ecfa8d7a8bfd15508b9198625260f596b3d586447044bcf787d01cbeede1b29b

Sharing

Copy URL Twitter E-mail

General

Target

ecfa8d7a8bfd15508b9198625260f596b3d586447044bcf787d01cbeede1b29b
Size

252KB
MD5

75246217370ea336a658dc002f8ba387
SHA1

bb8ca5b603c3137b32c381fb7135abf39de2c0e5
SHA256

ecfa8d7a8bfd15508b9198625260f596b3d586447044bcf787d01cbeede1b29b
SHA512

cf8b3c3206dd1c5a5a983b9417b315671017ba4aa6c65b1e42d270e07d65f98f1f7556bdd670860d0b385e76ce38c14a546cf212c71eb7556c0d5393921c8570
SSDEEP

3072:ShLo9c0z6YfV1dZaUQygRu4H+qXJRDyJgJmht/kHohlc1eznMUxU5vjS:aL2Rf/+Ru4H+GJRGL0S

Score

N/A

Malware Config

Signatures

Files

ecfa8d7a8bfd15508b9198625260f596b3d586447044bcf787d01cbeede1b29b
.exe windows x86

1cf8918e6a4c764edfd01c61d89afbb7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

netinst

?DllGetClassFactoryObject@@YAJPAPAVIDriverInstallInterfaceFactory@@@Z
?DllGetClassFactoryObject@@YAJPAPAVISysProberInterfaceFactory@@@Z

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

advapi32

RegEnumKeyExA
OpenThreadToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
RegCreateKeyA
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
RegSetValueExA
RegDeleteValueA
RegCloseKey
RegEnumValueA
RegCreateKeyExA
RegOpenKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

kernel32

WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
CreateDirectoryA
LCMapStringW
LCMapStringA
SetEnvironmentVariableA
lstrlenW
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryA
MultiByteToWideChar
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetLocalTime
LeaveCriticalSection
EnterCriticalSection
LocalFree
FormatMessageA
OutputDebugStringA
GetEnvironmentVariableA
WideCharToMultiByte
GetACP
GetLocaleInfoA
lstrlenA
GetModuleHandleA
GetVersionExA
CloseHandle
CreateFileA
DeviceIoControl
SetLastError
GetCurrentDirectoryA
GetPrivateProfileStringA
GetCurrentProcess
SetFileAttributesA
CopyFileA
GetSystemDirectoryA
FindClose
FindFirstFileA
WaitForSingleObject
CreateProcessA
SetCurrentDirectoryA
GetCurrentThread
GetShortPathNameA
FindNextFileA
ReadFile
GetSystemDefaultLangID
LoadResource
FindResourceExA
lstrcmpA
LocalAlloc
CreateMutexA
GetPrivateProfileSectionA
GetStdHandle
GetWindowsDirectoryA
CreateThread
CompareStringW
CompareStringA
SetEndOfFile
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
HeapReAlloc
GetStringTypeW
GetStringTypeA
GetSystemTimeAsFileTime
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
Sleep
GetFullPathNameA
GetModuleFileNameA
SetFilePointer
SetStdHandle
GetFileType
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
TlsFree
TlsSetValue
TlsAlloc
InterlockedExchange
GetThreadLocale
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
HeapFree
HeapAlloc
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
ExitProcess
GetCommandLineA
GetProcessHeap
GetStartupInfoA
GetCPInfo
InterlockedIncrement
GetOEMCP
TlsGetValue

user32

PostQuitMessage
LoadStringA
wsprintfA
ExitWindowsEx
MessageBoxA
SetDlgItemTextA
RegisterWindowMessageA
DefDlgProcA
LoadCursorA
RegisterClassA
FindWindowA
CreateDialogParamA
GetMessageA
IsDialogMessageA
TranslateMessage
GetDlgItem
DestroyWindow
DispatchMessageA
SetWindowTextA
SetTimer
KillTimer
PostMessageA
EnableWindow
ShowWindow

ole32

CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
CoUninitialize
CoInitializeEx

oleaut32

SysAllocStringByteLen
SysAllocStringLen
VarBstrCat
SysFreeString
SysStringLen
SysStringByteLen
VariantClear
SysAllocString

Exports

Exports

??0?$_String_val@DV?$allocator@D@std@@@std@@IAE@V?$allocator@D@1@@Z
??0?$_String_val@DV?$allocator@D@std@@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@IIABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@IDABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@1@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0CNcsDebug@@QAE@ABV0@@Z
??0CNcsDebug@@QAE@XZ
??0CNcsRegKey@@QAE@ABV0@@Z
??0CNcsRegKey@@QAE@PAUHKEY__@@@Z
??0CNcsRegKey@@QAE@XZ
??0CNcsString@@QAE@ABV0@@Z
??0CNcsString@@QAE@PBD@Z
??0CNcsString@@QAE@QA_W@Z
??0CNcsString@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1CNcsDebug@@UAE@XZ
??1CNcsRegKey@@UAE@XZ
??1CNcsString@@QAE@XZ
??4?$_String_val@DV?$allocator@D@std@@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4CNcsDebug@@QAEAAV0@ABV0@@Z
??4CNcsRegKey@@QAEAAV0@ABV0@@Z
??4CNcsRegKey@@QAEAAV0@PAUHKEY__@@@Z
??4CNcsString@@QAEAAV0@ABV0@@Z
??4CNcsString@@QAEAAV0@PBD@Z
??8CNcsString@@QBE_NABV0@@Z
??8CNcsString@@QBE_NPBD@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
??BCNcsString@@QAEPA_WXZ
??BCNcsString@@QBEPBDXZ
??HCNcsString@@QAE?AV0@ABV0@@Z
??MCNcsString@@QBE_NABV0@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??_7CNcsDebug@@6B@
??_7CNcsRegKey@@6B@
??_F?$_String_val@DV?$allocator@D@std@@@std@@QAEXXZ
?AddValueToMultiString@CNcsRegKey@@QAE_NABVCNcsString@@0@Z
?Close@CNcsRegKey@@QAEXXZ
?Configure@CNcsDebug@@QAEHPBD0KHK0@Z
?Create@CNcsRegKey@@QAE_NPAUHKEY__@@ABVCNcsString@@_N2@Z
?DeleteSubKey@CNcsRegKey@@QAE_NPBD@Z
?DeleteValue@CNcsRegKey@@QAE_NABVCNcsString@@@Z
?Empty@CNcsString@@QAEXXZ
?EnumSubKey@CNcsRegKey@@QAE_NAAVCNcsString@@@Z
?EnumValue@CNcsRegKey@@QAE_NAAVCNcsString@@@Z
?Error@CNcsDebug@@QAAXPADHPBDZZ
?FormatString@CNcsString@@QAAHPBDZZ
?GetCurrentLogLevel@CNcsDebug@@QAEKXZ
?GetHKey@CNcsRegKey@@QAEPAUHKEY__@@XZ
?GetRegType@CNcsRegKey@@QAEKABVCNcsString@@@Z
?GetValue@CNcsRegKey@@QAE_NABVCNcsString@@AAK@Z
?GetValue@CNcsRegKey@@QAE_NABVCNcsString@@AAV2@@Z
?GetValue@CNcsRegKey@@QAE_NABVCNcsString@@AAV?$vector@VCNcsString@@V?$allocator@VCNcsString@@@std@@@std@@@Z
?GetValue@CNcsRegKey@@QAE_NABVCNcsString@@PAEAAK@Z
?Init@CNcsRegKey@@AAEXXZ
?IsAlphaChar@CNcsString@@AAE_ND@Z
?IsEmpty@CNcsString@@QBEHXZ
?IsNumericChar@CNcsString@@AAE_ND@Z
?IsStringType@CNcsString@@QAE_NK@Z
?IsSubStringValueInMultiString@CNcsRegKey@@QAE_NABVCNcsString@@0AAV2@@Z
?IsSymbolicChar@CNcsString@@AAE_ND@Z
?IsValueInMultiString@CNcsRegKey@@QAE_NABVCNcsString@@0@Z
?LastResult@CNcsRegKey@@QAEJXZ
?Length@CNcsString@@QBEIXZ
?LoadStringA@CNcsString@@AAEHPAUHINSTANCE__@@KW4LangRes@1@@Z
?LoadStringA@CNcsString@@QAEHPAUHINSTANCE__@@K@Z
?MakeLower@CNcsString@@QAEXXZ
?MakeUpper@CNcsString@@QAEXXZ
?Open@CNcsRegKey@@QAE_NPAUHKEY__@@ABVCNcsString@@_N@Z
?Print@CNcsDebug@@QAAXPBDZZ
?PrintLastError@CNcsDebug@@QAEXH@Z
?RemoveSubKey@CNcsRegKey@@AAEKPBD@Z
?RemoveValueFromMultiString@CNcsRegKey@@QAE_NABVCNcsString@@0@Z
?ResetEnumeration@CNcsRegKey@@QAEXXZ
?SetValue@CNcsRegKey@@QAE_NABVCNcsString@@AAV2@_N@Z
?SetValue@CNcsRegKey@@QAE_NABVCNcsString@@K@Z
?SetValue@CNcsRegKey@@QAE_NABVCNcsString@@PAEK@Z
?SetValue@CNcsRegKey@@QAE_NABVCNcsString@@V?$vector@VCNcsString@@V?$allocator@VCNcsString@@@std@@@std@@@Z
?SubKeyExists@CNcsRegKey@@QAE_NABVCNcsString@@@Z
?_Chassign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEXIID@Z
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEXII@Z
?_Copy_s@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPADIII@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEXI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAE_NI_N@Z
?_Inside@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAE_NPBD@Z
?_Myptr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEPADXZ
?_Myptr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IBEPBDXZ
?_Pdif@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@KAIV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEX_NI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD0@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD0@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0@Z
?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?capacity@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHABV12@@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIABV12@@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIABV12@II@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBD@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBDI@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHPBD@Z
?copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPADII@Z
?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@V32@0@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@V32@@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?get_allocator@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$allocator@D@2@XZ
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@V32@@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@V32@D@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IABV12@@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IABV12@II@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IID@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBD@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBDI@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@ID@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@PBD1@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@1@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?push_back@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXD@Z
?rbegin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$reverse_iterator@V?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@XZ
?rbegin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$reverse_iterator@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@XZ
?rend@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$reverse_iterator@V?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@XZ
?rend@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$reverse_iterator@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@XZ
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@II@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIID@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBDI@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0ABV12@@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0ID@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0PBD1@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0PBD@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0PBDI@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@1@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXID@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
GetCodePage

Sections

.text
Size: 172KB - Virtual size: 169KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1cf8918e6a4c764edfd01c61d89afbb7

Headers

File Characteristics

Imports

netinst

version

advapi32

kernel32

user32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 172KB - Virtual size: 169KB

.rdata Size: 48KB - Virtual size: 47KB

.data Size: 8KB - Virtual size: 15KB

.rsrc Size: 20KB - Virtual size: 17KB

.text
Size: 172KB - Virtual size: 169KB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 8KB - Virtual size: 15KB

.rsrc
Size: 20KB - Virtual size: 17KB