Static | ZeroBOX

PE Compile Time

2023-05-03 22:44:14

PDB Path

D:\Mktmp\Amadey\Release\Amadey.pdb

PE Imphash

30345caf7ab375dfe19647a32bba1efe

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00028c3d 0x00028e00 6.42776085632
.rdata 0x0002a000 0x00007f76 0x00008000 5.06122566225
.data 0x00032000 0x00002468 0x00001800 1.36546723258
.rsrc 0x00035000 0x000001e0 0x00000200 4.71229819329
.reloc 0x00036000 0x0000217c 0x00002200 6.63062972307

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x00035060 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x42a040 GetFileAttributesA
0x42a044 CreateFileA
0x42a048 CloseHandle
0x42a04c GetSystemInfo
0x42a050 CreateThread
0x42a054 HeapAlloc
0x42a058 GetThreadContext
0x42a05c GetProcAddress
0x42a060 VirtualAllocEx
0x42a064 LocalFree
0x42a068 GetLastError
0x42a06c ReadProcessMemory
0x42a070 GetProcessHeap
0x42a074 CreateProcessA
0x42a078 CreateDirectoryA
0x42a07c SetThreadContext
0x42a080 WriteConsoleW
0x42a084 ReadConsoleW
0x42a088 SetEndOfFile
0x42a08c SetFilePointerEx
0x42a090 GetTempPathA
0x42a094 Sleep
0x42a09c GetModuleHandleA
0x42a0a0 GetComputerNameExW
0x42a0a4 ResumeThread
0x42a0a8 GetVersionExW
0x42a0ac CreateMutexA
0x42a0b0 VirtualAlloc
0x42a0b4 WriteFile
0x42a0b8 VirtualFree
0x42a0bc HeapFree
0x42a0c0 WriteProcessMemory
0x42a0c4 GetModuleFileNameA
0x42a0c8 RemoveDirectoryA
0x42a0cc ReadFile
0x42a0d0 HeapReAlloc
0x42a0d4 HeapSize
0x42a0dc GetConsoleMode
0x42a0e0 GetConsoleCP
0x42a0e4 FlushFileBuffers
0x42a0e8 GetStringTypeW
0x42a0f8 WideCharToMultiByte
0x42a0fc GetCPInfo
0x42a100 GetOEMCP
0x42a104 GetACP
0x42a108 IsValidCodePage
0x42a10c FindNextFileW
0x42a110 FindFirstFileExW
0x42a114 FindClose
0x42a118 SetStdHandle
0x42a11c GetFullPathNameW
0x42a124 DeleteFileW
0x42a128 LCMapStringW
0x42a13c SetEvent
0x42a140 ResetEvent
0x42a148 CreateEventW
0x42a14c GetModuleHandleW
0x42a158 GetCurrentProcess
0x42a15c TerminateProcess
0x42a164 IsDebuggerPresent
0x42a168 GetStartupInfoW
0x42a170 GetCurrentProcessId
0x42a174 GetCurrentThreadId
0x42a17c InitializeSListHead
0x42a180 RaiseException
0x42a184 SetLastError
0x42a188 RtlUnwind
0x42a18c TlsAlloc
0x42a190 TlsGetValue
0x42a194 TlsSetValue
0x42a198 TlsFree
0x42a19c FreeLibrary
0x42a1a0 LoadLibraryExW
0x42a1a4 ExitProcess
0x42a1a8 GetModuleHandleExW
0x42a1ac CreateFileW
0x42a1b0 GetDriveTypeW
0x42a1b8 GetFileType
0x42a1bc PeekNamedPipe
0x42a1c8 GetModuleFileNameW
0x42a1cc GetStdHandle
0x42a1d0 GetCommandLineA
0x42a1d4 GetCommandLineW
0x42a1d8 MultiByteToWideChar
0x42a1dc CompareStringW
0x42a1e0 DecodePointer
Library USER32.dll:
0x42a1fc GetSystemMetrics
0x42a200 ReleaseDC
0x42a204 GetDC
Library GDI32.dll:
0x42a02c SelectObject
0x42a030 CreateCompatibleDC
0x42a034 DeleteObject
0x42a038 BitBlt
Library ADVAPI32.dll:
0x42a000 RegCloseKey
0x42a004 RegGetValueA
0x42a008 RegQueryValueExA
0x42a00c GetUserNameA
0x42a010 RegSetValueExA
0x42a014 RegOpenKeyExA
0x42a01c GetUserNameW
0x42a020 LookupAccountNameW
Library SHELL32.dll:
0x42a1e8 SHGetFolderPathA
0x42a1ec ShellExecuteA
0x42a1f0 None
0x42a1f4 SHFileOperationA
Library WININET.dll:
0x42a20c HttpOpenRequestA
0x42a210 InternetReadFile
0x42a214 InternetConnectA
0x42a218 HttpSendRequestA
0x42a21c InternetCloseHandle
0x42a220 InternetOpenA
0x42a228 HttpSendRequestExW
0x42a22c HttpEndRequestA
0x42a230 InternetOpenW
0x42a234 InternetOpenUrlA
0x42a238 InternetWriteFile
Library gdiplus.dll:
0x42a240 GdipSaveImageToFile
0x42a248 GdipDisposeImage
0x42a254 GdiplusShutdown
0x42a258 GdiplusStartup

!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
CM @PRj
~~hPDC
E0SVW3
CE8VWh
CL$@RQ
L$T_^[3
tXh$-C
u"h0:C
URPQQh
;t$,v-
UQPXY]Y[
SVWj03
WWWSHSh
WPWWWS
:u"f9z
35(;C
<at.<rt!<wt
<=upG8
QQSVj8j@
zSSSSj
f9:t!V
f95|AC
u kE$<
PPPPPPPP
PPPPPWS
PP9E u:PPVWP
D8(Ht'
bad allocation
SleepConditionVariableCS
WakeAllConditionVariable
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__swift_1
__swift_2
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
operator co_await
operator<=>
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
`anonymous namespace'
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
CorExitProcess
UTF-16LEUNICODE
AreFileApisANSI
CompareStringEx
LCMapStringEx
LocaleNameToLCID
AppPolicyGetProcessTerminationMethod
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
?5Wg4p
%S#[k=
"B <1=
_hypot
_nextafter
Unknown exception
bad array new length
invalid stoi argument
stoi argument out of range
db957457369482ec492f41ac0f1a319b
27d75989acd3e0de8a0fe09a3de3e6f9
eb9685
ac7bcb8d2f52f8af0c35488b2507c0c7
RUSoIcyWDeGVIaYB
O1mYJzbEJiTeWdkAE0czSwV6Asro5q==
Pz2YIJ==
QnXeIfOYEyaqWr==
e33fVQL0DhTXWH==
X1LCRxzPKWK=
O1LsVPzWRNyoRRQiMScTOLRHxHZNLoyyLD7OPbu=
LD7OQbue
LjypN ==
X17ARy8xMfT6QNpl6k0E5SZ2MK4p4cPwg4L7MWPu5hTnaw3n6lEu5S5eJsLuLS3k2R==
X17ARy8xMfT6QNpl6k0E5SZ2MK4p4cPwg4L7MWPu5hTnaw3n6lEu5S5eG28w4w7z2YH7RQHh5dzM8xZu5AsL5SxmO2zz
X4Pb9gLX5v==
13ZeEv3zAAHGOvpUBA0EETEi
X17ARy8xMfT6QNpl6k0E5SZ2MK4p4cPwg4L7MWPu5hTnaw3n6lEu5S5eJsLu
foToVzroEuG
LD7yVPrh6BS ISVQBAz=
XIHpVWDd4SK=
X17ARy8xMfT6QNpl6k0E5SZ2MK4p4cPwg4L7MWPu5hTnaw3n6lEu5S5eG28w4w7z2YH7QVbh4Bu OdcuSEMD6m==
MWTNNODMMf7zPLBHCO==
0FDq9t==
XF7NRt==
MoXtLJ==
MoLeLJ==
Mn7tLJ==
MnHjLJ==
MnDsLJ==
MozdLJ==
MoToLJ==
MnPnLJ==
MnDWLJ==
MnvWLJ==
Mn7hLJ==
14HfVvZg4Bv1VTBr6AWp5wx
WXDj8 ==
dIPU9wirDr==
dIPU9AG2Dt6=
XHvVVVfq5t6=
MoTo7QK5
f3ff8zqvEd3d9xA=
d3Ts8fPoEuGnWxBu
U3TUPfzW3SXeRUpB7EMyLM5o1B==
XIHpVWDd4PPaaxJe
TWXvQUKcMX7fayhj6kL=
TYXj9fy=
V3Dt9zPu5XrYFvBjRe==
UWLzRt==
XHDoVzycMXTcaONr7Fb=
UH7d z3uAAbeV8==
PAWqRz3WQRvMWNR36kc58G==
TnjUVzPiRR3dWOM=
Wn7s z3q
X37q7z3v
T37n8VLr
Y3joNzPiRR3dWOM=
PECsIsKXFeaXLH==
T37o zPq6xZNbOFnHgsy7Mx202rh5dOw2n7s8LVgQSPaLpFk51MzSwFA4YQtDIYu
OTYnHLUp
GRnx8VZWRR3TILVr61sA6Sl201ZuG9zne4HnHPLd6BC0Fx9j5ULdBcRj3LuiGozndXvf8fzpROYb
LhYEMV3q6BTnat5W8VsqH9Bj2Mrs3MLigHjp8b3rQYPeat5B7FAqRM0PrlQK
GRmnHLUpDNY=
OTYHy ==
S4Ld9cUt
OnnqVp==
T37o zPq6xZNbOFnHgsm6xBu01Dh6wjwej7YHQ8Z6tZf9UNvEVMD5wVwN7ZkRMO=
X2jNRxPJPzLU eNn5lII5S522rZsMST10FLp8gLu4Xv6NTcv6FM5SNJQN1RlPuLweYzV zPuLhDmWH==
T37n9APWRSHHVN5n
1XHdVzPiRXfi8dxu5UWA6xFA28H16db5hYmqIMCvFySVKqk7ETZ=
OYTo7PHrRBSm
X2jNRxPJPzLU eNn5lII5S522rZsMST10FLp8gLu4Xv6SN9r7EMpOclmO1ZcIQ7PYGHJPyrSKPPyQSA=
X2jNRxPJPzLo9eVA50oYSNQyBIvcMSTzgnjdVQH9IhDs8NRG4VEB5wF7MKPpRwTw
YnjeVP3FJv==
0EyqIwu=
UHTgUQPo6ALeayVr5k5EEbhUO2Dv4xT1dX7o
UHTgUQPo6ALeayVr5k5EEblUO2Dv4xT1dX7o
X17ARy8xMfT6QNpl6k0E5SZ2MK4p4cPwg4KaPeL9IYTr dZw7DQq6dNr17U=
XIHpVAPf6z3a9NY=
PkyrKJ==
PkysI ==
PkyrJ ==
T4Ts9fPq6zHU8NBm
2XLi8rvV8zLuNRBVBAz=
LjypQvue
T1DxPyGcAb==
RmGcEv3B
RlWcEv3B
MjXzazfW
foToVzroEuGnWOln
LoPb9Vnn3RvlFtcoBA0u5IAk
LjygFbvW3RZe9UZ2BBvlC9YiOLLsAq==
MjWaNQbl6xG=
LjygFbvuRR2
LDWgEt==
XH7XVQDv3BTl9t9n8EL=
OXTYVPHX6Bjo9eFx5Eco8IBAO1Rv6wTAdXboVPKcDPXi9xYiBe==
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
NtUnmapViewOfSection
ntdll.dll
invalid string position
string too long
D:\Mktmp\Amadey\Release\Amadey.pdb
.text$di
.text$mn
.text$yd
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCU
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIC
.CRT$XIZ
.CRT$XLA
.CRT$XLZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$T
.rdata$r
.rdata$sxdata
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.tls$ZZZ
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.data$r
.rsrc$01
.rsrc$02
ReadFile
GetModuleFileNameA
WriteProcessMemory
HeapFree
VirtualFree
WriteFile
VirtualAlloc
CreateMutexA
GetVersionExW
GetComputerNameExW
ResumeThread
GetModuleHandleA
SetCurrentDirectoryA
GetTempPathA
GetLastError
GetFileAttributesA
CreateFileA
CloseHandle
GetSystemInfo
CreateThread
HeapAlloc
GetThreadContext
GetProcAddress
VirtualAllocEx
LocalFree
RemoveDirectoryA
ReadProcessMemory
GetProcessHeap
CreateProcessA
CreateDirectoryA
SetThreadContext
KERNEL32.dll
ReleaseDC
GetSystemMetrics
USER32.dll
DeleteObject
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
GDI32.dll
LookupAccountNameW
GetUserNameW
ConvertSidToStringSidW
RegOpenKeyExA
RegSetValueExA
GetUserNameA
RegQueryValueExA
RegGetValueA
RegCloseKey
ADVAPI32.dll
ShellExecuteA
SHGetFolderPathA
SHFileOperationA
SHELL32.dll
HttpOpenRequestA
InternetWriteFile
InternetOpenUrlA
InternetOpenW
HttpEndRequestA
HttpSendRequestExW
HttpAddRequestHeadersA
InternetOpenA
InternetCloseHandle
HttpSendRequestA
InternetConnectA
InternetReadFile
WININET.dll
GdipSaveImageToFile
GdipGetImageEncodersSize
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipGetImageEncoders
GdiplusShutdown
GdiplusStartup
gdiplus.dll
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RaiseException
SetLastError
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetModuleFileNameW
GetStdHandle
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
CompareStringW
LCMapStringW
DeleteFileW
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
HeapSize
HeapReAlloc
SetFilePointerEx
SetEndOfFile
ReadConsoleW
WriteConsoleW
DecodePointer
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVinvalid_argument@std@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
.?AVtype_info@@
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVbad_array_new_length@std@@
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
0#0(020C0H0R0c0h0r0
1#1(121C1H1R1c1h1r1
2#2(222C2H2R2c2h2r2
3#3(323C3H3R3c3h3r3
4#4(424C4H4R4c4h4r4
5#5(525C5H5R5c5h5r5
6#6(626C6H6R6c6h6r6
7#7(727C7H7R7c7h7r7
8#8(828C8H8R8c8h8r8
9#9(929C9H9R9c9h9r9
:#:(:2:C:H:R:c:h:r:
;#;(;2;C;H;R;c;h;r;
<#<(<2<C<H<R<c<h<r<
=#=(=2=C=H=R=c=h=r=
>#>(>2>C>H>R>c>h>r>
?#?(?2?C?H?R?c?h?r?
0#0(020A0Q0a0s0x0
1-131O1o1
3$3.3>3O3w3
44(404D4I4
5%5,535?5R5Y5v5|5
7N7k7}7
>C>L>*?^?
5/6=6P6z6
0$0*040>0E0O0Y0`0j0t0
1C2X2W3p3
:#:,:J:b:>;V;[;y;
>#>.>=>E>
?.?Q?X?
<R<*=F=
8O:1;i;H<W<h=w=
3(474H5W5h6w6
8R9X9_9j9p9
<b=o=x=
3F5h5C7
:8:G;x;
=%>1>U>v>
>@>X>~>
7#8A8_8
9/9M9k9
;/;T;y;
2X2"3a3C4g4z7
5|5N6*8>9
9H:f:w:
1$4.4P4T4X4\4j4
041-222@2F2O2
2b3j3x3~3
< <=<Q<
4*4Z4q416a6x6
8(898W8
7!8F8_8i8
7F9M:b:z:
;E;Z;n;
=3>>>O>`>l>
4 4?4Z4u4
5.5O5l5r5w5}5
6-656A6R6Y6
7)727=7D7d7j7p7v7|7
88/888i8o8u8{8
:':6:M:S:Y:_:e:k:q:
:,;9;a;s;
?'?1?T?
0%1/181A1V1_1
3*303V3_3e3m3r3
6616>6`6
969D9J9e9
:3:S:a:h:n:
< <X<o<}<
<#=>=C=H=c=p=y=~=
>!>->2>7>X>h>|>
:G;Z;c;p;
=.=@=O=
676^6r6
;<>*?4?A?r?
00070Q0o0
3G3R3@5J5c5m5
;N;R;Z;f;
</<H<M<f<w<|<
0;0#1.1
202]2d2o2}2
3'333A3Q3f3}3
727P7n7
7c9i9{9
;6<P<U<h>n>
2I2P2q2
3E3Z3j3w3
4%4>4O4Y4{4
5.5<5H5T5h5~5
6)696M6R6W6t6
7.787H7M7R7m7|7
838C8|8
9$909H9R9u9
<<<,?Z?
1M1\1j1
1&2-2m2t2}2
2$313`3l3
7%878k8
7"8O8v8
;+;\;j;v;
???W?u?
0R0W0\0a0s031
3$363H3Z3l3~3
7-8z8R9
0%1F1M1d1z1
161W1b1p1
1,2K2]2g2
4&4M4l4(5X5r5
:U;a;k;u;y;
<M<U<a<n<u<~<
==(=1=A=
?.?5?B?V?[?a?
?1?<?L?
;1;Z;u;
<-=7=a=i>
6%6.6L6R6W6^6n6|6
697A7I7Q7Y7w7
=;><?L?]?e?u?
0C0R0^0m0
0.171@1I1t1
1A2R2c2
979A9K9b9l9
:":,:W:a:k:
;!;+;B;L;w;
<7<A<K<b<l<
="=,=W=a=k=
>!>+>B>L>w>
?7?A?K?b?l?
0"0,0W0a0k0
1!1+1B1L1w1
272A2K2b2l2
3"3,3W3a3k3
4!4+4B4L4w4
575A5K5b5l5
6"6,6W6a6k6
7!7+7B7L7w7
878A8K8b8l8
9"9,9W9a9k9
:!:+:B:L:w:
;7;A;K;b;l;
<"<,<W<a<k<
=!=+=B=L=w=
>7>A>K>b>l>
?"?,?W?a?k?
0!0+0B0L0w0
171A1K1b1l1
2"2,2W2a2k2
3!3+3B3L3w3
474A4K4b4l4
5"5,5W5a5k5
6!6+6B6L6w6
777A7K7b7l7
8"8,8W8a8k8
9!9+9B9L9w9
:7:A:K:b:l:
;";,;W;a;k;
<!<+<B<L<w<
=7=A=K=b=l=
>">,>W>a>k>
?!?+?B?L?w?
070A0K0b0l0
1"1,1W1a1k1
2!2+2B2L2w2
373A3K3b3l3
4"4,4W4a4k4
5!5+5B5L5w5
676A6K6b6l6
7"7,7W7a7k7
8!8+8B8L8w8
979A9K9b9l9
:":,:W:a:k:
;!;+;B;M;|;
;#<-<7<
`2h2l2p2t2x2|2
3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
5 5$5(5,50545
6 6(60686@6H6P6X6`6h6p6x6
7 7(70787@7H7P7X7`7h7p7x7
8 8(80888@8H8P8X8`8h8p8x8
9 9(90989@9H9P9X9`9h9
3 3$3(3,3034383<3D3H3L3P3T3X3\3`3l3t3|3
9 9$9(9,9094989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|9
: :$:(:,:0:4:8:<:@:
6$6,646<6D6L6T6\6d6l6t6|6
7$7,747<7D7L7T7\7d7l7t7|7
8$8,848<8D8L8T8\8d8l8t8|8
9$9,949<9D9L9T9\9d9l9t9|9
:$:,:4:<:D:L:T:\:d:l:t:|:
;$;,;4;<;D;L;T;\;d;l;t;|;
<$<,<4<<<D<L<T<\<d<l<t<|<
7 7(70787@7H7P7X7`7h7p7x7
8 8(80888@8H8P8X8`8h8p8x8
9 9(90989@9H9P9X9`9h9p9x9
: :(:0:8:@:H:P:X:`:h:p:x:
; ;(;0;8;@;H;P;X;`;h;p;x;
< <(<0<8<@<H<P<X<`<h<p<x<
= =(=0=8=@=H=P=X=`=h=p=x=
2$2,242<2D2L2T2\2d2l2t2|2
44585<5@5X5\5l5p5t5|5
646D6H6X6\6`6d6l6
74787L7\7`7p7
< <$<(<0<D<L<T<\<`<d<l<
= =@=`=
> >@>`>
? ?@?`?
0 0@0`0
1 1(1,10181L1T1h1p1x1
1@1P1`1p1
7(7,7074787<7@7D7
6$6D6d6|6
@api-ms-win-core-synch-l1-2-0.dll
kernel32.dll
Bapi-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
kernel32
api-ms-
xmscoree.dll
Bapi-ms-win-core-datetime-l1-1-1
api-ms-win-core-file-l1-2-2
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
advapi32
api-ms-win-appmodel-runtime-l1-1-2
user32
ext-ms-
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
((((( H
((((( H
(
Bja-JP
zh-CHS
az-AZ-Latn
uz-UZ-Latn
kok-IN
syr-SY
div-MV
quz-BO
sr-SP-Latn
az-AZ-Cyrl
uz-UZ-Cyrl
quz-EC
sr-SP-Cyrl
quz-PE
smj-NO
bs-BA-Latn
smj-SE
sr-BA-Latn
sma-NO
sr-BA-Cyrl
sma-SE
sms-FI
smn-FI
zh-CHT
az-az-cyrl
az-az-latn
bs-ba-latn
div-mv
kok-in
quz-bo
quz-ec
quz-pe
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
syr-sy
uz-uz-cyrl
uz-uz-latn
zh-chs
zh-cht
CONOUT$
image/jpeg
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Clean
tehtris Clean
MicroWorld-eScan Gen:Variant.Barys.321153
ClamAV Win.Malware.Doina-10001799-0
CMC Clean
CAT-QuickHeal Clean
McAfee Downloader-FCND!13C6B003E4CD
Cylance unsafe
VIPRE Gen:Variant.Barys.321153
Sangfor Trojan.Win32.Save.a
K7AntiVirus Clean
BitDefender Gen:Variant.Barys.321153
K7GW Clean
Cybereason malicious.3e4cd8
BitDefenderTheta Gen:NN.ZexaF.36196.nuW@aWbUXkfi
VirIT Clean
Cyren Clean
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/TrojanDownloader.Amadey.A
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 100)
Kaspersky UDS:Trojan-Downloader.Win32.Deyma.gen
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Rising Trojan.Generic@AI.100 (RDML:1sWZhubuURj7J4Ghb6pcQw)
Sophos Mal/Generic-R
Baidu Clean
F-Secure Heuristic.HEUR/AGEN.1319380
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Downloader.dh
Trapmine Clean
FireEye Generic.mg.13c6b003e4cd8319
Emsisoft Gen:Variant.Barys.321153 (B)
Ikarus Trojan-Downloader.Win32.Amadey
GData Gen:Variant.Barys.321153
Jiangmin Clean
Webroot Clean
Avira HEUR/AGEN.1319380
MAX malware (ai score=83)
Antiy-AVL Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Trojan.Barys.D4E681
SUPERAntiSpyware Clean
ZoneAlarm UDS:Trojan-Downloader.Win32.Deyma.gen
Microsoft Trojan:Win32/Amadey.AY!MTB
Google Detected
AhnLab-V3 Malware/Win.Trojanspy.C5238800
Acronis Clean
VBA32 Clean
ALYac Gen:Variant.Barys.321153
TACHYON Clean
DeepInstinct MALICIOUS
Malwarebytes Clean
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Win32.Trojan.Agen.Ktgl
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.121218.susgen
Fortinet W32/Injector.EGTS!tr
AVG Win32:BotX-gen [Trj]
Avast Win32:BotX-gen [Trj]
CrowdStrike win/malicious_confidence_100% (W)
No IRMA results available.