xworm | TrioX V2[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

TrioX V2.zip
Size

37.7MB
MD5

3d370a2ed8c5e8655ace7a42d0c6e176
SHA1

e8f3f3ed239033a5255fe949f023808e0a91ad61
SHA256

d902efe2045c2a31329231c1a02c7ac12ba6e7e8c1c3b2027750ade67752a508
SHA512

8e46563e97e36af1c839bf5faa6374600ebb2505ccc0ea9f3d248662732c03db7ea340c09ed712501e8645f9b9f044e176704ae55181396bfda91fcdaa2524b5
SSDEEP

786432:6CNcE2hMJA15eWHmEaSJ1IN4ybdCbBfPrpxqI:6IcTvHlDIN4yb0xruI

Score

10^/10

xworm

Malware Config

Extracted

Family

xworm

Version

3.1

147.185.221.17:58036

Attributes

Install_directory
%Userprofile%

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
static1/unpack001/TrioX V2/TrioX V2.exe	family_xworm

Xworm family
xworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/TrioX V2/TrioX V2.exe

Files

TrioX V2.zip
.zip
TrioX V2/CygUtils64.plugin
.zip
CygUtilsLicenses.html
.html
bin/MobApt
bin/MobaBox.exe
bin/MobaControlPanel
bin/MobaHwInfo
bin/MobaSwInfo
bin/MobaTools
bin/MobaVNC.exe
bin/MobaVerifySSHAlgos
bin/Rainbowizer
bin/ServersListToMxtSessions.sh
bin/VNCHooks.dll
bin/_ssh.exe
bin/_ssh1.exe
bin/_vim.exe
bin/ascii
bin/autossh.exe
bin/awk.exe
bin/bash.exe
bin/conin.exe
bin/ctris.exe
bin/curl.exe
bin/cygcom_err-3.dll
bin/cygcrypto-3.dll
bin/cygcurl-4.dll
bin/cygfido2-1.dll
bin/cyggcc_s-seh-1.dll
bin/cyggssapi_krb5-2.dll
bin/cyggssrpc-4.dll
bin/cygiconv-2.dll
bin/cygk5crypto-3.dll
bin/cygkadm5srv_mit-11.dll
bin/cygkdb5-8.dll
bin/cygkrb5-3.dll
bin/cygkrb5support-0.dll
bin/cygncursesw-10.dll
bin/cygopenssh.dll
bin/cygssh2-1.dll
bin/cygssl-3.dll
bin/cygssp-0.dll
bin/cygstdc++-6.dll
bin/cygtermd.exe
bin/cygwin-console-helper.exe
bin/cygwin1.dll
bin/cygz.dll
bin/fortune
bin/getAvailableDisplay
bin/git-receive-pack.exe
bin/git-upload-archive.exe
bin/git-upload-pack.exe
bin/git.exe
bin/greed.exe
bin/grep.exe
bin/help
bin/iperf.exe
bin/kinit.exe
bin/klist.exe
bin/less.exe
bin/lrz.exe
bin/lscolors
bin/lsfont
bin/lsz.exe
bin/man
bin/mobawget
bin/mosh-client.exe
bin/moshsession
bin/mount.exe
bin/openssl.exe
bin/png2bmp
bin/png2ico
bin/rcp.exe
bin/rlogin.exe
bin/rsh.exe
bin/scp.exe
bin/scrdaemons
bin/setx11dpi
bin/sftp-server.exe
bin/sftp.exe
bin/showkey.exe
bin/soliterm.exe
bin/ssh-add.exe
bin/ssh-agent.exe
bin/ssh-copy-id
bin/ssh-keygen.exe
bin/ssh-keyscan.exe
bin/ssh-pkcs11-helper.exe
bin/ssh-sk-helper.exe
bin/ssh.exe
bin/sshd.exe
bin/sudoku.exe
bin/termwalk.exe
bin/top
bin/toybox.exe
bin/vicron
bin/vim
bin/vim.exe
bin/vnp.exe
bin/waitforX
bin/winpty-agent.exe
bin/winpty.dll
bin/zsh.exe
bin/zstd-decompress.exe
etc/bash.bashrc
etc/bash_completion
etc/inputrc
etc/machine-id
etc/persistprofile.sh
etc/pki/ca-trust/ca-legacy.conf
etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
etc/pki/tls/cert.pem
etc/pki/tls/certs/ca-bundle.crt,ca-bundle.trust.crt.mobapack
etc/setup/cmdlist
etc/ssl/certs
etc/system.jwmrc
etc/system.jwmrc.backgroundless
etc/vimrc.less
etc/zprofile
etc/zshrc
lib/engines-3/capi.dll
lib/engines-3/loader_attic.dll
lib/engines-3/padlock.dll
lib/ossl-modules/legacy.dll
usr/git/git-core/git-add--interactive
usr/git/git-core/git-add.exe
usr/git/git-core/git-am.exe
usr/git/git-core/git-annotate.exe
usr/git/git-core/git-apply.exe
usr/git/git-core/git-archimport
usr/git/git-core/git-archive.exe
usr/git/git-core/git-bisect
usr/git/git-core/git-bisect--helper.exe
usr/git/git-core/git-blame.exe
usr/git/git-core/git-branch.exe
usr/git/git-core/git-bugreport.exe
usr/git/git-core/git-bundle.exe
usr/git/git-core/git-cat-file.exe
usr/git/git-core/git-check-attr.exe
usr/git/git-core/git-check-ignore.exe
usr/git/git-core/git-check-mailmap.exe
usr/git/git-core/git-check-ref-format.exe
usr/git/git-core/git-checkout--worker.exe
usr/git/git-core/git-checkout-index.exe
usr/git/git-core/git-checkout.exe
usr/git/git-core/git-cherry-pick.exe
usr/git/git-core/git-cherry.exe
usr/git/git-core/git-clean.exe
usr/git/git-core/git-clone.exe
usr/git/git-core/git-column.exe
usr/git/git-core/git-commit-graph.exe
usr/git/git-core/git-commit-tree.exe
usr/git/git-core/git-commit.exe
usr/git/git-core/git-config.exe
usr/git/git-core/git-count-objects.exe
usr/git/git-core/git-credential-cache--daemon.exe
usr/git/git-core/git-credential-cache.exe
usr/git/git-core/git-credential-store.exe
usr/git/git-core/git-credential.exe
usr/git/git-core/git-cvsexportcommit
usr/git/git-core/git-cvsimport
usr/git/git-core/git-describe.exe
usr/git/git-core/git-diff-files.exe
usr/git/git-core/git-diff-index.exe
usr/git/git-core/git-diff-tree.exe
usr/git/git-core/git-diff.exe
usr/git/git-core/git-difftool--helper
usr/git/git-core/git-difftool.exe
usr/git/git-core/git-env--helper.exe
usr/git/git-core/git-fast-export.exe
usr/git/git-core/git-fast-import.exe
usr/git/git-core/git-fetch-pack.exe
usr/git/git-core/git-fetch.exe
usr/git/git-core/git-filter-branch
usr/git/git-core/git-fmt-merge-msg.exe
usr/git/git-core/git-for-each-ref.exe
usr/git/git-core/git-for-each-repo.exe
usr/git/git-core/git-format-patch.exe
usr/git/git-core/git-fsck-objects.exe
usr/git/git-core/git-fsck.exe
usr/git/git-core/git-fsmonitor--daemon.exe
usr/git/git-core/git-gc.exe
usr/git/git-core/git-get-tar-commit-id.exe
usr/git/git-core/git-grep.exe
usr/git/git-core/git-hash-object.exe
usr/git/git-core/git-help.exe
usr/git/git-core/git-hook.exe
usr/git/git-core/git-http-fetch.exe,git-http-push.exe,git-remote-http.exe.mobapack
usr/git/git-core/git-index-pack.exe
usr/git/git-core/git-init-db.exe
usr/git/git-core/git-init.exe
usr/git/git-core/git-instaweb
usr/git/git-core/git-interpret-trailers.exe
usr/git/git-core/git-log.exe
usr/git/git-core/git-ls-files.exe
usr/git/git-core/git-ls-remote.exe
usr/git/git-core/git-ls-tree.exe
usr/git/git-core/git-mailinfo.exe
usr/git/git-core/git-mailsplit.exe
usr/git/git-core/git-maintenance.exe
usr/git/git-core/git-merge-base.exe
usr/git/git-core/git-merge-file.exe
usr/git/git-core/git-merge-index.exe
usr/git/git-core/git-merge-octopus
usr/git/git-core/git-merge-one-file
usr/git/git-core/git-merge-ours.exe
usr/git/git-core/git-merge-recursive.exe
usr/git/git-core/git-merge-resolve
usr/git/git-core/git-merge-subtree.exe
usr/git/git-core/git-merge-tree.exe
usr/git/git-core/git-merge.exe
usr/git/git-core/git-mergetool
usr/git/git-core/git-mergetool--lib
usr/git/git-core/git-mktag.exe
usr/git/git-core/git-mktree.exe
usr/git/git-core/git-multi-pack-index.exe
usr/git/git-core/git-mv.exe
usr/git/git-core/git-name-rev.exe
usr/git/git-core/git-notes.exe
usr/git/git-core/git-p4
usr/git/git-core/git-pack-objects.exe
usr/git/git-core/git-pack-redundant.exe
usr/git/git-core/git-pack-refs.exe
usr/git/git-core/git-patch-id.exe
usr/git/git-core/git-prune-packed.exe
usr/git/git-core/git-prune.exe
usr/git/git-core/git-pull.exe
usr/git/git-core/git-push.exe
usr/git/git-core/git-quiltimport
usr/git/git-core/git-range-diff.exe
usr/git/git-core/git-read-tree.exe
usr/git/git-core/git-rebase.exe
usr/git/git-core/git-receive-pack.exe
usr/git/git-core/git-reflog.exe
usr/git/git-core/git-remote-ext.exe
usr/git/git-core/git-remote-fd.exe
usr/git/git-core/git-remote-ftp.exe
usr/git/git-core/git-remote-ftps.exe
usr/git/git-core/git-remote-https.exe
usr/git/git-core/git-remote.exe
usr/git/git-core/git-repack.exe
usr/git/git-core/git-replace.exe
usr/git/git-core/git-request-pull
usr/git/git-core/git-rerere.exe
usr/git/git-core/git-reset.exe
usr/git/git-core/git-restore.exe
usr/git/git-core/git-rev-list.exe
usr/git/git-core/git-rev-parse.exe
usr/git/git-core/git-revert.exe
usr/git/git-core/git-rm.exe
usr/git/git-core/git-send-email
usr/git/git-core/git-send-pack.exe
usr/git/git-core/git-sh-i18n
usr/git/git-core/git-sh-setup
usr/git/git-core/git-shortlog.exe
usr/git/git-core/git-show-branch.exe
usr/git/git-core/git-show-index.exe
usr/git/git-core/git-show-ref.exe
usr/git/git-core/git-show.exe
usr/git/git-core/git-sparse-checkout.exe
usr/git/git-core/git-stage.exe
usr/git/git-core/git-stash.exe
usr/git/git-core/git-status.exe
usr/git/git-core/git-stripspace.exe
usr/git/git-core/git-submodule
usr/git/git-core/git-submodule--helper.exe
usr/git/git-core/git-svn
usr/git/git-core/git-switch.exe
usr/git/git-core/git-symbolic-ref.exe
usr/git/git-core/git-tag.exe
usr/git/git-core/git-unpack-file.exe
usr/git/git-core/git-unpack-objects.exe
usr/git/git-core/git-update-index.exe
usr/git/git-core/git-update-ref.exe
usr/git/git-core/git-update-server-info.exe
usr/git/git-core/git-upload-archive.exe
usr/git/git-core/git-upload-pack.exe
usr/git/git-core/git-var.exe
usr/git/git-core/git-verify-commit.exe
usr/git/git-core/git-verify-pack.exe
usr/git/git-core/git-verify-tag.exe
usr/git/git-core/git-web--browse
usr/git/git-core/git-whatchanged.exe
usr/git/git-core/git-worktree.exe
usr/git/git-core/git-write-tree.exe
usr/git/git-core/git.exe
usr/git/git-core/mergetools/araxis
usr/git/git-core/mergetools/bc
usr/git/git-core/mergetools/codecompare
usr/git/git-core/mergetools/deltawalker
usr/git/git-core/mergetools/diffmerge
usr/git/git-core/mergetools/diffuse
usr/git/git-core/mergetools/ecmerge
usr/git/git-core/mergetools/emerge
usr/git/git-core/mergetools/examdiff
usr/git/git-core/mergetools/guiffy
usr/git/git-core/mergetools/gvimdiff
usr/git/git-core/mergetools/kdiff3
usr/git/git-core/mergetools/kompare
usr/git/git-core/mergetools/meld
usr/git/git-core/mergetools/nvimdiff
usr/git/git-core/mergetools/opendiff
usr/git/git-core/mergetools/p4merge
usr/git/git-core/mergetools/smerge
usr/git/git-core/mergetools/tkdiff
usr/git/git-core/mergetools/tortoisemerge
usr/git/git-core/mergetools/vimdiff
usr/git/git-core/mergetools/winmerge
usr/git/git-core/mergetools/xxdiff
usr/share/git-core/templates/description
usr/share/git-core/templates/hooks/applypatch-msg.sample
usr/share/git-core/templates/hooks/commit-msg.sample
usr/share/git-core/templates/hooks/fsmonitor-watchman.sample
usr/share/git-core/templates/hooks/post-update.sample
usr/share/git-core/templates/hooks/pre-applypatch.sample
usr/share/git-core/templates/hooks/pre-commit.sample
usr/share/git-core/templates/hooks/pre-merge-commit.sample
usr/share/git-core/templates/hooks/pre-push.sample
usr/share/git-core/templates/hooks/pre-rebase.sample
usr/share/git-core/templates/hooks/pre-receive.sample
usr/share/git-core/templates/hooks/prepare-commit-msg.sample
usr/share/git-core/templates/hooks/push-to-checkout.sample
usr/share/git-core/templates/hooks/update.sample
usr/share/git-core/templates/info/exclude
usr/share/locale/locale.alias
usr/share/man.tar
usr/share/perl5/FromCPAN/Error.pm
usr/share/perl5/FromCPAN/Mail/Address.pm
usr/share/perl5/Git.pm
usr/share/perl5/Git/I18N.pm
usr/share/perl5/Git/IndexInfo.pm
usr/share/perl5/Git/LoadCPAN.pm
usr/share/perl5/Git/LoadCPAN/Error.pm
usr/share/perl5/Git/LoadCPAN/Mail/Address.pm
usr/share/perl5/Git/Packet.pm
usr/share/perl5/Git/SVN.pm
usr/share/perl5/Git/SVN/Editor.pm
usr/share/perl5/Git/SVN/Fetcher.pm
usr/share/perl5/Git/SVN/GlobSpec.pm
usr/share/perl5/Git/SVN/Log.pm
usr/share/perl5/Git/SVN/Memoize/YAML.pm
usr/share/perl5/Git/SVN/Migration.pm
usr/share/perl5/Git/SVN/Prompt.pm
usr/share/perl5/Git/SVN/Ra.pm
usr/share/perl5/Git/SVN/Utils.pm
usr/share/sudoku/template
usr/share/terminfo/73/screen
usr/share/terminfo/74/tmux
usr/share/terminfo/78/xterm
usr/share/terminfo/78/xterm-256color
usr/share/terminfo/78/xterm-color
usr/share/vim.tar
usr/share/zsh.tar
TrioX V2/DirectML.Debug.dll
.dll windows:6 windows x64 arch:x64

6af4a8d442d21ca96033085fddf29a99

Code Sign

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ab:2d:42:53:a1:45:6e:a1:04:15:18:48:f1:c9:86:25:da:2e:5d:c1:c0:74:c2:e5:dc:5b:fa:af:22:98:1c:59
Signer

Actual PE Digest

ab:2d:42:53:a1:45:6e:a1:04:15:18:48:f1:c9:86:25:da:2e:5d:c1:c0:74:c2:e5:dc:5b:fa:af:22:98:1c:59

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

IsDebuggerPresent
DebugBreak
OutputDebugStringW
CloseHandle
GetLastError
SetLastError
HeapAlloc
HeapFree
GetProcessHeap
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
FormatMessageW
OutputDebugStringA
CreateFileW
FormatMessageA
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
LocalFree
GetLocaleInfoEx
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
CompareStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlUnwind
ExitProcess
GetModuleFileNameW
GetCurrentThread
GetStdHandle
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
SetConsoleCtrlHandler
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetFileSizeEx
SetFilePointerEx
SetStdHandle
HeapSize
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
ReadFile
ReadConsoleW
WriteConsoleW

Exports

Exports

DMLCreateDebugDevice

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 472KB - Virtual size: 471KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TrioX V2/DirectML.dll
.dll windows:6 windows x64 arch:x64

de90869f37e914fc01b99c913f65b5b5

Code Sign

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8e:c2:0e:91:b0:b2:da:ff:23:0b:b8:11:5c:25:bc:77:30:e0:86:67:88:a5:b0:2e:23:e6:b7:eb:ef:67:54:a6
Signer

Actual PE Digest

8e:c2:0e:91:b0:b2:da:ff:23:0b:b8:11:5c:25:bc:77:30:e0:86:67:88:a5:b0:2e:23:e6:b7:eb:ef:67:54:a6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap
HeapSize
HeapReAlloc

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
DeleteCriticalSection
ReleaseMutex
ReleaseSemaphore
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
CreateSemaphoreExW
OpenSemaphoreW
CreateMutexExW

api-ms-win-core-processthreads-l1-1-0

TlsSetValue
TlsFree
TlsGetValue
TlsAlloc
ExitProcess
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetStartupInfoW
GetCurrentProcess

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetModuleHandleExW
GetModuleFileNameW
LoadLibraryExW
DisableThreadLibraryCalls
LoadResource
GetModuleHandleW
LockResource
GetProcAddress
FreeLibrary

api-ms-win-core-localization-l1-2-0

GetOEMCP
FormatMessageW
GetLocaleInfoEx
GetLocaleInfoW
EnumSystemLocalesW
GetUserDefaultLCID
GetACP
IsValidLocale
LCMapStringW
GetCPInfo
LCMapStringEx
IsValidCodePage

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister

api-ms-win-core-libraryloader-l1-2-1

FindResourceW
LoadLibraryW

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualAlloc

d3d12

D3D12SerializeVersionedRootSignature

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringEx
MultiByteToWideChar
CompareStringW
GetStringTypeW

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-file-l1-1-0

FindClose
FindNextFileW
CreateFileW
SetFilePointerEx
WriteFile
FlushFileBuffers
FindFirstFileExW
GetFileType

api-ms-win-core-fibers-l1-1-0

FlsFree
FlsSetValue
FlsAlloc
FlsGetValue

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx
RtlPcToFileHeader
RtlUnwind

api-ms-win-core-interlocked-l1-1-0

InterlockedFlushSList
InitializeSListHead

api-ms-win-core-processenvironment-l1-1-0

SetEnvironmentVariableW
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
GetStdHandle
SetStdHandle
FreeEnvironmentStringsW

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

api-ms-win-core-console-l1-1-0

GetConsoleMode
GetConsoleOutputCP
WriteConsoleW

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

api-ms-win-appmodel-runtime-l1-1-0

GetCurrentPackageFullName

Exports

Exports

DMLCreateDevice
DMLCreateDevice1

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 82KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6.3MB - Virtual size: 6.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TrioX V2/TrioX V2.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TrioX V2/onnxruntime.dll
.dll windows:6 windows x64 arch:x64

39e1a29a795654c064e5e6ee1d09c320

Code Sign

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c6:c5:5b:e5:7b:f8:7b:45:cb:d8:d9:84:05:84:44:65:96:e9:58:cd:b4:7b:83:93:1e:94:56:6e:fb:19:4e:24
Signer

Actual PE Digest

c6:c5:5b:e5:7b:f8:7b:45:cb:d8:d9:84:05:84:44:65:96:e9:58:cd:b4:7b:83:93:1e:94:56:6e:fb:19:4e:24

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

api-ms-win-core-file-l1-1-0

RemoveDirectoryW
GetFinalPathNameByHandleW
GetFileAttributesW
ReadFile
FindNextFileW
CreateDirectoryW
GetFileAttributesA
DeleteFileW
GetFullPathNameW
SetFilePointerEx
CreateDirectoryA
FindClose
GetFileSizeEx
FindFirstFileW

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableA

msvcp140

??7ios_base@std@@QEBA_NXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Mtx_unlock
?eof@ios_base@std@@QEBA_NXZ
?good@ios_base@std@@QEBA_NXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
?_Xbad_function_call@std@@YAXXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
_Mbrtowc
?_Xbad_alloc@std@@YAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAF@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z
_Xtime_get_ticks
_Query_perf_counter
?id@?$ctype@D@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xinvalid_argument@std@@YAXPEBD@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?classic@locale@std@@SAAEBV12@XZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Query_perf_frequency
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
??Bios_base@std@@QEBA_NXZ
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBUtm@@PEB_W4@Z
?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$numpunct@_W@std@@2V0locale@2@A
?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A
_Thrd_id
?wclog@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Thrd_hardware_concurrency
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler
strchr
__std_terminate
__current_exception
_purecall
__std_exception_copy
__std_exception_destroy
__std_type_info_compare
memcpy
__std_type_info_name
memchr
__RTtypeid
__std_type_info_destroy_list
__current_exception_context
memmove
memset
_CxxThrowException
memcmp

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_initialize_onexit_table
abort
_initialize_narrow_environment
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
__doserrno
_beginthreadex
_set_doserrno
_errno
strerror_s
_seh_filter_dll
_initterm_e
_initterm
strerror
_invalid_parameter_noinfo
_crt_atexit
_get_errno
terminate
_cexit
_execute_onexit_table
_set_errno

api-ms-win-crt-stdio-l1-1-0

_wsopen_s
fclose
_write
_close
fputc
__stdio_common_vswprintf
_read
__stdio_common_vsnprintf_s
_get_stream_buffer_pointers
_fseeki64
fread
fsetpos
fgetc
__stdio_common_vsprintf
fwrite
fflush
__acrt_iob_func
_sopen_s
__stdio_common_vsprintf_s
ungetc
setvbuf
fgetpos
__stdio_common_vfprintf

api-ms-win-crt-string-l1-1-0

isalpha
isalnum
strncmp
towlower
iswspace
toupper
tolower
_towlower_l
_strnicmp
strcmp
isdigit
isspace
strnlen
_towupper_l

api-ms-win-crt-convert-l1-1-0

strtoull
strtod
strtoll
atoi
strtol
strtof
_strtoi64

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_fstat64i32
_wstat64
_unlock_file

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
free
_aligned_free
calloc
_aligned_malloc

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
WakeConditionVariable
InitOnceComplete
Sleep
WakeAllConditionVariable
SleepConditionVariableSRW

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockShared
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateSemaphoreExW
ReleaseSemaphore
CreateEventW
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess

api-ms-win-core-processthreads-l1-1-1

GetCurrentProcessorNumber
IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetLogicalProcessorInformationEx
GetSystemTimeAsFileTime
GetSystemInfo

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleA
GetModuleFileNameW
LoadLibraryExA
GetModuleHandleW
LoadLibraryExW
GetProcAddress
FreeLibrary

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx
FormatMessageA
FormatMessageW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
VirtualAlloc
MapViewOfFile
VirtualQuery
VirtualProtect
CreateFileMappingW
VirtualFree

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-processtopology-l1-1-0

SetThreadGroupAffinity

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec
PathCchRemoveBackslash

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventUnregister
EventSetInformation

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-crt-time-l1-1-0

_difftime64
_mktime64
_gmtime64_s
wcsftime
_localtime64_s

api-ms-win-crt-locale-l1-1-0

localeconv
_free_locale
_create_locale

api-ms-win-crt-math-l1-1-0

acosf
exp
expf
_ldclass
_fdclass
_dclass
sin
sinf
floor
floorf
atanf
sinhf
fmod
sqrt
ceil
sqrtf
fmodf
log
log10
asinf
ceilf
log2
_ldsign
llroundl
_fdsign
asinhf
atanhf
acoshf
log1pf
nearbyintf
remainderf
rintf
rint
cos
tanhf
logf
cosf
ilogbf
scalbn
ilogb
scalbnf
tanf
ldexp
fmax
roundf
pow
powf
tanh
coshf
_dsign

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

Exports

Exports

OrtGetApiBase
OrtGetWinMLAdapter
OrtSessionOptionsAppendExecutionProviderEx_DML
OrtSessionOptionsAppendExecutionProvider_CPU
OrtSessionOptionsAppendExecutionProvider_DML

Sections

.text
Size: 9.0MB - Virtual size: 9.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 377KB - Virtual size: 391KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 293KB - Virtual size: 292KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TrioX V2/onnxruntime.lib

Sharing

General

Malware Config

Extracted

Signatures

Files

6af4a8d442d21ca96033085fddf29a99

Code Sign

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4eCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

ab:2d:42:53:a1:45:6e:a1:04:15:18:48:f1:c9:86:25:da:2e:5d:c1:c0:74:c2:e5:dc:5b:fa:af:22:98:1c:59Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 472KB - Virtual size: 471KB

.data Size: 17KB - Virtual size: 25KB

.pdata Size: 97KB - Virtual size: 97KB

_RDATA Size: 512B - Virtual size: 512B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 22KB - Virtual size: 22KB

de90869f37e914fc01b99c913f65b5b5

Code Sign

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4eCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

8e:c2:0e:91:b0:b2:da:ff:23:0b:b8:11:5c:25:bc:77:30:e0:86:67:88:a5:b0:2e:23:e6:b7:eb:ef:67:54:a6Signer

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-memory-l1-1-0

d3d12

api-ms-win-core-string-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-appmodel-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.rdata Size: 2.7MB - Virtual size: 2.7MB

.data Size: 82KB - Virtual size: 97KB

.pdata Size: 114KB - Virtual size: 114KB

_RDATA Size: 512B - Virtual size: 512B

.rsrc Size: 6.3MB - Virtual size: 6.3MB

.reloc Size: 35KB - Virtual size: 35KB

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

ab:2d:42:53:a1:45:6e:a1:04:15:18:48:f1:c9:86:25:da:2e:5d:c1:c0:74:c2:e5:dc:5b:fa:af:22:98:1c:59
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 472KB - Virtual size: 471KB

.data
Size: 17KB - Virtual size: 25KB

.pdata
Size: 97KB - Virtual size: 97KB

_RDATA
Size: 512B - Virtual size: 512B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 22KB - Virtual size: 22KB

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

8e:c2:0e:91:b0:b2:da:ff:23:0b:b8:11:5c:25:bc:77:30:e0:86:67:88:a5:b0:2e:23:e6:b7:eb:ef:67:54:a6
Signer

.text
Size: 2.4MB - Virtual size: 2.4MB

.rdata
Size: 2.7MB - Virtual size: 2.7MB

.data
Size: 82KB - Virtual size: 97KB

.pdata
Size: 114KB - Virtual size: 114KB

_RDATA
Size: 512B - Virtual size: 512B

.rsrc
Size: 6.3MB - Virtual size: 6.3MB

.reloc
Size: 35KB - Virtual size: 35KB

.text
Size: 67KB - Virtual size: 67KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

c6:c5:5b:e5:7b:f8:7b:45:cb:d8:d9:84:05:84:44:65:96:e9:58:cd:b4:7b:83:93:1e:94:56:6e:fb:19:4e:24
Signer

.text
Size: 9.0MB - Virtual size: 9.0MB

.rdata
Size: 2.8MB - Virtual size: 2.8MB

.data
Size: 377KB - Virtual size: 391KB

.pdata
Size: 293KB - Virtual size: 292KB

.didat
Size: 512B - Virtual size: 128B

_RDATA
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 59KB - Virtual size: 58KB