Static | ZeroBOX

PE Compile Time

2024-07-24 16:53:21

PDB Path

F:\restart\restart\Release\restart.pdb

PE Imphash

42847d4634d50d324793794a61253375

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00011cd4 0x00011e00 6.58304648747
.rdata 0x00013000 0x00006784 0x00006800 4.81453713834
.data 0x0001a000 0x00001608 0x00000c00 2.11809836072
.rsrc 0x0001c000 0x000001e0 0x00000200 4.71006138269
.reloc 0x0001d000 0x0000117c 0x00001200 6.48597633031

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x0001c060 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x413000 Sleep
0x413004 WriteConsoleW
0x413008 CreateFileW
0x41300c SetFilePointerEx
0x413018 GetCurrentProcess
0x41301c TerminateProcess
0x413028 GetCurrentProcessId
0x41302c GetCurrentThreadId
0x413034 InitializeSListHead
0x413038 IsDebuggerPresent
0x41303c GetStartupInfoW
0x413040 GetModuleHandleW
0x413044 RtlUnwind
0x413048 RaiseException
0x41304c GetLastError
0x413050 SetLastError
0x413054 EncodePointer
0x413068 TlsAlloc
0x41306c TlsGetValue
0x413070 TlsSetValue
0x413074 TlsFree
0x413078 FreeLibrary
0x41307c GetProcAddress
0x413080 LoadLibraryExW
0x413084 FindClose
0x413088 FindFirstFileExW
0x41308c FindNextFileW
0x413098 GetStdHandle
0x41309c WriteFile
0x4130a0 GetModuleFileNameW
0x4130a4 ExitProcess
0x4130a8 GetModuleHandleExW
0x4130ac GetCommandLineA
0x4130b0 GetCommandLineW
0x4130b4 HeapFree
0x4130b8 HeapAlloc
0x4130bc MultiByteToWideChar
0x4130c0 WideCharToMultiByte
0x4130c4 CompareStringW
0x4130c8 LCMapStringW
0x4130cc DeleteFileW
0x4130d0 CloseHandle
0x4130d4 WaitForSingleObject
0x4130d8 GetExitCodeProcess
0x4130dc CreateProcessW
0x4130e4 MoveFileExW
0x4130e8 CreateDirectoryW
0x4130ec IsValidCodePage
0x4130f0 GetACP
0x4130f4 GetOEMCP
0x4130f8 GetCPInfo
0x413108 SetStdHandle
0x41310c GetFileType
0x413110 GetStringTypeW
0x413114 GetProcessHeap
0x41311c HeapSize
0x413120 HeapReAlloc
0x413124 FlushFileBuffers
0x413128 GetConsoleOutputCP
0x41312c GetConsoleMode
0x413130 DecodePointer
Library USER32.dll:
0x413138 GetForegroundWindow
0x41313c ShowWindow
0x413140 MessageBoxW

!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
QQSVWd
URPQQh
UQPXY]Y[
SSSQSP
uSSSSj
f9:t!V
QQSVj8j@
u kE$<
j-Xf9E
SystPQ
emRoPf
uihhsA
uG9]$t
PPPPPPPP
PPPPPWV
PP9E uPPSWP
PVVVVV
bad allocation
bad exception
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__swift_1
__swift_2
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
operator co_await
operator<=>
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
`anonymous namespace'
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
COMSPEC
cmd.exe
CorExitProcess
AreFileApisANSI
CompareStringEx
LCMapStringEx
LocaleNameToLCID
AppPolicyGetProcessTerminationMethod
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
?5Wg4p
%S#[k=
"B <1=
_hypot
_nextafter
Unknown exception
bad array new length
string too long
taskkill /f /im
\TempFolder
rd /s /q "
start "" "
F:\restart\restart\Release\restart.pdb
.text$mn
.text$x
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIC
.CRT$XIZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$r
.rdata$sxdata
.rdata$voltmd
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.data$r
.data$rs
.rsrc$01
.rsrc$02
KERNEL32.dll
GetForegroundWindow
ShowWindow
MessageBoxW
USER32.dll
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
RaiseException
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
FindClose
FindFirstFileExW
FindNextFileW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
LCMapStringW
DeleteFileW
CloseHandle
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
GetFileAttributesExW
MoveFileExW
CreateDirectoryW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
WriteConsoleW
DecodePointer
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVbad_exception@std@@
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVbad_array_new_length@std@@
.?AVtype_info@@
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
040K0u0
0181Q1m1
8L:Q:Y:
0-0C0w0
2'2,292s2L3U3`3g3z3
4#434C4S4\4v4
5=5c5r5
7)7c7l7
:!:>:j:t:}:$;-;5;p;z;
<$<+<:<
< =8===
5%6F6T6Z6u6
6!6J6f6
858?8K8P8U8s8}8
;+<0<4<8<<<
:*;9;R;
>*>H>_>z>
0020:0@0I0^0k0r0{0
4M4T4n4
878E8X8c8n8
8G9T9c9w9
:W;e;~;
30>0}0
1O1S1[1g1
202I2N2g2x2}2
383C3O;
242C2U2h2
31383W3
4*4?4O4\4
5F5_5m5y5
6H6`6p6
707@7E7J7e7o7
8%848?8D8I8j8z8
929D9P9h9r9
8E9O9:):I:S:l:
4P4W4^4e4
5&5K5s5
7"8<8N8
9'9=9m9
0B0`0n0u0
6!6J6Q6m6t6
637G7w7
:$:6:H:Z:l:~:
3-444;4B4O4
667P7U7X9r9
:/:<:J:X:c:y:
1&101:1>1D1H1N1T1Z1`1f1
1"2*262C2J2S2\2l2}2
5+50565U5W6
99*90969J9R9
"1Y2\3
232V2j2
3H3Z3d3
4#5J5i5%6U6o6
575D5t5
9A9Q9@;F;K;R;b;p;
<*=g=q=
=9>A>I>Q>Y>w>
4;5<6L6]6e6u6
7A7P7\7k7~7
7,858>8G8r8
2#3S3
6-6K6_6e6/7b7
<-<J<g<
H1P1\1`1d1h1l1p1t1
2 2(20282@2H2P2X2`2h2p2x2
3 3(30383@3H3P3X3`3h3p3x3
4 4(40484@4H4P4X4`4h4p4x4
5 5(50585@5H5P5X5`5h5p5x5
>$>(>,>0>4>
`5d5h5l5p5t5x5|5
6 6$6(6,6064686<6@6D6H6L6P6T6X6\6`6d6h6l6p6t6x6|6
68:<:@:D:
3$3,343<3D3L3T3\3d3l3t3|3
4$4,444<4D4L4T4\4d4l4t4|4
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6l6t6|6
7$7,747<7D7L7T7\7d7l7t7|7
8$8,848<8D8L8T8\8d8l8t8|8
9$9,949<9D9L9T9\9d9l9t9|9
4 4(40484@4H4P4X4`4h4p4x4
5 5(50585@5H5P5X5`5h5p5x5
6 6(60686@6H6P6X6`6h6p6x6
7 7(70787@7H7P7X7`7h7p7x7
8 8(80888@8H8P8X8`8h8p8x8
9 9(90989@9H9P9X9`9h9p9x9
: :(:0:8:@:H:P:X:`:h:p:x:
J5N5R5V5L>T>\>d>l>t>|>
2 2$2(202H2X2\2l2p2t2x2
3,3<3@3D3H3L3T3X3`3x3|3
9,949<9D9H9L9T9h9
:,:P:\:d:
;$;h;t;
;0<P<l<p<
=0=P=p=
>0>P>p>
?,?0?P?p?
1H6P6T6X6\6`6d6h6l6p6t6
80:P:p:
Aapi-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
kernel32
api-ms-
mscoree.dll
Aapi-ms-win-core-datetime-l1-1-1
api-ms-win-core-file-l1-2-4
api-ms-win-core-file-l1-2-2
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
advapi32
kernelbase
api-ms-win-appmodel-runtime-l1-1-2
user32
api-ms-win-core-fibers-l1-1-0
ext-ms-
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
Aja-JP
((((( H
((((( H
(
zh-CHS
az-AZ-Latn
uz-UZ-Latn
kok-IN
syr-SY
div-MV
quz-BO
sr-SP-Latn
az-AZ-Cyrl
uz-UZ-Cyrl
quz-EC
sr-SP-Cyrl
quz-PE
smj-NO
bs-BA-Latn
smj-SE
sr-BA-Latn
sma-NO
sr-BA-Cyrl
sma-SE
sms-FI
smn-FI
zh-CHT
az-az-cyrl
az-az-latn
bs-ba-latn
div-mv
kok-in
quz-bo
quz-ec
quz-pe
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
syr-sy
uz-uz-cyrl
uz-uz-latn
zh-chs
zh-cht
CONOUT$
Antivirus Signature
Bkav W32.Common.B83D2003
Lionic Trojan.Win32.Fragtor.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
Skyhigh Clean
ALYac Gen:Variant.Fragtor.604683
Cylance Unsafe
Zillya Clean
Sangfor Trojan.Win32.Agent.Vq9z
K7AntiVirus Clean
Alibaba Clean
K7GW Clean
Cybereason malicious.6a8787
huorong Clean
Baidu Clean
VirIT Clean
Paloalto generic.ml
Symantec ML.Attribute.HighConfidence
Elastic malicious (moderate confidence)
ESET-NOD32 Clean
APEX Malicious
Avast Win32:MalwareX-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Trojan.GenericKD.73934390
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Trojan.GenericKD.73934390
Tencent Clean
TACHYON Clean
Sophos Clean
F-Secure Clean
DrWeb Clean
VIPRE Gen:Variant.Fragtor.604683
TrendMicro Clean
McAfeeD ti!F160DF8CB420
Trapmine Clean
FireEye Trojan.GenericKD.73934390
Emsisoft Trojan.GenericKD.73934390 (B)
Ikarus Clean
GData Trojan.GenericKD.73934390
Jiangmin Clean
Webroot Clean
Varist Clean
Avira Clean
Antiy-AVL Trojan/Multi.Agent
Kingsoft Win32.Troj.Unknown.a
Gridinsoft Clean
Xcitium Clean
Arcabit Trojan.Generic.D4682636
SUPERAntiSpyware Clean
ZoneAlarm UDS:DangerousObject.Multi.Generic
Microsoft Trojan:Win32/Casdet!rfn
Google Clean
AhnLab-V3 Clean
Acronis Clean
McAfee Clean
MAX malware (ai score=87)
VBA32 Clean
Malwarebytes Generic.Malware/Suspicious
Panda Trj/Chgt.AD
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R011H09GS24
Rising Clean
Yandex Clean
SentinelOne Clean
MaxSecure Clean
Fortinet W32/PossibleThreat
BitDefenderTheta Gen:NN.ZexaF.36812.guW@aWTkADpi
AVG Win32:MalwareX-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_60% (D)
alibabacloud Clean
No IRMA results available.