OfficeClickToRun[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

OfficeClickToRun.exe
Size

12.0MB
MD5

f38146d163c8048120fe6fcd12c19e2b
SHA1

df9b0690137a88c45ddb2eb305ad34ed0128a686
SHA256

255f6b73208c4c8702e11a77e961c1003cf8eb751ad78a6a16b06a1e29aac730
SHA512

fc82422cc0103c857db231dd47c1f0a310a4a865612d0208e2e0eca866691f4c21ef4ea837f693bd45da5506e61cd080390a76c57ed8d65c3ead772ff117bc46
SSDEEP

98304:KDx31HriiW9ai6YKlM4aotALvDCqET0ZpyUmA4Olo9Pt2:M11U6sewEcpNmvOOI

Score

N/A

Malware Config

Signatures

Files

OfficeClickToRun.exe
.exe windows x64

671e3d12dfb9a6a59be0e196141b6acc

Code Sign

33:00:00:04:90:0e:61:14:98:12:78:23:70:00:00:00:00:04:90
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/05/2022, 20:47

Not After

11/05/2023, 20:47

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:02:cf:a0:25:90:e3:13:04:ef:15:00:00:00:00:02:cf
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/05/2022, 20:46

Not After

11/05/2023, 20:46

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:09:0a:d7:07:f3:a3:3a:73:99:d4:54:7a:26:66:10:cc:d4:da:df:5f:56:90:3b:ab:1d:15:33:33:00:54:fa
Signer

Actual PE Digest

8c:09:0a:d7:07:f3:a3:3a:73:99:d4:54:7a:26:66:10:cc:d4:da:df:5f:56:90:3b:ab:1d:15:33:33:00:54:fa

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

15/12/2022, 13:55
Valid: false

8c:09:0a:d7:07:f3:a3:3a:73:99:d4:54:7a:26:66:10:cc:d4:da:df:5f:56:90:3b:ab:1d:15:33:33:00:54:fa
Signer

Actual PE Digest

8c:09:0a:d7:07:f3:a3:3a:73:99:d4:54:7a:26:66:10:cc:d4:da:df:5f:56:90:3b:ab:1d:15:33:33:00:54:fa

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

15/12/2022, 13:55
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus
CryptReleaseContext
CryptDestroyHash
CryptCreateHash
CryptAcquireContextW
RegEnumKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteTreeW
RegDeleteKeyW
RegGetValueW
RegDeleteValueW
GetTokenInformation
IsValidSid
GetSidSubAuthorityCount
GetSidSubAuthority
EventUnregister
EventRegister
EventWriteTransfer
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CreateWellKnownSid
CheckTokenMembership
CryptGetHashParam
GetFileSecurityW
SetFileSecurityW
RegNotifyChangeKeyValue
RevertToSelf
RegQueryValueW
OpenThreadToken
OpenProcessToken
GetLengthSid
CopySid
InitializeAcl
AddAccessAllowedAce
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidA
ConvertSidToStringSidW
EqualSid
EventWrite
CreateProcessAsUserW
RegCopyTreeW
ConvertStringSidToSidW
LookupAccountSidW
ImpersonateLoggedOnUser
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenSCManagerW
CloseServiceHandle
OpenServiceW
QueryServiceStatusEx
QueryServiceConfigW
StartServiceW
ControlService
EnumDependentServicesW
DeleteService
CreateServiceW
ChangeServiceConfig2W
ChangeServiceConfigW
SetServiceObjectSecurity
RegEnumValueA
RegDeleteValueA
RegGetValueA
CloseEventLog
OpenEventLogW
ReadEventLogW
RegOpenCurrentUser
RegRenameKey
RegSetKeySecurity
RegGetKeySecurity
RegRestoreKeyW
RegSaveKeyExW
EnableTraceEx
ProcessTrace
CloseTrace
OpenTraceW
StartTraceW
ControlTraceW
SetThreadToken
GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetTokenInformation
DuplicateToken
DuplicateTokenEx

gdi32

AddFontResourceW
DeleteObject
EnumFontFamiliesExW
CreateFontIndirectW
RemoveFontResourceW
GetFontData
GetDeviceCaps
SelectObject

iphlpapi

CreateSortedAddressPairs
GetAdaptersInfo
FreeMibTable

kernel32

WideCharToMultiByte
TlsGetValue
CreateIoCompletionPort
GlobalMemoryStatusEx
QueryPerformanceCounter
GetStdHandle
GetCurrentThreadId
GetFileType
FindFirstFileW
FindNextFileW
InitializeSRWLock
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
GetProcessTimes
GetTickCount64
TerminateProcess
GetModuleFileNameA
GetShortPathNameA
K32GetModuleFileNameExW
CreateProcessW
FindResourceW
SizeofResource
LoadResource
OpenProcess
CreateEventExW
OpenEventW
GetVersionExW
GetDiskFreeSpaceExW
GetWindowsDirectoryW
DeviceIoControl
SetErrorMode
GetComputerNameW
MulDiv
GetLogicalProcessorInformation
GetNativeSystemInfo
GetSystemDirectoryW
HeapFree
HeapAlloc
GetProcessHeap
GetUserDefaultLocaleName
IsValidCodePage
GetCPInfoExW
CreateMutexExW
OpenMutexW
WaitForSingleObjectEx
TzSpecificLocalTimeToSystemTime
FlsGetValue
FlsSetValue
CreateThread
WaitForMultipleObjectsEx
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
CreateThreadpoolWork
SubmitThreadpoolWork
ReleaseSemaphore
QueryDepthSList
TryEnterCriticalSection
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
RtlCaptureStackBackTrace
GetTempPathW
GetLongPathNameW
ResetEvent
IsDebuggerPresent
GetFileAttributesExW
GetFileSize
MoveFileExW
CreateDirectoryW
RemoveDirectoryW
SetFileAttributesW
SetFilePointerEx
SetEndOfFile
FlushFileBuffers
LockFileEx
UnlockFileEx
GetFileInformationByHandleEx
GetCurrentDirectoryW
GetTempFileNameW
CopyFileExW
GetVolumePathNamesForVolumeNameW
SetFileInformationByHandle
CreateFileMappingW
RtlLookupFunctionEntry
RtlVirtualUnwind
GetFileAttributesW
GetFileTime
ReplaceFileW
CopyFileW
GetShortPathNameW
QueryPerformanceFrequency
GlobalFree
LockResource
SetFileTime
CancelIoEx
GetProcessAffinityMask
CreateWaitableTimerW
SetWaitableTimerEx
CancelWaitableTimer
WerRegisterMemoryBlock
WerUnregisterMemoryBlock
QueryFullProcessImageNameW
GetThreadIOPendingFlag
GetCurrentThread
lstrlenW
GetStartupInfoW
CreateMemoryResourceNotification
GetSystemPowerStatus
IsSystemResumeAutomatic
QueryUnbiasedInterruptTime
SetProcessInformation
OutputDebugStringW
RtlCaptureContext
CreateMutexW
OpenEventA
CreateEventA
OpenMutexA
CreateMutexA
OpenSemaphoreA
CreateSemaphoreA
OpenFileMappingA
LocalAlloc
LCMapStringEx
GetFileAttributesA
LoadLibraryExA
LCIDToLocaleName
K32GetProcessMemoryInfo
GetPhysicallyInstalledSystemMemory
GetProductInfo
GetLocalTime
GetThreadLocale
DeleteFileA
GetTempPathA
lstrcmpW
FlushViewOfFile
GetFullPathNameW
GetPriorityClass
GetExitCodeProcess
K32EnumProcesses
ProcessIdToSessionId
GetTimeZoneInformation
GetVolumeInformationW
GetExitCodeThread
GetLocaleInfoEx
ResolveLocaleName
GetUserPreferredUILanguages
GetACP
GetSystemDefaultLCID
EnumSystemLocalesEx
GetSystemDefaultLocaleName
GetUserGeoID
GetGeoInfoW
GetUserDefaultUILanguage
AreFileApisANSI
HeapCreate
GetDiskFreeSpaceW
LockFile
InitializeCriticalSection
GetFullPathNameA
HeapValidate
HeapSize
GetDiskFreeSpaceA
HeapReAlloc
GetSystemInfo
HeapCompact
HeapDestroy
UnlockFile
K32GetModuleBaseNameW
lstrcmpiW
IsProcessorFeaturePresent
VirtualQuery
WerRegisterRuntimeExceptionModule
WerUnregisterRuntimeExceptionModule
TlsSetValue
PostQueuedCompletionStatus
WaitForSingleObject
GetQueuedCompletionStatus
GlobalAlloc
GetSystemTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
CreateFileMappingA
CloseHandle
CreateFileA
UnmapViewOfFile
FindClose
LocaleNameToLCID
ReleaseMutex
GetCurrentProcessId
GlobalAddAtomW
GlobalFindAtomW
CreateEventW
SetEvent
DeleteFileW
VirtualProtect
InitOnceBeginInitialize
InitOnceComplete
CreateSymbolicLinkW
CreateHardLinkW
GetFinalPathNameByHandleW
GetFileInformationByHandle
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DeleteTimerQueueTimer
CreateTimerQueueTimer
GetDriveTypeW
GetDateFormatW
GetTimeFormatW
SetCurrentDirectoryW
FileTimeToSystemTime
FormatMessageW
GetModuleHandleA
GetOverlappedResult
CreateFileW
SetFilePointer
WriteFile
GetFileSizeEx
ReadFile
FlsAlloc
FlsFree
GetTickCount
Sleep
OutputDebugStringA
QueryActCtxW
CreateActCtxW
FindActCtxSectionStringW
LoadLibraryW
ActivateActCtx
DeactivateActCtx
SetLastError
RaiseException
LocalFree
GetModuleFileNameW
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSectionEx
VerifyVersionInfoW
VerSetConditionMask
TlsFree
GetModuleHandleW
LoadLibraryExW
ExpandEnvironmentStringsW
IsWow64Process
FreeLibrary
GetProcAddress
CompareStringEx
GetLastError
GetModuleHandleExW
GetCurrentProcess
WaitForMultipleObjects
TlsAlloc
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
FormatMessageA
LoadLibraryA
GetStringTypeExW
MapViewOfFile
FindFirstFileExW

oleaut32

SysFreeString
UnRegisterTypeLi
LoadTypeLi
SetErrorInfo
VariantClear
GetErrorInfo
VariantInit
RegisterTypeLi
SysStringLen
SysAllocString

rpcrt4

RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcRevertToSelf
UuidToStringW
RpcStringFreeW
RpcBindingInqAuthClientW
RpcServerUnregisterIf
RpcMgmtStopServerListening
RpcServerRegisterAuthInfoW
UuidCreate
NdrServerCall2
RpcMgmtWaitServerListen
RpcServerListen
RpcImpersonateClient
RpcBindingSetAuthInfoW
RpcBindingFree
RpcMgmtIsServerListening
RpcServerRegisterIf2
RpcServerUseProtseqEpW

ws2_32

FreeAddrInfoW
GetAddrInfoW
WSACleanup
WSAStartup

rstrtmgr

RmEndSession
RmStartSession
RmAddFilter
RmRegisterResources
RmGetList
RmRestart
RmShutdown

cabinet

ord13
ord14

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust
WTHelperGetProvSignerFromChain

wtsapi32

WTSQueryUserToken
WTSFreeMemory
WTSSendMessageW
WTSEnumerateSessionsW
WTSQuerySessionInformationW

setupapi

SetupIterateCabinetW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp
memchr
__RTDynamicCast
__std_exception_destroy
__std_exception_copy
__std_terminate
_CxxThrowException
__C_specific_handler
_purecall
__std_type_info_compare
__RTtypeid
__std_type_info_name
strchr
strstr
wcsstr
memset
wcsrchr
wcschr
memcpy
memmove
__current_exception
__current_exception_context
__C_specific_handler_noexcept

msvcp140

?pubimbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?pubsync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
?pubseekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QEBA_JXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?getline@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEA_W_J@Z
?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Mbrtowc
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??Bid@locale@std@@QEAA_KXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?width@ios_base@std@@QEAA_J_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?flags@ios_base@std@@QEBAHXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?good@ios_base@std@@QEBA_NXZ
?uncaught_exception@std@@YA_NXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?width@ios_base@std@@QEBA_JXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?exceptions@ios_base@std@@QEAAXH@Z
?flags@ios_base@std@@QEAAHH@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
?precision@ios_base@std@@QEAA_J_J@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?widen@?$ctype@D@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?narrow@?$ctype@D@std@@QEBADDD@Z
?is@?$ctype@D@std@@QEBA_NFD@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_join
_Thrd_id
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
_Mtx_unlock
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
?classic@locale@std@@SAAEBV12@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??0id@locale@std@@QEAA@_K@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z
?bad@ios_base@std@@QEBA_NXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
??0task_continuation_context@Concurrency@@AEAA@XZ
?__ExceptionPtrCreate@@YAXPEAX@Z
_Cnd_init_in_situ
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrToBool@@YA_NPEBX@Z
_Mtx_destroy_in_situ
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
_Mtx_init_in_situ
_Cnd_wait
_Cnd_broadcast
_Cnd_destroy_in_situ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
?__ExceptionPtrCompare@@YA_NPEBX0@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEA_K@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?fail@ios_base@std@@QEBA_NXZ
?eof@ios_base@std@@QEBA_NXZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?id@?$ctype@_W@std@@2V0locale@2@A
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??Bios_base@std@@QEBA_NXZ
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_J@Z
_Query_perf_frequency
?_Random_device@std@@YAIXZ
_Query_perf_counter
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?toupper@?$ctype@_W@std@@QEBA_W_W@Z
_Xtime_get_ticks
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA_W_W@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?narrow@?$ctype@_W@std@@QEBAD_WD@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
_Thrd_sleep
?id@?$numpunct@_W@std@@2V0locale@2@A
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?setf@ios_base@std@@QEAAHH@Z
?setf@ios_base@std@@QEAAHHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
_Mtx_current_owns
_Cnd_timedwait
?_Xinvalid_argument@std@@YAXPEBD@Z
?id@?$collate@_W@std@@2V0locale@2@A
_Wcsxfrm
_Wcscoll
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@F@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
_Thrd_detach
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
?tellp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
_Thrd_yield
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
_Mtx_trylock
_Cnd_signal
?uncaught_exceptions@std@@YAHXZ
_Cnd_register_at_thread_exit
?_Throw_future_error@std@@YAXAEBVerror_code@1@@Z
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
_Cnd_unregister_at_thread_exit
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ

concrt140

?_Acquire@_ReentrantBlockingLock@details@Concurrency@@QEAAXXZ
??1_ReentrantBlockingLock@details@Concurrency@@QEAA@XZ
??0_ReentrantBlockingLock@details@Concurrency@@QEAA@XZ
?_Release@_ReentrantBlockingLock@details@Concurrency@@QEAAXXZ

api-ms-win-crt-heap-l1-1-0

realloc
calloc
malloc
_msize
free
_set_new_mode

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswscanf
_set_fmode
fwrite
__stdio_common_vsnwprintf_s
__p__commode
fputs
_wfopen_s
__stdio_common_vswprintf_s
__stdio_common_vsnprintf_s
__stdio_common_vsprintf
_get_stream_buffer_pointers
__stdio_common_vsprintf_s
fputc
__stdio_common_vswprintf
fputwc
ungetwc
ungetc
fgetc
fgetwc
fgetpos
__stdio_common_vsscanf
setvbuf
_fseeki64
fsetpos
fread
fgets
fclose
fflush

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
raise
_exit
_invalid_parameter_noinfo
_errno
_beginthreadex
strerror
terminate
abort
_endthreadex
_seh_filter_exe
_set_app_type
_clearfp
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_crt_atexit
_initialize_onexit_table
_register_onexit_function

api-ms-win-crt-string-l1-1-0

isalnum
wcsncpy_s
towlower
strncpy_s
wcscmp
_stricmp
towupper
iswspace
isupper
tolower
isalpha
isxdigit
isspace
wcscat_s
wcsncat_s
wcsncmp
strcmp
strncmp
_strnicmp
_towupper_l
wmemcpy_s
iswalpha
wcscpy_s
strnlen
wcsnlen
_isctype_l
_wcsicmp
_wcsnicmp
isdigit
wcstok_s
strcspn

api-ms-win-crt-convert-l1-1-0

_wtol
_ui64toa_s
_wtoi64
_ultow_s
wcstoll
_i64toa_s
_itow_s
_wcstod_l
wcstoull
_wtof
_wtoi
_ui64tow_s
wcstoul
_i64tow_s
strtol
wcstol
strtod
atoi
wcstod
strtoull
_wcstoui64
strtoll
_wcstoi64

api-ms-win-crt-locale-l1-1-0

_free_locale
_create_locale
__pctype_func
___lc_codepage_func
__initialize_lconv_for_unsigned_char
_configthreadlocale

api-ms-win-crt-time-l1-1-0

clock
wcsftime
_localtime64_s
_time64
_gmtime64_s
_mktime64
_difftime64

api-ms-win-crt-utility-l1-1-0

rand_s
qsort
srand
rand

api-ms-win-crt-math-l1-1-0

__setusermatherr
expf
_dsign
ceilf
pow
floor
log10
logf
round
_dclass

api-ms-win-crt-filesystem-l1-1-0

_unlock_file
_lock_file
_wsplitpath_s

netapi32

NetGetJoinInformation
NetApiBufferFree

ntdll

NtSetInformationKey

apiclient

?CompleteUpdateRegistration@@YAJV?$shared_ptr@VORpcClient@@@std@@@Z
?KillQueuedProcesses@@YAJV?$shared_ptr@VORpcClient@@@std@@@Z
?RestartKilledProcesses@@YAJV?$shared_ptr@VORpcClient@@@std@@@Z
?InvokeProcessKillerEx@@YAJV?$shared_ptr@VORpcClient@@@std@@HHHPEB_W1PEAK@Z
?InvokeProcessKiller@@YAJV?$shared_ptr@VORpcClient@@@std@@HHHPEB_WPEAK@Z
?GetClickToRunData@@YAJV?$shared_ptr@VORpcClient@@@std@@HPEB_WPEA_WK@Z
?PromptUser@@YAJV?$shared_ptr@VORpcClient@@@std@@KPEAKPEB_W@Z
?RaiseTaskErrorEvent3@@YAJV?$shared_ptr@VORpcClient@@@std@@KKKKPEB_W@Z
?RaiseTaskToastEvent@@YAJV?$shared_ptr@VORpcClient@@@std@@H@Z
?RaiseTaskDialogEvent@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W1@Z
?RaiseTaskProgressEvent@@YAJV?$shared_ptr@VORpcClient@@@std@@U_GUID@@K@Z
?GetServiceVersion@@YAJV?$shared_ptr@VORpcClient@@@std@@PEA_WK@Z
?GetProcessPoolProcessId@@YAJV?$shared_ptr@VORpcClient@@@std@@PEAK@Z
?QueueTaskItem@@YAJV?$shared_ptr@VORpcClient@@@std@@U_GUID@@@Z

Sections

.text
Size: 7.3MB - Virtual size: 7.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 298KB - Virtual size: 451KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 741KB - Virtual size: 741KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 186KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 189KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

671e3d12dfb9a6a59be0e196141b6acc

Code Sign

33:00:00:04:90:0e:61:14:98:12:78:23:70:00:00:00:00:04:90Certificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

33:00:00:02:cf:a0:25:90:e3:13:04:ef:15:00:00:00:00:02:cfCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

8c:09:0a:d7:07:f3:a3:3a:73:99:d4:54:7a:26:66:10:cc:d4:da:df:5f:56:90:3b:ab:1d:15:33:33:00:54:faSigner

Signature Validations

Verification

15/12/2022, 13:55 Valid: false

8c:09:0a:d7:07:f3:a3:3a:73:99:d4:54:7a:26:66:10:cc:d4:da:df:5f:56:90:3b:ab:1d:15:33:33:00:54:faSigner

Signature Validations

Verification

15/12/2022, 13:55 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

gdi32

iphlpapi

kernel32

oleaut32

rpcrt4

ws2_32

rstrtmgr

cabinet

wintrust

wtsapi32

setupapi

vcruntime140_1

vcruntime140

msvcp140

concrt140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

netapi32

ntdll

apiclient

Sections

.text Size: 7.3MB - Virtual size: 7.3MB

.rdata Size: 3.2MB - Virtual size: 3.2MB

.data Size: 298KB - Virtual size: 451KB

.pdata Size: 741KB - Virtual size: 741KB

.didat Size: 2KB - Virtual size: 2KB

.rsrc Size: 186KB - Virtual size: 185KB

.reloc Size: 189KB - Virtual size: 188KB

33:00:00:04:90:0e:61:14:98:12:78:23:70:00:00:00:00:04:90
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

33:00:00:02:cf:a0:25:90:e3:13:04:ef:15:00:00:00:00:02:cf
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

8c:09:0a:d7:07:f3:a3:3a:73:99:d4:54:7a:26:66:10:cc:d4:da:df:5f:56:90:3b:ab:1d:15:33:33:00:54:fa
Signer

15/12/2022, 13:55
Valid: false

8c:09:0a:d7:07:f3:a3:3a:73:99:d4:54:7a:26:66:10:cc:d4:da:df:5f:56:90:3b:ab:1d:15:33:33:00:54:fa
Signer

15/12/2022, 13:55
Valid: false

.text
Size: 7.3MB - Virtual size: 7.3MB

.rdata
Size: 3.2MB - Virtual size: 3.2MB

.data
Size: 298KB - Virtual size: 451KB

.pdata
Size: 741KB - Virtual size: 741KB

.didat
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 186KB - Virtual size: 185KB

.reloc
Size: 189KB - Virtual size: 188KB