3204fb03e458d8fdc871e17d81ae7bcd87385fb8dc6fc05c83a8bb8cd83bf506

Sharing

Copy URL

Twitter E-mail

General

Target

3204fb03e458d8fdc871e17d81ae7bcd87385fb8dc6fc05c83a8bb8cd83bf506
Size

607KB
MD5

fe94588a21392297d3ae6c38c1697870
SHA1

0c2fbb93f43d58c33558cacbc6ffa5ac407e95a4
SHA256

3204fb03e458d8fdc871e17d81ae7bcd87385fb8dc6fc05c83a8bb8cd83bf506
SHA512

883f8d717f4e869a4ab10b4bf05862c6b1f92919ddaec7f4b32697e5c584ba778b06e981f9750e47e3c6d0137e2c64ce2b9fb159f23a6b7aac4c192fd5a68548
SSDEEP

6144:qHBqNcKXVB/WwRGfizfiTFKLHK0S9LkqLLNiBs0+olAjQ:qHLQ/WwRwEi5KOjJiNU

Score

1^/10

Malware Config

Signatures

Files

3204fb03e458d8fdc871e17d81ae7bcd87385fb8dc6fc05c83a8bb8cd83bf506
.exe windows:5 windows x86 arch:x86

de930fa6fb2cb23063c6c0460b87964c

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:9e:2a:aa:0f:65:01:f4:8d:a0:3f:f7:95:e9:89
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-12-2017 00:00

Not After

08-03-2021 23:59

Subject

CN=Guangzhou KuGou Computer Technology Co.\, Ltd.,OU=IT,O=Guangzhou KuGou Computer Technology Co.\, Ltd.,L=Guangzhou,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:e8:9e:2a:aa:0f:65:01:f4:8d:a0:3f:f7:95:e9:89
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-12-2017 00:00

Not After

08-03-2021 23:59

Subject

CN=Guangzhou KuGou Computer Technology Co.\, Ltd.,OU=IT,O=Guangzhou KuGou Computer Technology Co.\, Ltd.,L=Guangzhou,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ac:03:7f:09:a9:99:af:ad:1c:ba:fa:af:d0:a9:68:d2:6e:73:1b:1c:dc:f5:04:80:2e:e2:62:05:33:b1:fa:5e
Signer

Actual PE Digest

ac:03:7f:09:a9:99:af:ad:1c:ba:fa:af:d0:a9:68:d2:6e:73:1b:1c:dc:f5:04:80:2e:e2:62:05:33:b1:fa:5e

Digest Algorithm

sha256

PE Digest Matches

false

94:73:a4:72:76:37:82:95:7f:79:f7:bb:51:07:2b:8c:a8:10:28:fb
Signer

Actual PE Digest

94:73:a4:72:76:37:82:95:7f:79:f7:bb:51:07:2b:8c:a8:10:28:fb

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\buildbot_slave\build1\kugou\build\Release\KGDaemon.pdb

Imports

psapi

GetProcessImageFileNameW
GetModuleFileNameExW

iphlpapi

IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho

kernel32

CloseHandle
SetFileAttributesW
MultiByteToWideChar
LoadLibraryExW
GlobalAlloc
RaiseException
DecodePointer
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
GetCurrentThreadId
lstrcmpW
MulDiv
GlobalLock
GlobalUnlock
GetModuleHandleW
LoadResource
SizeofResource
FindResourceW
lstrcmpiW
CreateMutexW
WaitForSingleObject
OutputDebugStringW
LocalFree
GetFileAttributesW
LoadLibraryExA
VirtualFree
Sleep
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
GetProcessHeap
HeapFree
HeapAlloc
EncodePointer
InitializeSListHead
ReadFile
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
MapViewOfFile
CreateFileMappingW
FlushViewOfFile
UnmapViewOfFile
GetSystemInfo
GetVersionExW
GetFileSizeEx
GetNamedPipeInfo
GetCurrentProcessId
GetCurrentProcess
CancelIo
CreateNamedPipeW
ConnectNamedPipe
DuplicateHandle
WriteFile
GetWindowsDirectoryW
GetSystemDirectoryW
SetLastError
GetLastError
GetProcAddress
LoadLibraryW
FreeLibrary
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
QueryDosDeviceW
GetLogicalDriveStringsW
GetTickCount
GetFileSize
CreateFileW
GetSystemTimeAsFileTime
MoveFileW
VirtualAlloc

user32

UnregisterClassW
SetWindowLongW
GetWindowLongW
CreateWindowExW
DestroyWindow
SendMessageW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
MoveWindow
SetWindowPos
GetClientRect
ClientToScreen
ScreenToClient
BeginPaint
EndPaint
GetDC
ReleaseDC
InvalidateRect
InvalidateRgn
RedrawWindow
SetCapture
SetFocus
GetWindow
IsChild
GetParent
GetDlgItem
IsWindow
GetClassNameW
GetSysColor
DestroyAcceleratorTable
GetFocus
FillRect
GetDesktopWindow
CreateAcceleratorTableW
ReleaseCapture
DefWindowProcW
RegisterWindowMessageW
GetClassInfoExW
LoadCursorW
RegisterClassExW
CallWindowProcW
KillTimer
PostMessageW
SetTimer
UpdateWindow
ShowWindow
GetWindowThreadProcessId
GetForegroundWindow
PostQuitMessage
CharNextW
GetSystemMetrics

gdi32

GetDeviceCaps
GetObjectW
SelectObject
DeleteObject
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
DeleteDC
GetStockObject

advapi32

RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW

shell32

SHGetFolderPathW
SHGetSpecialFolderPathW

ole32

CLSIDFromProgID
CoGetClassObject
OleLockRunning
CreateStreamOnHGlobal
OleUninitialize
CoTaskMemRealloc
CLSIDFromString
CoTaskMemFree
CoCreateInstance
StringFromGUID2
OleInitialize
CoTaskMemAlloc

oleaut32

VarUI4FromStr
DispCallFunc
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
VariantClear
VariantInit
SysStringLen
SysAllocString
SysFreeString
SysAllocStringLen

infra

?SysWideToMultiByte@base@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@I@Z
?UninitializeInfra@infra@@YAXXZ
??1RefCountedThreadSafeBase@subtle@base@@IAE@XZ
??0RefCountedThreadSafeBase@subtle@base@@IAE@XZ
?InitializeInfra@infra@@YAXXZ
?Get@ThreadTaskRunnerHandle@base@@SA?AV?$scoped_refptr@VSingleThreadTaskRunner@base@@@@XZ
?Release@?$RefCountedThreadSafe@VTaskRunner@base@@UTaskRunnerTraits@2@@base@@QBEXXZ
?FromMilliseconds@TimeDelta@base@@SA?AV12@_J@Z
??1LogMessage@logging@@QAE@XZ
??0LogMessage@logging@@QAE@PBDHH@Z
??0Location@tracked_objects@@QAE@PBD0HPBX@Z
?GetProgramCounter@tracked_objects@@YAPBXXZ
??1WeakPtrBase@internal@base@@QAE@XZ
??1CallbackBase@internal@base@@IAE@XZ
?BelongsToCurrentThread@SingleThreadTaskRunner@base@@QBE_NXZ
?PostTask@TaskRunner@base@@QAE_NABVLocation@tracked_objects@@ABV?$Callback@$$A6AXXZ@2@@Z
?GetRef@WeakReferenceOwner@internal@base@@QBE?AVWeakReference@23@XZ
??1WeakReference@internal@base@@QAE@XZ
??1WeakReferenceOwner@internal@base@@QAE@XZ
??0WeakReferenceOwner@internal@base@@QAE@XZ
??0WeakPtrBase@internal@base@@IAE@ABVWeakReference@12@@Z
??0CallbackBase@internal@base@@IAE@PAVBindStateBase@12@@Z
?is_valid@WeakReference@internal@base@@QBE_NXZ
??0WeakPtrBase@internal@base@@QAE@ABV012@@Z
?ReadInt@PickleIterator@base@@QAE_NPAH@Z
??0PickleIterator@base@@QAE@ABVPickle@1@@Z
?WriteInt@Pickle@base@@QAE_NH@Z
??0Thread@base@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1Thread@base@@UAE@XZ
??0Options@Thread@base@@QAE@XZ
??1Options@Thread@base@@QAE@XZ
?StartWithOptions@Thread@base@@QAE_NABUOptions@12@@Z
?PostTask@MessageLoop@base@@QAEXABVLocation@tracked_objects@@ABV?$Callback@$$A6AXXZ@2@@Z
?IsRunning@Thread@base@@QBE_NXZ
?Stop@Thread@base@@QAEXXZ
?current@MessageLoop@base@@SAPAV12@XZ
?RunUntilIdle@MessageLoop@base@@QAEXXZ
?PostDelayedTask@MessageLoop@base@@QAEXABVLocation@tracked_objects@@ABV?$Callback@$$A6AXXZ@2@VTimeDelta@2@@Z
?Now@Time@base@@SA?AV12@XZ
?InMilliseconds@TimeDelta@base@@QBE_JXZ
??1FilePath@base@@QAE@XZ
??4FilePath@base@@QAEAAV01@ABV01@@Z
?Append@FilePath@base@@QBE?AV12@V?$BasicStringPiece@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@Z
??0JSONFileValueDeserializer@@QAE@ABVFilePath@base@@@Z
??1JSONFileValueDeserializer@@UAE@XZ
?Deserialize@JSONFileValueDeserializer@@UAE?AV?$scoped_ptr@VValue@base@@U?$default_delete@VValue@base@@@std@@@@PAHPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetAsDictionary@Value@base@@UAE_NPAPAVDictionaryValue@2@@Z
?GetList@DictionaryValue@base@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAPAVListValue@2@@Z
?FromDays@TimeDelta@base@@SA?AV12@H@Z
?GetDictionary@ListValue@base@@QAE_NIPAPAVDictionaryValue@2@@Z
?GetInteger@DictionaryValue@base@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAH@Z
?GetDouble@DictionaryValue@base@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAN@Z
?GetString@DictionaryValue@base@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAV34@@Z
?FromDoubleT@Time@base@@SA?AV12@N@Z
??0DictionaryValue@base@@QAE@XZ
??1DictionaryValue@base@@UAE@XZ
?SetDouble@DictionaryValue@base@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@N@Z
?ToDoubleT@Time@base@@QBENXZ
?SetInteger@DictionaryValue@base@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
??0ListValue@base@@QAE@XZ
?Insert@ListValue@base@@QAE_NIPAVValue@2@@Z
?Set@DictionaryValue@base@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAVValue@2@@Z
??0JSONFileValueSerializer@@QAE@ABVFilePath@base@@@Z
??1JSONFileValueSerializer@@UAE@XZ
?Serialize@JSONFileValueSerializer@@UAE_NABVValue@base@@@Z
??1ListValue@base@@UAE@XZ
?GetAsBoolean@Value@base@@UBE_NPA_N@Z
?GetAsInteger@Value@base@@UBE_NPAH@Z
?GetAsDouble@Value@base@@UBE_NPAN@Z
?GetAsString@Value@base@@UBE_NPAPBVStringValue@2@@Z
?GetAsString@Value@base@@UBE_NPAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?GetAsString@Value@base@@UBE_NPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetAsBinary@Value@base@@UBE_NPAPBVBinaryValue@2@@Z
?GetAsList@Value@base@@UBE_NPAPBVListValue@2@@Z
?GetAsList@Value@base@@UAE_NPAPAVListValue@2@@Z
?GetAsDictionary@DictionaryValue@base@@UBE_NPAPBV12@@Z
?GetAsDictionary@DictionaryValue@base@@UAE_NPAPAV12@@Z
?DeepCopy@DictionaryValue@base@@UBEPAV12@XZ
?Equals@DictionaryValue@base@@UBE_NPBVValue@2@@Z
?Remove@DictionaryValue@base@@UAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAV?$scoped_ptr@VValue@base@@U?$default_delete@VValue@base@@@std@@@@@Z
?RemoveWithoutPathExpansion@DictionaryValue@base@@UAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAV?$scoped_ptr@VValue@base@@U?$default_delete@VValue@base@@@std@@@@@Z
?RemovePath@DictionaryValue@base@@UAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAV?$scoped_ptr@VValue@base@@U?$default_delete@VValue@base@@@std@@@@@Z
?Swap@DictionaryValue@base@@UAEXPAV12@@Z
?GetAsList@ListValue@base@@UBE_NPAPBV12@@Z
?GetAsList@ListValue@base@@UAE_NPAPAV12@@Z
?GetAsDictionary@Value@base@@UBE_NPAPBVDictionaryValue@2@@Z
?DeepCopy@ListValue@base@@UBEPAV12@XZ
?Equals@ListValue@base@@UBE_NPBVValue@2@@Z
?Remove@ListValue@base@@UAE_NIPAV?$scoped_ptr@VValue@base@@U?$default_delete@VValue@base@@@std@@@@@Z
?Swap@ListValue@base@@UAEXPAV12@@Z
?GetSize@ListValue@base@@QBEIXZ
??0FilePath@base@@QAE@V?$BasicStringPiece@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@1@@Z
?BaseName@FilePath@base@@QBE?AV12@XZ
??0Lock@base@@QAE@XZ
??1Lock@base@@QAE@XZ
?Set@CancellationFlag@base@@QAEXXZ
?IsSet@CancellationFlag@base@@QBE_NXZ
?Acquire@Lock@base@@QAEXXZ
?Release@Lock@base@@QAEXXZ
?StopTracking@VerifierTraits@win@base@@SAXPAXPBX11@Z
?CloseHandle@HandleTraits@win@base@@SA_NPAX@Z
?StartTracking@VerifierTraits@win@base@@SAXPAXPBX11@Z
??1CancellationFlag@base@@QAE@XZ
?PostTask@WorkerPool@base@@SA_NABVLocation@tracked_objects@@ABV?$Callback@$$A6AXXZ@2@_N@Z
?Now@TimeTicks@base@@SA?AV12@XZ
?PathExists@base@@YA_NABVFilePath@1@@Z
?CreateDirectoryW@base@@YA_NABVFilePath@1@@Z
??0MessageLoopForUI@base@@QAE@XZ
?BaseInitLoggingImpl_built_with_NDEBUG@logging@@YA_NABULoggingSettings@1@@Z
??0LoggingSettings@logging@@QAE@XZ
?Run@MessageLoop@base@@QAEXXZ
?QuitWhenIdleClosure@MessageLoop@base@@SA?AV?$Callback@$$A6AXXZ@2@XZ
?FromMinutes@TimeDelta@base@@SA?AV12@H@Z
??1MessageLoop@base@@UAE@XZ
??0MessageLoop@base@@QAE@W4Type@01@@Z
?GetSwitchValueNative@CommandLine@base@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@Z
?HasSwitch@CommandLine@base@@QBE_NQBD@Z
?ForCurrentProcess@CommandLine@base@@SAPAV12@XZ
?Init@CommandLine@base@@SA_NHPBQBD@Z
?CleanUp@Thread@base@@MAEXXZ
?Run@Thread@base@@MAEXPAVMessageLoop@2@@Z
?Init@Thread@base@@MAEXXZ
?ThreadMain@Thread@base@@EAEXXZ
?Initialize@File@base@@QAEXABVFilePath@2@I@Z
?DirName@FilePath@base@@QBE?AV12@XZ
?Flush@File@base@@QAE_NXZ
?Close@File@base@@QAEXXZ
?Write@File@base@@QAEH_JPBDH@Z
?IsValid@File@base@@QBE_NXZ
?GetFunctionPointer@ScopedNativeLibrary@base@@QBEPAXPBD@Z
?Reset@ScopedNativeLibrary@base@@QAEXPAUHINSTANCE__@@@Z
??0FilePath@base@@QAE@XZ
??1ScopedNativeLibrary@base@@QAE@XZ
??0ScopedNativeLibrary@base@@QAE@PAUHINSTANCE__@@@Z
??1File@base@@QAE@XZ
??0File@base@@QAE@XZ
?Start@Thread@base@@QAE_NXZ
?UTF8ToWide@base@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@1@@Z
?GetDictionary@ListValue@base@@QBE_NIPAPBVDictionaryValue@2@@Z
?GetDictionary@DictionaryValue@base@@QBE_NV?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@PAPBV12@@Z
?HexStringToInt@base@@YA_NABV?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@1@PAH@Z
?MD5String@base@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@1@@Z
?SetString@DictionaryValue@base@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?GenerateGUID@base@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?YieldCurrentThread@PlatformThread@base@@SAXXZ
?empty@FilePath@base@@QBE_NXZ
?ReferencesParent@FilePath@base@@QBE_NXZ
?MakeAbsoluteFilePath@base@@YA?AVFilePath@1@ABV21@@Z
?GetCurrentDirectoryW@base@@YA_NPAVFilePath@1@@Z
??0LockImpl@internal@base@@QAE@XZ
?Lock@LockImpl@internal@base@@QAEXXZ
?Unlock@LockImpl@internal@base@@QAEXXZ
??0CallbackBase@internal@base@@QAE@ABV012@@Z
??1LockImpl@internal@base@@QAE@XZ
?GetTempDir@base@@YA_NPAVFilePath@1@@Z
?GetHomeDir@base@@YA?AVFilePath@1@XZ
?Create@Environment@base@@SAPAV12@XZ
?AppendASCII@FilePath@base@@QBE?AV12@V?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@Z
?GetInstance@OSInfo@win@base@@SAPAV123@XZ
?GetVersion@win@base@@YA?AW4Version@12@XZ
?LoadNativeLibrary@base@@YAPAUHINSTANCE__@@ABVFilePath@1@PAUNativeLibraryLoadError@1@@Z
?AddRef@RefCountedThreadSafeBase@subtle@base@@IBEXXZ
?Release@RefCountedThreadSafeBase@subtle@base@@IBE_NXZ
??0LogMessage@logging@@QAE@PBDHPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0Pickle@base@@QAE@H@Z
??0Pickle@base@@QAE@PBDH@Z
??0Pickle@base@@QAE@ABV01@@Z
??1Pickle@base@@UAE@XZ
?PeekNext@Pickle@base@@KA_NIPBD0PAI@Z
?GetInstance@TraceLog@trace_event@base@@SAPAV123@XZ
?ShouldCreateLogMessage@logging@@YA_NH@Z
?WriteUInt32@Pickle@base@@QAE_NI@Z
??0LogMessage@logging@@QAE@PBDH0@Z
?GetLastSystemErrorCode@logging@@YAKXZ
??0Win32ErrorLogMessage@logging@@QAE@PBDHHK@Z
??1Win32ErrorLogMessage@logging@@QAE@XZ
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PB_W@Z
?CurrentId@PlatformThread@base@@SAKXZ
?current@MessageLoopForIO@base@@SAPAV12@XZ
?RegisterIOHandler@MessageLoopForIO@base@@QAEXPAXPAVIOHandler@MessagePumpForIO@2@@Z
?WaitForIOCompletion@MessageLoopForIO@base@@QAE_NKPAVIOHandler@MessagePumpForIO@2@@Z
?GetCategoryGroupEnabled@TraceLog@trace_event@base@@SAPBEPBD@Z
?AddTraceEventWithThreadIdAndTimestamp@TraceLog@trace_event@base@@QAE?AUTraceEventHandle@23@DPBEPBD_K2HABVTimeTicks@3@HPAPBD0PB_KPBV?$scoped_refptr@VConvertableToTraceFormat@trace_event@base@@@@I@Z
??1ScopedTracer@trace_event_internal@@QAE@XZ
?StringToInt@base@@YA_NABV?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@1@PAH@Z
?ASCIIToUTF16@base@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@1@@Z

logging

??0KLogMessage@@QAE@PB_WHH@Z
??1KLogMessage@@QAE@XZ
?GetMinKLogLevel@@YAHXZ

msvcp140

??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?exceptions@ios_base@std@@QAEXH@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?narrow@?$ctype@_W@std@@QBED_WD@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?is@?$ctype@_W@std@@QBE_NF_W@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Xbad_function_call@std@@YAXXZ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?_BADOFF@std@@3_JB
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z

wininet

InternetReadFile
InternetOpenW
InternetCloseHandle
HttpQueryInfoW
InternetOpenUrlA
InternetGetConnectedState

ws2_32

socket
gethostbyname
gethostname
WSAStartup
WSACleanup
htons
inet_ntoa
ntohl
inet_addr
bind
ntohs
ioctlsocket
closesocket
recv
setsockopt

vcruntime140

_except_handler4_common
__vcrt_InitializeCriticalSectionEx
__CxxFrameHandler3
__std_terminate
_purecall
memmove
__std_exception_copy
__std_exception_destroy
wcsstr
__std_type_info_compare
_CxxThrowException
memset
memcpy
memchr
memcmp

api-ms-win-crt-runtime-l1-1-0

terminate
_controlfp_s
_invalid_parameter_noinfo_noreturn
_invalid_parameter_noinfo
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
_errno
_c_exit
_register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s
_set_fmode
fgetc
fputc
ungetc
__p__commode
__acrt_iob_func
__stdio_common_vfwprintf
__stdio_common_vswprintf
fflush
setvbuf
fsetpos
_fseeki64
fgetpos
fwrite
_get_stream_buffer_pointers
fclose
__stdio_common_vswscanf

api-ms-win-crt-string-l1-1-0

wcscat_s
_wcsicmp
tolower
wcslen
_wcsnicmp
wcsncpy_s
_wcslwr_s
iswprint

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
_recalloc
_callnewh
malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 217KB - Virtual size: 216KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 326KB - Virtual size: 326KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

de930fa6fb2cb23063c6c0460b87964c

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

23:e8:9e:2a:aa:0f:65:01:f4:8d:a0:3f:f7:95:e9:89Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

23:e8:9e:2a:aa:0f:65:01:f4:8d:a0:3f:f7:95:e9:89Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

ac:03:7f:09:a9:99:af:ad:1c:ba:fa:af:d0:a9:68:d2:6e:73:1b:1c:dc:f5:04:80:2e:e2:62:05:33:b1:fa:5eSigner

94:73:a4:72:76:37:82:95:7f:79:f7:bb:51:07:2b:8c:a8:10:28:fbSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

psapi

iphlpapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

infra

logging

msvcp140

wininet

ws2_32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 217KB - Virtual size: 216KB

.rdata Size: 59KB - Virtual size: 59KB

.data Size: 2KB - Virtual size: 4KB

.gfids Size: 512B - Virtual size: 112B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 326KB - Virtual size: 326KB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

23:e8:9e:2a:aa:0f:65:01:f4:8d:a0:3f:f7:95:e9:89
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

23:e8:9e:2a:aa:0f:65:01:f4:8d:a0:3f:f7:95:e9:89
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

ac:03:7f:09:a9:99:af:ad:1c:ba:fa:af:d0:a9:68:d2:6e:73:1b:1c:dc:f5:04:80:2e:e2:62:05:33:b1:fa:5e
Signer

94:73:a4:72:76:37:82:95:7f:79:f7:bb:51:07:2b:8c:a8:10:28:fb
Signer

.text
Size: 217KB - Virtual size: 216KB

.rdata
Size: 59KB - Virtual size: 59KB

.data
Size: 2KB - Virtual size: 4KB

.gfids
Size: 512B - Virtual size: 112B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 326KB - Virtual size: 326KB