agent-memory-3[.]1[.]0-windows-x86_64[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
agent-memory-3.1.0-windows-x86_64.zip
Size 18.5MB
Sample261102-gj4ntae18x
SHA256 e554d985abc7f32da04679d27c7eb5210861cf969ce89279cbc0b0c0d79fbd82
MD5 d63b2aa9960bb8ec3cbb578f25e7eb3c
SHA1 56f03d9c7f3e62c75fa2e5a40ad4f7fd85d243a1
SHA512 2d25b94ca9201fd185f32a55463a226080496166a3dcc0610a68fb3bb003be9f2a65fe7e995cd2a9237b12764d9f2a307b84e303e5a631a5864ee06e4843781f
SSDEEP 393216:lESITn0vKLybM79Ch5wQPttj08ai10essGylUZF1ef9DCOtj4UafVhxFRO4KUGic:evnDr9Q5w6Ft2yhRCOt2DxFXKCwT
TLSH
T1261733AEEC126D56BCC4E16FBB449FEAF27A021812FF39060A75DCD798014D09FB0569
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/agent-memory-3.1.0-windows-x86_64/memory-daemon.exe
unpack001/agent-memory-3.1.0-windows-x86_64/memory-ingest.exe
unpack001/agent-memory-3.1.0-windows-x86_64/memory-installer.exe
unpack001/agent-memory-3.1.0-windows-x86_64/memory.exe

File Explorer

agent-memory-3.1.0-windows-x86_64.zip

.zip 18.5MB
agent-memory-3.1.0-windows-x86_64/LICENSE

1KB
agent-memory-3.1.0-windows-x86_64/README.md

10KB
agent-memory-3.1.0-windows-x86_64/memory-daemon.exe

.exe 31.8MB
agent-memory-3.1.0-windows-x86_64/memory-ingest.exe

.exe 5.6MB
agent-memory-3.1.0-windows-x86_64/memory-installer.exe

.exe 2.7MB
agent-memory-3.1.0-windows-x86_64/memory.exe

.exe 8.1MB

agent-memory-3.1.0-windows-x86_64.zip

SHA256 e554d985abc7f32da04679d27c7eb5210861cf969ce89279cbc0b0c0d79fbd82
MD5 d63b2aa9960bb8ec3cbb578f25e7eb3c
SHA1 56f03d9c7f3e62c75fa2e5a40ad4f7fd85d243a1
SHA512 2d25b94ca9201fd185f32a55463a226080496166a3dcc0610a68fb3bb003be9f2a65fe7e995cd2a9237b12764d9f2a307b84e303e5a631a5864ee06e4843781f
SSDEEP 393216:lESITn0vKLybM79Ch5wQPttj08ai10essGylUZF1ef9DCOtj4UafVhxFRO4KUGic:evnDr9Q5w6Ft2yhRCOt2DxFXKCwT
TLSH
T1261733AEEC126D56BCC4E16FBB449FEAF27A021812FF39060A75DCD798014D09FB0569
MD5 SHA1 SHA512 SSDEEP TLSH

agent-memory-3.1.0-windows-x86_64/memory-daemon.exe

IMPHASH 951d4acd54c73bc2e24d9702763d3e2f
SHA256 86d2d71244a2dabac227ec8e9e99e82e296bdc465b6b9ece7e948f6bdbdc97f4
MD5 b879781c08eee0b754f93d1822cf95e3
SHA1 dbeefeb29f18cbad8a87504af4d0b2c83365fd8f
SHA512 41b6e77be5985bc0ea7f75a327a3b6c904a57edf674e42db9a55ff6b87bdd123fdd611c00118d5730d31bbef34b18c0da0f6c67c84f79162fc7dca4d2103ba0e
SSDEEP 196608:08JDSQRhkBbDzmpoUxFG5JtC+E7dXnJnI2cE394xTRqquNGz9En:08MaWKpoUxYqdXn539YTdBEn
TLSH
T1137739217A9E9C6CD15AC474834A8A735A3134EB0B35BAFF44D442363F6EAF45A3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23106080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

memory_daemon.pdb

kernel32

FlushFileBuffers FlushViewOfFile DuplicateHandle GetFileType CreateFileMappingW VirtualProtect MoveFileExW SetFileAttributesW GetDiskFreeSpaceExW LockFileEx SetWaitableTimer CreateWaitableTimerExW GetModuleHandleW GetConsoleOutputCP SetFileInformationByHandle InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared FindClose LocalFree FindFirstFileExW WriteConsoleW FindNextFileW GetCurrentProcessId GetCurrentProcessorNumber CreateDirectoryW DeleteFileW GetFileAttributesExW RemoveDirectoryW SetFilePointerEx SetFileTime DeviceIoControl GetCurrentThreadId GetSystemTimeAsFileTime MapViewOfFileEx CreateHardLinkW GetComputerNameA SetNamedPipeHandleState MultiByteToWideChar GetFileInformationByHandleEx SetConsoleCursorPosition FillConsoleOutputAttribute FillConsoleOutputCharacterA GetConsoleScreenBufferInfo GetStdHandle WriteFile TlsAlloc TlsGetValue lstrlenW TlsSetValue GetSystemInfo CreateFileMappingA MapViewOfFile VirtualAlloc CreateFileA UnmapViewOfFile VirtualFree SetConsoleMode GetConsoleMode CreateFileW CreateSymbolicLinkW GetTimeZoneInformationForYear GetModuleHandleA Sleep WakeAllConditionVariable SleepConditionVariableSRW FormatMessageW InitOnceBeginInitialize HeapAlloc InitOnceComplete GetLocaleInfoEx HeapFree GetProcessHeap CloseHandle WaitForSingleObject GetCurrentThread InitializeSListHead GetModuleFileNameW GetProcAddress GetFinalPathNameByHandleW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread ExitProcess CopyFileExW GetCommandLineW GetEnvironmentVariableW AddVectoredExceptionHandler GetEnvironmentStringsW GetFileInformationByHandle GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext CreateThread HeapReAlloc GetFullPathNameW SetLastError FreeEnvironmentStringsW FormatMessageA QueryPerformanceFrequency QueryPerformanceCounter GetCurrentDirectoryW RtlVirtualUnwind SetHandleInformation GetThreadId ReadConsoleW ReadFile SetConsoleTextAttribute GetQueuedCompletionStatusEx CancelIoEx GetOverlappedResult PostQueuedCompletionStatus SetFileCompletionNotificationModes CreateIoCompletionPort SetConsoleCtrlHandler GetLastError GetCurrentProcess SetThreadStackGuarantee SetUnhandledExceptionFilter

bcryptprimitives

ProcessPrng

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW RegOpenKeyTransactedW RegCreateKeyExW RegCreateKeyTransactedW SystemFunction036

ws2_32

select WSASend WSARecv getsockname accept getsockopt recv WSAStartup send WSASocketW bind listen shutdown getpeername closesocket getaddrinfo WSAGetLastError connect WSADuplicateSocketW setsockopt WSAIoctl WSACleanup freeaddrinfo ioctlsocket

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

secur32

EncryptMessage DeleteSecurityContext AcquireCredentialsHandleA QueryContextAttributesW ApplyControlToken AcceptSecurityContext InitializeSecurityContextW FreeContextBuffer DecryptMessage FreeCredentialsHandle

crypt32

CertGetCertificateChain CertVerifyCertificateChainPolicy CertDuplicateStore CertFreeCertificateContext CertDuplicateCertificateContext CertDuplicateCertificateChain CertFreeCertificateChain CertOpenStore CertAddCertificateContextToStore CertCloseStore CertEnumCertificatesInStore

shlwapi

PathIsRelativeW PathIsDirectoryW

bcrypt

BCryptGenRandom

ntdll

NtCancelIoFileEx NtWriteFile RtlNtStatusToDosError NtDeviceIoControlFile NtReadFile NtCreateFile NtOpenFile

rpcrt4

UuidToStringA RpcStringFreeA UuidCreateSequential

msvcp140

?uncaught_exceptions@std@@YAHXZ ?_Xlength_error@std@@YAXPEBD@Z _Thrd_hardware_concurrency _Mtx_lock _Mtx_unlock ?_Throw_Cpp_error@std@@YAXH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?uncaught_exception@std@@YA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Winerror_map@std@@YAHH@Z ??7ios_base@std@@QEBA_NXZ ?_Random_device@std@@YAIXZ _Unlock_shared_ptr_spin_lock _Lock_shared_ptr_spin_lock ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?fail@ios_base@std@@QEBA_NXZ ?eof@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Xbad_alloc@std@@YAXXZ _Query_perf_frequency _Query_perf_counter ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z _Cnd_signal _Cnd_broadcast ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z _Cnd_wait ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z _Xtime_get_ticks _Thrd_id ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z _Thrd_yield ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z

vcruntime140

__std_type_info_compare memchr _purecall strstr __current_exception __CxxFrameHandler3 memcpy memmove memcmp memset _CxxThrowException __current_exception_context __std_exception_destroy __std_exception_copy __C_specific_handler __std_terminate

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

truncf trunc fmaf log2 tanh llround tanhf __setusermatherr sqrt ceilf log2f exp2 log sin round expf cos asin logf ceil floorf pow asinf cosf sinf exp

api-ms-win-crt-string-l1-1-0

_strdup strncpy strncat_s isdigit strlen isspace wcscmp strcmp wcslen strcat_s

api-ms-win-crt-heap-l1-1-0

_callnewh malloc realloc _set_new_mode calloc _aligned_malloc _aligned_free free

api-ms-win-crt-runtime-l1-1-0

abort _configure_narrow_argv _register_onexit_function _initialize_onexit_table _set_app_type _get_initial_narrow_environment _register_thread_local_exe_atexit_callback _seh_filter_exe _c_exit _cexit __p___argv terminate _exit _initterm _beginthreadex _initialize_narrow_environment _errno _initterm_e strerror __p___argc strerror_s exit _crt_atexit

api-ms-win-crt-stdio-l1-1-0

fopen fread feof fwrite __stdio_common_vsnprintf_s __stdio_common_vsprintf __acrt_iob_func __p__commode fflush __stdio_common_vfprintf __stdio_common_vsprintf_s _set_fmode fclose

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64 clock

api-ms-win-crt-convert-l1-1-0

strtod strtoull strtoll strtol

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

OnigDefaultCaseFoldFlag OnigDefaultSyntax OnigEncodingASCII OnigEncodingUTF8 OnigSyntaxASIS OnigSyntaxEmacs OnigSyntaxGnuRegex OnigSyntaxGrep OnigSyntaxJava OnigSyntaxOniguruma OnigSyntaxPerl OnigSyntaxPerl_NG OnigSyntaxPosixBasic OnigSyntaxPosixExtended OnigSyntaxPython OnigSyntaxRuby onig_builtin_cmp onig_builtin_count onig_builtin_error onig_builtin_fail onig_builtin_max onig_builtin_mismatch onig_builtin_skip onig_builtin_total_count onig_callout_tag_is_exist_at_callout_num onig_copy_encoding onig_copy_syntax onig_copyright onig_end onig_error_code_to_str onig_foreach_name onig_free onig_free_body onig_free_match_param onig_free_match_param_content onig_get_arg_by_callout_args onig_get_args_num_by_callout_args onig_get_callback_each_match onig_get_callout_data onig_get_callout_data_by_callout_args onig_get_callout_data_by_callout_args_self onig_get_callout_data_by_callout_args_self_dont_clear_old onig_get_callout_data_by_tag onig_get_callout_data_by_tag_dont_clear_old onig_get_callout_data_dont_clear_old onig_get_callout_in_by_callout_args onig_get_callout_name_by_name_id onig_get_callout_num_by_callout_args onig_get_callout_num_by_tag onig_get_callout_tag_end onig_get_callout_tag_start onig_get_capture_range_in_callout onig_get_capture_tree onig_get_case_fold_flag onig_get_contents_by_callout_args onig_get_contents_end_by_callout_args onig_get_current_by_callout_args onig_get_default_case_fold_flag onig_get_encoding onig_get_match_stack_limit_size onig_get_name_id_by_callout_args onig_get_options onig_get_parse_depth_limit onig_get_passed_args_num_by_callout_args onig_get_progress_callout onig_get_regex_by_callout_args onig_get_retraction_callout onig_get_retry_counter_by_callout_args onig_get_retry_limit_in_match onig_get_retry_limit_in_search onig_get_right_range_by_callout_args onig_get_start_by_callout_args onig_get_string_by_callout_args onig_get_string_end_by_callout_args onig_get_subexp_call_limit_in_search onig_get_subexp_call_max_nest_level onig_get_syntax onig_get_syntax_behavior onig_get_syntax_op onig_get_syntax_op2 onig_get_syntax_options onig_get_used_stack_size_in_callout onig_initialize onig_initialize_encoding onig_initialize_match_param onig_is_error_code_needs_param onig_match onig_match_with_param onig_name_to_backref_number onig_name_to_group_numbers onig_new onig_new_match_param onig_noname_group_capture_is_active onig_number_of_capture_histories onig_number_of_captures onig_number_of_names onig_reg_init onig_region_clear onig_region_copy onig_region_free onig_region_init onig_region_new onig_region_resize onig_region_set onig_regset_add onig_regset_free onig_regset_get_regex onig_regset_get_region onig_regset_new onig_regset_number_of_regex onig_regset_replace onig_regset_search onig_regset_search_with_param onig_scan onig_search onig_search_with_param onig_set_callback_each_match onig_set_callout_data onig_set_callout_data_by_callout_args onig_set_callout_data_by_callout_args_self onig_set_callout_data_by_tag onig_set_callout_of_name onig_set_callout_user_data_of_match_param onig_set_capture_num_limit onig_set_default_case_fold_flag onig_set_default_syntax onig_set_match_stack_limit_size onig_set_match_stack_limit_size_of_match_param onig_set_meta_char onig_set_parse_depth_limit onig_set_progress_callout onig_set_progress_callout_of_match_param onig_set_retraction_callout onig_set_retraction_callout_of_match_param onig_set_retry_limit_in_match onig_set_retry_limit_in_match_of_match_param onig_set_retry_limit_in_search onig_set_retry_limit_in_search_of_match_param onig_set_subexp_call_limit_in_search onig_set_subexp_call_max_nest_level onig_set_syntax_behavior onig_set_syntax_op onig_set_syntax_op2 onig_set_syntax_options onig_set_verb_warn_func onig_set_warn_func onig_setup_builtin_monitors_by_ascii_encoded_name onig_unicode_define_user_property onig_version onigenc_get_default_encoding onigenc_get_left_adjust_char_head onigenc_get_prev_char_head onigenc_get_right_adjust_char_head onigenc_get_right_adjust_char_head_with_prev onigenc_init onigenc_is_valid_mbc_string onigenc_set_default_caseconv_table onigenc_set_default_encoding onigenc_step_back onigenc_str_bytelen_null onigenc_strdup onigenc_strlen onigenc_strlen_null

agent-memory-3.1.0-windows-x86_64/memory-ingest.exe

IMPHASH fcc09d440f0a34160ac7b38fe99a2def
SHA256 2e5bdc913e11a90c20589a0e9714fab8b402d6c06e17aa798fd3545fa04f257f
MD5 e18c8abc76e8859a6c5658a12e780af0
SHA1 3dc8d5b592c41508cfff6cc194e4310b842228e7
SHA512 7780c5f146e57acebcf4b92e3eaea37014a647f07e6427de09b0e592444c32e56189d8cfc32ebfefd33286915a78085c534be18078f5cf26658538ffe67fd557
SSDEEP 98304:iNewsfgM44jF0g251gBXhO/x/Ol+lvc0:Y2IR4jF0d51gBXhZyc
TLSH
T13F468E227A9984ECD06AC0B4C75687B2E772788A07307AEF05D0997A3F279F41E3D754
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3829104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

memory_ingest.pdb

kernel32

GetDiskFreeSpaceExW FlushFileBuffers GetCurrentProcess CreateFileMappingW MoveFileExW SetFileInformationByHandle Sleep InitializeSRWLock GetModuleHandleW GetConsoleOutputCP ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared FindClose FindFirstFileExW FindNextFileW LocalFree GetCurrentProcessId WriteConsoleW GetCurrentProcessorNumber CreateDirectoryW DeleteFileW GetFileAttributesExW RemoveDirectoryW SetFilePointerEx SetFileTime DeviceIoControl GetCurrentThreadId GetSystemTimeAsFileTime MapViewOfFileEx GetModuleHandleA CreateHardLinkW GetComputerNameA CreateFileW MultiByteToWideChar GetFileInformationByHandleEx GetConsoleMode TlsAlloc GetStdHandle ReadConsoleW WriteFile TlsGetValue ReadFile lstrlenW TlsSetValue GetSystemInfo CreateFileMappingA MapViewOfFile CreateFileA UnmapViewOfFile WakeAllConditionVariable SleepConditionVariableSRW FormatMessageW InitOnceBeginInitialize HeapAlloc InitOnceComplete GetLocaleInfoEx HeapFree GetProcessHeap CloseHandle WaitForSingleObject GetCurrentThread InitializeSListHead GetProcAddress GetLastError GetFinalPathNameByHandleW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetEnvironmentVariableW SetHandleInformation AddVectoredExceptionHandler GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext CreateThread HeapReAlloc SetLastError FormatMessageA QueryPerformanceFrequency QueryPerformanceCounter GetCurrentDirectoryW RtlVirtualUnwind GetThreadId GetQueuedCompletionStatusEx PostQueuedCompletionStatus SetFileCompletionNotificationModes CreateIoCompletionPort FlushViewOfFile SetThreadStackGuarantee SetUnhandledExceptionFilter

bcryptprimitives

ProcessPrng

ws2_32

WSASend getsockopt recv WSAStartup send WSASocketW bind shutdown closesocket getaddrinfo WSAGetLastError connect setsockopt WSAIoctl WSACleanup freeaddrinfo ioctlsocket

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

shlwapi

PathIsRelativeW PathIsDirectoryW

ntdll

NtDeviceIoControlFile NtWriteFile RtlNtStatusToDosError NtCancelIoFileEx NtReadFile NtCreateFile

rpcrt4

UuidToStringA RpcStringFreeA UuidCreateSequential

msvcp140

?_Xlength_error@std@@YAXPEBD@Z _Thrd_hardware_concurrency _Mtx_lock _Mtx_unlock ?_Throw_Cpp_error@std@@YAXH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?uncaught_exception@std@@YA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Winerror_map@std@@YAHH@Z ??7ios_base@std@@QEBA_NXZ ?_Random_device@std@@YAIXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?eof@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Xbad_alloc@std@@YAXXZ _Query_perf_frequency ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ _Query_perf_counter ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z _Cnd_signal _Cnd_broadcast ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z _Cnd_wait ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z _Xtime_get_ticks _Thrd_id ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z _Thrd_yield ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z

vcruntime140

__std_type_info_compare _purecall strstr __current_exception memcmp __CxxFrameHandler3 memcpy memset memmove _CxxThrowException __current_exception_context __std_exception_destroy __std_exception_copy __C_specific_handler __std_terminate

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

log ceilf log2 exp __setusermatherr pow sqrt

api-ms-win-crt-string-l1-1-0

strcmp strncat_s isdigit isspace wcscmp strncpy wcslen strlen strcat_s

api-ms-win-crt-heap-l1-1-0

calloc realloc free _aligned_malloc _aligned_free _callnewh _set_new_mode malloc

api-ms-win-crt-runtime-l1-1-0

_exit _set_app_type abort _register_onexit_function _seh_filter_exe _register_thread_local_exe_atexit_callback _beginthreadex _initterm_e _c_exit _initialize_onexit_table _initterm _get_initial_narrow_environment terminate _configure_narrow_argv __p___argc exit __p___argv _initialize_narrow_environment strerror_s _crt_atexit _errno _cexit

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vsprintf _set_fmode __stdio_common_vsnprintf_s __acrt_iob_func fflush __stdio_common_vfprintf __stdio_common_vsprintf_s

api-ms-win-crt-time-l1-1-0

_time64 _localtime64_s clock

api-ms-win-crt-convert-l1-1-0

strtod strtoull strtoll strtol

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

agent-memory-3.1.0-windows-x86_64/memory-installer.exe

IMPHASH 82f11e4cf64fa744e621fdf02b232fc5
SHA256 084a2d6ecc022f8f636a17d82ffade4b81c8aa4c7d61a3d56bc941a06b84c717
MD5 3b5a6d41c0145c8978676234a89788e0
SHA1 afe607a903a5600de8b15246c28fa22c6b09cde5
SHA512 cd512c944dca88c2f2772a555c237f703ce833501389def1aca58f622e6ecee5925db31fc707b6918c2b8fcd46602882ea3574d3f2e8e1b13981e35d8420197c
SSDEEP 24576:eCYjs8bJcYPjOrUc21P0iW35xZlvUsfXsQc5j7JRTLrqJFIviAvNOLikNocJgmaL:eLlcYzVW35xZKsx28F2o8VYBuHw2dL
TLSH
T170D53911BB5A59ECC29AC470834646731B35B0CB0B35BAFF40D496793F6AAF41F78268
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1719008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

memory_installer.pdb

kernel32

GetSystemTimeAsFileTime GetConsoleMode SetConsoleTextAttribute SetConsoleMode GetLastError CloseHandle GetConsoleScreenBufferInfo lstrlenW CreateFileW GetFileInformationByHandle GetConsoleOutputCP InitializeSListHead FindNextFileW GetModuleHandleA FormatMessageW GetModuleHandleW GetFileType SetUnhandledExceptionFilter WriteConsoleW MultiByteToWideChar GetModuleFileNameW WaitForSingleObject SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter GetCurrentProcessId GetCurrentProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime GetFileInformationByHandleEx GetStdHandle CreateDirectoryW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW FindFirstFileExW FindClose ExitProcess SwitchToThread GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex HeapAlloc

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

ntdll

RtlNtStatusToDosError NtReadFile NtWriteFile

vcruntime140

__current_exception __C_specific_handler _CxxThrowException memcmp memset memcpy memmove __CxxFrameHandler3 __current_exception_context

api-ms-win-crt-math-l1-1-0

__setusermatherr fmod

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table _exit terminate exit _initterm _cexit __p___argc _register_thread_local_exe_atexit_callback _c_exit _get_initial_narrow_environment _initterm_e _initialize_narrow_environment _seh_filter_exe _set_app_type _crt_atexit _configure_narrow_argv __p___argv

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

agent-memory-3.1.0-windows-x86_64/memory.exe

IMPHASH 60c2d7bc2b74c1b4d2f2819a8783fa6f
SHA256 700bdbd1cb16f5d95e8100bd62bf4a48cd860879a1587ced3b91c8a3a5fb5bcc
MD5 1800380c8d5bac3790cac5051a75a669
SHA1 81a7c3828c1ce7895141ba512a84286facc54115
SHA512 97dea771a90d7241e1084bb17437c1333931c861309b97fc145614d8696e8eb150d2d6d1e0bffa2005400d89aed7cd359f2ff44181d47bbf565da5b99d28373d
SSDEEP 98304:tmTPjEbhSekRy0Q18ofI1UDCI/WVl+LUGvUyV:VEQ18II1UDC10U3y
TLSH
T123865B22BA9A85ECD15AC0B4C20A4B628B3174CB0731BAFF05C096753F6AAF45F3D755
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5560240

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

memory.pdb

kernel32

FlushFileBuffers FlushViewOfFile GetFileType CreateFileMappingW MoveFileExW GetDiskFreeSpaceExW GetModuleHandleW GetConsoleOutputCP SetFileInformationByHandle InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared FindClose LocalFree FindFirstFileExW WriteConsoleW FindNextFileW GetCurrentProcessId GetCurrentProcessorNumber CreateDirectoryW DeleteFileW GetFileAttributesExW RemoveDirectoryW SetFilePointerEx SetFileTime DeviceIoControl GetCurrentThreadId GetSystemTimeAsFileTime MapViewOfFileEx CreateHardLinkW GetComputerNameA MultiByteToWideChar GetFileInformationByHandleEx GetConsoleScreenBufferInfo GetStdHandle WriteFile TlsAlloc TlsGetValue lstrlenW TlsSetValue GetSystemInfo CreateFileMappingA MapViewOfFile CreateFileA UnmapViewOfFile SetConsoleMode GetConsoleMode CreateFileW GetModuleHandleA Sleep WakeAllConditionVariable SleepConditionVariableSRW FormatMessageW InitOnceBeginInitialize HeapAlloc InitOnceComplete GetLocaleInfoEx HeapFree GetProcessHeap CloseHandle WaitForSingleObject GetCurrentThread InitializeSListHead GetModuleFileNameW GetProcAddress GetFinalPathNameByHandleW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread ExitProcess GetCommandLineW GetEnvironmentVariableW AddVectoredExceptionHandler GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext CreateThread HeapReAlloc SetLastError FormatMessageA QueryPerformanceFrequency QueryPerformanceCounter GetCurrentDirectoryW RtlVirtualUnwind SetHandleInformation GetThreadId ReadFile SetConsoleTextAttribute GetQueuedCompletionStatusEx PostQueuedCompletionStatus SetFileCompletionNotificationModes CreateIoCompletionPort GetLastError GetCurrentProcess SetThreadStackGuarantee SetUnhandledExceptionFilter

bcryptprimitives

ProcessPrng

ws2_32

WSASend getsockopt recv WSAStartup send WSASocketW bind shutdown closesocket getaddrinfo WSAGetLastError connect setsockopt WSAIoctl WSACleanup freeaddrinfo ioctlsocket

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

shlwapi

PathIsRelativeW PathIsDirectoryW

ntdll

NtCancelIoFileEx NtWriteFile RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile

rpcrt4

UuidToStringA RpcStringFreeA UuidCreateSequential

msvcp140

?_Xlength_error@std@@YAXPEBD@Z _Thrd_hardware_concurrency _Mtx_lock _Mtx_unlock ?_Throw_Cpp_error@std@@YAXH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?uncaught_exception@std@@YA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Winerror_map@std@@YAHH@Z ??7ios_base@std@@QEBA_NXZ ?_Random_device@std@@YAIXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?eof@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Xbad_alloc@std@@YAXXZ _Query_perf_frequency _Query_perf_counter ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z _Cnd_signal _Cnd_broadcast ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z _Cnd_wait ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z _Xtime_get_ticks _Thrd_id ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z _Thrd_yield ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z

vcruntime140

strstr __std_type_info_compare __std_terminate __C_specific_handler __current_exception __CxxFrameHandler3 memcpy memmove memcmp memset __current_exception_context _purecall _CxxThrowException __std_exception_destroy __std_exception_copy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

log2 __setusermatherr sqrt ceilf log pow exp

api-ms-win-crt-string-l1-1-0

strncpy strncat_s isdigit strlen isspace wcscmp strcmp wcslen strcat_s

api-ms-win-crt-heap-l1-1-0

_callnewh malloc realloc _set_new_mode calloc _aligned_malloc _aligned_free free

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s __stdio_common_vsprintf __acrt_iob_func __p__commode fflush __stdio_common_vfprintf __stdio_common_vsprintf_s _set_fmode

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64 clock

api-ms-win-crt-convert-l1-1-0

strtod strtoull strtoll strtol

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

agent-memory-3.1.0-windows-x86_64.zip

agent-memory-3.1.0-windows-x86_64/LICENSE

agent-memory-3.1.0-windows-x86_64/README.md

agent-memory-3.1.0-windows-x86_64/memory-daemon.exe

kernel32

bcryptprimitives

advapi32

ws2_32

api-ms-win-core-synch-l1-2-0

shell32

combase

secur32

crypt32

shlwapi

bcrypt

ntdll

rpcrt4

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic

agent-memory-3.1.0-windows-x86_64/memory-ingest.exe

kernel32

bcryptprimitives

ws2_32

api-ms-win-core-synch-l1-2-0

shlwapi

ntdll

rpcrt4

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic

agent-memory-3.1.0-windows-x86_64/memory-installer.exe

kernel32

shell32

combase

api-ms-win-core-synch-l1-2-0

bcryptprimitives

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic

agent-memory-3.1.0-windows-x86_64/memory.exe

kernel32

bcryptprimitives

ws2_32

api-ms-win-core-synch-l1-2-0

shlwapi

ntdll

rpcrt4

msvcp140

vcruntime140