk_vUL
k(JE!=
x4g/hB
V7X9pI
90fz4("
T1%)iR
XE,KA%e
GaMm5U
2&\ieTG
l@4O@S
l{+-VV}[
v(9djY
D:(5B_5
ZU47=R
C2)jS8E
6V&^}J
>~(ln6{
XH9N(
pn(Z/F
FWRnD!
RuRhIx
l<@*hO
m`Hecv
#XUYab"
,$f1fg
Dq=xNqN
|YU{W9
`=ia,\
$l@LS
Zql0kvU
!5kGjH
!-#uIj
B<Lp'j
wn8Kx6
#9v[tT
w,;fQ}uP
,my=9R
10E{ a
apHV;{u9
0'T=2p
Y'P}oo
,1;(+Z
XX>]WQ
|q0|H\!
i#_aD<l
I!&G!%
aco+;A
N%zul=
x=w).h
q)ip$^
Kk79$RC
Z/ &L
C@k.L+
J3*ql{cv
!slXb7
2BJ*i0
2YzM.^F
$3-p {
Yti>G;'
g1RD8G
i,.`Aj
-d'h|V
F04&p2F$
{|OEu?<
[V+krr
@W!?$0
sD0_3H
INXd'-
j;jN^v
W<\kk_
1doKUN
Tu$vgo
X\lCK2T
!_&Ljs
,\eLl*
_'.#8k
SQ4/2v
'DNh{X
+0-Su
O-#)A;
4<[;!IK8
qc\4}
xU70OZ
1%lq&1
QBSI~>N
(SaMN.\
U/8Y1-
-Erb!9
Fya<r/
rZ,.Oo*
p\"b@]
{.d/(M
4h-oe];
&X5--yG
Fw>viT!g
O93v[k
0x`{xK
n"HLHh
(~ecpgXt
^6OF%l
V!c^X~`
U]9Cc{K7
pP?ymq
6nBtyG
?3,e7o
k".VSFr
3>LVc:
}!zc4Q\,
1<2<
erYz)Wn#
&@mj^}
XPc]dX
fN:U>[
eIK'^t
3}4{;$
TfQ8G0%
c?aQr>G)
+y+2.f
e>?A?wzO
=\Zd0?%
eN*te/
n[q\Vy
9 Ctx|
,8OrRv
W8AI^k
f[>7$i
Pn@cbW95
46bRWw
)KhsD@
b9iN3-
>v:A!Ca~]
T=n|}$
kjK#O?#B
%7>Bh`"
=Uk&1_?
Iy0,Bg0
FU[.LUp
I4u7[v
82z j0)
O*R&;
fT-l+g
HA?@KQD1
TU.cRR
Tg&r>cT
p={q?:
#0#t=o
Dzq{rgPV
f__yB0z,
(}1!oh
o$7tHU@
&wq\]|&
E '&*f5
Kw0q*!
Ry9P6Y
p~^d_)3=s
:)1oGSoJK
T6+%;
EaY^3cJ
>yJy+G
(Q|X`_
/k%bJ%
6+Voi`;
|u0@z[
]=2q"C
3>RPC_
X4J\%R
P1&&bJ
n5Nvl*U
`\Yb.W
 v%g{
R1(_sD
vs'> V
RJ@vA#
@~dDED
OndYit
tK8B(O
^&X~to
9KJsoo
H"k.bK
W&<2Ky3z
jPcW$E
@A-\%(u
\mhu5K`5
W]5y}U
.^5dG6
~;W2j`
Z>awT>Led
-jugs"G
bz\g{WYZY3
=+tz%!
#p9A ae}&K
4&]Olg
?Cvu9C
8%vzJ$
U+w^;*~
\F\JO
pD\ak\
lJY[gG
5#q$4%
9!wh3N
p^/3}J
+b8'5?T
8{\PHzj
"7My.w
90fl>?
"R5+&i
CeZX$#
w,Q&'I
`fnx~0
EZ4`jf
[,LKqFC
)i>Ze<
WlWM0BK?
Yq7<u(
y'\-+v
En:@I-?
,(Id{4g
K(WV.=
Cv>oPF
:~jSvv
#}FZC
,k;+C9r8
*#4LeG
hnD*VQc
y,=VDZ_
Hn(rqd
VQ@&ol
uKY9?>
<KqE[N
R)t}t2hg{
-?w@(
#B=R:q
[k[W%
=iY`?Z
{tF4iq
|RI/`4
Q\Wz=:#
]7V%ii
x+GW'{
&;H&.~
B01K!(#
kXK1Jd
tbJrE=
w.?6g\A
|Hb64t3
Md(3D6j
oO-voGo
)$2PU$
[viqeri
;(Ji.}?
:aAtMB
3CC`1s
L^eyYt
an8{$Y
:IYkT
1ry?K-f
C5.) h
\:S/X8
B#8U>I
&RH~dc
NN[(DE
n''MK!C
,w/4q
C*Qk6A
"WvoR0
*:TPbCs
3G")LL
:|Cdb2
3'c#g
%`ApR[
yNy,@^
XGEft!
3{]dV7XC1
y""G=D
i2)&LR
Ni. d7
nhjQ=}
TJ?Y({J
+V%V3s
M1v1:|62
-Gs%WW_OA
'&Bd{A
da4$v-
2NSXhL
~(ROO$
AnsBYii
.uLn(7U
+)8%2E`&[f
J7*[rZ;
*g$F.8
ga;f(<
[wb!j4eHZ
hA":V
1P&Gv.
OsI?dX]n
'2XE?{@U
c;b|THx
6D[VJ[
Sv}ucTw
(A*W"a
o7DHd]
q-ZRq'
Bv1w`k
N5=dY(Xz
_x~aK7
y1V@R:
y,][T'r!
c}suqF:
]jTqRiM
IA%;P"V)
0ZtLGb
$"Y..?n
S!C]Ug^
HB#$H&
p!Os8b
|\nzPr
sV?=y]
L4715*
58[?8@
vKD~5G
Sx,P+]
XshRye
9]\I/u
b1zO(u
i01b*S
f9h}*fN
:d,<ma
m)T$v}
7Af%_VO
+;fqwk
+.a[GA
Isc!X}
JV"2mK
B2KLrM
Fk|!3{
*D|Y9&
^7+/%e
65u:V^E
<>x9!o
wN[eUL!
R<yFQ~U'A8
?Bs<F'
=KqxJ
K=`rX?
S<&OFJz
P@3e#-
Z$7NNa
pdPU%d*
Jd"YR
p{cV*2
!KfuX8
Ezu('<*
enw4{)
-bkn*A
U|R)/
]H\?o]=
3=,*m0k
NK!S4{
0~0"W5
]=kfPlB
IvA.kV
yA4%+
[j\7%p
T]Nh"i
Yk$y>m
v8<I +
]d2f(}i
hmMC4Mbm
fvvE{%^
Qt]Cla_I'
`PWH!j
+wattg1
$+\::&`
R=0f{9
G0uQZ$O
78K,'&
9!gmp=Ka
gS qKM
Dl)fKM,:
f#\W/TC
D!g1:G
*EN*E^i
QXi>,
qN0"\/{
!'+RD#
On>/f|DZ4
gVUI RA)
KqE|":1
2`sNKVtg
:X`?e[
bdSPQj@
;~sJ{
etof5Z
L2<&g
(~x,Ek2
UHXt6i
bxF+F/
_fo/[wR
6x|&.^>9s
R^AtG?
C-Df]h
f5'F5Z
#eO-5:z
KvSNs{
v_,Fep
nc o,=-
R^,Q&`|
T<eHOPw
dn2CN-a
REGF&9"W
tM2q>C
6qt[)#}
Inhu]M
L1ov=O^
SM|.?g]
IKCqjlj
*4>X.g/e
_"-#hpE/
b|rsva
j}1_}g/1
h?!`E&
Yl{j)7
jjR8a4
n)@c*`a
>vq|kw
o)R6~G
8aj=pQ
]X4}P'
5::0Kp
$Htd[-
J+eq 5w
6HsQ=-
N`g<]uG
}$PL/t
/s81c!
f~n1&c
i)~s8 `R
Y}eW*(6
-u9R?p%
Eg}$yMg
$?Z&g|
~_4T]v
hl>M(J
pRSw}j
")6e)\
qpb&3'
uOAQ0g
(i{Ut%
fanM;-u
s$p-)s'E3
m?L"0X
G&9s|D
F9,}MUZ
7xau,w
IX)EDI>
?W62ib
]V@Qc=
hU@tjp
oEtdPu
97X^9*
Y'TtUD
[yI>y)
48n`f;
{; YP<
r0Tb6#
!I$q#B
_4^<Ez!m
z-3~t
Q&{U%T
lvPY7yE
.rc.L9
WD1$$f
?R<O*?
UiPhaB
@m?q,@
z<0gp]
WVZ?:5
z,X\M}pcJ
kI>SV$&
,rc]-:%
mNAw1$V
@{AU,@
.Wd$D]
zjQN+c
qk@>Al7
ch0Zp"
_1 Vmpo
\zS~STz
\/O_Vp|
^1)}Hr
F1j'2eG
y;#f\=
V<#T69GOs
|K{+xF
?9RW+Y
TdtJdc
y`09IgG
7ZNafS
k[Z.:R
7F`:01
V6R/f1%
`ZK^P]<
co )Vms4p
?D+#W@
gD1,$A
@g%8V@
LaHCLa
d8=-jr
D#U/e]
"BJqV
pl$QOj>
|eL/%A
()+nG2.
i~t6$M
u)(9KJ
_k3~iA*
N zz+Q<
?bguFR
D1<$fA
R^d?>NE
)D1<$_
_X{8m?HS
?/'+G1
4@|~St=c
g~O,6w
ExitProcess
[~5y
?)H1!`
%gTfOG
\|.pSL#|?~
KS^)%>E_y*W
~`J0}p-
S}?ci[}
4Z%ID
FLZG7v
iKpM>
eWD1<$f
Q ~(PP
b[0(Hc
tvW\6RHCK
PyxbXE
kyPqkZ
8=154h)
nD1$$3
WD1<$I
Qpth74
+7A_uG
VUG?rv15
]\zIm[
pX>:@_I
`1rH18
k0c8[7
F4'Kv3P
FfPKMf
y4HuWX
m<RxW.
^(3Ndv`
A_XA]A[f
UAfNp'
Q(D/4
qhXK9+
2<]L1#
|UYvL+
R1@PbTM
[R{wTBO
ND14$_
L,\:NBu
:iA>\|q,&
A]A[A\Z
~Nc;SvN
!_Q^5|
N<Q}IS
D14$@"
+=Tkz
Op~`ze^M
B#~S>&!
rOn+M`)J
jVS!LT
z[7Tv+
zPu(#
X.UuG.[
kCi{uc
48n`f;
yiVOOD6c
eG-zw?
vDXjB0
1,$_Hc
WD1$$@
&u<AO:
<<HM^<7
T|Was2
yUI$.3
Vruq%i
!YzS[zVzR
>Ghp,~C
~+#Eg}
~yUB1[3
@1Qc>Nn
;5sQYS
s^kWD1$$I
D14$A#
D1,$f@
K]a#D:
%0f?d]
bQuV3
JN]4n&
MyUfjh3
=U}X%8
GetUserObjectInformationW
zc$BtF
Y#]mNl
[0}d"4
(pk1fD+
o3Dm-
EC|VX;
%9\3cQ
yPf54mBE
AMm#?^
)=o[`
F9T()T>
,BPNOI1K
{&K:DW
#F')z
I]/9[~
]:<I|r
/+y56f
("m2~U
>!-?7d
5!EA7>s
7h!6}T
AqJvAjR
@MO!3@
['k.=Z
#"]~c
<v|/g4vE
s\X0^Z'
LB=b/\
;X2)T-
KrZJj}
,\0%>3
3AA:seq'
A2^iqHB
WD1<$_
2abuf;
j]EdA"
.^~9*2i#
OJv|u>
y;q(qy
~JZN]nr
+EJ%x=
y$50@n
h1K]%c
kpaLG`
5k,qUX
b1A,!b{
u(?ZqD
[d">h$12
P*_DK1
Mr+g}u\
s?(!tH
o/r.hx
tn`_"9
GChn]
sq{\6Z%3
-KR;*<
6@CSgI
a@FlQG1
WD14$_fA
!_*|?.@
}gxs_^
+oV!6`$'
X*4Nf;
{[i%<}
M+S'~1
p+PQ^I
WD1$$H
a_TN[0
RegSetValueExA
Gaky G
Vu%`tW
I@c43[
PathFileExistsA
b|))/y
L4wUq#
S=:#aNkz
}p1uu|
mB-RD3
WD1<$_Mc
Iu--X'
P$sE 6
c4+YQ.,>
frPag.
vwT:'~
}vEJMq2
3J,bE)
4-|MKL
i|w>Zu
$61z}c>
#kWE,
8n4aU{-
i=v#CtU
1f%6BA
vt-@yT
{}/j8O0
S0vk1|B
4s+>yt
)WEIJ@
u(G;W1
WINHTTP.dll
g*%t(FN
c{AVh-&n
4,F|UN&
:Kf&2@!eY
pbCf*t
D+r](`
Q%s6Hk
3BwIDhMw
{A<[f;
@lV2;L
r2U=#;
^Is#Y>
y3DMI43
#l?)N=
z/frb~i
WapROD
2;9<L&
D1$$_Mc
WD1<$_@
}N'y}|
_eXi#(
yI(05+~
FH+Pg-f~TE1
0/X&$PJ
K$lOAI
EZGjq7C
}S@W4(]';
yIty8B
lsU-;
@5:^BY
D 1}P~
o6wQS{
-zNYx`
hy+|X~\
xMokFz
/N(nBzP[
5!s2gf
:[g&Bv
'zPajO;
Ul4Tv]=
zf#P=,
Z%y}Wp
kDM@:M
V)EAf.2
`E\0PB+
onaZ(d
g3y-[`1
OrKuaKrw
i:z^k$
ADVAPI32.dll
POKD89
q[!ep'|+
wU59!=
XkFhsU
$_gxL&=Lk
4>cU.x:
?GHf?8
AwV"}B
R$\vxe(
dfly5R&
}sUIdX9
o|l[>u
d}}+Tz
Iy9Xy~N
D1<$_Mc
W1,$fA
aY^~ZP
'h3@$Z
+T(Y[
1Iwa^m
WD1<$_Mc
9DbOTv
XWWD1$$_
9|9^
nf-X f
PwUF+u=
O+U4:O^|
wq8OjE
>k |#c
5,1@OH
n-W?(6
-b9cTf
SZ`UWf
9iW~a1i
FTXuj8A
J0z-s/
[Qa`>[
HSn|Se$h3
OF$Y&U
OQ9<YX
=WePUQ0
T>'"^h
Gk%wi
k8@5>x
/6s!W,
pO<<w8
Pq[s`v,
j9dz70(
ejuik:
GetVersionExA
`rhw_L
%#AJ7p
5,1@OW
WD1$$@"
$v9BqW2+
R$RV_u%
O ao9:
f=I}f;
w]' 1w,
,p&*EBx@
1~4sc~
z7n9\Y
Tj{ E)
_g"@[E
qTHmAS?
9ES+>2
gYr5tB
WD1$$_Mc
WP[7l1
cm;)2d
?l/fne
hl*YXk]
Ehn*uo
f91%&c
LXNe0R
*$M+9h
ci<:s3
^%Z>U|
H9(9nL)
%i"m+>
gkaDh`d
>;woI#
\.@nd<t=)
3.f!T]67
aIdt!!
#R}Xg9
dO)ML&
.quU[
[,I/BV
H*4*R:2&
P@^<\'1
|f0T_t7
dIy#5y
LoadLibraryA
mD1<$A2
<&M4:g)M
%xogFl[
a+JVhUN]s"
CW?)-2
D*o:56f
UU}1pU
4uwLfA
=KZ(7s
0_Po45}
K0@T8Sa
WD1<$f
`ewk.4G
DzA)jKm
4`WXfE
8T5o`V
=!W`At
3J`-cl`qb
T5Rfd2%
4F)831
$bH5S)8
@Ol l:
HmY-ARk
ft-&o0
4A7ooTG
To&wbe
>kJO{4
{ef/_f
iRws&8
>n{f<)
&^SP<g
@FTEL@
1<]@=1
Pr zi~v
|Ji:{=
V}^&fz)
VP_m<d
1,$_Hc
@_%sL@
1fa3w=R
Kg-XZC^[2
`bx"sV
4W1,$I
Td`tyYG
Sv6zf2
4uwLWD1<$H
6t2J0)
4n'%5L
w_&U<
@MwrC@
WD14$A
s~x$nA
I(Od)p
zRJI8C
CreateIpForwardEntry
6!~H7l
I(6kvF
IUlN|;
5,1@OA;
d~r_Ty
Iz6,y}A
{"c%|U
g6p]Vr
dLatVE
|o`,4qL
T5$DLc?
@ 266@
yw%F(~
_rpEou
rv46BqC
6`n1<U.
aUs\C6
Rm{k~E
3H7wo=p
bjX 7o
@qNqdrq
5Sn{jzpp
`@MgaG
+vH$-W
'%gb\"V
FiU<0c#
SLXH]@
cQTU!2
p)cg6K
=y?\G+
-pjQT[
UiU49p#
VRv-3K
t{7LW@
P9mU|O
r4AZkG"
B 'jQP
@rYP_s
SKGg+SY
>eX7Sx
n)t3<+
WFEx,?
qr[WfA
x1hIe^}/qP@
XWMg#fPd
*7kW^
A">hp
%2SnUP
1.]+=F
6ywR%a
:UZ[^oU
(uo59w
1xh `q
my|o<p
K|)l{{^
}=#'zJ
D1<$fD
7!tG^:
zW$Jz
'{ljp$c
=)WO_f
D1,$fD
-b9cT3
C? }:M
UD~.)0
,.e&X^
gyb9yr<
0<cKOB{,=
}\$ik:
\:5!s2g
}!E?t
t8?@_0
JL#Uik
%vGdUa7
*{rX!*
8g=*>C<2*u
WD1<$_
{1V>sqZ
>h-'Qb
@Erbem
hBf~AP
aKj7:3S
VnUu9s$
a2]<Q5*
W^DMgY3
W[.kD^K+j
[~e<hR
v;Cf=vwf;
*ZTLy{
!?Gkov
I;}u|g
klc[}E2
j4_n;'
RdvHUo
,_bEsa
UC[("c
s:J*IvK
NT,OYX
0Y0Q_j
w>akU}
;zS,B:>
nRa2T0
5Em=N"
D1,$_A
kw66T*
n!Z5sQYS
4^@o'>7
\jS4lj&
;j?/Y.'
_8Vv#K
"8R}fA
=BTp$l
[Sy@ljX-
?Dl$ha
e>P'z
@sI+I@
ERI%CiPuC
Q3?.
c%j*Q(C
}*$H6e
WD1$$D
'.<K!Y
<8p]Pv
pIac}LA@
|=C9L:4
JQZHzV-
Uap[f+
c2'wS`
pT"{T~
g)f%4l
{`X8q=
$!|%Y_
8rY0ht
`UZnh(
>.1B_<
aL]hWa@
*5eb?]
qiVM `
zhG=Jo0
6Yq{@d<
QJ1z|yv
CEgb!E
4uwLWf
'BB6`4
vIuOt/
c>'{i\
"s1#H%l
NNUZ`a
x(Tb}?
,0";jE
qFo"q~
&SF'fm;
NK_BJ`
\O*7M
:b[fA;
<D1<$I
$E#fH1
jo>z}0
N)cn~.
sDko"M
xEzHB
UA>leFI
@*#9G]
]pSMbH
b^o"T+
D5@X.d
@C1[T`K`
;[T.Dj
dYz&TzQ+
@5:^BY
WD14$_Mc
O(1f;
)-}73c
(\L_Zoe
(`A"$W
s0T[TRx
{ FB,)
tQ(z"W
ynO,_DK
K11UAx
6J;b!DK
/wUw#M
]=<x5=3
bco%`C
@&m%Fj
\hd'v1
cUN`{4
3ZGo#=
C>9='?
]:wX~=2C\K
5`$9oW{
zL8XPV
"V>Ob1
;/7Az}6
lrC7o2
,Z|D[@`
@I>wLj
OepLr-
p#8\K
"EF))zi
k\*YHUX
Ye{uib
$AN*[i
itoV6f
x`2H)i
sa#8CfT
/`7wg@
^egKnb
1,$_Hc
+H=/T"hl
jy0{~V
t*%Sh(/St)&x
z~j6G.@
0SqwN5
d)@6`s!y-
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Raccoon.4!c
Elastic malicious (moderate confidence)
MicroWorld-eScan Gen:Variant.Fragtor.289150
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
ALYac Gen:Variant.Fragtor.289150
Malwarebytes Malware.AI.3065879201
VIPRE Gen:Variant.Fragtor.289150
Sangfor Trojan.Win32.Fragtor.V5se
K7AntiVirus Trojan ( 0056e5201 )
BitDefender Gen:Variant.Fragtor.289150
K7GW Trojan ( 0056e5201 )
Cybereason malicious.0da875
Baidu Clean
VirIT Clean
Cyren Clean
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 multiple detections
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 99)
Kaspersky HEUR:Trojan-PSW.Win32.Raccoon.gen
Alibaba TrojanPSW:Win32/Raccoon.6c2640dd
NANO-Antivirus Clean
ViRobot Clean
Rising Trojan.Generic@AI.100 (RDML:fhOnm/cY/Nd8ag8Z8AxoUg)
TACHYON Clean
Sophos Mal/Generic-S
F-Secure Trojan.TR/AD.Nekark.lfcoo
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Generic.tc
Trapmine Clean
FireEye Generic.mg.02eceb12980e60c1
Emsisoft Gen:Variant.Fragtor.289150 (B)
Ikarus Clean
GData Gen:Variant.Fragtor.289150
Jiangmin Clean
Webroot Clean
Avira TR/AD.Nekark.lfcoo
Antiy-AVL Trojan[PSW]/Win32.Raccoon
Gridinsoft Clean
Xcitium Clean
Arcabit Trojan.Fragtor.D4697E
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan-PSW.Win32.Raccoon.gen
Microsoft Trojan:Win32/Raccoon.CREC!MTB
Google Clean
AhnLab-V3 Trojan/Win.Raccoon.C5432015
Acronis Clean
McAfee Artemis!02ECEB12980E
MAX malware (ai score=82)
DeepInstinct MALICIOUS
VBA32 BScope.TrojanDownloader.Agent
Cylance unsafe
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Win32.Trojan-QQPass.QQRob.Psmw
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Clean
Fortinet Clean
BitDefenderTheta Gen:NN.ZexaF.36196.@tW@a41Ad8ji
AVG Win32:Evo-gen [Trj]
Avast Win32:Evo-gen [Trj]
CrowdStrike win/malicious_confidence_90% (W)
No IRMA results available.