Static | ZeroBOX

PE Compile Time

2023-03-12 20:55:03

PE Imphash

531372f8fed94a7a0e3b8ef647c7fcb7

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00002d9e 0x00000000 0.0
.rdata 0x00004000 0x00000a55 0x00000000 0.0
.data 0x00005000 0x00000253 0x00000000 0.0
.pdata 0x00006000 0x000001b0 0x00000000 0.0
.vmp0 0x00007000 0x004791ce 0x00000000 0.0
.vmp1 0x00481000 0x005d4d70 0x005d4e00 7.92113226315
.reloc 0x00a56000 0x00000090 0x00000200 1.36687114185

Imports

Library user32.dll:
0x1804be000 wsprintfA
Library ws2_32.dll:
0x1804be010 getaddrinfo
Library advapi32.dll:
0x1804be020 GetTokenInformation
Library kernel32.dll:
0x1804be030 WriteFile
Library secur32.dll:
0x1804be040 GetUserNameExA
Library ole32.dll:
0x1804be050 CoUninitialize
Library WTSAPI32.dll:
0x1804be060 WTSSendMessageW
Library kernel32.dll:
0x1804be070 GetSystemTimeAsFileTime
Library user32.dll:
Library kernel32.dll:
0x1804be090 LocalAlloc
0x1804be098 LocalFree
0x1804be0a0 GetModuleFileNameW
0x1804be0a8 GetProcessAffinityMask
0x1804be0b0 SetProcessAffinityMask
0x1804be0b8 SetThreadAffinityMask
0x1804be0c0 Sleep
0x1804be0c8 ExitProcess
0x1804be0d0 FreeLibrary
0x1804be0d8 LoadLibraryA
0x1804be0e0 GetModuleHandleA
0x1804be0e8 GetProcAddress
Library user32.dll:
0x1804be0f8 GetProcessWindowStation

Exports

Ordinal Address Name
1 0x180001020 rundll
!This program cannot be run in DOS mode.
`.rdata
@.data
.pdata
@.vmp0
h.vmp1
h.reloc
~f}.6+
EE@xQ%S
3Y+q17
]>\4&Vu
3aG8>%
&Dgt/1zvk
:X1\ap
B*6-nL
{4r5gu
rAC|':<
}QS6JE@4^
<z(q1e
#6.Oj[
UjYkV><0V
C@8o>j
zrEcz7jhsD|:
#Wo4?%^
( cjcg
\M`Lg9
3[?,QS
6Gp)K0
R5z`EJ
trq>U\
gq~Ouf
}DucvO
4(f~j1
*V$+CQ
,<zA-9
ho`Zq#
Ea+#UD
Yd@tE<
R[tM@F
}`Y6w>y<+#
REYFkF
,}UJ}4
.\fWvy
z"GQq|
i5hCB
UG`<])
BTViQI
Xfzjh
#O]E@q
j6L+G9b
,F,C`m
T|#9+\
n($F=2kTv
+FHN\|
|Lt]^Sk
d|w)%F=
X'efVX
D@W|iM
9a,|5r9B
N:vpU9#
8-$u?P
XyV<H?
3<)ehWO\
OoFI&o
'G?Qx
`&i FY7'
Vb1BO?JU
;\9BY~
\.GE)M
Lvf<:z
5^a[K3o*
JJ_V2u
yJ|1?+M(s
%7p<c"
{DY <P
4)4MJG\
S^Bg?'
;7BE8#
'uDp!O
=E4.-@
AT~VJ}V
r{c7<c64
S(W!$h
SX!k|ZN
3{4!i:R
be(]3f
[(X.[I
>zb?"^
,FdsNT
~fU;KJ8
r7j?uK
n5H/{a
F:\pTw?
#|y$ub
|>ztYQ
9{>h%u
-'dBKf
vx2x@g
|9dc`7"
05P_d0
"//Bp0V
Z77?U]
XV1j@{!1
s'8@]to
-m9?NEj
<H5K+w|B^j~
V/T"cg
w:NbU
C0 C>ZKi
aD}B4
GetUserNameExA
_nR{BA
LocalFree
rRE5);X
Uw,+9>
Pxq2Hw
Q;u>_E{
wM1JaB
rRj!_o%
#$D&!q
|KQmB+
bHs4{|
@S*psCyI
yvW/=s
%B'yx&r+
XAq=+g
@`r>C?l
jzD47e
^3L;"E
7;N?G@"
4-aA@A
.0F90&q
r7JI:i
i*,vu
)dl(3}
;L-0s_
=C5vB{
ExitProcess
'Zq"$9
'#ym]8
rI58wr!
;5z)O)
%_il&z
/OwH8`
Ofb*KIV
8vJ)#i-n
|FnX2x
vlCqKn
+G-y*O
#hI(;on
cy{$7Ea
8bJ%34c
TWhF\7o
FSDNvC
B:L][*
T]u$*iWc#
CtV[tM
<1Or!B?
VU>w=M(
$L_*G]'
EvLr4(
IFe8Mi
[jM\%G
rOTQdA
5?zL 32
uIz7~_
217t{
"'yd5y
kDT-X#
.e/*f_
V,bi-EY
',a2Or
il5nQE
&,SGkv
w\9jie0
U3iU9!slqE
6vsU%P
m/Wa,q}
9O; "e
lQ<6{z!
+s:C~4pj
]I `K
Blr$qZAb
_epN%g
?5?GOi
8NC;-h6^
`C}@oZf
+2nt?_
(yNS0{-Yt#D
@>(E]?"
OMAqk
6GWbb#
!6l.T@
szrZ-$
j/yt?R
YXt=Qz
r<m-*'
IYn$8 x
ztM5I|2
/2P.)s$:ETT
+%?C!L
-,+9w
iQ +?7
G/qa5@
WTys#Fk{<
-|TJ`
'=z@&=
%>W96il
+L\tN!
i}r,D[
Cde9}S$!Re
4q/Z~h$
1{aClF9
X%Wp"a
EL[F]3
E.Beo%
ilGsAY
MM$3_n&0
6pq#Yu
W[hB)
|hBN_\Va
(F;xb|UrO({
>F'MzA
j:2E{.n
o2xs.n
%VQ}QU
?r(y?7
Ib,'w$c
iIWt\o
ZIfrBC
3Xa\,y
o\N{X'|
{V6tP
0`6;!w"w
S-(qwQ
FoO@b
okK`
GkO@cX
53y5&ad
EP~y?%
=R;j`=e9
]-^lmGw
MdOCFj
>_SP =
uX6\\C+#A
xEaYQm<
'g.K`
/Kwv,g[!
hy\,%S
3_YHy5
;%Sb2N
s^+--3
[V$>,p
O4PDmo
:R!V{V
>lUOQ]
e#~'kD2GJr
Er*fEW
4:,ef(e
cu->n'!$
2a>"n8
)t'kl(
P%r"z:
J}FJisW
5{hRKisG
,GJj'RHv
3M0m5&
VK<dM$
64A7Z@
9I#''e
v/h1>a
c$~@x!
+VKq:1j
>^laI{
DYDM2h 71d
$fo>tI
I ._2M
+Rj^T[
:V!IGv
1V+@oD
9527rm
@rl`H?B
n4z@iD
k,ri6^`
w7|^=dK
F{>OL+vc
Nty3DY
Wdwsm6
$S!D2W
3jc!8|8
;Yo5nS
<*>`OIb
@6.*?-
Fkn;Zs
SW`k3b
{jz@(iO
@izus`
36t;qnW%
?v>M'n-
Uz@W-+
#vY*>r-E
4yq=J*i\
WriteFile
getaddrinfo
3i@jJE
s_(?yVW"
@[X_X4/
} FOd`
'%aDH*
=}x[#L
W<wgE42
!os]sBF@
eQiA#]^HB~
L"Ln`L
g=Gj^a
j[(rKZ~-
04(#02
H}67H};$&
jyM2,yo0:
@p aSR
2e {$tR}
kernel32.dll
nTb7raU
[UY]O
!;4V|d
_! QTj
@dbC?
)5;Zfh
.=%fo)
2b`uJm
)eQ90d
nz>8@v
0HY/V[
OWbBf?
od dMX9^f5
G+J?S<r
@d'$Rm
VZ|G3g
@@)2UI
diIHk(o
zyMS;/
B2w|_7-~
x,aO}N
d!CsTR
.O2`-N
vaOUL;
2{`)DL
<oD[%[
ENHxg
"/_dJAs
voyk6u
:H?6;
,vY7CJ~
&4dnD`'r
skI3`vBmtW
%QPU/O2
pE.0 +
@Lkgyd
d;%v7j
yei=eF
NqhHos
9g]0.e
kmmjf:2
(-pJC"
o;Ka(|K:
`J`J P+
%/mw7CB
r_E9(-
<AsDW\
FZZ\BY
P*d]Ll3^e6
saTxp`?1TaY
!S8Z\z
)*b6rZk
\(R*b)`8.
v~#bDT
-w1p5B
[|W9K[
nQVoHU
`Z8KU1
|4zS/#k{
RmiVvKK
{C$*N^F
[#!FpL\j
6xt\$-R|
4/e,bL-
SHWPG.&
fhYI=mW
PqY`kYAxV
O/l+38
D0|]@^
L\g^Iv
RoyH Yo
'B(dew~1^fe
O<I|)ADo
p11g$KL
2E:X)q
B#6 i4
@K[#Y?
;GPTD{
)E|be<W
}LsP|w
oYz{$XxF
Q)W5&yY{
;+6k9N
ME\upo
xB&p"
z1&z:Z
^:G~UI
LDT{%z
Ox,Mp@
| gPGu(3l
3ki7,
I Ue-M
VX1}8
b~j=g</
O2lS8N
fL%673F
_K>{+[
LAUST
!:Kc%PSvc"
,_%*dq
^iY5v-
KK+|&U
+'g<Xl
_x5&s7w
Oopy@K`
poZd6e
hZ$o:v(
+oY^_Q/
&>$zBW
i'L`R
9[>]@LJ
$IdB$<
9slC")S
1*M.m
fYZ,=b
znm8c%L
qCTK`v_9
}tkU
l7\C `m
dRXg8wx
6u+dtfI2^_
AE(} y
n[BWr~
4voT?IQ
huUmt9o
9Tx8QjI
p+F35<
\0OR69n
**'t#_:v
5+4'.$
q%]Zh
,9w_SB
B M?V9y
zk~@E N
!0Fw?]
*>9Ehm
?d\:ugO
AY +$4 :
}P~lcpw^*{
~mmg}a
{MnpXVo
+z/S0M
:.Cq?M
OH?CW1
&q`)J$
:/&.$F
iZPlGp
G^"!ZV
W]lC"_r%f
'H-In
}p`P`L
jK]oZgv
TN&IU^j
R^AeEzC
}nk&qAQ
gd,dMoX5^nM
*r'r7f
V=|s^[
S8Z`S&
ZK]hZr
x&6i^2
s=>:)3X
>\`d*k
9g=dDS"
Qv$N%'F
mQfsu;H
JVUt(C
-h{WkY[
M"/gBw<
1p,6z3p
nR.OL*
&<J+M^
($J5,}s
j77?5M
1?ggu
8Ci)]}
f.k<S)
-~",>EiS
$8.a$x
BWPk&p
%^sV55
!ZBCRY
xg ^(yO(
<|ilyc
'Ehj5
K(_ m4
xMk4SL!
4_[KT"
>^~Hl0
1xbsQ'7
%R8"e[G,
\PtiY)[
r=U3A^
n7HnKB
dF(FWt
=93d6cd
~nRFum
AT3sI@
wz/ $)
Al_ag!
p1q>#/
j.N@Nu
tRBC9E
??HC`
>>HFBJ
eFR;>!
ifk;=#~
\hOji\
Rjsx~~
@k9N7|
/7>W;yi
5{*AV2}xR
Iwi5(Hw
1c>{D7>j
8I}K`
Sw>N~;B
%#6aAwA
&T0L|N
AzyRcc
K3+di;
lKG]s+
nc:7mo
Re,uV?d
&JJ5[F
"Os=rj
i%<8!f
hb`0?()
D;\mPt`
wBVwY@
GetProcAddress
ws2_32.dll
b$V?u%
zh36jx
g 5O;s
=-B>j-7
R>*D>7
0Y^D[|
X1~a^)Q*
zZt"G6;
uo<"Ol
?"Dr}3
F"%}'+
N GWCJ
JXN@&m
6Rjo[2R*1
a?$v6E
vu^{d-UV
(GxU~?
ql;v6eAj-R
r`7MEOL
Sb{b:o
I1S$1#
yu,7Q%4Y#k5")=.
S1h?Z>M
5Xqk6
$upoP8XW
4P|*RrY
KJAn6K"
ISZbok
+woj[f
<GORA8
MDcQ (
Gu0S.?
+RF4Q}
i$Tz3W
ahI/,-n
do:X#7
Gz'E,F
]o;rv8
.5,(-y
[+(1fq
o=9+%6
-^*w4$
1)'F4&
Aj6 qI0
rundll
socks64.dll
8hIqRtn
oa'NE!~P\7
)^Ev'T
0Uw*ZJ
$K#%Hf
CZ.w@E
n>&w%=b
?}uH5&
&psTm
h<WyI'
O!r IK.
.%ACn`
F _/?B
^NC|!k
:-M/3&
0|o(R b{
h+r2E]g
Pkem?LU
~nXhIt
+gsmFy
nC+b]y
Fl4.R
.b_.'r
95_; e
q_.E5hgw
z(@([x
W?Crt&
7AKj5,
I\rN.I
R+rK<gg
1Oxmb|
~f:X|&)g
7V}7?M|
C]`~Gx
Q,Zi=D
&+mu3i
~_"M4P
v&3oX;l
1ipu4t
S2a*gr>
uPdw7&
CkeF]
z_=3Pk_
j&|@Qh
Li*$RB?
z,vrP[
V7\O`
H^;m?6
avq@E\
*QXp8/
*arL ud
?{zf_
![Fd4%
s6Y31a
_Q+5xD
s6YeQk
XioY??A
DR_eB:
DR_e+:
OT.N Q
3!vm/x
K36'6MuS"
DNE4PA
RuI*tjEI
:ujV&7A
ADyAWq
>%I%eZV<
gt@*B
LocalAlloc
{[e'zE
6gO5^\
nSCx[$
BGn;fl
r>(&oN
8&aB<!&U^
#vV%(r-
lXc-~It/,+
:W~Iymr4
Rn*W7:
1d,CLYq
_Ef2&
q,Gz^6
(MN6?,
dn`YzO
'{oU>x
4wua6O
Cr0`C$
>@:BbAB;5g
( SC5
+[$l;uI
fILfrR
mrcZ+^j
[+^bW@?
|A_O9t
W";1XF"
_~@pNADK
P6so1d
<s1Z`I+V
-NqKe)
Q{(c|l
6$gt0d
[yUCc>l
45?+-a
F!'37_
>,H`aA
Rr%~GS
gv+dMoJ2^
soj0i
B#*Z>n
kIm-Fm
U=D"u/
=vg^BO-
u=YleK^
8&|_5g
**-:%+
I(Y8(at
hCCM8M
c-dyx_4^Yz
n6?EgP1>
Jnv2e5
`"kkua
|G ~C|
gH1MAB
$OB}QK%
;MPIO@<
lL<'Xz
wf_YkA
4]PPB~
znic}%m
GM0cAtPA
0sR{XJ
,kI#0`m
E^X3YG
<rr'+0M
K3ZW{+]X
t4Ih5y2
F7fU z
QF^Cc}_
:]C}Zf
Vq<9nx
J-?JiaP"j
|IvEH.
0G',@;
LaA&s^
|>6ygtm
|lPn?x
Nb1>jO
_xF,NRW.
*J]Qn7
Xb5rT:
.$!3kg
JZ~JlNN
?*#e1;
ntwae:
:$S:fwr1
3mZtHX
D-{8{
o,W2vs
JO$Lr<
vriSg-
i\<uri
g8Grvh
9v;X1h-
VB"vI*os-]
<$z{pa[
~BQ}n\
9'Gw+(
]D,6qx
&WBF=e
TL/\$-
q`e"*'
T{3G#<J
5q+/)M
Y0jfQp
)i,f4km
C^UN3+g
+yn?>g
S()0\I
HCP|3z
6$8`y?
Ypvojayr
Y'*PEP
B.8Bk
wmV~1}
:Z4ns"w$(
WS10%O~!
ve!Y!B
t4S{[{6'
$-f\_>
A6j"-3
o7eyYY
whi,O;
0"QhpP
++}R|,
lo(w?H
&5{pTa+
PYfU#U<
&^<Rl
U(N9sy
_'0cB#
-<C!l`
iIwyn3
z}#grR
U3<Eyr
LiwY%
prE~YB
/f\WU7V#
[-;[@Y
E,QOYlWIX
+d-koN
+_z4_
{B*gec&
'*Q5/-
6dM) S
6u=q~<
(R4Qg2
-hUz=C
FhE+7#
>(H]"(
]BPU6n
}~{.P=(
8ikBGn
qO3z[3
6D(7>7
*d7YjO
x|iM`n*
jn<Zaw
ra#,h2ddP
,Utc_ha[
p~x8*N@
>,h-zK
FG*Yf4
;SCkL?
(lVa;w}
uBG,hD
kiLS5(
t>aa\
.Z^5\q
?!rJj{
`XuIHLt
|\H_`6
wW{4^NAh
&0ih,Q|
dG<C&`N\
-Gl=7d
VFVlKVgoL
@vL`RA_
JCf9X[
p[ztCq
|Ww;>vD
=v#@)l-
5DsLP
,4%Q2]
i{mD(qT=S
ZcG}"(V
h'9@bj
7PB<S)P
_'n0pg
7I{Gb7.
}jk)H)
:E-*i^
`1S>*re
>E-m.Z
UJ$+v/c
(4Z($@
,PcB@D
dF.M>.M
|g6:(D+
}`U)77S
-*>_Tl
qL6*g4
t0ZZ-X|l
w^U{y9
!IAi58
O-%f5F
TDGgbj
K\Kph;
xjXLAA
Z_!eB#
*zd.>,W
WTSSendMessageW
6ispXu
wsprintfA
lDL;e6
h7%N(K
;c:t6[
O3,f|9
;$qX2=C
]Y(pD|cQw
g[4}bY
1@EkPw
2G"S(`
j4rGhXj
r<WY AT'Y
"fgNTg
/Tz@dq{
X?nW[ Ln
GetProcessWindowStation
GetSystemTimeAsFileTime
JnYPJmD
Wf-1p?P+
\%.m$A
yGQ4UEc)
3>f2'-d
@,z5K
0Cc2ErS
KELAXp
<}O09/z
G,zR{x
O?aG j
STO1=S
F}RT !@
"h%Rabm
NAWZ)H
HeV~iZ
xK<s<ng
~'4]Y4
W3A._7#
k"*I{#
t >9?#
/Jq8QFj
zmEqNU
9W{12a
9fg%7R
DqpA-kS
A+Maz2^
1K!@mg$
GetModuleFileNameW
T1_/7h
gTB#v3
JsN8W7
@wEz*M
)$H01
ZweArm:'
[3X~5P
9oi]=e
a,r)"OvoV
puIFE<s
-n;Uga
Ijr,bT
$0^83~
GetTokenInformation
yP*.oR`
d+(x7\)G
XY|`!e
z56TUTq7
-}?d@Z
}Tdn.o
.c3dtv_*^
Zwm(NC
Io3d[IS*^
V9?+lx=js
H)oo3xZ
N~'Qz@
b&)12V
\SxA1;
-{Bm;eLU
p0-IUukX
Hg1c)^2
"DTJCQ;
?kgd<q?
WlvTU/
0;k#g4c
?!6OiZ-yf
>V+C}A
yQdS|lE8\
5JS1Y!
:A:Hbs
2hGvKQ
L+LI6f
:yAc|a
;)*\=4
2Q!?IjV
A#`@Fk
|$]x*C
,YOtc
fL&Iam7
Bo!7i&
,GS8+F
oU)?4P
u!?/\r
0qc_FJ
BPkKJ\L
n7|;}mf
O&'\!
SetProcessAffinityMask
KRtA;8
>g.~cA
V:PJHlw>65
gL (ENGP~
C#Crqw
S4v-N~e-
uYuap7
B)dQ*o
vt_Sg-|O
I+Fk/wZ
k@ec/E
>1xDaA
P6f.[v
ZD3#,[
ozY@:
5<dJZ~
ULx[N<qx,.
5dM_#,^
y UX?<
yR??kxE
Fy,s`+x
5hTAST
oZjx/u
GY!L7H
?\Xr~'
9DI&yFU
bAgzbp
[UX YA
[C2't*0
jZb]7Y
+F.s+C
%`9?"eQ=
1N-%0L
6opP(,1n
ElJpMZ.9T[
H(h+;e
1&6EG%
A'#c4<Ul
ZH-lS(
l$Rr[
f{t$R`=
cwXKr}
x~o#NI"P
J%ZJ*gWY
%Fma`0M
is@t^#
Js.B^/&
xSWZ
.# GvQW`B
CAlO*w
{}Y!+!b
@%Bazh
h6HPsb
N_WCk]dF9
A.%(sn
UgL22-
1lCY6Bl
F=WWOB
Vhv^#^
-s;kz8
mF(GI9
o,6RztX
uxlOuyG
|rR%d>
uNq|:N
~`Xw`F
{M,v-n
Lg@DUi
Pole32.dll
Z\S#31M
c.,j9M
-@->t@V
Fg0M3Y|
bZw5+t
kA".IN
W&'dN-
w9rz1Bu
wFy54I
9ceC:e
qA4A~Ah
gU$gn'
gUd`wO
=nX5Oo|
/F'a|G
hX.y9
26w"?$|
F09"Bm
81{MK}
|7O9:@
@IXu4*M
v(`j]+Z8
q|y97d
-!w!:A
her{Rw.
>&BN+y
}nzAomu$$Ct
hcX?Y*I>
"8<-$3&&p
mKuKKa
oAYKc25
URGk9U
}5gd!V2y
<!&iU`K=u
wU`K}
/hb-Rm
*v)e`c
Ul W@!
ZN4+xj9si
55y\`
d,DnWh
wh(P(q.4]
@~dJko
o@7YgU[L
}xAu7^
XmPJ1`
wUB%x%
n;gDuu
(0H(e]
y*5e9x
gk|D-?
>w:zoV
Fhn6$9
_%t;b}
r}8>\gJ
C9`HY#g
kVSMU~
KnD6V>
&zY~lj
nC3!rs
fL`0l{t#n
>K{M7V+
H?'M?5
rwF&sv
SF9-BxD
*/.6/>8-
X RsT\
>yOC|5$
)FEs--
e*X1DK
7U[6[d
GZiqXl
^} {b;e
{`z <N
8z,@^
xS\v,h
^`A4.9
OUn%+_:
82`X @
82@@J]
<~aP=2
J{qupl
JA.qV@
R[{h_ZA/
.dcibJ
emUw-6
%U&w;Y
2`;I`b
^w6Ysb
Gy"=]vc
6x:P@i
=Fj_PK9:OK
*%SiFfy9
;]G\g>>_
9rNKeqY
)qdSEU
tf^ wt`
Z2[GZgVV
ank,"%
{ C`VW
@@:>V?
qT}.zP
@b 'DM
wU'TR0
[Nh,z:
0)I=_}]&
"SN@fJ
Fk#Z_E
@ AjU7
nmGE/n
HIRra&0H
,O&,wqn
PdU]9p
k9`eW+
L j2-7
4+BKj2mN
u7trZ1
aV'S/g
y^2O!Ho
}|CL&6
({lB^L
)e5%5B
ov6d%E
@45H#D
}Q3eAN
)~J"}q
_:eNUaI
Ob3B&s
Ub1Z{(v
u~E"~TF}
$5p8H7b9
@,zqF?
_*,U9G
(dX<`M
Npgi6U
rTn1M2
Ebmo-d
"R"R`6
@S}t[?o
~ZaeLf
si6?|t
Hy!|=O=
P$a54['
On@R`
B=D4Q@}
pa*Q{
LtItYt
Y <l-]
s*#R*<x
)bCsB/$
TU%I,V
]N9xqY
>*3~w"
f!kH)x
=6]Ieb
[/pOi[
LW(@7S
+cV_oA
#O<*BqY
cU@2k
d)}"#;<
~XThu>]B
l!_BdX
6$](L
20bbN`
>La-aA
&}A}0Qx
nu#JBnwK
!W7 a3
zv2L
;x0b8P&UNQY
Z^{a.G
cNBHt2jy
H)iaG?
E~'Co}]y&C\
f23NNz(
RDUH@^
#8e$Rj5
xv$2Ek
{?1-Hy
|jkgT7
JAT6&d
KbwSs}rj
{"R=j[
:mQ5nU8
ZR0rnTf
|wIm~0v1t
6mQS9[
i+kXx8
W7L&xS
hIa[x:
?%o_}\
35a!aA
wP4*K6C
b]Nd@e
W*2dX.
aGPSEe
Q@RY|X
@4V0Q?$
Ddc@sNA
@_%WQ?
N'UH}x
m}2!82W
#[vIDT
(:V'7B
@[Vu-E
Gq[m)*=
h(oN6mDAOn
:.tWRe
:LiDR
APd6`|d5
[WPiFL
8VH5]b
4-+a^0#%
,Cbp4|
pbu@k2G
J/fl?z
X=3!6k
?;0d-?
=L[yxS>
hK(wN[971
a$3`-D
a+vj#"Y-
|z7u;v
zYb/vN
c'ZFA>
z7v5fWf-Q
+9?.$i
&#[LaX
h2q%|f
Q <l`U
-yMutxn,
_~1XXD:
L_+)>l
.6rL-7(
;zyz:
pq#z}v7^W
0+shdR
EvwW#D
d vTm'R-k(C
vNuA~-
GL g#$
GIPS&a
,R-j)H
SJ|!SY
w=b`tTc
geT*dk
,:4Q-:
8=Yr_T=.v((
\Uv-\{
Bv}w;s
]vn4|Ga[
fp]iPIZ
z}W?*$
3PbCqJ
,(v~woZ-a"
0F\P;t
8$7W&Dyl
P\fAU7G*YH
0lz(Do3J
8`c~n!
!2sO}W
0vgoAJ
>AVz@O
2hgR8A
M.{x9
5lS&s8y
x'%%(?n
$KtNIA
%+)VsS
3:!/kDD
UZUl1fq
?wHi+d
"I1ijJpr\
:EB|EU
S88ASQ+h
lWb#k>
mI(,:7,&
0):T*b
>U7{o@
-7iInB
(-'?'/
J'Mbu?
|D8qx@{
,4ec|_A
Jy"NO<
=&AnIG
JPInN53
snrz~ynfs
GetProcessAffinityMask
X5)OoL
user32.dll
X&}q['
U)8hWc
;Wt%gW
Zb$J98
Kfu$.,
YLiqWd
x(y1-5]
F:_iWu?
xT=?7D
,vz&3pN
iU~emz
*pD&6
vIb&y-
l-)#"
qrJ>vh
1h5v}l
2U'nd<
.m.d`Q6
]!*|7@
RW8>"!
(46NJOG
U(0dz`Pb
eKGg5~
bg>-Gcj
GetUserObjectInformationW
.:v.5~
M`JG?Z
P 2CgT
X0C{CH
cN*I"Y
B{-te9
]X:r`[
Is)c(8
QYn)84p
b*21@^
5eyo2x
.mFg/m
%c{aP0
U/\:o=
hjtmMLv
i?;9gU
"-I/$A
:I$M6<
GF%NrW
o4X/'5
`jG[VR
yv\,|1
4_e66I
)+U6h8
CoUninitialize
z}"t w
>+y:gA
7rq@r3
S>3^[+
[=@pAq
>oRgyA
9dhc?e
*Cb2; K
9-o*?e
.v=8{
1/i"42
'nPV$(
)$yW%|C
PchC.HNx
AN&ixQuX
8C<`wD0I
NE-?)Y
"Cpd?6
L!uE7K
XqJy%\
=d=Y<;
zL8Ed2
Z^_M/OR
@>(ef\
#KVn'i^
~.*L?}I
%%d0Sk
'wIOkq
w3Oov
w52_bv
*<o"WB?
nquyOVB
27~:jI
.AaVXM
ZAGr*v
a"\NtY
|fjr`LV
zJKi?X
gjq^]lB
F%6{t@{
9w"5<$
\+QlA&
@eo;d]
Cs9dNK
(:-d?
^5oC8q
(A|Yjd^r
Xo-Y*p
Fd&Aw22
O"Sed<
}|!qL0
4'A}K)t
)6H-F\
qmo%9x#
^KvjPv
/<t[12
ull#FY
Q9~_2:X
eK#6zLpnf
7Mvp#
co3^"Lq
OUxP
l#+D}f
6ZM,{&
9:(}+%g
4'jsp#
8_LxNc0
})H.+OH*i
'"(<w0
@6bK2~
c:Q(AE
!gs6-I
&Q{$ "
#{n/cNg
GTR7`\
5Z-f.l.
V"t#{5
!_Z1;$V
ijreHnG
$\j28>
.JyFE5\
i ?.[t*|
ZGSzSN
6b;'}\ `
aw7,,_|u`K
f9}F={
{{jP%@&
]SAu{?<
H6x)0t
qq{^8xU
]/8Is-
ZPFwjs
Ex;amV
g>W3]>
vKl=6Z|p
u8U)H
oFS\h/t
W4dWUr
~,LbIV.
WbU:nR3J
nELF)7
uwZ<9'
cOzL&t[s
L{mx?O
vKfH{)
?RzHiL,
MoNy b~
Xt*hT&
yF=ODK
.l-*,fbg:
7v^h9n
YYiRsI*
r%\km,
,kCVBN
ZL!c1J
6{>cj9
nurpoa
4OR-V}
&#0N>?
34W e`
x,Bf+
s$\*c
|[?r|7
\m hoi
=|Sn}f
c+~Iym
wp>;C0
}pVJ:*
$Z|E]C
RM1I9T?
uKsqTO
H'$}^
eTu2p~
j?y!\f"
5z_Q.2
M]Zrl9
G:'koc
/9G3k,
j"yK,!w
o;EB9k&
zCz'Ej
X4mDo?a
RTO]%a|
CMnKLVz
c]-Ad"
be=l7i
w;%6}F
xH.7S`o
oqyqWF
);LQTwd
$h+}WM
Yu}r+@T
!_"rDbN!
hVkBCzY
:l!xnPs
yea5M`46T
@Qt]bN
md+F8g*
Qn\Fj0
T"s=[~:
oT Vy)
kZr3Sp
$IBqu~
PW4nC\$
np&dFT
05X~.N
W*U Z
O4~&*n
mLF{a~
O!cYW0
a*@6j[
TWWZDP>
^YKk>{
SJo5|V
>xb\gvR
%CW?Ej
qN!;o<*
0+[g)~
5yt @?
Vd^@fg
/)o/-d
1h.sBb
WXHiCk
EXSFM<
iCk4EQv
(}FYf,
QccHllt
X9OO5}
W4n8Uq
.Ix%R1
<nf[J\
zmg<'MO)
-Df"v)1`T9
`:d-kNU
\'waW^
jS#vyf
Z.E)U3]}
xg'HFT
z,JTxfj
E{L$[=J
C38qUD
mbQ?lV(
,';.Sf
(oYYG&
vXHy[#
B,*4Vs
IS:m^5
)5^6,*
+XH&;;
n^onVD1q~
/?^3j,_
=Y#2!g
mvBzN|
9$/Yd.
A(!_M$j
[5$eNno
3F~u`k
"IK:^1
L63]F4
>gC` ^i
=Xn?&SYM
&PB2m
!HV)cZ
=B$D^Y
|zBLF%
ff@ejla
.)$xkD
t/$3;7
2j.:!3
{(=8FZ
Z0<#H
;$-&DByn
?(XCcD+#
o^-(8WBc
XG/Z6H
)Fa!nP
b:t|*&
2/tcpn
S;xthg~m
G]^*NE
bL3Wv$1
] {B3I
**esK9
8V5N!
>swGts
.=;w7"
eNyGk{
Dx?YD@
-{il|&
IphU->
N..Dgs
-GBVEs
dJd&fY
R+g?i"
_OYV9d
NxD<k*
fEv%$/
8jDjDo
}E&]8
i}]]#c:g(
PST7IpK
cs\[}2
L\l*P=kfn
7BdW:Q
S".Afw
Z`Y+#4J
IWWkh*
NRje]d
RD)AM\
Q8^X`>
MYT*i6
N'5R_S
0w/5{c
-LtD/I
rw'1@bB
eBZr9+
6ZPz{5
>QwR${}
:f[i~E
r;r+<q*8
gnL{TR
e@#P"d"o
]C(s};a
dm:R@
79(IUAt
+`l04gx,
Z%Ju1o?
PdN\ D
9Nj^M_
.Bf^UEX
QUJACL9vl
T,H+^vr
quyN9Q
li!?lB
u"'c1yO
ra^vZ
Az5*L;
QY`BL'
"NtnkL
(4QjoCS
dK&5+@
6'*FtY
v7l/b$
WquV@t
1C\bCZP
{eAp~Q
l)L%b[`
tds<0c
=\%&M(0-
^QW:t(
j3 g@WFy
Vm"9"0
.GtLb{
B$+eHr
MvLxy)S
!8(6_o
rVlEBi
)*e(=g
/)FW\h
CvGHEVP
(e#H7B
Z&r_#|
<PI22k>
:q%Cj2j;
;M<YD}
Gb<chm
'yPK_%
(K~Q-8
us2x,D
[Qg+7\S8;
ET:O>M`
)/:P$N
3Vn],9="Q
I{(aW.tg
)WiydF
rh!rG2o}z]
++M}l(z
7:|z2z
2^7NT8Y2w
{nk{~I
jRFw<E\
R+E I.`
@sC+0x)
q_uCZI
6`36S{6
oN/SIy
UYqf,P
2dzz2Z
{FJLcx
e,S7av
5Owfpn
h8E}?
X`9rG+
9~QDk0
JGCerV
>K%T[{
JLc&Dp
=}Lj&S
ebSq5G,].
)d0ckv
OEWr_A !Kn4'
6`3|)7
8"'RWkc
)/,\\G
bH( f_
\.;87q!{
oo]w2"
H-Zt!h
tHNr&e
2#3i>o#H
:1*z\=
d`PDAi
CKaUvI%:Hf
OfUy@
_~X0ug
!y|,QHm
"Cv$(c
rp[rylW
nlso$,
6~S^H>7P
+x"7"v
G#b(=c
>*Bbjz
~tr<5j
2IcUw^n
#quY=f
y/N0C>
.>u?zW
g51lJql
d-!He"_
{NBu~($
U:W=wF/V
TZ*A[_
HvpC5*
:xP6V^ 2
t}?^{,IE
&V8M\z
23>+4tA!
AKa1H]
KJFwP*
2FZJxFx(
0553j=
^`f=lO@
.Me<0/
!j,hUA
8- lRO!
d:alpFY~
x<OXN`
:aGwKb
!IxOlo
'P2dJ$
z$OXcm
<&mAZ_!ZT9
<3v.Kw
':wj E
&uOS8ey
^YpyuP
2i[2#6
/h `w
)t:*1
s"*a[q
n}[|!$
13~`5z[soi
aAIcLk
amCgd_/e
1I72qX]
ll7tN7
9x"xY/
;;.61gU
tD'?@ww
;Mw>m7mu5
]\V8GS
wR..pl
{O=nu3
~dQMeT
> +[!X0
,^%{A#
b$[7gjB~
)w@J$+
kKaCA`
R[_iB1
20j\ltp(/S=$
PXy`A"
EJPNH
RWBZyo@
ns? aQ
V^+law|
4m98F^Z
h|bIc)c=
NprF`C
J)nEZE
dt4<\_N
T=Dzx01
.bDX-3
z7s0[q%+[A(0
kdb<S
,%Y6"0R
eO,wb"
/BuNhq
><QxvPkv
}sxqZT
'Wk;&%dy*
+l:o_cXs
`!Mobk
i(J`y)
KnHn1$
,Bt`'y
]sgt%4
R%K}7!
FTyL<rI
4zt="H
Noz+B>
Q+8PTv
aL<Nwd
!Y%n_j
7iBpY*
kGuRFvJ#(
vB2>b
!/Rr2q
#z*|s
y*(-nD
_$0pn3A
FhtYJd
@RG\;h%
Y6vsH$
n#2u2q=
u7z?f
W7?GZ
>aIv+o
y)^nO2P
+;6xL@t
1&Eb8v#
$jB6C"v
T^A)_
s1TR#D
-rQ=bY
Ldn"gS
.L_8:{Y
YMsYMy
r|Ktz8
1!/xt?
J5b^BD
3w%)A2
)=p)q_M
2I$`TD
>`;u?wX
;:%b_o
7AU2I&)
xj[}te
=5CpB)
a[*?P?
mnsXH0b
@8;N5f6
cFI(_tM$
Lk$-XZ:
Q6\7|_
uTE4XD
3fJ)J
}LM5Mj
VP(l]S
H(LL6J
"hRRsv
oDjkPqg
}ZxuA
>.<hag
:@=&oZ
Tm=2?]0
G$,d@\X
U_%r!0
nT/"q
!&Zh]_
r,3raG
G4_UJ{/
PQv:
*M~Fri
ZHU1G8
z"./^\
c40b0/
UwJ2O6
=?"u7R
Li!vtI]p
%y5)yhjN
QN:''+W
:S"O=x
b7v%a'
jP?kpC
~IE7[0Y
}%lcs
^@(hX8E
olS~W]`
^J&g?og8~
+p^sqx
1eo9<o
Z0|)r;S
e\$|mx'
6:fY_cyS
U#|/k2@
E&GI:&(F
[!F-j1DO
giTH6H
1Qx=}pH>
F}TgTFT%
$RB!V/
KY\S\Wz
I#<=[Hw H
a`my!K{
$/z90b
g+R&=|
!< }h6
8fm{X.
(c"7M'
-V"oX~
m2r8w32
R/5RuO
@)_j~e
uilLrN'
obb;*{8z
yGb@WB
YW'4l3
M51.|F
#ZMQs{n9
A3xA^<
hQ`\1:
!o0p9K
5"WnVu
z|]V$i
?D W`x
=I)<!P
iJctFiXt
I;M~)T@q
`]$:z)
#kx1.r
cC(@o/
~Yr{v'
1v#;,+1=8
F@pz5*#
Bv_45k
3 z`-:
Du8JVF
k`I7r/
7,|zO/
b1=I@8
1;4aF-@
oD"4 L[B
.<,c+*S
(ibV,67_
Aw}pD?@gbR
Hj4bd
.g^'b
vk;@LR]
D<Tj)Q
TT{p7\
qT+vr%
.X{Y7{C
.b!g1
{4yFGC
Ur*a?"
.Zk&;8Z
Dt@*1N
aB}0jf4
e:lwjv y
0CtOnDT
N6&Hb?7
&HYQW*
txMBuQ
VSJap2
Z&GA!v
_r%:Uz
Sc J]k
jPUh:T
E/!&N
%OjH!J
e`a+`1n
H-.miKd~
AJjh1#
lIg%5;
WTYz<H+m
[D"T9%)au
:x{JnH
V/TOn&z
(T'SK_
pcOs=$
DWKnP,1
#jUl-P}F
VTL%#=
X-L,rX
Bh7JBX
t$#*.+C
(B5|fKY3
;syl!xk`
cwGaVe
t[[N]O
Antivirus Signature
Bkav Clean
Lionic Clean
Elastic malicious (high confidence)
DrWeb BackDoor.Coroxy.1
MicroWorld-eScan Trojan.GenericKD.68526782
CMC Clean
CAT-QuickHeal Clean
McAfee Artemis!BB4E3B588AED
Malwarebytes Clean
VIPRE Clean
Sangfor Trojan.Win32.Sybici.Vt12
K7AntiVirus Trojan ( 0058cdab1 )
BitDefender Trojan.GenericKD.68526782
K7GW Trojan ( 0058cdab1 )
CrowdStrike win/malicious_confidence_100% (W)
BitDefenderTheta Clean
VirIT Clean
Cyren W64/ABRisk.BEZE-6664
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of Win64/Packed.VMProtect.L suspicious
APEX Malicious
Paloalto Clean
ClamAV Clean
Kaspersky Trojan-Proxy.Win32.Sybici.aac
Alibaba Packed:Win64/VMProtect.69cb5ce1
NANO-Antivirus Clean
ViRobot Clean
Rising Trojan.Sybici!8.13338 (CLOUD)
Sophos Mal/VMProtBad-A
F-Secure Trojan.TR/Proxy.Sybici.uuocm
Baidu Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win64.Trojan.tc
Trapmine Clean
FireEye Generic.mg.bb4e3b588aedce8e
Emsisoft Trojan.GenericKD.68526782 (B)
Ikarus Clean
GData Trojan.GenericKD.68526782
Jiangmin Clean
Webroot Clean
Google Detected
Avira TR/Proxy.Sybici.uuocm
MAX malware (ai score=81)
Antiy-AVL Trojan[Packed]/Win64.VMProtect
Gridinsoft Malware.Win64.Gen.bot
Xcitium Clean
Arcabit Trojan.Generic.D415A2CC
SUPERAntiSpyware Clean
ZoneAlarm Trojan-Proxy.Win32.Sybici.aac
Microsoft Trojan:Win32/Casdet!rfn
Cynet Malicious (score: 100)
AhnLab-V3 Malware/Win.Generic.C5467135
Acronis Clean
VBA32 Clean
ALYac Trojan.GenericKD.68526796
TACHYON Clean
DeepInstinct MALICIOUS
Cylance unsafe
Panda Trj/Chgt.AD
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Clean
Yandex Clean
SentinelOne Clean
MaxSecure Clean
Fortinet Riskware/Application
AVG Win64:TrojanX-gen [Trj]
Avast Win64:TrojanX-gen [Trj]
No IRMA results available.