Static | ZeroBOX

PE Compile Time

2023-08-04 09:25:20

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x0009d054 0x0009d200 7.28422123453
.rsrc 0x000a0000 0x000004d0 0x00000600 3.69548979
.reloc 0x000a2000 0x0000000c 0x00000200 0.101910425663

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x000a00a0 0x0000023c LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x000a02e0 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP-
o@GrUl
)D/A?IV2[d
d\lTD!LhK<R!E)3G.
.Dy3H.
,S*RV2[d
*E;U5A%IJd
loO)E4C'.
_l3_.
L A TW2Ad
l0C5M.T$3K.
eGd\lz
F0Q.^ib5
?=S!S7
1;gukI
$UW%T.U!
(]q\%
)$|U9W!
xOA1A A2H
FXL@,htw
.^$]4\
af ;;$Ys
lK 2A!A1H
@8].\:
NDQHgDK@
tZDQ`(t[H
fT|M0B
;W)U8V.W-
~nDQu0t"Ab
$%s9A^
Al9xtlA
A49{uY
;$TAHuc
G`D@pkt`
D]rgtFD?
DTBku|f_Jcuj
7b}DC]qA
._(^q]%^
sEW4T%U.V(Wx
DRLKT!+1$4H
$7+-$X
+$9+1$
A%A3A5A%_
$HW8T.U$V4W,
dA uEW
A7A'A2A9_
LK 6U#W,
sDW.T(UqV;W%
_of,9@tfHf
>+!$<DRDKP-
DAX^D@h
DL\RDKl
._(^q];\2
3W4T%U.V!
XA'A2A9_+
sOW(TqU2
|KLeunEW
fW;T,U)V1
AUf\AMubA
]A6A$A3_;
$S:V>AdA/A;A?H
@Pu1tbH
@Mu-tsH
,_)^8].\:^([
AxHBDe
9S:V2A!H
#$)!d$B!9$XH
yA3_;].
pIWqT;U%
m<ls|@U
@Qgt[Dz
it)f>;$
t] 8A1A H
*8.;54z
lK ?WqT2
$MW)T8U'
+$=+1$,
=$3+!$9
3W4T%U.V!
Vpmt;DCpyumD
HA'A2A9_+
sOW(TqU2
|M@2tbE^
DIhCD]P
|QDduv3
|^@otuD
$EW4T%U.V(Wx
]A7A'A2A9_
&$uU>A-H
fB\K j
&$uU>A-H
;3$Er
-8)994
5$ U,W,T)U8V.W-
@MxTtMD
uA;A1A4Al_$]
&$uU>W8T.U-
8].\:^(
C{f]Ccr|
$IWqT;U,V)W1
y83$5us
o85$`u|
_afQ_utif\_{ug
._(^q];\2
8$OU?Wx
WL'Mz?
,f1[s`#i5i
e4k?g3e]
e5kvg&e!i
I3X2=Pc&
j8?7e2cl
EK&G!<A;
`6X!%5f
848#N(JJz
;Uf8.88
KQf+;.
t,fVSbs)
LYD}hD
tRfq;*
_Qc|K;a
VAx|a;.
RQ<|l;<
TQi|b;5
RA |w;,
VDAQgEg
xOA1A A2H
DA1A4Al
$qWqT;U%
HA$A3_
$}W4T%U'
4]%\0
tr;huhD
-S=V.A;A0A#H
fS^ss/L
;^,])\&^2[
DK i 0
pwW(TqU;V,W
q_;^,])\&
)SeV-A9A=A/A8H
UeDCE}L
8_.^$]4\;^2[
9S:V2A!H
LL8=+3$QD^L@0*3
8\0^8[
tAfSAssI
;;mtrfz
xMA<A,A9H
4^%].\
kbV:A<H
cDQD]D
!9)$ ~Df(
%$wU2A!H
LM0V9"8
fV\L v
lI >A-A:H
f-;\$Zs
AQ\]8.
;W)U8V.W
._(^q]%^
ATr`Ev
$OW$T4U,
f%9,8!
.](\o
P W;T,U)V8W'
#$Ufzn
$_4^%].\6
xMA<A,A9H
0;^,])\
dL0yE\
|A0utrH
|M00tlH
$wW$T4U,
IAmA&_
$OW(TqU2
|] otsH
9$TCHt(
LM cU,W%
f>9)$Hv%H
D]4CAe
D@pV-YV0
DQ ,c#$
/=c $OH
pDW.T(UqV;W%
%_.^(]q\%
pYW.T$W=
U,W,T)U1
yfVDA0
eA(A8_1]
xZA9A=A.H
gf19Zuef-
EA*A9A3
pt7=z@
(c.<,3
9luB9(<
suHSAFHn
0fCH1ul
<Rrpj`nPx
gpb`sPd
crw0}j
uRfpi/w
}Bkpx`hPd0i
gpn`6Pz
upd`|p
cR6`c"j
b2wpv n
mp}`lPg0u
cp9`rPm
5p~`nPj0y
mpr`bPo
sri`|'|
apk`jP20
upd`|p
:2|pt1e
`pq`gPm0
apk`jP20z
KUy?x:
;eWSt;a
4D2A?IZ2
iVy,es
.E'N!L\2Gd\lz
b\e>Cm
.eDTx
>D&3W.
eQsD.
=t!n+e
:yCtm=a
e;eStz
,S*RV2[d
P?YeHcp
n9@>E$A5A!B>E+Dx@
@pU?B,P-B=X5
n-@=E8A/X?
n(@(E.A%A0B20/@3
0_*_Cpc
tGd\lz
o$@:E(ApX
e$@6A1Xj
n/i\trm
e*o^tx
DgO(Dm
&E0U?A9I
+L*A*C
m>U&DW
+L*A<T
+O4C;LV2[d
A?(VRa
[?%V0c
o<l#qqm
OA&kgWyeqCr=b
A~zvw=0
30SyXyG
y!z<~AY
m#}:cDB
0&i6uFF
h!w'~<J
z!`%y;T
V91I1W=I*8
$\>2MH
')+b\c
D$B'RFaU4Bd
H$I'L^{
K$K'A?V
Y1H1^6_D?W3R(;Q
rm oPm
0G(BR;"Z6U5*\%@
.H3BX;3
bF'U,`
WP'_,p
WF'Y,%
WA'I,z
h-WM'_,
U"WD'X,l
U=W\'T
UhWS%I
T?VM%Q
d6_$`]3T1D
c:_2-[/+Q
S?M&g!O
%?Q9^7
lx>y0yG7
xwPw~
.I;H">Q>TfSd ]1V7"Xs
/L%H/G
k+C'a
"L~H=GR?
L#H/GF?
L7H(GZ?
F+O'^
L+H2G[?
LR+H'B
*H(GV?Xf
KN+R'C
2QO+H'N
e'J'O
%#IC+^'H
7#]p+B'R
p0#A^+C'H
`*#@D+N'
no#^@+O'^
`2#LR+H'B
4`&2KN+R'C
^3`:2QO+H'N
^)`;#KB+
Q+F'O
^l`%#IC+^'H
^1`7#]p+B'R
2F3X-I-@.
2V3\-D/*
2M3//]/s&
b5[<i*"[)E(N&_%
YjX/Sw"H
Y:R8S`
,B(Eu:@;V<^7.Q?
tB8A-:R:A6Z5QO:
z mI,A-x
K"6k+{
q(h'B
@]"b@fJw
Mq`3/)
BH#L"<^o
F;s3;k
2fzpug
F!Q(*Z
dl0B9]
>0ffzl
)<zPUo
Q`!6%#
P0.`30?
fq,vT?
EK48e6
2oIyMu
oBSbGa
D=D'ql
OZ%5?~
fe`+-@
}Y.VxB
?RB a
gI0J%D3
#A|AL\
0 zI)A<j
UTlvpT
N6*x{9
^I%YBp)
+1~1)M
kn}_0]
X$d|-)X$Y
lKSbme
3jnr8p
\HcXA}
3G#1U:s
j,jH#/
mi`,czV
i 0I>A9x
3NO|CT
v|Pai.6i
/jyIS
hZv~o8
P8|0`f
;hLEy #
xqxCgzz
HE d?jo
B[gq~tF
oxZ MrH
)de)@v
Z;8/lz
$}!z~s
z^"=QQ*
'qbFk .
kr[f5[
IF(eatS
=[1A0G
"/T+-P"Ys
=KyUsX?S
b<X-B &o
eCt,es
=M1K0W>i
U D r
g H Yv
nY"Z.X.
3[">w
D O UdUpn
Z M H Y O E
i^3H"`
H Y O E U D
D O I
=W6J0A0G0
p M H Y O E Up
eH"N"b
Z M H Y u
kUnG"[5Q5
: Z M H Y O El
g H Y O E/K
n O I<dp
c<dp
t nVoZx
Y O Yw
s O E U D<
/:My/H0]5GW
p#Aoh-
LMtaRA
Pu(!$xfv
|Kdyf?~
ntbj(V
xtdj]V
EUSkC* ?W
ki_n[
gC-${P
4jtjdP9
- vC*
sErjmP
" jC 8
fC} :P?jjjyQ
sErQ=jh
E0uC(
DhhIC/
j0Pu)(
&M}hpb+
EgS?W`
?jij0j`jm
)jojejujd
9j0jzjEjh
,Mah,b>
tajjhYb+
tdj{hKb!
tpjmhMb1
hjghYb
EMhxb=
- vC* 5
:Egj5P$
ojdjujdjojiV`W
*uXjpP;
HzC)8=Q
MLjPbC%8(
E]VzB)H
<jzjmjhjyh
jujdjoQ:
:LK@7Q
|APePkC#$)Q
L^T2^33
;jhjyjoh
FI9gu{
itkP>S
NE9guq
CT9xux
CQ9num
DK jC1$D
uC9$H+
8yu}Pj
{tfj0V
itrjWV
uujuj`
LiuQj:
ttnjOV
Q4S"jd
t$jxjmV
LE@jojiV
ojejuW7
5PLExukP9
tjhTn(
tfhH98
+$e+T$vS;W
ctb=h@
Dy_1[V
>Q:Vgd
jujdjojij0
OGjfbo
otjI;O
Ntf`o? V
OGjfbo
otjI;O
Ntf`o? V
tsZf`n
}ti_73
3u80^8
B,jEji
VpuuY_$[
$uFjij1
4@z{vJ
COavRk
SAytpd
TAavpjiY
TAetid
SAqrj;$
|$bU?P9Q
Cy_1[8
:uIj~hK
S2W:jij0h
Cu];^4
,Q?X<],[
n9au~h
jejmji
j}h<{+
E`$z<muc
V~iuxje
W8W:Hch
gP-W:S
Ru[fVzauyjf
jhhw|-
F[_7[m
tb<ut}A
AX<vu`
z<$t+<5t\<1tV<
AUlD'Ft
tg<(t4j|
tk<"ub
th<&ta<^t~<#u`
u}umS8
eCN^\u
,U<|wl
,q<cwe
,,<qwq
rouj;$
D5AEysX
jahP|=
ErjljbQ(
k$tto8vt`
|1(z|'
C\uau jnV?R
{V?VfV
oA;PbQ
rMwj;,
?P5P%P4P
81tv;(
8etp@_
9mtmAB
9ot`AN
}}9]tf
<Mtl<pu
huq<OtV<|tK
p<DtnB
tSjojiSfj
uzjO_^
jahP}=
Dmt|9GtdW3
xwf_zmuf
iSgt:j8
9XtsW
mP>j9W
uDf@FmuCh
P2fAQoug
\]e~FW
Czjnh9
thFTuer
tijoji
<QtT<tI<
Uja[ch
qjo[*h
0_$t:h
De(itXW
Dl(ntK
uqjb[:
|])htd
tujojhjyV
tCj5^A
Dx(9tj
Dl(ntbV
D}(etM
:`lt~j{
j8hB~)
jgh=~1
-TGivP@
Q(S9j]j5
]Eg|v9
)(duoV
Dv(et+
TwDu+`
:PZd,Q
nrxS9j:V+
iF2jp_V
c|m9;s|
Dm-kt$
|{(o}\
ithS8R4
ejwW3V
VEdu5;:
ti<juzjmYf
guvjfXl
BA4V-jm
>V?<xt]<gt[
DB(%tO
D~('t(f
|h)iu7
uaV7joh
Ly({[D
D{(lu}
ojdjujdS
|d(u}9
`P*P=W;
tRjyjojeV"
%P]EOuSP`V-P
)jnjeW
Eaj0Q+
KDyf`V@
JDofjT
'Doff(
.$ifg~
0uZfbs
:Dofj(@
ugjm_N
Duuh;R4
lP2jtV
sajejn
3uZk($T
<tp<1tn<C
]~ktm3
]^cuxj1
]rV:hi
60tus3
{Q]uts9x
x:9}t$
Tu`tgW
+4)j`W
~yS7jlh
u|!"X/
xu596\v
!XP^PtK
_V3u0W
AlP?j,R
u|!+X(
0S)S>S
;~u{f
j`PZY,
VV9kt*
29j%h=
fDujtW
yutS6jw
0 oEKjiP
EejtYD
su S-V
D8)ztp
hu|jmX
upP8ji
4fDh_'[2
lvvjmYl
tA=o i
HV.jhYV
t`jxYF
>mY,tp
`P*P=P8P
dtsJPU8wp
wtP=P8h1
QE(tnj@X
Ou_+[9
@!Dhfv
s:erl:
zfb(e`5Dofj(`p(Doff(-
6Dmfg(\
#Defz(Q
#Dif?T
p<Dhfv(
`(DufkT
f`(d }Dzfb(
fv(z0(DufkY
fg(l@"De
|DzfbY
)DufkT
f`(|P}DzfbY
msRfvW
=$kfj~
ra;=$<wrrb;,$qvfNNDQ
r>;.$yw`r~;+$uvtNW
l8ot}3
fSsut`
tjjmXf
nIuCez
iVirMr
eiSez
oBtdm
t?a\u
*l_sT
iCe;s+i
>a[e9o
S=W%oSk?x
eQsS?W$o
l>oBkz
1H3Y5^7A9
E1V3[5_7
nw6]h
sEr'm
e(U84Xh
kD!M#M%
'R)G+D-W/_1W3A5R7W9S;
dM!J#]%I'M)_+H-A/Y1
3N5[7P9C;S=[?5A&C+E/GxI0K!M&O)Q=S1U#W<Y5[5]n_
A/C,E?G'I/K9M*O?Q;SdU,W5Y2{
fG].l
rbe$KQwy
pbAz"]
5fj/g{
%p0^Lo
@ry5OD
v[!|.H
p D"V$A&H(@*
,W.B0Y2J4Z6R8L:_<R>V@qB9D(F/H0J$L(N:P5R<T<VgX#Z6\5^&`
,T)-T69E1N&C&Du
,nEm)y
#C Ddo6o
e1o9C-Do
dH "M$M
*A!(:NqNS
!A'(yN>)m
#+N,Nh
H#<N$Nu
>dw?*=e
\7K=u`
=)u-=o
L=0pSk
^O=y(;
|PPN?0aE
Hai%s=z
edf|<?
s|?88=o
n? tm
?+p[o[
VHAC=y
Edp,=e
xckP=h
oPr r?QOpdL
erW h?
wPy?>;
h^d`}?
Z,H1-=0
zBJ@}?j
zfZ@q?
h'EPu?
of$pn?
$0u?0TK7
o~0`j?/ |
:HN?\3o
.xJ?EN
.>=F=o
"0K?Z=
s10I?>
tKY<=!
\=u@@"
?~aV-b
T=0Pf
zf K=i
la3P=u@g
F{U=d`
?O%)#6kw=y
t5{=hx
FBO<X=0
X]=mH*Ow&
(t~z=ix!
5E8Q0X5
c@0\7[8^8Tc
0\0[3Oe
V2_dV8z
T1^6A2
7\cEd]4]3\e
!tIrwI3X!d1+8]A6CH=d
%tQf6v$Y
s<11lR=e
1s?i_wanz
"M(pWFX=u
7N]019$Y=g!i]6
Y;L7b9g*0[FT=0
8U+F)t-N6V0=d
%Usv.L/U2M
r5P.j-W
E7X!zrG
A0w6R+8
wiR58
s96Y=o
eU#D=uHv,e!9<Lm
X& >S6s
g'qYu"o
497+r-j076m3K
=U D?uEv e*96L
X, "Sbs
lRLHB7R
e;15oo
X#eXc'VSuG=m
=W>h*r
x3z/J?t
V"ESp;5
eU#D=uHv,e!9<Lm
X& >S6s
g'qYu"o
497+r-jd
m%t8co
<w=B;L
fTA7c<Q8R4E)=e
U=D?uIvee494L
X. #S+s
p"fT4,7&1
A_c-bZv[I*o
%P"Q|K<K8eYC!J
I+SH=d
1yEtMpP=h
:y<Q%pY=o
.h w#F
"h:h%FX=u
%g0wzFG=m
m/FH=d
#gEv0FP=h
g?FY=o
zh1r'FU=y
/g2q.FR=i
Z"FD=o
Z%FT=0
'g1k3FR=e
m^6D=o
p|qG=m
B(XRw<0(s_=i
0h&r]M43o
SWMi[v
W{vLb?m%t8q[v
=W"X~b8U
I&j1Y9g\A
<P'y6Q"a0WDi
9R6mXb$=u
kWiH=d
;PsC*pP=h
r!v%a:W'fYM2s
7A,g\vZs z
hI6P=h
"t't`vOU4Q
X<v+g5Q=gAM#=o
dg#vUv]oy
0W,tQvZti
+W4q^R7po
r#v;gjQ"gYM/=y
v#o"V'd
0.FP=h
<W1rAv=o
s/y/g=vYH1eiR0d9n
l5<kTI
s\X]i%Xdwz
$M)q)H2nu
RKU7Q0W(J?s
U]0Qj5n
3!vZkVY(Z&o bNK(8*D
i_brn N>eh
&a5H>RQo
A'qYr X
AQsL8Xp1X3h
J#b_Y8HFkHzm
q#H"n(M<=i
6M=K6D=o
%X'gX9>r0
t-lR=e
8WirBv?o
c61#MUX
Sxw*Z>o
/1.=o
Q)t=H=y3X
h:7*3-y'sYc'sRW
I60\a1Jwy
YPv+s;g
pAFY=o
aW#qZw:U#R-KVL/od
0QIg.v?g2WYl
t"I0t*x"Y:oU8*XX=h
#R.r@L.p5A$p0
Q)t=H=y3X
h:7*3-y'sYc'sRW
Q<O/B,Q
Q)t=H=y3r
4EJKZ*q.H12:7*B
g;M#7ag
Z5J^e3L
h;LPD'uY=o
t*s=y
7A>j7M=m
p!n]M&14k
M&3QQ#rm
+A$j6M'm
8U1D)uOv0e;9=L
4=U9Je
X&d!a'7aX4u
p1jQ6Y=i
u$FU=y
v#6R=i
u 6D=o
$X/vXb;oTy8X
3QslLn
W8E"=o
s"rcy
8UEA4u$a!aD=o
f,r\z0
"e&f:rZze
.c CPvXUz
m)t.q]MVoz
<h#eXR
o#r_p4EYf
c@j>8
S138F&7#k&acK"h$FU=y
/c;d(M
s/Q3co
yw4j.pU=y
0A,00M)t
9Q/1;L#VTA
Q^r<L4a#O7l
v7j"iT=0
z(BsD?F*H!J2L"N*P$R7T:V>XiZJ1_3\5O7W9E
!t<n]a
TC?TLX:Ao
C(TIX+A8
GCbT^X.Ch
JC=TMXsUz
[C6TKX*Z0
KC'T@X&Ai
AC7TQX-A.
WC=TAX<A'
FC+TKX,Cu
CC:T]X&Ze
TC?TLX5Ao
C(TIX$Zy
GCbT^X=Ah
JC=TMX`X;
[C6TKX9Z0
KC'T@X;Ai
AC7TQX0Zo
cLI8Ao
cII2Zy
GrDc^T,Ah
s]Z5Ze
aDa^4m
rS$J1m
l_c?xm
/E=N,L
iVir,u
e^Ky(x)
4D2A?IZ2
:HuL63_.
n;eAus
eBnt.l
8I+I;E0.
t?a\u
;aYsE
%oQd6i
t9r_cs
e-ye2
e=odz)p
t|C3Dm
d'eHt<i
O,MsPz
>rYtC
E U D O I
Z M H Y O E U d
,B+D<F(H,J>L)N P8RcT/V:X1Zy
M H Y O E U D O I
Z M H y
zA/C,E?G'I/K9M*O?Q;SdU,W5Y2
e)sDd:@m
[?%V0L
A?(VVa
A?$VJ$
[?%VP$
@,D,_"b
t/@)sDd:@m
G?qVE$
d/@)sDd:@m
G?qVro
K?4V[$
A?(VCy
J?.V6FQct2b
C?)V&G
C?)U&C
T?,VW$
mpD/?Ic
@+UV$Sh
K?4V;I
J?.VV$Ra
J?.VV$Ra
A?$V*S
G?qVx
=^1A0B
'/T+-P'Ys
=NyUs]?S
=^1A0B>x
.F3X>`
H Y Ss
Z M Tr
lUgsS
b Y O E U<
ee\=]a
o U D O<FrUq
10k0N0@0K0,0-0'0
0y1e1z1Z1G1W161,1=1
1k2q2}2F2]2V2,2!2b2
2l3m3g3G3G3[3s323?3
3v4l4}4J4
4H4.4 4+4
4l5a5"5Y5E5Z5:5'575
6K6Q6]6&6=666
6n7`7k7L7M7G7'7'7;7S7
7z8g8w8V8L8]8*8x8(8
8f9}9v9L9A9
999%9:9
9g:g:{:
:R:_:+:1:=:
:j;8;h;N;@;K;,;-;';
;y<e<z<Z<G<W<6<,<=<
<k=q=}=F=]=V=,=!=b=
=l>m>g>G>G>[>s>2>?>
>v?l?}?J?
?H?.? ?+?
k0q0}0F0]0V0,0!0b0
1y1]1V1.1
1y2C2,2
6v7;77
<S=?=5=A=
=g>f>^>">
>q?m?o0i
0h1t1^1E1,1
2T3U323
4h5u5J5A5Q5 5
6|7(7}7]888
:0;m;/;
1O2C2*2
4u5V595?5
5J5=6:6
869|:$:
0q1M1R131:1
1`2[2Z2
2w3?33
>K?o`e
e0O0J0
:A;U=|>!>Q?X?e
5r7z7@8N8'929
;H<U<W<3<?<<
<o=-=k=
<d=G=$=
=}>J>t>
50[0>00h1t1E151
=v>C?o
0<1V171
2n3\3*3
S484P5
6`7_7+7
5k6!6]6
4V5'535
9U:c<9<
<`?a?Y?
?B?Q?"?
:y;y;p;e;O;R;
=z>p>Y>
6^6>6x8q8"8
9}:}:X:
9G:W:M:
0-2]2A2 2
=`>~>z>J>B>
>}?;?#?e
'3O3V3&3,343
:k<r<t< <+<
<n=Y=4=
=n>Y><>
j0(0_0C0[0?0
1`2^2U2
3N6%6:6
6j7~7b7v7m7z7K7@77O7W7(7?7$747"787
7x8i8i8g8s8r8J8
8T8Y8Q8F8*8/8%82848
9u9y9M9
9j:d:#:[:D:-:,:4:
=v>u>y>O>
>F>/>/>+>3>
>c?~?~?-?Y?B?U?;?'?4?-?
n0a0 0b0M0D0L0U0%0?000
0k1e1l1r1@1E1Q1T1,1
4U5Q5U5V5P555
6B7s9B9_999
9`:b:J:
;F;<;2;
<0=]= =>=%=
4a5?5n5u5t5Y5
:A;-;,;1;#;
0e1j1`1=1k1x1q1d1N1@1\1I1
3e4~4e4B4[4=424
f0t2z2)2u2
2e3q4L4k4
4B5.5/5{5
5u6A6E6Q6U626[6
7n888T8
9i:a:z:H:Q:z:#:
1u2z2v2
3%4*4#4
>??H?*?5?
6:8Y9(9=9
9Y:,:/:
9l:D:N:
0F1^1]3A3"3$3
9~:D:H:%:>:
>O?1?*?
9M:*:H<
>u?9?o
{0&0t3
3y4]4-4
4w5O5A525
5:6K6?6
:W;L;U;$;
W0)1Z1#1=1
3939363
3P4_4.4+48494
4`5t5}5G5R5H5S5(5v5,565
5'696!6
7k8{8p8
898#8;8!8
8J9M9%9*9!9
:i;p;B;s;7;
3i4o4S4P4
4r5A5X535
5x6e6!6
9e:s:A:-:a:,:
^3D6.6
7q868E9
0x1C1S131
6z7S7?7
7#;;<;<S>.>g>
>k?p?S?o
0^1%181
293o3@3]3
8t9\9U9=9
:m;e;d<!<
3o4E4G4F4
5L6e60787
7}8%8,8
8}9v9p9A9
9h:s:::
:l;w;w;K;@;&;9;2;Q;
<l=u=2=
4p5M565
577c7F7U767
=x>g>z>y
5`6-6)6
6n7K788
8X9/9G:#<
8g9|9K9R9
2h:f:v:7:
4n5t5E555*5-:
<{=F=Z=Z=>=
=`>h>u> >
132n3,3
=a>r>J>>4>9>
2Q585&545,5
5{6`6q6@6
>f?zPn
2v3]3<3@3
3r4T4O4-4%4G4
4f5c5^5q515
5h6;6X6A6?6
6z7I7R7-7)7
7{8c8R848/8
8d9~9F9C9>9Q9
:8:!::
:2;v;Z;);2;
;l<c<[<C<2<
<x=D=^=&=#=
=w>h>X>(>{>
x0D0^0&0#0
0w1h1X1(1{1
2m3L3C3;3#3
3j4u4X4$4>4
4n5n5W5H585
5s6N6B6r666
6k7<7M7,7#7
7{8f8J8U888
8n9N9N979(9
9g:y:S:.:":R:
:e;d;K;
;'<[<F<*<5<
<o=d=N=.=.=
=x>d>G>Y>3>
>b?E?D?+?|?
j0u0X0$0>0
0n1n1W1H181
1s2N2B2r262
2k3<3M3,3#3
3{4f4J4U484
4n5N5N575(5
5g6y6S6.6"6R6
6e7d7K7
7'8[8F8*858
8o9d9N9.9.9
9x:d:G:Y:3:
:b;E;D;+;|;
<1=q=O=D=.=
>X>D>'>9>
>m?i?B?%?$?
{0f0J0U080
0n1N1N171(1
1g2y2S2.2"2R2
2e3d3K3
3'4[4F4*454
4o5d5N5.5.5
5x6d6G6Y636
6b7E7D7+7|7
8I8P8/8*8
y2Q2L2C2Y2
2B2Q2(2=2'2)2%2027252P2
2u3`3g3e3 3n3u3t3Y3K3M3Y3T3[3Q3
3:3)3 353?313-383
3o4a4}4h4
4}4(4f4M4L4Q4C4U4A4\4S4)4t424!484-47494
4m5l5Q5C5U5A5\5S5)5t525!585-57595
8q9h9{9u9
9V9Y9T9=9#919)9
9a:y:p:s:M:
:N:Q:,:5:;:9:
4m5l5q5c5u5a5|5s5I5
5a6y6p6s6M6
6N6Q6,656;696
6k7i7a7x7K7E7
7F7)7$7-737
7}8c8q8i8@8C8]8
8>8!8<8%8
8l9u9{9y9Q9H9[9U9t9699949
9i:d:m:s:A:Y:P:S:-:|:.:1:
:~;a;|;e;K;I;A;X;+;%;d;&;
;4<v<y<t<]<C<Q<I< <#<=<l<
<i=8=j=u=H=Q=_=]=5=,=?=1=P=
=o>a> >b>M>@>I>W>%>=>4>7>
>d?g?y?(?Z?E?X?A?/?-?%?<?
z0e0x0a0O0M0E0\0/0!0`0"0
001r1}1p1Y1G1U1M1$1'191h1
1i282j2u2H2Q2_2]252,2?212P2
2o3a3 3b3M3@3I3W3%3=34373
3d4g4i
6z7e7x7a7O7M7E7\7/7!7`7"7
708r8}8p8Y8G8U8M8$8'898h8
8i989j9u9H9Q9_9]959,9?919P9
9o:a: :b:M:@:I:W:%:=:4:7:
5m6l6q6c6
=e>q>l>{>q>,>Z>I>@>U>_>Q>M>X>/>->x>6>=><>!>3>
p2e2O2A2]2H2_2]2
2F2-2,212#252!2
2k3e3$3f3I3D3M3S3!3930333
5P6W6U6p62696
6m7a7D7C7Q7t7*717
7k8u8i8L8[8)8|8"8
8y9c9}9Q9T9S9!9h9
9h:u:w:A:E:X:':=:P:z
q4i4@4C4]4
4>4!4<4%4
4l5u5{5y5Q5H5[5U5t5659545
5i6d6m6s6A6Y6P6S6-6|6.616
6~7a7|7e7K7I7A7X7+7%7d7&7
748v8y8t8]8C8Q8I8 8#8=8l8
8m9<9n9q9L9U9[9Y919(9;959T9
9k:e:$:f:I:D:M:S:!:9:0:3:
:`;c;};,;^;A;X;A;/;-;%;<;
<R<]<P<9<'<5<-<
<e=}=t=w=I=
=J=U=(=1=?===
=o>m>e>|>O>A>
>B>-> >)>7>
>y?g?u?m?D?G?Y?
?:?%?8?!?
0R0]0P090'050-0
0e1}1t1w1I1
1J1U1(111?1=1
1o2m2e2|2O2A2
2B2-2 2y`k
2z3i3`3u3
3q357 7'7%7`7.75747
7C8U8M8
8`9g9q9,9Z9I9D9=9;9=9
9r:a:x:m:w:E:M:,:#:5:P:
;q;m;x;O;M;
;>;9;0;
;e<a<|<_<]<
<F<)< <5<?<1<)<
<4=r=u=t=Y=W=Y=!=<==
=h>i>{>}>i>@>C>->x>6>=><>!>
>j?M?X?M?W?5?!?8?
d0e0O0]0=0<030
0`1u1K1M1E1,17151P1
1q2c2q2m2x2K2U2|2*2
7y8g8u8a8x8K8E8
8N8Q888!8
8z9e9|9
9h:}:{:]:1:(:
;y<t<_<9<@<
=}>X>)>>
u0P0!0
0}1(1Z1I1@1I1+1)1
1e2x2]2o
1^1E1D1I1[1]1I1$1+191d1"111
1i2 2Z2]2(2!2
8e9\9!9
:e;@;=;o
v4.0.30319
#Strings
<Module>
wowo.exe
Program
Writer
Runner
RunTime
mscorlib
System
Object
delayTime
antiVM
antiSandbox
antiDebug
antiEmulator
enablePersistence
enableFakeError
encryptType
compressed
System.Collections.Generic
List`1
fileNames
fileTypes
fileRunTypes
fileDropPaths
Decompress
EncryptOrDecryptXOR
Decrypt
EncryptInitalize
IEnumerable`1
EncryptOutput
GetResource
RunOnStartup
WriteAllBytes
Execute
DetectVirtualMachine
GetModuleHandle
DetectSandboxie
CheckRemoteDebuggerPresent
DetectDebugger
CheckEmulator
regName
AppPath
fileBytes
finalPath
runType
lpModuleName
hProcess
isDebuggerPresent
System.Reflection
AssemblyTitleAttribute
AssemblyDescriptionAttribute
AssemblyCompanyAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyTrademarkAttribute
AssemblyFileVersionAttribute
AssemblyVersionAttribute
System.Runtime.InteropServices
ComVisibleAttribute
GuidAttribute
System.Runtime.CompilerServices
CompilationRelaxationsAttribute
RuntimeCompatibilityAttribute
Environment
System.Threading
Thread
get_Item
String
op_Equality
System.Text
Encoding
get_Unicode
GetBytes
Concat
System.IO
Combine
get_Count
MemoryStream
System.IO.Compression
DeflateStream
Stream
CompressionMode
CopyTo
IDisposable
Dispose
ToArray
System.Core
System.Linq
Enumerable
<EncryptInitalize>b__0
Func`2
CS$<>9__CachedAnonymousMethodDelegate1
CompilerGeneratedAttribute
Select
<>c__DisplayClass3
<EncryptOutput>b__2
Assembly
GetExecutingAssembly
System.Resources
ResourceManager
GetObject
AppDomain
get_CurrentDomain
get_FriendlyName
Exists
GetEntryAssembly
get_Location
op_Inequality
FileAttributes
GetAttributes
SetAttributes
Microsoft.Win32
Registry
RegistryKey
LocalMachine
get_UTF8
GetString
OpenSubKey
SetValue
CurrentUser
Exception
.cctor
Convert
FromBase64String
GetTempPath
System.Diagnostics
Process
ProcessStartInfo
get_StartInfo
set_FileName
System.Management
ManagementObjectSearcher
ManagementObjectCollection
ManagementObjectEnumerator
GetEnumerator
ManagementBaseObject
get_Current
ToString
ToLower
ToUpperInvariant
Contains
MoveNext
DllImportAttribute
kernel32.dll
IntPtr
ToInt32
GetCurrentProcess
get_Handle
DateTime
get_Now
get_Ticks
b3knqa5jv4o.resources
1.0.0.0
$c17017a9-9846-4527-8c72-a424e361f7ab
WrapNonExceptionThrows
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
aafg31
latestplayer
eud/i0zmhyoeudoi0zmhy
eudoi0zmhyoe
octbno1zm
mhyoeedoi0z
zqhyoeudoi0zmhyoeud
oeudoi0zmhyoe
udoi0zmH
neudoi0:
iyoeudo)
{mhyoeu$
m0zmhyo%
zmhyoeudoi0zm
yoeudo
doi0zm
eudoi0
eudoi0zmh
nh0zmhyoeud
ixoeudoi0
hymeVd
ixoeudo
oh0.,;2+,4( .0z.'7;7:(?(~?!;-6)0doic5+<..708?
-"*+!_
zmhyoeud
i0zmhxodueok0
mZyoeud
oh0>$;)#$,d0LTz
0zmhyoe&!#,s.MBY)7:)OIg2(:<O,
HFMi0zm;<# 60OC
<?'4O@
D8!u((H0
Mi0zm?(#e'+ =l- !yoeu3
!=oeud:
Czmhy!
liyoeu
0zmhyoeudoi
dudoi0zmh{o
ni0zmhyoe
tdoi0zmhy
neudoi0zm
iyoeudoh0
lhyoeud
iyoeudo
udoi0zmhyoeud
neudoi0
h0zmhyo
tdoi0zm
1zmhyoe
ni0zmhy
h0zmhyoqud
1zmhyoe
lhyoeud
neudoi0
h0zmhyo
1zmhyoe
h0zmhyo
doi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zm
yoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeu
miyoeud
0{mhyoe
odudoi0
0{mhyoe
udoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmh
{mhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmj}
udoi0zmixo
doi0zmhxne
oi0zmhyl
udoi0zmbxo
0zmhyoet
zmhyoeueni
mhyoeudn
mhyoeudoh
hyoeudoi1
yoeudoi0{
oeudoi0zl
eudoi0zmi
udoi0zmhx
doi0zmhyn
oi0zmhyod
i0zmhyoet
0zmhyoeue
zmhyoeudn
mhyoeudoh
hyoeudoi1
yoeudoi0{
oeudoi0zl
udoi0y =0b202;6d? 85.10
0zlhy~eudmi
oeudoi0zmhyo
oiudo>u,97-*(%(.=uz =0oeudoi0xmkyaeedwi0z =0oeudol0|mcy
B<czmh
oi0zmhyoeudoi0zmhyoeu
0ok0zli
%ueom0~
mhyoeudo
oeudoi0z
@zm,y,
ufoi1zm
oaudoh
euLo[0HmiYoe
eUdnm0z
hyoeudoi0zmh
0zmhyoeu
uLoy0Zmiqoe
mhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudo
zmhyoeudoi0zmhyo
Q0zmhyoeu
e]dOipzllyo
udoi0zmhyoeu
yoeudoi0zmhyoeudoi0zmhyoeudoi0zm
doi0zmhyoeudoi0zmhyoeudoi0zmhyoe
GeUd/i1rmh
oi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoe
eudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmh
mhyoeudoi0zm
i0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhy
oi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zm
zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0z
i0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeud
eUdnI0z
hyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudo
eudoi0zmhyoeudoi0zmhyoeudoi0zmhyoe
oMuDo)0{Mhy
eudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoe
zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyo
yoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoe
hyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0
o`0zlH
hyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0z
doi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeu
eud/i0zmhyoeudoi0zmhy
udoi0zmhyoeu
esdoi6zmhyj
doi zmhyo
mhyoeudoi
udoi0zmhy
mpzmhyo
oi0zmhyoeudoi
0zmhyoeU
li0zmhy/
qdoi0zm(
keudoi0:
lyoeudo)
zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zm
oi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoe
,eudoi0zm
%oi0zmhyoeudo
eok0hmbyNeWd]i
znhjonuGoZ0Qmhyoepdbi
z|hmovu
eed=i=z
mxybeBd|i
mty?eddmi2zJheoiuiof0imiyGesdyiKz{h.osuEoN0
i=zehuopuoox0hmZy
ujoe0ymjyqepd
hro|uaoI0wmlywehdji#z`h
wmhyne
H6,<i0
oiXmh
X%5D|
X);iC@&6o
X'!iT@+1o
H&4B%Q
H0'oiQ
I!&0z
BW/)T,
X''=0z
^HDI^iQ
D\K@ZT_eu
@hyogudok0zmjyoewdni2z
0zCG%oeueo
0xmjylewdki(zhhtocumon0vm`yce|dci:zjhromuho
0wm~y`ewd
i=z|hkowufoH0wm]yme4dbiszoh)otu6od0)mey8ecd6i;z
hyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zMHYOEUDOI
RE@QOEUDOI
ZMHYOEUDOI
y j}xi
tenh1{lixndtenh1{lix
gwfmk2xoj{mgwfmk2xoji
ueDoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhy
yOEUDOI
ZM@QGM]DOI
ZMHYOEUDOI
y j}xi
ZMHYOMUDOI
ZMHYOEUDOI
ZMHYOEUDOI8j}xi
ehyoiugo`0zm
8!+&.)9do%s%.'5#$!!oi|92+-650do%s% '7*1466i|92&," '-,i06.7-&(0dRR0zVhDoH*Jo*0%CDy0e[d
YT^HDd
D\K@ZT^e
\EKBUudoiQ
^HGI^i0
\EHBUud
TXUBY0z
TXUBY0z
^HDI_i0
\EHBWud
3khiofuto
ni zlhiodutoh0jmhy
zouudoy0
hyheedli z
0ymxykeed
eugoy0
yo$8do9}zm%4@
IU)"$}Z
doi zmh
oeudoi0
-i0zmhy
yoeedoi
oi0zmhyoe
s?>,yw!07)i
+,~/m)y
! 7.i'z
\oiq9=h
X\o&s*m
shCo<u
{u_o30
0zmhyoeudoi0z
oeudoi0zmhy
zmhyoeudoi0zm
eudoi0zmh
doi0zmhyoeudo
hyoeudoi
&:* <d^m
_eudoi0zm
mhyoeudoi0z
hyoeudoi0z
yoeudoi
oeudoi0zmhy
i0zmhyoeudoi0
z^hMoPuRo^0BmQy
iBzBhWo9u
yOeudMi
mj0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoW0EmVyQeJd[i
z[hNo]u]oS0AmTyReudoi0zmhyoeudoi0{mjyleqdji6zjhqolunob0vmeyaezd
hjoquqo
0mmpyveudoi0zmhFoeu~or0fmuyqejdOi
zOhZoAuAoO0]m@yFe_dDi
z@hWoJuToX0Hm[yoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeud
)0zmhyo
doi0zmhy
i0vm|y
oe{doi0zmh
oeudoi0zmhyoeudoi0zmhyoeudoi0
'oi0zmh
oeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeud
,eud_i0zmhy
oi0zoh
,yoeudo
)hyoevd
-0zmhyo
+i0zmky
!udoi0z
+eudoj0
)hyoeud
>mhxoau
tzmhyoe
-0zmhxo
,yoeudo
)hyoewd
oi0zih
+eudoi0
)hygeqd
>mhxo`u
+i0zmmy
>mhyoeu
tzmhyoe
-0zmhxo
oi0zmhxo
+euloi0~m(y
+i0zmhy
1doi0zmhy
oi0zmh
+eudoi0ym
=oeudli
,yoeudoi0
>mhyoeugo
tzmhyme
tzmhyoepd
)hyeqd
=oeudni
=oetdki
>mhyoeu
-0zlhzo
1doh0~m
)hyoetd
-0zmhyo
>mhyofu
+i0{mmy
+i0zmjy
!udoi0z
+gudoi0~m8y
!udoi0z
+eudok0
)hyoeud
+eudoi0zm
!udoi4z
)hyoewd
,yoeudoh0
1doi0zmly
ni0zmh}o%u
tzmhyoetd
,yoeudo
)hyweqd
>mhyogu
tzmhyoe
zmhyoeudoi0zm
!udoi0zmh
udoi0zlhxo
1fok0ymiy
!udoi0z
)yoeudo
-0zmhyoeu
hyoeudni1z
,yoeudo
-0zmhyoeudoh0
hyoeudoi0zmhyo`udo
.)0zmhy
mhyoeueoh0
>mhyoeueo
,yoeudoi0zmiy
3zmhyoeudoi
8eudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyo
i1zmhyoeueoi0zmhy
udoi0z
yoeudoi0zmhy
eudoi0zmhyoeudoi0zmhyoeudoi
zlhyoeudoi0zmhyoeudoi0zmhyo
ufoi0zmhyoeudoi0zmhyoiulo
=Ae[doi2z
+yoeudoi0zmhyoeud
0zmhyo
noi0zm
'ni0zlhyoeueoi0zmhyoeud
-0zmhyo
1doi0zm
=oeudoi
>mhyoeu
+i0zmhyoeud
,i0zmhyoeudoi
,:odudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhy
;i0zmhyoeudoi0zmhyoeudoi0zmhyoe
0oi0zmhyoeudoi0zmhyoeudoi0zmhyo
udoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0
doi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeu
yoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeu
yoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoe
2yoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmh
Hyoeudoi0zmh
Oeudoi0zmhyo
20zmhyoeu
Hmhyoeudo
oi0zmh
oeudoi0zmhy`eudoi0zmhyojudoi0zmhyoezdoi0zmhyoeukoi0zmhyoeud`i0zmhyoeudof0zmhyoeudoi?zmhyoeudoi0umhyoeudoi0zbhyoeudoi0zmgyoeudoi0zmhvoeudoi0zmhy`eudoi0zmhyojudoi0zmhyoezdoi0zmhyoeukoi0zmhyoeud`i0zmhyoeudof0zmhyoeudoi?zmhyoeudoi0umhyoeudoi0zbhyoeudoi0zmgyoeudoi0zmhvoeudoi0zmhy`eudoi0zmhyojudoi0zmhyoezdoi0zmhyoeukoi0zmhyoeud`i0zmhyoeudof0zmhyoeudoi?zmhyoeudoi0umhyoeudoi0zbhyoeudoi0zmgyoeudoi0zmhvoeudoi0zmhy`eudoi0zmhyojudoi0zmhyoezdoi0zmhyoeukoi0zmhyoeud`i0zmhyoeudof0zmhyoeudoi?zmhyoeudoi0umhyoeudoi0zbhyoeudoi0zmgyoeudoi0zmhvoeudoi0zmhy`eudoi0zmhyojudoi0zmhyoezdoi0zmhyoeukoi0zmhyoeud`i0zmhyoeudof0zmhyoeudoi?zmhyoeudoi0umhyoeudoi0zbhyoeudoi0zmgyoeudoi0zmhvoeudoi0zmhy`eudoi0zmhyojudoi0zmhyoezdoi0zmhyoeukoi0zmhyoeud`i0zmhyoeudof0zmhyoeudoi?zmhyoeudoi0umhyoeudoi0zbhyoeudoi0zmgyoeudoi0zmhvoeudoi0zmhy`eudoi0zmhyojudoi0zmhyoezdoi0zmhyoeukoi0zmhyoeud`i0zmhyoeudof0zmhyoeudoi?zmhyoeudoi0umhyoeudoi0zbhyoeudoi0zmgyoeudoi0zmhvoeudoi0zmhy`eudoi0zmhyojudoi0zmhyoezdoi0zmhyoeukoi0zmhyoeud`i0zmhyoeudof0zmhyoeudoi?zmhyoeudoi0umhyo
eudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi1bmp
oeudoi0{lhI
eudoi0zl
i0zmhyoeu
:zmhyoeudoi0zmhyoe
oeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0zmhyoeudoi0z
AWkCZdaodw
doi0zmhyoeu
XORIAIZCNIWw
b3knqa5jv4o
U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVu
aafg31
latestplayer
Run Always
Run Once
Select * from Win32_ComputerSystem
Manufacturer
microsoft corporation
VIRTUAL
vmware
VirtualBox
SbieDll.dll
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
FileDescription
FileVersion
1.0.0.0
InternalName
wowo.exe
LegalCopyright
OriginalFilename
wowo.exe
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0
Antivirus Signature
Bkav Clean
Lionic Clean
Elastic malicious (high confidence)
DrWeb Trojan.MulDropNET.43
MicroWorld-eScan Trojan.GenericKD.68536382
ClamAV Clean
FireEye Generic.mg.c2ca868ecfdd5ee7
CAT-QuickHeal Trojan.MokesFC.S23223552
McAfee GenericRXOO-YN!C2CA868ECFDD
Malwarebytes Trojan.Crypt.MSIL.Generic
VIPRE IL:Trojan.MSILZilla.9891
Sangfor Trojan.Win32.Save.a
K7AntiVirus Ransomware ( 005a8b921 )
BitDefender Trojan.GenericKD.68536382
K7GW Ransomware ( 005a8b921 )
Cybereason malicious.ea52c1
BitDefenderTheta Gen:NN.ZemsilF.36348.Nm0@aarpAzd
VirIT Clean
Cyren W32/MSIL_Kryptik.FFY.gen!Eldorado
Symantec Scr.Malcode!gdn33
tehtris Clean
ESET-NOD32 a variant of MSIL/Agent.UZA
TrendMicro-HouseCall Trojan.Win32.SMOKELOADER.YXDHEZ
Avast Win32:DropperX-gen [Drp]
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan-Downloader.MSIL.ShortLoader.gen
Alibaba TrojanDownloader:MSIL/Mokes.a53a49e4
NANO-Antivirus Clean
ViRobot Trojan.Win.Z.Agent.646144.AL
Rising Trojan.AntiVM!1.CF63 (CLASSIC)
Emsisoft Trojan.GenericKD.68536382 (B)
F-Secure Trojan.TR/Agent.jgmmb
Baidu Clean
Zillya Clean
TrendMicro Trojan.Win32.SMOKELOADER.YXDHEZ
McAfee-GW-Edition BehavesLike.Win32.Generic.jc
Trapmine malicious.moderate.ml.score
CMC Clean
Sophos Troj/ILAgent-I
SentinelOne Static AI - Malicious PE
GData Trojan.GenericKD.68536382
Jiangmin Clean
Webroot Clean
Avira TR/Agent.jgmmb
Antiy-AVL Clean
Gridinsoft Trojan.Win32.Amadey.bot
Xcitium Clean
Arcabit IL:Trojan.MSILZilla.D26A3
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan-Downloader.MSIL.ShortLoader.gen
Microsoft Trojan:MSIL/Mokes.B!MTB
Google Detected
AhnLab-V3 Malware/Win.Generic.C4478643
Acronis suspicious
VBA32 Trojan.MSIL.Injector.gen
MAX malware (ai score=83)
DeepInstinct MALICIOUS
Cylance unsafe
Panda Trj/GdSda.A
APEX Malicious
Tencent Msil.Trojan-Downloader.Shortloader.Uimw
TACHYON Clean
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/GenKryptik.FFMZ!tr
AVG Win32:DropperX-gen [Drp]
Paloalto Clean
CrowdStrike win/malicious_confidence_100% (W)
No IRMA results available.