Static | ZeroBOX

PE Compile Time

2023-08-01 14:51:18

PDB Path

D:\Mktmp\Amadey\Release\Amadey.pdb

PE Imphash

ff195cccada6bfe977f7c90930774f78

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0002cc1d 0x0002ce00 6.4678044271
.rdata 0x0002e000 0x00008a9c 0x00008c00 5.29340453704
.data 0x00037000 0x000024b8 0x00001800 1.36891036901
.rsrc 0x0003a000 0x000001e0 0x00000200 4.71767883295
.reloc 0x0003b000 0x00002260 0x00002400 6.54705881389

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x0003a060 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x42e044 CloseHandle
0x42e048 GetSystemInfo
0x42e04c CreateThread
0x42e050 GetThreadContext
0x42e054 GetProcAddress
0x42e058 VirtualAllocEx
0x42e05c RemoveDirectoryA
0x42e060 CreateFileA
0x42e064 CreateProcessA
0x42e068 CreateDirectoryA
0x42e06c SetThreadContext
0x42e070 WriteConsoleW
0x42e074 ReadConsoleW
0x42e078 SetEndOfFile
0x42e07c HeapReAlloc
0x42e080 HeapSize
0x42e084 GetFileAttributesA
0x42e088 GetLastError
0x42e08c GetTempPathA
0x42e090 Sleep
0x42e094 GetModuleHandleA
0x42e09c ResumeThread
0x42e0a0 GetComputerNameExW
0x42e0a4 GetVersionExW
0x42e0a8 CreateMutexA
0x42e0ac VirtualAlloc
0x42e0b0 WriteFile
0x42e0b4 VirtualFree
0x42e0b8 WriteProcessMemory
0x42e0bc GetModuleFileNameA
0x42e0c0 ReadProcessMemory
0x42e0c4 ReadFile
0x42e0c8 SetFilePointerEx
0x42e0d0 GetConsoleMode
0x42e0d4 GetConsoleCP
0x42e0d8 FlushFileBuffers
0x42e0dc GetStringTypeW
0x42e0e0 GetProcessHeap
0x42e0f0 WideCharToMultiByte
0x42e0f4 GetCPInfo
0x42e0f8 GetOEMCP
0x42e0fc GetACP
0x42e100 IsValidCodePage
0x42e104 FindNextFileW
0x42e108 FindFirstFileExW
0x42e10c FindClose
0x42e110 SetStdHandle
0x42e114 GetFullPathNameW
0x42e11c DeleteFileW
0x42e130 SetEvent
0x42e134 ResetEvent
0x42e13c CreateEventW
0x42e140 GetModuleHandleW
0x42e14c GetCurrentProcess
0x42e150 TerminateProcess
0x42e158 IsDebuggerPresent
0x42e15c GetStartupInfoW
0x42e164 GetCurrentProcessId
0x42e168 GetCurrentThreadId
0x42e170 InitializeSListHead
0x42e174 RaiseException
0x42e178 SetLastError
0x42e17c RtlUnwind
0x42e180 TlsAlloc
0x42e184 TlsGetValue
0x42e188 TlsSetValue
0x42e18c TlsFree
0x42e190 FreeLibrary
0x42e194 LoadLibraryExW
0x42e198 ExitProcess
0x42e19c GetModuleHandleExW
0x42e1a0 CreateFileW
0x42e1a4 GetDriveTypeW
0x42e1ac GetFileType
0x42e1b0 PeekNamedPipe
0x42e1bc GetModuleFileNameW
0x42e1c0 GetStdHandle
0x42e1c4 GetCommandLineA
0x42e1c8 GetCommandLineW
0x42e1cc HeapFree
0x42e1d0 HeapAlloc
0x42e1d4 MultiByteToWideChar
0x42e1d8 CompareStringW
0x42e1dc LCMapStringW
0x42e1e0 DecodePointer
Library USER32.dll:
0x42e1fc GetSystemMetrics
0x42e200 ReleaseDC
0x42e204 GetDC
Library GDI32.dll:
0x42e030 SelectObject
0x42e034 CreateCompatibleDC
0x42e038 DeleteObject
0x42e03c BitBlt
Library ADVAPI32.dll:
0x42e000 RegCloseKey
0x42e004 RegGetValueA
0x42e008 RegQueryValueExA
0x42e010 GetSidSubAuthority
0x42e014 GetUserNameA
0x42e018 LookupAccountNameA
0x42e01c RegSetValueExA
0x42e020 RegOpenKeyExA
Library SHELL32.dll:
0x42e1e8 SHGetFolderPathA
0x42e1ec ShellExecuteA
0x42e1f0 None
0x42e1f4 SHFileOperationA
Library WININET.dll:
0x42e20c HttpOpenRequestA
0x42e210 InternetReadFile
0x42e214 InternetConnectA
0x42e218 HttpSendRequestA
0x42e21c InternetCloseHandle
0x42e220 InternetOpenA
0x42e228 HttpSendRequestExW
0x42e22c HttpEndRequestA
0x42e230 InternetOpenW
0x42e234 InternetOpenUrlA
0x42e238 InternetWriteFile
Library gdiplus.dll:
0x42e240 GdipSaveImageToFile
0x42e248 GdipDisposeImage
0x42e254 GdiplusShutdown
0x42e258 GdiplusStartup

!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
j$h ?C
j\h@@C
jXhPAC
j<h@EC
j4hhFC
j$hhGC
j4hdIC
CM @PRj
u(hxJC
E0SVW3
CE8VWh
CL$@RQ
L$T_^[3
tXh<}C
URPQQh
;t$,v-
UQPXY]Y[
SVWj03
WWWSHSh
WPWWWS
:u"f9z
F4_^[]
<ItC<Lt3<Tt#<h
A<lt'<tt
<at.<rt!<wt
<=upG8
j,hxYC
QQSVj8j@
Wj0XPV
SPjdVQ
zSSSSj
f9:t!V
u kE$<
PPPPPPPP
PPPPPWS
PP9E u:PPVWP
D8(Ht'
bad allocation
SleepConditionVariableCS
WakeAllConditionVariable
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__swift_1
__swift_2
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
operator co_await
operator<=>
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
`anonymous namespace'
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
CorExitProcess
`h````
xpxxxx
(null)
UTF-16LEUNICODE
AreFileApisANSI
CompareStringEx
LCMapStringEx
LocaleNameToLCID
AppPolicyGetProcessTerminationMethod
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
NAN(SNAN)
nan(snan)
NAN(IND)
nan(ind)
[aOni*{
~ $s%r
@b;zO]
v2!L.2
;1#INF
1#QNAN
1#SNAN
?5Wg4p
%S#[k=
"B <1=
_hypot
_nextafter
Unknown exception
bad array new length
invalid stoi argument
stoi argument out of range
a41af3524b0fb449d6a1605f2f3c755e
c75c6c37b2d7a348188eddc50140787b
a34ee2
93bc9fe8074579288414cee43a180659
eAbsQer97B==
LszC4f8w5m33VTmoQftdQvUA21XmVRaycz8w
MrU4S9==
UrQlgzOk
JLRsiI==
LLLsiI==
YcPi3LypSnNEN ==
YgD0jO3m6IBz0Qaj
UTDI0wzKL2B=
LTDy4OzRSTpAVTFeWPlEQKLKzH1PPsuBIvZUYau=
IvZUZau
IbqvW9==
UTZG0x8sNlKhUPehfh9p7RT5OK6r8gLzdWDcVVPp6nKzeySjfiNf7RZhLsNwPWZnZJ==
UTZG0x8sNlKhUPehfh9p7RT5OK6r8gLzdWDcVVPp6nKzeySjfiNf7RZhI2 y8A3CZQzc0PHc6jqYbzOqexBw7RrpQ2BB
UWHhhfLS6B==
YVRkNu3uBGySSxeQLx9pGSyl
UTZG0x8sNlKhUPehfh9p7RT5OK6r8gLzdWDcVVPp6nKzeySjfiNf7RZhLsNw
cgLu4yrjFAxl
IvZE4Orc7HJlMUKMLxI=
UAzv4VD95YB=
UTZG0x8sNlKhUPehfh9p7RT5OK6r8gLzdWDcVVPp6nKzeySjfiNf7RZhI2 y8A3CZQzcZUbc5HllSf2q2BVo8l==
JOLTWNDHNlYLTNqDML==
Xxvwhs==
UxZT0s==
JgPzUI==
JgDkUI==
JfZzUI==
JfzpUI==
JfvyUI==
JgrjUI==
JgLuUI==
JfHtUI==
Jfv2UI==
Jfn2UI==
JfZnUI==
YWzl4uZb5HmcZVqnfx5a7vrc
TPvpg9==
aAH0hvimEx==
aAH0hzGXEzX=
Uzn14Ufl6zX=
JgLufPK0
cV8lgyqqFjUpczp=
aVLygePjFAxz0zqq
RVL0YezR4YOqVWexgBVjNLZr3B==
UAzv4VD95VGmezya
QOPBZTK8N3YreA7ffhU=
QQPphey=
SVvzhyPp63i Jxqf1b==
RODF0s==
Uzvu4yy8N3KoeQCngCk=
RzZjiy3pBG3qZ ==
MsOw0y3RRXmY0PGZfhlQ F==
Qfb04yPdSXUp0QB=
TfZyiy3l
UVZwfy3q
QVZtgULm
VVbuWyPdSXUp0QB=
MwuyRrKSGk29PJ==
QVZuiyPl7DQZfQujRdBj9Lr522tj9hKzZfZygKVbRYGmPrugeYVkUvzD6YSvHMUx
LLQtQKUk
DJfDgUZRSXU5MNKnfYBl8Rf5211wKcvqbWztQOL97HtbJzYfeRUZDbLm5LwkKsvqaPnlgezkSUPn
I QKVU3l7HKzevUShSBbJ8vm4Mtu7QHldzbvga3mR4GqevUxgCJbTLUStlSM
DJetQKUkETP=
LLQNH9==
PWDjhbUo
Lffw4o==
QVZuiyPl7DQZfQujRdB88wvx21Fj AfzbbZ4QP8U7zQrcWCrOSVo7vPzP71mVQK=
UUbT0wPEQFC6dgCjeiRt7RZ54r1uQWP4XxDvgfLp53mhRV2rfCVQUMDTP1TnTyHzbQr1iyPpMnuy0J==
QVZthzPRSYyTZPUj
YPzj4yPdS37ubfmqeR5l8wzD48J3 h88eQewRLCqGEJ7Os 3OQ8=
LQLufOHmSHJy
UUbT0wPEQFC6dgCjeiRt7RZ54r1uQWP4XxDvgfLp53mhWPYngBVaQbfpQ11eMU3SVyzPYxrNLVGKUUp=
UUbT0wPEQFCAcgKweXxJUMKBDIxeQWPCdfbj4PH4JnuEbPGCdSNm7vz OKRrVAPz
Vfbk4O3AKB==
XwqwRvu=
RzLm3PPj7GCqeAKnehdpGabXQ2Fx8BP4aPZu
RzLm3PPj7GCqeAKnehdpGafXQ2Fx8BP4aPZu
UTZG0x8sNlKhUPehfh9p7RT5OK6r8gLzdWCgYdL4J4KDdfOsgAZb8cHu37W=
UAzv4zPa7FUmcPN=
McqxTI==
McqyR9==
McqxS9==
QWLyhePl7Fy6bPqi
ZPDogqvQ9FCGRTqRLxI=
IbqvZuu
QTvDYxG8Bh==
OeyiNu3w
OdOiNu3w
JbPFjyfR
cgLu4yrjFAxz0Qaj
IgHhhUni4XmxJv2kLx9f7Hun
IbqmOavR4XQqcWOYLyE7E8SlQLNuEu==
JbOgWPbg7Dx=
IbqmOavpSXTl
IvOmNs==
UzZ34PDq4HKxcvYjhBU=
LPL44OHS7HaAcguteBl HvDQ1Tx APDaP4u4OK8EVOuczNeLb==
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
NtUnmapViewOfSection
ntdll.dll
invalid string position
string too long
D:\Mktmp\Amadey\Release\Amadey.pdb
.text$di
.text$mn
.text$yd
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCU
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIC
.CRT$XIZ
.CRT$XLA
.CRT$XLZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$T
.rdata$r
.rdata$sxdata
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.tls$ZZZ
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.data$r
.rsrc$01
.rsrc$02
ReadFile
GetModuleFileNameA
WriteProcessMemory
VirtualFree
WriteFile
VirtualAlloc
CreateMutexA
GetVersionExW
GetComputerNameExW
ResumeThread
GetModuleHandleA
SetCurrentDirectoryA
GetTempPathA
GetLastError
GetFileAttributesA
CreateFileA
CloseHandle
GetSystemInfo
CreateThread
GetThreadContext
GetProcAddress
VirtualAllocEx
RemoveDirectoryA
ReadProcessMemory
CreateProcessA
CreateDirectoryA
SetThreadContext
KERNEL32.dll
ReleaseDC
GetSystemMetrics
USER32.dll
DeleteObject
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
GDI32.dll
GetSidIdentifierAuthority
RegOpenKeyExA
RegSetValueExA
LookupAccountNameA
GetUserNameA
GetSidSubAuthority
GetSidSubAuthorityCount
RegQueryValueExA
RegGetValueA
RegCloseKey
ADVAPI32.dll
ShellExecuteA
SHGetFolderPathA
SHFileOperationA
SHELL32.dll
HttpOpenRequestA
InternetWriteFile
InternetOpenUrlA
InternetOpenW
HttpEndRequestA
HttpSendRequestExW
HttpAddRequestHeadersA
InternetOpenA
InternetCloseHandle
HttpSendRequestA
InternetConnectA
InternetReadFile
WININET.dll
GdipSaveImageToFile
GdipGetImageEncodersSize
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipGetImageEncoders
GdiplusShutdown
GdiplusStartup
gdiplus.dll
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RaiseException
SetLastError
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetModuleFileNameW
GetStdHandle
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
MultiByteToWideChar
CompareStringW
LCMapStringW
DeleteFileW
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
SetFilePointerEx
HeapSize
HeapReAlloc
SetEndOfFile
ReadConsoleW
WriteConsoleW
DecodePointer
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVinvalid_argument@std@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
.?AVtype_info@@
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVbad_array_new_length@std@@
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
0#0(020C0H0R0c0h0r0
1#1(121C1H1R1c1h1r1
2#2(222C2H2R2c2h2r2
3#3(323C3H3R3c3h3r3
4#4(424C4H4R4c4h4r4
5#5(525C5H5R5c5h5r5
6#6(626C6H6R6c6h6r6
7#7(727C7H7R7c7h7r7
8#8(828C8H8R8c8h8r8
9#9(929C9H9R9c9h9r9
:#:(:2:C:H:R:c:h:r:
;#;(;2;C;H;R;c;h;r;
<#<(<2<C<H<R<c<h<r<
=#=(=2=C=H=R=c=h=r=
>#>(>2>C>H>R>c>h>r>
?#?(?2?C?H?R?c?h?r?
0#0(020C0H0R0c0h0r0
1282_2x2
2G3`3l3
4#4J4]4
7"7)7F7L7S7
9;9M9w9
9Z:h:v:
:G;a;g;n;D<L<g<n<
2/2R2m2
4I5[5k5
5`6j6q6
8 979b9
33:3S3l3{3
7&7&8i8
?8?R?g?v?
080R0e0
=b=:>V>
9_;A<y<X=g=x>
4'485G5X6g6x7
9b:h:o:z:
?6?H?Q?b?
:1:7:h:w;
=%>F>m>
>(?S?x?
;;D;i;
<+<P<u<
>9>W>u>
1#4b4G5
>&>7>W>h>
0,0004080J0
2#222@2D2H2L2Z2|2
565]5t8
<F=_=p=
:K;Z;h;l;p;t;x;|;
8C8\8f8
7F9M:b:z:
;E;Z;n;
=3>>>O>`>l>
4 4?4Z4u4
5.5O5l5r5w5}5
6-656A6R6Y6
7)727=7D7d7j7p7v7|7
88/888i8o8u8{8
:':6:M:S:Y:_:e:k:q:
:,;9;a;s;
?'?1?T?
0%1/181A1V1_1
3*3P3Y3_3g3l3
6!6.6P6
9&949:9U9}9
:#:C:Q:X:^:
<H<_<m<y<
=.=3=8=S=`=i=n=s=
>">'>H>X>l>u>
:7;J;S;`;o;
o0w0~0
5'6N6b6
6)7U;n;
2292W2o2
4d4r4{4
4/5:5(727K7U7
8<9]9x9
;+<6<u<
<6=:=B=N=h=
>0>5>N>_>d>r>
70K0g0
4 4M4T4_4m4t4z4
5#515A5V5m5
8"9@9^9
9S;Y;k;~;
=&>@>E>
494@4a4
555J5Z5g5
6.6?6I6k6|6
7,787D7X7n7
8)8=8B8G8d8
9(989=9B9]9l9w9|9
:#:3:l:
; ;8;B;e;o;
2=3L3Z3w3
4]4d4m4
5!5P5\5
:':[:~:
:Z;7<><
:';m;8>
1$2?2I2
23>3a3
6.7:7L7
8 8;8h8
4414C4U4g4y4
93:G:j:
(0I0P0g0}0
090Z0e0s0
0/1N1`1j1
3)3P3o3+4[4u4
9X:d:n:x:|:
;P;X;d;q;x;
<"<+<4<D<
==b=k=
>1>8>E>Y>^>d>
3$3[3b3}6r7z7
>">?>r>
889>9K9V9f9
:':9:K<g<
<E=Y=|=
44A4K4
;#;0;B;
;'<<<E<N<
=Y?_?d?k?{?
607Z7b7
?.?M?x?
"0D0h0
5,94:E:
<&=+===[=o=u=
1N2b2s2
516b7l7
8"8,8W8a8k8
9!9+9B9L9w9
:7:A:K:b:l:
;";,;W;a;k;
<!<+<B<L<w<
=7=A=K=b=l=
>">,>W>a>k>
?!?+?B?L?w?
070A0K0b0l0
1"1,1W1a1k1
2!2+2B2L2w2
373A3K3b3l3
4"4,4W4a4k4
5!5+5B5L5w5
676A6K6b6l6
7"7,7W7a7k7
8!8+8B8L8w8
979A9K9b9l9
:":,:W:a:k:
;!;+;B;L;w;
<7<A<K<b<l<
="=,=W=a=k=
>!>+>B>L>w>
?7?A?K?b?l?
0"0,0W0a0k0
1!1+1B1L1w1
272A2K2b2l2
3"3,3W3a3k3
4!4+4B4L4w4
575A5K5b5l5
6"6,6W6a6k6
7!7+7B7L7w7
878A8K8b8l8
9"9,9W9a9k9
:!:+:B:L:w:
;7;A;K;b;l;
<"<,<W<a<k<
=!=+=B=L=w=
>7>A>K>b>l>
?"?,?W?a?k?
0!0+0B0L0w0
171A1K1b1l1
2"2,2W2a2k2
3!3+3B3L3w3
474A4K4b4l4
5"5,5W5a5k5
6!6+6B6L6w6
777A7K7b7l7
8"8,8W8a8k8
9!9+9B9L9w9
:7:A:K:b:l:
;";-;\;b;l;v;
`2h2l2p2t2x2|2
3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
5 5$5(5,50545
6 6(60686@6H6P6X6`6h6p6x6
7 7(70787@7H7P7X7`7h7p7x7
8 8(80888@8H8P8X8`8h8p8x8
9 9(90989@9H9P9X9`9h9
4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4X9\9`9d9h9l9p9t9x9|9
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
6$6(6,6064686<6@6D6H6L6P6T6X6\6
7$7,747<7D7L7T7\7d7l7t7|7
8$8,848<8D8L8T8\8d8l8t8|8
9$9,949<9D9L9T9\9d9l9t9|9
:$:,:4:<:D:L:T:\:d:l:t:|:
;$;,;4;<;D;L;T;\;d;l;t;|;
<$<,<4<<<D<L<T<\<d<l<t<|<
=$=,=4=<=D=L=T=\=d=l=t=|=
8 8(80888@8H8P8X8`8h8p8x8
9 9(90989@9H9P9X9`9h9p9x9
: :(:0:8:@:H:P:X:`:h:p:x:
; ;(;0;8;@;H;P;X;`;h;p;x;
< <(<0<8<@<H<P<X<`<h<p<x<
= =(=0=8=@=H=P=X=`=h=p=x=
> >(>0>8>@>H>P>X>`>h>p>x>
=$=,=4=<=D=L=T=\=d=l=
D0H0L0P0h0l0|0
1 1$1,1D1T1X1h1l1p1t1|1
2(2,2D2H2\2l2p2
7 7(7074787@7T7\7d7l7p7t7|7
808P8p8
909P9p9
:0:P:p:
;0;P;p;
<,<0<8<<<@<H<\<d<x<
1@1P1`1p1
7(7,7074787<7@7D7
06T6t6
@api-ms-win-core-synch-l1-2-0.dll
kernel32.dll
Bapi-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
kernel32
api-ms-
xmscoree.dll
(null)
Bapi-ms-win-core-datetime-l1-1-1
api-ms-win-core-file-l1-2-2
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
advapi32
api-ms-win-appmodel-runtime-l1-1-2
user32
ext-ms-
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
((((( H
((((( H
(
Cja-JP
zh-CHS
az-AZ-Latn
uz-UZ-Latn
kok-IN
syr-SY
div-MV
quz-BO
sr-SP-Latn
az-AZ-Cyrl
uz-UZ-Cyrl
quz-EC
sr-SP-Cyrl
quz-PE
smj-NO
bs-BA-Latn
smj-SE
sr-BA-Latn
sma-NO
sr-BA-Cyrl
sma-SE
sms-FI
smn-FI
zh-CHT
az-az-cyrl
az-az-latn
bs-ba-latn
div-mv
kok-in
quz-bo
quz-ec
quz-pe
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
syr-sy
uz-uz-cyrl
uz-uz-latn
zh-chs
zh-cht
CONOUT$
image/jpeg
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Clean
tehtris Clean
ClamAV Win.Malware.Doina-10001799-0
CMC Clean
CAT-QuickHeal Clean
McAfee Downloader-FCND!90E148220861
Cylance unsafe
VIPRE Gen:Variant.Doina.60896
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Trojan ( 005a7a4a1 )
BitDefender Gen:Variant.Doina.60896
K7GW Trojan ( 005a7a4a1 )
Cybereason malicious.208611
Baidu Clean
VirIT Clean
Cyren W32/Amadey.C1.gen!Eldorado
Symantec ML.Attribute.HighConfidence
Elastic Windows.Trojan.Amadey
ESET-NOD32 a variant of Win32/TrojanDownloader.Amadey.A
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan-Downloader.Win32.Deyma.gen
Alibaba TrojanDownloader:Win32/Amadey.3586b182
NANO-Antivirus Clean
SUPERAntiSpyware Clean
MicroWorld-eScan Gen:Variant.Doina.60896
Tencent Win32.Trojan.Agen.Ddhl
TACHYON Clean
Sophos Mal/Generic-R
F-Secure Heuristic.HEUR/AGEN.1319380
DrWeb Clean
Zillya Clean
TrendMicro Trojan.Win32.AMADEY.YXDHEZ
McAfee-GW-Edition BehavesLike.Win32.Generic.dh
Trapmine Clean
FireEye Generic.mg.90e1482208611ebf
Emsisoft Gen:Variant.Doina.60896 (B)
Ikarus Trojan-Downloader.Win32.Amadey
Jiangmin Clean
Webroot Clean
Avira HEUR/AGEN.1319380
Antiy-AVL Trojan[Downloader]/Win32.Amadey
Microsoft Trojan:Win32/Amadey.RDH!MTB
Gridinsoft Clean
Xcitium Clean
Arcabit Trojan.Doina.DEDE0
ViRobot Clean
ZoneAlarm HEUR:Trojan-Downloader.Win32.Deyma.gen
GData Gen:Variant.Doina.60896
Google Detected
AhnLab-V3 Malware/Win.Trojanspy.C5238800
Acronis Clean
BitDefenderTheta Gen:NN.ZexaF.36348.ouW@amEIRFpi
ALYac Gen:Variant.Doina.60896
MAX malware (ai score=88)
DeepInstinct MALICIOUS
VBA32 Clean
Malwarebytes Backdoor.Amadey
Panda Trj/Genetic.gen
Zoner Clean
TrendMicro-HouseCall Trojan.Win32.AMADEY.YXDHEZ
Rising Spyware.Agent!8.C6 (TFE:5:Ff7t0kYd78J)
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Amadey.A!tr
AVG Win32:BotX-gen [Trj]
Avast Win32:BotX-gen [Trj]
CrowdStrike win/malicious_confidence_100% (W)
No IRMA results available.