Static | ZeroBOX

PE Compile Time

2024-07-02 09:19:29

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
c\x07\x08\x126ZK\x04 0x00002000 0x0004c350 0x0004c400 7.99942452878
.text 0x00050000 0x0000f608 0x0000f800 5.02949451957
.rsrc 0x00060000 0x00000670 0x00000800 3.59592402886
.reloc 0x00062000 0x0000000c 0x00000200 0.0980041756627
0x00064000 0x00000010 0x00000200 0.142635768149

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x000600a0 0x000003e0 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x00060480 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x464000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
$d]jda
Sps)edb
RwA3 <n
y Hn)Zz
?0C7cc`
wNFP/8
w?yA[[
?ObVP\
ATwJf9
b~WFG9
v:.\beq
h'y"Q)
|'Sn_|
sQ7}[>3
-t~N,+B
hOO0JRB
FGbF}9
V#d;oP
FwN~Sr
/"Qd6?I
&'uu<{
,d=0$_
U@K}C"
Ko]x| #
822D6=
\@cXt1
(coq#
aI5`*fX
^v&!c1C6
WpCXAB
vvKVbcChi
y\J+ie
ypJ;r9
F2l:pag
AS~bg5;
:`~~|b
aU@;p8,
;G)W
Ie^ry#R
v8m(-'
HBcfDQ
[yKYsZ
3KN*S|
I$8OR!
Mcwd4x
UB"u30
j05}yb
!z-l'e
Y*eP1$
Cwu/_D\CU{'[
GH,_M}!
'?7ni%
7zivd.B
GXuU2Ji
_PS &^O
^.(]<(K
-$r$KA
2SNIzu
3Z<!~1#
X9>>#N
K,~w41
L+]Ti )
/qC[N`
fp*r7-
z}6qv>
'd:xJo
mEfcE,
m 3U}6
)e^QS9
zJJ{%C
Rx}XBB
3@$2k4
I-.rnb
D9^UdM`2
T?.XAl
fPI3E]
{3Khi&e
C 6u%e
]y=d}m
:V:#s)(
Iz2tizz
lNG^J'f
ohkZOq
c8}61
%tX)V(
?^H$(:
H.8}(X
m)!M[+
1F.U?x
OnB#_
y.*0Ly
k*=a(Hl
w$ 1<g.(r=
\9VSjp
pR=T+0
h0X+y+n
U<b9??
wnss;L)
#PZY-I
o0Z-v7
Yxo7E>D1
j3qKcf3|
5.k31,
Wbo]y
~Zp~]G
L1K7]pt
[n3f5&
9Kj_!X
?a!1Po
I9mC{/
i^O]}x
D3{6^w
TCsL}-"
:!Z{s{A
Q?7or=l
1#I!5T
Q>DH4G
to!Ndu
O\#=AG
Y,8'',
Edya$;T`fx;}T,U
Qv7[~L%
%SW30l
G^hT3-
z{]/Nn
yN?qd0YpqD
|'$CQY-
>\Fy|9
IiX"r
;V:n/LvXv
ge50C|
l9Mes9Z
4n&M63gs
)-:#3<k
]lt`v`B
/>fJ&P-
!}{jS1oK
eCV?+|]
h>U\`~
;HOmIq
AQiGSD_
VC{0X7
`N2M^b{-\
eV/ 7
;G`.9h
C"(f1R
"j8Orvn
q/>%x|
t 'DbCP
`>fatT2
SNw?|U>
M39g+M
g<Q-0547Z
F7%eZK
2)(;qJF
z[HtXM
9d^*O?
'}A!Ek
`VeU~J9
X*Gy>UU-1
RHr=_K
_Q+p0{
%^.-zG
*?<wEi
DR5;i\
hv FZ|{6
4at+Cr
> 2b#5
h)FkI7
lRRm3FU
BO//#.f
O(w"@1ni
Ib@:rQ
A)lCQI
"8@fdl
iFdk~+
l^ud4(-0
.P^h+0n
Wr z6Y
}%Oh+R^qC
$=aPl8Y
XB8;*T#
zOvteU@
fajG#Dx
i4SU0Tg@x
XVjHs=
K<fqCBE
fR,7'}
%m',ne2
!artf|
}mu=m@J
1[_8$E
jok[o6
xWzEI%
UVF'a8
XsbSW#V
`1*[1%7
l$nPUs
1U;YIV:Z
FcrIPq'X
S9~ZJa
)6^j_7b
3^kJf
e"yB-BZ
2jYyJZ
Q!t5<~
(G)b~jkIq
A.c[#(
k}}^Vpf
VldcN #{
*D#s]}
BMb}\Ac1@W
YP*jnA
iLdJp/
[e8 },
&oU6u.
[kcA'i4
0[jLWvX
,L)$N
wdM.@[!#B
6d+|7srp
an)u=Hl<$
^R@6\T*H(&
7OS*>;
}p|e*}
lKNW'!
oTW ?r
o<!.h@/
07>X58E\S
jNC6@
,VKs+m
KG,um7
u7p#r/
"R%q9T
={-#:$
5_ciZ
OXmPK"
&[@=9l
XJ-rHC1@>9
pD>O#*
SEe@Ph
>)s[&.6
a^%s+M
QKjbdL
40cqaoF
nT|-r4
KvRq]a
Ye6/N\Gc8$WuW
<+lzcS
Z?M74@
YEE~S6
4uT{J\
MnPp$E"
E5?Dm o
b30A~
GfnMqA
{W]kal
z*Kw:+
1I="mag
ee3CV%
$d(&Nb
P$sHw7
-Y"|T_B\
HA2L!'
0xT.b,
4icHEJN
C]fCl[`
@Jgr~
z#vS^=
>&$)\ax
Q&(WnFrd
:z3d1
}C+hKXp
shpvHd
XM4Qf:C
pL;_/K
kedj~k8
NvQ6?`$
e4nh7&
7PrJk~+
<EOg".
^;wD9v
o<n|lz
AWkjXb
<d#"}[Q
7m2;k{?
;WJx2r
n$>B|s
Ek6fd1
{}(0qiJo
F$tR<cNS
ye1n-}
ig}F~B
^,@Qph'
Elc^P|g
g&Bf0C
o|&>}4b
Ct,<{m7=
<Tj!fN
68{ibX
l->=!\
86 |?e
5RL`mw
"TM9(.
T9N4'D
AM!'bI:
_5`Y2z3
UZo%sX
T-SXn}
'*sod
x0")TG$
F3g\#,*3i
1W"yL..r8$
1>$e]'
D+ZTTp
`g\"Mw,
:3b3?{7
$9,9gt})
O?"$tJ
Kn*O7K
|@LDt(FHl
yc|.jH
;6aSj0e"
+ OX`+
oeUOp[
'Lf &Z
p^YknH
eQ?pN*
v9Ju85
0!4l8b
7h0{iD4
r1G-ZQ
p{cl@'
uiQwQJ<w
SNV2ol
,!u ~5.N
iWc^"'@
MGcZ,)
oG*qHT
yZpr[#
I.'sRHE^
/P[Cu4
H%0<h?Z
#w\il,k}v
pz0J,1l
)sa+Su
zA2RVWwP
&)U9%/
NWX`Ub
DG8*@dJ
[L?dsV|
8,&vJgK
R#b`"<
\h'IXx
Bq^?>+(
/MXCE0
|qB;FoA
qda"L+
FPYOa
<8ui;D+
1S/Te4.
",#/XR
T6"Y9(
.K2dHa0
j3%O4#
=3Y i[
I_RTt
Tf?a]Ew:
ViV9dH-
l+j/h]r
>,7|<`
r4(%]x
(>b@^20p
]9G83K
+`MWh)
KL}z3i
2@7HsHl
)Fm;]g
QKyo63(
FEzXai
JM/*z~
Y]-%mN
DMX|h_
{KWmYz
Q@#(\I:Yyc
&Go1@4
}+$y4"+
f=fv6J
|:D_F)
\N=1/$
vqG*9
A"EcT)
|en,ZD
AM@k=*
D@+ a+X
1 T*%K
jsB,\A
&B=Gp\D
"d&T9/e
]"V jd.
=`mmyJ8
M5c/#%
{G& x3
OS9MLL
dYfd^O
'!NIn^y
|~'`=$u
zK>26I
sJOEQeR
jn7fY7o
E<*N0V
fS"vV6
g@D"]%
%$Dl/MaD
UT;083
(|a<2~
e(uBxj;e
x,7y?bK
@#rW$
Q\}s,E
~KcH8[T
F3$p{BE>
D)/*BJ
>oGs](+
f>Yj k_
4f(s!#
sAq!j<.
]MLLq(
0yC@Go
>,+k7A
F7WF+1
=~Ng>whC,
tkv>n7s
>#}2kU
[X'#5&
b{fNt32
@4'T9i<
>a6sI
)a.[-wF
-dK`diO
S<f5AgpzwSb;
DsBUl!
m2fEO.p
"^Wh<w}B
8vf|6|
:zG,#A
sBE@}HX
"k6Un|
"kD]S1
v^?y#
r0fc>ueh'J
/tp}]J
SX'XoI
oKr\=Q
>E>o-D
|X|>xX
_5zR-78
1#o~CG
l;n|BH
B;||tN
Js&~X
]?B,nG^9
\h5Y H
B6<nPqb
W\)X]/]
DgUfy5
0a? *_g4
1X|4T
0g:9dy
RUB!/n
hmr*X99x
CI`]6V$
3]>*9LT}
EDOR`M
Wp&.=j
A_w!:D
O8P'WB
VO]c#KF
PPk7!$l
F2*N*O-b
XyCt?,
>e1{hBN
"{%ymt
=6esF(
/b[od'n
~JX--n
NuUfFn$
zc$K+`
69$aG,
u`x'=~
TKK}s-
=(l^=T2#H:
1[2J|W
>!Pz1[C
b{zf22u
8)%"bM
VFB+OJv
Dqg@?L
?mFWq:
9/{[T|
\\63Z2i
ZKv4t$!
_L^[h0
HLQ,C?
C{v!6q
q3U4Da(
X{n18d
gXcCUR
"'^u~;
FZ?-"o
EcSk]V
vv72AE
GVFCWB
Lm+>#'6
$zlu}:V
C;A{F9_
$..@8~
Z,(;1
C~_19
*ekBpa~
Yq3"MI
_CorExeMain
mscoree.dll
v4.0.30319
#Strings
done.exe
mscorlib
UnverifiableCodeAttribute
System.Security
<Module>
.cctor
VirtualProtect
kernel32.dll
Object
System
FileStream
System.IO
MulticastDelegate
Invoke
BeginInvoke
IAsyncResult
AsyncCallback
callback
object
EndInvoke
result
BinaryReader
System.Core
CallSite`1
System.Runtime.CompilerServices
Action`3
CallSite
List`1
System.Collections.Generic
BinaryWriter
Exception
SerializationInfo
System.Runtime.Serialization
StreamingContext
ConsoleColor
Func`2
CreateFileW
SafeFileHandle
Microsoft.Win32.SafeHandles
DeviceIoControl
Kernel32.dll
System.Windows.Forms
Dictionary`2
EventArgs
PaintEventArgs
MySettings
LenovoController.Properties
ApplicationSettingsBase
System.Configuration
$$method0x6000087-1
$$method0x6000087-2
$$method0x6000087-3
$$method0x6000087-4
$$method0x6000087-5
$$method0x600008b-1
ValueType
ConfusedByAttribute
Attribute
AssemblyCopyrightAttribute
System.Reflection
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyFileVersionAttribute
DebuggableAttribute
System.Diagnostics
DebuggingModes
RuntimeCompatibilityAttribute
AssemblyTitleAttribute
AssemblyDescriptionAttribute
AssemblyCompanyAttribute
CompilerGeneratedAttribute
DynamicAttribute
STAThreadAttribute
GeneratedCodeAttribute
System.CodeDom.Compiler
EditorBrowsableAttribute
System.ComponentModel
EditorBrowsableState
DebuggerNonUserCodeAttribute
Module
GetTypeFromHandle
RuntimeTypeHandle
get_Module
get_FullyQualifiedName
String
get_Length
get_Chars
Marshal
System.Runtime.InteropServices
GetHINSTANCE
IntPtr
op_Explicit
UInt32
TypeCode
GetTypeCode
Delegate
Combine
Interlocked
System.Threading
CompareExchange
Remove
Stream
Microsoft.CSharp
CSharpArgumentInfo
Microsoft.CSharp.RuntimeBinder
Create
CSharpArgumentInfoFlags
Binder
InvokeMember
CallSiteBinder
CSharpBinderFlags
IEnumerable`1
Target
Console
get_Error
TextWriter
WriteLine
ToArray
IOException
SecurityException
ArgumentException
SeekOrigin
ReadBoolean
Boolean
ReadByte
ReadChar
ReadInt16
ReadInt32
ReadInt64
ReadDouble
Double
ReadSingle
Single
op_Equality
System.Xml
XmlReader
Exists
IsStartElement
get_Name
TryGetValue
get_Item
Convert
ToInt32
ToUpper
IDisposable
Dispose
Concat
get_Message
Format
GetFileName
ToLower
op_Inequality
set_ForegroundColor
ResetColor
StreamWriter
ConsoleKeyInfo
ReadKey
get_Key
ConsoleKey
Enumerable
System.Linq
Select
ToList
IsNullOrWhiteSpace
ReadLine
Assembly
Random
MethodInfo
RuntimeHelpers
InitializeArray
RuntimeFieldHandle
Encoding
System.Text
get_ASCII
GetString
GetType
GetMethod
ToString
RuntimeEnvironment
GetRuntimeDirectory
Environment
GetCommandLineArgs
MethodBase
MD5CryptoServiceProvider
System.Security.Cryptography
TripleDESCryptoServiceProvider
get_Unicode
GetBytes
HashAlgorithm
ComputeHash
SymmetricAlgorithm
set_Key
set_Mode
CipherMode
CreateDecryptor
ICryptoTransform
TransformFinalBlock
IndexOutOfRangeException
DivideByZeroException
ConfuserEx v1.0.0
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
SkipVerification
Microsoft Corporation. All Rights Reserved.
$Microsoft
Windows
-operativsystem
10.06.2763.0
WrapNonExceptionThrows
cbsmsg.dll
(Chinhu-Chakasenderwa Service Message DLL
Microsoft Corporation
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
15.0.0.0
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
Method assepts only primitive CLR types as <T> parameter, e.g. int, char, double...
Invoke
io: Unable to create file stream due to an i/o error, exiting...
security: Not enough permissions to open stream on this file, exiting...
env: Output file path given incorrectly, exiting...
error: {e.Message}
Unable to close writer and stream: {e.Message}
io: Unable to create file stream due to an i/o error, exiting... {e.Message}
Unable to flush changes: {e.Message}
DumpReportCfg.xml
body {
font-family: verdana, arial, sans-serif;
font-size: 12px;
margin-left: 25px;
color: DarkBlue;
font-family: verdana, arial, sans-serif;
font-size: 20px;
margin-left: -15px;
margin-bottom: 0px;
color: DarkBlue;
font-family: verdana, arial, sans-serif;
font-size: 14px;
margin-left: -15px;
button {
padding: 2px 10px;
font-family: verdana, arial, sans-serif;
font-size: 12px;
border-radius: 3px;
border: 1px solid #7F7F7F;
button:hover {
background-color: DarkGray;
color: white;
button:focus {
outline:0;
.toggle-button {
padding: 0px 0px;
margin-right: 3px;
font-size: 10px;
font-weight: bold;
height: 15px;
width: 15px;
font-family: 'Courier New', monospace;
text-align: center;
vertical-align: middle;
.toggle-header {
margin-bottom: 0;
margin-left: 0;
margin-top: 3px;
padding: 0;
font-size: 12px;
vertical-align: top;
.toggle-header td {
margin-bottom: 0;
padding: 0;
font-family: verdana, arial, sans-serif;
vertical-align: top;
.report-table {
margin-left: 15px;
margin-top: 0px;
margin-bottom: 0px;
padding: 0.5em;
.report-table td {
text-align: left;
padding: 0.3em;
font-size: 11px;
.report-table th {
font-size: 12px;
text-align: left;
padding: 0.3em;
background-color: #4f81BD;
color: white;
.report-table tr {
font-size: 12px;
height: 1em;
.report-table tr:nth-child(even)
background-color: #eee;
.report-table tr:nth-child(odd)
background-color:#fff;
.sourcecode-frame {
font-weight: bold;
color: black;
.thread-id {
font-family: 'Consolas', 'Courier New', monospace;
font-weight: normal;
function expand(divName, buttonName) {
if (document.getElementById(divName) === null) return;
document.getElementById(divName).style.display = 'block';
document.getElementById(buttonName).firstChild.data = '-';
function collapse(divName, buttonName) {
if (document.getElementById(divName) === null) return;
document.getElementById(divName).style.display = 'none';
document.getElementById(buttonName).firstChild.data = '+';
function toggle(divName, buttonName) {
var div = document.getElementById(divName);
if (div === null) return;
if (div.style.display === 'none') {
expand(divName, buttonName);
else {
collapse(divName, buttonName);
function setVisibility(show) {
var divName = '';
var buttonId = '';
for (var i = 0; i < numThreads; i++)
divName = 'divThread' + i.toString();
buttonId = 'btThread' + i.toString();
if (show == true) {
expand(divName, buttonId);
}
else {
collapse(divName, buttonId);
}
<?xml version="1.0" encoding="utf-8" ?>
<Config>
<Debugger exe64="" exe32="" timeout="60" />
<Pdb folder="" />
<Style file="" />
<Report file=".\DumpReport.html" show="1" />
<Log folder="" clean="1"/>
<SymbolCache folder="" />
<SourceCodeRoot folder="" />
</Config >
Creates an HTML report from a user-mode dump file using WinDBG or CDB. It shows the call stacks of all threads,
exception details (if any), the loaded modules and the environment details of the target machine.
DumpReport /DUMPFILE dump_file [/PDBFOLDER pdb_folder] [/REPORTFILE html_file] [/SHOWREPORT value] [/QUIET value]
/DUMPFILE: Full path of the dump file to read.
/PDBFOLDER: (optional) Folder containing the corresponding PDBs.
If not specified, PDB files are expected to be in the dump's folder.
/REPORTFILE: (optional) Full path of the HTML report file. It can also be specified in the config file.
By default, a file named 'DumpReport.html' is created in the execution folder.
/SHOWREPORT: (optional) If the value is 1, the report automatically opens in the default browser.
/QUIET: (optional) If 1, the console window does not show progress messages.
Example:
DumpReport /DUMPFILE "C:\dump\crash.dmp" /PDBFOLDER "C:\dump" /SHOWREPORT 1
If the dump file is the only argument, the call can be simplified as follows:
DumpReport "C:\dump\crash.dmp"
In this case, it is also possible to drag and drop the dump directly onto the executable.
Any value containing spaces must be enclosed in double quotes.
Providing the PDB files is not necessary but improves the information of the call stack traces.
The location of the debuggers to use and other options must be defined in the XML
configuration file ({0}).
Run 'DumpReport /CONFIG HELP' for more information on the XML configuration file.
Run 'DumpReport /STYLE HELP' for information on customizing the report's style.
A file named '{0}' must exist together with the executable.
This file contains the default values of the parameters.
Some can be overriden by command line.
<Config>: Main node.
<Debugger>: Supported debuggers are WinDbg.exe and CDB.exe.
exe64: Full path of the 64-bit version debugger.
exe32: Full path of the 32-bit version debugger.
timeout: Maximum number of minutes to wait for the debugger to finish.
<Pdb>:
folder: Folder containing the PDB files. If not specified, PDB files are expected to be
in the same location as the dump file.
<Style>:
file: Full path of a custom CSS file to use.
Run 'DumpReport /STYLE HELP' for more information about the report's CSS style.
<Report>:
file: Full path of the report file to be created.
show: If set to 1, the report will be displayed automatically in the default browser.
<Log>:
folder: Folder where the debugger log files will be created.
If not specified, log files are created in the same location as the dump file.
The name of the log files is the name of the dump file appended with '.log'
clean: Indicates whether the log files should be deleted after being processed.
<SymbolCache>:
folder: Folder to use as symbol cache. If not specified, the debugger will use its default
symbol cache (e.g: C:\ProgramData\dbg)
<SourceCodeRoot>:
folder: The report will emphasize the frames whose source file's path contains this folder.
Run 'DumpReport /CONFIG CREATE' to create a default config file.
CSS styles:
body: Default style for the HTML document.
h1: Title header.
h2: Section header.
button: Default button style.
toggle-button: Style of the Expand/Collapse button (+/-)
toggle-header: Auxiliary table that contains a toggle button and a label
that describes an area that can be expanded or collapsed.
report-table: Style for tables showing thread call stacks, loaded modules or
environment variables. By default, a striped style is used.
sourcecode-frame: Call stack frame associated to the source code root.
thread-id: Style for the thread identifier and intruction pointer.
Run 'DumpReport /STYLE CREATE' to create a sample CSS file (style.css).
.logopen /u "{LOG_FILE}"
.foreach (module {lm1m} ) { .if ($sicmp("${module}","wow64") == 0) { .echo WOW64 found; } }
.effmach
.logclose
.logopen /u "{LOG_FILE}"
{PROGRESS_STEP}
.lines -e
.foreach (module {lm1m} ) { .if ($sicmp("${module}","wow64") == 0) { .load soswow64; .echo WOW64 found; .effmach x86; } }
.effmach
.cordll -ve -u -l
.chain
.echo > !eeversion
{PROGRESS_STEP}
!eeversion
.echo >>> TARGET INFO
!envvar COMPUTERNAME
!envvar USERNAME
.echo PROCESS_ID:
.echo TARGET:
vertarget
.echo >>> MANAGED THREADS
{PROGRESS_STEP}
!Threads
.echo >>> MANAGED STACKS
.block { ~* e !clrstack }
.echo >>> EXCEPTION INFO
{PROGRESS_STEP}
.exr -1
.echo EXCEPTION CONTEXT RECORD:
.echo EXCEPTION CALL STACK:
.echo >>> HEAP
{PROGRESS_STEP}
.echo >>> INSTRUCTION POINTERS
{PROGRESS_STEP}
.block { ~* e ? {INSTRUCT_PTR} }
.echo >>> THREAD STACKS
{PROGRESS_STEP}
~* kv n
.echo >>> LOADED MODULES
{PROGRESS_STEP}
{PROGRESS_STEP}
.echo >>> END OF LOG
.logclose
.logopen /u "{LOG_FILE}"
.block { .effmach x86 }
.lines -e
r @$t0 = 0;
.foreach(value {dd[FIRST_PARAM]}){ .if (@$t0 == 1) { .exr value }; r @$t0 = @$t0 + 1; }
.logclose
.logopen /u "{LOG_FILE}"
.exr [CHILD_SP] + @@c++(sizeof(ntdll!_CONTEXT)) + 0x20
.logclose
.logopen /u "{LOG_FILE}"
.exr [THIRD_PARAM]
.logclose
.logopen /u "{LOG_FILE}"
r @$t0 = 0;
.foreach(value {dq[FOURTH_PARAM]}){ .if (@$t0 == 1) { .exr value; .break; }; r @$t0 = @$t0 + 1; }
.logclose
DumpReport.html
/CONFIG
CREATE
Use /CONFIG with HELP or CREATE
/STYLE
Use /STYLE with HELP or CREATE
Configuration file does not exist.
Please run 'DumpReport /CONFIG CREATE' to create it.
Debugger
Report
SymbolCache
SourceCodeRoot
timeout
folder
Configuration file contains errors.
Please run 'DumpReport /CONFIG HELP' for XML syntax.
/DUMPFILE
/PDBFOLDER
/REPORTFILE
/SHOWREPORT
/QUIET
Invalid parameter
/DUMPFILE parameter not found
Please type 'DumpReport' for help.
Value not found for parameter
{0} debugger not found: cbsmsg.dll
windbg.exe
cdb.exe
Wrong {0} debugger ('cbsmsg.dll'). Only 'WinDBG.exe' or 'CDB.exe' are supported.
Sample:
Nodes:
File already exists. Overwrite? [Y/N] >
Configuration file created.
Please edit the path to the debuggers (WinDBG.exe or CDB.exe).
********
___ . . .
___ . ___ .
___ . .
. . ___ .
___ ___ .
. . . .
. ___ ___ ___
___ . ___
. ___ . .
___ ___
___ ___ ___
. ___ ___ .
___ ___ . ___
. ___ .
. . ___
. . . ___
. ___ ___
___ . . ___
___ . ___ ___
___ ___ . .
. ___ ___ ___ ___
. . ___ ___ ___
. . . ___ ___
. . . . ___
. . . . .
___ . . . .
___ ___ . . .
___ ___ ___ . .
___ ___ ___ ___ .
___ ___ ___ ___ ___
Enter text you want to change to Morse code
Text in Morse Code
R A Z O R D E V E L O P E R
fireball
point
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
Chinhu-Chakasenderwa Service Message DLL
CompanyName
Microsoft Corporation
FileDescription
cbsmsg.dll
FileVersion
10.06.2763.0
InternalName
done.exe
LegalCopyright
Microsoft Corporation. All Rights Reserved.
OriginalFilename
done.exe
ProductName
Microsoft
Windows
-operativsystem
ProductVersion
10.06.2763.0
Assembly Version
0.0.0.0
Antivirus Signature
Bkav W32.AIDetectMalware.CS
Lionic Trojan.Win32.AveMaria.4!c
tehtris Clean
ClamAV Win.Packed.XtremeRAT-9951454-0
CMC Clean
CAT-QuickHeal Trojan.Generic.TRFH471
Skyhigh BehavesLike.Win32.Generic.fc
ALYac Gen:Variant.Jalapeno.2514
Cylance Unsafe
Zillya Clean
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Clean
Alibaba Trojan:MSIL/AveMaria.1638a1ee
K7GW Trojan ( 0056f9c11 )
Cybereason malicious.93c4d4
Baidu Clean
VirIT Trojan.Win32.MSIL_Heur.D
Paloalto Clean
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of MSIL/GenKryptik.ESXT
APEX Malicious
Avast Win32:CrypterX-gen [Trj]
Cynet Clean
Kaspersky HEUR:Trojan.MSIL.Inject.gen
BitDefender Gen:Variant.Jalapeno.2514
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Gen:Variant.Jalapeno.2514
Tencent Msil.Trojan.Inject.Ogil
TACHYON Clean
Sophos Mal/Generic-S
F-Secure Trojan.TR/ATRAPS.Gen
DrWeb Trojan.PackedNET.2904
VIPRE Gen:Variant.Jalapeno.2514
TrendMicro TrojanSpy.Win32.NEGASTEAL.YXEGBZ
McAfeeD ti!6297429668A5
Trapmine malicious.moderate.ml.score
FireEye Generic.mg.6a1ff8c93c4d4ba5
Emsisoft Gen:Variant.Jalapeno.2514 (B)
SentinelOne Static AI - Malicious PE
GData Gen:Variant.Jalapeno.2514
Jiangmin Clean
Webroot W32.Trojan.Gen
Varist Clean
Avira TR/ATRAPS.Gen
Antiy-AVL Clean
Kingsoft malware.kb.c.1000
Gridinsoft Trojan.Win32.AgentTesla.tr
Xcitium Clean
Arcabit Trojan.Jalapeno.D9D2
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.MSIL.Inject.gen
Microsoft Trojan:MSIL/AveMaria.N!MTB
Google Detected
AhnLab-V3 Trojan/Win.CrypterX-gen.C5060207
Acronis suspicious
McAfee Avemaria-FUSF!6A1FF8C93C4D
MAX malware (ai score=86)
VBA32 Clean
Malwarebytes Crypt.Trojan.MSIL.DDS
Panda Trj/GdSda.A
Zoner Probably Heur.ExeHeaderL
TrendMicro-HouseCall TrojanSpy.Win32.NEGASTEAL.YXEGBZ
Rising Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:o0bK0wELbXk9fSeJbyHrNw)
Yandex Clean
Ikarus Trojan.MSIL.Krypt
MaxSecure Clean
Fortinet MSIL/GenKryptik.ESXT!tr
BitDefenderTheta Gen:NN.ZemsilF.36808.xu0@amr9jzc
AVG Win32:CrypterX-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (W)
alibabacloud Trojan:MSIL/AveMaria.N9OKG
No IRMA results available.