Static | ZeroBOX

PE Compile Time

2022-12-07 23:39:28

PDB Path

D:\Mktmp\Amadey\Release\Amadey.pdb

PE Imphash

857774b8dd5bc6abe25ef09f890c7f72

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0002df16 0x0002e000 6.45419257743
.rdata 0x0002f000 0x00009c4c 0x00009e00 4.98131167683
.data 0x00039000 0x0000444c 0x00001800 1.40298916524
.rsrc 0x0003e000 0x000001e0 0x00000200 4.71767883295
.reloc 0x0003f000 0x00002908 0x00002a00 6.58102332328

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x0003e060 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x42f040 CopyFileA
0x42f044 GetLastError
0x42f048 GetFileAttributesA
0x42f04c CreateFileA
0x42f050 CloseHandle
0x42f054 GetSystemInfo
0x42f058 CreateThread
0x42f05c HeapAlloc
0x42f060 GetThreadContext
0x42f064 GetProcAddress
0x42f068 VirtualAllocEx
0x42f06c GetTempPathA
0x42f070 RemoveDirectoryA
0x42f074 ReadProcessMemory
0x42f078 GetProcessHeap
0x42f07c CreateProcessA
0x42f080 CreateDirectoryA
0x42f084 SetThreadContext
0x42f088 WriteConsoleW
0x42f08c ReadConsoleW
0x42f090 SetEndOfFile
0x42f094 HeapReAlloc
0x42f098 HeapSize
0x42f09c Sleep
0x42f0a4 GetModuleHandleA
0x42f0a8 ResumeThread
0x42f0ac SuspendThread
0x42f0b0 GetComputerNameExW
0x42f0b4 GetVersionExW
0x42f0b8 CreateMutexW
0x42f0bc VirtualAlloc
0x42f0c0 WriteFile
0x42f0c4 VirtualFree
0x42f0c8 HeapFree
0x42f0cc WriteProcessMemory
0x42f0d0 GetModuleFileNameA
0x42f0d4 LocalFree
0x42f0d8 ReadFile
0x42f0dc SetFilePointerEx
0x42f0e4 GetConsoleMode
0x42f0e8 GetConsoleCP
0x42f0ec FlushFileBuffers
0x42f0f0 GetStringTypeW
0x42f100 WideCharToMultiByte
0x42f104 GetCPInfo
0x42f108 GetOEMCP
0x42f10c GetACP
0x42f110 IsValidCodePage
0x42f114 FindNextFileW
0x42f118 FindFirstFileExW
0x42f11c FindClose
0x42f120 SetStdHandle
0x42f124 GetFullPathNameW
0x42f12c DeleteFileW
0x42f130 DecodePointer
0x42f13c GetCurrentProcess
0x42f140 TerminateProcess
0x42f148 IsDebuggerPresent
0x42f14c GetStartupInfoW
0x42f150 GetModuleHandleW
0x42f158 GetCurrentProcessId
0x42f15c GetCurrentThreadId
0x42f164 InitializeSListHead
0x42f168 RtlUnwind
0x42f16c RaiseException
0x42f170 SetLastError
0x42f174 EncodePointer
0x42f188 TlsAlloc
0x42f18c TlsGetValue
0x42f190 TlsSetValue
0x42f194 TlsFree
0x42f198 FreeLibrary
0x42f19c LoadLibraryExW
0x42f1a0 ExitProcess
0x42f1a4 GetModuleHandleExW
0x42f1a8 CreateFileW
0x42f1ac GetDriveTypeW
0x42f1b4 GetFileType
0x42f1b8 PeekNamedPipe
0x42f1c4 GetModuleFileNameW
0x42f1c8 GetStdHandle
0x42f1cc GetCommandLineA
0x42f1d0 GetCommandLineW
0x42f1d4 MultiByteToWideChar
0x42f1d8 CompareStringW
0x42f1dc LCMapStringW
Library USER32.dll:
0x42f1f4 GetSystemMetrics
0x42f1f8 ReleaseDC
0x42f1fc GetDC
Library GDI32.dll:
0x42f02c SelectObject
0x42f030 CreateCompatibleDC
0x42f034 DeleteObject
0x42f038 BitBlt
Library ADVAPI32.dll:
0x42f000 RegCloseKey
0x42f004 RegGetValueA
0x42f008 RegQueryValueExA
0x42f00c GetUserNameA
0x42f010 RegSetValueExA
0x42f014 RegOpenKeyExA
0x42f01c GetUserNameW
0x42f020 LookupAccountNameW
Library SHELL32.dll:
0x42f1e4 ShellExecuteA
0x42f1e8 None
0x42f1ec SHGetFolderPathA
Library WININET.dll:
0x42f204 HttpOpenRequestA
0x42f208 InternetOpenUrlW
0x42f20c InternetReadFile
0x42f210 InternetConnectA
0x42f214 HttpSendRequestA
0x42f218 InternetCloseHandle
0x42f21c InternetOpenA
0x42f224 HttpSendRequestExW
0x42f228 HttpEndRequestA
0x42f22c InternetOpenW
0x42f230 InternetOpenUrlA
0x42f234 InternetWriteFile
Library gdiplus.dll:
0x42f23c GdipSaveImageToFile
0x42f244 GdipDisposeImage
0x42f250 GdiplusShutdown
0x42f254 GdiplusStartup

!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
j h,CC
j hPCC
j h|CC
jDh`DC
j<h<EC
jLhPIC
jPh`JC
j@hhKC
j h\MC
j?hPNC
CM @PRj
QQSVWd
URPQQh
;t$,v-
UQPXY]Y[
SVWj03
WWWSHSh
WPWWWS
:u"f9z
<at.<rt!<wt
<=upG8
j,hX{C
QQSVj8j@
zSSSSj
f9:t!V
u kE$<
PPPPPPPP
PPPPPWS
PP9E u:PPVWP
D8(Ht'
bad allocation
bad exception
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__swift_1
__swift_2
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
operator co_await
operator<=>
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
`anonymous namespace'
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
CorExitProcess
UTF-16LEUNICODE
AreFileApisANSI
CompareStringEx
LCMapStringEx
LocaleNameToLCID
AppPolicyGetProcessTerminationMethod
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
?5Wg4p
%S#[k=
"B <1=
_hypot
_nextafter
Unknown exception
bad array new length
invalid stoi argument
stoi argument out of range
cfac6b67d21f51e528b5c2e3168ca73b
85f469ce401df19fc5a7f9408bc52f06
010079
20a957d38de2bd1c5d289122ce239744
OEEwIEzqPaG5F MtEt==
N7ppJUMfYdGEGw2p2T6e1Okm3Bey
OD43HB==
Q1M4JU8WRNy6Hq==
17529YQgOdL9TG==
W5NKQFAPVSC=
N5NAUXAW2JqAOQQaKRmIXMVxyx6PTusyKH9WOjv=
KH9WPjve
KnAxMh==
W59IQG9xXbLhNMpd4j tdT3SNAarbiJwf8NeL4QufdLz8v3f4kOjdT95KiSwTYXk1V==
W59IQG9xXbLhNMpd4j tdT3SNAarbiJwf8NeL4QufdLz8v3f4kOjdT95HSeybC1z12JeQYIhf rY5wZm3zCAdTBcPSGB
W8Rj8oMXfr==
071mDD4zLwzSLupMzz tNUI9
W59IQG9xXbLhNMpd4j tdT3SNAarbiJwf8NeL4QufdLz8v3f4kOjdT95KiSw
esVwUHsoPqyl
KH9GUXshgxKlFRVIzzJ=
WMJxU4EdeOC=
W59IQG9xXbLhNMpd4j tdT3SNAarbiJwf8NeL4QufdLz8v3f4kOjdT95HSeybC1z12JeP3chexmlLccmQDWsen==
L0VVMWEMXbZLMKBzAN==
ZJFy8B==
WJ9VQB==
LsZBKR==
LsNmKR==
Lr9BKR==
LrJrKR==
LrFAKR==
LsBlKR==
LsVwKR==
LrRvKR==
LrF4KR==
Lrx4KR==
Lr9pKR==
08JnUD0gexnc
V1Fr7h==
cMR28EjrOn==
cMR28IH2OpY=
WLx3U3gqfpY=
LsVw6YL5
e7hn7HrvP Vp6wA=
c7VA7nQoPqyzTwBm
T7V2OnAWdOPqOTpt5DWnUN9e2r==
WMJxU4EdeLHm8wJ7
S0ZDP2LcXTZr8xhb4jV=
S2Zr8nz=
U7FB8HQufTj CuBbPd==
T0NHQB==
WLFwUHzcXTLo8NNj5El=
TL9l9H4uLw4qS7==
OEYyQH4W1NnYTMRV4jmUgH==
Srl2UHQi2NVpTNM=
Vr9A9H4q
W79y6H4v
S79v73Mr
X7lwMHQi2NVpTNM=
OIEAHALXQa39IG==
S79w9HQqgtRZ9NFfFfCnfNBS1SyjcjIw1r9A7TWg1OHmIoFc30Wo1xJq5OXvLOSu
NX0vGTVp
FVpF730W2NV5FKVj40CpeTpS1R6wOetnd8JvGXMdgxubCw9b3TV3KdV 4BBkOutnc1xn7nAp2KQn
Kl0ML34qgxLz8s5O6UCfQ F 3CyuaSFifLlx7j4r1UHq8s5t5EKf0N4FsbXM
FVovGTVpOJQ=
NX0Pxh==
R8Nl8kVt
NrpyUx==
S79w9HQqgtRZ9NFfFfCbeyFk1RKjdCdwdn96GY9ZgpRr6TNnCUWsdxZmOX6mZSI=
W6lVQFQJ0vD67dNf3kSxdT9S3h6uUYN1ZJNx7oMueTnhKScn4EWU1ONGORYnXAFwd2B39HQuWdvyTG==
S79v8IQW2OzTSM5f
01JlUHQi2T8u5cxm3T6peyJq3YO3dj65g2oyHUDvQuK7HpkZCS9=
N2Vw6XIr2xKy
W6lVQFQJ0vD67dNf3kSxdT9S3h6uUYN1ZJNx7oMueTnhPM9j5DWeXdpcPR6eQW1PXKJROGsSVLHKNRA=
W6lVQFQJ0vDA6dVs3ZyN1OUoCyCeUYNzfrllUYI9TdvE5MRy2UOqdxJXNAWrZCNw
XrlmUX4FUr==
ZIAyHEv=
TLVoTYQogwDq8xVj3jetNclKPSKxbDN1c19w
TLVoTYQogwDq8xVj3jetNcpKPSKxbDN1c19w
W59IQG9xXbLhNMpd4j tdT3SNAarbiJwf8MiOmM9TULD7cZo5C0feeRh2X1=
WMJxUIQfgvVm6MY=
OoAzJR==
OoAAHh==
OoAzIh==
S8VA8nQqgvz65MBe
11Nq7zwVivDGKQBNzzJ=
KnAxPDve
S5FFOGHcL8==
QqIkDD4B
QpYkDD4B
LnZH HgW
esVwUHsoPqyzTNlf
KsRj83ondNnxCscgzz jdJEa
KnAoEjwWdNRq6TZUzAFaL 29PBSuIw==
LnYiMYclgty=
KnAoEjwu2NUl
KHYoDB==
WL95UYEvdxLx6s9f6DV=
N1V6UXIXgxbA6dFp3DmdgJFqPRYxdCNAc1dwUXLcOLPu6wYazd==
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
NtUnmapViewOfSection
ntdll.dll
invalid string position
string too long
D:\Mktmp\Amadey\Release\Amadey.pdb
.text$di
.text$mn
.text$x
.text$yd
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCU
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIC
.CRT$XIZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$r
.rdata$sxdata
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.data$r
.rsrc$01
.rsrc$02
ReadFile
GetModuleFileNameA
WriteProcessMemory
HeapFree
VirtualFree
WriteFile
VirtualAlloc
CreateMutexW
GetVersionExW
SuspendThread
GetComputerNameExW
ResumeThread
GetModuleHandleA
SetCurrentDirectoryA
GetTempPathA
CopyFileA
GetLastError
GetFileAttributesA
CreateFileA
CloseHandle
GetSystemInfo
CreateThread
HeapAlloc
GetThreadContext
GetProcAddress
VirtualAllocEx
LocalFree
RemoveDirectoryA
ReadProcessMemory
GetProcessHeap
CreateProcessA
CreateDirectoryA
SetThreadContext
KERNEL32.dll
ReleaseDC
GetSystemMetrics
USER32.dll
DeleteObject
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
GDI32.dll
LookupAccountNameW
GetUserNameW
ConvertSidToStringSidW
RegOpenKeyExA
RegSetValueExA
GetUserNameA
RegQueryValueExA
RegGetValueA
RegCloseKey
ADVAPI32.dll
ShellExecuteA
SHGetFolderPathA
SHELL32.dll
HttpOpenRequestA
InternetOpenUrlW
InternetWriteFile
InternetOpenUrlA
InternetOpenW
HttpEndRequestA
HttpSendRequestExW
HttpAddRequestHeadersA
InternetOpenA
InternetCloseHandle
HttpSendRequestA
InternetConnectA
InternetReadFile
WININET.dll
GdipSaveImageToFile
GdipGetImageEncodersSize
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipGetImageEncoders
GdiplusShutdown
GdiplusStartup
gdiplus.dll
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetModuleFileNameW
GetStdHandle
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
CompareStringW
LCMapStringW
DeleteFileW
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
SetFilePointerEx
HeapSize
HeapReAlloc
SetEndOfFile
ReadConsoleW
WriteConsoleW
DecodePointer
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVinvalid_argument@std@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
.?AVtype_info@@
.?AVbad_exception@std@@
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVbad_array_new_length@std@@
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
0#0(020C0H0R0c0h0r0
1#1(121C1H1R1c1h1r1
2#2(222C2H2R2c2h2r2
3#3(323C3H3R3c3h3r3
4#4(424C4H4R4c4h4r4
5#5(525C5H5R5c5h5r5
6#6(626C6H6R6c6h6r6
7#7(727C7H7R7c7h7r7
8#8(828C8H8R8c8h8r8
9#9(929C9H9R9c9h9r9
:#:(:2:C:H:R:c:h:r:
;#;(;2;C;H;R;c;h;r;
<#<(<2<C<H<R<c<h<r<
=#=(=2=C=H=R=c=h=r=
>#>(>2>C>H>R>c>h>r>
?#?(?2?C?H?R?c?h?r?
0#0(020A0Q0a0s0x0
1E1m1s1
2%3*303g3
4"4c4j4
4#5)5B5I5v5
6"6)6F6L6S6
>L>X>7?e?
8)8<8m8{8
;,;O;r;
=0V0q0
4V465E5^5w5
6,6;6B6M6W6b6k6F7U7k7
8&959b9
:;c;|;
1=1Y1A2Y2^2
505R5Y5
162H2|2
8J819@9
>S>:?I?
4\4C5~5
8*8<8_86;E;
<2<D<M<^<
0/3X3_5
8/8D9o9
1$2W2s2&383T3
?%?G?p?
0/0Q0s0
F0X0|0
81<6=H=_=
314N4I7X7b7l7p7t7x7
7*81969D9J9S9
F061G1b1
66607L8
?+?9?[?}?
0(0Y0V1V4x4f5
4'4B4]4
7&868M8_8~8
1&1E1`1{1
2$242J2S2^2e2
3 303@3P3Y3
4"5H5W5n5t5z5
8,818>8x8Y9l9v9%:.:6:q:{:
;%;,;?; <@<J<m<
> >&>P>v>
9)9=9Y9c9m9{9
485@7E7p7u7
7%818N9U9
:.:V:q:v:{:
;";';,;J;T;`;e;j;
;$<7<U<c<
>H>O>T>X>\>`>
:2:::D:M:^:p:
7'8:8l;Z<d<q<
<==`=g=
50>0w0
6$7s7~7
9"9-939A9_9x9}9
<)<.<7<~<
===F=N=k=
0.0=0K0W0c0q0
1151I1R1
7,868Q8
=i>D?K?{?
020P0w0
0#181J1W1p1
22D2`2n2z2
3C3[3k3
4+4;4@4E4`4j4z4
5 5/5:5?5D5e5u5
6D6V6b6z6
9.989n9^<
0!1(1x1
4 5W5i5
94:z:E=+>
111L1V1
1,2K2n2
5;6G6Y6
7$7-7H7u7
0$0+020?0
3,3>3P3b3t3
4%4Z5#6
9@9T9w9
:?:T:e:
:4;Z;r;
>-?^?}?
:&:0:::D:Q:Z:c:s:
<+<0<6<@<J<`<g<t<
?(?/?[?
>+>6>F>
1%292\2
5*5h5{5
8!9+9i9
?8?C?P?b?
G0\0e0n0
4i4q4y4
515=5I5i5
6*6=7n7
;k;l<|<
=(=.=7=q=
>\>e>n>w>
4*4@4H4
7'9t9e:
:;;V;b;l;
<"<,<W<a<k<
=!=+=B=L=w=
>7>A>K>b>l>
?"?,?W?a?k?
0!0+0B0L0w0
171A1K1b1l1
2"2,2W2a2k2
3!3+3B3L3w3
474A4K4b4l4
5"5,5W5a5k5
6!6+6B6L6w6
777A7K7b7l7
8"8,8W8a8k8
9!9+9B9L9w9
:7:A:K:b:l:
;";,;W;a;k;
<!<+<B<L<w<
=7=A=K=b=l=
>">,>W>a>k>
?!?+?B?L?w?
070A0K0b0l0
1"1,1W1a1k1
2!2+2B2L2w2
373A3K3b3l3
4"4,4W4a4k4
5!5+5B5L5w5
676A6K6b6l6
7"7,7W7a7k7
8!8+8B8L8w8
979A9K9b9l9
:":,:W:a:k:
;!;+;B;L;w;
<7<A<K<b<l<
="=,=W=a=k=
>!>+>B>L>w>
?7?A?K?b?l?
0"0,0W0a0k0
1!1+1B1L1w1
272A2K2b2l2
3"3,3W3a3k3
4!4+4B4L4w4
575A5K5b5l5
6"6,6W6a6k6
7!7+7B7L7w7
878A8K8b8l8
9"9,9W9a9k9
:!:+:B:L:w:
;7;A;K;b;l;
<"<,<W<a<k<
=!=+=B=L=w=
>7>A>K>b>l>
\2d2h2l2p2t2x2|2
3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
5 5$5(5,5054585<5@5D5H5L5P5h5p5x5
6 6(60686@6H6P6X6`6h6p6x6
7 7(70787@7H7P7X7`7h7p7x7
8 8(80888@8H8P8X8`8h8p8x8
3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3X8\8`8d8h8l8p8t8x8|8
9 9$9(9,9094989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|9
5 5$5(5l5t5|5
6$6,646<6D6L6T6\6d6l6t6|6
7$7,747<7D7L7T7\7d7l7t7|7
8$8,848<8D8L8T8\8d8l8t8|8
9$9,949<9D9L9T9\9d9l9t9|9
:$:,:4:<:D:L:T:\:d:l:t:|:
;$;,;4;<;D;L;T;\;d;l;t;|;
<$<,<4<<<D<L<T<\<d<l<t<|<
7 7(70787@7H7P7X7`7h7p7x7
8 8(80888@8H8P8X8`8h8p8x8
9 9(90989@9H9P9X9`9h9p9x9
: :(:0:8:@:H:P:X:`:h:p:x:
; ;(;0;8;@;H;P;X;`;h;p;x;
< <(<0<8<@<H<P<X<`<h<p<x<
= =(=0=8=@=H=P=X=`=h=p=x=
1$1,141<1D1L1T1\1d1l1t1|1
,00080
1,1<1@1P1T1X1\1d1|1
2$2(282<2@2H2`2p2t2x2|2
3$3(3,3D3
8$8,888X8d8
9,949<9D9L9T9\9d9l9t9|9
: :,:L:T:`:
;,;4;<;D;L;T;\;h;
<$<,<4<<<D<L<T<\<h<
=$=0=P=X=`=l=
>8>D>d>l>t>
? ?0?T?\?d?l?t?|?
080@0P0t0|0
1$1,141<1D1L1T1\1d1l1t1|1
2 2@2H2P2X2`2p2
3$3,343<3D3L3T3\3d3l3t3|3
4 4(40484H4l4t4|4
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6p6
7$7,747<7D7L7T7\7d7l7t7|7
8,848<8D8L8T8\8d8l8t8|8
9$9,949<9D9L9T9\9h9
:$:,:4:<:D:L:T:\:d:l:t:|:
;$;,;4;<;D;L;T;\;d;l;t;|;
<,<4<<<D<L<T<\<d<l<t<|<
=<=D=L=T=\=d=l=t=|=
>$>,>4><>D>L>T>\>d>l>t>|>
?$?,?4?<?D?L?T?\?d?l?t?|?
0<0D0L0T0\0d0l0t0|0
1$1,141<1D1L1T1\1d1l1t1|1
2$2,242<2D2L2X2|2
3$3,343<3D3L3T3\3d3l3t3|3
4$4,444<4D4L4T4\4d4l4t4
5$5,545<5D5L5T5\5d5l5t5|5
6,646<6D6L6T6\6d6l6t6|6
787D7d7l7t7|7
8$8,80848<8P8l8p8
989D9L9t9x9
:0:P:p:
;0;P;p;
<0<P<p<
=0=P=p=
> >(><>D>X>`>h>p>
101@1P1`1p1
7 7$7(7,70747
6D6d6
Bapi-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
kernel32
api-ms-
xmscoree.dll
Capi-ms-win-core-datetime-l1-1-1
api-ms-win-core-file-l1-2-2
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
advapi32
api-ms-win-appmodel-runtime-l1-1-2
user32
ext-ms-
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
((((( H
((((( H
(
Cja-JP
zh-CHS
az-AZ-Latn
uz-UZ-Latn
kok-IN
syr-SY
div-MV
quz-BO
sr-SP-Latn
az-AZ-Cyrl
uz-UZ-Cyrl
quz-EC
sr-SP-Cyrl
quz-PE
smj-NO
bs-BA-Latn
smj-SE
sr-BA-Latn
sma-NO
sr-BA-Cyrl
sma-SE
sms-FI
smn-FI
zh-CHT
az-az-cyrl
az-az-latn
bs-ba-latn
div-mv
kok-in
quz-bo
quz-ec
quz-pe
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
syr-sy
uz-uz-cyrl
uz-uz-latn
zh-chs
zh-cht
CONOUT$
image/jpeg
Antivirus Signature
Bkav W32.AIDetect.malware2
Lionic Trojan.Win32.Deyma.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
McAfee Artemis!369321F33D5F
Cylance Unsafe
Zillya Clean
Sangfor Trojan.Win32.Save.a
K7AntiVirus Clean
BitDefender Gen:Variant.Lazy.158178
K7GW Clean
CrowdStrike win/malicious_confidence_100% (W)
Baidu Clean
VirIT Clean
Cyren W32/Amadey.A.gen!Eldorado
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/TrojanDownloader.Amadey.A
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 100)
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba TrojanDownloader:Win32/Amadey.a5fd8235
NANO-Antivirus Clean
SUPERAntiSpyware Clean
MicroWorld-eScan Gen:Variant.Lazy.158178
Rising Trojan.Generic@AI.100 (RDML:mMTw7NwLuqPivtIFNn7ejQ)
Ad-Aware Gen:Variant.Lazy.158178
Emsisoft Gen:Variant.Lazy.158178 (B)
Comodo Clean
F-Secure Clean
DrWeb Clean
VIPRE Gen:Variant.Lazy.158178
TrendMicro Clean
McAfee-GW-Edition Clean
Trapmine Clean
FireEye Generic.mg.369321f33d5ffaee
Sophos Mal/Horst
Ikarus Clean
GData Gen:Variant.Lazy.158178
Jiangmin TrojanDownloader.Deyma.akw
Webroot Clean
Avira Clean
MAX malware (ai score=84)
Antiy-AVL Clean
Kingsoft Win32.Troj.Generic_a.a.(kcloud)
Gridinsoft Trojan.Win32.Gen.bot
Arcabit Trojan.Lazy.D269E2
ViRobot Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Amadey.PAB!MTB
Google Detected
AhnLab-V3 Malware/Win.Trojanspy.C5238800
Acronis suspicious
BitDefenderTheta Gen:NN.ZexaF.36106.puW@amB2DIoi
ALYac Gen:Variant.Lazy.158178
TACHYON Clean
VBA32 Clean
Malwarebytes Trojan.Amadey
Panda Trj/Genetic.gen
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002C0RL722
Tencent Clean
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Injector.EGTS!tr
AVG Win32:BotX-gen [Trj]
Cybereason malicious.33d5ff
Avast Win32:BotX-gen [Trj]
No IRMA results available.