f9da16d920080421c9a96cd3cc2d38bab17efa307ef2dba31a0c84839dd21d06

Sharing

Copy URL Twitter E-mail

General

Target

f9da16d920080421c9a96cd3cc2d38bab17efa307ef2dba31a0c84839dd21d06
Size

828KB
MD5

1cf216212392ce21533974da8a475a67
SHA1

ebe2af7b36a53da174a3f92f1f4a7fa0da4b05ad
SHA256

f9da16d920080421c9a96cd3cc2d38bab17efa307ef2dba31a0c84839dd21d06
SHA512

bd20bb9e8b3a9d4b39b747b76b406000d142979cf510454e574d61c3335b8b6fad894ddd8654677e96eb835a742e01d910831c7ff6f87cdabf625b51843d7d31
SSDEEP

12288:lvtVeio34r6FbiCgVxpKk1+quPCdQ1py1DuQUAjGzhhluIg8NZftyWhsIGuT47xJ:FfoIuFbiCgVxpKk1Mqd+s1DU

Score

N/A

Malware Config

Signatures

Files

f9da16d920080421c9a96cd3cc2d38bab17efa307ef2dba31a0c84839dd21d06
.dll windows x86

0f891695e6b16e2d68e5f81c6790b88e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
GetModuleFileNameA
TerminateProcess
InterlockedCompareExchange
InterlockedExchange

output

?super@@YA?AU?$COutputManip1Para@ABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@@ABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
??6COutput@@QAEAAV0@ABVCReal@@@Z
??6COutput@@QAEAAV0@ABU?$COutputManip1Para@ABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@@@Z
?sub@@YA?AU?$COutputManip1Para@ABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@@ABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?endl@@YAAAVCOutput@@AAV1@@Z
?strwidth@@YA?AU?$COutputManip1Para@H@@H@Z
??6COutput@@QAEAAV0@ABU?$COutputManip1Para@H@@@Z
??6COutput@@QAEAAV0@ABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
??6COutput@@QAEAAV0@P6AAAV0@AAV0@@Z@Z

common

?SetQuery@CMtsRecordset@@UAEXPBD@Z
?SetFieldType@CMtsFieldExchange@@QAEXI@Z
?DFX_Text@CMtsFieldExchange@@SAXPAV1@PBDAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?DFX_Single@CMtsFieldExchange@@SAXPAV1@PBDAAM@Z
?DFX_Double@CMtsFieldExchange@@SAXPAV1@PBDAAN@Z
?MoveFirst@CMtsRecordset@@QAEXXZ
?IsEOF@CMtsRecordset@@QBEHXZ
?MoveNext@CMtsRecordset@@QAEXXZ
?RFX_Long@CMtsFieldExchange@@SAXPAV1@PBDAAJ@Z
?RFX_Text@CMtsFieldExchange@@SAXPAV1@PBDAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?RFX_Single@CMtsFieldExchange@@SAXPAV1@PBDAAM@Z
?RFX_Double@CMtsFieldExchange@@SAXPAV1@PBDAAN@Z
??1CMtsRecordset@@UAE@XZ
?GetRuntimeClass@CMtsRecordset@@UBEPAUCRuntimeClass@@XZ
?Open@CMtsRecordset@@UAEHHPBDH@Z
?Open@CMtsRecordset@@UAEHPBD@Z
?Close@CMtsRecordset@@UAEXXZ
?AddNew@CMtsRecordset@@UAEXXZ
?Edit@CMtsRecordset@@UAEXXZ
?Update@CMtsRecordset@@UAEHXZ
?Delete@CMtsRecordset@@UAEXXZ
?Requery@CMtsRecordset@@UAEHXZ
?GetErrorMessage@CMtsRecordset@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
??0CMtsRecordset@@QAE@PAVCMtsDatabase@@@Z
?SetTableName@CMtsRecordset@@UAEXPBD@Z
?GetDefaultSQL@CMtsRecordset@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?DoFieldExchange@CMtsRecordset@@UAEXPAVCMtsFieldExchange@@@Z
?GetFieldValue@CMtsRecordset@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@H@Z
?GetFieldName@CMtsRecordset@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@H@Z
?GetFieldType@CMtsRecordset@@UAEHH@Z

mfc90

ord1137
ord391
ord1152
ord1241
ord820
ord2481
ord5997
ord3213
ord305
ord1611
ord1252
ord5835
ord5963
ord4392
ord300
ord1603
ord316
ord310
ord817
ord601
ord798
ord800
ord1254
ord6494
ord6154
ord6153
ord2539
ord266
ord819
ord265
ord2691
ord3856

msvcr90

??0exception@std@@QAE@XZ
__clean_type_info_names_internal
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__CppXcptFilter
_adjust_fdiv
free
_amsg_exit
_initterm_e
_initterm
_purecall
__CxxFrameHandler3
_invalid_parameter_noinfo
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
_encoded_null
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
atoi
memcpy_s
memset
atof
_CIsqrt
_CItan
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_malloc_crt

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?push_back@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

oleaut32

SysFreeString

Exports

Exports

??0CAmeC_ELSE_RS@@QAE@PAVCMtsDatabase@@@Z
??0CAmeC_RS@@QAE@PAVCMtsDatabase@@@Z
??0CAmeEX_RS@@QAE@PAVCMtsDatabase@@@Z
??0CAmeI_HP_RS@@QAE@PAVCMtsDatabase@@@Z
??0CAmeI_M_RS@@QAE@PAVCMtsDatabase@@@Z
??0CAmeI_S_RS@@QAE@PAVCMtsDatabase@@@Z
??0CAmeI_W_RS@@QAE@PAVCMtsDatabase@@@Z
??0CAmeL_RS@@QAE@PAVCMtsDatabase@@@Z
??0CAmeP_RS@@QAE@PAVCMtsDatabase@@@Z
??0CAmeT_M_RS@@QAE@PAVCMtsDatabase@@@Z
??0CAmeT_S_RS@@QAE@PAVCMtsDatabase@@@Z
??0CAmeT_W_RS@@QAE@PAVCMtsDatabase@@@Z
??0CAmeX_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsC_BJG_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsC_B_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsC_DB_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsC_EBGB_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsC_EBJG_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsC_EB_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsC_IB_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsC_OB_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsC_RLg_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsC_R_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsC_W_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsDamper_MildSt_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsEL_R_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsER_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsEX_B_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsEX_SB_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsH_CDGP_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsH_LR_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsH_MR_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsH_RLg_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsH_R_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsH_SR_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsH_TDGP_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsH_TR_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsH_WHB_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsH_W_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsH_ZH_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsH_Z_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsI_RLg_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsI_R_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsI_W_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsL_BE_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsL_CFDA_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsL_CFEA_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsL_D_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsL_EBG_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsL_EB_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsL_EG_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsL_E_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsL_R_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsO_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsP_B_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsP_CFB_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsP_CS_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsP_R_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsP_W_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsS_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsT_MH_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsT_NH_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsT_WH_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsX_B_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsX_RB_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsZ_C_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsZ_JG_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsZ_RS@@QAE@PAVCMtsDatabase@@@Z
??0CChsZ_Z_RS@@QAE@PAVCMtsDatabase@@@Z
??0CDBData@@QAE@ABV0@@Z
??0CDBData@@QAE@XZ
??0CDefine_C_RS@@QAE@PAVCMtsDatabase@@@Z
??0CDefine_G_RS@@QAE@PAVCMtsDatabase@@@Z
??0CDefine_Z_RS@@QAE@PAVCMtsDatabase@@@Z
??0CEngC_RS@@QAE@PAVCMtsDatabase@@@Z
??0CEngEL_RS@@QAE@PAVCMtsDatabase@@@Z
??0CEngH_Co_RS@@QAE@PAVCMtsDatabase@@@Z
??0CEngH_RS@@QAE@PAVCMtsDatabase@@@Z
??0CEngI_5_RS@@QAE@PAVCMtsDatabase@@@Z
??0CEngI_RS@@QAE@PAVCMtsDatabase@@@Z
??0CEngL_RS@@QAE@PAVCMtsDatabase@@@Z
??0CEngT_H_RS@@QAE@PAVCMtsDatabase@@@Z
??0CEngT_I_RS@@QAE@PAVCMtsDatabase@@@Z
??0CJpnEL_RS@@QAE@PAVCMtsDatabase@@@Z
??0CJpnEX_Co_RS@@QAE@PAVCMtsDatabase@@@Z
??0CJpnEX_L_RS@@QAE@PAVCMtsDatabase@@@Z
??0CJpnEX_RS@@QAE@PAVCMtsDatabase@@@Z
??0CJpnH_RS@@QAE@PAVCMtsDatabase@@@Z
??0CJpnI_RS@@QAE@PAVCMtsDatabase@@@Z
??0CJpnL_RS@@QAE@PAVCMtsDatabase@@@Z
??0CJpnNL_RS@@QAE@PAVCMtsDatabase@@@Z
??0CJpnP_C_RS@@QAE@PAVCMtsDatabase@@@Z
??0CJpnP_T_RS@@QAE@PAVCMtsDatabase@@@Z
??0CJpnT_RS@@QAE@PAVCMtsDatabase@@@Z
??0CJpnX_Co_RS@@QAE@PAVCMtsDatabase@@@Z
??0CJpnX_RS@@QAE@PAVCMtsDatabase@@@Z
??0CLysaght_C_RS@@QAE@PAVCMtsDatabase@@@Z
??0CLysaght_Z_RS@@QAE@PAVCMtsDatabase@@@Z
??0CSecData@@QAE@ABV0@@Z
??0CSecData@@QAE@XZ
??1CAmeC_ELSE_RS@@UAE@XZ
??1CAmeC_RS@@UAE@XZ
??1CAmeEX_RS@@UAE@XZ
??1CAmeI_HP_RS@@UAE@XZ
??1CAmeI_M_RS@@UAE@XZ
??1CAmeI_S_RS@@UAE@XZ
??1CAmeI_W_RS@@UAE@XZ
??1CAmeL_RS@@UAE@XZ
??1CAmeP_RS@@UAE@XZ
??1CAmeT_M_RS@@UAE@XZ
??1CAmeT_S_RS@@UAE@XZ
??1CAmeT_W_RS@@UAE@XZ
??1CAmeX_RS@@UAE@XZ
??1CChsC_BJG_RS@@UAE@XZ
??1CChsC_B_RS@@UAE@XZ
??1CChsC_DB_RS@@UAE@XZ
??1CChsC_EBGB_RS@@UAE@XZ
??1CChsC_EBJG_RS@@UAE@XZ
??1CChsC_EB_RS@@UAE@XZ
??1CChsC_IB_RS@@UAE@XZ
??1CChsC_OB_RS@@UAE@XZ
??1CChsC_RLg_RS@@UAE@XZ
??1CChsC_R_RS@@UAE@XZ
??1CChsC_W_RS@@UAE@XZ
??1CChsDamper_MildSt_RS@@UAE@XZ
??1CChsEL_R_RS@@UAE@XZ
??1CChsER_RS@@UAE@XZ
??1CChsEX_B_RS@@UAE@XZ
??1CChsEX_SB_RS@@UAE@XZ
??1CChsH_CDGP_RS@@UAE@XZ
??1CChsH_LR_RS@@UAE@XZ
??1CChsH_MR_RS@@UAE@XZ
??1CChsH_RLg_RS@@UAE@XZ
??1CChsH_R_RS@@UAE@XZ
??1CChsH_SR_RS@@UAE@XZ
??1CChsH_TDGP_RS@@UAE@XZ
??1CChsH_TR_RS@@UAE@XZ
??1CChsH_WHB_RS@@UAE@XZ
??1CChsH_W_RS@@UAE@XZ
??1CChsH_ZH_RS@@UAE@XZ
??1CChsH_Z_RS@@UAE@XZ
??1CChsI_RLg_RS@@UAE@XZ
??1CChsI_R_RS@@UAE@XZ
??1CChsI_W_RS@@UAE@XZ
??1CChsL_BE_RS@@UAE@XZ
??1CChsL_CFDA_RS@@UAE@XZ
??1CChsL_CFEA_RS@@UAE@XZ
??1CChsL_D_RS@@UAE@XZ
??1CChsL_EBG_RS@@UAE@XZ
??1CChsL_EB_RS@@UAE@XZ
??1CChsL_EG_RS@@UAE@XZ
??1CChsL_E_RS@@UAE@XZ
??1CChsL_R_RS@@UAE@XZ
??1CChsO_RS@@UAE@XZ
??1CChsP_B_RS@@UAE@XZ
??1CChsP_CFB_RS@@UAE@XZ
??1CChsP_CS_RS@@UAE@XZ
??1CChsP_R_RS@@UAE@XZ
??1CChsP_W_RS@@UAE@XZ
??1CChsS_RS@@UAE@XZ
??1CChsT_MH_RS@@UAE@XZ
??1CChsT_NH_RS@@UAE@XZ
??1CChsT_WH_RS@@UAE@XZ
??1CChsX_B_RS@@UAE@XZ
??1CChsX_RB_RS@@UAE@XZ
??1CChsZ_C_RS@@UAE@XZ
??1CChsZ_JG_RS@@UAE@XZ
??1CChsZ_RS@@UAE@XZ
??1CChsZ_Z_RS@@UAE@XZ
??1CDBData@@QAE@XZ
??1CDefine_C_RS@@UAE@XZ
??1CDefine_G_RS@@UAE@XZ
??1CDefine_Z_RS@@UAE@XZ
??1CEngC_RS@@UAE@XZ
??1CEngEL_RS@@UAE@XZ
??1CEngH_Co_RS@@UAE@XZ
??1CEngH_RS@@UAE@XZ
??1CEngI_5_RS@@UAE@XZ
??1CEngI_RS@@UAE@XZ
??1CEngL_RS@@UAE@XZ
??1CEngT_H_RS@@UAE@XZ
??1CEngT_I_RS@@UAE@XZ
??1CJpnEL_RS@@UAE@XZ
??1CJpnEX_Co_RS@@UAE@XZ
??1CJpnEX_L_RS@@UAE@XZ
??1CJpnEX_RS@@UAE@XZ
??1CJpnH_RS@@UAE@XZ
??1CJpnI_RS@@UAE@XZ
??1CJpnL_RS@@UAE@XZ
??1CJpnNL_RS@@UAE@XZ
??1CJpnP_C_RS@@UAE@XZ
??1CJpnP_T_RS@@UAE@XZ
??1CJpnT_RS@@UAE@XZ
??1CJpnX_Co_RS@@UAE@XZ
??1CJpnX_RS@@UAE@XZ
??1CLysaght_C_RS@@UAE@XZ
??1CLysaght_Z_RS@@UAE@XZ
??1CSecData@@QAE@XZ
??4CDBData@@QAEAAV0@ABV0@@Z
??4CSecData@@QAEAAV0@ABV0@@Z
??8CDBData@@QBE_NABV0@@Z
??8CSecData@@QBE_NABV0@@Z
??9CDBData@@QBE_NABV0@@Z
??9CSecData@@QBE_NABV0@@Z
??ACSecData@@QAEAAVCReal@@H@Z
??ACSecData@@QBEABVCReal@@H@Z
??_7CAmeC_ELSE_RS@@6B@
??_7CAmeC_RS@@6B@
??_7CAmeEX_RS@@6B@
??_7CAmeI_HP_RS@@6B@
??_7CAmeI_M_RS@@6B@
??_7CAmeI_S_RS@@6B@
??_7CAmeI_W_RS@@6B@
??_7CAmeL_RS@@6B@
??_7CAmeP_RS@@6B@
??_7CAmeT_M_RS@@6B@
??_7CAmeT_S_RS@@6B@
??_7CAmeT_W_RS@@6B@
??_7CAmeX_RS@@6B@
??_7CChsC_BJG_RS@@6B@
??_7CChsC_B_RS@@6B@
??_7CChsC_DB_RS@@6B@
??_7CChsC_EBGB_RS@@6B@
??_7CChsC_EBJG_RS@@6B@
??_7CChsC_EB_RS@@6B@
??_7CChsC_IB_RS@@6B@
??_7CChsC_OB_RS@@6B@
??_7CChsC_RLg_RS@@6B@
??_7CChsC_R_RS@@6B@
??_7CChsC_W_RS@@6B@
??_7CChsDamper_MildSt_RS@@6B@
??_7CChsEL_R_RS@@6B@
??_7CChsER_RS@@6B@
??_7CChsEX_B_RS@@6B@
??_7CChsEX_SB_RS@@6B@
??_7CChsH_CDGP_RS@@6B@
??_7CChsH_LR_RS@@6B@
??_7CChsH_MR_RS@@6B@
??_7CChsH_RLg_RS@@6B@
??_7CChsH_R_RS@@6B@
??_7CChsH_SR_RS@@6B@
??_7CChsH_TDGP_RS@@6B@
??_7CChsH_TR_RS@@6B@
??_7CChsH_WHB_RS@@6B@
??_7CChsH_W_RS@@6B@
??_7CChsH_ZH_RS@@6B@
??_7CChsH_Z_RS@@6B@
??_7CChsI_RLg_RS@@6B@
??_7CChsI_R_RS@@6B@
??_7CChsI_W_RS@@6B@
??_7CChsL_BE_RS@@6B@
??_7CChsL_CFDA_RS@@6B@
??_7CChsL_CFEA_RS@@6B@
??_7CChsL_D_RS@@6B@
??_7CChsL_EBG_RS@@6B@
??_7CChsL_EB_RS@@6B@
??_7CChsL_EG_RS@@6B@
??_7CChsL_E_RS@@6B@
??_7CChsL_R_RS@@6B@
??_7CChsO_RS@@6B@
??_7CChsP_B_RS@@6B@
??_7CChsP_CFB_RS@@6B@
??_7CChsP_CS_RS@@6B@
??_7CChsP_R_RS@@6B@
??_7CChsP_W_RS@@6B@
??_7CChsS_RS@@6B@
??_7CChsT_MH_RS@@6B@
??_7CChsT_NH_RS@@6B@
??_7CChsT_WH_RS@@6B@
??_7CChsX_B_RS@@6B@
??_7CChsX_RB_RS@@6B@
??_7CChsZ_C_RS@@6B@
??_7CChsZ_JG_RS@@6B@
??_7CChsZ_RS@@6B@
??_7CChsZ_Z_RS@@6B@
??_7CDefine_C_RS@@6B@
??_7CDefine_G_RS@@6B@
??_7CDefine_Z_RS@@6B@
??_7CEngC_RS@@6B@
??_7CEngEL_RS@@6B@
??_7CEngH_Co_RS@@6B@
??_7CEngH_RS@@6B@
??_7CEngI_5_RS@@6B@
??_7CEngI_RS@@6B@
??_7CEngL_RS@@6B@
??_7CEngT_H_RS@@6B@
??_7CEngT_I_RS@@6B@
??_7CJpnEL_RS@@6B@
??_7CJpnEX_Co_RS@@6B@
??_7CJpnEX_L_RS@@6B@
??_7CJpnEX_RS@@6B@
??_7CJpnH_RS@@6B@
??_7CJpnI_RS@@6B@
??_7CJpnL_RS@@6B@
??_7CJpnNL_RS@@6B@
??_7CJpnP_C_RS@@6B@
??_7CJpnP_T_RS@@6B@
??_7CJpnT_RS@@6B@
??_7CJpnX_Co_RS@@6B@
??_7CJpnX_RS@@6B@
??_7CLysaght_C_RS@@6B@
??_7CLysaght_Z_RS@@6B@
??_FCAmeC_ELSE_RS@@QAEXXZ
??_FCAmeC_RS@@QAEXXZ
??_FCAmeEX_RS@@QAEXXZ
??_FCAmeI_HP_RS@@QAEXXZ
??_FCAmeI_M_RS@@QAEXXZ
??_FCAmeI_S_RS@@QAEXXZ
??_FCAmeI_W_RS@@QAEXXZ
??_FCAmeL_RS@@QAEXXZ
??_FCAmeP_RS@@QAEXXZ
??_FCAmeT_M_RS@@QAEXXZ
??_FCAmeT_S_RS@@QAEXXZ
??_FCAmeT_W_RS@@QAEXXZ
??_FCAmeX_RS@@QAEXXZ
??_FCChsC_BJG_RS@@QAEXXZ
??_FCChsC_B_RS@@QAEXXZ
??_FCChsC_DB_RS@@QAEXXZ
??_FCChsC_EBGB_RS@@QAEXXZ
??_FCChsC_EBJG_RS@@QAEXXZ
??_FCChsC_EB_RS@@QAEXXZ
??_FCChsC_IB_RS@@QAEXXZ
??_FCChsC_OB_RS@@QAEXXZ
??_FCChsC_RLg_RS@@QAEXXZ
??_FCChsC_R_RS@@QAEXXZ
??_FCChsC_W_RS@@QAEXXZ
??_FCChsDamper_MildSt_RS@@QAEXXZ
??_FCChsEL_R_RS@@QAEXXZ
??_FCChsER_RS@@QAEXXZ
??_FCChsEX_B_RS@@QAEXXZ
??_FCChsEX_SB_RS@@QAEXXZ
??_FCChsH_CDGP_RS@@QAEXXZ
??_FCChsH_LR_RS@@QAEXXZ
??_FCChsH_MR_RS@@QAEXXZ
??_FCChsH_RLg_RS@@QAEXXZ
??_FCChsH_R_RS@@QAEXXZ
??_FCChsH_SR_RS@@QAEXXZ
??_FCChsH_TDGP_RS@@QAEXXZ
??_FCChsH_TR_RS@@QAEXXZ
??_FCChsH_WHB_RS@@QAEXXZ
??_FCChsH_W_RS@@QAEXXZ
??_FCChsH_ZH_RS@@QAEXXZ
??_FCChsH_Z_RS@@QAEXXZ
??_FCChsI_RLg_RS@@QAEXXZ
??_FCChsI_R_RS@@QAEXXZ
??_FCChsI_W_RS@@QAEXXZ
??_FCChsL_BE_RS@@QAEXXZ
??_FCChsL_CFDA_RS@@QAEXXZ
??_FCChsL_CFEA_RS@@QAEXXZ
??_FCChsL_D_RS@@QAEXXZ
??_FCChsL_EBG_RS@@QAEXXZ
??_FCChsL_EB_RS@@QAEXXZ
??_FCChsL_EG_RS@@QAEXXZ
??_FCChsL_E_RS@@QAEXXZ
??_FCChsL_R_RS@@QAEXXZ
??_FCChsO_RS@@QAEXXZ
??_FCChsP_B_RS@@QAEXXZ
??_FCChsP_CFB_RS@@QAEXXZ
??_FCChsP_CS_RS@@QAEXXZ
??_FCChsP_R_RS@@QAEXXZ
??_FCChsP_W_RS@@QAEXXZ
??_FCChsS_RS@@QAEXXZ
??_FCChsT_MH_RS@@QAEXXZ
??_FCChsT_NH_RS@@QAEXXZ
??_FCChsT_WH_RS@@QAEXXZ
??_FCChsX_B_RS@@QAEXXZ
??_FCChsX_RB_RS@@QAEXXZ
??_FCChsZ_C_RS@@QAEXXZ
??_FCChsZ_JG_RS@@QAEXXZ
??_FCChsZ_RS@@QAEXXZ
??_FCChsZ_Z_RS@@QAEXXZ
??_FCDefine_C_RS@@QAEXXZ
??_FCDefine_G_RS@@QAEXXZ
??_FCDefine_Z_RS@@QAEXXZ
??_FCEngC_RS@@QAEXXZ
??_FCEngEL_RS@@QAEXXZ
??_FCEngH_Co_RS@@QAEXXZ
??_FCEngH_RS@@QAEXXZ
??_FCEngI_5_RS@@QAEXXZ
??_FCEngI_RS@@QAEXXZ
??_FCEngL_RS@@QAEXXZ
??_FCEngT_H_RS@@QAEXXZ
??_FCEngT_I_RS@@QAEXXZ
??_FCJpnEL_RS@@QAEXXZ
??_FCJpnEX_Co_RS@@QAEXXZ
??_FCJpnEX_L_RS@@QAEXXZ
??_FCJpnEX_RS@@QAEXXZ
??_FCJpnH_RS@@QAEXXZ
??_FCJpnI_RS@@QAEXXZ
??_FCJpnL_RS@@QAEXXZ
??_FCJpnNL_RS@@QAEXXZ
??_FCJpnP_C_RS@@QAEXXZ
??_FCJpnP_T_RS@@QAEXXZ
??_FCJpnT_RS@@QAEXXZ
??_FCJpnX_Co_RS@@QAEXXZ
??_FCJpnX_RS@@QAEXXZ
??_FCLysaght_C_RS@@QAEXXZ
??_FCLysaght_Z_RS@@QAEXXZ
?ClearData@CSecData@@QAEXXZ
?DoFieldExchange@CAmeC_ELSE_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CAmeC_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CAmeEX_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CAmeI_HP_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CAmeI_M_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CAmeI_S_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CAmeI_W_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CAmeL_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CAmeP_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CAmeT_M_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CAmeT_S_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CAmeT_W_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CAmeX_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsC_BJG_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsC_B_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsC_DB_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsC_EBGB_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsC_EBJG_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsC_EB_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsC_IB_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsC_OB_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsC_RLg_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsC_R_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsC_W_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsDamper_MildSt_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsEL_R_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsER_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsEX_B_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsEX_SB_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsH_CDGP_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsH_LR_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsH_MR_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsH_RLg_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsH_R_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsH_SR_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsH_TDGP_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsH_TR_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsH_WHB_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsH_W_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsH_ZH_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsH_Z_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsI_RLg_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsI_R_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsI_W_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsL_BE_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsL_CFDA_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsL_CFEA_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsL_D_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsL_EBG_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsL_EB_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsL_EG_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsL_E_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsL_R_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsO_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsP_B_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsP_CFB_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsP_CS_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsP_R_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsP_W_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsS_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsT_MH_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsT_NH_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsT_WH_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsX_B_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsX_RB_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsZ_C_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsZ_JG_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsZ_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CChsZ_Z_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CDefine_C_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CDefine_G_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CDefine_Z_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CEngC_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CEngEL_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CEngH_Co_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CEngH_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CEngI_5_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CEngI_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CEngL_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CEngT_H_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CEngT_I_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CJpnEL_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CJpnEX_Co_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CJpnEX_L_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CJpnEX_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CJpnH_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CJpnI_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CJpnL_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CJpnNL_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CJpnP_C_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CJpnP_T_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CJpnT_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CJpnX_Co_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CJpnX_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CLysaght_C_RS@@UAEXPAVCMtsFieldExchange@@@Z
?DoFieldExchange@CLysaght_Z_RS@@UAEXPAVCMtsFieldExchange@@@Z
?FindType@CDBData@@QBE_NH@Z
?FindType@CSecData@@QBE_NH@Z
?Get@CAmeC_ELSE_RS@@UBEXAAHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAJ1@Z
?Get@CAmeC_RS@@UBEXAAHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAJ1@Z
?Get@CAmeEX_RS@@UBEXAAHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAJ1@Z

Sections

.text
Size: 488KB - Virtual size: 487KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 282KB - Virtual size: 282KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0f891695e6b16e2d68e5f81c6790b88e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

output

common

mfc90

msvcr90

msvcp90

oleaut32

Exports

Exports

Sections

.text Size: 488KB - Virtual size: 487KB

.rdata Size: 282KB - Virtual size: 282KB

.data Size: 8KB - Virtual size: 8KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 47KB - Virtual size: 46KB

.text
Size: 488KB - Virtual size: 487KB

.rdata
Size: 282KB - Virtual size: 282KB

.data
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 47KB - Virtual size: 46KB