Faktur Pajak.JPG.zip
- SHA256 21e2b06d538821864388c445fc564e8782224dff235355bcbddfdd7043610c75
Overview
overview
9Static
static
3Faktur Paj... .exe
windows11-ltsc_2024-x64
9shared/05t...0q.dll
windows11-ltsc_2024-x64
1shared/Gui...26.pdf
windows11-ltsc_2024-x64
3shared/Mee...0.docx
windows11-ltsc_2024-x64
1shared/api-77504.dll
windows11-ltsc_2024-x64
1data/sechcc0.bat
windows11-ltsc_2024-x64
3shared/pac...35.msi
windows11-ltsc_2024-x64
6shared/sqlite3207.dll
windows11-ltsc_2024-x64
3shared/v1cdwua.dll
windows11-ltsc_2024-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Faktur Pajak.JPG .exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
300 seconds
Behavioral task
behavioral2
Sample
shared/05t758s5yo0q.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
shared/Guidelines_2021-04-26.pdf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
300 seconds
Behavioral task
behavioral4
Sample
shared/Meeting Notes v3.0.docx
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral5
Sample
shared/api-77504.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral6
Sample
data/sechcc0.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
300 seconds
Behavioral task
behavioral7
Sample
shared/package_20240116_161335.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
300 seconds
Behavioral task
behavioral8
Sample
shared/sqlite3207.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
Behavioral task
behavioral9
Sample
shared/v1cdwua.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
General
- Target Faktur Pajak.JPG.zip
- Size 14.6MB
- Sample260910-h74jdszdrd
- SHA256 21e2b06d538821864388c445fc564e8782224dff235355bcbddfdd7043610c75
- MD5 0405ae66e07f3f68d7237ae8218ea00b
- SHA1 51895eafc5c24bd5d3061e998f78a06734173141
- SHA512 e7133964460e38f810d546db2194b05daeccdd924a00a6695dfc0340759098cddaad4983c74ec0a7e7ab3d61ae6017def607c5e7c247fb0c6a69b2eebf3d233f
- SSDEEP 393216:iIzx1WLwrQq2N2v3vFZvpEl7WRc2s2K5dE/tmNvQbKreCjX:jzTWWBQ2/PxElGY2GEUNvQbKvX
- TLSH T104F633E3E56368F6E2BF141D39B62D72B49D4326F1EA0724D11B0F7B70C6F20A255891
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/Faktur Pajak.JPG .exe unpack002/shared/05t758s5yo0q.dll unpack002/shared/api-77504.dll unpack002/shared/sqlite3207.dll unpack002/shared/v1cdwua.dll
File Explorer
-
Faktur Pajak.JPG.zip.zip 14.6MB
-
Faktur Pajak.JPG .exe.exe 21.8MB
-
$TEMP/20260909_135136_246415_photo_AQADCxNrG1i7CFVy.jpg.jpg 11KB
-
shared/05t758s5yo0q.dll.dll 386KB
-
shared/Guidelines_2021-04-26.pdf.pdf 1.1MB
-
shared/IMG_20230314_064553.jpg.jpg 1.9MB
-
shared/Meeting Notes v3.0.docx.docx 343KB
-
shared/NetworkManager.log1.1MB
-
shared/api-77504.dll.dll 3.9MB
-
shared/bundle_20230422_093945.zip.zip 569KB
-
META/salt.bin24KB
-
data/05h103lxq7so.dat171KB
-
data/2903vir.log12KB
-
data/fs9hcqadqm.txt6KB
-
data/jgexvz.txt4KB
-
data/la9dx0z.txt195KB
-
data/q2mwso2anrn0.cfg76KB
-
data/sechcc0.log.bat 1.0MB
-
shared/hlxicv6y3.ttf1.3MB
-
shared/package_20240116_161335.msi.msi 440KB
-
shared/sqlite3207.dll.dll 958KB
-
shared/system.4.log1.3MB
-
shared/v1cdwua.dll.dll 561KB
Faktur Pajak.JPG .exe
- IMPHASH e1f0fd081f41c8daeeeaa6e5a3fab665
- SHA256 7db39951df5698d13cdb7126fdce8ffdeb521698ab8f6369aba7755e2c120bb9
- MD5 5d26f9bd04cd18129608f466ec7e8280
- SHA1 c0deae43cbecc7e9bdb11061b8ba1f538b1bb128
- SHA512 1812e638b3d3febb2f9ac9c9bf4334c27c5e724162f443c1bbb2eacc161fcb96ec130fd99a1be9b41f7fd8e76132b8a64be422bc5985bafa810b13c556056f4c
- SSDEEP 393216:3y5mIlOWMNkbp97hJZs34yTguclOgJCet1n52RTm9V7NoNgc1:C5Nkk9fTSTHclFtPcV
- TLSH T18537C01663F800A2DA37527CE26B1719A23374152326A1DB3379F13C6EFA6D49B7B740
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
51448
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyW
RegEnumValueW
RegQueryValueExW
RegSetValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCreateKeyExW
RegOpenKeyExW
shell32
SHGetPathFromIDListW
SHGetFileInfoW
SHFileOperationW
SHBrowseForFolderW
ShellExecuteExW
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
IIDFromString
CoCreateInstance
comctl32
ImageList_Create
ord17
ImageList_Destroy
ImageList_AddMasked
user32
PeekMessageW
DispatchMessageW
wsprintfA
SystemParametersInfoW
LoadCursorW
SetClassLongW
GetWindowLongW
GetSysColor
ScreenToClient
SetCursor
GetWindowRect
TrackPopupMenu
AppendMenuW
EnableMenuItem
CreatePopupMenu
GetSystemMenu
GetSystemMetrics
IsWindowEnabled
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
CheckDlgButton
EndDialog
DialogBoxParamW
IsWindowVisible
SetWindowPos
CreateWindowExW
SendInput
RegisterClassW
CallWindowProcW
GetMessagePos
CharNextW
ExitWindowsEx
SetWindowTextW
SetTimer
CreateDialogParamW
DestroyWindow
LoadImageW
FindWindowExW
SetWindowLongW
InvalidateRect
ReleaseDC
GetDC
SetForegroundWindow
EnableWindow
GetDlgItem
ShowWindow
IsWindow
PostQuitMessage
SendMessageTimeoutW
SendMessageW
wsprintfW
FillRect
GetClientRect
EndPaint
BeginPaint
DrawTextW
DefWindowProcW
SetDlgItemTextW
GetDlgItemTextW
CharNextA
CharPrevW
MessageBoxIndirectW
GetClassInfoW
gdi32
DeleteObject
CreateFontIndirectW
CreateBrushIndirect
GetDeviceCaps
SelectObject
SetBkMode
SetTextColor
SetBkColor
kernel32
LCMapStringW
GetProcessHeap
VirtualProtect
InitializeCriticalSectionEx
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetStringTypeW
GetFileType
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
HeapSize
IsValidCodePage
FindFirstFileExW
HeapFree
HeapAlloc
GetModuleHandleExW
GetStdHandle
OutputDebugStringA
OutputDebugStringW
GetCurrentThread
LocalFree
LocalAlloc
RaiseException
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RtlUnwind
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
MoveFileExW
lstrcatW
lstrcpyA
lstrcmpiA
GetProcAddress
GetModuleHandleA
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
GetACP
ExpandEnvironmentStringsW
SetCurrentDirectoryW
SearchPathW
CompareFileTime
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetFullPathNameW
GetShortPathNameW
ReadFile
SetFileAttributesW
SetFilePointer
SetFileTime
CloseHandle
Sleep
FreeLibrary
GetModuleHandleW
LoadLibraryExW
GlobalAlloc
GlobalFree
MulDiv
lstrcmpW
lstrcmpiW
lstrlenA
GetPrivateProfileStringW
WritePrivateProfileStringW
MoveFileW
MultiByteToWideChar
GetFileSize
GetLastError
GetTickCount
GetModuleFileNameW
GetCommandLineW
SetEnvironmentVariableW
GetTempPathW
SetErrorMode
GetCurrentProcess
ExitProcess
GetWindowsDirectoryW
GetVersionExW
FreeResource
LoadResource
LockResource
SizeofResource
FindResourceW
CopyFileW
GetDiskFreeSpaceW
CreateThread
GlobalUnlock
GlobalLock
lstrcpynW
lstrlenW
WideCharToMultiByte
CreateDirectoryW
CreateFileW
GetTempFileNameW
RemoveDirectoryW
WriteFile
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
GetSystemDirectoryW
DecodePointer
Name
.text
Size
127KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
7.8MB
Virtual Size
7.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=33140,
count=142, id=261, version=33140,
count=2, productName=Unmarked objects (old),
count=20, id=259, version=35207,
count=17, id=260, version=35207,
count=41, id=261, version=35207,
count=21, id=260, version=33140,
count=1, id=262, version=33140,
count=15, id=257, version=33140,
count=241, id=1, productName=Unmarked objects,
count=12, id=260, version=35213,
count=1, id=255, version=35213,
count=1, id=151,
count=1, id=258, version=35213,
$TEMP/20260909_135136_246415_photo_AQADCxNrG1i7CFVy.jpg
- SHA256 10cadaae66ce15c241a779330e5afb8e00bb312015dd9849abb7bc4870846b41
- MD5 49f8d51aa4731ccaac1beee30a85860b
- SHA1 fa58d52aa90b10c45ae57960955657b85cafbca5
- SHA512 6f4d481a9a9b511a546230c063b4ed712955d71618a37c526e6366287d08b751379f34886aeb6abf1e1c714fe180ff47a9fb5fd5de087711987e7590b9810da7
- SSDEEP 192:41jlp3M/resl+/pqzSPQlGonqy/HqJPrP/rvSBGW4wEImT8Qupya7eU4OT3AHvUD:41jlNM/rDz8i/G7rvUG1Pw3b7KS3AHJo
- TLSH T19B42BF9FC212C85A6D1A22B8B1D87598D0E5F6F69447F57CC1B7AD28D3170F2F18D102
- MD5 SHA1 SHA512 SSDEEP TLSH
shared/05t758s5yo0q.dll
- IMPHASH 379e4eaa15aabf7f0d46ccc0e0eb561d
- SHA256 729d8da016206c763ede8723cc057cf0381e42deb6653061d33481883720daa1
- MD5 3c435578212865341f81f33759127618
- SHA1 f3c698e035d5e96d3e9731143ab5269a8f1f8bc2
- SHA512 4ebdf5bd4e239d0915a09601e9f6109c3915446d5f7d4918a9daa4d7ea387e751bf66a02170fafc3548e648ad5f1b39ca5ac74f098049d2eb371ea38e2ef4b94
- SSDEEP 6144:BK9XAT/2R6UJx66UYxopfoS9RD7gzuhZFhXJdyOdMpM2gKg0:BK9wTC68x66topfoSvD7gzuh1ZrOpa
- TLSH T199845A1DA2BC4095D46AC17CC95746B9A672BC288B4315CB10A0FE7D7F3BEE5AA74F00
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
15520
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
umrdp.pdb
msvcrt
wcschr
rand
srand
time
memcpy_s
_vsnwprintf
_purecall
wcsstr
_initterm
_wcsicmp
memcpy
_unlock
__C_specific_handler
wcsrchr
malloc
_callnewh
_lock
free
_XcptFilter
_amsg_exit
__CxxFrameHandler3
memmove
_onexit
__dllonexit
memset
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetVersionExW
GetSystemWindowsDirectoryW
GetTickCount
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
DeleteCriticalSection
CancelWaitableTimer
ResetEvent
WaitForSingleObject
SetWaitableTimer
SetEvent
CreateEventW
InitializeCriticalSection
EnterCriticalSection
WaitForMultipleObjectsEx
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExA
GetProcAddress
LoadStringW
FreeLibrary
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
OpenThreadToken
GetCurrentProcessId
CreateThread
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-security-base-l1-1-0
CheckTokenMembership
GetSidSubAuthorityCount
IsValidAcl
AllocateAndInitializeSid
GetSidIdentifierAuthority
CreateWellKnownSid
GetSidSubAuthority
GetLengthSid
IsValidSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ImpersonateLoggedOnUser
RevertToSelf
EqualSid
FreeSid
AddAccessAllowedAceEx
CopySid
GetTokenInformation
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
HeapReAlloc
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
api-ms-win-core-io-l1-1-0
DeviceIoControl
GetOverlappedResult
api-ms-win-core-file-l1-1-0
ReadFile
GetFileSize
CreateFileW
DeleteFileW
WriteFile
QueryDosDeviceW
api-ms-win-core-io-l1-1-1
CancelIo
api-ms-win-core-synch-l1-2-1
CreateWaitableTimerW
api-ms-win-core-registry-l1-1-0
RegOpenUserClassesRoot
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyExW
RegQueryValueExW
RegGetValueW
RegCloseKey
RegDeleteValueW
RegNotifyChangeKeyValue
RegOpenCurrentUser
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
ntdll
RtlInsertElementGenericTable
RtlMultiByteToUnicodeN
EtwEventWriteFull
EtwTraceMessage
NtCreateFile
EtwEventWrite
RtlOpenCurrentUser
RtlNtStatusToDosError
NtMakePermanentObject
NtMakeTemporaryObject
NtClose
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
NtCreateSymbolicLinkObject
RtlInitUnicodeString
NtQueryInformationProcess
EtwEventActivityIdControl
DbgPrint
RtlEnumerateGenericTable
RtlInitializeGenericTable
RtlDeleteElementGenericTable
RtlLookupElementGenericTable
RtlEnumerateGenericTableWithoutSplaying
EtwEventRegister
RtlGetSuiteMask
EtwEventUnregister
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
advapi32
EventActivityIdControl
TraceMessage
user32
UnregisterDeviceNotification
PostMessageW
DispatchMessageW
PeekMessageW
MsgWaitForMultipleObjectsEx
PostThreadMessageW
UnregisterClassW
RegisterClassExW
GetClassInfoExW
DestroyWindow
CreateWindowExW
DefWindowProcW
RegisterDeviceNotificationW
winspool.drv
SetPrinterW
DeletePrinter
ClosePrinter
FindFirstPrinterChangeNotification
FindClosePrinterChangeNotification
FindNextPrinterChangeNotification
OpenPrinterW
EnumPrintersW
SetPrinterDataW
GetPrinterDataW
ord203
GetPrinterW
EnumPrinterDriversW
FreePrinterNotifyInfo
kernel32
TlsSetValue
SleepEx
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
InitializeCriticalSectionEx
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolCleanupGroup
SetThreadpoolThreadMaximum
CreateThreadpool
CloseThreadpool
CloseThreadpoolCleanupGroup
CancelIoEx
WaitForMultipleObjects
GetThreadId
ResumeThread
ProcessIdToSessionId
ReadFileEx
GetModuleHandleW
QueueUserAPC
WaitForSingleObjectEx
lstrcmpiW
DeleteTimerQueueTimer
CreateTimerQueueTimer
FreeLibraryAndExitThread
GetProcessHeap
GetModuleHandleExW
GetTickCount64
ReleaseSemaphore
VerifyVersionInfoW
UnregisterWait
TlsAlloc
GetSystemInfo
SwitchToThread
CreateSemaphoreW
TlsGetValue
TlsFree
OpenThread
api-ms-win-devices-config-l1-1-1
CM_Get_DevNode_Status
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventUnregister
EventWriteTransfer
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
newdev
DiUninstallDevice
ServiceMain
SvchostPushServiceGlobals
Name
.text
Size
252KB
Virtual Size
252KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=60, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=18, id=260, version=26213,
count=3, id=259, version=26213,
count=383, id=1, productName=Unmarked objects,
count=19, id=257, version=26213,
count=4, id=261, version=26213,
count=1, id=256, version=26213,
count=100, id=270, version=26213,
count=1, id=255, version=26213,
count=1, id=258, version=26213,
shared/Guidelines_2021-04-26.pdf
- SHA256 10dfbb2b997d61f62f685c8d2fbb43532f1b323b27507bdf70731858cc6f6e69
- MD5 e1f4cf45612a3c024859c4081b87a350
- SHA1 a243d39342951f45dbc399a24626be293bfc8e1b
- SHA512 3424a0421bb278d3bd2a9e5a4ddafe55f59763efc0e37930cf0d44b64fe90a3fe9fd0cc63464f7dccc900ab7d06656476d10820d29023c79023251a10a32c92f
- SSDEEP 24576:tRJYBIu5eiTOL3mijVnjRxoN7IyPgJv7o:tTUI0e6O1jVjRmJIy4xo
- TLSH T1B7358D6B67AD00E8C17AC078866B970BF7B2745543306BCF067686A6DF2BBE1553E310
- MD5 SHA1 SHA512 SSDEEP TLSH
shared/IMG_20230314_064553.jpg
- SHA256 6a36e9b3479556977302afcbb82f8d1b180bfb9a40369beae80c6cb5698ee9d3
- MD5 e02619de03ad30ac29eb9a25938f3e1d
- SHA1 91c44b3a00692805bb42ed67e922288141cbbc3e
- SHA512 4e6dc9c655f4350dd11d42901647cb5faec5dc2051201aaa27b51929e8dc5aecba70fca087b990f2ad8bc82296f06679dbbafe0598b60f6166bc4ebaa67b0431
- SSDEEP 49152:x4ICiiVXdTXOtKgsmfJHtgYcn8hnTVqurfa7V+BVVdc:liVXdLOtDJHu5nenTkEWsBVnc
- TLSH T12B95AD16EDFA5F17E83A4B7D82F75224B938C56DE7538B07221CB2383452778168B368
- MD5 SHA1 SHA512 SSDEEP TLSH
shared/Meeting Notes v3.0.docx
- SHA256 de43c79e2b4e8454a5a0f0ebca92b91851642bacd2f71f3bfe0c976a6948b55f
- MD5 a98f0a9063d3475662c62a6de4e4ac7a
- SHA1 feb281ccc7d0a7024228f72381af809e6bcf3098
- SHA512 c49d19c2d27381e5beb74c3c0b699a27e98ab6958c24bbeb258b47e82b54e60d50eee4ca89c6a1f38100e19b0bcbb434866e231d587a0cecf1423d2af151d0f3
- SSDEEP 6144:Axrat8VkhTfdH2B6AVA4+yzcvuuPRFXVLkj+2N0mLsQ5K39LGPhh:jwGdW8AVJzcVPvX0tstyL
- TLSH T1B27423C2A80A3652D2D9A837DD99BD07A10822A4B77313C7D419AC7293965DFB02FC5E
- MD5 SHA1 SHA512 SSDEEP TLSH
shared/NetworkManager.log
- SHA256 e313f6786f9dc262f734f0be430e01ed2a1a3eab3bbb50bbacaeb0e64831dd95
- MD5 c9ce602c98921534fd8011bceaa8a1d4
- SHA1 eed55d4cddd16b19df5e7113068d6b43d982e5d3
- SHA512 80385271b85affe392d29f046b124fcc3071ab1f92cc8568e13c2aa2ec28fba9b3b1465faf4024b37781ead75afe13be53539e5db866d0107439ba4d3fa7781f
- SSDEEP 3072:IXjDyMlI0r1EUJtOGDW5Sa/DLMkvNB+bTgqRL8aT07VnU/i/eVoFUbYlKKmOI+md:8S0RGv/DcCWK5qYlKwDjo
- TLSH T1A435416613F100321F57435DFA9A2F593613B245231F342437BEE26C5ADD428ABEB798
- MD5 SHA1 SHA512 SSDEEP TLSH
shared/api-77504.dll
- IMPHASH 3f085ce37eb71fb3fe430635cc1fc62a
- SHA256 446c1c35b470f23797802ec436502b2f7011820cbbfc72995b44095c77e519df
- MD5 27c60ea1ab495d5c4bbf1cd00f7f55c2
- SHA1 7e8d96ebe18992f4241d8ff47a24d91d41f086d3
- SHA512 50641ec4840347db4ec70c36c35d9d70637653e704930643046b4c3e8e39c0a1104b4c43df0fba112fbd2e73084b8e7fa909c8dcfc8a53734b82d96570d7777a
- SSDEEP 49152:ZgEr/Ybluil79UAmBMB3JH+UDmnosIScT9t03LNeJtMNIdNRez/ubrU5QJuwUySo:PnLt279eCJ099p
- TLSH T1E0165C6E2BEC41A6C17AD278C5AB4746E2717C262B7186CF0121A17E4F3BBD14B3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
487120
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
EdgeContent.pdb
msvcp_win
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
_Strxfrm
_Strcoll
?is@?$ctype@D@std@@QEBA_NFD@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
_To_byte
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
??Bios_base@std@@QEBA_NXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
_To_wide
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
??0task_continuation_context@Concurrency@@AEAA@XZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
_Cnd_destroy_in_situ
_Cnd_init_in_situ
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Cnd_broadcast
_Cnd_wait
_Mtx_unlock
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?widen@?$ctype@G@std@@QEBAGD@Z
?id@?$ctype@G@std@@2V0locale@2@A
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
?setf@ios_base@std@@QEAAHHH@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
_Wcsxfrm
_Wcscoll
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
??1_Locinfo@std@@QEAA@XZ
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??0_Locinfo@std@@QEAA@PEBD@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?widen@?$ctype@_W@std@@QEBA_WD@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?uncaught_exception@std@@YA_NXZ
?flags@ios_base@std@@QEBAHXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?_Xbad_function_call@std@@YAXXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?id@?$collate@_W@std@@2V0locale@2@A
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?good@ios_base@std@@QEBA_NXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?_BADOFF@std@@3_JB
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Xout_of_range@std@@YAXPEBD@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
?_Xlength_error@std@@YAXPEBD@Z
?_XGetLastError@std@@YAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_Xbad_alloc@std@@YAXXZ
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-string-l1-1-0
wcslen
strncmp
wcsncmp
strlen
memset
wcscmp
wcsnlen
strcmp
api-ms-win-crt-private-l1-1-0
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__stricmp
_o__strnicmp
_o__ultow_s
_o__wcsicmp
_o__wcsnicmp
_o__wcstoui64
_o__wtof
_o__wtoi
_o__wtoi64
_o__wtol
_o_bsearch_s
_o_ceil
_o_floor
_o_fputs
_o_free
_o_isalpha
_o_isdigit
_o_isspace
_o_iswspace
_o_isxdigit
_o_malloc
_o_memcpy_s
_o_realloc
_CxxThrowException
_o_strtol
_o_strtoull
_o_terminate
_o_toupper
_o_towlower
_o_towupper
_o_wcscat_s
_o_wcscpy
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstod
_o_wcstok_s
_o_wcstol
_o_wcstoul
_o_wmemcpy_s
__C_specific_handler
_o__itow_s
__std_type_info_compare
memchr
_o__execute_onexit_table
_o__errno
memcmp
wcsstr
wcschr
memcpy
wcsrchr
memmove
strchr
_o__crt_atexit
_o__configure_narrow_argv
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__cexit
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___stdio_common_vfwprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___acrt_iob_func
__std_terminate
__CxxFrameHandler3
iertutil
ord100
ord76
ord74
ord89
ord796
IntlPercentEncodeNormalize
ord81
ord594
ord65
ord49
ord70
ord63
CreateUri
ord68
ord398
CreateIUriBuilder
ord820
ord59
ord231
ord97
ord791
ord64
ord79
ord32
ord681
ord88
ord85
ord58
ord793
ord232
ord690
ord62
ord57
ord61
ord302
ord140
ord80
ord78
ord795
ord301
ord792
ord144
ord854
ord688
ord595
ord794
ord851
ord86
ord45
ord852
ord314
ord312
ord311
ord66
ord87
ord91
ord597
ord56
ord855
ord685
ord138
ord656
ord661
ord651
ord655
ord102
ord650
ord658
ord652
ord654
ord172
ord82
ord77
ord134
ord67
ord870
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoOriginateError
SetRestrictedErrorInfo
RoTransformError
GetRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
IsErrorPropagationEnabled
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoActivateInstance
RoUninitialize
RoGetActivationFactory
api-ms-win-downlevel-advapi32-l1-1-0
GetTokenInformation
DuplicateToken
EventProviderEnabled
RevertToSelf
IsValidSid
InitializeAcl
GetLengthSid
CheckTokenMembership
OpenThreadToken
RegQueryInfoKeyW
RegDeleteTreeW
RegEnumKeyExW
TraceMessageVa
RegCreateKeyExW
OpenProcessToken
EventUnregister
RegGetValueW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
EventRegister
EventWriteTransfer
RegCloseKey
AddAccessAllowedAce
api-ms-win-downlevel-shlwapi-l1-1-0
PathFindFileNameW
StrCmpCW
PathIsUNCServerShareW
StrCmpW
StrRStrIW
StrStrIW
StrChrNW
StrChrW
StrCmpNICW
PathIsUNCServerW
StrCmpICW
StrTrimW
PathFindExtensionW
PathFileExistsW
StrCmpIW
PathFindExtensionA
StrStrIA
api-ms-win-core-kernel32-legacy-l1-1-0
WTSGetActiveConsoleSessionId
WaitForMultipleObjects
FindResourceW
LoadLibraryW
RaiseFailFastException
ntdll
NtQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
NtUpdateWnfStateData
RtlGetSuiteMask
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlSubscribeWnfStateChangeNotification
RtlIpv6AddressToStringW
RtlIpv4AddressToStringW
RtlCompareMemory
NtSetThreadExecutionState
RtlQueryTokenHostIdAsUlong64
RtlGetDeviceFamilyInfoEnum
RtlGetVersion
NtQueryInformationProcess
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
LoadLibraryExA
LoadLibraryExW
GetModuleHandleW
GetProcAddress
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleExW
GetModuleFileNameW
SizeofResource
LoadResource
LockResource
api-ms-win-core-synch-l1-1-0
CreateEventW
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
OpenEventW
DeleteCriticalSection
CreateMutexW
WaitForSingleObjectEx
CreateSemaphoreExW
InitializeCriticalSectionEx
CreateEventExW
InitializeSRWLock
CreateMutexExW
SetEvent
WaitForMultipleObjectsEx
ResetEvent
WaitForSingleObject
InitializeCriticalSection
ReleaseMutex
OpenSemaphoreW
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
ReleaseSemaphore
EnterCriticalSection
LeaveCriticalSection
api-ms-win-core-heap-l1-1-0
HeapReAlloc
HeapSize
HeapSetInformation
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError
RaiseException
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThread
TlsFree
GetCurrentProcessId
GetThreadPriority
GetProcessId
TlsSetValue
SetThreadPriority
TlsAlloc
CreateThread
GetCurrentThreadId
SetProcessShutdownParameters
TlsGetValue
GetCurrentProcess
OpenThread
api-ms-win-eventing-provider-l1-1-0
EventWriteEx
EventSetInformation
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetLocaleInfoW
GetLocaleInfoEx
ResolveLocaleName
LocaleNameToLCID
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
TrySubmitThreadpoolCallback
CloseThreadpoolWork
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
CreateThreadpoolWork
CloseThreadpool
CreateThreadpool
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
SetThreadpoolThreadMaximum
CreateThreadpoolCleanupGroup
WaitForThreadpoolTimerCallbacks
oleaut32
SafeArrayDestroy
VariantCopy
BSTR_UserFree
SafeArrayGetDim
SafeArrayGetUBound
VarDateFromStr
SysAllocStringLen
SafeArrayAccessData
SysFreeString
SysAllocString
SysStringLen
SafeArrayUnaccessData
SafeArrayCreateVector
SafeArrayPutElement
BSTR_UserSize
SysAllocStringByteLen
SafeArrayCopy
SafeArrayGetElemsize
SafeArrayGetLBound
SysStringByteLen
SafeArrayCreate
VariantChangeType
VariantInit
VarBstrCmp
LoadRegTypeLi
LPSAFEARRAY_UserSize64
VARIANT_UserUnmarshal64
VARIANT_UserFree64
LPSAFEARRAY_UserMarshal
LPSAFEARRAY_UserUnmarshal64
VARIANT_UserMarshal
LPSAFEARRAY_UserMarshal64
VARIANT_UserSize
LPSAFEARRAY_UserFree64
VARIANT_UserUnmarshal
VARIANT_UserFree
LPSAFEARRAY_UserUnmarshal
VariantClear
LoadTypeLi
SetErrorInfo
SysReAllocStringLen
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserSize
VARIANT_UserMarshal64
VARIANT_UserSize64
BSTR_UserUnmarshal64
BSTR_UserMarshal64
BSTR_UserSize64
BSTR_UserFree64
BSTR_UserMarshal
BSTR_UserUnmarshal
api-ms-win-core-synch-l1-2-0
WakeConditionVariable
SleepConditionVariableCS
InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize
Sleep
InitializeConditionVariable
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-processthreads-l1-1-1
OpenProcess
GetProcessMitigationPolicy
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemTime
GetLocalTime
GetComputerNameExW
GetSystemDirectoryW
GetSystemInfo
GetTickCount64
GetVersionExW
GetLogicalProcessorInformation
GetTickCount
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
CompareStringEx
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-processthreads-l1-1-3
SetProcessInformation
SetThreadDescription
api-ms-win-rtcore-ntuser-private-l1-1-7
IsOneCoreTransformMode
api-ms-win-core-memory-l1-1-0
VirtualAlloc
OpenFileMappingW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
VirtualQuery
VirtualProtect
windows.storage
SHGetInstanceExplorer
SHGetSpecialFolderPathW
SHGetKnownFolderPath
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient8
ObjectStublessClient6
ObjectStublessClient5
ObjectStublessClient13
ObjectStublessClient7
ObjectStublessClient3
ObjectStublessClient11
ObjectStublessClient14
ObjectStublessClient12
ObjectStublessClient10
ObjectStublessClient4
NdrProxyForwardingFunction4
ObjectStublessClient25
CStdAsyncStubBuffer_Release
ObjectStublessClient26
NdrProxyForwardingFunction3
NdrProxyForwardingFunction6
CStdStubBuffer2_Disconnect
NdrProxyForwardingFunction11
CStdAsyncStubBuffer_Connect
CStdStubBuffer2_QueryInterface
CStdAsyncStubBuffer_AddRef
CStdAsyncStubBuffer_Invoke
NdrProxyForwardingFunction5
ObjectStublessClient17
CStdAsyncStubBuffer_QueryInterface
NdrProxyForwardingFunction10
NdrProxyForwardingFunction9
ObjectStublessClient22
ObjectStublessClient27
NdrProxyForwardingFunction7
CStdStubBuffer2_Connect
ObjectStublessClient31
ObjectStublessClient30
ObjectStublessClient29
ObjectStublessClient16
ObjectStublessClient18
ObjectStublessClient21
ObjectStublessClient28
ObjectStublessClient20
ObjectStublessClient15
ObjectStublessClient23
ObjectStublessClient9
NdrProxyForwardingFunction8
ObjectStublessClient19
CStdStubBuffer2_CountRefs
ObjectStublessClient24
CStdAsyncStubBuffer_Disconnect
api-ms-win-core-url-l1-1-0
UrlCanonicalizeW
UrlIsW
UrlApplySchemeW
ParseURLW
GetAcceptLanguagesW
UrlEscapeW
PathCreateFromUrlW
UrlUnescapeW
UrlCanonicalizeA
api-ms-win-core-windowserrorreporting-l1-1-1
WerRegisterAdditionalProcess
WerRegisterCustomMetadata
api-ms-win-core-windowserrorreporting-l1-1-0
WerRegisterRuntimeExceptionModule
WerUnregisterRuntimeExceptionModule
WerSetFlags
api-ms-win-core-job-l2-1-0
QueryInformationJobObject
CreateJobObjectW
SetInformationJobObject
AssignProcessToJobObject
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-downlevel-shlwapi-l2-1-0
IStream_WriteStr
SHCreateStreamOnFileEx
IStream_Write
SHStrDupW
IStream_Size
IStream_Read
SHGetValueW
SHCreateMemStream
IStream_Reset
api-ms-win-downlevel-user32-l1-1-0
CharLowerW
api-ms-win-downlevel-shell32-l1-1-0
SetCurrentProcessExplicitAppUserModelID
api-ms-win-core-kernel32-legacy-l1-1-1
PowerSetRequest
PowerCreateRequest
PowerClearRequest
api-ms-win-core-heap-obsolete-l1-1-0
GlobalUnlock
LocalReAlloc
LocalAlloc
LocalFree
GlobalFree
GlobalAlloc
GlobalLock
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
GetSystemDefaultLocaleName
EnumUILanguagesW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpA
api-ms-win-core-file-l1-1-0
GetFileSize
FileTimeToLocalFileTime
CreateDirectoryW
FindClose
ReadFile
SetFilePointer
FindNextFileW
WriteFile
SetFilePointerEx
LocalFileTimeToFileTime
CompareFileTime
GetFileTime
CreateFileW
DeleteFileW
GetFileAttributesW
FindFirstFileW
GetFullPathNameW
GetLongPathNameW
GetFileSizeEx
GetTempFileNameW
RemoveDirectoryW
api-ms-win-core-file-l1-2-0
GetTempPathW
CreateFile2
rpcrt4
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
NdrCStdStubBuffer2_Release
NdrCStdStubBuffer_Release
IUnknown_QueryInterface_Proxy
NdrStubForwardingFunction
RpcRaiseException
NdrGetUserMarshalInfo
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
NdrClientCall3
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrStubCall3
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
NdrDllGetClassObject
api-ms-win-core-com-l1-1-0
CoGetCallerTID
CoGetCallContext
CoRegisterPSClsid
api-ms-win-core-processenvironment-l1-1-0
SetEnvironmentVariableW
GetCurrentDirectoryW
ExpandEnvironmentStringsW
api-ms-win-core-path-l1-1-0
PathAllocCombine
PathCchAddBackslash
PathCchAppend
PathCchCombine
PathCchCanonicalize
api-ms-win-core-file-l2-1-0
CopyFile2
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
api-ms-win-power-base-l1-1-0
PowerDeterminePlatformRoleEx
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
GetNativeSystemInfo
api-ms-win-core-io-l1-1-0
CancelIoEx
CreateIoCompletionPort
GetQueuedCompletionStatus
GetOverlappedResult
api-ms-win-core-realtime-l1-1-0
QueryUnbiasedInterruptTime
api-ms-win-crt-math-l1-1-0
ceilf
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-registry-l2-1-0
RegEnumKeyW
api-ms-win-security-base-l1-2-0
CheckTokenCapability
api-ms-win-core-psapi-l1-1-0
K32GetProcessMemoryInfo
K32GetProcessImageFileNameW
K32EnumProcesses
userenv
GetAppContainerFolderPath
GetAppContainerRegistryLocation
api-ms-win-core-io-l1-1-1
CancelIo
api-ms-win-security-base-l1-1-0
ImpersonateLoggedOnUser
api-ms-win-security-isolatedcontainer-l1-1-0
IsProcessInIsolatedContainer
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
IEGetWriteableFolderPath
IEIsInPrivateBrowsing
IEIsProtectedModeProcess
IERefreshElevationPolicy
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.wpp_sf
Size
512B
Virtual Size
53B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
28KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
136KB
Virtual Size
136KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ssm_url
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
85KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=144, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=56, id=260, version=26213,
count=5, id=259, version=26213,
count=20, id=261, version=26213,
count=2340, id=1, productName=Unmarked objects,
count=9, id=257, version=26213,
count=1, id=256, version=26213,
count=601, id=270, version=26213,
count=1, id=253, version=26213,
count=1, id=255, version=26213,
count=1, id=258, version=26213,
shared/bundle_20230422_093945.zip
- SHA256 dc7654a3d6da4328013798b6ffa8de251435edc295e058c2d5dcb59ae98766a1
- MD5 1397392c304698a1479c61e62b6c6f4b
- SHA1 0997332412efa7778b54331186fa452a57157859
- SHA512 b6729a22839d31d2f4e1884e587aa533e5939ed7074e32d97d9db4fc1629c587f048ccfc51ad485894cdb8fb790ff072d955b208afba58178815e91b3885d2c6
- SSDEEP 12288:8GXogzYVqWYxBi5AaskHwbQcQ2QDWxOv1T9r+F8FyzjO5jjNXL:HogzXWYxg5AasS4Ex9iF6Gy5fFL
- TLSH T1E0C42342116AA56AF37FE2BC9AE41C83B8C25D4601BE1D5AD7034F87FE55A34C60CF86
- MD5 SHA1 SHA512 SSDEEP TLSH
META/salt.bin
- SHA256 199c55786486647a67e52f40048ab42d338991ade4dc3e82f43dcdc8b34f05c7
- MD5 b9bb677ec1f4683540fabec24c875087
- SHA1 7f74570063b179b73f9614f90c7fcbaea66b77d9
- SHA512 b15b5852bb8291d4055e21dbae228a54a4821a215cd027c65930f88203e3a91394a73472f66f21e0fe8c7cb29889afd52ab3a47eebb098862839b1cf563a5458
- SSDEEP 768:xziV66Nj8dL2F3GEqDk8GbWNs5u8nYJEj:8UwQdiOGYsq0
- TLSH T1DFB2E19542450857397B1B74F206444902592A8DEDC3BA24EE12770B7BCEE571F06FE3
- MD5 SHA1 SHA512 SSDEEP TLSH
data/05h103lxq7so.dat
- SHA256 0218b9b2847e1f84ab5960d63692c172e43f66220490368cc336fafca7fb374a
- MD5 502e45c8464ce16208078825a61bd36f
- SHA1 0b64a0d602e30d0b1f8d6096a177200bc031816f
- SHA512 710df8fbb354e5b79abdd5c11cd4f947f9f7129cd73734711fccfc5a451c00442382eb04715f143e94d1806530126c2b0437ebe3406549da46dc0e0b74002fd6
- SSDEEP 3072:ePNFrGpuLAlUvvCzRsZ3nepgcZ6jdNnkA9U+yfCE8:8FrdE9zRsAO5jjnkkU+yfCE8
- TLSH T14904230312D6856BC3D7F28D97886562FCE12A4B41BA4F7C960B9C69C93FE34D608D89
- MD5 SHA1 SHA512 SSDEEP TLSH
data/2903vir.log
- SHA256 6e0eda73b9e9698839000eb6f18dbc4b05efc09c282885c37424384e13e84881
- MD5 1c8152cbd8cf05b70f124cdf558f26ca
- SHA1 5c7f3ef5d3c8a423865e070f460557aeb3b4ec92
- SHA512 699042ddd68de2810947eec8630275333a1389fb20fe8321fd26ab088fc575b5d3328ae2e71d71a70860aab03c28cbe59b148e86f19474129b54df47a9bb47ca
- SSDEEP 192:MLZu6ErNjpa8WaYviXoG1wgpAj1n6YkrHG9265JDorfxM9DeYiTk53z+NJ3:Es66jXf+gs1WrHVwkr5MbiTm3z+NJ3
- TLSH T1B942C19BD28EA36246E235F3190DA8DDFB5AA03C1BE5D47424E9D02037419796B6F2F0
- MD5 SHA1 SHA512 SSDEEP TLSH
data/fs9hcqadqm.txt
- SHA256 e723885f948c21897a75fc0c456fb0a9efa214cec634eda0cb1ed57427ecc9b1
- MD5 427c61f6b0f4b66730d624e6b417d761
- SHA1 941d78a9084353ff90be833e1830572f92c9a3a9
- SHA512 049fa257572372f891ceb44ef098da55f944ef63722046f5d5b8bd145decffae52cbc034f9ba17d89ff4d0a25797c577097bbf28bd8e109581147247d7867e52
- SSDEEP 96:PO2Jlq3AOgohbwLQvOQMqWAyzSpNUfnY8VD1xfwwPwrFH1NdH0K8IoDzZ:BJEfgohbwRQ9WAhNUPY+DzfDPo9eZ
- TLSH T107D1BCDBD2CDA36641F236F7290D548AFB2AA03C0BA1D53528F9D0203751D39676E3E4
- MD5 SHA1 SHA512 SSDEEP TLSH
data/jgexvz.txt
- SHA256 26709f5d838a4e95653d65e3483f1b63381928051419524d5d276e21bb09766a
- MD5 8973d758abc9da9c914b8884f72ec60c
- SHA1 9436a1ea60f3b3498c94112fb9a7a6002c4c2c84
- SHA512 c9fa4ad23bc6103b7049bf9ae2ad4d029be7984eb75626e76ced478244c1f2c324cb5eb2f58dbf84b774340208f3d568e8d4c59c80dd0e765a3d5f33d05c5466
- SSDEEP 96:uWzNIU4r08PdTMwj5RwzNhOjqwJnuye/U0htAIdZo:HpFEdzRwvOjfPYy
- TLSH T1CA918E5BE28AA37711E375F25A0D8899FB6EE03C1B92D07125EAD0203741D78672F2B4
- MD5 SHA1 SHA512 SSDEEP TLSH
data/la9dx0z.txt
- SHA256 2926bf19ae283fd6cb1634dbe60546a38d1816a2a2269456a22988bda0703e7b
- MD5 e0672730c28aad483ae6aafda3875dc3
- SHA1 31d760595630a431c3da8b40fe6115e904dee20e
- SHA512 0f319372bc87dee5bf5d4459bebe5b1b952e187a3c3defc900bdbccf7d51f1df2a383e2a5bb536398063f9c86006c63daf5b31352cb3850b147a5727ad7f6a51
- SSDEEP 3072:FCmusmOK7vyMPmgXe9X+ISwXpf1N0uYAAwEEW6StiFm75YEyQWIlx8wRiqdigvL7:4lsQvmdXoDD3zdk1a
- TLSH T16714CF9BD6CEA36706E235E2190D9899FB2AA03C0BA5D53528FDD0203740D79676F3F4
- MD5 SHA1 SHA512 SSDEEP TLSH
data/q2mwso2anrn0.cfg
- SHA256 bde9883260650f0cde8c6a499f13bcb0a405780ab8c8ddd8ed42bde043013ecd
- MD5 23432c425a0484676c4dd6e1282b944e
- SHA1 54605e4bd26ab85572c66f72d776947c83fdff3e
- SHA512 c401797e9599b76a8eb1e31d25f7a75c7078e254a6e5c769a05b53fd03b66973e62aec0790b9967e16b35c374cf3711ff16799f57a2e5b1620098b4efcb0facd
- SSDEEP 1536:SsHddUR2HVRUtbqiz2OPh9Xm1xFBFXmQJ3iIsM:Ss9dUyVWtbqiaOPh9Xm1hl/J3i7M
- TLSH T1FF73C09BD6CEE36312E235E21A0D6899FB6E903C1BE1D53428FDD0203740979676E2F5
- MD5 SHA1 SHA512 SSDEEP TLSH
data/sechcc0.log
- SHA256 44170463f5a3e55e136a50441d5f4398e7063fa7bdccfc5da987cee0f99181ad
- MD5 66dde1041e6ad615a00a19872f680cbc
- SHA1 e425211effb0f92aba5f65cb8d03a823a290630c
- SHA512 23aebaa32b56530a2800850ea2baf1f11dc1a252fdb0463b56ec91c4376bb2f7591ad547d32f35ae3c705fe344f1a74e8eebcfa33eefd3b632883588352c1cf2
- SSDEEP 6144:nUknaPLvsYAFdFg6gLQwvN0wf+D5qX9Aq334BMw8YFxHAdQ3i9VuyyjMvCoTZ5dv:Ohti+fceGlPKZdDN7aq8tTS4Vg
- TLSH T19925CF9BD6CEE36246E235E21A0D58D9FB2AA03C0BA5D53528FDD0203740D79676E3F4
- MD5 SHA1 SHA512 SSDEEP TLSH
shared/hlxicv6y3.ttf
- SHA256 a4676a1dc708b536347f6885a0702b40ad3bce83b65db089a289773f68d09999
- MD5 8e22f6df31393fbfc9f1a985ef071cca
- SHA1 23bcb1b8cb00c495e89f4fe88fa00f7884b5fe3f
- SHA512 49405aca22fb2cafecfedaf209028e470615675c6a9d21d36ce7ab6cf2b12d15b3dfd6346befb468185294c75bce80afd114fe0a9828d212bd77d1db120efd65
- SSDEEP 24576:3blTlANREKFCTRElRNa/GzH61ZI5U8cB2YzAfG6c7U5m:hwBheZI5/YzKc7l
- TLSH T134559F05F382FB54D2277A79C07CD3955EB66818AB3AD31F5387F463A90A0E49CA43D8
- MD5 SHA1 SHA512 SSDEEP TLSH
shared/package_20240116_161335.msi
- SHA256 8e4495a4eb1810b4fcadfda78c655beb3949c2af08da6032e4f4ee07d251e206
- MD5 0c3593f7014b44993683257d7646f500
- SHA1 88a515c1c99a735005b812fbe901cbd376896c95
- SHA512 2a51900259c85629c7a79ad20bfff983bf8cd2b3406186270f1a4795b2459a9190240d7a13c41099937bbbaa9c7a084abe29802ffd4e4d99c3decb904eaabf72
- SSDEEP 6144:Rv2MeFRZp3x7uhKi6b+9NfG5CnBPPizT5BXw+3s3qUI:ROMeFRdaT6b8G5iPPOw+3JUI
- TLSH T142A4BE11B4C0843ADAFA09319439D630AEBDFE244B50C9DF9354B92E5E706C1AB73B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
37f66dac4d776cb1b35a80b9d5892d9d7861ec4d5ba3b8cdd32d17e1eba7157b
Digest Algorithm
sha256
Digest Matches
Trusted
Prehash
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 27, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 8, 2024 - Jun 23, 2035
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:86:e7:71:94:b9:4d:ff:09:fb:00:00:00:00:00:86
Issuer
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 8, 2025 - May 6, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:3605-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:b0:43:35:66:cf:af:95:e8:00:01:00:00:02:13
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
shared/sqlite3207.dll
- IMPHASH cdeba4dddc4cab9a685c3c0f0d5c5f35
- SHA256 c813a07c4c7c76892006106773cf0914ba7ae9a590a0a92c1d9761ed7aba3028
- MD5 8f2c53c30f0e57cf5f32c66cdf4953f5
- SHA1 a7fc90e49abb1c877450532dc27e9404964045d8
- SHA512 8d6d346a944a03d4a4116da564bc6f8c2ee0ade9adf5596efc548fdd81d5b1686b47fb9164f79772973ad8f51e0be02c71caa3d822181942c840aa883da07ca1
- SSDEEP 12288:bWDKQ3tGjk+eGt/d5+qM2YzStFFjKRiEHxSQu3XV6c4zNPObuilTDa/HsO:iDKQ3I9lX9m/xSXv4zNouilvIHs
- TLSH T1CF25089B11CB08EAE9ABF2F1376EBBE080174136161384C72B05D395F9312DF676BA45
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
828624
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mfmkvsrcsnk.pdb
msvcrt
isspace
_Strftime
_Gettnames
_isnan
_finite
_Wcsftime
??0exception@@QAE@ABQBDH@Z
_W_Gettnames
_W_Getmonths
__CxxFrameHandler3
memchr
_W_Getdays
_Getmonths
_Getdays
islower
_CxxThrowException
towlower
_free_locale
memcpy
_XcptFilter
tolower
_callnewh
_amsg_exit
_get_current_locale
_initterm
malloc
__mb_cur_max
sprintf_s
free
localeconv
??0exception@@QAE@ABQBD@Z
?what@exception@@UBEPBDXZ
strcspn
_wtoi
??0bad_cast@@QAE@ABV0@@Z
??0bad_cast@@QAE@PBD@Z
wcsncmp
_CIsqrt
qsort
memcmp
strncpy_s
strnlen
atoi
wcstombs_s
memmove_s
_wcsicmp
swscanf
__crtLCMapStringA
__crtLCMapStringW
__crtCompareStringA
??1bad_cast@@UAE@XZ
__crtCompareStringW
_wcsdup
?terminate@@YAXXZ
abort
ldexp
modf
_stricmp
_vsnprintf_s
__dllonexit
realloc
memset
_ismbblead
___mb_cur_max_func
calloc
___lc_codepage_func
_onexit
??1type_info@@UAE@XZ
memmove
??0exception@@QAE@ABV0@@Z
_except_handler4_common
_CIlog
isalnum
___lc_collate_cp_func
swscanf_s
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
memcpy_s
___lc_handle_func
isupper
__pctype_func
__uncaught_exception
setlocale
isdigit
_errno
_vsnwprintf
_unlock
_lock
_ftol2
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
FreeLibrary
DisableThreadLibraryCalls
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
ReleaseMutex
InitializeCriticalSectionEx
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
SetEvent
ReleaseSemaphore
CreateSemaphoreExW
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
EnterCriticalSection
ReleaseSRWLockShared
ReleaseSRWLockExclusive
WaitForSingleObject
InitializeSRWLock
AcquireSRWLockShared
CreateMutexExW
CreateEventW
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError
RaiseException
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
TraceMessage
api-ms-win-core-processthreads-l1-1-0
TlsGetValue
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
TlsSetValue
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetLocaleInfoW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoTransformError
oleaut32
VariantClear
VariantChangeType
SysAllocString
VariantInit
api-ms-win-core-com-l1-1-0
IIDFromString
CreateStreamOnHGlobal
CoGetMalloc
CoTaskMemFree
CoCreateInstance
PropVariantCopy
PropVariantClear
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
api-ms-win-core-winrt-string-l1-1-0
WindowsDuplicateString
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCompareStringOrdinal
WindowsConcatString
WindowsCreateStringReference
WindowsCreateString
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
GetStringTypeW
MultiByteToWideChar
CompareStringOrdinal
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
SleepConditionVariableSRW
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
propsys
InitPropVariantFromDoubleVector
PSStringFromPropertyKey
PSPropertyKeyFromString
InitPropVariantFromCLSID
InitPropVariantFromStringAsVector
PropVariantChangeType
StgDeserializePropVariant
StgSerializePropVariant
PSCreateMemoryPropertyStore
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
862KB
Virtual Size
861KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
15KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
140B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
71KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=259, version=26213,
count=255, id=1, productName=Unmarked objects,
count=5, id=257, version=26213,
count=69, id=260, version=26213,
count=1, id=256, version=26213,
count=47, id=265, version=26213,
count=21, id=261, version=26213,
count=1, id=255, version=26213,
count=1, id=258, version=26213,
shared/system.4.log
- SHA256 add0dd3a7dacb0b40fd39dcb06815de224e9592adf3a1edb86c5a3dde0c50ef8
- MD5 e9b1feacc720daa4f5dc38e1a1b652d6
- SHA1 2f1f75db15d9720d539ef8394f68b099ef993a75
- SHA512 10af1b2f736f3819d673713fe2fcf979966e0d2bd3ec5f00729c36127eba5dddd0c686fd3088359df5fe52e8fa317c5f198c353cf6bf6490a7a846767075c179
- SSDEEP 3072:hKGC5SA+DgoFNwGGG38ha6c+/Ilek3UE8gNQNbcnuGaHeiBJiSWDJWiOVoS1Jx2b:hUSvDLgC3wPBJCs/p7mPilyX+C
- TLSH T1AD55206662F900F21B17039EF65A6F1E06233247231FB0257BFEA16C56DD41CEBAB494
- MD5 SHA1 SHA512 SSDEEP TLSH
shared/v1cdwua.dll
- IMPHASH 0cb02882a54ef6aa39a178d938d1ef21
- SHA256 241a2f99ebe30a69572ef893a37cb92a2d84162cab08c8408e5d844c6fa6ac42
- MD5 b65c2be8d43e4b1aa28e7c0e999f1f67
- SHA1 237398d7d440ec6e79a161083cf386ef79e18f0d
- SHA512 58e8c19e31f294da9010183f1db5a6a6da322b0093a786d21c3ce75840b2e1e64d1d45050fd59d3a4feef535357dfb01b2318476691aad54dc6cd2d80f142acf
- SSDEEP 12288:lZ1sWCCtTQW2JdJLGbKY4GzrvR6mPtST9hvVj1zrEWQ:lZ1sWCCtTQWodJLGbKY4GzrZ6mPtST9K
- TLSH T196C43A62C6EC4264F5E7383A853E3634A8EED5650B7081C733C1D9D8EC786D45A3AB4B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
508736
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Windows.Graphics.Printing.pdb
msvcrt
memcmp
memcpy
ceil
_XcptFilter
_initterm
__CxxFrameHandler3
_ftol2_sse
_lock
_unlock
__dllonexit
_onexit
memmove
_amsg_exit
malloc
free
_vsnwprintf
memcpy_s
_set_errno
_get_errno
memmove_s
realloc
bsearch_s
_wcsicmp
wcsrchr
_callnewh
_except_handler4_common
_purecall
_ftol2
memset
rpcrt4
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
CStdStubBuffer_Disconnect
NdrCStdStubBuffer_Release
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
NdrStubCall2
NdrDllCanUnloadNow
NdrStubForwardingFunction
api-ms-win-core-com-l1-1-0
CoReleaseMarshalData
CoGetApartmentType
CoWaitForMultipleHandles
CreateStreamOnHGlobal
CoTaskMemAlloc
CoDecrementMTAUsage
CoIncrementMTAUsage
CoMarshalInterface
CoCreateGuid
CoGetMalloc
CoGetCallerTID
CoTaskMemFree
CoCreateInstance
CoGetCallContext
CoCreateFreeThreadedMarshaler
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
GetTraceEnableLevel
UnregisterTraceGuids
GetTraceEnableFlags
GetTraceLoggerHandle
RegisterTraceGuidsW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventActivityIdControl
EventRegister
EventUnregister
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleFileNameW
GetModuleFileNameA
LoadStringW
GetProcAddress
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
DisableThreadLibraryCalls
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-synch-l1-1-0
CreateMutexW
InitializeSRWLock
InitializeCriticalSectionEx
CreateEventW
ReleaseSemaphore
ReleaseMutex
SetEvent
CreateMutexExW
DeleteCriticalSection
ResetEvent
AcquireSRWLockShared
ReleaseSRWLockShared
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
CreateEventExW
CreateSemaphoreExW
OpenSemaphoreW
api-ms-win-core-synch-l1-2-0
SleepConditionVariableSRW
InitOnceBeginInitialize
InitializeConditionVariable
Sleep
InitOnceComplete
WakeAllConditionVariable
InitOnceExecuteOnce
SleepConditionVariableCS
InitOnceInitialize
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetProcessId
OpenProcessToken
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetLocaleInfoW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalReAlloc
LocalFree
oleaut32
SysAllocString
VariantClear
SysAllocStringLen
VariantInit
VariantChangeType
SysFreeString
ord448
ord445
ord446
ord447
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient11
CStdStubBuffer2_CountRefs
ObjectStublessClient22
ObjectStublessClient20
ObjectStublessClient15
ObjectStublessClient23
CStdStubBuffer2_Disconnect
ObjectStublessClient13
ObjectStublessClient8
ObjectStublessClient6
CStdStubBuffer2_QueryInterface
ObjectStublessClient19
NdrProxyForwardingFunction4
ObjectStublessClient7
ObjectStublessClient4
NdrProxyForwardingFunction5
ObjectStublessClient9
ObjectStublessClient5
ObjectStublessClient17
ObjectStublessClient10
ObjectStublessClient16
ObjectStublessClient21
NdrProxyForwardingFunction3
CStdStubBuffer2_Connect
ObjectStublessClient24
ObjectStublessClient25
ObjectStublessClient27
ObjectStublessClient28
ObjectStublessClient26
ObjectStublessClient29
ObjectStublessClient14
ObjectStublessClient3
ObjectStublessClient12
ObjectStublessClient18
shcore
SHCreateThread
CreateRandomAccessStreamOverStream
d2d1
ord1
api-ms-win-core-winrt-robuffer-l1-1-0
RoGetBufferMarshaler
combase
ord157
ord90
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Name
.text
Size
498KB
Virtual Size
498KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=62, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=26213,
count=20, id=260, version=26213,
count=269, id=1, productName=Unmarked objects,
count=11, id=257, version=26213,
count=7, id=261, version=26213,
count=1, id=256, version=26213,
count=56, id=265, version=26213,
count=1, id=255, version=26213,
count=1, id=258, version=26213,