2026-08-09_719d363d2e70e8f93456f2f3c23fb144_elex_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_719d363d2e70e8f93456f2f3c23fb144_elex_mespinoza
Size 1.4MB
Sample260809-t4mbgsbd55
SHA256 707d11279e293049f55ed3a72c4e8581140c5ba3b39e8cd8f4c3cde4caffc59c
MD5 719d363d2e70e8f93456f2f3c23fb144
SHA1 d3c595fc72ce58b1507997defa119ed9eb295420
SHA512 a0c7bd8e3d1794049d08c7a28bfea37632ee9de8d253cd314196365f94a4514226c996b67ff42761e59f594a5805096602e753cd68327ed949e7355a1bfd732b
SSDEEP 12288:paoFmP6mgALDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:paoFHmuNyBo4kx929bL3Hnx
TLSH
T1A96502323B9D8173E95B13748CA8ABB9A42CF9540F6196C7E38E073E59765E31E32503
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_719d363d2e70e8f93456f2f3c23fb144_elex_mespinoza

File Explorer

2026-08-09_719d363d2e70e8f93456f2f3c23fb144_elex_mespinoza

.exe 1.4MB

2026-08-09_719d363d2e70e8f93456f2f3c23fb144_elex_mespinoza

IMPHASH bec431cff4152b33ea6f6db34c9be5a3
SHA256 707d11279e293049f55ed3a72c4e8581140c5ba3b39e8cd8f4c3cde4caffc59c
MD5 719d363d2e70e8f93456f2f3c23fb144
SHA1 d3c595fc72ce58b1507997defa119ed9eb295420
SHA512 a0c7bd8e3d1794049d08c7a28bfea37632ee9de8d253cd314196365f94a4514226c996b67ff42761e59f594a5805096602e753cd68327ed949e7355a1bfd732b
SSDEEP 12288:paoFmP6mgALDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:paoFHmuNyBo4kx929bL3Hnx
TLSH
T1A96502323B9D8173E95B13748CA8ABB9A42CF9540F6196C7E38E073E59765E31E32503
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

58454

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\jekins_work\workspace\pcmgr_international\product\win32\dbginfo\wmsvc.pdb

kernel32

DeleteCriticalSection EnterCriticalSection LeaveCriticalSection FreeLibrary GetFileAttributesW MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW GetLogicalDriveStringsW QueryDosDeviceW GetModuleHandleW Module32FirstW TerminateProcess InitializeCriticalSectionAndSpinCount WaitForSingleObject GetCommandLineW GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection GetCurrentThreadId CreateEventW SetEvent RaiseException ResetEvent Sleep OpenEventW UnregisterWait RegisterWaitForSingleObject InterlockedExchange lstrcmpiW FatalAppExitW SetConsoleCtrlHandler CreateThread SetProcessWorkingSetSize GetCurrentProcessId OutputDebugStringW SuspendThread TerminateThread GetLocalTime MoveFileW QueryPerformanceCounter QueryPerformanceFrequency InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetModuleFileNameW DeleteFileW SetFileAttributesW GetCurrentProcess LocalFree LocalAlloc GetVersionExW GetProcAddress LoadLibraryW OpenProcess Process32NextW Process32FirstW GetLastError CreateToolhelp32Snapshot GetFileSize CloseHandle CreateFileW WaitForMultipleObjects

user32

PeekMessageW TranslateMessage PostThreadMessageW DispatchMessageW GetMessageW

advapi32

CreateProcessAsUserW StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerExW SetServiceStatus RegEnumKeyExW SetSecurityDescriptorDacl InitializeSecurityDescriptor ControlService StartServiceW QueryServiceStatus DeleteService ChangeServiceConfig2W ChangeServiceConfigW OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW RegOpenKeyExW RegDeleteKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegCreateKeyExW RegOpenKeyW SetTokenInformation DuplicateTokenEx FreeSid EqualSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken

shell32

CommandLineToArgvW SHCreateDirectoryExW

shlwapi

PathFileExistsW PathFindFileNameW PathRemoveFileSpecW PathAppendW SHDeleteValueW SHRegSetUSValueW

msvcp140

??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_BADOFF@std@@3_JB ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ ?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSWaitSystemEvent

ws2_32

gethostbyname socket WSAStartup closesocket

imm32

ImmDisableIME

vcruntime140

memcmp _except_handler4_common _CxxThrowException memchr __CxxFrameHandler3 __vcrt_InitializeCriticalSectionEx __std_exception_destroy memcpy __std_terminate memset memmove wcsrchr wcsstr _purecall __std_exception_copy strchr

api-ms-win-crt-heap-l1-1-0

malloc _recalloc _set_new_mode free calloc _callnewh

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s __stdio_common_vsprintf_s fwrite getchar __stdio_common_vfprintf __acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _set_fmode _wfopen __p__commode fclose

api-ms-win-crt-string-l1-1-0

wcsncpy_s wcslen strnlen _wcsnicmp wmemcpy_s wcscmp wcsnlen strlen _wcsicmp _wcsupr_s

api-ms-win-crt-runtime-l1-1-0

_controlfp_s _invalid_parameter_noinfo _beginthreadex _c_exit __p___wargv __p___argc _exit exit _initterm_e _errno _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv terminate _invalid_parameter_noinfo_noreturn _set_app_type _seh_filter_exe _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _crt_atexit _cexit

api-ms-win-crt-convert-l1-1-0

wcstoul wcstol

api-ms-win-crt-math-l1-1-0

_isnan _dtest _except1 __setusermatherr modf _finite

api-ms-win-crt-filesystem-l1-1-0

_waccess

api-ms-win-crt-locale-l1-1-0

setlocale _configthreadlocale

??0Exception@Json@@QAE@ABV01@@Z ??0Exception@Json@@QAE@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??0Factory@StreamWriter@Json@@QAE@ABV012@@Z ??0Factory@StreamWriter@Json@@QAE@XZ ??0FastWriter@Json@@QAE@ABV01@@Z ??0FastWriter@Json@@QAE@XZ ??0LogicError@Json@@QAE@$$QAV01@@Z ??0LogicError@Json@@QAE@ABV01@@Z ??0LogicError@Json@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??0Path@Json@@QAE@$$QAV01@@Z ??0Path@Json@@QAE@ABV01@@Z ??0Path@Json@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVPathArgument@1@1111@Z ??0PathArgument@Json@@QAE@$$QAV01@@Z ??0PathArgument@Json@@QAE@ABV01@@Z ??0PathArgument@Json@@QAE@I@Z ??0PathArgument@Json@@QAE@PBD@Z ??0PathArgument@Json@@QAE@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??0PathArgument@Json@@QAE@XZ ??0RuntimeError@Json@@QAE@$$QAV01@@Z ??0RuntimeError@Json@@QAE@ABV01@@Z ??0RuntimeError@Json@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??0StaticString@Json@@QAE@PBD@Z ??0StreamWriter@Json@@QAE@ABV01@@Z ??0StreamWriter@Json@@QAE@XZ ??0StreamWriterBuilder@Json@@QAE@ABV01@@Z ??0StreamWriterBuilder@Json@@QAE@XZ ??0StyledStreamWriter@Json@@QAE@ABV01@@Z ??0StyledStreamWriter@Json@@QAE@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??0StyledWriter@Json@@QAE@ABV01@@Z ??0StyledWriter@Json@@QAE@XZ ??0Value@Json@@QAE@$$QAV01@@Z ??0Value@Json@@QAE@ABV01@@Z ??0Value@Json@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??0Value@Json@@QAE@ABVStaticString@1@@Z ??0Value@Json@@QAE@H@Z ??0Value@Json@@QAE@I@Z ??0Value@Json@@QAE@N@Z ??0Value@Json@@QAE@PBD0@Z ??0Value@Json@@QAE@PBD@Z ??0Value@Json@@QAE@W4ValueType@1@@Z ??0Value@Json@@QAE@_J@Z ??0Value@Json@@QAE@_K@Z ??0Value@Json@@QAE@_N@Z ??0ValueConstIterator@Json@@AAE@ABV?$_Tree_iterator@V?$_Tree_val@U?$_Tree_simple_types@U?$pair@$$CBVCZString@Value@Json@@V23@@std@@@std@@@std@@@std@@@Z ??0ValueConstIterator@Json@@QAE@ABVValueIterator@1@@Z ??0ValueConstIterator@Json@@QAE@XZ ??0ValueIterator@Json@@AAE@ABV?$_Tree_iterator@V?$_Tree_val@U?$_Tree_simple_types@U?$pair@$$CBVCZString@Value@Json@@V23@@std@@@std@@@std@@@std@@@Z ??0ValueIterator@Json@@QAE@ABV01@@Z ??0ValueIterator@Json@@QAE@ABVValueConstIterator@1@@Z ??0ValueIterator@Json@@QAE@XZ ??0ValueIteratorBase@Json@@QAE@ABV?$_Tree_iterator@V?$_Tree_val@U?$_Tree_simple_types@U?$pair@$$CBVCZString@Value@Json@@V23@@std@@@std@@@std@@@std@@@Z ??0ValueIteratorBase@Json@@QAE@XZ ??0Writer@Json@@QAE@ABV01@@Z ??0Writer@Json@@QAE@XZ ??1Exception@Json@@UAE@XZ ??1Factory@StreamWriter@Json@@UAE@XZ ??1FastWriter@Json@@UAE@XZ ??1LogicError@Json@@UAE@XZ ??1Path@Json@@QAE@XZ ??1PathArgument@Json@@QAE@XZ ??1RuntimeError@Json@@UAE@XZ ??1StreamWriter@Json@@UAE@XZ ??1StreamWriterBuilder@Json@@UAE@XZ ??1StyledStreamWriter@Json@@QAE@XZ ??1StyledWriter@Json@@UAE@XZ ??1Value@Json@@QAE@XZ ??1Writer@Json@@UAE@XZ ??4Exception@Json@@QAEAAV01@ABV01@@Z ??4Factory@StreamWriter@Json@@QAEAAV012@ABV012@@Z ??4FastWriter@Json@@QAEAAV01@ABV01@@Z ??4LogicError@Json@@QAEAAV01@$$QAV01@@Z ??4LogicError@Json@@QAEAAV01@ABV01@@Z ??4Path@Json@@QAEAAV01@$$QAV01@@Z ??4Path@Json@@QAEAAV01@ABV01@@Z ??4PathArgument@Json@@QAEAAV01@$$QAV01@@Z ??4PathArgument@Json@@QAEAAV01@ABV01@@Z ??4RuntimeError@Json@@QAEAAV01@$$QAV01@@Z ??4RuntimeError@Json@@QAEAAV01@ABV01@@Z ??4StaticString@Json@@QAEAAV01@$$QAV01@@Z ??4StaticString@Json@@QAEAAV01@ABV01@@Z ??4StreamWriter@Json@@QAEAAV01@ABV01@@Z ??4StreamWriterBuilder@Json@@QAEAAV01@ABV01@@Z ??4StyledStreamWriter@Json@@QAEAAV01@ABV01@@Z ??4StyledWriter@Json@@QAEAAV01@ABV01@@Z ??4Value@Json@@QAEAAV01@$$QAV01@@Z ??4Value@Json@@QAEAAV01@ABV01@@Z ??4ValueConstIterator@Json@@QAEAAV01@$$QAV01@@Z ??4ValueConstIterator@Json@@QAEAAV01@ABV01@@Z ??4ValueConstIterator@Json@@QAEAAV01@ABVValueIteratorBase@1@@Z ??4ValueIterator@Json@@QAEAAV01@ABV01@@Z ??4ValueIteratorBase@Json@@QAEAAV01@$$QAV01@@Z ??4ValueIteratorBase@Json@@QAEAAV01@ABV01@@Z ??4Writer@Json@@QAEAAV01@ABV01@@Z ??6Json@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@AAV12@ABVValue@0@@Z ??8Value@Json@@QBE_NABV01@@Z ??8ValueIteratorBase@Json@@QBE_NABV01@@Z ??9Value@Json@@QBE_NABV01@@Z ??9ValueIteratorBase@Json@@QBE_NABV01@@Z ??AStreamWriterBuilder@Json@@QAEAAVValue@1@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??AValue@Json@@QAEAAV01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??AValue@Json@@QAEAAV01@ABVStaticString@1@@Z ??AValue@Json@@QAEAAV01@H@Z ??AValue@Json@@QAEAAV01@I@Z ??AValue@Json@@QAEAAV01@PBD@Z ??AValue@Json@@QBEABV01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??AValue@Json@@QBEABV01@H@Z ??AValue@Json@@QBEABV01@I@Z ??AValue@Json@@QBEABV01@PBD@Z ??BStaticString@Json@@QBEPBDXZ ??BValue@Json@@QBE_NXZ ??CValueConstIterator@Json@@QBEPBVValue@1@XZ ??CValueIterator@Json@@QAEPAVValue@1@XZ ??DValueConstIterator@Json@@QBEABVValue@1@XZ ??DValueIterator@Json@@QAEAAVValue@1@XZ ??EValueConstIterator@Json@@QAE?AV01@H@Z ??EValueConstIterator@Json@@QAEAAV01@XZ ??EValueIterator@Json@@QAE?AV01@H@Z ??EValueIterator@Json@@QAEAAV01@XZ ??FValueConstIterator@Json@@QAE?AV01@H@Z ??FValueConstIterator@Json@@QAEAAV01@XZ ??FValueIterator@Json@@QAE?AV01@H@Z ??FValueIterator@Json@@QAEAAV01@XZ ??GValueIteratorBase@Json@@QBEHABV01@@Z ??MValue@Json@@QBE_NABV01@@Z ??NValue@Json@@QBE_NABV01@@Z ??OValue@Json@@QBE_NABV01@@Z ??PValue@Json@@QBE_NABV01@@Z ??_7Exception@Json@@6B@ ??_7Factory@StreamWriter@Json@@6B@ ??_7FastWriter@Json@@6B@ ??_7LogicError@Json@@6B@ ??_7RuntimeError@Json@@6B@ ??_7StreamWriter@Json@@6B@ ??_7StreamWriterBuilder@Json@@6B@ ??_7StyledWriter@Json@@6B@ ??_7Writer@Json@@6B@ ??_FStyledStreamWriter@Json@@QAEXXZ ??_FValue@Json@@QAEXXZ ?addPathInArg@Path@Json@@AAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$vector@PBVPathArgument@Json@@V?$allocator@PBVPathArgument@Json@@@std@@@4@AAV?$_Vector_const_iterator@V?$_Vector_val@U?$_Simple_types@PBVPathArgument@Json@@@std@@@std@@@4@W4Kind@PathArgument@2@@Z ?append@Value@Json@@QAEAAV12@$$QAV12@@Z ?append@Value@Json@@QAEAAV12@ABV12@@Z ?asBool@Value@Json@@QBE_NXZ ?asCString@Value@Json@@QBEPBDXZ ?asDouble@Value@Json@@QBENXZ ?asFloat@Value@Json@@QBEMXZ ?asInt64@Value@Json@@QBE_JXZ ?asInt@Value@Json@@QBEHXZ ?asLargestInt@Value@Json@@QBE_JXZ ?asLargestUInt@Value@Json@@QBE_KXZ ?asString@Value@Json@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?asUInt64@Value@Json@@QBE_KXZ ?asUInt@Value@Json@@QBEIXZ ?begin@Value@Json@@QAE?AVValueIterator@2@XZ ?begin@Value@Json@@QBE?AVValueConstIterator@2@XZ ?c_str@StaticString@Json@@QBEPBDXZ ?clear@Value@Json@@QAEXXZ ?compare@Value@Json@@QBEHABV12@@Z ?computeDistance@ValueIteratorBase@Json@@IBEHABV12@@Z ?copy@Value@Json@@QAEXABV12@@Z ?copy@ValueIteratorBase@Json@@IAEXABV12@@Z ?copyPayload@Value@Json@@QAEXABV12@@Z ?decrement@ValueIteratorBase@Json@@IAEXXZ ?defaultRealPrecision@Value@Json@@2IB ?demand@Value@Json@@QAEPAV12@PBD0@Z ?deref@ValueIteratorBase@Json@@IAEAAVValue@2@XZ ?deref@ValueIteratorBase@Json@@IBEABVValue@2@XZ ?dropNullPlaceholders@FastWriter@Json@@QAEXXZ ?dupMeta@Value@Json@@AAEXABV12@@Z ?dupPayload@Value@Json@@AAEXABV12@@Z ?empty@Value@Json@@QBE_NXZ ?enableYAMLCompatibility@FastWriter@Json@@QAEXXZ ?end@Value@Json@@QAE?AVValueIterator@2@XZ ?end@Value@Json@@QBE?AVValueConstIterator@2@XZ ?find@Value@Json@@QBEPBV12@PBD0@Z ?get@Value@Json@@QBE?AV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV12@@Z ?get@Value@Json@@QBE?AV12@IABV12@@Z ?get@Value@Json@@QBE?AV12@PBD0ABV12@@Z ?get@Value@Json@@QBE?AV12@PBDABV12@@Z ?getComment@Value@Json@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4CommentPlacement@2@@Z ?getMemberNames@Value@Json@@QBE?AV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@XZ ?getOffsetLimit@Value@Json@@QBEHXZ ?getOffsetStart@Value@Json@@QBEHXZ ?getString@Value@Json@@QBE_NPAPBD0@Z ?hasComment@Value@Json@@QBE_NW4CommentPlacement@2@@Z ?hasCommentForValue@StyledStreamWriter@Json@@CA_NABVValue@2@@Z ?hasCommentForValue@StyledWriter@Json@@CA_NABVValue@2@@Z ?increment@ValueIteratorBase@Json@@IAEXXZ ?indent@StyledStreamWriter@Json@@AAEXXZ ?indent@StyledWriter@Json@@AAEXXZ ?index@ValueIteratorBase@Json@@QBEIXZ ?initBasic@Value@Json@@AAEXW4ValueType@2@_N@Z ?insert@Value@Json@@QAE_NI$$QAV12@@Z ?insert@Value@Json@@QAE_NIABV12@@Z ?invalidPath@Path@Json@@CAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z ?isAllocated@Value@Json@@ABE_NXZ ?isArray@Value@Json@@QBE_NXZ ?isBool@Value@Json@@QBE_NXZ ?isConvertibleTo@Value@Json@@QBE_NW4ValueType@2@@Z ?isDouble@Value@Json@@QBE_NXZ ?isEqual@ValueIteratorBase@Json@@IBE_NABV12@@Z ?isInt64@Value@Json@@QBE_NXZ ?isInt@Value@Json@@QBE_NXZ ?isIntegral@Value@Json@@QBE_NXZ ?isMember@Value@Json@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?isMember@Value@Json@@QBE_NPBD0@Z ?isMember@Value@Json@@QBE_NPBD@Z ?isMultilineArray@StyledStreamWriter@Json@@AAE_NABVValue@2@@Z ?isMultilineArray@StyledWriter@Json@@AAE_NABVValue@2@@Z ?isNull@Value@Json@@QBE_NXZ ?isNumeric@Value@Json@@QBE_NXZ ?isObject@Value@Json@@QBE_NXZ ?isString@Value@Json@@QBE_NXZ ?isUInt64@Value@Json@@QBE_NXZ ?isUInt@Value@Json@@QBE_NXZ ?isValidIndex@Value@Json@@QBE_NI@Z ?key@ValueIteratorBase@Json@@QBE?AVValue@2@XZ ?make@Path@Json@@QBEAAVValue@2@AAV32@@Z ?makePath@Path@Json@@AAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$vector@PBVPathArgument@Json@@V?$allocator@PBVPathArgument@Json@@@std@@@4@@Z ?maxInt64@Value@Json@@2_JB ?maxInt@Value@Json@@2HB ?maxLargestInt@Value@Json@@2_JB ?maxLargestUInt@Value@Json@@2_KB ?maxUInt64@Value@Json@@2_KB ?maxUInt64AsDouble@Value@Json@@2NB ?maxUInt@Value@Json@@2IB ?memberName@ValueIteratorBase@Json@@QBEPBDPAPBD@Z ?memberName@ValueIteratorBase@Json@@QBEPBDXZ ?minInt64@Value@Json@@2_JB ?minInt@Value@Json@@2HB ?minLargestInt@Value@Json@@2_JB ?name@ValueIteratorBase@Json@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?newStreamWriter@StreamWriterBuilder@Json@@UBEPAVStreamWriter@2@XZ ?null@Value@Json@@2ABV12@B ?nullRef@Value@Json@@2ABV12@B ?nullSingleton@Value@Json@@SAABV12@XZ ?omitEndingLineFeed@FastWriter@Json@@QAEXXZ ?pushValue@StyledStreamWriter@Json@@AAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?pushValue@StyledWriter@Json@@AAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?releasePayload@Value@Json@@AAEXXZ ?removeIndex@Value@Json@@QAE_NIPAV12@@Z ?removeMember@Value@Json@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?removeMember@Value@Json@@QAEXPBD@Z ?removeMember@Value@Json@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAV12@@Z ?removeMember@Value@Json@@QAE_NPBD0PAV12@@Z ?removeMember@Value@Json@@QAE_NPBDPAV12@@Z ?resize@Value@Json@@QAEXI@Z ?resolve@Path@Json@@QBE?AVValue@2@ABV32@0@Z ?resolve@Path@Json@@QBEABVValue@2@ABV32@@Z ?resolveReference@Value@Json@@AAEAAV12@PBD0@Z ?resolveReference@Value@Json@@AAEAAV12@PBD@Z ?setComment@Value@Json@@QAEXPBDIW4CommentPlacement@2@@Z ?setComment@Value@Json@@QAEXPBDW4CommentPlacement@2@@Z ?setComment@Value@Json@@QAEXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4CommentPlacement@2@@Z ?setDefaults@StreamWriterBuilder@Json@@SAXPAVValue@2@@Z ?setIsAllocated@Value@Json@@AAEX_N@Z ?setOffsetLimit@Value@Json@@QAEXH@Z ?setOffsetStart@Value@Json@@QAEXH@Z ?setType@Value@Json@@AAEXW4ValueType@2@@Z ?size@Value@Json@@QBEIXZ ?swap@Value@Json@@QAEXAAV12@@Z ?swapPayload@Value@Json@@QAEXAAV12@@Z ?toStyledString@Value@Json@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?type@Value@Json@@QBE?AW4ValueType@2@XZ ?unindent@StyledStreamWriter@Json@@AAEXXZ ?unindent@StyledWriter@Json@@AAEXXZ ?validate@StreamWriterBuilder@Json@@QBE_NPAVValue@2@@Z ?valueToQuotedString@Json@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD@Z ?valueToString@Json@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z ?valueToString@Json@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@I@Z ?valueToString@Json@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@NIW4PrecisionType@1@@Z ?valueToString@Json@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_J@Z ?valueToString@Json@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_K@Z ?valueToString@Json@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z ?what@Exception@Json@@UBEPBDXZ ?write@FastWriter@Json@@UAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVValue@2@@Z ?write@StyledStreamWriter@Json@@QAEXAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@ABVValue@2@@Z ?write@StyledWriter@Json@@UAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVValue@2@@Z ?writeArrayValue@StyledStreamWriter@Json@@AAEXABVValue@2@@Z ?writeArrayValue@StyledWriter@Json@@AAEXABVValue@2@@Z ?writeCommentAfterValueOnSameLine@StyledStreamWriter@Json@@AAEXABVValue@2@@Z ?writeCommentAfterValueOnSameLine@StyledWriter@Json@@AAEXABVValue@2@@Z ?writeCommentBeforeValue@StyledStreamWriter@Json@@AAEXABVValue@2@@Z ?writeCommentBeforeValue@StyledWriter@Json@@AAEXABVValue@2@@Z ?writeIndent@StyledStreamWriter@Json@@AAEXXZ ?writeIndent@StyledWriter@Json@@AAEXXZ ?writeString@Json@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVFactory@StreamWriter@1@ABVValue@1@@Z ?writeValue@FastWriter@Json@@AAEXABVValue@2@@Z ?writeValue@StyledStreamWriter@Json@@AAEXABVValue@2@@Z ?writeValue@StyledWriter@Json@@AAEXABVValue@2@@Z ?writeWithIndent@StyledStreamWriter@Json@@AAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?writeWithIndent@StyledWriter@Json@@AAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

Name

.text

Size

136KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_719d363d2e70e8f93456f2f3c23fb144_elex_mespinoza

kernel32

user32

advapi32

shell32

shlwapi

msvcp140

wtsapi32

ws2_32

imm32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic