Static | ZeroBOX

PE Compile Time

2024-09-24 21:15:03

PE Imphash

b2441dba6e8763e48513cb7a162594f3

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x000898a4 0x00000000 0.0
.rdata 0x0008b000 0x00025c12 0x00000000 0.0
.data 0x000b1000 0x00007334 0x00000000 0.0
.pdata 0x000b9000 0x00006090 0x00000000 0.0
.vmp0 0x000c0000 0x00378993 0x00000000 0.0
.vmp1 0x00439000 0x00598ca0 0x00598e00 7.91132746171
.reloc 0x009d2000 0x000000d4 0x00000200 2.10622313462
.rsrc 0x009d3000 0x0000c740 0x0000c800 7.9199425802

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x009d30e8 0x0000c4b8 LANG_ENGLISH SUBLANG_ENGLISH_UK PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_GROUP_ICON 0x009df5a0 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_UK data
RT_MANIFEST 0x009df5b8 0x00000188 LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x14084b000 HeapSize
Library USER32.dll:
0x14084b010 MessageBoxW
Library ADVAPI32.dll:
0x14084b020 IsValidSid
Library SHELL32.dll:
0x14084b030 ShellExecuteA
Library libcurl.dll:
0x14084b040 curl_easy_perform
Library ntdll.dll:
0x14084b050 RtlAdjustPrivilege
Library USERENV.dll:
0x14084b060 UnloadUserProfile
Library NETAPI32.dll:
0x14084b070 NetUserChangePassword
Library RPCRT4.dll:
0x14084b080 RpcStringFreeA
Library WTSAPI32.dll:
0x14084b090 WTSSendMessageW
Library KERNEL32.dll:
0x14084b0a0 FlsSetValue
Library USER32.dll:
0x14084b0b0 GetProcessWindowStation
Library KERNEL32.dll:
0x14084b0c0 LocalAlloc
0x14084b0c8 LocalFree
0x14084b0d0 GetModuleFileNameW
0x14084b0d8 GetProcessAffinityMask
0x14084b0e0 SetProcessAffinityMask
0x14084b0e8 SetThreadAffinityMask
0x14084b0f0 Sleep
0x14084b0f8 ExitProcess
0x14084b100 FreeLibrary
0x14084b108 LoadLibraryA
0x14084b110 GetModuleHandleA
0x14084b118 GetProcAddress
Library USER32.dll:
0x14084b128 GetProcessWindowStation

!This program cannot be run in DOS mode.
`.rdata
@.data
.pdata
@.vmp0
h.vmp1
h.reloc
@.rsrc
0piH%Kb
y<&*dy
^L]!lP#uW
`_4IYC
;e+6_dW
OT&C*!s
C'Nsp|
w!e}H2
\8%wM8Sa
7qbp~i
>~*L(~T
Kf.Hy /
[7Nv2[[
+]ZM&B
N*qX[GTxjx
%i5'|Z
TZa//o
]lN'|x
,dH m3
{m|to
t/P_Cr
1I[ype
kt$:Dnt
a Z!I+
5<kSY5
3Zdj"t
dp6CNx%F
pE*'/(
/27PJh
"`nE`K
)m_`n]
gk`-iX
Af<?8$)
w3D^`h
&oH\<m
Dl`V1^
}GD3?lM
di$w|W
QcR[".c
BXcBI7)ci
M|UEZI
-~VQl
uviFb|$
o06lm|w
5DK\7l
I@*axY@)
$tLYooak]p
o}Xxgk(
,_@c|=\@
hH@[y$
%<|'"0
i9C=*
Fd5=SK
Cg`T`5
.J+HFP
$&}I*DSU
U?sB8m
wDf1/g
lUa%zaU
g6+!{0_
bRt3
{fP[A@P9
Lnd!#y
'H95 B
0M7/dm
arG3UK
]qGp!J
|fuAp$S
XCpMI4
^KRe ;
kE@?dED@
>V4B~>
"kg/L/PKd
:#h;Gq
%$Fi/C
/enMS<
=nzs:nz
N#5-,?
V-hb{z`
PT`(jeO
zQ0VG-
iGAdoi
m-~oIB
gsQ9RX
4]L=<s
{@3Mb{=[g
~cLy5
6x7ELD
!^~h0jWZv
~Lx~Si
~WX=,
|5jq/Y
d](6E{
_W(s!|
GW54\A
gt]a$%
a<q.9q
m,Oh[m
17M7<m
T3_v'9
6|[J/u{
'OX>v`
fs$#u3
ltd(F
:ks>>A
&ca)Js
UJma@'JN)
Lm{3E4
x0+v@
4FHFvG
k^6pQ7=*1
JY?XHv
HB#3GL
#_Tt+)
S@}<iX@*
'WlLx
KrH;j'h
$+3a$
{D^AyjK^k<W
2YQcH<
'bD\fX
u>(9u%[
e0p~^Fq
.N?y4r
FD4u#;V
OtYqgp
+u"^dJ
[B{j'
)25mvV)
;W!)a"
`v?T?$
ARCe<~
kP]rl(4
us#1])
cduSc\
.jt85n/T
s/@NUu
/Yj]nn
xuGBF\x
6Q.n@;_w
SV=+1'%
"D<sa4
dUQWf
/oA<%2
R|?KCmG
o2.U48~AJ
BXno6h66..
C{4C[L$W
1L;+km
NetUserChangePassword
\`<-2>S
cF/nbhF`
(c'd16
)cvwNU{
}WVH1Sh
fEqJd=I
/[J.v.
~sB>sl
FlsSetValue
|VJ;k)x
;idruc
v$AFkA
%-~fNP`
j3%}";
HeapSize
14'b`
u}rjZ*
}xEGs2
dz[@9r
sD"-Ym
q0V`j`
Zj5?M~d
9ZP/Ht
1GSoAa
j,EK_
46E>Wc
tyef/
H&bi/J%
J)Ty `
$:F2<n
QL;f`#
7P`w],h`
M9U2B17
ujQ~1@
)WIq`x2y
Q6rt`aT
C`h(nq`
ZaC)0 E]Q
<%oa`"7
Puug%H
ZU( o[U
=9t/`P
F$<cEX
66lB`
8:6{{n
.%x[Pu
"Q~D_-6
P LIbI
C6:HX?
ce(twus
pPS"tO
Hk=vxXM
LJxB[t
_U0u7^
MZ'H[4
_Z#SU{
|Z]*Xj
:2zanb=
n!|FXR
"lOmW{
@Nz_@D>ZA
Y#ZXZT2
LocalFree
K8G6Ag
s/!RQK
m`].e
:t2/K?
+Gt~5U
D3*=KJ
f}`yddz7
N[I]j?
[x5"6[
k2Usv
I `{^r
`zu\'c
7Yhhh5Y
`Fm+*Y=
`6/9t<YUC
#w7;U~
XuHOy0
V3IIZy)
GetUserObjectInformationW
,Jk*1
7AX3RH
i$8|oR
@@]<8K@
BJ@(M
}E%B[
&?gOk'
U'=_xSz)rV
`i3R6GxT
=:fisIG|i
*hz"D,5
[=Eg4[
BBe{>.
S:q-y
u!J@D>ZA
F*iYY|
qq|d'<
l,7ns%kt
wgjaa'
{+g|M$
{+2t6^
;Ac3}A,
Wa3SDh
r/.@%t
e}y<z{
rL{Dq^7L
<B7avAj
H/_*(:oLh'
tW9!!]
FCfd~b
qMHT{l
;u@/V _V
]Bhi~yV
rR4#Ow
9h6MUL
W7':J
FreeLibrary
|3z}CAA
}1&^Lwso
-N%Z%f
Q(,x7;iI^
zx>2Uo9w
$w]<{Ty
1c`P_ef
sCqMGg
[WC m#
xT?zoH
cuwSK!
c'.O$n
`OHTQXP
kM}o}.
]{)q<=E
>=rI
0h /$5h
_O;(1[
}u3c(.z
c<k!}5
M){q?q
DTK8%y
&r2%.Ef4
p2k;=xJ
2\:?8p
!.0h,o0!
f/4:"`
WTSSendMessageW
hkIjHq
d\/;x5]
kuDu+?
VM4BFmp
]RS+Mb"
AfCr`d
|x4|7<
0-pbGK-
O^@xoo
B20> {
xNdFyh
[rb%k+>
3G`%I
eKlRwI
C`L'>.
2I31!h
21c'rd
mXa(>@
yRx"][
DuaU)LL
NIv5H:
b8y\y=
.+": F;
I%*~/C
$OEG5U
J$Jo`;az
w}@vDg
/)h?E@U
|Hn&5D
~21XHx|
n<\`-|
`@]O[H
6f70QP
?7R hB
u1k69@
9PgITM
)/7Z>?
GetModuleFileNameW
U%b&Vd
s]xYV*)5
4k?[9V
#jxH$s
ZB#&C-
a|=G{o
;FD#l"
eH5A*e
r1TMJ
Uzt}lr
'um*G9ei
wOMP:;9
={R0NL
-,+4s9
i@YwzY
wLFLuL
W@OqEk
/1>k/
'Tm{]7U
W;o95l
:<55u5
:w$JZ=
`+"p\R
X:;ZJ%@"
S%^L";
Yz8g4RK
)_][~X>.
3q?|7\
yFp/0U+
.CKt@D
xGH@'itA
ACeJ:g
.kzdB(6
0hF7ty
D~p%MjsS1
:R}UM}
\mHDnF
S[@tC\
4I@Re;
WmKbZNM
D1}h#J1&
h3I]bu
h5kYxy=
LKyW-w
GetProcessWindowStation
RU`{[
oX&&XD
.Bh[{f~
H)}ETs:
_8U%}3
an0i}#3
Y9.^Fb
)fK~<d
.PriFePL
z,sLhA
fP/]@y
dwL~|m
)+WVQI
O$>-65
H@D>ZA
~G>ZAK
fBdhng
%oNS6pP>
T#M$\f
CMZ*/l/
D{'Xo1
|klqo>g
*hI+:wE
Dg}aSL
Z+*>3v
ySZ575c
h@cz:p
%u:oD'
b6;Hd<7h
G71F,7
wYZU2`yL-
ExitProcess
RtlAdjustPrivilege
69N|{A
?OO'Fz
%v`V/F
-lso5#
1i" Upk'
%Bz0V~
'Z@D>ZA
ptl|)
?9Y.9A
l._Hv
P#0'Fi
!vl~Y:
%4awLO
+icVkE
/E?Cnd\
v\jQlCg
*WUV*(KSp
Byey_CNm
SetThreadAffinityMask
\sZ`Pz
Jup%:*9
curl_easy_perform
sM,'-n
lxAC$}KH
~jHVjO
I"K:H9v
\RSfxc"
aVS,j^&
d.IV(1X
EOb!X
XEJb4
oY<fbxYx
$~OFCY
lN0.RQ
DJdo!8
Afh@%n;5QX
>WzDEl
e v+Y4
R[AeLP
0wW;m|
}['Zy^
nfk%'@"Bt
5e~<4>vi
6NU@:|_V@D
y:s>ZUSb
ifk8LR
<"a$U_
s*jog,
O63Kn8
+lJEB#l
SetProcessAffinityMask
@g|=zB
:~ld1f
w;j/`fo
,D7Yuk
vw0\W+0
)GQ/0 j
#Fr82}
d/S<?b
eg"L[f
k/y7?m
XFk@!dn*nZ
b;/rEh`^
r|fdL!
"r3];9
P/e/ek
z`Y?;?OW
PN7M4]
%vd~r!C
Sr((1z
^C/hUUx;G
tam{2p
W@53x\@
PR?ux:
w~v-aKB{
JQxBfM
;hhb3#
*+7HgJ
X^xXt_
]ifGK5
*YGaq\
m~(-|U
_8=t.{
i%$FLj
X7@mm<
M'Y;\o
{7O1:N
@VSD)+
Y@3O#w4
?sNH6dnE
Y<mj8E
]RY3&a
R,m2Cq|=
v{m03"
shW(dW
oOfy%>e
4j{"!F
$;$wu
%J(HeA
<zG*GM
)Mo~_P
BNvz6F
m}hzY.
}sr/>/v4
#gA&T_
f$P?:s
"x{3Oi
/4+X;u
qA(7@0r
qrTSi
`3h,$-
!>$E\(Jt
UwaNad
vJnFVQ
!WW#FQ
EpCrGgO
<R)nO
p/2_Ut
Yfo=4`
C/Yroz0`
iV(v:f
?sgv.9
mw[{h?#o
G[9$~!
5\(/!e
?<|R2A/
<Wp1/e
sw%k|FD|
FHw[oz
]e4z6U
4<o-r)Q
ehu-<E7
]G/B!5
*\UYXn(
UM*qq7;
TkBw 4
&rF6kx
6sf1Cu
``~-}Ac?
,,fkU8
:5Ac%;lPnTv_
_"MHZ&mr
7+0GVZ
_IT_!+
3\FO:k
y'79c$"
9 97d<
RMAIfI
FfNl1?
'0AT<5*
zw">Z%
[dNlq=
oWv25g
hw'g;,
\[i(k
\])J8x-
S,V .
 Y|Ag
(X&~e9J?
*513A+
Bi:<-%
1b wM#$
b, n@9
Bu9{-t
.P{0B=$
+H.+gp
5n%j"1jgn
BW %m,
G>!4ogw
|$jtl}
xOTH'<3
QsZi:kBv"
1(}8@A
`W!fqS0
3G_Bm^
1X,:vW
#E$K=@z~
5s;}kW
_#=")^Up
dmkGjxk
&~a'S{+
QPQ$%+
_&H\&H~
%7c_Y1`
Q-W&my\/
*vy'.s7h
-RyGF#Tr
H9!hBa<H0
zP;+tes
R33$F?
~bx7iY
|wUGJ4mH
"4c)hyv
3M6@z='
fMwYc@
br"8?av]J
ytWQcx,
K2V"ly
+)p/}g
D4+j^A
f@!vk;
z\\x)5
RcmbPU
**!NHtb
\`oS/L
<m[tZ=:
-f!KC$I
@W0>C!
^-mG*K
Y@fmHZ?
}?S%"X
kRZ+!0
gCv*,`
yHi|k/j
Jm'1zf$
K;J(8Y
f3bL]>
k+fANi
pgjv`q
*8`h$E8&T
YaU<.'
K,8hKdN
*={ +s6
6+y:{
U&^gs:m+
tT1ID}
4v5@A_5
~bSNs/x
feq?+(_
hCXM%|,w
D7mm#"
E>A*>:GDt
Mqi7v:
Mh$%%V
S)@W7-
<Xi1lH
zji4?f
P\ix"}
a=_g-b
2Ztvvq
(G*QA_-
o_7Ol!
rkqyb7
5FLJI%
s@{*sO'
wiahAd
H<fv;N
MaVu`,/
f)P@3.O
qcaKB@
8R`$#~
`3p!D|Pe+1
'z-!&9
=-6jXi@)
hPV[.,
3zE<<a
'5.gM_p
IF@rE>:
%DS%w}
H["U=T3E
6fO_-+/
_rvZ/M
@v7C@8
+1_~m?
j'#6=Sv
~4"\UR
!^#Gn_G
i-?*>v.
/S*Ccy
1Lbh~!2
pJ`A1(F
!LL-h4YG
K*gNk4
VL!~&@
q+!8.&
kp$t8Dtu.
/^pBd@&
Wj\t+f
}oM/qa
I8u#"E
&4~>p#
?tLHX@
=Wi:8
O2)>9t
6Ir%x
}VW\G4]DF
yOt[{v
3D@A.y
Zx\;Ov
|y~IDb
Az`4|{
3m6}T-
WMymJ+
=FuTl~
Qc-t,O
z7JL\ "es&us
sw&-da
wun?>b
ie=b0*
|6R^x_4k
HO8Op5
jSG82M
vTbYryUi
9#x#5V
ohTRso^9
%BwJB@
0Nh|u>
0)DqT<w-
dK[@.@
rmqexN
RTSduY
tysBF?&
rz*B;B
Rh_C5j
MPc7 H
OJu,byv
PRyz/I
VHg;+[
]a:.3?
DxGWa
Dk_+rW
7P>fWE
?`^e't
Cg1Tac
G2f)U~G
zC(G!o
:+ -B_Q
D5w$Vv8
$S`v493e
N;&^B?%
eF%>'d
G492sa
-&)3k!
J$Y9t%,OJT
=2F oY
/hRl2n`
fY5dk-
X'{=jK
n8i!6kV
YxNLY%
ogNch:
%QR,pTA=
c!W^#v
N;4;/c%
is-F(b
c;K&`;Q
$PrVH!
AZCQOm:
<,slGb
;Xdb83
qm;+A
O{pvd
7a|]10
rBt?_D!yZ
_eh&=[tm
?qsw|&
sO2YKq
%$oapT
UD 6ODA
2qBo*P
Mx>g/$
7Sp`w,
5<%'{H
o@f4l}%\&
`\k:8A{
XQN#h,
tAMQ^_
'>SeK2
oq) 4T
?F{RN]
[ejR[f
(lkZ$R
AT%`o=
w%=Q'9i
v2r(CJ
x{<!Y;F
UAmw a
nR3O}x
*pS;~<
&R+z2%Ge
ov7u:
&[AKZ5
e->XZq
=dw2'*
Hy((EI
DTl[%bs-
09LQLP+
k];_TwzOZ
JnS"vh
ZNNZ-F
YS]BTNj
8>kJLc K
bRzW<r{
CKdQ[x2
FA~D"]
yb4zPT=
mY}4_Tdc
\ymKH{
G\y@X.
[ZZ|^4Q
6|B}9$
+L4416
2u"VFgI
V_O2}E
+I7n10
$%/_la
=LE$0z
csL@B&>P
:8t{)9
4tf,bc
a=\iGP
d:d}OD
}.q5]#
O%nITC
#h`eYb
\0v%Oln;l,Zg
$*Kj C
c6Czb
L'U9I]
`S89.s
C;5vaQ
ZB"sWK
$oSg\r
(?%JHE
u`"yVW?
}W\/Ag)
rLC6A
eA0yAQ
'yyN@g
w~NQ|8
1I K%q
}<`FWWM
(WB#ci-{
p7_7:s
,~QG}:]WZ
8TW1BM-'
27zf2X
|;/74\
|+0-"-
XFFn&
[;@_{-y
U5g&jM
LsknlV
LS0nHM}
&@p>;D
[9{MUu&
TjNOEr
d6R3{x:
bq b)H
^C-wMP
ue$voB
A/afiB7BQs
Ff!6TX
D|??W5=
)eI#O#
1wAi#K
_efhH
XP%T6mpK
ppFqOT[[[$
@Pvdq;
*+cX8W
^,{L+S
/N8*9;
Vg"9D\V"g
e[N5ep$&
pHSyQ
uWz`U,
,?a"-zE
Zfb45Cy
a@APD+
E>P0qP
<G40CE
we.}R<
?!)|>>
%HhXYn
yqhkw8
o05Fp=
_*p^FB
KTvujKm!
I*%+}z
jc.zX~
bQz'it
:,y~r-
_v1b04|2
EO/"Xi
w_X>H4
~mwH&=7f
}uvFYB
:MnUim
)ysT~6
Ekd~U)
3zRX D
&=714>
iHEGe&_
L<j}MpH}G
YY+[nv
('L7H,iOO'
Cu?[xu
Hdcp!j~
'Q1NVW
y.\kq
u-5z0,
9qX$H]
WEsR*^l
eJ@D]0
muO|NB
I!h("
#AqyUz
-7.p8+
FqgMU/
S|8zlLB
pzOyp'
a&YF,-'Bd
nOVDOG
tgcNDl
TO*x<3
!gqrVpJ
Xab,xz
^%p/u
u!,5(b
v$o5Gw
_cTD#M/m
[CC"|A7u
}{xf D
Ro* Rf
r:6>DyC
fm>(p1
|>R/79
HV3JTM
S1'2nK_3
gm+F78_
tYsb"t7
[s%E!"#
AbS=pR
3A4gM{
IsValidSid
d6,>Tg
AM[go8*n
H:MWqN
|/?q z
~ggH#b
h/|S*n
;s{gqk
lhip9^
VY"p;$X:
&cV^h0
|skqv8
h0@[|kB
.x&m9(
~K)$ZFM
Ew`JMr4
ufoZ2L
wYuroM
B/@8<^
~<j~e
_#R8`O
ZE#P<2
>"roC
azbI]"
o!`,T/
"4*D'PFY
$4MI'%
3mL+*!
&`0C8Z
KDpTZu
ZoH`=nf
SRm`@Y
^[`HBEc`
*/A{?R
Ncgh`$
bRb`Yb
/: zh
P\`e{Kd`
BK1n#h
3pBoC.
mwb"a.
!5Ucv&8
rS@twW
^v-l2Sfv0
MV/y,N
P4,m[0
BW;-R~
e)e9Z$
U7'*|bc
^87A|F7
>Y:5-(
.(fE|F/
Hz3ES3
yMr])E
n/zV6h
z/-<JB
3~&o/"
ms^?Ls
m'xYS>
Xi47NBe
I0B:RhNG;
EK;CY
9KQxtPL
h):K!@+:
N< wWI
n6}x$(5NS-
b=_Fv@
i$L`m%
N30sU
f6)\30
f6)H4xw_
n<yG0x
OltGt1
M'etkD
Zlt&jmcX
(Uv(6[
TE$7uw
y2$e`Q`
G5$5,O
9|i[rm
sE1\41
)V5WXb
&&)2Va
N45u0h/F
jpzSW@
6I<`jo
&|SV@|]
M7;e\7
v &xF8
X~"pZQ
?^#T>g
YxWqf0
`Ug06O<
o/\pfi
Z'RFK&
JB0iGB9u
EL>9.C
.*3u
!xFS.T
/Wc>Nj
j<Ww:f
=2{o)b
qKpM^}
FbKP#p
/Um"Akk}/
j,64RU^
`/s|Cf
o"yNI]@>
=FNgQL
!A6;baJY
`JV.t%w\*8
P`m9#eh (
t/Oc7r
18LJ3C
CT{m^r
B?baTN[
O@p+Hx
RcAq!F
QM+UR3
dxOC `
Sg=2` #Z
P97p&#ujn
3vm]v"
:bfdBN
&+M4y(
#C[b+b)
~V4!]>
Pn`3@J
Fa`<(PO
mtY{VBS
C-hAcV<
-7'oB/7#
]sD #{;-
||k4X3
R<=&^%
}VMEL44
_tP)KK
w+bk )
0ziy]1
(rM[,8
t0t ^
y.7>=;q
vE-)YC
[_FV{]2
f6k%_iH:
i;@G6v
3!f,"~
7:;*{p
F\pKm)H
ccE`"5;
^vs0ly
T\7jf!
<~Ert:J
mY5NUb'!
>;X%c'
c~UR.
?$rkUa
x>|NnuL`
(4AnC`
]7Clz9?
(kSI%(
%>\BzRE
oLscOm
4h_[S<
l2vDf"[
5=l>e[,
5l>+(1
Z AqAW[
c}~Y7N
~w6C:O
",p!R%
a&n,RdITq
Wa-*>
M?@Z% E
=A8:JSZ'
H4%U!j
0j!mcXt
pe;[Q<
@Tb8}|
,+MS+_0
5'q?-LNlg
Kx(EuR=+
~a{Ss^
g=o<4q
'>^dbk
/m^"/'
.dE=h;
e}:=9MeL
R;>=UJ`
h\?{1~j
S{ Q<0^<
5v}At>
|[l7M,y
f7Yz0+
gF'pTFS
/No6Y+
<"&;;s
A4LTf3H
b+Dp:w
!re@iN
v;_[FA
w(QuxN
aTf5St
J|K,4^
yFWO/1_
*My^ sG
/,zIAe
f^uiNSX
lZ5&M|
1>Ab';
Wxc2X\R
}g`aR:hn>
1/7sDT(l
c'4.{
e@v_^f1
<J"k}u
JHLq5s
;@R~dBe6
f1ulv&
HM%&\!:
*S>a\n
B%b&D$
sL!.}S,
S|c`p>L
R3pz'M%
o0}Mp{
E8?Z}d
a6C.lKW7
;R_ i4
<JQ:Lb
AatN-8
rX,^tF8
Ru7E_a
B9t(/B|
A(.\]$
c@Hm6<=
P gOF[@
mCJS!k
{jZ*'Zs
?\K>N}
tRl;./U
C/Fno)
cFzoGL
8<uCUz
BAN<^v
=df7!=9
;g%MgL
#-qBrW
au6[KI
fB2/bK6
7q"vnT
,y7E2Cg
)iqJLD];
{ ]}]%WS6
_*{_$G
:9Y6E
v*lb[7Ei
V&+CX
~dG}no
wO}B,;
E?8VE'
pF^|zF
'Q`Qf.
RyOO1.l,
HY-hOy
IL@D>ZA
P$RK@g
n&2cuM
=Le|=|L
:BXM_2
`DV&(H+
-Lb/q^
.m"uUE
oP.9<t
OTN=dJ
wK_t5.
zJn\~r
|/.8`loE<
O@D>ZAn
$6OSC?y
k>AEF_
|QW@IAQt
$}5et$
I^I{~4
SxFj'
sg9SK\`p
Z":dmS/_I[qW
\*LC|d
i~+<f6L
b(iX_0
gGtrz5G
"OXzgtHJ
%- )O."
^6zyX3
@m(y/)f
>iO_#^rW
o^z_ G
!}Wz4!
/Rm"a
o+.:Uq
_WZJ^]
k.\+X.[
0YuU!9
Xs)h<C
Hvd_`-
CJf\tf
~fT*y<
xmAEW1
["Jf7[
&`Q_&1
De'uDu
)NTRs"N
kNn=<kzq-
zutoF-L
@)U}SKh_kG
Ei{2?W3
Y7]?!j\M?r0y
L?mh2]?
s'O<ch3
C|`R1Y
ekyw>f
EW%zkM
t_}BAu_
A&w*Pvo
]bx50f
Rzv9`SE[
gu_Cfj
RL}`%p/
{WH`lg
g$O[F|
?X<}N4X
5jrt;-
t7A`z2
E)Bj71
H;E%Ce
`rz?c\B
LRtp+(
fD5c"5W
c~zP@4
"\6@/\
cc4.mH3Fml.
'S:C}6
Tm+eM<
Tcoofm
wNI,hT
Y#TmEP
$p#bj(<
(Lu^|jTN
\CG9tj
##1lS`G
_Q\W=*
?86y|A
eUzf%
7VYL2Ii
?&aAtS
,Jvmr@
x<,ji^
ki]yef
gV%V${
oDE7baT
~(c{\_
Kwg{3}
qD^?5&)
5C[n2X
X73p:2
!xO|pQ[
C9_Op?'
Y+\y^2
UzBNx^uB=
hvr(cT
I.t-I$l
=9w%YK
zf`wwW
>;r4+P
@`?1*}7
"zQBkN
PsxMyTs1
~L>Tc=
b7Xt-2
\y;lt]
8oqQrfh
<xesF;
kb(sMuC_w
B-|j,%t
q-9K|V
Xn3(~E
Dr:ooN6
>D2)fRJ\w
sMA2Tn
h;4*qhT]
uz)r\Jl
~?bL9X
({gSV9:
*??iC&M
7;^l/&
)m7<-#&
zp+#i%B
5Hn"(W
6@xwKM
GY@Vq,
F@}XP'
skLH~xdLL
A^Y&~Z
|+)XVN
{v-LC+q
_=c/jd
woGv_l"
{/59m}
7]=eZ(
:\/6t5(1
NN7#3t
K^qw`2
lCylEA
L/-=l@
#U6Y:C
{PJ(8c
e19T+]
`{V`{J)Y`
(*F>,t
f0Rv'zA
_#o8Jq
+s:0?!
l%d<gp<
Se2yoz
L`;Zkhl7b
Wf<QXTK
$}Eo&3`0
6Dtj;"
rTuku10
_:4bdp
sLa@I<
mk-'--*
mz?}t;}
['4A>|I
#m=(w"
B}$9X`
|3L &4r
`&bdSu
-C9piP
9j}!kO:
2?fo&m
/1]AZ
5i#Sq-l
Srg'&b
|kocot
-zLyi"
6Im0f~
=4tp|OB$E
6J?(EqIA
C?8a5
h`"sG;Gk$
g@'E#T@
8Q28qq
wBa0f?/X
-%Ag?Q
r#N0z=YN
%-KRMoL+
MKu`nm
;"Te+9
GetProcessWindowStation
e.eAid
OY,TO5
[h4|,[
o-l<s
cQTN1j
*n-elv
e%cC'j
tBYa}4
y?z!>.
&mRY7&
k*uDJ
CNZDXN
.jAo!)
!dpP]t6
-loE\
^4&`[q
XY[rva*
r"%iBr
ov$%B7
dX21z0lzN
B`2W:\`
FZa`e<9
oAT`@}
#N12(&N
gR`O0n
.kb96-S
Mocd>\
KU*1Q'
|3Pw**W
9g<hlB
%,MW"]
%W^#PCG
2 A& 5
ifT:brw
xNK_SER
w 2!KY!2
o.S.K#
'0F68O
(F}tg*
libcurl.dll
n2ary.
eg,SBf
hoBs6s"
9C%>9m
R_K`}e
`$y"+f_o
-.s}03
Xyg("=
C5FY|xB
9Tgn-}~!
`E%HW#{
A0([4(
EHo9fcx
?ZURec
Bt'`0Y
<4fn<H+
V8 6}V
4/uE`)V
}o(127
|]Ue(:
?NFMFZ
hoBsYs"
Ho< IbRM
\uqe`"(
`Z"vKv
l%#Tpw
.ib/Bj
M<.!4T
=u!(1I
bDW(B&)
fa;PW5
-2A]Q~5
bM<%Q
!eJJw0
u~oi!L
~G,4yex
O+i/dj
7oT)|S
;UgVuo^
S3Hi|j
Z\bTs4E
W\putE
c4igP{
[(La3?
Ph9a3?
k;=<IVBL
giAA,'
4(;q&]
_Bx6"X
K)/hK/
p]|r/1^
v@G?>
de#siR
/!rW``-,
}&j(n~
{z\VOR
\XL5ZI
1I|d28
|8>x9d
$S(y9R
LBA%#%G,
%@(_U%fh
+TUB?Y
h>}sok2
P^,SER
M&0!$,
<\-^$Bq
-z#uIn
A0H )U
/Evmix
-sC>Iz
Y5yt`#
Ei} hRL
.eH5gCk
pAuB;~
JdUm4pc
lfi^:w
=q\;Bh
y7IiozPp
Z69/'S]{
RPCRT4.dll
Szf V)
*U0'->
=8{tU=D
6QQhLiD
.Hopi&
Pa?s`>
USERENV.dll
gmWy,
d"Oj$V
{[koJ:
riohAK
D64d&Rv4
sW:6ZW
c%/:AiS_T
7qh/KfTq
%.dKtPV
:4Wd/hG
Ms@|lw
O%J Kj
~S"\SN
,RqV|,]
1A=7|n
q[sLS!c
%{j[.XF
kd7i9t
N4YMkkE
]?ft;'
C>MpU@D>ZA
nMrKFK
7[|ro0[
]m->gweK
G|c56z1
2L`Yn;
$"_@D>ZA
@6EX@o
LI(gH}G3T
s/q[j1
DJ=@oP
utp;B2.
,G2`7wHvf\4%
#p~yTI9
#1ZMzT*
A77>;vJDGZ
RC+iC$
%D^'/=
}QDWtf2
[1u/ !u
S}S"x3;
dOeIV?
7NmUK%
m8Du`+2
;{jVg$
?wkl3cWWX
WR;Kgr+
\qjeh
RpcStringFreeA
Z~VP2'
<c5_$j
.&,js^8
GmQHre
'piS^[=S
vX}vG>p=G
/qX}vG>
eV'7sEK`c
>"chC"%Q
f.gCib
|9w8~0N
y<*ZFn;
sbp+kf
w?Ovh%
&\'I{d
g(U``EzZ`
/IHu`F
'y!:LU
n/md?n
^my8nh
%?`]@,
l8a{xr
7*2{((
}+)t-O
fvhsY[P
&S]@CS
[?s/%[
(" 1/@
'&rzkA
9""~(c
"7(ayrF
g^9Jn(
lhOBd}[F
eM%6&x
SHELL32.dll
K@CY0J@0
_@4dt]@
>2'^@f
W"e1[F
l(K(6l
!`WHtK
j6.ztl
3wJx$g
sZed_>
}wf0.`
`V1ERc
NJ1XE)Y
XAwaD>I
wLY8aeY
+Jqm>W|
ShvC6e
EyJvn:Gv
z}E@Z>
lG`e8Z
r/q~Ht
Q,k~J
vcx+U)
Y5N:5>
K>BPcQC
UOi1C
2eS\S6
gzidPE1
jI\*wN`
c;[|%=fYz%
AJ^|p|
f})4?u
aCLDUInr
P6ag*}[
Z@I(iQ@6
+UHxvJR
^+tI0
\$P{C3
w#.a@@
.Jiu2d
[BqdvZ
k:8-M
3D4*k
'!QeGh
7['Gei
<G-/Y
wBNrc/
Uj7Cqj
k6?0i7
voi=2)
@9~\@q
%u.""D
gOfos8v
NETAPI32.dll
*mqbUB
/"rob[
^ubo~8
D"/[|l
Yx}4V\
6u)YS1;
#=,"|qOZr
3@V=s0
C"Wp6x
jPC~)c
V 9'`gn
2W()%``
!ey;7t
&dmM`7Hd
!A0;}<
9"Ob_Z
@af_(l
\|CA#XR\
AH1d>-
5Pj`]#czu
s)@Za(L3c
J S/,sE
To!|v=
?!qP[3D
n Sho~
onnspN7t
.AaVXM
k{5#[b
E5Py;+]
'['EPlU-
ufB-WO
S\`w-y
3v@$N_
4JItMM
B5+c^=
)M#J=T
s^N';W<
A?~*6p
:6M|bk
yNWU3H
+%+h;9:
Zc7S/n>A:
SA6GvA
,xd%_!
XLs0V
}. ,sx
fUFy=i
BdU)TZ
E$tX(3(
rHZxW
_w*P4y
XOaHJW
7bSTdw
y"r#@0
#Bzv2"X
")?@.K0
}Zv~"%
U.eyV9}
KS]`9=x
7K`Xiv
mOgM41
<K;X>U(
O;(!C=
e}GbR?%
ABU_Rl
" '~0G
<^\8c-C
83b?;<I
bhg!$Xb
.95XX|
,^:Y^m^s
L!VA&:n#]MUn
#],C~x
T|a$5*84
H\8I+&
`A&#,
9NR. ,
,eKs4A
4w #I*
xWK&5
'jjOM)
9wK;h_A
eGIt!\k
^rHKT'
i5x:Te=
7cW<||
7Z!J
9g^1ZZ
Nzi]]U
N?@`pA
d%Ca+n
%;uhm>s(~6
Z+t0Mx
Q93;g=\*
y`:zOH
[Dkl$t
3]7>zt
'}4O$Lg/e?
'qiwu_YX
^{@Uc8
9~:@uFhe
?JfHVN5%Ex
gJkD<G
wNDBWw
OT<A`<
$Q<EeK
0/+;G6
}Pwp+7
gx3,Vk
m*VeCg
T.Vq8$
9Al?DJ^
r=G?&t
Bb.3kN
z{4"esA=
}Huwg*
'He{k'6,M
&R*su
}Xw\UyLA
'|#t{b
ovd`(F
]HT2M9
aofh/<
61Kqj\
Tv/d7g
"`SKTjV
,X8:76
scxQ1of
XMJ}7M]
u-Nk)W|
zn@.Y?=
\9QFu{
,DA2N0&U^
9`FJ[6
MIV5+TK
%#h{au
l]pnuq
`(\<Mq#Q
L!"X0P
/P3[T$&L
ytZ.G{
+5yDrh
[0ilEC
Wd"$%M
#}M^n1Z
`z1MjY
X=RYKZ
m@~E)]j
G#gjB
Y(Ure#
[@.BU1
k'aWmEJ
_O(l0)
5KYi"e-
/WUD|M
IV96iE
^Ja$gH
5"yUuKY
Jz*^u|
K3c@"^
^<CCQ
P)>X19
ZUfF%l
end$;V
Gl?^H@+
|+ZIarYM
\Bbi~U
Cq96q*
wL!w|j
!YMb*`
B3asvg
}6ON}U
bfek}|SE
OClQmN{
:Q[FR-FNF
VL|[ZV
Uke|4@|r\%$<
'BWXod
hf30A}
)DO)BZ
%nJ9>VfI
SSLD^cq
BOJCNS
1n$&nL
_zM98}
<lP h4
%aF[cI#,
2sqIj-$zZ
3\wg5qP
MI+Mo
;8XL."
_/c1i;
[Xf4w<
m?Pq"'
g8tG]N
4e'rlrY
x{jR!//
XSW&!Q
|s%nFO
/(UW7j4
~%,d;T
s^/t:C)
:("|@r
n#,&jz
o)k~]}
]|-k!T
mU4.+#w
}Tm:N2
*UU5Jpj
,*1|/Q
u\0U0}
_Dy?#6#
)ASi|+
TVkBIb
p%:ry
,"{{p6Rmo
J%1~vd*6 :
'x{,Ck
D0GRS'
[>\J[*
!MA[Ii
e1M>!b
Kd}Xg.
.i?&4(
b=]\[f
aDx_h1
Vw,L(&
uHh=+?
PZJ,K?
z9sP}R
lc J@Ya
0bm3b1
_!:~fb
Kd)-)Q]
<%f)Sq
NX&=AZ
yZWI{
wE2 HB
Nc6xpW
#3*TtI
L4mI<h
]fe_H'|R
Rx>#jBE
VSOD&\gEal
9q($m|
p+x$6gE
f r_XOh
YT;C,Me\
Pq9\5
Eea3:S
C!Wh/z
.9b(u\O
BWrGAx
N.u2Ya&,F0
f,S_4
Om4N%W"
\{k/i5c
T13`AvNm
Z:eJ@f
\GI_6e
pz\C5y
Lezy%`^
Y<]V8B1[
7O0Q(?
-KL`*Sy7
|ykIFg
/u7!?#
f`SOXk
itf=[7
N.4ohy
K1P.,'l
@B|.'_Z?
f\/|'L
7/V$vb
[]T.:p
_}]'u=q
jVXA-G
oVt85c
kQms61
#UW\Ak
T)C_TZ
i(jQD&w
cS@`L7
iXW@v6
Z+?`Ws6s
j1fa+f
1}fh&T
Yf3aj
P;I_"Ht
ZJ}:n0
PI}\z
#g/-]O
S/qSWC4T
gUrV>2h
efghFZ
YYMRwsf
b`9z8"
4K*dbVN
T85DB
u@rT:(
`{"xD:
}%4vk:
8C)1Ye(
|7jMsf
xQw7E
s<=.$!@mo4.
m\F^4=
!W_*9yL
.EsN1~
Dw$q?!
rco71};
OedTw~
`z?U9.
F@'WgM
`i?zL;XF
"x]}qI'
T,qAyk
7ESoLJ
u>@c*Et
lN\6ks$E
MiheEr
-$Z#OyL+
LFJf4th"
AcAyDS
PlM^4E
(6z-E_
()8Sfu
0"eh4Q
pV}0zH}
5+}w+L,
YZrB'dJ
({N7&#
N,@Yj2
u\5&<_
*FenSE
E!KRp3
c%JJ}&6
ENy7#6
pO'9!S:
/%`~(m_k
y=NLbA
h&2=Me<z
SmhQ$|
s-JoTx
+|ovW\U9##
kt#SP\Op
?[N=U@=
WtefPt8
m]@7ag
/^5IQ)
~.+'B'
Q3c(b9
]3QSvt
=YFtoo%>
CWzPX\V|
`QSqF}
">NBM<
'W9BS2
3bRD:'
T"a~Aj
Y;;?l7[
#%y*1gi
5Oc{_[9
d4]&f
s`~Zqn
P>Y&DA
"n|X:D
Antivirus Signature
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.VMProtect.4!c
Elastic malicious (high confidence)
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
Skyhigh BehavesLike.Win64.Generic.tc
ALYac Clean
Cylance Unsafe
Zillya Clean
Sangfor PUP.Win32.Agent.Vmpk
CrowdStrike win/malicious_confidence_90% (D)
Alibaba Clean
K7GW Trojan ( 0058cdab1 )
K7AntiVirus Trojan ( 0058cdab1 )
Baidu Clean
VirIT Clean
Paloalto generic.ml
Symantec ML.Attribute.HighConfidence
tehtris Generic.Malware
ESET-NOD32 a variant of Win64/Packed.VMProtect.L suspicious
APEX Malicious
Avast Clean
Cynet Malicious (score: 100)
Kaspersky Clean
BitDefender Clean
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Clean
Tencent Clean
Sophos Mal/Generic-S
F-Secure Clean
DrWeb Clean
VIPRE Clean
TrendMicro Clean
McAfeeD Real Protect-LS!F7FC951C907B
Trapmine malicious.moderate.ml.score
CTX exe.trojan.vmprotect
Emsisoft Clean
huorong Clean
FireEye Generic.mg.f7fc951c907b03e6
Jiangmin Clean
Webroot Clean
Varist W64/ABApplication.FAJB-5699
Avira Clean
Fortinet Riskware/Application
Antiy-AVL GrayWare/Win32.Puwaders
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Program:Win32/Wacapew.C!ml
Google Detected
AhnLab-V3 Clean
Acronis Clean
McAfee Artemis!F7FC951C907B
TACHYON Clean
VBA32 Clean
Malwarebytes Malware.AI.2288176233
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Rising Clean
Yandex Clean
Ikarus PUA.VMProtect
MaxSecure Trojan.Malware.300983.susgen
GData Clean
AVG Clean
DeepInstinct MALICIOUS
alibabacloud VirTool:Win/Packed.VMProtect.L
No IRMA results available.