Static | ZeroBOX

PE Compile Time

2024-10-22 21:24:12

PE Imphash

32fbf5b10b16ec517b227ff71a382b38

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0001e63e 0x0001e800 6.41892343887
.rdata 0x00020000 0x0000b408 0x0000b600 4.41472109422
.data 0x0002c000 0x000178a0 0x00014c00 5.49782800825
.pdata 0x00044000 0x00001968 0x00001a00 5.20763856898
.rsrc 0x00046000 0x00000328 0x00000400 2.63032409164
.reloc 0x00047000 0x00001ab2 0x00001c00 1.91882947914

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x00046060 0x000002c8 LANG_ENGLISH SUBLANG_ENGLISH_US data

Imports

Library OLEAUT32.dll:
0x1400203b0 VariantClear
Library KERNEL32.dll:
0x140020000 EnumSystemLocalesEx
0x140020008 IsValidLocaleName
0x140020010 LCMapStringEx
0x140020018 GetUserDefaultLocaleName
0x140020020 FreeEnvironmentStringsW
0x140020028 GetEnvironmentStringsW
0x140020030 QueryPerformanceCounter
0x140020038 FlsFree
0x140020040 FlsSetValue
0x140020048 FlsGetValue
0x140020050 FlsAlloc
0x140020060 UnhandledExceptionFilter
0x140020068 RtlVirtualUnwind
0x140020070 RtlCaptureContext
0x140020078 LoadLibraryExW
0x140020080 ReadConsoleW
0x140020088 SetStdHandle
0x140020090 WriteConsoleW
0x140020098 OutputDebugStringW
0x1400200a0 LocalFree
0x1400200a8 GetTickCount64
0x1400200b0 SetEndOfFile
0x1400200b8 GetConsoleMode
0x1400200c0 GetConsoleCP
0x1400200c8 FlushFileBuffers
0x1400200d0 SetFilePointerEx
0x1400200d8 GetThreadContext
0x1400200e0 GetTempFileNameW
0x1400200e8 GetFileSize
0x1400200f0 SetThreadContext
0x1400200f8 SetFilePointer
0x140020100 FreeLibrary
0x140020108 GetCurrentProcess
0x140020110 WaitForSingleObject
0x140020118 WriteFile
0x140020120 OpenProcess
0x140020128 GetSystemDirectoryW
0x140020130 LoadLibraryW
0x140020138 GetModuleFileNameW
0x140020140 CreateFileW
0x140020148 GetTempPathW
0x140020150 GetLastError
0x140020158 GetProcAddress
0x140020160 VirtualAllocEx
0x140020168 LoadLibraryA
0x140020170 GetModuleHandleA
0x140020178 lstrcatW
0x140020180 Wow64SetThreadContext
0x140020188 CloseHandle
0x140020190 WriteProcessMemory
0x140020198 ResumeThread
0x1400201a0 Wow64GetThreadContext
0x1400201a8 CreateThread
0x1400201b0 HeapAlloc
0x1400201b8 GetProcessHeap
0x1400201c0 Sleep
0x1400201c8 CreateRemoteThread
0x1400201d0 CreateToolhelp32Snapshot
0x1400201d8 VirtualProtectEx
0x1400201e0 VirtualProtect
0x1400201e8 ExitProcess
0x1400201f0 CreateMutexA
0x1400201f8 HeapReAlloc
0x140020200 CreateFileA
0x140020208 FindFirstFileW
0x140020210 MapViewOfFile
0x140020218 UnmapViewOfFile
0x140020220 CompareFileTime
0x140020228 HeapFree
0x140020230 GetModuleHandleW
0x140020238 GetProcessTimes
0x140020240 GetFileAttributesA
0x140020248 TerminateProcess
0x140020250 ReadFile
0x140020258 lstrcatA
0x140020260 MultiByteToWideChar
0x140020268 CreateDirectoryA
0x140020270 CopyFileA
0x140020278 SetFileAttributesA
0x140020280 Process32FirstW
0x140020288 CreateFileMappingA
0x140020290 GetModuleFileNameA
0x140020298 Process32NextW
0x1400202a0 IsDebuggerPresent
0x1400202a8 FindNextFileW
0x1400202b0 DeleteFileW
0x1400202c0 WideCharToMultiByte
0x1400202c8 GetStringTypeW
0x1400202d0 EncodePointer
0x1400202d8 DecodePointer
0x1400202e0 EnterCriticalSection
0x1400202e8 LeaveCriticalSection
0x1400202f8 DeleteCriticalSection
0x140020300 GetLocaleInfoEx
0x140020308 GetCPInfo
0x140020318 GetSystemTimeAsFileTime
0x140020320 GetCommandLineW
0x140020328 RtlPcToFileHeader
0x140020330 RaiseException
0x140020338 RtlLookupFunctionEntry
0x140020340 RtlUnwindEx
0x140020350 GetModuleHandleExW
0x140020358 HeapSize
0x140020360 IsValidCodePage
0x140020368 GetACP
0x140020370 GetOEMCP
0x140020378 SetLastError
0x140020380 GetCurrentThreadId
0x140020388 GetStdHandle
0x140020390 GetFileType
0x140020398 InitOnceExecuteOnce
0x1400203a0 GetStartupInfoW

!This program cannot be run in DOS mode.
`.rdata
@.data
.pdata
@.rsrc
@.reloc
SVWAVH
8A^_^[
HcA<D9
@USVWH
tY!T$@H
UVWAVAWH
A_A^_^]
UVWAVAWH
A_A^_^]
WAVAWH
A_A^_
SVWAVAWH
0A_A^_^[
UVWATAUAVAWH
`A_A^A]A\_^]
UAVAWH
\$ UVWH
HcA<H
@SVWATAUAVAWH
`A_A^A]A\_^[
UAVAWH
WATAUAVAWH
L96tfH
0A_A^A]A\_
UVWATAUAVAWH
@A_A^A]A\_^]
UVWAVAWH
0A_A^_^]
@SVWAVAWH
fD9|$0u
@A_A^_^[
tzH91uu
l$ VWAVH
\$0f9]
t$`fD9
t&fD9u
UWATAVAWH
H9wxu"H
A_A^A\_]
toH9Kxu
@SUVWAVH
0A^_^][
\$ VWAVH
l$ VWAVH
WATAUAVAWH
0A_A^A]A\_
UAVAWH
UVWAVAWH
A_A^_^]
WATAUAVAWH
PA_A^A]A\_
UVWAVAWH
D8:u2H
A_A^_^]
D9>tXA
fffffff
ATAVAWH
A_A^A\
\$ UVWATAUAVAWH
A_A^A]A\_^]
A:8uiI
t"A88t
@8l$8t
l$ VWAVH
r9\$ ~>L
l$ VWAUAVAWH
L$$fA;
u$HcG$H;
t5f9(t
A_A^A]_^
AUAVAWH
0A_A^A]
s WATAUAVAWH
9t$P~.8\$vt(H
9t$P~98\$vt3H
A_A^A]A\_
WAVAWH
A_A^_
WATAUAVAWH
A_A^A]A\_
VWATAVAWH
A_A^A\_^
x ATAVAWH
A_A^A\
x UAVAWH
x ATAUAWH
@A_A]A\
VWATAVAWH
A_A^A\_^
UVWATAUAVAWH
A_A^A]A\_^]
D8eoupH
UVWATAUAVAWH
pA_A^A]A\_^]
WATAUAVAWH
A_A^A]A\_
AUAVAWH
0A_A^A]
@SVWATAUAVAWH
L!|$@L!
D$HHcH
A_A^A]A\_^[
SVWATAUAVAWH
0A_A^A]A\_^[
WATAVH
@A^A\_
WAVAWH
fD9>u"
0A_A^_
@UATAUAVAWH
!t$(H!t$ I
A_A^A]A\]
Genuua
ineIuY
nteluQ3
WATAUAVAWH
@A_A^A]A\_
WATAUAVAWH
A_A^A]A\_
l$ VWATAVAWH
T$&@8t$&t9@8r
A81t@@8r
A_A^A\_^
WAVAWH
fE98t'
0A_A^_
@SUVWATAUAVAWH
A_A^A]A\_^][
;Cu1f9K
f93t M;
L$ SUVWH
|$ ATAVAWH
0A_A^A\
WATAUAVAWH
0A_A^A]A\_
\$ UVWATAUAVAWH
^fD9+t
A_A^A]A\_^]
\$ UVWATAUAVAWH
A_A^A]A\_^]
fD9|$bu
H9L$Ht8H
` AUAVAWH
t$HHc0I
\$0D9=
A_A^A]
t$ WATAUAVAW
A_A^A]A\_
VWATAVAWH
A_A^A\_^
VWATAVAWH
A_A^A\_^
\$ UVWATAUAVAWH
!|$HHc
|$HD9l$X
HcD$LH;
HcD$LH;
H!|$ L
A_A^A]A\_^]
@SUVWATAVAWH
zu|D!t$ E3
A_A^A\_^][
@UATAUAVAWH
A_A^A]A\]
D82u&H
D8t$Ht
t$ WAVAWH
Hct$PH
seHcD$XH
fD9!u:A
fD93tSH
CfD93u
H3E H3E
x ATAVAWH
D8&t4H
D8d$Ht
A_A^A\
ATAVAWH
D8d$8t
@A_A^A\
t$ WATAUAVAW
A_A^A]A\_
VWATAVAWH
A_A^A\_^
t$ WATAUAVAWH
0A_A^A]A\_
VWATAVAWH
0A_A^A\_^
WATAUAVAWH
gfffffffH
D8L$Ht
A_A^A]A\_
x AUAVAWH
A_A^A]
@SUVWH
@SUVWH
@SUVWAVH
A^_^][
LcA<E3
UATAUAVAWH
A_A^A]A\]
WATAUAVAWH
A_A^A]A\_
f9.uVH
f9.u"H
tVf91tQH
x ATAVAWH
A_A^A\
@SUVWATAVAWH
3fD9 t
A_A^A\_^][
WATAUAVAWH
A_A^A]A\_
USVWATAUAVAWH
8UXt#D
XA_A^A]A\_^[]
` AUAVAWH
0A_A^A]
UVWATAUAVAWH
A_A^A]A\_^]
@UATAUAVAWH
A_A^A]A\]
@SUVWATAVAWH
PA_A^A\_^][
UVWATAUAVAWH
A_A^A]A\_^]
D8t$8t
@USVWH
x AUAVAWH
A_A^A]
|$ UATAUAVAWH
A_A^A]A\]
|$ UATAUAVAWH
A_A^A]A\]
UVWATAUAVAWH
A_A^A]A\_^]
UVWATAUAVAWH
A_A^A]A\_^]
x AUAVAWH
A_A^A]
H(H9J(u
permission denied
file exists
no such device
filename too long
device or resource busy
io error
directory not empty
invalid argument
no space on device
no such file or directory
function not supported
no lock available
not enough memory
resource unavailable try again
cross device link
operation canceled
too many files open
permission_denied
address_in_use
address_not_available
address_family_not_supported
connection_already_in_progress
bad_file_descriptor
connection_aborted
connection_refused
connection_reset
destination_address_required
bad_address
host_unreachable
operation_in_progress
interrupted
invalid_argument
already_connected
too_many_files_open
message_size
filename_too_long
network_down
network_reset
network_unreachable
no_buffer_space
no_protocol_option
not_connected
not_a_socket
operation_not_supported
protocol_not_supported
wrong_protocol_type
timed_out
operation_would_block
address family not supported
address in use
address not available
already connected
argument list too long
argument out of domain
bad address
bad file descriptor
bad message
broken pipe
connection aborted
connection already in progress
connection refused
connection reset
destination address required
executable format error
file too large
host unreachable
identifier removed
illegal byte sequence
inappropriate io control operation
invalid seek
is a directory
message size
network down
network reset
network unreachable
no buffer space
no child process
no link
no message available
no message
no protocol option
no stream resources
no such device or address
no such process
not a directory
not a socket
not a stream
not connected
not supported
operation in progress
operation not permitted
operation not supported
operation would block
owner dead
protocol error
protocol not supported
read only file system
resource deadlock would occur
result out of range
state not recoverable
stream timeout
text file busy
timed out
too many files open in system
too many links
too many symbolic link levels
value too large
wrong protocol type
bad allocation
0123456789abcdefghijklmnopqrstuvwxyz
0123456789abcdefghijklmnopqrstuvwxyz
0123456789abcdefABCDEF
Unknown exception
bad exception
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
CorExitProcess
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
(null)
`h````
xpxxxx
GetCurrentPackageId
UTF-16LE
UNICODE
_hypot
_nextafter
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__clrcall
__eabi
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
`h`hhh
xppwpp
MessageBoxW
GetActiveWindow
GetLastActivePopup
GetUserObjectInformationW
GetProcessWindowStation
CreateFile2
1#SNAN
1#QNAN
generic
unknown error
iostream
iostream stream error
system
string too long
invalid string position
kernel32
CreateProcessInternalW
ntdll.dll
NtClose
NtMapViewOfSection
NtSetInformationFile
RtlInitUnicodeString
NtSetInformationProcess
RtlAdjustPrivilege
NtCreateSection
NtOpenFile
NtWriteFile
RtlCreateProcessParametersEx
NtCreateProcessEx
NtCreateThreadEx
NtQueryInformationFile
NtQuerySystemInformation
NtSuspendProcess
NtResumeProcess
wcscpy
msvcrt.dll
wcscat
wcscmp
wcsncpy
wcslen
strlen
realloc
wcsstr
CloseHandle
kernel32.dll
CreateFileW
FreeLibrary
MoveFileW
GetFileSizeEx
GetWindowsDirectoryA
GetVolumeInformationA
GetTickCount
wsprintfW
user32.dll
wsprintfA
VirtualAlloc
ReadFile
VirtualFree
SetFilePointer
CreateDirectoryW
FindFirstFileW
FindNextFileW
FindClose
CopyFileW
WriteFile
GetSystemDirectoryW
ExitProcess
CreateProcessW
ShellExecuteW
shell32.dll
GetModuleFileNameW
GetShortPathNameW
GetEnvironmentVariableW
InternetOpenW
wininet.dll
InternetOpenUrlW
HttpQueryInfoA
InternetReadFile
InternetConnectW
HttpOpenRequestW
HttpSendRequestA
InternetCloseHandle
SHGetFolderPathW
SHGetFolderPathA
SHGetKnownFolderPath
PathIsURLW
shlwapi.dll
PathCombineW
PathFindFileNameW
RegDeleteKeyW
Advapi32.dll
RegOpenKeyExA
RegSetValueExA
RegCloseKey
OpenProcessToken
GetTokenInformation
AdjustTokenPrivileges
GetUserNameW
LookupPrivilegeValueA
CoUninitialize
ole32.dll
CoCreateInstance
CoInitialize
MessageBoxA
SeDebugPrivilege
ReflectiveLoader
bad locale name
ios_base::badbit set
ios_base::failbit set
ios_base::eofbit set
%08lX%04lX%lu
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
Services
bad cast
OLEAUT32.dll
GetThreadContext
GetTempFileNameW
GetFileSize
SetThreadContext
SetFilePointer
FreeLibrary
GetCurrentProcess
WaitForSingleObject
WriteFile
OpenProcess
GetSystemDirectoryW
LoadLibraryW
GetModuleFileNameW
CreateFileW
GetTempPathW
GetLastError
GetProcAddress
VirtualAllocEx
LoadLibraryA
GetModuleHandleA
lstrcatW
Wow64SetThreadContext
CloseHandle
WriteProcessMemory
ResumeThread
Wow64GetThreadContext
CreateThread
HeapAlloc
GetProcessHeap
CreateRemoteThread
CreateToolhelp32Snapshot
VirtualProtectEx
VirtualProtect
ExitProcess
CreateMutexA
HeapReAlloc
CreateFileA
FindFirstFileW
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
CompareFileTime
HeapFree
GetModuleHandleW
GetProcessTimes
GetFileAttributesA
TerminateProcess
ReadFile
lstrcatA
MultiByteToWideChar
CreateDirectoryA
CopyFileA
SetFileAttributesA
Process32FirstW
CreateFileMappingA
GetModuleFileNameA
Process32NextW
IsDebuggerPresent
FindNextFileW
DeleteFileW
ExpandEnvironmentStringsW
WideCharToMultiByte
GetStringTypeW
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetLocaleInfoEx
GetCPInfo
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetCommandLineW
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
InitializeCriticalSectionAndSpinCount
GetModuleHandleExW
HeapSize
IsValidCodePage
GetACP
GetOEMCP
SetLastError
GetCurrentThreadId
GetStdHandle
GetFileType
InitOnceExecuteOnce
GetStartupInfoW
SetFilePointerEx
FlushFileBuffers
GetConsoleCP
GetConsoleMode
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
QueryPerformanceCounter
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetUserDefaultLocaleName
LCMapStringEx
IsValidLocaleName
EnumSystemLocalesEx
LoadLibraryExW
ReadConsoleW
SetStdHandle
WriteConsoleW
OutputDebugStringW
LocalFree
KERNEL32.dll
.?AVbad_alloc@std@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
.?AV_Locimp@locale@std@@
Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.
.?AVtype_info@@
.?AVbad_exception@std@@
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AV_com_error@@
.?AV_Iostream_error_category@std@@
.?AV_System_error_category@std@@
.?AVerror_category@std@@
.?AV_Generic_error_category@std@@
.?AVsystem_error@std@@
.?AVbad_cast@std@@
.?AV?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@
.?AVexception@std@@
.?AVcodecvt_base@std@@
.?AV?$codecvt@_WDH@std@@
.?AV?$basic_istream@_WU?$char_traits@_W@std@@@std@@
.?AVios_base@std@@
.?AV?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@
!This program cannot be run in DOS mode.
*XRich
`.rdata
@.data
@.reloc
CE SPW
L$$_^3
QQSVWd
Genuu_
ineIuV
nteluM3
uPVWhQ^@
~pjCXf
j@j _W
QQSVWh
j"_f9y
HtHu4j
URPQQh0
;t$,v-
UQPXY]Y[
PP9E u
x$;5$-A
x&;5$-A
~';_t|%3
xy;5$-A
permission denied
file exists
no such device
filename too long
device or resource busy
io error
directory not empty
invalid argument
no space on device
no such file or directory
function not supported
no lock available
not enough memory
resource unavailable try again
cross device link
operation canceled
too many files open
permission_denied
address_in_use
address_not_available
address_family_not_supported
connection_already_in_progress
bad_file_descriptor
connection_aborted
connection_refused
connection_reset
destination_address_required
bad_address
host_unreachable
operation_in_progress
interrupted
invalid_argument
already_connected
too_many_files_open
message_size
filename_too_long
network_down
network_reset
network_unreachable
no_buffer_space
no_protocol_option
not_connected
not_a_socket
operation_not_supported
protocol_not_supported
wrong_protocol_type
timed_out
operation_would_block
address family not supported
address in use
address not available
already connected
argument list too long
argument out of domain
bad address
bad file descriptor
bad message
broken pipe
connection aborted
connection already in progress
connection refused
connection reset
destination address required
executable format error
file too large
host unreachable
identifier removed
illegal byte sequence
inappropriate io control operation
invalid seek
is a directory
message size
network down
network reset
network unreachable
no buffer space
no child process
no link
no message available
no message
no protocol option
no stream resources
no such device or address
no such process
not a directory
not a socket
not a stream
not connected
not supported
operation in progress
operation not permitted
operation not supported
operation would block
owner dead
protocol error
protocol not supported
read only file system
resource deadlock would occur
result out of range
state not recoverable
stream timeout
text file busy
timed out
too many files open in system
too many links
too many symbolic link levels
value too large
wrong protocol type
bad allocation
Unknown exception
CorExitProcess
GetCurrentPackageId
bad exception
MessageBoxW
GetActiveWindow
GetLastActivePopup
GetUserObjectInformationW
GetProcessWindowStation
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__clrcall
__eabi
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
generic
unknown error
iostream
iostream stream error
system
SeDebugPrivilege
firefox.exe
string too long
invalid string position
vector<T> too long
ReflectiveLoader
InternetOpenW
HttpQueryInfoA
InternetOpenUrlW
InternetReadFile
InternetCloseHandle
WININET.dll
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
ADVAPI32.dll
HeapAlloc
GetCurrentProcess
Process32First
WaitForSingleObject
GetProcessHeap
OpenProcess
Process32Next
CreateToolhelp32Snapshot
CloseHandle
CreateRemoteThread
VirtualProtectEx
VirtualAllocEx
WriteProcessMemory
EncodePointer
DecodePointer
GetCommandLineW
RaiseException
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
GetLastError
InterlockedDecrement
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
HeapSize
GetStdHandle
WriteFile
GetModuleFileNameW
HeapFree
SetLastError
InterlockedIncrement
GetCurrentThreadId
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
TerminateProcess
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapReAlloc
OutputDebugStringW
LoadLibraryW
WideCharToMultiByte
LCMapStringEx
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
CreateFileW
KERNEL32.dll
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
.?AVtype_info@@
.?AVbad_exception@std@@
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AV_Iostream_error_category@std@@
.?AV_System_error_category@std@@
.?AVerror_category@std@@
.?AV_Generic_error_category@std@@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><application xmlns="urn:schemas-microsoft-com:asm.v3"><windowsSettings><dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware></windowsSettings></application></assembly>
1,282W2d2t2
2 3+323?3Z3
354<4I4[4t4}4
7J92:O<Y<s=}=
0`1`2M3
8I9c9y9
:7:R:m:
;1;<;_;j;v;
>7>U>\>`>d>h>l>p>t>x>
>:?E?`?g?l?p?t?
0^0d0h0l0p0
2K2R2Z2
3F6g6r6x6
;!<(<,<0<4<8<<<@<D<
3<3^3t3
374A4H4[4
5$5.5>5N5^5g5w5
627:7M7X7]7o7z7
7Y8p8}8
9#9(94999X9
:8:>:~:
=K=c=m=
>&?<?B?T?
0!0&0}0
7 7,71777K7Y7e7}7
9=:I:O:U:[:
=(=3=Q=m=u=z=
=!>)>4>9>T>Y>x>
?/?8???H?O?f?|?
O0Z0`0
[0x0~0
1?1N1U1
5/666K6U6
7-9?9y9
9M:]:s:
;+;2;Y;
>X>^>j>
2'2-232;2A2G2O2U2[2c2l2s2{2
8#828<8b8
1'191K1]1o1
1C6d6k6
797Y7n7x7
8@9S9c9
0>1H1N1b1n1
333U3\3
8)8/848<8B8b8
8#9B9b9q9
T1X1\1h1l1p1t1x1
2$2,242<2D2L2T2\2d2l2t2|2
3$3,343<3D3L3T3\3d3l3t3|3
4$4,444<4D4L4T4\4d4l4t4|4
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6
? ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\?`?d?h?l?p?
$0,040<0D0L0T0\0d0l0t0|0
0\;`;d;h;|;
;8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<
= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\=`=d=h=l=p=t=x=|=
l0p0x0
1 1(1@1P1T1d1h1l1p1x1
2(282<2L2P2`2d2h2p2
3 30343D3H3L3T3l3|3
4 444<4P4X4l4t4|4
5 5@5`5
60686<6X6`6d6|6
7 7(70747<7P7p7
808<8X8x8
9$9,9p9
: :0:<:\:d:l:x:
080X0x0
489<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|9
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
;$;0;4;8;<;`;h;
> >$>(>,>8><>@>D>H>L>P>T>\>`>p>
?,?0?4?
.?AV?$ctype@_W@std@@
.?AVfailure@ios_base@std@@
.?AVruntime_error@std@@
.?AV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@
.?AV?$_Iosb@H@std@@
.?AV?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@
.?AV_Facet_base@std@@
.?AUctype_base@std@@
.?AV?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@
.?AVfacet@locale@std@@
.?AV?$basic_ios@_WU?$char_traits@_W@std@@@std@@
((((( H
h(((( H
H
mscoree.dll
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
LC_ALL
LC_COLLATE
LC_CTYPE
LC_MONETARY
LC_NUMERIC
LC_TIME
(null)
kernel32.dll
- floating point support not loaded
- not enough space for arguments
- not enough space for environment
- abort() has been called
- not enough space for thread data
- unexpected multithread lock error
- unexpected heap error
- unable to open console device
- not enough space for _onexit/atexit table
- pure virtual function call
- not enough space for stdio initialization
- not enough space for lowio initialization
- unable to initialize heap
- CRT not initialized
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
- not enough space for locale information
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
- inconsistent onexit begin-end variables
DOMAIN error
SING error
TLOSS error
runtime error
Runtime Error!
Program:
<program name unknown>
Microsoft Visual C++ Runtime Library
UTF-16LE
UNICODE
american
american english
american-english
australian
belgian
canadian
chinese
chinese-hongkong
chinese-simplified
chinese-singapore
chinese-traditional
dutch-belgian
english-american
english-aus
english-belize
english-can
english-caribbean
english-ire
english-jamaica
english-nz
english-south africa
english-trinidad y tobago
english-uk
english-us
english-usa
french-belgian
french-canadian
french-luxembourg
french-swiss
german-austrian
german-lichtenstein
german-luxembourg
german-swiss
irish-english
italian-swiss
norwegian
norwegian-bokmal
norwegian-nynorsk
portuguese-brazilian
spanish-argentina
spanish-bolivia
spanish-chile
spanish-colombia
spanish-costa rica
spanish-dominican republic
spanish-ecuador
spanish-el salvador
spanish-guatemala
spanish-honduras
spanish-mexican
spanish-modern
spanish-nicaragua
spanish-panama
spanish-paraguay
spanish-peru
spanish-puerto rico
spanish-uruguay
spanish-venezuela
swedish-finland
america
britain
england
great britain
holland
hong-kong
new-zealand
pr china
pr-china
puerto-rico
slovak
south africa
south korea
south-africa
south-korea
trinidad & tobago
united-kingdom
united-states
USER32.DLL
CONOUT$
s -k DcomLaunch -p -s LSM
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder
ProcessHacker.exe
procexp.exe
procexp64.exe
TOTALCMD.exe
x64dbg.exe
http://176.111.174.140/api/loader.bin
vmware.exe
vmware-vmx.exe
vboxservice.exe
vboxtray.exe
svchost.exe
Chrome
%SystemRoot%\system32\svchost.exe
Unknown
firefox.exe
explorer.exe
\MRT.exe
\Mozilla\Firefox\Profiles\
release
\prefs.js
user_pref("network.http.http2.enabled", false);
user_pref("network.http.http3.enable", false);
user_pref("network.http.version", 1);
user_pref("network.http.http4.enable", false);
user_pref("network.http.spdy.enabled", false);
user_pref("network.http.spdy.enabled.v3", false);
user_pref("network.http.spdy.enabled.v3-1", false);
Amscoree.dll
@R6002
- floating point support not loaded
- not enough space for arguments
- not enough space for environment
- abort() has been called
- not enough space for thread data
- unexpected multithread lock error
- unexpected heap error
- unable to open console device
- not enough space for _onexit/atexit table
- pure virtual function call
- not enough space for stdio initialization
- not enough space for lowio initialization
- unable to initialize heap
- CRT not initialized
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
- not enough space for locale information
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
- inconsistent onexit begin-end variables
DOMAIN error
SING error
TLOSS error
runtime error
Runtime Error!
Program:
<program name unknown>
Microsoft Visual C++ Runtime Library
dkernel32.dll
@ja-JP
USER32.DLL
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
((((( H
h(((( H
H
CONOUT$
NIKMOK
VS_VERSION_INFO
StringFileInfo
040004b0
CompanyName
Microsoft Corporation
FileDescription
System.exe
FileVersion
1.5.0.0
InternalName
System.exe
LegalCopyright
Copyright (C) 2025
OriginalFilename
System.exe
ProductName
System.exe
ProductVersion
1.5.0.0
VarFileInfo
Translation
Antivirus Signature
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.Androm.m!c
Elastic malicious (high confidence)
ClamAV Clean
CMC Clean
CAT-QuickHeal Backdoor.Androm
Skyhigh Artemis!Trojan
ALYac Trojan.Generic.36892069
Cylance Unsafe
Zillya Clean
Sangfor Backdoor.Win32.Androm.Vllf
CrowdStrike win/malicious_confidence_100% (D)
Alibaba Trojan:Win64/Nekark.7be4fea5
K7GW Trojan ( 005b776e1 )
K7AntiVirus Trojan ( 005b776e1 )
huorong Backdoor/Tinukebot.b
Baidu Clean
VirIT Clean
Paloalto generic.ml
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of Win64/Agent.EAQ
APEX Malicious
Avast Win32:MalwareX-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky Backdoor.Win32.Androm.vsub
BitDefender Trojan.Generic.36892069
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Trojan.Generic.36892069
Tencent Malware.Win32.Gencirc.11ca3ed5
Sophos Mal/Generic-S
F-Secure Trojan.TR/AD.Nekark.bnyag
DrWeb Trojan.Siggen29.57557
VIPRE Trojan.Generic.36892069
TrendMicro Trojan.Win64.AMADEY.YXEJWZ
McAfeeD ti!0FBAD12595C3
Trapmine malicious.moderate.ml.score
CTX exe.trojan.androm
Emsisoft Trojan.Generic.36892069 (B)
Ikarus Trojan.Win64.Agent
FireEye Generic.mg.b611b18150ff90f6
Jiangmin Clean
Webroot W32.Trojan.Gen
Varist Clean
Avira TR/AD.Nekark.bnyag
Fortinet W64/Agent.EAQ!tr
Antiy-AVL Trojan[Backdoor]/Win32.Androm
Kingsoft malware.kb.a.947
Gridinsoft Ransom.Win64.Wacatac.sa
Xcitium Malware@#22ml15uqhw2se
Arcabit Trojan.Generic.D232EDA5
SUPERAntiSpyware Clean
ZoneAlarm UDS:DangerousObject.Multi.Generic
Microsoft Trojan:Win32/Sabsik.FL.A!ml
Google Detected
AhnLab-V3 Trojan/Win.Tnaket.C5685982
Acronis Clean
McAfee Artemis!B611B18150FF
TACHYON Clean
VBA32 Clean
Malwarebytes Malware.AI.798652179
Panda Trj/Chgt.AD
Zoner Clean
TrendMicro-HouseCall Trojan.Win64.AMADEY.YXEJWZ
Rising Backdoor.Androm!8.113 (TFE:5:uGYVIXwGFbQ)
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Clean
GData Trojan.Generic.36892069
AVG Win32:MalwareX-gen [Trj]
DeepInstinct MALICIOUS
alibabacloud Backdoor:Win/Wacatac.B9nj
No IRMA results available.