2026-08-19_50325c02990e1bb2c4fdaf90dd039617_elex_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-19_50325c02990e1bb2c4fdaf90dd039617_elex_mespinoza
Size 2.1MB
Sample260819-2vrtlsx1dz
SHA256 0ef87258b5aeaf1cbcfb54789f35f9b5563cb874663e3ca281c613491da58c54
MD5 50325c02990e1bb2c4fdaf90dd039617
SHA1 276b1fe89e9d50fffa3a0113f74c67e769c080fe
SHA512 709619070adb1dd8a48a685a586b805ee809e4ab35d60dd99a84af8237f8dbaebfe7952f6ffb8384d7db346a52b4ba31f7b9645714c5bd1353d83f63f2ae4fc2
SSDEEP 24576:uaFAecjbLknurHs9NeAT+0PfMrTcrrPOfEECc69XkosRDaVqQXPO3g:uaFRjnuXH0HiTcrq7Cc62RD6vPO3g
TLSH
T107A54B10B3818539F9B30972DDBD466E452CFE510B18ACD7D3C81A1F1AB5DE2AA32D27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-19_50325c02990e1bb2c4fdaf90dd039617_elex_mespinoza

.exe 2.1MB

2026-08-19_50325c02990e1bb2c4fdaf90dd039617_elex_mespinoza

IMPHASH 96fc9a0446e8cc08d8a56d4476d459e4
SHA256 0ef87258b5aeaf1cbcfb54789f35f9b5563cb874663e3ca281c613491da58c54
MD5 50325c02990e1bb2c4fdaf90dd039617
SHA1 276b1fe89e9d50fffa3a0113f74c67e769c080fe
SHA512 709619070adb1dd8a48a685a586b805ee809e4ab35d60dd99a84af8237f8dbaebfe7952f6ffb8384d7db346a52b4ba31f7b9645714c5bd1353d83f63f2ae4fc2
SSDEEP 24576:uaFAecjbLknurHs9NeAT+0PfMrTcrrPOfEECc69XkosRDaVqQXPO3g:uaFRjnuXH0HiTcrq7Cc62RD6vPO3g
TLSH
T107A54B10B3818539F9B30972DDBD466E452CFE510B18ACD7D3C81A1F1AB5DE2AA32D27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

02:1f:16:75:45:c8:a9:ae:0f:81:87:dc:a0:28:0f:81:fb:a7:de:17:36:c6:b5:f5:1d:3e:ed:05:c2:be:96:32

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Xiamen Huanya Zhongzhi Technology Partnership Enterprise,OU=IT,O=Xiamen Huanya Zhongzhi Technology Partnership Enterprise,L=Xiamen,ST=Fujian,C=CN

Chains

Aug 14, 2026

CN=Xiamen Huanya Zhongzhi Technology Partnership Enterprise,OU=IT,O=Xiamen Huanya Zhongzhi Technology Partnership Enterprise,L=Xiamen,ST=Fujian,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=Xiamen Huanya Zhongzhi Technology Partnership Enterprise,OU=IT,O=Xiamen Huanya Zhongzhi Technology Partnership Enterprise,L=Xiamen,ST=Fujian,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=Xiamen Huanya Zhongzhi Technology Partnership Enterprise,OU=IT,O=Xiamen Huanya Zhongzhi Technology Partnership Enterprise,L=Xiamen,ST=Fujian,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

81:4e:42:17:a1:29:7f:ed:5a:cc:d4:17:f8:91:ad:75

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2024 - Jul 28, 2038

Subject

CN=Xiamen Huanya Zhongzhi Technology Partnership Enterprise,OU=IT,O=Xiamen Huanya Zhongzhi Technology Partnership Enterprise,L=Xiamen,ST=Fujian,C=CN

Serial Number

19:28:e6:b4:f8:8f:8d:55:7b:19:2a:7c

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 20, 2024 - Nov 12, 2027

Minor OS version

Major OS version

Entry point

1167613

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

J:\SP-100\V2.0.6181_PingAn\Code\Common\Output\Bin\WSUS_Center.pdb

entcommon

DesDecryptString DesEncryptString IsUTF8

quickanalyze

?GetNetWorkCardInformation@CQuickAnalyze@Online@@SA_NAAV?$vector@USNetWorkCardInformation@Online@@V?$allocator@USNetWorkCardInformation@Online@@@std@@@std@@@Z

policy

?GetInstance@CPolicyHandle@@SAAAV1@XZ ?SavePolicy@CPolicyHandle@@QAE_NAAUSSRequestInformation@@ABUSSPolicyInformation@@@Z ?UpdateFileSignatures@CPolicyHandle@@QAE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABUSSFileCategoryOptionsInformation@@@Z ?LoadPolicy@CPolicyHandle@@QAE_NABUSSRequestInformation@@AAUSSPolicyInformation@@@Z ?LoadMonitorFileOperatePolicys@CPolicyHandle@@QAE_NABUSSRequestInformation@@AAV?$vector@USSMonitorFileOperateInformation@@V?$allocator@USSMonitorFileOperateInformation@@@std@@@std@@@Z

fmpexportdll

?SetSrTempPath@CFmpExportDll@@QAE_NPB_W@Z ?LoadPartition@CFmpExportDll@@QAE_ND_N@Z ?LoadFolder@CFmpExportDll@@QAE_NPB_W_N@Z ?LoadRemoteDevice@CFmpExportDll@@QAE_NQAUSRemoteSource@@_N@Z ?FreeSystem@CFmpExportDll@@QAE_NXZ ?AnalyzeFileSignature@CFmpExportDll@@QAE_NXZ ?PreAnalyzePluginFile@CFmpExportDll@@QAE_NABV?$set@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@@Z ?Parse@CFmpExportDll@@QAE_NABUSParseParam@@_NPAX@Z ?SignRecovery@CFmpExportDll@@QAE_NABUSParseParam@@ABUSSPolicyInformation@@@Z ?DoSearch@CFmpExportDll@@QAE_NABUSParseParam@@ABUSSPolicyInformation@@@Z ?DoHash@CFmpExportDll@@QAE_NABUSParseParam@@ABUSSPolicyInformation@@@Z ?DoSuspectFilter@CFmpExportDll@@QAE_NABUSParseParam@@ABUSSPolicyInformation@@@Z ?MyFUnInit@CFmpExportDll@@QAEXXZ ?SetOutDbPath@CFmpExportDll@@QAE_NPB_W@Z ?SetFsDbPath@CFmpExportDll@@QAE_NPB_W@Z ?SetResultDir@CFmpExportDll@@QAE_NPB_W@Z ?SetExportDir@CFmpExportDll@@QAE_NPB_W@Z ?SetPrivatePwdDictPath@CFmpExportDll@@QAE_NPB_W@Z ?CreateIndex@CFmpExportDll@@QAEHABUSCreateIndexParam@@@Z ?CopyIndexTable@CFmpExportDll@@QAE_NPB_W0@Z ?GetFileSignatureXmlPath@CFmpExportDll@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?CreatePasswordIndex@CFmpExportDll@@QAE_NH@Z ?DealPartitionFileSystem@CFmpExportDll@@QAE_NDPB_WH@Z ?SavePartitionInfo@CFmpExportDll@@QAE_NPB_W00@Z ?SetPolicyInfo@CFmpExportDll@@QAE_NAAVCJson@@@Z ?DoSearchFileKeyword@CFmpExportDll@@QAE_NPB_W00ABUSSKeyWordsSearchInformation@@ABUSSSearchOptionsInformation@@AAV?$vector@USKeywordResult@@V?$allocator@USKeywordResult@@@std@@@std@@@Z ?StopSearchFileKeyword@CFmpExportDll@@QAE_NXZ ?GetInstance@CFmpExportDll@@SAAAV1@XZ ?Init@CFmpExportDll@@QAE_NABUSInitParam@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?Start@CFmpExportDll@@QAE_NXZ ?Stop@CFmpExportDll@@QAE_NXZ ?WriteErrorList@CFmpExportDll@@QAEXXZ ?DeleteErrorList@CFmpExportDll@@QAEXXZ ?SetFilterPath@CFmpExportDll@@QAEXABV?$set@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@@Z ?GetKeyFromMemory@CFmpExportDll@@QAEXXZ ?GetKeyInformation@CFmpExportDll@@QAE_NAAV?$map@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@USIMKeyResult@@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@USIMKeyResult@@@std@@@2@@std@@@Z ?ConnectFtpClientSignal@CFmpExportDll@@QAEXABV?$slot@$$A6A_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@000@ZV?$function@$$A6A_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@000@Z@boost@@@signals2@boost@@@Z ?SetSrDbPath@CFmpExportDll@@QAE_NPB_W@Z

entjsoncpp

??1Value@Json@@QAE@XZ ??0Value@Json@@QAE@H@Z ??0Value@Json@@QAE@W4ValueType@1@@Z ??0Value@Json@@QAE@_N@Z ??4Value@Json@@QAEAAV01@$$QAV01@@Z ??4Value@Json@@QAEAAV01@ABV01@@Z ??0Value@Json@@QAE@I@Z ?asString@Value@Json@@QBEPBDXZ ??0Value@Json@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??1FastWriter@Json@@UAE@XZ ??0Reader@Json@@QAE@XZ ??1Reader@Json@@QAE@XZ ?parse@Reader@Json@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVValue@2@_N@Z ?writeString@Json@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVFactory@StreamWriter@1@ABVValue@1@@Z ??0Value@Json@@QAE@$$QAV01@@Z ??0Value@Json@@QAE@ABV01@@Z ??1StreamWriterBuilder@Json@@UAE@XZ ??0StreamWriterBuilder@Json@@QAE@XZ ??0FastWriter@Json@@QAE@XZ ?removeMember@Value@Json@@QAEXPBD@Z ?append@Value@Json@@QAEAAV12@ABV12@@Z ??AValue@Json@@QAEAAV01@H@Z ??AValue@Json@@QAEAAV01@PBD@Z ?clear@Value@Json@@QAEXXZ ?empty@Value@Json@@QBE_NXZ ?size@Value@Json@@QBEIXZ ?isString@Value@Json@@QBE_NXZ ?isInt@Value@Json@@QBE_NXZ ?asInt@Value@Json@@QBEHXZ ?asCString@Value@Json@@QBEPBDXZ ?type@Value@Json@@QBE?AW4ValueType@2@XZ ??0Value@Json@@QAE@PBD@Z

ftpclient

??1CFtpClientExport@@QAE@XZ ??0CFtpClientExport@@QAE@XZ ?Init@CFtpClientExport@@QAE_NXZ ?Upload@CFtpClientExport@@QAE_NABUSFtpUploadInformation@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z

advapi32

DuplicateTokenEx InitializeSecurityDescriptor SetSecurityDescriptorSacl SetSecurityDescriptorDacl GetSecurityDescriptorSacl GetUserNameW OpenProcessToken CryptAcquireContextW CryptGenRandom CryptReleaseContext ConvertStringSecurityDescriptorToSecurityDescriptorW LookupAccountSidW GetTokenInformation LookupPrivilegeValueW AdjustTokenPrivileges

zlibmanager

?GetInstance@CZlibManager@@SAAAV1@XZ ?ZipMulti@CZlibManager@@QAE_NABV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@1_N1@Z ?Zip@CZlibManager@@QAE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@00_N0@Z

shell32

SHGetFileInfoW

userenv

ExpandEnvironmentStringsForUserW

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSEnumerateSessionsW WTSQuerySessionInformationW

crashrpt

ord31 ord15 ord29 ord9

user32

RegisterClassW TranslateMessage DestroyWindow DispatchMessageW SendMessageW CreateWindowExW DefWindowProcW wsprintfW GetMessageW PostMessageW wvsprintfW PostQuitMessage

psapi

GetProcessImageFileNameW GetProcessMemoryInfo

protobufnet

??0RpcMessage_ParameterList@rpc@@QAE@ABV01@@Z ?bool_param@RpcMessage_Parameter@rpc@@QBE_NXZ ?SetInstance@CProtoBufNetLogManager@@SAXPAV1@@Z ?CallWithResponse@RpcRequestControl@rpc@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00ABVRpcMessage_ParameterList@2@V?$shared_ptr@VRpcMessage_Response@rpc@@@boost@@@Z ?GetSessionID@RpcClient@rpc@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?GetRpcRequestControlPtr@RpcClient@rpc@@QAE?AV?$shared_ptr@VRpcRequestControl@rpc@@@boost@@XZ ??1RpcMessage_ParameterList@rpc@@UAE@XZ ??0RpcMessage_ParameterList@rpc@@QAE@XZ ?set_bool_param@RpcMessage_Parameter@rpc@@QAEX_N@Z ?uint64_param@RpcMessage_Parameter@rpc@@QBE_KXZ ?set_uint_param@RpcMessage_Parameter@rpc@@QAEXI@Z ?uint_param@RpcMessage_Parameter@rpc@@QBEIXZ ?set_int_param@RpcMessage_Parameter@rpc@@QAEXH@Z ?int_param@RpcMessage_Parameter@rpc@@QBEHXZ ?set_string_param@RpcMessage_Parameter@rpc@@QAEXPBD@Z ?set_string_param@RpcMessage_Parameter@rpc@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?string_param@RpcMessage_Parameter@rpc@@QBEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?add_parameters@RpcMessage_ParameterList@rpc@@QAEPAVRpcMessage_Parameter@2@XZ ?parameters@RpcMessage_ParameterList@rpc@@QBEABVRpcMessage_Parameter@2@H@Z ?parameters_size@RpcMessage_ParameterList@rpc@@QBEHXZ ??1RpcService@rpc@@UAE@XZ ??0RpcService@rpc@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@I@Z ?bytes_param@RpcMessage_Parameter@rpc@@QBEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?GetClient@CProtoBufNet@@QAE?AV?$shared_ptr@VRpcClient@rpc@@@boost@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?DelClient@CProtoBufNet@@QAE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?CreateClient@CProtoBufNet@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABUSNetParam@@@Z ?GetInstance@CProtoBufNet@@SAAAV1@XZ ?AddService@RpcResponseControl@rpc@@QAE_NV?$shared_ptr@VRpcService@rpc@@@boost@@@Z ?DisConnect@RpcClient@rpc@@QAE_NXZ ?ReConnect@RpcClient@rpc@@QAE_NXZ ?IsConnected@RpcClient@rpc@@QAE_NXZ ?ConnectErrorCodeSignal@RpcClient@rpc@@QAE?AVconnection@signals2@boost@@ABV?$slot@$$A6AXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABI@ZV?$function@$$A6AXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABI@Z@boost@@@45@@Z ?ConnectNewSessionSignal@RpcClient@rpc@@QAE?AVconnection@signals2@boost@@ABV?$slot@$$A6AXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@ZV?$function@$$A6AXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z@boost@@@45@@Z ?ConnectToDisconnectSignal@RpcClient@rpc@@QAE?AVconnection@signals2@boost@@ABV?$slot@$$A6AXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@ZV?$function@$$A6AXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z@boost@@@45@@Z ?GetRpcResponseControlPtr@RpcClient@rpc@@QAE?AV?$shared_ptr@VRpcResponseControl@rpc@@@boost@@XZ ?Stop@RpcClient@rpc@@QAE_NXZ ?Run@RpcClient@rpc@@QAE_N_N@Z ?GetServer@CProtoBufNet@@QAE?AV?$shared_ptr@VRpcServer@rpc@@@boost@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?GetAttribute@RpcServer@rpc@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAUSSocketAttribute@@@Z ?GetRpcRequestControlPtr@RpcServer@rpc@@QAE?AV?$shared_ptr@VRpcRequestControl@rpc@@@boost@@XZ ?CallWithoutResponse@RpcRequestControl@rpc@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00ABVRpcMessage_ParameterList@2@@Z ?GetAttribute@RpcClient@rpc@@QAE_NAAUSSocketAttribute@@@Z ?GetMetadata@RpcMessage_Response@rpc@@UBE?AUMetadata@protobuf@google@@XZ ?SetCachedSize@RpcMessage_Response@rpc@@EBEXH@Z ?SerializeWithCachedSizesToArray@RpcMessage_Response@rpc@@UBEPAEPAE@Z ?SerializeWithCachedSizes@RpcMessage_Response@rpc@@UBEXPAVCodedOutputStream@io@protobuf@google@@@Z ?MergePartialFromCodedStream@RpcMessage_Response@rpc@@UAE_NPAVCodedInputStream@io@protobuf@google@@@Z ?ByteSize@RpcMessage_Response@rpc@@UBEHXZ ?IsInitialized@RpcMessage_Response@rpc@@UBE_NXZ ?Clear@RpcMessage_Response@rpc@@UAEXXZ ?MergeFrom@RpcMessage_Response@rpc@@UAEXABVMessage@protobuf@google@@@Z ?CopyFrom@RpcMessage_Response@rpc@@UAEXABVMessage@protobuf@google@@@Z ?New@RpcMessage_Response@rpc@@UBEPAV12@XZ ??1RpcMessage_Response@rpc@@UAE@XZ ??0RpcMessage_Response@rpc@@QAE@XZ ?set_uint64_param@RpcMessage_Parameter@rpc@@QAEX_K@Z ?set_bytes_param@RpcMessage_Parameter@rpc@@QAEXPBXI@Z ?parameters@RpcMessage_Response@rpc@@QBEABVRpcMessage_ParameterList@2@XZ ?error_code@RpcMessage_Response@rpc@@QBE_KXZ ?is_success@RpcMessage_Response@rpc@@QBE_NXZ ??4RpcMessage_ParameterList@rpc@@QAEAAV01@ABV01@@Z ?GetCachedSize@RpcMessage_Response@rpc@@UBEHXZ ??1CProtoBufNetLogManager@@UAE@XZ ??0CProtoBufNetLogManager@@QAE@XZ

logmanager

?WriteLogA@CLogManager@@QAA_NW4ELOGPRIORITY@@PADZZ ?WriteLog@CLogManager@@QAA_NW4ELOGPRIORITY@@PA_WZZ ?SetLogLevel@CLogManager@@QAEXW4ELOGPRIORITY@@@Z ?GetCurrentLogPath@CLogManager@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?Close@CLogManager@@QAE_NXZ ?Open@CLogManager@@QAE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4ELOGPRIORITY@@0@Z ?GetInstance@CLogManager@@SAAAV1@XZ

pdh

PdhCollectQueryData PdhRemoveCounter PdhGetFormattedCounterValue PdhEnumObjectItemsW PdhGetRawCounterValue PdhAddCounterW PdhCloseQuery PdhOpenQueryW PdhComputeCounterStatistics

mfc140u

ord1513 ord1525 ord1523 ord1045 ord296 ord8182 ord6966 ord266 ord1511 ord265

kernel32

CreateWaitableTimerA TlsSetValue TlsGetValue TlsAlloc SetWaitableTimer OpenEventA FormatMessageA AreFileApisANSI LCMapStringW GetFullPathNameW GetFileAttributesW TlsFree InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetTempFileNameA GetTempPathA GetModuleFileNameA OpenThread VirtualQuery FlushInstructionCache GetThreadContext VirtualProtectEx GetSystemInfo GetThreadPriority GetCurrentThread SuspendThread SetThreadPriority VirtualAlloc VirtualFree SystemTimeToFileTime QueryPerformanceCounter SetProcessWorkingSetSize Process32FirstW Process32NextW CreateToolhelp32Snapshot OpenProcess ResumeThread GetComputerNameW WTSGetActiveConsoleSessionId LocalFree GetDiskFreeSpaceExW GetFileAttributesExW GetLogicalDriveStringsW GetSystemDirectoryW GetVersionExW GetDiskFreeSpaceW QueryDosDeviceW lstrcmpW MoveFileExW GetWindowsDirectoryW SetFileAttributesW RemoveDirectoryW GetShortPathNameW FindNextFileW GetVolumeInformationW CreateDirectoryW WideCharToMultiByte MultiByteToWideChar GetPrivateProfileIntW CopyFileW GetCurrentProcessId DeleteFileW GetPrivateProfileStringW WritePrivateProfileStringW GetModuleFileNameW GetDriveTypeW GetFileSize SetFilePointerEx CreateFileW FindClose DeviceIoControl GetCurrentThreadId FindFirstFileW GetLogicalDrives GlobalMemoryStatusEx TerminateProcess GetModuleHandleA CreateMutexW ConnectNamedPipe GetSystemTimeAsFileTime ResetEvent WaitForMultipleObjects CreateNamedPipeW CreateSemaphoreA DuplicateHandle WaitForMultipleObjectsEx ReleaseSemaphore GetCurrentProcess GetTickCount GetOverlappedResult CreateThread TerminateThread CreateFileA CreateEventW DisconnectNamedPipe WaitForSingleObject WriteFile SetLastError ReadFile LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetModuleHandleW GetProcAddress LoadLibraryW Sleep OutputDebugStringW UnmapViewOfFile CloseHandle SetEvent CreateEventA WaitForSingleObjectEx GetProcessHeap DeleteCriticalSection HeapDestroy HeapAlloc HeapReAlloc GetLastError HeapSize InitializeCriticalSectionAndSpinCount HeapFree

ole32

CoUninitialize CoCreateInstance CoInitialize

msvcp140

?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z _FNan _Nan ?toupper@?$ctype@D@std@@QBEDD@Z ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z ??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z _Mbrtowc ?id@?$ctype@D@std@@2V0locale@2@A ?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QBE_JXZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ??0_Locinfo@std@@QAE@PBD@Z ??1_Locinfo@std@@QAE@XZ ?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ ?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ ?_Getfalse@_Locinfo@std@@QBEPBDXZ ?_Gettrue@_Locinfo@std@@QBEPBDXZ ?_Incref@facet@locale@std@@UAEXXZ ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ ??0facet@locale@std@@IAE@I@Z ??1facet@locale@std@@MAE@XZ ?c_str@?$_Yarn@D@std@@QBEPBDXZ ??_D?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?id@?$numpunct@_W@std@@2V0locale@2@A ?id@?$numpunct@D@std@@2V0locale@2@A ?always_noconv@codecvt_base@std@@QBE_NXZ ?widen@?$ctype@_W@std@@QBE_WD@Z ?getloc@ios_base@std@@QBE?AVlocale@2@XZ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@G@Z ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z ?id@?$ctype@_W@std@@2V0locale@2@A ?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?toupper@?$ctype@_W@std@@QBE_W_W@Z ?tolower@?$ctype@_W@std@@QBE_W_W@Z ??Bid@locale@std@@QAEIXZ ?classic@locale@std@@SAABV12@XZ ?uncaught_exception@std@@YA_NXZ ?_BADOFF@std@@3_JB ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ ?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z

vcruntime140

__RTDynamicCast _except_handler4_common __telemetry_main_return_trigger memcpy memset __std_terminate memmove memcmp __std_type_info_compare _purecall __std_exception_destroy __std_exception_copy strstr memchr _CxxThrowException __CxxFrameHandler3 strchr __telemetry_main_invoke_trigger __vcrt_InitializeCriticalSectionEx

api-ms-win-crt-heap-l1-1-0

_set_new_mode free calloc malloc

api-ms-win-crt-string-l1-1-0

wcslen _wcsicmp _wcsnicmp _wcsupr_s _wcsdup tolower wcsncpy wmemcpy_s wcsnlen wcscmp strlen strncmp towlower

api-ms-win-crt-convert-l1-1-0

strtoul strtol wcstoul _strtoi64 strtod _wtoi64 _strtoui64 atoi

api-ms-win-crt-runtime-l1-1-0

_cexit __p___argc __p___wargv _errno _beginthreadex _invalid_parameter_noinfo _crt_atexit _seh_filter_exe _c_exit _register_onexit_function _initialize_onexit_table _wassert abort _register_thread_local_exe_atexit_callback _exit exit _initterm_e _set_app_type strerror terminate _configure_wide_argv _controlfp_s _initialize_wide_environment _get_initial_wide_environment _initterm _invalid_parameter_noinfo_noreturn

api-ms-win-crt-stdio-l1-1-0

fgets ftell __stdio_common_vfprintf __acrt_iob_func __stdio_common_vswprintf_s _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos fwrite fgetc _set_fmode fseek fclose _wfopen_s fflush fopen fputc __p__commode __stdio_common_vsprintf_s __stdio_common_vsprintf __stdio_common_vswprintf

api-ms-win-crt-time-l1-1-0

_localtime64 _time64 _gmtime64 clock

api-ms-win-crt-filesystem-l1-1-0

remove _access _unlock_file _lock_file _stat64i32 _wrename

api-ms-win-crt-utility-l1-1-0

ldiv srand rand

api-ms-win-crt-multibyte-l1-1-0

_mbsrchr

api-ms-win-crt-math-l1-1-0

_except1 __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

??0CIniFile@@QAE@ABV0@@Z ??0CIniFile@@QAE@PBD@Z ??0CIniFile@@QAE@XZ ??0CLogManagerNoEncrypt@@QAE@ABV0@@Z ??0CRunIniData@@QAE@ABV0@@Z ??0CRunIniData@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N111@Z ??0CRunIniData@@QAE@XZ ??0SearchAPI@@QAE@ABV0@@Z ??1CIniFile@@QAE@XZ ??1CRunIniData@@QAE@XZ ??4CIniFile@@QAEAAV0@ABV0@@Z ??4CLogManagerNoEncrypt@@QAEAAV0@ABV0@@Z ??4CRunIniData@@QAEAAV0@ABV0@@Z ??4SearchAPI@@QAEAAV0@ABV0@@Z ?AddItemValue@CIniFile@@QAE_NPBD0V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?AddOneSection@CIniFile@@QAE_NAAVCIniSection@@@Z ?CheckSection@CIniFile@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?DecryptIniFile@CRunIniData@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@_N@Z ?DeleteItemValue@CIniFile@@QAE_NPBD0@Z ?DeleteOneSection@CIniFile@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?EnCryptIniFile@CRunIniData@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0_N@Z ?GetIniModifyDate@CRunIniData@@SA_JABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z ?GetIniPath@CIniFile@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?GetItemValue@CIniFile@@QAE_NPBD0AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?GetTempFilePath@CRunIniData@@CAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?Load@CIniFile@@QAE_NPBDK@Z ?Load@CIniFile@@QAE_NXZ ?Load@CRunIniData@@QAE_NXZ ?ParseLine@CIniFile@@AAEXPADAAH@Z ?PrivateConstruct@CRunIniData@@AAEXXZ ?ResetAllIniFile@CIniFile@@QAE_NPAU_iobuf@@@Z ?Save@CIniFile@@QAE_NXZ ?SaveNewFile@CRunIniData@@QAE_NXZ ?SetEncryptFlag@CRunIniData@@QAEX_N@Z ?SetIniPath@CIniFile@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetItemValue@CIniFile@@QAE_NPBD00@Z ?__autoclassinit2@CLogManagerNoEncrypt@@QAEXI@Z

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

452KB

Virtual Size

452KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

216KB

Virtual Size

220KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=16, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=4, id=199, version=41118,

count=2, id=206, version=65501,

count=12, id=259, version=23013,

count=14, id=260, version=23013,

count=29, id=261, version=23013,

count=6, id=257, version=23013,

count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=28, id=261, productName=VS2015 [14.0] build 23026, version=23026,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=1, id=208, version=65501,

count=26, id=203, version=65501,

count=19, id=257, productName=VS2015 [14.0] build 23026, version=23026,

count=733, id=1, productName=Unmarked objects,

count=61, id=265, version=23026,

count=1, id=256, productName=VS2015 [14.0] build 23026, version=23026,

count=1, id=255, productName=VS2015 [14.0] build 23026, version=23026,

count=1, id=151,

count=1, id=258, productName=VS2015 [14.0] build 23026, version=23026,