jaffacakes118_3d800b7dbdcb6874e29ddd2e9a1313f3d82b323e89a720c632c708098a7ca0e9.zip
- SHA256 3d800b7dbdcb6874e29ddd2e9a1313f3d82b323e89a720c632c708098a7ca0e9
Overview
overview
4Static
static
30.0ximkut6lhk.dll
windows10-2004-x64
10.0ximkut6lhk.dll
windows11-ltsc_2024-x64
10.22tybcjqvw7.dll
windows10-2004-x64
10.22tybcjqvw7.dll
windows11-ltsc_2024-x64
10.9z6ed380lnd.dll
windows10-2004-x64
10.9z6ed380lnd.dll
windows11-ltsc_2024-x64
10.e00ypq8qhln.dll
windows10-2004-x64
10.e00ypq8qhln.dll
windows11-ltsc_2024-x64
10.l1j7g2laz7n.dll
windows10-2004-x64
10.l1j7g2laz7n.dll
windows11-ltsc_2024-x64
10.wdzcov7dsab.dll
windows10-2004-x64
10.wdzcov7dsab.dll
windows11-ltsc_2024-x64
10.yqnjc1u99y.dll
windows10-2004-x64
10.yqnjc1u99y.dll
windows11-ltsc_2024-x64
1preflight.js
ubuntu-18.04-amd64
3preflight.js
debian-9-armhf
4preflight.js
debian-9-mips
3preflight.js
debian-9-mipsel
3winpty-agent.exe
windows10-2004-x64
1winpty-agent.exe
windows11-ltsc_2024-x64
1winpty.dll
windows10-2004-x64
1winpty.dll
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0.0ximkut6lhk.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
0.0ximkut6lhk.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
0.22tybcjqvw7.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
0.22tybcjqvw7.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
0.9z6ed380lnd.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
0.9z6ed380lnd.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
0.e00ypq8qhln.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
0.e00ypq8qhln.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
0.l1j7g2laz7n.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
0.l1j7g2laz7n.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
0.wdzcov7dsab.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
0.wdzcov7dsab.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
0.yqnjc1u99y.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
0.yqnjc1u99y.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
preflight.js
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
preflight.js
Resource
debian9-armhf-20260513-en
debian-9-armhf
5 signatures
150 seconds
Behavioral task
behavioral17
Sample
preflight.js
Resource
debian9-mipsbe-20260513-en
debian-9-mips
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
preflight.js
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
winpty-agent.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
winpty-agent.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
winpty.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
winpty.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target jaffacakes118_3d800b7dbdcb6874e29ddd2e9a1313f3d82b323e89a720c632c708098a7ca0e9.zip
- Size 7.7MB
- Sample261107-1debhsfv8y
- SHA256 3d800b7dbdcb6874e29ddd2e9a1313f3d82b323e89a720c632c708098a7ca0e9
- MD5 5f9c1a9fbe1209a2cce19f0a84fb9c3c
- SHA1 84d6ec328bf227443079c4da6e26344b1700bdbb
- SHA512 70ea0c9da3f590bda0f572b1b90f12a9d3f7e5c111973cea12f2f3fef308cfba3f22dedb8fd75e0dec1b5e084cddabd5363fbf626e1f9b7a50b47065feda88f0
- SSDEEP 196608:fS04Vf2vSTHnGlQkEQjWNkbAAGLBLkEokwYIPCuf1vTdRw7:K0ofw2Gll2kIRMk2P9NbHw7
- TLSH T18C863327EC6634B28AB41ED2C65484179F07C46BCD6D4B31BB28C262CF93941F76A17E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 8 IoCs
Checks for missing Authenticode signature.
resource unpack001/0.0ximkut6lhk.node unpack001/0.22tybcjqvw7.node unpack001/0.9z6ed380lnd.node unpack001/0.e00ypq8qhln.node unpack001/0.l1j7g2laz7n.node unpack001/0.wdzcov7dsab.node unpack001/0.yqnjc1u99y.node unpack001/winpty.dll
File Explorer
-
jaffacakes118_3d800b7dbdcb6874e29ddd2e9a1313f3d82b323e89a720c632c708098a7ca0e9.zip.zip 7.7MB
-
0.0ximkut6lhk.node.dll 1.6MB
-
0.22tybcjqvw7.node.dll 214KB
-
0.9z6ed380lnd.node.dll 415KB
-
0.e00ypq8qhln.node.dll 3.4MB
-
0.l1j7g2laz7n.node.dll 1.5MB
-
0.wdzcov7dsab.node.dll 258KB
-
0.yqnjc1u99y.node.dll 525KB
-
app.jsc3.9MB
-
preflight.js.js .sh 1KB
-
winpty-agent.exe.exe 296KB
-
winpty.dll.dll 245KB
0.0ximkut6lhk.node
- IMPHASH 04084d643c609dec5b942b355cf5584d
- SHA256 c5f81f4623559e4357508468a6509eb8e9b214e7ccf466bef5f83c694822b652
- MD5 4f3747b52c6a15d487f89e5b791e5817
- SHA1 8b99a9953d5179b2dedc9494bdcfb33e5831fe69
- SHA512 d17ef4eac4da4b152829aeeab3f914473a5b9afabcab11c9ed0f4697e0f5547a228d6015601f1ef29f8c5a786ded78f71f0c044bab3ee0ea10f8884042889c42
- SSDEEP 24576:M9JZo2B/EspTCN+afsF1uheFYwTg5BhuHDGjMsbyF1lChR64fdky9pW:EoSna0FfFYwK6HDKLhs4lQ
- TLSH T1FA758D46F2B900FCC46BC278891B6607E7B2740517749BDB55A08AAA6F33FE1167F324
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1239388
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\better-sqlite3\better-sqlite3\build\Release\better_sqlite3.pdb
kernel32
GetModuleHandleA
LoadLibraryExA
AreFileApisANSI
ReadFile
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
RaiseException
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
InterlockedFlushSList
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStdHandle
GetFileType
GetStringTypeW
SetStdHandle
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
VirtualProtect
VirtualQuery
node_register_module_v108
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
232KB
Virtual Size
231KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
21KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=259, version=29395,
count=149, id=261, version=29395,
count=34, id=260, version=29395,
count=14, id=260, version=30034,
count=10, id=259, version=30034,
count=41, id=261, version=30034,
count=3, id=257, version=29395,
count=234, id=1, productName=Unmarked objects,
count=3, id=265, version=30154,
count=1, id=256, version=30154,
count=1, id=255, version=30154,
count=1, id=258, version=30154,
0.22tybcjqvw7.node
- IMPHASH aa53cc3a3e67d4ba643a7686e13b6557
- SHA256 67c5ccb589f6c30f5e2103c960722253d9c09d46e28555514eea0a0b159a2218
- MD5 3cc70e273768ca7ea3c6c10026c2649b
- SHA1 c8a689239748df49370520e3b0151b1116f27318
- SHA512 6d5d55c96a97b744f7f005995fa8a3ac8fac5bdc44878960cf130fb7bfe1180f16ec679cb186c6b63d68079a1618df6f72b922347ce17b824d319ed9fdd0308d
- SSDEEP 3072:+O3uM8JhvlCBHZRyN6t/Y8McDLWy7RD2TRXF1D66wOs+B9NTDGLvdy:r3V83oRyN6t/Y8MWqydMrm+bTqL1
- TLSH T1F0247C46B2A504B8ECBBC13C89534E02E67378550760EBDF07A0477A9F5B7E1A93EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
67116
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
HeapSize
SetStdHandle
GetConsoleMode
HeapReAlloc
WriteConsoleW
GetModuleHandleA
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
CreateSymbolicLinkW
LocalFree
LoadLibraryA
GetProcAddress
FreeLibrary
OpenProcess
GetExitCodeProcess
TerminateProcess
GetCurrentProcess
WaitForSingleObject
GetConsoleOutputCP
WriteFile
FlushFileBuffers
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
CloseHandle
SearchPathW
RaiseException
GetLastError
GetSystemInfo
VirtualProtect
VirtualQuery
GetModuleHandleW
LoadLibraryExA
RtlPcToFileHeader
FormatMessageA
GetLocaleInfoEx
GetCurrentThreadId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
InterlockedFlushSList
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetCPInfo
ExitProcess
GetModuleFileNameW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetStdHandle
GetFileType
SetFilePointerEx
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
user32
ExitWindowsEx
shell32
SHGetFolderPathW
ole32
CoUninitialize
CoInitializeEx
advapi32
AdjustTokenPrivileges
OpenProcessToken
DuplicateTokenEx
ConvertSidToStringSidW
RegDeleteTreeW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegDeleteKeyExW
RegCreateKeyExW
RegCloseKey
LookupPrivilegeValueW
LookupAccountNameW
ImpersonateLoggedOnUser
GetTokenInformation
CreateProcessAsUserW
wtsapi32
WTSQueryUserToken
WTSEnumerateSessionsW
WTSQuerySessionInformationW
WTSFreeMemory
vssapi
CreateVssBackupComponentsInternal
VssFreeSnapshotPropertiesInternal
crypt32
CryptUnprotectData
Name
.text
Size
132KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
62KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=138, id=261, version=30795,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33218,
count=17, id=259, version=33218,
count=56, id=261, version=33218,
count=11, id=260, version=30795,
count=17, id=257, version=30795,
count=233, id=1, productName=Unmarked objects,
count=2, id=261, version=33519,
count=1, id=255, version=33519,
count=1, id=258, version=33519,
0.9z6ed380lnd.node
- IMPHASH e48c128f7fdb720da6b5c9b5a21efbb9
- SHA256 cc7fb651af0ee3f5ff219b10e46d1456c71521fa92fd9ff5a3b2eb59a17bdb72
- MD5 3c0376a1310fc0774f3375b4d2f604fd
- SHA1 991a248199474b1e05a612d2e85fbc1de6fc1372
- SHA512 3b3a5d0cea9ed88385d26cd0c53f6be27b5b6a13fdf640ce00860f428541e5e2adc35fe80f5ec75472ebaf0b5dc74e09f3f3a109f70e640fa180f1a57c81002b
- SSDEEP 6144:0Mp4YJMPTI7hEMfyeo9g3S5/Th0C3BR+LoMYlsViNte7W:0MA4E8yeo9q+/Tf3BR+J+sVM
- TLSH T1E6947C15F79404B9E4B7D27CCD239A02E6B6781A0370D6CF03E49A662F277E15A3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
151388
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleA
GetProcAddress
RaiseException
GetLastError
GetSystemInfo
VirtualProtect
VirtualQuery
FreeLibrary
GetModuleHandleW
LoadLibraryExA
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
SetFileInformationByHandle
AreFileApisANSI
CloseHandle
DeviceIoControl
CopyFileW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlPcToFileHeader
RtlUnwindEx
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
WriteConsoleW
SetEndOfFile
RtlUnwind
Name
.text
Size
297KB
Virtual Size
296KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
91KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=175, id=261, version=30795,
count=16, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33218,
count=18, id=259, version=33218,
count=80, id=261, version=33218,
count=3, id=257, version=30795,
count=163, id=1, productName=Unmarked objects,
count=2, id=261, version=33519,
count=1, id=255, version=33519,
count=1, id=258, version=33519,
0.e00ypq8qhln.node
- IMPHASH 1465254f858e359c5171a05db42933ce
- SHA256 58b9b21f81e89a03b6bcbb0bbf3dd65c94983c71629abb5262990d4d00b94ca6
- MD5 3a39ab6fae8068f9aabed4a4606ffa43
- SHA1 8cb654d604654aefac5662c96b3a1830e65c0bb6
- SHA512 d60fcffcf37bfd7a79b4fcfde6271be7cbc56f7e75617150d71465e4af95c19c3830069e9061e1be544a4900304101e51f2686fa4b351e0a3337b77f655e3fc3
- SSDEEP 49152:LuZFjZpr9IJZXDMxuMyX772VvmXwgjcTJsv6tWKFdu9CUPTvG7y2f+4Y7iGjp2u+:aZFYC9tHgAJsv6tWKFdu9CUi+
- TLSH T1BFF58D83B2A65264D8B3C13886A7D55BDA327C02CF249ADF115CB3496EB37F0193B725
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1418604
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
userenv
GetUserProfileDirectoryW
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
netapi32
NetApiBufferFree
NetShareEnum
ws2_32
WSAAsyncSelect
advapi32
CopySid
GetSidSubAuthorityCount
GetSidSubAuthority
RegSetValueExW
RegFlushKey
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
BuildTrusteeWithSidW
GetNamedSecurityInfoW
GetEffectiveRightsFromAclW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
SystemFunction036
OpenProcessToken
AccessCheck
AllocateAndInitializeSid
MapGenericMask
DuplicateToken
FreeSid
GetLengthSid
GetTokenInformation
LookupAccountSidW
kernel32
EnumSystemLocalesW
GetStdHandle
GetFileSizeEx
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapSize
WriteConsoleW
ReadFile
GetModuleHandleA
GetProcAddress
OutputDebugStringW
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetConsoleWindow
GetModuleHandleW
CloseHandle
SetEvent
WaitForSingleObjectEx
CreateEventW
GetLastError
LocalFree
FormatMessageW
GetCommandLineW
GetCurrentProcessId
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount64
GetSystemTime
GetLocalTime
DuplicateHandle
WaitForSingleObject
Sleep
WaitForMultipleObjects
CreateThread
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
GetThreadPriority
TerminateThread
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemInfo
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
GetCurrencyFormatW
GetUserDefaultLCID
GetUserPreferredUILanguages
MultiByteToWideChar
WideCharToMultiByte
GetStartupInfoW
GetModuleFileNameW
ResetEvent
CreateFileW
GetFileAttributesExW
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
GetFileAttributesW
GetFileInformationByHandle
GetFullPathNameW
GetLogicalDrives
GetLongPathNameW
RemoveDirectoryW
SetFileTime
GetTempPathW
GetVolumePathNamesForVolumeNameW
SetErrorMode
DeviceIoControl
CopyFileW
MoveFileW
MoveFileExW
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
GetFileInformationByHandleEx
FlushFileBuffers
GetFileType
SetEndOfFile
SetFilePointerEx
WriteFile
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetTimeZoneInformation
GetGeoInfoW
GetUserGeoID
UnregisterWaitEx
RegisterWaitForSingleObject
FindFirstFileExW
FindNextFileW
FreeLibrary
GetModuleHandleExW
LoadLibraryW
GetExitCodeProcess
OpenProcess
GetSystemDirectoryW
ReleaseMutex
CreateMutexA
VirtualAlloc
VirtualFree
IsValidLocale
LCMapStringW
CompareStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetEnvironmentVariableW
HeapReAlloc
HeapAlloc
HeapFree
ExitProcess
SetStdHandle
SetFileAttributesW
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
FreeLibraryAndExitThread
ExitThread
GetCommandLineA
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
SetLastError
InterlockedFlushSList
RtlUnwindEx
RtlPcToFileHeader
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
VirtualProtect
VirtualQuery
LoadLibraryExA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
ole32
CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemFree
user32
GetQueueStatus
DestroyWindow
CreateWindowExW
UnregisterClassW
SetTimer
DefWindowProcW
PostMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
CharNextExA
MsgWaitForMultipleObjectsEx
KillTimer
GetWindowLongPtrW
SetWindowLongPtrW
RegisterClassW
winmm
timeKillEvent
timeSetEvent
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
106KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
62KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=259, version=30795,
count=182, id=261, version=30795,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33218,
count=18, id=259, version=33218,
count=83, id=261, version=33218,
count=30, id=260, version=30795,
count=1, id=262, version=30795,
count=21, id=257, version=30795,
count=44, id=260, version=33519,
count=276, id=1, productName=Unmarked objects,
count=163, id=261, version=33519,
count=1, id=255, version=33519,
count=1, id=258, version=33519,
0.l1j7g2laz7n.node
- IMPHASH a33647508065dcb8879135382952df57
- SHA256 4f42603e864aacb060ba6abc27f072723163bc25114c806a93836c1b22762d6a
- MD5 b23c406ecfaf6d1a5ff22468b8cd99c5
- SHA1 2db69ee25d7f19a7e5db38efd841663bb9964da7
- SHA512 b1163e4badf254d37f0be99bfa235a054cbc353ce100601244975664fd800769909827fc3f6cc5c7a1a118b6f8f809d94ce568b99fc641d2bfcca94bf8e1efcd
- SSDEEP 24576:9s9+ZqNyD34Fo3wJrSloI3VZtmpM7geGEjVleb2ubzAgEETsxg/ScrqfwjajKjsK:9s9+ZqNyD34Fo3wJrSloI3VZtmpM7ger
- TLSH T1A1755C2FB1F540E9C0BDD078D62BA507EB7530994B2892EB11E585963F27FF06A7E201
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1181164
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ws2_32
accept
freeaddrinfo
getaddrinfo
WSASocketW
WSASend
WSARecv
WSAIoctl
WSAGetLastError
WSASetLastError
WSACleanup
WSAStartup
shutdown
setsockopt
select
listen
htons
htonl
getsockopt
getsockname
ioctlsocket
connect
closesocket
bind
__WSAFDIsSet
kernel32
WriteConsoleW
CreateFileW
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetLastError
FormatMessageA
FormatMessageW
WideCharToMultiByte
LocalFree
CloseHandle
SetLastError
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CancelIoEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
WaitForSingleObject
SleepEx
CreateEventW
SetWaitableTimer
Sleep
WaitForMultipleObjects
QueueUserAPC
TerminateThread
GetSystemTimeAsFileTime
CreateWaitableTimerA
GetModuleHandleA
GetProcAddress
FindClose
SetFilePointerEx
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
FreeLibrary
GetModuleHandleW
LoadLibraryExA
RtlPcToFileHeader
GetCurrentThreadId
QueryPerformanceCounter
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
InitializeCriticalSectionEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
InitializeSListHead
InterlockedFlushSList
RtlUnwindEx
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
HeapReAlloc
HeapSize
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
mswsock
AcceptEx
GetAcceptExSockaddrs
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
175KB
Virtual Size
174KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
48KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=259, version=30795,
count=144, id=261, version=30795,
count=10, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33218,
count=18, id=259, version=33218,
count=60, id=261, version=33218,
count=7, id=257, version=30795,
count=284, id=1, productName=Unmarked objects,
count=2, id=261, version=33519,
count=1, id=255, version=33519,
count=1, id=258, version=33519,
0.wdzcov7dsab.node
- IMPHASH 8b468abf6d7aabc81aede48bb7a73bf6
- SHA256 f927cc7e32127597f21768cfc18605b638b725cea06146363f7bed2d4eb954ee
- MD5 b8eefbb2dfedfc6d0440ef70e7e4df54
- SHA1 b158fdb5d651850c5cc24d8c37f860d978ba4948
- SHA512 11f91e093929ac55826bff94da8bf2d646bf4375f3240599e95499d4d284a63c6a3162769220a9656ab12fcbac7bdbcbaafc1a34c5341c5025840c2d2820b001
- SSDEEP 3072:ZHcV7YJjQVL5C+iYKd5t+VeBgGQ6TcpbLcgOomMs1LMDiJJ72XQXcFK+i+INYqvf:Zi1K5t+VeBg3dpbADxLJrHxiqvjr
- TLSH T1E3447C5973A40CB9EAB7823C89534A06E7F2BC1607A0DBCF03A046AB5F277D1953E751
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
41104
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Projects\wp\node_modules\.pnpm\[email protected]_patch_hash=wkyocvtnp4jmmu6m6ja5t6qmy4\node_modules\node-pty\build\Release\pty.pdb
kernel32
GetModuleHandleA
GetProcessId
CloseHandle
SetEnvironmentVariableA
GetExitCodeProcess
GetEnvironmentVariableW
GetFileAttributesW
MultiByteToWideChar
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
CreateFileW
SetFilePointerEx
GetFileSizeEx
SetStdHandle
HeapSize
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
GetProcessHeap
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStringTypeW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
ExitProcess
HeapFree
WriteFile
OutputDebugStringW
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
shlwapi
PathIsRelativeW
PathCombineW
winpty
winpty_agent_process
winpty_get_console_process_list
winpty_error_msg
winpty_error_free
winpty_config_free
winpty_free
winpty_spawn_config_free
winpty_config_new
winpty_spawn
winpty_config_set_initial_size
winpty_conin_name
winpty_spawn_config_new
winpty_open
winpty_conout_name
winpty_set_size
Name
.text
Size
170KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
1024B
Virtual Size
640B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=159, id=261, version=30795,
count=16, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33218,
count=18, id=259, version=33218,
count=2, id=257, version=33519,
count=74, id=261, version=33218,
count=5, id=257, version=30795,
count=172, id=1, productName=Unmarked objects,
count=3, id=265, version=33519,
count=1, id=255, version=33519,
count=1, id=258, version=33519,
0.yqnjc1u99y.node
- IMPHASH e56950b011112d55645e79b8fc87ad20
- SHA256 80d534b732872bc08822a1e7ba956c4302675fbe35ff91e3016f516578be7aaa
- MD5 b7f335d9595b99b71042e1fe8c2226c7
- SHA1 12dea2972485adec045397263c4fc15263efd214
- SHA512 6e001959ea81c566b2f76b0db500ab401b956162c50f7d554af5dcce187d04ee15340b6095d812816e51ab7217edb7a5539dd92eca315666d96b25740ddf1e34
- SSDEEP 12288:RMB+pLE42AfklLxSXEufOV4IQL7hnCH8qH:RMB+pE4RWtiOWnL707
- TLSH T10BB46D2AA6A807A8F1BB917C89674D06FA7678860364DADF03E087365F177D14F3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
231160
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Projects\wp\node_modules\.pnpm\[email protected]_patch_hash=etudl5ashw2yven72fovvfkh2i\node_modules\classic-level\build\Release\classic_level.pdb
kernel32
GetModuleHandleA
LoadLibraryExA
CreateDirectoryW
ReadFile
FindFirstFileW
GetFileSizeEx
FindNextFileW
WriteFile
RemoveDirectoryW
GetTempPathW
FindClose
CreateFileW
MultiByteToWideChar
Sleep
GetLastError
GetFileAttributesExW
QueryPerformanceFrequency
DeleteFileW
CloseHandle
SetFilePointerEx
LocalFree
MoveFileExW
WideCharToMultiByte
FormatMessageA
QueryPerformanceCounter
FlushFileBuffers
GetCurrentThreadId
GetLocalTime
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
TryAcquireSRWLockExclusive
GetProcAddress
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
CreateThread
ExitThread
FreeLibraryAndExitThread
ExitProcess
OutputDebugStringW
HeapFree
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetConsoleOutputCP
GetConsoleMode
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
SetStdHandle
ReadConsoleW
HeapSize
HeapReAlloc
SetEndOfFile
GetSystemInfo
VirtualProtect
VirtualQuery
Name
.text
Size
377KB
Virtual Size
377KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
119KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=153, id=261, version=30795,
count=10, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=14, id=260, version=33218,
count=17, id=259, version=33218,
count=54, id=261, version=33218,
count=3, id=257, version=30795,
count=184, id=1, productName=Unmarked objects,
count=42, id=265, version=33519,
count=1, id=255, version=33519,
count=1, id=258, version=33519,
app.jsc
- SHA256 5f071a36c0a79ddce92824a49fd8e9bd048b87cabb635671073402365afc342a
- MD5 6e023b9b3097a2dba311cb06a91fe259
- SHA1 93b003e193d4514444d8722a11a34e9e3b572166
- SHA512 208c81e5327c1046dc0e7e94709bc1fafe4a3d325f9c9830248f965c5a213f25b8104a850f7e1575a8ffec17187409b7996f5248c6a4137c5868de45363716e6
- SSDEEP 98304:PmNQf1ZQSBgN2o1BFgoAb9a4Y/V1AdIdp+5/qU9tYTaXrGjcF/yWI:uNQNZF+0o1BFgo0a4YEIdk5iUBXN/k
- TLSH T1981633CB591358F64A52EF46DA5C5856CA17C6BFC8DBC33EBA4CC061CA22C16735222F
- MD5 SHA1 SHA512 SSDEEP TLSH
preflight.js
- SHA256 fc3ae90921bee53a04dd49475aef3cb07304c1ac483cc336e70e3b1288c6c0ec
- MD5 64eb605c96635206891376968a7cb264
- SHA1 695d91dcfe6c62e331d12d4dcc8e80a4222b663d
- SHA512 44cc7674d8a00acde2142a2800820a58713b85a264704a0067cdf606e0065639dbfbc7659cfe43b31df46305bbf3f566cc8fc8f7fb091d3accfe47dd9eaef2ee
- TLSH T1C5211DE423D8F6A1264020CEC17F9647F261D4399118FA84F3C8DCE696C58270966F2B
- MD5 SHA1 SHA512 TLSH
winpty-agent.exe
- IMPHASH 1cb5f69ff93f0e4663547de45cd126fb
- SHA256 204405159682b784d39fb7721cc84b6cd3bbd2baf81ac46b90ed92c3a9155a41
- MD5 00bf8005efa56acbb4b07763f3f8ad0a
- SHA1 d56dee7b943cca62989a203e9238f7ca514c362c
- SHA512 fea1436c11a56feb262cf9c05244e7cf20f2b4bf288867dc910f6c2a581cb5a9b27dd603bcca6d36c287bcfb3c291c927dc5d6ed838b80c9abfd1021c8b8811a
- SSDEEP 6144:f3lHz5KTVG+RQliOkri9IYTU88CX1hzBfwiu2dGOHJhPca:jKTVGEnBri9IYTU8NX1GOphPca
- TLSH T1B4549E1AB3A814F8E867C17CC9469903E6B2784A0335DBDF17A447663F276E05E3DB60
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6f:fa:fd:98:27:ff:52:cd:a6:a0:c9:83:09:c3:aa:42:d6:db:d5:39:0b:af:3a:e0:37:52:51:58:fe:f2:39:7b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 13, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:3BD4-4B80-69C3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e5:8f:6a:c0:f3:3d:b4:0b:a3:00:01:00:00:01:e5
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
99516
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\node_modules\node-pty\build\Release\winpty-agent.pdb
kernel32
GetConsoleCP
LoadLibraryW
GetProcAddress
FreeLibrary
SetConsoleMode
GetConsoleMode
GetTickCount
GenerateConsoleCtrlEvent
ReadConsoleInputW
WaitForMultipleObjects
Sleep
ReadFile
CancelIo
WriteFile
CreateNamedPipeW
CreateFileW
CreateEventW
ResetEvent
GetOverlappedResult
ConnectNamedPipe
GetConsoleCursorInfo
GetConsoleTitleW
GetConsoleWindow
SetConsoleTitleW
GetConsoleScreenBufferInfo
GetConsoleOutputCP
SetConsoleScreenBufferSize
SetConsoleWindowInfo
CreateConsoleScreenBuffer
FillConsoleOutputCharacterW
ReadConsoleOutputW
FillConsoleOutputAttribute
SetConsoleCursorPosition
WriteConsoleOutputW
GetCommandLineW
GetCurrentThreadId
GetModuleFileNameA
SetNamedPipeHandleState
SetLastError
GetEnvironmentVariableA
GetCurrentProcessId
TransactNamedPipe
GetSystemTimeAsFileTime
WaitNamedPipeW
WideCharToMultiByte
LocalAlloc
GetCurrentThread
LocalFree
GetVersionExW
GetSystemDirectoryW
WriteConsoleW
CreateProcessW
WriteConsoleInputW
CloseHandle
GetConsoleProcessList
GetLargestConsoleWindowSize
GetLastError
DuplicateHandle
WaitForSingleObject
GetStdHandle
GetCurrentProcess
SetConsoleCtrlHandler
SetConsoleTextAttribute
GetModuleHandleW
HeapReAlloc
HeapSize
GetProcessHeap
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetCommandLineA
HeapFree
HeapAlloc
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
FlushFileBuffers
GetFileSizeEx
SetFilePointerEx
FindClose
FindFirstFileExW
advapi32
SetSecurityDescriptorDacl
AllocateAndInitializeSid
SetEntriesInAclW
OpenProcessToken
FreeSid
InitializeSecurityDescriptor
OpenThreadToken
GetTokenInformation
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
shell32
CommandLineToArgvW
user32
CloseDesktop
CreateDesktopW
SetProcessWindowStation
PostMessageW
SendMessageW
CreateWindowStationW
MapVirtualKeyW
VkKeyScanW
GetDoubleClickTime
CloseWindowStation
GetUserObjectInformationW
GetProcessWindowStation
Name
.text
Size
194KB
Virtual Size
193KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=29395,
count=141, id=261, version=29395,
count=10, id=260, version=29395,
count=48, id=261, version=30034,
count=16, id=260, version=30034,
count=10, id=259, version=30034,
count=9, id=257, version=29395,
count=159, id=1, productName=Unmarked objects,
count=29, id=265, version=30153,
count=1, id=255, version=30153,
count=1, id=258, version=30153,
winpty.dll
- IMPHASH d7472042adcbad8dc3267d828df2ba30
- SHA256 dd4c290d6b2589f71f7c53b6a94a56d69d0d4c3ad96b97496da2b6632ca8007b
- MD5 5029b21d2108810c69befa937bb89c64
- SHA1 efacb363c93805f614bcf4aff640d94750e66a28
- SHA512 0b1a3791f5a8370d1f67263ecb53e456d93d9206ad935739d23fa0abb5437ee67fbc9344abc73c222e4bb6419642cae22a85996e1cac50e0d4d43b824b8e3142
- SSDEEP 3072:6Nle4hzC+1KDwmzKMNwzPdlkmc47Y4ghGy5xX26cWM9BXg7+6ZYTb5Vo1m4Sb4vI:UlbNKDyywzPdlWSYrMsGp4voyC
- TLSH T14A346D0973E50CBDE9B79279C9638906E6727C054730D6DF03A0466B9F2B7E0993EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
53584
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Projects\wp\node_modules\.pnpm\[email protected]_patch_hash=wkyocvtnp4jmmu6m6ja5t6qmy4\node_modules\node-pty\build\Release\winpty.pdb
kernel32
GetEnvironmentVariableA
DuplicateHandle
CreateEventW
GetLastError
CloseHandle
GetOverlappedResult
DeleteCriticalSection
CreateProcessW
ConnectNamedPipe
GetCurrentThreadId
GetModuleFileNameA
SetNamedPipeHandleState
SetLastError
InitializeCriticalSection
GetCurrentProcessId
TransactNamedPipe
GetSystemTimeAsFileTime
WaitNamedPipeW
LoadLibraryW
GetProcAddress
FreeLibrary
WideCharToMultiByte
LocalAlloc
GetCurrentThread
LocalFree
GetVersionExW
GetSystemDirectoryW
LeaveCriticalSection
WaitForMultipleObjects
CreateNamedPipeW
WriteFile
GetCurrentProcess
EnterCriticalSection
CancelIo
ReadFile
GetFileAttributesW
GetModuleFileNameW
GetModuleHandleExW
CreateFileW
GetModuleHandleW
HeapReAlloc
HeapSize
SetStdHandle
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
GetFileType
WriteConsoleW
ExitProcess
OutputDebugStringW
HeapFree
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
advapi32
SetSecurityDescriptorDacl
AllocateAndInitializeSid
SetEntriesInAclW
OpenProcessToken
FreeSid
InitializeSecurityDescriptor
OpenThreadToken
GetTokenInformation
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
user32
CloseDesktop
CreateDesktopW
CloseWindowStation
GetUserObjectInformationW
GetProcessWindowStation
CreateWindowStationW
SetProcessWindowStation
GetThreadDesktop
winpty_agent_process
winpty_conerr_name
winpty_config_free
winpty_config_new
winpty_config_set_agent_timeout
winpty_config_set_initial_size
winpty_config_set_mouse_mode
winpty_conin_name
winpty_conout_name
winpty_error_code
winpty_error_free
winpty_error_msg
winpty_free
winpty_get_console_process_list
winpty_open
winpty_set_size
winpty_spawn
winpty_spawn_config_free
winpty_spawn_config_new
Name
.text
Size
160KB
Virtual Size
159KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=139, id=261, version=30795,
count=10, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=40, id=261, version=33218,
count=14, id=260, version=33218,
count=18, id=259, version=33218,
count=7, id=257, version=30795,
count=129, id=1, productName=Unmarked objects,
count=14, id=265, version=33519,
count=1, id=256, version=33519,
count=1, id=255, version=33519,
count=1, id=258, version=33519,