2026-08-08_13b5930e3aa052875f76a336782ab589_akira_amadey_coinminer_darkgate_elex_glassworm_icedid_luca-stealer_lynx_medusalocker_njrat_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_13b5930e3aa052875f76a336782ab589_akira_amadey_coinminer_darkgate_elex_glassworm_icedid_luca-stealer_lynx_medusalocker_njrat_revil_smoke-loader
Size 40.8MB
Sample260808-hwtvtabl8x
SHA256 7384e42acb7385573e6ba592f425b794653543cc02805e05fe71e0d6227e691e
MD5 13b5930e3aa052875f76a336782ab589
SHA1 2b04ce307e4800ec0f1a6b7d7199566448603014
SHA512 73887fc2f432da1d552d96363c38b92a0fb1319589c990a25c7a5221cc84b1a90ca0c0a7427a77165b558e9b1386123707794ad768dd032bdee79a834d6c651d
SSDEEP 786432:FyD0dmTjckDTAa6ItUopIBMx7rPJwF53kCe64PpgFD:YYMTIkDTAPItUBBq+9lj4Py
TLSH
T16197D092BA42C036D5A241B0456AEBBF977478214B2205C7639C3B7D5F325E12F3BB1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-08_13b5930e3aa052875f76a336782ab589_akira_amadey_coinminer_darkgate_elex_glassworm_icedid_luca-stealer_lynx_medusalocker_njrat_revil_smoke-loader

.exe 40.8MB

2026-08-08_13b5930e3aa052875f76a336782ab589_akira_amadey_coinminer_darkgate_elex_glassworm_icedid_luca-stealer_lynx_medusalocker_njrat_revil_smoke-loader

IMPHASH 2d2b5bbb0ec9fb1a1733b30b2186d467
SHA256 7384e42acb7385573e6ba592f425b794653543cc02805e05fe71e0d6227e691e
MD5 13b5930e3aa052875f76a336782ab589
SHA1 2b04ce307e4800ec0f1a6b7d7199566448603014
SHA512 73887fc2f432da1d552d96363c38b92a0fb1319589c990a25c7a5221cc84b1a90ca0c0a7427a77165b558e9b1386123707794ad768dd032bdee79a834d6c651d
SSDEEP 786432:FyD0dmTjckDTAa6ItUopIBMx7rPJwF53kCe64PpgFD:YYMTIkDTAPItUBBq+9lj4Py
TLSH
T16197D092BA42C036D5A241B0456AEBBF977478214B2205C7639C3B7D5F325E12F3BB1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

16:5d:3d:9b:e6:ce:7f:4f:fa:a8:97:77:8f:8d:98:8f:67:e6:d2:25:f7:4f:2b:16:9f:34:18:b1:2a:29:88:46

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=6821849,CN=NinjaOne LLC,O=NinjaOne LLC,L=Oldsmar,ST=Florida,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jul 28, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

37:ad:31:0f:56:ca:02:99:a8:5c:9d:7a:7d:d5:27:2f:ab:6e:9d:f4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Jul 28, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

02:6d:d6:17:c0:73:c0:a5:51:2e:29:a5:2b:e8:3a:6d

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 13, 2024 - Jun 15, 2027

Minor OS version

Major OS version

Entry point

14663400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\BuildAgent\work\aac9931d38d89885\build_root\x86-windows-release-static\app\win-patcher\NinjaRMMAgentPatcher.pdb

setupapi

SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo

rpcrt4

RpcServerInqBindings RpcBindingVectorFree RpcServerListen RpcServerRegisterIfEx RpcServerUnregisterIf NdrServerCall2 RpcServerRegisterAuthInfoW RpcBindingInqAuthClientW RpcMgmtWaitServerListen RpcMgmtStopServerListening RpcMgmtIsServerListening RpcServerUseProtseqEpW

wintrust

WTHelperProvDataFromStateData CryptCATAdminCalcHashFromFileHandle CryptCATAdminEnumCatalogFromHash CryptCATAdminAcquireContext CryptCATAdminReleaseContext CryptCATAdminReleaseCatalogContext WinVerifyTrust WTHelperGetProvSignerFromChain CryptCATCatalogInfoFromContext

wtsapi32

WTSQueryUserToken WTSSendMessageW WTSEnumerateSessionsW WTSQuerySessionInformationW WTSFreeMemory

dbghelp

SymGetModuleBase64 SymFunctionTableAccess64 SymGetOptions SymInitialize SymFromAddr SymSetOptions StackWalk64

shlwapi

SHDeleteValueW PathRemoveFileSpecW PathRemoveExtensionW PathFindFileNameW PathFileExistsW PathFileExistsA PathStripPathW PathQuoteSpacesW StrStrW SHDeleteKeyW

user32

KillTimer GetWindowLongW SetWindowLongW CharNextExA PostMessageW MsgWaitForMultipleObjectsEx RegisterDeviceNotificationW UnregisterDeviceNotification GetUserObjectInformationW UnregisterClassW MessageBoxW wsprintfW LoadStringA TranslateMessage DispatchMessageW PostThreadMessageW GetQueueStatus GetProcessWindowStation DestroyWindow SetTimer CreateWindowExW RegisterClassW DefWindowProcW PeekMessageW GetWindowThreadProcessId EnumWindows

winhttp

WinHttpCloseHandle WinHttpOpenRequest WinHttpCrackUrl WinHttpConnect WinHttpSendRequest WinHttpQueryHeaders WinHttpReceiveResponse WinHttpOpen

kernel32

LoadResource LockResource SizeofResource FindResourceW VerSetConditionMask OpenEventA VerifyVersionInfoW GetSystemInfo FindFirstVolumeW FindNextVolumeW FindVolumeClose GetLogicalDrives QueryDosDeviceW GetVolumePathNamesForVolumeNameW DeviceIoControl GetSystemTimes GlobalMemoryStatusEx GetVersion FileTimeToSystemTime MultiByteToWideChar Thread32First Thread32Next InitializeCriticalSection LoadLibraryExA DuplicateHandle ReleaseSemaphore TlsGetValue CreateSemaphoreA lstrlenW LCMapStringA GetStringTypeExA GetVolumeInformationW OpenEventW ResumeThread CreateJobObjectW AssignProcessToJobObject SetInformationJobObject GetComputerNameW GetFileAttributesExW GetLongPathNameW GetWindowsDirectoryW GetNativeSystemInfo IsWow64Process GetBinaryTypeW GetVolumeInformationByHandleW GetTempFileNameW GetPrivateProfileStringW WritePrivateProfileStringW WritePrivateProfileSectionW CopyFileW CreateSemaphoreW SetFileAttributesW GetCurrentThreadId GetDriveTypeW GetFileTime SetThreadExecutionState VirtualAlloc VirtualFree SleepEx WaitForMultipleObjects CreateIoCompletionPort GetQueuedCompletionStatus CancelIoEx InitializeCriticalSectionAndSpinCount TlsSetValue GetModuleHandleA GetSystemTime SystemTimeToFileTime InitOnceExecuteOnce RemoveDirectoryW QueryPerformanceCounter FindResourceExW VirtualQuery Module32FirstW Module32NextW GetCurrentThread SetThreadStackGuarantee InitializeConditionVariable WakeConditionVariable SleepConditionVariableCS GetThreadId LockFileEx SetEndOfFile UnlockFileEx GetStdHandle GetFileType SetUnhandledExceptionFilter AddVectoredExceptionHandler GetExitCodeThread RemoveVectoredExceptionHandler GetFileSizeEx SetFilePointerEx WriteFile FindFirstFileExW LoadLibraryW SetNamedPipeHandleState TransactNamedPipe GetProcessHeap WaitNamedPipeW OutputDebugStringW GetLocalTime TryEnterCriticalSection HeapFree GetConsoleWindow ReadFile TlsFree TlsAlloc LeaveCriticalSection EnterCriticalSection GetFinalPathNameByHandleW InitOnceComplete InitOnceBeginInitialize GetStringTypeW GetQueuedCompletionStatusEx GetVersionExA ExpandEnvironmentStringsA GetCurrentProcessorNumber CreateMutexA CompareStringW GetVolumeNameForVolumeMountPointW GetVolumePathNameW GetUserGeoID GetGeoInfoW GetTimeZoneInformation GetStartupInfoW GetUserPreferredUILanguages GetCurrencyFormatW GetLocaleInfoW GetTimeFormatW GetDateFormatW RegisterWaitForSingleObject UnregisterWaitEx GetFileSize GetDiskFreeSpaceExW CreateFileW PostQueuedCompletionStatus HeapSize HeapReAlloc WriteFileEx ReadFileEx FreeEnvironmentStringsW GetEnvironmentStringsW GetFileInformationByHandleEx TzSpecificLocalTimeToSystemTime MoveFileW SetErrorMode GetThreadPriority SetThreadPriority SwitchToThread GetOEMCP EnumSystemLocalesW IsValidLocale GetCommandLineA HeapDestroy GetSystemDefaultUILanguage SetLastError GetTempPathW GetModuleFileNameA GetTickCount64 SetFileAttributesA GetFileAttributesA SetEnvironmentVariableW QueryPerformanceFrequency HeapAlloc DecodePointer RtlCaptureStackBackTrace MoveFileExA CopyFileA Process32NextW Process32FirstW CreateToolhelp32Snapshot LocalAlloc LoadLibraryExW GetProcAddress GetModuleHandleW Wow64RevertWow64FsRedirection Wow64DisableWow64FsRedirection GetComputerNameExW GetWindowsDirectoryA GetSystemDirectoryW GetCurrentProcessId GetCurrentProcess DeleteCriticalSection InitializeCriticalSectionEx PeekNamedPipe CreatePipe RaiseException SetHandleInformation WaitForSingleObjectEx IsProcessorFeaturePresent CompareStringEx GetOverlappedResult ConnectNamedPipe DisconnectNamedPipe GlobalFree HeapCreate GetDiskFreeSpaceW OutputDebugStringA LockFile SetFilePointer GetFullPathNameA UnmapViewOfFile ExitProcess HeapValidate GetTempPathA GetDiskFreeSpaceA FlushViewOfFile CreateFileA DeleteFileA HeapCompact UnlockFile CreateFileMappingW MapViewOfFile GetProcessId ConvertThreadToFiberEx ConvertFiberToThread GetACP GetSystemDirectoryA CreateFiberEx DeleteFiber SwitchToFiber ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode GetModuleHandleExW GetEnvironmentVariableA GetLogicalProcessorInformation IsDBCSLeadByteEx IsValidCodePage SleepConditionVariableSRW WakeAllConditionVariable AreFileApisANSI CopyFileExW CreateDirectoryExW SetFileTime GetFullPathNameW GetFileInformationByHandle FlushFileBuffers GetCurrentDirectoryW GetEnvironmentVariableW WriteConsoleW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock GetConsoleOutputCP SetStdHandle SetConsoleCtrlHandler FreeLibraryAndExitThread ExitThread CreateNamedPipeW GetUserDefaultLCID LCMapStringW MoveFileExW QueryFullProcessImageNameW LoadLibraryA FreeLibrary GetTickCount SystemTimeToTzSpecificLocalTime RtlUnwind InterlockedPushEntrySList IsDebuggerPresent UnhandledExceptionFilter InitializeSListHead GetCPInfo LCMapStringEx EncodePointer OpenProcess GetProcessTimes CompareFileTime lstrcatW CreateProcessW CreateMutexW ReleaseMutex GetCommandLineW MoveFileA lstrcmpiW GetModuleFileNameW CreateProcessA TerminateThread CreateThread GetExitCodeProcess TerminateProcess GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateDirectoryW GetSystemTimeAsFileTime CloseHandle WaitForSingleObject Sleep ResetEvent SetEvent CreateEventW CreateEventA LocalFree WideCharToMultiByte FormatMessageW FormatMessageA GetLastError SetFileInformationByHandle FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetLocaleInfoEx

netapi32

NetWkstaGetInfo DsGetDcNameW NetShareGetInfo NetApiBufferFree NetShareEnum NetShareAdd

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

userenv

GetUserProfileDirectoryW DestroyEnvironmentBlock CreateEnvironmentBlock

bcrypt

BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider

secur32

LsaFreeReturnBuffer LsaDeregisterLogonProcess GetUserNameExW InitSecurityInterfaceW LsaLogonUser LsaRegisterLogonProcess LsaLookupAuthenticationPackage

activeds

ord3 ord15

gpedit

DeleteGPOLink CreateGPOLink

msi

ord160 ord141 ord8 ord246 ord248 ord6 ord32 ord92 ord118 ord159

rstrtmgr

RmStartSession RmRegisterResources RmGetList

iphlpapi

ConvertInterfaceLuidToGuid ConvertInterfaceIndexToLuid ConvertInterfaceLuidToNameW GetAdaptersAddresses GetAdaptersInfo GetIfTable ConvertInterfaceNameToLuidW ConvertInterfaceLuidToIndex if_nametoindex GetBestRoute2 if_indextoname GetUnicastIpAddressTable FreeMibTable

crypt32

CertCreateCertificateContext CertOpenSystemStoreW CertDuplicateCertificateContext CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CertOpenSystemStoreA CertGetIntendedKeyUsage CertGetEnhancedKeyUsage PFXImportCertStore CryptStringToBinaryW CertEnumCertificatesInStore CertOpenStore CryptQueryObject CertNameToStrW CertRDNValueToStrW CertGetCertificateContextProperty CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CryptMsgGetParam CryptDecodeObjectEx CryptBinaryToStringW CryptMsgClose

ws2_32

WSACleanup htonl WSAStartup gethostname WSAGetLastError __WSAFDIsSet accept bind closesocket connect ioctlsocket getpeername getsockname htons listen ntohl ntohs select setsockopt WSASetLastError WSARecv WSASend WSASocketW getaddrinfo freeaddrinfo inet_ntop send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents socket recv recvfrom sendto WSASocketA inet_addr inet_ntoa gethostbyaddr gethostbyname getservbyport getservbyname shutdown getnameinfo WSAAccept WSAConnect WSAHtonl WSANtohl WSANtohs WSARecvFrom WSASendTo WSAAsyncSelect WSAGetOverlappedResult inet_pton WSADuplicateSocketW getsockopt WSAIoctl

ole32

CoInitializeEx CoCreateInstance StringFromGUID2 CoSetProxyBlanket CoTaskMemFree CLSIDFromString CoCreateGuid CoInitialize CoUninitialize

shell32

SHGetKnownFolderPath SHGetFolderPathW

oleaut32

SafeArrayAccessData SafeArrayGetLBound SafeArrayGetUBound SafeArrayDestroy SysStringLen SysAllocString VariantClear VariantInit SysFreeString SafeArrayGetVartype SafeArrayCopy SafeArrayUnlock SafeArrayLock SafeArrayRedim SafeArrayCreate VarBstrCat SafeArrayUnaccessData SafeArrayGetElement GetErrorInfo SysAllocStringLen

advapi32

CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW BuildExplicitAccessWithNameW BuildSecurityDescriptorW RegGetValueA SystemFunction036 ConvertSecurityDescriptorToStringSecurityDescriptorW RegSetKeySecurity RegEnumKeyExA RegQueryValueExA RegOpenKeyExA RegGetKeySecurity RegFlushKey QueryServiceStatus CreateServiceW LsaRemoveAccountRights LsaAddAccountRights LsaOpenPolicy LsaClose LogonUserW LookupAccountNameW IsValidSid InitializeSid InitializeAcl GetSidLengthRequired GetAclInformation GetAce AddAce ConvertStringSecurityDescriptorToSecurityDescriptorW MapGenericMask DuplicateToken AccessCheck CreateProcessAsUserA LsaNtStatusToWinError GetSidSubAuthorityCount GetSidSubAuthority GetLengthSid EqualSid CopySid AllocateLocallyUniqueId RegDeleteTreeW RegRenameKey RegEnumValueW RegCreateKeyExW ConvertSidToStringSidW RegDeleteValueW RegDeleteKeyW CryptDecrypt LookupPrivilegeNameA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExW SetTokenInformation RevertToSelf ImpersonateLoggedOnUser DuplicateTokenEx ConvertStringSidToSidW SetNamedSecurityInfoW GetNamedSecurityInfoW FreeSid AllocateAndInitializeSid NotifyServiceStatusChangeA StartServiceW QueryServiceConfig2W QueryServiceConfigA OpenServiceA EnumDependentServicesW ControlService ChangeServiceConfigA ConvertSidToStringSidA LookupAccountNameA LookupAccountSidW GetTokenInformation QueryServiceStatusEx QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService CloseServiceHandle LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken CreateProcessAsUserW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource CryptEnumProvidersW CryptGenRandom RegNotifyChangeKeyValue AddAccessAllowedAce SetSecurityDescriptorGroup SetSecurityDescriptorOwner GetEffectiveRightsFromAclW BuildTrusteeWithSidW CryptExportKey EnumServicesStatusExW CryptSignHashW

psapi

QueryWorkingSet GetProcessImageFileNameW

winmm

timeSetEvent timeKillEvent

mpr

WNetGetUniversalNameW

??4SvcLibWinUtils@@QAEAAV0@$$QAV0@@Z ??4SvcLibWinUtils@@QAEAAV0@ABV0@@Z ?CalcUsagePct@SvcLibWinUtils@@SAMABUSCpu@LiveTaskManagerQt@@AAU23@@Z ?FILETIME_to_QDateTime@SvcLibWinUtils@@SA?AVQDateTime@@_K@Z ?GetShortcutParams@SvcLibWinUtils@@SA_NAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@1@Z ?ParseService@SvcLibWinUtils@@SA?AUSService@LiveTaskManagerQt@@ABU_ENUM_SERVICE_STATUS_PROCESSW@@ABV?$RAIIWrapper@USCHandleTraits@Common@NinjaRMM@@@Common@NinjaRMM@@@Z ?SendCustomMessage@SvcLibWinUtils@@SA_NABVQString@@V2@_NHAB_N@Z ?SendRebootMessage@SvcLibWinUtils@@SA_NABVQString@@V2@_NH@Z ?calc_process_memory@SvcLibWinUtils@@SAKPAXAA_K1@Z ?checkIfUsersLoggedIn@SvcLibWinUtils@@SA_NXZ ?createUserProcess@SvcLibWinUtils@@SA_NKPA_WPAU_STARTUPINFOW@@PAU_PROCESS_INFORMATION@@@Z ?createUserProcessAndWait@SvcLibWinUtils@@SA_NKPA_WPAU_STARTUPINFOW@@PAU_PROCESS_INFORMATION@@AAKK@Z ?getActiveUserSessionToken@SvcLibWinUtils@@SA_NPAPAXAAK@Z ?getAllSid@SvcLibWinUtils@@SA_NAAV?$vector@U_WTS_SESSION_INFOW@@V?$allocator@U_WTS_SESSION_INFOW@@@std@@@std@@@Z ?getDomainRole@SvcLibWinUtils@@SAHXZ ?getProcessByName@SvcLibWinUtils@@SAKABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?getUserBySid@SvcLibWinUtils@@SA_NKAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?getWindowsVersion@SvcLibWinUtils@@SAHXZ ?get_executable_path_by_pid@SvcLibWinUtils@@CAKIAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?get_path_by_device@SvcLibWinUtils@@CA_NAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z ?listUsersTempFolders@SvcLibWinUtils@@SA?AVQStringList@@XZ ?queryCpuData@SvcLibWinUtils@@SA_NAAUSCpu@LiveTaskManagerQt@@@Z ?queryDiskDriveData@SvcLibWinUtils@@SA_NAAV?$QMap@VQString@@USPhysicalDiskDrive@LiveTaskManagerQt@@@@@Z ?queryMemoryData@SvcLibWinUtils@@SA_NAAUSMemory@LiveTaskManagerQt@@@Z ?queryNetworkData@SvcLibWinUtils@@SA_NAAV?$QMap@VQString@@USNetwork@LiveTaskManagerQt@@@@@Z ?queryNetworkStatsData@SvcLibWinUtils@@SA_NAAV?$QMap@VQString@@USNetwork@LiveTaskManagerQt@@@@@Z ?queryRunningProcess@SvcLibWinUtils@@SA_NAAV?$QMap@HUSProcess@LiveTaskManagerQt@@@@@Z ?queryService@SvcLibWinUtils@@SA_NAAV?$QMap@VQString@@USService@LiveTaskManagerQt@@@@@Z

Name

.text

Size

15.4MB

Virtual Size

15.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

24.0MB

Virtual Size

24.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

455KB

Virtual Size

535KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.qtmetad

Size

512B

Virtual Size

106B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.qtmimed

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

813KB

Virtual Size

813KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=42, id=259, version=27412,

count=224, id=261, version=27412,

count=11, id=253, version=28518,

count=21, id=260, version=30034,

count=28, id=259, version=30034,

count=121, id=261, version=30034,

count=2, id=253, version=23601,

count=42, id=260, version=27412,

count=5, id=262, version=27412,

count=23, productName=Unmarked objects (old),

count=2, id=259, productName=VS2019 v16.11.9 build 30139, version=30139,

count=57, id=257, version=27412,

count=780, id=1, productName=Unmarked objects,

count=1582, id=260, productName=VS2019 v16.11.9 build 30139, version=30139,

count=1328, id=261, productName=VS2019 v16.11.9 build 30139, version=30139,

count=1, id=256, productName=VS2019 v16.11.9 build 30139, version=30139,

count=1, id=255, productName=VS2019 v16.11.9 build 30139, version=30139,

count=1, id=258, productName=VS2019 v16.11.9 build 30139, version=30139,