Static task
static1
Behavioral task
behavioral1
Sample
a4cf9fb6fbfed3a7ec4ae3d05d72b437_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a4cf9fb6fbfed3a7ec4ae3d05d72b437_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a4cf9fb6fbfed3a7ec4ae3d05d72b437_JaffaCakes118
-
Size
909KB
-
MD5
a4cf9fb6fbfed3a7ec4ae3d05d72b437
-
SHA1
fcdbde723381cd22d88cf9355f0bc25d109a160e
-
SHA256
142425dba4c7d8e849cff20e9166944120eb18423241d3c632a0bb80f0088013
-
SHA512
ff17fc980b95b2e9ee303777b24e1127e11edac62e40e2eff321e2c980a2da01c3f01afa4c974ec58c7706d6d976a2578ba53a7e3d3f8afb85c7ec0cae8bee97
-
SSDEEP
12288:dOVGgAM+3DJrKtgXLDn73VM1sISD8BFzM19sRz3TQcwK/KtfZK1v9/QH:XgAp1K6Dh4usR3raxQv9I
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a4cf9fb6fbfed3a7ec4ae3d05d72b437_JaffaCakes118
Files
-
a4cf9fb6fbfed3a7ec4ae3d05d72b437_JaffaCakes118.exe windows:5 windows x86 arch:x86
87b436e2c7a812a5df742dc376d9165d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
esent
JetRetrieveTaggedColumnList
JetUpdate
JetGetVersion
JetGetTableColumnInfo
JetIndexRecordCount
JetMove@16
JetAttachDatabase2
JetOpenFileSectionInstance
JetBeginTransaction2
JetAddColumn
JetRestore
JetRegisterCallback
JetDeleteTable
JetOpenTempTable2
JetSetCurrentIndex2
JetDetachDatabase2
JetDetachDatabase
JetSetColumn@28
JetCompact
JetOSSnapshotPrepare
JetGetSecondaryIndexBookmark
JetCloseDatabase
JetGetDatabaseFileInfo
JetRetrieveColumn
JetIdle
JetTruncateLog
JetGetIndexInfo
JetDefragment
JetCreateIndex
JetGotoSecondaryIndexBookmark
ese
JetConvertDDL
JetOpenDatabase
JetSnapshotStart
JetBeginExternalBackup
JetOpenFile
JetCloseFile
JetResetSessionContext
JetRollback
JetSeek@12
JetGetAttachInfoInstance
JetGetLock
JetCloseTable@8
JetEndExternalBackupInstance2
JetBeginTransaction@4
JetOSSnapshotFreeze
JetIntersectIndexes
JetGetCurrentIndex
JetTerm2
JetDupSession
JetOSSnapshotThaw
JetResetTableSequential
JetBeginSession
JetRetrieveColumn@32
JetSetLS
JetSetSystemParameter
JetCreateTableColumnIndex
JetDupCursor
JetRestore2
JetBackup
JetRenameTable
JetBackupInstance
JetSetColumns
JetGetRecordPosition
JetGetColumnInfo
JetDBUtilities
JetAttachDatabase
msvcp60
??Ystd@@YAAAV?$complex@O@0@AAV10@ABV10@@Z
??1?$basic_ofstream@DU?$char_traits@D@std@@@std@@UAE@XZ
_Xbig
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
?real@?$_Complex_base@N@std@@QAENABN@Z
_Sinh
??_D?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEXXZ
??$?5GU?$char_traits@G@std@@@std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@PAG@Z
?_Doraise@runtime_error@std@@MBEXXZ
??$?YNN@std@@YAAAV?$complex@N@0@AAV10@ABV10@@Z
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?pubseekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@H@2@V32@H@Z
??_7?$basic_ios@GU?$char_traits@G@std@@@std@@6B@
?eq_int_type@?$char_traits@G@std@@SA_NABG0@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHIIPBGI@Z
?find@?$char_traits@G@std@@SAPBGPBGIABG@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAG@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAM@Z
?open@?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEXPBDF@Z
??_F?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
?eq@?$char_traits@D@std@@SA_NABD0@Z
?do_frac_digits@?$_Mpunct@D@std@@MBEHXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$codecvt@GDH@std@@QAE@ABV_Locinfo@1@I@Z
?tolower@?$ctype@G@std@@QBEPBGPAGPBG@Z
?infinity@?$numeric_limits@O@std@@SAOXZ
?_Init@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEXPBDIH@Z
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??$norm@M@std@@YAMABV?$complex@M@0@@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@ABV01@@Z
??$?KN@std@@YA?AV?$complex@N@0@ABV10@ABN@Z
?_Exp@?$_Ctr@N@std@@SAFPANNF@Z
?_Init@?$numpunct@D@std@@IAEXABV_Locinfo@2@@Z
??Hstd@@YA?AV?$complex@N@0@ABNABV10@@Z
?polar@std@@YA?AV?$complex@N@1@ABN0@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@IIABV?$allocator@G@1@@Z
??0?$numpunct@D@std@@QAE@ABV_Locinfo@1@I@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??$polar@O@std@@YA?AV?$complex@O@0@ABO@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@I@Z
??4?$basic_iostream@DU?$char_traits@D@std@@@std@@QAEAAV01@ABV01@@Z
??$exp@O@std@@YA?AV?$complex@O@0@ABV10@@Z
??0_Timevec@std@@QAE@ABV01@@Z
?do_toupper@?$ctype@D@std@@MBEDD@Z
sqlunirl
_CharUpper@4
_ReadConsoleInput_@16
_IsBadStringPtr_@8
_CreateDC_@16
_LookupPrivilegeName_@16
ConvertMultiSZNameToW
_ExtTextOut@32
_GetSystemDirectory_@8
_GetTextExtentPoint32@16
_GetFileVersionInfo_@16
_DialogBoxIndirectParam_@20
newWideCharFromMultiByte
_RemoveFontResource_@4
_SetComputerName_@4
_RegisterClassEx_@4
newMultiByteFromWideCharEx
_GetTempPath_@8
_EnumPropsEx_@12
_wvsprintf_@12
_OpenEvent_@12
_OpenDesktop_@16
_RegCreateKeyEx_@36
_QueryServiceLockStatus_@16
_SetUserObjectInformation_@16
_RegSaveKey_@12
_LoadCursorFromFile_@4
_LoadLibraryEx_@12
_TranslateAccelerator@12
_GetCurrentHwProfile_@4
_NDdeTrustedShareEnum_@24
_ObjectDeleteAuditAlarm_@12
_LoadAccelerators_@8
_GetFileSecurity_@20
_DrawText@20
_SetDlgItemText@12
_MoveFile@8
_DragQueryFile_@16
_OpenFileMapping_@12
_DefMDIChildProc_@16
_LoadImage_@24
_RegisterServiceCtrlHandler_@8
query
?GetVPathAuthorization@CMetaDataMgr@@QAEKPBG@Z
?PutMaxValue@CValueNormalizer@@QAEXKAAKW4VARENUM@@@Z
?GetVPathAccess@CMetaDataMgr@@QAEKPBG@Z
?GetWeight@CDbCmdTreeNode@@QBEJXZ
?IsValid@COccRestriction@@QBEHXZ
?TreeCount@CRestriction@@QBEKXZ
??0CAllocStorageVariant@@QAE@AAUtagPROPVARIANT@@AAVPMemoryAllocator@@@Z
?_FindOrAddAnchor@CDbSortNode@@AAEPAVCDbSortListAnchor@@XZ
?GetDWORDParam@CMachineAdmin@@QAEHPBGAAK@Z
??0CImpersonateRemoteAccess@@QAE@PAVCImpersonationTokenCache@@@Z
?_FindGroupListAnchor@CDbNestingNode@@AAEPAVCDbProjectListAnchor@@XZ
?ParseStringColumns@@YGPAVCDbColumns@@PBGPAUIColumnMapper@@KPAVPVariableSet@@PAV?$CDynArray@G@@@Z
?GetLCIDFromString@@YGKPAG@Z
??1CCatalogEnum@@QAE@XZ
?ChangeDirty@CPropStoreInfo@@AAEXH@Z
?GetOffset@CKeyDeComp@@QAEXAAUBitOffset@@@Z
BindIFilterFromStorage
?Remove@CWorkQueue@@QAEXPAVPWorkItem@@@Z
?IsValid@CNodeRestriction@@QBEHXZ
??0CDbSelectNode@@QAE@XZ
??1CPropertyStoreWids@@QAE@XZ
??0CDbNatLangRestriction@@QAE@PBGABVCDbColumnNode@@K@Z
?Init@CSdidLookupTable@@QAEHPAVCiStorage@@@Z
?AddCatalog@CCatState@@QAEXAAV?$XPtrST@G@@@Z
?SetScopeProperties@@YGXPAUICommand@@IPBQBGPBK11@Z
?AllocAndCopyWString@CDbCmdTreeNode@@SGPAGPBG@Z
??0CUnfilteredRestriction@@QAE@XZ
??1CNodeRestriction@@QAE@XZ
?GetOleDBErrorInfo@@YGJPAUIUnknown@@ABU_GUID@@KIPAUtagERRORINFO@@PAPAUIErrorInfo@@@Z
??0CDefColumnRegEntry@@QAE@XZ
?RemoveFirstChild@CDbCmdTreeNode@@IAEPAV1@XZ
?GetStringFromLCID@@YGPBGK@Z
?Read@CRegAccess@@QAEKPBGK@Z
?SetBOOL@CStorageVariant@@QAEXFI@Z
?Get@CWin32RegAccess@@QAEHPBGPAGIH@Z
?SetMappedCacheSize@CPropStoreManager@@QAEXKK@Z
??1CPropertyList@@UAE@XZ
?WritePrimaryProperty@CPropStoreManager@@QAEJKKABVCStorageVariant@@@Z
?SetCD@CCatState@@QAEXPBG@Z
?DoUpdates@CFilterDaemon@@QAEJXZ
?MakeLocalICommand@@YGJPAPAUIUnknown@@PAUICiCDocStore@@PAU1@@Z
?Add@CKeyArray@@QAEHHABVCKey@@@Z
??0CDbColumns@@QAE@I@Z
?ReInitializeIISScopes@CImpersonationTokenCache@@QAEXXZ
??1CFilterDaemon@@QAE@XZ
?EndTransaction@CPropStoreManager@@QAEXKHKK@Z
??0CPropertyValueParser@@QAE@AAVCQueryScanner@@GK@Z
?SetProperty@CFullPropSpec@@QAEXK@Z
?Read@CDynStream@@QAEKPAXK@Z
??0CCatState@@QAE@XZ
?_dwLastCheckMoment@CGlobalPropFileRefresher@@0KA
??1CPropertyRestriction@@QAE@XZ
?Accept@CQueryScanner@@QAEXXZ
_StopFWCiSvcWork@16
??0CWorkQueue@@QAE@IW4WorkQueueType@0@@Z
?ContainsDrive@CDriveInfo@@SGHPBG@Z
?GetFileSystem@CDriveInfo@@QAE?AW4eFileSystem@1@H@Z
?QueryCatalogAdmin@CCatalogEnum@@QAEPAVCCatalogAdmin@@XZ
?Lookup@CPropStoreInfo@@AAEIK@Z
?SystemExceptionTranslator@@YAXIPAU_EXCEPTION_POINTERS@@@Z
?GetWString@CMemDeSerStream@@UAEPAGXZ
??1CPhraseRestriction@@QAE@XZ
??0CEventLog@@QAE@PBG0@Z
?wcsipattern@@YGPAGPAGPBG@Z
EndCacheTransaction
??0CException@@QAE@XZ
?CheckError@CLocalGlobalPropertyList@@QAEJAAKPAPAG@Z
?CiGetPassword@@YGHPBG0PAG@Z
?Remove@CColumns@@QAEXI@Z
??0CRcovStrmMDTrans@@QAE@AAVPRcovStorageObj@@W4MDOp@0@K@Z
?Next@CCatalogEnum@@QAEHXZ
?DoFailTest@@YGXJ@Z
?OpenRecordForWrites@CPropStoreManager@@QAEPAVCCompositePropRecordForWrites@@KPAE@Z
?AddMachine@CCatState@@QAEXAAV?$XPtrST@G@@@Z
??0CAllocStorageVariant@@QAE@PBGAAVPMemoryAllocator@@@Z
??0CLocalGlobalPropertyList@@QAE@K@Z
??1CFullPropSpec@@QAE@XZ
??0CDriveInfo@@QAE@PBGK@Z
??0CPropertyStoreWids@@QAE@AAVCPropStoreManager@@@Z
?AppendListElement@CDbListAnchor@@IAEHGABUtagDBID@@@Z
??1CImpersonationTokenCache@@QAE@XZ
?StrLen@CKey@@QBEIXZ
?Write@CRcovStrmTrans@@IAEXPBXK@Z
InitializeCIISAPIPerformanceData
?GetFloat@CMemDeSerStream@@UAEMXZ
?GetVolumeName@CDriveInfo@@QAEPBGH@Z
?ReadProperty@CPropStoreManager@@QAEHAAVCCompositePropRecord@@KAAUtagPROPVARIANT@@@Z
??1CEventLog@@QAE@XZ
??0CDbColId@@QAE@ABU_GUID@@PBG@Z
?Size@CDbQueryResults@@QAEKXZ
??1CRegChangeEvent@@QAE@XZ
?SetProperty@CDbPropBaseRestriction@@QAEHABUtagDBID@@@Z
?Shrink@CDynStream@@QAEXAAVPStorage@@K@Z
?SetRunningAsSystem@CImpersonateSystem@@SGXXZ
?GetCY@CAllocStorageVariant@@QBE?ATtagCY@@I@Z
?DisableVPathNotify@CMetaDataMgr@@QAEXXZ
??1CPidLookupTable@@QAE@XZ
?UnMarshall@CDbProperties@@QAEHAAVPDeSerStream@@@Z
??1CScopeEnum@@QAE@XZ
?Flush@CDynStream@@QAEXXZ
?GetSectorSize@CDriveInfo@@QAEKXZ
?NextWorkId@CPropertyStoreWids@@QAEKXZ
dbghelp
SymGetTypeFromName
SymGetSearchPath
MiniDumpWriteDump
SymGetSymFromAddr64
SymEnumerateModules64
ImagehlpApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
SymLoadModule
SearchTreeForFile
SymMatchFileName
MiniDumpReadDumpStream
SymLoadModuleEx
EnumerateLoadedModules64
SymSetContext
MapDebugInformation
SymInitialize
SymUnloadModule64
SymEnumSym
ImagehlpApiVersionEx
SymGetModuleInfoW
SymGetLinePrev
EnumerateLoadedModules
SymFromAddr
SymMatchString
SymGetLineNext64
SymRegisterCallback64
SymEnumSourceFiles
SymFromName
SymGetModuleBase64
SymGetLineNext
SymGetModuleBase
WinDbgExtensionDllInit
SymGetOptions
SymEnumerateSymbolsW
vc7fpo
dbghelp
DbgHelpCreateUserDump
SymCleanup
DbgHelpCreateUserDumpW
GetTimestampForLoadedLibrary
opengl32
glGetMapdv
glLoadMatrixf
glPushAttrib
glLogicOp
glPopAttrib
glColor3iv
glRasterPos4iv
glIndexd
glTexCoord1fv
glIndexi
glTexCoord4fv
glRasterPos3i
glColor3f
glFogi
glColor4us
glBegin
wglSetLayerPaletteEntries
glEdgeFlag
glColor3dv
glVertex3sv
glEvalCoord2f
glTexCoord1sv
glColor3usv
glVertex3fv
glListBase
glGetTexEnviv
glDisableClientState
glTexEnvi
glBindTexture
glIndexub
glEvalPoint1
glVertex3iv
glTexSubImage2D
glIndexPointer
wglGetLayerPaletteEntries
glDisable
glSelectBuffer
mscms
CreateProfileFromLogColorSpaceW
GetNamedProfileInfo
UnregisterCMMW
ConvertColorNameToIndex
GetPS2ColorRenderingDictionary
UninstallColorProfileW
AssociateColorProfileWithDeviceA
GetColorDirectoryA
ConvertIndexToColorName
GetColorProfileElementTag
UninstallColorProfileA
GetColorProfileFromHandle
OpenColorProfileW
GetPS2ColorRenderingIntent
SetColorProfileElementSize
InternalSetDeviceConfig
CheckBitmapBits
EnumColorProfilesA
InternalGetDeviceConfig
SelectCMM
RegisterCMMA
SetStandardColorSpaceProfileA
InstallColorProfileW
UnregisterCMMA
OpenColorProfileA
GetCMMInfo
CreateColorTransformW
GetCountColorProfileElements
InternalGetPS2CSAFromLCS
shlwapi
PathIsPrefixW
UrlGetPartA
UrlCompareW
PathFindFileNameA
PathCanonicalizeA
PathCreateFromUrlA
PathGetDriveNumberW
PathIsContentTypeA
PathIsRootW
PathCompactPathW
UrlIsNoHistoryA
StrFormatByteSize64A
StrCSpnIW
SHDeleteEmptyKeyA
PathFindSuffixArrayW
AssocIsDangerous
StrIsIntlEqualW
IntlStrEqWorkerW
wnsprintfA
PathSkipRootW
PathStripToRootW
PathUnExpandEnvStringsA
SHAutoComplete
SHGetViewStatePropertyBag
StrRetToBufA
PathSetDlgItemPathA
PathUnquoteSpacesA
SHRegWriteUSValueW
PathRemoveFileSpecA
PathIsUNCW
PathAddExtensionA
SHOpenRegStreamW
SHOpenRegStream2W
SHIsLowMemoryMachine
SHRegQueryInfoUSKeyA
StrStrIA
SHOpenRegStream2A
PathIsSameRootW
StrToIntExW
SHRegEnumUSValueW
msvcr71
_wchdir
_stat
_yn
ceil
_ungetwch
_beep
_adj_fdiv_m32
_execlp
_adj_fprem1
iswprint
_itoa
putwc
_rmdir
__set_buffer_overrun_handler
_wrmdir
_adj_fdivr_m64
_adj_fdiv_r
fprintf
difftime
??0bad_cast@@QAE@PBD@Z
_execve
_CIcos
_wexecve
??4bad_typeid@@QAEAAV0@ABV0@@Z
_mbscspn
_snscanf
_mbsninc
??_Fbad_typeid@@QAEXXZ
_wfdopen
_fpieee_flt
isdigit
_safe_fprem1
_chkesp
kernel32
GetTimeFormatA
GetLongPathNameA
EnumSystemLocalesW
ReadConsoleInputW
WinExec
ReadConsoleInputExW
GetPrivateProfileStructA
CreateHardLinkA
EnumDateFormatsW
Beep
GetPrivateProfileStringW
ClearCommError
GetNumaNodeProcessorMask
WritePrivateProfileStringA
InterlockedExchange
DeleteTimerQueueTimer
SetHandleCount
EncodeSystemPointer
GetComPlusPackageInstallStatus
SetVolumeLabelW
RaiseException
GetConsoleNlsMode
QueryDosDeviceA
SetConsoleMode
WriteConsoleOutputCharacterW
CreateActCtxA
QueueUserAPC
SetStdHandle
SetConsoleMenuClose
GetOEMCP
FindFirstFileW
ReleaseMutex
GetConsoleCommandHistoryLengthA
GetFileSize
EnumLanguageGroupLocalesA
RtlZeroMemory
SetConsoleDisplayMode
GetLastError
Process32FirstW
SetFilePointerEx
lstrcpy
SetConsoleScreenBufferSize
ReadConsoleOutputCharacterW
HeapLock
IsSystemResumeAutomatic
SetLocaleInfoA
GetFullPathNameA
GetPrivateProfileStructW
FileTimeToLocalFileTime
RtlFillMemory
GetHandleContext
GetExpandedNameA
LZStart
GetConsoleFontSize
SetThreadIdealProcessor
EnumCalendarInfoA
GetComputerNameA
GetTickCount
GetWindowsDirectoryA
EnumResourceTypesW
NlsGetCacheUpdateCount
UTUnRegister
GetConsoleCommandHistoryLengthW
GetFileType
SetCommConfig
BeginUpdateResourceW
SetConsoleCursorPosition
CreateEventW
FillConsoleOutputAttribute
GetDllDirectoryA
VirtualAlloc
advapi32
WmiMofEnumerateResourcesW
RegCreateKeyW
GetFileSecurityW
SetSecurityInfoExW
AddAccessAllowedObjectAce
UpdateTraceW
LsaOpenSecret
LsaSetForestTrustInformation
RegSetValueExA
SystemFunction022
SetServiceObjectSecurity
MakeSelfRelativeSD
MD4Final
QueryServiceConfig2A
LsaQuerySecret
CryptGetDefaultProviderA
UnregisterIdleTask
SetNamedSecurityInfoW
GetTrusteeNameW
QueryUsersOnEncryptedFile
RegFlushKey
GetSecurityInfoExW
SystemFunction032
ChangeServiceConfig2A
ConvertSecurityDescriptorToStringSecurityDescriptorW
RegRestoreKeyW
InitializeSecurityDescriptor
RegQueryInfoKeyW
SaferiRecordEventLogEntry
WmiNotificationRegistrationW
ProcessTrace
CryptSetProvParam
FlushTraceW
LsaRemovePrivilegesFromAccount
LsaSetTrustedDomainInformation
LookupPrivilegeNameA
OpenEncryptedFileRawW
msvcrt40
acos
strxfrm
_endthreadex
_CIasin
strncpy
__lconv_init
ldiv
?set_unexpected@@YAP6AXXZP6AXXZ@Z
??_8fstream@@7Bostream@@@
?cin@@3Vistream_withassign@@A
islower
?fd@ifstream@@QBEHXZ
_mbsspn
__threadhandle
getenv
_EH_prolog
__initenv
ferror
?tie@ios@@QAEPAVostream@@PAV2@@Z
_winmajor
??_8stdiostream@@7Bistream@@@
_mbsicmp
_ismbslead
?rdbuf@strstream@@QBEPAVstrstreambuf@@XZ
?underflow@strstreambuf@@UAEHXZ
_wcsupr
isprint
_wcsset
atan2
_wfdopen
vprintf
_getmaxstdio
??0filebuf@@QAE@XZ
_wremove
_pgmptr
??4iostream@@IAEAAV0@AAV0@@Z
_safe_fdivr
_chdir
_makepath
??_Gofstream@@UAEPAXI@Z
untfs
??1NTFS_BITMAP@@UAE@XZ
?IsDosName@NTFS_SA@@SGEPBU_FILE_NAME@@@Z
?Initialize@NTFS_BOOT_FILE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
?ReadSet@NTFS_FRS_STRUCTURE@@QAEEPAVTLINK@@@Z
?Read@NTFS_ATTRIBUTE@@QAEEPAXVBIG_INT@@KPAK@Z
??0NTFS_CLUSTER_RUN@@QAE@XZ
??0NTFS_BAD_CLUSTER_FILE@@QAE@XZ
?AddFileNameAttribute@NTFS_FILE_RECORD_SEGMENT@@QAEEPAU_FILE_NAME@@@Z
?SetVolumeFlag@NTFS_SA@@QAEEGPAE@Z
?Relocate@NTFS_CLUSTER_RUN@@QAEXVBIG_INT@@@Z
??1NTFS_FILE_RECORD_SEGMENT@@UAE@XZ
?Write@NTFS_FILE_RECORD_SEGMENT@@UAEEXZ
?Initialize@NTFS_MFT_INFO@@QAEEXZ
??1NTFS_ATTRIBUTE_LIST@@UAE@XZ
Chkdsk
?Initialize@NTFS_BITMAP@@QAEEVBIG_INT@@EPAVLOG_IO_DP_DRIVE@@K@Z
?GetNextAttributeListEntry@NTFS_ATTRIBUTE_LIST@@QBEPBU_ATTRIBUTE_LIST_ENTRY@@PBU2@@Z
?Create@NTFS_FILE_RECORD_SEGMENT@@QAEEPBU_STANDARD_INFORMATION@@G@Z
?Initialize@NTFS_FILE_RECORD_SEGMENT@@QAEEXZ
?MakeNonresident@NTFS_ATTRIBUTE@@UAEEPAVNTFS_BITMAP@@@Z
?QueryAttribute@NTFS_FILE_RECORD_SEGMENT@@QAEEPAVNTFS_ATTRIBUTE@@PAEKPBVWSTRING@@@Z
?Read@NTFS_MFT_FILE@@UAEEXZ
??1NTFS_CLUSTER_RUN@@UAE@XZ
Extend
?Initialize@NTFS_CLUSTER_RUN@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@VBIG_INT@@KK@Z
?QueryDefaultClustersPerIndexBuffer@NTFS_SA@@SGKPBVDP_DRIVE@@K@Z
??0NTFS_UPCASE_TABLE@@QAE@XZ
Sections
.text Size: 593KB - Virtual size: 592KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 210KB - Virtual size: 209KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 105KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE