FileCoAuth[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

FileCoAuth.exe
Size

1017KB
MD5

2c097ba923affecd2ebf2363411a4e79
SHA1

18d854010015385df06b76eb134bee86725e345e
SHA256

2d29b5a7e1d24195a70db50b72c8de0ee650efa135e1875bb2302a5f85f5f6b3
SHA512

0e326002546b31fb54fa9678649ae5d9376a93d1ed4813ac4938a8e61953d50a7f68f522a4fdf4674aa9ecaeba5596a8246827185848b23d6c4e3eedc11af92d
SSDEEP

24576:fNnZsf3PxTm0rq+pbAs5XdQXb5XL6MGQATDZb:FnZsfJlTOsBdQXwvR

Score

1^/10

Malware Config

Signatures

Files

FileCoAuth.exe
.exe windows:6 windows x64

521e7b6b2641485cfcbbfb3d212b3820

Code Sign

33:00:00:04:fa:70:20:8d:01:f1:4f:ec:1e:00:00:00:00:04:fa
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/02/2023, 20:11

Not After

31/01/2024, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

23:5f:13:3c:54:5c:b5:4a:19:7d:98:84:0b:5e:58:88:1d:8a:c4:8f:4e:0d:f0:09:14:71:20:f2:26:63:0b:ab
Signer

Actual PE Digest

23:5f:13:3c:54:5c:b5:4a:19:7d:98:84:0b:5e:58:88:1d:8a:c4:8f:4e:0d:f0:09:14:71:20:f2:26:63:0b:ab

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

loggingplatform

?GuidToString@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBU_GUID@@@Z
?LoggingSetCommonDatapoint@@YAXPEB_W0@Z
?LoggingSetCommonDatapointUserId@@YAXPEB_WW4UserIdType@@@Z
?StripPrivateInfoFromString@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEB_W@Z
?g_pLoggingAPIWrapper@@3PEAVILoggingAPIWrapper@@EA
?GetEmptyTelemetryUsageExperimentVector@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?NarrowStringToWideString@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEBD@Z
?LoggingSendTelemetryEvent@@YAXAEAUTelemetryEvent@@QEAUStructuredEventParameter@@@Z
?SetEventExpiration@TelemetryEvent@@QEAAXII@Z
??0TelemetryEvent@@QEAA@PEBD0AEBU_GUID@@II00II@Z
?OneDriveAssertWorker@@YAXPEB_WW4OneDriveAssertType@@0I000ZZ
?GetActiveHydrationsCount@QoS@@YAIXZ
?IsAnyLibraryIrmEnabled@QoS@@YA_NXZ
?LoggingRecordAssert@@YAXPEB_W000I0_NI1@Z
??1TelemetryEvent@@QEAA@XZ
?LoggingInitializeForExternalComponent@@YAJPEB_W0_NG11W4TelemetryTransportType@@0K1@Z
?LoggingRotateIfNeeded@@YAXXZ
?LoggingWriteStructuredEvent@@YAXAEBUStructuredEvent@@QEAUStructuredEventParameter@@@Z
??0StructuredEvent@@QEAA@PEBDH0AEBU_GUID@@IIII@Z

telemetry

?Report@IncomingTelemetry@@YAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00JV?$duration@_JU?$ratio@$00$0DLJKMKAA@@std@@@chrono@3@@Z

updateringsettings

?GetUpdateRingSettingsManager@@YAPEAVIUpdateRingSettingsManager@@XZ

propsys

PropVariantToStringAlloc
PropVariantToUInt32

ntdll

VerSetConditionMask
RtlCaptureContext
NtQueryDirectoryFile
RtlNtStatusToDosError
RtlLookupFunctionEntry
RtlVirtualUnwind

kernel32

SetFilePointer
GetCompressedFileSizeW
FindFirstFileNameW
IsDebuggerPresent
SetHandleInformation
CreatePipe
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
DeviceIoControl
LoadLibraryExW
ReadDirectoryChangesW
CreateSymbolicLinkW
GetUserGeoID
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetProductInfo
VerifyVersionInfoW
SetLastError
ReleaseMutex
WaitForMultipleObjects
GetEnvironmentVariableW
ExpandEnvironmentStringsW
GetProcessTimes
GetExitCodeProcess
CreateProcessW
RemoveDirectoryW
GetSystemTimes
SetThreadInformation
GetPrivateProfileStringW
WritePrivateProfileStringW
SetDllDirectoryW
CopyFileW
MoveFileExW
ReplaceFileW
GetComputerNameW
RegisterApplicationRestart
GetFileInformationByHandleEx
OpenFileById
GetDllDirectoryW
DebugBreak
WaitForSingleObjectEx
ReadFile
GetVolumePathNameW
WerRegisterFile
GetTickCount64
GetComputerNameExW
GetLogicalDrives
GetDriveTypeW
GetVolumeInformationW
DuplicateHandle
UnregisterApplicationRestart
SystemTimeToTzSpecificLocalTime
GetFinalPathNameByHandleW
OpenMutexW
GetFileType
GetFileSizeEx
GetFileSize
OutputDebugStringW
InitOnceBeginInitialize
InitOnceComplete
InitializeCriticalSectionAndSpinCount
ResetEvent
GetFileInformationByHandle
GetFileAttributesExW
GetDiskFreeSpaceExW
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
CreateFileW
CreateDirectoryW
GetLongPathNameW
GetTickCount
CreateEventExW
WaitForMultipleObjectsEx
FindNextFileW
LCMapStringW
WideCharToMultiByte
MultiByteToWideChar
K32GetModuleFileNameExW
GetUserDefaultLocaleName
GetUserDefaultLCID
LCIDToLocaleName
MoveFileW
LocalAlloc
LoadLibraryW
FreeLibrary
GetVersionExW
GetSystemTimeAsFileTime
GetSystemTime
OpenProcess
TerminateProcess
GetCurrentProcessId
CreateMutexW
FindFirstFileW
FindClose
DeleteFileW
SystemTimeToFileTime
LocalFree
GetCurrentThread
SetFileAttributesW
GetFileAttributesW
CompareStringOrdinal
QueryFullProcessImageNameW
GetCurrentProcess
IsWow64Process
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
RaiseException
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
GetProcAddress
DecodePointer
HeapAlloc
CreateThread
CloseHandle
SetEvent
GetLastError
Sleep
CreateEventW
WaitForSingleObject
InitializeCriticalSectionEx
GetModuleFileNameW
GetCommandLineW
HeapFree
FormatMessageW
InitializeSListHead
QueryPerformanceCounter
GetCurrentDirectoryW
InterlockedPushEntrySList
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetFileInformationByHandle
SetProcessShutdownParameters
QueueUserWorkItem
MoveFileWithProgressW
GlobalLock
GlobalUnlock
GlobalFree
GlobalAlloc
GetDateFormatW
OpenEventW
GetLocaleInfoW

user32

CharUpperW
GetMessageW
SetTimer
KillTimer
PostMessageW
EnumWindows
GetClassNameW
DispatchMessageW
CharNextW
SendMessageTimeoutW
PeekMessageW
PostQuitMessage
MsgWaitForMultipleObjectsEx
SetCursor
TranslateMessage
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
LoadImageW
GetWindowThreadProcessId
GetProcessDefaultLayout
GetIconInfo
GetWindowRect
TrackPopupMenu
GetSubMenu
GetDoubleClickTime
PostThreadMessageW
SetMenuDefaultItem
EnableMenuItem
GetMenuStringW
GetMenuItemCount
RemoveMenu
DeleteMenu
AppendMenuW
ModifyMenuW
EndDialog
RegisterClassW
SystemParametersInfoW
DestroyWindow
ShowWindow
IsWindow
SetForegroundWindow
FindWindowW
SendMessageW
GetClientRect
RegisterClassExW
LoadIconW
GetClassInfoExW
GetLastInputInfo
IsHungAppWindow
MapWindowPoints
GetWindowLongW
CloseClipboard
OpenClipboard
GetClipboardData
SetClipboardData
EmptyClipboard
SetWindowPos
AdjustWindowRectEx
MessageBoxW
AllowSetForegroundWindow
SetFocus
GetLastActivePopup
LoadCursorW
CreateWindowExW

advapi32

CryptReleaseContext
RegCopyTreeW
RegNotifyChangeKeyValue
CheckTokenMembership
InitializeAcl
CreateProcessWithTokenW
GetUserNameW
SetFileSecurityW
CreateProcessAsUserW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
GetAce
DeleteAce
AddAce
StartServiceW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
QueryServiceStatusEx
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfig2W
ChangeServiceConfigW
RegDeleteTreeW
RegUnLoadKeyW
RegLoadKeyW
RegEnumKeyW
RegDeleteKeyExW
RegCreateKeyTransactedW
GetAclInformation
FreeSid
DuplicateTokenEx
CreateWellKnownSid
AllocateAndInitializeSid
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
RegOpenKeyExW
CryptAcquireContextW
RegGetValueW
RegSetKeyValueW
RegSetValueExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyExW
LookupPrivilegeValueW
IsValidSid
GetTokenInformation
GetLengthSid
CopySid
AdjustTokenPrivileges
AccessCheck
SetEntriesInAclW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
OpenProcessToken
DuplicateToken
MapGenericMask
IsValidAcl
OpenThreadToken
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
RegDeleteKeyW
ConvertStringSidToSidW

shell32

SHGetFolderPathAndSubDirW
SHGetFolderPathW
ShellExecuteExW
SHQueryUserNotificationState
SHAppBarMessage
SHGetPathFromIDListW
SHBrowseForFolderW
SHParseDisplayName
ShellExecuteW
Shell_NotifyIconW
SHCreateDirectoryExW
SHCreateItemFromParsingName
SHGetKnownFolderItem
CommandLineToArgvW
SHFileOperationW
SHGetKnownFolderPath
ord526
SHChangeNotify
SHAssocEnumHandlers
SHGetSpecialFolderPathW
SHSetKnownFolderPath
AssocCreateForClasses

ole32

CoCreateGuid
CoSetProxyBlanket
CoWaitForMultipleHandles
CLSIDFromString
StringFromCLSID
CreateBindCtx
CoRevertToSelf
CreateItemMoniker
CoImpersonateClient
PropVariantClear
CoInitializeSecurity
GetRunningObjectTable
CoTaskMemFree
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoReleaseServerProcess
CoAddRefServerProcess
CoInitializeEx
CoUninitialize
CoAllowSetForegroundWindow
CoCreateInstance
CoRegisterClassObject
CoResumeClassObjects
CoRevokeClassObject
CoGetObject
CoGetCallContext
StringFromGUID2

oleaut32

SetErrorInfo
SysStringByteLen
SafeArrayUnaccessData
SafeArrayAccessData
GetErrorInfo
GetRecordInfoFromTypeInfo
LoadRegTypeLi
SysAllocStringByteLen
SysStringLen
SysAllocString
RegisterTypeLi
SysFreeString
LoadTypeLi
UnRegisterTypeLi

crypt32

CertFindExtension
CryptBinaryToStringW
CryptStringToBinaryW

rpcrt4

UuidToStringW
RpcStringFreeW
RpcBindingFree
RpcBindingFromStringBindingW
RpcBindingVectorFree
RpcStringBindingComposeW
RpcServerInqBindings
RpcServerRegisterIfEx
RpcServerUnregisterIf
RpcServerUseProtseqW
RpcBindingSetAuthInfoExW
RpcEpRegisterW
RpcEpUnregister
RpcServerInqCallAttributesW

secur32

GetUserNameExW

shlwapi

SHDeleteValueW
PathIsDirectoryEmptyW
PathRemoveFileSpecW
StrStrIW
PathIsPrefixW
PathStripToRootW
SHGetValueA
PathStripPathW
PathIsDirectoryW
SHRegGetUSValueW
SHGetValueW
PathFindFileNameW
PathFileExistsW
SHStrDupW
SHCreateStreamOnFileEx
SHRegCreateUSKeyW
SHRegCloseUSKey
SHRegSetUSValueW
AssocCreate
UrlEscapeW
UrlCreateFromPathW
SHSetValueW
SHDeleteKeyW
SHCreateStreamOnFileW
AssocQueryStringW
SHRegGetBoolUSValueW
SHRegGetPathW
SHRegGetValueW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wininet

InternetGetConnectedState
InternetCheckConnectionW

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory
WTSQueryUserToken
WTSEnumerateSessionsW

msvcp140

?_Random_device@std@@YAIXZ
_Xtime_get_ticks
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?widen@?$ctype@_W@std@@QEBA_WD@Z
?id@?$collate@_W@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_N@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
_Wcsxfrm
_Wcscoll
?id@?$ctype@_W@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_counter
_Query_perf_frequency
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
_Cnd_wait
_Cnd_broadcast
_Cnd_unregister_at_thread_exit
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Cnd_register_at_thread_exit
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?_Syserror_map@std@@YAPEBDH@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
??0task_continuation_context@Concurrency@@AEAA@XZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?uncaught_exceptions@std@@YAHXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xruntime_error@std@@YAXPEBD@Z
??0_Locinfo@std@@QEAA@HPEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getname@_Locinfo@std@@QEBAPEBDXZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??Bid@locale@std@@QEAA_KXZ
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@_N@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z
?_Makeloc@_Locimp@locale@std@@CAPEAV123@AEBV_Locinfo@3@HPEAV123@PEBV23@@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
?tolower@?$ctype@D@std@@QEBADD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?toupper@?$ctype@_W@std@@QEBA_W_W@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setf@ios_base@std@@QEAAHH@Z
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z

userenv

CreateEnvironmentBlock
GetDefaultUserProfileDirectoryW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_purecall
__std_terminate
wcschr
__std_type_info_compare
__std_type_info_name
__std_exception_copy
_CxxThrowException
__RTDynamicCast
memcpy
memmove
__C_specific_handler
__current_exception_context
__current_exception
wcsstr
wcsrchr
strchr
memcmp
memset
__std_exception_destroy

api-ms-win-crt-heap-l1-1-0

malloc
_set_new_mode
realloc
free
_callnewh

api-ms-win-crt-string-l1-1-0

_wcsnicmp
tolower
toupper
wcscmp
_wcsicmp
isxdigit
wcsncmp
towupper
towlower
wcsncpy_s
isalnum
wcscat_s
wcscspn
_strnicmp
strncmp
_wcsdup
iswxdigit
wcstok_s
wcscpy_s
iswspace

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_beginthread
_invalid_parameter_noinfo_noreturn
abort
_set_app_type
terminate
_cexit
_errno
_invalid_parameter_noinfo
_register_thread_local_exe_atexit_callback
_c_exit
_seh_filter_exe
_exit
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_initialize_onexit_table
_register_onexit_function

api-ms-win-crt-time-l1-1-0

_localtime64_s
_time64

api-ms-win-crt-convert-l1-1-0

strtoull
wcstoll
atof
_wtoi
atol
strtoll
_strtod_l
wcstoul

api-ms-win-crt-locale-l1-1-0

_free_locale
_create_locale
_configthreadlocale

api-ms-win-crt-math-l1-1-0

ceilf
__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
fclose
__stdio_common_vswprintf
_set_fmode
_wfopen_s

filesyncsessions

GetSettingsPersistence

gdi32

GetObjectW

Sections

.text
Size: 623KB - Virtual size: 622KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 251KB - Virtual size: 250KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

521e7b6b2641485cfcbbfb3d212b3820

Code Sign

33:00:00:04:fa:70:20:8d:01:f1:4f:ec:1e:00:00:00:00:04:faCertificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

23:5f:13:3c:54:5c:b5:4a:19:7d:98:84:0b:5e:58:88:1d:8a:c4:8f:4e:0d:f0:09:14:71:20:f2:26:63:0b:abSigner

Headers

DLL Characteristics

File Characteristics

Imports

loggingplatform

telemetry

updateringsettings

propsys

ntdll

kernel32

user32

advapi32

shell32

ole32

oleaut32

crypt32

rpcrt4

secur32

shlwapi

version

wininet

wtsapi32

msvcp140

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

filesyncsessions

gdi32

Sections

.text Size: 623KB - Virtual size: 622KB

.rdata Size: 251KB - Virtual size: 250KB

.data Size: 38KB - Virtual size: 49KB

.pdata Size: 29KB - Virtual size: 29KB

.rsrc Size: 58KB - Virtual size: 58KB

.reloc Size: 7KB - Virtual size: 6KB

33:00:00:04:fa:70:20:8d:01:f1:4f:ec:1e:00:00:00:00:04:fa
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

23:5f:13:3c:54:5c:b5:4a:19:7d:98:84:0b:5e:58:88:1d:8a:c4:8f:4e:0d:f0:09:14:71:20:f2:26:63:0b:ab
Signer

.text
Size: 623KB - Virtual size: 622KB

.rdata
Size: 251KB - Virtual size: 250KB

.data
Size: 38KB - Virtual size: 49KB

.pdata
Size: 29KB - Virtual size: 29KB

.rsrc
Size: 58KB - Virtual size: 58KB

.reloc
Size: 7KB - Virtual size: 6KB