Static | ZeroBOX

PE Compile Time

2023-11-02 19:45:36

PDB Path

D:\Mktmp\Amadey\Release\Amadey.pdb

PE Imphash

dc5e346c01606ee3d3aee4549b4acd39

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0002e30f 0x0002e400 6.48394871289
.rdata 0x00030000 0x0000e2e8 0x0000e400 5.73316684893
.data 0x0003f000 0x000027c0 0x00001800 1.41313976851
.rsrc 0x00042000 0x000001e0 0x00000200 4.70045676348
.reloc 0x00043000 0x000028ac 0x00002a00 6.57616707764

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x00042060 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x430044 Sleep
0x430048 GetTempPathA
0x43004c GetLastError
0x430050 GetFileAttributesA
0x430054 CreateFileA
0x430058 CloseHandle
0x43005c GetSystemInfo
0x430060 CreateThread
0x430064 GetThreadContext
0x43006c VirtualAllocEx
0x430070 RemoveDirectoryA
0x430074 ReadProcessMemory
0x430078 CreateProcessA
0x43007c CreateDirectoryA
0x430080 SetThreadContext
0x430084 ReadConsoleW
0x430088 SetEndOfFile
0x43008c HeapSize
0x430090 SetFilePointerEx
0x430094 GetModuleHandleA
0x430098 ResumeThread
0x43009c GetComputerNameExW
0x4300a0 GetVersionExW
0x4300a4 CreateMutexA
0x4300a8 PeekNamedPipe
0x4300ac VirtualAlloc
0x4300b0 WriteFile
0x4300b4 VirtualFree
0x4300b8 WriteProcessMemory
0x4300bc GetModuleFileNameA
0x4300c0 GetProcAddress
0x4300c4 ReadFile
0x4300c8 GetConsoleMode
0x4300cc GetConsoleCP
0x4300d0 FlushFileBuffers
0x4300d4 GetProcessHeap
0x4300e4 GetOEMCP
0x4300e8 GetACP
0x4300ec IsValidCodePage
0x4300f0 FindNextFileW
0x4300f4 FindFirstFileExW
0x4300f8 FindClose
0x430100 HeapReAlloc
0x430104 SetStdHandle
0x430108 GetFullPathNameW
0x430110 DeleteFileW
0x430114 HeapAlloc
0x430118 HeapFree
0x43011c WideCharToMultiByte
0x43012c SetLastError
0x430134 CreateEventW
0x430138 TlsAlloc
0x43013c TlsGetValue
0x430140 TlsSetValue
0x430144 TlsFree
0x43014c GetModuleHandleW
0x430150 EncodePointer
0x430154 DecodePointer
0x430158 MultiByteToWideChar
0x43015c CompareStringW
0x430160 LCMapStringW
0x430164 GetStringTypeW
0x430168 GetCPInfo
0x43016c SetEvent
0x430170 ResetEvent
0x430178 IsDebuggerPresent
0x430184 GetStartupInfoW
0x430190 GetCurrentProcessId
0x430194 GetCurrentThreadId
0x430198 InitializeSListHead
0x43019c GetCurrentProcess
0x4301a0 TerminateProcess
0x4301a4 RaiseException
0x4301a8 RtlUnwind
0x4301ac FreeLibrary
0x4301b0 LoadLibraryExW
0x4301b4 ExitProcess
0x4301b8 GetModuleHandleExW
0x4301bc CreateFileW
0x4301c0 GetDriveTypeW
0x4301c8 GetFileType
0x4301d4 GetModuleFileNameW
0x4301d8 GetStdHandle
0x4301dc GetCommandLineA
0x4301e0 GetCommandLineW
0x4301e4 WriteConsoleW
Library USER32.dll:
0x430200 GetSystemMetrics
0x430204 ReleaseDC
0x430208 GetDC
Library GDI32.dll:
0x430030 SelectObject
0x430034 CreateCompatibleDC
0x430038 DeleteObject
0x43003c BitBlt
Library ADVAPI32.dll:
0x430000 RegCloseKey
0x430004 RegGetValueA
0x430008 RegQueryValueExA
0x430010 GetSidSubAuthority
0x430014 GetUserNameA
0x430018 LookupAccountNameA
0x43001c RegSetValueExA
0x430020 RegOpenKeyExA
Library SHELL32.dll:
0x4301ec SHGetFolderPathA
0x4301f0 ShellExecuteA
0x4301f4 None
0x4301f8 SHFileOperationA
Library WININET.dll:
0x430210 HttpOpenRequestA
0x430214 InternetReadFile
0x430218 InternetConnectA
0x43021c HttpSendRequestA
0x430220 InternetCloseHandle
0x430224 InternetOpenA
0x430228 HttpSendRequestExA
0x430230 HttpEndRequestA
0x430234 InternetOpenW
0x430238 InternetOpenUrlA
0x43023c InternetWriteFile
Library gdiplus.dll:
0x430244 GdipSaveImageToFile
0x43024c GdipDisposeImage
0x430258 GdiplusShutdown
0x43025c GdiplusStartup

!This program cannot be run in DOS mode.
)@"o,A
o-A.o,A
o,ARich
`.rdata
@.data
@.reloc
E0SVW3
CM @PRj
CE8SVWh
VVjPQP
QQSVWd
URPQQh
;t$,v-
UQPXY]Y[
t#Vhd@C
SVWj03
WWWSHSh
WPWWWS
tGht@C
:u"f9z
F4_^[]
<ItC<Lt3<Tt#<h
A<lt'<tt
PPPPPPPP
<at.<rt!<wt
<=upG8
QQSVj8j@
Wj0XPV
SPjdVQ
PPPPPWS
PP9E u:PPVWP
u kE$<
zSSSSj
f9:t!V
PPPPPPPP
D8(Ht'
bad allocation
address family not supported
address in use
address not available
already connected
argument list too long
argument out of domain
bad address
bad file descriptor
bad message
broken pipe
connection aborted
connection already in progress
connection refused
connection reset
cross device link
destination address required
device or resource busy
directory not empty
executable format error
file exists
file too large
filename too long
function not supported
host unreachable
identifier removed
illegal byte sequence
inappropriate io control operation
interrupted
invalid argument
invalid seek
io error
is a directory
message size
network down
network reset
network unreachable
no buffer space
no child process
no link
no lock available
no message available
no message
no protocol option
no space on device
no stream resources
no such device or address
no such device
no such file or directory
no such process
not a directory
not a socket
not a stream
not connected
not enough memory
not supported
operation canceled
operation in progress
operation not permitted
operation not supported
operation would block
owner dead
permission denied
protocol error
protocol not supported
read only file system
resource deadlock would occur
resource unavailable try again
result out of range
state not recoverable
stream timeout
text file busy
timed out
too many files open in system
too many files open
too many links
too many symbolic link levels
value too large
wrong protocol type
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
InitOnceExecuteOnce
CreateEventExW
CreateSemaphoreW
CreateSemaphoreExW
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
FlushProcessWriteBuffers
FreeLibraryWhenCallbackReturns
GetCurrentProcessorNumber
CreateSymbolicLinkW
GetCurrentPackageId
GetTickCount64
GetFileInformationByHandleEx
SetFileInformationByHandle
GetSystemTimePreciseAsFileTime
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
InitializeSRWLock
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
SleepConditionVariableSRW
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CompareStringEx
GetLocaleInfoEx
LCMapStringEx
0123456789abcdefghijklmnopqrstuvwxyz
0123456789abcdefghijklmnopqrstuvwxyz
bad exception
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__swift_1
__swift_2
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
operator co_await
operator<=>
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
`anonymous namespace'
CorExitProcess
`h````
xpxxxx
(null)
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
[aOni*{
~ $s%r
@b;zO]
v2!L.2
UTF-16LEUNICODE
AreFileApisANSI
LocaleNameToLCID
AppPolicyGetProcessTerminationMethod
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
NAN(SNAN)
nan(snan)
NAN(IND)
nan(ind)
_hypot
_nextafter
1#QNAN
1#SNAN
]vQ<)8
|)P!?Ua0
Eb2]A=
u?^p?o4
y1~?|"
?x+s7
?5Od%
?|I7Z#
>,'1D=
?g)([|X>=
~U`?K
:h"?bC
@H#?43
Ax#?uN}*
r7Yr7=
F0$?3=1
H`$?h|
&?~YK|
sU0&?W
<8bunz8
?#%X.y
F||<##
<@En[vP
b<log10
?5Wg4p
%S#[k=
"B <1=
Unknown exception
bad array new length
invalid stoi argument
stoi argument out of range
f48b56f79c948bc59f0d8abf81e21098
110809d565579c33aa316d831dad3c6a
548b49
6a7d8666f910d52dc040acc9bcec216a
TwxvHe3qLBSnJkGU
QV 5TBupa4DXNTaj rGobC6B8xE=
Sv1xGr==
ZrXm6CZp
OLYt8L==
QLSt8L==
SwV3HOFWXVyrKR==
0QOA9SSfJoTXWR==
ZTKJPzKPQ3K=
QTKzTRKWXUyoR1OaRZaRSVSKFscEJnyuNv6VNdF=
Nv6VOdFe
NbxwLb==
ZT6HPAixSmT6QXndarYC9205Uvhg2bPsiWKdKY0uaoTnaG1fasCs926hRdZlJR3g4J==
ZT6HPAixSmT6QXndarYC9205Uvhg2bPsiWKdKY0uaoTnaG1fasCs926hONln2v7v4QGdPSShakzM8HXm HqJ92ypWNNq
ZWOi7iWXaC==
3VYlCxdzGHHGOFnMGHYCI3Fl
ZT6HPAixSmT6QXndarYC9205Uvhg2bPsiWKdKY0uaoTnaG1fasCs926hRdZl
hgSvTBCoKBG
Nv6FTRChbIS I2TIGHx=
ZAGwTYOd ZK=
ZT6HPAixSmT6QXndarYC9205Uvhg2bPsiWKdKY0uaoTnaG1fasCs926hONln2v7v4QGdOXmh Iu OnamXLKB w==
OOSULQOMSm7zPVzzHV==
2xCx7v==
Zx6UPv==
3WGmTx g Iv1V3zjaHUn9Gyc
YPCq6b==
fAO17ytrJy==
fAO17CR2JA6=
QUyt8Ril pKo
OgSv5SV5
hVem6BBvKk3d9Hy=
fVSz6h0oKBGnWHzm
WVS1NhKW9ZXeR4ntbLKwPW6r9m==
ZAGwTYOd WPaaHH7
VOWCOWVcS47faIfbarJ=
VQWq7hJ=
XVCA7B0ua4rYFFzbWl==
WOKGPv==
ZzCvTBJcS4TcaYLjbM =
Wz6k8BduGHbeVh==
RsVxPBdWWYvMWXPVara3bQ==
Vfi1TB0iXY3dWYK=
Yf6z8Bdq
ZV6x5Bdv
VV6u6XWr
0VivLB0iXY3dWYK=
RwBzGuVXLlaXLR==
VV6v8B0qbEZNbYDfMnqwaWy58NF93cOs4f6z6N6gWZPaLzDc 8KxWGGDbJ4kBHYq
QLXuFN5p
IJmE6X WXY3TIVTja8qy 2m58MclE8zjgWGuFRWdbIC0FH7b 1JbFmSmawI EnzjfPum6hKpXVYb
N XLKXdqbITnaD3Oc2qoLiCm xFj1LLeiziw6ddrW5PeaD3tbMyoVW1Sz74B
IJluFN5pJUY=
QLXOwb==
UWKk7e5t
QfmxTr==
VV6v8B0qbEZNbYDfMnqk HCx8MR94vjsgb65FSiZbAZf94LnJ2KB9GWzVScbPLO=
ZUiUPz0JVGLU oLf sGG9265 ccjKRTX2xKw6iWu 4v6N3anaMK3WXKTVM5cNtLsgQy28B0uRoDmWR==
VV6u7C0WXZHHVX3f
3PGkTB0iX4fi8nvm 1Uy HGD TVS4cb1jQlxGONvLFSVKAiZJ0X=
QQSv5RSrXISm
ZUiUPz0JVGLU oLf sGG9265 ccjKRTX2xKw6iWu 4v6SX7jbLKnSmmpWMc4GP7L0yGQNACSQWPyQ2y=
ZUiUPz0JVGLo9oTs 7mWWXRBJtJ4KRTvifikTSS9OoDs8XPy92Cz9GG Uv3gPvTs
0filTRdFPC==
2wxxGyF=
WzSnSS0obHLeaITj r3CIliXWNRm2wTXfP6v
WzSnSS0obHLeaITj r3CIlmXWNRm2wTXfP6v
ZT6HPAixSmT6QXndarYC9205Uvhg2bPsiWJhNgW9O5Tr nXobKOo nOu9S8=
ZAGwTC0fbG3a9XW=
RcxyIL==
RcxzGb==
RcxyHb==
VWSz7h0qbGHU8Xze
4PKp6tGVdGLuN1zNGHx=
NbxwOxFe
VTCENARcGi==
TeFjCxdB
TdVjCxdB
ObWG9BqW
hgSvTBCoKBGnWYjf
NgOi7Xyn9YvlFDagGHYs9SBn
NbxnDdGW9YZe94XUGItjGiZlWwZjyp==
ObVhLSmlbEG=
NbxnDdGuXY2
NvVnCv==
Zz64TSOv9ITl9D7fcLJ=
QPS5TRSXbIjo9oDp LambSCDWM5m4vTwfPavTRVcJWXi9HWaGl==
hVe28BWrb42 IYOaJ2FjJA==
hWN 7r==
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
NtUnmapViewOfSection
ntdll.dll
invalid string position
string too long
0123456789ABCDEF
D:\Mktmp\Amadey\Release\Amadey.pdb
.text$di
.text$mn
.text$x
.text$yd
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCC
.CRT$XCL
.CRT$XCU
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIC
.CRT$XIZ
.CRT$XLA
.CRT$XLZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$T
.rdata$r
.rdata$sxdata
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.tls$ZZZ
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.data$r
.rsrc$01
.rsrc$02
ReadFile
GetModuleFileNameA
WriteProcessMemory
VirtualFree
WriteFile
VirtualAlloc
PeekNamedPipe
CreateMutexA
GetVersionExW
GetComputerNameExW
ResumeThread
GetModuleHandleA
SetCurrentDirectoryA
GetTempPathA
GetLastError
GetFileAttributesA
CreateFileA
CloseHandle
GetSystemInfo
CreateThread
GetThreadContext
GetProcAddress
VirtualAllocEx
RemoveDirectoryA
ReadProcessMemory
CreateProcessA
CreateDirectoryA
SetThreadContext
KERNEL32.dll
ReleaseDC
GetSystemMetrics
USER32.dll
DeleteObject
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
GDI32.dll
GetSidIdentifierAuthority
RegOpenKeyExA
RegSetValueExA
LookupAccountNameA
GetUserNameA
GetSidSubAuthority
GetSidSubAuthorityCount
RegQueryValueExA
RegGetValueA
RegCloseKey
ADVAPI32.dll
ShellExecuteA
SHGetFolderPathA
SHFileOperationA
SHELL32.dll
HttpOpenRequestA
InternetWriteFile
InternetOpenUrlA
InternetOpenW
HttpEndRequestA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetOpenA
InternetCloseHandle
HttpSendRequestA
InternetConnectA
InternetReadFile
WININET.dll
GdipSaveImageToFile
GdipGetImageEncodersSize
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipGetImageEncoders
GdiplusShutdown
GdiplusStartup
gdiplus.dll
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetCurrentProcess
TerminateProcess
RaiseException
RtlUnwind
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetModuleFileNameW
GetStdHandle
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
DeleteFileW
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle
HeapReAlloc
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
HeapSize
SetEndOfFile
ReadConsoleW
WriteConsoleW
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVinvalid_argument@std@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
.?AVtype_info@@
.?AVbad_exception@std@@
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVbad_array_new_length@std@@
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
0#0(020C0H0R0c0h0r0
1#1(121C1H1R1c1h1r1
2#2(222C2H2R2c2h2r2
3#3(323C3H3R3c3h3r3
4#4(424C4H4R4c4h4r4
5#5(525C5H5R5c5h5r5
6#6(626C6H6R6c6h6r6
7#7(727C7H7R7c7h7r7
8#8(828C8H8R8c8h8r8
9#9(929C9H9R9c9h9r9
:#:(:2:C:H:R:c:h:r:
;#;(;2;C;H;R;c;h;r;
<#<(<2<C<H<R<c<h<r<
=#=(=2=C=H=R=c=h=r=
>#>(>2>C>H>R>c>h>r>
?#?(?2?C?H?R?c?h?r?
0#0(020C0H0R0c0h0r0
1!13181B1N1X1d1p1|1
2?2d2{2
3(3O3h3?4D4`4
5*5g5n5
7I7b7n7v7
9#999D9
?"?8?>?E?
2I2R2]3D4_4
6^7p7}7
0*030@0E0K0R0q0
4$4/4J4c4|4
;0;T;t;{;
<==N=a=y=
=#>=>R>a>y>
?C?L?[?d?x?
030W0w0~0
<'<8=G=X>g>x?
363<3g3
20P0o0
151S1u1
3"3G3e3
1'4J4T4d4h4l4p4
:%:H:L:P:T:
2.2A2K5n5}5
77%7.7i7/878E8K8T8
0L1e1v1
<,>;>L>P>T>X>\>`>d>h>l>p>
;$;I;n;
:2>n>;?
141s1~1
132N2a<
636R6m6
6+7K7k7
8"8(8.83898?8D8J8P8U8[8a8f8l8r8w8}8
9!9'9-92989>9C9H9O9T9Z9`9e9k9q9v9|9
: :&:,:1:7:=:B:H:N:S:Y:_:d:j:p:u:{:
;);1;x;
<&<0<7<=<G<V<^<j<{<
=%=,=7===D=
=/>U>d>{>
191>1K1
4F5[5n5x5'60686s6}6
7'7.7A7Q7n7
748=8J8P8z8
9'9.9N9T9Z9`9f9l9s9z9
;*<B<G<
<D=U=4?G?e?s?
!1X1_1d1h1l1p1
?7???Q?^?
0$0*0E0m0
0F1U152e4
?&?-?3?e?q?
2'2,212L2V2b2g2l2
3&4C4O4q4
5+525>5V5[5g5l5
5O6V6h6|6
4}9k:u:
;N;q;x;
4!4L4W4
8'8B8M8
=?=F=d>
?0?E?J?T?Y?d?o?|?
3 3Y3n3y3
4*484?4G4_4m4u4
66Z6_6e6j6r6x6
9 :;:H:V:d:o:
9/9A9N9g9
9 :':H:q:
;;/;4;9;I;N;S;c;h;m;
;$<P<Y<
>,>;>F>K>P>n>}>
> ?D?[?`?k?
0 0*0u0
0%1/1e1
5#626@6]6e6
7C7J7S7}7
868B8t8
/0N5R8r8
:#:";(;K;
0050K0S0
9L9U9`9
:#:,:5:
==O=W=
2;3h3p3}3
575T5h5s5
768V8f8
:,:=:E:U:f:
=G>P>h>
1"1,161Z1d1n1x1
3393B3i3n3t3~3
6%6+6:6E6K6U6f6m6
6&717>7G7\7
8,8X8e9
9v<\=:>a>
70b0}0
2(222?2I2Y2
4,5l5x5
6 6$6*6.64686B6U6^6y6
:,:8:I:W:b:*;|<
<d=k=u=
>,>>>P>b>t>
?%?7?I?[?m?
2,3e3y3
4!7Z9{9
5B5W5h5
576]6u6
2"3)3#6
151`1{1
;@<F<+>G>
>%?9?\?
2*2h2{2
5!6+6i6
728Q8]8
;$;T;x;
0'0-0y0
0!1-1A1M1Y1y1
22+2:2#3
7"737]7
=7=A=K=b=l=
>">,>W>a>k>
?!?+?B?L?w?
070A0K0b0l0
1"1,1W1a1k1
2!2+2B2L2w2
373A3K3b3l3
4"4,4W4a4k4
5!5+5B5L5w5
676A6K6b6l6
7"7,7W7a7k7
8!8+8B8L8w8
979A9K9b9l9
:":,:W:a:k:
;!;+;B;L;w;
<7<A<K<b<l<
="=,=W=a=k=
>!>+>B>L>w>
?7?A?K?b?l?
0"0,0W0a0k0
1!1+1B1L1w1
272A2K2b2l2
3"3,3W3a3k3
4!4+4B4L4w4
575A5K5b5l5
6"6,6W6a6k6
7!7+7B7L7w7
878A8K8b8l8
9"9,9W9a9k9
:!:+:B:L:w:
;7;A;K;b;l;
<"<,<W<a<k<
=!=+=B=L=w=
>7>A>K>b>l>
?"?,?W?a?k?
0!0+0B0L0w0
171A1K1b1l1
2"2,2W2a2k2
3!3+3B3L3w3
474A4K4b4l4
5"5,5W5a5k5
6!6+6B6L6w6
777A7K7b7l7
8"8,8W8a8k8
9!9+9B9L9w9
:7:A:K:b:l:
;";,;W;a;k;
<!<+<B<L<w<
=7=A=K=b=l=
>">,>W>a>k>
?!?+?B?L?w?
070A0K0b0l0
1"1,1W1a1k1
2"2,262B2m2s2}2
d2l2p2t2x2|2
3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
5 5$5(5,505D5H5L5P5T5X5\5`5d5h5l5p5
8$8,848<8D8L8T8\8d8l8t8|8
9$9,949<9D9L9T9\9d9l9t9|9
:$:,:4:<:D:L:T:
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6l6t6|6
7$7,747<7D7L7T7\7d7l7t7|7
8$8,848<8D8L8T8\8d8l8t8|8
9$9,949<9D9L9T9\9d9l9t9|9
:$:,:4:<:D:L:T:\:d:l:t:|:
;$;,;4;<;D;L;T;\;d;l;t;|;
< <(<0<8<@<H<P<X<`<h<p<x<
= =(=0=8=@=H=P=X=`=h=p=x=
> >(>0>8>@>H>P>X>`>h>p>x>
? ?(?0?8?@?H?P?X?`?h?p?x?
0 0(00080@0H0P0X0`0h0p0x0
1 1(10181@1H1P1X1`1h1p1x1
2 2(20282@2H2P2X2`2h2p2x2
6 6(60686@6H6P6X6`6h6p6x6
7 7(70787@7H7P7X7`7h7p7x7
8 8(80888@8H8P8X8`8h8p8x8
9 9(90989@9H9P9X9`9|?
4 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l50:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
? ?$?t?|?
0$0,040<0D0L0T0Z2^2b2f2
3$3,343<3D3L3T3\3d3l3t3|3
4$4,444<4D4L4T4\4d4l4t4|4
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6l6t6|6
7$7,747<7D7L7T7\7d7l7t7|7
8$8,848<8D8L8T8\8d8l8t8|8
9$9,949<9D9L9T9\9d9l9t9|9
:$:,:4:8:@:H:P:X:`:h:p:x:
; ;(;0;8;@;H;P;X;`;h;p;x;
< <(<0<8<@<H<P<X<`<h<p<x<
= =(=0=8=@=H=P=X=`=h=p=x=
> >(>0>8>@>H>P>X>`>h>p>x>
? ?(?0?8?@?H?P?X?`?h?p?x?
0 0(00080@0H0P0X0`0h0p0x0
1 1(10181@1H1P1
h1L6P6X6
7$7(787<7@7D7L7d7t7x7
8(8,848L8\8`8p8t8x8
9(9,9<9L9\9`9d9|9
> >(>,>0>8>L>T>\>d>h>l>t>
?(?0?4?P?X?\?l?
0(0D0H0h0
1(1H1h1
2(2H2h2
3(3H3h3
4(4H4d4h4p4t4x4
p0t0x0|0
2$2(2,2H2L2
7,7H7d7
TCjjjj
ekernel32.dll
zh-CHS
az-AZ-Latn
uz-UZ-Latn
kok-IN
syr-SY
div-MV
quz-BO
sr-SP-Latn
az-AZ-Cyrl
uz-UZ-Cyrl
quz-EC
sr-SP-Cyrl
quz-PE
smj-NO
bs-BA-Latn
smj-SE
sr-BA-Latn
sma-NO
sr-BA-Cyrl
sma-SE
sms-FI
smn-FI
zh-CHT
az-az-cyrl
az-az-latn
bs-ba-latn
div-mv
kok-in
quz-bo
quz-ec
quz-pe
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
syr-sy
uz-uz-cyrl
uz-uz-latn
zh-chs
zh-cht
api-ms-win-core-synch-l1-2-0.dll
Capi-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
kernel32
api-ms-
mscoree.dll
(null)
((((( H
((((( H
(
Capi-ms-win-core-datetime-l1-1-1
api-ms-win-core-file-l1-2-2
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
advapi32
api-ms-win-appmodel-runtime-l1-1-2
user32
ext-ms-
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
CONOUT$
image/jpeg
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Amadey.4!c
tehtris Clean
ClamAV Win.Downloader.Amadey-10017867-0
CMC Clean
CAT-QuickHeal Clean
Skyhigh BehavesLike.Win32.Downloader.dh
McAfee Downloader-FCND!107C3B33E05D
Cylance Unsafe
Zillya Clean
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 005a7a4a1 )
BitDefender Gen:Variant.Zusy.446510
K7GW Trojan ( 005a7a4a1 )
Cybereason malicious.3e05d1
huorong TrojanDownloader/Amadey.p
Baidu Clean
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/TrojanDownloader.Amadey.A
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 100)
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba TrojanDownloader:Win32/Amadey.b6d38fe6
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Gen:Variant.Zusy.446510
Tencent Win32.Trojan.Agen.Pgil
TACHYON Clean
Sophos Mal/Amadey-C
F-Secure Trojan:W32/Amadey.A
DrWeb Clean
VIPRE Gen:Variant.Zusy.446510
McAfeeD ti!6338B823D517
Trapmine suspicious.low.ml.score
FireEye Generic.mg.107c3b33e05d1d56
Emsisoft Gen:Variant.Zusy.446510 (B)
Ikarus Trojan-Downloader.Win32.Amadey
GData Win32.Trojan-Downloader.Amadey.D
Jiangmin Clean
Webroot Clean
Varist W32/Amadey.C1.gen!Eldorado
Avira HEUR/AGEN.1375090
Antiy-AVL Clean
Kingsoft Win32.Troj.Unknown.a
Gridinsoft Trojan.Amadey.65344.dd!yf
Xcitium Clean
Arcabit Trojan.Zusy.D6D02E
SUPERAntiSpyware Clean
ZoneAlarm UDS:DangerousObject.Multi.Generic
Microsoft Trojan:Win32/Amadey!pz
Google Detected
AhnLab-V3 Malware/Win.Trojanspy.C5238800
Acronis Clean
ALYac Gen:Variant.Zusy.446510
MAX malware (ai score=88)
Malwarebytes Generic.Malware/Suspicious
Panda Trj/Genetic.gen
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002C0DH624
Rising Downloader.Amadey!8.125AC (CLOUD)
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Clean
Fortinet W32/Amadey.A!tr
BitDefenderTheta Gen:NN.ZexaF.36810.quW@aymJhBgi
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (W)
alibabacloud Trojan[spy]:Win/Amadey.A
No IRMA results available.