jaffacakes118_2d42aa747f7ebc3280b14d30c6b71043545888946d9d6acd6abbaf4545841462.zip
- SHA256 2d42aa747f7ebc3280b14d30c6b71043545888946d9d6acd6abbaf4545841462
Overview
overview
3Static
static
30.0q623mdd1sl.dll
windows10-2004-x64
10.0q623mdd1sl.dll
windows11-ltsc_2024-x64
10.1fzxozgfnft.dll
windows10-2004-x64
10.1fzxozgfnft.dll
windows11-ltsc_2024-x64
10.4y96phlkjco.dll
windows10-2004-x64
10.4y96phlkjco.dll
windows11-ltsc_2024-x64
10.6vzw4h01z28.dll
windows10-2004-x64
10.6vzw4h01z28.dll
windows11-ltsc_2024-x64
10.a4c0v0v9ypb.dll
windows10-2004-x64
10.a4c0v0v9ypb.dll
windows11-ltsc_2024-x64
10.e8c4uq4arrk.dll
windows10-2004-x64
10.e8c4uq4arrk.dll
windows11-ltsc_2024-x64
10.njne5ccg4rc.dll
windows10-2004-x64
10.njne5ccg4rc.dll
windows11-ltsc_2024-x64
1app.js
windows10-2004-x64
3app.js
windows11-ltsc_2024-x64
3preload.js
windows10-2004-x64
3preload.js
windows11-ltsc_2024-x64
3winpty-agent.exe
windows10-2004-x64
1winpty-agent.exe
windows11-ltsc_2024-x64
1winpty.dll
windows10-2004-x64
1winpty.dll
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0.0q623mdd1sl.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
0.0q623mdd1sl.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
0.1fzxozgfnft.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
0.1fzxozgfnft.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
0.4y96phlkjco.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
0.4y96phlkjco.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
0.6vzw4h01z28.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
0.6vzw4h01z28.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
0.a4c0v0v9ypb.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
0.a4c0v0v9ypb.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
0.e8c4uq4arrk.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
0.e8c4uq4arrk.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
0.njne5ccg4rc.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
0.njne5ccg4rc.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
app.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
app.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
preload.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
preload.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
winpty-agent.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
winpty-agent.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
winpty.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
winpty.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target jaffacakes118_2d42aa747f7ebc3280b14d30c6b71043545888946d9d6acd6abbaf4545841462.zip
- Size 13.4MB
- Sample261107-1dbwdsfv8x
- SHA256 2d42aa747f7ebc3280b14d30c6b71043545888946d9d6acd6abbaf4545841462
- MD5 df0b41dfd6c726c5b202625fd0146b8a
- SHA1 38d1d8898751a657d9f9c08196f071913cef20b7
- SHA512 61afb06eac73a5d2fa75cd6588d977af0b47485825b33123366809fe454f30404029030a938cff1bfb102009eaf76c56489e5f262ea59cd3025b090a7a2b9942
- SSDEEP 393216:jpQflPriC2yP6Yk2UwIFnSqZ5RncLal8pvNhL/:a9PhP6D22SqZ56K8pvNJ/
- TLSH T13BE633B04695144BEE736DB8A1898B7035941A31F21EC0F5F3622BD77441A2C7BF9F2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 8 IoCs
Checks for missing Authenticode signature.
resource unpack001/0.0q623mdd1sl.node unpack001/0.1fzxozgfnft.node unpack001/0.4y96phlkjco.node unpack001/0.6vzw4h01z28.node unpack001/0.a4c0v0v9ypb.node unpack001/0.e8c4uq4arrk.node unpack001/0.njne5ccg4rc.node unpack001/winpty.dll
File Explorer
-
jaffacakes118_2d42aa747f7ebc3280b14d30c6b71043545888946d9d6acd6abbaf4545841462.zip.zip 13.4MB
-
0.0q623mdd1sl.node.dll 523KB
-
0.1fzxozgfnft.node.dll 253KB
-
0.4y96phlkjco.node.dll 276KB
-
0.6vzw4h01z28.node.dll 184KB
-
0.a4c0v0v9ypb.node.dll 148KB
-
0.e8c4uq4arrk.node.dll 1.8MB
-
0.njne5ccg4rc.node.dll 1.6MB
-
app.js11.2MB
-
preload.js.js 10KB
-
winpty-agent.exe.exe 311KB
-
winpty.dll.dll 240KB
0.0q623mdd1sl.node
- IMPHASH e56950b011112d55645e79b8fc87ad20
- SHA256 4e64935a83d4c1178703e2e00172babf6d2a5047ce31f54bd85fc8841858cbca
- MD5 4bd6f7aac148df74333d9cc44d29b6f5
- SHA1 99866df49e3273c15525a924313036920746d9e0
- SHA512 612eb650a042a8bdd7a85888a11e8b04bb5edbce59c69924d7744c5ac324f9b3c297ddd94f593c24b86533bf5188c7e1ba783457237d3a8edaf5667097117ce6
- SSDEEP 12288:Ts82OKPQEAcifJtkRelRfY/AhtvQ/9q1MZ:Ts82OK2xfHkReHw/eO
- TLSH T1C7B46B29A6A803B9F1B7D57CC9A74906F6B238930364DADF07E086365F177D14A3E720
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
231740
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Projects\wp\node_modules\.pnpm\[email protected]_patch_h_a80dcef01cc322bf39255ebd4bb8be7e\node_modules\classic-level\build\Release\classic_level.pdb
kernel32
GetModuleHandleA
LoadLibraryExA
CreateDirectoryW
ReadFile
FindFirstFileW
GetFileSizeEx
FindNextFileW
WriteFile
RemoveDirectoryW
GetTempPathW
FindClose
CreateFileW
MultiByteToWideChar
Sleep
GetLastError
GetFileAttributesExW
QueryPerformanceFrequency
DeleteFileW
CloseHandle
SetFilePointerEx
LocalFree
MoveFileExW
WideCharToMultiByte
FormatMessageA
QueryPerformanceCounter
FlushFileBuffers
GetCurrentThreadId
GetLocalTime
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
TryAcquireSRWLockExclusive
GetProcAddress
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
CreateThread
ExitThread
FreeLibraryAndExitThread
ExitProcess
OutputDebugStringW
HeapFree
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetConsoleOutputCP
GetConsoleMode
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
SetStdHandle
ReadConsoleW
HeapSize
HeapReAlloc
SetEndOfFile
GetSystemInfo
VirtualProtect
VirtualQuery
Name
.text
Size
375KB
Virtual Size
374KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
119KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=153, id=261, version=30795,
count=10, id=260, version=30795,
count=9, id=259, version=34321,
count=14, id=260, version=34321,
count=55, id=261, version=34321,
count=3, id=257, version=30795,
count=184, id=1, productName=Unmarked objects,
count=42, id=265, version=34435,
count=1, id=255, version=34435,
count=1, id=258, version=34435,
0.1fzxozgfnft.node
- IMPHASH 8b468abf6d7aabc81aede48bb7a73bf6
- SHA256 1cc61e15e22714c644796ae0ded833dc248730e7a303bde86d7b8f9d17e1d13e
- MD5 d599a280913bb11a530b643d3892bd5c
- SHA1 b05eeb3826cfccbda692add3d8bb6489e8d167fb
- SHA512 895d9d424616d465eb02db48e06c4cd56948008ac003d870abc8c5b1e235a13f682efb80b95e1046aac5883e8a0d9ffdca0c6c715ab674b8b1061c8fe9a0eb9f
- SSDEEP 3072:+/rTAi4B9ilq/w/8gHHgtmtj0WEIRwVu0LTtozq17uXgROcfTI8OyvrbLgeI:+Tg/wfnzGTRFBo1kvDgf
- TLSH T1F0446C5973A40CB5E9B7823CC9534A06D7F2BC0543A0E7DF03A4469A5F277D1AA3E722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
40848
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Projects\wp\node_modules\.pnpm\[email protected]_patch_hash=7_c92087652b99662cabfcdfbb4ce098f1\node_modules\node-pty\build\Release\pty.pdb
kernel32
GetModuleHandleA
GetProcessId
CloseHandle
SetEnvironmentVariableA
GetExitCodeProcess
GetEnvironmentVariableW
GetFileAttributesW
MultiByteToWideChar
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
CreateFileW
SetFilePointerEx
GetFileSizeEx
SetStdHandle
HeapSize
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
GetProcessHeap
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStringTypeW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
ExitProcess
HeapFree
WriteFile
OutputDebugStringW
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
shlwapi
PathIsRelativeW
PathCombineW
winpty
winpty_agent_process
winpty_get_console_process_list
winpty_error_msg
winpty_error_free
winpty_config_free
winpty_free
winpty_spawn_config_free
winpty_config_new
winpty_spawn
winpty_config_set_initial_size
winpty_conin_name
winpty_spawn_config_new
winpty_open
winpty_conout_name
winpty_set_size
Name
.text
Size
166KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=159, id=261, version=30795,
count=16, id=260, version=30795,
count=10, id=259, version=34321,
count=14, id=260, version=34321,
count=2, id=257, version=34435,
count=75, id=261, version=34321,
count=5, id=257, version=30795,
count=172, id=1, productName=Unmarked objects,
count=3, id=265, version=34435,
count=1, id=255, version=34435,
count=1, id=258, version=34435,
0.4y96phlkjco.node
- IMPHASH a2295491130d64ec9e8839d8160b4f5c
- SHA256 2b2711563d4ea385ef6f84042dfc2188c5719e85211cb40f1180c97482ebea37
- MD5 1da53629da7820c9c1b840ec5216a1ba
- SHA1 1c8c4f980d5bddd728567951671774c66d7b9a26
- SHA512 8d9b6b608ec018a748fafeb3f8227be4ade8618ab54f69ee85db19b5427c2283b0df96ea7fbd36861dcccbda15795a1c929784a8584e0c2dacc16ede23f37e7a
- SSDEEP 3072:GlPyjFXvFlXY9U+FK/6R0ksJ8fPdeq0o0iew77NFNNWDzZoWnHeemHK0Q59XI4aF:UPyjR90y/6R0ksJ2sHYnUtnpLot
- TLSH T1FF543A1AA6948DBAD867C17DC9834E01EBF27C9547A0EACF136009D65F137E19E3B702
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
108420
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
LoadLibraryExA
LoadLibraryExW
WriteConsoleW
HeapReAlloc
HeapSize
SetStdHandle
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
VirtualQueryEx
VirtualProtectEx
VirtualQuery
VirtualFree
VirtualProtect
VirtualAlloc
FlushInstructionCache
SetThreadContext
SetLastError
IsValidCodePage
GetStringTypeW
SetFilePointerEx
GetFileType
GetStdHandle
GetThreadContext
ResumeThread
SuspendThread
GetCurrentThreadId
GetModuleHandleA
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
CreateSymbolicLinkW
WTSGetActiveConsoleSessionId
GetSystemPowerStatus
SetSystemPowerState
QueryFullProcessImageNameW
SetThreadExecutionState
LocalFree
GlobalLock
GlobalUnlock
LoadLibraryW
GetProcAddress
FreeLibrary
OpenProcess
ProcessIdToSessionId
CreateProcessW
GetCurrentThread
TerminateProcess
GetCurrentProcess
CreateWaitableTimerW
CancelWaitableTimer
SetWaitableTimer
WaitForSingleObject
GetLastError
CloseHandle
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HeapFree
HeapAlloc
GetModuleFileNameW
ExitProcess
GetCPInfo
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetFileAttributesW
SearchPathW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
InterlockedFlushSList
RtlUnwindEx
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetCurrentProcessId
IsProcessorFeaturePresent
RaiseException
GetSystemInfo
RtlPcToFileHeader
FormatMessageA
GetLocaleInfoEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
user32
GetWindowThreadProcessId
DestroyIcon
GetIconInfo
EnumWindows
GetDC
GetWindowTextW
IsIconic
GetWindowRect
ExitWindowsEx
GetWindowTextLengthW
IsWindowVisible
FlashWindowEx
PrintWindow
ShowWindow
IsWindow
GetSystemMetrics
ReleaseDC
gdi32
GetObjectW
SelectObject
GetDIBits
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
shell32
ExtractIconExW
SHGetFolderPathW
ole32
CoUninitialize
CoInitializeEx
CLSIDFromString
StringFromGUID2
GetHGlobalFromStream
CreateStreamOnHGlobal
advapi32
RegQueryInfoKeyW
SetThreadToken
OpenProcessToken
ConvertSidToStringSidW
StartServiceW
QueryServiceStatusEx
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
EnumServicesStatusExW
ControlService
CloseServiceHandle
ChangeServiceConfigW
RegDeleteTreeW
RegDeleteKeyValueW
RegSetValueExW
RegQueryValueExW
CreateProcessAsUserW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegCreateKeyExW
RegCloseKey
LookupPrivilegeValueW
LookupAccountNameW
SetTokenInformation
RevertToSelf
ImpersonateLoggedOnUser
GetTokenInformation
DuplicateTokenEx
AdjustTokenPrivileges
api-ms-win-shcore-scaling-l1-1-1
SetProcessDpiAwareness
wininet
InternetSetOptionW
wtsapi32
WTSEnumerateSessionsW
WTSQuerySessionInformationW
WTSFreeMemory
WTSQueryUserToken
powrprof
PowerWriteDCValueIndex
PowerWriteACValueIndex
PowerEnumerate
gdiplus
GdipAlloc
GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipSaveImageToStream
GdipCreateBitmapFromScan0
vssapi
CreateVssBackupComponentsInternal
VssFreeSnapshotPropertiesInternal
crypt32
CryptUnprotectData
ncrypt
NCryptOpenKey
NCryptCreatePersistedKey
NCryptGetProperty
NCryptSetProperty
NCryptFinalizeKey
NCryptDecrypt
NCryptImportKey
NCryptExportKey
NCryptSignHash
NCryptDeleteKey
NCryptFreeObject
NCryptOpenStorageProvider
Name
.text
Size
167KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=141, id=261, version=33140,
count=8, id=259, version=33140,
count=10, id=259, version=35207,
count=14, id=260, version=35207,
count=1, id=263, version=33140,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=56, id=261, version=35207,
count=13, id=260, version=33140,
count=27, id=257, version=33140,
count=3, id=261, version=34435,
count=322, id=1, productName=Unmarked objects,
count=2, id=261, version=35217,
count=1, id=255, version=35217,
count=1, id=258, version=35217,
0.6vzw4h01z28.node
- IMPHASH c1b46afc2132351bc04db0937da5d4a0
- SHA256 b7a04b4f98e42e8228de5349c0ce962d2731e1030fcd1d7d5322b7378edac6d9
- MD5 32420810f15103b6eda219ea973f7b28
- SHA1 b50532c98bdf313f577d49f72e58bc48e669c4da
- SHA512 8310241e1c3af5e75b4f001f66491d5bd7581916814b6b4e70fc1dbf187b44b6a0db38febafe0dd133aec94c7a07823a36c8a9268f36c883a0df4f5bb6b3d2cb
- SSDEEP 3072:i0TjT461PoID3GMXN7oQfuEo1fAxb+KAOyHra3odor9ok93zYY:iUjTnG83pdoQWJfAF+KaH28Y
- TLSH T189046C1A73A4007DEDA7D138C9939E02E676744503609BDF07A04779AF2B3E19E3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
57304
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Projects\wp\node_modules\.pnpm\[email protected]_patch_hash_4a22736cbc2753f2d306fc4237afc9cf\node_modules\drivelist\build\Release\drivelist.pdb
kernel32
GetModuleHandleA
GetLogicalDrives
DeviceIoControl
GetDriveTypeA
CreateFileW
GetLastError
CreateFileA
CloseHandle
WideCharToMultiByte
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
WriteFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
setupapi
SetupDiGetDeviceRegistryPropertyA
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
Name
.text
Size
120KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=135, id=261, version=30795,
count=10, id=260, version=30795,
count=10, id=259, version=34321,
count=14, id=260, version=34321,
count=44, id=261, version=34321,
count=1, id=262, version=30795,
count=9, id=257, version=30795,
count=146, id=1, productName=Unmarked objects,
count=4, id=265, version=34435,
count=1, id=255, version=34435,
count=1, id=258, version=34435,
0.a4c0v0v9ypb.node
- IMPHASH 038d8bb906458d16a645a6d0df8baaf2
- SHA256 445cc603cd5b07598e1c7536c9a13a30fcd77865b7af16bb115f16e5c62f0dac
- MD5 c41cdfad0b66914efb0fb7b90829659c
- SHA1 6c88c5b2ab101488813df9d33d06df0ddc651953
- SHA512 8b3e8e23221fcf786ea99191782a86cac06e8565d5f72c414c896fe5375a925dca79e4d3a3b76a6564c39afd70f0f729c87a9e1596abd076185ddd6651660266
- SSDEEP 3072:oI1/rPQazSErO3iDK0CR9Kd6N0GdqFWRU1X:7TQuSM60KaA0
- TLSH T112E35C57B3A900BBE077C279C9534A55E372B8614B516BDF03A0437A2F233E19D3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
24644
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
GetCurrentThreadId
OpenThread
TerminateThread
GetThreadId
GetModuleHandleW
GetModuleHandleA
GetProcAddress
WriteConsoleW
CreateFileW
HeapReAlloc
HeapSize
SetStdHandle
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
GetStringTypeW
GetProcessHeap
RaiseException
GetLastError
GetSystemInfo
VirtualProtect
VirtualQuery
FreeLibrary
LoadLibraryExA
QueryPerformanceCounter
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WakeAllConditionVariable
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlPcToFileHeader
RtlUnwindEx
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetStdHandle
GetFileType
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
user32
UnhookWindowsHookEx
SetWindowsHookExW
GetWindowThreadProcessId
GetForegroundWindow
GetKeyboardState
CallNextHookEx
PostThreadMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetKeyboardLayout
ToUnicodeEx
GetKeyState
Name
.text
Size
82KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
52KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=141, id=261, version=33140,
count=12, id=260, version=33140,
count=8, id=259, version=33140,
count=9, id=259, version=35207,
count=14, id=260, version=35207,
count=54, id=261, version=35207,
count=5, id=257, version=33140,
count=189, id=1, productName=Unmarked objects,
count=2, id=261, version=35217,
count=1, id=255, version=35217,
count=1, id=258, version=35217,
0.e8c4uq4arrk.node
- IMPHASH b3b2e598a9ec0be29b43dde9074b5309
- SHA256 f2848206ebdf71adb39ec35ad8f7cf0fcd241c0ee578d832d880d5bf59acf5f0
- MD5 60abb61303cce4603a1686dfea59e374
- SHA1 107f1b267fb43c85e56fdddc3ca259517068cdb4
- SHA512 e26331eabe37503c0c7d73308e2eede1ab028308cedf8753e1e4c0339bd61ef3d75e75a78c5dde351c4b82b35ab9d938a84f3bfb505cfc26f531707469aebc47
- SSDEEP 49152:zO1UuNhVj7pjgtnwLGLI8qWKgcsy+eOi:8GsPgS
- TLSH T1F2951A1461E542BDC17BE077A952954EFE623894C738DAF308EDA1322F567DCA2BF108
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1165956
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ws2_32
accept
freeaddrinfo
getaddrinfo
WSASocketW
WSASend
WSARecv
WSAIoctl
WSAGetLastError
WSASetLastError
WSACleanup
WSAStartup
shutdown
setsockopt
select
listen
htons
htonl
getsockopt
getsockname
ioctlsocket
connect
closesocket
bind
__WSAFDIsSet
kernel32
WriteConsoleW
CreateFileW
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetLastError
FormatMessageA
FormatMessageW
WideCharToMultiByte
LocalFree
CloseHandle
SetLastError
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CancelIoEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
WaitForSingleObject
SleepEx
CreateEventW
SetWaitableTimer
Sleep
WaitForMultipleObjects
QueueUserAPC
TerminateThread
GetSystemTimeAsFileTime
CreateWaitableTimerA
GetModuleHandleA
GetProcAddress
FindClose
SetFilePointerEx
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
FreeLibrary
GetModuleHandleW
LoadLibraryExA
RtlPcToFileHeader
GetCurrentThreadId
QueryPerformanceCounter
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
InitializeSListHead
InterlockedFlushSList
RtlUnwindEx
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
HeapReAlloc
HeapSize
HeapAlloc
HeapFree
GetStdHandle
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
mswsock
AcceptEx
GetAcceptExSockaddrs
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
516KB
Virtual Size
516KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
48KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=259, version=30795,
count=144, id=261, version=30795,
count=10, id=260, version=30795,
count=10, id=259, version=35207,
count=14, id=260, version=35207,
count=59, id=261, version=35207,
count=7, id=257, version=30795,
count=285, id=1, productName=Unmarked objects,
count=2, id=261, version=35217,
count=1, id=255, version=35217,
count=1, id=258, version=35217,
0.njne5ccg4rc.node
- IMPHASH 04084d643c609dec5b942b355cf5584d
- SHA256 6bb5b5f82fd4889331f2e15f2044730bfeb1550db838f8a0b7f552aaa4216ed4
- MD5 2eac03bddb15a8177b58076d4f5aaa00
- SHA1 44b014d8e3aa6ab31044ee5951f1807eca3fcca4
- SHA512 bc6596a7c8f6631694bb6ba3214306a8058a94c1ebaf0851dd38693be9e51024ff5a62acf656683243d9bb8c6d6c6e90068d0ae84578cf209575d504b762cfa7
- SSDEEP 49152:FGhzqxwR2gmGqHDAKYNtKss/v/aIz0mY:FGpqG2g5qHDNcmj0mY
- TLSH T1F2758E46B3B900FCC46BC1B8861B6607E7B2740513759BEF55908AAA6F23FE1167F324
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1255116
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\better-sqlite3\better-sqlite3\build\Release\better_sqlite3.pdb
kernel32
GetModuleHandleA
LoadLibraryExA
AreFileApisANSI
ReadFile
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
RaiseException
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
InterlockedFlushSList
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStdHandle
GetFileType
GetStringTypeW
SetStdHandle
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
VirtualProtect
VirtualQuery
node_register_module_v108
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
233KB
Virtual Size
233KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
22KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=259, version=29395,
count=149, id=261, version=29395,
count=34, id=260, version=29395,
count=14, id=260, version=30034,
count=10, id=259, version=30034,
count=41, id=261, version=30034,
count=3, id=257, version=29395,
count=234, id=1, productName=Unmarked objects,
count=3, id=265, version=30154,
count=1, id=256, version=30154,
count=1, id=255, version=30154,
count=1, id=258, version=30154,
app.js
- SHA256 5b4edd9bffdd7909b8b432eacd463d59eb23eba151c9e218161ab15dd72d55ed
- MD5 0d1fce0cb2b9dec26a10f0822aeffb19
- SHA1 adcc6bf4d80cdd92d95feeebdea052ac4e986234
- SHA512 5bbd0fcdf6dd944449f61c0c619ba56ce2175c1ed954b7117d53772f2f8192caf301f594726e915156de7f82766c566bc847e63749cd020095775916e5d9c729
- SSDEEP 196608:r07pYI7lMoa96F8lnAqNcMmMEVgRho5SXEtDQ3BX3iaT4NEO+I7ON3MTxLeSZw:rLI7JhF8JAacV4oSXECd3iagl77Y3EdK
- TLSH T1A5C633F04262514AEDA3ADBCE9959F7030911B36F65EC0F5B32669CB640086C3BB4F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
preload.js
- SHA256 6afb781477cdd31bf5ef346519023fb50750fb3074a498e2424958b46b698742
- MD5 99718dfa4d085dac919cd8ff84e1abb7
- SHA1 4b85f17aaded05eaa78da4eefd8c63eb4cbe74ab
- SHA512 55b348de1ae2ae35459ed68771116b96ecb27bf9cb11339c1ea4c8a84a8052ac536cf2d89888805e96a9cbef48e0b24e3c057e5f68c6ae9588448644bfa4c8a2
- SSDEEP 192:V0/4Ha/peiktdSJbF8qAOvF/OEEOJpKnLJX8S7OAtYWjqR:Vs4HIeikrSJbwOt/S4YxD/tv8
- TLSH T15B22C5C6269BF0AB67D321737D4F6494D5D4D028E94BCB08F459DCA8FA90A2FC287D60
- MD5 SHA1 SHA512 SSDEEP TLSH
winpty-agent.exe
- IMPHASH fa8455d5e83e9585e56dd2605ec1f104
- SHA256 2a0d20429c9aaf27e0ae461c12a21ddb5cf6a3a134970aabb11d53799518b595
- MD5 db3110fa4f88700e6b173115ee409922
- SHA1 1fe406583a1cf2dc34dad0a6c1c8809bfd4a06cc
- SHA512 0d2c97ed48ada8aa5f9f69ee6064ee4be3b8b812c2f0a0248957cbf9ba89381ecf0c3f7ef763073e3601f429c628b507e9e1246cd8bc97e9dc50828e4782feb5
- SSDEEP 3072:VzjUJuN9zxJigRUnf0I8KkYab4J9Nk6TPgi8mOcZJACa8/q3RiJvrVoobnru/s/7:VzjUJuKgRUsIJnBTPYWvfnla/KDX
- TLSH T157648C1AF7A910F9D9B7C17CC9428902EA727C564760DADF03A049A63F2B7E05E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
68:17:ad:aa:7b:e8:12:d4:5d:17:3c:55:df:13:f7:86:46:6f:22:c2:f9:82:6a:57:de:c1:e2:c5:79:03:10:db
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 14, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:84:98:e2:12:e0:78:a3:31:5d:00:00:00:00:04:84
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:551A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1b:d0:b2:b8:02:67:f7:72:cf:00:01:00:00:02:1b
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
98560
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\node_modules\node-pty\build\Release\winpty-agent.pdb
kernel32
GetConsoleCP
LoadLibraryW
GetProcAddress
FreeLibrary
SetConsoleMode
GetConsoleMode
GetTickCount
GenerateConsoleCtrlEvent
ReadConsoleInputW
WaitForMultipleObjects
Sleep
ReadFile
CancelIo
WriteFile
CreateNamedPipeW
CreateFileW
CreateEventW
ResetEvent
GetOverlappedResult
ConnectNamedPipe
GetConsoleCursorInfo
GetConsoleTitleW
GetConsoleWindow
SetConsoleTitleW
GetConsoleScreenBufferInfo
GetConsoleOutputCP
SetConsoleScreenBufferSize
SetConsoleWindowInfo
CreateConsoleScreenBuffer
FillConsoleOutputCharacterW
ReadConsoleOutputW
FillConsoleOutputAttribute
SetConsoleCursorPosition
WriteConsoleOutputW
GetCommandLineW
GetCurrentThreadId
GetModuleFileNameA
SetNamedPipeHandleState
SetLastError
GetEnvironmentVariableA
GetCurrentProcessId
TransactNamedPipe
GetSystemTimeAsFileTime
WaitNamedPipeW
WideCharToMultiByte
LocalAlloc
GetCurrentThread
LocalFree
GetVersionExW
GetSystemDirectoryW
WriteConsoleW
CreateProcessW
WriteConsoleInputW
CloseHandle
GetConsoleProcessList
GetLargestConsoleWindowSize
GetLastError
DuplicateHandle
WaitForSingleObject
GetStdHandle
GetCurrentProcess
SetConsoleCtrlHandler
SetConsoleTextAttribute
GetModuleHandleW
HeapReAlloc
HeapSize
GetProcessHeap
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetCommandLineA
HeapFree
HeapAlloc
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
CompareStringW
LCMapStringW
FlushFileBuffers
GetFileSizeEx
SetFilePointerEx
FindClose
FindFirstFileExW
advapi32
SetSecurityDescriptorDacl
AllocateAndInitializeSid
SetEntriesInAclW
OpenProcessToken
FreeSid
InitializeSecurityDescriptor
OpenThreadToken
GetTokenInformation
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
shell32
CommandLineToArgvW
user32
CloseDesktop
CreateDesktopW
SetProcessWindowStation
PostMessageW
GetProcessWindowStation
MapVirtualKeyW
SendMessageW
VkKeyScanW
GetDoubleClickTime
CloseWindowStation
GetUserObjectInformationW
CreateWindowStationW
Name
.text
Size
197KB
Virtual Size
196KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=145, id=261, version=33140,
count=12, id=260, version=33140,
count=8, id=259, version=33140,
count=10, id=259, version=35207,
count=16, id=260, version=35207,
count=50, id=261, version=35207,
count=9, id=257, version=33140,
count=165, id=1, productName=Unmarked objects,
count=29, id=265, version=35217,
count=1, id=255, version=35217,
count=1, id=258, version=35217,
winpty.dll
- IMPHASH d7472042adcbad8dc3267d828df2ba30
- SHA256 25b57d95fa6a043175662319606f85c994c78d8cc759090c398760930299c926
- MD5 1b157f5712c991598fb41a53697393b3
- SHA1 b983ecb389a216ae5118c95ceea7427872118245
- SHA512 d40445668494ef1db396982eaececff8706709efb6ca3eb00f015ab1f311f2960cf75d2c975a603f4730cf4bb9ab938b6d6e51ebdf38b238a78c63f5359fa735
- SSDEEP 3072:+POWZFrZtR//4lqJxf/9DHAlqptMhX9uRL5gEqN5XgPCKNYDbrJs1mbqbbpyggTE:+PO0rhn4oJxf/NUqp2p4N8gyggQij
- TLSH T1B6345C0976E808B8F9B79279C9A39912E7727C050770D7DF03A0465B9F2B7D09D3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
53224
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Projects\wp\node_modules\.pnpm\[email protected]_patch_hash=7_c92087652b99662cabfcdfbb4ce098f1\node_modules\node-pty\build\Release\winpty.pdb
kernel32
GetEnvironmentVariableA
DuplicateHandle
CreateEventW
GetLastError
CloseHandle
GetOverlappedResult
DeleteCriticalSection
CreateProcessW
ConnectNamedPipe
GetCurrentThreadId
GetModuleFileNameA
SetNamedPipeHandleState
SetLastError
InitializeCriticalSection
GetCurrentProcessId
TransactNamedPipe
GetSystemTimeAsFileTime
WaitNamedPipeW
LoadLibraryW
GetProcAddress
FreeLibrary
WideCharToMultiByte
LocalAlloc
GetCurrentThread
LocalFree
GetVersionExW
GetSystemDirectoryW
LeaveCriticalSection
WaitForMultipleObjects
CreateNamedPipeW
WriteFile
GetCurrentProcess
EnterCriticalSection
CancelIo
ReadFile
GetFileAttributesW
GetModuleFileNameW
GetModuleHandleExW
CreateFileW
GetModuleHandleW
HeapReAlloc
HeapSize
SetStdHandle
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
GetFileType
WriteConsoleW
ExitProcess
OutputDebugStringW
HeapFree
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
advapi32
SetSecurityDescriptorDacl
AllocateAndInitializeSid
SetEntriesInAclW
OpenProcessToken
FreeSid
InitializeSecurityDescriptor
OpenThreadToken
GetTokenInformation
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
user32
CloseDesktop
CreateDesktopW
CloseWindowStation
GetUserObjectInformationW
GetProcessWindowStation
CreateWindowStationW
SetProcessWindowStation
GetThreadDesktop
winpty_agent_process
winpty_conerr_name
winpty_config_free
winpty_config_new
winpty_config_set_agent_timeout
winpty_config_set_initial_size
winpty_config_set_mouse_mode
winpty_conin_name
winpty_conout_name
winpty_error_code
winpty_error_free
winpty_error_msg
winpty_free
winpty_get_console_process_list
winpty_open
winpty_set_size
winpty_spawn
winpty_spawn_config_free
winpty_spawn_config_new
Name
.text
Size
156KB
Virtual Size
155KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=139, id=261, version=30795,
count=10, id=260, version=30795,
count=10, id=259, version=34321,
count=14, id=260, version=34321,
count=40, id=261, version=34321,
count=7, id=257, version=30795,
count=129, id=1, productName=Unmarked objects,
count=14, id=265, version=34435,
count=1, id=256, version=34435,
count=1, id=255, version=34435,
count=1, id=258, version=34435,