!This program cannot be run in DOS mode.
K@Rich
`.rdata
@.data
.pdata
@.rsrc
@.reloc
UVWATAUAVAWH
`A_A^A]A\_^]
@SVWAVAWH
A_A^_^[
A_A^_^[
@SUVAWH
(A_^][
UATAUAVAWH
A_A^A]A\]
|$ UATAUAVAWH
A_A^A]A\]
u0HcH<H
H3E H3E
bad allocation
Unknown exception
bad array new length
string too long
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
invalid stol argument
stol argument out of range
C:\windows\system32\ntdll.dll
NtCreateSection
NtMapViewOfSection
NtUnmapViewOfSection
NtWriteVirtualMemory
RtlInitUnicodeString
RtlCreateProcessParameters
RtlCreateUserProcess
RtlCreateUserThread
NtWaitForSingleObject
NtClose
C:\Users\Administrator\Desktop\Espio-main\loader\x64\Release\Espio.pdb
.text$di
.text$mn
.text$mn$00
.text$x
.text$yd
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCU
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIZ
.CRT$XPA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$r
.rdata$voltmd
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.data$r
.data$rs
.pdata
.rsrc$01
.rsrc$02
SizeofResource
GetCurrentProcess
FreeResource
LockResource
LoadLibraryW
LoadResource
FindResourceW
FreeLibrary
GetConsoleWindow
VirtualProtect
CreateFileA
CloseHandle
K32GetModuleInformation
GetProcAddress
CreateFileMappingW
MapViewOfFile
KERNEL32.dll
ShowWindow
USER32.dll
?_Xlength_error@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
MSVCP140.dll
__CxxFrameHandler4
__std_exception_destroy
__std_exception_copy
__C_specific_handler
_CxxThrowException
__current_exception
__current_exception_context
memset
VCRUNTIME140_1.dll
VCRUNTIME140.dll
isalnum
_invalid_parameter_noinfo_noreturn
_errno
strtol
malloc
_callnewh
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
__setusermatherr
_get_initial_narrow_environment
_initterm
_initterm_e
_set_fmode
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
terminate
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
memchr
memcpy
memmove
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVbad_array_new_length@std@@
.?AVtype_info@@
MHhiYzB4YzUweDkzMHgzYjB4MzAweGNhMHhmMDB4MzYweDY1MHhiMzB4YTkweGQ3MHg5NDB4Y2UweDlmMHhlODB4NmQweDliMHhlZDB4OWIweGUyMHgxMTB4ZTEweDg0MHhhODB4OTQweDY1MHg1MTB4OTgweDBjMHg5YTB4MmQweGFhMHg0ZDB4YTgweGI2MHgzZjB4YmYweGQzMHg1NTB4MTEweDNjMHg1ZTB4NTgweDU0MHgzNzB4N2QweDhkMHhiNDB4ODYweDkzMHhjYTB4ZjEweDVlMHhhODB4NTEweDUzMHg5ZDB4MDMweGQ3MHgzMjB4Y2MweDE4MHg2MzB4ZGYweGM3MHg1NjB4MWIweGIzMHgxYzB4NGQweGVlMHg3NzB4MDMweGU5MHhjZDB4YjMweDEyMHhmYTB4YTAweDZlMHg5NDB4ZWQweDkwMHgwNzB4ODkweGNiMHg4MTB4Y2IweDBlMHhlNzB4M2MweGMwMHhlNzB4NzcweDI2MHg0ODB4MDIweGI5MHhhNDB4MjcweDRhMHgwMTB4MTQweDUwMHg2NjB4YWQweDBhMHg4ODB4ODgweDY4MHhhYzB4ZmIweDNiMHg3YjB4ODkweGJjMHg3YzB4NWYweDA3MHhmOTB4ZWYweDMyMHhjNTB4Y2YweDhhMHhmYjB4OWIweGMzMHg4MjB4MTIweDcxMHgwNDB4ODkweGRjMHgzODB4MjkweDU2MHg2NjB4NzgweDI2MHhkZTB4OTcweGUyMHg0MDB4NGYweDc1MHhmYzB4MDcweDY0MHhmNTB4MmUweGE3MHg2MTB4NmEweGJiMHg5YzB4MWIweDZkMHg2NzB4NjEweDQxMHhhYjB4ZWEweDlkMHgyYjB4ZDEweDMwMHgyODB4OWMweGNjMHhmNDB4MDQweGY1MHgyOTB4YmMweGE2MHgwNjB4M2EweDQ4MHgzMzB4MjcweGVjMHg3YzB4MmUweGUxMHg0ODB4YzAweGNmMHg4NjB4MzEweDlk
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
ntdll.dll
\??\C:\Windows\System32\werfault.exe
obfuscatedPayload
OBFUSCATEDPAYLOAD