f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4[.]7z

Sharing

Copy URL

Twitter E-mail

General

Target

f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4.7z
Size

5.0MB
MD5

2ef2cf7195cf0454560bc8e48f34b6e0
SHA1

12d96d76abedb97e5c96f68a044d3810b2340224
SHA256

c78468e0c0080700cb378ddb67268ebaa0d5a036f192a70e604a5076682474f9
SHA512

1c85722a782dab780e0a4e4d0b0e8ec6ed218ad5f95ffd67da4baaf4bf70bdc9e73aa2ff4bd0c1c577b1c08229e3f930c70e7d656ec5e7b905a7b00ec87612c6
SSDEEP

98304:G6Sd2dVT5D16OaKb44KEU8vL/nampqZ3ANhO5RDQLYfcdEiF:NhVTNwOabP8v7aTZ3ANhaRMLScdEi

Score

N/A

Malware Config

Signatures

Files

f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4.7z
.7z
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/A8O1E003-R4Q1-P8Q3-X4A6-Y2R2V7W0G8T1.exe
.exe windows x86

a5db5a466a58a88fc36a0259818100cd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

MethCallEngine
ord669
ord598
ord631
EVENT_SINK_AddRef
ord527
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord606
ord717
ProcCallEngine
ord644
ord645
ord100
ord616

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 144KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/BIozhqydH.exe
.exe windows x86

a5db5a466a58a88fc36a0259818100cd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

MethCallEngine
ord669
ord598
ord631
EVENT_SINK_AddRef
ord527
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord606
ord717
ProcCallEngine
ord644
ord645
ord100
ord616

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 144KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/CL_Utility.ps1
.ps1
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/DismHost.exe
.exe windows x64

442f7e3a29906c8a93ad439091a19377

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-05-2019 21:24

Not After

02-05-2020 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

51:fc:4a:de:44:37:6f:6e:6c:e2:d9:e5:8a:7a:35:66:ac:56:42:8d:49:96:c7:81:05:84:21:2f:91:65:58:0e
Signer

Actual PE Digest

51:fc:4a:de:44:37:6f:6e:6c:e2:d9:e5:8a:7a:35:66:ac:56:42:8d:49:96:c7:81:05:84:21:2f:91:65:58:0e

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

16-06-2022 11:52
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

msvcrt

_wfopen
fgetws
feof
__CxxFrameHandler3
_wtoi
wcschr
_wcsnicmp
_vsnwprintf
_vscprintf
vsprintf_s
vswprintf_s
_vscwprintf
swscanf_s
fclose
wcstok_s
iswctype
strrchr
_vsnprintf
memcpy
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_commode
_fmode
_acmdln
_initterm
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
_wcsicmp
wcscpy_s
_beginthreadex
wcsstr
wcsrchr
__C_specific_handler
calloc
memmove_s
malloc
memcpy_s
_purecall
free
towlower
memcmp
memset

advapi32

CheckTokenMembership
OpenThreadToken
GetTokenInformation
OpenProcessToken
FreeSid
AddAccessAllowedAce
AllocateAndInitializeSid
EqualSid
IsValidSecurityDescriptor
GetAclInformation
InitializeAcl
AddAce
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
MakeAbsoluteSD
GetSecurityDescriptorControl
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetLengthSid
CopySid
IsValidSid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
GetSecurityDescriptorOwner

kernel32

CreateFileMappingW
MapViewOfFile
TlsSetValue
TlsAlloc
GetLocalTime
GetFileSize
TlsGetValue
TlsFree
FormatMessageA
UnmapViewOfFile
GetLastError
CreateEventExW
CloseHandle
WaitForSingleObjectEx
SetErrorMode
GetCommandLineW
InitializeCriticalSection
SetThreadUILanguage
SetEvent
EnterCriticalSection
LeaveCriticalSection
OpenEventW
WaitForMultipleObjectsEx
ExitProcess
DeleteCriticalSection
OutputDebugStringW
GetModuleFileNameW
RaiseException
GetCurrentThreadId
GetModuleHandleW
HeapSize
VirtualQuery
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
MultiByteToWideChar
WideCharToMultiByte
Sleep
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
FreeLibrary
GetModuleHandleExW
GetVersionExW
SetLastError
SearchPathW
WaitForSingleObject
GetModuleFileNameA
WriteFile
CreateMutexW
CreateMutexA
ReleaseMutex
GetVersion
CreateFileA
DeleteFileA
DeleteFileW
CreateFileMappingA
DebugBreak
GetFileSizeEx
GetWindowsDirectoryW
IsDebuggerPresent
FlushFileBuffers
DeviceIoControl
LoadLibraryExW
HeapReAlloc
GetSystemWindowsDirectoryW
ExpandEnvironmentStringsW
CreateFileW
FormatMessageW
FindResourceExW
LoadResource
LocalFree
GetProcAddress
SetFilePointer
GetTempFileNameW
GetCurrentThread

ole32

CoRegisterPSClsid
ProgIDFromCLSID
CoRevokeClassObject
CoInitializeSecurity
CoCreateInstance
CLSIDFromString
CoRegisterClassObject
CoInitializeEx
CoUninitialize
CoTaskMemFree

user32

LoadStringW

oleaut32

SysFreeString
SysAllocString
SysStringLen
LoadRegTypeLi
LoadTypeLi
SystemTimeToVariantTime
SetErrorInfo
CreateErrorInfo
VariantTimeToSystemTime
SysAllocStringLen

ntdll

RtlNtStatusToDosError
RtlGetVersion
RtlFreeHeap
RtlAllocateHeap

Sections

.text
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/IoJbxlqcb.exe
.exe windows x86

a5db5a466a58a88fc36a0259818100cd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

MethCallEngine
ord669
ord598
ord631
EVENT_SINK_AddRef
ord527
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord606
ord717
ProcCallEngine
ord644
ord645
ord100
ord616

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 144KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/RS_AdminDiagnosticHistory.ps1
.ps1
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/RS_MachineWERQueue.ps1
.ps1
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/RS_SyncSystemTime.ps1
.ps1
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/RS_UserDiagnosticHistory.ps1
.ps1
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/RS_UserWERQueue.ps1
.ps1
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/TS_DiagnosticHistory.ps1
.ps1
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/TS_InaccurateSystemTime.ps1
.ps1
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/TS_WERQueue.ps1
.ps1
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/Video.UI.exe
.exe windows x64

8653d4e89b1e6c3d6d8fefaa429e8904

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-core-com-l1-1-0

IIDFromString
CoFreeUnusedLibrariesEx
CoGetContextToken
CoCreateInstanceFromApp
CoCreateGuid
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoTaskMemAlloc
PropVariantClear

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
OutputDebugStringW
IsDebuggerPresent

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventWriteTransfer
EventWrite
EventRegister

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemTimeAsFileTime

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx
IsValidLocaleName

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
DeleteCriticalSection
InitializeCriticalSection
AcquireSRWLockShared
ReleaseSRWLockShared
LeaveCriticalSection

api-ms-win-core-file-l1-1-0

GetFullPathNameW
DeleteFileW
GetFileAttributesExW

d3d11

CreateDirect3D11SurfaceFromDXGISurface
CreateDirect3D11DeviceFromDXGIDevice
D3D11CreateDevice

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-3

GetIntegratedDisplaySize

d2d1

ord1

dwrite

DWriteCreateFactory

dxgi

CreateDXGIFactory2
CreateDXGIFactory1

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
WakeAllConditionVariable
SleepConditionVariableCS
InitializeConditionVariable
Sleep

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoActivateInstance

api-ms-win-shcore-stream-winrt-l1-1-0

CreateStreamOverRandomAccessStream

api-ms-win-core-winrt-string-l1-1-0

WindowsConcatString
WindowsIsStringEmpty
WindowsCreateStringReference
WindowsDuplicateString
WindowsGetStringLen
WindowsCompareStringOrdinal
WindowsCreateString
WindowsDeleteString
WindowsGetStringRawBuffer

sharedui

?Register@QueryFactoryBase@Core@Entertainment@MS@@KAXIIAEBV?$function@$$A6A?AV?$shared_ptr@VIService@Core@Entertainment@MS@@@std@@XZ@std@@@Z
?ForceNonBreakingString@Utilities@Common@Entertainment@MS@@YAPE$AAVString@Platform@@PE$AAV56@@Z
?TokenizeString@Utilities@Common@Entertainment@MS@@YA?AV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@PE$AAVString@Platform@@PEB_W@Z
?EscapeXMLSpecialCharacters@Utilities@Common@Entertainment@MS@@YAPE$AAVString@Platform@@PE$AAV56@V?$shared_ptr@V?$vector@_WV?$allocator@_W@std@@@std@@@std@@@Z
?c_newLine@Utilities@Common@Entertainment@MS@@3QEB_WEB
?ToString@Utilities@Common@Entertainment@MS@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@VStringReference@Platform@@@Z
?GetMainWindowDispatcher@Utilities@Common@Entertainment@MS@@YAPE$AAVCoreDispatcher@Core@UI@Windows@@XZ
?Utf8ToUtf16@Utilities@Common@Entertainment@MS@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@6@@Z
?EndsWith@Utilities@Common@Entertainment@MS@@YA_NPE$AAVString@Platform@@_W@Z
?GetClassNameFromTypeName@Utilities@Common@Entertainment@MS@@YAPE$AAVString@Platform@@PE$AAV56@@Z
?SplitString@Utilities@Common@Entertainment@MS@@YAPE$AAU?$IVector@PE$AAVString@Platform@@@Collections@Foundation@Windows@@PE$AAVString@Platform@@0_N@Z
?ToLower@Utilities@Common@Entertainment@MS@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV56@@Z
?create_async_action@Utilities@Common@Entertainment@MS@@YAPE$AAUIAsyncAction@Foundation@Windows@@XZ
?TrimString@Utilities@Common@Entertainment@MS@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV56@@Z
?IsUIThreadForCurrentWindowOfView@Utilities@Common@Entertainment@MS@@YA_NW4ApplicationViewType@1234@PE$AAU?$IBox@H@Platform@@@Z
?ConvertStringToGuid@Utilities@Common@Entertainment@MS@@YA?AU_GUID@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?Create@QueryFactoryBase@Core@Entertainment@MS@@KA?AV?$shared_ptr@VIService@Core@Entertainment@MS@@@std@@I@Z
?Clear@SingletonManagerBase@Core@Entertainment@MS@@KAXI@Z
?CaptureViewDispatcherOfView@Utilities@Common@Entertainment@MS@@YAXW4ApplicationViewType@1234@PE$AAVCoreWindow@Core@UI@Windows@@@Z
?Register@SingletonManagerBase@Core@Entertainment@MS@@KAXIIAEBV?$function@$$A6A?AV?$shared_ptr@VIService@Core@Entertainment@MS@@@std@@XZ@std@@@Z
?CaptureMainWindowDispatcher@Utilities@Common@Entertainment@MS@@YAXXZ
?async_from_task@Utilities@Common@Entertainment@MS@@YAPE$AAUIAsyncAction@Foundation@Windows@@V?$task@X@Concurrency@@@Z
?ToUpper@Utilities@Common@Entertainment@MS@@YAPE$AAVString@Platform@@PE$AAV56@@Z
?IsBackgroundThreadOfView@Utilities@Common@Entertainment@MS@@YA_NW4ApplicationViewType@1234@PE$AAU?$IBox@H@Platform@@@Z
?ToString@Utilities@Common@Entertainment@MS@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV56@@Z
?ConvertGuidToString@Utilities@Common@Entertainment@MS@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@U_GUID@@_N@Z
?ToString@Utilities@Common@Entertainment@MS@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEB_W@Z
?create_timer_task@Utilities@Common@Entertainment@MS@@YA?AV?$task@X@Concurrency@@KVcancellation_token@6@@Z
?IsRegistered@SingletonManagerBase@Core@Entertainment@MS@@KA_NI@Z
?placeholderStrings@Utilities@Common@Entertainment@MS@@3QBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?ReplaceSubstring@Utilities@Common@Entertainment@MS@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV56@00@Z
?ToString@Utilities@Common@Entertainment@MS@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PE$AAVString@Platform@@@Z
?create_iterative_task@Utilities@Common@Entertainment@MS@@YA?AV?$task@X@Concurrency@@V?$function@$$A6A?AV?$task@_N@Concurrency@@XZ@std@@Vcancellation_token@6@@Z
?create_timer_task@Utilities@Common@Entertainment@MS@@YA?AV?$task@X@Concurrency@@V?$duration@KU?$ratio@$00$0DOI@@std@@@chrono@std@@Vcancellation_token@6@@Z
?GetOrCreate@SingletonManagerBase@Core@Entertainment@MS@@KA?AV?$shared_ptr@VIService@Core@Entertainment@MS@@@std@@I@Z
?use_ui_thread_context_of_view@Utilities@Common@Entertainment@MS@@YA?AVtask_continuation_context@Concurrency@@W4ApplicationViewType@1234@PE$AAU?$IBox@H@Platform@@@Z
?ToString@Utilities@Common@Entertainment@MS@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z

vccorlib140_app

?__abi_WinRTraiseCOMException@@YAXJ@Z
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
?__abi_WinRTraiseDisconnectedException@@YAXXZ
?__abi_WinRTraiseWrongThreadException@@YAXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
?__abi_WinRTraiseChangedStateException@@YAXXZ
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
?__abi_WinRTraiseAccessDeniedException@@YAXXZ
?__abi_WinRTraiseFailureException@@YAXXZ
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
?__abi_WinRTraiseNullReferenceException@@YAXXZ
?__abi_WinRTraiseInvalidCastException@@YAXXZ
?__abi_WinRTraiseNotImplementedException@@YAXXZ
??0Object@Platform@@QE$AAA@XZ
?Free@Heap@Details@Platform@@SAXPEAX@Z
?AlignedFree@Heap@Details@Platform@@SAXPEAX@Z
?ReleaseTarget@ControlBlock@Details@Platform@@AEAAXXZ
?GetWeakReference@Details@Platform@@YAPEAU__abi_IUnknown@@QE$ADVObject@2@@Z
?Allocate@Heap@Details@Platform@@SAPEAX_K0@Z
??BType@Platform@@SA?AVTypeName@Interop@Xaml@UI@Windows@@PE$AAV01@@Z
?__abi_make_type_id@@YAPE$AAVType@Platform@@AEBU__abi_type_descriptor@@@Z
?get@Empty@Size@Foundation@Windows@@SA?AV234@XZ
?__abi_translateCurrentException@@YAJ_N@Z
?AllocateException@Heap@Details@Platform@@SAPEAX_K0@Z
??0NotImplementedException@Platform@@QE$AAA@XZ
?ResolveWeakReference@Details@Platform@@YAPE$AAVObject@2@AEBU_GUID@@PEAPEAU__abi_IUnknown@@@Z
??0Delegate@Platform@@QE$AAA@XZ
?Allocate@Heap@Details@Platform@@SAPEAX_K@Z
??0NullReferenceException@Platform@@QE$AAA@XZ
?GetTypeCode@Type@Platform@@SA?AW4TypeCode@2@PE$AAV12@@Z
?CreateValue@Details@Platform@@YAPE$AAVObject@2@W4TypeCode@2@PEBX@Z
?GetIBoxVtable@Details@Platform@@YAPEAXPEAX@Z
?get@FullName@Type@Platform@@QE$AAAPE$AAVString@3@XZ
??0DisconnectedException@Platform@@QE$AAA@XZ
?EventSourceInitialize@Details@Platform@@YAXPEAPEAX@Z
?EventSourceUninitialize@Details@Platform@@YAXPEAPEAX@Z
?EventSourceAdd@Details@Platform@@YA?AVEventRegistrationToken@Foundation@Windows@@PEAPEAXPEAUEventLock@12@PE$AAVDelegate@2@@Z
?EventSourceRemove@Details@Platform@@YAXPEAPEAXPEAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
?__abi_cast_String_to_Object@__abi_details@@YAPE$AAVObject@Platform@@PE$AAVString@3@@Z
?EventSourceGetTargetArray@Details@Platform@@YAPEAXPEAXPEAUEventLock@12@@Z
?EventSourceGetTargetArraySize@Details@Platform@@YAIPEAX@Z
?EventSourceGetTargetArrayEvent@Details@Platform@@YAPEAXPEAXIPEBXPEA_J@Z
?ReCreateException@Exception@Platform@@SAPE$AAV12@H@Z
?GetType@Object@Platform@@QE$AAAPE$AAVType@2@XZ
?ToString@Guid@Platform@@QEAAPE$AAVString@2@XZ
?ReleaseInContextImpl@Details@Platform@@YAJPEAUIUnknown@@0@Z
?GetProxyImpl@Details@Platform@@YAJPEAUIUnknown@@AEBU_GUID@@0PEAPEAU3@@Z
?GetObjectContext@Details@Platform@@YAPEAUIUnknown@@XZ
?__abi_ObjectToString@__abi_details@@YAPE$AAVString@Platform@@PE$AAVObject@3@_N@Z
?IntersectsWith@Rect@Foundation@Windows@@QEAA_NV123@@Z
?__abi_cast_Object_to_String@__abi_details@@YAPE$AAVString@Platform@@_NPE$AAVObject@3@@Z
?ToString@Enum@Platform@@QE$AAAPE$AAVString@2@XZ
?ToString@float64@default@@QEAAPE$AAVString@Platform@@XZ
??0OutOfMemoryException@Platform@@QE$AAA@XZ
??0FailureException@Platform@@QE$AAA@XZ
??0OutOfBoundsException@Platform@@QE$AAA@XZ
??0ChangedStateException@Platform@@QE$AAA@XZ
?GetIBoxArrayVtable@Details@Platform@@YAPEAXPEAX@Z
??0Exception@Platform@@QE$AAA@HPE$AAVString@1@@Z
??0Rect@Foundation@Windows@@QEAA@VPoint@12@VSize@12@@Z
?GetHashCode@Object@Platform@@QE$AAAHXZ
??0InvalidArgumentException@Platform@@QE$AAA@PE$AAVString@1@@Z
?Equals@Object@Platform@@QE$AAA_NPE$AAV12@@Z
??0FailureException@Platform@@QE$AAA@PE$AAVString@1@@Z
?CreateException@Exception@Platform@@SAPE$AAV12@H@Z
?ToString@int32@default@@QEAAPE$AAVString@Platform@@XZ
??0NotImplementedException@Platform@@QE$AAA@PE$AAVString@1@@Z
?get@Message@Exception@Platform@@QE$AAAPE$AAVString@3@XZ
??0InvalidArgumentException@Platform@@QE$AAA@XZ
??0GridLength@Xaml@UI@Windows@@QEAA@NW4GridUnitType@123@@Z
??0AccessDeniedException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0AccessDeniedException@Platform@@QE$AAA@XZ
??0ObjectDisposedException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0Exception@Platform@@QE$AAA@H@Z
??0COMException@Platform@@QE$AAA@H@Z
?ToString@uint32@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@int64@default@@QEAAPE$AAVString@Platform@@XZ
?ToString@uint64@default@@QEAAPE$AAVString@Platform@@XZ
?GetCmdArguments@Details@Platform@@YAPEAPEA_WPEAH@Z
?ToString@ValueType@Platform@@QE$AAAPE$AAVString@2@XZ
?ToString@Boolean@Platform@@QEAAPE$AAVString@2@XZ
?InitializeData@Details@Platform@@YAJH@Z
?UninitializeData@Details@Platform@@YAXH@Z
?GetActivationFactoryByPCWSTR@@YAJPEAXAEAVGuid@Platform@@PEAPEAX@Z
?GetIidsFn@@YAJHPEAKPEBU__s_GUID@@PEAPEAVGuid@Platform@@@Z

msvcp140_app

??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$ctype@_W@std@@2V0locale@2@A
?id@?$collate@_W@std@@2V0locale@2@A
_Wcsxfrm
_Wcscoll
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
??Bid@locale@std@@QEAA_KXZ
?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?good@ios_base@std@@QEBA_NXZ
?uncaught_exception@std@@YA_NXZ
?width@ios_base@std@@QEAA_J_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?_Xbad_alloc@std@@YAXXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?GetNextAsyncId@platform@details@Concurrency@@YAIXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
_Xtime_get_ticks
?_Xout_of_range@std@@YAXPEBD@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?fail@ios_base@std@@QEBA_NXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBUtm@@PEB_W4@Z
?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A
_Thrd_id
?widen@?$ctype@_W@std@@QEBA_WD@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
_Query_perf_frequency
_Query_perf_counter
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_XGetLastError@std@@YAXXZ
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
?_Xlength_error@std@@YAXPEBD@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Xbad_function_call@std@@YAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
_Cnd_broadcast
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
_Mtx_lock
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
_Mtx_destroy_in_situ
_Cnd_destroy_in_situ
_Mtx_init_in_situ
_Cnd_init_in_situ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
_Cnd_wait
?_IsNonBlockingThread@_Task_impl_base@details@Concurrency@@SA_NXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z

concrt140_app

??1scoped_lock@reader_writer_lock@Concurrency@@QEAA@XZ
??1_Concurrent_vector_base_v4@details@Concurrency@@IEAA@XZ
?_Internal_clear@_Concurrent_vector_base_v4@details@Concurrency@@IEAA_KP6AXPEAX_K@Z@Z
?_Segment_index_of@_Concurrent_vector_base_v4@details@Concurrency@@KA_K_K@Z
?_Internal_throw_exception@_Concurrent_vector_base_v4@details@Concurrency@@IEBAX_K@Z
?_Internal_push_back@_Concurrent_vector_base_v4@details@Concurrency@@IEAAPEAX_KAEA_K@Z
?_Internal_copy@_Concurrent_vector_base_v4@details@Concurrency@@IEAAXAEBV123@_KP6AXPEAXPEBX1@Z@Z
??0critical_section@Concurrency@@QEAA@XZ
??1critical_section@Concurrency@@QEAA@XZ
??0scoped_lock@critical_section@Concurrency@@QEAA@AEAV12@@Z
??1scoped_lock@critical_section@Concurrency@@QEAA@XZ
?_Trace_ppl_function@Concurrency@@YAXAEBU_GUID@@EW4ConcRT_EventType@1@@Z
?PPLParallelForeachEventGuid@Concurrency@@3U_GUID@@B
??1_StructuredTaskCollection@details@Concurrency@@QEAA@XZ
?_CheckTaskCollection@_UnrealizedChore@details@Concurrency@@IEAAXXZ
?Free@Concurrency@@YAXPEAX@Z
?_GetNumberOfVirtualProcessors@_CurrentScheduler@details@Concurrency@@SAIXZ
?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QEAA?AW4_TaskCollectionStatus@23@PEAV_UnrealizedChore@23@@Z
?_Confirm_cancel@_Cancellation_beacon@details@Concurrency@@QEAA_NXZ
??0?$_SpinWait@$00@details@Concurrency@@QEAA@P6AXXZ@Z
?_Yield@_Context@details@Concurrency@@SAXXZ
?_IsSynchronouslyBlocked@_Context@details@Concurrency@@QEBA_NXZ
?_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QEAA_NXZ
??1_Cancellation_beacon@details@Concurrency@@QEAA@XZ
??0_Cancellation_beacon@details@Concurrency@@QEAA@XZ
?try_lock@reader_writer_lock@Concurrency@@QEAA_NXZ
??0_Context@details@Concurrency@@QEAA@PEAVContext@2@@Z
?_CurrentContext@_Context@details@Concurrency@@SA?AV123@XZ
?unlock@reader_writer_lock@Concurrency@@QEAAXXZ
?_UnderlyingYield@details@Concurrency@@YAXXZ
?try_lock_read@reader_writer_lock@Concurrency@@QEAA_NXZ
?set@event@Concurrency@@QEAAXXZ
?wait@event@Concurrency@@QEAA_KI@Z
??0event@Concurrency@@QEAA@XZ
??1event@Concurrency@@QEAA@XZ
??1scoped_lock_read@reader_writer_lock@Concurrency@@QEAA@XZ
??0scoped_lock_read@reader_writer_lock@Concurrency@@QEAA@AEAV12@@Z
?_Internal_capacity@_Concurrent_vector_base_v4@details@Concurrency@@IEBA_KXZ
??0scoped_lock@reader_writer_lock@Concurrency@@QEAA@AEAV12@@Z
??1reader_writer_lock@Concurrency@@QEAA@XZ
??0reader_writer_lock@Concurrency@@QEAA@XZ
?_Internal_reserve@_Concurrent_vector_base_v4@details@Concurrency@@IEAAX_K00@Z
?_Schedule@_StructuredTaskCollection@details@Concurrency@@QEAAXPEAV_UnrealizedChore@23@@Z

vcruntime140_app

memset
memcpy
__CxxFrameHandler3
__std_terminate
__std_exception_copy
__std_exception_destroy
_purecall
__std_type_info_compare
strchr
wcschr
__C_specific_handler
wcsrchr
memmove
_CxxThrowException
memcmp

api-ms-win-crt-runtime-l1-1-0

_errno
_register_thread_local_exe_atexit_callback
_c_exit
_exit
exit
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_initterm_e
terminate
_initterm
_get_narrow_winmain_command_line
_set_app_type
_wassert
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_seh_filter_exe
_cexit

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s
__stdio_common_vswprintf_s
__stdio_common_vswprintf
__stdio_common_vswscanf
_set_fmode
__p__commode
__stdio_common_vsprintf_s
__acrt_iob_func
__stdio_common_vfprintf

api-ms-win-crt-math-l1-1-0

lroundf
powf
lround
sqrtf
_isnan
round
floor
__setusermatherr
modf
_fdtest
_dtest
acosf
ceil
ceilf
cosf
fmodf
pow
sinf
roundf
sqrt

api-ms-win-crt-string-l1-1-0

_wcsicmp
wcslen
strncmp
towlower
iswdigit
_wcsnicmp
isspace
isalnum
tolower

api-ms-win-crt-heap-l1-1-0

_callnewh
_aligned_free
_set_new_mode
malloc
free
_aligned_malloc
realloc

api-ms-win-crt-convert-l1-1-0

mbstowcs_s
_wtoi
wcstol
wcstoul

api-ms-win-crt-time-l1-1-0

_time64
_localtime64_s

api-ms-win-crt-utility-l1-1-0

bsearch_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-core-winrt-error-l1-1-0

RoFailFastWithErrorContext
SetRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoReportUnhandledError

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

Sections

.text
Size: 13.8MB - Virtual size: 13.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8.1MB - Virtual size: 8.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.6MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 384KB - Virtual size: 384KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/WER2506.tmp.txt
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/WERAEBE.tmp.txt
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/WERB09.tmp.txt
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/__PSScriptPolicyTest_eg4nc2yx.0nl.ps1
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/aspnet_wp.exe
.exe windows x86

86cd395a95e50e0fe5b24c196b560c16

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-03-2020 18:39

Not After

03-03-2021 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

41:be:ca:a9:db:66:12:5e:98:94:34:45:20:64:91:53:7d:cb:5b:4c:ae:80:5e:73:69:a4:fb:94:85:bf:d7:95
Signer

Actual PE Digest

41:be:ca:a9:db:66:12:5e:98:94:34:45:20:64:91:53:7d:cb:5b:4c:ae:80:5e:73:69:a4:fb:94:85:bf:d7:95

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

16-06-2022 11:52
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

webengine4

MonitorGlobalConfigFile
GetConfigurationFromNativeCode
DisposeAppDomainsIndirect
InitializeManagedCode
UnInitializeManagedCode
PerfCounterInitialize
XspLogEvent
EtwTraceAspNetRegister
EtwTraceAspNetUnregister
GetGlobalConfigFullPathW
IsManagedDebuggerConnectedIndirect
ReleaseWmiEventManager
GetXSPHeap
IsConfigFileName
DrainThreadPool
InitializeLibrary
TraceEnabled
TraceRaiseEvent
GetProcessMemoryInformation
PerfDecrementGlobalCounter
PerfIncrementGlobalCounter
GetAppDomainIndirect
ClrQueueUserWorkItem
AttachHandleToThreadPool
LoadLibraryUsingFullPath

advapi32

CryptReleaseContext
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SetThreadToken

kernel32

GetProcessAffinityMask
GetSystemInfo
LoadLibraryW
FreeLibrary
GetVersionExW
TerminateProcess
HeapFree
RaiseException
VirtualProtect
VirtualQuery
LoadLibraryExA
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetSystemDirectoryW
CreateFileW
ReadFile
WriteFile
DebugBreak
CloseHandle
GetHandleInformation
GetLastError
SetNamedPipeHandleState
GetOverlappedResult
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
Sleep
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
lstrlenA
lstrlenW
SetEvent
ResetEvent
WaitForSingleObject
OpenEventW
GetCurrentProcess
ExitProcess
SetProcessAffinityMask
SwitchToThread
GetCurrentThreadId
HeapAlloc

vcruntime140_clr0400

memcpy
memset
_except_handler4_common

ucrtbase_clr0400

_initialize_onexit_table
_crt_atexit
_controlfp_s
terminate
_register_onexit_function
_itow_s
wcstoul
_wtoi
__acrt_iob_func
__stdio_common_vswprintf
__stdio_common_vfprintf
_beginthread
_seh_filter_exe
_set_app_type
__setusermatherr
_configure_wide_argv
_initialize_wide_environment
_get_initial_wide_environment
_initterm
_initterm_e
_exit
_set_fmode
__p___argc
__p___wargv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
exit

Exports

Exports

PMAppendLogParameter
PMCallISAPI
PMCloseConnection
PMDoneWithSession
PMEmptyResponse
PMFlushCore
PMGetAdditionalPostedContent
PMGetAllServerVariables
PMGetBasics
PMGetClientCertificate
PMGetCurrentProcessInfo
PMGetHistoryTable
PMGetImpersonationToken
PMGetMemoryLimitInMB
PMGetPreloadedPostedContent
PMGetQueryString
PMGetQueryStringRawBytes
PMGetServerVariable
PMGetStartTimeStamp
PMGetTraceContextId
PMGetVirtualPathToken
PMIsClientConnected
PMMapUrlToPath
PMTraceRaiseEvent
PMWriteBytes
PMWriteHeaders

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/dpjcqocbc2.txt
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/dpjcqocbc4.txt
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/esfctKdzg.exe
.exe windows x86

a5db5a466a58a88fc36a0259818100cd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

MethCallEngine
ord669
ord598
ord631
EVENT_SINK_AddRef
ord527
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord606
ord717
ProcCallEngine
ord644
ord645
ord100
ord616

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 144KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/smsvchost.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

33:00:00:01:46:32:e2:e1:e5:ca:2c:4e:1f:00:00:00:00:01:46
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13-11-2019 21:42

Not After

11-02-2021 21:42

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:3E7A-E359-A25D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-05-2019 21:37

Not After

02-05-2020 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-05-2019 21:37

Not After

02-05-2020 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

22:2d:6a:90:3c:b9:d0:c6:a9:a6:da:fd:33:ca:20:46:22:f2:28:c6:ec:3a:b3:de:7e:1c:b5:3d:76:43:cf:13
Signer

Actual PE Digest

22:2d:6a:90:3c:b9:d0:c6:a9:a6:da:fd:33:ca:20:46:22:f2:28:c6:ec:3a:b3:de:7e:1c:b5:3d:76:43:cf:13

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

16-06-2022 11:52
Valid: false

ca:64:eb:af:07:82:ad:9f:63:6f:fc:3f:d6:02:fa:7b:69:9f:27:93
Signer

Actual PE Digest

ca:64:eb:af:07:82:ad:9f:63:6f:fc:3f:d6:02:fa:7b:69:9f:27:93

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

07-12-2019 05:56
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/w..orIFtb.exe
.exe windows x86

a5db5a466a58a88fc36a0259818100cd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

MethCallEngine
ord669
ord598
ord631
EVENT_SINK_AddRef
ord527
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord606
ord717
ProcCallEngine
ord644
ord645
ord100
ord616

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 144KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/README.md
f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/xpertwar.exe
.exe windows x86

c2610cba89cdbbff56c51b9124c91bc0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapSize
GetCommandLineA
MultiByteToWideChar
Sleep
GetLastError
SetEvent
HeapReAlloc
CloseHandle
RaiseException
FreeConsole
CreateThread
HeapAlloc
DecodePointer
HeapDestroy
GetProcAddress
DeleteCriticalSection
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
CreateEventA
EnterCriticalSection
LeaveCriticalSection
FlushFileBuffers
SetFilePointerEx
GetModuleHandleA
GetConsoleCP
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapQueryInformation
WriteConsoleW
OutputDebugStringA
GetFileType
GetCurrentThreadId
InitializeCriticalSectionEx
WaitForSingleObject
VirtualAlloc
SetLastError
HeapFree
GetConsoleMode
GetModuleFileNameA
LCMapStringW
GetACP
WriteFile
GetStdHandle
ExitProcess
HeapValidate
GetModuleHandleExW
GetModuleFileNameW
VirtualQuery
VirtualProtect
GetSystemInfo
LoadLibraryExW
CreateFileW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
GetCurrentProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess

user32

UnregisterClassA
CharUpperA
TranslateMessage
CharNextW
PostThreadMessageA
DispatchMessageA
GetMessageA
CharNextA
GetWindowTextLengthA
GetWindowRect
IsWindow
GetWindowTextA
SetWindowTextA
MoveWindow
SendMessageA

advapi32

RegDeleteKeyA
RegQueryInfoKeyA
RegOpenKeyExA
RegCloseKey

ole32

CoInitialize
StringFromGUID2
CoUninitialize
CoReleaseServerProcess
CoRegisterClassObject
CoResumeClassObjects
CoRevokeClassObject
CoAddRefServerProcess
CoCreateInstance

oleaut32

VariantClear
SysAllocString
VariantInit
VariantCopy
SysAllocStringLen
VariantChangeType
UnRegisterTypeLi
LoadTypeLi
SysFreeString
RegisterTypeLi
SysStringLen

wininet

InternetCheckConnectionA

Sections

.text
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 334KB - Virtual size: 347KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a5db5a466a58a88fc36a0259818100cd

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 24KB - Virtual size: 20KB

.data Size: - Virtual size: 3KB

.rsrc Size: 144KB - Virtual size: 140KB

a5db5a466a58a88fc36a0259818100cd

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 24KB - Virtual size: 20KB

.data Size: - Virtual size: 3KB

.rsrc Size: 144KB - Virtual size: 140KB

442f7e3a29906c8a93ad439091a19377

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

51:fc:4a:de:44:37:6f:6e:6c:e2:d9:e5:8a:7a:35:66:ac:56:42:8d:49:96:c7:81:05:84:21:2f:91:65:58:0eSigner

Signature Validations

Verification

16-06-2022 11:52 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

kernel32

ole32

user32

oleaut32

ntdll

Sections

.text Size: 77KB - Virtual size: 76KB

.rdata Size: 36KB - Virtual size: 36KB

.data Size: 1KB - Virtual size: 4KB

.pdata Size: 4KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 512B - Virtual size: 448B

a5db5a466a58a88fc36a0259818100cd

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 24KB - Virtual size: 20KB

.data Size: - Virtual size: 3KB

.rsrc Size: 144KB - Virtual size: 140KB

8653d4e89b1e6c3d6d8fefaa429e8904

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-com-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-file-l1-1-0

d3d11

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-3

d2d1

dwrite

dxgi

.text
Size: 24KB - Virtual size: 20KB

.data
Size: - Virtual size: 3KB

.rsrc
Size: 144KB - Virtual size: 140KB

.text
Size: 24KB - Virtual size: 20KB

.data
Size: - Virtual size: 3KB

.rsrc
Size: 144KB - Virtual size: 140KB

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

51:fc:4a:de:44:37:6f:6e:6c:e2:d9:e5:8a:7a:35:66:ac:56:42:8d:49:96:c7:81:05:84:21:2f:91:65:58:0e
Signer

16-06-2022 11:52
Valid: false

.text
Size: 77KB - Virtual size: 76KB

.rdata
Size: 36KB - Virtual size: 36KB

.data
Size: 1KB - Virtual size: 4KB

.pdata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 512B - Virtual size: 448B

.text
Size: 24KB - Virtual size: 20KB

.data
Size: - Virtual size: 3KB

.rsrc
Size: 144KB - Virtual size: 140KB

.text
Size: 13.8MB - Virtual size: 13.8MB

.rdata
Size: 8.1MB - Virtual size: 8.1MB

.data
Size: 1.6MB - Virtual size: 1.7MB

.pdata
Size: 1.1MB - Virtual size: 1.1MB

.didat
Size: 512B - Virtual size: 40B

.rsrc
Size: 30KB - Virtual size: 29KB

.reloc
Size: 384KB - Virtual size: 384KB

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

41:be:ca:a9:db:66:12:5e:98:94:34:45:20:64:91:53:7d:cb:5b:4c:ae:80:5e:73:69:a4:fb:94:85:bf:d7:95
Signer

16-06-2022 11:52
Valid: false

.text
Size: 21KB - Virtual size: 20KB

.data
Size: 512B - Virtual size: 3KB

.idata
Size: 3KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 20B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 24KB - Virtual size: 20KB

.data
Size: - Virtual size: 3KB

.rsrc
Size: 144KB - Virtual size: 140KB