85b4ad4494c81464eb6728b5c9278311

Sharing

Copy URL Twitter E-mail

General

Target

85b4ad4494c81464eb6728b5c9278311
Size

1.3MB
MD5

85b4ad4494c81464eb6728b5c9278311
SHA1

cd969e1935e62a1fca9bcf5934a4025b5f70f59a
SHA256

ef11503f4a2484876dbceefd8315e40638fcaa473cf3f8397b735a94ccccd7b1
SHA512

83b309892c5a9f211decab708b960dae3a89978844239afc69e1bcd1d84e53bcd359a77360523b85b69e54f32b6cab928a27a92405a57dbd25449282fa7f8dc6
SSDEEP

24576:+eukVgFyWSmxJzoirH2k7bk72hCYZU6TFZ4vC80quaM9TWOCw4CLDd:N5mPMOU6TFZX83uaM9H4CLDd

Score

1^/10

Malware Config

Signatures

Files

85b4ad4494c81464eb6728b5c9278311
.dll windows:6 windows x86 arch:x86

d92e5fee9464aafc8cb418c271f179ee

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

09:90:fb:6f:d4:13:03:58:16:e4:87:59:da:ee:71:f2
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

05/07/2017, 00:00

Not After

24/09/2019, 23:59

Subject

CN=LULU Software,O=LULU Software,L=Saint-Laurent,ST=Quebec,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

09:90:fb:6f:d4:13:03:58:16:e4:87:59:da:ee:71:f2
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

05/07/2017, 00:00

Not After

24/09/2019, 23:59

Subject

CN=LULU Software,O=LULU Software,L=Saint-Laurent,ST=Quebec,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

53:57:04:a9:1d:87:f5:df:5c:7e:3f:64:25:71:82:9c:87:91:3a:9b:ef:4e:3c:4b:d8:04:30:b4:5d:13:5a:5f
Signer

Actual PE Digest

53:57:04:a9:1d:87:f5:df:5c:7e:3f:64:25:71:82:9c:87:91:3a:9b:ef:4e:3c:4b:d8:04:30:b4:5d:13:5a:5f

Digest Algorithm

sha256

PE Digest Matches

true

2e:25:21:26:2e:c3:a8:f3:dc:ae:15:b7:20:54:8c:ce:32:99:59:9b
Signer

Actual PE Digest

2e:25:21:26:2e:c3:a8:f3:dc:ae:15:b7:20:54:8c:ce:32:99:59:9b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\TemporaryBuilds\main_app_builder_1\3\s\App\_bin\soda\Win32\Release\ui-update.pdb

Imports

encoding-conversion

_SLConvertUTF8ToUTF16@16
_SLConvertACPToUnicode@16
_SLConvertUTF16ToUTF8@16
_SLConvertUnicodeToACP@16

user32

SetWindowPos
IsWindow
PostMessageW
SetWindowTextW
PostThreadMessageW
SystemParametersInfoW
LoadImageW
SendNotifyMessageW
IsWindowVisible
RegisterWindowMessageW
CreateWindowExW
RegisterClassExW
MonitorFromRect
SendMessageW
EnableWindow
GetWindowRect
InflateRect
GetMonitorInfoW
MonitorFromWindow
UpdateWindow
GetClientRect
LoadStringW
SetForegroundWindow
GetClassInfoExW

kernel32

Sleep
GetCurrentThreadId
FormatMessageW
LocalFree
GetModuleHandleW
GetProcAddress
CloseHandle
CreateEventA
SetEvent
WaitForSingleObjectEx
LocalAlloc
GetCurrentProcess
GetFileAttributesW
GetModuleFileNameW
lstrcpynW
GetCurrentProcessId
ProcessIdToSessionId
GetLastError
RaiseException
GetSystemTime
SystemTimeToFileTime
DeviceIoControl
LoadResource
LockResource
SizeofResource
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
HeapAlloc
HeapFree
GetProcessHeap
ReleaseSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
AcquireSRWLockShared
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetTempPathW
GetLongPathNameW
CreateProcessW
FormatMessageA
LCMapStringW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryA
GetStringTypeExW
GetUserDefaultLCID
OutputDebugStringW
GetTickCount
TlsFree
TlsSetValue
VirtualProtect
TlsGetValue
TlsAlloc
ResumeThread
SetWaitableTimer
OpenEventA
WaitForMultipleObjectsEx
ReleaseSemaphore
ResetEvent
LoadLibraryExA
FreeLibrary
VirtualQuery
FindResourceW
GetSystemInfo
CreateFileW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeSListHead
CreateEventW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CreateWaitableTimerA
GetModuleHandleA

shell32

Shell_NotifyIconW

ole32

CoUninitialize
CoResumeClassObjects
CoAddRefServerProcess
CoReleaseServerProcess
CoRegisterClassObject
CoRevokeClassObject
OleRun
CoInitializeEx
CoCreateInstance

oleaut32

SysFreeString
SysStringLen
SysAllocString
GetErrorInfo

atom

_SLGetAtomFromString@8
_CalculateSequenceHash@12
_IsSingletonStaticDataStorageAvailable@0
_GetSingletonStaticData@12
_CreateSingletonStaticData@16
_SLGetStringFromAtom@8

ui-service-provider

_ServiceProviderGetServiceObject@12

msvcp140

?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Xlength_error@std@@YAXPBD@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?widen@?$ctype@_W@std@@QBE_WD@Z
?_Xout_of_range@std@@YAXPBD@Z
?narrow@?$ctype@_W@std@@QBED_WD@Z
?is@?$ctype@_W@std@@QBE_NF_W@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?id@?$ctype@_W@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?exceptions@ios_base@std@@QAEXH@Z
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
?_BADOFF@std@@3_JB
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
?_Xbad_function_call@std@@YAXXZ
??_D?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Xbad_alloc@std@@YAXXZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?toupper@?$ctype@_W@std@@QBE_W_W@Z
?_Throw_C_error@std@@YAXH@Z
_Mtx_lock
_Mtx_unlock
_Cnd_wait
_Cnd_broadcast
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_register_at_thread_exit
_Cnd_unregister_at_thread_exit
?_Syserror_map@std@@YAPBDH@Z
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?_Release_chore@details@Concurrency@@YAXPAU_Threadpool_chore@12@@Z
?_Schedule_chore@details@Concurrency@@YAHPAU_Threadpool_chore@12@@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_Capture@_ContextCallback@details@Concurrency@@AAEXXZ
?_Reset@_ContextCallback@details@Concurrency@@AAEXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QBEXV?$function@$$A6AXXZ@std@@_N@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AAEXXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?__ExceptionPtrRethrow@@YAXPBX@Z
??0task_continuation_context@Concurrency@@AAE@XZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QAEX_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?do_unshift@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Throw_future_error@std@@YAXABVerror_code@1@@Z
?__ExceptionPtrToBool@@YA_NPBX@Z
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QAEXXZ
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?_XGetLastError@std@@YAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?classic@locale@std@@SAABV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_J@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PBX@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?imbue@ios_base@std@@QAE?AVlocale@2@ABV32@@Z
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?id@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?id@?$numpunct@D@std@@2V0locale@2@A
?tolower@?$ctype@D@std@@QBEDD@Z
??1?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAO@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAN@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAM@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAK@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAI@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAG@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z
?_Getcat@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@PBD3@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?putback@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAM@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@M@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?do_always_noconv@?$codecvt@_WDU_Mbstatet@@@std@@MBE_NXZ
?do_length@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ

vcruntime140

__std_type_info_destroy_list
__RTtypeid
__CxxFrameHandler3
__std_terminate
_except_handler4_common
__std_exception_copy
_purecall
__std_type_info_compare
__std_type_info_name
__RTDynamicCast
memcpy
memmove
memset
_CxxThrowException
__std_exception_destroy

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_beginthreadex
_invalid_parameter_noinfo_noreturn
strerror
_seh_filter_dll
terminate
_errno
_configure_narrow_argv
_initialize_narrow_environment

api-ms-win-crt-string-l1-1-0

wcsncpy_s
strncpy_s
_wcsnicmp
wcsnlen
strnlen
tolower
isspace
isdigit
_wcsicmp

api-ms-win-crt-heap-l1-1-0

malloc
calloc
free
_callnewh

api-ms-win-crt-stdio-l1-1-0

ungetc
fflush
setvbuf
fgetpos
fsetpos
_get_stream_buffer_pointers
fputc
__stdio_common_vsnprintf_s
fwrite
_fseeki64
fclose
__stdio_common_vswprintf_s
fgetc

api-ms-win-crt-filesystem-l1-1-0

_unlock_file
_lock_file

api-ms-win-crt-time-l1-1-0

_gmtime64
_gmtime64_s

brand

_GetProductNameDll@4

Exports

Exports

??0?$oserializer@Vxml_woarchive@archive@boost@@UAppCheckUpdatesData@@@detail@archive@boost@@QAE@XZ
??0?$oserializer@Vxml_woarchive@archive@boost@@VPreviewerSwitcherContext@WS@@@detail@archive@boost@@QAE@XZ
??0?$oserializer@Vxml_woarchive@archive@boost@@VSessionIdContext@WS@@@detail@archive@boost@@QAE@XZ
??0?$oserializer@Vxml_woarchive@archive@boost@@Vdate@gregorian@3@@detail@archive@boost@@QAE@XZ
??0?$oserializer@Vxml_woarchive@archive@boost@@Vptime@posix_time@3@@detail@archive@boost@@QAE@XZ
??0?$oserializer@Vxml_woarchive@archive@boost@@Vtime_duration@posix_time@3@@detail@archive@boost@@QAE@XZ
??0?$singleton@V?$extended_type_info_typeid@UAppCheckUpdatesData@@@serialization@boost@@@serialization@boost@@QAE@XZ
??0?$singleton@V?$extended_type_info_typeid@VPreviewerSwitcherContext@WS@@@serialization@boost@@@serialization@boost@@QAE@XZ
??0?$singleton@V?$extended_type_info_typeid@VSessionIdContext@WS@@@serialization@boost@@@serialization@boost@@QAE@XZ
??0?$singleton@V?$extended_type_info_typeid@Vdate@gregorian@boost@@@serialization@boost@@@serialization@boost@@QAE@XZ
??0?$singleton@V?$extended_type_info_typeid@Vptime@posix_time@boost@@@serialization@boost@@@serialization@boost@@QAE@XZ
??0?$singleton@V?$extended_type_info_typeid@Vtime_duration@posix_time@boost@@@serialization@boost@@@serialization@boost@@QAE@XZ
??1?$singleton@V?$extended_type_info_typeid@UAppCheckUpdatesData@@@serialization@boost@@@serialization@boost@@QAE@XZ
??1?$singleton@V?$extended_type_info_typeid@VPreviewerSwitcherContext@WS@@@serialization@boost@@@serialization@boost@@QAE@XZ
??1?$singleton@V?$extended_type_info_typeid@VSessionIdContext@WS@@@serialization@boost@@@serialization@boost@@QAE@XZ
??1?$singleton@V?$extended_type_info_typeid@Vdate@gregorian@boost@@@serialization@boost@@@serialization@boost@@QAE@XZ
??1?$singleton@V?$extended_type_info_typeid@Vptime@posix_time@boost@@@serialization@boost@@@serialization@boost@@QAE@XZ
??1?$singleton@V?$extended_type_info_typeid@Vtime_duration@posix_time@boost@@@serialization@boost@@@serialization@boost@@QAE@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UAppCheckUpdatesData@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UAppCheckUpdatesData@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@VPreviewerSwitcherContext@WS@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@VPreviewerSwitcherContext@WS@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@VSessionIdContext@WS@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@VSessionIdContext@WS@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@Vdate@gregorian@boost@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@Vdate@gregorian@boost@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@Vptime@posix_time@boost@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@Vptime@posix_time@boost@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@Vtime_duration@posix_time@boost@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@Vtime_duration@posix_time@boost@@@23@XZ
?get_const_instance@?$singleton@V?$map@Vxml_woarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vxml_woarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$oserializer@Vxml_woarchive@archive@boost@@UAppCheckUpdatesData@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vxml_woarchive@archive@boost@@UAppCheckUpdatesData@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vxml_woarchive@archive@boost@@VPreviewerSwitcherContext@WS@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vxml_woarchive@archive@boost@@VPreviewerSwitcherContext@WS@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vxml_woarchive@archive@boost@@VSessionIdContext@WS@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vxml_woarchive@archive@boost@@VSessionIdContext@WS@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vxml_woarchive@archive@boost@@Vdate@gregorian@3@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vxml_woarchive@archive@boost@@Vdate@gregorian@3@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vxml_woarchive@archive@boost@@Vptime@posix_time@3@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vxml_woarchive@archive@boost@@Vptime@posix_time@3@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vxml_woarchive@archive@boost@@Vtime_duration@posix_time@3@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vxml_woarchive@archive@boost@@Vtime_duration@posix_time@3@@detail@archive@3@XZ
?get_lock@singleton_module@serialization@boost@@CAAA_NXZ
?get_mutable_instance@?$singleton@V?$map@Vxml_woarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vxml_woarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?is_destroyed@?$singleton@V?$map@Vxml_woarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_locked@singleton_module@serialization@boost@@SA_NXZ
?lock@?1??get_lock@singleton_module@serialization@boost@@CAAA_NXZ@4_NA
?lock@singleton_module@serialization@boost@@SAXXZ
?save_object_data@?$oserializer@Vxml_woarchive@archive@boost@@UAppCheckUpdatesData@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vxml_woarchive@archive@boost@@VPreviewerSwitcherContext@WS@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vxml_woarchive@archive@boost@@VSessionIdContext@WS@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vxml_woarchive@archive@boost@@Vdate@gregorian@3@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vxml_woarchive@archive@boost@@Vptime@posix_time@3@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vxml_woarchive@archive@boost@@Vtime_duration@posix_time@3@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?unlock@singleton_module@serialization@boost@@SAXXZ
CreateServiceObject
ReflectServiceObjectInfo
RegisterResources
ServiceObjectModuleInitialize
ServiceObjectModuleOnCleanup
ServiceObjectModuleOnFree
_CreateServiceObject@8
_ReflectServiceObjectInfo@8
_RegisterResources@4
_ServiceObjectModuleInitialize@0
_ServiceObjectModuleOnCleanup@0
_ServiceObjectModuleOnFree@0

Sections

.text
Size: 752KB - Virtual size: 751KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 289KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 96KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 151KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d92e5fee9464aafc8cb418c271f179ee

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

09:90:fb:6f:d4:13:03:58:16:e4:87:59:da:ee:71:f2Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

09:90:fb:6f:d4:13:03:58:16:e4:87:59:da:ee:71:f2Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6Certificate

Extended Key Usages

Key Usages

53:57:04:a9:1d:87:f5:df:5c:7e:3f:64:25:71:82:9c:87:91:3a:9b:ef:4e:3c:4b:d8:04:30:b4:5d:13:5a:5fSigner

2e:25:21:26:2e:c3:a8:f3:dc:ae:15:b7:20:54:8c:ce:32:99:59:9bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

encoding-conversion

user32

kernel32

shell32

ole32

oleaut32

atom

ui-service-provider

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

brand

Exports

Exports

Sections

.text Size: 752KB - Virtual size: 751KB

.rdata Size: 289KB - Virtual size: 288KB

.data Size: 96KB - Virtual size: 98KB

.rsrc Size: 151KB - Virtual size: 150KB

.reloc Size: 77KB - Virtual size: 76KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

09:90:fb:6f:d4:13:03:58:16:e4:87:59:da:ee:71:f2
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

09:90:fb:6f:d4:13:03:58:16:e4:87:59:da:ee:71:f2
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

53:57:04:a9:1d:87:f5:df:5c:7e:3f:64:25:71:82:9c:87:91:3a:9b:ef:4e:3c:4b:d8:04:30:b4:5d:13:5a:5f
Signer

2e:25:21:26:2e:c3:a8:f3:dc:ae:15:b7:20:54:8c:ce:32:99:59:9b
Signer

.text
Size: 752KB - Virtual size: 751KB

.rdata
Size: 289KB - Virtual size: 288KB

.data
Size: 96KB - Virtual size: 98KB

.rsrc
Size: 151KB - Virtual size: 150KB

.reloc
Size: 77KB - Virtual size: 76KB