164d623a5a6a1b38403e36008c2ef4f6de2d2841e6a88815670fbd89edeadd5c

Sharing

Copy URL Twitter E-mail

General

Target

164d623a5a6a1b38403e36008c2ef4f6de2d2841e6a88815670fbd89edeadd5c
Size

1.8MB
MD5

c8b0b8dd43000df1d461639feb70ae41
SHA1

c0c3cd866817fc39c41bde0dddcb976263fbdbed
SHA256

164d623a5a6a1b38403e36008c2ef4f6de2d2841e6a88815670fbd89edeadd5c
SHA512

23c49f63d655653ccf9895a533b3d570f7688a0431a8ee440eeb9df921aafd51d5359e6febf0ac4f8e5d3834ce9658091791580656b80a804051dcb529d17d2b
SSDEEP

49152:1sjxBrEi/YW4ocuJ5txUJGWSEmrxlbTT1z6F/iiDJ:1sjxBrEMYW4ocuPbr1A6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
164d623a5a6a1b38403e36008c2ef4f6de2d2841e6a88815670fbd89edeadd5c

Files

164d623a5a6a1b38403e36008c2ef4f6de2d2841e6a88815670fbd89edeadd5c
.exe windows:5 windows x86

bb63f430314ffea0ccc724724b66a8e8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteCriticalSection
GetProcessHeap
GetModuleFileNameW
GetCurrentThreadId
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
SetUnhandledExceptionFilter
VerSetConditionMask
VerifyVersionInfoW
GetVersionExW
GetNativeSystemInfo
GetModuleHandleW
CreateMutexW
GetSystemTimeAsFileTime
GetComputerNameW
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceW
GetTempPathW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
FormatMessageW
LocalFree
Process32FirstW
Process32NextW
OpenProcess
CreateToolhelp32Snapshot
WaitForSingleObject
CreateEventW
SetEvent
ResetEvent
SetWaitableTimer
ReleaseMutex
GetExitCodeThread
SetLastError
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
GetExitCodeProcess
TerminateProcess
CreateProcessW
GetCommandLineW
FindResourceExW
GetUserDefaultUILanguage
CreateDirectoryW
RemoveDirectoryW
UnlockFile
LockFile
QueryPerformanceCounter
MulDiv
lstrlenW
CompareStringW
GlobalReAlloc
lstrcmpiW
LoadLibraryExW
Sleep
lstrcmpW
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
DecodePointer
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
ReadConsoleW
EnumSystemLocalesW
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleMode
GetConsoleCP
ExitProcess
QueryPerformanceFrequency
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
SetConsoleCtrlHandler
RtlUnwind
GetUserDefaultLCID
GetStringTypeExW
LoadLibraryA
GetFileType
GetStdHandle
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
OutputDebugStringW
SystemTimeToFileTime
CreateWaitableTimerA
OpenEventA
CreateEventA
WaitForMultipleObjectsEx
FormatMessageA
AreFileApisANSI
DeviceIoControl
SetFilePointerEx
SetEndOfFile
GetEnvironmentVariableW
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
UnhandledExceptionFilter
InitializeSListHead
WaitForSingleObjectEx
GetCPInfo
GetLocaleInfoW
LCMapStringW
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
GetStringTypeW
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
HeapFree
MultiByteToWideChar
GetACP
WideCharToMultiByte
ReadFile
FindClose
HeapDestroy
FindNextFileW
FindFirstFileW
WriteFile
SetFilePointer
FlushFileBuffers
GetFileSize
GetFileAttributesW
MoveFileW
GetLocalTime
GetCurrentProcessId
GetModuleHandleA
LoadLibraryW
GetLastError
SetErrorMode
FreeLibrary
CreateFileW
DeleteFileW
CloseHandle
GetTickCount
GetProcAddress
GetCommandLineA

user32

IsChild
UnregisterClassW
RegisterWindowMessageW
GetClassNameW
RedrawWindow
GetMessageW
TranslateMessage
DispatchMessageW
SystemParametersInfoW
GetSysColor
GetSystemMetrics
ShowWindow
SetForegroundWindow
IsWindow
GetActiveWindow
WaitForInputIdle
MessageBoxW
SendMessageW
GetDC
ReleaseDC
SetWindowLongW
GetWindowLongW
DefWindowProcW
CallWindowProcW
LoadStringW
OffsetRect
UnionRect
SetWindowTextW
InvalidateRect
BeginPaint
EndPaint
GetClientRect
PtInRect
ScreenToClient
GetFocus
DrawFocusRect
ClientToScreen
GetParent
LoadImageW
FillRect
GetSysColorBrush
SetCapture
GetWindowTextW
CreateAcceleratorTableW
InvalidateRgn
GetDesktopWindow
DestroyAcceleratorTable
PeekMessageW
CharNextW
MapDialogRect
DialogBoxIndirectParamW
EndDialog
GetWindowTextLengthW
DrawTextW
DeleteMenu
GetDlgItem
DestroyCursor
LoadCursorW
GetClassInfoExW
RegisterClassExW
CreateDialogIndirectParamW
GetSystemMenu
EnableMenuItem
SetFocus
GetWindow
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
MapWindowPoints
DestroyWindow
IsDialogMessageW
PostQuitMessage
GetCursorPos
GetCursor
ReleaseCapture
GetCapture
SetCursor
CreateWindowExW
SetTimer
AdjustWindowRectEx
GetMenu
KillTimer
SetWindowPos
PostMessageW
MoveWindow

gdi32

SetTextColor
DeleteDC
DeleteObject
GetObjectW
SetBkMode
SelectObject
GetDeviceCaps
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
CreateFontIndirectW
GetStockObject
SetWindowOrgEx
GetCurrentObject
SetViewportOrgEx

shell32

ShellExecuteExW
CommandLineToArgvW
ShellExecuteW
SHBrowseForFolderW
ord165
SHGetFolderPathW
SHGetPathFromIDListW

ole32

CLSIDFromProgID
CoGetClassObject
OleLockRunning
CoTaskMemAlloc
CoTaskMemRealloc
CreateStreamOnHGlobal
CLSIDFromString
StringFromGUID2
CoUninitialize
CoInitializeEx
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateGuid
CoCreateInstance

oleaut32

SysAllocStringLen
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
VarUI4FromStr
VariantInit
SysStringLen
VariantClear
SysFreeString
SysAllocString

shlwapi

PathFileExistsW
PathFindFileNameW
ord176

comctl32

InitCommonControlsEx

uxtheme

GetThemeFont
OpenThemeData
GetThemeColor

psapi

GetModuleFileNameExW

gdiplus

GdipDeleteBrush
GdipCreateSolidFill
GdipCreateFromHDC
GdipDrawImageRectI
GdipSetInterpolationMode
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCreateBitmapFromScan0
GdipGetImageWidth
GdipGetImageHeight
GdipCloneImage
GdipAlloc
GdipFree
GdipLoadImageFromStream
GdipFillRectangleI
GdiplusStartup
GdiplusShutdown
GdipDeleteGraphics

rpcrt4

UuidCreate

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

winhttp

WinHttpConnect
WinHttpOpen
WinHttpCloseHandle
WinHttpSetTimeouts
WinHttpQueryOption
WinHttpQueryHeaders
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpSetOption
WinHttpSendRequest
WinHttpSetStatusCallback
WinHttpReceiveResponse
WinHttpCrackUrl

crypt32

CertFreeCertificateContext
CertGetCertificateChain
CertCreateCertificateChainEngine
CertNameToStrW
CertFreeCertificateChainEngine
CertFreeCertificateChain
CryptProtectData

wintrust

WinVerifyTrust

Exports

Exports

?$TSS0@?1??get_instance@?$singleton@V?$extended_type_info_typeid@Uactivity_item@core_utils@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@Uactivity_item@core_utils@@@34@XZ@4HA
?$TSS0@?1??get_instance@?$singleton@V?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@34@XZ@4HA
?$TSS0@?1??get_instance@?$singleton@V?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@34@XZ@4HA
?$TSS0@?1??get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@4@XZ@4HA
?$TSS0@?1??get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@4@XZ@4HA
?$TSS0@?1??get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@4@XZ@4HA
?$TSS0@?1??get_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4HA
?$TSS0@?1??get_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4HA
?$TSS0@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@4HA
?$TSS0@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ@4HA
?$TSS0@?1??get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@4@XZ@4HA
?$TSS0@?1??get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@4@XZ@4HA
?$TSS0@?1??get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@4@XZ@4HA
??0?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@QAE@XZ
??0?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@QAE@XZ
??0?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@QAE@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@Uactivity_item@core_utils@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@Uactivity_item@core_utils@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@23@XZ
?get_const_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@3@XZ
?get_instance@?$singleton@V?$extended_type_info_typeid@Uactivity_item@core_utils@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@Uactivity_item@core_utils@@@23@XZ
?get_instance@?$singleton@V?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@23@XZ
?get_instance@?$singleton@V?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@23@XZ
?get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@3@XZ
?get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@3@XZ
?get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@3@XZ
?get_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@3@XZ
?get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@3@XZ
?get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?instance@?$singleton@V?$extended_type_info_typeid@Uactivity_item@core_utils@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@Uactivity_item@core_utils@@@23@A
?instance@?$singleton@V?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@23@A
?instance@?$singleton@V?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@23@A
?instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@0AAV?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@3@A
?instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@0AAV?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@3@A
?instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@0AAV?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@3@A
?instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@0AAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@A
?instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@0AAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@A
?instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@A
?instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@A
?instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@3@A
?instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@3@A
?instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@3@A
?is_destroyed@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?load_object_data@?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?load_object_data@?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?load_object_data@?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?save_object_data@?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@Uactivity_item@core_utils@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@Uactivity_item@core_utils@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@Uactivity_item@core_utils@@@serialization@boost@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@serialization@boost@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@serialization@boost@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@634@A
?t@?1??get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@634@A
?t@?1??get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@634@A
?t@?1??get_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@734@A
?t@?1??get_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@734@A
?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@634@A
?t@?1??get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@634@A
?t@?1??get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@634@A

Sections

.text
Size: 889KB - Virtual size: 889KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 554KB - Virtual size: 554KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 246KB - Virtual size: 245KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bb63f430314ffea0ccc724724b66a8e8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

shlwapi

comctl32

uxtheme

psapi

gdiplus

rpcrt4

version

winhttp

crypt32

wintrust

Exports

Exports

Sections

.text Size: 889KB - Virtual size: 889KB

.rdata Size: 554KB - Virtual size: 554KB

.data Size: 29KB - Virtual size: 35KB

.rsrc Size: 246KB - Virtual size: 245KB

.reloc Size: 62KB - Virtual size: 61KB

.text
Size: 889KB - Virtual size: 889KB

.rdata
Size: 554KB - Virtual size: 554KB

.data
Size: 29KB - Virtual size: 35KB

.rsrc
Size: 246KB - Virtual size: 245KB

.reloc
Size: 62KB - Virtual size: 61KB