Static | ZeroBOX

PE Compile Time

2020-07-09 16:43:56

PDB Path

C:\cilihocah\sagaya-90_vud pizujubejeg31-yisidibene29\l.pdb

PE Imphash

dceae8ee937ee18f560a0f6c135be8cf

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00061a7d 0x00061c00 7.91680869377
.data 0x00063000 0x0283a224 0x00005600 1.14536507951
.rsrc 0x0289e000 0x0000ce88 0x0000d000 6.66507890357

Resources

Name Offset Size Language Sub-language File type
RT_CURSOR 0x028aa818 0x00000130 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_ICON 0x028aa300 0x00000468 LANG_SERBIAN SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x028aa300 0x00000468 LANG_SERBIAN SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x028aa300 0x00000468 LANG_SERBIAN SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x028aa300 0x00000468 LANG_SERBIAN SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x028aa300 0x00000468 LANG_SERBIAN SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x028aa300 0x00000468 LANG_SERBIAN SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x028aa300 0x00000468 LANG_SERBIAN SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x028aa300 0x00000468 LANG_SERBIAN SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x028aa300 0x00000468 LANG_SERBIAN SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x028aa300 0x00000468 LANG_SERBIAN SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x028aa300 0x00000468 LANG_SERBIAN SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x028aa300 0x00000468 LANG_SERBIAN SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x028aa300 0x00000468 LANG_SERBIAN SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x028aa300 0x00000468 LANG_SERBIAN SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_STRING 0x028aad70 0x00000116 LANG_SERBIAN SUBLANG_DEFAULT data
RT_STRING 0x028aad70 0x00000116 LANG_SERBIAN SUBLANG_DEFAULT data
RT_ACCELERATOR 0x028aa808 0x00000010 LANG_SERBIAN SUBLANG_DEFAULT data
RT_ACCELERATOR 0x028aa808 0x00000010 LANG_SERBIAN SUBLANG_DEFAULT data
RT_GROUP_CURSOR 0x028aa948 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_GROUP_ICON 0x028aa768 0x00000068 LANG_SERBIAN SUBLANG_DEFAULT data
RT_GROUP_ICON 0x028aa768 0x00000068 LANG_SERBIAN SUBLANG_DEFAULT data
RT_VERSION 0x028aa960 0x000001b4 LANG_NEUTRAL SUBLANG_NEUTRAL data

Imports

Library KERNEL32.dll:
0x40100c CreateTapePartition
0x401014 CreateActCtxA
0x401018 GetCPInfoExW
0x40101c WriteConsoleInputW
0x401020 ReadConsoleInputW
0x401024 InitializeSListHead
0x40102c WriteConsoleA
0x401030 GetConsoleCP
0x401034 VerifyVersionInfoW
0x401038 CreateFileW
0x401044 EnumDateFormatsExA
0x40104c LoadLibraryA
0x401054 SetConsoleCP
0x401058 FindFirstVolumeW
0x40105c ReadFile
0x401060 BuildCommDCBW
0x401064 VerLanguageNameW
0x401068 SetFileApisToANSI
0x40106c WriteProcessMemory
0x401070 SetEvent
0x401074 GetExitCodeThread
0x401078 EndUpdateResourceA
0x40107c GetCPInfoExA
0x401080 SetLastError
0x401084 UpdateResourceA
0x401088 SetConsoleTitleW
0x40108c FindClose
0x401090 LoadLibraryExA
0x401094 CopyFileW
0x401098 ReadConsoleA
0x40109c ZombifyActCtx
0x4010a0 AddRefActCtx
0x4010a4 HeapUnlock
0x4010ac ReadConsoleOutputW
0x4010b0 GlobalFindAtomW
0x4010b8 GetUserDefaultLCID
0x4010c0 IsWow64Process
0x4010c4 UnmapViewOfFile
0x4010c8 GetAtomNameW
0x4010cc HeapSize
0x4010d0 GetGeoInfoA
0x4010d4 GetCurrentProcess
0x4010d8 VirtualProtect
0x4010dc GetProcAddress
0x4010e0 GetModuleHandleA
0x4010e4 CreateThread
0x4010e8 GetVersionExW
0x4010f0 WaitForSingleObject
0x4010f8 VerifyVersionInfoA
0x401104 GetComputerNameA
0x401108 CommConfigDialogW
0x40110c GetConsoleAliasA
0x401114 GetDiskFreeSpaceW
0x401118 CreateFileA
0x401124 Sleep
0x401134 RaiseException
0x401138 RtlUnwind
0x40113c GetLastError
0x401140 HeapReAlloc
0x401144 HeapAlloc
0x401148 GetStartupInfoW
0x401154 HeapFree
0x401158 TerminateProcess
0x40115c IsDebuggerPresent
0x401160 GetModuleHandleW
0x401164 TlsGetValue
0x401168 TlsAlloc
0x40116c TlsSetValue
0x401170 TlsFree
0x401174 GetCurrentThreadId
0x401178 SetHandleCount
0x40117c GetStdHandle
0x401180 GetFileType
0x401184 GetStartupInfoA
0x401188 SetFilePointer
0x40118c HeapCreate
0x401190 VirtualFree
0x401194 VirtualAlloc
0x401198 ExitProcess
0x40119c WriteFile
0x4011a0 GetModuleFileNameA
0x4011a4 GetModuleFileNameW
0x4011b0 GetCommandLineW
0x4011b8 GetTickCount
0x4011bc GetCurrentProcessId
0x4011c0 GetCPInfo
0x4011c4 GetACP
0x4011c8 GetOEMCP
0x4011cc IsValidCodePage
0x4011d0 GetLocaleInfoA
0x4011d4 GetStringTypeA
0x4011d8 MultiByteToWideChar
0x4011dc GetStringTypeW
0x4011e4 SetStdHandle
0x4011e8 WideCharToMultiByte
0x4011ec GetConsoleMode
0x4011f0 FlushFileBuffers
0x4011f4 LCMapStringA
0x4011f8 LCMapStringW
0x4011fc GetConsoleOutputCP
0x401200 WriteConsoleW
0x401204 CloseHandle
Library USER32.dll:
0x40120c GetAltTabInfoW

Exports

Ordinal Address Name
1 0x45318d @GetOtherVice@12
2 0x45e842 @SetFirstEverVice@4
!This program cannot be run in DOS mode.
`.data
bad allocation
jeruyosejosuvilevewoxati
gojolazodicufevaxasirenam
xopixobogicefukajuzu
lujucirekopusopurogara
kernel32.dll
LocalAlloc
dojatatenek
fideholujoridegibayurexodowevex
bad allocation
string too long
invalid string position
Unknown exception
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
GAIsProcessorFeaturePresent
KERNEL32
bad exception
EncodePointer
DecodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
CorExitProcess
runtime error
TLOSS error
SING error
DOMAIN error
An application has made an attempt to load the C runtime library incorrectly.
Please contact the application's support team for more information.
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
- not enough space for locale information
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
- CRT not initialized
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
- not enough space for environment
- not enough space for arguments
- floating point support not loaded
Microsoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program:
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
Complete Object Locator'
Class Hierarchy Descriptor'
Base Class Array'
Base Class Descriptor at (
Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
delete[]
new[]
`local vftable constructor closure'
`local vftable'
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
delete
__unaligned
__restrict
__ptr64
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
GetProcessWindowStation
GetUserObjectInformationA
GetLastActivePopup
GetActiveWindow
MessageBoxA
USER32.DLL
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
_nextafter
_hypot
1#QNAN
1#SNAN
CONOUT$
C:\cilihocah\sagaya-90_vud pizujubejeg31-yisidibene29\l.pdb
)E.bM(
v~4YQo
v~4YQo
<*`+kA
WOuFJ
8(iW`D
ost!a*
Lx(HP4
#E-",UQ
2<zZ$,Z
u)%d{d
*=Nifp
+[1,7'
zMR(nH
h!}p\v-t
@m3swB
}Fg`4+$_}T
vfaBM3
D4$9Zo\
!fmt'W
9?H`H"
0i.7l
oAiIR/
y'*u7.
,wCy2^k
]"ef#0]
~~a#UL3
x8fkX1G
3&V}41
W!=6) },
ck`e]%
8!l^Eq
42s8-/R
q@{Z"%p
id3}Rf
B%x!:VE(
]P?%9ZG
e]~IP6
,01+$J*X
ukL%j:=
'PF[H^
Zf"%K2xd
(!%'+~T
@`2\PMK
vCo~)F
'mox@>
o||.
`Kq@oQ|
k:[p]$
E|q<$@
D1m]d^
>3_<g,^#DJ
T]pP[}
vFB!r _
$FqKwQ
dj"[aI
~8@Kl$
TS,!qX
-/R[`k~
~PJ.`T
&[U/o=
XzGvyQs
PYSVbV/
g5UZ \b
pe(o>V
VVweB+
U"H\Sz
&O85Bm
'N~kG#
SVSRaM\
EHBWAD
WrL3.T
D^yA']d
H"<+
e7x2QE
A(wTql
xRE-
BAyti fS
|dnd.(
&h]cI]
BL&f53
/OS2^=
E9,m3}
6ONig/
3'tz%;3
ota$X3
N"XjK9
Di&0ha
j`4kBi
~n$g3~
V3'o~=
e{6_A%
(n:B~A
WVP\YG
!7<g8d@
Go5H~n
7Dx^Ch+(oW
dKD*fH
{``MV)v
CcdX|,
zFu##4
HqS-+N
p,@-`;
sTG8HJ>!&
K+C'4E
yg:{g`
!QLA:yL:
W9Wpz[^4
F2!YWf
b5%6y%
M/YO6SJ
7Ri_DZ
+;?8>H
Cf>:Gc
u^w>ow
%TCn-7)
*/&i33I3
O>J(IO
9/PJ$vR
f%pI0m]Q
:,l0_37
#Df&8[
Ou@ME"
+:S&2S~
*a](`-eJ
Q!U@22~i
n-.eEd
}WdTDie
c&hlJW
Y'+YqO
6)=H$@
7<5m`w
2??T'z,I
((jw]qu
kzi"a/Y
te,>1,
^NUfi(I
'Z{Fi
G(]Fk6
si:zpw
(%h!<T
%2zXC#b
rd}D*J
\H9(j2
Nc.1~w
wLZ1s{
b?/po
ltS=Qw1
do cV;v2N
@P,),]
Nw`1w$
-QG+x<b
w@oUL)})
rd07M`
@l@IbH
HUOK+E
o{Ce-
'CcaMQ
nF"Kvh
G^:E}.
.oZ\6[
Wg\Uc>
/UJi!>
R_BZ?f
1wso-JH
5/lOfS
v=akvu
L;:>x_
<teK7bYe"
yVT%'8iH!F9AY
lkv@y>O
Z1Ss6]
Ql)Rk>
l(oa~D
8VU8"k
*Xe^?cq
7q"{Tx
-RhGB`}}
~DFd@0
Q/+9"/
3U&2Gn
xq~=BW
]~z,95]
;0.\B|
7#L\[|
Ccoa[0G
^O;iyt"26
[V$T9Vboe
55g<|b/H
m9(0j7
r&lse2
V"USXv
ap7vKD
Fr`"LJ`K
@Qch.O
5p*(d8
98"[97
X-E6c~FK
|QWX`3
15m4Pv
Hm~lWE
q8,\K|
WIjEGH
ekYc:5
poB6]_
JKNdcQZ
k)HgaB
TfA'+*
Bv(P^R
$:@iHe
CI0_6+
"bt;Zk
;Hdx|1a
])c.Dt
7N-b$KC
9f(LX
44?X_f
*ewE6U
[n}DZ1
KcYfy
d<J8pV
a7h%l}
t,]E,S
!CuNv^P
iOR1_*G
Q2Ylk>
5n1W[_
eMSWPm&8
"/$C6v
N?MJC*B23
4vl<a$
Xj4!Y9]
`zC[#9
cVmQ*Z
b;r75N
J13G_1t
Sq"<hq
7)~&=*
,-L{Vc
AR'6kN)
=HJ"&+
iUUXiU]j)y
zo!v`^L6
OM1%YU%>
+}PJP$
h,a`,='
~!Is4+
1d/Lm>
p)6<=\Y)cH|Q'
TyWJjv
WB|eSi
;hhPnx1
9@N+.r2
(%i)'w
LLah#P
1<BS|6C
+@h88){
t$8;x]
W|eZ1/9
p>;G:%X
{2e+hn
'J4O:Mz5oHs
'_K-R.
)QD:G`R`>#T
7iL~D;
*<0#;B
+0y;c;
gE<z_KJ
{qfyb]Y!
W8bo.T
&3$cs
?6vaFMW
i*Fq]3
Ui-q^J
3ZR_[.'
(l~#O(4
/p$sY/
<mYm}#Gg
n" D"5
#KZlax
"P0p~p
M>QGdr
urZRH(
MU~~|WO
^)mYmJ
;275kiT"
C"czEE
$zfyb8g
h\@Rqi
moA:is
l8fUB"
b-F|pw
=M^{WZT
%>3i@$
02p; j
Lw_eqmp
H4`f%~
TJn[c4
1>eG`@
tJZkfW
pr_#Z=8qk
g<cIxQ
KY+jP2
^EO);K
}I/"gi
%:AOIF
RiiKR8
sPL@YX?
4@<Bmk"
_473LEo
G%FwI#
1p]C0R
v|ZC#\Nk
@C"D@e
$VI6x~
iIC~n2A
Z;Bj2+:J
M@}h z
6_'])bHJ
F%WCTN
ki8,JC
H~skZ8*|
iJP8sv
^`0Bb/
6~9xKQ=
(x=pPI
cd}hc+
2NX#VM
b3zW|!*el1
0m}"w
/Q)'a+
+\\'y8
y57OK4
\=BOP+
S C[~(N<
K+7lTF
G3r>DM
x]q4+z
./8K5!
*a|?NX
bGXB[R
'M}sOE
xwT`!J
K*dyT@
i)~/R"
0d}=\*
ayZMn;
Z+@,H4
nSP9uW
1Ktgit
6292y=x
1sBD `
D[d8Iu
RjoTC
z_Y5}_
]pq!p.
4X$+d0
;}S[x3
)kcF9`
a7!9LS
^UN1[Z
Ked4H$
KaJ;PbaA
v}Pp{aI$#.
0>s_k,
OMoE$*
|_EV6=
l*:0t{Y
r)wM'U
,d(o?AD
Z7upJ_C
,pq.v0
(S+r@p
z:h5X:
R{WbbcYO
3k<i[6w
3/T30k`
wyiy%-
w?3G}W
qhz~S
bx-jTj
N5YMm6
!0Z~A~
GR,xfL
yNYS+X
;Ua:8fr(U>
1 dh|i
#5&RW9
GOQq63oS
]t5KB(
6O8di1
GNwJ[R
(yJ9*ZM3p
FbrM%OG
%);6}W
|>Oa.B
q}}bv^i
#L6n30
aq^30ijn
#.#sBf
}t~PJQ
3h~YElN4"
}D/H3]
wAQ"ia
<9nq~V
Y|NV"m
2."'FVR
7B]{W2
TVJA;(
p7|}~W
fn.)}gG
2aG1iw
IAtrap
uPK$iL8
6R|e_Y
`@L @U
e@/K;u
^NK)A|
!ds3i"
2>=o Nh
BCFz4G"
wfSG"z
0Vx_QF
n{?a^&
[DN+fB:
^/VNOe
Xq9Gc&
!'P#p :
MAy_%h
\z=K\Q
&5C|MH
@n62MJ
6+k4OL
VfKf8+
jvzlH{
&*4dA>(
;6dT%h)z
PdFuh3
dVt=.5
S<U]O)<
KL1z"3
hQ6-};
= {L y
V6`)@-
%YO]u9
3Ri/](
kFoB!.J
@Cee'
QwM(A*
a"X-"%'w
J.cI3e
#;`A?Y*2(
&D~=!^n!
g={gT
$"^?+9
h >Oa=2
%bXI~BKT
\*\OHg
!'c3~[
=$|:J_
,rw_-]!
qm@|`0Yt
,6DAIC@u
tz&9a&O,
wI$s0M
He;$P3
<AsWOd
KH[UY1@
JCr"T`
:I/KAZ
`-60%x#l$1
Lbmg98^wp
dKa^'6
hC=qONr
hRdD{H
ZKVX8j
jh+am}`
0E?iMg
9S:9z$\G
`?W\w4aA
X11.q/76u^
F_xnF
RxUO,F
?A)CEL@J
$91^^6J
\QmxJ*
z2A`25
>adot3
P4poG?g
YhDX-w
R^ U\F
CsD"'c)
NDgV'Ep
YEp?3y
'%64_,
oGHh,!i
/$<y)>f\W
}46B:-
>fg\bvF
JeA_Ar
0Ie69P
dbI[f%
g:-Gq*
lOi;+pG
8I>sq%
h/%A 6
CLst)v
FnC7<t6
4kiyWo
]4[Hw#
(v_n.d|&Ze
q4}{l:n
5;LD~.q
}4g`{L
nDxi/
ow_l1G
ME_mc&
w;YRC4
p\D^I;8
t+ .wu
lTh2\d
~ 7FhX`
!9lRQ(
`CFwC}
5!WI5v$L
6a$715
27Wx<
92+8WZ'#
C}}-7]
P[q> I
:eR!qT
k-HEWXF
o'kXia
TGt/<F
<1D;*QMe
t,'L^(
hF^5>@
AN]!~M:
vX'VYA
$rX`rZ
,lMJC-
t\itH:c
[T1sUl
rnAe={
d9\Bb1
k|+?w2
bA0B&-0U
WU 3Vc&
n*3^n@Y
V0sVwq
8zkf1k
XJQ$gc
gH6_0M
J@|C)
N3bY)]
R0_5jKV
BTxsT)
5rooh.A
rnL:W_
H?2'jLa
Ok"uGw
\SQ)3~
[{eo>
R[wd#6--
bW]!<#
eUI%'lj
uYQ"_}
VVVVVVh(
E@2$|'
^u*VVV
PSSSSS
0WWWWW
0WWWWW
QQSVWd
0SSSSS
_VVVVV
^WWWWW
HtHu4j
s[S;7|G;w
tR99u2
Y;=(iF
j@j ^V
r=0fF
>=Yt1j
QQSVWh
0A@@Ju
Fh=@jF
0SSSSS
PPPPPPPP
0SSSSS
PPPPPPPP
URPQQh
tRHtCHt4Ht%HtFHHt
0SSSSS
_VVVVV
;t$,v-
UQPXY]Y[
0WWWWW
AAFFf;
t"SS9]
t+WWVPV
<+t(<-t$:
+t HHt
u;h00@
u,h(0@
LeaveCriticalSection
GetConsoleAliasesLengthA
InterlockedExchangeAdd
CreateTapePartition
GetSystemDefaultLCID
CreateActCtxA
GetCPInfoExW
WriteConsoleInputW
ReadConsoleInputW
InitializeSListHead
SetConsoleDisplayMode
WriteConsoleA
GetConsoleCP
VerifyVersionInfoW
CreateFileW
WritePrivateProfileSectionW
GetPrivateProfileSectionA
EnumDateFormatsExA
CancelTimerQueueTimer
LoadLibraryA
FlushInstructionCache
SetConsoleCP
FindFirstVolumeW
ReadFile
BuildCommDCBW
VerLanguageNameW
SetFileApisToANSI
WriteProcessMemory
SetEvent
GetExitCodeThread
EndUpdateResourceA
GetCPInfoExA
SetLastError
UpdateResourceA
SetConsoleTitleW
FindClose
LoadLibraryExA
CopyFileW
ReadConsoleA
ZombifyActCtx
AddRefActCtx
HeapUnlock
DnsHostnameToComputerNameW
ReadConsoleOutputW
GlobalFindAtomW
GetSystemWindowsDirectoryW
GetUserDefaultLCID
BuildCommDCBAndTimeoutsA
IsWow64Process
UnmapViewOfFile
GetAtomNameW
HeapSize
GetGeoInfoA
GetCurrentProcess
VirtualProtect
GetProcAddress
GetModuleHandleA
CreateThread
GetVersionExW
GetProcessAffinityMask
WaitForSingleObject
SetConsoleCursorInfo
VerifyVersionInfoA
WriteConsoleOutputCharacterA
GetFileAttributesExA
GetComputerNameA
CommConfigDialogW
GetConsoleAliasA
GetSystemTimeAsFileTime
GetDiskFreeSpaceW
KERNEL32.dll
GetAltTabInfoW
RealChildWindowFromPoint
USER32.dll
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
RaiseException
RtlUnwind
GetLastError
HeapReAlloc
HeapAlloc
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapFree
TerminateProcess
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetFilePointer
HeapCreate
VirtualFree
VirtualAlloc
ExitProcess
WriteFile
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
InitializeCriticalSectionAndSpinCount
SetStdHandle
WideCharToMultiByte
GetConsoleMode
FlushFileBuffers
LCMapStringA
LCMapStringW
GetConsoleOutputCP
WriteConsoleW
CloseHandle
CreateFileA
gebeneh.exe
@GetOtherVice@12
@SetFirstEverVice@4
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.
.?AVtype_info@@
.?AVbad_exception@std@@
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
8`!!KK
nqCP):
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
H;;;;;;;;;;;;;;;;;;;;;;;;;u
;;;;;;;;;;;;;;;;;;;;;;;
Y;;;;;;;;;;;;;;;;;;;;bSv
;;;;;;;;;;;;;;;;;;;
K;;;;;;;;;;;;;;;;;;t
;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;
:;;;;;;;;;;;;;;;;;;;;;
y>;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;X
;;;;;;;;;l;;;;;;;;;;;;;;;;;;{
;;;;;;;;LP;;;;;;;;;;;;;;;;;;=
Wr;;;;;;;5
E;;;;;;;;;;;;;;;;;;B
;;;;;#
;;;;;;;;;;;;;;;;;;
1;;;;;;;;;;;;;;;;;;<6
;;;;;;;;;;;;;;;;;;2|
,;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;w
;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;7
;;;;;;;;;;;;;;;;;;;;;;;;;;;M+
;;;;;;;;;;;;;;;;;;;;;;;;;;;;T;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
(((((((((((((((((((((((((((((((((((
E(((((((((((
((((((((((ZT
(((((((((
((((((((((
\(((((((((((((!
(((((((((((((
(((((((((((((
(((((((((E
(((((((((|
`u5(((((((((
\J(((((((((,
L((((((((((((
((((((((((((((
((((((((
>=}\"+}
"),y{#"z
43~~+:{
,0M{l&
!83{b$
3RUnD1/
6K[r}vq
NQd:)6zS
I;i}mu
=hS~c8'
XSwtC>
&TavB1/~
3E<{z12
fIKE"E
uYYk1U

b
F[%5

1[c
|[%qW

o
5$x\CqI*
o[


:c
[Fc^


qU]Uer
C5I]
^
p

^
x
%

%
%
f<Cf'0K~F
-Pb<"r
3\tT!}
Rsz"/FnM
S&`~~"]
*7d<#t
Bm}9#y
E:bzp-\
buteyugimuzadagesurux
tixetusepobirabuxawevomepenetis
beyixepematileyacuhecajo
Nepebuc xupademujoxu
yukeduzezaribanipeyobizitewehujipibuwojatajuhajesukirumimorohodot
podofomiwuxofaluzetigijenowucos
mapadavoxisovuyavigofipuhi
honuwefacayufofuxevanopo
konigoy xujalowoha bizijifez
KERNEL32.DLL
mscoree.dll
((((( H
h(((( H
H
VS_VERSION_INFO
StringFileInform
081564b6
InternalName
kogzmuahoke.exi
Copyright
Copyrighz (C) 2020, vodkaguts
ProductVersion
91.78.38.10
VarFileInfo
Translation
Leyifuyitefam jagucubolim9Cixuco lupazekezab nul benine nuwecovekizalo pagojaxifoja6Jemubaletehutuf havudu ziru jinevuxasigo nimita nizeyoJLuf zerinewuyijoyug fedib zuhuyizeguwej yuzemoju ciloyejoze gaguvuwujafomo
Punevewexujuf"Tijavefafoso hepix tulokusibibagob
Tilonodagokolul roduvacexir
"Vacu rexuwaxakipemi kafu sijutucezYSeguyoloy dalotuhalibi xum yijeya monom sigatuse cucuxazayanu hice jeniserahaw nojujaxepu
Antivirus Signature
Bkav W32.AIDetect.malware2
Lionic Trojan.Win32.Convagent.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.37342318
FireEye Generic.mg.eb9d1220e5322bcf
CAT-QuickHeal Clean
ALYac Trojan.GenericKD.37342318
Cylance Unsafe
VIPRE Clean
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 00576f791 )
BitDefender Trojan.GenericKD.37342318
K7GW Trojan ( 00576f791 )
Cybereason Clean
BitDefenderTheta Clean
Cyren W32/Kryptik.EUY.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Kryptik.HLYN
Baidu Clean
APEX Malicious
Paloalto generic.ml
ClamAV Win.Dropper.Babar-9883606-0
Kaspersky HEUR:Exploit.Win32.Shellcode.gen
Alibaba Trojan:Win32/Raccrypt.5f40b094
NANO-Antivirus Clean
ViRobot Clean
Rising Trojan.Kryptik!1.D82C (CLASSIC)
Ad-Aware Trojan.GenericKD.37342318
TACHYON Clean
Sophos Mal/Generic-S
Comodo Clean
F-Secure Clean
DrWeb Trojan.Packed2.43354
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Generic.gc
CMC Clean
Emsisoft Trojan.Agent (A)
Ikarus Trojan.Win32.Crypt
GData Win32.Trojan.PSE.9P5K2D
Jiangmin Clean
eGambit Clean
Avira TR/Crypt.Agent.strqm
Antiy-AVL Clean
Kingsoft Win32.Troj.Generic_a.a.(kcloud)
Gridinsoft Ransom.Win32.STOP.ko!se61707
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Raccrypt.GQ!MTB
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Raccrypt.C4578271
Acronis Clean
McAfee GenericRXAA-AA!EB9D1220E532
MAX malware (ai score=99)
VBA32 BScope.Trojan.Bingoml
Malwarebytes Trojan.MalPack.GS
Panda Trj/Genetic.gen
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002H0CH321
Tencent Clean
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Clean
Fortinet W32/GenKryptik.ERHN!tr
Webroot W32.Trojan.Gen
AVG Win32:DropperX-gen [Drp]
Avast Win32:DropperX-gen [Drp]
CrowdStrike win/malicious_confidence_90% (W)
Qihoo-360 Win32/Trojan.Generic.HwoCueAA
No IRMA results available.