2026-11-07_12e723e076771f66b276b2e3f0ec6cd3_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-07_12e723e076771f66b276b2e3f0ec6cd3_mespinoza
Size 5.3MB
Sample261107-vbrk6set7n
SHA256 a6c56d74e561cfe19388a213ae073b4bc9c37fc4ae244d3304235db2e28bec3a
MD5 12e723e076771f66b276b2e3f0ec6cd3
SHA1 c5b4d2bd0dec0aec8b8ed6574c9edee8e6bb5e44
SHA512 5825c1e8b66515ae02466ead3f3fac339721c6f2838a1f29426b6e581a185cde050a84a04f99a9fde2602358f21e062227f987e3a9bfb3d9285ed046a52cc169
SSDEEP 49152:DH/zQuVz7DMfX1gD3sUdNANE7reQ64cc861oxSf2OF7ZBMRU63NRUYdKN0a8pIy6:D5viy2lknisie1
TLSH
T15B466117662961A9C1BBC03CD5835F22F86130E907396BF74541826A2E71FF8BD3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-07_12e723e076771f66b276b2e3f0ec6cd3_mespinoza

File Explorer

2026-11-07_12e723e076771f66b276b2e3f0ec6cd3_mespinoza

.exe 5.3MB

2026-11-07_12e723e076771f66b276b2e3f0ec6cd3_mespinoza

IMPHASH 362814e5f7e69fc8bc74db8f7422ff0c
SHA256 a6c56d74e561cfe19388a213ae073b4bc9c37fc4ae244d3304235db2e28bec3a
MD5 12e723e076771f66b276b2e3f0ec6cd3
SHA1 c5b4d2bd0dec0aec8b8ed6574c9edee8e6bb5e44
SHA512 5825c1e8b66515ae02466ead3f3fac339721c6f2838a1f29426b6e581a185cde050a84a04f99a9fde2602358f21e062227f987e3a9bfb3d9285ed046a52cc169
SSDEEP 49152:DH/zQuVz7DMfX1gD3sUdNANE7reQ64cc861oxSf2OF7ZBMRU63NRUYdKN0a8pIy6:D5viy2lknisie1
TLSH
T15B466117662961A9C1BBC03CD5835F22F86130E907396BF74541826A2E71FF8BD3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4087264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\lior\dev\Locate\build\debug\bin\Debug\locate_unit_tests.pdb

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AreFileApisANSI CancelIoEx CloseHandle CompareStringOrdinal ConnectNamedPipe CopyFile2 CreateDirectoryExW CreateDirectoryW CreateEventA CreateEventW CreateFile2 CreateFileMappingA CreateFileW CreateHardLinkW CreateMutexA CreateMutexExW CreateNamedPipeW CreateProcessW CreateSymbolicLinkW CreateThread DeviceIoControl DisconnectNamedPipe FindClose FindFirstFileExW FindFirstFileW FindFirstVolumeW FindNextFileW FindNextVolumeW FindVolumeClose FlushFileBuffers FlushViewOfFile FormatMessageA GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentVariableW GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFileSizeEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLocaleInfoEx GetModuleFileNameW GetModuleHandleW GetOverlappedResult GetProcAddress GetStartupInfoW GetStdHandle GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetTickCount64 GetVersion GetVolumeInformationW GetVolumeNameForVolumeMountPointW GetVolumePathNameW GetVolumePathNamesForVolumeNameW InitOnceBeginInitialize InitOnceComplete InitializeSListHead IsDebuggerPresent LCMapStringEx LocalFree LockFile LockFileEx MapViewOfFileEx MoveFileExW MultiByteToWideChar OpenFileById OpenMutexA OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe QueryPerformanceCounter ReadFile ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared SetConsoleCtrlHandler SetConsoleTextAttribute SetCurrentDirectoryW SetEndOfFile SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SignalObjectAndWait Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TryAcquireSRWLockShared UnlockFile UnmapViewOfFile VirtualAlloc WaitForSingleObject WaitNamedPipeW WakeAllConditionVariable WideCharToMultiByte WriteFile

advapi32

AdjustTokenPrivileges ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW CreateRestrictedToken CreateWellKnownSid DuplicateTokenEx EqualSid GetFileSecurityW GetTokenInformation ImpersonateLoggedOnUser ImpersonateNamedPipeClient ImpersonateSelf InitializeAcl InitializeSecurityDescriptor IsValidSid LookupPrivilegeValueW OpenProcessToken OpenThreadToken RevertToSelf SetEntriesInAclW SetFileSecurityW SetNamedSecurityInfoW SetSecurityDescriptorDacl SetThreadToken

msvcp140d

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??0_Lockit@std@@QEAA@H@Z ??0facet@locale@std@@IEAA@_K@Z ??0task_continuation_context@Concurrency@@AEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1_Locinfo@std@@QEAA@XZ ??1_Lockit@std@@QEAA@XZ ??1facet@locale@std@@MEAA@XZ ??2_Crt_new_delete@std@@SAPEAX_K@Z ??3_Crt_new_delete@std@@SAXPEAX@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_J@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?CaptureCallstack@platform@details@Concurrency@@YA_KPEAPEAX_K1@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Id_cnt@id@locale@std@@0HA ?_Incref@facet@locale@std@@UEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Random_device@std@@YAIXZ ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ ?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ ?_Winerror_map@std@@YAHH@Z ?_XGetLastError@std@@YAXXZ ?_Xbad_alloc@std@@YAXXZ ?_Xbad_function_call@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Xruntime_error@std@@YAXPEBD@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?classic@locale@std@@SAAEBV12@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?clog@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?copyfmt@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAAEAV12@AEBV12@@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?fail@ios_base@std@@QEBA_NXZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?flags@ios_base@std@@QEAAHH@Z ?flags@ios_base@std@@QEBAHXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?is@?$ctype@D@std@@QEBA_NFD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PEAV32@@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?setf@ios_base@std@@QEAAHH@Z ?setf@ios_base@std@@QEAAHHH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?tolower@?$ctype@D@std@@QEBADD@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uncaught_exceptions@std@@YAHXZ ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z _Cnd_broadcast _Cnd_do_broadcast_at_thread_exit _Cnd_register_at_thread_exit _Cnd_signal _Cnd_unregister_at_thread_exit _Cnd_wait _Mtx_current_owns _Mtx_lock _Mtx_unlock _Query_perf_counter _Query_perf_frequency _Strcoll _Strxfrm _Thrd_detach _Thrd_hardware_concurrency _Thrd_id _Thrd_join _Xtime_get_ticks __crtLCMapStringA __crtLCMapStringW

msvcp140d_atomic_wait

__std_atomic_notify_all_direct __std_atomic_wait_direct __std_calloc_crt __std_free_crt __std_tzdb_delete_leap_seconds __std_tzdb_delete_time_zones __std_tzdb_get_leap_seconds __std_tzdb_get_time_zones

user32

CharLowerBuffW

vcruntime140d

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __RTtypeid __current_exception __current_exception_context __std_exception_copy __std_exception_destroy __std_terminate __std_type_info_compare __std_type_info_destroy_list _purecall memchr memcmp memcpy memmove memset strchr

vcruntime140_1d

__CxxFrameHandler4

ucrtbased

_CrtDbgReport _CrtDbgReportW ___lc_codepage_func ___lc_collate_cp_func ___lc_locale_name_func __acrt_iob_func __p___argc __p___argv __p__commode __setusermatherr __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsprintf_s _aligned_free _aligned_malloc _beginthreadex _c_exit _callnewh _calloc_dbg _cexit _configthreadlocale _configure_narrow_argv _crt_at_quick_exit _crt_atexit _dsign _dupenv_s _errno _execute_onexit_table _exit _free_dbg _fseeki64 _get_initial_narrow_environment _get_stream_buffer_pointers _gmtime64_s _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _lock_file _malloc_dbg _register_onexit_function _register_thread_local_exe_atexit_callback _rotl _seh_filter_dll _seh_filter_exe _set_app_type _set_fmode _set_new_mode _strdup _time64 _unlock_file _wassert abort calloc ceilf exit fclose fflush fgetc fgetpos fputc fread free fsetpos fwrite getchar getenv isalnum isdigit isspace ldexp localeconv malloc nextafter nextafterf realloc setvbuf strcmp strcpy strerror strftime strlen strncmp strtod strtoll strtoul strtoull terminate tolower ungetc wcscpy wcslen

Name

.text

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

898KB

Virtual Size

898KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

76KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

408KB

Virtual Size

407KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-07_12e723e076771f66b276b2e3f0ec6cd3_mespinoza

kernel32

advapi32

msvcp140d

msvcp140d_atomic_wait

user32

vcruntime140d

vcruntime140_1d

ucrtbased

generic