Static | ZeroBOX

PE Compile Time

2023-08-02 00:13:03

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x0003ac54 0x0003ae00 5.32415239179
.rsrc 0x0003e000 0x00000546 0x00000600 3.99944884154
.reloc 0x00040000 0x0000000c 0x00000200 0.101910425663

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x0003e0a0 0x000002bc LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x0003e35c 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
com.apple.Safari
Unable to resolve HTTP prox
;j||PbbPGGPkkPBBPvvvv
P$&3)m
i/2+q803p
z||5bb5GG/vvvv kk BB
PJ=1"N
yc**<+==
\!+|nE
(7-rz~C
6sreraxtrE7
U]Q~\\Evc
U(6!!7`w~}jq^8)()(()(*7ws{}_81(6!!"nj8#,.`8#,.vqO8#(6()8LV8kow|vqO08(6-7yttqbwU
"yop}z
Qpv" #
V1(w&9"xe>3::3!7
ee5?$3$3 $3%
ALEEL^Hi
`]H]XLL]
Z:v|?"?t**;4
GkrAX@KVJDt
BVgnoP
@cL[JP[e
BIKI?t
Z2/(&.-
YY._((TTTT\ZAY]^-A\].XAT-[TAUUXY(//_
U5(3$"3(5
g5",$.
g+&.3)"#"5
g40(#).
*/%USS#' V#SS:'/$U:'V&#:V/U.:%##T#QU#
@wHWZROU^_^Ix
HLT_URl$
~s{f|wvw`Q2wfsq{t{f`wQ2|{s
}V2ae}v|{E$
////////////2////2////2////2////////
R(29190
9?.)3/9
u5N`zqyqxQm`}`zqp]d
,.("*(
[j}kowjZ8[M
pn@WAE]@pqg
&q|sohrw
VVRJAKLr
LWDCDv8
LU^Zr8/%(p
<*sz}f`g;(
y ).534h{
4SyVIDLQK@A@WfyQCJVJWFLhy
&94<!;010'
!3:&:'6<
LmB]PXE_TUTCrmEW^B^CRX|m
6!73+6
HJL_BY~IHY]T_NChqYAXLKHiq
scEGAROTsDETPYRCNe|
C[MAZ\FM
1*!<46'20
?AW,ljm
4Naw{f{f|wv[N~{s_{vw`q|[Nw`seft}A
>9#8"..
HMZIMZlOKRl
!A1+ 770&
.814;2/-
3261<;
.<>H7I;I:I,8%o8TN=(py|szgEagtaf
\P<:p?*?:;-)1,<
+441>7,-9
z3/!99+:
K\VMWJg
^\SZHg]KYJPHKKYHgJ]LKYU
S{lz~f{K)bjfeO
4;7;a|<! !(&<
}tq~wjhkj}kmtty
G-$!.':8;:-;=$$)
`+*/b"#!)-(
>)8-(<
:a'<V[XUV]
KQJP\\^
V@]EAASB
_XBYCOOMp
-8$6\?!'
$1-?U6(.
S|hfia`lSFZH"A_Yaj
@Sj}nx{i`\
zu|acav`f
5YN^GJ]
NFJEYNX~
NFJEkpLEB__NX
gDDRTTv
CRYERCY~
RCVA^Eg
[W@AFD%
U^H]Y_UMU
PxCO1<<9
@AVEAV@G]VPVAoR__ZiV_Zuo
C5ynx^$7
-a)5#!rdvu5*py~sxtyr7ddvG+
jbHL^}jw[
|FPA\fieaspgzviPGTbeasipgtbaszf
{hnsrtnnxNA/=M^NstJAqdovtoM=stio|PAXO\JI[RN
udqfyb`k
^\$)lo
iems]FTYsi
CZV^@nugj@Z
HOUPLHz`NSH][UJ]r
OXKOXn
5qJMQGZBFFTe
?d`rkgc
2=15'>26=
_XBG[_mwNS^GNo
YNOEJFFDh
FJYLDY{w
"."x"%?:&"
Mfjf<fa{~bfTN`wv|s
}Q2BFTN;$*j:2aw~{T2
s`u}`BNw`}fA~sgf`{DNB
*v#/#y#$>;'#
w%2396::8
w:6%08%
;6"#%>
+l5#>&""0
>48^L[JJ[ynjx
v p<+8<+=r
-:)-:,c
<vpmr]pgtpgq->
6meifWzm{}Wzm~zm{4
;,?;,:u
$wu+pxt{Jgpf`Jgpcgpf:)
VF8-7"72&&7
X[ZUTWVQPSRMLONIHKJEDGFA@Cx{zutwvqpsrmlonihkjedgfa`c
ZNG@]]Lzu
kuZ][hD@{uL[H^]OFzu{lz|v}gl{{|jvplba
Ouru2ds~pu}Q@
yishr~~\
8!pqJ]NJ]khluk
l[G]F\PPr
~)|||~|y}
&""!98
>(!$+"?
(9>4>/8
m*#$*,>>(
m>:")#$
#"$>?(
9#(??8
m>:")#$
9+">"?.$
(?,:9+"
~^_^^)Z*\XYXX)PP*[
YYY[Y\X..+]_[Q4
{LHHKSRh{TBKNAHUw{LHHKSRh{
{BDNAAh{SAHTHUDNj{BUFPSAHt
*<!9==/
%3.622
$A6x@VKSWWEt
esnvrr`Q!QULR
`wd`wA2
!XYNE_YJ{wHERxN]B_Hjw_MDXDYHBfwNYJ\_MDx
EDS@DSe
/-+!)+
O*>ou~v~w^itozxrou~sonZk
OYD\XXJ[HERX
}RW_sFQx1
"'/#6!
6!(!<+
+</9:(!
63;7"5
Ulnh{f}ZU
5084!6
poa!qy*<50y48+>6+
58,-+0
*/'+>)
op~>nf5#*/
f+'4!)4
*'324/
-9z)/8d>$?%))
9>$?%))
OUNTXXzgHOUNTXXzg
1pcd9cybxttVK
KQJP\\~c
inyjnyO{ruqs
&#PVRHSIEEg
itlhhzK
_ITLHHZk
w[6wdsfY
CIFP{KNFj
FUBWh{KNFj
FUBWh{
,9<v<69/
esgwfdtbc
ha`onmlkji"! /.
7654321
TSIRHDDF{SIBNKd
9{c{<487+<*
fAG004D474=@1(<=1D(2CF1(AC1C(21F05<72
m'}kgzgz`kjG|kj`k]
HUF%(0
jFF4)$<
;XQ)_ITLHHZkWTIOUTx
xumOS\Ro
TXO\XOyvid|^BMC~vOXK]^LEy
ctESNVRR@qMNSUONb
d]kx||n
{|{<q|ds`f~gNQ\Ds`f~GNspdp2q|dgN
EVRR@Q
<P]Erag
8ux`wdbzcJUX@wdbzCJwt`t6ux`cJ
?PFOJeNBQDLQs
Xqvq6{vnyjltmD[VNyjltMD
2WD@@RC
"EehpGTRJs
X_E^DHHJ
XLEB__Nx_E^DHHj
XLEB__NX
YNOJDGE\DOA
AVWR\_]D\wyG
JLKFSKFw<
] 6+377%4
mw:;.x%"8#9557
3:&$#&x
_7aUa+1*0<<>c
?LVMW[[y
RUOTNBB`
\S[^^[@F
q%3.622
*?:p?*?:
6=0;<5,1)
6=0;<5,1
JerdyaeewFJdsqwxw[rwyzxayRJsdwabpyE
%#+"1"+
" &5(3
Inh`c!%
.8%=99+:
\UP_VKi
*|z0*g{u
P4"?'##1
rx x~4)c
h<=!8|!<;5=>
#(>+/)#;#(dl`osdrTeduqxsbod}esnvrr`Qeduqxsbod}dl`ourni)#]
KZGB_]
]@A@IG]
Y0-*$,/
l4J\AY]]O~JKZ^W\M@K
xb=596*=+
s"8vqmJ
GV/5jbna}j|Z1}m3
P|f235(=?50,,
;,:>&;
?(>:"?
^I_ypCKEAm
e@SDWg%
{_#4"&>#
1)(5>.
RR#s3&3
3;67(=
AM2~nio
c&DTSU
EtcuqitD&urhckcjC
D^\KTOm
SDRt}SDRVNSc
XB@WHSq
`aK^Kn
vXOY]EXhvIEiIEi
j|.52,590
k\KYKGxC[GCA\Fmr]KB[JACrI@GZZK]r
\G@^GKB}rM@g
\G\@Kh
L[MkbPQIQQ}bPQIQQ}
FQGahQY[F\whQXS[[s
\GygqjaqfgmvkW
;<FVQW
8QL\[]
Ogyr! *#*
plDQSUSYlQ\\YJ_}l
xonnLdm`Q!
_mllN#fobS_pmljw`vglqS#gojk`mllN_
'=<42!
O_!v*:=;
i2%$2/m%49"`%6)4!.`lr`./)32%6`l(3!
h`uxnq`
QB!k*q
580-7<=<+
y*.6=70
J]UWJP[
=';(!*
CfE++7$-&
V^OHBh
|m"H* k
Uj`kjK
E]GEIGE
ET<W+*,1$70",#+*
7 15$!
.7*21
stzawdjG`vdGZ76klR
@fg~b$
bh# hpx%h#xb="1
=?9*7,
cnSFJUHa;
(,T+._/_]]U]@ZT^T@/\]\@.T(_@X]X)).X)
\/b)rh7"+
7cF$.ef.6>c.e>${dwM{kr
LS@zLDHg
S`4y2aipi'(!=i::,%i: i,$(
i,!=i/&i,3
ak #k{a
GOClELKPVq
5(3$"5.#"
1SPS*
KDBM(*
v4.0.30319
#Strings
:S]eku}
6 N n
"'"+"@"L"W"g"
.K.5.(.
 . }!
chuAutKLx60
G0Y1f570
ZrS3LwxIO0
4Ish7mzO1a0
8ZtJKtvlg0
vUIH7y0
HMACSHA1
RMCuUmO1
S3z799LRU1
DzJUYxJk0X1
hQfNTHL9qY1
7lCvIDZ1
IEnumerable`1
ICollection`1
IEnumerator`1
IList`1
CS$<>9__CachedAnonymousMethodDelegate1
X3BPcTkhf1
get_Item1
EWgLuxy1
HMACSHA512
Advapi32
kernel32
Microsoft.Win32
user32
ToUInt32
ReadInt32
ToInt32
6c2cef64-a589-4e8c-a60d-430779c24442
QKYVO2SUI2
aVNgxZypJ2
3dkbL2
n5zcptfJJM2
HgufEeGwmN2
PkUuN2
KeyValuePair`2
Dictionary`2
NkOS3mDig2
nHOUwtl2i2
get_Item2
QsLijr2
mq5Xs2
RlDvs2
nIshmkUw2
RIqwQ53
BFQVt93
RoNw8C3
5x1xC3
RaeI645D3
3r98xvED3
SlpNHpFR3
Tuple`3
NJrDZQMuf3
gq183Sj3
get_Item3
qnEiKq3
g5TFRgd6Bw3
9cH29PHx634
42jKRUbK864
ToUInt64
ReadInt64
ToInt64
HtrCAA4
4b5rUlh7E4
0WR6a1JF4
yAC1Q4
zGdXIbmstU4
ej10eRg4
AVwNh4
pd6fYn4
iZxhBAKbA05
ylYzlA95
bq4b8B5
66TBDFklB5
gBkSNP3F5
8mwSaP5
7TzyVgh5
LIhbsb5dk5
nAx0NIH1n5
ZFgPgVBFNp5
vhcfOs5
qasyFWhgx5
ToUInt16
ReadInt16
ToInt16
HMACSHA256
PRzGiHA6
vPvvQB6
guXvH6
1iquYQ6
4uGXU6
jU7I0yrW6
OrS2nsJll6
PGtowdkc4B7
VaultGetItem_WIN7
eIbIOtM1T7
G7QF93kXV7
Ckgsl7
4BiOIibx7
Vtjjx7
6umFL88
get_UTF8
SHbBH8
IgXEkVDA6L8
zYOrCYDRL8
VaultGetItem_WIN8
9EccR8
xqvuqs3SS8
0Km1DT8
qkJOzU8
hH2ZxY8
t053tpeczm8
NgLSn8
uR45hQrfo8
NUvQM8JGop8
zDCsFv8q8
AqpFy8
ebbpFF29
hnIsapUVj89
kvYz5ejJ9
0Z8mivJ9
nkvaTUX9
LANWY9
VhbpQy4hY9
yr8Z1X3ig9
YhWzruyknl9
EiqpViCm9
FyI2HTYm9
rm6OYuEZFs9
XShBKIQKv9
<Module>
JA8wGmT2A
7WC9YA
sy4ggigA
1UFhaWvEnA
QVYlVsA
7XvJVtA
MXagJ2J2B
Xf1sqW2B
kmM9pP3B
ilHfuEEB
J7G1w5IB
ri4iLB
AK4Q6O3QB
KAb5UB
BQyDXB
e9NTXYYB
gdpT2sB
zoGypsB
Alm4tB
XcbbbzB
v6WL2C
eBMvOgWbDC
QUqlJmpIIC
pFpVxDMC
iWroWC
vVvqFIEZntC
v5d8viewyC
K0NNAmdzC
9Q1vjrO1D
9iKo3D
get_ID
set_ID
fileHandleID
lpdwProcessID
processID
get_FormatID
set_FormatID
mmBPv5px6TD
Ezcp8OXvUYD
Fv6HNYEiZD
mxNSQTbD
f1PesMmfD
V8TllEpfD
873QRRWAgD
dYk6ClhuD
tOZvcE6vD
xcNtmH2E
5yhCpMzvM2E
FitntJE
hixP39z1SE
oPanEnL8pSE
AU75n9fE
Jd2ffE
jA6qoQnE
buzonE
vlnJDIqE
xHRTrE
Ti5NVZ0xuE
PmfJvE
FiO0pQwE
GTxMh3F
Ak5g3s4P15F
VE2DgxgS15F
Y2IZ247F
y0ck6j8F
X81if9F
4lFeoyIF
YFlalM4PMF
B26tp55WF
kfK3ddqaF
q60zJ8i5SiF
kODOlkF
AfrVblwF
zgsd7HyF
Zj9apZRDb5G
26Sv6G
fVpEEDjVwQG
KDVTdG
e1VEzRlkahG
ligxFijiG
SHUzWpG
XwPlhCi9zpG
Ly26Z1rVzG
NPTy1A06H
jencUrEDGH
YfTvJev8HH
tcInYLH
4RWNErdMJMH
ebgRSH
Hpu0UuLbH
ie6NJS6AtcH
BNVbdLgH
GJdojH
IaCwUwpH
h2xPFLqH
LPLkuH
JQ6GtFyH
axmx3I
e3OFvQWZCI
3n9answTFI
get_ASCII
RAtb5ah3oJI
MJqCqJquKNI
nxTyXSAZWI
hcTmgI
0qRl2ojI
sYojIJ
mKCMDnJJ
S9tj9Jh3OJ
YnHJQJ
abQWZRJ
IclVVJ
KRhSNEXJ
9CHcYJ
n0KkXuXeJ
ObzlfQ8nJ
cWzUAuctJ
GXX1P3Z86K
oWeAQ34Z7K
GFKm01DK
cCSUQcSHK
G40p7KK
hkhQLK
RSBm1OK
L2DkhP6OK
c2ZXsxoEOK
INlaWklVVQK
skQAKMtRK
jJ30bK
8tyK3P9bK
pRQRbK
sMaycK
g1o6As6gK
7W6v8xtK
rEOV3ihcuK
HBYqvqAl08L
wBKSfZeX0NL
rclO8yufL
BUUKlUcXDhL
J7AswA7ojL
pMwgd530LoL
msmjpL
4Mecg8AyL
zkb3xazL
XgX7Sj5FR4M
Cfgr8M
92T8GGxBM
jVjz6HM
9HkLMM
7wk8rrYYM
InzwRpvrZM
tVpFEOlleM
ouK6fM
RG5tkM
k4ci8FECmM
ogUuCRw8qwM
DgaMb7syM
E7xKWmzM
wg87ozM
BAvyBod0N
c9269T5DN
WBrg3mAKN
Z5Ke9rJSN
CeXeDXN
wrVPUgLXN
aVWqu7YN
ifiiMoN
JibmVLLRsN
QiGnxNi7tN
U3gk0TztN
7r6hwhxN
YZ2pHF4pm2O
1nhZUiL7O
sRYbMADO
BfoA7CGO
System.IO
9JEJaeMO
NjqXAyhDWO
q9NyPej3eYO
FDFvMPvYaO
ud2PcO
rm5gFRrpHiO
QERRkvcQkO
cxi8UnO
kdWhziboO
2ET6qOP1P
YKkM3P
3kR94Ki4P
w3VVp30VDP
REOnM7JEP
bEtT1KP
mUOAODfTP
HhF3ZP
We0Eo83kP
ruF8lP
cNpMB4MQ
9fPmtGPQ
zfUyJ0wjwPQ
xIAGfQ
Haw4jyoQ
3QLAvzsQ
uQ8eOA3Y9R
gSkcKE5CcDR
f0eMIR
GnW510RR
DbJVBAcR
RnkV5BDDkR
pEOmaaXoR
9LVoTpR
aSJyzHrR
NPDRwR
nIy8KF1EWwR
imzP7S
pzvSTDS
2bYYJS
zIhFzFDu7RS
qKsMlpS
ZQG4sS
SBE3EmxnuS
jVSjzS
LYqLC0T
fMee1BJgt2T
LTgDodWGT
nxpK1dHT
2C0MM7IT
gkzpPeyIT
iITiu5KT
qt0xPT
Q6qe3nmaT
eWicFqT
mMIQ5UrT
NIBNJfntT
jrqMBldLAwT
qLvX5OD1U
QEfOelx44U
UOlQ69d4U
83BQhXAU
PSfSIjAU
gUWRPDU
2zxl6CEU
FYS2juhhSFU
G1P2Bo1SU
El38CBVU
dmVIhCyTVU
AhClg2TXU
Rr6RfveU
fux2G7IvU
yKB6rA6V
OlVlWL8V
jqZTGV
get_IV
set_IV
tc70fV
AKdsuh0W
zkdVGe6W
0jgVsL9W
6ADMy9VJW
r80PwUXW
QxQO8cW
9tLUv2FdW
5sV4cTOULuW
gR8fzW
QCTIZL7X
sEBN5jXGX
hyc8OGMX
JsT7mjJSMX
59fV3AJUX
0QFazOfX
JMAZfjX
mmCf0uX
2Xm4bmBnyvX
B243yX
sfymcUEzyX
prTzT78Y
YDAvYk6fWIY
KXnfXjSY
b8hjTY
bctUeY
qB1sXBbWynY
J29OTLV9UsY
zf30nA7Z
5iNo8Z
EM2n1MBZ
7Hhld5w30TZ
3khYDTZ
uYy6K1DYZ
4t4TH9yhZ
wJmHMMNFCoZ
nOHh39a
0PgzPnHdPa
prHMRa
rbV2ZSa
HQOihL5Va
rnZe92DOnja
lNTu8na
get_Data
set_Data
ProtectedData
PropertyData
PVDixa
tzaMYOIKjya
M4GfshZ4za
H4QSCCB6b
XvuVHb
ewoJeP9Kb
TRhtM4mZb
mscorlib
7wIZoIfWlb
ToojDrsb
dgstlEee4c
RqXuYBc
75rFCc
sOMeICc
QJWyP5OdFc
q9kepHTc
Np4cSqVc
UVzHxhDKcc
oJ5IMscc
System.Collections.Generic
Microsoft.VisualBasic
WndProc
HookProc
lmoHpc
TUGSpc
FromFileTimeUtc
JOUyBd
get_Id
schemaId
pszAlgId
GetWindowThreadProcessId
processId
JUSjx4Rd
l3vxTUd
OpenRead
lpcbNeeded
SHA1Managed
RijndaelManaged
add_Changed
remove_Changed
get_LastModified
set_LastModified
_lastModified
Interlocked
set_Enabled
get_IsEnabled
set_IsEnabled
_enabled
lpOverlapped
samDesired
add_Elapsed
get_LastAccessed
set_LastAccessed
_lastAccessed
get_Reserved
reserved
OvQ94H9fd
UmQiCXfd
pPackageSid
get_IsInvalid
get_Guid
vaultGuid
<ID>k__BackingField
<FormatID>k__BackingField
<Data>k__BackingField
<LastModified>k__BackingField
<IsEnabled>k__BackingField
<LastAccessed>k__BackingField
<Password>k__BackingField
<password>k__BackingField
<PropertyStorage>k__BackingField
<Name>k__BackingField
<FileName>k__BackingField
<ApplicationName>k__BackingField
<Username>k__BackingField
<username>k__BackingField
<Type>k__BackingField
<type>k__BackingField
<TypedPropertyValue>k__BackingField
<Size>k__BackingField
<IsRunning>k__BackingField
<Path>k__BackingField
<hostmask>k__BackingField
<Version>k__BackingField
<Application>k__BackingField
<Description>k__BackingField
<user>k__BackingField
<hoster>k__BackingField
<Tasks>k__BackingField
<objects>k__BackingField
<Accounts>k__BackingField
<Keys>k__BackingField
<Lenght>k__BackingField
<Host>k__BackingField
<GuidMasterKey>k__BackingField
GetField
TrimEnd
ReadToEnd
Append
get_Millisecond
GetUpperBound
GetLowerBound
set_Method
method
1QUb2ard
Clipboard
get_Password
set_Password
get_password
set_password
JCtZDtd
J6hPyvd
05QhmUn3e
h5K37fDe
14VUZHe
bdc6eVIe
OXtMKMNe
lvoeNiEdRe
OGjjhrRe
uPvnSpKlQSe
BvgzcgR0We
xQVQNYe
7zcGTpg0Ze
OLiFce
Replace
QueryDosDevice
hInstance
IdentityReference
wScanCode
keyCode
set_Mode
FileMode
ShareMode
PaddingMode
CryptoStreamMode
CipherMode
SelectSingleNode
XmlNode
get_Unicode
get_BigEndianUnicode
IsTextUnicode
03lun9Qfe
FromImage
get_PropertyStorage
set_PropertyStorage
SerializedPropertyStorage
SendMessage
MailMessage
AddRange
CompareExchange
CredentialCache
ubjNWHie
EndInvoke
BeginInvoke
GetEnvironmentVariable
SetEnvironmentVariable
IEnumerable
IDisposable
ToDouble
get_Handle
RuntimeFieldHandle
hSourceHandle
SafeHandle
GetModuleHandle
RuntimeTypeHandle
ReleaseHandle
CloseHandle
DuplicateHandle
CreateHandle
GetTypeFromHandle
hSourceProcessHandle
hTargetProcessHandle
lpTargetHandle
bInheritHandle
vaultHandle
handle
Rectangle
ToSingle
CreateFile
hTemplateFile
DeleteFile
WriteFile
MoveFile
MapViewOfFile
UnmapViewOfFile
uB5kle
lphModule
get_MainModule
ProcessModule
get_Name
set_Name
lpDeviceName
get_FileName
set_FileName
GetModuleFileName
lpExistingFileName
lpFileName
GetFileName
lpNewFileName
_fileName
get_ModuleName
lpModuleName
lpBaseName
baseName
lpValueName
rootPathName
get_OSFullName
get_FullName
get_ApplicationName
set_ApplicationName
lpName
lpAppName
get_UserName
get_ComputerName
get_ProcessName
processName
GetProcessesByName
lpKeyName
GetDirectoryName
filename
get_Username
set_Username
get_username
set_username
System.Net.Mime
DateTime
GetLastAccessTime
AppendLine
get_NewLine
Combine
LocalMachine
Escape
Unescape
DataProtectionScope
get_Type
set_Type
set_MediaType
pszBlobType
GetFileType
ValueType
SecurityProtocolType
GetType
ContentType
get_type
set_type
FileShare
Compare
System.Core
PtrToStructure
get_InvariantCulture
Capture
HttpWebResponse
GetResponse
Dispose
Reverse
cbm6te
X509Certificate
Create
MulticastDelegate
GetKeyboardState
lpKeyState
GetKeyState
Delete
nNumberOfBytesToWrite
STAThreadAttribute
CompilerGeneratedAttribute
GuidAttribute
SecuritySafeCriticalAttribute
ExtensionAttribute
AssemblyFileVersionAttribute
FlagsAttribute
CompilationRelaxationsAttribute
ReliabilityContractAttribute
ParamArrayAttribute
RuntimeCompatibilityAttribute
SuppressUnmanagedCodeSecurityAttribute
set_UseShellExecute
ReadByte
ToByte
get_Value
TryGetValue
get_TypedPropertyValue
set_TypedPropertyValue
GetPropertyValue
set_KeepAlive
Remove
Z6Ni1sxe
get_Size
set_Size
dataSize
get_StorageSize
lpFileSize
get_NameSize
volumeNameSize
nFileSystemNameSize
get_StoreSize
get_ValueSize
get_HashSize
set_BlockSize
chunkSize
get_KeySize
Serialize
Deserialize
Initialize
Finalize
Resize
r8qhY1v33f
dNySzXSKO5f
M8FMLAf
X4loEf
0FiCIUJFf
oq5M8If
EnszzDNf
SizeOf
get_ItemOf
LastIndexOf
ifnvdsDVf
acMhdKpef
cchBuff
O0mYmf
DJLGKgnf
IYDc1Ntf
E2As1xf
MrDcBg
YYY3Gg
9fzGQnYQg
sJjTZ92sXWg
RbFRyBXg
get_Jpeg
YHFX0tDEkg
byaajoaBKmg
System.Threading
get_Padding
set_Padding
UTF8Encoding
System.Drawing.Imaging
get_IsRunning
set_IsRunning
CreateFileMapping
FromBase64String
ToBase64String
EscapeDataString
UnescapeDataString
lpReturnedString
GetPrivateProfileString
ToString
GetString
Substring
System.Drawing
cZhKNqg
get_Msg
X4uwRKPug
VXIglRxg
S7ZMX1h
KxtWFfTFl3h
L4Npip9h
wEKvWrKyNAh
54EUMK8BxUh
pruroeNrYh
Q66xtvah
dwMaximumSizeHigh
dwFileOffsetHigh
SLpDMQXih
Kq16Vnh
veTV4sh
ComputeHash
mE8sba9th
get_Path
set_Path
get_ExecutablePath
GetTempPath
GetFolderPath
lpTargetPath
get_Width
get_Length
SystemInformationLength
ObjectInformationLength
set_MaxJsonLength
ReturnLength
maximumComponentLength
GetWindowTextLength
EndsWith
StartsWith
SkUX5zh
Zt080i
eXzhN7u51i
AE2i7i
ePdBeWf7Di
naWIVlDi
zaMSz4Ki
fDD5UV9Vi
BRFV0Xi
gjIf81rcbi
8rWf5W5ji
ALY1KXNNmi
PtrToStringUni
StringToHGlobalUni
A1wTDWycui
A2EZGSQiA4j
TEYnjleyA8j
OPbQmyAj
m87Cw5RGj
Yo5RZMt2Hj
X1jI8H6Qj
ng7YnBdj
W3uJ7uDl0fj
skvrnUvr0ij
lV2q6Klj
vuhzJ5Ad2uj
6K6YUtxj
rrN2iAk
dUbBKpZyBk
mQLunGerbJk
WFyxOk
AsyncCallback
RemoteCertificateValidationCallback
get_ServerCertificateValidationCallback
set_ServerCertificateValidationCallback
callback
get_CapsLock
TransformFinalBlock
TransformBlock
zQg1eQek
ND6sZbik
YxlNbjk
HVCcP6ok
idHook
EjkhsDpk
gJhNMsk
get_hostmask
set_hostmask
Pzgk4l
sIUhAMl
He5Fp6jPl
z5WD7gSl
6FSrPYXl
8qESJ2pFSYl
AllocHGlobal
FreeHGlobal
Marshal
NetworkCredential
Decimal
System.Security.Principal
set_Interval
Rijndael
System.Collections.ObjectModel
System.ComponentModel
System.Net.Mail
43sA0jl
Kernel32.dll
kernel32.dll
User32.dll
user32.dll
vaultcli.dll
psapi.dll
ntdll.dll
bcrypt.dll
System.Xml
set_IsBodyHtml
set_SecurityProtocol
Control
ZlSNjrl
set_EnableSsl
HJODOwl
5A03G1EC2m
p9WQC1qVa2m
J9vKD1ao3m
n3xnsl5m
5TT9hcRm
FileStream
get_BaseStream
GetResponseStream
CryptoStream
MemoryStream
get_LParam
get_WParam
get_Param
lParam
wParam
get_Item
set_Item
VaultGetItem
vaultItem
OperatingSystem
SymmetricAlgorithm
phAlgorithm
KeyedHashAlgorithm
algorithm
8bXoXJqnalm
fOBIOcmm
Random
D0rzVoAdrm
ICryptoTransform
GTgrLf13n
J4hun6hB07n
rxZ51ZF6PZn
ToBoolean
IsLittleEndian
4PTIIdn
CopyFromScreen
get_PrimaryScreen
lpNumberOfBytesWritten
X509Chain
ChangeClipboardChain
p989ln
get_OSVersion
get_Version
set_Version
get_Application
set_Application
get_Location
GetVolumeInformation
NtQuerySystemInformation
ObjectInformation
pszImplementation
System.Globalization
System.Web.Script.Serialization
System.Reflection
PropertyDataCollection
ValueCollection
MatchCollection
GroupCollection
ManagementObjectCollection
AttachmentCollection
KeyCollection
set_Position
CreationDisposition
get_ContentDisposition
SearchOption
Win32Exception
CryptographicException
ArgumentOutOfRangeException
ArgumentException
get_Description
set_Description
get_StatusDescription
_description
System.Runtime.ConstrainedExecution
StringComparison
l1Dokpn
tNQ1RXqn
Intern
add_KeyDown
remove_KeyDown
get_CtrlKeyDown
get_ShiftKeyDown
get_AltKeyDown
1rtGjinBo
iixi9Jo
VovqaPo
CompareTo
CopyTo
k2o43X602Yo
ImageCodecInfo
FieldInfo
FileInfo
CultureInfo
pPaddingInfo
FileSystemInfo
MemberInfo
ComputerInfo
get_StartInfo
ProcessStartInfo
GetLastInputInfo
DirectoryInfo
q95iko
bCWZro
qJ6Ee2so
eVqQgso
bqt7xzUB9uo
t3jz3UBY88p
HUJM2eyLCJp
N9Z5Np
IOXKWYVExPp
add_KeyUp
remove_KeyUp
Ns8PMVXVp
dwNumberOfBytesToMap
Bitmap
Weo5d2Xgp
L42Uhhp
rFFICSJZnp
AWQ98Zebqp
m4hUrQnbqp
8cXipBdltp
lfoNeDcvp
iqvkvp
0vnr6mi98Dq
g4kq4Jq
UMx5Uq
JG5S3s3FnUq
3Rf95tKZq
gS7Ggq
System.Linq
tB3XqE5tq
zC8vM5r
rRtI76r
D8rZ6vx998r
ecFlNAr
3E8cBr
zNJ0ylVMvJr
D9ZPmUNMr
v9P4ujgxSMr
ToChar
lpChar
DirectorySeparatorChar
73EnuCir3cr
szZgqQer
volumeSerialNumber
StreamReader
TextReader
BinaryReader
SHA1CryptoServiceProvider
MD5CryptoServiceProvider
RNGCryptoServiceProvider
TripleDESCryptoServiceProvider
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
IFormatProvider
StringBuilder
SpecialFolder
sender
Encoder
volumeNameBuffer
fileSystemNameBuffer
buffer
ServicePointManager
ManagementObjectSearcher
SecurityIdentifier
ElapsedEventHandler
LjL2mer
ToUpper
CurrentUser
get_user
set_user
EncoderParameter
BitConverter
get_hoster
set_hoster
BinaryFormatter
SetClipboardViewer
ToLower
JavaScriptSerializer
JhOfpSgr
get_Major
get_Minor
GetLastWin32Error
GetLastError
IEnumerator
ManagementObjectEnumerator
GetEnumerator
RandomNumberGenerator
.cctor
Monitor
CreateDecryptor
CreateEncryptor
D0AKY5Gtr
passwordVaultPtr
ReadIntPtr
WZDFFxJfq1s
67JC3s
YDuHW8s
CaStHwSs8s
DtzO7o5Ds
gigtqZZEKKs
Graphics
System.Diagnostics
get_Bounds
Microsoft.VisualBasic.Devices
System.Runtime.InteropServices
System.Runtime.CompilerServices
GetInstances
get_ChildNodes
Matches
GetDirectories
get_Properties
ExpandEnvironmentVariables
GetFiles
EnumProcessModules
NumberStyles
GetSubKeyNames
ReadAllLines
GetProcesses
System.Security.Cryptography.X509Certificates
FlagsAndAttributes
lpFileMappingAttributes
SecurityAttributes
Rfc2898DeriveBytes
ReadAllBytes
GetBytes
get_Values
GetLogicalDrives
fileSystemFlags
dwFlags
ElapsedEventArgs
get_Tasks
set_Tasks
yUhmFrTls
ICredentials
set_Credentials
get_DefaultCredentials
set_UseDefaultCredentials
Equals
CreateParams
VaultEnumerateItems
System.Windows.Forms
Contains
System.Web.Extensions
System.Text.RegularExpressions
iterations
System.Collections
set_MaximumAutomaticRedirections
StringSplitOptions
RegexOptions
options
get_Groups
hiNDRrs
get_Chars
GetImageEncoders
System.Timers
RuntimeHelpers
EncoderParameters
SslPolicyErrors
BwLxIoaNss
SystemInformationClass
ObjectInformationClass
ManagementClass
dwDesiredAccess
FileAccess
processAccess
get_Success
hProcess
OpenProcess
GetCurrentProcess
lpBaseAddress
MailAddress
get_objects
set_objects
VaultEnumerateVaults
get_Attachments
set_Arguments
get_Accounts
set_Accounts
get_Exists
get_Keys
set_Keys
get_ModifierKeys
KEp8F5zs
LpBvcdf6t
YMJawKt
QpO5PpK7Ut
068AptHGYt
Concat
AppendFormat
ImageFormat
Subtract
ManagementBaseObject
hFileMappingObject
hObject
ManagementObject
cbKeyObject
pbKeyObject
NtQueryObject
object
set_Subject
Collect
set_AllowAutoRedirect
flProtect
Unprotect
System.Net
QRo5tret
offset
mm3dMwoKft
Y7ALd2ht
get_Height
get_Lenght
set_Lenght
op_Explicit
WaitForExit
rGJcsYA3gkt
cbSalt
bztAChhlt
VaultOpenVault
get_Default
lpDefault
pcbResult
IAsyncResult
phkResult
result
set_UserAgent
SmtpClient
System.Management
pResourceElement
XmlElement
pIdentityElement
Attachment
Environment
XmlDocument
get_Parent
GetParent
get_Current
get_Count
get_HandleCount
get_TickCount
vaultItemCount
set_IterationCount
vaultCount
BCryptDecrypt
BCryptEncrypt
TrimStart
Convert
set_Port
HttpWebRequest
XmlNodeList
ToList
get_Host
set_Host
ICredentialsByHost
set_Timeout
GetKeyboardLayout
dwLayout
cbInput
pbInput
cbOutput
pbOutput
get_StandardOutput
set_RedirectStandardOutput
MoveNext
System.Text
ReadAllText
AppendAllText
get_InnerText
GetText
GetWindowText
luQ6o93u
roOHaivFu
S9nBIhfKu
k0jAau
L36yKxz4ju
sgsHeou
25Tl1j7fiou
lIoMDi3v
7VszhCv
G1hkCgIv
lS2vKv
fGAUUTv
tvdG0h15Obv
CFutR343cv
JI7Op1Lz6jv
aUK74QQq5pv
shj3ZFX6sv
YEXGsv
XfiZxv
WMArmfK4w
HHt0uoU18w
7TBLX49w
reYi5IHmBw
bSp1SL5kJw
rOvXuHcTKw
X2r1TmOUw
zBEWNLVw
IvI7Suhaw
tR3bEbWbjiw
IhOAaWlw
dwMaximumSizeLow
dwFileOffsetLow
get_Now
GetForegroundWindow
NativeWindow
set_CreateNoWindow
Z9bcZBc8urw
2PhrWvw
eTip3x
3DtdbgJ5x
kECuXGySJ9x
rnv2uYhZf9x
ToUnicodeEx
GetModuleFileNameEx
RegQueryValueEx
GetFileSizeEx
UnhookWindowsHookEx
SetWindowsHookEx
CallNextHookEx
RegOpenKeyEx
MTI3GNGx
i3NieABBvPx
dSJsyefQx
lXdWNHVx
03kJtXgdWx
ucchMax
qAZ0xgQRMix
QSprgc8tjx
PmsVSlx
z5bYyEzasx
lQO0V9xx
uVdyAObVIy
ToByteArray
InitializeArray
ToArray
ToCharArray
Consistency
set_Body
xEgZ4ey
get_Key
set_Key
OpenSubKey
subKey
RegCloseKey
get_GuidMasterKey
set_GuidMasterKey
_guidMasterKey
ContainsKey
wVirtKey
hImportKey
BCryptImportKey
BCryptDestroyKey
RegistryKey
System.Security.Cryptography
GetExecutingAssembly
Multiply
5JiFEi4Ooy
BlockCopy
System.Runtime.Serialization.Formatters.Binary
get_TotalPhysicalMemory
Directory
Registry
get_Capacity
Quality
op_Equality
op_Inequality
System.Security
System.Net.Security
IsNullOrEmpty
BCryptSetAlgorithmProperty
BCryptGetProperty
BCryptSetProperty
pszProperty
mDIR0z
Enthml5Dz
tNEFZnNIz
hVmXiPJz
cuWk4JTz
WTM2NHiaz
WrapNonExceptionThrows
1.0.0.0
$b6a735cb-fb4d-4e01-90a8-eab405e7044f
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
pp p!p"p#p$p%p&p'p(p)p*p+p,p-p.p/p0p1p2p3p4p5p6p7p8p9p:p;p<p=p>p?p@pApDpEpFpGpHpKpfy|y
k#n+n9
45 6!7"8#9$:%;&<'=(>)?*@+A,B-C0D4E5F6G7H8I9K:N;O=QATD]FcJuPvTwVxYy]z`
BACAIHJHQPVUWUXU\[cbedfdgdhdidjdml
Accounts
logins
sha512
credential
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
FileDescription
FileVersion
1.0.0.0
InternalName
6c2cef64-a589-4e8c-a60d-430779c24442.exe
LegalCopyright
OriginalFilename
6c2cef64-a589-4e8c-a60d-430779c24442.exe
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0
Antivirus Signature
Bkav Clean
Lionic Trojan.Win32.Stealer.12!c
tehtris Clean
MicroWorld-eScan Gen:Variant.Lazy.364860
ClamAV Win.Packed.Generic-10003641-0
FireEye Generic.mg.598f6a222625e007
CAT-QuickHeal Clean
McAfee Artemis!598F6A222625
Malwarebytes Spyware.AgentTesla.Generic
VIPRE Gen:Variant.Lazy.364860
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Spyware ( 0059d5311 )
BitDefender Gen:Variant.Lazy.364860
K7GW Spyware ( 0059d5311 )
Cybereason malicious.e6689e
BitDefenderTheta Gen:NN.ZemsilF.36662.om0@ai37!@f
VirIT Trojan.Win32.Genus.SUJ
Cyren W32/MSIL_Kryptik.JRO.gen!Eldorado
Symantec Trojan.Whispergate
Elastic malicious (high confidence)
ESET-NOD32 a variant of MSIL/Spy.AgentTesla.F
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 99)
Kaspersky HEUR:Trojan-PSW.MSIL.Stealer.gen
Alibaba TrojanPSW:MSIL/Stealer.fc415a9b
NANO-Antivirus Clean
ViRobot Clean
Rising Spyware.AgentTesla!8.10E35 (CLOUD)
Sophos Troj/Tesla-CNT
Baidu Clean
F-Secure Trojan.TR/Spy.Gen8
DrWeb BackDoor.SpyBotNET.62
Zillya Trojan.AgentTesla.Win32.7021
TrendMicro TrojanSpy.Win32.NEGASTEAL.YXDHEZ
McAfee-GW-Edition BehavesLike.Win32.Generic.dm
Trapmine suspicious.low.ml.score
CMC Clean
Emsisoft Gen:Variant.Lazy.364860 (B)
SentinelOne Static AI - Malicious PE
GData Gen:Variant.Lazy.364860
Jiangmin Clean
Webroot Clean
Avira TR/Spy.Gen8
MAX malware (ai score=87)
Antiy-AVL Trojan[Spy]/MSIL.AgentTesla
Gridinsoft Spy.Win32.Keylogger.cl
Xcitium Malware@#1jhp519ov6l54
Arcabit Trojan.Lazy.D5913C
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan-PSW.MSIL.Stealer.gen
Microsoft HackTool:Win64/Mimikatz.A
Google Detected
AhnLab-V3 Malware/Win.Generic.C5459834
Acronis Clean
VBA32 TScope.Trojan.MSIL
ALYac Gen:Variant.Lazy.364860
TACHYON Trojan-PWS/W32.DN-InfoStealer.243712.I
DeepInstinct MALICIOUS
Cylance unsafe
Panda Trj/Chgt.AD
Zoner Clean
TrendMicro-HouseCall TrojanSpy.Win32.NEGASTEAL.YXDHEZ
Tencent Trojan-PSW.MSIL.Stealer.ho
Yandex Clean
Ikarus Trojan-Spy.MSIL.AgentTesla
MaxSecure Trojan.Malware.74396735.susgen
Fortinet MSIL/Agent.F!tr.spy
AVG Win32:PWSX-gen [Trj]
Avast Win32:PWSX-gen [Trj]
CrowdStrike win/malicious_confidence_100% (W)
No IRMA results available.