erggre[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

erggre.exe
Size

13.3MB
MD5

832a909f22867ec55bb7d8c31eb00a52
SHA1

92212dc01f4c5af2f9427afa019ccbdc322f1eea
SHA256

39b48daa6c9dcbc9513af10d0c9b9bfb283297f6606b0d272a3f284e4256813f
SHA512

5b8b480ad9828873c526aac7406f37e807f8f6d9b43c934d5e5d605858c13995f11d381932423e149c8f25ae03906d9281cf8164ff8dae99f98112faabab6c72
SSDEEP

393216:lqd7W3Cl9gGawy803PcGtOGj7/acgvMy2hnuYU:lq7qCHgGawy82cG5Cc2YU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
erggre.exe

Files

erggre.exe
.exe windows:6 windows x64 arch:x64

1495c2a37534cbd192196e59c575f74a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

LeaveCriticalSection
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

FindWindowA

advapi32

OpenProcessToken

shell32

ShellExecuteW

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

ntdll

RtlCaptureContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf

api-ms-win-crt-runtime-l1-1-0

_set_app_type

api-ms-win-crt-math-l1-1-0

_dsign

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-string-l1-1-0

tolower

api-ms-win-crt-utility-l1-1-0

rand

Exports

Exports

??0Assembler@a64@_abi_1_13@asmjit@@QEAA@PEAVCodeHolder@23@@Z
??0Assembler@x86@_abi_1_13@asmjit@@QEAA@PEAVCodeHolder@23@@Z
??0BaseAssembler@_abi_1_13@asmjit@@QEAA@XZ
??0BaseBuilder@_abi_1_13@asmjit@@QEAA@XZ
??0BaseCompiler@_abi_1_13@asmjit@@QEAA@XZ
??0BaseEmitter@_abi_1_13@asmjit@@QEAA@W4EmitterType@12@@Z
??0Builder@a64@_abi_1_13@asmjit@@QEAA@PEAVCodeHolder@23@@Z
??0Builder@x86@_abi_1_13@asmjit@@QEAA@PEAVCodeHolder@23@@Z
??0CodeHolder@_abi_1_13@asmjit@@QEAA@PEBUTemporary@Support@12@@Z
??0Compiler@a64@_abi_1_13@asmjit@@QEAA@PEAVCodeHolder@23@@Z
??0Compiler@x86@_abi_1_13@asmjit@@QEAA@PEAVCodeHolder@23@@Z
??0ConstPool@_abi_1_13@asmjit@@QEAA@PEAVZone@12@@Z
??0ErrorHandler@_abi_1_13@asmjit@@QEAA@XZ
??0FileLogger@_abi_1_13@asmjit@@QEAA@PEAU_iobuf@@@Z
??0FuncPass@_abi_1_13@asmjit@@QEAA@PEBD@Z
??0JitAllocator@_abi_1_13@asmjit@@QEAA@PEBUCreateParams@012@@Z
??0JitRuntime@_abi_1_13@asmjit@@QEAA@PEBUCreateParams@JitAllocator@12@@Z
??0Logger@_abi_1_13@asmjit@@QEAA@XZ
??0Pass@_abi_1_13@asmjit@@QEAA@PEBD@Z
??0StringLogger@_abi_1_13@asmjit@@QEAA@XZ
??0Target@_abi_1_13@asmjit@@QEAA@XZ
??1Assembler@a64@_abi_1_13@asmjit@@UEAA@XZ
??1Assembler@x86@_abi_1_13@asmjit@@UEAA@XZ
??1BaseAssembler@_abi_1_13@asmjit@@UEAA@XZ
??1BaseBuilder@_abi_1_13@asmjit@@UEAA@XZ
??1BaseCompiler@_abi_1_13@asmjit@@UEAA@XZ
??1BaseEmitter@_abi_1_13@asmjit@@UEAA@XZ
??1Builder@a64@_abi_1_13@asmjit@@UEAA@XZ
??1Builder@x86@_abi_1_13@asmjit@@UEAA@XZ
??1CodeHolder@_abi_1_13@asmjit@@QEAA@XZ
??1Compiler@a64@_abi_1_13@asmjit@@UEAA@XZ
??1Compiler@x86@_abi_1_13@asmjit@@UEAA@XZ
??1ConstPool@_abi_1_13@asmjit@@QEAA@XZ
??1ErrorHandler@_abi_1_13@asmjit@@UEAA@XZ
??1FileLogger@_abi_1_13@asmjit@@UEAA@XZ
??1JitAllocator@_abi_1_13@asmjit@@QEAA@XZ
??1JitRuntime@_abi_1_13@asmjit@@UEAA@XZ
??1Logger@_abi_1_13@asmjit@@UEAA@XZ
??1Pass@_abi_1_13@asmjit@@UEAA@XZ
??1StringLogger@_abi_1_13@asmjit@@UEAA@XZ
??1Target@_abi_1_13@asmjit@@UEAA@XZ
??_FAssembler@a64@_abi_1_13@asmjit@@QEAAXXZ
??_FAssembler@x86@_abi_1_13@asmjit@@QEAAXXZ
??_FBuilder@a64@_abi_1_13@asmjit@@QEAAXXZ
??_FBuilder@x86@_abi_1_13@asmjit@@QEAAXXZ
??_FCodeHolder@_abi_1_13@asmjit@@QEAAXXZ
??_FCompiler@a64@_abi_1_13@asmjit@@QEAAXXZ
??_FCompiler@x86@_abi_1_13@asmjit@@QEAAXXZ
??_FFileLogger@_abi_1_13@asmjit@@QEAAXXZ
??_FJitAllocator@_abi_1_13@asmjit@@QEAAXXZ
??_FJitRuntime@_abi_1_13@asmjit@@QEAAXXZ
?_add@JitRuntime@_abi_1_13@asmjit@@UEAAIPEAPEAXPEAVCodeHolder@23@@Z
?_alloc@Zone@_abi_1_13@asmjit@@QEAAPEAX_K0@Z
?_alloc@ZoneAllocator@_abi_1_13@asmjit@@QEAAPEAX_KAEA_K@Z
?_allocZeroed@ZoneAllocator@_abi_1_13@asmjit@@QEAAPEAX_KAEA_K@Z
?_append@ZoneBitVector@_abi_1_13@asmjit@@QEAAIPEAVZoneAllocator@23@_N@Z
?_archTraits@_abi_1_13@asmjit@@3QBUArchTraits@12@B
?_cleanupBlock@ZoneStackBase@_abi_1_13@asmjit@@QEAAXI_K@Z
?_commonInfoTable@InstDB@x86@_abi_1_13@asmjit@@3QBUCommonInfo@1234@B
?_emit@Assembler@a64@_abi_1_13@asmjit@@UEAAIIAEBUOperand_@34@00PEBU534@@Z
?_emit@Assembler@x86@_abi_1_13@asmjit@@UEAAIIAEBUOperand_@34@00PEBU534@@Z
?_emit@BaseBuilder@_abi_1_13@asmjit@@UEAAIIAEBUOperand_@23@00PEBU423@@Z
?_emit@BaseEmitter@_abi_1_13@asmjit@@UEAAIIAEBUOperand_@23@00PEBU423@@Z
?_emitI@BaseEmitter@_abi_1_13@asmjit@@QEAAII@Z
?_emitI@BaseEmitter@_abi_1_13@asmjit@@QEAAIIAEBUOperand_@23@00000@Z
?_emitI@BaseEmitter@_abi_1_13@asmjit@@QEAAIIAEBUOperand_@23@0000@Z
?_emitI@BaseEmitter@_abi_1_13@asmjit@@QEAAIIAEBUOperand_@23@000@Z
?_emitI@BaseEmitter@_abi_1_13@asmjit@@QEAAIIAEBUOperand_@23@00@Z
?_emitI@BaseEmitter@_abi_1_13@asmjit@@QEAAIIAEBUOperand_@23@0@Z
?_emitI@BaseEmitter@_abi_1_13@asmjit@@QEAAIIAEBUOperand_@23@@Z
?_emitOpArray@BaseEmitter@_abi_1_13@asmjit@@UEAAIIPEBUOperand_@23@_K@Z
?_grow@ZoneVectorBase@_abi_1_13@asmjit@@IEAAIPEAVZoneAllocator@23@II@Z
?_init@Zone@_abi_1_13@asmjit@@QEAAX_K0PEBUTemporary@Support@23@@Z
?_init@ZoneStackBase@_abi_1_13@asmjit@@QEAAIPEAVZoneAllocator@23@_K@Z
?_insert@ZoneHashBase@_abi_1_13@asmjit@@QEAAPEAVZoneHashNode@23@PEAVZoneAllocator@23@PEAV423@@Z
?_instInfoTable@InstDB@a64@_abi_1_13@asmjit@@3QBUInstInfo@1234@B
?_instInfoTable@InstDB@x86@_abi_1_13@asmjit@@3QBUInstInfo@1234@B
?_instSignatureTable@InstDB@x86@_abi_1_13@asmjit@@3QBUInstSignature@1234@B
?_log@FileLogger@_abi_1_13@asmjit@@UEAAIPEBD_K@Z
?_log@Logger@_abi_1_13@asmjit@@UEAAIPEBD_K@Z
?_log@StringLogger@_abi_1_13@asmjit@@UEAAIPEBD_K@Z
?_newConst@BaseCompiler@_abi_1_13@asmjit@@QEAAIPEAVBaseMem@23@W4ConstPoolScope@23@PEBX_K@Z
?_newReg@BaseCompiler@_abi_1_13@asmjit@@QEAAIPEAVBaseReg@23@AEBV423@PEBD@Z
?_newReg@BaseCompiler@_abi_1_13@asmjit@@QEAAIPEAVBaseReg@23@W4TypeId@23@PEBD@Z
?_newRegFmt@BaseCompiler@_abi_1_13@asmjit@@QEAAIPEAVBaseReg@23@AEBV423@PEBDZZ
?_newRegFmt@BaseCompiler@_abi_1_13@asmjit@@QEAAIPEAVBaseReg@23@W4TypeId@23@PEBDZZ
?_newStack@BaseCompiler@_abi_1_13@asmjit@@QEAAIPEAVBaseMem@23@IIPEBD@Z
?_opChar@String@_abi_1_13@asmjit@@QEAAIW4ModifyOp@123@D@Z
?_opChars@String@_abi_1_13@asmjit@@QEAAIW4ModifyOp@123@D_K@Z
?_opFormat@String@_abi_1_13@asmjit@@QEAAIW4ModifyOp@123@PEBDZZ
?_opHex@String@_abi_1_13@asmjit@@QEAAIW4ModifyOp@123@PEBX_KD@Z
?_opNumber@String@_abi_1_13@asmjit@@QEAAIW4ModifyOp@123@_KI1W4StringFormatFlags@23@@Z
?_opSignatureTable@InstDB@x86@_abi_1_13@asmjit@@3QBUOpSignature@1234@B
?_opString@String@_abi_1_13@asmjit@@QEAAIW4ModifyOp@123@PEBD_K@Z
?_opVFormat@String@_abi_1_13@asmjit@@QEAAIW4ModifyOp@123@PEBDPEAD@Z
?_prepareBlock@ZoneStackBase@_abi_1_13@asmjit@@QEAAII_K@Z
?_rehash@ZoneHashBase@_abi_1_13@asmjit@@QEAAXPEAVZoneAllocator@23@I@Z
?_release@JitRuntime@_abi_1_13@asmjit@@UEAAIPEAX@Z
?_releaseDynamic@ZoneAllocator@_abi_1_13@asmjit@@QEAAXPEAX_K@Z
?_remove@ZoneHashBase@_abi_1_13@asmjit@@QEAAPEAVZoneHashNode@23@PEAVZoneAllocator@23@PEAV423@@Z
?_reserve@ZoneVectorBase@_abi_1_13@asmjit@@IEAAIPEAVZoneAllocator@23@II@Z
?_resize@ZoneBitVector@_abi_1_13@asmjit@@QEAAIPEAVZoneAllocator@23@II_N@Z
?_resize@ZoneVectorBase@_abi_1_13@asmjit@@IEAAIPEAVZoneAllocator@23@II@Z
?_typeData@TypeUtils@_abi_1_13@asmjit@@3UTypeData@123@B
?_zeroBlock@Zone@_abi_1_13@asmjit@@2UBlock@123@B
?add@ConstPool@_abi_1_13@asmjit@@QEAAIPEBX_KAEA_K@Z
?addAddressToAddressTable@CodeHolder@_abi_1_13@asmjit@@QEAAI_K@Z
?addAfter@BaseBuilder@_abi_1_13@asmjit@@QEAAPEAVBaseNode@23@PEAV423@0@Z
?addBefore@BaseBuilder@_abi_1_13@asmjit@@QEAAPEAVBaseNode@23@PEAV423@0@Z
?addDiagnosticOptions@BaseEmitter@_abi_1_13@asmjit@@QEAAXW4DiagnosticOptions@23@@Z
?addFunc@BaseCompiler@_abi_1_13@asmjit@@QEAAPEAVFuncNode@23@PEAV423@@Z
?addFuncNode@BaseCompiler@_abi_1_13@asmjit@@QEAAIPEAPEAVFuncNode@23@AEBUFuncSignature@23@@Z
?addFuncRetNode@BaseCompiler@_abi_1_13@asmjit@@QEAAIPEAPEAVFuncRetNode@23@AEBUOperand_@23@1@Z
?addInvokeNode@BaseCompiler@_abi_1_13@asmjit@@QEAAIPEAPEAVInvokeNode@23@IAEBUOperand_@23@AEBUFuncSignature@23@@Z
?addNode@BaseBuilder@_abi_1_13@asmjit@@QEAAPEAVBaseNode@23@PEAV423@@Z
?addPass@BaseBuilder@_abi_1_13@asmjit@@QEAAIPEAVPass@23@@Z
?align@Assembler@a64@_abi_1_13@asmjit@@UEAAIW4AlignMode@34@I@Z
?align@Assembler@x86@_abi_1_13@asmjit@@UEAAIW4AlignMode@34@I@Z
?align@BaseBuilder@_abi_1_13@asmjit@@UEAAIW4AlignMode@23@I@Z
?align@BaseEmitter@_abi_1_13@asmjit@@UEAAIW4AlignMode@23@I@Z
?alloc@JitAllocator@_abi_1_13@asmjit@@QEAAIAEAVSpan@123@_K@Z
?alloc@VirtMem@_abi_1_13@asmjit@@YAIPEAPEAX_KW4MemoryFlags@123@@Z
?allocDualMapping@VirtMem@_abi_1_13@asmjit@@YAIPEAUDualMapping@123@_KW4MemoryFlags@123@@Z
?allocZeroed@Zone@_abi_1_13@asmjit@@QEAAPEAX_K0@Z
?assertionFailed@DebugUtils@_abi_1_13@asmjit@@YAXPEBDH0@Z
?assign@String@_abi_1_13@asmjit@@QEAAIPEBD_K@Z
?attach@CodeHolder@_abi_1_13@asmjit@@QEAAIPEAVBaseEmitter@23@@Z
?beginWriteScope@JitAllocator@_abi_1_13@asmjit@@QEAAIAEAUWriteScopeData@123@W4CachePolicy@VirtMem@23@@Z
?bind@BaseAssembler@_abi_1_13@asmjit@@UEAAIAEBVLabel@23@@Z
?bind@BaseBuilder@_abi_1_13@asmjit@@UEAAIAEBVLabel@23@@Z
?bind@BaseEmitter@_abi_1_13@asmjit@@UEAAIAEBVLabel@23@@Z
?bindLabel@CodeHolder@_abi_1_13@asmjit@@QEAAIAEBVLabel@23@I_K@Z
?clear@String@_abi_1_13@asmjit@@QEAAIXZ
?clearDiagnosticOptions@BaseEmitter@_abi_1_13@asmjit@@QEAAXW4DiagnosticOptions@23@@Z
?codeSize@CodeHolder@_abi_1_13@asmjit@@QEBA_KXZ
?comment@BaseAssembler@_abi_1_13@asmjit@@UEAAIPEBD_K@Z
?comment@BaseBuilder@_abi_1_13@asmjit@@UEAAIPEBD_K@Z
?comment@BaseEmitter@_abi_1_13@asmjit@@UEAAIPEBD_K@Z
?commentf@BaseEmitter@_abi_1_13@asmjit@@QEAAIPEBDZZ
?commentv@BaseEmitter@_abi_1_13@asmjit@@QEAAIPEBDPEAD@Z
?copyFlattenedData@CodeHolder@_abi_1_13@asmjit@@QEAAIPEAX_KW4CopySectionFlags@23@@Z
?copyFrom@ZoneBitVector@_abi_1_13@asmjit@@QEAAIPEAVZoneAllocator@23@AEBV123@@Z
?copySectionData@CodeHolder@_abi_1_13@asmjit@@QEAAIPEAX_KIW4CopySectionFlags@23@@Z
?debugOutput@DebugUtils@_abi_1_13@asmjit@@YAXPEBD@Z
?deletePass@BaseBuilder@_abi_1_13@asmjit@@QEAAIPEAVPass@23@@Z
?detach@CodeHolder@_abi_1_13@asmjit@@QEAAIPEAVBaseEmitter@23@@Z
?dup@Zone@_abi_1_13@asmjit@@QEAAPEAXPEBX_K_N@Z
?embed@BaseAssembler@_abi_1_13@asmjit@@UEAAIPEBX_K@Z
?embed@BaseBuilder@_abi_1_13@asmjit@@UEAAIPEBX_K@Z
?embed@BaseEmitter@_abi_1_13@asmjit@@UEAAIPEBX_K@Z
?embedConstPool@BaseAssembler@_abi_1_13@asmjit@@UEAAIAEBVLabel@23@AEBVConstPool@23@@Z
?embedConstPool@BaseBuilder@_abi_1_13@asmjit@@UEAAIAEBVLabel@23@AEBVConstPool@23@@Z
?embedConstPool@BaseEmitter@_abi_1_13@asmjit@@UEAAIAEBVLabel@23@AEBVConstPool@23@@Z
?embedDataArray@BaseAssembler@_abi_1_13@asmjit@@UEAAIW4TypeId@23@PEBX_K2@Z
?embedDataArray@BaseBuilder@_abi_1_13@asmjit@@UEAAIW4TypeId@23@PEBX_K2@Z
?embedDataArray@BaseEmitter@_abi_1_13@asmjit@@UEAAIW4TypeId@23@PEBX_K2@Z
?embedLabel@BaseAssembler@_abi_1_13@asmjit@@UEAAIAEBVLabel@23@_K@Z
?embedLabel@BaseBuilder@_abi_1_13@asmjit@@UEAAIAEBVLabel@23@_K@Z
?embedLabel@BaseEmitter@_abi_1_13@asmjit@@UEAAIAEBVLabel@23@_K@Z
?embedLabelDelta@BaseAssembler@_abi_1_13@asmjit@@UEAAIAEBVLabel@23@0_K@Z
?embedLabelDelta@BaseBuilder@_abi_1_13@asmjit@@UEAAIAEBVLabel@23@0_K@Z
?embedLabelDelta@BaseEmitter@_abi_1_13@asmjit@@UEAAIAEBVLabel@23@0_K@Z
?emitAnnotatedJump@BaseCompiler@_abi_1_13@asmjit@@QEAAIIAEBUOperand_@23@PEAVJumpAnnotation@23@@Z
?emitArgsAssignment@BaseEmitter@_abi_1_13@asmjit@@QEAAIAEBVFuncFrame@23@AEBVFuncArgsAssignment@23@@Z
?emitEpilog@BaseEmitter@_abi_1_13@asmjit@@QEAAIAEBVFuncFrame@23@@Z
?emitProlog@BaseEmitter@_abi_1_13@asmjit@@QEAAIAEBVFuncFrame@23@@Z
?endFunc@BaseCompiler@_abi_1_13@asmjit@@QEAAIXZ
?endWriteScope@JitAllocator@_abi_1_13@asmjit@@QEAAIAEAUWriteScopeData@123@@Z
?ensureAddressTableSection@CodeHolder@_abi_1_13@asmjit@@QEAAPEAVSection@23@XZ
?equals@String@_abi_1_13@asmjit@@QEBA_NPEBD_K@Z
?errorAsString@DebugUtils@_abi_1_13@asmjit@@YAPEBDI@Z
?fill@ConstPool@_abi_1_13@asmjit@@QEBAXPEAX@Z
?finalize@BaseEmitter@_abi_1_13@asmjit@@UEAAIXZ
?finalize@Builder@a64@_abi_1_13@asmjit@@UEAAIXZ
?finalize@Builder@x86@_abi_1_13@asmjit@@UEAAIXZ
?finalize@Compiler@a64@_abi_1_13@asmjit@@UEAAIXZ
?finalize@Compiler@x86@_abi_1_13@asmjit@@UEAAIXZ
?finalize@FuncFrame@_abi_1_13@asmjit@@QEAAIXZ
?flatten@CodeHolder@_abi_1_13@asmjit@@QEAAIXZ
?flushInstructionCache@VirtMem@_abi_1_13@asmjit@@YAXPEAX_K@Z
?flushWriteScope@JitAllocator@_abi_1_13@asmjit@@QEAAIAEAUWriteScopeData@123@@Z
?formatData@Formatter@_abi_1_13@asmjit@@YAIAEAVString@23@W4FormatFlags@23@W4Arch@23@W4TypeId@23@PEBX_K5@Z
?formatDataType@Formatter@_abi_1_13@asmjit@@YAIAEAVString@23@W4FormatFlags@23@W4Arch@23@W4TypeId@23@@Z
?formatFeature@Formatter@_abi_1_13@asmjit@@YAIAEAVString@23@W4Arch@23@I@Z
?formatInstruction@Formatter@_abi_1_13@asmjit@@YAIAEAVString@23@W4FormatFlags@23@PEBVBaseEmitter@23@W4Arch@23@AEBVBaseInst@23@PEBUOperand_@23@_K@Z
?formatLabel@Formatter@_abi_1_13@asmjit@@YAIAEAVString@23@W4FormatFlags@23@PEBVBaseEmitter@23@I@Z
?formatNode@Formatter@_abi_1_13@asmjit@@YAIAEAVString@23@AEBVFormatOptions@23@PEBVBaseBuilder@23@PEBVBaseNode@23@@Z
?formatNodeList@Formatter@_abi_1_13@asmjit@@YAIAEAVString@23@AEBVFormatOptions@23@PEBVBaseBuilder@23@@Z
?formatNodeList@Formatter@_abi_1_13@asmjit@@YAIAEAVString@23@AEBVFormatOptions@23@PEBVBaseBuilder@23@PEBVBaseNode@23@3@Z
?formatOperand@Formatter@_abi_1_13@asmjit@@YAIAEAVString@23@W4FormatFlags@23@PEBVBaseEmitter@23@W4Arch@23@AEBUOperand_@23@@Z
?formatRegister@Formatter@_abi_1_13@asmjit@@YAIAEAVString@23@W4FormatFlags@23@PEBVBaseEmitter@23@W4Arch@23@W4RegType@23@I@Z
?formatTypeId@Formatter@_abi_1_13@asmjit@@YAIAEAVString@23@W4TypeId@23@@Z
?growBuffer@CodeHolder@_abi_1_13@asmjit@@QEAAIPEAUCodeBuffer@23@_K@Z
?handleError@ErrorHandler@_abi_1_13@asmjit@@UEAAXIPEBDPEAVBaseEmitter@23@@Z
?hardenedRuntimeInfo@VirtMem@_abi_1_13@asmjit@@YA?AUHardenedRuntimeInfo@123@XZ
?host@CpuInfo@_abi_1_13@asmjit@@SAAEBV123@XZ
?info@VirtMem@_abi_1_13@asmjit@@YA?AUInfo@123@XZ
?init@CallConv@_abi_1_13@asmjit@@QEAAIW4CallConvId@23@AEBVEnvironment@23@@Z
?init@CodeHolder@_abi_1_13@asmjit@@QEAAIAEBVEnvironment@23@AEBVCpuFeatures@23@_K@Z
?init@CodeHolder@_abi_1_13@asmjit@@QEAAIAEBVEnvironment@23@_K@Z
?init@FuncDetail@_abi_1_13@asmjit@@QEAAIAEBUFuncSignature@23@AEBVEnvironment@23@@Z
?init@FuncFrame@_abi_1_13@asmjit@@QEAAIAEBVFuncDetail@23@@Z
?instIdToString@InstAPI@_abi_1_13@asmjit@@YAIW4Arch@23@IAEAVString@23@@Z
?isLabelValid@BaseEmitter@_abi_1_13@asmjit@@QEBA_NI@Z
?labelByName@BaseEmitter@_abi_1_13@asmjit@@QEAA?AVLabel@23@PEBD_KI@Z
?labelIdByName@CodeHolder@_abi_1_13@asmjit@@QEAAIPEBD_KI@Z
?labelNodeOf@BaseBuilder@_abi_1_13@asmjit@@QEAAIPEAPEAVLabelNode@23@I@Z
?largePageSize@VirtMem@_abi_1_13@asmjit@@YA_KXZ
?logf@Logger@_abi_1_13@asmjit@@QEAAIPEBDZZ
?logv@Logger@_abi_1_13@asmjit@@QEAAIPEBDPEAD@Z
?newAlignNode@BaseBuilder@_abi_1_13@asmjit@@QEAAIPEAPEAVAlignNode@23@W4AlignMode@23@I@Z
?newCommentNode@BaseBuilder@_abi_1_13@asmjit@@QEAAIPEAPEAVCommentNode@23@PEBD_K@Z
?newConstPoolNode@BaseBuilder@_abi_1_13@asmjit@@QEAAIPEAPEAVConstPoolNode@23@@Z
?newEmbedDataNode@BaseBuilder@_abi_1_13@asmjit@@QEAAIPEAPEAVEmbedDataNode@23@W4TypeId@23@PEBX_K3@Z
?newFuncNode@BaseCompiler@_abi_1_13@asmjit@@QEAAIPEAPEAVFuncNode@23@AEBUFuncSignature@23@@Z
?newFuncRetNode@BaseCompiler@_abi_1_13@asmjit@@QEAAIPEAPEAVFuncRetNode@23@AEBUOperand_@23@1@Z
?newInstNode@BaseBuilder@_abi_1_13@asmjit@@QEAAIPEAPEAVInstNode@23@IW4InstOptions@23@I@Z
?newInvokeNode@BaseCompiler@_abi_1_13@asmjit@@QEAAIPEAPEAVInvokeNode@23@IAEBUOperand_@23@AEBUFuncSignature@23@@Z
?newJumpAnnotation@BaseCompiler@_abi_1_13@asmjit@@QEAAPEAVJumpAnnotation@23@XZ
?newJumpNode@BaseCompiler@_abi_1_13@asmjit@@QEAAIPEAPEAVJumpNode@23@IW4InstOptions@23@AEBUOperand_@23@PEAVJumpAnnotation@23@@Z
?newLabel@BaseAssembler@_abi_1_13@asmjit@@UEAA?AVLabel@23@XZ
?newLabel@BaseBuilder@_abi_1_13@asmjit@@UEAA?AVLabel@23@XZ
?newLabel@BaseEmitter@_abi_1_13@asmjit@@UEAA?AVLabel@23@XZ
?newLabelEntry@CodeHolder@_abi_1_13@asmjit@@QEAAIPEAPEAVLabelEntry@23@@Z
?newLabelLink@CodeHolder@_abi_1_13@asmjit@@QEAAPEAULabelLink@23@PEAVLabelEntry@23@I_K_JAEBUOffsetFormat@23@@Z
?newLabelNode@BaseBuilder@_abi_1_13@asmjit@@QEAAIPEAPEAVLabelNode@23@@Z
?newNamedLabel@BaseAssembler@_abi_1_13@asmjit@@UEAA?AVLabel@23@PEBD_KW4LabelType@23@I@Z
?newNamedLabel@BaseBuilder@_abi_1_13@asmjit@@UEAA?AVLabel@23@PEBD_KW4LabelType@23@I@Z
?newNamedLabel@BaseEmitter@_abi_1_13@asmjit@@UEAA?AVLabel@23@PEBD_KW4LabelType@23@I@Z
?newNamedLabelEntry@CodeHolder@_abi_1_13@asmjit@@QEAAIPEAPEAVLabelEntry@23@PEBD_KW4LabelType@23@I@Z
?newRelocEntry@CodeHolder@_abi_1_13@asmjit@@QEAAIPEAPEAURelocEntry@23@W4RelocType@23@@Z
?newSection@CodeHolder@_abi_1_13@asmjit@@QEAAIPEAPEAVSection@23@PEBD_KW4SectionFlags@23@IH@Z
?newVirtReg@BaseCompiler@_abi_1_13@asmjit@@QEAAIPEAPEAVVirtReg@23@W4TypeId@23@UOperandSignature@23@PEBD@Z
?onAttach@Assembler@a64@_abi_1_13@asmjit@@UEAAIPEAVCodeHolder@34@@Z
?onAttach@Assembler@x86@_abi_1_13@asmjit@@UEAAIPEAVCodeHolder@34@@Z
?onAttach@BaseAssembler@_abi_1_13@asmjit@@UEAAIPEAVCodeHolder@23@@Z
?onAttach@BaseBuilder@_abi_1_13@asmjit@@UEAAIPEAVCodeHolder@23@@Z
?onAttach@BaseCompiler@_abi_1_13@asmjit@@UEAAIPEAVCodeHolder@23@@Z
?onAttach@BaseEmitter@_abi_1_13@asmjit@@UEAAIPEAVCodeHolder@23@@Z
?onAttach@Builder@a64@_abi_1_13@asmjit@@UEAAIPEAVCodeHolder@34@@Z
?onAttach@Builder@x86@_abi_1_13@asmjit@@UEAAIPEAVCodeHolder@34@@Z
?onAttach@Compiler@a64@_abi_1_13@asmjit@@UEAAIPEAVCodeHolder@34@@Z
?onAttach@Compiler@x86@_abi_1_13@asmjit@@UEAAIPEAVCodeHolder@34@@Z
?onDetach@Assembler@a64@_abi_1_13@asmjit@@UEAAIPEAVCodeHolder@34@@Z
?onDetach@Assembler@x86@_abi_1_13@asmjit@@UEAAIPEAVCodeHolder@34@@Z
?onDetach@BaseAssembler@_abi_1_13@asmjit@@UEAAIPEAVCodeHolder@23@@Z
?onDetach@BaseBuilder@_abi_1_13@asmjit@@UEAAIPEAVCodeHolder@23@@Z
?onDetach@BaseCompiler@_abi_1_13@asmjit@@UEAAIPEAVCodeHolder@23@@Z
?onDetach@BaseEmitter@_abi_1_13@asmjit@@UEAAIPEAVCodeHolder@23@@Z
?onDetach@Builder@a64@_abi_1_13@asmjit@@UEAAIPEAVCodeHolder@34@@Z
?onDetach@Builder@x86@_abi_1_13@asmjit@@UEAAIPEAVCodeHolder@34@@Z
?onDetach@Compiler@a64@_abi_1_13@asmjit@@UEAAIPEAVCodeHolder@34@@Z
?onDetach@Compiler@x86@_abi_1_13@asmjit@@UEAAIPEAVCodeHolder@34@@Z
?onSettingsUpdated@BaseEmitter@_abi_1_13@asmjit@@UEAAXXZ
?padEnd@String@_abi_1_13@asmjit@@QEAAI_KD@Z
?passByName@BaseBuilder@_abi_1_13@asmjit@@QEBAPEAVPass@23@PEBD@Z
?prepare@String@_abi_1_13@asmjit@@QEAAPEADW4ModifyOp@123@_K@Z
?protect@VirtMem@_abi_1_13@asmjit@@YAIPEAX_KW4MemoryFlags@123@@Z
?protectJitMemory@VirtMem@_abi_1_13@asmjit@@YAXW4ProtectJitAccess@123@@Z
?query@JitAllocator@_abi_1_13@asmjit@@QEBAIAEAVSpan@123@PEAX@Z
?queryFeatures@InstAPI@_abi_1_13@asmjit@@YAIW4Arch@23@AEBVBaseInst@23@PEBUOperand_@23@_KPEAVCpuFeatures@23@@Z
?queryRWInfo@InstAPI@_abi_1_13@asmjit@@YAIW4Arch@23@AEBVBaseInst@23@PEBUOperand_@23@_KPEAUInstRWInfo@23@@Z
?registerLabelNode@BaseBuilder@_abi_1_13@asmjit@@QEAAIPEAVLabelNode@23@@Z
?release@JitAllocator@_abi_1_13@asmjit@@QEAAIPEAX@Z
?release@VirtMem@_abi_1_13@asmjit@@YAIPEAX_K@Z
?releaseDualMapping@VirtMem@_abi_1_13@asmjit@@YAIPEAUDualMapping@123@_K@Z
?relocateToBase@CodeHolder@_abi_1_13@asmjit@@QEAAI_K@Z
?removeNode@BaseBuilder@_abi_1_13@asmjit@@QEAAPEAVBaseNode@23@PEAV423@@Z
?removeNodes@BaseBuilder@_abi_1_13@asmjit@@QEAAXPEAVBaseNode@23@0@Z
?rename@BaseCompiler@_abi_1_13@asmjit@@QEAAXAEBVBaseReg@23@PEBDZZ
?reportError@BaseEmitter@_abi_1_13@asmjit@@QEAAIIPEBD@Z
?reserveBuffer@CodeHolder@_abi_1_13@asmjit@@QEAAIPEAUCodeBuffer@23@_K@Z
?reset@CodeHolder@_abi_1_13@asmjit@@QEAAXW4ResetPolicy@23@@Z
?reset@ConstPool@_abi_1_13@asmjit@@QEAAXPEAVZone@23@@Z
?reset@JitAllocator@_abi_1_13@asmjit@@QEAAXW4ResetPolicy@23@@Z
?reset@String@_abi_1_13@asmjit@@QEAAIXZ
?reset@Zone@_abi_1_13@asmjit@@QEAAXW4ResetPolicy@23@@Z
?reset@ZoneAllocator@_abi_1_13@asmjit@@QEAAXPEAVZone@23@@Z
?resolveUnresolvedLinks@CodeHolder@_abi_1_13@asmjit@@QEAAIXZ
?run@FuncPass@_abi_1_13@asmjit@@UEAAIPEAVZone@23@PEAVLogger@23@@Z
?run@Pass@_abi_1_13@asmjit@@UEAAIPEAVZone@23@PEAVLogger@23@@Z
?runOnFunction@FuncPass@_abi_1_13@asmjit@@UEAAIPEAVZone@23@PEAVLogger@23@PEAVFuncNode@23@@Z
?runPasses@BaseBuilder@_abi_1_13@asmjit@@QEAAIXZ
?scopedWrite@JitAllocator@_abi_1_13@asmjit@@QEAAIAEAUWriteScopeData@123@AEAVSpan@123@P6AI1PEAX@Z2@Z
?scopedWrite@JitAllocator@_abi_1_13@asmjit@@QEAAIAEAUWriteScopeData@123@AEAVSpan@123@_KPEBX2@Z
?section@BaseAssembler@_abi_1_13@asmjit@@UEAAIPEAVSection@23@@Z
?section@BaseBuilder@_abi_1_13@asmjit@@UEAAIPEAVSection@23@@Z
?section@BaseEmitter@_abi_1_13@asmjit@@UEAAIPEAVSection@23@@Z
?sectionByName@CodeHolder@_abi_1_13@asmjit@@QEBAPEAVSection@23@PEBD_K@Z
?sectionNodeOf@BaseBuilder@_abi_1_13@asmjit@@QEAAIPEAPEAVSectionNode@23@I@Z
?serializeTo@BaseBuilder@_abi_1_13@asmjit@@QEAAIPEAVBaseEmitter@23@@Z
?setCursor@BaseBuilder@_abi_1_13@asmjit@@QEAAPEAVBaseNode@23@PEAV423@@Z
?setErrorHandler@BaseEmitter@_abi_1_13@asmjit@@QEAAXPEAVErrorHandler@23@@Z
?setErrorHandler@CodeHolder@_abi_1_13@asmjit@@QEAAXPEAVErrorHandler@23@@Z
?setLogger@BaseEmitter@_abi_1_13@asmjit@@QEAAXPEAVLogger@23@@Z
?setLogger@CodeHolder@_abi_1_13@asmjit@@QEAAXPEAVLogger@23@@Z
?setOffset@BaseAssembler@_abi_1_13@asmjit@@QEAAI_K@Z
?setStackSize@BaseCompiler@_abi_1_13@asmjit@@QEAAIIII@Z
?sformat@Zone@_abi_1_13@asmjit@@QEAAPEADPEBDZZ
?shrink@JitAllocator@_abi_1_13@asmjit@@QEAAIAEAVSpan@123@_K@Z
?stackAlignment@Environment@_abi_1_13@asmjit@@QEBAIXZ
?statistics@JitAllocator@_abi_1_13@asmjit@@QEBA?AUStatistics@123@XZ
?stringToInstId@InstAPI@_abi_1_13@asmjit@@YAIW4Arch@23@PEBD_K@Z
?truncate@String@_abi_1_13@asmjit@@QEAAI_K@Z
?typeIdToRegSignature@ArchUtils@_abi_1_13@asmjit@@YAIW4Arch@23@W4TypeId@23@PEAW4523@PEAUOperandSignature@23@@Z
?updateFuncFrame@FuncArgsAssignment@_abi_1_13@asmjit@@QEBAIAEAVFuncFrame@23@@Z
?updateSectionLinks@BaseBuilder@_abi_1_13@asmjit@@QEAAXXZ
?validate@InstAPI@_abi_1_13@asmjit@@YAIW4Arch@23@AEBVBaseInst@23@PEBUOperand_@23@_KW4ValidationFlags@23@@Z
?write@JitAllocator@_abi_1_13@asmjit@@QEAAIAEAVSpan@123@P6AI0PEAX@Z1W4CachePolicy@VirtMem@23@@Z
?write@JitAllocator@_abi_1_13@asmjit@@QEAAIAEAVSpan@123@_KPEBX1W4CachePolicy@VirtMem@23@@Z

Sections

.text
Size: - Virtual size: 419KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.;zC
Size: - Virtual size: 9.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rGs
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.oMn
Size: 13.3MB - Virtual size: 13.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1495c2a37534cbd192196e59c575f74a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

msvcp140

ntdll

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

Exports

Exports

Sections

.text Size: - Virtual size: 419KB

.rdata Size: - Virtual size: 149KB

.data Size: - Virtual size: 5KB

.pdata Size: - Virtual size: 12KB

.;zC Size: - Virtual size: 9.2MB

.rGs Size: 3KB - Virtual size: 2KB

.oMn Size: 13.3MB - Virtual size: 13.3MB

.reloc Size: 512B - Virtual size: 104B

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 419KB

.rdata
Size: - Virtual size: 149KB

.data
Size: - Virtual size: 5KB

.pdata
Size: - Virtual size: 12KB

.;zC
Size: - Virtual size: 9.2MB

.rGs
Size: 3KB - Virtual size: 2KB

.oMn
Size: 13.3MB - Virtual size: 13.3MB

.reloc
Size: 512B - Virtual size: 104B

.rsrc
Size: 512B - Virtual size: 480B