c1969988cbd9c9d86853e5bb4786d2cc97adbb6f22647183163c475ff6fed737

Sharing

Copy URL Twitter E-mail

General

Target

c1969988cbd9c9d86853e5bb4786d2cc97adbb6f22647183163c475ff6fed737
Size

66KB
MD5

ea0c548eb508f074e47f324962d9ae00
SHA1

1d2e7d119e15740ead5b3843d793e3ebcc740c55
SHA256

c1969988cbd9c9d86853e5bb4786d2cc97adbb6f22647183163c475ff6fed737
SHA512

4049db4e91a368486757138666d0a7c992735f3a88162cf085d90066bc783f0905f99bca3bdd176bc1fd4cb5d8f8a822f35d0d5dbec5abadc59ceefd4d53f93b
SSDEEP

768:offDPh1UgvSPbWA3bsRNZheIcxyEZ6tPX+QhEOjDv1myFj3Djon+MK:of7Ph1UgvSPbWObYFeIcx/6QLODcnjK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c1969988cbd9c9d86853e5bb4786d2cc97adbb6f22647183163c475ff6fed737

Files

c1969988cbd9c9d86853e5bb4786d2cc97adbb6f22647183163c475ff6fed737
.exe windows:6 windows x64 arch:x64

ff389be6fe82a30329605cb6511492b9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

dfhack-client

?run_command@RemoteClient@DFHack@@QEAA?AW4command_result@2@AEAVcolor_ostream@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@6@@Z
?CopyFrom@CoreTextNotification@dfproto@@QEAAXAEBV12@@Z
?CopyFrom@CoreErrorNotification@dfproto@@QEAAXAEBV12@@Z
?CopyFrom@EmptyMessage@dfproto@@QEAAXAEBV12@@Z
??1RemoteClient@DFHack@@QEAA@XZ
?CopyFrom@IntMessage@dfproto@@QEAAXAEBV12@@Z
?CopyFrom@IntListMessage@dfproto@@QEAAXAEBV12@@Z
?connect@RemoteClient@DFHack@@QEAA_NH@Z
?default_instance@StringListMessage@dfproto@@SAAEBV12@XZ
?CopyFrom@StringListMessage@dfproto@@QEAAXAEBV12@@Z
?add_text@color_ostream_wrapper@DFHack@@MEAAXW4color_value@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1color_ostream@DFHack@@UEAA@XZ
?add_text@buffered_color_ostream@DFHack@@MEAAXW4color_value@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0color_ostream@DFHack@@QEAA@XZ
??0RemoteClient@DFHack@@QEAA@PEAVcolor_ostream@1@@Z
?CopyFrom@CoreBindRequest@dfproto@@QEAAXAEBV12@@Z
?CopyFrom@CoreBindReply@dfproto@@QEAAXAEBV12@@Z
?CopyFrom@CoreRunCommandRequest@dfproto@@QEAAXAEBV12@@Z
?default_instance@CoreRunLuaRequest@dfproto@@SAAEBV12@XZ
?CopyFrom@CoreRunLuaRequest@dfproto@@QEAAXAEBV12@@Z
?CopyFrom@StringMessage@dfproto@@QEAAXAEBV12@@Z
?flush_proxy@color_ostream_wrapper@DFHack@@MEAAXXZ
?end_batch@color_ostream@DFHack@@MEAAXXZ
?bind@RemoteFunctionBase@DFHack@@QEAA_NAEAVcolor_ostream@2@PEAVRemoteClient@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2@Z
?execute@RemoteFunctionBase@DFHack@@IEAA?AW4command_result@2@AEAVcolor_ostream@2@PEBVMessageLite@protobuf@google@@PEAV567@@Z
?CopyFrom@CoreTextFragment@dfproto@@QEAAXAEBV12@@Z
??0CoreTextFragment@dfproto@@QEAA@XZ
?CoreErrorNotification_ErrorCode_IsValid@dfproto@@YA_NH@Z
?CoreTextFragment_Color_IsValid@dfproto@@YA_NH@Z
?shutdown@Console@DFHack@@QEAA_NXZ
?init@Console@DFHack@@QEAA_N_N@Z
??1Console@DFHack@@UEAA@XZ
??0Console@DFHack@@QEAA@XZ
??1color_ostream_proxy@DFHack@@UEAA@XZ
?flush_proxy@color_ostream_proxy@DFHack@@MEAAXXZ
?begin_batch@color_ostream@DFHack@@MEAAXXZ

protobuf-lite

?New@StringTypeHandlerBase@internal@protobuf@google@@SAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?Reserve@RepeatedPtrFieldBase@internal@protobuf@google@@IEAAXH@Z
?Clear@StringTypeHandlerBase@internal@protobuf@google@@SAXPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?kEmptyString@internal@protobuf@google@@3V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@B

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

vcruntime140

memcmp
_CxxThrowException
__std_exception_destroy
__std_exception_copy
_purecall
memcpy
memmove
__current_exception
__current_exception_context
__C_specific_handler
memset

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_register_onexit_function
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_exit
exit
_initterm_e
_get_initial_narrow_environment
_initialize_narrow_environment
_invalid_parameter_noinfo_noreturn
_initterm
_configure_narrow_argv
_set_app_type
terminate
_seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
fgetc
__acrt_iob_func
_set_fmode
__p__commode

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
malloc
_callnewh

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

kernel32

QueryPerformanceCounter
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
RtlCaptureContext
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry

Exports

Exports

??0Graphic@DFHack@@QEAA@$$QEAV01@@Z
??0Graphic@DFHack@@QEAA@AEBV01@@Z
??0Graphic@DFHack@@QEAA@XZ
??0Module@DFHack@@QEAA@AEBV01@@Z
??0Module@DFHack@@QEAA@XZ
??0RPCFunctionBase@DFHack@@IEAA@PEBVMessageLite@protobuf@google@@0@Z
??0RemoteClient@DFHack@@QEAA@AEBV01@@Z
??0RemoteFunctionBase@DFHack@@IEAA@PEBVMessageLite@protobuf@google@@0@Z
??0RemoteFunctionBase@DFHack@@QEAA@$$QEAV01@@Z
??0RemoteFunctionBase@DFHack@@QEAA@AEBV01@@Z
??0StateChangeScript@DFHack@@QEAA@$$QEAV01@@Z
??0StateChangeScript@DFHack@@QEAA@AEBV01@@Z
??0StateChangeScript@DFHack@@QEAA@W4state_change_event@1@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z
??0buffered_color_ostream@DFHack@@QEAA@XZ
??0color_ostream_proxy@DFHack@@QEAA@AEAVcolor_ostream@1@@Z
??0color_ostream_wrapper@DFHack@@QEAA@AEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z
??1Graphic@DFHack@@UEAA@XZ
??1Module@DFHack@@UEAA@XZ
??1RPCFunctionBase@DFHack@@IEAA@XZ
??1RemoteFunctionBase@DFHack@@QEAA@XZ
??1StateChangeScript@DFHack@@QEAA@XZ
??1buffered_color_ostream@DFHack@@UEAA@XZ
??1color_ostream_wrapper@DFHack@@UEAA@XZ
??4CoreBindReply@dfproto@@QEAAAEAV01@AEBV01@@Z
??4CoreBindRequest@dfproto@@QEAAAEAV01@AEBV01@@Z
??4CoreErrorNotification@dfproto@@QEAAAEAV01@AEBV01@@Z
??4CoreRunCommandRequest@dfproto@@QEAAAEAV01@AEBV01@@Z
??4CoreRunLuaRequest@dfproto@@QEAAAEAV01@AEBV01@@Z
??4CoreSuspendClaimMain@DFHack@@QEAAAEAU01@AEBU01@@Z
??4CoreSuspendReleaseMain@DFHack@@QEAAAEAU01@AEBU01@@Z
??4CoreTextFragment@dfproto@@QEAAAEAV01@AEBV01@@Z
??4CoreTextNotification@dfproto@@QEAAAEAV01@AEBV01@@Z
??4EmptyMessage@dfproto@@QEAAAEAV01@AEBV01@@Z
??4Graphic@DFHack@@QEAAAEAV01@$$QEAV01@@Z
??4Graphic@DFHack@@QEAAAEAV01@AEBV01@@Z
??4IntListMessage@dfproto@@QEAAAEAV01@AEBV01@@Z
??4IntMessage@dfproto@@QEAAAEAV01@AEBV01@@Z
??4Module@DFHack@@QEAAAEAV01@AEBV01@@Z
??4StateChangeScript@DFHack@@QEAAAEAV01@$$QEAV01@@Z
??4StateChangeScript@DFHack@@QEAAAEAV01@AEBV01@@Z
??4StringListMessage@dfproto@@QEAAAEAV01@AEBV01@@Z
??4StringMessage@dfproto@@QEAAAEAV01@AEBV01@@Z
??8StateChangeScript@DFHack@@QEAA?B_NAEBV01@@Z
??9StateChangeScript@DFHack@@QEAA?B_NAEBV01@@Z
??_7Graphic@DFHack@@6B@
??_7Module@DFHack@@6B@
??_7buffered_color_ostream@DFHack@@6B?$basic_ostream@DU?$char_traits@D@std@@@std@@@
??_7buffered_color_ostream@DFHack@@6Bcolor_ostream@1@@
??_7color_ostream_proxy@DFHack@@6B?$basic_ostream@DU?$char_traits@D@std@@@std@@@
??_7color_ostream_proxy@DFHack@@6Bcolor_ostream@1@@
??_7color_ostream_wrapper@DFHack@@6B?$basic_ostream@DU?$char_traits@D@std@@@std@@@
??_7color_ostream_wrapper@DFHack@@6Bcolor_ostream@1@@
??_8buffered_color_ostream@DFHack@@7B@
??_8color_ostream_proxy@DFHack@@7B@
??_8color_ostream_wrapper@DFHack@@7B@
??_DConsole@DFHack@@QEAAXXZ
??_Dbuffered_color_ostream@DFHack@@QEAAXXZ
??_Dcolor_ostream_proxy@DFHack@@QEAAXXZ
??_Dcolor_ostream_wrapper@DFHack@@QEAAXXZ
??_FRemoteClient@DFHack@@QEAAXXZ
?COLOR_BLACK@CoreTextFragment@dfproto@@2W4CoreTextFragment_Color@2@B
?COLOR_BLUE@CoreTextFragment@dfproto@@2W4CoreTextFragment_Color@2@B
?COLOR_BROWN@CoreTextFragment@dfproto@@2W4CoreTextFragment_Color@2@B
?COLOR_CYAN@CoreTextFragment@dfproto@@2W4CoreTextFragment_Color@2@B
?COLOR_DARKGREY@CoreTextFragment@dfproto@@2W4CoreTextFragment_Color@2@B
?COLOR_GREEN@CoreTextFragment@dfproto@@2W4CoreTextFragment_Color@2@B
?COLOR_GREY@CoreTextFragment@dfproto@@2W4CoreTextFragment_Color@2@B
?COLOR_LIGHTBLUE@CoreTextFragment@dfproto@@2W4CoreTextFragment_Color@2@B
?COLOR_LIGHTCYAN@CoreTextFragment@dfproto@@2W4CoreTextFragment_Color@2@B
?COLOR_LIGHTGREEN@CoreTextFragment@dfproto@@2W4CoreTextFragment_Color@2@B
?COLOR_LIGHTMAGENTA@CoreTextFragment@dfproto@@2W4CoreTextFragment_Color@2@B
?COLOR_LIGHTRED@CoreTextFragment@dfproto@@2W4CoreTextFragment_Color@2@B
?COLOR_MAGENTA@CoreTextFragment@dfproto@@2W4CoreTextFragment_Color@2@B
?COLOR_RED@CoreTextFragment@dfproto@@2W4CoreTextFragment_Color@2@B
?COLOR_WHITE@CoreTextFragment@dfproto@@2W4CoreTextFragment_Color@2@B
?COLOR_YELLOW@CoreTextFragment@dfproto@@2W4CoreTextFragment_Color@2@B
?CR_FAILURE@CoreErrorNotification@dfproto@@2W4CoreErrorNotification_ErrorCode@2@B
?CR_LINK_FAILURE@CoreErrorNotification@dfproto@@2W4CoreErrorNotification_ErrorCode@2@B
?CR_NOT_FOUND@CoreErrorNotification@dfproto@@2W4CoreErrorNotification_ErrorCode@2@B
?CR_NOT_IMPLEMENTED@CoreErrorNotification@dfproto@@2W4CoreErrorNotification_ErrorCode@2@B
?CR_OK@CoreErrorNotification@dfproto@@2W4CoreErrorNotification_ErrorCode@2@B
?CR_WOULD_BREAK@CoreErrorNotification@dfproto@@2W4CoreErrorNotification_ErrorCode@2@B
?CR_WRONG_USAGE@CoreErrorNotification@dfproto@@2W4CoreErrorNotification_ErrorCode@2@B
?Color_ARRAYSIZE@CoreTextFragment@dfproto@@2HB
?Color_IsValid@CoreTextFragment@dfproto@@SA_NH@Z
?Color_MAX@CoreTextFragment@dfproto@@2W4CoreTextFragment_Color@2@B
?Color_MIN@CoreTextFragment@dfproto@@2W4CoreTextFragment_Color@2@B
?DEFAULT_PORT@RemoteClient@DFHack@@2HB
?ErrorCode_ARRAYSIZE@CoreErrorNotification@dfproto@@2HB
?ErrorCode_IsValid@CoreErrorNotification@dfproto@@SA_NH@Z
?ErrorCode_MAX@CoreErrorNotification@dfproto@@2W4CoreErrorNotification_ErrorCode@2@B
?ErrorCode_MIN@CoreErrorNotification@dfproto@@2W4CoreErrorNotification_ErrorCode@2@B
?FAILURE@Console@DFHack@@2HB
?Finish@Graphic@DFHack@@UEAA_NXZ
?GetCachedSize@CoreBindReply@dfproto@@UEBAHXZ
?GetCachedSize@CoreBindRequest@dfproto@@UEBAHXZ
?GetCachedSize@CoreErrorNotification@dfproto@@UEBAHXZ
?GetCachedSize@CoreRunCommandRequest@dfproto@@UEBAHXZ
?GetCachedSize@CoreRunLuaRequest@dfproto@@UEBAHXZ
?GetCachedSize@CoreTextFragment@dfproto@@UEBAHXZ
?GetCachedSize@CoreTextNotification@dfproto@@UEBAHXZ
?GetCachedSize@EmptyMessage@dfproto@@UEBAHXZ
?GetCachedSize@IntListMessage@dfproto@@UEBAHXZ
?GetCachedSize@IntMessage@dfproto@@UEBAHXZ
?GetCachedSize@StringListMessage@dfproto@@UEBAHXZ
?GetCachedSize@StringMessage@dfproto@@UEBAHXZ
?RETRY@Console@DFHack@@2HB
?SHUTDOWN@Console@DFHack@@2HB
?Start@Module@DFHack@@UEAA_NXZ
?add_arguments@CoreRunCommandRequest@dfproto@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?add_arguments@CoreRunCommandRequest@dfproto@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?add_arguments@CoreRunCommandRequest@dfproto@@QEAAXPEBD@Z
?add_arguments@CoreRunCommandRequest@dfproto@@QEAAXPEBD_K@Z
?add_arguments@CoreRunLuaRequest@dfproto@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?add_arguments@CoreRunLuaRequest@dfproto@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?add_arguments@CoreRunLuaRequest@dfproto@@QEAAXPEBD@Z
?add_arguments@CoreRunLuaRequest@dfproto@@QEAAXPEBD_K@Z
?add_fragments@CoreTextNotification@dfproto@@QEAAPEAVCoreTextFragment@2@XZ
?add_value@IntListMessage@dfproto@@QEAAXH@Z
?add_value@StringListMessage@dfproto@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?add_value@StringListMessage@dfproto@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?add_value@StringListMessage@dfproto@@QEAAXPEBD@Z
?add_value@StringListMessage@dfproto@@QEAAXPEBD_K@Z
?arguments@CoreRunCommandRequest@dfproto@@QEBAAEBV?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@XZ
?arguments@CoreRunCommandRequest@dfproto@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?arguments@CoreRunLuaRequest@dfproto@@QEBAAEBV?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@XZ
?arguments@CoreRunLuaRequest@dfproto@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?arguments_size@CoreRunCommandRequest@dfproto@@QEBAHXZ
?arguments_size@CoreRunLuaRequest@dfproto@@QEBAHXZ
?assigned_id@CoreBindReply@dfproto@@QEBAHXZ
?bind@RemoteFunctionBase@DFHack@@QEAA_NPEAVRemoteClient@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@1@Z
?buf@color_ostream@DFHack@@AEAAPEAVbuffer@12@XZ
?clear_arguments@CoreRunCommandRequest@dfproto@@QEAAXXZ
?clear_arguments@CoreRunLuaRequest@dfproto@@QEAAXXZ
?clear_assigned_id@CoreBindReply@dfproto@@QEAAXXZ
?clear_code@CoreErrorNotification@dfproto@@QEAAXXZ
?clear_color@CoreTextFragment@dfproto@@QEAAXXZ
?clear_command@CoreRunCommandRequest@dfproto@@QEAAXXZ
?clear_fragments@CoreTextNotification@dfproto@@QEAAXXZ
?clear_function@CoreRunLuaRequest@dfproto@@QEAAXXZ
?clear_has_assigned_id@CoreBindReply@dfproto@@AEAAXXZ
?clear_has_code@CoreErrorNotification@dfproto@@AEAAXXZ
?clear_has_color@CoreTextFragment@dfproto@@AEAAXXZ
?clear_has_command@CoreRunCommandRequest@dfproto@@AEAAXXZ
?clear_has_function@CoreRunLuaRequest@dfproto@@AEAAXXZ
?clear_has_input_msg@CoreBindRequest@dfproto@@AEAAXXZ
?clear_has_method@CoreBindRequest@dfproto@@AEAAXXZ
?clear_has_module@CoreRunLuaRequest@dfproto@@AEAAXXZ
?clear_has_output_msg@CoreBindRequest@dfproto@@AEAAXXZ
?clear_has_plugin@CoreBindRequest@dfproto@@AEAAXXZ
?clear_has_text@CoreTextFragment@dfproto@@AEAAXXZ
?clear_has_value@IntMessage@dfproto@@AEAAXXZ
?clear_has_value@StringMessage@dfproto@@AEAAXXZ
?clear_input_msg@CoreBindRequest@dfproto@@QEAAXXZ
?clear_method@CoreBindRequest@dfproto@@QEAAXXZ
?clear_module@CoreRunLuaRequest@dfproto@@QEAAXXZ
?clear_output_msg@CoreBindRequest@dfproto@@QEAAXXZ
?clear_plugin@CoreBindRequest@dfproto@@QEAAXXZ
?clear_text@CoreTextFragment@dfproto@@QEAAXXZ
?clear_value@IntListMessage@dfproto@@QEAAXXZ
?clear_value@IntMessage@dfproto@@QEAAXXZ
?clear_value@StringListMessage@dfproto@@QEAAXXZ
?clear_value@StringMessage@dfproto@@QEAAXXZ
?code@CoreErrorNotification@dfproto@@QEBA?AW4CoreErrorNotification_ErrorCode@2@XZ
?color@CoreTextFragment@dfproto@@QEBA?AW4CoreTextFragment_Color@2@XZ
?color@color_ostream@DFHack@@QEAA?AW4color_value@2@XZ
?command@CoreRunCommandRequest@dfproto@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?default_ostream@RemoteFunctionBase@DFHack@@IEAAAEAVcolor_ostream@2@XZ
?default_output@RemoteClient@DFHack@@QEAAAEAVcolor_ostream@2@XZ
?flush_proxy@color_ostream@DFHack@@MEAAXXZ
?fragments@CoreTextNotification@dfproto@@QEBAAEBV?$RepeatedPtrField@VCoreTextFragment@dfproto@@@protobuf@google@@XZ
?fragments@CoreTextNotification@dfproto@@QEBAAEBVCoreTextFragment@2@H@Z
?fragments@buffered_color_ostream@DFHack@@QEAAAEBV?$list@U?$pair@W4color_value@DFHack@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@std@@V?$allocator@U?$pair@W4color_value@DFHack@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@std@@@2@@std@@XZ
?fragments_size@CoreTextNotification@dfproto@@QEBAHXZ
?function@CoreRunLuaRequest@dfproto@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getConsole@Core@DFHack@@QEAAAEAVConsole@2@XZ
?getModstate@Core@DFHack@@QEAACXZ
?getPluginManager@Core@DFHack@@QEAAPEAVPluginManager@2@XZ
?has_assigned_id@CoreBindReply@dfproto@@QEBA_NXZ
?has_code@CoreErrorNotification@dfproto@@QEBA_NXZ
?has_color@CoreTextFragment@dfproto@@QEBA_NXZ
?has_command@CoreRunCommandRequest@dfproto@@QEBA_NXZ
?has_function@CoreRunLuaRequest@dfproto@@QEBA_NXZ
?has_input_msg@CoreBindRequest@dfproto@@QEBA_NXZ
?has_method@CoreBindRequest@dfproto@@QEBA_NXZ
?has_module@CoreRunLuaRequest@dfproto@@QEBA_NXZ
?has_output_msg@CoreBindRequest@dfproto@@QEBA_NXZ
?has_plugin@CoreBindRequest@dfproto@@QEBA_NXZ
?has_text@CoreTextFragment@dfproto@@QEBA_NXZ
?has_value@IntMessage@dfproto@@QEBA_NXZ
?has_value@StringMessage@dfproto@@QEBA_NXZ
?in@RPCFunctionBase@DFHack@@QEAAPEAVMessageLite@protobuf@google@@XZ
?input_msg@CoreBindRequest@dfproto@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?isInited@Console@DFHack@@QEAA_NXZ
?isMapLoaded@Core@DFHack@@QEAA_NXZ
?isValid@Core@DFHack@@QEAA_NXZ
?isValid@RemoteFunctionBase@DFHack@@QEAA_NXZ
?isWorldLoaded@Core@DFHack@@QEAA_NXZ
?is_console@Console@DFHack@@UEAA_NXZ
?is_console@color_ostream@DFHack@@UEAA_NXZ
?kArgumentsFieldNumber@CoreRunCommandRequest@dfproto@@2HB
?kArgumentsFieldNumber@CoreRunLuaRequest@dfproto@@2HB
?kAssignedIdFieldNumber@CoreBindReply@dfproto@@2HB
?kCodeFieldNumber@CoreErrorNotification@dfproto@@2HB
?kColorFieldNumber@CoreTextFragment@dfproto@@2HB
?kCommandFieldNumber@CoreRunCommandRequest@dfproto@@2HB
?kFragmentsFieldNumber@CoreTextNotification@dfproto@@2HB
?kFunctionFieldNumber@CoreRunLuaRequest@dfproto@@2HB
?kInputMsgFieldNumber@CoreBindRequest@dfproto@@2HB
?kMethodFieldNumber@CoreBindRequest@dfproto@@2HB
?kModuleFieldNumber@CoreRunLuaRequest@dfproto@@2HB
?kOutputMsgFieldNumber@CoreBindRequest@dfproto@@2HB
?kPluginFieldNumber@CoreBindRequest@dfproto@@2HB
?kTextFieldNumber@CoreTextFragment@dfproto@@2HB
?kValueFieldNumber@IntListMessage@dfproto@@2HB
?kValueFieldNumber@IntMessage@dfproto@@2HB
?kValueFieldNumber@StringListMessage@dfproto@@2HB
?kValueFieldNumber@StringMessage@dfproto@@2HB
?make_in@RPCFunctionBase@DFHack@@QEBAPEAVMessageLite@protobuf@google@@XZ
?make_out@RPCFunctionBase@DFHack@@QEBAPEAVMessageLite@protobuf@google@@XZ
?method@CoreBindRequest@dfproto@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?module@CoreRunLuaRequest@dfproto@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?mutable_arguments@CoreRunCommandRequest@dfproto@@QEAAPEAV?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@XZ
?mutable_arguments@CoreRunCommandRequest@dfproto@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?mutable_arguments@CoreRunLuaRequest@dfproto@@QEAAPEAV?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@XZ
?mutable_arguments@CoreRunLuaRequest@dfproto@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?mutable_command@CoreRunCommandRequest@dfproto@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?mutable_fragments@CoreTextNotification@dfproto@@QEAAPEAV?$RepeatedPtrField@VCoreTextFragment@dfproto@@@protobuf@google@@XZ
?mutable_fragments@CoreTextNotification@dfproto@@QEAAPEAVCoreTextFragment@2@H@Z
?mutable_function@CoreRunLuaRequest@dfproto@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?mutable_input_msg@CoreBindRequest@dfproto@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?mutable_method@CoreBindRequest@dfproto@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?mutable_module@CoreRunLuaRequest@dfproto@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?mutable_output_msg@CoreBindRequest@dfproto@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?mutable_plugin@CoreBindRequest@dfproto@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?mutable_text@CoreTextFragment@dfproto@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?mutable_value@IntListMessage@dfproto@@QEAAPEAV?$RepeatedField@H@protobuf@google@@XZ
?mutable_value@StringListMessage@dfproto@@QEAAPEAV?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@XZ
?mutable_value@StringListMessage@dfproto@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?mutable_value@StringMessage@dfproto@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?out@RPCFunctionBase@DFHack@@QEAAPEAVMessageLite@protobuf@google@@XZ
?output_msg@CoreBindRequest@dfproto@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?plugin@CoreBindRequest@dfproto@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?proxy_target@color_ostream@DFHack@@UEAAPEAV12@XZ
?proxy_target@color_ostream_proxy@DFHack@@UEAAPEAVcolor_ostream@2@XZ
?release_command@CoreRunCommandRequest@dfproto@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?release_function@CoreRunLuaRequest@dfproto@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?release_input_msg@CoreBindRequest@dfproto@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?release_method@CoreBindRequest@dfproto@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?release_module@CoreRunLuaRequest@dfproto@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?release_output_msg@CoreBindRequest@dfproto@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?release_plugin@CoreBindRequest@dfproto@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?release_text@CoreTextFragment@dfproto@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?release_value@StringMessage@dfproto@@QEAAPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?run_command@RemoteClient@DFHack@@QEAA?AW4command_result@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@5@@Z
?set_arguments@CoreRunCommandRequest@dfproto@@QEAAXHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?set_arguments@CoreRunCommandRequest@dfproto@@QEAAXHPEBD@Z
?set_arguments@CoreRunCommandRequest@dfproto@@QEAAXHPEBD_K@Z
?set_arguments@CoreRunLuaRequest@dfproto@@QEAAXHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?set_arguments@CoreRunLuaRequest@dfproto@@QEAAXHPEBD@Z
?set_arguments@CoreRunLuaRequest@dfproto@@QEAAXHPEBD_K@Z
?set_assigned_id@CoreBindReply@dfproto@@QEAAXH@Z
?set_code@CoreErrorNotification@dfproto@@QEAAXW4CoreErrorNotification_ErrorCode@2@@Z
?set_color@CoreTextFragment@dfproto@@QEAAXW4CoreTextFragment_Color@2@@Z
?set_command@CoreRunCommandRequest@dfproto@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?set_command@CoreRunCommandRequest@dfproto@@QEAAXPEBD@Z
?set_command@CoreRunCommandRequest@dfproto@@QEAAXPEBD_K@Z
?set_function@CoreRunLuaRequest@dfproto@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?set_function@CoreRunLuaRequest@dfproto@@QEAAXPEBD@Z
?set_function@CoreRunLuaRequest@dfproto@@QEAAXPEBD_K@Z
?set_has_assigned_id@CoreBindReply@dfproto@@AEAAXXZ
?set_has_code@CoreErrorNotification@dfproto@@AEAAXXZ
?set_has_color@CoreTextFragment@dfproto@@AEAAXXZ
?set_has_command@CoreRunCommandRequest@dfproto@@AEAAXXZ
?set_has_function@CoreRunLuaRequest@dfproto@@AEAAXXZ
?set_has_input_msg@CoreBindRequest@dfproto@@AEAAXXZ
?set_has_method@CoreBindRequest@dfproto@@AEAAXXZ
?set_has_module@CoreRunLuaRequest@dfproto@@AEAAXXZ
?set_has_output_msg@CoreBindRequest@dfproto@@AEAAXXZ
?set_has_plugin@CoreBindRequest@dfproto@@AEAAXXZ
?set_has_text@CoreTextFragment@dfproto@@AEAAXXZ
?set_has_value@IntMessage@dfproto@@AEAAXXZ
?set_has_value@StringMessage@dfproto@@AEAAXXZ
?set_input_msg@CoreBindRequest@dfproto@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?set_input_msg@CoreBindRequest@dfproto@@QEAAXPEBD@Z
?set_input_msg@CoreBindRequest@dfproto@@QEAAXPEBD_K@Z
?set_method@CoreBindRequest@dfproto@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?set_method@CoreBindRequest@dfproto@@QEAAXPEBD@Z
?set_method@CoreBindRequest@dfproto@@QEAAXPEBD_K@Z
?set_module@CoreRunLuaRequest@dfproto@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?set_module@CoreRunLuaRequest@dfproto@@QEAAXPEBD@Z
?set_module@CoreRunLuaRequest@dfproto@@QEAAXPEBD_K@Z
?set_output_msg@CoreBindRequest@dfproto@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?set_output_msg@CoreBindRequest@dfproto@@QEAAXPEBD@Z
?set_output_msg@CoreBindRequest@dfproto@@QEAAXPEBD_K@Z
?set_plugin@CoreBindRequest@dfproto@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?set_plugin@CoreBindRequest@dfproto@@QEAAXPEBD@Z
?set_plugin@CoreBindRequest@dfproto@@QEAAXPEBD_K@Z
?set_text@CoreTextFragment@dfproto@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?set_text@CoreTextFragment@dfproto@@QEAAXPEBD@Z
?set_text@CoreTextFragment@dfproto@@QEAAXPEBD_K@Z
?set_value@IntListMessage@dfproto@@QEAAXHH@Z
?set_value@IntMessage@dfproto@@QEAAXH@Z
?set_value@StringListMessage@dfproto@@QEAAXHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?set_value@StringListMessage@dfproto@@QEAAXHPEBD@Z
?set_value@StringListMessage@dfproto@@QEAAXHPEBD_K@Z
?set_value@StringMessage@dfproto@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?set_value@StringMessage@dfproto@@QEAAXPEBD@Z
?set_value@StringMessage@dfproto@@QEAAXPEBD_K@Z
?text@CoreTextFragment@dfproto@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?value@IntListMessage@dfproto@@QEBAAEBV?$RepeatedField@H@protobuf@google@@XZ
?value@IntListMessage@dfproto@@QEBAHH@Z
?value@IntMessage@dfproto@@QEBAHXZ
?value@StringListMessage@dfproto@@QEBAAEBV?$RepeatedPtrField@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@protobuf@google@@XZ
?value@StringListMessage@dfproto@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?value@StringMessage@dfproto@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?value_size@IntListMessage@dfproto@@QEBAHXZ
?value_size@StringListMessage@dfproto@@QEBAHXZ

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ff389be6fe82a30329605cb6511492b9

Headers

DLL Characteristics

File Characteristics

Imports

dfhack-client

protobuf-lite

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 23KB - Virtual size: 23KB

.rdata Size: 37KB - Virtual size: 36KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 176B

.rsrc Size: 512B - Virtual size: 4KB

.text
Size: 23KB - Virtual size: 23KB

.rdata
Size: 37KB - Virtual size: 36KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 176B

.rsrc
Size: 512B - Virtual size: 4KB