adhesive[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

adhesive.dll
Size

55.1MB
MD5

e95aabb84cc0999f312daaf0a1da8954
SHA1

bba85fbeb80effaeb823c554ea66e9d63f35df6e
SHA256

ecaea5e361f604a3a1cdb96839992ed5498a995ba5eab0c0f69dafb55008f233
SHA512

f01a9a50ef09d5f597bfd3e227d0ab6cd84f0a39b74c31c1592dc2db988ade0aec592d60b52e1d33c69c75c47ffd2490ed84097f1d1f6889d3f46e9d68b7aed8
SSDEEP

393216:plJNMOsf94UUL7iKQV+atSjBsT2spQASuD9tKngj0HFja8MTqJG4x6Na:IPf9gsHIBaNqE4

Score

N/A

Malware Config

Signatures

Files

adhesive.dll
.dll windows x64

1b6c1fce83b0d67a7b24becd07b30cd3

Code Sign

47:d5:29:f4:40:91:b5:18:5e:6f:ab:9d:30:34:f0:df
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

14/05/2021, 00:00

Not After

13/05/2024, 23:59

Subject

SERIALNUMBER=2370477,CN=TASKS ME - IT DEVELOPMENT (AILENE BULALACAO TAGOLGOL),O=TASKS ME - IT DEVELOPMENT (AILENE BULALACAO TAGOLGOL),L=Paranaque City,C=PH,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13025048

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

47:d5:29:f4:40:91:b5:18:5e:6f:ab:9d:30:34:f0:df
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

14/05/2021, 00:00

Not After

13/05/2024, 23:59

Subject

SERIALNUMBER=2370477,CN=TASKS ME - IT DEVELOPMENT (AILENE BULALACAO TAGOLGOL),O=TASKS ME - IT DEVELOPMENT (AILENE BULALACAO TAGOLGOL),L=Paranaque City,C=PH,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13025048

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

82:a0:6d:5d:fe:3d:6d:c9:e3:14:48:08:80:ee:ce:9d:e0:36:f1:22:40:ca:89:67:3a:f6:c6:14:34:d4:85:82
Signer

Actual PE Digest

82:a0:6d:5d:fe:3d:6d:c9:e3:14:48:08:80:ee:ce:9d:e0:36:f1:22:40:ca:89:67:3a:f6:c6:14:34:d4:85:82

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=2370477,CN=TASKS ME - IT DEVELOPMENT (AILENE BULALACAO TAGOLGOL),O=TASKS ME - IT DEVELOPMENT (AILENE BULALACAO TAGOLGOL),L=Paranaque City,C=PH,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13025048

29/09/2022, 18:51
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
CloseHandle
CompareFileTime
ConvertFiberToThread
ConvertThreadToFiber
CopyFileW
CreateDirectoryW
CreateEventW
CreateFiber
CreateFileMappingW
CreateSemaphoreExW
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFiber
DeleteFileW
DisableThreadLibraryCalls
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileW
FindNextFileW
FlushInstructionCache
FormatMessageA
FormatMessageW
FreeLibrary
GetCommandLineW
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentVariableA
GetEnvironmentVariableW
GetFileAttributesExW
GetFileAttributesW
GetFileType
GetFullPathNameW
GetLargePageMinimum
GetLastError
GetLocaleInfoEx
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetPrivateProfileStringW
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetProcessWorkingSetSize
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetThreadContext
GetTickCount
HeapAlloc
HeapCreate
HeapFree
HeapReAlloc
InitOnceBeginInitialize
InitOnceComplete
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
InterlockedPushEntrySList
IsDebuggerPresent
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryW
LocalAlloc
LocalFree
MapViewOfFile
MoveFileExW
MoveFileW
MultiByteToWideChar
OpenProcess
OpenThread
OutputDebugStringA
QueryFullProcessImageNameW
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleA
ReadConsoleW
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleMode
SetEvent
SetLastError
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SleepEx
SuspendThread
SwitchToFiber
SystemTimeToFileTime
TerminateProcess
Thread32First
Thread32Next
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualLock
VirtualProtect
VirtualQuery
VirtualUnlock
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteFile

shell32

SHGetKnownFolderPath

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertGetNameStringW
CertOpenSystemStoreA
CertOpenSystemStoreW
CryptMsgClose
CryptMsgGetParam
CryptQueryObject
CryptUnprotectData

v8-9.3.345.16

??0CreateParams@Isolate@v8@@QEAA@XZ
??0HandleScope@v8@@QEAA@PEAVIsolate@1@@Z
??0TryCatch@v8@@QEAA@PEAVIsolate@1@@Z
??0Utf8Value@String@v8@@QEAA@PEAVIsolate@2@V?$Local@VValue@v8@@@2@@Z
??1CreateParams@Isolate@v8@@QEAA@XZ
??1HandleScope@v8@@QEAA@XZ
??1Locker@v8@@QEAA@XZ
??1TryCatch@v8@@QEAA@XZ
??1Utf8Value@String@v8@@QEAA@XZ
?ByteLength@ArrayBufferView@v8@@QEAA_KXZ
?Call@Function@v8@@QEAA?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@HQEAV52@@Z
?Compile@Script@v8@@SA?AV?$MaybeLocal@VScript@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VString@v8@@@2@PEAVScriptOrigin@2@@Z
?CopyContents@ArrayBufferView@v8@@QEAA_KPEAX_K@Z
?CreateHandle@HandleScope@v8@@KAPEA_KPEAVIsolate@internal@2@_K@Z
?Data@BackingStore@v8@@QEBAPEAXXZ
?DisposeGlobal@V8@v8@@CAXPEA_K@Z
?Enter@Context@v8@@QEAAXXZ
?Enter@Isolate@v8@@QEAAXXZ
?Exception@TryCatch@v8@@QEBA?AV?$Local@VValue@v8@@@2@XZ
?Exit@Context@v8@@QEAAXXZ
?Exit@Isolate@v8@@QEAAXXZ
?Get@Object@v8@@QEAA?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@@Z
?GetBackingStore@ArrayBuffer@v8@@QEAA?AV?$shared_ptr@VBackingStore@v8@@@std@@XZ
?GetCurrent@Isolate@v8@@SAPEAV12@XZ
?Global@Context@v8@@QEAA?AV?$Local@VObject@v8@@@2@XZ
?GlobalizeReference@V8@v8@@CAPEA_KPEAVIsolate@internal@2@PEA_K@Z
?HasCaught@TryCatch@v8@@QEBA_NXZ
?Initialize@Locker@v8@@AEAAXPEAVIsolate@2@@Z
?IsArrayBufferView@Value@v8@@QEBA_NXZ
?MoveGlobalReference@V8@v8@@CAXPEAPEA_K0@Z
?New@ArrayBuffer@v8@@SA?AV?$Local@VArrayBuffer@v8@@@2@PEAVIsolate@2@_K@Z
?New@Context@v8@@SA?AV?$Local@VContext@v8@@@2@PEAVIsolate@2@PEAVExtensionConfiguration@2@V?$MaybeLocal@VObjectTemplate@v8@@@2@V?$MaybeLocal@VValue@v8@@@2@UDeserializeInternalFieldsCallback@2@PEAVMicrotaskQueue@2@@Z
?New@External@v8@@SA?AV?$Local@VExternal@v8@@@2@PEAVIsolate@2@PEAX@Z
?New@Function@v8@@SA?AV?$MaybeLocal@VFunction@v8@@@2@V?$Local@VContext@v8@@@2@P6AXAEBV?$FunctionCallbackInfo@VValue@v8@@@2@@ZV?$Local@VValue@v8@@@2@HW4ConstructorBehavior@2@W4SideEffectType@2@@Z
?New@FunctionTemplate@v8@@SA?AV?$Local@VFunctionTemplate@v8@@@2@PEAVIsolate@2@P6AXAEBV?$FunctionCallbackInfo@VValue@v8@@@2@@ZV?$Local@VValue@v8@@@2@V?$Local@VSignature@v8@@@2@HW4ConstructorBehavior@2@W4SideEffectType@2@PEBVCFunction@2@EEE@Z
?New@Isolate@v8@@SAPEAV12@AEBUCreateParams@12@@Z
?New@ObjectTemplate@v8@@SA?AV?$Local@VObjectTemplate@v8@@@2@PEAVIsolate@2@V?$Local@VFunctionTemplate@v8@@@2@@Z
?New@Uint8Array@v8@@SA?AV?$Local@VUint8Array@v8@@@2@V?$Local@VArrayBuffer@v8@@@2@_K1@Z
?NewFromUnsigned@Integer@v8@@SA?AV?$Local@VInteger@v8@@@2@PEAVIsolate@2@I@Z
?NewFromUtf8@String@v8@@SA?AV?$MaybeLocal@VString@v8@@@2@PEAVIsolate@2@PEBDW4NewStringType@2@H@Z
?Parse@JSON@v8@@SA?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VString@v8@@@2@@Z
?Reallocate@Allocator@ArrayBuffer@v8@@UEAAPEAXPEAX_K1@Z
?Run@Script@v8@@QEAA?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@@Z
?Set@Object@v8@@QEAA?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@1@Z
?Set@Template@v8@@QEAAXV?$Local@VName@v8@@@2@V?$Local@VData@v8@@@2@W4PropertyAttribute@2@@Z
?SetFatalErrorHandler@Isolate@v8@@QEAAXP6AXPEBD0@Z@Z
?StackTrace@TryCatch@v8@@QEBA?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@@Z
?ToLocalEmpty@V8@v8@@CAXXZ

ws2_32

WSACleanup
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAIoctl
WSAResetEvent
WSASetLastError
WSAStartup
WSAWaitForMultipleEvents
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getnameinfo
getpeername
getsockname
getsockopt
htonl
htons
ioctlsocket
listen
ntohs
recv
select
send
setsockopt
shutdown
socket

shlwapi

StrStrIW

user32

GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW

advapi32

AdjustTokenPrivileges
DeregisterEventSource
LookupPrivilegeValueW
OpenProcessToken
RegisterEventSourceW
ReportEventW

winmm

timeGetTime

rage-nutsnbolts-five

?OnGameFrame@@3V?$fwEvent@$$V@@A
?OnMainGameFrame@@3V?$fwEvent@$$V@@A

net

?GetGUID@NetLibrary@@QEAA_KXZ
?OnNetLibraryCreate@NetLibrary@@2V?$fwEvent@PEAVNetLibrary@@@@A

citizen-resources-client

??0CachedResourceMounter@fx@@IEAA@PEAVResourceManager@1@@Z
??0RcdBaseStream@resources@@QEAA@PEAVRcdFetcher@1@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0RcdStream@resources@@QEAA@PEAVRcdFetcher@1@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0ResourceCache@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
??0ResourceCacheDeviceV2@resources@@QEAA@AEBV?$shared_ptr@VResourceCache@@@std@@_N@Z
??1CachedResourceMounter@fx@@UEAA@XZ
??1RcdBulkStream@resources@@UEAA@XZ
??1RcdStream@resources@@UEAA@XZ
??1ResourceCache@@QEAA@XZ
??1ResourceCacheDeviceV2@resources@@UEAA@XZ
?AddEntry@ResourceCache@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$array@E$0BE@@3@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@3@@Z
?AddResourceEntry@CachedResourceMounter@fx@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@000_KAEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@4@@Z
?AddStatusCallback@CachedResourceMounter@fx@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$function@$$A6AXW4StatusType@CachedResourceMounter@fx@@HH@Z@4@@Z
?Close@?$StreamDevice@VRcdStream@resources@@U?$HandleDataWithBulk@VRcdStream@resources@@VRcdBulkStream@2@@detail@vfs@@@vfs@@UEAA_N_K@Z
?CloseBulk@?$BulkStreamDevice@VRcdStream@resources@@VRcdBulkStream@2@@vfs@@UEAA_N_K@Z
?CloseFile@RcdBulkStream@resources@@MEAAXXZ
?CloseFile@RcdStream@resources@@MEAAXXZ
?Create@?$StreamDevice@VRcdStream@resources@@U?$HandleDataWithBulk@VRcdStream@resources@@VRcdBulkStream@2@@detail@vfs@@@vfs@@UEAA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?CreateStream@ResourceCacheDeviceV2@resources@@UEAA?AV?$shared_ptr@VRcdStream@resources@@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?EnsureRead@RcdBaseStream@resources@@UEAA_NAEBV?$function@$$A6AX_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z@std@@@Z
?ExistsOnDisk@ResourceCacheDeviceV2@resources@@UEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?ExtensionCtl@ResourceCacheDeviceV2@resources@@UEAA_NHPEAX_K@Z
?FetchEntry@ResourceCacheDeviceV2@resources@@UEAA?AV?$task@URcdFetchResult@resources@@@Concurrency@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?FindClose@?$StreamDevice@VRcdStream@resources@@U?$HandleDataWithBulk@VRcdStream@resources@@VRcdBulkStream@2@@detail@vfs@@@vfs@@UEAAX_K@Z
?FindFirst@?$StreamDevice@VRcdStream@resources@@U?$HandleDataWithBulk@VRcdStream@resources@@VRcdBulkStream@2@@detail@vfs@@@vfs@@UEAA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAUFindData@2@@Z
?FindNext@?$StreamDevice@VRcdStream@resources@@U?$HandleDataWithBulk@VRcdStream@resources@@VRcdBulkStream@2@@detail@vfs@@@vfs@@UEAA_N_KPEAUFindData@2@@Z
?GetEntryForFileName@ResourceCacheDeviceV2@resources@@UEAA?AV?$optional@V?$reference_wrapper@$$CBUEntry@ResourceCacheEntryList@@@std@@@std@@V?$basic_string_view@DU?$char_traits@D@std@@@4@@Z
?GetLength@?$BulkStreamDevice@VRcdStream@resources@@VRcdBulkStream@2@@vfs@@UEAA_K_K@Z
?GetLength@ResourceCacheDeviceV2@resources@@UEAA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetRealSize@ResourceCacheDeviceV2@resources@@MEAA_KAEBUEntry@ResourceCacheEntryList@@@Z
?InitializeLoad@CachedResourceMounter@fx@@MEAA?AV?$fwRefContainer@VResource@fx@@@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVurl@v1@skyr@@@Z
?IsBlocking@ResourceCacheDeviceV2@resources@@UEAA_NXZ
?LoadResource@CachedResourceMounter@fx@@UEAA?AV?$task@V?$fwRefContainer@VResource@fx@@@@@Concurrency@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?LoadResourceWithError@CachedResourceMounter@fx@@UEAA?AV?$task@V?$expected@V?$fwRefContainer@VResource@fx@@@@VResourceManagerError@fx@@@tl@@@Concurrency@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Open@?$StreamDevice@VRcdStream@resources@@U?$HandleDataWithBulk@VRcdStream@resources@@VRcdBulkStream@2@@detail@vfs@@@vfs@@UEAA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z
?OpenBulk@?$BulkStreamDevice@VRcdStream@resources@@VRcdBulkStream@2@@vfs@@UEAA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEA_K@Z
?OpenFile@RcdBulkStream@resources@@MEAA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?OpenFile@RcdStream@resources@@MEAA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?PropagateError@ResourceCacheDeviceV2@resources@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Read@?$StreamDevice@VRcdStream@resources@@U?$HandleDataWithBulk@VRcdStream@resources@@VRcdBulkStream@2@@detail@vfs@@@vfs@@UEAA_K_KPEAX0@Z
?Read@RcdStream@resources@@UEAA_KPEAX_K@Z
?ReadBulk@?$BulkStreamDevice@VRcdStream@resources@@VRcdBulkStream@2@@vfs@@UEAA_K_K0PEAX0@Z
?ReadBulk@RcdBulkStream@resources@@UEAA_K_KPEAX0@Z
?RemoveResourceEntries@CachedResourceMounter@fx@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Seek@?$StreamDevice@VRcdStream@resources@@U?$HandleDataWithBulk@VRcdStream@resources@@VRcdBulkStream@2@@detail@vfs@@@vfs@@UEAA_K_K_JH@Z
?Seek@RcdStream@resources@@UEAA_K_JH@Z
?SetPathPrefix@ResourceCacheDeviceV2@resources@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?UnfetchEntry@ResourceCacheDeviceV2@resources@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Write@?$StreamDevice@VRcdStream@resources@@U?$HandleDataWithBulk@VRcdStream@resources@@VRcdBulkStream@2@@detail@vfs@@@vfs@@UEAA_K_KPEBX0@Z
?WriteBulk@?$BulkStreamDevice@VRcdStream@resources@@VRcdBulkStream@2@@vfs@@UEAA_K_K0PEBX0@Z

ros-patches-five

?IDidntDoNothing@@YAXXZ

rage-device-five

?OnInitialMount@fiDevice@rage@@2V?$fwEvent@$$V@@A

net-tcp-server

?GetOrCreate@UvLoopManager@net@@QEAA?AV?$fwRefContainer@VUvLoopHolder@net@@@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

net-base

?ToString@PeerAddress@net@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

libuv

uv_async_init
uv_async_send
uv_close
uv_poll_init_socket
uv_poll_start
uv_poll_stop
uv_timer_init
uv_timer_start
uv_timer_stop

citizen-scripting-core

?EnterScope@ProfilerComponent@fx@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_J@Z
?ExitScope@ProfilerComponent@fx@@QEAAX_J@Z

citizen-resources-core

?GetAllEntries@ResourceMetaDataComponent@fx@@QEAA?AV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@2@@std@@@2@@std@@XZ
?GetCurrent@ResourceManager@fx@@SAPEAV12@_N@Z
?GlobEntriesVector@ResourceMetaDataComponent@fx@@QEAA?AV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?OnInitializeInstance@Resource@fx@@2V?$fwEvent@PEAVResource@fx@@@@A
?OnInitializeInstance@ResourceManager@fx@@2V?$fwEvent@PEAVResourceManager@fx@@@@A

vfs-core

??0Device@vfs@@QEAA@XZ
??0RagePackfile@vfs@@QEAA@XZ
??0Stream@vfs@@QEAA@V?$fwRefContainer@VDevice@vfs@@@@_K@Z
??0ZipFile@vfs@@QEAA@XZ
??1Device@vfs@@UEAA@XZ
?CloseBulk@Device@vfs@@UEAA_N_K@Z
?Create@Device@vfs@@UEAA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?CreateDirectoryW@Device@vfs@@UEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?ExtensionCtl@Device@vfs@@UEAA_NHPEAX_K@Z
?GetAttributes@Device@vfs@@UEAAIAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetDevice@vfs@@YA?AV?$fwRefContainer@VDevice@vfs@@@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetLength@Device@vfs@@UEAA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetLength@Device@vfs@@UEAA_K_K@Z
?GetLength@Stream@vfs@@QEAA_KXZ
?GetModifiedTime@Device@vfs@@UEAA_JAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Mount@vfs@@YAXV?$fwRefContainer@VDevice@vfs@@@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?OpenArchive@RagePackfile@vfs@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAV34@@Z
?OpenArchive@ZipFile@vfs@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?OpenBulk@Device@vfs@@UEAA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEA_K@Z
?OpenRead@vfs@@YA?AV?$fwRefContainer@VStream@vfs@@@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Read@Stream@vfs@@QEAA_KPEAX_K@Z
?ReadBulk@Device@vfs@@UEAA_K_K0PEAX0@Z
?ReadToEnd@Stream@vfs@@QEAA?AV?$vector@EV?$allocator@E@std@@@std@@XZ
?RemoveDirectoryW@Device@vfs@@UEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?RemoveFile@Device@vfs@@UEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?RenameFile@Device@vfs@@UEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?Seek@Stream@vfs@@QEAA_K_JH@Z
?SetPathPrefix@Device@vfs@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Write@Device@vfs@@UEAA_K_KPEBX0@Z
?Write@Stream@vfs@@QEAA_KPEBX_K@Z
?WriteBulk@Device@vfs@@UEAA_K_K0PEBX0@Z

scripting-gta

?GetNativeHandler@ScriptEngine@fx@@SA?AV?$optional@V?$function@$$A6AXAEAVScriptContext@fx@@@Z@std@@@boost@@_K@Z
?RegisterNativeHandler@ScriptEngine@fx@@SAX_KV?$function@$$A6AXAEAVScriptContext@fx@@@Z@std@@@Z

rage-scripting-five

?CleanNativeResult@PointerArgumentHints@scripting@fx@@SAX_KW4ResultType@23@PEAX@Z
?GetNativeHandler@scrEngine@rage@@SAP6AXPEAVscrNativeCallContext@2@@Z_K@Z
?OnScriptInit@scrEngine@rage@@2V?$fwEvent@$$V@@A

conhost-v2

?OnShouldDrawGui@ConHost@@3V?$fwEvent@PEA_N@@A

msvcp140

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
??0facet@locale@std@@IEAA@_K@Z
??0ios_base@std@@IEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??1facet@locale@std@@MEAA@XZ
??1ios_base@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??Bid@locale@std@@QEAA_KXZ
??_8?$basic_ostream@DU?$char_traits@D@std@@@std@@7B@
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Random_device@std@@YAIXZ
?_Syserror_map@std@@YAPEBDH@Z
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Winerror_map@std@@YAHH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xbad_function_call@std@@YAXXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?clear@ios_base@std@@QEAAXH@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?good@ios_base@std@@QEBA_NXZ
?id@?$numpunct@D@std@@2V0locale@2@A
?id@?$numpunct@_W@std@@2V0locale@2@A
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uncaught_exception@std@@YA_NXZ
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
_Cnd_broadcast
_Cnd_destroy_in_situ
_Cnd_do_broadcast_at_thread_exit
_Cnd_init_in_situ
_Cnd_wait
_Mbrtowc
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Mtx_lock
_Mtx_trylock
_Mtx_unlock
_Query_perf_counter
_Query_perf_frequency
_Thrd_detach
_Thrd_yield
_Xtime_get_ticks

rpcrt4

RpcStringFreeA
UuidToStringA

wintrust

WinVerifyTrust

vcruntime140

_CxxThrowException
__C_specific_handler
__CxxFrameHandler3
__intrinsic_setjmp
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_destroy_list
_purecall
longjmp
memchr
memcmp
memcpy
memmove
memset
strchr
strrchr
strstr
wcschr
wcsrchr
wcsstr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsnprintf_s
__stdio_common_vsprintf
__stdio_common_vsprintf_s
__stdio_common_vsscanf
__stdio_common_vswprintf
_close
_fileno
_lseeki64
_read
_setmode
_wfopen
_wopen
_write
fclose
feof
ferror
fflush
fgetc
fgets
fopen
fputc
fputs
fread
freopen
fseek
ftell
fwrite
getc
putchar
setvbuf

api-ms-win-crt-heap-l1-1-0

_aligned_free
_aligned_malloc
_callnewh
calloc
free
malloc
realloc

api-ms-win-crt-runtime-l1-1-0

__sys_errlist
__sys_nerr
_beginthreadex
_cexit
_configure_narrow_argv
_crt_atexit
_errno
_execute_onexit_table
_exit
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_seh_filter_dll
abort
raise
signal
strerror
strerror_s
terminate

api-ms-win-crt-math-l1-1-0

_dpcomp
_dsign
_dtest
_fdpcomp
_fdsign
_fdtest
_finite
_hypotf
_ldsign
_ldtest
acos
acosf
acosh
acoshf
asin
asinf
asinh
asinhf
atan
atan2
atan2f
atanf
atanh
atanhf
cbrt
cbrtf
ceil
ceilf
copysign
cos
cosf
cosh
coshf
erf
erfc
erfcf
erff
exp
exp2
exp2f
expf
expm1
expm1f
fdim
fdimf
floor
floorf
fma
fmod
fmodf
frexp
hypot
ilogb
ilogbf
ldexp
lgamma
lgammaf
log
log10
log10f
log1p
log1pf
log2
log2f
logb
logbf
logf
modf
modff
nearbyint
nearbyintf
nextafter
nextafterf
pow
powf
remainder
remainderf
round
roundf
scalbn
scalbnf
sin
sinf
sinh
sinhf
sqrt
sqrtf
tan
tanf
tanh
tanhf
tgamma
tgammaf
trunc
truncf

api-ms-win-crt-time-l1-1-0

_gmtime64
_gmtime64_s
_time64
clock
strftime

api-ms-win-crt-string-l1-1-0

_strdup
_stricmp
_strnicmp
_wcsdup
isalnum
isalpha
iscntrl
isgraph
islower
ispunct
isspace
isupper
iswspace
isxdigit
strcoll
strcpy
strcspn
strlen
strncat
strncmp
strncpy
strpbrk
strspn
tolower
toupper
wcscat_s
wcscpy
wcscpy_s
wcslen
wcsncpy
wcspbrk

api-ms-win-crt-convert-l1-1-0

atoi
strtod
strtoimax
strtol
strtoll
strtoul
strtoull
wcstombs

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-utility-l1-1-0

_byteswap_uint64
_byteswap_ulong
_byteswap_ushort
qsort
rand
srand

api-ms-win-crt-filesystem-l1-1-0

_fstat64
_stat64i32
_unlink
_waccess
_wstat64
_wunlink

bcrypt

BCryptGenRandom

oleaut32

GetErrorInfo
SetErrorInfo
SysAllocString
SysFreeString
SysStringLen

Exports

Exports

CreateComponent

Sections

.text
Size: 54.7MB - Virtual size: 54.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 317KB - Virtual size: 335KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1b6c1fce83b0d67a7b24becd07b30cd3

Code Sign

47:d5:29:f4:40:91:b5:18:5e:6f:ab:9d:30:34:f0:dfCertificate

Extended Key Usages

Key Usages

47:d5:29:f4:40:91:b5:18:5e:6f:ab:9d:30:34:f0:dfCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

82:a0:6d:5d:fe:3d:6d:c9:e3:14:48:08:80:ee:ce:9d:e0:36:f1:22:40:ca:89:67:3a:f6:c6:14:34:d4:85:82Signer

Signature Validations

Verification

29/09/2022, 18:51 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shell32

crypt32

v8-9.3.345.16

ws2_32

shlwapi

user32

advapi32

winmm

rage-nutsnbolts-five

net

citizen-resources-client

ros-patches-five

rage-device-five

net-tcp-server

net-base

libuv

citizen-scripting-core

citizen-resources-core

vfs-core

scripting-gta

rage-scripting-five

conhost-v2

msvcp140

rpcrt4

wintrust

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

bcrypt

oleaut32

Exports

Exports

Sections

.text Size: 54.7MB - Virtual size: 54.7MB

.data Size: 317KB - Virtual size: 335KB

.idata Size: 37KB - Virtual size: 36KB

.tls Size: 25KB - Virtual size: 24KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 49KB - Virtual size: 49KB

47:d5:29:f4:40:91:b5:18:5e:6f:ab:9d:30:34:f0:df
Certificate

47:d5:29:f4:40:91:b5:18:5e:6f:ab:9d:30:34:f0:df
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

82:a0:6d:5d:fe:3d:6d:c9:e3:14:48:08:80:ee:ce:9d:e0:36:f1:22:40:ca:89:67:3a:f6:c6:14:34:d4:85:82
Signer

29/09/2022, 18:51
Valid: false

.text
Size: 54.7MB - Virtual size: 54.7MB

.data
Size: 317KB - Virtual size: 335KB

.idata
Size: 37KB - Virtual size: 36KB

.tls
Size: 25KB - Virtual size: 24KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 49KB - Virtual size: 49KB