FileCoAuth[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

FileCoAuth.exe
Size

1.1MB
MD5

15925dccdc840337f6ae6bddd24f43e1
SHA1

e42679cd01361b874ff5a7f1163784ebf9de874d
SHA256

890db7d75b5dd8955b9cb73c320b84e08d1df8a2c48f0e0a751181e0be5cfcc1
SHA512

d9a7ef48f4fe8f3c6b46f0cffd32fdb99f1c3537093d301fa8cfbdb451a82c7ef34d85b17142bf95bd431c95ca09f8de3ef4de060e194b117103f8e92c064e5b
SSDEEP

12288:T4qNtft4j9c5lVkJQAdsS03vBbvRjReEEeKAwEkfnq6Puf8NBSMGyzk5hZ0p:Uq4hc5/kJQAdsSYfdehFHq6VoMGyzSs

Score

1^/10

Malware Config

Signatures

Files

FileCoAuth.exe
.exe windows:6 windows x64 arch:x64

0691bcb5ba574850b38515a946db8a25

Code Sign

33:00:00:05:4e:12:b9:0a:00:7b:12:49:99:00:00:00:00:05:4e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2023, 19:50

Not After

16/10/2024, 19:50

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

57:7a:28:70:68:26:8e:4e:f3:76:1f:de:14:d7:25:8a:fd:8c:86:de:b2:38:06:3d:4c:67:5e:01:47:c2:e6:57
Signer

Actual PE Digest

57:7a:28:70:68:26:8e:4e:f3:76:1f:de:14:d7:25:8a:fd:8c:86:de:b2:38:06:3d:4c:67:5e:01:47:c2:e6:57

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\dbs\sh\odct\0202_163225_0\client\onedrive\Product\FileCoAuth\Desktop\exe\obj\amd64\FileCoAuth.pdb

Imports

loggingplatform

?LoggingSetCommonDatapoint@@YAXPEB_W0@Z
?LoggingSetCommonDatapointUserId@@YAXPEB_WW4UserIdType@@@Z
?GetEmptyTelemetryUsageExperimentVector@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?StripPrivateInfoFromString@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEB_W@Z
?GuidToString@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBU_GUID@@@Z
?NarrowStringToWideString@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEBD@Z
?LoggingSendTelemetryEvent@@YAXAEAUTelemetryEvent@@QEAUStructuredEventParameter@@@Z
?SetEventExpiration@TelemetryEvent@@QEAAXII@Z
??1TelemetryEvent@@QEAA@XZ
??0TelemetryEvent@@QEAA@PEBD0AEBU_GUID@@II00II@Z
?g_pLoggingAPIWrapper@@3PEAVILoggingAPIWrapper@@EA
?OneDriveAssertWorker@@YAXPEB_WW4OneDriveAssertType@@0I000ZZ
?GetActiveHydrationsCount@QoS@@YAIXZ
?IsAnyLibraryIrmEnabled@QoS@@YA_NXZ
?LoggingRecordAssert@@YAXPEB_W000I0_NI1@Z
?LoggingInitializeForExternalComponent@@YAJPEB_W0_NG11W4TelemetryTransportType@@0K1@Z
?LoggingRotateIfNeeded@@YAXXZ
?LoggingWriteStructuredEvent@@YAXAEBUStructuredEvent@@QEAUStructuredEventParameter@@@Z
??0StructuredEvent@@QEAA@PEBDH0AEBU_GUID@@IIII@Z

telemetry

?Report@IncomingTelemetry@@YAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00JV?$duration@_JU?$ratio@$00$0DLJKMKAA@@std@@@chrono@3@@Z

updateringsettings

?GetUpdateRingSettingsManager@@YAPEAVIUpdateRingSettingsManager@@XZ

propsys

PropVariantToUInt32
PropVariantToStringAlloc

ntdll

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
VerSetConditionMask
RtlNtStatusToDosError
NtQueryDirectoryFile

kernel32

SetFileInformationByHandle
SetFilePointer
GetCompressedFileSizeW
FindFirstFileNameW
IsDebuggerPresent
SetHandleInformation
CreatePipe
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
DeviceIoControl
LoadLibraryExW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
ReadDirectoryChangesW
CreateSymbolicLinkW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetProductInfo
VerifyVersionInfoW
SetLastError
ReleaseMutex
WaitForMultipleObjects
GetEnvironmentVariableW
ExpandEnvironmentStringsW
GetProcessTimes
ReadFile
CreateProcessW
SetProcessShutdownParameters
GetSystemTimes
SetThreadInformation
GetPrivateProfileStringW
WritePrivateProfileStringW
SetDllDirectoryW
CopyFileW
MoveFileExW
ReplaceFileW
GetComputerNameW
RegisterApplicationRestart
GetFileInformationByHandleEx
OpenFileById
GetDllDirectoryW
FormatMessageW
GetVolumePathNameW
DebugBreak
WerRegisterFile
GetTickCount64
GetComputerNameExW
GetLogicalDrives
GetDriveTypeW
GetVolumeInformationW
DuplicateHandle
UnregisterApplicationRestart
SystemTimeToTzSpecificLocalTime
OpenMutexW
GetLocaleInfoW
GetFinalPathNameByHandleW
GetFileType
GetFileSizeEx
GetFileSize
OutputDebugStringW
InitOnceBeginInitialize
InitOnceComplete
InitializeCriticalSectionAndSpinCount
ResetEvent
GetFileInformationByHandle
GetFileAttributesExW
GetDiskFreeSpaceExW
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
CreateFileW
CreateDirectoryW
RemoveDirectoryW
GetLongPathNameW
GetTickCount
CreateEventExW
WaitForMultipleObjectsEx
FindNextFileW
LCMapStringW
WideCharToMultiByte
MultiByteToWideChar
K32GetModuleFileNameExW
GetUserDefaultLocaleName
GetUserDefaultLCID
GetUserGeoID
LCIDToLocaleName
MoveFileW
LocalAlloc
LoadLibraryW
FreeLibrary
GetVersionExW
GetSystemTimeAsFileTime
GetSystemTime
OpenProcess
TerminateProcess
GetCurrentProcessId
CreateMutexW
FindFirstFileW
FindClose
DeleteFileW
SystemTimeToFileTime
LocalFree
GetCurrentThread
SetFileAttributesW
GetFileAttributesW
CompareStringOrdinal
QueryFullProcessImageNameW
GetCurrentProcess
IsWow64Process
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
RaiseException
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
GetProcAddress
DecodePointer
HeapAlloc
CreateThread
CloseHandle
SetEvent
GetLastError
Sleep
CreateEventW
WaitForSingleObject
InitializeCriticalSectionEx
GetModuleFileNameW
GetCommandLineW
HeapFree
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
GetCurrentDirectoryW
InterlockedPushEntrySList
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetExitCodeProcess
QueueUserWorkItem
MoveFileWithProgressW
GetDateFormatW
OpenEventW
WaitForSingleObjectEx

user32

AdjustWindowRectEx
AllowSetForegroundWindow
SetWindowPos
EmptyClipboard
GetClipboardData
GetWindowLongW
MapWindowPoints
SetFocus
GetLastActivePopup
GetLastInputInfo
GetClassInfoExW
LoadIconW
PostThreadMessageW
TranslateMessage
CharNextW
DispatchMessageW
CharUpperW
GetMessageW
SetTimer
KillTimer
SetMenuDefaultItem
EnumWindows
GetClassNameW
MessageBoxW
GetClientRect
LoadImageW
GetWindowThreadProcessId
SystemParametersInfoW
PeekMessageW
PostQuitMessage
MsgWaitForMultipleObjectsEx
SetCursor
RegisterClipboardFormatW
SetClipboardData
CloseClipboard
OpenClipboard
LoadCursorW
GetProcessDefaultLayout
GetIconInfo
SendMessageTimeoutW
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
FindWindowW
GetWindowRect
TrackPopupMenu
GetSubMenu
SendMessageW
RegisterClassExW
SetForegroundWindow
IsHungAppWindow
IsWindow
EndDialog
ModifyMenuW
AppendMenuW
DeleteMenu
RemoveMenu
GetMenuItemCount
GetMenuStringW
EnableMenuItem
GetDoubleClickTime
ShowWindow
PostMessageW
DestroyWindow
RegisterClassW
CreateWindowExW

advapi32

RegGetValueW
InitializeAcl
CreateProcessWithTokenW
GetUserNameW
GetAce
SetFileSecurityW
CreateProcessAsUserW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
StartServiceW
StartServiceCtrlDispatcherW
DeleteAce
AddAce
CheckTokenMembership
SetServiceStatus
RegisterServiceCtrlHandlerW
QueryServiceStatusEx
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfig2W
ChangeServiceConfigW
RegDeleteTreeW
RegUnLoadKeyW
RegLoadKeyW
RegEnumKeyW
RegDeleteKeyExW
RegCreateKeyTransactedW
GetAclInformation
FreeSid
DuplicateTokenEx
CreateWellKnownSid
AllocateAndInitializeSid
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegNotifyChangeKeyValue
RegSetKeyValueW
RegSetValueExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyExW
LookupPrivilegeValueW
IsValidSid
GetTokenInformation
GetLengthSid
CopySid
AdjustTokenPrivileges
AccessCheck
SetEntriesInAclW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
OpenProcessToken
DuplicateToken
MapGenericMask
IsValidAcl
OpenThreadToken
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
RegDeleteKeyW
RegOpenKeyExW
RegCopyTreeW
ConvertStringSidToSidW

shell32

SHBrowseForFolderW
SHGetKnownFolderItem
SHCreateItemFromParsingName
CommandLineToArgvW
SHFileOperationW
SHGetSpecialFolderPathW
SHQueryUserNotificationState
SHChangeNotify
SHParseDisplayName
ShellExecuteExW
SHAssocEnumHandlers
SHGetFolderPathW
SHGetFolderPathAndSubDirW
SHSetKnownFolderPath
ord526
Shell_NotifyIconW
SHGetPathFromIDListW
SHCreateDirectoryExW
SHAppBarMessage
AssocCreateForClasses
ShellExecuteW
SHGetKnownFolderPath

ole32

StringFromCLSID
CreateBindCtx
CoRevertToSelf
CLSIDFromString
CoWaitForMultipleHandles
CoSetProxyBlanket
CoCreateGuid
CreateItemMoniker
CoImpersonateClient
PropVariantClear
CoInitializeSecurity
GetRunningObjectTable
CoAllowSetForegroundWindow
CoTaskMemFree
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoReleaseServerProcess
CoAddRefServerProcess
CoInitializeEx
CoRevokeClassObject
CoCreateInstance
CoRegisterClassObject
CoResumeClassObjects
CoUninitialize
CoGetObject
CoGetCallContext
StringFromGUID2

oleaut32

GetRecordInfoFromTypeInfo
SysAllocStringByteLen
UnRegisterTypeLi
LoadRegTypeLi
LoadTypeLi
SysStringByteLen
SafeArrayAccessData
SafeArrayUnaccessData
SysFreeString
RegisterTypeLi
SysAllocString
SysStringLen
GetErrorInfo
SetErrorInfo

crypt32

CryptBinaryToStringW
CryptStringToBinaryW
CertFindExtension

rpcrt4

RpcBindingFree
RpcBindingFromStringBindingW
RpcBindingVectorFree
RpcStringBindingComposeW
RpcServerInqBindings
RpcServerRegisterIfEx
RpcServerUnregisterIf
RpcServerUseProtseqW
RpcBindingSetAuthInfoExW
RpcEpRegisterW
RpcEpUnregister
RpcServerInqCallAttributesW
RpcStringFreeW
UuidToStringW

secur32

GetUserNameExW

shlwapi

SHCreateStreamOnFileEx
SHStrDupW
SHRegCreateUSKeyW
SHRegCloseUSKey
SHRegSetUSValueW
PathFileExistsW
PathFindFileNameW
SHGetValueW
SHRegGetUSValueW
PathIsDirectoryW
PathStripPathW
PathStripToRootW
PathIsPrefixW
StrStrIW
PathRemoveFileSpecW
PathIsDirectoryEmptyW
SHDeleteKeyW
SHDeleteValueW
AssocCreate
UrlEscapeW
UrlCreateFromPathW
SHSetValueW
SHCreateStreamOnFileW
AssocQueryStringW
SHRegGetPathW
SHRegGetBoolUSValueW
SHGetValueA
SHRegGetValueW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wininet

InternetCheckConnectionW
InternetGetConnectedState

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory
WTSQueryUserToken
WTSEnumerateSessionsW

msvcp140

?_Random_device@std@@YAIXZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
_Xtime_get_ticks
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?widen@?$ctype@_W@std@@QEBA_WD@Z
?id@?$collate@_W@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_N@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
_Wcsxfrm
_Wcscoll
?id@?$ctype@_W@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_counter
_Query_perf_frequency
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
_Cnd_wait
_Cnd_broadcast
_Cnd_unregister_at_thread_exit
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Cnd_register_at_thread_exit
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?_Syserror_map@std@@YAPEBDH@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
??0task_continuation_context@Concurrency@@AEAA@XZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?uncaught_exceptions@std@@YAHXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xruntime_error@std@@YAXPEBD@Z
??0_Locinfo@std@@QEAA@HPEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getname@_Locinfo@std@@QEBAPEBDXZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??Bid@locale@std@@QEAA_KXZ
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@_N@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z
?_Makeloc@_Locimp@locale@std@@CAPEAV123@AEBV_Locinfo@3@HPEAV123@PEBV23@@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
?tolower@?$ctype@D@std@@QEBADD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?toupper@?$ctype@_W@std@@QEBA_W_W@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setf@ios_base@std@@QEAAHH@Z
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ

userenv

GetDefaultUserProfileDirectoryW
CreateEnvironmentBlock

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context
__C_specific_handler
__current_exception
__RTDynamicCast
memcpy
wcsstr
wcsrchr
strchr
memcmp
memmove
__std_exception_destroy
__std_exception_copy
_purecall
__std_type_info_name
__std_terminate
wcschr
__std_type_info_compare
_CxxThrowException
memset

api-ms-win-crt-heap-l1-1-0

realloc
malloc
free
_callnewh
_set_new_mode

api-ms-win-crt-string-l1-1-0

tolower
wcstok_s
isxdigit
toupper
isalnum
_strnicmp
wcscspn
_wcsdup
towlower
towupper
iswxdigit
iswspace
_wcsnicmp
wcsncmp
_wcsicmp
wcscmp
wcsncpy_s
wcscat_s
wcscpy_s
strncmp

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_invalid_parameter_noinfo_noreturn
_crt_atexit
abort
terminate
_cexit
_invalid_parameter_noinfo
_seh_filter_exe
_errno
_set_app_type
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
_c_exit
_register_thread_local_exe_atexit_callback
_beginthread
_initialize_onexit_table

api-ms-win-crt-time-l1-1-0

_localtime64_s
_time64

api-ms-win-crt-convert-l1-1-0

atof
strtoll
atol
wcstoll
wcstoul
strtoull
_wtoi
_strtod_l

api-ms-win-crt-math-l1-1-0

ceilf
__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
_create_locale
_free_locale

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode
fclose
__stdio_common_vswprintf
_wfopen_s

filesyncsessions

GetSettingsPersistence

gdi32

GetObjectW

Sections

.text
Size: 666KB - Virtual size: 666KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 46KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0691bcb5ba574850b38515a946db8a25

Code Sign

33:00:00:05:4e:12:b9:0a:00:7b:12:49:99:00:00:00:00:05:4eCertificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

57:7a:28:70:68:26:8e:4e:f3:76:1f:de:14:d7:25:8a:fd:8c:86:de:b2:38:06:3d:4c:67:5e:01:47:c2:e6:57Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

loggingplatform

telemetry

updateringsettings

propsys

ntdll

kernel32

user32

advapi32

shell32

ole32

oleaut32

crypt32

rpcrt4

secur32

shlwapi

version

wininet

wtsapi32

msvcp140

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-stdio-l1-1-0

filesyncsessions

gdi32

Sections

.text Size: 666KB - Virtual size: 666KB

.rdata Size: 264KB - Virtual size: 264KB

.data Size: 46KB - Virtual size: 57KB

.pdata Size: 31KB - Virtual size: 30KB

.rsrc Size: 58KB - Virtual size: 58KB

.reloc Size: 7KB - Virtual size: 7KB

33:00:00:05:4e:12:b9:0a:00:7b:12:49:99:00:00:00:00:05:4e
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

57:7a:28:70:68:26:8e:4e:f3:76:1f:de:14:d7:25:8a:fd:8c:86:de:b2:38:06:3d:4c:67:5e:01:47:c2:e6:57
Signer

.text
Size: 666KB - Virtual size: 666KB

.rdata
Size: 264KB - Virtual size: 264KB

.data
Size: 46KB - Virtual size: 57KB

.pdata
Size: 31KB - Virtual size: 30KB

.rsrc
Size: 58KB - Virtual size: 58KB

.reloc
Size: 7KB - Virtual size: 7KB