jaffacakes118_5a024ae97242be3b1b954f845f7a87a1411c47830f81a2b54f47ec2cf741e2a0.zip
- SHA256 5a024ae97242be3b1b954f845f7a87a1411c47830f81a2b54f47ec2cf741e2a0
Overview
overview
3Static
static
30.60iybw52ns8.dll
windows10-2004-x64
10.60iybw52ns8.dll
windows11-ltsc_2024-x64
10.cmuxyx5pg9n.dll
windows10-2004-x64
10.cmuxyx5pg9n.dll
windows11-ltsc_2024-x64
10.nktakimjku.dll
windows10-2004-x64
10.nktakimjku.dll
windows11-ltsc_2024-x64
10.rw8sdiuwg5l.dll
windows10-2004-x64
10.rw8sdiuwg5l.dll
windows11-ltsc_2024-x64
10.tnkh2xxo19e.dll
windows10-2004-x64
10.tnkh2xxo19e.dll
windows11-ltsc_2024-x64
10.utmgqqt75bo.dll
windows10-2004-x64
10.utmgqqt75bo.dll
windows11-ltsc_2024-x64
10.za8syx90sdi.dll
windows10-2004-x64
10.za8syx90sdi.dll
windows11-ltsc_2024-x64
1preflight.js
windows10-2004-x64
3preflight.js
windows11-ltsc_2024-x64
3winpty-agent.exe
windows10-2004-x64
1winpty-agent.exe
windows11-ltsc_2024-x64
1winpty.dll
windows10-2004-x64
1winpty.dll
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0.60iybw52ns8.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
0.60iybw52ns8.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
0.cmuxyx5pg9n.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
0.cmuxyx5pg9n.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
0.nktakimjku.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
0.nktakimjku.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
0.rw8sdiuwg5l.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
0.rw8sdiuwg5l.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
0.tnkh2xxo19e.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
0.tnkh2xxo19e.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
0.utmgqqt75bo.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
0.utmgqqt75bo.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
0.za8syx90sdi.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
0.za8syx90sdi.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
preflight.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
preflight.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
winpty-agent.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
winpty-agent.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
winpty.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
winpty.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target jaffacakes118_5a024ae97242be3b1b954f845f7a87a1411c47830f81a2b54f47ec2cf741e2a0.zip
- Size 12.9MB
- Sample261107-1gcbbsvxft
- SHA256 5a024ae97242be3b1b954f845f7a87a1411c47830f81a2b54f47ec2cf741e2a0
- MD5 3d48a83fd884ae23fae1627ef1a20de6
- SHA1 9f3e8556862ccca49609299bab2623289cdc2d01
- SHA512 a41ca67bde903e715f163b0a58fbdf510587ef3f95fb41b2469b4d74511eb866fd66640a73b7682a1f9caa0c4b0f4aac293e763142ea1227d9e3eb0ca2f44d32
- SSDEEP 393216:/nFIQJ/clieIKBxXy6B4acicike1AedJTh5PstOgLl:/FxJEAeD+6rciRAilh5stOyl
- TLSH T1E8D633AB524E494B77681ABA3F019D4CC91401D8AD03FA58D69F7F7218FBDD063CB42A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 8 IoCs
Checks for missing Authenticode signature.
resource unpack001/0.60iybw52ns8.node unpack001/0.cmuxyx5pg9n.node unpack001/0.nktakimjku.node unpack001/0.rw8sdiuwg5l.node unpack001/0.tnkh2xxo19e.node unpack001/0.utmgqqt75bo.node unpack001/0.za8syx90sdi.node unpack001/winpty.dll
File Explorer
-
jaffacakes118_5a024ae97242be3b1b954f845f7a87a1411c47830f81a2b54f47ec2cf741e2a0.zip.zip 12.9MB
-
0.60iybw52ns8.node.dll 253KB
-
0.cmuxyx5pg9n.node.dll 1.8MB
-
0.nktakimjku.node.dll 164KB
-
0.rw8sdiuwg5l.node.dll 184KB
-
0.tnkh2xxo19e.node.dll 1.6MB
-
0.utmgqqt75bo.node.dll 259KB
-
0.za8syx90sdi.node.dll 522KB
-
app.jsc10.7MB
-
preflight.js.js 1KB
-
winpty-agent.exe.exe 296KB
-
winpty.dll.dll 240KB
0.60iybw52ns8.node
- IMPHASH 8b468abf6d7aabc81aede48bb7a73bf6
- SHA256 267af8b5d1b9ad3930b3c321ea42cb7f1497d9d6410c31b4b08112066cc3bb50
- MD5 8ca680ed1c15912e9e169b1962638986
- SHA1 d32b84ca6a60d5628498cc7059be108a2c9b3bd4
- SHA512 453cf05309fe6c321ef60e080a7c9ef5b441627549789df0e236cbfc5540c7b6cd84d34788c0acb8e44def1e4e385424c5b0fbdc70fd1fe5096b3b6127f0a0d6
- SSDEEP 3072:qqksAxisZCvmWv6TUcd2CpEWkAsqxlHsI6/nfufgpOcmJiSbmiKgvJL94XV:qqkYEYMuzQCZ/Clb3Zvx94F
- TLSH T18F447C59B3A40CB4E9B7823DC9534906D7F2BC0543A0E7DF03A4469A5F277E0AA3E752
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
40832
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Projects\wp\node_modules\.pnpm\[email protected]_patch_hash=3nooxfv76oog7zg6nsh6fnneum\node_modules\node-pty\build\Release\pty.pdb
kernel32
GetModuleHandleA
GetProcessId
CloseHandle
SetEnvironmentVariableA
GetExitCodeProcess
GetEnvironmentVariableW
GetFileAttributesW
MultiByteToWideChar
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
CreateFileW
SetFilePointerEx
GetFileSizeEx
SetStdHandle
HeapSize
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
GetProcessHeap
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStringTypeW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
ExitProcess
HeapFree
WriteFile
OutputDebugStringW
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
shlwapi
PathIsRelativeW
PathCombineW
winpty
winpty_agent_process
winpty_get_console_process_list
winpty_error_msg
winpty_error_free
winpty_config_free
winpty_free
winpty_spawn_config_free
winpty_config_new
winpty_spawn
winpty_config_set_initial_size
winpty_conin_name
winpty_spawn_config_new
winpty_open
winpty_conout_name
winpty_set_size
Name
.text
Size
166KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=159, id=261, version=30795,
count=16, id=260, version=30795,
count=10, id=259, version=34321,
count=14, id=260, version=34321,
count=2, id=257, version=34435,
count=75, id=261, version=34321,
count=5, id=257, version=30795,
count=172, id=1, productName=Unmarked objects,
count=3, id=265, version=34435,
count=1, id=255, version=34435,
count=1, id=258, version=34435,
0.cmuxyx5pg9n.node
- IMPHASH 60282564abb1c4be8c411afc7ee3f299
- SHA256 a006e443a4e94e9aa781ce77f8a2cbe7e1d8ab368146b53725c69d037c7e93da
- MD5 af5554350693c8ac1cc92a9dc7a78573
- SHA1 65467cca33298a5b3d43e5f95dff49f92c39d93e
- SHA512 17fb219261db79e802409861a6f7dbf5f0b3352de04b4d352d01ed949054e6497876b440d109b69c3cf9d498fdf51eca8df8eccb579c4924ad8c26c57e686a73
- SSDEEP 49152:BLsrw0iJtPNjPw3GtVFVVegyRDJHc9ErA8AWNO+BnU+UyPWu0MgvgdrUVUvVx9ar:aV26A
- TLSH T17195191861E502BDC17BE077A952954FFE6238948338DAF708ED91322F567DCA6BF108
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1173952
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ws2_32
accept
freeaddrinfo
getaddrinfo
WSASocketW
WSASend
WSARecv
WSAIoctl
WSAGetLastError
WSASetLastError
WSACleanup
WSAStartup
shutdown
setsockopt
select
listen
htons
htonl
getsockopt
getsockname
ioctlsocket
connect
closesocket
bind
__WSAFDIsSet
kernel32
WriteConsoleW
CreateFileW
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetLastError
FormatMessageA
FormatMessageW
WideCharToMultiByte
LocalFree
CloseHandle
SetLastError
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CancelIoEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
WaitForSingleObject
SleepEx
CreateEventW
SetWaitableTimer
Sleep
WaitForMultipleObjects
QueueUserAPC
TerminateThread
GetSystemTimeAsFileTime
CreateWaitableTimerA
GetModuleHandleA
GetProcAddress
FindClose
SetFilePointerEx
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
FreeLibrary
GetModuleHandleW
LoadLibraryExA
RtlPcToFileHeader
GetCurrentThreadId
QueryPerformanceCounter
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
InitializeSListHead
InterlockedFlushSList
RtlUnwindEx
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
HeapReAlloc
HeapSize
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
mswsock
AcceptEx
GetAcceptExSockaddrs
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
506KB
Virtual Size
506KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
48KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=259, version=30795,
count=144, id=261, version=30795,
count=10, id=260, version=30795,
count=10, id=259, version=34321,
count=14, id=260, version=34321,
count=59, id=261, version=34321,
count=7, id=257, version=30795,
count=284, id=1, productName=Unmarked objects,
count=2, id=261, version=34435,
count=1, id=255, version=34435,
count=1, id=258, version=34435,
0.nktakimjku.node
- IMPHASH 291f463f2fb6753c3f9775b4c11c1aa6
- SHA256 a4e18d5896c5889635efe31c6f1a0ce8ccafeabe9521e0f92c46a5861e8c290b
- MD5 629497ab98678c5d6f9af76ec3c7a867
- SHA1 3b56d0c4b787a838972d9a304acdf1d5f2b49f00
- SHA512 6d2003903cead41889902ff46ec282503bc234f99c3fbd8124b3e3cb1b1e63bf27e195fe9feb32086a82b6c83fa4e1aab309f8b76dcbb41487c8c987d25a351e
- SSDEEP 3072:S1M26BVoepFkqPPZ3i+wqOmSrRpO+QegC2OAF2+:yqoepuqPB3i+AmS9pss+
- TLSH T18AF36D17B3A504B7E5738238C9639A46F772B4110760ABEF07A0837A5F27790AD3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
21888
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\uiohook-napi\uiohook-napi\build\Release\uiohook_napi.pdb
kernel32
LoadLibraryExA
SetLastError
GetCurrentThreadId
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
GetLastError
LCMapStringW
GetStdHandle
GetFileType
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetStdHandle
GetFileSizeEx
SetFilePointerEx
HeapSize
CloseHandle
CreateFileW
WriteConsoleW
VirtualQuery
VirtualProtect
GetSystemInfo
GetCurrentThread
SetThreadPriority
FlsFree
GetModuleHandleA
user32
GetForegroundWindow
SetWindowsHookExA
PostThreadMessageA
SetTimer
RegisterWindowMessageA
GetAsyncKeyState
CallNextHookEx
PostMessageA
UnhookWindowsHookEx
GetMessageA
ActivateKeyboardLayout
GetKeyboardLayout
GetKeyboardLayoutList
GetKeyboardLayoutNameA
GetWindowThreadProcessId
GetDoubleClickTime
EnumDisplayMonitors
DispatchMessageA
TranslateMessage
SystemParametersInfoA
KillTimer
SetWinEventHook
UnhookWinEvent
GetSystemMetrics
SendInput
GetMessageTime
advapi32
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
_register_uiohook_napi_
hook_create_screen_info
hook_get_auto_repeat_delay
hook_get_auto_repeat_rate
hook_get_multi_click_time
hook_get_pointer_acceleration_multiplier
hook_get_pointer_acceleration_threshold
hook_get_pointer_sensitivity
hook_post_event
hook_run
hook_set_dispatch_proc
hook_set_logger_proc
hook_stop
napi_register_module_v1
Name
.text
Size
98KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=29395,
count=136, id=261, version=29395,
count=10, id=260, version=29395,
count=14, id=260, version=30034,
count=9, id=259, version=30034,
count=33, id=261, version=30034,
count=7, id=257, version=29395,
count=163, id=1, productName=Unmarked objects,
count=9, id=265, version=30154,
count=1, id=256, version=30154,
count=1, id=255, version=30154,
count=1, id=258, version=30154,
0.rw8sdiuwg5l.node
- IMPHASH c1b46afc2132351bc04db0937da5d4a0
- SHA256 9faed67b4420f00a565dbf377309b2518da08120aff804cf670985c0f04cab94
- MD5 7c9b99950355777e1621d19d37ebc41a
- SHA1 0bd351dee226456798e9e6f17ab6d991020ec2c9
- SHA512 ef74d70a674019f4f4b9f54638ca1c4df1b20f497f7a314abadd5e8fe438eb88966667f010dce27a11dae7c3fda316c9b5c3228425b6990c292be7f4cb06c7ce
- SSDEEP 3072:ooDPpaLIYfYcrltsoCkMTGLErKMbCg53fq/OyHrSiv5+IuoRq:/DPprl4lSoChePMb7pfq/H75HRM
- TLSH T107046D0A73A4017DECA7D13DC9879E02E676744503709ADF07A04779AF2B3E19E3AB52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
57288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Projects\wp\node_modules\.pnpm\[email protected]_patch_hash=a5o3tlj6ol3yud3qnhubz54bj4\node_modules\drivelist\build\Release\drivelist.pdb
kernel32
GetModuleHandleA
GetLogicalDrives
DeviceIoControl
GetDriveTypeA
CreateFileW
GetLastError
CreateFileA
CloseHandle
WideCharToMultiByte
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
WriteFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
setupapi
SetupDiGetDeviceRegistryPropertyA
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
Name
.text
Size
120KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=135, id=261, version=30795,
count=10, id=260, version=30795,
count=10, id=259, version=34321,
count=14, id=260, version=34321,
count=44, id=261, version=34321,
count=1, id=262, version=30795,
count=9, id=257, version=30795,
count=146, id=1, productName=Unmarked objects,
count=4, id=265, version=34435,
count=1, id=255, version=34435,
count=1, id=258, version=34435,
0.tnkh2xxo19e.node
- IMPHASH 04084d643c609dec5b942b355cf5584d
- SHA256 6bb5b5f82fd4889331f2e15f2044730bfeb1550db838f8a0b7f552aaa4216ed4
- MD5 2eac03bddb15a8177b58076d4f5aaa00
- SHA1 44b014d8e3aa6ab31044ee5951f1807eca3fcca4
- SHA512 bc6596a7c8f6631694bb6ba3214306a8058a94c1ebaf0851dd38693be9e51024ff5a62acf656683243d9bb8c6d6c6e90068d0ae84578cf209575d504b762cfa7
- SSDEEP 49152:FGhzqxwR2gmGqHDAKYNtKss/v/aIz0mY:FGpqG2g5qHDNcmj0mY
- TLSH T1F2758E46B3B900FCC46BC1B8861B6607E7B2740513759BEF55908AAA6F23FE1167F324
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1255116
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\better-sqlite3\better-sqlite3\build\Release\better_sqlite3.pdb
kernel32
GetModuleHandleA
LoadLibraryExA
AreFileApisANSI
ReadFile
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
RaiseException
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
InterlockedFlushSList
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStdHandle
GetFileType
GetStringTypeW
SetStdHandle
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
VirtualProtect
VirtualQuery
node_register_module_v108
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
233KB
Virtual Size
233KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
22KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=259, version=29395,
count=149, id=261, version=29395,
count=34, id=260, version=29395,
count=14, id=260, version=30034,
count=10, id=259, version=30034,
count=41, id=261, version=30034,
count=3, id=257, version=29395,
count=234, id=1, productName=Unmarked objects,
count=3, id=265, version=30154,
count=1, id=256, version=30154,
count=1, id=255, version=30154,
count=1, id=258, version=30154,
0.utmgqqt75bo.node
- IMPHASH be67663277eb3081f0ced3b9df41c059
- SHA256 6c0dacd99283f0fff4408938dc49d282f6b19e2161f3619f078a5b64dd49b9f6
- MD5 3c36c8533d6be2a6f7d2088093ca2a11
- SHA1 8004cdeacd6f1a6fe5ffdbef2f017bcaf5b31cac
- SHA512 ddf22c3b6114ee2566c8745429d56d58e211b6bbc754c00fcb9c3d664e57595fd3bdf08cd64d682bafd8792f57283dacfad8113c4074a51e67d8cf86ea6e44e2
- SSDEEP 6144:HaqJS+2zcO7mHl6Q3wmPzX+OMu68kZHow/isi:Yv17mFFwmPT+OX6NZj/
- TLSH T18B444C47B2A40CBAEC6BD13D894B4A02E3B27C560760EBCF1350465AAF577D1AE3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
98896
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
LoadLibraryExA
LoadLibraryExW
GetModuleHandleW
HeapReAlloc
HeapSize
SetLastError
VirtualQueryEx
VirtualProtectEx
VirtualQuery
VirtualFree
WriteConsoleW
VirtualProtect
SetStdHandle
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
VirtualAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
FlushInstructionCache
SetThreadContext
GetThreadContext
ResumeThread
SuspendThread
GetCurrentThreadId
GetModuleHandleA
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
CreateSymbolicLinkW
WTSGetActiveConsoleSessionId
GetSystemPowerStatus
SetSystemPowerState
QueryFullProcessImageNameW
SetThreadExecutionState
LocalFree
GlobalLock
GlobalUnlock
LoadLibraryW
GetProcAddress
FreeLibrary
OpenProcess
CreateProcessW
GetCurrentThread
TerminateProcess
GetCurrentProcess
CreateWaitableTimerW
CancelWaitableTimer
SetWaitableTimer
GetLastError
CloseHandle
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
SetFilePointerEx
GetFileType
GetStdHandle
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HeapFree
HeapAlloc
GetProcessHeap
SearchPathW
GetModuleFileNameW
ExitProcess
GetCPInfo
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RaiseException
GetSystemInfo
RtlPcToFileHeader
FormatMessageA
GetLocaleInfoEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
InterlockedFlushSList
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
user32
ReleaseDC
GetDC
GetSystemMetrics
ExitWindowsEx
gdi32
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
SelectObject
shell32
SHGetFolderPathW
ole32
CoUninitialize
CoInitializeEx
CLSIDFromString
StringFromGUID2
GetHGlobalFromStream
CreateStreamOnHGlobal
advapi32
RegQueryInfoKeyW
SetThreadToken
ConvertSidToStringSidW
StartServiceW
QueryServiceStatusEx
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
EnumServicesStatusExW
ControlService
CloseServiceHandle
ChangeServiceConfigW
RegDeleteTreeW
RegDeleteKeyValueW
RegSetValueExW
RegQueryValueExW
CreateProcessAsUserW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegCreateKeyExW
RegCloseKey
LookupPrivilegeValueW
LookupAccountNameW
SetTokenInformation
RevertToSelf
ImpersonateLoggedOnUser
GetTokenInformation
DuplicateTokenEx
AdjustTokenPrivileges
OpenProcessToken
api-ms-win-shcore-scaling-l1-1-1
SetProcessDpiAwareness
wininet
InternetSetOptionW
wtsapi32
WTSQueryUserToken
WTSEnumerateSessionsW
WTSFreeMemory
WTSQuerySessionInformationW
powrprof
PowerEnumerate
PowerWriteDCValueIndex
PowerWriteACValueIndex
gdiplus
GdiplusStartup
GdipCloneImage
GdipAlloc
GdipFree
GdipDisposeImage
GdipSaveImageToStream
GdipCreateBitmapFromHBITMAP
GdiplusShutdown
vssapi
CreateVssBackupComponentsInternal
VssFreeSnapshotPropertiesInternal
crypt32
CryptUnprotectData
ncrypt
NCryptExportKey
NCryptFinalizeKey
NCryptSetProperty
NCryptSignHash
NCryptDeleteKey
NCryptOpenStorageProvider
NCryptOpenKey
NCryptCreatePersistedKey
NCryptDecrypt
NCryptFreeObject
NCryptGetProperty
Name
.text
Size
160KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=138, id=261, version=30795,
count=10, id=259, version=34321,
count=14, id=260, version=34321,
count=1, id=263, version=30795,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=56, id=261, version=34321,
count=11, id=260, version=30795,
count=27, id=257, version=30795,
count=301, id=1, productName=Unmarked objects,
count=5, id=261, version=34435,
count=1, id=255, version=34435,
count=1, id=258, version=34435,
0.za8syx90sdi.node
- IMPHASH e56950b011112d55645e79b8fc87ad20
- SHA256 40be032fa3c41cd9f54338591ba06e3055f1eac32adbd48011f6315fa1ffcdf9
- MD5 aaeb1edad35d6b0877d523c79fd21bcb
- SHA1 942bac3a2d6aab7ee42b056c40ed18e3a2adf1b9
- SHA512 c9d287deb4843325d3b420a2d87540027a6f786bdc41cca7626e5d1be85b41828aa9ab3604b8aaca67220a1a0727938b2c21a96c5f74b462d20a6568210b7e3b
- SSDEEP 12288:Qb3fQvfP2ANXWqsT7QywHHh3Fef3xz8k21rb:Qb3fQvfpmq87QNHB34f3f6r
- TLSH T13FB47C2AA6A803A8F0BBD57C89674906F6B638931361DBDF07D086365F177D14B3E720
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
231724
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Projects\wp\node_modules\.pnpm\[email protected]_patch_hash=etudl5ashw2yven72fovvfkh2i\node_modules\classic-level\build\Release\classic_level.pdb
kernel32
GetModuleHandleA
LoadLibraryExA
CreateDirectoryW
ReadFile
FindFirstFileW
GetFileSizeEx
FindNextFileW
WriteFile
RemoveDirectoryW
GetTempPathW
FindClose
CreateFileW
MultiByteToWideChar
Sleep
GetLastError
GetFileAttributesExW
QueryPerformanceFrequency
DeleteFileW
CloseHandle
SetFilePointerEx
LocalFree
MoveFileExW
WideCharToMultiByte
FormatMessageA
QueryPerformanceCounter
FlushFileBuffers
GetCurrentThreadId
GetLocalTime
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
TryAcquireSRWLockExclusive
GetProcAddress
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
CreateThread
ExitThread
FreeLibraryAndExitThread
ExitProcess
OutputDebugStringW
HeapFree
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetConsoleOutputCP
GetConsoleMode
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
SetStdHandle
ReadConsoleW
HeapSize
HeapReAlloc
SetEndOfFile
GetSystemInfo
VirtualProtect
VirtualQuery
Name
.text
Size
374KB
Virtual Size
374KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
119KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=153, id=261, version=30795,
count=10, id=260, version=30795,
count=9, id=259, version=34321,
count=14, id=260, version=34321,
count=55, id=261, version=34321,
count=3, id=257, version=30795,
count=184, id=1, productName=Unmarked objects,
count=42, id=265, version=34435,
count=1, id=255, version=34435,
count=1, id=258, version=34435,
app.jsc
- SHA256 9b5359dc99501ef2a4667d265e9b032f76dc28c97437a463965e2168d20e5c38
- MD5 d064dfaaef30c057b832c79996c35e89
- SHA1 cc184740bed0dbc6f3702e5815a7aba9eaef0404
- SHA512 1d1f17306188959b858a586f5598352e4ce01aa40b4058fd566324effd002b6323162d351fbdba3beab12e41d3f8672d33173531d5f16c10f18458650e6c57f5
- SSDEEP 196608:13lnxIUf6stZsmmS32EjTKB1xyqJlviXFWy4USHuHnHaQkCGUkPF3ANcL1ci:13lqUfhbsmmSmd1xyGiXcy4US0HOCbk5
- TLSH T136B633FB624E4A4737A81DBA3F005588DD2905E4A516EB6CD6DF7F3224FB8D0A2CB015
- MD5 SHA1 SHA512 SSDEEP TLSH
preflight.js
- SHA256 d21e2193f80378603c15bf71b6a7669c8a9266a04f34ea3502c82f1d80532bec
- MD5 28e756c61961b10a026999c80e6f3f9b
- SHA1 5a1b268a75570cbd8f39540b2ea914cdf10c9cbf
- SHA512 0691ead63b5c33f6ac67d84fa8dd0840723c999997f6d3c638f5b647d72ca41dcd09786d15b73458c0e568d947c0732e8ce7d3f73dab5b7542bb1b97ed3628b4
- TLSH T1212130E023E4FAA12A4560CEC13F5249F636C03A9129F0D0FBCDDDE393C101746A6E22
- MD5 SHA1 SHA512 TLSH
winpty-agent.exe
- IMPHASH 1cb5f69ff93f0e4663547de45cd126fb
- SHA256 204405159682b784d39fb7721cc84b6cd3bbd2baf81ac46b90ed92c3a9155a41
- MD5 00bf8005efa56acbb4b07763f3f8ad0a
- SHA1 d56dee7b943cca62989a203e9238f7ca514c362c
- SHA512 fea1436c11a56feb262cf9c05244e7cf20f2b4bf288867dc910f6c2a581cb5a9b27dd603bcca6d36c287bcfb3c291c927dc5d6ed838b80c9abfd1021c8b8811a
- SSDEEP 6144:f3lHz5KTVG+RQliOkri9IYTU88CX1hzBfwiu2dGOHJhPca:jKTVGEnBri9IYTU8NX1GOphPca
- TLSH T1B4549E1AB3A814F8E867C17CC9469903E6B2784A0335DBDF17A447663F276E05E3DB60
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6f:fa:fd:98:27:ff:52:cd:a6:a0:c9:83:09:c3:aa:42:d6:db:d5:39:0b:af:3a:e0:37:52:51:58:fe:f2:39:7b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 13, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:3BD4-4B80-69C3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e5:8f:6a:c0:f3:3d:b4:0b:a3:00:01:00:00:01:e5
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
99516
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\node_modules\node-pty\build\Release\winpty-agent.pdb
kernel32
GetConsoleCP
LoadLibraryW
GetProcAddress
FreeLibrary
SetConsoleMode
GetConsoleMode
GetTickCount
GenerateConsoleCtrlEvent
ReadConsoleInputW
WaitForMultipleObjects
Sleep
ReadFile
CancelIo
WriteFile
CreateNamedPipeW
CreateFileW
CreateEventW
ResetEvent
GetOverlappedResult
ConnectNamedPipe
GetConsoleCursorInfo
GetConsoleTitleW
GetConsoleWindow
SetConsoleTitleW
GetConsoleScreenBufferInfo
GetConsoleOutputCP
SetConsoleScreenBufferSize
SetConsoleWindowInfo
CreateConsoleScreenBuffer
FillConsoleOutputCharacterW
ReadConsoleOutputW
FillConsoleOutputAttribute
SetConsoleCursorPosition
WriteConsoleOutputW
GetCommandLineW
GetCurrentThreadId
GetModuleFileNameA
SetNamedPipeHandleState
SetLastError
GetEnvironmentVariableA
GetCurrentProcessId
TransactNamedPipe
GetSystemTimeAsFileTime
WaitNamedPipeW
WideCharToMultiByte
LocalAlloc
GetCurrentThread
LocalFree
GetVersionExW
GetSystemDirectoryW
WriteConsoleW
CreateProcessW
WriteConsoleInputW
CloseHandle
GetConsoleProcessList
GetLargestConsoleWindowSize
GetLastError
DuplicateHandle
WaitForSingleObject
GetStdHandle
GetCurrentProcess
SetConsoleCtrlHandler
SetConsoleTextAttribute
GetModuleHandleW
HeapReAlloc
HeapSize
GetProcessHeap
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetCommandLineA
HeapFree
HeapAlloc
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
FlushFileBuffers
GetFileSizeEx
SetFilePointerEx
FindClose
FindFirstFileExW
advapi32
SetSecurityDescriptorDacl
AllocateAndInitializeSid
SetEntriesInAclW
OpenProcessToken
FreeSid
InitializeSecurityDescriptor
OpenThreadToken
GetTokenInformation
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
shell32
CommandLineToArgvW
user32
CloseDesktop
CreateDesktopW
SetProcessWindowStation
PostMessageW
SendMessageW
CreateWindowStationW
MapVirtualKeyW
VkKeyScanW
GetDoubleClickTime
CloseWindowStation
GetUserObjectInformationW
GetProcessWindowStation
Name
.text
Size
194KB
Virtual Size
193KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=29395,
count=141, id=261, version=29395,
count=10, id=260, version=29395,
count=48, id=261, version=30034,
count=16, id=260, version=30034,
count=10, id=259, version=30034,
count=9, id=257, version=29395,
count=159, id=1, productName=Unmarked objects,
count=29, id=265, version=30153,
count=1, id=255, version=30153,
count=1, id=258, version=30153,
winpty.dll
- IMPHASH d7472042adcbad8dc3267d828df2ba30
- SHA256 6e913cb0a19922420cb5887587bd2583c5a63ec5d8348a26844b50e5b02c2192
- MD5 2b734820db2be821cb40d4df1bedf325
- SHA1 b261b6feb6d0bc136eff034a9cf8a9308ecaf40c
- SHA512 3bd3bec70573432ec31876e841c7308b990f58a62a8790d13d0b0375857fe14624097989388d2e731d5ad2e9380e0e1d16cb08c0b0954993959f15b28f840b84
- SSDEEP 3072:28v3kM6L5t8uXrY6ZYQ/tTVBQCWDJtshHdOhb0sWuNIXg3Sw9Yfbr9M1mbebWoVx:28v3mLMUr3ZYQ/NDWJWZIYNEu2/IgS8
- TLSH T141345C0976E908B8FDB79279C9A78912D7727C050720D7DF03A046669F3B7E09D3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
53224
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Projects\wp\node_modules\.pnpm\[email protected]_patch_hash=3nooxfv76oog7zg6nsh6fnneum\node_modules\node-pty\build\Release\winpty.pdb
kernel32
GetEnvironmentVariableA
DuplicateHandle
CreateEventW
GetLastError
CloseHandle
GetOverlappedResult
DeleteCriticalSection
CreateProcessW
ConnectNamedPipe
GetCurrentThreadId
GetModuleFileNameA
SetNamedPipeHandleState
SetLastError
InitializeCriticalSection
GetCurrentProcessId
TransactNamedPipe
GetSystemTimeAsFileTime
WaitNamedPipeW
LoadLibraryW
GetProcAddress
FreeLibrary
WideCharToMultiByte
LocalAlloc
GetCurrentThread
LocalFree
GetVersionExW
GetSystemDirectoryW
LeaveCriticalSection
WaitForMultipleObjects
CreateNamedPipeW
WriteFile
GetCurrentProcess
EnterCriticalSection
CancelIo
ReadFile
GetFileAttributesW
GetModuleFileNameW
GetModuleHandleExW
CreateFileW
GetModuleHandleW
HeapReAlloc
HeapSize
SetStdHandle
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
GetFileType
WriteConsoleW
ExitProcess
OutputDebugStringW
HeapFree
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
advapi32
SetSecurityDescriptorDacl
AllocateAndInitializeSid
SetEntriesInAclW
OpenProcessToken
FreeSid
InitializeSecurityDescriptor
OpenThreadToken
GetTokenInformation
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
user32
CloseDesktop
CreateDesktopW
CloseWindowStation
GetUserObjectInformationW
GetProcessWindowStation
CreateWindowStationW
SetProcessWindowStation
GetThreadDesktop
winpty_agent_process
winpty_conerr_name
winpty_config_free
winpty_config_new
winpty_config_set_agent_timeout
winpty_config_set_initial_size
winpty_config_set_mouse_mode
winpty_conin_name
winpty_conout_name
winpty_error_code
winpty_error_free
winpty_error_msg
winpty_free
winpty_get_console_process_list
winpty_open
winpty_set_size
winpty_spawn
winpty_spawn_config_free
winpty_spawn_config_new
Name
.text
Size
156KB
Virtual Size
155KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=139, id=261, version=30795,
count=10, id=260, version=30795,
count=10, id=259, version=34321,
count=14, id=260, version=34321,
count=40, id=261, version=34321,
count=7, id=257, version=30795,
count=129, id=1, productName=Unmarked objects,
count=14, id=265, version=34435,
count=1, id=256, version=34435,
count=1, id=255, version=34435,
count=1, id=258, version=34435,