_tmp_99a87189df39df7603d3842059f44022e6595ac5e2191fd8d457efb6167fc736[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

_tmp_99a87189df39df7603d3842059f44022e6595ac5e2191fd8d457efb6167fc736.exe
Size

5.3MB
MD5

90f012a88eaa904f0a62a86141be4c2b
SHA1

308fdddd5749928c5b8b47433ef62992720b1095
SHA256

99a87189df39df7603d3842059f44022e6595ac5e2191fd8d457efb6167fc736
SHA512

cb37877037624a24a3354993c1b650a0fe0bb66c1d8b3a43984a6a75fb383bf1cf2273423f312533487f58866392fbfdd645e0e462de914d33d23658bc79bf1d
SSDEEP

49152:nt14VpObFvq5sUWtznCIjLmwbeOnu5AoGkLFD484inLyJqe83g2fTOhqcNaIX4lr:3v2FB1zfe88OGw8a0cD5xzd

Score

1^/10

Malware Config

Signatures

Files

_tmp_99a87189df39df7603d3842059f44022e6595ac5e2191fd8d457efb6167fc736.exe
.exe windows:10 windows x64 arch:x64

13b3350eaa4fa93826af992e348fe878

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d3:2f:77:11:7b:da:25:c1:a7:cd:27:36:ec:85:e5:f9:bd:eb:d3:f2:20:16:99:fc:9e:60:c2:dd:9d:b8:32:7c
Signer

Actual PE Digest

d3:2f:77:11:7b:da:25:c1:a7:cd:27:36:ec:85:e5:f9:bd:eb:d3:f2:20:16:99:fc:9e:60:c2:dd:9d:b8:32:7c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

explorer.pdb

Imports

msvcp_win

?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
_Thrd_detach
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_join
_Thrd_id
_Cnd_do_broadcast_at_thread_exit
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?_Xbad_alloc@std@@YAXXZ
?tolower@?$ctype@G@std@@QEBAGG@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
_Wcscoll
_Wcsxfrm
?_Xout_of_range@std@@YAXPEBD@Z
??Bid@locale@std@@QEAA_KXZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
??0_Lockit@std@@QEAA@H@Z
??0_Locinfo@std@@QEAA@PEBD@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??1_Lockit@std@@QEAA@XZ
??1_Locinfo@std@@QEAA@XZ
?is@?$ctype@G@std@@QEBA_NFG@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QEBA_NXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
?width@ios_base@std@@QEAA_J_J@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
_Mtx_init_in_situ
_Xtime_get_ticks
_Mtx_unlock
_Mtx_lock
_Mtx_destroy_in_situ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?id@?$collate@G@std@@2V0locale@2@A

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_set_error_mode
_initterm_e
_initterm
_c_exit

api-ms-win-crt-string-l1-1-0

_wcsrev
strncmp
memset
wcsncpy
wcscspn
wcscmp
wcsncmp

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-private-l1-1-0

_o_iswalnum
_o_iswspace
_o_malloc
_o_memcpy_s
_o_pow
_o_realloc
_o_roundf
_o_sqrt
_o_terminate
_o_toupper
_o_towlower
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
_o_wcstoll
__C_specific_handler
__CxxFrameHandler3
_o__purecall
_o_free
_o__mktime64
_o_floor
_o_exit
_o_ceil
memmove
_o_bsearch
_o__wtoi
_o__wcsnicmp
_o__wcsicmp
_o__localtime64
_o__itow_s
_o__set_new_mode
_o__set_fmode
_o__set_errno
_o__set_app_type
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_wide_environment
_o__initialize_onexit_table
_o__get_wide_winmain_command_line
_o__get_errno
_o__exit
_o__errno
_o__difftime64
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__beginthreadex
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
wcsstr
__std_terminate
__CxxFrameHandler4
_o__seh_filter_exe
_o__register_onexit_function
_o__recalloc
_CxxThrowException
memcmp
memcpy

aepic

PicRetrieveFileInfo
PicFreeFileInfo

twinapi

ord9

api-ms-win-core-job-l2-1-0

AssignProcessToJobObject
CreateJobObjectW
QueryInformationJobObject
SetInformationJobObject

api-ms-win-core-windowserrorreporting-l1-1-3

RegisterApplicationRestart

api-ms-win-core-url-l1-1-0

HashData
PathIsURLW
UrlUnescapeW

api-ms-win-core-kernel32-private-l1-1-0

CheckElevation
CheckElevationEnabled

api-ms-win-core-registryuserspecific-l1-1-0

SHRegGetUSValueW
SHRegGetBoolUSValueW

api-ms-win-core-com-private-l1-1-0

CoRegisterMessageFilter

api-ms-win-core-atoms-l1-1-0

GlobalGetAtomNameW

api-ms-win-core-sidebyside-l1-1-0

DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxW

ntdll

wcsspn
RtlQueryResourcePolicy
RtlInitString
RtlGetVersion
RtlUpcaseUnicodeChar
RtlGetNativeSystemInformation
ZwQueryDirectoryFile
RtlpEnsureBufferSize
RtlNtPathNameToDosPathName
ZwEnumerateKey
RtlInitUnicodeStringEx
RtlFormatCurrentUserKeyPath
ZwCreateFile
ZwQueryInformationFile
ZwCreateSection
ZwQueryInformationProcess
ZwSetInformationProcess
RtlxAnsiStringToUnicodeSize
RtlAnsiStringToUnicodeString
ZwUnmapViewOfSection
ZwMapViewOfSection
LdrResSearchResource
RtlVerifyVersionInfo
RtlImageDirectoryEntryToData
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
NtOpenThreadToken
NtClose
NtQueryInformationToken
NtOpenProcessToken
RtlCompareUnicodeString
RtlFreeHeap
RtlAllocateHeap
wcschr
RtlDosPathNameToNtPathName_U_WithStatus
ZwOpenFile
wcsrchr
strchr
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlPublishWnfStateData
NtSetSystemInformation
RtlFlushHeaps
ZwQuerySystemInformation
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlQueryWnfStateData
RtlNtStatusToDosError
RtlInitUnicodeString
RtlCaptureContext
RtlGetDeviceFamilyInfoEnum
NtSetInformationProcess
NtQueryInformationProcess
ZwQueryValueKey
ZwOpenKey
ZwClose
RtlReAllocateHeap
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
RtlRunOnceExecuteOnce
RtlCopyUnicodeString
RtlUpcaseUnicodeString
RtlIsStateSeparationEnabled
RtlNtStatusToDosErrorNoTeb
RtlFreeUnicodeString
NtSetThreadExecutionState
VerSetConditionMask
WinSqmSetDWORD
WinSqmIsOptedIn
WinSqmAddToStreamEx

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetProcAddress
FindStringOrdinal
GetModuleHandleA
LoadResource
LockResource
GetModuleFileNameW
LoadLibraryExW
SizeofResource
FreeLibrary
LoadStringW
GetModuleFileNameA
FindResourceExW
GetModuleHandleExW

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
OpenMutexW
ReleaseSemaphore
CreateEventW
InitializeCriticalSection
CreateSemaphoreExW
InitializeSRWLock
SetEvent
WaitForMultipleObjectsEx
EnterCriticalSection
CreateEventExW
ResetEvent
InitializeCriticalSectionAndSpinCount
SleepEx
WaitForSingleObject
OpenEventW
DeleteCriticalSection
ReleaseMutex
CreateMutexExW
TryAcquireSRWLockExclusive
ReleaseSRWLockShared
OpenSemaphoreW
TryEnterCriticalSection
AcquireSRWLockShared
ReleaseSRWLockExclusive
CreateMutexW
WaitForSingleObjectEx
AcquireSRWLockExclusive
InitializeCriticalSectionEx

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetErrorMode
SetUnhandledExceptionFilter
SetLastError
GetLastError
RaiseException

api-ms-win-core-file-l1-1-0

GetLongPathNameW
FindClose
DeleteFileW
GetFileAttributesW
WriteFile
CreateFileW
FindNextFileW
CompareFileTime
FindFirstFileW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventActivityIdControl
EventSetInformation
EventEnabled
EventWriteTransfer
EventWrite
EventProviderEnabled

api-ms-win-core-registry-l1-1-0

RegOpenCurrentUser
RegQueryValueExW
RegCreateKeyExW
RegDeleteTreeW
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegDeleteKeyExW
RegSetKeySecurity
RegNotifyChangeKeyValue
RegEnumValueW
RegGetValueW
RegQueryInfoKeyW
RegCloseKey
RegEnumKeyExW
RegGetKeySecurity

api-ms-win-core-threadpool-l1-2-0

SubmitThreadpoolWork
CreateThreadpoolWait
TrySubmitThreadpoolCallback
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolWork
CreateThreadpoolTimer
CloseThreadpoolWait

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW
ExitProcess
GetCurrentThreadId
TerminateProcess
SetPriorityClass
SetProcessShutdownParameters
QueueUserAPC
CreateProcessW
CreateThread
OpenThreadToken
OpenThread
GetCurrentProcessId
GetExitCodeProcess
ResumeThread
GetCurrentProcess
GetProcessId
SetThreadPriority
OpenProcessToken
GetCurrentThread
GetPriorityClass
GetThreadPriority
SetThreadPriorityBoost
ProcessIdToSessionId

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx
GetUserDefaultLangID
GetGeoInfoW
FormatMessageW
GetCalendarInfoW
GetThreadUILanguage
GetLocaleInfoW
GetUserDefaultLocaleName

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

oleaut32

SafeArrayDestroy
SysAllocStringByteLen
SysAllocString
VarUI4FromStr
SafeArrayUnaccessData
SafeArrayCreate
SysStringLen
VariantClear
VariantInit
SysFreeString
SafeArrayAccessData

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolGetUniqueContext
SHTaskPoolQueueTask

api-ms-win-shcore-sysinfo-l1-1-0

IsOS
SetCurrentProcessExplicitAppUserModelID

api-ms-win-core-com-l1-1-0

CoFreeUnusedLibraries
CoGetObjectContext
CoIncrementMTAUsage
CoCreateFreeThreadedMarshaler
CoMarshalInterThreadInterfaceInStream
CoGetApartmentType
CoWaitForMultipleHandles
CoGetInterfaceAndReleaseStream
CoReleaseMarshalData
CoGetStdMarshalEx
CoInitializeSecurity
IIDFromString
PropVariantClear
CoCancelCall
CoTaskMemFree
CreateStreamOnHGlobal
CoCreateInstance
CoDisableCallCancellation
StringFromGUID2
StringFromIID
CoEnableCallCancellation
CoCreateGuid
CLSIDFromString
CoRegisterClassObject
CoSetProxyBlanket
CoGetCallContext
CoRevokeClassObject
CoTaskMemRealloc
CoTaskMemAlloc
CoGetMalloc
CoInitializeEx
CoUninitialize

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrToIntW
StrStrIW
StrCmpICW
StrChrW
StrCmpICA
StrCmpIW
StrCmpNICW
StrCmpW
StrChrIW
StrCmpNIW
QISearch
StrRChrW

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW
CommandLineToArgvW

api-ms-win-shcore-comhelpers-l1-1-0

IUnknown_GetSite
IUnknown_SetSite
IUnknown_Set
IUnknown_QueryService

api-ms-win-core-heap-l2-1-0

LocalFree
GlobalAlloc
LocalReAlloc
GlobalFree
LocalAlloc

api-ms-win-core-processthreads-l1-1-1

OpenProcess
GetProcessMitigationPolicy
IsProcessorFeaturePresent

api-ms-win-core-datetime-l1-1-0

GetDateFormatW

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetTickCount64
GetSystemDirectoryW
GetTickCount
GetWindowsDirectoryW
GetVersionExW
GetLogicalProcessorInformation
GetSystemTime
GetSystemTimeAsFileTime

api-ms-win-core-datetime-l1-1-1

GetDateFormatEx
GetTimeFormatEx

api-ms-win-core-processenvironment-l1-1-0

SearchPathW
GetCurrentDirectoryW
ExpandEnvironmentStringsW
GetCommandLineW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathGetArgsW
PathCombineW
PathFindExtensionW
PathGetDriveNumberW
PathCommonPrefixW
PathQuoteSpacesW
PathFileExistsW
PathRemoveBlanksW
SHExpandEnvironmentStringsW
PathFindFileNameW
PathRemoveFileSpecW
PathIsFileSpecW
PathParseIconLocationW

api-ms-win-core-winrt-string-l1-1-0

WindowsCompareStringOrdinal
WindowsSubstringWithSpecifiedLength
WindowsDuplicateString
WindowsDeleteStringBuffer
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsPreallocateStringBuffer
WindowsGetStringLen
WindowsPromoteStringBuffer
WindowsCreateStringReference
WindowsCreateString

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoUninitialize
RoGetActivationFactory
RoActivateInstance

api-ms-win-shcore-registry-l1-1-0

SHEnumKeyExW
SHDeleteKeyW
SHRegGetValueW
SHDeleteValueW
SHSetValueW
SHGetValueW
SHQueryInfoKeyW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringOrdinal
CompareStringW

api-ms-win-shcore-thread-l1-1-0

SHCreateThread
SHGetThreadRef
SetProcessReference
SHSetThreadRef
SHCreateThreadRef

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrcmpiW

api-ms-win-security-base-l1-1-0

IsValidSid
GetLengthSid
GetTokenInformation
EqualSid
CopySid
GetAclInformation
GetAce
DeleteAce
InitializeAcl
AddAce
DuplicateToken
MakeAbsoluteSD
SetKernelObjectSecurity
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
CreateWellKnownSid
CheckTokenMembership

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
RegisterTraceGuidsW
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
UnregisterTraceGuids

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
FindResourceW

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-errorhandling-l1-1-1

RemoveVectoredExceptionHandler

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW
RegDeleteKeyValueW

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-winrt-error-l1-1-0

RoFailFastWithErrorContext
RoOriginateError
RoTransformError
SetRestrictedErrorInfo
GetRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo
RoOriginateLanguageException

api-ms-win-core-path-l1-1-0

PathAllocCombine
PathCchRemoveFileSpec
PathCchAddExtension
PathCchCombine
PathCchAppend

api-ms-win-shcore-unicodeansi-l1-1-0

SHAnsiToUnicode

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock

api-ms-win-core-processthreads-l1-1-3

SetProcessInformation
SetThreadDescription

api-ms-win-core-memory-l1-1-0

MapViewOfFile
CreateFileMappingW
OpenFileMappingW
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-shcore-stream-l1-1-0

IStream_Reset
SHCreateStreamOnFileW
SHCreateMemStream
IStream_Write
IStream_Read
SHCreateStreamOnFileEx
SHOpenRegStream2W

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-shcore-path-l1-1-0

ord170

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx
CreateTimerQueueTimer
DeleteTimerQueueTimer
ChangeTimerQueueTimer

api-ms-win-core-sysinfo-l1-2-0

GetOsSafeBootMode
GetProductInfo

api-ms-win-core-localization-l1-2-3

GetUserDefaultGeoName

userenv

GetProfileType
DeriveAppContainerSidFromAppContainerName

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToFileTime
GetDynamicTimeZoneInformation

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW
GetSystemPowerStatus
RegisterWaitForSingleObject

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InitializeSListHead

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW

api-ms-win-core-string-l2-1-0

CharNextW
CharLowerBuffW

api-ms-win-service-management-l2-1-0

QueryServiceConfigW
NotifyServiceStatusChangeW

api-ms-win-core-io-l1-1-0

CreateIoCompletionPort
GetQueuedCompletionStatus

api-ms-win-core-sysinfo-l1-2-1

GetPhysicallyInstalledSystemMemory

api-ms-win-shcore-registry-l1-1-1

SHRegGetValueFromHKCUHKLM

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor
ord244

iphlpapi

GetNetworkConnectivityHint

api-ms-win-core-toolhelp-l1-1-0

Process32NextW
Process32FirstW
CreateToolhelp32Snapshot

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-stringansi-l1-1-0

CharNextA

api-ms-win-power-base-l1-1-0

PowerDeterminePlatformRoleEx
GetPwrCapabilities
CallNtPowerInformation

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-shlwapi-winrt-storage-l1-1-1

ShellMessageBoxW
ord479
SHPinDllOfCLSID
SHCreateWorkerWindowW
ord279
IUnknown_GetWindow
SHIsChildOrSelf
ord481
ord165
ord635
ord478
ord544
ord197
StrRetToBufW
PathRemoveArgsW
ord292
AssocQueryStringW
StrRetToStrW
ord509

api-ms-win-ntuser-sysparams-l1-1-0

GetDisplayConfigBufferSizes
QueryDisplayConfig
GetSystemMetrics
EnumDisplayMonitors
EnumDisplayDevicesW
GetMonitorInfoW
SystemParametersInfoW

api-ms-win-ntuser-rectangle-l1-1-0

SetRect
InflateRect
SetRectEmpty
PtInRect
IntersectRect
OffsetRect
SubtractRect
CopyRect
IsRectEmpty
EqualRect
UnionRect

api-ms-win-rtcore-ntuser-winevent-l1-1-0

UnhookWinEvent
SetWinEventHook
NotifyWinEvent

api-ms-win-shell-namespace-l1-1-0

SHParseDisplayName
SHCreateItemFromParsingName
SHGetIDListFromObject
ILFree
ILClone
SHGetNameFromIDList
ILFindLastID
SHBindToParent
SHBindToFolderIDListParent
SHBindToObject
SHCreateItemFromIDList
ILCombine
ILRemoveLastID
ILIsEqual
ILCloneFirst
ILGetSize
ILIsParent

dxgi

DXGIDeclareAdapterRemovalSupport

api-ms-win-rtcore-ntuser-wmpointer-l1-1-0

GetPointerType
GetPointerInfo
GetPointerDevices
GetCurrentInputMessageSource
EnableMouseInPointer

api-ms-win-storage-exports-internal-l1-1-0

GetThreadFlags
SHGetFolderPathEx
SetThreadFlags
SHGetKnownFolderIDList

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjects
MsgWaitForMultipleObjectsEx

api-ms-win-appmodel-runtime-l1-1-0

GetPackageFullName
GetPackagesByPackageFamily

api-ms-win-rtcore-ntuser-wmpointer-l1-1-2

SetWindowFeedbackSetting

api-ms-win-rtcore-ntuser-clipboard-l1-1-0

RegisterClipboardFormatW

api-ms-win-rtcore-ntuser-private-l1-1-0

GetWindowBand
CreateWindowInBand

api-ms-win-rtcore-ntuser-powermanagement-l1-1-0

RegisterPowerSettingNotification
UnregisterPowerSettingNotification

propsys

PropVariantToBoolean
PSCreateMemoryPropertyStore
PSGetPropertyFromPropertyStorage
InitVariantFromResource
PSPropertyBag_WriteStr
PropVariantToUInt32
PSPropertyBag_WriteDWORD
PropVariantToStringAlloc
InitVariantFromGUIDAsString

coremessaging

CreateDispatcherQueueController

urlmon

URLOpenBlockingStreamW

api-ms-win-shell-changenotify-l1-1-0

SHChangeNotify

api-ms-win-shell-dataobject-l1-1-0

SHCreateDataObject

api-ms-win-appmodel-runtime-l1-1-1

FindPackagesByPackageFamily
ParseApplicationUserModelId

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification

gdi32

StretchBlt
ExcludeClipRect
SetStretchBltMode
Rectangle
GetCurrentObject
SelectClipRgn
GetClipRgn
GetOutlineTextMetricsW
GetGlyphOutlineW
CreateRectRgnIndirect
GetTextExtentPoint32W
GetStockObject
ExtTextOutW
GetTextMetricsW
GetDeviceCaps
CreateRectRgn
SetTextColor
SetRectRgn
OffsetRgn
CombineRgn
DeleteObject
GetObjectW
DeleteDC
CreateCompatibleDC
SelectObject
GetClipBox
CreateFontIndirectW
SetTextAlign

kernel32

IsBadWritePtr

rpcrt4

NdrClientCall3
RpcBindingFree
RpcStringFreeW
RpcBindingSetAuthInfoExW
I_RpcExceptionFilter
RpcStringBindingComposeW
RpcBindingFromStringBindingW
UuidFromStringW

wininet

InternetCrackUrlW

shcore

ord183
ord210
ord126
ord1
SHUnicodeToAnsi
ord123
ord121
ord190
ord187
ord162
ord109
ord213
ord174
ord186
ord192
ord142
ord200
ord184

shell32

ord172
ord680
ord723
ord743
ord907
ord43
Shell_GetCachedImageIndexW
ord790
ord885
ord727
ord162
SHAppBarMessage
ord894
ord193
ord906
ord895
SHGetLocalizedName
SHGetPropertyStoreForWindow
ord764
ord866
SHEvaluateSystemCommandTemplate
ord181
ord244
ExtractIconExW
ShellExecuteW
ord132
ord137
Shell_NotifyIconW
Shell_NotifyIconGetRect
ord6
SHGetStockIconInfo
DuplicateIcon
ord91
ord254
ord54
SHEnableServiceObject
ord61
ord896
SHAddToRecentDocs
ord60
SHUpdateRecycleBinIcon
ord2
ord711
SHFileOperationW
ord4
SHGetPathFromIDListW
ord645
ord644
ord753
ord733
ord95
DragQueryFileW
ord67
SHCreateItemInKnownFolder
ord206
ord201
ord188
ord899
ShellExecuteExW
ord245
ord200
ord89
ord190
ord85
ord100
SHChangeNotifyRegisterThread
ord850
ord22
ord134
ord792

shlwapi

PathIsRelativeW
ord164
PathIsDirectoryW
ord413
ord548
ord163
ord467
AssocQueryKeyW
ChrCmpIW
AssocCreate

uxtheme

GetThemeBackgroundExtent
GetThemeBool
OpenThemeData
OpenThemeDataForDpi
GetThemeMargins
ord138
BufferedPaintSetAlpha
ord126
GetThemePartSize
IsThemeActive
GetBufferedPaintBits
GetThemeInt
GetThemeColor
GetThemeMetric
SetWindowTheme
GetWindowTheme
BufferedPaintUnInit
EndBufferedPaint
BeginBufferedPaint
IsAppThemed
CloseThemeData
DrawThemeParentBackground
DrawThemeBackground
ord86
GetThemeFont
DrawThemeTextEx
IsCompositionActive
BufferedPaintInit

dwmapi

ord138
ord114
ord139
DwmRegisterThumbnail
ord140
DwmGetWindowAttribute
ord159
DwmQueryThumbnailSourceSize
DwmSetWindowAttribute
ord124
ord113
DwmEnableBlurBehindWindow
ord141
DwmUpdateThumbnailProperties
DwmUnregisterThumbnail
DwmIsCompositionEnabled

user32

SetScrollInfo
GetScrollInfo
SetScrollPos
GetMenuStringW
InternalGetWindowText
GetLayeredWindowAttributes
SetLayeredWindowAttributes
DrawTextExW
IsProcessDPIAware
SetThreadDpiAwarenessContext
GetWindowCompositionAttribute
GetWindowProcessHandle
EndTask
ChangeWindowMessageFilterEx
TranslateAcceleratorW
ord2611
MonitorFromRect
ord2573
GetGuiResources
IsHungAppWindow
ord2574
SwitchToThisWindow
GetLastActivePopup
UnregisterHotKey
RegisterHotKey
SendDlgItemMessageW
EndDialog
ExitWindowsEx
GetKeyState
LoadIconW
HungWindowFromGhostWindow
CascadeWindows
TileWindows
LockWorkStation
InjectMouseInput
MapVirtualKeyExW
InjectKeyboardInput
DrawTextW
GetCaretBlinkTime
GetSysColor
CopyImage
DestroyIcon
BringWindowToTop
GetSystemMetricsForDpi
ord2005
TrackMouseEvent
SetCapture
GetMenuState
GetCapture
ReleaseCapture
InsertMenuW
PostThreadMessageW
UnregisterClassA
GetClassLongPtrW
UpdateLayeredWindow
ord2521
UnregisterClassW
ord2522
GetMenuInfo
SetMenuInfo
GetDpiForSystem
GetWindowDpiAwarenessContext
AreDpiAwarenessContextsEqual
CharLowerW
GetDoubleClickTime
IsCharAlphaNumericW
CalculatePopupWindowPosition
SetMenuItemInfoW
CopyIcon
SetCursor
IsTopLevelWindow
ShowWindowAsync
GetClassLongW
GetClassWord
GetIconInfo
GetIconInfoExW
GetCursorInfo
GetPhysicalCursorPos
LoadAcceleratorsW
IsWindowUnicode
DrawIconEx
DefWindowProcA
GhostWindowFromHungWindow
GetSysColorBrush
GetSystemMenu
GetLastInputInfo
ModifyMenuW
GetAsyncKeyState
AdjustWindowRect
ReplyMessage
MonitorFromPoint
GetMenuItemInfoW
GetDpiForWindow
SetWindowCompositionAttribute
GetMenuItemCount
SetGestureConfig
CreateIconIndirect
LoadImageW
CheckMenuItem
EnableMenuItem
GetSubMenu
RemoveMenu
LoadMenuW
LoadCursorW
DestroyMenu
GetMenuDefaultItem
SetMenuDefaultItem
CreatePopupMenu
TrackPopupMenuEx
IsIconic
MonitorFromWindow
ReleaseDC
DeleteMenu
GetDC
FillRect
AdjustWindowRectEx

sspicli

GetUserNameExW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW
PowerCreateRequest
PowerSetRequest

api-ms-win-security-isolatedcontainer-l1-1-1

IsProcessInWDAGContainer

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-kernel32-legacy-l1-1-2

SetTermsrvAppInstallMode

api-ms-win-shell-shdirectory-l1-1-0

ord292

api-ms-win-eventing-controller-l1-1-0

StartTraceW
EnableTraceEx2
StopTraceW

api-ms-win-appmodel-runtime-l1-1-3

GetStagedPackagePathByFullName2

api-ms-win-core-biptcltapi-l1-1-7

BiPtEnumerateWorkItemsForPackageName
BiPtQueryWorkItem
BiPtAssociateApplicationEntryPoint
BiPtFreeMemory

api-ms-win-crt-math-l1-1-0

ceilf
floorf

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imrsiv
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 740KB - Virtual size: 739KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

13b3350eaa4fa93826af992e348fe878

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5fCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

d3:2f:77:11:7b:da:25:c1:a7:cd:27:36:ec:85:e5:f9:bd:eb:d3:f2:20:16:99:fc:9e:60:c2:dd:9d:b8:32:7cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp_win

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-private-l1-1-0

aepic

twinapi

api-ms-win-core-job-l2-1-0

api-ms-win-core-windowserrorreporting-l1-1-3

api-ms-win-core-url-l1-1-0

api-ms-win-core-kernel32-private-l1-1-0

api-ms-win-core-registryuserspecific-l1-1-0

api-ms-win-core-com-private-l1-1-0

api-ms-win-core-atoms-l1-1-0

api-ms-win-core-sidebyside-l1-1-0

ntdll

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

oleaut32

api-ms-win-shcore-taskpool-l1-1-0

api-ms-win-shcore-sysinfo-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-shcore-comhelpers-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-shcore-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-shcore-thread-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-l2-1-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-registry-l1-1-1

api-ms-win-core-com-l1-1-1

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-path-l1-1-0

api-ms-win-shcore-unicodeansi-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-processthreads-l1-1-3

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

d3:2f:77:11:7b:da:25:c1:a7:cd:27:36:ec:85:e5:f9:bd:eb:d3:f2:20:16:99:fc:9e:60:c2:dd:9d:b8:32:7c
Signer