dynamiclinkmanager[.]exe

Resubmissions

26/05/2024, 17:21

240526-vw35psef78 1

26/05/2024, 16:44

240526-t9a6eadg82 1

Sharing

Copy URL Twitter E-mail

General

Target

dynamiclinkmanager.exe
Size

426KB
MD5

ab1a0d96c7c03baa2d8470eba3f0c919
SHA1

4732c93c988525e171b2ba10202cc31c4a1e3222
SHA256

2f66e76387396b90b53e8bebcf68447b682042d4d7f949ef0b0521603da01e09
SHA512

ea265c7b326c0586c0d52fe02ba51363c20e647b4f097653b210add09eb65fd214390ade2f26e2e365b1c0f7d54baa0801dcce31e5434f5b30caba9d5718c922
SSDEEP

6144:IiNcPU19Ld/DoMAqt5GSrZlcx3EpMX5/J1TmUIzGJ6lC7xrP9n98:InqT/MMARSVCx3EpMPh6zXC72

Score

1^/10

Malware Config

Signatures

Files

dynamiclinkmanager.exe
.exe windows:6 windows x64 arch:x64

f4c57148fec8a7cde48d9f7d85c15415

Code Sign

05:96:37:35:c0:e0:1c:f3:7d:3e:39:31:40:eb:af:4b
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/12/2020, 00:00

Not After

21/12/2022, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Premiere Pro\, AME\, After Effects\, Speedgrade,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4d:7b:70:91:93:25:c4:1f:0a:71:b6:44:b3:5f:9c:c2:b3:16:80:ce:38:3d:a0:b9:3a:60:bc:ed:a4:39:b1:2c
Signer

Actual PE Digest

4d:7b:70:91:93:25:c4:1f:0a:71:b6:44:b3:5f:9c:c2:b3:16:80:ce:38:3d:a0:b9:3a:60:bc:ed:a4:39:b1:2c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\releases\dva\shared\adobe\dynamiclink\dynamiclinkmanager\lib\win\release\64\dynamiclinkmanager.pdb

Imports

dvacore

??1Localizer@config@dvacore@@UEAA@XZ
?Set@Localizer@config@dvacore@@SAXPEAV123@AEBVDir@filesupport@3@@Z
?Terminate@ConsoleLogFile@console@dvacore@@SAXXZ
?Instance@DebugDatabase@debug@dvacore@@SAAEAV123@XZ
?SetFileWritesDisabled@DebugDatabase@debug@dvacore@@QEAAX_N@Z
?RunPlatformEventLoop@threads@dvacore@@YAXXZ
?Initialize@config@dvacore@@YA_NPEBD@Z
??0Localizer@config@dvacore@@QEAA@XZ
?LimitedDLLHijackFix@config@dvacore@@YAXXZ
?DecrementLazilyDisplayErrors@ErrorManager@config@dvacore@@UEAAXXZ
?IsBetaPrime@config@dvacore@@YA_NXZ
?ExecuteFunctionAndConvertException@ErrorManager@config@dvacore@@UEAAHV?$function0@H@boost@@@Z
?ExecuteFunctionWithTopLevelExceptionHandler@ErrorManager@config@dvacore@@UEAAHV?$function0@H@boost@@@Z
?IncrementLazilyDisplayErrors@ErrorManager@config@dvacore@@UEAAXXZ
?NotifyProcessBegin@ProcessBeginEndNotificationRegistry@config@dvacore@@QEAAXAEBV?$array@VParameter@detail@config@dvacore@@$09@std@@@Z
?NewDeferredErrorReporter@ErrorManager@config@dvacore@@UEAA?AV?$intrusive_ptr@VDeferredErrorReporter@config@dvacore@@@boost@@_N@Z
?kAppShortName@config@dvacore@@3PEBDEB
?Terminate@config@dvacore@@YAXPEBD@Z
?GetInstance@ProcessBeginEndNotificationRegistry@config@dvacore@@SAAEAV123@XZ
?SetState@appstatemanager@dvacore@@YAXW4AppState@12@@Z
?IsInitializedAndEventLoopRunning@appstatemanager@dvacore@@YA_NXZ
?Set@ErrorManager@config@dvacore@@SAXPEAV123@@Z
??1ErrorManager@config@dvacore@@UEAA@XZ
??0ErrorManager@config@dvacore@@QEAA@XZ
?kAppMajorVersion@config@dvacore@@3PEBDEB
?SetAppIsHeadless@config@dvacore@@YAX_N@Z
?SetCompanyName@config@dvacore@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@@Z
?SetClientBuildNumber@config@dvacore@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@@Z
?SetClientInternalVersion@config@dvacore@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@@Z
?SetClientVersion@config@dvacore@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@@Z
?SetApplicationName@config@dvacore@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@@Z
?SetClientName@config@dvacore@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@@Z
?RegisterCurrentThreadAsMainThread@threads@dvacore@@YA?AV?$shared_ptr@VAsyncEventLoopAdaptor@threads@dvacore@@@boost@@XZ
?SetDisableFileWrites@debug@dvacore@@YAX_N@Z
?StdToUTF16String@string@dvacore@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@PEBD@Z
?TotalPhysicalMemory@utility@dvacore@@YA_KXZ
?SavePropList@utils@proplist@dvacore@@YAXAEAVFile@filesupport@3@AEBVPropList@23@@Z
?LoadPropList@utils@proplist@dvacore@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@AEAVPropList@23@_N@Z
?SetValue@PropList@proplist@dvacore@@UEAAXAEBV?$basic_string@EU?$char_traits@E@std@@U?$STLAllocator@E@allocator@dvacore@@@std@@AEBV?$list@_KV?$allocator@_K@std@@@5@@Z
?GetValue@PropList@proplist@dvacore@@UEBA_NAEBV?$basic_string@EU?$char_traits@E@std@@U?$STLAllocator@E@allocator@dvacore@@@std@@AEAV?$list@_KV?$allocator@_K@std@@@5@@Z
?SetValue@PropList@proplist@dvacore@@UEAAXAEBV?$basic_string@EU?$char_traits@E@std@@U?$STLAllocator@E@allocator@dvacore@@@std@@AEB_K@Z
?GetValue@PropList@proplist@dvacore@@UEBA_NAEBV?$basic_string@EU?$char_traits@E@std@@U?$STLAllocator@E@allocator@dvacore@@@std@@AEA_K@Z
??1PropList@proplist@dvacore@@UEAA@XZ
??0PropList@proplist@dvacore@@QEAA@XZ
?GetCurrentTimeStamp@HighPrecisionTime@utility@dvacore@@SA_KXZ
?ConvertToNanos@HighPrecisionTime@utility@dvacore@@SA_J_K@Z
?PrefDir@Dir@filesupport@dvacore@@SA?AV123@XZ
?Create@Dir@filesupport@dvacore@@QEAAXXZ
?kAppMinorVersion@config@dvacore@@3PEBDEB
?kAppIsHeadless@config@dvacore@@3PEBDEB
?kSuiteBrandingMinorVersion@config@dvacore@@3PEBDEB
?GetDefaultParserFactory@xml@dvacore@@YA?AV?$deprecated_auto_ptr@VDocParserFactory@xml@dvacore@@@utility@2@XZ
?SetParserFactory@xml@dvacore@@YAXAEAV?$deprecated_auto_ptr@VDocParserFactory@xml@dvacore@@@utility@2@@Z
?MainExecutableFile@commondirs@filesupport@dvacore@@YA?AVFile@23@XZ
?LaunchProcess@utility@dvacore@@YA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@AEBV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@U?$STLAllocator@V?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@@allocator@dvacore@@@4@_NW4LaunchPreference@12@@Z
?GetAddress@MemoryMappedFile@dvacore@@QEAAPEAXXZ
?EncodeBinaryDataToUTF8String@utility@dvacore@@YA_NPEBE_KAEAV?$basic_string@EU?$char_traits@E@std@@U?$STLAllocator@E@allocator@dvacore@@@std@@@Z
?GetCurrentProcessID@threads@dvacore@@YAIXZ
?GetClientVersion@config@dvacore@@YAAEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@XZ
?GetClientName@config@dvacore@@YAAEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@XZ
??6utility@dvacore@@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@AEAV23@AEBVGuid@01@@Z
?AsUTF8String@Guid@utility@dvacore@@QEBA?AV?$basic_string@EU?$char_traits@E@std@@U?$STLAllocator@E@allocator@dvacore@@@std@@XZ
?AsString@Guid@utility@dvacore@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@XZ
??0Guid@utility@dvacore@@QEAA@PEBD_K@Z
??0Guid@utility@dvacore@@QEAA@XZ
?CreateUnique@Guid@utility@dvacore@@SA?AV123@XZ
?BuildCall@serialization@dvacore@@YA?AV?$shared_ptr@Vany@boost@@@boost@@PEBDAEBVany@4@@Z
?GetVariantInObject@serialization@dvacore@@YA?AV?$shared_ptr@Vany@boost@@@boost@@AEBV?$map@V?$basic_string@EU?$char_traits@E@std@@U?$STLAllocator@E@allocator@dvacore@@@std@@V?$shared_ptr@Vany@boost@@@boost@@U?$less@X@2@U?$STLAllocator@U?$pair@$$CBV?$basic_string@EU?$char_traits@E@std@@U?$STLAllocator@E@allocator@dvacore@@@std@@V?$shared_ptr@Vany@boost@@@boost@@@std@@@allocator@dvacore@@@std@@PEBD@Z
?GetJSONString@serialization@dvacore@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@AEBVany@boost@@_N@Z
?AddToObject@serialization@dvacore@@YAXAEAVany@boost@@AEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@V34@_N@Z
?AddToObject@serialization@dvacore@@YAXAEAVany@boost@@PEBDV34@_N@Z
?AppendToArray@serialization@dvacore@@YAXAEAVany@boost@@V34@@Z
?AsyncExecuteTaskOnAllThreads@threads@dvacore@@YA?AV?$shared_ptr@VIMultithreadedTask@threads@dvacore@@@boost@@AEBV?$function@$$A6AXH@Z@4@HAEBV?$shared_ptr@VAsyncExecutor@threads@dvacore@@@4@@Z
?GetCPUBoundExecutor@threads@dvacore@@YA?AV?$shared_ptr@VAsyncExecutor@threads@dvacore@@@boost@@XZ
?Delete@File@filesupport@dvacore@@QEAAXXZ
?Exists@File@filesupport@dvacore@@QEBA_NXZ
?FullPath@File@filesupport@dvacore@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@XZ
??4File@filesupport@dvacore@@QEAAAEAV012@AEBV012@@Z
??1File@filesupport@dvacore@@QEAA@XZ
??0File@filesupport@dvacore@@QEAA@AEBV012@@Z
??0File@filesupport@dvacore@@QEAA@AEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@W4StorageType@12@@Z
??0File@filesupport@dvacore@@QEAA@AEBVDir@12@AEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@@Z
??0File@filesupport@dvacore@@QEAA@XZ
?TempDir@Dir@filesupport@dvacore@@SA?AV123@XZ
?Exists@Dir@filesupport@dvacore@@QEBA_NXZ
?FullPath@Dir@filesupport@dvacore@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@XZ
??4Dir@filesupport@dvacore@@QEAAAEAV012@AEBV012@@Z
??1Dir@filesupport@dvacore@@QEAA@XZ
??0Dir@filesupport@dvacore@@QEAA@XZ
?TraceChangeCount@debug@dvacore@@YAHXZ
?Trace@debug@dvacore@@YAXHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?TraceEnabled@debug@dvacore@@YA_NPEBEH_N@Z
?kSuiteBrandingVersion@config@dvacore@@3PEBDEB
?kSuiteVersion@config@dvacore@@3PEBDEB
?kAppBuildNumber@config@dvacore@@3PEBDEB
?AsciiToUTF16@string@dvacore@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@PEBD_K@Z
?UTF16to8@string@dvacore@@YA?AV?$basic_string@EU?$char_traits@E@std@@U?$STLAllocator@E@allocator@dvacore@@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@4@@Z
?UTF8to16@string@dvacore@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@AEBV?$basic_string@EU?$char_traits@E@std@@U?$STLAllocator@E@allocator@dvacore@@@4@PEAW4UnicodeErrorCode@12@PEA_K@Z
??_DoUTF16StringStream@dvacore@@QEAAXXZ
??0oUTF16StringStream@dvacore@@QEAA@XZ
?SubstituteErrorMessage@config@dvacore@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@PEBDAEBVReplacementValue@12@111@Z
?str@?$basic_ostringstream@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@2@XZ
?Recycle@MemoryRecycler@allocator@dvacore@@YAXPEAX_K@Z
?Allocate@MemoryRecycler@allocator@dvacore@@YAPEAX_KAEA_K@Z
?kErrorMappedFileException@MemoryMappedFile@dvacore@@2HA
?GetName@MemoryMappedFile@dvacore@@QEBAXAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Size@MemoryMappedFile@dvacore@@QEBA_KXZ
?CloseFileHandleIfPossible@MemoryMappedFile@dvacore@@QEAAXXZ
?Init@MemoryMappedFile@dvacore@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_KI@Z
??1MemoryMappedFile@dvacore@@QEAA@XZ
??0MemoryMappedFile@dvacore@@QEAA@XZ
?kAppPatchVersion@config@dvacore@@3PEBDEB

dvamarshal

?SendSimpleOK@Responder@dvamarshal@@QEAAXXZ
??1Responder@dvamarshal@@QEAA@XZ
?SendGeneralResult@Responder@dvamarshal@@QEAAXV?$shared_ptr@Vany@boost@@@boost@@@Z
?GetSession@Responder@dvamarshal@@QEAA?AV?$shared_ptr@VSession@dvatransport@@@boost@@XZ
?GetSessionID@Responder@dvamarshal@@QEAA_KXZ
?DidSendResponse@Responder@dvamarshal@@QEBA_NXZ
??0Responder@dvamarshal@@QEAA@AEBV01@@Z
?SendPushNotification@Pusher@dvamarshal@@QEAA_NV?$shared_ptr@Vany@boost@@@boost@@@Z
?Instance@MessageRegistrar@dvamarshal@@SAPEAV12@XZ
?Register@MessageRegistrar@dvamarshal@@QEAAXPEBDV?$shared_ptr@VMessageHandlerBase@dvamarshal@@@boost@@@Z
?UnRegister@MessageRegistrar@dvamarshal@@QEAAXPEBD@Z
??0RPCServer@dvamarshal@@QEAA@AEBV?$shared_ptr@VServer@dvatransport@@@boost@@AEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@@Z
??1RPCServer@dvamarshal@@QEAA@XZ
?GetPusher@RPCServer@dvamarshal@@QEAA?AV?$shared_ptr@VPusher@dvamarshal@@@boost@@AEBV?$shared_ptr@VSession@dvatransport@@@4@@Z
??0RPCClient@dvamarshal@@QEAA@AEBV?$shared_ptr@VSession@dvatransport@@@boost@@AEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@@Z
??1RPCClient@dvamarshal@@QEAA@XZ
?SendNotification@RPCClient@dvamarshal@@QEAAXV?$shared_ptr@Vany@boost@@@boost@@@Z
?SendError@Responder@dvamarshal@@QEAAXHAEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@@Z

dvatransport

?ServerStart@SocketTransport@dvatransport@@QEAA?AV?$shared_ptr@VServer@SocketTransport@dvatransport@@@boost@@G_N@Z
?GetPort@Server@SocketTransport@dvatransport@@QEAAGXZ
?ClientStart@SocketTransport@dvatransport@@QEAA?AV?$shared_ptr@VSession@dvatransport@@@boost@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@G@Z

dynamiclink

?GetKeyFileName@dynamiclink@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetDynamicLinkManagerPortFileName@dynamiclink@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBI@Z
?GetDynamicLinkProtocolVersion@dynamiclink@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@XZ
??4?$GenericAssetInfoT@UAnywhereAssetInfo@dynamiclink@@@dynamiclink@@QEAAAEAU01@AEBU01@@Z
??1?$GenericAssetInfoT@UAnywhereAssetInfo@dynamiclink@@@dynamiclink@@QEAA@XZ
??8?$GenericAssetInfoT@UAnywhereAssetInfo@dynamiclink@@@dynamiclink@@QEBA_NAEBU01@@Z
?GetSharedTransport@dynamiclink@@YA?AV?$shared_ptr@VSocketTransport@dvatransport@@@boost@@XZ
??0?$GenericAssetInfoT@UAnywhereAssetInfo@dynamiclink@@@dynamiclink@@QEAA@AEBUAnywhereAssetInfo@1@@Z
?GetPathToAEServer@platformutils@dynamiclink@@YA?AVDir@filesupport@dvacore@@XZ
?kCharacterAnimatorDirectHeadedConnect@dynamiclink@@3QEBDEB
??0?$GenericAssetInfoT@UAnywhereAssetInfo@dynamiclink@@@dynamiclink@@QEAA@XZ
??4AnywhereAssetInfo@dynamiclink@@QEAAAEAU01@$$QEAU01@@Z
??0AnywhereAssetInfo@dynamiclink@@QEAA@AEBU01@@Z
??1AnywhereAssetInfo@dynamiclink@@QEAA@XZ
??0AnywhereAssetInfo@dynamiclink@@QEAA@XZ
?kBetaSuffixString@platformutils@dynamiclink@@3V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@B
?GetDynamicLinkVersionInfo@dynamiclink@@YA?AV?$tuple@HHH@std@@XZ
?GetResolvedPathComponent@platformutils@dynamiclink@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@AEBV34@@Z
?GetAEHeadlessServerPath@platformutils@dynamiclink@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@XZ
?GetPathToPProServer@platformutils@dynamiclink@@YA?AVDir@filesupport@dvacore@@XZ
??0?$GenericAssetInfoT@UAnywhereAssetInfo@dynamiclink@@@dynamiclink@@QEAA@AEBVFile@filesupport@dvacore@@@Z
?GetPathToCharacterAnimatorServer@platformutils@dynamiclink@@YA?AVDir@filesupport@dvacore@@XZ
?kPProHeadedServerPath@platformutils@dynamiclink@@3QEBDEB
?kAEHeadedServerPath@platformutils@dynamiclink@@3QEBDEB
?kPProHeadlessServerPath@platformutils@dynamiclink@@3QEBDEB
?kCharacterAnimatorHeadedServerPath@platformutils@dynamiclink@@3QEBDEB
?kCharacterAnimatorHeadlessServerPath@platformutils@dynamiclink@@3QEBDEB
?kPProServerSourceTypeProjectExtension@PProServer@dynamiclink@@2V?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@B
?kCharacterAnimatorDLMConnectWithVersion@dynamiclink@@3QEBDEB
?kCharacterAnimatorDLMConnect@dynamiclink@@3QEBDEB
?kCharacterAnimatorDirectConnect@dynamiclink@@3QEBDEB
?kCharacterAnimatorServerName@CharacterAnimatorServer@dynamiclink@@2V?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@B
?kCharacterAnimatorSourceTypeProjectExtension@CharacterAnimatorServer@dynamiclink@@2V?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@B
?kCharacterAnimatorSourceTypeProject@CharacterAnimatorServer@dynamiclink@@2V?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@B
?GetSAPCodeFromEnum@platformutils@dynamiclink@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4SAPCodeEnum@12@@Z
?GetInstalledAppFile@platformutils@dynamiclink@@YA?AVFile@filesupport@dvacore@@W4SAPCodeEnum@12@@Z
?IsProjectFileBased@?$GenericAssetInfoT@UAnywhereAssetInfo@dynamiclink@@@dynamiclink@@QEBA_NXZ
??0?$GenericAssetInfoT@UAnywhereAssetInfo@dynamiclink@@@dynamiclink@@QEAA@AEBU01@@Z

dvaappsupport

?RegisterUserID@feature@dvaappsupport@@YAXAEBV?$basic_string@EU?$char_traits@E@std@@U?$STLAllocator@E@allocator@dvacore@@@std@@@Z

kernel32

GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetProcAddress
GetModuleHandleW
CreateEventW
ResetEvent
InitializeCriticalSectionAndSpinCount
InitializeSListHead
CreateFileW
LockFile
UnlockFile
QueryPerformanceCounter
SetEvent
WaitForSingleObjectEx
CreateEventA
GetCurrentThreadId
LocalFree
FormatMessageA
FormatMessageW
WideCharToMultiByte
GetLastError
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TlsAlloc
TlsFree
GetSystemInfo
GetCurrentProcessId
CloseHandle
OutputDebugStringW
GetSystemTimeAsFileTime

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

ole32

CoInitialize
CoUninitialize

msvcp140

?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?uncaught_exception@std@@YA_NXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Xlength_error@std@@YAXPEBD@Z
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_J@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?_Xout_of_range@std@@YAXPEBD@Z

ws2_32

WSAStartup
WSACleanup

vcruntime140

__std_terminate
__std_exception_copy
__std_exception_destroy
_CxxThrowException
_purecall
__current_exception_context
memmove
memset
__std_type_info_compare
__std_type_info_name
memcmp
memchr
__C_specific_handler
__current_exception
memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
strerror
_seh_filter_exe
_set_app_type
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
_c_exit
_initterm_e
_exit
exit
terminate

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
__p__commode
_set_fmode

api-ms-win-crt-string-l1-1-0

strncpy

api-ms-win-crt-heap-l1-1-0

_callnewh
_set_new_mode
free
malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 284KB - Virtual size: 283KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

f4c57148fec8a7cde48d9f7d85c15415

Code Sign

05:96:37:35:c0:e0:1c:f3:7d:3e:39:31:40:eb:af:4bCertificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

4d:7b:70:91:93:25:c4:1f:0a:71:b6:44:b3:5f:9c:c2:b3:16:80:ce:38:3d:a0:b9:3a:60:bc:ed:a4:39:b1:2cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

dvacore

dvamarshal

dvatransport

dynamiclink

dvaappsupport

kernel32

advapi32

ole32

msvcp140

ws2_32

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 284KB - Virtual size: 283KB

.rdata Size: 91KB - Virtual size: 91KB

.data Size: 28KB - Virtual size: 30KB

.pdata Size: 13KB - Virtual size: 12KB

.rsrc Size: 1KB - Virtual size: 1KB

05:96:37:35:c0:e0:1c:f3:7d:3e:39:31:40:eb:af:4b
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

4d:7b:70:91:93:25:c4:1f:0a:71:b6:44:b3:5f:9c:c2:b3:16:80:ce:38:3d:a0:b9:3a:60:bc:ed:a4:39:b1:2c
Signer

.text
Size: 284KB - Virtual size: 283KB

.rdata
Size: 91KB - Virtual size: 91KB

.data
Size: 28KB - Virtual size: 30KB

.pdata
Size: 13KB - Virtual size: 12KB

.rsrc
Size: 1KB - Virtual size: 1KB