10012024_0133_PolsRatrader[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

10012024_0133_PolsRatrader.zip
Size

2.9MB
MD5

05b04165b68452fb554fc33e5be65072
SHA1

05d47a2a20f3d9c189caf2ebcb1ad5e622e54ca7
SHA256

339cfbb5dd51b94d782cb322b592467a030cb2503015c09ee031d4c55f388d15
SHA512

874715ba89478692233b70b6ce2a5af2b892c1f3959eeb7c7bb22fbc82ebeec511d4584a25342bff564efa9252db8a84eee917ec307eee25e7b3e9c9a44c899c
SSDEEP

49152:4n2cqtE+5PWZMB1qEzda5D/GatWTjvE/OOKnPY0MpIVujznXDdcT:4n2VtEgPdiERqpWvMOOp0MiVuPzdI

Score

1^/10

Malware Config

Signatures

Files

10012024_0133_PolsRatrader.zip
.zip

Password: infected
Client32.ini
HTCTL32.DLL
.dll windows:5 windows x86 arch:x86

Password: infected

6ba08298dd09ea8e41ab7285d3183bba

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12/01/2016, 00:00

Not After

21/09/2017, 23:59

Subject

CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12/01/2016, 00:00

Not After

21/09/2017, 23:59

Subject

CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

49:9a:ad:c7:dc:6b:64:28:d9:9b:28:3b:14:85:83:63:08:60:5c:14:e0:60:b3:f1:ce:19:61:68:8b:29:63:f5
Signer

Actual PE Digest

49:9a:ad:c7:dc:6b:64:28:d9:9b:28:3b:14:85:83:63:08:60:5c:14:e0:60:b3:f1:ce:19:61:68:8b:29:63:f5

Digest Algorithm

sha256

PE Digest Matches

true

55:a2:2c:85:ec:8b:5f:16:52:a8:7d:e3:fd:3a:49:f5:1f:08:59:26
Signer

Actual PE Digest

55:a2:2c:85:ec:8b:5f:16:52:a8:7d:e3:fd:3a:49:f5:1f:08:59:26

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wsock32

getpeername
ntohs
socket
setsockopt
bind
htons
WSASetBlockingHook
WSAUnhookBlockingHook
send
gethostname
getsockname
connect
__WSAFDIsSet
WSASetLastError
ioctlsocket
gethostbyname
shutdown
recv
closesocket
WSACancelBlockingCall
inet_ntoa
select
WSAGetLastError
WSAStartup
WSACleanup
inet_addr

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime

kernel32

IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetLocaleInfoW
LoadLibraryW
SetConsoleCtrlHandler
FatalAppExitA
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
ReadFile
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDBCSLeadByte
CompareStringA
GetModuleFileNameA
GetProcAddress
GetModuleHandleA
OutputDebugStringA
LoadLibraryA
FreeLibrary
InitializeCriticalSection
DeleteCriticalSection
Sleep
LeaveCriticalSection
EnterCriticalSection
SetLastError
WritePrivateProfileStringA
CloseHandle
FlushFileBuffers
SetFilePointer
GetFileSize
GetPrivateProfileIntA
CreateFileA
SetStdHandle
WriteFile
GetLocalTime
GetDateFormatA
CopyFileA
InterlockedExchange
SetEvent
GetVersionExA
InterlockedDecrement
GetTickCount
SystemTimeToFileTime
GetSystemTime
OpenProcess
GetCurrentProcessId
GetCurrentThreadId
InterlockedIncrement
GetTempPathA
ReleaseMutex
WaitForSingleObject
TerminateThread
lstrlenA
CreateMutexA
SetThreadPriority
CreateThread
CreateEventA
ExitProcess
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
GetVersion
GlobalFree
LCMapStringW
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsProcessorFeaturePresent
HeapDestroy
HeapCreate
GetModuleFileNameW
GetConsoleCP
GetConsoleMode
WriteConsoleW
SetEndOfFile
GetProcessHeap
GetLastError
PulseEvent
HeapAlloc
HeapFree
RtlUnwind
RaiseException
HeapReAlloc
EncodePointer
DecodePointer
GetCommandLineA
GetModuleHandleW
GetStdHandle

user32

PostThreadMessageA
PostMessageA
GetMessageA
TranslateMessage
DispatchMessageA
SetTimer
KillTimer
PeekMessageA
PostQuitMessage
GetDesktopWindow
MessageBoxA
wvsprintfA
wsprintfA

advapi32

GetTokenInformation
LogonUserA
ImpersonateLoggedOnUser
RevertToSelf
GetUserNameA
OpenProcessToken

Exports

Exports

ctl_adddomain
ctl_addoperator
ctl_bridgename
ctl_broadcast
ctl_broadcastdata
ctl_call
ctl_callremote
ctl_clearpin
ctl_clientpinrequest
ctl_clientstatus
ctl_close
ctl_closeremote
ctl_connected
ctl_controlpinrequest
ctl_controlsendpin
ctl_escape
ctl_findslaves
ctl_findslaves2
ctl_findslavesex
ctl_getconnectivityinfo
ctl_getfailedreason
ctl_getfileinfo
ctl_getlocalipaddressinuse
ctl_getsession
ctl_hangup
ctl_helpreq
ctl_installed
ctl_licenseinfo
ctl_maxpacket
ctl_messageacknowledged
ctl_messagereceived
ctl_myaddr
ctl_netname
ctl_networks
ctl_nsessions
ctl_open
ctl_openremote
ctl_pause
ctl_pingnet
ctl_pittmanfunc
ctl_publishservice
ctl_publishserviceex
ctl_putfile
ctl_putfilelink
ctl_remotename
ctl_removedomain
ctl_removeoperator
ctl_send
ctl_sendif
ctl_sendto
ctl_subset
ctl_userstatus
ctl_version

Sections

.text
Size: 249KB - Virtual size: 249KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NSM.LIC
PCICHEK.DLL
.dll windows:5 windows x86 arch:x86

Password: infected

56e17186efeb24a70224bc24dced0a14

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12/01/2016, 00:00

Not After

21/09/2017, 23:59

Subject

CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12/01/2016, 00:00

Not After

21/09/2017, 23:59

Subject

CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

1c:85:f0:b4:e9:5d:96:97:1a:93:1d:23:61:fb:ff:03:12:06:47:1d:f0:67:be:ea:70:1e:7b:4b:bd:e4:42:fe
Signer

Actual PE Digest

1c:85:f0:b4:e9:5d:96:97:1a:93:1d:23:61:fb:ff:03:12:06:47:1d:f0:67:be:ea:70:1e:7b:4b:bd:e4:42:fe

Digest Algorithm

sha256

PE Digest Matches

true

73:b0:90:d4:ff:6d:5b:3c:de:16:aa:12:28:10:8e:c4:ba:c6:96:af
Signer

Actual PE Digest

73:b0:90:d4:ff:6d:5b:3c:de:16:aa:12:28:10:8e:c4:ba:c6:96:af

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ExitProcess
GetVersionExA
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess

user32

LoadStringA
wsprintfA
MessageBoxA

msvcr100

memset
_crt_debugger_hook

Exports

Exports

CheckLicenseString
IsILS

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 795B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PCICL32.DLL
.dll windows:5 windows x86 arch:x86

Password: infected

e88a5043d77a82981daefac5a519917e

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12/01/2016, 00:00

Not After

21/09/2017, 23:59

Subject

CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12/01/2016, 00:00

Not After

21/09/2017, 23:59

Subject

CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

e9:98:7b:c8:60:29:41:5c:d8:5b:09:48:eb:ae:47:8e:d5:c1:48:d0:f9:82:58:ff:10:b8:83:69:fe:79:b7:d7
Signer

Actual PE Digest

e9:98:7b:c8:60:29:41:5c:d8:5b:09:48:eb:ae:47:8e:d5:c1:48:d0:f9:82:58:ff:10:b8:83:69:fe:79:b7:d7

Digest Algorithm

sha256

PE Digest Matches

true

f7:0f:c1:22:f6:e1:a0:1e:82:57:07:cb:c8:a6:af:c0:ee:75:68:66
Signer

Actual PE Digest

f7:0f:c1:22:f6:e1:a0:1e:82:57:07:cb:c8:a6:af:c0:ee:75:68:66

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shfolder

SHGetFolderPathA

pcichek

IsILS
CheckLicenseString

pcicapi

CapiClose
CapiOpen
CapiListen
CapiHangup

mpr

WNetCancelConnection2A
WNetGetConnectionA
WNetAddConnection2A

comctl32

ImageList_Draw
ImageList_LoadImageA
ImageList_Destroy
ImageList_ReplaceIcon
ImageList_AddMasked
ImageList_GetImageCount
ord17
ImageList_DrawEx
ImageList_GetIconSize
ImageList_GetIcon
ImageList_Create

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

winmm

waveOutClose
waveOutReset
waveInClose
waveInUnprepareHeader
waveInReset
waveInStop
waveOutUnprepareHeader
waveInPrepareHeader
waveOutSetVolume
waveOutOpen
waveInStart
waveInOpen
waveOutWrite
waveOutPrepareHeader
timeGetTime
timeEndPeriod
timeBeginPeriod
PlaySoundA
waveInAddBuffer

wsock32

inet_addr
send
setsockopt
bind
listen
accept
htons
socket
connect
getpeername
gethostbyname
recv
shutdown
closesocket
WSACleanup
WSAStartup
WSAGetLastError
gethostname
htonl
ioctlsocket

kernel32

IsBadReadPtr
SizeofResource
CreateDirectoryA
RemoveDirectoryA
MoveFileA
MulDiv
GetDiskFreeSpaceA
GetCurrentDirectoryA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetVolumeInformationA
FileTimeToDosDateTime
FileTimeToLocalFileTime
OpenEventA
MultiByteToWideChar
OutputDebugStringA
SetCurrentDirectoryA
GetProcessHeap
GetTimeFormatW
GetDateFormatW
RaiseException
InitializeCriticalSectionAndSpinCount
WideCharToMultiByte
lstrlenW
lstrlenA
lstrcmpiA
FlushInstructionCache
lstrcmpA
FindResourceExA
TerminateThread
ReleaseMutex
WaitForSingleObjectEx
GlobalReAlloc
CreateNamedPipeA
ConnectNamedPipe
SetProcessShutdownParameters
SetConsoleCtrlHandler
IsDBCSLeadByteEx
DisconnectNamedPipe
WriteProfileStringA
DefineDosDeviceA
QueryDosDeviceA
ResumeThread
VirtualQueryEx
GetThreadContext
ReadProcessMemory
PulseEvent
CreateRemoteThread
SetThreadContext
PostQueuedCompletionStatus
CreateIoCompletionPort
GetQueuedCompletionStatus
Beep
GetSystemDefaultLangID
GetSystemInfo
SuspendThread
OpenThread
GetProcessVersion
GlobalGetAtomNameA
HeapReAlloc
RtlUnwind
DecodePointer
EncodePointer
InterlockedCompareExchange
HeapAlloc
HeapFree
FindResourceA
LoadResource
LockResource
VirtualProtectEx
WriteProcessMemory
GetExitCodeThread
CompareStringA
SetFilePointer
GetProfileStringA
GetOEMCP
GetShortPathNameA
TerminateProcess
SystemTimeToFileTime
CreateFileMappingA
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
CreatePipe
DuplicateHandle
SetHandleInformation
FormatMessageA
LocalFree
SetNamedPipeHandleState
GetPriorityClass
WinExec
SearchPathA
IsValidCodePage
SetSystemTime
_lopen
_lclose
DeleteFileA
SetFileAttributesA
GetSystemDirectoryA
GetDateFormatA
GetTimeFormatA
GlobalSize
SetUnhandledExceptionFilter
OpenMutexA
CreateMutexA
SetErrorMode
GetACP
SetPriorityClass
GetFileAttributesA
GetTempFileNameA
CopyFileA
FileTimeToSystemTime
GetComputerNameA
ExitProcess
GetModuleHandleA
GetExitCodeProcess
GetCurrentProcess
LoadLibraryExA
ExitThread
GetDriveTypeA
GetWindowsDirectoryA
IsDBCSLeadByte
GetLocalTime
GetFileSize
GlobalAlloc
GlobalLock
ReadFile
GlobalUnlock
GlobalFree
GetSystemPowerStatus
ExpandEnvironmentStringsA
FindFirstFileA
FindNextFileA
FindClose
GetUserDefaultUILanguage
GetUserDefaultLangID
GetModuleFileNameA
GetCurrentProcessId
CreateProcessA
DeleteCriticalSection
InitializeCriticalSection
GetVersion
CreateThread
SetThreadPriority
InterlockedIncrement
WaitForMultipleObjects
GetOverlappedResult
ResetEvent
InterlockedDecrement
LeaveCriticalSection
EnterCriticalSection
GetLastError
DeviceIoControl
InterlockedExchange
SetLastError
GetProcAddress
FreeLibrary
LoadLibraryA
CreateFileA
GetTempPathA
WriteFile
GetCurrentThreadId
CreateEventA
WaitForSingleObject
SetEvent
GlobalDeleteAtom
Sleep
GlobalAddAtomA
OpenProcess
GetVersionExA
GetTickCount
CloseHandle
GetSystemTimeAsFileTime
VirtualProtect
VirtualAlloc
GetModuleHandleW
VirtualQuery
GetConsoleMode
GetCommandLineA
LCMapStringW
GetCPInfo
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
GetStdHandle
GetModuleFileNameW
HeapSize
GetLocaleInfoW
SetHandleCount
GetFileType
GetStartupInfoW
GetConsoleCP
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
GetTimeZoneInformation
CreateFileW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
FlushFileBuffers
LoadLibraryW
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
InterlockedPushEntrySList
VirtualFree
InterlockedPopEntrySList
LocalAlloc

user32

GetScrollRange
CreateCursor
HideCaret
OemToCharBuffA
ScrollWindow
SetScrollPos
SetScrollRange
ClipCursor
DrawIconEx
RemoveMenu
SetActiveWindow
AdjustWindowRectEx
TrackPopupMenuEx
SetMenuDefaultItem
InsertMenuItemA
EndMenu
SetMenuInfo
GetMenuInfo
GetScrollInfo
SetScrollInfo
TileWindows
GetWindowRgn
GetAsyncKeyState
EnumThreadWindows
EnumDisplaySettingsA
CreateDesktopA
PostMessageW
OpenInputDesktop
GetMenuItemRect
mouse_event
MapVirtualKeyA
CharLowerBuffA
ShowCursor
SwitchDesktop
AttachThreadInput
GetCursor
CreateDialogIndirectParamA
DialogBoxIndirectParamA
DialogBoxParamA
SetClassLongA
MapDialogRect
CreateAcceleratorTableA
DestroyAcceleratorTable
RedrawWindow
InvalidateRgn
CharNextA
LoadAcceleratorsA
ScreenToClient
ModifyMenuA
CreateMenu
MoveWindow
SetCursorPos
DrawTextW
IsDialogMessageA
UnionRect
DrawFocusRect
wsprintfW
EndDialog
OpenWindowStationA
GetProcessWindowStation
SetProcessWindowStation
CloseWindowStation
MsgWaitForMultipleObjects
GetUserObjectSecurity
SetUserObjectSecurity
MessageBoxIndirectA
WinHelpA
UnhookWindowsHookEx
SetWindowsHookExA
CreateDialogParamA
GetLastActivePopup
CallNextHookEx
GetUpdateRect
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyCursor
GetActiveWindow
IsZoomed
CreatePopupMenu
AppendMenuA
CopyRect
EqualRect
ClientToScreen
DeferWindowPos
IsChild
GetWindowPlacement
TranslateAcceleratorA
SetRectEmpty
SetMenu
SetWindowPlacement
GetForegroundWindow
CharUpperBuffA
WindowFromPoint
WaitForInputIdle
GetUserObjectInformationA
GetCursorPos
CheckDlgButton
SetForegroundWindow
EnumChildWindows
RegisterClipboardFormatA
CountClipboardFormats
EnumClipboardFormats
GetClipboardData
IsClipboardFormatAvailable
GetClipboardFormatNameA
RegisterWindowMessageA
DestroyIcon
CharUpperA
ExitWindowsEx
GetDesktopWindow
MessageBoxA
keybd_event
GetThreadDesktop
SetThreadDesktop
wvsprintfA
CreateCaret
ShowCaret
DestroyCaret
UnregisterClassA
SetTimer
KillTimer
SetDlgItemTextA
SendMessageA
SendDlgItemMessageA
PostMessageA
ShowWindow
DefWindowProcA
CallWindowProcA
PostThreadMessageA
GetQueueStatus
GetDlgItem
GetDlgCtrlID
GetDC
ReleaseDC
InvalidateRect
GetKeyState
PeekMessageA
SetCaretPos
DrawMenuBar
GetSystemMenu
OpenClipboard
EmptyClipboard
SetClipboardData
MessageBeep
CloseClipboard
FindWindowExA
DeleteMenu
GetWindowTextLengthA
GetFocus
GetClassInfoExA
DestroyWindow
DefDlgProcA
RegisterClassExA
IsDlgButtonChecked
GetDlgItemTextA
IsIconic
GetMenu
SystemParametersInfoA
IntersectRect
GetCursorInfo
GetIconInfo
IsWindowVisible
GetWindow
SendMessageTimeoutA
GetClassLongA
CopyIcon
CopyImage
LoadImageA
OpenDesktopA
EnumDesktopWindows
CloseDesktop
EnumWindows
GetClassNameA
GetClassInfoA
LoadIconA
RegisterClassA
BringWindowToTop
GetMessageA
TranslateMessage
DispatchMessageA
SetPropA
GetPropA
RemovePropA
GetCapture
SetCapture
ReleaseCapture
CreateWindowExA
BeginPaint
EndPaint
wsprintfA
PostQuitMessage
GetMenuItemID
CheckMenuItem
EnableMenuItem
GetMenuItemInfoA
SetMenuItemInfoA
PtInRect
GetWindowDC
LoadMenuA
GetSubMenu
GetMenuItemCount
DestroyMenu
InflateRect
GetSystemMetrics
FindWindowA
GetWindowThreadProcessId
IsWindow
SetFocus
SetWindowPos
GetParent
GetWindowTextA
SetWindowTextA
GetWindowLongA
SetWindowLongA
MapWindowPoints
GetClientRect
DrawTextA
OffsetRect
IsWindowEnabled
SetRect
GetWindowRect
FillRect
LoadBitmapA
GetSysColor
SetCursor
LoadCursorA
UpdateWindow
EnableWindow
LoadStringA

gdi32

EndPage
StartPage
ExtEscape
ExtTextOutA
CreateDIBitmap
GetSystemPaletteEntries
RealizePalette
EqualRgn
CreateBrushIndirect
GetDCOrgEx
GetTextExtentPoint32A
SetBrushOrgEx
PatBlt
CreatePatternBrush
GetTextMetricsA
StretchBlt
GetDIBits
CreateDIBSection
GdiFlush
GetRegionData
CombineRgn
GetNearestPaletteIndex
GetBkMode
CreateFontIndirectW
SetBitmapBits
UnrealizeObject
SetDIBits
SetWindowOrgEx
AddFontResourceA
CreatePenIndirect
GetClipRgn
GetWindowOrgEx
IntersectClipRect
Arc
Chord
Pie
Polyline
RoundRect
SetPolyFillMode
SetTextJustification
SetTextCharacterExtra
SelectPalette
RemoveFontResourceA
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
GetObjectA
CreateRectRgn
CreateRectRgnIndirect
PtInRegion
RectInRegion
CreatePalette
GetPaletteEntries
GetTextColor
BitBlt
DeleteDC
RectVisible
SetRectRgn
DeleteObject
GetMapMode
SetMapMode
GetStretchBltMode
SetStretchBltMode
GetBitmapBits
BeginPath
TextOutA
EndPath
PathToRegion
GetRgnBox
OffsetRgn
FillRgn
FrameRgn
CreateBitmap
CreateDCA
SelectClipRgn
LineDDA
Polygon
CreateFontIndirectA
CreateHatchBrush
GetDeviceCaps
SetBkColor
ExtFloodFill
GetPixel
SetPixel
SetPixelV
Ellipse
Rectangle
SetROP2
MoveToEx
LineTo
GetStockObject
CreatePen
CreateSolidBrush
GetTextExtentPointA
SetBkMode
SetTextColor
GetBkColor

winspool.drv

EnumPrinterDriversA
DeletePrinter
AddPrinterA
EnumPrintersA
ord201
ord202
EnumJobsA
SetJobA
AbortPrinter
StartPagePrinter
WritePrinter
OpenPrinterA
ClosePrinter
StartDocPrinterA
EndPagePrinter
EndDocPrinter
GetPrinterA

comdlg32

ChooseFontA
PageSetupDlgA
GetOpenFileNameA
GetSaveFileNameA

advapi32

EnumServicesStatusA
RegisterServiceCtrlHandlerA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegCreateKeyA
SetTokenInformation
SetServiceStatus
StartServiceCtrlDispatcherA
LogonUserA
ControlService
StartServiceA
RegQueryInfoKeyW
CryptGetProvParam
CryptReleaseContext
AllocateLocallyUniqueId
FreeSid
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
LookupPrivilegeValueA
AdjustTokenPrivileges
QueryServiceConfigA
CreateProcessAsUserA
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetAclInformation
InitializeAcl
GetAce
AddAce
AddAccessAllowedAce
IsValidSid
GetLengthSid
CopySid
RegQueryInfoKeyA
RegDeleteKeyA
RegEnumKeyExA
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegFlushKey
RegOpenKeyExA
RegCloseKey
OpenSCManagerA
OpenServiceA
QueryServiceStatus
CloseServiceHandle
GetUserNameA
LookupPrivilegeNameA
RegQueryValueExA
GetTokenInformation
LookupAccountSidA
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
AllocateAndInitializeSid
EqualSid
RevertToSelf
OpenProcessToken
ImpersonateLoggedOnUser
GetUserNameW

shell32

ExtractIconExA
SHGetSpecialFolderPathA
SHGetFileInfoA
SHGetMalloc
SHGetDesktopFolder
SHGetPathFromIDListA
FindExecutableA
ExtractIconA
Shell_NotifyIconA
ShellExecuteA

ole32

CoUninitialize
CoInitialize
CoCreateInstance
CreateStreamOnHGlobal
StringFromGUID2
ReleaseStgMedium
OleDuplicateData
CreateDataAdviseHolder
CoTaskMemFree
CLSIDFromProgID
OleInitialize
OleUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoInitializeSecurity
CoInitializeEx
OleCreateStaticFromData
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
OleSetContainedObject
IIDFromString
CLSIDFromString
CoGetClassObject
OleLockRunning

oleaut32

LoadTypeLi
VariantCopy
OleLoadPicture
SysFreeString
SysAllocString
VariantClear
VariantInit
VariantChangeType
SysStringLen
SysAllocStringLen
VarUI4FromStr
OleCreateFontIndirect
LoadRegTypeLi
OleCreatePictureIndirect
SysStringByteLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayCreate

netapi32

NetApiBufferFree
NetUserEnum

wininet

InternetCrackUrlA

Exports

Exports

_GetRawWMIStringW@16
_GetWMIStringW@16
_IsAcerA@8
_NSMClient32@8
_NSMFindClass@12
br_close
br_open
br_poll
br_status

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 311KB - Virtual size: 310KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 21B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.hhshare
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 141KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
QualityUpdateAssistant.dll
.dll windows:10 windows x64 arch:x64

Password: infected

e6d97e7ad6ba61299f71ef76c678bd32

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:ff:44:f1:c6:e0:3d:12:ad:0a:ab:67:bc:e9:a8:87:fb:73:8d:75:8b:cf:82:9b:48:08:1b:38:60:c9:31:9b
Signer

Actual PE Digest

77:ff:44:f1:c6:e0:3d:12:ad:0a:ab:67:bc:e9:a8:87:fb:73:8d:75:8b:cf:82:9b:48:08:1b:38:60:c9:31:9b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__localtime64
_o__lock_file
_o__malloc_base
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__unlock_file
_o__wcsdup
_o__wcsicmp
_o__wcsupr_s
_o__wfsopen
memmove
_o__wtol
_o_abort
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgetwc
_o_fputwc
_o_free
_o_fsetpos
_o_fwrite
_o_malloc
_o_pow
_o_realloc
_o_setlocale
_o_setvbuf
_o_terminate
_o_ungetc
_o_ungetwc
_o_wcstol
_o_wcstoul
__C_specific_handler
_CxxThrowException
wcschr
_o__execute_onexit_table
_o__errno
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__crt_atexit
_o__configure_narrow_argv
wcsstr
strchr
__uncaught_exception
_o__cexit
_o__calloc_base
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_collate_cp_func
_o____lc_codepage_func
__CxxFrameHandler3
memcmp
_o__fseeki64
_o__free_base
memcpy

api-ms-win-crt-string-l1-1-0

wcsnlen
memset
wcsncmp
wcscmp

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetModuleFileNameA
LoadLibraryExA
GetModuleHandleExW
FreeLibrary
GetModuleHandleW
GetModuleFileNameW
GetProcAddress

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
InitOnceExecuteOnce
InitOnceBeginInitialize
Sleep
WakeConditionVariable
InitializeConditionVariable
SleepConditionVariableSRW
InitOnceComplete

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx
InitializeSRWLock
CreateEventExW
CreateMutexExW
ReleaseSRWLockExclusive
SetEvent
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
OpenSemaphoreW
AcquireSRWLockShared
CreateSemaphoreExW
WaitForSingleObjectEx
ReleaseSemaphore
WaitForSingleObject
ReleaseSRWLockShared
LeaveCriticalSection
DeleteCriticalSection
CreateMutexW
InitializeCriticalSection
ReleaseMutex

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
HeapDestroy
HeapSize

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
RaiseException
GetLastError
SetLastError
UnhandledExceptionFilter

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWriteTransfer
EventSetInformation

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
GetCurrentThreadId
CreateProcessW
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

LCMapStringEx
GetUserDefaultLocaleName
FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

SysFreeString
SysStringLen
VariantInit
VariantClear
SysAllocString

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetVersionExA
GetLocalTime
GetWindowsDirectoryW
GetSystemDirectoryW
GlobalMemoryStatusEx
GetSystemWindowsDirectoryW
GetSystemTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW
PathRemoveFileSpecW
PathFindFileNameW

api-ms-win-core-file-l1-1-0

FindNextFileW
FindClose
FindFirstFileW
GetFileSize
CompareFileTime
GetDiskFreeSpaceExW
GetFileAttributesW
DeleteFileW
CreateDirectoryW
CreateFileW

api-ms-win-eventing-controller-l1-1-0

StartTraceW
ControlTraceW
EnableTraceEx2

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegQueryInfoKeyW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegGetValueW
RegEnumValueW
RegDeleteTreeW
RegSetValueExW
RegOpenKeyExW

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-eventing-legacy-l1-1-0

QueryTraceW

api-ms-win-core-com-l1-1-0

CoUninitialize
CoTaskMemAlloc
CoGetApartmentType
CoCreateFreeThreadedMarshaler
CoInitializeEx
CLSIDFromString
CoWaitForMultipleHandles
CoCreateInstance
CoTaskMemRealloc
CoSetProxyBlanket
CoTaskMemFree

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree
GlobalFree

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpW

rpcrt4

UuidCreate

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus
MoveFileW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW
RegDeleteKeyValueW

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

shell32

SHGetSpecialFolderPathW

pdh

PdhAddCounterW
PdhOpenQueryW
PdhGetFormattedCounterValue
PdhCloseQuery
PdhCollectQueryData

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

_unlock_locales
_lock_locales

winhttp

WinHttpOpenRequest
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpQueryOption
WinHttpConnect
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpAddRequestHeaders
WinHttpCloseHandle
WinHttpOpen
WinHttpReceiveResponse

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW
GetFileVersionInfoW

crypt32

CertFreeCertificateChain
CertFreeCertificateContext
CryptStringToBinaryW
CertVerifyCertificateChainPolicy
CertGetCertificateChain

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateString
WindowsCreateStringReference
WindowsGetStringRawBuffer

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

ntdll

NtPowerInformation
RtlConvertDeviceFamilyInfoToString

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-kernel32-legacy-l1-1-1

PowerClearRequest
PowerCreateRequest
PowerSetRequest

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoTransformError

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
CompareStringEx

api-ms-win-security-cryptoapi-l1-1-0

CryptAcquireContextW
CryptDestroyHash
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptHashData

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
MapViewOfFile
CreateFileMappingW

wkscli

NetGetJoinInformation

netutils

NetApiBufferFree

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

user32

UnregisterClassA

netapi32

NetFreeAadJoinInformation
NetGetAadJoinInformation

wintrust

WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WinVerifyTrust

urlmon

URLDownloadToFileW

api-ms-win-crt-math-l1-1-0

ceilf

Exports

Exports

Execute

Sections

.text
Size: 303KB - Virtual size: 302KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TCCTL32.DLL
.dll windows:5 windows x86 arch:x86

Password: infected

2c4d798bb87ec57193b7625c4259da43

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12/01/2016, 00:00

Not After

21/09/2017, 23:59

Subject

CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12/01/2016, 00:00

Not After

21/09/2017, 23:59

Subject

CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

8f:ec:cd:2a:c3:24:de:bf:34:53:a4:ee:a7:d9:37:bf:a7:ed:0e:6c:ec:5f:1c:f3:ea:50:69:cc:cb:c8:7b:04
Signer

Actual PE Digest

8f:ec:cd:2a:c3:24:de:bf:34:53:a4:ee:a7:d9:37:bf:a7:ed:0e:6c:ec:5f:1c:f3:ea:50:69:cc:cb:c8:7b:04

Digest Algorithm

sha256

PE Digest Matches

true

13:46:de:36:a0:83:71:12:2e:47:55:89:99:d1:8d:7f:a0:45:c1:55
Signer

Actual PE Digest

13:46:de:36:a0:83:71:12:2e:47:55:89:99:d1:8d:7f:a0:45:c1:55

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime

kernel32

GetLastError
WriteFile
ReadFile
Sleep
ClearCommError
InterlockedIncrement
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
GetModuleFileNameA
DeleteCriticalSection
CloseHandle
TerminateThread
SetEvent
CreateEventA
GetTickCount
SetThreadPriority
CreateThread
SetCommTimeouts
InitializeCriticalSection
GetCommState
IsDBCSLeadByte
CompareStringA
GetProcAddress
LoadLibraryA
FreeLibrary
GetModuleHandleA
OutputDebugStringA
OpenProcess
GetCurrentProcessId
GetVersionExA
GetLocalTime
GetOverlappedResult
GetCurrentThreadId
ExitProcess
MultiByteToWideChar
WideCharToMultiByte
LocalAlloc
LocalFree
PulseEvent
InterlockedExchange
GetExitCodeThread
ResetEvent
GetVersion
SetLastError
EscapeCommFunction
GetCommModemStatus
CreateDirectoryA
GetDateFormatA
GetTimeFormatA
GetSystemTimeAsFileTime
lstrlenW
lstrlenA
CreateFileW
GetProcessHeap
SetEndOfFile
WriteConsoleW
CreateFileA
FlushFileBuffers
SetStdHandle
LoadLibraryW
GetLocaleInfoA
IsValidLocale
EnumSystemLocalesA
WaitForSingleObject
GetStringTypeW
FatalAppExitA
GetUserDefaultLCID
GetTempPathA
SetConsoleCtrlHandler
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleMode
GetConsoleCP
GetLocaleInfoW
HeapSize
SetFilePointer
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
HeapDestroy
HeapAlloc
HeapFree
RtlUnwind
HeapReAlloc
RaiseException
EncodePointer
DecodePointer
GetCommandLineA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetCurrentThread
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetStdHandle
GetModuleFileNameW
HeapCreate

user32

CharLowerA
PostThreadMessageA
PostMessageA
GetMessageA
TranslateMessage
DispatchMessageA
SetTimer
MessageBoxA
KillTimer
PeekMessageA
PostQuitMessage
wsprintfA
wvsprintfA

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
GetTokenInformation
GetUserNameA

oleaut32

SysAllocStringLen
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElemsize
SafeArrayAccessData
SafeArrayUnaccessData
VariantChangeType
VariantClear
SysStringByteLen
CreateErrorInfo
GetErrorInfo
SysAllocString
SetErrorInfo
SysFreeString
VariantInit

Exports

Exports

?RemoteNotify@@YAXP6GHHPAXPATCTL_CALLBACK@@@Z0@Z
ctl_bridgename
ctl_broadcastdata
ctl_call
ctl_callremote
ctl_close
ctl_closeremote
ctl_connected
ctl_escape
ctl_findslaves
ctl_findslavesex
ctl_getcodepage
ctl_getlocalipaddressinuse
ctl_getsession
ctl_hangup
ctl_helpreq
ctl_installed
ctl_maxpacket
ctl_myaddr
ctl_netname
ctl_networks
ctl_nsessions
ctl_open
ctl_openremote
ctl_pause
ctl_pingnet
ctl_remotename
ctl_send
ctl_sendex
ctl_sendif
ctl_sendname
ctl_sendto
ctl_subset
ctl_version

Sections

.text
Size: 305KB - Virtual size: 305KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
expediteupdater.exe
.exe windows:10 windows x64 arch:x64

Password: infected

da2cfb60f9d1d3f0a689150fa3fa6ea1

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5a:d7:84:9f:9a:29:59:34:85:86:31:70:4b:93:80:b3:47:47:2c:6d:1a:c8:51:6c:d1:d1:26:52:c9:e4:44:3a
Signer

Actual PE Digest

5a:d7:84:9f:9a:29:59:34:85:86:31:70:4b:93:80:b3:47:47:2c:6d:1a:c8:51:6c:d1:d1:26:52:c9:e4:44:3a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-crt-locale-l1-1-0

_lock_locales
_unlock_locales

api-ms-win-crt-string-l1-1-0

wcsnlen
memset

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_initterm
_initterm_e
_c_exit

api-ms-win-crt-private-l1-1-0

_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__lock_file
_o__malloc_base
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__unlock_file
_o__wcsdup
_o__wcsicmp
_o__wcsupr_s
_o__wtol
_o_abort
_o_exit
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgetwc
_o_fputwc
_o_free
_o_fsetpos
_o_fwrite
_o_malloc
_o_realloc
_o_setlocale
_o_setvbuf
_o_terminate
_o_ungetc
_o_ungetwc
_o_wcstok_s
_o_wcstoul
__uncaught_exception
__C_specific_handler
_CxxThrowException
_o__get_wide_winmain_command_line
_o__fseeki64
_o__free_base
_o__exit
_o__errno
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__calloc_base
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
_o___p__commode
_o___acrt_iob_func
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_collate_cp_func
_o____lc_codepage_func
strchr
wcschr
__CxxFrameHandler3
memcmp
memcpy
memmove

api-ms-win-core-file-l1-1-0

CreateDirectoryW
GetFileAttributesW
DeleteFileW

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleFileNameW
SizeofResource
LockResource
LoadResource
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
WakeConditionVariable
InitOnceComplete
Sleep
InitOnceBeginInitialize
InitOnceExecuteOnce
InitializeConditionVariable
WakeAllConditionVariable

api-ms-win-eventing-controller-l1-1-0

EnableTraceEx2
StartTraceW
ControlTraceW

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
TryAcquireSRWLockExclusive
CreateSemaphoreExW
ReleaseMutex
OpenSemaphoreW
InitializeCriticalSectionAndSpinCount
InitializeSRWLock
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
CreateMutexW
CreateMutexExW
ReleaseSemaphore
WaitForSingleObjectEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-eventing-legacy-l1-1-0

QueryTraceW

api-ms-win-core-com-l1-1-0

CoUninitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoInitializeEx
CoCreateInstance
CoSetProxyBlanket

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventSetInformation
EventUnregister

api-ms-win-core-shlwapi-legacy-l1-1-0

PathRemoveFileSpecW

api-ms-win-core-heap-l2-1-0

LocalAlloc
GlobalFree
LocalFree

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
GetStartupInfoW
TerminateProcess
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

LCMapStringEx
FormatMessageW
GetUserDefaultLocaleName

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

VariantInit
SysFreeString
SysStringLen
VariantClear
SysAllocString

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetWindowsDirectoryW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegEnumValueW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegGetValueW
RegCloseKey
RegQueryInfoKeyW
RegQueryValueExW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpIW

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

rpcrt4

UuidCreate

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
CompareStringEx

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

winhttp

WinHttpCloseHandle

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW
GetFileVersionInfoSizeW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateStringReference

ntdll

RtlGetVersion
RtlConvertDeviceFamilyInfoToString

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-crt-math-l1-1-0

ceilf

Sections

.text
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
msvcr100.dll
.dll windows:5 windows x86 arch:x86

Password: infected

5271d5ce8b44dd47bc92563e27585466

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:b2:9b:00:00:00:00:00:15
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

21/02/2011, 20:53

Not After

21/05/2012, 20:53

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

8d:91:f0:a3:ff:41:70:8c:67:d0:ba:79:6d:52:da:88:0c:59:23:cc
Signer

Actual PE Digest

8d:91:f0:a3:ff:41:70:8c:67:d0:ba:79:6d:52:da:88:0c:59:23:cc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

EncodePointer
DecodePointer
RaiseException
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetCurrentThreadId
TlsGetValue
GetCommandLineW
GetCommandLineA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ExitThread
CloseHandle
GetLastError
ResumeThread
CreateThread
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
FindNextFileA
FindFirstFileExA
FindClose
FindNextFileW
FindFirstFileExW
GetLogicalDrives
GetDiskFreeSpaceA
FileTimeToSystemTime
FileTimeToLocalFileTime
SetErrorMode
Sleep
Beep
GetFileAttributesA
SetFileAttributesA
SetEnvironmentVariableA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetCurrentDirectoryW
SetCurrentDirectoryW
GetFullPathNameA
GetDriveTypeW
GetCurrentProcessId
CreateDirectoryA
MoveFileA
RemoveDirectoryA
GetDriveTypeA
DeleteFileA
GetFileAttributesW
SetEnvironmentVariableW
SetFileAttributesW
GetFullPathNameW
CreateDirectoryW
MoveFileW
RemoveDirectoryW
DeleteFileW
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
LoadLibraryA
FreeLibrary
CreateProcessW
ReadFile
DuplicateHandle
GetCurrentProcess
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetLocalTime
WideCharToMultiByte
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
SetLocalTime
InterlockedPopEntrySList
InterlockedFlushSList
QueryDepthSList
InterlockedPushEntrySList
CreateTimerQueue
CreateTimerQueueTimer
DeleteTimerQueueTimer
SetEvent
CreateEventW
SwitchToThread
SignalObjectAndWait
TryEnterCriticalSection
GetTickCount
VirtualFree
GetVersionExW
SetThreadPriority
VirtualAlloc
GetSystemInfo
GetProcessAffinityMask
VirtualProtect
SetThreadAffinityMask
InitializeSListHead
ReleaseSemaphore
CreateSemaphoreW
WaitForMultipleObjects
GetThreadPriority
LoadLibraryW
SleepEx
OutputDebugStringW
FreeLibraryAndExitThread
GetModuleHandleA
GetThreadTimes
DebugBreak
MultiByteToWideChar
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeFormatA
GetDateFormatA
GetTimeFormatW
GetDateFormatW
RtlUnwind
HeapAlloc
HeapFree
HeapCreate
HeapDestroy
HeapQueryInformation
HeapReAlloc
HeapSize
HeapValidate
HeapCompact
HeapWalk
VirtualQuery
SetHandleCount
GetFileType
GetStartupInfoW
GetFileInformationByHandle
PeekNamedPipe
CreateFileA
CreateFileW
SetFilePointer
GetConsoleCP
GetConsoleMode
FlushFileBuffers
CreatePipe
SetStdHandle
ReadConsoleInputA
SetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
ReadConsoleInputW
WriteConsoleW
ReadConsoleW
SetEndOfFile
GetProcessHeap
InterlockedExchange
LockFile
UnlockFile
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
SetConsoleCtrlHandler
GetLocaleInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
LCMapStringW
CompareStringW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsProcessorFeaturePresent

Exports

Exports

$I10_OUTPUT
??0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z
??0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z
??0SchedulerPolicy@Concurrency@@QAA@IZZ
??0SchedulerPolicy@Concurrency@@QAE@ABV01@@Z
??0SchedulerPolicy@Concurrency@@QAE@XZ
??0_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ
??0_NonReentrantPPLLock@details@Concurrency@@QAE@XZ
??0_ReaderWriterLock@details@Concurrency@@QAE@XZ
??0_ReentrantBlockingLock@details@Concurrency@@QAE@XZ
??0_ReentrantLock@details@Concurrency@@QAE@XZ
??0_ReentrantPPLLock@details@Concurrency@@QAE@XZ
??0_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z
??0_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z
??0_SpinLock@details@Concurrency@@QAE@ACJ@Z
??0_TaskCollection@details@Concurrency@@QAE@XZ
??0_Timer@details@Concurrency@@IAE@I_N@Z
??0__non_rtti_object@std@@QAE@ABV01@@Z
??0__non_rtti_object@std@@QAE@PBD@Z
??0bad_cast@std@@AAE@PBQBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??0bad_target@Concurrency@@QAE@PBD@Z
??0bad_target@Concurrency@@QAE@XZ
??0bad_typeid@std@@QAE@ABV01@@Z
??0bad_typeid@std@@QAE@PBD@Z
??0context_self_unblock@Concurrency@@QAE@PBD@Z
??0context_self_unblock@Concurrency@@QAE@XZ
??0context_unblock_unbalanced@Concurrency@@QAE@PBD@Z
??0context_unblock_unbalanced@Concurrency@@QAE@XZ
??0critical_section@Concurrency@@QAE@XZ
??0default_scheduler_exists@Concurrency@@QAE@PBD@Z
??0default_scheduler_exists@Concurrency@@QAE@XZ
??0event@Concurrency@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABQBDH@Z
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??0improper_lock@Concurrency@@QAE@PBD@Z
??0improper_lock@Concurrency@@QAE@XZ
??0improper_scheduler_attach@Concurrency@@QAE@PBD@Z
??0improper_scheduler_attach@Concurrency@@QAE@XZ
??0improper_scheduler_detach@Concurrency@@QAE@PBD@Z
??0improper_scheduler_detach@Concurrency@@QAE@XZ
??0improper_scheduler_reference@Concurrency@@QAE@PBD@Z
??0improper_scheduler_reference@Concurrency@@QAE@XZ
??0invalid_link_target@Concurrency@@QAE@PBD@Z
??0invalid_link_target@Concurrency@@QAE@XZ
??0invalid_multiple_scheduling@Concurrency@@QAE@PBD@Z
??0invalid_multiple_scheduling@Concurrency@@QAE@XZ
??0invalid_operation@Concurrency@@QAE@PBD@Z
??0invalid_operation@Concurrency@@QAE@XZ
??0invalid_oversubscribe_operation@Concurrency@@QAE@PBD@Z
??0invalid_oversubscribe_operation@Concurrency@@QAE@XZ
??0invalid_scheduler_policy_key@Concurrency@@QAE@PBD@Z
??0invalid_scheduler_policy_key@Concurrency@@QAE@XZ
??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@PBD@Z
??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@XZ
??0invalid_scheduler_policy_value@Concurrency@@QAE@PBD@Z
??0invalid_scheduler_policy_value@Concurrency@@QAE@XZ
??0message_not_found@Concurrency@@QAE@PBD@Z
??0message_not_found@Concurrency@@QAE@XZ
??0missing_wait@Concurrency@@QAE@PBD@Z
??0missing_wait@Concurrency@@QAE@XZ
??0nested_scheduler_missing_detach@Concurrency@@QAE@PBD@Z
??0nested_scheduler_missing_detach@Concurrency@@QAE@XZ
??0operation_timed_out@Concurrency@@QAE@PBD@Z
??0operation_timed_out@Concurrency@@QAE@XZ
??0reader_writer_lock@Concurrency@@QAE@XZ
??0scheduler_not_attached@Concurrency@@QAE@PBD@Z
??0scheduler_not_attached@Concurrency@@QAE@XZ
??0scheduler_resource_allocation_error@Concurrency@@QAE@J@Z
??0scheduler_resource_allocation_error@Concurrency@@QAE@PBDJ@Z
??0scoped_lock@critical_section@Concurrency@@QAE@AAV12@@Z
??0scoped_lock@reader_writer_lock@Concurrency@@QAE@AAV12@@Z
??0scoped_lock_read@reader_writer_lock@Concurrency@@QAE@AAV12@@Z
??0task_canceled@details@Concurrency@@QAE@PBD@Z
??0task_canceled@details@Concurrency@@QAE@XZ
??0unsupported_os@Concurrency@@QAE@PBD@Z
??0unsupported_os@Concurrency@@QAE@XZ
??1SchedulerPolicy@Concurrency@@QAE@XZ
??1_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ
??1_ReentrantBlockingLock@details@Concurrency@@QAE@XZ
??1_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@XZ
??1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@XZ
??1_SpinLock@details@Concurrency@@QAE@XZ
??1_TaskCollection@details@Concurrency@@QAE@XZ
??1_Timer@details@Concurrency@@IAE@XZ
??1__non_rtti_object@std@@UAE@XZ
??1bad_cast@std@@UAE@XZ
??1bad_typeid@std@@UAE@XZ
??1critical_section@Concurrency@@QAE@XZ
??1event@Concurrency@@QAE@XZ
??1exception@std@@UAE@XZ
??1reader_writer_lock@Concurrency@@QAE@XZ
??1scoped_lock@critical_section@Concurrency@@QAE@XZ
??1scoped_lock@reader_writer_lock@Concurrency@@QAE@XZ
??1scoped_lock_read@reader_writer_lock@Concurrency@@QAE@XZ
??1type_info@@UAE@XZ
??2@YAPAXI@Z
??2@YAPAXIHPBDH@Z
??3@YAXPAX@Z
??4?$_SpinWait@$00@details@Concurrency@@QAEAAV012@ABV012@@Z
??4?$_SpinWait@$0A@@details@Concurrency@@QAEAAV012@ABV012@@Z
??4SchedulerPolicy@Concurrency@@QAEAAV01@ABV01@@Z
??4__non_rtti_object@std@@QAEAAV01@ABV01@@Z
??4bad_cast@std@@QAEAAV01@ABV01@@Z
??4bad_typeid@std@@QAEAAV01@ABV01@@Z
??4exception@std@@QAEAAV01@ABV01@@Z
??8type_info@@QBE_NABV0@@Z
??9type_info@@QBE_NABV0@@Z
??_7__non_rtti_object@std@@6B@
??_7bad_cast@std@@6B@
??_7bad_typeid@std@@6B@
??_7exception@@6B@
??_7exception@std@@6B@
??_F?$_SpinWait@$00@details@Concurrency@@QAEXXZ
??_F?$_SpinWait@$0A@@details@Concurrency@@QAEXXZ
??_Fbad_cast@std@@QAEXXZ
??_Fbad_typeid@std@@QAEXXZ
??_U@YAPAXI@Z
??_U@YAPAXIHPBDH@Z
??_V@YAXPAX@Z
?Alloc@Concurrency@@YAPAXI@Z
?Block@Context@Concurrency@@SAXXZ
?Create@CurrentScheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z
?Create@Scheduler@Concurrency@@SAPAV12@ABVSchedulerPolicy@2@@Z
?CreateResourceManager@Concurrency@@YAPAUIResourceManager@1@XZ
?CreateScheduleGroup@CurrentScheduler@Concurrency@@SAPAVScheduleGroup@2@XZ
?CurrentContext@Context@Concurrency@@SAPAV12@XZ
?Detach@CurrentScheduler@Concurrency@@SAXXZ
?DisableTracing@Concurrency@@YAJXZ
?EnableTracing@Concurrency@@YAJXZ
?Free@Concurrency@@YAXPAX@Z
?Get@CurrentScheduler@Concurrency@@SAPAVScheduler@2@XZ
?GetExecutionContextId@Concurrency@@YAIXZ
?GetNumberOfVirtualProcessors@CurrentScheduler@Concurrency@@SAIXZ
?GetOSVersion@Concurrency@@YA?AW4OSVersion@IResourceManager@1@XZ
?GetPolicy@CurrentScheduler@Concurrency@@SA?AVSchedulerPolicy@2@XZ
?GetPolicyValue@SchedulerPolicy@Concurrency@@QBEIW4PolicyElementKey@2@@Z
?GetProcessorCount@Concurrency@@YAIXZ
?GetProcessorNodeCount@Concurrency@@YAIXZ
?GetSchedulerId@Concurrency@@YAIXZ
?GetSharedTimerQueue@details@Concurrency@@YAPAXXZ
?Id@Context@Concurrency@@SAIXZ
?Id@CurrentScheduler@Concurrency@@SAIXZ
?IsCurrentTaskCollectionCanceling@Context@Concurrency@@SA_NXZ
?Log2@details@Concurrency@@YAKI@Z
?Oversubscribe@Context@Concurrency@@SAX_N@Z
?RegisterShutdownEvent@CurrentScheduler@Concurrency@@SAXPAX@Z
?ResetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXXZ
?ScheduleGroupId@Context@Concurrency@@SAIXZ
?ScheduleTask@CurrentScheduler@Concurrency@@SAXP6AXPAX@Z0@Z
?SetConcurrencyLimits@SchedulerPolicy@Concurrency@@QAEXII@Z
?SetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z
?SetPolicyValue@SchedulerPolicy@Concurrency@@QAEIW4PolicyElementKey@2@I@Z
?VirtualProcessorId@Context@Concurrency@@SAIXZ
?Yield@Context@Concurrency@@SAXXZ
?_Abort@_StructuredTaskCollection@details@Concurrency@@AAEXXZ
?_Acquire@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Acquire@_NonReentrantPPLLock@details@Concurrency@@QAEXPAX@Z
?_Acquire@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Acquire@_ReentrantLock@details@Concurrency@@QAEXXZ
?_Acquire@_ReentrantPPLLock@details@Concurrency@@QAEXPAX@Z
?_AcquireRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_AcquireWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_Cancel@_StructuredTaskCollection@details@Concurrency@@QAEXXZ
?_Cancel@_TaskCollection@details@Concurrency@@QAEXXZ
?_CheckTaskCollection@_UnrealizedChore@details@Concurrency@@IAEXXZ
?_ConcRT_Assert@details@Concurrency@@YAXPBD0H@Z
?_ConcRT_CoreAssert@details@Concurrency@@YAXPBD0H@Z
?_ConcRT_DumpMessage@details@Concurrency@@YAXPB_WZZ
?_ConcRT_Trace@details@Concurrency@@YAXHPB_WZZ
?_Copy_str@exception@std@@AAEXPBD@Z
?_DoYield@?$_SpinWait@$00@details@Concurrency@@IAEXXZ
?_DoYield@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ
?_IsCanceling@_StructuredTaskCollection@details@Concurrency@@QAE_NXZ
?_IsCanceling@_TaskCollection@details@Concurrency@@QAE_NXZ
?_Name_base@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_Name_base_internal@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_NumberOfSpins@?$_SpinWait@$00@details@Concurrency@@IAEKXZ
?_NumberOfSpins@?$_SpinWait@$0A@@details@Concurrency@@IAEKXZ
?_Release@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Release@_NonReentrantPPLLock@details@Concurrency@@QAEXXZ
?_Release@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Release@_ReentrantLock@details@Concurrency@@QAEXXZ
?_Release@_ReentrantPPLLock@details@Concurrency@@QAEXXZ
?_ReleaseRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_ReleaseWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_Reset@?$_SpinWait@$00@details@Concurrency@@IAEXXZ
?_Reset@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ
?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z
?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z
?_Schedule@_StructuredTaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z
?_Schedule@_TaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z
?_SetSpinCount@?$_SpinWait@$00@details@Concurrency@@QAEXI@Z
?_SetSpinCount@?$_SpinWait@$0A@@details@Concurrency@@QAEXI@Z
?_ShouldSpinAgain@?$_SpinWait@$00@details@Concurrency@@IAE_NXZ
?_ShouldSpinAgain@?$_SpinWait@$0A@@details@Concurrency@@IAE_NXZ
?_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QAE_NXZ
?_SpinOnce@?$_SpinWait@$0A@@details@Concurrency@@QAE_NXZ
?_SpinYield@Context@Concurrency@@SAXXZ
?_Start@_Timer@details@Concurrency@@IAEXXZ
?_Stop@_Timer@details@Concurrency@@IAEXXZ
?_Tidy@exception@std@@AAEXXZ
?_Trace_ppl_function@Concurrency@@YAXABU_GUID@@EW4ConcRT_EventType@1@@Z
?_TryAcquire@_NonReentrantBlockingLock@details@Concurrency@@QAE_NXZ
?_TryAcquire@_ReentrantBlockingLock@details@Concurrency@@QAE_NXZ
?_TryAcquire@_ReentrantLock@details@Concurrency@@QAE_NXZ
?_TryAcquireWrite@_ReaderWriterLock@details@Concurrency@@QAE_NXZ
?_Type_info_dtor@type_info@@CAXPAV1@@Z
?_Type_info_dtor_internal@type_info@@CAXPAV1@@Z
?_UnderlyingYield@details@Concurrency@@YAXXZ
?_ValidateExecute@@YAHP6GHXZ@Z
?_ValidateRead@@YAHPBXI@Z
?_ValidateWrite@@YAHPAXI@Z
?_Value@_SpinCount@details@Concurrency@@SAIXZ
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrCompare@@YA_NPBX0@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?_inconsistency@@YAXXZ
?_invalid_parameter@@YAXPBG00II@Z
?_is_exception_typeof@@YAHABVtype_info@@PAU_EXCEPTION_POINTERS@@@Z
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
?_open@@YAHPBDHH@Z
?_query_new_handler@@YAP6AHI@ZXZ
?_query_new_mode@@YAHXZ
?_set_new_handler@@YAP6AHI@ZH@Z
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_set_new_mode@@YAHH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?_sopen@@YAHPBDHHH@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?_wopen@@YAHPB_WHH@Z
?_wsopen@@YAHPB_WHHH@Z
?before@type_info@@QBEHABV1@@Z
?get_error_code@scheduler_resource_allocation_error@Concurrency@@QBEJXZ
?lock@critical_section@Concurrency@@QAEXXZ
?lock@reader_writer_lock@Concurrency@@QAEXXZ
?lock_read@reader_writer_lock@Concurrency@@QAEXXZ
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
?native_handle@critical_section@Concurrency@@QAEAAV12@XZ
?raw_name@type_info@@QBEPBDXZ
?reset@event@Concurrency@@QAEXXZ
?set@event@Concurrency@@QAEXXZ
?set_new_handler@@YAP6AXXZP6AXXZ@Z
?set_terminate@@YAP6AXXZH@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
?set_unexpected@@YAP6AXXZH@Z
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?swprintf@@YAHPAGIPBGZZ
?swprintf@@YAHPA_WIPB_WZZ
?terminate@@YAXXZ
?try_lock@critical_section@Concurrency@@QAE_NXZ
?try_lock@reader_writer_lock@Concurrency@@QAE_NXZ
?try_lock_read@reader_writer_lock@Concurrency@@QAE_NXZ
?unexpected@@YAXXZ
?unlock@critical_section@Concurrency@@QAEXXZ
?unlock@reader_writer_lock@Concurrency@@QAEXXZ
?vswprintf@@YAHPA_WIPB_WPAD@Z
?wait@Concurrency@@YAXI@Z
?wait@event@Concurrency@@QAEII@Z
?wait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z
?what@exception@std@@UBEPBDXZ
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_CRT_RTC_INIT
_CRT_RTC_INITW
_CreateFrameInfo
_CxxThrowException
_EH_prolog
_FindAndUnlinkFrame
_Getdays
_Getmonths
_Gettnames
_HUGE
_IsExceptionObjectToBeDestroyed
_NLG_Dispatch2
_NLG_Return
_NLG_Return2
_Strftime
_XcptFilter
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__CppXcptFilter
__CxxCallUnwindDelDtor
__CxxCallUnwindDtor
__CxxCallUnwindStdDelDtor
__CxxCallUnwindVecDtor
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__STRINGTOLD
__STRINGTOLD_L
__TypeMatch
___fls_getvalue@4
___fls_setvalue@8
___lc_codepage_func
___lc_collate_cp_func
___lc_handle_func
___mb_cur_max_func
___mb_cur_max_l_func
___setlc_active_func
___unguarded_readlc_active_add_func
__argc
__argv
__badioinfo
__clean_type_info_names_internal
__control87_2
__create_locale
__crtCompareStringA
__crtCompareStringW
__crtLCMapStringA
__crtLCMapStringW
__daylight
__dllonexit
__doserrno
__dstbias
__fpecode
__free_locale
__get_current_locale
__get_flsindex
__get_tlsindex
__getmainargs
__initenv
__iob_func
__isascii
__iscsym
__iscsymf
__iswcsym
__iswcsymf
__lconv
__lconv_init
__libm_sse2_acos
__libm_sse2_acosf
__libm_sse2_asin
__libm_sse2_asinf
__libm_sse2_atan
__libm_sse2_atan2
__libm_sse2_atanf
__libm_sse2_cos
__libm_sse2_cosf
__libm_sse2_exp
__libm_sse2_expf
__libm_sse2_log
__libm_sse2_log10
__libm_sse2_log10f
__libm_sse2_logf
__libm_sse2_pow
__libm_sse2_powf
__libm_sse2_sin
__libm_sse2_sinf
__libm_sse2_tan
__libm_sse2_tanf
__mb_cur_max
__p___argc
__p___argv
__p___initenv
__p___mb_cur_max
__p___wargv
__p___winitenv
__p__acmdln
__p__commode
__p__daylight
__p__dstbias
__p__environ
__p__fmode
__p__iob
__p__mbcasemap
__p__mbctype
__p__pctype
__p__pgmptr
__p__pwctype
__p__timezone
__p__tzname
__p__wcmdln
__p__wenviron
__p__wpgmptr
__pctype_func
__pioinfo
__pwctype_func
__pxcptinfoptrs
__report_gsfailure
__set_app_type
__set_flsgetvalue
__setlc_active
__setusermatherr
__strncnt
__swprintf_l
__sys_errlist
__sys_nerr
__threadhandle
__threadid
__timezone
__toascii
__tzname
__unDName
__unDNameEx
__unDNameHelper
__uncaught_exception
__unguarded_readlc_active
__vswprintf_l
__wargv
__wcserror
__wcserror_s
__wcsncnt
__wgetmainargs
__winitenv
_abnormal_termination
_abs64
_access
_access_s
_acmdln
_aligned_free
_aligned_malloc
_aligned_msize
_aligned_offset_malloc
_aligned_offset_realloc
_aligned_offset_recalloc
_aligned_realloc
_aligned_recalloc
_amsg_exit
_assert
_atodbl
_atodbl_l
_atof_l
_atoflt
_atoflt_l
_atoi64
_atoi64_l
_atoi_l
_atol_l
_atoldbl
_atoldbl_l
_beep
_beginthread
_beginthreadex
_byteswap_uint64
_byteswap_ulong
_byteswap_ushort
_c_exit
_cabs
_callnewh
_calloc_crt
_cexit
_cgets
_cgets_s
_cgetws
_cgetws_s
_chdir
_chdrive
_chgsign
_chkesp
_chmod
_chsize
_chsize_s
_clearfp
_close
_commit
_commode
_configthreadlocale
_control87
_controlfp
_controlfp_s
_copysign
_cprintf
_cprintf_l
_cprintf_p

Sections

.text
Size: 709KB - Virtual size: 708KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nskbfltr.inf
pcicapi.dll
.dll windows:5 windows x86 arch:x86

Password: infected

d78463f91aa83e9c39d2e594035ae4bb

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12/01/2016, 00:00

Not After

21/09/2017, 23:59

Subject

CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12/01/2016, 00:00

Not After

21/09/2017, 23:59

Subject

CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

3d:b6:09:02:28:e8:91:ba:e3:c0:b6:7b:de:e7:37:ed:39:79:47:84:74:cf:7c:5d:2d:36:3d:d8:2c:05:0b:fb
Signer

Actual PE Digest

3d:b6:09:02:28:e8:91:ba:e3:c0:b6:7b:de:e7:37:ed:39:79:47:84:74:cf:7c:5d:2d:36:3d:d8:2c:05:0b:fb

Digest Algorithm

sha256

PE Digest Matches

true

9c:33:79:f7:f1:bd:90:f4:a1:94:37:e4:f2:5a:58:25:b4:bb:94:cc
Signer

Actual PE Digest

9c:33:79:f7:f1:bd:90:f4:a1:94:37:e4:f2:5a:58:25:b4:bb:94:cc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
GetModuleHandleA
OutputDebugStringA
LoadLibraryA
FreeLibrary
CloseHandle
OpenProcess
GetCurrentProcessId
CreateEventA
InterlockedIncrement
GetVersionExA
GetLocalTime
GetTempPathA
GetCurrentThreadId
GetTickCount
GetLastError
ExitProcess
SetLastError
DisableThreadLibraryCalls
GetModuleFileNameA
LeaveCriticalSection
EnterCriticalSection
SetEvent
InterlockedDecrement
WaitForSingleObject
DeleteCriticalSection
CreateThread
InitializeCriticalSection
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
Sleep
IsDBCSLeadByte

user32

GetMessageA
TranslateMessage
DispatchMessageA
SetTimer
MessageBoxA
KillTimer
PeekMessageA
PostQuitMessage
wvsprintfA
wsprintfA

advapi32

GetTokenInformation
OpenProcessToken

msvcr100

strncpy
_except_handler4_common
strrchr
isdigit
fclose
fopen
strncat
fputs
memset
memcpy
_malloc_crt
free
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit

Exports

Exports

CapiClose
CapiConnected
CapiDial
CapiHangup
CapiListen
CapiNotify
CapiOpen
CapiOpen2
CapiRead
CapiSend

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
remcmdstub.exe
.exe windows:4 windows x86 arch:x86

47fd9e27a90c5418f2563fefa3fed45c

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2e:6f:9f:ff:bb:2a:f5:b9:cb:05:59:84:7d:5e:59:74
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

08/07/2009, 00:00

Not After

21/08/2011, 23:59

Subject

CN=NetSupport Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=NetSupport,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetOEMCP
WaitForSingleObject
Sleep
WriteFile
GetExitCodeProcess
GenerateConsoleCtrlEvent
WaitForMultipleObjects
CloseHandle
CreateProcessA
SetLastError
GetProcAddress
LoadLibraryA
SetConsoleCtrlHandler
GetLastError
SetConsoleMode
GetConsoleMode
GetStdHandle
ExpandEnvironmentStringsA
GetVersionExA
GetModuleFileNameA
GetEnvironmentStrings
GetEnvironmentStringsW
SetFilePointer
FlushFileBuffers
SetStdHandle
GetCommandLineA
GetVersion
ExitProcess
GetCPInfo
GetACP
FreeLibrary
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
VirtualFree
HeapCreate
SetHandleCount
GetFileType
GetStartupInfoA
GetModuleHandleA
GetEnvironmentVariableA
HeapDestroy
HeapReAlloc
HeapFree
RtlUnwind
GetStringTypeA
GetStringTypeW
HeapAlloc
VirtualAlloc

user32

EnumThreadWindows
SendMessageA
EnumWindows
GetClassNameA

Sections

.text
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
sedplugins.dll
.dll windows:10 windows x64 arch:x64

a1ac2e9e84558e103f9242fdbf2c5788

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:10:bd:50:5a:67:88:9f:b7:93:31:85:5f:8f:96:04:47:64:d3:42:ea:67:25:65:cf:18:58:e3:2d:7b:31:19
Signer

Actual PE Digest

0f:10:bd:50:5a:67:88:9f:b7:93:31:85:5f:8f:96:04:47:64:d3:42:ea:67:25:65:cf:18:58:e3:2d:7b:31:19

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

api-ms-win-crt-locale-l1-1-0

_lock_locales
_unlock_locales

api-ms-win-crt-string-l1-1-0

memset
wcsnlen
wcsncmp

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__localtime64
_o__lock_file
_o__mktime64
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__unlock_file
_o__wcsdup
_o__wcsicmp
_o__wcsnicmp
_o__wcstoi64
_o__wcsupr_s
_o__wfsopen
_o__wtoi
_o__wtol
_o_abort
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgetwc
_o_fputwc
_o_free
_o_fsetpos
_o_fwrite
_o_malloc
_o_pow
_o_realloc
_o_round
_o_setlocale
_o_setvbuf
_o_strncpy_s
_o_strtol
_o_terminate
_o_towlower
_o_ungetc
_o_ungetwc
_o_wcstombs
_o_wcstoul
__uncaught_exception
__C_specific_handler
_CxxThrowException
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
wcsstr
_o__fseeki64
_o__execute_onexit_table
_o__errno
_o__difftime64
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__calloc_base
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_collate_cp_func
_o____lc_codepage_func
strrchr
strchr
wcschr
__CxxFrameHandler3
memcmp
memcpy
memmove

api-ms-win-core-file-l1-1-0

CreateDirectoryW
GetFileSize
FindNextFileW
FindFirstFileW
FindClose
CreateFileW
CompareFileTime
GetDiskFreeSpaceExW
FileTimeToLocalFileTime
DeleteFileW
SetFileAttributesW
RemoveDirectoryW
GetTempFileNameW
WriteFile
GetFileAttributesW

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetModuleFileNameA
SizeofResource
GetModuleHandleW
GetModuleHandleExW
LoadResource
LoadLibraryExW
FreeLibrary
GetModuleHandleA
GetProcAddress
LoadLibraryExA
LockResource

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitializeConditionVariable
Sleep
WakeConditionVariable
WakeAllConditionVariable
InitOnceExecuteOnce
InitOnceBeginInitialize
SleepConditionVariableSRW

api-ms-win-eventing-controller-l1-1-0

StartTraceW
ControlTraceW
EnableTraceEx2

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegDeleteTreeW
RegEnumValueW
RegGetValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteValueW
RegQueryValueExW
RegSetValueExW

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
OpenSemaphoreW
InitializeCriticalSectionEx
AcquireSRWLockExclusive
CreateEventExW
ReleaseSRWLockShared
InitializeCriticalSection
DeleteCriticalSection
InitializeSRWLock
WaitForSingleObjectEx
AcquireSRWLockShared
CreateSemaphoreExW
ReleaseSRWLockExclusive
ReleaseMutex
ReleaseSemaphore
WaitForSingleObject
CreateMutexW
TryAcquireSRWLockExclusive
CreateMutexExW
SetEvent

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapDestroy
HeapReAlloc
HeapSize
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
RaiseException
SetLastError

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-com-l1-1-0

CoSetProxyBlanket
CoTaskMemAlloc
CLSIDFromString
CoTaskMemRealloc
CoUninitialize
CoTaskMemFree
CoGetApartmentType
CoWaitForMultipleHandles
CoCreateInstance
CoCreateGuid
CoInitializeEx
CoCreateFreeThreadedMarshaler

api-ms-win-eventing-legacy-l1-1-0

QueryTraceW

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventRegister
EventSetInformation

api-ms-win-core-shlwapi-legacy-l1-1-0

PathRemoveFileSpecW
PathFileExistsW

api-ms-win-core-heap-l2-1-0

LocalAlloc
GlobalFree
LocalFree

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
CreateProcessW
GetCurrentThreadId
TerminateProcess
GetExitCodeProcess
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetSystemWindowsDirectoryW
GlobalMemoryStatusEx
GetSystemTimeAsFileTime
GetSystemInfo
GetSystemTime
GetWindowsDirectoryW
GetSystemDirectoryW
GetVersionExW
GetVersionExA

api-ms-win-core-localization-l1-2-0

GetUserDefaultLocaleName
FormatMessageW
LCMapStringEx

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

SysFreeString
VariantClear
VariantChangeType
SysStringLen
VariantTimeToSystemTime
VariantInit
SysAllocString

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW
RegSetKeyValueW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW
lstrcmpiW

rpcrt4

UuidCreate

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW
GetSystemPowerStatus

api-ms-win-core-string-l1-1-0

GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-memory-l1-1-0

MapViewOfFile
UnmapViewOfFile
CreateFileMappingW

shell32

SHGetSpecialFolderPathW

api-ms-win-crt-time-l1-1-0

_time64

winhttp

WinHttpQueryOption
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpSendRequest
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpReadData
WinHttpAddRequestHeaders
WinHttpConnect
WinHttpSetTimeouts
WinHttpReceiveResponse

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW
GetFileVersionInfoW

crypt32

CertGetCertificateChain
CertFreeCertificateContext
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CryptStringToBinaryW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo
GetNativeSystemInfo

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsDeleteString

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

ntdll

NtPowerInformation
NtQueryVolumeInformationFile
RtlConvertDeviceFamilyInfoToString

api-ms-win-core-kernel32-legacy-l1-1-1

PowerSetRequest
PowerCreateRequest
PowerClearRequest

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW

api-ms-win-service-management-l1-1-0

OpenServiceW
OpenSCManagerW
CloseServiceHandle

api-ms-win-service-management-l2-1-0

ChangeServiceConfigW
QueryServiceConfigW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus
ControlService

api-ms-win-core-libraryloader-l1-2-1

FindResourceW
LoadLibraryW

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec
PathCchCombine

netutils

NetApiBufferFree

api-ms-win-core-file-l1-2-1

GetCompressedFileSizeW

api-ms-win-core-winrt-error-l1-1-0

RoTransformError
RoOriginateError

wkscli

NetGetJoinInformation

iphlpapi

IcmpSendEcho
IcmpCreateFile

ws2_32

getaddrinfo
WSAStartup
inet_addr
inet_ntoa

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

shlwapi

PathIsDirectoryW

user32

UnregisterClassA

netapi32

NetFreeAadJoinInformation
NetGetAadJoinInformation

wintrust

WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WinVerifyTrust

api-ms-win-security-cryptoapi-l1-1-0

CryptCreateHash
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptAcquireContextW

setupapi

SetupIterateCabinetW

wininet

InternetCloseHandle
InternetReadFile
HttpQueryInfoW
InternetOpenW
InternetOpenUrlW

api-ms-win-crt-math-l1-1-0

ceilf

Exports

Exports

CheckShellTask
EnumeratePlugins
EnumeratePluginsWithApplicationSource
ExecuteShell
GetPluginDefaultSettings
GetSettingsName
Plugin_DetectCondition
Plugin_Init
Plugin_IsActionApplicable
Plugin_IsEnabled
Plugin_IsInteractiveOnly
Plugin_PerformAction
Plugin_Process
Plugin_Process_Aqua
Plugin_Uninit
RegisterApplication
SedimentDriver_Init
SedimentDriver_Init_Aqua
SedimentDriver_Uninit

Sections

.text
Size: 375KB - Virtual size: 374KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 168KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
uhssvc.exe
.exe windows:10 windows x64 arch:x64

1907f38be5d352a4d87e957bcd9a5264

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

26:d1:7d:cd:27:e7:b3:ff:1d:82:74:51:11:18:bd:c5:89:94:c0:fb:81:1b:ad:17:f4:53:e7:ab:39:76:4f:ca
Signer

Actual PE Digest

26:d1:7d:cd:27:e7:b3:ff:1d:82:74:51:11:18:bd:c5:89:94:c0:fb:81:1b:ad:17:f4:53:e7:ab:39:76:4f:ca

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-crt-locale-l1-1-0

_lock_locales
_unlock_locales

api-ms-win-crt-string-l1-1-0

__strncnt
memset
wcsnlen

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_c_exit
_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__lock_file
_o__malloc_base
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__unlock_file
_o__wcsdup
_o__wcsicmp
_o__wcsupr_s
_o__wtoi
_o_abort
_o_exit
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fputc
_o_fread
_o_free
_o_fsetpos
_o_fwrite
_o_islower
_o_isupper
_o_malloc
_o_mbstowcs
_o_rand
_o_setlocale
_o_setvbuf
_o_srand
_o_terminate
_o_towlower
_o_towupper
_o_ungetc
_o_wcstok_s
_o_wcstol
_o_wcstoul
__uncaught_exception
__C_specific_handler
_CxxThrowException
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_wide_environment
_o__initialize_onexit_table
_o__get_stream_buffer_pointers
_o__get_initial_wide_environment
_o__fseeki64
_o__free_base
wcsstr
_o__exit
_o__errno
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__calloc_base
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnprintf_s
_o___stdio_common_vfwprintf
_o___stdio_common_vfprintf
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
_o___p__commode
_o___p___wargv
_o___p___argc
_o___acrt_iob_func
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_codepage_func
wcschr
__CxxFrameHandler3
memcmp
memcpy
memmove

api-ms-win-core-file-l1-1-0

DeleteFileW
CreateDirectoryW
GetFileAttributesW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetProcAddress
SizeofResource
GetModuleFileNameW
GetModuleFileNameA
LoadResource
LockResource
FreeLibrary
LoadLibraryExW
GetModuleHandleW

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
InitOnceBeginInitialize
Sleep
InitOnceComplete

api-ms-win-eventing-controller-l1-1-0

ControlTraceW
StartTraceW
EnableTraceEx2

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegEnumValueW
RegOpenKeyExW
RegDeleteTreeW
RegGetValueW
RegDeleteValueW
RegQueryValueExW
RegCloseKey

api-ms-win-core-synch-l1-1-0

CreateMutexW
WaitForSingleObject
CreateSemaphoreExW
CreateEventExW
ReleaseMutex
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
CreateEventW
OpenSemaphoreW
CreateMutexExW
SetEvent
ReleaseSemaphore
WaitForSingleObjectEx

api-ms-win-core-heap-l1-1-0

HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
RaiseException

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
CreateProcessW
GetExitCodeProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-eventing-legacy-l1-1-0

QueryTraceW

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoInitializeEx
CoTaskMemFree
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoWaitForMultipleHandles
CoUninitialize
CoTaskMemRealloc

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-service-core-l1-1-0

SetServiceStatus
StartServiceCtrlDispatcherW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventUnregister
EventSetInformation

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW
PathRemoveFileSpecW
PathFileExistsW

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW

api-ms-win-core-heap-l2-1-0

GlobalFree
LocalFree
LocalAlloc

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetUserDefaultLocaleName
LCMapStringEx

api-ms-win-service-winsvc-l1-1-0

ControlService
RegisterServiceCtrlHandlerW
QueryServiceStatus

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

SysFreeString
SysAllocString
VariantClear
VariantInit

api-ms-win-core-sysinfo-l1-1-0

GetWindowsDirectoryW
GetSystemDirectoryW
GetLocalTime
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
GetSystemTime
GetVersionExA

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW
lstrcmpiW

rpcrt4

UuidCreate

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW

api-ms-win-service-management-l1-1-0

CloseServiceHandle
DeleteService
CreateServiceW
OpenServiceW
OpenSCManagerW

api-ms-win-core-string-l1-1-0

GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-crt-time-l1-1-0

_time64

winhttp

WinHttpCloseHandle
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpReadData
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpConnect
WinHttpOpen
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpSetOption

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW
GetFileVersionInfoW

crypt32

CertVerifyCertificateChainPolicy

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo
GetProductInfo

api-ms-win-core-winrt-string-l1-1-0

WindowsCompareStringOrdinal
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsCreateString
WindowsDeleteString

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

ntdll

RtlConvertDeviceFamilyInfoToString
RtlGetVersion
NtDeleteWnfStateName

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpIW

netapi32

NetGetAadJoinInformation
NetFreeAadJoinInformation

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
FindResourceW

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec
PathCchCombine

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain

api-ms-win-crt-math-l1-1-0

ceilf

Sections

.text
Size: 205KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
unifiedinstaller.dll
.dll windows:10 windows x64 arch:x64

0d7aa914c886b803ea8f25e24b902644

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

57:4a:e5:87:b3:45:32:dc:55:da:1c:3b:ed:33:cc:61:c1:19:07:80:67:86:c7:8b:4a:ce:46:ab:f1:74:fa:bd
Signer

Actual PE Digest

57:4a:e5:87:b3:45:32:dc:55:da:1c:3b:ed:33:cc:61:c1:19:07:80:67:86:c7:8b:4a:ce:46:ab:f1:74:fa:bd

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
memmove
_o__wtoi
_o_free
_o_malloc
_o_mbstowcs
_o_terminate
_o_towlower
_o_towupper
_o_wcstoul
__C_specific_handler
_CxxThrowException
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcschr
__CxxFrameHandler3
memcmp
memcpy
_o__wcsupr_s

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
LoadLibraryExA
GetProcAddress
GetModuleHandleExW
FreeLibrary
LoadLibraryExW

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
OpenSemaphoreW
CreateEventExW
WaitForSingleObject
CreateMutexExW
CreateMutexW
ReleaseSemaphore
DeleteCriticalSection
InitializeCriticalSectionEx
SetEvent
CreateSemaphoreExW
ReleaseMutex

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree
HeapSize
HeapReAlloc
HeapDestroy

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetUserDefaultLocaleName

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-file-l1-1-0

GetFileAttributesW
CreateDirectoryW
DeleteFileW

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
Sleep
InitOnceComplete

api-ms-win-eventing-controller-l1-1-0

EnableTraceEx2
StartTraceW
ControlTraceW

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegDeleteTreeW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegDeleteValueW
RegCloseKey

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-eventing-legacy-l1-1-0

QueryTraceW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventSetInformation
EventWriteTransfer

api-ms-win-core-shlwapi-legacy-l1-1-0

PathRemoveFileSpecW
PathFileExistsW

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc
GlobalFree

oleaut32

VariantClear

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetWindowsDirectoryW
GetSystemDirectoryW
GetVersionExA

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

rpcrt4

UuidCreate

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

msi

MsiGetPropertyW
MsiCloseHandle
MsiProcessMessage
MsiRecordSetStringW
MsiCreateRecord

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW
GetFileVersionInfoW

api-ms-win-service-management-l1-1-0

StartServiceW
OpenServiceW
CloseServiceHandle
OpenSCManagerW

api-ms-win-service-management-l2-1-0

ChangeServiceConfigW
QueryServiceConfig2W
ChangeServiceConfig2W

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

ntdll

RtlConvertDeviceFamilyInfoToString
NtDeleteWnfStateName

wkscli

NetGetJoinInformation

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo
GetProductInfo

netutils

NetApiBufferFree

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference
WindowsCompareStringOrdinal

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

winhttp

WinHttpReadData
WinHttpCloseHandle
WinHttpSendRequest
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpSetOption
WinHttpConnect
WinHttpSetTimeouts
WinHttpReceiveResponse
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpQueryHeaders

api-ms-win-core-util-l1-1-0

DecodePointer

shell32

SHGetSpecialFolderPathW

netapi32

NetGetAadJoinInformation
NetFreeAadJoinInformation

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-crt-math-l1-1-0

ceilf

Exports

Exports

InstallHealthTools
SavePackageInformation
UnInstallPackage

Sections

.text
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

6ba08298dd09ea8e41ab7285d3183bba

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

49:9a:ad:c7:dc:6b:64:28:d9:9b:28:3b:14:85:83:63:08:60:5c:14:e0:60:b3:f1:ce:19:61:68:8b:29:63:f5Signer

55:a2:2c:85:ec:8b:5f:16:52:a8:7d:e3:fd:3a:49:f5:1f:08:59:26Signer

Headers

DLL Characteristics

File Characteristics

Imports

wsock32

winmm

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 249KB - Virtual size: 249KB

.rdata Size: 35KB - Virtual size: 34KB

.data Size: 10KB - Virtual size: 25KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 12KB

Password: infected

56e17186efeb24a70224bc24dced0a14

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

1c:85:f0:b4:e9:5d:96:97:1a:93:1d:23:61:fb:ff:03:12:06:47:1d:f0:67:be:ea:70:1e:7b:4b:bd:e4:42:feSigner

73:b0:90:d4:ff:6d:5b:3c:de:16:aa:12:28:10:8e:c4:ba:c6:96:afSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcr100

Exports

Exports

Sections

.text Size: 1KB - Virtual size: 1KB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

49:9a:ad:c7:dc:6b:64:28:d9:9b:28:3b:14:85:83:63:08:60:5c:14:e0:60:b3:f1:ce:19:61:68:8b:29:63:f5
Signer

55:a2:2c:85:ec:8b:5f:16:52:a8:7d:e3:fd:3a:49:f5:1f:08:59:26
Signer

.text
Size: 249KB - Virtual size: 249KB

.rdata
Size: 35KB - Virtual size: 34KB

.data
Size: 10KB - Virtual size: 25KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 12KB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

1c:85:f0:b4:e9:5d:96:97:1a:93:1d:23:61:fb:ff:03:12:06:47:1d:f0:67:be:ea:70:1e:7b:4b:bd:e4:42:fe
Signer

73:b0:90:d4:ff:6d:5b:3c:de:16:aa:12:28:10:8e:c4:ba:c6:96:af
Signer

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 795B

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 512B - Virtual size: 268B

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

e9:98:7b:c8:60:29:41:5c:d8:5b:09:48:eb:ae:47:8e:d5:c1:48:d0:f9:82:58:ff:10:b8:83:69:fe:79:b7:d7
Signer

f7:0f:c1:22:f6:e1:a0:1e:82:57:07:cb:c8:a6:af:c0:ee:75:68:66
Signer

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 311KB - Virtual size: 310KB

.data
Size: 47KB - Virtual size: 73KB

.tls
Size: 512B - Virtual size: 21B

.hhshare
Size: 512B - Virtual size: 28B

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

.reloc
Size: 141KB - Virtual size: 140KB

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

77:ff:44:f1:c6:e0:3d:12:ad:0a:ab:67:bc:e9:a8:87:fb:73:8d:75:8b:cf:82:9b:48:08:1b:38:60:c9:31:9b
Signer