Static | ZeroBOX

PE Compile Time

2022-12-13 23:26:18

PDB Path

D:\Mktmp\Amadey\Release\Amadey.pdb

PE Imphash

857774b8dd5bc6abe25ef09f890c7f72

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0002e776 0x0002e800 6.43995331324
.rdata 0x00030000 0x00009d44 0x00009e00 4.98071448695
.data 0x0003a000 0x0000444c 0x00001800 1.39570295002
.rsrc 0x0003f000 0x000001e0 0x00000200 4.71767883295
.reloc 0x00040000 0x00002950 0x00002a00 6.59199748858

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x0003f060 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x430040 CopyFileA
0x430044 GetLastError
0x430048 GetFileAttributesA
0x43004c CreateFileA
0x430050 CloseHandle
0x430054 GetSystemInfo
0x430058 CreateThread
0x43005c HeapAlloc
0x430060 GetThreadContext
0x430064 GetProcAddress
0x430068 VirtualAllocEx
0x43006c GetTempPathA
0x430070 RemoveDirectoryA
0x430074 ReadProcessMemory
0x430078 GetProcessHeap
0x43007c CreateProcessA
0x430080 CreateDirectoryA
0x430084 SetThreadContext
0x430088 WriteConsoleW
0x43008c ReadConsoleW
0x430090 SetEndOfFile
0x430094 HeapReAlloc
0x430098 HeapSize
0x43009c Sleep
0x4300a4 GetModuleHandleA
0x4300a8 ResumeThread
0x4300ac SuspendThread
0x4300b0 GetComputerNameExW
0x4300b4 GetVersionExW
0x4300b8 CreateMutexW
0x4300bc VirtualAlloc
0x4300c0 WriteFile
0x4300c4 VirtualFree
0x4300c8 HeapFree
0x4300cc WriteProcessMemory
0x4300d0 GetModuleFileNameA
0x4300d4 LocalFree
0x4300d8 ReadFile
0x4300dc SetFilePointerEx
0x4300e4 GetConsoleMode
0x4300e8 GetConsoleCP
0x4300ec FlushFileBuffers
0x4300f0 GetStringTypeW
0x430100 WideCharToMultiByte
0x430104 GetCPInfo
0x430108 GetOEMCP
0x43010c GetACP
0x430110 IsValidCodePage
0x430114 FindNextFileW
0x430118 FindFirstFileExW
0x43011c FindClose
0x430120 SetStdHandle
0x430124 GetFullPathNameW
0x43012c DeleteFileW
0x430130 DecodePointer
0x43013c GetCurrentProcess
0x430140 TerminateProcess
0x430148 IsDebuggerPresent
0x43014c GetStartupInfoW
0x430150 GetModuleHandleW
0x430158 GetCurrentProcessId
0x43015c GetCurrentThreadId
0x430164 InitializeSListHead
0x430168 RtlUnwind
0x43016c RaiseException
0x430170 SetLastError
0x430174 EncodePointer
0x430188 TlsAlloc
0x43018c TlsGetValue
0x430190 TlsSetValue
0x430194 TlsFree
0x430198 FreeLibrary
0x43019c LoadLibraryExW
0x4301a0 ExitProcess
0x4301a4 GetModuleHandleExW
0x4301a8 CreateFileW
0x4301ac GetDriveTypeW
0x4301b4 GetFileType
0x4301b8 PeekNamedPipe
0x4301c4 GetModuleFileNameW
0x4301c8 GetStdHandle
0x4301cc GetCommandLineA
0x4301d0 GetCommandLineW
0x4301d4 MultiByteToWideChar
0x4301d8 CompareStringW
0x4301dc LCMapStringW
Library USER32.dll:
0x4301f4 GetSystemMetrics
0x4301f8 ReleaseDC
0x4301fc GetDC
Library GDI32.dll:
0x43002c SelectObject
0x430030 CreateCompatibleDC
0x430034 DeleteObject
0x430038 BitBlt
Library ADVAPI32.dll:
0x430000 RegCloseKey
0x430004 RegGetValueA
0x430008 RegQueryValueExA
0x43000c GetUserNameA
0x430010 RegSetValueExA
0x430014 RegOpenKeyExA
0x43001c GetUserNameW
0x430020 LookupAccountNameW
Library SHELL32.dll:
0x4301e4 ShellExecuteA
0x4301e8 None
0x4301ec SHGetFolderPathA
Library WININET.dll:
0x430204 HttpOpenRequestA
0x430208 InternetOpenUrlW
0x43020c InternetReadFile
0x430210 InternetConnectA
0x430214 HttpSendRequestA
0x430218 InternetCloseHandle
0x43021c InternetOpenA
0x430224 HttpSendRequestExW
0x430228 HttpEndRequestA
0x43022c InternetOpenW
0x430230 InternetOpenUrlA
0x430234 InternetWriteFile
Library gdiplus.dll:
0x43023c GdipSaveImageToFile
0x430244 GdipDisposeImage
0x430250 GdiplusShutdown
0x430254 GdiplusStartup

!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
j h,SC
j hPSC
j h|SC
jDhXTC
j<h4UC
jLhHYC
jPhXZC
j@h`[C
j hT]C
j?hH^C
CM @PRj
QQSVWd
URPQQh
;t$,v-
UQPXY]Y[
SVWj03
WWWSHSh
WPWWWS
:u"f9z
<at.<rt!<wt
<=upG8
QQSVj8j@
zSSSSj
f9:t!V
u kE$<
PPPPPPPP
PPPPPWS
PP9E u:PPVWP
D8(Ht'
bad allocation
bad exception
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__swift_1
__swift_2
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
operator co_await
operator<=>
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
`anonymous namespace'
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
CorExitProcess
UTF-16LEUNICODE
AreFileApisANSI
CompareStringEx
LCMapStringEx
LocaleNameToLCID
AppPolicyGetProcessTerminationMethod
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
?5Wg4p
%S#[k=
"B <1=
_hypot
_nextafter
Unknown exception
bad array new length
invalid stoi argument
stoi argument out of range
388785d59fe357f0c8538881ec5e4b6d
bf045808586a2473c5a7441da6f3bfa9
e4a636
37688b5c260e03cb74c656e2f2dc0c81
FgFqJdDUJoUpFfhU
DZWeKtQkWEQn5S 1Uam Dem
Ev1YJu==
EjJvJtPWML2VTw==
RZ2WaRYeJrZWTM==
MXKESyINQ6Q=
DXKuWQIUXXEnOWR6VRfGSSOvME3RMzvAAz6QQcD=
Az6QRcDc
AfxrOa==
MX6CSzgvSpZ5NSq9ej3r9ZWQ1H8t5nMy60K9NXYsarZm8B4aekHh9Z23YpPyM30mRN==
MX6CSzgvSpZ5NSq9ej3r9ZWQ1H8t5nMy60K9NXYsarZm8B4aekHh9Z23VZbA5H4BRUG9SRQfanFL5C0hdzvy9Zua3ZDD
M0Od hUVaF==
QZYgFwbxGKNFLAqHKz3rI0B7
MX6CSzgvSpZ5NSq9ej3r9ZWQ1H8t5nMy60K9NXYsarZm8B4aekHh9Z23YpPy
5kSqWAAmKEM9
Az6AWQAfbLY9FXWDKzC=
MEGrWXMb 2Q=
MX6CSzgvSpZ5NSq9ej3r9ZWQ1H8t5nMy60K9NXYsarZm8B4aekHh9Z23VZbA5H4BRUG9RWkf LA9Lidh1DPq t==
BSSPOPMKSpcyMQCuLN==
PBCs u==
MB6PSu==
BkWvMK==
BkKgMK==
Bj6vMK==
BjGlMK==
BjCuMK==
BkyfMK==
BkSqMK==
BjOpMK==
BjCYMK==
BjuYMK==
Bj6jMK==
Q0GhWw8e LB0
LTCl9a==
3EOW xrpJB==
3EOW BP0JDb=
MDuXWWooaDb=
BkSq8RT3
5Zeh9AztKn9c6CB=
3ZSu9gYmKEMmTCCh
JZSWQgIU923dOZqofDPlPT2cfy==
MEGrWXMb ZV 8CK2
ISWxRVTaS7ce8Di7ejO=
IUWl gH=
KZCv AYsa7xXCAC70d==
JSKBSu==
MDCqWAHaS7Zb8TOefEe=
JD6faAbsGKhdSc==
EwVsSAbUW1BLTSSQejfSbN==
IjiWWAYgX19cTTN=
Lj6uaAbo
MZ6s8Abt
IZ6p9WUp
NZiqOAYgX19cTTN=
EABuJtTVLogWIM==
IZ6qaAYobH5M9TGaQfvlaTuQeZvl6oLyRj6u9M4eW2V IuG8d0PmWDCoiVUxETVw
DPXpIM3n
vNmz9W8UX19SFQWee0vn ZiQeY3yHjwp40GpIQUbbLIZCC 7dTO1FjO8hIymHzwp3Tuh9gInXY4a
AdXGNWbobLZm8y6JgUvdLfy8gJvw4XIk6Dir9cbpW8Vd8y6ofEDdVTXDGiUO
vNlpIM3nJX4=
DPXJza==
H0Kf d3r
DjmsWq==
IZ6qaAYobH5M9TGaQfv EyieYHl7Hgy4f60IRgXbD5e6ZOiNUPq9DSk243oSXL=
MYiPSyYHVJRT7jOadkLv9Z2Qgo3wN3Q3PBKr9hUs 7B5KYdieEPSWUGE2YVpQFIy4UyXaAYsRrJlTM==
IZ6p BYUX2NGSS6a
QTGfWAYgX7lh5iyhdTZn ECog5L57o977UlsJNLtLIYUHvlUNS2=
DUSq8QQpXLYl
MYiPSyYHVJRT7jOadkLv9Z2Qgo3wN3Q3PBKr9hUs 7B5PS efDPcSjia3Y3gJ14RNCGLQzAQQZVxNXB=
MYiPSyYHVJRn6jWndZrLWUNmQFzgN3QB6jifWRQ7OrJr5SStcUHo9DCV1HTtSHQy
NjigWQbDPF==
PAxsJxD=
JDSiVRYmbKRd8DWedj8rIieI3ZHz5IQ33T6q
JDSiVRYmbKRd8DWedj8rIiiI3ZHz5IQ33T6q
MX6CSzgvSpZ5NSq9ej3r9ZWQ1H8t5nMy60JcQfU7O8Zq7i0jfCTd kKff4Y=
MEGrWBYdbJ9 6SZ=
EgxtLK==
EgxuJa==
EgxtKa==
I0Su gYobJNT5SC
RTKk9sETdJRtKWCIKzC=
AfxrRwDc
IXCzQzPaGl==
GiFeFwbz
GhVeFwbz
BfWBbAoU
5kSqWAAmKEMmTTma
AkOd Wwl91BkCydbKz3h9Px9
AfxiGcEU915d6Z0PKAy9GfV73IPwBB==
BfVcORkjbHM=
AfxiGcEsX189
AzViFu==
MD6ZWRMt9LZk6y agDO=
DTS0WQQVbLpn6jGkdDfbbPyo3YVz7HQC3TaqWQTaJZ3h6CZ6Kd==
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
NtUnmapViewOfSection
ntdll.dll
invalid string position
string too long
D:\Mktmp\Amadey\Release\Amadey.pdb
.text$di
.text$mn
.text$x
.text$yd
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCU
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIC
.CRT$XIZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$r
.rdata$sxdata
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.data$r
.rsrc$01
.rsrc$02
ReadFile
GetModuleFileNameA
WriteProcessMemory
HeapFree
VirtualFree
WriteFile
VirtualAlloc
CreateMutexW
GetVersionExW
SuspendThread
GetComputerNameExW
ResumeThread
GetModuleHandleA
SetCurrentDirectoryA
GetTempPathA
CopyFileA
GetLastError
GetFileAttributesA
CreateFileA
CloseHandle
GetSystemInfo
CreateThread
HeapAlloc
GetThreadContext
GetProcAddress
VirtualAllocEx
LocalFree
RemoveDirectoryA
ReadProcessMemory
GetProcessHeap
CreateProcessA
CreateDirectoryA
SetThreadContext
KERNEL32.dll
ReleaseDC
GetSystemMetrics
USER32.dll
DeleteObject
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
GDI32.dll
LookupAccountNameW
GetUserNameW
ConvertSidToStringSidW
RegOpenKeyExA
RegSetValueExA
GetUserNameA
RegQueryValueExA
RegGetValueA
RegCloseKey
ADVAPI32.dll
ShellExecuteA
SHGetFolderPathA
SHELL32.dll
HttpOpenRequestA
InternetOpenUrlW
InternetWriteFile
InternetOpenUrlA
InternetOpenW
HttpEndRequestA
HttpSendRequestExW
HttpAddRequestHeadersA
InternetOpenA
InternetCloseHandle
HttpSendRequestA
InternetConnectA
InternetReadFile
WININET.dll
GdipSaveImageToFile
GdipGetImageEncodersSize
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipGetImageEncoders
GdiplusShutdown
GdiplusStartup
gdiplus.dll
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetModuleFileNameW
GetStdHandle
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
CompareStringW
LCMapStringW
DeleteFileW
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
SetFilePointerEx
HeapSize
HeapReAlloc
SetEndOfFile
ReadConsoleW
WriteConsoleW
DecodePointer
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVinvalid_argument@std@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
.?AVtype_info@@
.?AVbad_exception@std@@
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVbad_array_new_length@std@@
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
0#0(020C0H0R0c0h0r0
1#1(121C1H1R1c1h1r1
2#2(222C2H2R2c2h2r2
3#3(323C3H3R3c3h3r3
4#4(424C4H4R4c4h4r4
5#5(525C5H5R5c5h5r5
6#6(626C6H6R6c6h6r6
7#7(727C7H7R7c7h7r7
8#8(828C8H8R8c8h8r8
9#9(929C9H9R9c9h9r9
:#:(:2:C:H:R:c:h:r:
;#;(;2;C;H;R;c;h;r;
<#<(<2<C<H<R<c<h<r<
=#=(=2=C=H=R=c=h=r=
>#>(>2>C>H>R>c>h>r>
?#?(?2?C?H?R?c?h?r?
0#0(020A0Q0a0s0x0
1E1m1s1
2%3*303g3
4"4c4j4
4#5)5B5I5v5
6"6)6F6L6S6
='=7===F=
999Y9l9
111I1U1e1j1p1w1
2@2\2h2v2
6.6G6Z6s6
7'727;7
:2:e:~:
>K>m>t>9?
3I3e3F4Y4
9+9j9Q:`:
=>>%?4?s?
4G4.5=5|5c6
6&757L7
819J9\9
=%=/=R=d=m=~=/>
9$9O9d:
2r4$59677\7j7
4@4U5l5_6
<0<Y<{<
;,;q>v?
3*3N3X3
;(;.;7;z;
>9>?>M>S>\>
6J8K9Q:
<:<:>f>
5?7N7\7`7d7h7l7p7t7x7|7
4'5P5y5
:(:C:a:|:
:F;a;~;
>)>>>]>
>C?N?_?p?|?
8&8E8`8{8
9$949J9S9^9e9
: :0:@:P:Y:
;"<H<W<n<t<z<
?,?1?>?x?
Y0l0v0%1.161q1{1
2%2,2?2 3@3J3m3
5 5&5P5v5
0)0=0Y0c0m0{0
;8<@>E>p>u>
1.1V1q1v1{1
2"2'2,2J2T2`2e2j2
2$373U3c3
5H5O5T5X5\5`5
121:1D1M1^1p1
l2Z3d3q3
3=4`4g4
657>7w7
=$>s>~>
0$0/050C0a0z0
1181o1
3+30393
4?4H4P4m4
6$7>7M7[7g7s7
8$8/8E8Y8b8
><?F?a?
4y5T6[6
7'7@7^7
818F8X8e8~8
9#9(9-9R9n9|9
:Q:i:y:
;9;I;N;S;n;x;
<.<=<H<M<R<s<
= =+=R=d=p=
=*>#?R?
0<0F0|0l3
6,6f6m6
9%;,;o;
;.<e<w<
8?8Z8d8
8:9Y9|9
=I=U=g=
>>2>;>V>
6+72797@7M7
:(:::L:^:p:
;!;3;h<1=
? ?>?I?
&0>0n0
1M1b1s1
1*141>1H1R1_1h1q1
393>3D3N3X3n3u3
6%666=6i6
7(8Y:m:
5+565F5
8%999\9
<*<h<{<
0"0,0j0
686C6P6b6
6G7\7e7n7
;i;q;y;
<1<=<I<i<
=*==>n>
2k2l3|3
4(4.474q4
5\5e5n5w5
;*;@;H;
4"4,4W4a4k4
5!5+5B5L5w5
676A6K6b6l6
7"7,7W7a7k7
8!8+8B8L8w8
979A9K9b9l9
:":,:W:a:k:
;!;+;B;L;w;
<7<A<K<b<l<
="=,=W=a=k=
>!>+>B>L>w>
?7?A?K?b?l?
0"0,0W0a0k0
1!1+1B1L1w1
272A2K2b2l2
3"3,3W3a3k3
4!4+4B4L4w4
575A5K5b5l5
6"6,6W6a6k6
7!7+7B7L7w7
878A8K8b8l8
9"9,9W9a9k9
:!:+:B:L:w:
;7;A;K;b;l;
<"<,<W<a<k<
=!=+=B=L=w=
>7>A>K>b>l>
?"?,?W?a?k?
0!0+0B0L0w0
171A1K1b1l1
2"2,2W2a2k2
3!3+3B3L3w3
474A4K4b4l4
5"5,5W5a5k5
6!6+6B6L6w6
777A7K7b7l7
8"8,8W8a8k8
9!9+9B9L9w9
:7:A:K:b:l:
;";,;W;a;k;
<!<+<B<L<w<
=7=A=K=b=l=
>">,>W>a>k>
?!?+?B?L?w?
070A0K0b0l0
1"1,1W1a1k1
2!2+2B2L2w2
373A3K3b3l3
4"4,4W4a4k4
5!5+5B5L5w5
676A6K6b6l6
7"7,7W7a7k7
\2d2h2l2p2t2x2|2
3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
5 5$5(5,5054585<5@5D5H5L5P5h5p5x5
6 6(60686@6H6P6X6`6h6p6x6
7 7(70787@7H7P7X7`7h7p7x7
8 8(80888@8H8P8X8`8h8p8x8
3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3X8\8`8d8h8l8p8t8x8|8
9 9$9(9,9094989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|9
5 5$5(5l5t5|5
6$6,646<6D6L6T6\6d6l6t6|6
7$7,747<7D7L7T7\7d7l7t7|7
8$8,848<8D8L8T8\8d8l8t8|8
9$9,949<9D9L9T9\9d9l9t9|9
:$:,:4:<:D:L:T:\:d:l:t:|:
;$;,;4;<;D;L;T;\;d;l;t;|;
<$<,<4<<<D<L<T<\<d<l<t<|<
7 7(70787@7H7P7X7`7h7p7x7
8 8(80888@8H8P8X8`8h8p8x8
9 9(90989@9H9P9X9`9h9p9x9
: :(:0:8:@:H:P:X:`:h:p:x:
; ;(;0;8;@;H;P;X;`;h;p;x;
< <(<0<8<@<H<P<X<`<h<p<x<
= =(=0=8=@=H=P=X=`=h=p=x=
1$1,141<1D1L1T1\1d1l1t1|1
,00080
1,1<1@1P1T1X1\1d1|1
2$2(282<2@2H2`2p2t2x2|2
3$3(3,3D3
8$8,888X8d8
949<9D9L9T9\9d9l9t9|9
:(:4:T:\:h:
;4;<;D;L;T;\;d;p;
<,<4<<<D<L<T<\<d<p<
=$=,=8=X=`=h=t=
> >@>L>l>t>|>
? ?(?8?\?d?l?t?|?
0 0@0H0X0|0
1$1,141<1D1L1T1\1d1l1t1|1
2(2H2P2X2`2h2x2
3$3,343<3D3L3T3\3d3l3t3|3
4(40484@4P4t4|4
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6l6x6
7$7,747<7D7L7T7\7d7l7t7|7
848<8D8L8T8\8d8l8t8|8
9$9,949<9D9L9T9\9d9l9t9
:$:,:4:<:D:L:T:\:d:l:t:|:
;$;,;4;<;D;L;T;\;d;l;t;|;
<(<L<T<\<d<l<t<|<
=$=,=8=\=d=l=t=|=
>$>,>4><>D>L>T>\>d>l>t>|>
?$?,?4?<?D?L?T?\?d?l?t?|?
0$0,040@0d0l0t0|0
1$1,141<1D1L1T1\1d1l1t1|1
2$2,242<2D2L2T2\2d2l2t2|2
3$3,343<3D3P3t3|3
4$4,444<4D4L4T4\4d4l4t4|4
5$5,545<5D5L5T5\5d5l5x5
6$6,646<6D6L6T6\6d6l6t6|6
7$7,747<7D7L7T7\7d7l7t7|7
808<8\8d8l8t8x8
9$9(9,949H9d9h9
:0:<:D:l:p:
;(;H;h;
<(<H<h<
=(=H=h=
>(>H>h>
? ?4?<?P?X?`?h?|?
101@1P1`1p1
7 7$7(7,70747
6D6d6
LCjjjj
XCjjjh
Capi-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
kernel32
api-ms-
xmscoree.dll
Capi-ms-win-core-datetime-l1-1-1
api-ms-win-core-file-l1-2-2
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
advapi32
api-ms-win-appmodel-runtime-l1-1-2
user32
ext-ms-
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
((((( H
((((( H
(
Cja-JP
zh-CHS
az-AZ-Latn
uz-UZ-Latn
kok-IN
syr-SY
div-MV
quz-BO
sr-SP-Latn
az-AZ-Cyrl
uz-UZ-Cyrl
quz-EC
sr-SP-Cyrl
quz-PE
smj-NO
bs-BA-Latn
smj-SE
sr-BA-Latn
sma-NO
sr-BA-Cyrl
sma-SE
sms-FI
smn-FI
zh-CHT
az-az-cyrl
az-az-latn
bs-ba-latn
div-mv
kok-in
quz-bo
quz-ec
quz-pe
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
syr-sy
uz-uz-cyrl
uz-uz-latn
zh-chs
zh-cht
CONOUT$
image/jpeg
Antivirus Signature
Bkav W32.AIDetect.malware2
Lionic Trojan.Win32.Nymaim.4!c
tehtris Clean
DrWeb Trojan.MulDrop21.25581
MicroWorld-eScan Gen:Variant.Lazy.158178
FireEye Generic.mg.c6524cc2cb091e23
CAT-QuickHeal Clean
ALYac Gen:Variant.Lazy.158178
Cylance Unsafe
VIPRE Gen:Variant.Lazy.158178
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan-Downloader ( 005790d31 )
BitDefender Gen:Variant.Lazy.158178
K7GW Clean
Cybereason malicious.2cb091
BitDefenderTheta Gen:NN.ZexaF.36106.puW@aukH0Mii
VirIT Clean
Cyren W32/Amadey.A.gen!Eldorado
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/TrojanDownloader.Amadey.A
Zoner Clean
TrendMicro-HouseCall Trojan.Win32.PRIVATELOADER.YXCLNZ
Paloalto Clean
ClamAV Clean
Kaspersky HEUR:Trojan.Win32.Nymaim.gen
Alibaba TrojanDownloader:Win32/Nymaim.f4cd086e
NANO-Antivirus Clean
ViRobot Clean
Rising Spyware.Agent!8.C6 (TFE:5:UdgJwn0396Q)
Ad-Aware Gen:Variant.Lazy.158178
Emsisoft Gen:Variant.Lazy.158178 (B)
Comodo Clean
F-Secure Clean
Baidu Clean
Zillya Clean
TrendMicro Trojan.Win32.PRIVATELOADER.YXCLNZ
McAfee-GW-Edition BehavesLike.Win32.NetLoader.dh
Trapmine Clean
CMC Clean
Sophos Mal/Generic-S + Mal/Horst
Ikarus Win32.Outbreak
GData Win32.Trojan-Downloader.Amadey.01QQ87
Jiangmin Clean
Webroot W32.Nymaim
Google Detected
Avira HEUR/AGEN.1253146
MAX malware (ai score=86)
Antiy-AVL Trojan[Downloader]/Win32.Amadey
Kingsoft Win32.Troj.Undef.(kcloud)
Gridinsoft Trojan.Win32.Gen.bot
Arcabit Trojan.Lazy.D269E2
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.Win32.Nymaim.gen
Microsoft Trojan:Win32/Woreflint.A!cl
Cynet Malicious (score: 100)
AhnLab-V3 Malware/Win.Trojanspy.C5238800
Acronis suspicious
McAfee Artemis!C6524CC2CB09
TACHYON Clean
VBA32 Clean
Malwarebytes Trojan.Amadey
Panda Trj/Genetic.gen
APEX Malicious
Tencent Win32.Trojan.Nymaim.Fdhl
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Injector.EGTS!tr
AVG Win32:BotX-gen [Trj]
Avast Win32:BotX-gen [Trj]
No IRMA results available.