2026-07-15_1206136bea617277787a04b49d03a9ea_akira_amadey_avoslocker_coinminer_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_lynx_medusalocker_njrat_redline-stealer_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-15_1206136bea617277787a04b49d03a9ea_akira_amadey_avoslocker_coinminer_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_lynx_medusalocker_njrat_redline-stealer_revil_smoke-loader
Size 28.5MB
Sample260716-aps1yahv3k
SHA256 42f7748542836c97b10d8fd50ad668a514f2e4325848d3eab14d6d4a13db393b
MD5 1206136bea617277787a04b49d03a9ea
SHA1 30b782e708a62783c732799926a2d3739c4e1d7d
SHA512 94476dce6ba852d8fbde61f58d2ddc913c4dd5e3119cc21b17a3709eac164270b1953b4a6ba46e69480e24933199cd594af4f7fc8bb9b6cc9709b77c948ce754
SSDEEP 393216:qc0+/PMfscnpxMQvHBJQ9tZO5IBuJsv6tWKFdu9C9igCJsv6tWKFdu9CFOkJsv6R:Vqscn/MQ/7QYIB1gKB
TLSH
T1DA67BF527A478072D562427484769B7FCA35BD214B2245CBA39C3B2D4E722E17F3BB0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-15_1206136bea617277787a04b49d03a9ea_akira_amadey_avoslocker_coinminer_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_lynx_medusalocker_njrat_redline-stealer_revil_smoke-loader

.exe 28.5MB

2026-07-15_1206136bea617277787a04b49d03a9ea_akira_amadey_avoslocker_coinminer_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_lynx_medusalocker_njrat_redline-stealer_revil_smoke-loader

IMPHASH 3458a8ef681e7d7169894333f4108cf0
SHA256 42f7748542836c97b10d8fd50ad668a514f2e4325848d3eab14d6d4a13db393b
MD5 1206136bea617277787a04b49d03a9ea
SHA1 30b782e708a62783c732799926a2d3739c4e1d7d
SHA512 94476dce6ba852d8fbde61f58d2ddc913c4dd5e3119cc21b17a3709eac164270b1953b4a6ba46e69480e24933199cd594af4f7fc8bb9b6cc9709b77c948ce754
SSDEEP 393216:qc0+/PMfscnpxMQvHBJQ9tZO5IBuJsv6tWKFdu9C9igCJsv6tWKFdu9CFOkJsv6R:Vqscn/MQ/7QYIB1gKB
TLSH
T1DA67BF527A478072D562427484769B7FCA35BD214B2245CBA39C3B2D4E722E17F3BB0B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

f3:6e:b9:69:d8:c5:be:16:75:63:7c:75:a7:7a:75:ec:d7:e7:b1:29:0a:7c:b8:06:c3:68:07:f9:88:15:73:e4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=NinjaRMM\, LLC,O=NinjaRMM\, LLC,ST=California,C=US

Chains

Mar 8, 2024

CN=NinjaRMM\, LLC,O=NinjaRMM\, LLC,ST=California,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=NinjaRMM\, LLC,O=NinjaRMM\, LLC,ST=California,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

a6:39:54:52:0b:95:b1:9c:59:8b:85:f3:21:21:00:a3:f0:12:89:99

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=NinjaRMM\, LLC,O=NinjaRMM\, LLC,ST=California,C=US

Chains

Mar 8, 2024

CN=NinjaRMM\, LLC,O=NinjaRMM\, LLC,ST=California,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=NinjaRMM\, LLC,O=NinjaRMM\, LLC,ST=California,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=NinjaRMM\, LLC,O=NinjaRMM\, LLC,ST=California,C=US

Serial Number

82:31:89:63:f2:be:45:bf:7c:49:a4:90:be:f5:68:ed

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2021 - Oct 10, 2024

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

9743608

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\BuildAgent\work\aac9931d38d89885\build_root\x86-windows-release-static\app\win-patcher\NinjaRMMAgentPatcher.pdb

dbghelp

SymInitialize SymGetOptions SymSetOptions SymFromAddr SymGetModuleBase64 StackWalk64 SymFunctionTableAccess64

shlwapi

PathQuoteSpacesW PathStripPathW PathFileExistsA PathFileExistsW PathRemoveExtensionW StrStrW SHDeleteValueW PathRemoveFileSpecW SHDeleteKeyW PathFindFileNameW

user32

GetProcessWindowStation GetUserObjectInformationW PostMessageW EnumWindows GetWindowThreadProcessId PeekMessageW PostThreadMessageW DispatchMessageW TranslateMessage wsprintfW DefWindowProcW RegisterClassW CreateWindowExW DestroyWindow GetQueueStatus MsgWaitForMultipleObjectsEx SetTimer KillTimer GetWindowLongW SetWindowLongW SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx CharNextExA MessageBoxW UnregisterClassW UnregisterDeviceNotification RegisterDeviceNotificationW

winhttp

WinHttpSendRequest WinHttpReceiveResponse WinHttpOpenRequest WinHttpConnect WinHttpCloseHandle WinHttpCrackUrl WinHttpQueryHeaders WinHttpOpen

kernel32

lstrlenW GetFileAttributesExW GetTempFileNameW GetPrivateProfileStringW WritePrivateProfileStringW WritePrivateProfileSectionW CopyFileW CreateSemaphoreW GetVolumeInformationW SetFileAttributesW GetCurrentThreadId GetFileTime SetThreadExecutionState VirtualAlloc VirtualFree SleepEx WaitForMultipleObjects CreateIoCompletionPort GetQueuedCompletionStatus CancelIoEx InitializeCriticalSectionAndSpinCount TlsSetValue GetModuleHandleA GetSystemTime SystemTimeToFileTime InitOnceExecuteOnce RemoveDirectoryW QueryPerformanceCounter QueryPerformanceFrequency GetTickCount64 VirtualQuery LoadLibraryExW Module32FirstW Module32NextW GetCurrentThread InitializeConditionVariable WakeConditionVariable SleepConditionVariableCS GetThreadId LockFileEx SetEndOfFile UnlockFileEx GetStdHandle GetFileType SetUnhandledExceptionFilter GetExitCodeThread GetFileSizeEx SetFilePointerEx WriteFile FindFirstFileExW LoadLibraryW SetNamedPipeHandleState TransactNamedPipe CreateNamedPipeW WaitNamedPipeW OutputDebugStringW GetLocalTime TryEnterCriticalSection EnumSystemLocalesW TlsGetValue ReleaseSemaphore DuplicateHandle IsValidLocale GetConsoleOutputCP GetCommandLineA ExitProcess SetStdHandle SetConsoleCtrlHandler FreeLibraryAndExitThread QueryDosDeviceW SystemTimeToTzSpecificLocalTime RtlUnwind InterlockedPushEntrySList OutputDebugStringA IsDebuggerPresent UnhandledExceptionFilter InitializeSListHead GetCPInfo LCMapStringEx EncodePointer GetLocaleInfoEx CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork GetLogicalDrives FindVolumeClose FindNextVolumeW FindFirstVolumeW GetVersion VerifyVersionInfoW VerSetConditionMask FindResourceW SizeofResource LockResource LoadResource FindResourceExW GetConsoleWindow TlsFree TlsAlloc LeaveCriticalSection EnterCriticalSection PostQueuedCompletionStatus HeapSize HeapDestroy HeapReAlloc SetLastError GetModuleFileNameA SetFileAttributesA GetFileAttributesA SetEnvironmentVariableW WaitForSingleObjectEx GetProcessHeap HeapFree HeapAlloc Process32NextW Process32FirstW CreateToolhelp32Snapshot LoadLibraryExA GetProcAddress GetModuleHandleW Wow64RevertWow64FsRedirection Wow64DisableWow64FsRedirection GetComputerNameExW GetCurrentProcessId GetCurrentProcess DeleteCriticalSection InitializeCriticalSectionEx PeekNamedPipe CreatePipe RaiseException SetHandleInformation DecodePointer ReadFile GetFileSize GetDiskFreeSpaceExW CreateFileW RtlCaptureStackBackTrace MoveFileExA CopyFileA GetUserDefaultLCID LCMapStringW MoveFileExW QueryFullProcessImageNameW LoadLibraryA FreeLibrary GetTickCount OpenProcess GetProcessTimes CompareFileTime lstrcatW CreateProcessW CreateMutexW ReleaseMutex GetCommandLineW MoveFileA lstrcmpiW GetModuleFileNameW CreateProcessA TerminateThread CreateThread GetExitCodeProcess TerminateProcess GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateDirectoryW GetSystemTimeAsFileTime CloseHandle WaitForSingleObject Sleep ResetEvent SetEvent HeapCreate CreateEventW CreateEventA LocalFree WideCharToMultiByte FormatMessageW FormatMessageA GetLastError GetACP InitializeCriticalSection Thread32Next Thread32First FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize SetFileInformationByHandle GetStringTypeW GetWindowsDirectoryA ExpandEnvironmentStringsA GetVersionExA GetCurrentProcessorNumber CreateMutexA GetVolumeNameForVolumeMountPointW GetVolumePathNameW CompareStringW GetUserPreferredUILanguages GetCurrencyFormatW GetLocaleInfoW GetTimeFormatW GetDateFormatW GetUserGeoID GetGeoInfoW GetTimeZoneInformation GetStartupInfoW UnmapViewOfFile MapViewOfFile CreateFileMappingW GetDriveTypeW RegisterWaitForSingleObject UnregisterWaitEx WriteFileEx ReadFileEx SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetFileInformationByHandleEx TzSpecificLocalTimeToSystemTime MoveFileW SetErrorMode GetTempPathW GetLongPathNameW IsProcessorFeaturePresent GetThreadPriority SetThreadPriority SwitchToThread GetNativeSystemInfo CompareStringEx GetOverlappedResult ConnectNamedPipe GlobalFree DisconnectNamedPipe GetProcessId ConvertThreadToFiber ConvertFiberToThread GetModuleHandleExW CreateFiber DeleteFiber SwitchToFiber ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode GetEnvironmentVariableA GetSystemDirectoryW GetLogicalProcessorInformation ResumeThread OpenEventA IsDBCSLeadByteEx IsValidCodePage SleepConditionVariableSRW WakeAllConditionVariable AreFileApisANSI CopyFileExW CreateDirectoryExW GetWindowsDirectoryW SetFileTime GetFullPathNameW GetOEMCP MultiByteToWideChar FileTimeToSystemTime GetSystemInfo GlobalMemoryStatusEx DeviceIoControl GetSystemTimes LocalAlloc GetVolumePathNamesForVolumeNameW UnlockFile HeapCompact DeleteFileA CreateFileA FlushViewOfFile GetDiskFreeSpaceA GetTempPathA HeapValidate GetFullPathNameA LockFile GetDiskFreeSpaceW ExitThread GetFileInformationByHandle FlushFileBuffers GetCurrentDirectoryW GetEnvironmentVariableW WriteConsoleW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock

iphlpapi

ConvertInterfaceIndexToLuid ConvertInterfaceLuidToGuid ConvertInterfaceNameToLuidW ConvertInterfaceLuidToIndex ConvertInterfaceLuidToNameW GetAdaptersAddresses GetAdaptersInfo GetIfTable

netapi32

DsGetDcNameW NetShareGetInfo NetShareEnum NetApiBufferFree NetWkstaGetInfo NetShareAdd

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock GetUserProfileDirectoryW

wtsapi32

WTSEnumerateSessionsW WTSQuerySessionInformationW WTSFreeMemory WTSSendMessageW WTSQueryUserToken

bcrypt

BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptGenRandom

advapi32

RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW CreateProcessAsUserW OpenProcessToken GetSecurityInfo RegEnumKeyExA RegQueryValueExA RegOpenKeyExA BuildTrusteeWithSidW RegisterEventSourceW MapGenericMask DuplicateToken AccessCheck GetSidSubAuthorityCount SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAce RegNotifyChangeKeyValue CloseServiceHandle DeleteService OpenSCManagerW OpenServiceW ReportEventW GetEffectiveRightsFromAclW CryptGetUserKey QueryServiceConfigW CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW BuildExplicitAccessWithNameW BuildSecurityDescriptorW RegGetValueA SystemFunction036 ConvertSecurityDescriptorToStringSecurityDescriptorW ConvertStringSecurityDescriptorToSecurityDescriptorW RegSetKeySecurity RegGetKeySecurity RegFlushKey QueryServiceStatus CreateServiceW LsaNtStatusToWinError LsaRemoveAccountRights LsaAddAccountRights LsaOpenPolicy LsaClose LogonUserW LookupAccountNameW IsValidSid InitializeSid InitializeAcl GetSidSubAuthority GetSidLengthRequired GetLengthSid GetAclInformation GetAce CopySid AddAce RegDeleteTreeW RegRenameKey RegEnumValueW RegCreateKeyExW ConvertSidToStringSidW RegDeleteValueW RegDeleteKeyW FreeSid AllocateAndInitializeSid EnumServicesStatusExW LookupPrivilegeNameA LookupAccountSidW GetTokenInformation RegSetValueExW SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW RevertToSelf ImpersonateLoggedOnUser DuplicateTokenEx NotifyServiceStatusChangeA StartServiceW QueryServiceConfig2W QueryServiceConfigA OpenServiceA EnumDependentServicesW ControlService ChangeServiceConfigA QueryServiceStatusEx DeregisterEventSource

activeds

ord3 ord15

gpedit

DeleteGPOLink CreateGPOLink

msi

ord141 ord6 ord32 ord246 ord160 ord92 ord118 ord8 ord159 ord248

rstrtmgr

RmStartSession RmGetList RmRegisterResources

ole32

StringFromGUID2 CoUninitialize CoSetProxyBlanket CLSIDFromString CoCreateGuid CoInitialize CoTaskMemFree CoCreateInstance CoInitializeEx

ws2_32

WSAGetOverlappedResult WSASocketA WSAWaitForMultipleEvents inet_pton socket recv recvfrom WSAResetEvent getnameinfo WSACloseEvent inet_ntop freeaddrinfo getaddrinfo WSASocketW WSASend WSARecv WSAAccept WSAEventSelect WSACreateEvent WSAEnumNetworkEvents WSASetLastError send setsockopt select ntohs WSAStartup WSACleanup gethostname WSAGetLastError __WSAFDIsSet accept bind closesocket WSAConnect WSAHtonl WSANtohl WSANtohs WSARecvFrom WSASendTo WSAAsyncSelect connect WSAIoctl ioctlsocket getpeername getsockname ntohl htonl htons sendto listen getsockopt

shell32

SHGetKnownFolderPath SHGetFolderPathW

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreW CryptDecodeObjectEx CertOpenStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertDuplicateCertificateContext CertGetCertificateContextProperty CertCreateCertificateContext CertAddCertificateContextToStore

oleaut32

SafeArrayGetUBound SafeArrayGetLBound SafeArrayAccessData SafeArrayGetVartype SysAllocString VariantClear SafeArrayCopy SafeArrayUnlock SafeArrayLock SafeArrayRedim SafeArrayCreate VarBstrCat SysAllocStringLen GetErrorInfo SafeArrayGetElement SafeArrayUnaccessData SysStringLen VariantInit SysFreeString SafeArrayDestroy

psapi

GetModuleFileNameExW GetProcessMemoryInfo QueryWorkingSet GetProcessImageFileNameW

winmm

timeSetEvent timeKillEvent

mpr

WNetGetUniversalNameW

??4SvcLibWinUtils@@QAEAAV0@$$QAV0@@Z ??4SvcLibWinUtils@@QAEAAV0@ABV0@@Z ?CalcUsagePct@SvcLibWinUtils@@SAMABUSCpu@LiveTaskManagerQt@@AAU23@@Z ?FILETIME_to_QDateTime@SvcLibWinUtils@@SA?AVQDateTime@@_K@Z ?GetShortcutParams@SvcLibWinUtils@@SA_NAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@1@Z ?ParseService@SvcLibWinUtils@@SA?AUSService@LiveTaskManagerQt@@ABU_ENUM_SERVICE_STATUS_PROCESSW@@ABV?$RAIIWrapper@USCHandleTraits@Common@NinjaRMM@@@Common@NinjaRMM@@@Z ?SendCustomMessage@SvcLibWinUtils@@SA_NABVQString@@V2@_NHAB_N@Z ?SendRebootMessage@SvcLibWinUtils@@SA_NABVQString@@V2@_NH@Z ?calc_process_memory@SvcLibWinUtils@@SAKPAXAAK@Z ?checkIfUsersLoggedIn@SvcLibWinUtils@@SA_NXZ ?createUserProcess@SvcLibWinUtils@@SA_NKPA_WPAU_STARTUPINFOW@@PAU_PROCESS_INFORMATION@@@Z ?createUserProcessAndWait@SvcLibWinUtils@@SA_NKPA_WPAU_STARTUPINFOW@@PAU_PROCESS_INFORMATION@@AAKK@Z ?getActiveUserSessionToken@SvcLibWinUtils@@SA_NPAPAXAAK@Z ?getAllSid@SvcLibWinUtils@@SA_NAAV?$vector@U_WTS_SESSION_INFOW@@V?$allocator@U_WTS_SESSION_INFOW@@@std@@@std@@@Z ?getDomainRole@SvcLibWinUtils@@SAHXZ ?getProcessByName@SvcLibWinUtils@@SAKABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?getUserBySid@SvcLibWinUtils@@SA_NKAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?getWindowsVersion@SvcLibWinUtils@@SAHXZ ?get_executable_path_by_pid@SvcLibWinUtils@@CAKIAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?get_path_by_device@SvcLibWinUtils@@CA_NAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z ?listUsersTempFolders@SvcLibWinUtils@@SA?AVQStringList@@XZ ?queryCpuData@SvcLibWinUtils@@SA_NAAUSCpu@LiveTaskManagerQt@@@Z ?queryDiskDriveData@SvcLibWinUtils@@SA_NAAV?$QMap@VQString@@USPhysicalDiskDrive@LiveTaskManagerQt@@@@@Z ?queryMemoryData@SvcLibWinUtils@@SA_NAAUSMemory@LiveTaskManagerQt@@@Z ?queryNetworkData@SvcLibWinUtils@@SA_NAAV?$QMap@VQString@@USNetwork@LiveTaskManagerQt@@@@@Z ?queryNetworkStatsData@SvcLibWinUtils@@SA_NAAV?$QMap@VQString@@USNetwork@LiveTaskManagerQt@@@@@Z ?queryRunningProcess@SvcLibWinUtils@@SA_NAAV?$QMap@HUSProcess@LiveTaskManagerQt@@@@@Z ?queryService@SvcLibWinUtils@@SA_NAAV?$QMap@VQString@@USService@LiveTaskManagerQt@@@@@Z

Name

.text

Size

11.1MB

Virtual Size

11.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

16.3MB

Virtual Size

16.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

312KB

Virtual Size

381KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.qtmetad

Size

512B

Virtual Size

106B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.qtmimed

Size

315KB

Virtual Size

315KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

518KB

Virtual Size

518KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=39, id=259, version=27412,

count=226, id=261, version=27412,

count=11, id=253, version=28518,

count=21, id=260, version=30034,

count=29, id=259, version=30034,

count=123, id=261, version=30034,

count=2, id=253, version=23601,

count=40, id=260, version=27412,

count=3, id=262, version=27412,

count=21, productName=Unmarked objects (old),

count=2, id=259, productName=VS2019 v16.11.9 build 30139, version=30139,

count=57, id=257, version=27412,

count=711, id=1, productName=Unmarked objects,

count=1080, id=260, productName=VS2019 v16.11.9 build 30139, version=30139,

count=1095, id=261, productName=VS2019 v16.11.9 build 30139, version=30139,

count=1, id=256, productName=VS2019 v16.11.9 build 30139, version=30139,

count=1, id=255, productName=VS2019 v16.11.9 build 30139, version=30139,

count=1, id=258, productName=VS2019 v16.11.9 build 30139, version=30139,