TSCLicensing[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

TSCLicensing.dll
Size

6.4MB
MD5

9ea1c14c42e69bd576f0aff4d6ad0562
SHA1

64dcc7bb0140560baf34eb3a40d0e8604a6c6932
SHA256

51ea38cb36e06ccdb52384948000dd104fc61aa69f579546ad0c8c96733c2094
SHA512

a98671a0d3d5ef87b0353849fa8f58dc36cd110015f79944b7734bf1d5417bb1cd177894ab1be54d7d3d4d8107b837695540439f76fbb20f24917128ed694423
SSDEEP

98304:NSkbzMCXCFF2hdt2S3hV9AyWcLfJFi47K/jTs+5k/RL0l2V/Ekq00EFMo/s2i5:NPzdX0FOh9jWq847ojY+5kJM2VA0mo

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

TSCLicensing.dll
.dll windows x64

2d7d3a073dd4cb7f6144e54eab0aafe4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

cpprest140_2_9

?set_request_uri@_http_request@details@http@web@@QEAAXAEBVuri@4@@Z

mswsock

TransmitFile

ws2_32

ntohs

winhttp

WinHttpOpenRequest

kernel32

GetVersionExA
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

advapi32

DuplicateTokenEx

shell32

CommandLineToArgvW

odbc32

ord75

msvcp140

??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAM@Z

bcrypt

BCryptCloseAlgorithmProvider

vcruntime140

strrchr

api-ms-win-crt-runtime-l1-1-0

_endthreadex

api-ms-win-crt-string-l1-1-0

isdigit

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-convert-l1-1-0

mbsrtowcs

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-environment-l1-1-0

__p__wenviron

api-ms-win-crt-math-l1-1-0

modf

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

wtsapi32

WTSSendMessageW

user32

GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

Exports

Exports

??0ActivationData@TSCLicensing@@QEAA@PEBD@Z
??0ActivationData@TSCLicensing@@QEAA@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0CppRestWebProxyAdapter@TSCLicensing@@QEAA@V?$shared_ptr@VILogger@TSCLicensing@@@std@@@Z
??0License@@QEAA@ULicensingResponse@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@3@W4LicenseType@TSCLicensing@@@Z
??0License@@QEAA@ULicensingResponse@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@3@W4LicenseType@TSCLicensing@@PEAV?$ILicenseProvider@VILicense@@@@@Z
??0LicenseSoftLimitChecker@@QEAA@XZ
??0LicenseVersionChecker@@QEAA@H@Z
??0MaintenanceAgreementEntitlement@TSCLicensing@@QEAA@V?$shared_ptr@VISecureCache@TSCLicensing@@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@@Z
??0NalpeironHelper@@QEAA@V?$shared_ptr@VINalpeironAPI@TSCLicensing@@@std@@V?$shared_ptr@VILicenseVersionChecker@@@2@V?$shared_ptr@VILicenseSoftLimitChecker@@@2@V?$shared_ptr@VINalpeironCommonHelper@TSCLicensing@@@2@V?$shared_ptr@VILogger@TSCLicensing@@@2@V?$shared_ptr@VIGetProxyInfo@TSCLicensing@@@2@V?$shared_ptr@VSDKConfig@TSCLicensing@@@2@AEBUNalpeironSystemInfo@@_N@Z
??0NalpeironLicenseProvider@TSCLicensing@@QEAA@V?$shared_ptr@VINalpeironHelper@@@std@@UNalpeironSystemInfo@@V?$shared_ptr@VITSCActivationEntitlementProvider@TSCLicensing@@@3@H@Z
??0NalpeironLicensingConfiguration@@QEAA@HHHHHHHH_NV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@1UNalpeironSystemInfo@@W4Environment@TSCLicensing@@V?$shared_ptr@VIGetProxyInfo@TSCLicensing@@@2@@Z
??0NalpeironPassiveHelper@TSCLicensing@@QEAA@V?$shared_ptr@VINalpeironPassiveAPI@TSCLicensing@@@std@@V?$shared_ptr@VINalpeironCommonHelper@TSCLicensing@@@3@V?$shared_ptr@VILicenseVersionChecker@@@3@V?$shared_ptr@VILogger@TSCLicensing@@@3@V?$shared_ptr@VSDKConfig@TSCLicensing@@@3@@Z
??0NalpeironPassiveLicenseProvider@TSCLicensing@@QEAA@V?$shared_ptr@VINalpeironPassiveHelper@TSCLicensing@@@std@@@Z
??0NalpeironSystemInfo@@QEAA@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@000@Z
??0OfflineActivationData@@QEAA@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
??0PassiveActivationData@TSCLicensing@@QEAA@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
??0PassiveNalpeironLicenseConfiguration@TSCLicensing@@QEAA@HHHHHHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0UNalpeironSystemInfo@@@Z
??0ProxyResolverAdapter@Win@TSCLicensing@@QEAA@V?$shared_ptr@VILogger@TSCLicensing@@@std@@@Z
??0TSCActivationAPI@TSCLicensing@@QEAA@V?$shared_ptr@VIKeysApi@Generated@TSCLicensing@@@std@@V?$shared_ptr@VIWebViewApi@Api@TSCLicensing@@@3@V?$shared_ptr@VILogger@TSCLicensing@@@3@@Z
??0TSCActivationAPIFactory@TSCLicensing@@QEAA@V?$shared_ptr@VILogger@TSCLicensing@@@std@@W4Environment@1@V?$shared_ptr@VIGetProxyInfo@TSCLicensing@@@3@V?$shared_ptr@VIRedirectBuilder@@@3@@Z
??0TSCActivationEntitlementProvider@TSCLicensing@@QEAA@V?$shared_ptr@VITSCActivationAPIFactory@TSCLicensing@@@std@@V?$shared_ptr@VISecureCache@TSCLicensing@@@3@AEBHV?$shared_ptr@VIEntitlement@TSCLicensing@@@3@3@Z
??0TSCLicensingServiceLocator@TSCLicensing@@QEAA@V?$shared_ptr@VILicensingConfiguration@@@std@@V?$shared_ptr@VIRedirectBuilder@@@3@@Z
??0WebViewUrlEntitlement@TSCLicensing@@QEAA@XZ
??0WinProxyResultConverter@Win@TSCLicensing@@QEAA@V?$shared_ptr@VILogger@TSCLicensing@@@std@@@Z
??1ITSCActivationAPI@TSCLicensing@@UEAA@XZ
??1ITSCActivationAPIFactory@TSCLicensing@@UEAA@XZ
??4LicensingResponse@@QEAAAEAU0@$$QEAU0@@Z
??4LicensingResponse@@QEAAAEAU0@AEBU0@@Z
??4_Init_locks@std@@QEAAAEAV01@AEBV01@@Z
?AttemptToRefreshEntitlementsOnline@TSCActivationEntitlementProvider@TSCLicensing@@UEAA?AV?$task@X@Concurrency@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?AttemptToRefreshLicenseOnline@NalpeironHelper@@UEAAXXZ
?BuildNumber@NalpeironSystemInfo@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?CanReachNalpeiron@NalpeironHelper@@UEAA_NXZ
?CheckLicenseVersion@LicenseVersionChecker@@UEAAHH@Z
?CheckLicenseVersion@LicenseVersionChecker@@UEAAHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?CheckSoftLimit@LicenseSoftLimitChecker@@UEAAHHH@Z
?CheckSoftLimit@LicenseSoftLimitChecker@@UEAAHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?CleanInvalidLicenseKeyChars@StringUtilCommon@TSCLicensing@@YAXAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?CleanInvalidSeparators@StringUtilCommon@TSCLicensing@@YAXAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?ClearEntitlementsFromCache@TSCActivationEntitlementProvider@TSCLicensing@@UEAAXXZ
?CloseLibrary@NalpeironHelper@@UEAAXXZ
?CloseLibrary@NalpeironPassiveHelper@TSCLicensing@@UEAAXXZ
?CompleteOfflineActivation@NalpeironLicenseProvider@TSCLicensing@@UEAA?AV?$shared_ptr@VILicense@@@std@@UOfflineActivationData@@@Z
?CompleteOfflineActivation@NalpeironPassiveLicenseProvider@TSCLicensing@@UEAA?AV?$shared_ptr@VILicense@@@std@@UOfflineActivationData@@@Z
?CompleteOfflineActivation@TSCLicensingServiceLocator@TSCLicensing@@UEAA?AV?$shared_ptr@VILicense@@@std@@UOfflineActivationData@@@Z
?CompleteOfflineDeactivation@NalpeironLicenseProvider@TSCLicensing@@UEAA?AV?$shared_ptr@VILicense@@@std@@XZ
?CompleteOfflineDeactivation@NalpeironPassiveLicenseProvider@TSCLicensing@@UEAA?AV?$shared_ptr@VILicense@@@std@@XZ
?CompleteOfflineDeactivation@TSCLicensingServiceLocator@TSCLicensing@@UEAA?AV?$shared_ptr@VILicense@@@std@@XZ
?CompletePassiveActivation@NalpeironPassiveHelper@TSCLicensing@@UEAAHV?$shared_ptr@VPassiveActivationData@TSCLicensing@@@std@@@Z
?ConstructActivationAPI@TSCActivationAPIFactory@TSCLicensing@@UEAA?AV?$shared_ptr@VITSCActivationAPI@TSCLicensing@@@std@@XZ
?ConvertToCppRestProxyInfo@CppRestWebProxyAdapter@TSCLicensing@@QEAA?AVweb_proxy@web@@UProxyInfo@2@@Z
?CreateLicensingService@NalpeironServiceFactory@@UEAA?AV?$shared_ptr@VILicensingService@@@std@@V?$shared_ptr@VILicensingConfiguration@@@3@V?$shared_ptr@VIRedirectBuilder@@@3@@Z
?DeleteLicenseCacheFiles@NalpeironHelper@@UEAAXXZ
?DeleteLicensingFiles@NalpeironPassiveHelper@TSCLicensing@@UEAAXXZ
?DeleteLicensingFiles@NalpeironPassiveLicenseProvider@TSCLicensing@@UEAAXXZ
?DeleteLicensingFiles@TSCLicensingServiceLocator@TSCLicensing@@UEAAXXZ
?EditionId@NalpeironSystemInfo@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?FileExists@FileSystemUtil@TSCLicensing@@UEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?FullProductVersion@NalpeironSystemInfo@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetActivationCertificateRequest@NalpeironHelper@@UEAAHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV23@@Z
?GetCertificate@PassiveActivationData@TSCLicensing@@QEAA?BV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetComputerID@NalpeironHelper@@UEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetComputerID@NalpeironHelper@@UEAA_NPEAPEAD@Z
?GetComputerID@NalpeironPassiveHelper@TSCLicensing@@UEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetDeactivationCertificateRequest@NalpeironHelper@@UEAAHAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetEntitlementsFromCache@NalpeironHelper@@UEAA?AV?$shared_ptr@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@std@@XZ
?GetEntitlementsFromCache@TSCActivationEntitlementProvider@TSCLicensing@@UEAA?AV?$shared_ptr@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@std@@XZ
?GetLicense@NalpeironLicenseProvider@TSCLicensing@@UEAA?AV?$shared_ptr@VILicense@@@std@@V?$shared_ptr@VActivationData@TSCLicensing@@@4@@Z
?GetLicense@NalpeironPassiveLicenseProvider@TSCLicensing@@UEAA?AV?$shared_ptr@VILicense@@@std@@V?$shared_ptr@VActivationData@TSCLicensing@@@4@@Z
?GetLicense@TSCLicensingServiceLocator@TSCLicensing@@UEAA?AV?$shared_ptr@VILicense@@@std@@V?$shared_ptr@VActivationData@TSCLicensing@@@4@@Z
?GetLicenseCode@ActivationData@TSCLicensing@@UEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetLicenseType@NalpeironHelper@@UEAA?AW4LicenseType@TSCLicensing@@XZ
?GetLicenseValidationResponse@License@@UEAA?AULicensingResponse@@XZ
?GetMaintenanceInfo@TSCActivationAPI@TSCLicensing@@UEAA?AV?$task@V?$shared_ptr@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@std@@@Concurrency@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetProxyInfo@ProxyResolverAdapter@Win@TSCLicensing@@UEAA?AUProxyInfo@3@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetStoredLicenseCode@NalpeironHelper@@UEAA_NPEAPEAD@Z
?GetSubscriptionExpirationDate@NalpeironHelper@@UEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetTrialExpirationDate@NalpeironHelper@@UEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetUDFValue@NalpeironHelper@@UEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V23@@Z
?GetUDFValue@NalpeironPassiveHelper@TSCLicensing@@UEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V34@@Z
?GetWebViewUrl@TSCActivationAPI@TSCLicensing@@UEAA?AV?$task@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Concurrency@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?InitLibrary@NalpeironHelper@@UEAAHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0IIIIIII@Z
?InitLibrary@NalpeironPassiveHelper@TSCLicensing@@UEAAHV?$shared_ptr@VPassiveNalpeironLicenseConfiguration@TSCLicensing@@@std@@@Z
?InstallLang@NalpeironSystemInfo@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?IsLicenseActivated@NalpeironHelper@@UEAA_NXZ
?IsSubscription@License@@UEAA_NXZ
?IsTrial@License@@UEAA_NXZ
?Key@License@@UEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?Key@OfflineActivationData@@QEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?LicenseCertificate@OfflineActivationData@@QEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?LicenseData@License@@UEAA?AV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@XZ
?ParseProxyIpAndPort@WinProxyResultConverter@Win@TSCLicensing@@QEAA?AUProxyInfo@3@UWINHTTP_PROXY_INFO@@@Z
?RPCCall@NalpeironHelper@@UEAAHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00AEAV23@@Z
?ReadFromCache@MaintenanceAgreementEntitlement@TSCLicensing@@UEAA_NXZ
?ReadFromCache@WebViewUrlEntitlement@TSCLicensing@@UEAA_NXZ
?ReadSecureCache@NalpeironHelper@@UEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV23@@Z
?RefreshEntitlementData@License@@UEAA?AVthread@std@@XZ
?RefreshEntitlementData@NalpeironLicenseProvider@TSCLicensing@@UEAA?AVthread@std@@XZ
?RefreshEntitlementData@NalpeironPassiveLicenseProvider@TSCLicensing@@UEAA?AVthread@std@@XZ
?RemoveLastPathElement@FileSystemUtil@TSCLicensing@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V34@@Z
?Return@License@@UEAA?AULicensingResponse@@XZ
?ReturnLicense@NalpeironHelper@@UEAA_NXZ
?ReturnLicense@NalpeironLicenseProvider@TSCLicensing@@UEAA?AULicensingResponse@@XZ
?ReturnLicense@NalpeironPassiveLicenseProvider@TSCLicensing@@UEAA?AULicensingResponse@@XZ
?Separator@FileSystemUtil@TSCLicensing@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?SetActivationListener@License@@UEAA?AVthread@std@@KV?$shared_ptr@VIActivationListener@@@3@@Z
?SetActivationListener@NalpeironLicenseProvider@TSCLicensing@@UEAA?AVthread@std@@KV?$shared_ptr@VIActivationListener@@@4@@Z
?SetActivationListener@NalpeironPassiveLicenseProvider@TSCLicensing@@UEAA?AVthread@std@@KV?$shared_ptr@VIActivationListener@@@4@@Z
?SetEntitlementListener@License@@UEAA?AVthread@std@@KV?$shared_ptr@VIEntitlementListener@@@3@@Z
?SetEntitlementListener@NalpeironLicenseProvider@TSCLicensing@@UEAA?AVthread@std@@KV?$shared_ptr@VIEntitlementListener@@@4@@Z
?SetEntitlementListener@NalpeironPassiveLicenseProvider@TSCLicensing@@UEAA?AVthread@std@@KV?$shared_ptr@VIEntitlementListener@@@4@@Z
?SetValue@MaintenanceAgreementEntitlement@TSCLicensing@@UEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?SetValue@WebViewUrlEntitlement@TSCLicensing@@UEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?ShutDownLicensing@NalpeironLicenseProvider@TSCLicensing@@UEAAXXZ
?ShutDownLicensing@NalpeironPassiveLicenseProvider@TSCLicensing@@UEAAXXZ
?ShutDownLicensing@TSCLicensingServiceLocator@TSCLicensing@@UEAAXXZ
?ShutDownNalpeiron@NalpeironHelper@@UEAAXXZ
?ShutDownNalpeiron@NalpeironPassiveHelper@TSCLicensing@@UEAAXXZ
?StopActivationListener@License@@UEAAXXZ
?StopActivationListener@NalpeironLicenseProvider@TSCLicensing@@UEAAXXZ
?StopActivationListener@NalpeironPassiveLicenseProvider@TSCLicensing@@UEAAXXZ
?StopEntitlementListener@License@@UEAAXXZ
?StopEntitlementListener@NalpeironLicenseProvider@TSCLicensing@@UEAAXXZ
?StopEntitlementListener@NalpeironPassiveLicenseProvider@TSCLicensing@@UEAAXXZ
?ToMap@MaintenanceAgreementEntitlement@TSCLicensing@@UEBA?AV?$shared_ptr@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@std@@XZ
?ToMap@WebViewUrlEntitlement@TSCLicensing@@UEBA?AV?$shared_ptr@V?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@std@@XZ
?ToStdString@StringUtilWin@TSCLicensing@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?ToStdWString@StringUtilWin@TSCLicensing@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?UnlockOffline@NalpeironHelper@@UEAAHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?UploadSystemInfo@NalpeironHelper@@UEAA_NXZ
?VerifyLicense@NalpeironHelper@@UEAAHAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?WriteSecureCache@NalpeironHelper@@UEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?isValid@LicensingResponse@@QEAA_NXZ

Sections

.text
Size: - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 708KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 6.4MB - Virtual size: 6.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2d7d3a073dd4cb7f6144e54eab0aafe4

Headers

DLL Characteristics

File Characteristics

Imports

cpprest140_2_9

mswsock

ws2_32

winhttp

kernel32

advapi32

shell32

odbc32

msvcp140

bcrypt

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

wtsapi32

user32

Exports

Exports

Sections

.text Size: - Virtual size: 1.7MB

.rdata Size: - Virtual size: 708KB

.data Size: - Virtual size: 109KB

.pdata Size: - Virtual size: 107KB

.vmp0 Size: - Virtual size: 3.7MB

.vmp1 Size: 6.4MB - Virtual size: 6.4MB

.reloc Size: 512B - Virtual size: 188B

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: - Virtual size: 1.7MB

.rdata
Size: - Virtual size: 708KB

.data
Size: - Virtual size: 109KB

.pdata
Size: - Virtual size: 107KB

.vmp0
Size: - Virtual size: 3.7MB

.vmp1
Size: 6.4MB - Virtual size: 6.4MB

.reloc
Size: 512B - Virtual size: 188B

.rsrc
Size: 1KB - Virtual size: 1KB